Session state
Use OTP or magic link to obtain a verified session, then either activate a new anchor invite or complete TOTP step-up for an existing anchor.
Verified session
Use OTP as the primary verified path. Magic link remains the fallback path.
Challenge id
No active OTP challenge yet.
Anchor next step
Reuse the verified session for existing-anchor TOTP step-up, or move into invite activation for first-time enrollment.
Anchor challenge id
No active anchor step-up challenge yet.
Dev fallback
This keeps the shell bootstrappable when you need to paste a token pair directly.