The liveness check in the worker loop read a null NetState as a dead one:
if (job.State?.Running != true) { continue; }
A password change carries no connection, so State is null, null != true, and
every off-loop SetPassword was silently dropped -- the hash never ran, the
account was never written, and the callback that confirms it to the player
never fired. Apply() had the null case right; the dequeue check did not.
Nothing caught it because the tests all drove ComputeInline, which bypasses
the queue entirely. Adds one that goes through TryEnqueue and pumps the loop
context, which fails against the old check.
Also drops the unused Pending property and narrows MaxPending to private.
80d19c882d