Two tabs with the cookie already set never POST /api/session, so name-online on login did not cover the design rule. Claim the name under the same lock as the online check. Co-authored-by: Cursor <cursoragent@cursor.com>
run-aspire.cmd
run-aspire.ps1
run-aspire.sh