Sign-in failures sort into a few shapes, each with a fix the message already names.
429, "try again after <time>" — lockout crossed its threshold. Wait: the lock clears itself at the named time and is never permanent; there is no unlock command because there is no state to clear by hand. The correct password does not bypass it — the lock is checked first, on purpose. If this is your only administrator and the factor is also lost, break-glass recovery is exempt from the lock and still works from the sign-in screen.
Refusals for a username that does not exist — expected. Failures count against the name as typed, or the 429 would tell an attacker which accounts are real.
401 on every call — an expired 12-hour token, usually. But if every token suddenly fails at once, the master secret changed, which invalidates all of them by design.
401 naming an integrity check — the serious one: a factor row modified outside goca. The factor is quarantined and a critical event fires. Treat it as an incident — find what has database write access before restoring service.
Now I can tell a lockout from an expiry from an incident.