Server-verified enrollment state (issue #165 — never optimistic):
'enrolled'
'partial'
'none'
'unknown'
Server-verified enrollment state (issue #165 — never optimistic):
'enrolled': BOTH the ciphertext blob (recovery-service) and the OTP contact binding (recoverian) exist server-side — recovery can complete.'partial': exactly one of the two exists (an interrupted registration). Retrying the rotation repairs it.'none': neither exists (or recovery is not configured at all).'unknown': a status query failed (401/network) — the state could not be verified and MUST NOT be shown as enrolled.