@@ -0,0 +1,157 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [#25096] A session lookup the store cannot answer is a FAILURE, never a
+ * signed-out caller.
+ *
+ * plugin-auth mounts better-auth's `customSession` whenever a data engine is
+ * configured, so `GET /get-session` and every in-process `api.getSession` run
+ * its override. Up to 1.7.7 that override caught whatever the inner session
+ * read threw and answered `null`, so a store outage read exactly like "nobody
+ * is signed in": over HTTP `anonymous-session-refusal.ts` then turned that
+ * `null` into its 401 `UNAUTHENTICATED`, telling a signed-in browser to sign in
+ * again. From 1.7.8 (better-auth/better-auth#11391) the override lets the
+ * read's error through, so the store failure reaches the caller as
+ * better-auth's own 500 `FAILED_TO_GET_SESSION`, which that seam passes
+ * through untouched (it converts a `200` + `null` only).
+ *
+ * That is the right answer for this platform (AGENTS.md, "Absence must be
+ * loud" and the degradation-log-level rule): a failure the caller is told
+ * about is not a silent degradation, and the browser can tell "retry later"
+ * from "sign in again". The in-process callers that want the old reading keep
+ * it on purpose: `resolveSessionData` (runtime) and `resolveRequestExecutionContext`
+ * (core) catch the throw themselves and treat the request as anonymous.
+ *
+ * Real stack: `ObjectQL` over `@objectstack/driver-sql` + better-sqlite3, the
+ * objects from this plugin's manifest and a real `AuthManager`. The fault is
+ * injected at the engine, on the `sys_session` reads alone, after the sign-up
+ * wrote the session, so every other read the request makes is the real one.
+ *
+ * Pinned:
+ *  - the store failure answers 500 `FAILED_TO_GET_SESSION` over HTTP and
+ *    rejects the in-process read, and it does not clear the session cookie;
+ *  - the two controls the failure must stay distinguishable from: the healthy
+ *    store answers the session, and a token the store does not hold is signed
+ *    out (401 `UNAUTHENTICATED` over HTTP, `null` in process).
+ */
+
+import { describe, it, expect, afterEach, vi } from 'vitest';
+import { ObjectQL } from '@objectstack/objectql';
+import { SqlDriver } from '@objectstack/driver-sql';
+import { AuthManager } from './auth-manager.js';
+import { authIdentityObjects } from './manifest.js';
+
+const BASE = 'http://localhost:3000';
+const AUTH = `${BASE}/api/v1/auth`;
+const SECRET = 'test-secret-at-least-32-chars-long-25096';
+const PASSWORD = 'S3cure!Passw0rd-25096';
+const SESSION_OBJECT = 'sys_session';
+
+const engines: ObjectQL[] = [];
+afterEach(async () => {
+  vi.restoreAllMocks();
+  while (engines.length) {
+    try { await engines.pop()!.destroy(); } catch { /* noop */ }
+  }
+});
+
+async function bootEngine(): Promise<ObjectQL> {
+  const engine = new ObjectQL();
+  engines.push(engine);
+  engine.registerDriver(new SqlDriver({ client: 'better-sqlite3', connection: { filename: ':memory:' }, useNullAsDefault: true }), true);
+  await engine.init();
+  for (const object of authIdentityObjects) engine.registry.registerObject(object as never, '@objectstack/plugin-auth');
+  await engine.syncSchemas();
+  return engine;
+}
+
+const cookieFrom = (response: Response): string =>
+  (response.headers.getSetCookie?.() ?? [response.headers.get('set-cookie') ?? ''])
+    .map((c) => c.split(';')[0])
+    .filter(Boolean)
+    .join('; ');
+
+const getSession = (manager: AuthManager, cookie: string) =>
+  manager.handleRequest(new Request(`${AUTH}/get-session`, { headers: { cookie } }));
+
+/** A signed-up user's session cookie, on a manager over a real engine. */
+async function signedIn(): Promise<{ engine: ObjectQL; manager: AuthManager; cookie: string }> {
+  const engine = await bootEngine();
+  const manager = new AuthManager({ secret: SECRET, baseUrl: BASE, dataEngine: engine as never } as never);
+  const signedUp = await manager.handleRequest(new Request(`${AUTH}/sign-up/email`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', origin: BASE },
+    body: JSON.stringify({ email: 'reader@example.com', password: PASSWORD, name: 'Reader' }),
+  }));
+  expect(signedUp.status, await signedUp.clone().text()).toBe(200);
+  const cookie = cookieFrom(signedUp);
+  expect(cookie, 'the sign-up set a session cookie').toMatch(/session_token=/);
+  return { engine, manager, cookie };
+}
+
+/** Every engine read of `sys_session` throws from here on; every other read is the real one. */
+function failSessionStore(engine: ObjectQL): { attempts: () => number } {
+  let attempts = 0;
+  const target = engine as unknown as Record<'find' | 'findOne', (object: string, ...rest: unknown[]) => Promise<unknown>>;
+  for (const method of ['find', 'findOne'] as const) {
+    const real = target[method].bind(engine);
+    vi.spyOn(target, method).mockImplementation(async (object: string, ...rest: unknown[]) => {
+      if (object === SESSION_OBJECT) {
+        attempts += 1;
+        throw new Error('session store unavailable (injected)');
+      }
+      return real(object, ...rest);
+    });
+  }
+  return { attempts: () => attempts };
+}
+
+describe('[#25096] a session lookup the store cannot answer is a failure, never a signed-out caller', () => {
+  it('CONTROL: the healthy store answers the signed-in session', async () => {
+    const { manager, cookie } = await signedIn();
+    const res = await getSession(manager, cookie);
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { user?: { email?: string } } | null;
+    expect(body?.user?.email).toBe('reader@example.com');
+  });
+
+  it('CONTROL: a token the store does not hold is signed out, 401 UNAUTHENTICATED over HTTP and null in process', async () => {
+    const { manager } = await signedIn();
+    const stranger = 'better-auth.session_token=not-a-session-the-store-holds.sig';
+    const res = await getSession(manager, stranger);
+    const text = await res.clone().text();
+    expect(res.status, text).toBe(401);
+    expect(JSON.stringify(JSON.parse(text))).toContain('UNAUTHENTICATED');
+    const api = await manager.getApi();
+    expect(await api.getSession({ headers: new Headers({ cookie: stranger }) } as never)).toBeNull();
+  });
+
+  it('over HTTP: the store failure answers 500 FAILED_TO_GET_SESSION and keeps the session cookie', async () => {
+    vi.spyOn(console, 'error').mockImplementation(() => {});
+    const { engine, manager, cookie } = await signedIn();
+    const fault = failSessionStore(engine);
+
+    const res = await getSession(manager, cookie);
+
+    expect(fault.attempts(), 'the request really reached the session store').toBeGreaterThan(0);
+    const text = await res.clone().text();
+    expect(res.status, text).toBe(500);
+    expect((JSON.parse(text) as { code?: string }).code).toBe('FAILED_TO_GET_SESSION');
+    // Nothing tells the browser to drop its credential: the session still
+    // exists, the store just could not read it.
+    const cleared = (res.headers.getSetCookie?.() ?? []).filter((c) => /session_token=;|session_token=\s*;|Max-Age=0/i.test(c));
+    expect(cleared).toEqual([]);
+  });
+
+  it('in process: the store failure rejects `api.getSession` instead of resolving null', async () => {
+    vi.spyOn(console, 'error').mockImplementation(() => {});
+    const { engine, manager, cookie } = await signedIn();
+    const api = await manager.getApi();
+    const fault = failSessionStore(engine);
+
+    const read = api.getSession({ headers: new Headers({ cookie }) } as never);
+
+    await expect(read).rejects.toMatchObject({ statusCode: 500, body: { code: 'FAILED_TO_GET_SESSION' } });
+    expect(fault.attempts()).toBeGreaterThan(0);
+  });
+});
@@ -0,0 +1,109 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [#25096] The ObjectQL adapter keeps the primary key better-auth forces on a
+ * single-use reservation, so a replayed reservation is refused.
+ *
+ * better-auth's replay checks (DPoP proof `jti`s, `private_key_jwt` client
+ * assertions, SAML assertion ids, SIWE nonces) all go through
+ * `internalAdapter.reserveVerificationValue`. It inserts a `verification` row
+ * whose `id` is derived from the guarded value (SHA-256 of
+ * `reserve:IDENTIFIER`), with `forceAllowId: true`, and reads a failed insert
+ * as "already taken" only when a row with THAT id exists. So the whole check
+ * rests on one property of the adapter underneath: the forced id must land as
+ * the row's primary key. An adapter or engine that swaps in an id of its own
+ * lets every insert succeed, and every replay with it.
+ *
+ * 1.7.8 (better-auth/better-auth#11625) fixed that for `generateId: "uuid"`,
+ * where the id field used to replace the non-UUID digest. plugin-auth sets no
+ * `generateId`, so better-auth's own generator runs and the forced digest is
+ * passed through as base64url (`encodeDeterministicId`). What this file pins is
+ * the half better-auth cannot see: that the ObjectQL adapter, the engine and
+ * the SQL driver keep it.
+ *
+ * Real stack: `ObjectQL` over `@objectstack/driver-sql` + better-sqlite3, the
+ * objects from this plugin's manifest and a real `AuthManager`; the
+ * reservation is better-auth's own, read off the instance's `$context`.
+ */
+
+import { describe, it, expect, afterEach } from 'vitest';
+import { createHash } from 'node:crypto';
+import { ObjectQL } from '@objectstack/objectql';
+import { SqlDriver } from '@objectstack/driver-sql';
+import { AuthManager } from './auth-manager.js';
+import { authIdentityObjects } from './manifest.js';
+
+const BASE = 'http://localhost:3000';
+const SECRET = 'test-secret-at-least-32-chars-long-25096';
+const VERIFICATION_OBJECT = 'sys_verification';
+
+type Row = Record<string, unknown>;
+
+interface ReservingContext {
+  internalAdapter: {
+    reserveVerificationValue(data: { identifier: string; value: string; expiresAt: Date }): Promise<boolean>;
+  };
+}
+
+const engines: ObjectQL[] = [];
+afterEach(async () => {
+  while (engines.length) {
+    try { await engines.pop()!.destroy(); } catch { /* noop */ }
+  }
+});
+
+async function boot(): Promise<{ engine: ObjectQL; context: ReservingContext }> {
+  const engine = new ObjectQL();
+  engines.push(engine);
+  engine.registerDriver(new SqlDriver({ client: 'better-sqlite3', connection: { filename: ':memory:' }, useNullAsDefault: true }), true);
+  await engine.init();
+  for (const object of authIdentityObjects) engine.registry.registerObject(object as never, '@objectstack/plugin-auth');
+  await engine.syncSchemas();
+  const manager = new AuthManager({ secret: SECRET, baseUrl: BASE, dataEngine: engine as never } as never);
+  const auth = (await manager.getAuthInstance()) as unknown as { $context: Promise<ReservingContext> };
+  return { engine, context: await auth.$context };
+}
+
+/** Rows at DRIVER level, below the engine, with the identifier the reservation stored. */
+async function reservationRows(engine: ObjectQL, identifier: string): Promise<Row[]> {
+  const driver = (engine as unknown as { getDriver(o: string): { find(o: string, q: unknown): Promise<unknown> } })
+    .getDriver(VERIFICATION_OBJECT);
+  const found = await driver.find(VERIFICATION_OBJECT, { where: { identifier } });
+  return (Array.isArray(found) ? found : [found]).filter(Boolean) as Row[];
+}
+
+/** better-auth's deterministic reservation id without a `generateId` strategy: base64url SHA-256, unpadded. */
+const reservationId = (identifier: string): string =>
+  createHash('sha256').update(`reserve:${identifier}`).digest('base64url');
+
+const expiresAt = () => new Date(Date.now() + 5 * 60_000);
+
+describe('[#25096] a single-use reservation refuses its replay through the ObjectQL adapter', () => {
+  it('the first reservation wins and is stored under the id better-auth forced', async () => {
+    const { engine, context } = await boot();
+    const identifier = 'replay-probe:first';
+
+    expect(await context.internalAdapter.reserveVerificationValue({ identifier, value: 'v', expiresAt: expiresAt() })).toBe(true);
+
+    const rows = await reservationRows(engine, identifier);
+    expect(rows).toHaveLength(1);
+    expect(rows[0]!.id, 'the engine kept the forced primary key').toBe(reservationId(identifier));
+  });
+
+  it('the replay of the same value is refused, and leaves one row', async () => {
+    const { engine, context } = await boot();
+    const identifier = 'replay-probe:replayed';
+
+    expect(await context.internalAdapter.reserveVerificationValue({ identifier, value: 'v', expiresAt: expiresAt() })).toBe(true);
+    expect(await context.internalAdapter.reserveVerificationValue({ identifier, value: 'v', expiresAt: expiresAt() })).toBe(false);
+
+    expect(await reservationRows(engine, identifier)).toHaveLength(1);
+  });
+
+  it('CONTROL: a different value is its own reservation and wins', async () => {
+    const { context } = await boot();
+
+    expect(await context.internalAdapter.reserveVerificationValue({ identifier: 'replay-probe:a', value: 'v', expiresAt: expiresAt() })).toBe(true);
+    expect(await context.internalAdapter.reserveVerificationValue({ identifier: 'replay-probe:b', value: 'v', expiresAt: expiresAt() })).toBe(true);
+  });
+});