v0.9.1 GoAlertUser asks for a verification code once per contact method instead of reissuing one on every reconcile. GoAlert deletes an unverified SMS, VOICE or EMAIL contact method when its verification code expires -- deliberately, since v0.31.0. The operator treated that as drift, recreated the method and sent a fresh code, so a real person received a repeated text, phone call and email for hours in a loop only they could end, and each recreation destroyed the GoAlert message-log evidence that the sends had happened. Verification is now recorded against method identity and survives the method being deleted and recreated, so a code is requested once and never reissued. The person completes it from the GoAlert UI on their own schedule. The resting state is stable but not finished: the method sits in GoAlert unverified, so it will not notify anyone. A ContactMethodsVerified condition and a VerificationExpired event make that visible instead of silent. Ready stays True, because the object itself is synced. Also adds the skip-unverifiable-contact-methods annotation for teams who would rather the operator never create verifiable methods at all.