othala v0.6.4 Session and profile lifecycle: access ends where it should, identity fields apps key on are admin-controlled, and admin accounts cannot lock themselves out. - Deleting an identity, or removing a group or role, revokes its app grants; signing out of an app also ends the portal session. - Usernames are admin-controlled; saving profile settings ends the account's other sessions; email_verified reflects only the account's own address. - Admin accounts keep a second factor through settings, and the admin console refuses to deactivate yourself or the last active admin. - Signing out takes a token-bound form post; the request form requires a signed-in account; the error page shows only reasons it recognises. - The password policy rejects any known-breached password and fails closed. - Reference edge snippets pass the verified identity id upstream and keep the Kratos session cookie away from app backends.