Authorize-page polling: pending|approved (+redirect_url once approved). The redirect_url only ever targets the client's REGISTERED redirect_uri.

lmcp-api#272: the page that opened /oauth/authorize holds a poll secret (poll; only its sha256 is on the nonce row, and the deep link never carries it). With LMCP_OAUTH_POLL_BINDING=1 the code goes only to that secret: any other poll reads pending (no oracle), so whoever holds just the nonce cannot collect the code. Off until the 3.0.421 Mac auto-connect sends it; meanwhile an unbound collection is counted (oauth_approve_status_unbound, no address). A nonce minted before this change has no hash.

A collected row is kept as 'collected' until it expires (no longer deleted), so the tray's retry of /oauth/tray-approve still answers ok. The same page may read the same redirect again only when ITS secret made the first collection (collected_bound, review B3); any other reader of a collected row gets expired, as before.