{
  "task": "SECRETS-WP-0010-T03",
  "supersedes": "2026-09-16-review-fresh-authentication.json",
  "finding": "Authelia 4.38 rejects prompt=login even after fresh login: at 23:48:28 auth_time 23:48:27 precedes request 23:48:27.926758234. Upstream issue 2596 implements support in 4.39. Prior forced-login change introduced a production regression.",
  "source": "https://github.com/authelia/authelia/issues/2596",
  "action": "Restore prior working image with memo-input fix. Remove incompatible prompt/max_age from review login. Do not relax MFA age policy.",
  "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:ef6fdd61209863654be3adba070661645a2714e86cb4b7f4e847540291b55f07",
  "remaining": "Automated fresh sign-in requires a separately validated Authelia upgrade including changed ID-token claims behavior. Native human review retry remains necessary."
}