Disable two-factor authentication contract

Purpose: deliver the requested link for disabling two-step authentication. API implementation: App\Mail\disableTwoFA. Baseline: resources/views/emails/users/disableTwoFA.blade.php. authTwoController queues this Mailable after creating the disable request.

Suggested subject: Disable two-step authentication request. This preserves the current subject.

Suggested preheader: Disable two-step authentication only if you requested this change. The link expires in 5 minutes.

Portable placeholder contract

Token	Existing Laravel source / derivation	Requirement
{{logo_url}}	Existing Built app_name PNG	Optional deployment override; concrete project HTTPS logo is the default
{{preheader}}	Suggested fixed copy above	Required escaped text
{{disable_url}}	$link built in disableTwoFA::build() as config('app.url') + '/disabletwofa/' + $this->request->hash	Required complete trusted URL; same value in action and fallback

The portable disable_url name maps to the existing Blade link key. The Mailable's request/hash is input to that existing server-side generation; it is not another link or an identifier to expose in a browser-side renderer. Keep the current caller, request generation, no-reply From name and queue behavior during later integration.

Content and states

The action explicitly says Disable two-step authentication. It does not reset a password, approve a login or verify a device. The body retains the single-use and five-minute validity instructions. No expiry_minutes input is invented. Enforcement is unchanged and was not runtime-audited.

The draft adds a visible fallback using the same link and the instruction not to use the link if the change was not requested. These are documented security-copy clarifications, not new application actions. There is no account-holder name in the current data contract, so the draft adds no greeting token.

States are the normal request and a long fictional link for wrapping checks. No completed/expired/disabled confirmation email is invented. All preview links are local explanations and cannot disable anything.

Integration

ready/disable-two-factor.txt and matching populated .txt files preserve the request, link, single-use/five-minute copy and unsolicited-change instruction. Convert portable placeholders to the existing Blade fields explicitly; escape dynamic text/attributes and validate the full generated application URL separately. Do not render untrusted text as HTML. Logo HTTPS/CID policy, provider limitations and native dark-mode fallback are covered in integration-notes.html.