@@ -0,0 +1,20 @@
+---
+'@objectstack/plugin-auth': patch
+---
+
+fix(plugin-auth)!: a completed password reset ends the account's other sessions, and a reset request answers the same way for any address without waiting on its mail
+
+Clause-②: no (narrowing) — the auth manager refuses an `emailAndPassword.revokeSessionsOnPasswordReset: false` it accepted before, at construction and on every configuration patch. Nothing is widened: no export, route, key or answer is added.
+Metadata-protocol: none
+
+<!-- adr-0087: not-required (no-migration-prescription) No metadata moves: no spec key, authorable spelling, object definition, settings key or stored shape is added, removed, renamed or re-shaped, and no exported declaration changes. `emailAndPassword.revokeSessionsOnPasswordReset` stays declared by `@objectstack/spec`; what changes is which value plugin-auth's own entry validation accepts for the deployment configuration a host hands the plugin in code, so there is nothing for `objectstack migrate meta` to rewrite and no tombstone. The other categories are closed on facts: the package publishes (not unpublished); no ADR-0087 id is named or touched (not registered or already-registered); and nothing exported is removed or narrowed (not runtime-interface-only, type-surface-only or runtime-export-retired). -->
+
+**BREAKING** for a deployment that sets `emailAndPassword.revokeSessionsOnPasswordReset: false` only.
+
+- **A completed password reset ends the account's other sessions.** Every self-service reset door — the emailed link (`POST /api/v1/auth/reset-password`) and the phone OTP reset (`POST /api/v1/auth/phone-number/reset-password`) — ends every existing session of the account when it sets the new password, the same as an administrator's forced reset does. The person who reset the password signs in again with it. It is not a setting.
+- **`revokeSessionsOnPasswordReset: false` is refused.** The auth manager refuses it at construction, which stops the boot, and on a configuration patch, where the standing configuration keeps ruling, with a message naming the key. `true` and an absent key are accepted and change nothing.
+- **A reset request answers the same way for any address, without waiting on its mail.** `POST /api/v1/auth/request-password-reset` answers at once; the reset mail is built and sent after the response. A send that fails is logged on the server, at error, and never changes the answer.
+- **Unchanged.** The answer's status and body; the reset mail's template, locale and recipient; the identity import, whose invitation mail is still awaited and still reported per row when it is not delivered; an administrator's forced reset and its revocation switch.
+- **Who sees it.** A user signed in somewhere else when their password is reset is signed out there. A host whose configuration sets `revokeSessionsOnPasswordReset: false` no longer boots until the key is removed.
+
+**The remedy.** Delete `revokeSessionsOnPasswordReset: false` from the `emailAndPassword` block the host passes the auth plugin; nothing else is needed.
@@ -289,6 +289,10 @@ const response = await fetch('http://localhost:3000/api/v1/auth/request-password
 });
 ```
 
+The request answers `{ status: true }` the same way for any address. The reset
+mail is sent after the response; a send that fails is logged on the server and
+never changes the answer.
+
 #### Reset Password with Token
 
 {/* os:check */}
@@ -303,6 +307,11 @@ const response = await fetch('http://localhost:3000/api/v1/auth/reset-password',
 });
 ```
 
+A completed reset ends every existing session of the account — the emailed link
+and the phone OTP reset alike, the same as an administrator's forced reset — so
+the user signs in again with the new password. It is not a setting:
+`emailAndPassword.revokeSessionsOnPasswordReset: false` is refused at boot.
+
 #### Setting a first local password
 
 `POST /api/v1/auth/set-initial-password` sets an **initial** local password for a
 
@@ -260,7 +260,7 @@ ObjectStack uses [better-auth](https://www.better-auth.com/) via
 | Session TTL       | 7 days                                    | `session.expiresIn` (seconds)             |
 | Access token TTL  | inherited from session                    | configure in better-auth                  |
 | Refresh           | better-auth `/auth/get-session` rolls TTL | `session.updateAge` (seconds)             |
-| Revocation        | DELETE on `session` row                   | `revokeSessionsOnPasswordReset: true`     |
+| Revocation        | DELETE on `session` row; a completed password reset ends every session of the account | — always on (`revokeSessionsOnPasswordReset: false` is refused at boot) |
 | Idle / absolute / concurrent caps | Off (opt-in)              | `session_idle_timeout_minutes` / `session_absolute_max_hours` / `max_concurrent_sessions_per_user` (Setup → Authentication) |
 | Email verify TTL  | 1 hour                                    | `emailVerification.expiresIn`             |
 
@@ -276,8 +276,8 @@ curl -X POST -H "Authorization: Bearer $TOK" $API/auth/sign-out
 curl -H "Authorization: Bearer $TOK" $API/data/account
 # → 401 Unauthorized
 
-# 3. Confirm password reset revokes all other sessions for that user
-#    (requires revokeSessionsOnPasswordReset: true)
+# 3. Confirm a completed password reset ends the user's other sessions
+#    (always on: a session signed in before the reset answers 401 after it)
 ```
 
 ## CORS
@@ -344,7 +344,6 @@ Run the production hardening checklist before each release:
 - [ ] `server.security.rateLimit` enabled with a sized budget; `server.trustProxy`
       matches the topology (`true` only behind a proxy that overwrites
       `X-Forwarded-For`); multi-node: the `cache` service is shared
-- [ ] `revokeSessionsOnPasswordReset: true`
 - [ ] CORS origin list is explicit, not `*`
 - [ ] `enforceProjectMembership: true` on scoped routes
 - [ ] `osv-scanner --lockfile=pnpm-lock.yaml` clean (npm retired the
 
@@ -309,8 +309,11 @@ describe('[#23598] the import reports an invitation the email transport did not
     // address has an account or whether its mail went out.
     expect(throughFailing).toEqual(throughFine);
     expect(throughFailing).toEqual(noAccount);
-    // Both sends really ran, with the reset copy.
-    expect(attempts.filter((m) => m.to.address === failing).map((m) => m.template)).toEqual(['auth.password_reset']);
-    expect(attempts.filter((m) => m.to.address === fine).map((m) => m.template)).toEqual(['auth.password_reset']);
+    // Both sends really ran, with the reset copy — after the response, which
+    // is when the public door sends.
+    await vi.waitFor(() => {
+      expect(attempts.filter((m) => m.to.address === failing).map((m) => m.template)).toEqual(['auth.password_reset']);
+      expect(attempts.filter((m) => m.to.address === fine).map((m) => m.template)).toEqual(['auth.password_reset']);
+    });
   }, 60_000);
 });
@@ -119,6 +119,14 @@ async function boot(locale: string | undefined, extra: Record<string, unknown> =
 
 const USER = { id: 'u1', email: 'ada@example.com', name: 'Ada' };
 
+/**
+ * A reset requested through the public door (a call that carries its
+ * `Request`) is sent after the response, so the drives below wait for it to
+ * land before reading what was sent; a call with no request is awaited inline.
+ */
+const resetSent = (sent: any[]) =>
+  vi.waitFor(() => expect(sent.some((x: any) => x.template === 'auth.password_reset')).toBe(true));
+
 /**
  * Drive all five auth sends and return the recorded `sendTemplate` inputs.
  *
@@ -317,6 +325,7 @@ async function driveWithHeader(
     { user: USER, url: 'http://x/reset', token: 't' },
     request,
   );
+  await resetSent(sent);
   await capturedConfig.emailVerification.sendVerificationEmail(
     { user: USER, url: 'http://x/verify', token: 't' },
     request,
@@ -522,6 +531,7 @@ async function driveResetWith(opts: {
     { user: USER, url: 'http://x/reset', token: 't' },
     request,
   );
+  await resetSent(sent);
   return { sent, reads };
 }
 
@@ -619,6 +629,7 @@ describe('#14762 — sys_user.locale is the top rung of the auth-mail ladder', (
       { user: USER, url: 'http://x/reset', token: 't' },
       new Request('http://x/any', { headers: { 'accept-language': 'zh-CN' } }),
     );
+    await resetSent(sent);
     expect(sent[0].locale).toBe('zh-CN');
   });
 
 
@@ -68,6 +68,7 @@ import {
 import { vendorClientAddressOptions } from './client-address-vendor.js';
 import { PLATFORM_IDP_PROVIDER_ID, refuseImplicitAccountLink } from './implicit-account-linking.js';
 import { isPlaceholderEmail } from './placeholder-email.js';
+import { logAfterResponseSendFailure, sendAfterResponseOnPublicDoor } from './run-after-response.js';
 
 /**
  * The `AuthManager` members the function below reads — every one of them, and
@@ -382,17 +383,28 @@ export async function createAuthInstance(this: AuthInstanceHost): Promise<Auth<a
           ? { resetPasswordTokenExpiresIn: this.config.emailAndPassword.resetPasswordTokenExpiresIn } : {}),
         ...(this.config.emailAndPassword?.autoSignIn != null
           ? { autoSignIn: this.config.emailAndPassword.autoSignIn } : {}),
-        ...(this.config.emailAndPassword?.revokeSessionsOnPasswordReset != null
-          ? { revokeSessionsOnPasswordReset: this.config.emailAndPassword.revokeSessionsOnPasswordReset } : {}),
+        // A completed password reset ends the account's other sessions, on
+        // every reset door, always — not a deployment option. An explicit
+        // `false` never reaches here: the manager refuses it at entry.
+        // `password-reset-ends-sessions.ts` holds the rule and the wiring.
+        revokeSessionsOnPasswordReset: true,
       // #14319 — better-auth calls this as `sendResetPassword(data, ctx.request)`.
       // [#23598] better-auth CATCHES what this callback throws
       // (`runInBackgroundOrAwait`) and still answers `{ status: true }`, so a
       // failed send can never reach the identity import that asked for it.
       // `settleImportResetDelivery` settles the import's own delivery receipt
-      // with the outcome (and re-raises it unchanged); a call that carries a
-      // `Request` — the public door — is handed straight through.
+      // with the outcome (and re-raises it unchanged).
       // `account-invitation-marker.ts` holds the legs that keep it server-only.
-      sendResetPassword: async ({ user, url, token }: { user: { id: string; email: string; name?: string }; url: string; token: string }, request?: unknown) => settleImportResetDelivery(user.email, request, async () => {
+      //
+      // A reset request answers the same way for any address, answers at once
+      // and does not wait on the send: a call that carries a `Request` — the
+      // public door — resolves immediately, and the mail is built and sent
+      // after the response
+      // (`sendAfterResponseOnPublicDoor`); what the send does is logged on
+      // the server and never reaches the caller. The identity import's own
+      // server-side call (no `Request`) still awaits its send, because it
+      // reads the delivery receipt the send settles.
+      sendResetPassword: sendAfterResponseOnPublicDoor(async ({ user, url, token }: { user: { id: string; email: string; name?: string }; url: string; token: string }, request?: unknown) => settleImportResetDelivery(user.email, request, async () => {
         // #2766 V1.5 — placeholder addresses (phone-only users) are never
         // real recipients. Refuse loudly instead of "sending" into the void;
         // the reset path for these users is phone sign-in / an admin
@@ -488,7 +500,7 @@ export async function createAuthInstance(this: AuthInstanceHost): Promise<Auth<a
             `${invitation ? 'Account-invitation' : 'Password-reset'} email could not be sent to ${user.email}: ${result.error ?? 'delivery failed'}`,
           );
         }
-      }),
+      }), (error) => logAfterResponseSendFailure(this.config.logger, 'password-reset', error)),
       // [#25060, ruling 1B on #25040] The mail half of "a sign-up for an
       // address that already has an account answers like a success". The
       // vendor calls this only when the address already has a row AND its
 
@@ -80,6 +80,7 @@ import {
 } from './reconcile-membership.js';
 import type { TenancyService } from './tenancy-service.js';
 import { OtpSendGuard, assertOtpCooldownSeconds } from './otp-send-guard.js';
+import { assertPasswordResetEndsSessions } from './password-reset-ends-sessions.js';
 import type { CounterStore } from './rate-limit-storage.js';
 import {
   applyUserBan,
@@ -1604,6 +1605,12 @@ export class AuthManager {
     // appear after boot.
     assertScimAdminCoherence(config.plugins);
 
+    // A completed password reset ends the account's other sessions, always;
+    // an explicit `revokeSessionsOnPasswordReset: false` is refused here, at
+    // boot, rather than silently overridden (`password-reset-ends-sessions.ts`).
+    // `applyConfigPatch` re-runs it on the merged result.
+    assertPasswordResetEndsSessions(config.emailAndPassword);
+
     // The mobile sign-in hand-off's registered app schemes — same
     // boot-loudly rationale: an entry that is not a reverse-domain app scheme
     // is refused here, never dropped (`one-time-token-handoff.ts`).
@@ -2075,6 +2082,12 @@ export class AuthManager {
     if ('plugins' in patch) {
       assertScimAdminCoherence(next.plugins);
     }
+    // Same entry validation the constructor runs, on the MERGED block: a patch
+    // cannot ask a completed password reset to keep the account's other
+    // sessions. Refused loudly and the standing config keeps ruling.
+    if ('emailAndPassword' in patch) {
+      assertPasswordResetEndsSessions(next.emailAndPassword);
+    }
     if ('trustedAppSchemes' in patch) {
       assertTrustedAppSchemes(next.trustedAppSchemes);
     }
 
@@ -79,6 +79,8 @@ async function driveAuthMail(tenancy: Tenancy) {
     { user: USER, url: 'http://x/reset', token: 't' },
     new Request('http://x/api/v1/auth/request-password-reset'),
   );
+  // The public door sends the reset mail after the response.
+  await vi.waitFor(() => expect(sent.some((s) => s.template === 'auth.password_reset')).toBe(true));
   await config.emailVerification.sendVerificationEmail({ user: USER, url: 'http://x/verify', token: 't' });
   await config.plugins.find((p: any) => p.id === 'magic-link')._opts.sendMagicLink({
     email: USER.email, url: 'http://x/magic', token: 't',