Scope note: this screen covers phone verification by one-time code only. Email verification keeps the already-approved link-click pattern in auth-experience/04-verify-landing.html (flow verify-email) — it is linked, not re-implemented here as code-entry. See manifest.json "reconciliation" for the full rationale.

Default · enter phone (skippable, re-prompts from profile)
Confirm your phone Skip for now

Add a phone number so we can reach you and offer text-message codes for sign-in.

Sending · code dispatch in flight
Confirm your phone
Enter code · OtpInput (same primitive as step-up)
Confirm your phone Skip for now

Enter the 6-digit code we sent to •••• •• 4471.

Error · wrong or expired code (fail-closed, no navigation)
Confirm your phone

Enter the 6-digit code we sent to •••• •• 4471.

Wrong or expired code.
Error · couldn't send the code (generic send failure, fail-closed)
Confirm your phone

We couldn't send a code to that number. Check it and try again, or skip for now — you can finish this from your security settings later.

Verified · success
Confirm your phone

Phone verified. •••• •• 4471 can now receive text-message codes.

Frame 03 / 04 · Confirm your contact (phone) · /account/security/verify/phone — 375px (Android TWA)

Review · mfa-stepup-mobile approve or reject each flow ↓
mfa-stepup-mobileapproved · izzywdev
confirm-contact-phoneapproved · izzywdev
security-status-mobileapproved · izzywdev