I got some details wrong; in particular, the initial dispute denial was after two months (with the Consumer Financial Protection Bureau agreeing with the bank after another two months), and the resolution followed NJ Advance Media contacting BofA.