{{-- The state belongs beside the title, not floating inside the card: it is a property of the account, not of whichever step is on screen. --}} {{-- Every action below is re-checked server-side against a recent password confirmation — hiding a button stops nobody who can post to /livewire/update. --}} @if (! $passwordConfirmed) {{-- The gate. Being signed in is not enough to change how the account is protected: the realistic threat is an unlocked machine. --}} @elseif ($twoFactorOn) @elseif ($twoFactorPending) {{-- The step that had no way out. The secret exists but is unconfirmed, so "Abbrechen" genuinely clears it rather than leaving a dangling enrolment that nothing else on the console would ever show. --}} @else @endif @if ($recoveryCodes) {{-- Its own card, not a footnote under another one: these are the only way back in once the phone is gone, and they are shown exactly once. --}} @endif