Setup expired — start sign-in again
During mandatory 2FA login, confirming the authenticator code failed because the pending setup cookie is missing or does not match the setup session (AUTH_2FA_SETUP_EXPIRED / product: start sign-in again).
Why this happens
readTotpSetupPendingCookie empty or userId ≠ mandatory-setup gate. Member waited too long, cleared cookies, or started over. Distinct from Account Settings Setup expired — open Set up Google Authenticator again and from Setup session expired — sign in again (mandatory-setup cookie itself gone).
Diagnose and fix
1. Return to login; enter password again so mandatory setup restarts.
2. Scan the new QR promptly; enter the 6-digit code.
3. Keep cookies enabled; same browser/IP for the flow.
4. Lost device later: staff Reset user 2FA / sessions.