[noamtfh]

Why

Draft pending the implementation merge and final behavior check. Secure Enclave enrollment remains behind the disabled-by-default backup_enable_secure_enclave_sync_factor gate. Keep this PR as a draft and merge it when backup_enable_secure_enclave_sync_factor is turned on for production rollout, after checking the text against the final merged iOS implementation.

Eligible iOS Sync Factors move to device-only Secure Enclave storage. The docs currently describe only non-synchronized Keychain storage and omit the pending-key registration lifecycle.

Tracks MCORE-2048. Implementation: worldcoin/world-app-ios#8681, reviewed at 71395239f0a5a8f073f3349e5e1d0aad793132c8.

What

• Document Secure Enclave storage, legacy fallback, activation, replacement cleanup, and admission-gate rollback.
• Explain BF-1 creation confirmation and duplicate-create behavior after a lost response.
• Explain BF-2 retained-key retries, exact backup membership checks, Turnkey reconciliation, and abandoning local enrollment after an authenticated restore of a different backup.
• Describe separate Turnkey user and policy creation, querying after uncertain responses, and rejecting duplicate or wrong-role users.
• Correct the related duplicate-create error description and distinguish Turnkey API public keys from device-held private keys.

Factor permissions, backup encryption and format, Main Factor ceremonies, and Money/World ID sharing are unchanged by the implementation. Separate client authorization is tracked in MCORE-2045.

Test

• Compared the text with SyncFactorKeyStore, SyncFactorService, AccountManagementService creation/registration/cleanup, and TurnkeyService reconciliation in implementation commit 71395239f0a5a8f073f3349e5e1d0aad793132c8.
• pnpm run spellcheck: passed.
• pnpm run check-links: passed.
• pnpm exec mint validate --telemetry false: passed; reported the pre-existing missing images/favicon.svg referenced by unchanged docs.json.
• git diff --check: passed.
• make swiftlint-changed in the implementation evidence checkout: no changed Swift files.

Risk

Documentation only. The text describes security-sensitive storage, enrollment, cleanup, and signing boundaries; it must be reviewed against the final merged iOS implementation before docs merge and broad rollout. Implementation PR #8681 is still open, so this is a draft pending that check. It does not introduce encrypted-archive replay or general resumable Turnkey account provisioning.