[TheGreatAxios]

The bug

Every attempt for a provider contends for the one registered redirect_uri, and the authorize page already open in the browser is bound to the state and PKCE verifier of the attempt that opened it. A second start therefore has two ways to fail, and both are reachable from an ordinary retry:

• mountOAuthLogin starts a fresh login without ending the old one, so the callback server cannot bind the fixed port and the retry answers 409.
• A caller that does end the old one first (as Solutions Builder's own hub mount did) mints a new state, and the page the operator is signing in on redirects into a listener that no longer recognises it — refused as state mismatch, with the sign-in lost. That is how this was found:

http://localhost:1455/auth/callback?code=…&state=B0IhJsI75VfLzlQyWFBiwCWkWZExfNUzfWwbk7qGa60

A well-formed state from generateState(), just not the one the listener then expected.

The change

createLoginRegistry (root export, no hono/@intx/*): one live login per key.

• startOrResume(key, begin, { tag }) returns the handle already in flight, or starts one. resumed says which.
• A login is resumed only for the tag that started it — one principal's authorization is not another's to continue. A different tag falls through to begin and contends for the port exactly as today.
• An entry is released when its login settles, so the next attempt after a completed, failed or cancelled one starts clean. Observing completed there also stops a rejection landing unhandled when a caller only reads authorizeUrl.
• cancel(key) ends the login in flight and frees the port.

mountOAuthLogin uses it: a start that collides with the same principal's pending login now answers 200 with that login's id and authorize URL instead of 409.

Also: a refused redirect is reported as a code — state_mismatch, provider_error (carrying the server's own error), no_code — instead of prose. What a person should be told differs by product and brand; what the redirect was does not. OAuthCallbackError carries the code too.

Breaking

CallbackServerConfig.failedHtml now takes CallbackFailure rather than a string. Both known consumers are ours; Solutions Builder's pin bump lands with the matching change.

Verification

bun run check — typecheck, lint, format, 58 tests pass (4 new for the registry: resume, tag isolation, release on settle, cancel). Not yet driven through a live ChatGPT sign-in; that happens on the Solutions Builder pin bump.

Hardening from security review

• A mismatched redirect no longer ends the login. The listener is on a fixed port anything on the machine can reach; ending the wait on a bad state let any stray or crafted request (a stale tab, a page firing a link at localhost) cancel a legitimate sign-in. It is still refused with 400 and its code never trusted — the login just keeps waiting for its own.
• mountOAuthLogin cleans up by login, not by provider. A settled login leaves the registry while its credential is still being stored; a newer login for the same provider (possibly another principal's) could then be cancelled by the TTL sweep reaching the older entry, or lose its id so a retry could not resume. Cancel now targets the login's own handle; the id is released only if it is still that login's.

59 pass. The mismatch change is covered by a test (a crafted redirect is refused, then the genuine one completes). The mount race has no test: mountOAuthLogin has no harness, since it needs a DB and tenant context. The fix comes from reading the code.

[linear-code]

CL-8857