@@ -0,0 +1,16 @@
+---
+'@object-ui/auth': patch
+---
+
+fix(auth): with email+password sign-in off, phone sign-in on and no single sign-on, the login card draws the phone way in on first paint instead of a single sign-on view
+
+Clause-②: no
+Metadata-protocol: none
+
+`LoginForm` collapsed into the single sign-on view whenever the server turned email+password sign-in off (`emailPassword.enabled: false`), whether or not single sign-on existed. A deployment that signs in by phone only showed its users "Use a password instead" and, behind it, a "Back to single sign-on" button with no single sign-on anywhere. Now, with the password door shut, no single sign-on offered (`features.sso`) or enforced (`features.ssoEnforced`) and a phone way in advertised (`features.phoneNumber` or `features.phoneNumberOtp`), the form is drawn on first paint:
+
+- the identifier field reads "Phone number" (the existing `phoneLabel` / `phonePlaceholder` labels), since the server refuses an email address;
+- with phone OTP the only way in, the form opens on the verification-code step and offers no switch to a password form the server refuses;
+- no "Back to single sign-on" button, no sign-up link and no password-form description, all of which name a door the server refuses.
+
+A shut password door with single sign-on offered, declared enforcement, the no-method state and a failed config fetch (the password form, break-glass) are unchanged.
@@ -336,16 +336,30 @@ export function LoginForm({
     };
   }, [getAuthConfig]);
 
+  // A phone way in the server advertises: phone+password, or phone OTP.
+  const phoneSignInOffered = phonePasswordEnabled || phoneOtpEnabled;
   // Under enforced mode, and when the server has turned the password door off,
   // the password form is collapsed until the user opts into the break-glass
-  // path; otherwise it's always shown.
-  const passwordFormCollapsed = ssoEnforced || passwordSignInOff;
+  // path; otherwise it's always shown. One exception: the password door shut
+  // with no single sign-on offered but a phone way in. The form then holds the
+  // way in (phone+password, phone OTP), so it is drawn on first paint; a
+  // collapsed view there would be a single sign-on view with no single
+  // sign-on in it.
+  const passwordFormCollapsed =
+    ssoEnforced || (passwordSignInOff && (ssoEnabled || !phoneSignInOffered));
   const passwordFormVisible = !passwordFormCollapsed || showPasswordFallback;
   // The break-glass link reveals the password form, so it is offered only
   // while that form holds a password door the server accepts: email+password
   // itself, or phone+password sign-in. The SSO button needs no link: the
   // SSO-only view draws it on first paint (`ssoEmailFormVisible` below).
   const breakGlassOffered = !passwordSignInOff || phonePasswordEnabled;
+  // The form's mode as drawn: with no password door the server accepts, the
+  // only way the form can hold is phone OTP, so it opens there and offers no
+  // switch back to a password form the server refuses.
+  const formMode = breakGlassOffered ? mode : 'phone-otp';
+  // The identifier field names only what the server accepts: with email
+  // sign-in refused, a phone number is the one identifier left.
+  const phoneOnlyIdentifier = passwordSignInOff && phonePasswordEnabled;
   // Nothing the server advertises lets anyone in: say so, instead of SSO copy
   // with no SSO affordance and a password link the server refuses.
   const noSignInMethod =
@@ -407,7 +421,7 @@ export function LoginForm({
     // that the server rejects as "Invalid email" (#3238) — trim before use.
     const identifier = email.trim();
     try {
-      if (mode === 'phone-otp') {
+      if (formMode === 'phone-otp') {
         await signInWithPhoneOtp(phone.trim(), otpCode.trim());
       } else if (phonePasswordEnabled && looksLikePhoneIdentifier(identifier)) {
         // Unified identifier: a phone-shaped entry routes to phone+password.
@@ -570,7 +584,10 @@ export function LoginForm({
                 ? ssoOnlyCopy
                   ? l.ssoOnlyDescription
                   : undefined
-                : description
+                : passwordSignInOff
+                  ? // The password-form copy names a door the server refuses.
+                    undefined
+                  : description
           }
         />
       )}
@@ -607,7 +624,7 @@ export function LoginForm({
         />
 
         {passwordFormVisible ? (
-        mode === 'phone-otp' ? (
+        formMode === 'phone-otp' ? (
         /* Phone-OTP sign-in (framework#2780): request a code, then verify.
            Server-side the number is guarded by a per-number cooldown +
            hourly cap — the resend button mirrors it with a countdown. */
@@ -674,13 +691,15 @@ export function LoginForm({
             {isLoading ? l.submittingButton : l.submitButton}
           </button>
 
-          <button
-            type="button"
-            onClick={() => switchMode('password')}
-            className={`w-full text-center text-xs text-muted-foreground underline-offset-4 transition-colors hover:text-primary hover:underline ${AUTH_TOUCH_TARGET_CLASS}`}
-          >
-            {l.usePasswordSignInText}
-          </button>
+          {breakGlassOffered && (
+            <button
+              type="button"
+              onClick={() => switchMode('password')}
+              className={`w-full text-center text-xs text-muted-foreground underline-offset-4 transition-colors hover:text-primary hover:underline ${AUTH_TOUCH_TARGET_CLASS}`}
+            >
+              {l.usePasswordSignInText}
+            </button>
+          )}
         </form>
         ) : (
         <form onSubmit={handleSubmit} className="space-y-4">
@@ -691,15 +710,26 @@ export function LoginForm({
 
           <div className="space-y-2">
             <label htmlFor="login-email" className={AUTH_FIELD_LABEL_CLASS}>
-              {phonePasswordEnabled ? l.emailOrPhoneLabel : l.emailLabel}
+              {phoneOnlyIdentifier
+                ? l.phoneLabel
+                : phonePasswordEnabled
+                  ? l.emailOrPhoneLabel
+                  : l.emailLabel}
             </label>
             <input
               id="login-email"
               // `text` (not `email`) when a phone number is also accepted, so the
-              // browser doesn't reject a phone-shaped value on native validation.
-              type={phonePasswordEnabled ? 'text' : 'email'}
-              inputMode={phonePasswordEnabled ? 'text' : 'email'}
-              placeholder={phonePasswordEnabled ? l.emailOrPhonePlaceholder : l.emailPlaceholder}
+              // browser doesn't reject a phone-shaped value on native validation;
+              // `tel` when it is the only identifier the server accepts.
+              type={phoneOnlyIdentifier ? 'tel' : phonePasswordEnabled ? 'text' : 'email'}
+              inputMode={phoneOnlyIdentifier ? 'tel' : phonePasswordEnabled ? 'text' : 'email'}
+              placeholder={
+                phoneOnlyIdentifier
+                  ? l.phonePlaceholder
+                  : phonePasswordEnabled
+                    ? l.emailOrPhonePlaceholder
+                    : l.emailPlaceholder
+              }
               value={email}
               onChange={(e) => setEmail(e.target.value)}
               required
@@ -783,8 +813,12 @@ export function LoginForm({
             </button>
           )}
 
-          {/* Break-glass form was opened under enforced mode — let the user
-              collapse back to the SSO-only view. */}
+          {/* Break-glass form was opened from the collapsed view — let the
+              user collapse back to it. The form is collapsed only where single
+              sign-on is enforced or offered (a shut password door with a phone
+              way in and no SSO draws the form on first paint), and the link
+              that opens it is offered only with a password door, so there is
+              always single sign-on to go back to. */}
           {passwordFormCollapsed && showPasswordFallback && (
             <button
               type="button"
@@ -854,7 +888,9 @@ export function LoginForm({
         )}
       </div>
 
-      {registerUrl && !passwordFormCollapsed && (
+      {/* Sign-up is an email+password door too: not offered while the server
+          refuses that door, whether or not the form is collapsed. */}
+      {registerUrl && !passwordFormCollapsed && !passwordSignInOff && (
         <p className="px-8 text-center text-[13px] text-muted-foreground">
           {l.noAccountText}{' '}
           <LinkComp href={registerUrl} className={AUTH_LINK_CLASS}>
 
@@ -37,6 +37,9 @@ const SSO_ONLY_COPY = "Sign in with your organization's single sign-on";
 const BREAK_GLASS = { name: 'Use a password instead' } as const;
 const SSO_BUTTON = { name: 'Sign in with SSO' } as const;
 const PROVIDER_BUTTON = { name: /Continue with Acme IdP$/ } as const;
+const OTP_LINK = { name: 'Sign in with verification code' } as const;
+const PASSWORD_INSTEAD = { name: 'Sign in with password instead' } as const;
+const BACK_TO_SSO = { name: 'Back to single sign-on' } as const;
 const OIDC: AuthPublicConfig['socialProviders'] = [
   { id: 'acme-idp', name: 'Acme IdP', enabled: true, type: 'oidc' },
 ];
@@ -48,20 +51,25 @@ const PASSWORD_OFF_NOTHING_ELSE: AuthPublicConfig = {
   features: { sso: false, ssoEnforced: false },
 };
 
-function client(getConfig: AuthClient['getConfig']): AuthClient {
+function client(getConfig: AuthClient['getConfig'], overrides: Partial<AuthClient> = {}): AuthClient {
   return {
     signIn: vi.fn(),
     getSession: vi.fn().mockResolvedValue(null),
     getConfig,
     signInWithProvider: vi.fn().mockResolvedValue(undefined),
+    ...overrides,
   } as unknown as AuthClient;
 }
 
-function renderLogin(config: AuthPublicConfig | Error, props: LoginFormProps = {}) {
+function renderLogin(
+  config: AuthPublicConfig | Error,
+  props: LoginFormProps = {},
+  overrides: Partial<AuthClient> = {},
+) {
   const getConfig =
     config instanceof Error ? vi.fn().mockRejectedValue(config) : vi.fn().mockResolvedValue(config);
   return render(
-    <AuthProvider authUrl="/api/auth" client={client(getConfig)}>
+    <AuthProvider authUrl="/api/auth" client={client(getConfig, overrides)}>
       <LoginForm registerUrl="/register" {...props} />
     </AuthProvider>,
   );
@@ -172,8 +180,8 @@ describe('LoginForm — doors the server does advertise stay usable', () => {
 
     expect(screen.queryByTestId('login-no-sign-in-method')).toBeNull();
     expect(screen.queryByText(SSO_ONLY_COPY)).toBeNull();
-    fireEvent.click(screen.getByRole('button', BREAK_GLASS));
-    expect(await screen.findByRole('button', { name: 'Sign in with verification code' })).toBeTruthy();
+    // The phone ways in are on the first paint; the full matrix is below.
+    expect(screen.getByRole('button', OTP_LINK)).toBeTruthy();
   });
 
   it('falls back to the password form when the config fetch fails (break-glass beats lock-out)', async () => {
@@ -195,3 +203,135 @@ describe('LoginForm — doors the server does advertise stay usable', () => {
     expect(screen.queryByTestId('login-no-sign-in-method')).toBeNull();
   });
 });
+
+/**
+ * The password door shut, no single sign-on offered or enforced, and a phone
+ * way in advertised: the card is not collapsed into the single sign-on view.
+ * The form holding the phone way in is the first paint, and no "Back to single
+ * sign-on" button is drawn, since there is no single sign-on to go back to.
+ * Cells with single sign-on keep their collapse and their back button.
+ */
+describe('LoginForm — password off, phone sign-in on, no single sign-on', () => {
+  /** The QA repro: `email_password_enabled` false on a boot with phone sign-in. */
+  const PHONE_ONLY: AuthPublicConfig = {
+    socialProviders: [],
+    emailPassword: { enabled: false },
+    features: { sso: false, ssoEnforced: false, phoneNumber: true, phoneNumberOtp: true },
+  };
+
+  it('draws the phone+password form and the verification-code way in on first paint, with no SSO view', async () => {
+    renderLogin(PHONE_ONLY);
+    await configResolved();
+
+    // The identifier the server still accepts is a phone number; email is refused.
+    expect(screen.getByLabelText('Phone number')).toBeTruthy();
+    expect(screen.queryByLabelText('Email or phone number')).toBeNull();
+    expect(screen.getByLabelText('Password')).toBeTruthy();
+    expect(screen.getByRole('button', OTP_LINK)).toBeTruthy();
+
+    expect(screen.queryByRole('button', BREAK_GLASS)).toBeNull();
+    expect(screen.queryByRole('button', BACK_TO_SSO)).toBeNull();
+    expect(screen.queryByText(SSO_ONLY_COPY)).toBeNull();
+    expect(screen.queryByTestId('login-no-sign-in-method')).toBeNull();
+    // Sign-up and the password-form copy are email+password doors the server refuses.
+    expect(screen.queryByText('Sign up')).toBeNull();
+    expect(screen.queryByText(/Enter your email and password/)).toBeNull();
+  });
+
+  it('draws no back-to-SSO button in the verification-code form either, and switches back', async () => {
+    renderLogin(PHONE_ONLY, { hideHeader: true });
+    await configResolved();
+
+    fireEvent.click(screen.getByRole('button', OTP_LINK));
+    expect(await screen.findByLabelText('Verification code')).toBeTruthy();
+    expect(screen.queryByRole('button', BACK_TO_SSO)).toBeNull();
+    expect(screen.queryByText(SSO_ONLY_COPY)).toBeNull();
+
+    // Phone+password is a door the server accepts, so the switch back is offered.
+    fireEvent.click(screen.getByRole('button', PASSWORD_INSTEAD));
+    expect(await screen.findByLabelText('Password')).toBeTruthy();
+    expect(screen.queryByRole('button', BACK_TO_SSO)).toBeNull();
+  });
+
+  it('signs a phone number in with its password from the first paint', async () => {
+    const signIn = vi.fn();
+    const signInWithPhonePassword = vi
+      .fn()
+      .mockResolvedValue({ user: { id: 'u2' }, session: { token: 'pw-tok' } });
+    renderLogin(PHONE_ONLY, {}, { signIn, signInWithPhonePassword });
+    await configResolved();
+
+    fireEvent.change(screen.getByLabelText('Phone number'), { target: { value: '13800138000' } });
+    fireEvent.change(screen.getByLabelText('Password'), { target: { value: 'S3cret!' } });
+    fireEvent.click(screen.getByRole('button', { name: 'Sign In' }));
+
+    await waitFor(() => expect(signInWithPhonePassword).toHaveBeenCalledWith('13800138000', 'S3cret!'));
+    expect(signIn).not.toHaveBeenCalled();
+  });
+
+  it('with phone OTP the only way in, opens on the verification-code form with no switch to a refused password form', async () => {
+    renderLogin({
+      socialProviders: [],
+      emailPassword: { enabled: false },
+      features: { sso: false, ssoEnforced: false, phoneNumber: false, phoneNumberOtp: true },
+    });
+    await configResolved();
+
+    expect(screen.getByLabelText('Phone number')).toBeTruthy();
+    expect(screen.getByLabelText('Verification code')).toBeTruthy();
+    expect(screen.getByRole('button', { name: 'Get code' })).toBeTruthy();
+    expect(screen.queryByLabelText('Password')).toBeNull();
+    expect(screen.queryByRole('button', PASSWORD_INSTEAD)).toBeNull();
+    expect(screen.queryByRole('button', BREAK_GLASS)).toBeNull();
+    expect(screen.queryByRole('button', BACK_TO_SSO)).toBeNull();
+  });
+
+  it('with phone+password the only way in, draws it with no verification-code link', async () => {
+    renderLogin({
+      socialProviders: [],
+      emailPassword: { enabled: false },
+      features: { sso: false, ssoEnforced: false, phoneNumber: true, phoneNumberOtp: false },
+    });
+    await configResolved();
+
+    expect(screen.getByLabelText('Phone number')).toBeTruthy();
+    expect(screen.getByLabelText('Password')).toBeTruthy();
+    expect(screen.queryByRole('button', OTP_LINK)).toBeNull();
+    expect(screen.queryByRole('button', BREAK_GLASS)).toBeNull();
+    expect(screen.queryByRole('button', BACK_TO_SSO)).toBeNull();
+  });
+
+  it('CONTROL: with SSO advertised as well, the card stays collapsed and the back button returns', async () => {
+    renderLogin({ ...PHONE_ONLY, features: { ...PHONE_ONLY.features, sso: true } });
+    await configResolved();
+
+    expect(screen.getByText(SSO_ONLY_COPY)).toBeTruthy();
+    expect(screen.getByRole('button', SSO_BUTTON)).toBeTruthy();
+    expect(screen.queryByLabelText('Password')).toBeNull();
+
+    fireEvent.click(screen.getByRole('button', BREAK_GLASS));
+    expect(await screen.findByLabelText('Password')).toBeTruthy();
+    expect(screen.getByRole('button', BACK_TO_SSO)).toBeTruthy();
+  });
+
+  it('CONTROL: under declared enforcement, the card stays collapsed and the back button returns', async () => {
+    renderLogin(
+      {
+        ...PHONE_ONLY,
+        socialProviders: OIDC,
+        features: { ...PHONE_ONLY.features, ssoEnforced: true },
+      },
+      { hideHeader: true },
+    );
+    await configResolved();
+
+    expect(screen.getByText(SSO_ONLY_COPY)).toBeTruthy();
+    expect(await screen.findByRole('button', PROVIDER_BUTTON)).toBeTruthy();
+    expect(screen.queryByLabelText('Password')).toBeNull();
+
+    fireEvent.click(screen.getByRole('button', BREAK_GLASS));
+    expect(await screen.findByLabelText('Password')).toBeTruthy();
+    fireEvent.click(screen.getByRole('button', BACK_TO_SSO));
+    await waitFor(() => expect(screen.queryByLabelText('Password')).toBeNull());
+  });
+});