@@ -0,0 +1,27 @@
+---
+'@objectstack/plugin-auth': patch
+'@objectstack/platform-objects': patch
+'@object-ui/i18n': patch
+'@object-ui/app-shell': patch
+---
+
+feat(plugin-auth)!: an organization administrator reads the client address their access-policy list is judged by, and the console's notices over the retired `require_mfa` column are gone
+
+Clause-②: yes (narrowing) — the published `@object-ui/i18n` packs (all eleven) drop the `console.organizationMfa.needsTwoFactor` and `.nowRequired` keys, which had no reader outside the removed notices. Both keys were added by the still-pending `.changeset/30295-org-mfa-notice-and-enroll-refusal.md` and never released, so no published version of the packs carries them. The widening half: a new served read, `GET /api/v1/auth/client-address`.
+Metadata-protocol: none
+Skills-docs: none — `skills/**` teaches no access-policy key, client-address read or console notice, and `content/docs/**` teaches no per-organization access policy; its `allowed_ip_ranges` section in `permissions/authentication.mdx` is the deployment's own list, whose platform-admin read it names correctly.
+
+<!-- adr-0087: not-required (runtime-interface-only ui/packages/i18n/src/locales/en.ts#TranslationKeys) the key type of the console's own translation catalogue: no Zod schema, no spec declaration and no stored metadata reads it, so the compiler is the channel that reaches every caller -->
+
+**An organization administrator sees their judged address before saving their organization's Allowed IP ranges.** A save of `access_policy.allowed_ip_ranges` that leaves out the saving request's own address is refused, and until now an organization administrator learned that address only from the refusal: `GET /api/v1/auth/admin/client-address` answers platform administrators alone. `GET /api/v1/auth/client-address` answers the same `{ clientAddress, trustProxy }`, the address the save check judges (`server.trustProxy` deciding whether forwarded headers count; `null` when the server cannot establish one), to the caller who may save that list: `setup.write` in their current organization, resolved the way the settings door resolves a saving caller. It is the caller's own address only; the query set is closed and empty (`400 VALIDATION_ERROR`), the answer is `Cache-Control: no-store`. Anonymous: `401 UNAUTHENTICATED`. A held session: `403` with its posture's code. A member without `setup.write`: `403 PERMISSION_DENIED`. An unreachable permission store: `503 SERVICE_UNAVAILABLE`. The console's Access policy page does not read it yet.
+
+**The organization's IP list is judged on an objectstack mount's own session read too.** The routes the auth plugin mounts itself under `/api/v1/auth` (the platform-admin routes, the authorized-AI-assistant routes, session revoke, add member and the others that read the caller's session in process) now carry the address the deployment's IP gate established for the request to that read, so a session whose organization's Allowed IP ranges no longer admit it is ended there (`revoke_reason: ip_not_allowed`), as it already was on a session read through better-auth's own routes. Data requests outside the auth mount are judged by neither list, as before.
+
+`sys_session.revoke_reason`'s published vocabulary (the field description) now names `ip_not_allowed`.
+
+**BREAKING** (`@object-ui/i18n`, TypeScript only): the exported `TranslationKeys` (`typeof en`) loses the two `console.organizationMfa.*` keys, in all eleven packs (ar, de, en, es, fr, ja, ko, pt-BR, ru, zh-Hans, zh-Hant). A `t()` call that names one still compiles, since its key is a `string`, and reads the key back. Both keys come from the still-pending `.changeset/30295-org-mfa-notice-and-enroll-refusal.md` and were never released: a consumer of a published `@object-ui/i18n` never had them.
+
+| Removed key | Replacement |
+|:---|:---|
+| `console.organizationMfa.needsTwoFactor` | none: `sys_organization.require_mfa` is read-only and off the organization form; the multi-factor requirement is the access policy's `mfa_required` level, whose save refusal names two-factor itself |
+| `console.organizationMfa.nowRequired` | none: the same column can no longer be turned on, so no save turns the requirement on from the organization form |
@@ -369,7 +369,7 @@ export const arObjects: NonNullable<TranslationData['objects']> = {
       },
       revoke_reason: {
         label: "سبب الإلغاء",
-        help: "سبب إلغاء الجلسة (idle_timeout، absolute_max، concurrent_cap، user_revoked، admin، organization_membership_ended، admin_password_reset، password_reset، …)."
+        help: "سبب إلغاء الجلسة (idle_timeout، absolute_max، concurrent_cap، ip_not_allowed، user_revoked، admin، organization_membership_ended، admin_password_reset، password_reset، …)."
       },
       active_organization_id: {
         label: "المؤسسة النشطة"
 
@@ -369,7 +369,7 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
       },
       revoke_reason: {
         label: "Revoke Reason",
-        help: "Why the session was revoked (idle_timeout, absolute_max, concurrent_cap, user_revoked, admin, organization_membership_ended, admin_password_reset, password_reset, …)."
+        help: "Why the session was revoked (idle_timeout, absolute_max, concurrent_cap, ip_not_allowed, user_revoked, admin, organization_membership_ended, admin_password_reset, password_reset, …)."
       },
       active_organization_id: {
         label: "Active Organization"
 
@@ -369,7 +369,7 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
       },
       revoke_reason: {
         label: "Motivo de la revocación",
-        help: "Por qué se revocó la sesión (idle_timeout, absolute_max, concurrent_cap, user_revoked, admin, organization_membership_ended, admin_password_reset, password_reset, …)."
+        help: "Por qué se revocó la sesión (idle_timeout, absolute_max, concurrent_cap, ip_not_allowed, user_revoked, admin, organization_membership_ended, admin_password_reset, password_reset, …)."
       },
       active_organization_id: {
         label: "Organización activa"
 
@@ -369,7 +369,7 @@ export const jaJPObjects: NonNullable<TranslationData['objects']> = {
       },
       revoke_reason: {
         label: "失効理由",
-        help: "セッションが失効した理由（idle_timeout、absolute_max、concurrent_cap、user_revoked、admin、organization_membership_ended、admin_password_reset、password_reset など）。"
+        help: "セッションが失効した理由（idle_timeout、absolute_max、concurrent_cap、ip_not_allowed、user_revoked、admin、organization_membership_ended、admin_password_reset、password_reset など）。"
       },
       active_organization_id: {
         label: "アクティブ組織"
 
@@ -369,7 +369,7 @@ export const zhCNObjects: NonNullable<TranslationData['objects']> = {
       },
       revoke_reason: {
         label: "撤销原因",
-        help: "会话被撤销的原因（idle_timeout、absolute_max、concurrent_cap、user_revoked、admin、organization_membership_ended、admin_password_reset、password_reset 等）。"
+        help: "会话被撤销的原因（idle_timeout、absolute_max、concurrent_cap、ip_not_allowed、user_revoked、admin、organization_membership_ended、admin_password_reset、password_reset 等）。"
       },
       active_organization_id: {
         label: "当前组织"
 
@@ -369,7 +369,7 @@ export const zhHantObjects: NonNullable<TranslationData['objects']> = {
       },
       revoke_reason: {
         label: "撤銷原因",
-        help: "工作階段被撤銷的原因（idle_timeout、absolute_max、concurrent_cap、user_revoked、admin、organization_membership_ended、admin_password_reset、password_reset 等）。"
+        help: "工作階段被撤銷的原因（idle_timeout、absolute_max、concurrent_cap、ip_not_allowed、user_revoked、admin、organization_membership_ended、admin_password_reset、password_reset 等）。"
       },
       active_organization_id: {
         label: "目前組織"
 
@@ -243,8 +243,13 @@ export const SysSession = ObjectSchema.create({
       // `password_reset` is its self-service counterpart: a completed password
       // reset ended the session (the reset doors in `INTERACTIVE_REVOKE_REASON`,
       // `plugin-auth/session-tombstone.ts`).
+      // `ip_not_allowed` is a session control beside the timers: the
+      // organization's own allowed IP ranges (`access_policy`, ADR-0069 TL;DR 6)
+      // no longer admit the address the session was read from, judged on a
+      // session read through a door (`enforceSessionControls`,
+      // `plugin-auth/auth-manager-password-session-policy.ts`).
       description:
-        'Why the session was revoked (idle_timeout, absolute_max, concurrent_cap, user_revoked, '
+        'Why the session was revoked (idle_timeout, absolute_max, concurrent_cap, ip_not_allowed, user_revoked, '
         + 'admin, organization_membership_ended, admin_password_reset, password_reset, …).',
     }),
 
 
@@ -29,6 +29,10 @@
  *    `GET /api/v1/auth/admin/client-address`, answers the address that same
  *    save would be judged by: the plugin's real auth routes on a real Hono app,
  *    the transport peer supplied the way `@hono/node-server` supplies it.
+ *  - Its organization twin, `GET /api/v1/auth/client-address`, answers the
+ *    same address to the caller who may save their organization's
+ *    `access_policy` list (`setup.write` in their current organization), and
+ *    refuses everyone else before any address is read.
  *
  * `@objectstack/service-settings` resolves to its `src/` here (this package's
  * `vitest.config.ts`), so the routes and the service are the checkout's.
@@ -42,8 +46,11 @@ import {
   builtinSettingsManifests,
   registerSettingsRoutes,
 } from '@objectstack/service-settings';
+import { AuthzStoreUnavailableError } from '@objectstack/core';
 import { AuthPlugin } from './auth-plugin.js';
 import type { AuthManager } from './auth-manager.js';
+import type { OrganizationAddressReaderContext } from './client-address-read.js';
+import { readMountDoor } from './request-client-address.js';
 
 const OFFICE = '203.0.113.0/24';
 const ADMIN_CTX = { enforced: true, permissions: ['manage_platform_settings'], userId: 'usr_admin' };
@@ -76,10 +83,21 @@ interface Rig {
   logger: { info: Mock; error: Mock; warn: Mock; debug: Mock };
   save(body: Record<string, unknown>, transport?: Transport): Promise<{ status: number; body: any }>;
   /** `GET /api/v1/auth/admin/client-address` on the plugin's real auth routes. */
-  read(transport?: Transport, opts?: { session?: unknown; query?: string }):
+  read(transport?: Transport, opts?: { session?: unknown; query?: string; onSessionRead?: () => Promise<void> }):
+    Promise<{ status: number; body: any; cacheControl: string | null }>;
+  /**
+   * `GET /api/v1/auth/client-address` on the same routes. `caller` is what the
+   * route's resolution of its caller answers (the settings door's composition,
+   * stubbed at that one seam): an organization administrator unless a test
+   * says otherwise; an `Error` is thrown from it.
+   */
+  orgRead(transport?: Transport, opts?: { caller?: OrganizationAddressReaderContext | Error; query?: string }):
     Promise<{ status: number; body: any; cacheControl: string | null }>;
 }
 
+/** What the organization read's caller resolution answers for an organization administrator. */
+const ORG_ADMIN_CALLER: OrganizationAddressReaderContext = { systemPermissions: ['setup.access', 'setup.write'] };
+
 async function boot(
   opts: { env?: Record<string, string | undefined>; svc?: SettingsService; plugin?: Record<string, unknown> } = {},
 ): Promise<Rig> {
@@ -135,14 +153,23 @@ async function boot(
   };
 
   let app: Hono | undefined;
-  const read: Rig['read'] = async (transport = {}, opts = {}) => {
+  const mounted = (): Hono => {
     if (!app) {
       app = new Hono();
       (plugin as any).registerAuthRoutes({ getRawApp: () => app, getPort: () => 0 }, ctx);
     }
+    return app;
+  };
+  const read: Rig['read'] = async (transport = {}, opts = {}) => {
+    const app = mounted();
     const session = 'session' in opts ? opts.session : PLATFORM_ADMIN_SESSION;
     // The gate reads the session through the auth service's in-process read.
-    const getApi = vi.spyOn(manager, 'getApi').mockResolvedValue({ getSession: async () => session } as any);
+    const getApi = vi.spyOn(manager, 'getApi').mockResolvedValue({
+      getSession: async () => {
+        await opts.onSessionRead?.();
+        return session;
+      },
+    } as any);
     try {
       const res = await app.request(
         `http://localhost:3000/api/v1/auth/admin/client-address${opts.query ?? ''}`,
@@ -154,7 +181,25 @@ async function boot(
       getApi.mockRestore();
     }
   };
-  return { svc, manager, logger: ctx.logger, save, read };
+  const orgRead: Rig['orgRead'] = async (transport = {}, opts = {}) => {
+    const app = mounted();
+    const caller = 'caller' in opts ? opts.caller : ORG_ADMIN_CALLER;
+    const resolve = vi.spyOn(plugin as any, 'resolveOrganizationSettingsCaller').mockImplementation(async () => {
+      if (caller instanceof Error) throw caller;
+      return caller;
+    });
+    try {
+      const res = await app.request(
+        `http://localhost:3000/api/v1/auth/client-address${opts.query ?? ''}`,
+        { method: 'GET', headers: transport.headers ?? {} },
+        transport.remoteAddress ? { incoming: { socket: { remoteAddress: transport.remoteAddress } } } : {},
+      );
+      return { status: res.status, body: await res.json(), cacheControl: res.headers.get('cache-control') };
+    } finally {
+      resolve.mockRestore();
+    }
+  };
+  return { svc, manager, logger: ctx.logger, save, read, orgRead };
 }
 
 const stored = async (svc: SettingsService) => (await svc.get('auth', 'allowed_ip_ranges', {})).value ?? null;
@@ -391,6 +436,122 @@ describe('#30398 the address read serves the address the save check judges', ()
   });
 });
 
+describe("a mount's in-process session read carries the address the D5 gate judged", () => {
+  // `customSession` judges the organization's IP list on that read with the
+  // door it finds open (`organization-access-policy-doors.test.ts`); this is
+  // the mount half: the middleware opens it, for the read the route makes.
+  const doorAtTheRead = async (rig: Rig, transport: Transport) => {
+    let door: unknown = 'not read';
+    const res = await rig.read(transport, { onSessionRead: async () => { door = await readMountDoor(); } });
+    expect(res.status, JSON.stringify(res.body)).toBe(200);
+    return door;
+  };
+
+  it("the peer address, or the forwarded one under trustProxy, the read's own answer", async () => {
+    expect(await doorAtTheRead(await boot(), { remoteAddress: '203.0.113.9' })).toEqual({ address: '203.0.113.9' });
+    const forwarded = { headers: { 'x-forwarded-for': '198.51.100.7, 10.0.0.2' }, remoteAddress: '10.0.0.1' };
+    expect(await doorAtTheRead(await boot({ plugin: { trustProxy: true } }), forwarded)).toEqual({ address: '198.51.100.7' });
+  });
+
+  it('a forged forwarded header is not believed without trustProxy', async () => {
+    const forged = { headers: { 'x-forwarded-for': '198.51.100.7' }, remoteAddress: '10.0.0.1' };
+    expect(await doorAtTheRead(await boot(), forged)).toEqual({ address: '10.0.0.1' });
+  });
+
+  it('an address the server cannot establish is still a door, with no address', async () => {
+    expect(await doorAtTheRead(await boot(), {})).toEqual({ address: undefined });
+  });
+
+  it('outside a mount no door is open', async () => {
+    expect(await readMountDoor()).toBeUndefined();
+  });
+});
+
+describe('the organization administrator reads the address their access-policy save is judged by', () => {
+  const NOBODY = '192.0.2.0/24';
+
+  it('an organization administrator reads the address the save check judges, the platform route\'s answer', async () => {
+    for (const [plugin, transport] of [
+      [{}, { remoteAddress: '203.0.113.9' }],
+      [{ trustProxy: true }, { headers: { 'x-forwarded-for': '198.51.100.7, 10.0.0.2' }, remoteAddress: '10.0.0.1' }],
+      [{}, {}],
+    ] as const) {
+      const rig = await boot({ plugin });
+      const read = await rig.orgRead(transport);
+      expect(read.status, JSON.stringify(read.body)).toBe(200);
+      expect(read.cacheControl).toBe('no-store');
+      // The platform administrator's read of the same connection answers the same address…
+      expect(read.body.data).toEqual((await rig.read(transport)).body.data);
+      // …and it is the address a save from that connection is judged by.
+      const save = await rig.save({ allowed_ip_ranges: NOBODY }, transport);
+      expect(save.status, JSON.stringify(save.body)).toBe(400);
+      const judged = save.body.error.details.fields.find((f: any) => f.field === 'allowed_ip_ranges').constraint.clientAddress;
+      expect(read.body.data.clientAddress).toBe(judged);
+    }
+  });
+
+  it('the platform route still refuses that organization administrator, who is not a platform admin', async () => {
+    const res = await (await boot()).read(
+      { remoteAddress: '203.0.113.9' },
+      { session: { user: { id: 'usr_org_admin', email: 'org-admin@example.com' } } },
+    );
+    expect(res.status).toBe(403);
+    expect(res.body.error.code).toBe('PERMISSION_DENIED');
+  });
+
+  describe('who may read it: the caller who may save the list, refused before any address is read', () => {
+    const refusedBeforeTheRead = async (caller: OrganizationAddressReaderContext | undefined) => {
+      const rig = await boot();
+      const asked = vi.spyOn(rig.manager, 'trustsForwardedHeaders');
+      const res = await rig.orgRead({ remoteAddress: '203.0.113.9' }, { caller });
+      expect(asked).not.toHaveBeenCalled();
+      expect(res.body.success).toBe(false);
+      expect(res.body.data).toBeUndefined();
+      return res;
+    };
+
+    it('no principal: 401 UNAUTHENTICATED', async () => {
+      const res = await refusedBeforeTheRead(undefined);
+      expect(res.status).toBe(401);
+      expect(res.body.error.code).toBe('UNAUTHENTICATED');
+    });
+
+    it('a plain member, without setup.write in their organization: 403 PERMISSION_DENIED', async () => {
+      const res = await refusedBeforeTheRead({ systemPermissions: ['setup.access'] });
+      expect(res.status).toBe(403);
+      expect(res.body.error.code).toBe('PERMISSION_DENIED');
+    });
+
+    it("a held organization administrator (ADR-0069 D3): 403 with the posture's own code", async () => {
+      const res = await refusedBeforeTheRead({
+        ...ORG_ADMIN_CALLER,
+        authGate: { code: 'MFA_REQUIRED', message: 'Set up two-factor authentication.' },
+      });
+      expect(res.status).toBe(403);
+      expect(res.body.error.code).toBe('MFA_REQUIRED');
+    });
+  });
+
+  it('an unreachable permission store is an outage, 503 SERVICE_UNAVAILABLE, never a refusal', async () => {
+    const res = await (await boot()).orgRead({ remoteAddress: '203.0.113.9' }, { caller: new AuthzStoreUnavailableError('sys_user_permission_set') });
+    expect(res.status).toBe(503);
+    expect(res.body.error.code).toBe('SERVICE_UNAVAILABLE');
+    expect(res.body.data).toBeUndefined();
+  });
+
+  it('the query set is closed and empty: no parameter can name another address, user or organization', async () => {
+    const rig = await boot();
+    const asked = vi.spyOn(rig.manager, 'trustsForwardedHeaders');
+    for (const query of ['?userId=usr_other', '?organizationId=org_other', '?address=198.51.100.7']) {
+      const res = await rig.orgRead({ remoteAddress: '203.0.113.9' }, { query });
+      expect(res.status).toBe(400);
+      expect(res.body.error.code).toBe('VALIDATION_ERROR');
+      expect(res.body.data).toBeUndefined();
+    }
+    expect(asked).not.toHaveBeenCalled();
+  });
+});
+
 describe('an allowed IP range whose prefix is not decimal digits within its family is refused at every save door and never matches at the gate', () => {
   // An entry is an address, or an address, `/` and a prefix length of one or
   // two decimal digits from 0 to 32 (IPv4) or one to three from 0 to 128