Auth state set before validation finished
The client marked the user authenticated before the server confirmed the session, producing a flash of logged-in state that flipped back on an unverified email.
It could not have worked
A race, an ordering, one column holding two things. The shape ruled it out before the code ran.
Around the shadcn migration, the frontend was marking users authenticated before the server confirmed anything, so you'd get a flash of "logged in" that could flip back on an unconfirmed email. The slow validation endpoint widened the window.
I don't have the exact root cause anymore; best guess is an optimistic state update running ahead of confirmation. Fixed with the shadcn rewrite. Auth state only gets set after full server confirmation now, however much snappier the optimistic version feels.