# Wetech Login Attempt Limit

<!-- auto-oncall-optimization-record
{
  "schemaVersion": "auto-oncall-optimization-record-v1",
  "optimizationId": "wetech-login-attempt-limit-2026-09-02",
  "problems": [
    {
      "problemId": "managed-wetech-repeated-login-lockout",
      "summary": "Managed Wetech repeatedly submitted the same P81 credentials while a login page remained visible, turning one unavailable login into enough consecutive attempts to lock the shared account.",
      "status": "candidate",
      "applicability": "Agent9-backed Wetech OP evidence acquisition that must refresh P81, Grafana, or Dashboard browser authentication.",
      "issueKeys": ["APID-29438"],
      "sourceRefs": ["https://tidb.atlassian.net/browse/APID-29438#problem:managed-wetech-repeated-login-lockout"],
      "signalTextIncludesAny": [
        "grafana_session_not_ready",
        "account has been blocked after multiple consecutive login attempts"
      ],
      "observedThrough": "2026-09-02",
      "effectiveAt": null,
      "verifiedAt": null,
      "attemptedAction": "Submit each P81, TOTP, Grafana, and Dashboard credential step at most once in one browser session, stop immediately on the observed P81 account-blocked page, and return a safe specific Provider error code.",
      "evidenceUrl": "https://tidb.atlassian.net/browse/APID-29438"
    }
  ]
}
-->

- Owner: Wetech Managed Tool Provider Executor
- Source: APID-29438 v10 read replay and exact-target browser canary
- Implementation status: local candidate for Wetech Managed Tool v11
- Effective status: `candidate`

## Bounded problem

The v10 Tool accepted the exact Middle East `SaaS` target and loaded its Drive9
browser state, but timed out while establishing the Grafana session. A bounded
local reproduction using the current Kubernetes-secret-backed credentials ended
on a P81 page stating that the shared account had been blocked after multiple
consecutive login attempts. The browser loop could resubmit the same visible
credential form throughout its login deadline.

## Intended change

- Allow each P81 password, P81 TOTP, Grafana password, and Dashboard password
  form to be submitted only once during one Tool browser session.
- If the same form remains visible, wait for the session deadline without
  submitting again.
- Detect the exact observed P81 blocked-account message before any further form
  action and return `p81_account_blocked` without exposing page text or values.

## Next validation action

After the shared P81 account is unlocked and its current password is confirmed,
publish and install v11, run one fixed-argument Middle East `SaaS` canary, then
use the preserved APID-29438 read replay only after that canary succeeds.