Repeated /mcp reauth commands could remain blocked by a prior unfinished login because each command receives a fresh controller. Coordinate flows through session-shared state so a replacement cancels and cleans up the old flow before proceeding.