  recovery: detect=15s recover=post-reauth
