fix: defer HeroSMS reuse confirmation until final cleanup

tests/background-message-router-step2-skip.test.js

@@ -56,7 +56,7 @@ function createRouter(overrides = {}) {
     finalizeStep3Completion: overrides.finalizeStep3Completion || (async (payload) => {
       events.finalizePayloads.push(payload);
     }),
-    finalizeIcloudAliasAfterSuccessfulFlow: async () => {},
+    finalizeIcloudAliasAfterSuccessfulFlow: overrides.finalizeIcloudAliasAfterSuccessfulFlow || (async () => {}),
     findHotmailAccount: async () => null,
     flushCommand: async () => {},
     getCurrentLuckmailPurchase: () => null,
@@ -294,6 +294,40 @@ test('message router finalizes pending phone activation on platform verify succe
   assert.deepStrictEqual(events.phoneFinalizations, [state]);
 });
 
+test('message router does not finalize pending phone activation when icloud finalization fails', async () => {
+  const state = {
+    stepStatuses: { 10: 'pending' },
+    reusablePhoneActivation: {
+      activationId: '123456',
+      phoneNumber: '66959916439',
+      successfulUses: 0,
+      maxUses: 3,
+    },
+    pendingPhoneActivationConfirmation: {
+      activationId: '123456',
+      phoneNumber: '66959916439',
+      successfulUses: 0,
+      maxUses: 3,
+    },
+  };
+  const { router, events } = createRouter({
+    state,
+    getStepDefinitionForState: (step) => ({ id: step, key: step === 10 ? 'platform-verify' : '' }),
+    finalizeIcloudAliasAfterSuccessfulFlow: async () => {
+      throw new Error('icloud finalize failed');
+    },
+  });
+
+  await assert.rejects(
+    () => router.handleStepData(10, {
+      localhostUrl: 'http://localhost:1455/auth/callback?code=ok',
+    }),
+    /icloud finalize failed/
+  );
+
+  assert.deepStrictEqual(events.phoneFinalizations, []);
+});
+
 test('message router marks step 3 failed when post-submit finalize fails', async () => {
   const { router, events } = createRouter({
     finalizeStep3Completion: async () => {

tests/phone-verification-flow.test.js

@@ -95,6 +95,53 @@ test('phone verification helper requires manual HeroSMS maxPrice', async () => {
   );
 });
 
+test('phone verification helper still clears existing activation when maxPrice is missing', async () => {
+  const requests = [];
+  let currentState = {
+    heroSmsApiKey: 'demo-key',
+    heroSmsMaxPrice: '',
+    currentPhoneActivation: {
+      activationId: '123456',
+      phoneNumber: '66959916439',
+      successfulUses: 0,
+      maxUses: 3,
+    },
+    reusablePhoneActivation: null,
+    pendingPhoneActivationConfirmation: null,
+  };
+  const helpers = api.createPhoneVerificationHelpers({
+    addLog: async () => {},
+    ensureStep8SignupPageReady: async () => {},
+    fetchImpl: async (url) => {
+      const parsedUrl = new URL(url);
+      requests.push(parsedUrl);
+      return {
+        ok: true,
+        text: async () => 'ACCESS_CANCEL',
+      };
+    },
+    getState: async () => currentState,
+    sendToContentScriptResilient: async () => ({}),
+    setState: async (updates) => {
+      currentState = { ...currentState, ...updates };
+    },
+    sleepWithStop: async () => {},
+    throwIfStopped: () => {},
+  });
+
+  await assert.rejects(
+    () => helpers.completePhoneVerificationFlow(1, { addPhonePage: true }),
+    /HeroSMS maxPrice is missing/i
+  );
+
+  assert.equal(requests.length, 1);
+  assert.equal(requests[0].searchParams.get('action'), 'setStatus');
+  assert.equal(requests[0].searchParams.get('id'), '123456');
+  assert.equal(requests[0].searchParams.get('status'), '8');
+  assert.equal(requests[0].searchParams.has('maxPrice'), false);
+  assert.equal(currentState.currentPhoneActivation, null);
+});
+
 test('phone verification helper retries with HeroSMS getNumberV2 when getNumber reports NO_NUMBERS', async () => {
   const requests = [];
   const helpers = api.createPhoneVerificationHelpers({