@@ -0,0 +1,14 @@
+---
+'@objectstack/platform-objects': patch
+'@objectstack/plugin-auth': patch
+'@objectstack/core': patch
+---
+
+feat(plugin-auth,platform-objects,core): `sys_api_key.revoked_reason` accepts `organization_membership_ended`, and no user-context Restore lifts it
+
+Clause-②: yes (widening)
+Metadata-protocol: none
+
+- **`@objectstack/platform-objects`: `sys_api_key.revoked_reason` gains the option `organization_membership_ended`** ("Organization membership ended"), beside `admin_password_reset`. It is the word `sys_session.revoke_reason` already carries when a membership removal ends a session, so one grep finds every place the platform acts on a membership ending, across sessions and keys. The platform never writes it: a host that removes someone from the organization and revokes their keys writes it in the system context, beside `revoked: true`. The column stays readonly and off the ADR-0092 D2 whitelist, so no data-API write sets or clears it. The field's help text names both reasons and who can restore each; the six translated locales carry the new option and the new help.
+- **`@objectstack/plugin-auth`: the restore guard refuses every user-context restore of a key carrying that reason**, a platform administrator's included (by the `admin_full_access` grant or by the `OS_PLATFORM_OWNER_EMAIL` anchor), on the by-id path and per row on a multi-row update: `403 PERMISSION_DENIED`, nothing written, and a message that says the owner's membership ended and that a member creates a new key (`POST /api/v1/keys`, or the API Keys page). This is the `restore_api_key` row action's own door (`PATCH /api/v1/data/sys_api_key/{id}` with `{ revoked: false }`). Re-arming the key would hand a non-member's credential back its access, whoever clicks Restore, and on a `single` deployment no per-request membership check refuses the key, so `revoked` is the only barrier. A system-context un-revoke still lands and clears the reason, as for every reason. `admin_password_reset` keeps its rule unchanged: a platform administrator restores it, its owner does not.
+- **`@objectstack/core`: the key door's `403 API_KEY_REVOKED` text for such a key** says it was revoked because its owner's membership in the organization ended and cannot be restored, and names the new-key road. It used to offer "its owner or a platform administrator can restore it", a restore the guard now refuses. Code, status and every carried field are unchanged.
@@ -351,4 +351,21 @@ describe('[#23944] the revoked refusal agrees with the declared restore action',
     expect(resetMessage).toContain('POST /api/v1/keys');
     expect(plainMessage).toMatch(/Its owner or a platform administrator can restore it/);
   });
+
+  it('a key revoked because its owner\'s membership ended names no restorer, only the new-key road', async () => {
+    // `revoked_reason: organization_membership_ended` is written by the host
+    // that removed the owner, and plugin-auth's restore door refuses every
+    // user-context restore on that reason, a platform administrator's
+    // included. The text follows the door: it offers no restore anyone could
+    // make. Code, status and every carried field stay those of any revoked key.
+    const ended = await resolveApiKeyAdmission(
+      makeQl({ revoked: true, revoked_reason: 'organization_membership_ended' }), headers(), NOW, undefined, undefined, policy(),
+    );
+
+    expect(ended.outcome === 'lifecycle' && ended.refusal).toMatchObject({ code: 'API_KEY_REVOKED', keyId: KEY_ID, userId: OWNER });
+    const endedMessage = ended.outcome === 'lifecycle' ? ended.refusal.message : '';
+    expect(endedMessage).toMatch(/membership in the organization ended, and it cannot be restored/);
+    expect(endedMessage).not.toMatch(/can restore it/);
+    expect(endedMessage).toContain('POST /api/v1/keys');
+  });
 });
@@ -315,17 +315,24 @@ function lifecycleRefusalOf(
       // `revoked_reason`: a key an administrator's forced password reset
       // revoked (`admin_password_reset`) is restored by a platform
       // administrator only (plugin-auth `api-key-restore-guard.ts` refuses its
-      // owner); any other revoked key by its owner or a platform administrator.
-      // The text names exactly those restorers and never claims the key is
-      // gone for good. Rotation stays the other road, for a key that should
-      // not come back.
+      // owner); a key revoked because its owner's membership in the
+      // organization ended (`organization_membership_ended`, written by the
+      // host that removed them) by no one, the same guard refusing every
+      // user-context restore of it; any other revoked key by its owner or a
+      // platform administrator. The text names exactly those restorers, and
+      // says the key cannot come back only where no restorer exists. Rotation
+      // stays the other road, for a key that should not come back.
       message: row.revoked_reason === 'admin_password_reset'
         ? `${label} was revoked by an administrator's forced password reset. Only a platform administrator can `
           + 'restore it (the Restore API Key action on the API Keys list); otherwise create a new key '
           + '(POST /api/v1/keys, or the API Keys page) and replace this one wherever it is configured.'
-        : `${label} was revoked. Its owner or a platform administrator can restore it (the Restore API Key action `
-          + 'on the API Keys list); otherwise create a new key (POST /api/v1/keys, or the API Keys page) and replace '
-          + 'this one wherever it is configured.',
+        : row.revoked_reason === 'organization_membership_ended'
+          ? `${label} was revoked because its owner's membership in the organization ended, and it cannot be `
+            + 'restored. A member of the organization creates a new key (POST /api/v1/keys, or the API Keys page) '
+            + 'and replaces this one wherever it is configured.'
+          : `${label} was revoked. Its owner or a platform administrator can restore it (the Restore API Key action `
+            + 'on the API Keys list); otherwise create a new key (POST /api/v1/keys, or the API Keys page) and replace '
+            + 'this one wherever it is configured.',
       ...ids,
     };
   }
 
@@ -1160,9 +1160,10 @@ export const arObjects: NonNullable<TranslationData['objects']> = {
       },
       revoked_reason: {
         label: "سبب الإلغاء",
-        help: "يُعيَّن عندما تُبطل إعادة تعيين كلمة المرور القسرية من قِبل المسؤول هذا المفتاح. لا يستطيع استعادة مثل هذا المفتاح إلا مسؤول المنصة؛ وينشئ مالكه مفتاحًا جديدًا. يُمسح عند استعادة المفتاح. فارغ للمفتاح المُبطَل من قائمة مفاتيح API.",
+        help: "سبب إبطال المفتاح، حين يحدد من يستطيع استعادته. إعادة تعيين كلمة المرور من قِبل المسؤول: لا يستطيع استعادة المفتاح إلا مسؤول المنصة. انتهاء العضوية في المؤسسة: غادر المالك المؤسسة، ولا يستطيع أحد استعادة المفتاح؛ وينشئ عضوٌ مفتاحًا جديدًا. يُمسح عند استعادة المفتاح. فارغ للمفتاح المُبطَل من قائمة مفاتيح API.",
         options: {
-          admin_password_reset: "إعادة تعيين كلمة المرور من قِبل المسؤول"
+          admin_password_reset: "إعادة تعيين كلمة المرور من قِبل المسؤول",
+          organization_membership_ended: "انتهاء العضوية في المؤسسة"
         }
       },
       key: {
 
@@ -1160,9 +1160,10 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
       },
       revoked_reason: {
         label: "Revoke Reason",
-        help: "Set when an administrator's forced password reset revoked this key. Only a platform administrator can restore such a key; its owner creates a new one. Cleared when the key is restored. Empty for a key revoked from the API Keys list.",
+        help: "Why the key was revoked, where that decides who can restore it. Administrator password reset: only a platform administrator can restore the key. Organization membership ended: the owner left the organization, and no one can restore the key; a member creates a new one. Cleared when the key is restored. Empty for a key revoked from the API Keys list.",
         options: {
-          admin_password_reset: "Administrator password reset"
+          admin_password_reset: "Administrator password reset",
+          organization_membership_ended: "Organization membership ended"
         }
       },
       key: {
 
@@ -1160,9 +1160,10 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
       },
       revoked_reason: {
         label: "Motivo de la revocación",
-        help: "Se registra cuando el restablecimiento forzado de la contraseña por parte de un administrador revocó esta clave. Solo un administrador de la plataforma puede restaurar una clave así; su propietario crea una nueva. Se borra cuando la clave se restaura. Vacío para una clave revocada desde la lista de claves de API.",
+        help: "Por qué se revocó la clave, cuando eso decide quién puede restaurarla. Restablecimiento forzado de la contraseña por un administrador: solo un administrador de la plataforma puede restaurar la clave. Fin de la pertenencia a la organización: el propietario dejó la organización y nadie puede restaurar la clave; un miembro crea una nueva. Se borra cuando la clave se restaura. Vacío para una clave revocada desde la lista de claves de API.",
         options: {
-          admin_password_reset: "Restablecimiento forzado de la contraseña por un administrador"
+          admin_password_reset: "Restablecimiento forzado de la contraseña por un administrador",
+          organization_membership_ended: "Fin de la pertenencia a la organización"
         }
       },
       key: {
 
@@ -1160,9 +1160,10 @@ export const frObjects: NonNullable<TranslationData['objects']> = {
       },
       revoked_reason: {
         label: "Motif de la révocation",
-        help: "Renseigné lorsque la réinitialisation forcée du mot de passe par un administrateur a révoqué cette clé. Seul un administrateur de la plateforme peut restaurer une telle clé ; son propriétaire en crée une nouvelle. Effacé lorsque la clé est restaurée. Vide pour une clé révoquée depuis la liste Clés API.",
+        help: "Motif de la révocation de la clé, lorsqu'il détermine qui peut la restaurer. Réinitialisation du mot de passe par un administrateur : seul un administrateur de la plateforme peut restaurer la clé. Fin de l'appartenance à l'organisation : le propriétaire a quitté l'organisation et personne ne peut restaurer la clé ; un membre en crée une nouvelle. Effacé lorsque la clé est restaurée. Vide pour une clé révoquée depuis la liste Clés API.",
         options: {
-          admin_password_reset: "Réinitialisation du mot de passe par un administrateur"
+          admin_password_reset: "Réinitialisation du mot de passe par un administrateur",
+          organization_membership_ended: "Fin de l'appartenance à l'organisation"
         }
       },
       key: {
 
@@ -1160,9 +1160,10 @@ export const jaJPObjects: NonNullable<TranslationData['objects']> = {
       },
       revoked_reason: {
         label: "失効理由",
-        help: "管理者によるパスワードの強制リセットでこのキーが失効したときに記録されます。このようなキーを復元できるのはプラットフォーム管理者のみで、所有者は新しいキーを作成します。キーを復元するとクリアされます。API キー一覧から失効させたキーでは空です。",
+        help: "キーが失効した理由で、誰が復元できるかを左右する場合に記録されます。管理者によるパスワードの強制リセット：キーを復元できるのはプラットフォーム管理者のみです。組織メンバーシップの終了：所有者が組織を離れたため、誰もキーを復元できません。組織のメンバーが新しいキーを作成します。キーを復元するとクリアされます。API キー一覧から失効させたキーでは空です。",
         options: {
-          admin_password_reset: "管理者によるパスワードの強制リセット"
+          admin_password_reset: "管理者によるパスワードの強制リセット",
+          organization_membership_ended: "組織メンバーシップの終了"
         }
       },
       key: {
 
@@ -1160,9 +1160,10 @@ export const ptBRObjects: NonNullable<TranslationData['objects']> = {
       },
       revoked_reason: {
         label: "Motivo da revogação",
-        help: "Definido quando a redefinição forçada de senha por um administrador revogou esta chave. Somente um administrador da plataforma pode restaurar essa chave; o proprietário cria uma nova. Limpo quando a chave é restaurada. Vazio para uma chave revogada na lista de Chaves de API.",
+        help: "Por que a chave foi revogada, quando isso decide quem pode restaurá-la. Redefinição de senha pelo administrador: somente um administrador da plataforma pode restaurar a chave. Fim da associação à organização: o proprietário saiu da organização e ninguém pode restaurar a chave; um membro cria uma nova. Limpo quando a chave é restaurada. Vazio para uma chave revogada na lista de Chaves de API.",
         options: {
-          admin_password_reset: "Redefinição de senha pelo administrador"
+          admin_password_reset: "Redefinição de senha pelo administrador",
+          organization_membership_ended: "Fim da associação à organização"
         }
       },
       key: {
 
@@ -1160,9 +1160,10 @@ export const zhCNObjects: NonNullable<TranslationData['objects']> = {
       },
       revoked_reason: {
         label: "撤销原因",
-        help: "管理员强制重置密码时撤销了该密钥，则记录此原因。此类密钥只能由平台管理员恢复，其所有者应创建新的密钥。密钥恢复后清除。从 API 密钥列表撤销的密钥此项为空。",
+        help: "密钥被撤销的原因，仅在它决定谁能恢复密钥时记录。管理员强制重置密码：只有平台管理员能恢复该密钥。组织成员资格已结束：所有者已离开组织，任何人都不能恢复该密钥，由组织成员创建新的密钥。密钥恢复后清除。从 API 密钥列表撤销的密钥此项为空。",
         options: {
-          admin_password_reset: "管理员强制重置密码"
+          admin_password_reset: "管理员强制重置密码",
+          organization_membership_ended: "组织成员资格已结束"
         }
       },
       key: {