Text a one-time code to the phone the athlete typed, so they can prove they hold it before we ever schedule a message to it.

Unsafe on purpose: this triggers an outbound text to a number the request names, which is exactly the kind of thing a cross-site page must not be able to do with someone else's cookie. The store owns all three budgets (per session, per requester — the stable abuse material a fresh cookie cannot reset — and per receiving phone); a refused mint sends nothing, and the 429 says when asking again can work. Asking again inside the budget replaces the pending code — that one path is "Resend code" and "wrong number, let me fix it" both — and a re-ask within the store's cooldown returns the SAME code under the same outbox dedupe key, which is what makes retrying this route after a failed enqueue safe and free.

The phone never lands in telemetry; the session id is the trace key.