Recovery is waiting for setup.
No mobile recovery authority is enrolled on this Fleet host yet. That is safe: recovery remains optional and completely separate from CoreID.
1
Bootstrap once
Use the root-held Fleet bootstrap token only to enter the protected setup surface.
2
Enroll Leadstrium Auth
Register the mobile app's Ed25519 public key. The private key never leaves the phone.
3
Recover independently
Future recovery uses a signed challenge, not CoreID and not the bootstrap token.
After bootstrap sign-in, open /auth/recovery/setup to enroll Leadstrium Auth.