diff --git a/apps/ai-game-creator-shell/src-tauri/src/auth_session.rs b/apps/ai-game-creator-shell/src-tauri/src/auth_session.rs
index 592f5ef95..08f192e1f 100644
--- a/apps/ai-game-creator-shell/src-tauri/src/auth_session.rs
+++ b/apps/ai-game-creator-shell/src-tauri/src/auth_session.rs
@@ -1350,6 +1350,28 @@ mod tests {
         assert_eq!(missing_reason.message(), "登录失败");
     }
 
+    /// 发码端点不带凭据：401/403 不是「用户可改的输入」，而是协议异常，属系统变体（带上文上报）。
+    ///
+    /// api-server 的 `send_phone_code` 只会返回 400（手机号登录未启用）与 5xx；401/403 真出现时
+    /// 说明契约破了，不该被当成业务提示吞掉。
+    #[test]
+    fn send_code_401_403_stay_system_rejections() {
+        for status in [StatusCode::UNAUTHORIZED, StatusCode::FORBIDDEN] {
+            let error = map_auth_failure(
+                status,
+                r#"{"error":{"message":"手机号登录暂未启用"}}"#,
+                "发送验证码失败",
+                AuthRoute::SendCode,
+            );
+            assert!(matches!(
+                error,
+                ClientAuthError::UnexpectedRejection(UnexpectedRejection { .. })
+            ));
+            assert!(!error.is_authority_failure());
+            assert_eq!(error.message(), "手机号登录暂未启用");
+        }
+    }
+
     #[test]
     fn input_rejections_and_throttling_keep_the_server_text() {
         let password_length = map_auth_failure(