Once a one-time code lands in an inbox the agent reads, it's in the agent's context, and that means it also sits in every transcript and trace I keep for the run. So your first move closes a second hole. A code sent to the founder's phone never ends up logged next to the agent's tool calls.