The two out-of-band MFA methods use different mechanisms: OIDC is poll-only, mobile-approve is WS-primary with poll fallback.
This is deliberate, not accidental. OIDC's callback arrives as an HTTP redirect into enterprise/grpc/desktop_client_mfa.rs, so there is no oneshot to park - park is inapplicable, not merely unpreferred. Mobile-approve already has an open WebSocket, so parking is the natural fast path.
Converging them would simplify the engine and the #3046 contract.
The two out-of-band MFA methods use different mechanisms: OIDC is poll-only, mobile-approve is WS-primary with poll fallback.
This is deliberate, not accidental. OIDC's callback arrives as an HTTP redirect into enterprise/grpc/desktop_client_mfa.rs, so there is no oneshot to park - park is inapplicable, not merely unpreferred. Mobile-approve already has an open WebSocket, so parking is the natural fast path.
Converging them would simplify the engine and the #3046 contract.