@@ -0,0 +1,14 @@
+---
+'@objectstack/platform-objects': patch
+---
+
+fix: Setup → Sessions shows each session's user agent and last activity, so two sessions of one user can be told apart
+
+Clause-②: no
+Metadata-protocol: none
+
+Two sessions of one user read the same in the `sys_session` list: same user, organization and creation minute, with no device or activity column. An administrator who wanted to end one of them could not tell which, and revoked both.
+
+The two views that list live sessions, `all_sessions` (Setup's Sessions page) and `mine` (the Account app), now show `user_agent` and `last_activity_at` next to the IP address. Both fields already existed on `sys_session`. The `revoked` audit view is unchanged.
+
+`user_agent` is the raw string better-auth records. `last_activity_at` is written only while an idle timeout is configured (`session_idle_timeout_minutes` above 0). With the default of 0 the column is empty.
@@ -0,0 +1,45 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+//
+// `sys_session`'s session-listing views must let an administrator tell two
+// sessions of one user apart. Without the device and the last request, two
+// rows read the same user, organization and creation minute, and the admin
+// who meant to end one session revokes both.
+//
+// Pinned here, at the declaration: both views that list live sessions carry
+// `user_agent` and `last_activity_at`, every column names a declared field,
+// and no column names the `internal` bearer token.
+
+import { describe, it, expect } from 'vitest';
+import { SysSession } from './sys-session.object.js';
+
+type ViewLike = { columns?: unknown };
+const views = (SysSession as any).listViews as Record<string, ViewLike>;
+const fields = (SysSession as any).fields as Record<string, { internal?: boolean }>;
+
+const columnsOf = (view: string): string[] => {
+  const cols = views[view]?.columns;
+  expect(Array.isArray(cols), `sys_session.listViews.${view}.columns`).toBe(true);
+  return cols as string[];
+};
+
+const LIVE_SESSION_VIEWS = ['all_sessions', 'mine'] as const;
+
+describe('sys_session list views tell one user\'s sessions apart', () => {
+  it.each(LIVE_SESSION_VIEWS)('%s shows the device (user_agent) and the last request (last_activity_at)', (view) => {
+    const cols = columnsOf(view);
+    expect(cols).toContain('user_agent');
+    expect(cols).toContain('last_activity_at');
+  });
+
+  it('both columns are declared fields of the object', () => {
+    expect(fields.user_agent).toBeDefined();
+    expect(fields.last_activity_at).toBeDefined();
+  });
+
+  it.each(Object.keys(views))('%s names only declared, non-internal fields', (view) => {
+    for (const col of columnsOf(view)) {
+      expect(fields[col], `sys_session.listViews.${view} column ${col}`).toBeDefined();
+      expect(fields[col]?.internal, `sys_session.listViews.${view} column ${col}`).not.toBe(true);
+    }
+  });
+});
@@ -115,6 +115,13 @@ export const SysSession = ObjectSchema.create({
   // the audit trail those columns exist for gets a view of its own — otherwise
   // the fields would be written and still readable nowhere, which is the same
   // declared-≠-enforced gap one layer up.
+  //
+  // Both session-listing views carry `user_agent` and `last_activity_at`: two
+  // sessions of one user otherwise read identically (same user, organization
+  // and creation minute), and an administrator who cannot tell which device a
+  // row is revokes both. The device and the last request are what tell them
+  // apart. The revoked view is an audit trail ordered by `revoked_at` and is
+  // left as it was.
   listViews: {
     // [#21972] Declared FIRST on purpose: a route that names no view opens the
     // first declared list view, so a caller-scoped view (`mine`) is never
@@ -125,7 +132,7 @@ export const SysSession = ObjectSchema.create({
       name: 'all_sessions',
       label: 'All',
       data: { provider: 'object', object: 'sys_session' },
-      columns: ['user_id', 'ip_address', 'active_organization_id', 'created_at', 'expires_at'],
+      columns: ['user_id', 'user_agent', 'ip_address', 'last_activity_at', 'active_organization_id', 'created_at', 'expires_at'],
       filter: [{ field: 'revoked_at', operator: 'is_null' }],
       sort: [{ field: 'created_at', order: 'desc' }],
       pagination: { pageSize: 50 },
@@ -135,7 +142,7 @@ export const SysSession = ObjectSchema.create({
       name: 'mine',
       label: 'My Sessions',
       data: { provider: 'object', object: 'sys_session' },
-      columns: ['ip_address', 'active_organization_id', 'created_at', 'expires_at'],
+      columns: ['user_agent', 'ip_address', 'last_activity_at', 'active_organization_id', 'created_at', 'expires_at'],
       filter: [
         { field: 'user_id', operator: 'equals', value: '{current_user_id}' },
         { field: 'revoked_at', operator: 'is_null' },