# Lift aal2 step-up detection into the session fetch

The m11 `/simplify` pass found (and deliberately skipped as out-of-diff) an altitude issue: `dashboard/src/common/hooks/use-ory-flow.ts` rediscovers the aal2 step-up need by trial-and-error at the login page (mints a flow, checks whether it carries a second-factor node). Instead, surface `session_aal2_required` from `fetchSession` (`dashboard/src/common/server-fn/session.ts`), propagate through `requireAuth` (`dashboard/src/common/lib/auth/`), and redirect to login with an explicit `aal=aal2` param — the hook then renders the step-up flow directly instead of probing for it.

Touches `session.ts` / `requireAuth` / login-route schema / `use-ory-flow.ts`; the six m11 fixture-driven `use-ory-flow` tests pin current behavior and must be updated alongside. Sub-hour ⇒ inbox note, not a milestone.

Source: `w4/m11` t005 completion note ("Follow-up (non-blocking)"), filed via `/pm-brainstorm more for w4` → `/pm` 2026-07-12 so it survives m11's move to `done/`.
