You'll notice
Sign-in errors now tell apart a stale callback URL from one that's simply missing an authorization code
What
Error messages shown during OAuth device or browser sign-in were rewritten to detect a specific case: when a pasted callback URL actually belongs to a different, unrelated sign-in attempt (called a state mismatch), rather than just lacking an authorization code. In that case, the message now tells the user to retry using the URL from the specific sign-in flow that's still open.
Why
This gives a clearer, more actionable error message when a sign-in fails because the wrong callback URL was pasted, instead of a generic missing-code error that wouldn't point to the actual problem.