A phone-scan sign-in panel whose QR carries the secret while the screen shows only a derived pairing phrase, with expiry computed from expiresAt instead of trusted, scans attributed by device and approximate location so a wrong one can be rejected, and loading/empty/error handled as first-class branches.