key-cape/docs/evidence/2026-09-24-fresh-login-and-account-switch.md

Fresh login and account switch — 2026-09-24

Issuer image already running: forgejo.coulomb.social/coulomb/key-cape@sha256:8dc35801d1d2b0905a43530c40b1fed0107fc179141fe5b2b614c52c01714fc9 (Forgejo image run 69, source 11ce29a). No further rollout was made.

The founder completed the browser journeys and reported that both worked. Issuer telemetry for 23:40–23:46 UTC, event type and client only:

Time	Event	Client	Result
23:42:25	mfa_failed	user-engine-portal	failure
23:43:20	auth_success then token_issued	user-engine-portal	success
23:44:45	auth_success then token_issued	user-engine-portal	success
23:45:37	auth_success then token_issued	user-engine-portal	success
23:46:10	token_exchange_error, then auth_failed	vergabe-demo-company	failure
23:46:38	auth_success then token_issued	vergabe-demo-company	success

No stale_upstream_authentication in the window. Each portal success was a new auth_start, so the earlier session was not silently reused. The Vergabe token was issued after one failed code exchange, on a second attempt. Already issued application JWTs are not revoked by provider logout.