Sub-ticket of PLUTO-202 BUILD (dispatch-ready, Elazar-launched per bs-mqpzo3ly470 — do NOT act between sessions): Pluto admin "Cambiar email de acceso" server action (canonical change-login-Gmail, decision bs-mqq2v3r1802). New action in src/lib/admin-actions.ts, gate withCap(manageUsers) NOT fullAccess (reportes-trap, mem pluto-view-as-architecture). Input targetUserId+newEmail. In ONE txn w/ setArchiveContext (users is trigger-archived): (1) isAllowlistedEmail(new); (2) dedup-reject if canonicalizeEmail(new) belongs to another live user (id!=target, deletedAt IS NULL); (3) UPDATE users.email=new (emailCanonical GENERATED auto-regens, mem pluto-stored-generated-column-no-recompute) + SET users.authId=NULL so new Google identity re-links next login; (4) cleanup stale auth.users row for OLD identity via service-role admin deleteUser so old account cannot log back in; (5) userAuditLog email delta old->new; (6) optional fire welcome email to new address. Re-login on new gmail = proof-of-control (auth/callback matches by canonicalizeEmail(users.email)==canon(auth email), stamps new authId, same row -> roles/practicas intact). UI: "Cambiar email de acceso" in admin-user-detail.tsx with AlertDialog confirm (account-takeover-shaped). Touches auth/identity -> pre-impl audit design-ping + pre-push audit diff review per push-to-done. · pluto