{"version":"2.1.225","anchor":"untrusted-device-recovery-can-be-turned-off-by-a-flag-unarch","canonical_anchor":"untrusted-device-recovery-can-be-turned-off-by-a-flag-unarch","heading":"Untrusted-device recovery can be turned off by a flag; unarchive gets its own 403 handling","tier":"notice","area":"Auth","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.225\/e\/untrusted-device-recovery-can-be-turned-off-by-a-flag-unarch","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.225","markdown":"### Untrusted-device recovery can be turned off by a flag; unarchive gets its own 403 handling\n\nUntrusted-device failures still recover automatically, and expired trusted-device sessions now tell you to run \/login.\n\n**What**\n\nWhether an untrusted-device failure counts as auth-recoverable is now controlled by a kill switch, and the 403 classification used by archive and unarchive was split.\n\n**Details**\n\n- the recoverability check changed from `reason === \"untrusted_device\" || reason === \"session_stale_relogin\"` to treating `untrusted_device` as recoverable only when the proactive-enrollment kill switch is off\n- gate is `tengu_sessions_elevated_auth_disable_proactive_enrollment`, fallback false, so absent a remote value `untrusted_device` stays recoverable\n- archive and unarchive pass different 403 classification modes; only unarchive maps `session_stale_relogin`\n- that reason surfaces as \"session expired for trusted-device check \u2014 run \/login to re-authenticate\"\n\n**Evidence**\n\n`tengu_sessions_elevated_auth_disable_proactive_enrollment`\n\n- Area: Auth\n- Names: `\/login`\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 0\/5"}