The identity linking page says phone-code sign-ins are succeeding, yet returning students are landing in fresh accounts with empty course histories. The workflow should resolve the external identity first; this is an account-recovery incident wearing an authentication badge.
Short answer: model identity linking as separate, auditable state transitions: resolve the external identity first, inspect all existing ownership and recovery paths second, then attach only after an exact match and a uniqueness check. Never let a fuzzy match merge two student accounts.
This order matters more than the choice of authentication vendor. A phone one-time code proves control of a phone number at a point in time; it doesn't prove that the caller owns whichever existing account looks similar. The least complex safe design keeps sign-in proof, account selection, and identity attachment as three different decisions.
What should the first page reveal?
An actionable page should say more than “login conversion changed.” For an edtech service, I want the alert payload to separate successful verification from successful account resolution: provider, normalized identity type, resolution outcome, whether an attachment was attempted, and the count of usable login methods before and after the transition. I don't need the phone number in the alert, and it shouldn't be in a metric label. A stable internal reason code is enough.
