Supervised iPhone sends Authenticate but never TokenUpdate: "Skipped token update due to incomplete migration"

I'm supervising an iPhone over USB (sparserestore / cloud-config method) and enrolling it into self-hosted NanoMDM via ConfigurationURL in Setup Assistant.

Enrollment reaches Authenticate (server logs it fine, cert associates), but the device never sends TokenUpdate, so there's no push token and the server can't push anything.

Device logs (mdmd) show the reason, repeating: Skipped token update due to incomplete migration

The device seems stuck mid-"migration," it's listening for com.apple.managedconfiguration.cleanupmigrationfinished but that never fires, so TokenUpdate is deferred forever.

How do I get the device out of this "incomplete migration" state so TokenUpdate fires? Or maybe it's something else causing the issue, and I am chasing the wrong thing? Any help would be appreciated, thanks!