v6.21.0

Auto-released from merge of PR #1808 (trigger: push).

• An admin API login started on one replica now completes on another. The PKCE verifier and state of a pending /admin/login/start (Claude) or /admin/codex/login/start login lived in one process, so behind a load balancer a /complete that landed on a different replica got 410 no pending login (#1733). With --pool-shared-accounts the pending login is also kept on the refresh-lock service, stored as the account records are, for its 10 minutes and single-use across the fleet; it is removed when it completes or is replaced, a lapsed one is never served, and the cap of 64 pending logins per engine holds fleet-wide. Two replicas starting a login with no alias at once get different generated aliases, and a completion that races a restart of the same alias cannot delete or spend the restart. The Worker deletes a lapsed login at its lapse; Redis deletes it on the next start or when the hash expires at the newest lapse of any login in it, at most an hour past its own. If the service does not answer at start, the login stays on that instance alone and is logged without the secret. Without the switch no service call is made. Rebuild the Redis image or redeploy the Worker so the service serves the new /logins/* endpoints; an older one is logged and the logins stay per instance.
• A Codex login no longer overwrites a seat on the instance that completes it. That instance now answers 409 if it already holds a seat under the alias, without consuming the login, so an instance without the seat can still complete it. This applies with or without --pool-shared-accounts. The two 410 messages for a missing login now read (unknown or expired): start a new login.

---

Built + tested + npm-published inline by cc-drift-auto-release.yml on this run — tokenless via OIDC trusted publishing, provenance-attested. See the workflow log for the publish output.