InternalForgets the escalation after a successful login: it has served its purpose, and the argument-less escalation edge must have nothing stale to reopen.
InternalStores what the login answer issued for the last-resort-recovery entrypoint call. The escalation edge takes no argument: the code-entry screen reads this client state, which a checkpoint carries across a process restart.
InternalInternalInternalInternalInternal
The process's recovery tickets: the issued values behind the screens' opaque tickets — server state of the screen, kept for the whole process, so a repeated action (another identifier, another code, another "Forgot password") resolves the same issued values again — plus the handoff the login answer leaves for the last-resort-recovery code-entry screen. One value per runtime layer (installed by the Android app layer, like the screen stack), so a ticket issued by one runtime is not resolved by another, and the registry goes with its process — except the client state a restore hands to the new layer (
RestoredAccountRecoveryTickets), which is what lets a trail from the code-entry screen retrace without replaying the password login. It is process state and belongs in a checkpoint (round-trip lands with the checkpoint unit).The last-resort entrypoint handoff is the same pattern as the two-factor one: the login action's issued values wait for the screen's
enter, never an edge argument, so a trail step carries nothing and a retrace in a fresh process is given the handoff as a precondition (#314 carries it across processes). The methods are the library's own seam (the screens and their tests use them); a published declaration carries the empty shape, not the methods.