X_ACCOUNT_LOCKED

per-ip, per-account or per-org bucket is inside its lockout

repeated failed attempts — password or second-factor code. cause names the caller's own key (an address or an email) and the seconds left; a locked org is never named, because its id was looked up from the address the caller typed. The wiki used to name x auth unlock <key>, a command that has never existed

wait out the seconds cause names — or clear this one bucket: await auth.limiter.recordSuccess('<key>'), await auth.orgLimiter.recordSuccess(orgKey(user.orgId)) for a tenant — or raise defineAuth({ rateLimit }). Never reset(): it drops every bucket in the table, including the spray this lockout is holding