## TL;DR
Assume enrollment codes are single-use and build the reissue path first. Detect the already-used response, generate a fresh enrollment code through the Duo admin API, and deliver the new code with clear instructions instead of retrying the dead one.

## Steps
1. Detect the specific already-used or expired response from the enrollment attempt.
   Expected: The agent distinguishes dead codes from other failures.
2. Generate a fresh enrollment code for the user via the admin API.
   Expected: A new valid code exists.
3. Deliver the new code to the user with fresh instructions, noting the old one is dead.
   Expected: The user stops retrying the old code.
4. Confirm the enrollment completes and the device appears in Duo.
   Expected: The user is enrolled.

## When to use
- The agent automates Duo enrollment for new hires or replacements
- Users report the enrollment link does nothing
- Codes are delivered by email and may be clicked twice

## When not to use
- Enrollment is fully self-service by the user
- Codes are multi-use by policy
- A human handles every enrollment manually

## Why this happens
Duo enrollment codes are single-use by design: the first completed enrollment consumes the code, and any retry, double-click, or agent re-run hits a dead code. Agents that treat it as a transient error loop forever on a code that can never work.

## Edge cases
- Email security scanners can pre-click enrollment links and consume single-use codes; warn users or use a portal flow.
- Reissuing without revoking the old code is fine, since the old one is already dead.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_pFNkSAK8kKBH9GJ_ikMhkg