Check the code the athlete typed back; on a match the phone is proven.

Every outcome is a 200 with a name the page can render its own copy for — a wrong code is the athlete mistyping, not an HTTP failure. The store burns an attempt per mismatch and refuses a record out of attempts, so the only move left after attempts_exhausted or expired is requesting a fresh code. The proven phone comes back from the store, not echoed from any request, so what the caller learns is what was verified.