A refused form: its message, per-field errors, and what to fill back in (never a password).
Optional
Why, for a client leaf that acts on it: a passkey that's gone, a login locked until reset.
What a form that stays put did, said in its status line: another code sent.
A refused form: its message, per-field errors, and what to fill back in (never a password).