A removed admin keeps their frozen reach forever and can still sign revocations that cover it, so durable removal of an admin requires rotating the role to a fresh key.

Revoking an admin's membership alone is not a removal. Every team will hit this.

Bob was an admin of Members. Dan removes him. Bob cannot read, write, or grant anything. But Members is on his keyring. And keyrings never shrink.

So Bob can keep signing revocations that cut through Members. Against members added years later. There is no clock. His old notes and his new notes look the same.

He cannot take anything. Every note is signed. This is griefing, not theft. But it is forever. Unless you move.

Rotation. Mint a fresh role. Members prime. Its key signs the surviving admins in, and is destroyed. Dan wires the document into Members prime, and unplugs the old supply.

Then the members who stay get re-added. One certificate each. The roster is the whole job.

Everything below comes back by itself. A team Alice wired up from Members keeps working. Nothing re-signed.

Bob's keys now open a room that routes nothing. His revocations stop biting. Even the good ones. The survivors re-sign those.

The survivors' keyrings grow to include Members prime. Their old revocations keep working.

One hazard. The old room is dormant, not demolished. Its roster is still wired inside. Wire a document into old Members again, and every former member lights up. And Bob's keys work again.

After removing an admin, rotate the role. Otherwise the removal is not durable.

Check yourself. Dan revokes Bob's admin membership and does nothing else. Can Bob still cut new members?