Runs TWO full avatar flows concurrently for the same slot. Expected: both confirms return ready, exactly one URL survives (newest-wins), the loser's row is finalized superseded → rejected, and a later replay of the loser's confirm returns rejected · superseded by ….
Notes: gateway CORS allows all origins in development. If the S3 POST step fails with a CORS error, that's the input bucket's CORS configuration (it must allow POST from your origin), not this client. Rate limit: 10 image requests/min/user.