Every user must hold a passkey, as last reconciled from Cognito; false without a user.
A dashboard user exists to store a phone number on; without one, none is asked for yet.
Every user must give one (collected, not verified); null until they do.
What the dashboard knows about the signed-in user, to pick the step after sign-in.