@@ -0,0 +1,19 @@
+---
+'@objectstack/plugin-auth': patch
+'@objectstack/spec': patch
+---
+
+fix(plugin-auth): an auth request is judged and executed as one account
+
+Clause-②: yes
+Metadata-protocol: none
+
+A request whose session cookie and bearer token name two different signed-in accounts is refused before anything runs, with `401 CREDENTIALS_NAME_DIFFERENT_ACCOUNTS`, and nothing is read or written for either account. It applies to every better-auth endpoint (over HTTP and to the in-process session read every data door makes) and to the raw ObjectStack routes on the identity mount. One credential alone, two credentials that name the same account (two sessions of one user included), and a credential that names no signed-in account are unaffected. An API key is not a session credential for this rule; each door keeps its existing one-principal rule for keys. A session read that cannot answer refuses too, as an outage (`503 SERVICE_UNAVAILABLE`), and so does the identity mount when the judgment cannot be reached at all.
+
+`CREDENTIALS_NAME_DIFFERENT_ACCOUNTS` is registered in the `@objectstack/spec` error-code ledger under `@objectstack/plugin-auth`.
+
+A successful `/change-password` stamps `password_changed_at`, clears an administrator's forced change and appends the history entry on the account the change acted on, and only when the password checks before it ran for that account; otherwise none of them lands, and the operator is told.
+
+`/admin/revoke-user-session` refuses a token that identifies no session (`404 RESOURCE_NOT_FOUND`) for a caller signed in by bearer alone, as it already did on the cookie lane.
+
+The Console needs no change: its session read already treats any refused read as a stale token, retrying with the cookie alone and dropping the token.
@@ -417,7 +417,7 @@ const result = AutomationApiErrorCode.parse(data);
 
 | Property | Type | Required | Description |
 | :--- | :--- | :--- | :--- |
-| **code** | `Enum<'VALIDATION_ERROR' \| 'INVALID_FIELD' \| 'MISSING_REQUIRED_FIELD' \| 'INVALID_FORMAT' \| 'VALUE_TOO_LONG' \| 'VALUE_TOO_SHORT' \| 'VALUE_OUT_OF_RANGE' \| … +363 more>` | ✅ | The inner refusal's code in its WIRE spelling - the ADR-0112 member a record save of the same write answers in `error.code` (e.g. `UNIQUE_VIOLATION`); the closed set `ApiErrorSchema.code` parses against |
+| **code** | `Enum<'VALIDATION_ERROR' \| 'INVALID_FIELD' \| 'MISSING_REQUIRED_FIELD' \| 'INVALID_FORMAT' \| 'VALUE_TOO_LONG' \| 'VALUE_TOO_SHORT' \| 'VALUE_OUT_OF_RANGE' \| … +364 more>` | ✅ | The inner refusal's code in its WIRE spelling - the ADR-0112 member a record save of the same write answers in `error.code` (e.g. `UNIQUE_VIOLATION`); the closed set `ApiErrorSchema.code` parses against |
 | **message** | `string` | ✅ | The inner refusal's own diagnostic text, verbatim, without the node and operation prefixes the run's failure text adds |
 
 ### Allowed Values: `FlowInnerRefusal.code`
@@ -520,6 +520,7 @@ const result = AutomationApiErrorCode.parse(data);
 * `CONNECTOR_UPSTREAM_CHANGED`
 * `CONNECTOR_UPSTREAM_UNAVAILABLE`
 * `CREATE_FAILED`
+* `CREDENTIALS_NAME_DIFFERENT_ACCOUNTS`
 * `CUBE_NOT_FOUND`
 * `DATASET_INVALID`
 * `DATASOURCE_ADMIN_ERROR`
 
@@ -28,7 +28,7 @@ const result = ApiErrorSchema.parse(data);
 
 | Property | Type | Required | Description |
 | :--- | :--- | :--- | :--- |
-| **code** | `Enum<'VALIDATION_ERROR' \| 'INVALID_FIELD' \| 'MISSING_REQUIRED_FIELD' \| 'INVALID_FORMAT' \| 'VALUE_TOO_LONG' \| 'VALUE_TOO_SHORT' \| 'VALUE_OUT_OF_RANGE' \| … +363 more>` | ✅ | Error code (e.g. VALIDATION_ERROR; StandardErrorCode ∪ the ledger the serving side registers — ERROR_CODE_LEDGER for framework packages) |
+| **code** | `Enum<'VALIDATION_ERROR' \| 'INVALID_FIELD' \| 'MISSING_REQUIRED_FIELD' \| 'INVALID_FORMAT' \| 'VALUE_TOO_LONG' \| 'VALUE_TOO_SHORT' \| 'VALUE_OUT_OF_RANGE' \| … +364 more>` | ✅ | Error code (e.g. VALIDATION_ERROR; StandardErrorCode ∪ the ledger the serving side registers — ERROR_CODE_LEDGER for framework packages) |
 | **declaredCode** | `string` | optional | The producer-declared code, verbatim, when it is not a member of the closed `code` vocabulary — the open, author-authored channel (app-specific spellings; ADR-0112) |
 | **message** | `string` | ✅ | Readable error message |
 | **userMessage** | `string` | optional | Producer-marked user-facing refusal text, verbatim. Present exactly when the producer opted in at throw time; consumers render it to end users and keep their generic substitution for anything unmarked. Status-agnostic; never replaces `message`. |
@@ -138,6 +138,7 @@ const result = ApiErrorSchema.parse(data);
 * `CONNECTOR_UPSTREAM_CHANGED`
 * `CONNECTOR_UPSTREAM_UNAVAILABLE`
 * `CREATE_FAILED`
+* `CREDENTIALS_NAME_DIFFERENT_ACCOUNTS`
 * `CUBE_NOT_FOUND`
 * `DATASET_INVALID`
 * `DATASOURCE_ADMIN_ERROR`
 
@@ -305,6 +305,7 @@ const result = ErrorCode.parse(data);
 * `CONNECTOR_UPSTREAM_CHANGED`
 * `CONNECTOR_UPSTREAM_UNAVAILABLE`
 * `CREATE_FAILED`
+* `CREDENTIALS_NAME_DIFFERENT_ACCOUNTS`
 * `CUBE_NOT_FOUND`
 * `DATASET_INVALID`
 * `DATASOURCE_ADMIN_ERROR`
 
@@ -326,6 +326,64 @@ describe('#10069 — /admin/revoke-user-session refuses when the token identifie
   });
 });
 
+// ───────────────────────────────────────────────────────────────────────────
+/**
+ * The bearer lane. The global before-hook runs before better-auth folds an
+ * `Authorization: Bearer` token into the session cookie, so the guard resolves
+ * a caller signed in by bearer alone through the shared actor resolver, and
+ * grades the role stored on that user. Same answers as the cookie lane.
+ */
+describe('/admin/revoke-user-session judges a caller signed in by bearer alone as it judges the cookie lane', () => {
+  const bearerFrom = (response: Response): string => response.headers.get('set-auth-token') ?? '';
+  const revokeByBearer = (manager: AuthManager, bearer: string, sessionToken: unknown) =>
+    manager.handleRequest(
+      new Request(`${BASE}/admin/revoke-user-session`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', authorization: `Bearer ${bearer}` },
+        body: JSON.stringify({ sessionToken }),
+      }),
+    );
+  const seedBearer = async () => {
+    const seeded = await seed();
+    const adminBearer = bearerFrom(await signIn(seeded.manager, 'admin@example.com'));
+    expect(adminBearer, 'sign-in must hand out a bearer').not.toBe('');
+    return { ...seeded, adminBearer };
+  };
+
+  it('a token matching ZERO rows answers 404 with code AND status', async () => {
+    const { engine, manager, targetRow, adminBearer } = await seedBearer();
+
+    const res = await revokeByBearer(manager, adminBearer, 'no-such-token-anywhere');
+    const body: any = await res.json();
+    expect(res.status).toBe(404);
+    expect(body?.code).toBe(ADMIN_REVOKE_USER_SESSION_NOT_FOUND_CODE);
+    expect(body?.success).not.toBe(true);
+    expect(sessionRows(engine).find((r) => r.id === targetRow.id)?.revoked_at).toBeUndefined();
+  });
+
+  it("an admitted revoke still succeeds — an admin revoking an arbitrary user's session", async () => {
+    const { engine, manager, targetCookie, targetRow, adminBearer } = await seedBearer();
+
+    const res = await revokeByBearer(manager, adminBearer, targetRow.token);
+    expect(res.status, await res.clone().text()).toBe(200);
+    expect(await res.json()).toHaveProperty('success', true);
+    expect(sessionRows(engine).find((r) => r.id === targetRow.id)?.revoke_reason).toBe('admin');
+    expect(await isAuthenticated(manager, targetCookie)).toBe(false);
+  });
+
+  it('a NON-ADMIN caller keeps the vendor 403 for missing and live tokens alike', async () => {
+    const { manager, targetRow } = await seedBearer();
+    const plainBearer = bearerFrom(await signUp(manager, 'plain-bearer@example.com'));
+    expect(plainBearer).not.toBe('');
+
+    const missing = await revokeByBearer(manager, plainBearer, 'no-such-token-anywhere');
+    const live = await revokeByBearer(manager, plainBearer, targetRow.token);
+    expect(missing.status).toBe(403);
+    expect(live.status).toBe(403);
+    expect(await missing.text()).toBe(await live.text());
+  });
+});
+
 // ───────────────────────────────────────────────────────────────────────────
 describe('adminMayRevokeUserSessions — the vendor permission question, vendor inputs', () => {
   const admin = { id: 'u_1', role: 'admin' };
 
@@ -26,7 +26,7 @@
  * caller awaits the same promise the body settles, with no extra wrapper. A
  * method is handed over as a closure that calls it on the manager at call
  * time, so a test double or spy set on the manager is still the one the body
- * reaches — `resolveActor` included, which three of the guards ask through
+ * reaches — `resolveActor` included, which four of the guards ask through
  * the manager rather than calling the function here directly.
  *
  * Each field was checked on its own: `orgRolesMap` and
@@ -463,7 +463,7 @@ export async function assertRevokeSessionIdentifiesRecord(this: Pick<ActorGuardH
 }
 
 /** The body of `AuthManager#assertAdminRevokeUserSessionIdentifiesRecord`; the method's docblock there is its contract. */
-export async function assertAdminRevokeUserSessionIdentifiesRecord(ctx: any): Promise<void> {
+export async function assertAdminRevokeUserSessionIdentifiesRecord(this: Pick<ActorGuardHost, 'resolveActor'>, ctx: any): Promise<void> {
   const token = ctx?.body?.sessionToken;
   if (typeof token !== 'string') return; // vendor's body schema answers 400
 
@@ -474,8 +474,19 @@ export async function assertAdminRevokeUserSessionIdentifiesRecord(ctx: any): Pr
     // a demoted caller the vendor is about to refuse).
     const { getAuthoritativeSessionFromCtx } = await import('better-auth/api');
     const s: any = await getAuthoritativeSessionFromCtx(ctx).catch(() => null);
+    let caller: any = s?.user;
+    // The bearer lane: this hook runs before better-auth folds an
+    // `Authorization: Bearer` token into the session cookie, so the read
+    // above sees no session for a caller signed in by bearer alone. The
+    // caller is then the user the shared actor resolver names, read back
+    // from the store (`findUserById`), so the role graded below is the
+    // stored one, as on the cookie lane.
+    if (!caller?.id) {
+      const actor = await this.resolveActor(ctx);
+      if (actor?.userId) caller = await ctx.context.internalAdapter.findUserById(actor.userId);
+    }
     // No resolvable caller → the vendor's adminMiddleware issues the 401.
-    if (!s?.user?.id) return;
+    if (!caller?.id) return;
 
     // The vendor's own permission question, with the vendor's own inputs:
     // the LIVE admin-plugin options (the object the mounted plugin retains)
@@ -485,7 +496,7 @@ export async function assertAdminRevokeUserSessionIdentifiesRecord(ctx: any): Pr
       (p: any) => p?.id === 'admin',
     )?.options;
     const { defaultRoles } = await import('better-auth/plugins/admin/access');
-    if (!adminMayRevokeUserSessions(s.user, adminOptions, defaultRoles as any)) return;
+    if (!adminMayRevokeUserSessions(caller, adminOptions, defaultRoles as any)) return;
 
     const found = await ctx.context.internalAdapter.findSession(token);
     admitted = anySessionCarriesToken(found);
 
@@ -67,6 +67,7 @@ export interface AfterHookHost {
   enforceConcurrentCap: AuthManager['enforceConcurrentCap'];
   externalDirectoryDoorDeps: AuthManager['externalDirectoryDoorDeps'];
   isEmailDeliveryLive: AuthManager['isEmailDeliveryLive'];
+  logDurabilityDegradation: AuthManager['logDurabilityDegradation'];
   recordPasswordHistory: AuthManager['recordPasswordHistory'];
   roleChangeGrantDeps: AuthManager['roleChangeGrantDeps'];
   sendChangeEmailNotice: AuthManager['sendChangeEmailNotice'];
@@ -90,6 +91,38 @@ function changeEmailFrom(user: unknown): { email: string; name?: string; id?: st
   };
 }
 
+/**
+ * The user of the session the endpoint acted on, as better-auth's session
+ * middleware recorded it on `ctx.context.session` before the handler ran.
+ */
+function actingUserIdOf(ctx: any): string | undefined {
+  const id: unknown = ctx?.context?.session?.user?.id;
+  return typeof id === 'string' && id !== '' ? id : undefined;
+}
+
+/**
+ * ADR-0069 D1 — the account a successful password change's after-effects
+ * (the `password_changed_at` stamp, the forced-change flag it clears, the
+ * history entry) land on, or `undefined` when they land on none.
+ *
+ * `/change-password`: the account the endpoint acted on
+ * ({@link actingUserIdOf}), and only when the before-hook's password checks
+ * ran for that same account (`__osPwChangeUserId`, stashed beside them). A
+ * clear of the forced-change flag is the verdict those checks gate, so an
+ * account they did not judge is given none of it, and no account but the one
+ * changed is ever stamped.
+ *
+ * `/reset-password`: no session is involved; the account is the reset
+ * token's, which the before-hook resolved, as before.
+ */
+function passwordChangeAfterEffectsAccount(ctx: any): string | undefined {
+  const checkedFor: unknown = ctx?.context?.__osPwChangeUserId;
+  const checked = typeof checkedFor === 'string' && checkedFor !== '' ? checkedFor : undefined;
+  if (ctx?.path !== '/change-password') return checked;
+  const acting = actingUserIdOf(ctx);
+  return acting !== undefined && acting === checked ? acting : undefined;
+}
+
 /**
  * better-auth's admin plugin refuses a banned user's new session with this
  * code, from its `session.create.before` hook (`ADMIN_ERROR_CODES.BANNED_USER`
@@ -251,6 +284,15 @@ export async function globalAfterHook(this: AfterHookHost, ctx: any) {
 
   // ── ADR-0069 D1: on a successful change/reset — stamp
   //    password_changed_at (expiry) and commit password history.
+  //
+  // Every after-effect lands on ONE account, read by
+  // `passwordChangeAfterEffectsAccount`: on `/change-password` the account
+  // the endpoint itself acted on — the session better-auth's
+  // `sensitiveSessionMiddleware` recorded on `ctx.context.session` before
+  // the handler ran, the reading the change-email notice below takes — and
+  // only when the before-hook's reuse and forced-change checks ran for that
+  // same account. The history entry is the old hash those checks read, so it
+  // is appended only to the account it was read from.
   if (ctx?.path === '/change-password' || ctx?.path === '/reset-password') {
     let succeeded: boolean;
     try {
@@ -260,10 +302,27 @@ export async function globalAfterHook(this: AfterHookHost, ctx: any) {
       succeeded = !(ctx?.context?.returned instanceof Error);
     }
     if (succeeded) {
-      const stampId = ctx?.context?.__osPwChangeUserId;
-      if (stampId) await this.stampPasswordChangedAt(stampId);
-      const stash = ctx?.context?.__osPwHistory;
-      if (stash?.userId) await this.recordPasswordHistory(stash.userId, stash.oldHash);
+      const stampId = passwordChangeAfterEffectsAccount(ctx);
+      if (stampId) {
+        await this.stampPasswordChangedAt(stampId);
+        const stash = ctx?.context?.__osPwHistory;
+        if (stash?.userId === stampId) await this.recordPasswordHistory(stash.userId, stash.oldHash);
+      } else if (ctx?.path === '/change-password' && actingUserIdOf(ctx)) {
+        // The password changed, but the checks that gate these writes never
+        // judged the account it changed on: nothing is stamped, so a forced
+        // change stays outstanding and the user is asked again (the safe
+        // direction), and the operator is told, here.
+        this.logDurabilityDegradation(
+          'AuthManager: a password change succeeded, but its password_changed_at stamp, the '
+            + 'must_change_password clear and the history entry were NOT written: the password '
+            + 'checks before it (reuse, forced change) did not run for the account it changed. '
+            + 'The new password works; any forced change stays outstanding, so the user is asked '
+            + 'to change it again at the next sign-in, and the password-age clock keeps its old '
+            + 'start. Remedy: none needed per request; the next change whose checks run re-stamps.',
+          new Error('password checks did not run for the acting account'),
+          { object: 'sys_user', fields: ['password_changed_at', 'must_change_password'] },
+        );
+      }
     }
     delete ctx.context.__osPwChangeUserId;
     delete ctx.context.__osPwHistory;
 
@@ -158,6 +158,7 @@ export interface AuthInstanceHost {
   isPlatformAdminUserId: AuthManager['isPlatformAdminUserId'];
   isSsoWired: AuthManager['isSsoWired'];
   linkingContext: AuthManager['linkingContext'];
+  logDurabilityDegradation: AuthManager['logDurabilityDegradation'];
   recordPasswordHistory: AuthManager['recordPasswordHistory'];
   resolveActor: AuthManager['resolveActor'];
   resolveAuthSecret: AuthManager['resolveAuthSecret'];
@@ -823,6 +824,7 @@ export async function createAuthInstance(this: AuthInstanceHost): Promise<Auth<a
           enforceConcurrentCap: (...a) => this.enforceConcurrentCap(...a),
           externalDirectoryDoorDeps: (...a) => this.externalDirectoryDoorDeps(...a),
           isEmailDeliveryLive: (...a) => this.isEmailDeliveryLive(...a),
+          logDurabilityDegradation: (...a) => this.logDurabilityDegradation(...a),
           recordPasswordHistory: (...a) => this.recordPasswordHistory(...a),
           roleChangeGrantDeps: (...a) => this.roleChangeGrantDeps(...a),
           sendChangeEmailNotice: (...a) => this.sendChangeEmailNotice(...a),
 
@@ -69,6 +69,7 @@ import {
   LAST_LOCAL_CREDENTIAL_CODE,
   LAST_LOCAL_CREDENTIAL_MESSAGE,
 } from './last-local-credential.js';
+import { refuseRequestNamingDifferentAccounts } from './one-account-per-request.js';
 import { ORGANIZATION_DELETE_PATH } from './organization-delete.js';
 import { carriesPrincipalSession } from './principal-session-mint.js';
 import { SSO_PROVIDER_DELETE_PATH } from './sign-in-method-floor.js';
@@ -150,6 +151,17 @@ export async function globalBeforeHook(
   // `principal-session-mint.ts` (3b).
   if (carriesPrincipalSession(ctx)) await setShouldSkipSessionRefresh(true);
 
+  // ── An auth request is judged and executed as one account ────────
+  // AHEAD OF EVERY GATE BELOW, and of the endpoint: a request whose
+  // session cookie and bearer token name two different signed-in
+  // accounts is refused here (401 CREDENTIALS_NAME_DIFFERENT_ACCOUNTS),
+  // so every gate that follows, every after-effect and the endpoint
+  // itself see one account or none. One credential, one account, or a
+  // credential that names nobody passes untouched. The two steps above
+  // read nothing, so they keep their place. `one-account-per-request.ts`
+  // states the rule and how each credential is read.
+  await refuseRequestNamingDifferentAccounts(ctx);
+
   // ── #2780: per-number OTP send guard (admission control) ─────
   // MUST run BEFORE the phone-number endpoints: better-auth's
   // send-otp handler stores a fresh code and only THEN invokes