Constant MAX_PENDING 

const MAX_PENDING: usize = 64;

How many sign-ins may be in flight at once.

OperatorAuth::start is reachable without a credential — it has to be, since signing in is how a caller gets one — and every call it accepts holds an entry until it is used or ages out. One operator needs one at a time; this is high enough never to be reached by a person and low enough that a flood cannot grow this map without bound. Past it, the oldest entry is dropped rather than the newest refused, so an attacker filling it cannot lock the operator out.