SAS verification sometimes handles old requests

[turt2live]

Old requests come through SAS:

• when firing up an old matrix client, all your interactive verification requests arrive again #9197
• Logging in on a new device can replay stale Incoming Verification Requests which then get stuck. #8629

[turt2live]

I didn't post this earlier, apparently:

It looks like the timeouts are indeed not handled, assuming this is correct:

There's also several TODO comments in the area which may be of relevance. I suspect this project will turn into not just fixing the reported bugs, but also hardening the code paths.

[turt2live]

Having finally dug through the code and problems in a bit more detail, I don't think that any of the above issues are actually timeout related. There is a problem with timeouts, so I've opened #10117 to track that.

It looks like the 5 issues referenced here are actually bad handling of the state machine (starting in the middle, and getting stuck). Will try to reproduce them one by one.

Edit: I have absolutely hijacked this issue for refocusing the problem.