Constant MAX_VERIFY_ATTEMPTS 

const MAX_VERIFY_ATTEMPTS: u32 = 5;

Failed-validation ceiling: the session self-destructs once this many wrong submissions have been counted, so the Nth burns and N-1 are tolerated. Caps token brute-force (mirrors the device-grant ceiling).