Security
Access lockout shows the deadline and spares typos
Form abuse protection now tells a filling mistake from an automated attempt, and the lockout screen says when access comes back.
The anti-abuse protection counted a wrongly filled field the same way as a failed reCAPTCHA. Someone who mistyped an e-mail a few times spent the same quota as someone trying to force the form.
Two limits
A failure now has an origin. A field validation error counts against its own limit; a failed reCAPTCHA still counts as abuse. The default is abuse, so existing callers keep their behaviour.
Lockout with a deadline
The access check returns the lockout time, and the login screens replace a marker with the release date and time. Projects with their own login screen need to include that marker to show the deadline.
Source: Core · req-169 · BATCH-174