Two problems with the first cut.
An expired id disconnected. Before any of this existed the game login always
verified the password, so that turned a slow player into a lockout for no
gain. A player can sit on the server list as long as they like; expiry now
falls back to the password verify that was always there. An id for the wrong
account or the wrong address is a different matter -- that client is not ours,
and there is nothing there worth checking a password against.
Ids are only consumed by a game login, so anyone who reaches the server list
and never picks a server abandons theirs. Nothing reclaimed those: the lifetime
was only consulted on lookup. 128 abandoned logins filled the window and the
eviction path then started discarding ids that live clients were still on their
way to redeem. Issuing now reclaims expired entries before evicting a live one.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
e5b7161a71