# OpenAI login recovery gate before phone/SMS runs (2026-05-10)

## Trigger

Use this note before any new country-specific OpenAI phone-verification run, especially when BOSS asks to test a new 5sim country such as Chile.

## Incident

BOSS requested testing Chile numbers 5 times.

Intended mapping:

```text
5sim country: chile
OpenAI ISO: CL
Visible selector: 智利 (+56)
Dial prefix: 56
Total attempts: 5
```

Two blockers appeared before any 5sim number was bought:

1. The generated Chile runner still read `FIVE_SIM_COUNTRY_ORDER` from env, so it started with the old Europe list (`italy,poland,spain,england`) instead of `chile`.
2. OpenAI account recovery could not return to `add-phone`:
   - Password login showed `Incorrect email address or password`.
   - Clicking `使用一次性验证码登录` returned `invalid_state`.
   - Fresh Codex2API OAuth URLs plus stale-tab cleanup still landed on the password page/error state.

Because the runner failed before `add-phone`, no Chile 5sim activation was bought and no number was submitted.

## Rule

Before buying any 5sim activation for a new country, enforce a hard pre-buy gate:

```text
current URL must be https://auth.openai.com/add-phone
OpenAI account must already be usable / email-verified
country selector can be set and read back for the target country
```

If the page is any of the following, stop before buying numbers:

```text
/auth.openai.com/log-in/password
Incorrect email address or password
invalid_state
account_deactivated
email-verification stale state
```

## Runner implementation guard

Country-specific test runners must not accidentally read a stale env country order.

For one-off country tests, explicitly set:

```python
ORDER = ['chile']  # or requested country only
LIMIT = 5          # requested total/per-country budget
```

Also emit the effective order at startup and verify it matches the request before attempting OAuth recovery:

```json
{"phase":"phone_strict_start","countries":["chile"],"max_total_attempts":5}
```

If startup emits a different country list than requested, abort immediately rather than buying or submitting any number.

## Recovery recommendation

When login recovery fails with password mismatch plus `invalid_state`, do not keep generating OAuth URLs in a loop. The next step should be one of:

1. create a fresh ClawEmail sub-mailbox and restart the OpenAI account flow;
2. manually verify/reset the account password;
3. manually test visible browser `使用一次性验证码登录` once to confirm whether `invalid_state` persists.

Only resume 5sim phone attempts after `add-phone` is restored.