428 (Precondition Required, RFC 6585) is the correct semantic — the request requires the client to complete a prerequisite step (Login Flow v2 provisioning) before retrying. 412 (Precondition Failed) is for header-based preconditions like ETags / If-Match. No behavior change beyond the status code; same JSON payload. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>