Step 2 — poll while the operator completes identity verification, and again after /complete to confirm the new factor was enrolled. status tracks the reset lifecycle (INITIATED → PENDING_REVIEW → LIVENESS_PASSED → COMPLETED, or terminal REJECTED / EXPIRED). For totp / passkey resets, enrollmentStatus gives a finer signal for the enrollment step: PENDING once verification has passed but the new factor has not yet been submitted, COMPLETED once it has. SMS resets have no enrollment step, so enrollmentStatus is null.