fix(platform-objects): sys_session.revoke_reason description names admin_password_reset (#23518)

Fixes #23477

Clause-②: no

`sys_session.revoke_reason` is free text; its description is the field's
only published vocabulary. It now names `admin_password_reset`, the
value `plugin-auth/forced-reset-revocation.ts`
(`FORCED_RESET_REVOKE_REASON`) writes on sessions an administrator's
forced password reset revokes. Ruling (triage 6168824114): add the value
with its cause and run `node scripts/check-i18n-bundles.mjs --write`;
precedent #15784.

## Changes
- `sys-session.object.ts`: description lists `admin_password_reset`
after `organization_membership_ended`; the in-code comment records it as
the second authorization-event cause.
- `apps/translations/*.objects.generated.ts`: the generator rewrote
`en`; the zh-CN, ja-JP and es-ES help strings are hand-written values,
so I added the value there too, as #15784 did.
- New `plugin-auth/src/forced-reset-revoke-reason-vocabulary.test.ts`:
asserts the description contains the producer's constant (no existing
test pinned the list; plugin-auth already depends on platform-objects,
the reverse would not be allowed).
- `.changeset/23477-revoke-reason-vocabulary.md`: patch for
`@objectstack/platform-objects`, description text only.

Landing spot matches the claim's file surface; the test sits in
plugin-auth, the producer side.

## Evidence (head after merging origin/main)
- `check-i18n-bundles.mjs --write` exit 0; plain run: all bundles in
sync (10 packages).
- plugin-auth new test 1/1; platform-objects full suite 70 files, 1091
tests; both packages' typecheck OK; `@objectstack/spec` `test:repo` 60
files, 1029 tests.
- dispatch-gates: 66 derived families, all run, all exit 0 except
`check:dual-build-cjs-loads` (exit 3, PREREQUISITE NOT MET, no dist for
unrelated packages): NOT MEASURED, a description-only diff does not
reach it.
- No accept/refuse change, so no consumer sweep beyond the above.

## Acceptance notes
Bundle folder is `apps/translations` (not `identity`); open PR #23469
also regenerates that folder, so the later lander re-runs the generator.

---
_Generated by [Claude
Code](https://claude.ai/code/session_01D6F9axfoPzR7t8G1J7Ytzz)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

.changeset/23477-revoke-reason-vocabulary.md

@@ -0,0 +1,5 @@
+---
+'@objectstack/platform-objects': patch
+---
+
+fix(platform-objects): the `sys_session.revoke_reason` description names `admin_password_reset`, the value an administrator's forced password reset writes on the sessions it revokes. Description text only; nothing is accepted or refused differently.

packages/platform-objects/src/apps/translations/en.objects.generated.ts

@@ -342,7 +342,7 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
       },
       revoke_reason: {
         label: "Revoke Reason",
-        help: "Why the session was revoked (idle_timeout, absolute_max, concurrent_cap, user_revoked, admin, organization_membership_ended, …)."
+        help: "Why the session was revoked (idle_timeout, absolute_max, concurrent_cap, user_revoked, admin, organization_membership_ended, admin_password_reset, …)."
       },
       active_organization_id: {
         label: "Active Organization"

packages/platform-objects/src/apps/translations/es-ES.objects.generated.ts

@@ -342,7 +342,7 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
       },
       revoke_reason: {
         label: "Motivo de la revocación",
-        help: "Por qué se revocó la sesión (idle_timeout, absolute_max, concurrent_cap, user_revoked, admin, organization_membership_ended, …)."
+        help: "Por qué se revocó la sesión (idle_timeout, absolute_max, concurrent_cap, user_revoked, admin, organization_membership_ended, admin_password_reset, …)."
       },
       active_organization_id: {
         label: "Organización activa"

packages/platform-objects/src/apps/translations/ja-JP.objects.generated.ts

@@ -342,7 +342,7 @@ export const jaJPObjects: NonNullable<TranslationData['objects']> = {
       },
       revoke_reason: {
         label: "失効理由",
-        help: "セッションが失効した理由（idle_timeout、absolute_max、concurrent_cap、user_revoked、admin、organization_membership_ended など）。"
+        help: "セッションが失効した理由（idle_timeout、absolute_max、concurrent_cap、user_revoked、admin、organization_membership_ended、admin_password_reset など）。"
       },
       active_organization_id: {
         label: "アクティブ組織"

packages/platform-objects/src/apps/translations/zh-CN.objects.generated.ts

@@ -342,7 +342,7 @@ export const zhCNObjects: NonNullable<TranslationData['objects']> = {
       },
       revoke_reason: {
         label: "撤销原因",
-        help: "会话被撤销的原因（idle_timeout、absolute_max、concurrent_cap、user_revoked、admin、organization_membership_ended 等）。"
+        help: "会话被撤销的原因（idle_timeout、absolute_max、concurrent_cap、user_revoked、admin、organization_membership_ended、admin_password_reset 等）。"
       },
       active_organization_id: {
         label: "当前组织"

packages/platform-objects/src/identity/sys-session.object.ts

@@ -196,9 +196,12 @@ export const SysSession = ObjectSchema.create({
       // backing a session's active organization ends and the user holds no
       // other. ⛔ It is a COURTESY, never the enforcement: the wall is the
       // per-request membership check in `resolve-authz-context.ts`.
+      // `admin_password_reset` is the second authorization-event cause: an
+      // administrator's forced password reset revoked the session
+      // (`plugin-auth/forced-reset-revocation.ts`, `FORCED_RESET_REVOKE_REASON`).
       description:
         'Why the session was revoked (idle_timeout, absolute_max, concurrent_cap, user_revoked, '
-        + 'admin, organization_membership_ended, …).',
+        + 'admin, organization_membership_ended, admin_password_reset, …).',
     }),
 
     // ── Active context (multi-org/team) ──────────────────────────

packages/plugins/plugin-auth/src/forced-reset-revoke-reason-vocabulary.test.ts

@@ -0,0 +1,13 @@
+import { describe, it, expect } from 'vitest';
+import { SysSession } from '@objectstack/platform-objects/identity';
+import { FORCED_RESET_REVOKE_REASON } from './forced-reset-revocation';
+
+// `sys_session.revoke_reason` is free text; its description is the only
+// published vocabulary, so a value this producer writes must be named there.
+describe('sys_session.revoke_reason vocabulary', () => {
+  it('names the value a forced reset writes', () => {
+    expect(FORCED_RESET_REVOKE_REASON).toBe('admin_password_reset');
+    const description = String((SysSession.fields as any).revoke_reason.description);
+    expect(description).toContain(FORCED_RESET_REVOKE_REASON);
+  });
+});