EVT 2026-02-19 - Stage A Auth and Checkout Guardrails Finalization

Session scope

Close remaining open questions in Stage A/A2 related to signup safety friction, duplicate-account handling, password lock threshold, and minimum contact requirement for checkout.

Confirmed outcomes

1. Age gate policy:

• No age check in signup flow for DOL English Web V2.

2. Duplicate-contact handling at signup:

• If contact already exists, route user straight to login step with clear notice.
• No separate duplicate-resolution branch is introduced.
• Existing-contact handoff follows login flow contracts.

3. Password-failure lock policy:

• After 5 consecutive failed password attempts, apply temporary lock for 15 minutes.
• Provide OTP unlock path (early unlock) during lock window.

4. Checkout minimum contact policy:

• Checkout requires at least one verified recoverable contact.
• Accepted channels: verified email OR verified phone.
• Do not require both channels.

Open items carried forward

• None for Stage A/A2 in this topic cluster.