What’s Fixed
Entering incorrect two-factor codes at sign-in could leave you unable to get back in. The lockout lasted longer than the sign-in session it applied to, so once the session expired the screen reported that there was no verification in progress — a dead end with no way forward and no explanation. Failed attempts also carried across sign-in visits, so the block could arrive after only a couple of visible tries on a fresh login, and correct codes were rejected while it was in effect with nothing on screen to say why.
Bug Fixes
- The verification session now outlasts the lockout, so waiting out a lockout returns you to a working code prompt instead of a dead end.
- The sign-in screen now shows a live countdown of the time remaining on a lockout, and the submit button is disabled until it clears.
- The screen now shows how many attempts remain before a lockout starts.
- When a verification session does expire, the screen says so plainly and returns you to sign in instead of leaving you on a broken prompt.
The protection itself is unchanged: the same number of failed attempts triggers a lockout, it lasts the same length of time, and correct codes are still rejected while one is active. What changed is that the reason and the remaining time are now visible, and the session no longer expires out from under you.