PEAP/MSCHAP doesn't run post-auth in inner-tunnel for reject?

Am I being dumb / getting something wrong or does the post-auth session not get called if PEAP/MSCHAP returns a reject? It seems to run for successful auths, but not failures. This is in the context of us not seeing log messages for EAP auth failures; I suspect that the client may just "hang up" and let the EAP session expire, and since the inner post-auth doesn't run, and the outer session expires, I have no logs. This is in 2.1.12