@@ -28,7 +28,7 @@ Ruling A on #23367: the key store stays `sys_api_key`, and the policy is auth co
 - **The key-admission seam (`resolveApiKeyAdmission`, `@objectstack/core`).** A real key its own state refuses is a new outcome, `lifecycle`, with one of three distinct codes: `API_KEY_REVOKED`, `API_KEY_EXPIRED` (past `expires_at`, or past the grace of a key created with none) or `API_KEY_INACTIVE` (no recorded use for longer than the window). `resolveAuthzContext` raises it as the branded `ApiKeyLifecycleRefusalError` (`403`, a located message naming the key's prefix, the date and the remedy). An unknown key is still `none`.
 - **`last_used_at` is written.** Its description promised "Automatically updated on each API call", and nothing wrote it. The seam now stamps it on an admitted (or held) call, at most once an hour per key, and the inactivity judgment reads the value as it was BEFORE that call's stamp, so a key's own use cannot revive it. A stamp that fails never fails the request; it is said once, at `error`.
 - **Keys created before the policy.** A key with no expiry gets one year from `api_key_policy_started_at`; the date is stamped onto its `expires_at` the first time it is admitted, so the keys page shows it, and the refusal after it names it. A key with no recorded use counts its inactivity from the same anchor (or from its own creation, when later) — never from an earlier `created_at`, since no use was ever recorded before the policy.
-- **Every face that admits keys** passes the policy source (`apiKeyLifecyclePolicySourceOf(authService)`, a required input beside `userAuthGates`). The REST data API, the datasource admin routes, the share-link routes, the marketplace install-local routes and the MCP stdio transport answer the refusal's `403` and code. The runtime dispatcher (the MCP HTTP endpoint among its routes), the settings routes and the storage routes refuse the same key with their generic `401` — fail-closed, never an admission — and the server log names the code.
+- **Every face that admits keys** passes the policy source (`apiKeyLifecyclePolicySourceOf(authService)`, a required input beside `userAuthGates`). Every one of them answers the refusal's `403` and code: the runtime dispatcher (the MCP HTTP endpoint among its routes), the REST data API, the settings routes, the storage download routes, the datasource admin routes, the share-link routes, the marketplace install-local routes and the MCP stdio transport. Each relays the refusal by its brand, so every other identity fault at those doors keeps its existing answer.
 - **`OS_CLOUD_API_KEY` is untouched.** It is the runtime's outbound credential to the control plane, never admitted by this seam.
 
 What changes for you:
@@ -37,5 +37,5 @@ What changes for you:
 - **A signing asking for more than a year is refused** `400 API_KEY_EXPIRY_TOO_LONG`, where it used to be accepted. Ask for the date the message names, or an earlier one.
 - **A key unused for 90 days is refused** `403 API_KEY_INACTIVE`, where it used to be served. It is not revoked; the remedy is a new key.
 - **A key that already existed with no expiry keeps working for one year** from the date the policy took effect on your deployment (`auth.api_key_policy_started_at`), then answers `403 API_KEY_EXPIRED` naming that date. Replace such keys within the year.
-- **A revoked or expired key answers its own code** (`403 API_KEY_REVOKED` / `API_KEY_EXPIRED`) on the faces listed above, where it used to answer the generic `401`; and a session cookie sent beside such a key no longer answers for it.
+- **A revoked or expired key answers its own code** (`403 API_KEY_REVOKED` / `API_KEY_EXPIRED`) on every face that accepts a key, where it used to answer the generic `401`; and a session cookie sent beside such a key no longer answers for it.
 - **Hosts calling `resolveAuthzContext`, `resolveApiKeyAdmission` or `resolveApiKeyPrincipal` directly** pass `apiKeyLifecycle: apiKeyLifecyclePolicySourceOf(authService)` (or the sixth argument), or an explicit `undefined` where no auth service exists. A caller of `resolveAuthzContext` that wants the located answer re-raises `ApiKeyLifecycleRefusalError` (`isApiKeyLifecycleRefusalError`) the way it re-raises the store outage. Code switching exhaustively over `ApiKeyAdmission['outcome']` handles the new `lifecycle` outcome.
@@ -168,12 +168,11 @@ create the new key first, switch the integration over, then revoke the old one.
 An unknown key (a typo, a key that never existed) still gets the generic
 `401 UNAUTHENTICATED`.
 
-These codes reach the caller on the REST data API (`/api/v1/data/…`), the
-datasource admin and share-link routes, the marketplace install routes and the
-MCP **stdio** transport. The other endpoints the runtime serves — the MCP HTTP
-endpoint (`/api/v1/mcp`) among them — and the settings and file-storage routes
-refuse the same key with the generic `401 UNAUTHENTICATED`; the server log
-names the code there.
+These codes reach the caller on every endpoint that accepts a key: the MCP
+HTTP endpoint (`/api/v1/mcp`) and the other endpoints the runtime serves, the
+REST data API (`/api/v1/data/…`), the settings, file-download, datasource
+admin and share-link routes, the marketplace install routes, and the MCP
+**stdio** transport.
 
 Send it on every request in any of three equivalent forms:
 
 
@@ -449,7 +449,7 @@ result set — a response indistinguishable from a successful query.
 **Fix:** Create a new key and replace this one wherever it is configured. A revoked key never works again.  
 **Retry:** `no_retry`
 
-These three are answered by the REST data API, the datasource admin and share-link routes, the marketplace install routes and the MCP stdio transport. The other endpoints the runtime serves (the MCP HTTP endpoint among them) and the settings and file-storage routes refuse the same key with the generic `401 UNAUTHENTICATED`. An unknown key is always the generic 401.
+These three are answered on every endpoint that accepts an API key: the endpoints the runtime serves (the MCP HTTP endpoint among them), the REST data API, the settings, file-download, datasource admin and share-link routes, the marketplace install routes and the MCP stdio transport. An unknown key is always the generic 401.
 
 ---