@@ -23,8 +23,10 @@
  * `apps/objectos` (multi-tenant) and `apps/objectos-ee` (single-environment)
  * — wire the same canonical implementation. cloud ADR-0008 Phase 2 moves this
  * surface into the open `@objectstack/cloud-connection` package; keep this
- * file dependency-light (structural Plugin types, no @objectstack/core) so
- * the move is mechanical.
+ * file dependency-light (structural Plugin types) so the move is mechanical.
+ * The one value it takes from `@objectstack/core` is the ADR-0069 gate's
+ * decision, `evaluateAuthGate`: a second copy of a security decision is the
+ * defect that function exists to prevent (see `sessionFromAuthService`).
  *
  * ## Environment & session resolution — two modes
  *
@@ -50,7 +52,7 @@
  * self-hosted runtimes).
  */
 
-// Minimal structural plugin contract — keep this module independent of
+// Minimal structural plugin contract — keep this module's TYPES independent of
 // @objectstack/core so the cloud ADR-0008 Phase 2 move to the open package stays
 // mechanical (mirrors the other plugins in this package).
 interface PluginContext {
@@ -78,12 +80,22 @@ interface Plugin {
 }
 
 import { hostname } from 'node:os';
+import { evaluateAuthGate, type AuthGate } from '@objectstack/core';
 import { inProcessSessionReadInput } from '@objectstack/types';
 import { ConnectionCredentialStore } from './connection-credential-store.js';
 import { CLOUD_CONNECTION_UI_BUNDLE } from './cloud-connection-ui.js';
 
 const CLOUD_CONNECTION_PREFIX = '/api/v1/cloud-connection';
 
+/**
+ * A signed-in caller of this surface, and the ADR-0069 posture its session
+ * carries (`authGate`, present only for a session the policy holds).
+ */
+interface ResolvedSession {
+    userId: string;
+    authGate?: AuthGate;
+}
+
 /**
  * The one message every `ENVIRONMENT_NOT_FOUND` refusal on this surface carries.
  *
@@ -201,17 +213,40 @@ export class CloudConnectionPlugin implements Plugin {
                 manifest?.register?.(CLOUD_CONNECTION_UI_BUNDLE);
             } catch { /* no manifest service — headless kernel */ }
 
-            const sessionFromAuthService = async (authSvc: any, rawReq: Request): Promise<{ userId?: string } | null> => {
+            const sessionFromAuthService = async (authSvc: any, rawReq: Request): Promise<ResolvedSession | null> => {
                 const api = typeof authSvc?.getApi === 'function' ? await authSvc.getApi() : authSvc?.api ?? authSvc;
                 // [#22258] The in-process session-read rule: a request carrying a
                 // session cookie reads without renewal, because this route's
                 // response never carries a renewed cookie.
                 const session = await api?.getSession?.(inProcessSessionReadInput(rawReq.headers));
                 const userId = session?.user?.id ? String(session.user.id) : undefined;
-                return userId ? { userId } : null;
+                if (!userId) return null;
+                // ADR-0069: the ONE consult of the authentication-policy gate for
+                // every door on this surface, asked of the session this read
+                // returned (the posture rides its user, computed by plugin-auth's
+                // `customSession` enrichment only while a gate feature is active).
+                // Both modes read here: the host kernel's `auth` (single-env) and
+                // the environment's own kernel's (multi-tenant).
+                //
+                // No request path is passed, so the allow-list can grant no
+                // exemption (an empty path earns none, #7898). Nothing this plugin
+                // mounts is a remediation or bootstrap route.
+                const authGate = evaluateAuthGate(session?.user, '');
+                return authGate ? { userId, authGate } : { userId };
             };
 
-            const resolveSession = async (environmentId: string, rawReq: Request): Promise<{ userId?: string } | null> => {
+            /**
+             * ADR-0069: a session the authentication policy HOLDS (an expired
+             * password, enforced MFA not yet enrolled) is gated out of every
+             * protected resource until it remediates. Every door that resolves
+             * a session answers it this way, before its own 401 and before any
+             * control-plane call: REST's answer (`403` with the gate's own
+             * `code` and `message`), in this surface's envelope.
+             */
+            const refuseHeldSession = (c: any, gate: AuthGate) =>
+                c.json({ success: false, error: { code: gate.code, message: gate.message } }, 403);
+
+            const resolveSession = async (environmentId: string, rawReq: Request): Promise<ResolvedSession | null> => {
                 try {
                     if (this.cfg.singleEnvironment) {
                         // Single-env: the host kernel owns auth.
@@ -294,6 +329,7 @@ export class CloudConnectionPlugin implements Plugin {
                     return c.json({ success: false, error: { code: 'ENVIRONMENT_NOT_FOUND', message: ENVIRONMENT_NOT_FOUND_MESSAGE } }, 404);
                 }
                 const session = await resolveSession(environmentId ?? '', c.req.raw);
+                if (session?.authGate) return refuseHeldSession(c, session.authGate);
                 if (!session?.userId) return c.json({ success: false, error: { code: 'UNAUTHENTICATED', message: 'Sign in to this environment to connect a cloud account.' } }, 401);
                 if (!cloudUrl) return c.json({ success: false, error: { code: 'CLOUD_UNCONFIGURED', message: 'No cloud control plane configured.' } }, 503);
                 try {
@@ -349,6 +385,7 @@ export class CloudConnectionPlugin implements Plugin {
                     return c.json({ success: false, error: { code: 'ENVIRONMENT_NOT_FOUND', message: ENVIRONMENT_NOT_FOUND_MESSAGE } }, 404);
                 }
                 const session = await resolveSession(environmentId ?? '', c.req.raw);
+                if (session?.authGate) return refuseHeldSession(c, session.authGate);
                 if (!session?.userId) return c.json({ success: false, error: { code: 'UNAUTHENTICATED', message: 'Sign in to this environment.' } }, 401);
                 if (!cloudUrl) return c.json({ success: false, error: { code: 'CLOUD_UNCONFIGURED', message: 'No cloud control plane configured.' } }, 503);
 
@@ -447,6 +484,7 @@ export class CloudConnectionPlugin implements Plugin {
                     return c.json({ success: false, error: { code: 'ENVIRONMENT_NOT_FOUND', message: ENVIRONMENT_NOT_FOUND_MESSAGE } }, 404);
                 }
                 const session = await resolveSession(environmentId ?? '', c.req.raw);
+                if (session?.authGate) return refuseHeldSession(c, session.authGate);
                 if (!session?.userId) return c.json({ success: false, error: { code: 'UNAUTHENTICATED', message: 'Sign in to this environment.' } }, 401);
 
                 // Revoke cloud-side FIRST (the oscc_ bearer self-identifies;
@@ -495,6 +533,7 @@ export class CloudConnectionPlugin implements Plugin {
                 // explicit env-admin role check; today only owners/admins obtain
                 // a session via SSO-as-owner.)
                 const session = await resolveSession(environmentId, c.req.raw);
+                if (session?.authGate) return refuseHeldSession(c, session.authGate);
                 if (!session?.userId) {
                     return c.json({ success: false, error: { code: 'UNAUTHENTICATED', message: 'Sign in to this environment to install apps.' } }, 401);
                 }
@@ -545,6 +584,7 @@ export class CloudConnectionPlugin implements Plugin {
                 }
 
                 const session = await resolveSession(environmentId, c.req.raw);
+                if (session?.authGate) return refuseHeldSession(c, session.authGate);
                 if (!session?.userId) {
                     return c.json({ success: false, error: { code: 'UNAUTHENTICATED', message: 'Sign in to this environment.' } }, 401);
                 }
@@ -607,6 +647,7 @@ export class CloudConnectionPlugin implements Plugin {
                 }
 
                 const session = await resolveSession(environmentId, c.req.raw);
+                if (session?.authGate) return refuseHeldSession(c, session.authGate);
                 if (!session?.userId) {
                     return c.json({ success: false, error: { code: 'UNAUTHENTICATED', message: 'Sign in to this environment.' } }, 401);
                 }
@@ -644,6 +685,7 @@ export class CloudConnectionPlugin implements Plugin {
                 }
 
                 const session = await resolveSession(environmentId ?? '', c.req.raw);
+                if (session?.authGate) return refuseHeldSession(c, session.authGate);
                 if (!session?.userId) {
                     return c.json({ success: false, error: { code: 'UNAUTHENTICATED', message: 'Sign in to this environment.' } }, 401);
                 }
 
@@ -112,6 +112,10 @@ import type { Plugin, PluginContext } from '@objectstack/core';
 import {
     resolveAuthzContext,
     isAuthzStoreUnavailableError,
+    // ADR-0069 — the authentication-policy gate's ONE decision, asked of the
+    // session `resolveInstallPrincipal` reads (see `admitInstallCaller`).
+    evaluateAuthGate,
+    type AuthGate,
     // [#16013] The ADMISSION seam's posture derivation, in ONE call — the same
     // symbol `packages/rest`'s seam now imports, for the same reason. It reads
     // the posture IN FORCE off the kernel's `tenancy` service and carries
@@ -529,6 +533,25 @@ function organizationWallActive(ctx: PluginContext): boolean {
 const NO_ACTIVE_ORGANIZATION_CODE = 'PERMISSION_DENIED';
 const NO_ACTIVE_ORGANIZATION_STATUS = 403;
 
+/**
+ * The caller one install-local admission resolved: identity and grants off the
+ * shared resolver, plus the two postures the doors read.
+ */
+interface InstallPrincipal {
+    userId: string;
+    systemPermissions: string[];
+    /** [#15204 W2] The ADR-0095 posture rung the resolver derived. */
+    posture?: unknown;
+    /** [#15204 W2] The EFFECTIVE tenancy posture this admission resolved. */
+    tenancyPosture?: TenancyPosture;
+    /**
+     * ADR-0069: the authentication-policy posture of the session this
+     * admission resolved, present only for a session the policy holds.
+     * `admitInstallCaller` refuses on it.
+     */
+    authGate?: AuthGate;
+}
+
 /**
  * [#15204 W2] What an admitted mutating request carries past
  * `requireInstallCapability`: the acting user, plus the two inputs ADR-0131
@@ -1719,8 +1742,9 @@ export class MarketplaceInstallLocalPlugin implements Plugin {
         // Before the ledger is touched, exactly as the mutating doors refuse
         // before any work: a refused caller must not be able to learn what is
         // installed from timing or from a downstream storage error.
-        const principal = await this.resolveInstallPrincipal(c, ctx);
-        if (!principal) return this.refuseUnauthenticated(c);
+        const admitted = await this.admitInstallCaller(c, ctx);
+        if (!admitted.ok) return admitted.response;
+        const { principal } = admitted;
         const operator = principal.systemPermissions.includes(INSTALL_LOCAL_CAPABILITY);
 
         const { entries, skipped } = this.readAll();
@@ -3280,14 +3304,7 @@ export class MarketplaceInstallLocalPlugin implements Plugin {
     private resolveInstallPrincipal = async (
         c: any,
         ctx: PluginContext,
-    ): Promise<{
-        userId: string;
-        systemPermissions: string[];
-        /** [#15204 W2] The ADR-0095 posture rung the resolver derived. */
-        posture?: unknown;
-        /** [#15204 W2] The EFFECTIVE tenancy posture this admission resolved. */
-        tenancyPosture?: TenancyPosture;
-    } | null> => {
+    ): Promise<InstallPrincipal | null> => {
         const headers = c?.req?.raw?.headers;
         if (!headers) return null;
         try {
@@ -3301,6 +3318,13 @@ export class MarketplaceInstallLocalPlugin implements Plugin {
             let ql: IObjectQLEngine | undefined;
             try { ql = ctx.getService<IObjectQLEngine>('objectql'); } catch { /* no data engine */ }
 
+            // The session user the bridge below read, kept so the ADR-0069 gate
+            // is asked about the SAME session the resolver admitted: one read,
+            // both decisions. The resolver calls the bridge only when no API
+            // key admitted the caller, so a key caller leaves it unset and no
+            // policy holds it.
+            let sessionUser: unknown;
+
             // The better-auth session bridge — resolved lazily and defensively,
             // exactly as the previous implementation did, then handed to the
             // shared resolver instead of being trusted on its own.
@@ -3313,7 +3337,9 @@ export class MarketplaceInstallLocalPlugin implements Plugin {
                     }
                     // [#22258] The in-process session-read rule, as in
                     // `resolveActiveOrgId` above.
-                    return await api?.getSession?.(inProcessSessionReadInput(h));
+                    const session = await api?.getSession?.(inProcessSessionReadInput(h));
+                    sessionUser = session?.user;
+                    return session;
                 } catch {
                     return undefined;
                 }
@@ -3325,11 +3351,19 @@ export class MarketplaceInstallLocalPlugin implements Plugin {
             const tenancyPosture = await this.resolveAdmissionTenancyPosture(ctx);
             const authz = await resolveAuthzContext({ ql, headers, getSession, tenancyPosture });
             if (!authz.userId) return null;
+            // ADR-0069: the ONE consult of the authentication-policy gate for
+            // all five doors, on the session read above (the posture rides its
+            // user, computed by plugin-auth's `customSession` enrichment only
+            // while a gate feature is active). No request path is passed, so
+            // the allow-list can grant no exemption (an empty path earns none,
+            // #7898); no install-local route is a remediation or bootstrap route.
+            const authGate = evaluateAuthGate(sessionUser, '');
             return {
                 userId: String(authz.userId),
                 systemPermissions: Array.isArray(authz.systemPermissions) ? authz.systemPermissions : [],
                 posture: authz.posture,
                 tenancyPosture,
+                ...(authGate ? { authGate } : {}),
             };
         } catch (err) {
             // [commit 6a180e42d] `null` here means "nobody is authenticated", which is
@@ -3355,6 +3389,29 @@ export class MarketplaceInstallLocalPlugin implements Plugin {
         error: { code: 'UNAUTHENTICATED', message: 'Authentication required.' },
     }, 401);
 
+    /**
+     * ADR-0069: the floor all five doors open with, the listing included.
+     * Nobody authenticated is `401` ({@link refuseUnauthenticated}). A session
+     * the authentication policy HOLDS (an expired password, enforced MFA not
+     * yet enrolled) is gated out of every protected resource until it
+     * remediates, so it gets REST's answer: `403` with the gate's own `code`
+     * and `message`, in this plugin's envelope, before its capabilities are
+     * consulted and before the ledger is read. One helper for the same reason
+     * the 401 is one literal: a door added later cannot copy a weaker answer.
+     */
+    private admitInstallCaller = async (
+        c: any,
+        ctx: PluginContext,
+    ): Promise<{ ok: true; principal: InstallPrincipal } | { ok: false; response: Response }> => {
+        const principal = await this.resolveInstallPrincipal(c, ctx);
+        if (!principal) return { ok: false, response: this.refuseUnauthenticated(c) };
+        if (principal.authGate) {
+            const { code, message } = principal.authGate;
+            return { ok: false, response: c.json({ success: false, error: { code, message } }, 403) };
+        }
+        return { ok: true, principal };
+    };
+
     /**
      * [#8976] The shared refusal for the four mutating routes: 401 when nobody
      * is authenticated, 403 when somebody is but holds no authoring capability,
@@ -3379,8 +3436,9 @@ export class MarketplaceInstallLocalPlugin implements Plugin {
         ctx: PluginContext,
         action: string,
     ): Promise<InstallAdmission | { ok: false; response: Response }> => {
-        const principal = await this.resolveInstallPrincipal(c, ctx);
-        if (!principal) return { ok: false, response: this.refuseUnauthenticated(c) };
+        const admitted = await this.admitInstallCaller(c, ctx);
+        if (!admitted.ok) return admitted;
+        const { principal } = admitted;
         if (!principal.systemPermissions.includes(INSTALL_LOCAL_CAPABILITY)) {
             ctx.logger?.warn?.(
                 `[MarketplaceInstallLocal] refused ${action} for ${principal.userId} — `