All issuances serialise through a single mutex in tailscaled. The old 300s timeout fired while a predecessor was legitimately mid-ACME, causing the queued loop to advance retryCount on a non-failure. 30m covers ~15 queued flows and works as a wedge detector against true hangs. Updates #20288 Updates #42164 Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk>