A package update rewrites the PAM stack include order, and MFA still prompts but account validation now happens after the wrong module

Authentication appears normal until edge-case users begin failing account checks after successful factors.