# Fresh login and account switch — 2026-09-24

Issuer image already running:
`forgejo.coulomb.social/coulomb/key-cape@sha256:8dc35801d1d2b0905a43530c40b1fed0107fc179141fe5b2b614c52c01714fc9`
(Forgejo image run 69, source `11ce29a`). No further rollout was made.

The founder completed the browser journeys and reported that both worked.
Issuer telemetry for 23:40–23:46 UTC, event type and client only:

| Time | Event | Client | Result |
|---|---|---|---|
| 23:42:25 | `mfa_failed` | `user-engine-portal` | failure |
| 23:43:20 | `auth_success` then `token_issued` | `user-engine-portal` | success |
| 23:44:45 | `auth_success` then `token_issued` | `user-engine-portal` | success |
| 23:45:37 | `auth_success` then `token_issued` | `user-engine-portal` | success |
| 23:46:10 | `token_exchange_error`, then `auth_failed` | `vergabe-demo-company` | failure |
| 23:46:38 | `auth_success` then `token_issued` | `vergabe-demo-company` | success |

No `stale_upstream_authentication` in the window. Each portal success was a new
`auth_start`, so the earlier session was not silently reused. The Vergabe
token was issued after one failed code exchange, on a second attempt. Already
issued application JWTs are not revoked by provider logout.