Deciding at authorize instead of at registration is the right split. Some numbers on how much this matters right now: on Nov 4 we checked 61 official MCP servers that require login, and 36 of them do not advertise CIMD support yet, so most self-registering clients still go through DCR, which is exactly where your per-user list sits. One item I would add to the checklist is the iss parameter in the authorization response. 40 of the same 61 do not return it, and without it a client connected to several authorization servers has no reliable way to tell which one sent a code.