fn pending_registry() -> &'static Mutex<BTreeMap<String, Pending>>
Keeps one-use consent state out of persistence, exports and logs; restart safely invalidates it.