# Decision: email collision check

Changing your email in settings wrote straight to a UNIQUE column. A collision surfaced as a raw constraint error
inside a server action — the form looked like it did nothing.

`changeEmail` in `lib/auth.ts` now validates the address, compares it case-insensitively after trimming, and
returns "That email already has an account." when another user owns it. It returns ok when the address is already
yours.

A deferred neighbour: sessions are not revoked when the password changes, so a 30-day token survives a password
rotation.

Related: [[First-run gate]], [[Session cookie rules]], [[SQLite schema]].