diff --git a/apps/mobile/src/components/login-screen.test.ts b/apps/mobile/src/components/login-screen.test.ts
index 40572713369..21033947d53 100644
--- a/apps/mobile/src/components/login-screen.test.ts
+++ b/apps/mobile/src/components/login-screen.test.ts
@@ -39,7 +39,10 @@ const setLanguagePickerBridge = vi.hoisted(() => vi.fn());
 const announcingWarning = vi.hoisted(() => vi.fn());
 // `sessionEnded` is toggled per test to drive the login screen's announcement
 // effect without re-mocking the module.
-const authState = vi.hoisted(() => ({ sessionEnded: false }));
+const authState = vi.hoisted(() => ({
+  sessionEnded: false,
+  token: undefined as string | undefined,
+}));
 
 vi.mock('expo-router', () => ({
   useRouter: () => ({ push }),
@@ -71,7 +74,11 @@ vi.mock('@/lib/a11y/announcing-toast', () => ({
   announcingToast: { warning: announcingWarning },
 }));
 vi.mock('@/lib/auth/auth-context', () => ({
-  useAuth: () => ({ sessionEnded: authState.sessionEnded, signIn: vi.fn() }),
+  useAuth: () => ({
+    sessionEnded: authState.sessionEnded,
+    signIn: vi.fn(),
+    token: authState.token,
+  }),
 }));
 vi.mock('@/lib/auth/use-device-auth', () => ({
   useDeviceAuth: () => ({
@@ -95,7 +102,7 @@ vi.mock('@/lib/hooks/use-theme-colors', () => ({
 vi.mock('@/lib/login-draft', () => ({
   clearLoginDrafts: vi.fn(),
   clearPersistedLoginDrafts: vi.fn(),
-  persistLoginDrafts: vi.fn(),
+  persistLoginDrafts: vi.fn().mockResolvedValue(undefined),
   restoreLoginDrafts: vi.fn().mockResolvedValue(null),
 }));
 vi.mock('@/lib/picker-bridge', () => ({
@@ -322,6 +329,7 @@ describe('login-screen language globe', () => {
     deviceAuth.error = undefined;
     deviceAuth.verificationUrl = undefined;
     deviceAuth.resumed = false;
+    authState.token = undefined;
     push.mockClear();
     setLanguagePickerBridge.mockClear();
   });
@@ -510,8 +518,10 @@ describe('login-screen idle skeleton', () => {
     deviceAuth.error = undefined;
     deviceAuth.verificationUrl = undefined;
     deviceAuth.resumed = false;
+    authState.token = undefined;
     vi.mocked(restoreLoginDrafts).mockResolvedValue({ email: '', ssoRecovery: null });
     vi.mocked(clearPersistedLoginDrafts).mockClear();
+    vi.mocked(persistLoginDrafts).mockClear();
   });
 
   it('shows a form skeleton until the draft restore finishes', async () => {
@@ -563,6 +573,70 @@ describe('login-screen idle skeleton', () => {
 
     renderer.unmount();
   });
+
+  it('persists the drafts when the screen unmounts so a rotation remount restores them', async () => {
+    const renderer = await mountLoginScreen();
+
+    await act(async () => {
+      await Promise.resolve();
+    });
+    expect(persistLoginDrafts).not.toHaveBeenCalled();
+
+    renderer.unmount();
+    await act(async () => {
+      await Promise.resolve();
+    });
+
+    expect(persistLoginDrafts).toHaveBeenCalledTimes(1);
+  });
+
+  it('skips unmount persistence once the mount completed a sign-in', async () => {
+    deviceAuth.status = 'approved';
+    deviceAuth.token = 'tok';
+    // signIn's mock does not publish through the context; the completed
+    // sign-in publishes the token there, which is what retires the drafts.
+    authState.token = 'tok';
+
+    const renderer = await mountLoginScreen();
+
+    await act(async () => {
+      await Promise.resolve();
+      await Promise.resolve();
+    });
+
+    renderer.unmount();
+    await act(async () => {
+      await Promise.resolve();
+    });
+
+    expect(persistLoginDrafts).not.toHaveBeenCalled();
+  });
+
+  it('skips unmount persistence when a non-device sign-in published its token', async () => {
+    // Email-code, Apple, Google, and passkey sign-ins complete without the
+    // device-auth approved path: they publish the token through the auth
+    // context directly. The unmount persistence must stay off for them too,
+    // or the typed email would pre-fill the next login as the previous
+    // account's address.
+    const renderer = await mountLoginScreen();
+
+    await act(async () => {
+      await Promise.resolve();
+    });
+
+    authState.token = 'provider-token';
+    await act(async () => {
+      renderer.update(createElement(LoginScreen));
+      await Promise.resolve();
+    });
+
+    renderer.unmount();
+    await act(async () => {
+      await Promise.resolve();
+    });
+
+    expect(persistLoginDrafts).not.toHaveBeenCalled();
+  });
 });
 
 describe('login-screen approved wait surface', () => {
diff --git a/apps/mobile/src/components/login-screen.tsx b/apps/mobile/src/components/login-screen.tsx
index ac5c0386874..9e3f14e3002 100644
--- a/apps/mobile/src/components/login-screen.tsx
+++ b/apps/mobile/src/components/login-screen.tsx
@@ -2,7 +2,7 @@
 import * as Clipboard from 'expo-clipboard';
 import { type Href, useRouter } from 'expo-router';
 import { Globe } from '@/components/ui/icons';
-import { useCallback, useEffect, useState } from 'react';
+import { useCallback, useEffect, useRef, useState } from 'react';
 import { useTranslation } from 'react-i18next';
 import { I18nManager, Pressable, ScrollView, View } from 'react-native';
 import { useKeyboardState } from 'react-native-keyboard-controller';
@@ -33,7 +33,7 @@ import { setLanguagePickerBridge } from '@/lib/picker-bridge';
 import { useScreenInsets } from '@/lib/screen-insets';
 
 export function LoginScreen() {
-  const { sessionEnded, signIn } = useAuth();
+  const { sessionEnded, signIn, token: publishedToken } = useAuth();
   const router = useRouter();
   const {
     status,
@@ -59,12 +59,16 @@ export function LoginScreen() {
     ssoRecovery: SsoRecoveryDraft | null;
   } | null>(null);
 
+  // Set once this mount completes a sign-in: the unmount persistence then
+  // stays off, because the signed-in session owns the screen and a typed
+  // email from the abandoned attempt must not survive into the next login.
+  const signedInRef = useRef(false);
+
   const persistToken = useCallback(
     async (tokenValue: string, refreshTokenValue?: string, expiresInValue?: number) => {
       setPersistError(undefined);
       try {
         await signIn(tokenValue, refreshTokenValue, expiresInValue);
-        clearLoginDrafts();
       } catch {
         setPersistError(t('login.couldNotCompleteSignIn'));
       }
@@ -72,6 +76,19 @@ export function LoginScreen() {
     [signIn, t]
   );
 
+  // Every provider's completed sign-in — device code, email code, Apple,
+  // Google, passkey — publishes its token through the auth context, so this
+  // one watch covers them all: the module drafts are dropped (a later
+  // sign-out must not re-persist the previous account's address) and the
+  // unmount persistence stays off, or the next login mount would pre-fill
+  // the previous account's address.
+  useEffect(() => {
+    if (publishedToken !== undefined) {
+      clearLoginDrafts();
+      signedInRef.current = true;
+    }
+  }, [publishedToken]);
+
   useEffect(() => {
     let cancelled = false;
     const restoreDrafts = async () => {
@@ -90,6 +107,22 @@ export function LoginScreen() {
     void restoreDrafts();
     return () => {
       cancelled = true;
+      // Write the module-level drafts back before this mount's state dies, so
+      // the next mount restores what the user had typed — a device rotation
+      // that recreates the activity must not blank the email field. A failed
+      // write leaves the field empty on the next mount; the restore path
+      // already tolerates missing drafts. After a completed sign-in the
+      // drafts were cleared on purpose, so persistence stays off.
+      if (signedInRef.current) {
+        return;
+      }
+      void (async () => {
+        try {
+          await persistLoginDrafts();
+        } catch {
+          // Swallow: nothing to show on an unmounting screen.
+        }
+      })();
     };
   }, []);
 
diff --git a/apps/mobile/src/components/login/__tests__/idle-auth-email-flow.mounted.test.tsx b/apps/mobile/src/components/login/__tests__/idle-auth-email-flow.mounted.test.tsx
index b6568a5df69..0ffe59d591a 100644
--- a/apps/mobile/src/components/login/__tests__/idle-auth-email-flow.mounted.test.tsx
+++ b/apps/mobile/src/components/login/__tests__/idle-auth-email-flow.mounted.test.tsx
@@ -323,4 +323,167 @@ describe('IdleAuth email sign-in flow (real useNativeAuth)', () => {
       renderer.unmount();
     });
   });
+
+  it('drops a refusal that settles after the user edited the code', async () => {
+    mockPostAuth.mockResolvedValue({
+      ok: true,
+      data: { success: true, challengeId: 'c0000000-0000-4000-8000-000000000001' },
+    });
+
+    const renderer = await mountIdleAuth();
+
+    const field = findAll(renderer.root, 'FormField')[0];
+    if (!field) {
+      throw new Error('FormField not found');
+    }
+    act(() => {
+      (field.props.onChangeText as (value: string) => void)('late@example.com');
+    });
+
+    await act(async () => {
+      (continueButton(renderer.root).props.onPress as () => void)();
+      await Promise.resolve();
+      await Promise.resolve();
+      await Promise.resolve();
+    });
+
+    const otpForm = findAll(renderer.root, 'EmailOtpForm')[0];
+    if (!otpForm) {
+      throw new Error('EmailOtpForm not found');
+    }
+
+    // The refusal resolves only after the user has edited the code.
+    const verifyGate = Promise.withResolvers<unknown>();
+    mockPostAuth.mockReturnValue(verifyGate.promise as never);
+
+    await act(async () => {
+      (otpForm.props.onVerify as (code: string) => void)('000000');
+      await Promise.resolve();
+      await Promise.resolve();
+    });
+
+    // The user edits the code while the attempt is in flight.
+    act(() => {
+      (otpForm.props.onCodeChange as () => void)();
+    });
+
+    await act(async () => {
+      verifyGate.resolve({
+        ok: false,
+        errorCode: 'INVALID_CODE',
+        ssoOrganizationId: undefined,
+      });
+      await Promise.resolve();
+      await Promise.resolve();
+      await Promise.resolve();
+    });
+
+    expect(findAll(renderer.root, 'EmailOtpForm')[0]?.props.error).toBeUndefined();
+
+    act(() => {
+      renderer.unmount();
+    });
+  });
+
+  it('renders a wrong-code refusal inline on the code step and clears it on edit', async () => {
+    mockPostAuth.mockResolvedValue({
+      ok: true,
+      data: { success: true, challengeId: 'c0000000-0000-4000-8000-000000000001' },
+    });
+
+    const renderer = await mountIdleAuth();
+
+    const field = findAll(renderer.root, 'FormField')[0];
+    if (!field) {
+      throw new Error('FormField not found');
+    }
+    act(() => {
+      (field.props.onChangeText as (value: string) => void)('wrong@example.com');
+    });
+
+    await act(async () => {
+      (continueButton(renderer.root).props.onPress as () => void)();
+      await Promise.resolve();
+      await Promise.resolve();
+      await Promise.resolve();
+    });
+
+    const otpForm = findAll(renderer.root, 'EmailOtpForm')[0];
+    if (!otpForm) {
+      throw new Error('EmailOtpForm not found');
+    }
+    expect(otpForm.props.error).toBeUndefined();
+
+    mockPostAuth.mockResolvedValue({
+      ok: false,
+      errorCode: 'INVALID_CODE',
+      ssoOrganizationId: undefined,
+    });
+    await act(async () => {
+      (otpForm.props.onVerify as (code: string) => void)('000000');
+      await Promise.resolve();
+      await Promise.resolve();
+      await Promise.resolve();
+    });
+
+    expect(findAll(renderer.root, 'EmailOtpForm')[0]?.props.error).toBe(
+      'That code is incorrect. Please try again.'
+    );
+
+    // Editing the code retires the refusal message.
+    act(() => {
+      (otpForm.props.onCodeChange as () => void)();
+    });
+    expect(findAll(renderer.root, 'EmailOtpForm')[0]?.props.error).toBeUndefined();
+
+    act(() => {
+      renderer.unmount();
+    });
+  });
+
+  it('signs in when the correct code verifies and stays silent on success', async () => {
+    mockPostAuth.mockResolvedValue({
+      ok: true,
+      data: { success: true, challengeId: 'c0000000-0000-4000-8000-000000000001' },
+    });
+
+    const renderer = await mountIdleAuth();
+
+    const field = findAll(renderer.root, 'FormField')[0];
+    if (!field) {
+      throw new Error('FormField not found');
+    }
+    act(() => {
+      (field.props.onChangeText as (value: string) => void)('correct@example.com');
+    });
+
+    await act(async () => {
+      (continueButton(renderer.root).props.onPress as () => void)();
+      await Promise.resolve();
+      await Promise.resolve();
+      await Promise.resolve();
+    });
+
+    const otpForm = findAll(renderer.root, 'EmailOtpForm')[0];
+    if (!otpForm) {
+      throw new Error('EmailOtpForm not found');
+    }
+
+    mockPostAuth.mockResolvedValue({
+      ok: true,
+      data: { token: 'at', refreshToken: 'rt', expiresIn: 3600 },
+    });
+    await act(async () => {
+      (otpForm.props.onVerify as (code: string) => void)('123456');
+      await Promise.resolve();
+      await Promise.resolve();
+      await Promise.resolve();
+    });
+
+    expect(findAll(renderer.root, 'EmailOtpForm')[0]?.props.error).toBeUndefined();
+
+    act(() => {
+      renderer.unmount();
+    });
+  });
 });
diff --git a/apps/mobile/src/components/login/email-otp-form.tsx b/apps/mobile/src/components/login/email-otp-form.tsx
index b9a27299154..a1876928d2e 100644
--- a/apps/mobile/src/components/login/email-otp-form.tsx
+++ b/apps/mobile/src/components/login/email-otp-form.tsx
@@ -6,7 +6,7 @@ import { Button } from '@/components/ui/button';
 import { formFieldA11y } from '@/components/ui/form-field-a11y';
 import { Input } from '@/components/ui/input';
 import { Text } from '@/components/ui/text';
-import { type useNativeAuth } from '@/lib/auth/use-native-auth';
+import { type BusyAction } from '@/lib/auth/use-native-auth';
 import { useThemeColors } from '@/lib/hooks/use-theme-colors';
 import { canSubmitEmailCode } from './email-otp-state';
 
@@ -35,13 +35,19 @@ function formatCodeDestination(message: string, email: string): string {
 export function EmailOtpForm({
   email,
   busy,
+  error,
   onVerify,
+  onCodeChange,
   onResend,
   onBack,
 }: Readonly<{
   email: string;
-  busy: ReturnType<typeof useNativeAuth>['busy'];
+  busy: BusyAction;
+  /** A verify refusal in the active language, rendered above the verify button. */
+  error?: string;
   onVerify: (code: string) => void;
+  /** Fires on every code-input change so the caller can retire a stale refusal message. */
+  onCodeChange?: () => void;
   onResend: () => void;
   onBack: () => void;
 }>) {
@@ -83,9 +89,15 @@ export function EmailOtpForm({
         onChangeText={value => {
           codeRef.current = value;
           setHasCompleteCode(/^\d{6}$/.test(value));
+          onCodeChange?.();
         }}
         accessibilityLabel={formFieldA11y({ label: t('login.signInCodeField'), required: true })}
       />
+      {error ? (
+        <Text className="text-center text-sm text-destructive" accessibilityLiveRegion="polite">
+          {error}
+        </Text>
+      ) : null}
       <Button
         size="lg"
         className="flex-row gap-2"
diff --git a/apps/mobile/src/components/login/email-otp-state.ts b/apps/mobile/src/components/login/email-otp-state.ts
index 4155e310530..7b4cdf8b8ca 100644
--- a/apps/mobile/src/components/login/email-otp-state.ts
+++ b/apps/mobile/src/components/login/email-otp-state.ts
@@ -1,8 +1,5 @@
-import { type useNativeAuth } from '@/lib/auth/use-native-auth';
+import { type BusyAction } from '@/lib/auth/use-native-auth';
 
-export function canSubmitEmailCode(
-  code: string,
-  busy?: ReturnType<typeof useNativeAuth>['busy']
-): boolean {
+export function canSubmitEmailCode(code: string, busy?: BusyAction): boolean {
   return busy === undefined && /^\d{6}$/.test(code);
 }
diff --git a/apps/mobile/src/components/login/idle-auth.tsx b/apps/mobile/src/components/login/idle-auth.tsx
index 724f0f51d18..9e6ad02fbed 100644
--- a/apps/mobile/src/components/login/idle-auth.tsx
+++ b/apps/mobile/src/components/login/idle-auth.tsx
@@ -66,6 +66,10 @@ export function IdleAuth({
   const { t } = useTranslation();
   const colors = useThemeColors();
   const [view, setView] = useState<'main' | 'otp'>('main');
+  const [verifyError, setVerifyError] = useState<string | undefined>(undefined);
+  // Bumps on every user step that retires a refusal (edit, resend, back), so a
+  // slow refusal from an earlier attempt cannot re-appear after the user moved on.
+  const verifyAttemptRef = useRef(0);
   const [appleAvailable, setAppleAvailable] = useState(false);
   const [browserAuthStarting, setBrowserAuthStarting] = useState(false);
   const emailRef = useRef(initialEmail);
@@ -133,6 +137,8 @@ export function IdleAuth({
     // reports a rejected address (`INVALID_REQUEST` / `INVALID_EMAIL`).
     const ok = await requestEmailCode(emailRef.current);
     if (ok) {
+      verifyAttemptRef.current += 1;
+      setVerifyError(undefined);
       setView('otp');
     }
   };
@@ -186,10 +192,28 @@ export function IdleAuth({
       <EmailOtpForm
         email={emailRef.current.trim().toLowerCase()}
         busy={busy}
+        error={verifyError}
         onVerify={code => {
-          void verifyEmailCode(emailRef.current, code);
+          const attempt = verifyAttemptRef.current;
+          void (async () => {
+            const outcome = await verifyEmailCode(emailRef.current, code);
+            // A refusal may settle after the user has moved on — edited the
+            // code (clearing the message), requested a resend, or gone back.
+            // Only the attempt this refusal belongs to may write its message.
+            if (!outcome.ok && attempt === verifyAttemptRef.current) {
+              setVerifyError(outcome.message);
+            }
+          })();
+        }}
+        onCodeChange={() => {
+          // Editing the code retires the refusal message above the field and
+          // disowns any verify attempt still in flight for the old code.
+          verifyAttemptRef.current += 1;
+          setVerifyError(undefined);
         }}
         onResend={() => {
+          verifyAttemptRef.current += 1;
+          setVerifyError(undefined);
           void (async () => {
             const ok = await requestEmailCode(emailRef.current);
             if (ok) {
@@ -198,6 +222,8 @@ export function IdleAuth({
           })();
         }}
         onBack={() => {
+          verifyAttemptRef.current += 1;
+          setVerifyError(undefined);
           setView('main');
         }}
       />
diff --git a/apps/mobile/src/lib/auth/use-native-auth.test.ts b/apps/mobile/src/lib/auth/use-native-auth.test.ts
index caa18c6a829..95e88287d17 100644
--- a/apps/mobile/src/lib/auth/use-native-auth.test.ts
+++ b/apps/mobile/src/lib/auth/use-native-auth.test.ts
@@ -646,10 +646,11 @@ describe('useNativeAuth signup step-up', () => {
       const resultRef = await mountNativeAuth();
 
       await act(async () => {
-        expect(await resultRef.current?.verifyEmailCode('user@example.com', '123456')).toBe(false);
+        const outcome = await resultRef.current?.verifyEmailCode('user@example.com', '123456');
+        expect(outcome).toEqual({ ok: false, message: i18n.t(key) });
       });
 
-      expect(toast.error).toHaveBeenCalledWith(i18n.t(key));
+      expect(toast.error).not.toHaveBeenCalled();
       expect(authMock.signIn).not.toHaveBeenCalled();
     }
   );
diff --git a/apps/mobile/src/lib/auth/use-native-auth.ts b/apps/mobile/src/lib/auth/use-native-auth.ts
index 6e0f01b8eb1..4b92868eef3 100644
--- a/apps/mobile/src/lib/auth/use-native-auth.ts
+++ b/apps/mobile/src/lib/auth/use-native-auth.ts
@@ -65,7 +65,10 @@ async function tokenRefusalMessage(
   return signupStepUpMessage(result.signupMethods, { apple, google: googleConfigured });
 }
 
-type BusyAction = 'apple' | 'google' | 'passkey' | 'otp-send' | 'otp-verify' | undefined;
+export type BusyAction = 'apple' | 'google' | 'passkey' | 'otp-send' | 'otp-verify' | undefined;
+
+/** Outcome of an email-code verification attempt: a token, or an inline refusal message. */
+type EmailCodeVerifyResult = { ok: true } | { ok: false; message: string };
 
 type NativeAuthResult = {
   busy: BusyAction;
@@ -76,7 +79,7 @@ type NativeAuthResult = {
   signInWithGoogle: () => Promise<void>;
   signInWithPasskey: () => Promise<void>;
   requestEmailCode: (email: string) => Promise<boolean>;
-  verifyEmailCode: (email: string, code: string) => Promise<boolean>;
+  verifyEmailCode: (email: string, code: string) => Promise<EmailCodeVerifyResult>;
   ssoRecovery: SsoRecovery | null;
   clearSsoRecovery: () => void;
   handleSsoError: (email: string, ssoOrganizationId: string | undefined) => void;
@@ -348,11 +351,10 @@ export function useNativeAuth(): NativeAuthResult {
   );
 
   const verifyEmailCode = useCallback(
-    async (rawEmail: string, code: string) => {
+    async (rawEmail: string, code: string): Promise<EmailCodeVerifyResult> => {
       const email = rawEmail.trim().toLowerCase();
       if (!startAction('otp-verify')) {
-        toast.error(i18n.t('login.couldNotCompleteSignIn'));
-        return false;
+        return { ok: false, message: i18n.t('login.couldNotCompleteSignIn') };
       }
       try {
         // Only send a challengeId when the email matches. A mismatched
@@ -363,7 +365,7 @@ export function useNativeAuth(): NativeAuthResult {
         try {
           admissionBody = await resolveAdmission();
         } catch {
-          return false;
+          return { ok: false, message: i18n.t('authErrors.retryableAdmission') };
         }
 
         const result = await postAuth('/api/auth/native/token', {
@@ -377,15 +379,17 @@ export function useNativeAuth(): NativeAuthResult {
         if (!result.ok) {
           if (result.errorCode === 'SSO_ERROR') {
             handleSsoError(email, result.ssoOrganizationId);
-          } else {
-            toast.error(await tokenRefusalMessage(result, googleConfigured));
           }
-          return false;
+          // Every other refusal surfaces inline on the code step: the form owns
+          // the message slot, so a wrong, spent, or contested code reads in the
+          // active language right where the input is. A toast here was the
+          // reported dead end — the screen kept its silence while the toast
+          // could land behind the keyboard or expire unnoticed.
+          return { ok: false, message: await tokenRefusalMessage(result, googleConfigured) };
         }
         const parsed = parseTokenPair(result.data);
         if (!parsed) {
-          toast.error(defaultErrorMessage());
-          return false;
+          return { ok: false, message: defaultErrorMessage() };
         }
         await signIn(
           parsed.token,
@@ -395,12 +399,11 @@ export function useNativeAuth(): NativeAuthResult {
         if (parsed.created === true) {
           announcingToast.success(i18n.t('login.accountCreated'));
         }
-        return true;
+        return { ok: true };
       } catch (error) {
         // eslint-disable-next-line no-console -- surface swallowed auth errors to Sentry
         console.error('[native-auth] verifyEmailCode signIn failed:', error);
-        toast.error(defaultErrorMessage());
-        return false;
+        return { ok: false, message: defaultErrorMessage() };
       } finally {
         finishAction('otp-verify');
       }