A stack uses a Secrets Manager dynamic reference. The database secret rotates after deployment, but an application configuration value is not refreshed. Which assumption should be corrected?

1. A dynamic reference does not guarantee every consuming resource refreshes automatically on secret rotation; use a rotation-aware retrieval or update strategy.
2. A dynamic reference permanently disables all secret rotation.
3. The secret ARN is the new database password after rotation.
4. Renaming the stack output automatically forces every application to reload secrets.