@bongos/core 1.20.69 → 1.20.70

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.20.69",
-  "core_contract": "1.20.69",
-  "source_commit": "983e206de19e3e452119fa087677995534a0bd91",
+  "core_version": "1.20.70",
+  "core_contract": "1.20.70",
+  "source_commit": "31aa1da4c574b3429cbe3bea1cee188486c0845b",
   "source_ref": "HEAD",
-  "built_at": "2026-10-01T14:04:36.716Z",
+  "built_at": "2026-10-01T14:41:01.807Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 572,
     "agent_docs_stubbed": 27,
-    "functional_verbatim": 2794,
+    "functional_verbatim": 2795,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3394,
-  "tree_sha256": "251c283dabfc92029abfd63749f8c964092c6110a6773d446852b4f8f11ca724",
+  "file_count": 3395,
+  "tree_sha256": "ba829522471ea62d370430e52214b3298f81333cef684d98d98231286a345e34",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -317,12 +317,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "3350163ed447189b523028f711e3ef1a400ea375ebe7123f2515add8b6a89de1"
+      "sha256": "472c0606ff4fe4e775d56e038702960834838d8767e984427f5de29d31f9cbe9"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "a863d3db1a112c490648e0f2b3eaddf3f2e8c9ebe107ec298ea5ff0c663a5e6a"
+      "sha256": "d641fbda06eb527c39d2eabbc7afc9f9182b03d766917e9fd84d69e86e9cc397"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -332,17 +332,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "06bf39230e1c813494dc85130694754d1eb6b3fd55d3e93a684dd238bf6bc22b"
+      "sha256": "73b143d7faa4d930ab82f9f31b178816cc5a8ea87754de7e0575441905d4562a"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "2345d96c47f3851443f8b1adc5dac4556705e7f63f9875a4c62252bf833f17d4"
+      "sha256": "05ba628ec9c3761d8814af291cd5b11a02dd279c6e8df232b20ca632cc1e4336"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "313cfd428b7fd04a9fec6e56cdc1ddabb69af6ca144d7e09d2384a50d48b53df"
+      "sha256": "11a7eb441c5533244c695a4c60fe7b170e87eb4081af77703e796e8370e971e5"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -2262,12 +2262,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "0abf904bcf32aef68bd70592d09cb986e4538cae62c2b9b268af8904d8a483fb"
+      "sha256": "a24995419c2daa05deca5f2ed06656801c313f7499039a739b1bfa2cbc87e595"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "026ea9ba339051ada00869b8363718fae4fcded3be6eae98bcc60a37b9e844dc"
+      "sha256": "63946432b10d130a8f1749ced38bb733449ea4ed8039c9794287d3a269249b0c"
     },
     {
       "path": "docs/architecture.md",
@@ -2802,12 +2802,12 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "36f8057dc29204b364c3d02c48b4ea21082a94915d187405dc863af09fda03d7"
+      "sha256": "82e53cbebb5b042447d74679e2501c04a79e55d473e4cb3976578572152d5cf6"
     },
     {
       "path": "docs/modules-contract.md",
       "mode": "0000644",
-      "sha256": "5d78d2fa2266bfed7e1034c0649274cb544333aa0c81ecdcb34413524729764f"
+      "sha256": "33eb2665aea5cc00feb1de80b673f6063f98b2a8bd2caeb6fa4b09e41965c1df"
     },
     {
       "path": "docs/onboarding/diagrams/01-task-lifecycle.mmd",
@@ -9457,12 +9457,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "d67978a0c965aad91f26a8f1c1b8e913cca63e4aeafb8348bf842d817a5078a6"
+      "sha256": "ce7e8e4e85602173606cdf3d320047cb41654ab0662ea2840537a7f10b4dfab4"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "742449c7fddbb1eb1de87b87308a2cb3585f0a2e0b8ab5eba5818fbab42106f7"
+      "sha256": "f82ba870c1432fd2fd421397df493f3c052bab48a920d403558364ccd720a109"
     },
     {
       "path": "public-docs/index.html",
@@ -9482,7 +9482,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "b4ccf7b529c34b659f29b69fb6d06b0b53b534469c637f3bc2f8bf62d0623e7a"
+      "sha256": "936955084e861a2c76032f3219e888b6c83c137c2ad6f0ba744ad7f65c5492a3"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -10342,7 +10342,7 @@
     {
       "path": "scripts/gds/module.js",
       "mode": "0000644",
-      "sha256": "7ac7a4234d44c592f51a28d95a91f14379c6271977eb05d1e89700ba72827817"
+      "sha256": "240a50d80078e81b692cea24d823340d797f3193afd6bec0dcb5d9afb0669c54"
     },
     {
       "path": "scripts/gds/move-escalation.js",
@@ -11147,7 +11147,7 @@
     {
       "path": "scripts/gds/upgrade.js",
       "mode": "0000644",
-      "sha256": "399c2225543fc0d37505bca9cd96e33cf5598aa1f364a458d5b5efb3a588ddb3"
+      "sha256": "0646b9d86c01d190ed1b670694d2585827241b94792c70852b670a06327afb40"
     },
     {
       "path": "scripts/gds/validate-design.js",
@@ -11437,7 +11437,7 @@
     {
       "path": "src/bongos/module-store.js",
       "mode": "0000644",
-      "sha256": "6e058031cd08e741f970c6f4a535e36ff96bd61a34d335e72ab82d91e508d21f"
+      "sha256": "4d4cb32e7fdc80c2f31c76a04d939c62980515eb06f7d3862a91c5163a9a70ce"
     },
     {
       "path": "src/bongos/module-submissions.js",
@@ -11587,7 +11587,7 @@
     {
       "path": "src/bongos/routes/modules.js",
       "mode": "0000644",
-      "sha256": "9a73d17319e72baaf1214bad5b8ae7847c8c11a4caa7cb7db74ef5b5dce1be8d"
+      "sha256": "abf74a67f9706eed2d8134c8bff0e1ab55831493aeb4217e5a0f16326e85c64b"
     },
     {
       "path": "src/bongos/routes/my-sessions.js",
@@ -11662,7 +11662,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "e1bae2a66ddf99dc54ceb55ce274d116780689f5ef224841d16106bc8b81701d"
+      "sha256": "4ac89563e04b58f5b2a3662990aeb1916f614ba099fe1414f10a51865168cb48"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -14742,7 +14742,7 @@
     {
       "path": "tests/module_cli.mjs",
       "mode": "0000644",
-      "sha256": "cc3a4259d03582ca93287271ddc95bbeaea76447e104b8fb0f33aa6b154c8e7c"
+      "sha256": "18fa817150d1d390f5f1c44651aea7e667227c8063393b2d0f82ff0b9f7fbaa8"
     },
     {
       "path": "tests/module_contributions.mjs",
@@ -14824,6 +14824,11 @@
       "mode": "0000644",
       "sha256": "1b50c9f68bfe731b29ddcce6947847b6e6f3f7bc5b0a08bbacc4afb25d5a3d90"
     },
+    {
+      "path": "tests/module_upgrade_updates.mjs",
+      "mode": "0000644",
+      "sha256": "7260dabcf71a69d4ce41609e8a88c94c112fdda354f774dadf0a2648f4feacaf"
+    },
     {
       "path": "tests/modules.mjs",
       "mode": "0000644",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 485 operations across 73 resource groups
+- 486 operations across 73 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -1087,6 +1087,8 @@ function createClient(opts = {}) {
       getStoreModulesKeyVersionsVersionHowto: (args) => request("GET", "/store/modules/{key}/versions/{version}/howto", { hasBody: false }, args),
       // GET /store/modules/{key}/versions/{version}/tarball — rank: any-builder — GET /store/modules/:key/versions/:version/tarball
       getStoreModulesKeyVersionsVersionTarball: (args) => request("GET", "/store/modules/{key}/versions/{version}/tarball", { hasBody: false }, args),
+      // GET /store/modules/latest — rank: any-builder — GET /store/modules/latest
+      getStoreModulesLatest: (args) => request("GET", "/store/modules/latest", { hasBody: false }, args),
     },
     "taskRecommendations": {
       // POST /task-recommendations — rank: any-builder — POST /task-recommendations

package/clients/bongos-client/index.cjs

@@ -1086,6 +1086,8 @@ function createClient(opts = {}) {
       getStoreModulesKeyVersionsVersionHowto: (args) => request("GET", "/store/modules/{key}/versions/{version}/howto", { hasBody: false }, args),
       // GET /store/modules/{key}/versions/{version}/tarball — rank: any-builder — GET /store/modules/:key/versions/:version/tarball
       getStoreModulesKeyVersionsVersionTarball: (args) => request("GET", "/store/modules/{key}/versions/{version}/tarball", { hasBody: false }, args),
+      // GET /store/modules/latest — rank: any-builder — GET /store/modules/latest
+      getStoreModulesLatest: (args) => request("GET", "/store/modules/latest", { hasBody: false }, args),
     },
     "taskRecommendations": {
       // POST /task-recommendations — rank: any-builder — POST /task-recommendations

package/clients/bongos-client/index.d.ts

@@ -167,6 +167,7 @@ export interface GetSpecialitiesResponse { specialities: unknown }
 export interface GetSsoPubkeyResponse { alg: unknown; format: unknown; public_key_b64: unknown }
 export interface GetStoreEntitlementsResponse { entitlements: unknown }
 export interface GetStoreModulesKeyVersionsVersionHowtoResponse { module_key: unknown; title: unknown; version: unknown; published_at: unknown; delisted: unknown; markdown: unknown; artifact_url: unknown }
+export interface GetStoreModulesLatestResponse { latest: unknown }
 export interface GetTaskRecommendationsForMeResponse { recommendations: unknown; count: unknown }
 export interface GetTaskRecommendationsMineResponse { recommendations: unknown; count: unknown }
 export interface GetTasksClaimableResponse { claimable: unknown; claimable_total: unknown; active_claims: unknown }
@@ -1533,6 +1534,8 @@ export interface BongosClient {
     getStoreModulesKeyVersionsVersionHowto(args?: RequestArgs): Promise<GetStoreModulesKeyVersionsVersionHowtoResponse>;
     /** GET /store/modules/{key}/versions/{version}/tarball — rank: any-builder */
     getStoreModulesKeyVersionsVersionTarball(args?: RequestArgs): Promise<ApiResponse>;
+    /** GET /store/modules/latest — rank: any-builder */
+    getStoreModulesLatest(args?: RequestArgs): Promise<GetStoreModulesLatestResponse>;
   };
   "taskRecommendations": {
     /** POST /task-recommendations — rank: any-builder */

package/clients/bongos-client/index.mjs

@@ -1083,6 +1083,8 @@ export function createClient(opts = {}) {
       getStoreModulesKeyVersionsVersionHowto: (args) => request("GET", "/store/modules/{key}/versions/{version}/howto", { hasBody: false }, args),
       // GET /store/modules/{key}/versions/{version}/tarball — rank: any-builder — GET /store/modules/:key/versions/:version/tarball
       getStoreModulesKeyVersionsVersionTarball: (args) => request("GET", "/store/modules/{key}/versions/{version}/tarball", { hasBody: false }, args),
+      // GET /store/modules/latest — rank: any-builder — GET /store/modules/latest
+      getStoreModulesLatest: (args) => request("GET", "/store/modules/latest", { hasBody: false }, args),
     },
     "taskRecommendations": {
       // POST /task-recommendations — rank: any-builder — POST /task-recommendations

package/docs/api/openapi.json

@@ -19794,6 +19794,44 @@
         ]
       }
     },
+    "/store/modules/latest": {
+      "get": {
+        "operationId": "get_store_modules_latest",
+        "tags": [
+          "store"
+        ],
+        "summary": "GET /store/modules/latest",
+        "description": "The newest published version of each named module — what `bongos upgrade` compares an instance's installed store modules against to report the updates available (task 1003787). `?keys=a,b,c`, at most STORE_LATEST_MAX_KEYS. rank: any-builder — a read of public store metadata (version numbers and the core range each needs, the same facts the how-to page shows). It takes no entitlement and changes nothing, unlike acquire; a key the store does not know is simply absent from the answer.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "src/bongos/routes/modules.js",
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetStoreModulesLatestResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/store/modules/{key}/acquire": {
       "post": {
         "operationId": "post_store_modules_key_acquire",
@@ -24851,6 +24889,15 @@
           "artifact_url"
         ]
       },
+      "GetStoreModulesLatestResponse": {
+        "type": "object",
+        "properties": {
+          "latest": {}
+        },
+        "required": [
+          "latest"
+        ]
+      },
       "GetTaskRecommendationsForMeResponse": {
         "type": "object",
         "properties": {
@@ -30997,9 +31044,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 485,
-  "x-schema-count": 513,
+  "x-endpoint-count": 486,
+  "x-schema-count": 514,
   "x-undocumented-bodies": 12,
-  "x-response-schemas": 343,
+  "x-response-schemas": 344,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 485 endpoints across 89 route files.
+> **Generated from the live route files** — the route file is authoritative. 486 endpoints across 89 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -769,7 +769,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/sso/pubkey` | `public` | — | GET /sso/pubkey — the hub's Ed25519 assertion-verification key (public). |
 | POST | `/api/bongos/sso/token` | `public` | `client_id`, `client_secret`, `code`, `redirect_uri` | POST /sso/token — server-to-server code redemption. |
 
-## `store` (7)
+## `store` (8)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -780,6 +780,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/store/modules/:key/versions` | `metic+archon` | _undocumented_ | POST /api/bongos/store/modules/:key/versions — publish one module version to the store (task 1004271, ADR 0338 D1). |
 | GET | `/api/bongos/store/modules/:key/versions/:version/howto` | `any-builder` | — | GET /api/bongos/store/modules/:key/versions/:version/howto — the how-to a version shipped with (task 1004366, ADR 0347 D1/D3), read from … |
 | GET | `/api/bongos/store/modules/:key/versions/:version/tarball` | `any-builder` | — |  |
+| GET | `/api/bongos/store/modules/latest` | `any-builder` | — | The newest published version of each named module — what `bongos upgrade` compares an instance's installed store modules against to repor… |
 
 ## `task-recommendations` (4)
 

package/docs/module-api-changelog.md

@@ -2795,5 +2795,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.20.67 with no explicit bump. run 36871565601. (task 1002620)
   1.20.69 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.20.68 with no explicit bump. run 36873353617. (task 1002620)
+  1.20.70 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.69 with no explicit bump. run 36877499272. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/modules-contract.md

@@ -380,6 +380,8 @@ Run `bongos upgrade` to confirm coreVersion compatibility, then `node scripts/gd
 - The new version is written beside the old one and swapped in; any failure leaves the installed version in place. Files the new version dropped are gone afterwards.
 - The on/off switch is untouched. A module bundled with the core is refused; it updates with the core (`bongos upgrade`).
 
+**`bongos upgrade` says which installed modules have an update** (task 1003787), below its compatibility rows, so one command answers "what is stale here" for the core and its modules. It asks `GET /store/modules/latest?keys=…` for the newest version of every module here with an exact version — a read that takes no entitlement — and lists each newer one with `bongos module update <key>`, or says it waits for the core when that version needs a newer one. A delisted module is flagged as getting no further versions (ADR 0338 D2). None of this changes the exit code: an incompatible enabled module still blocks and nothing else does. With no session or no reachable store it says "not checked" and the pre-check stands; `--no-store` skips the read.
+
 ## Carving an existing core domain (the `db.js` per-domain pattern)
 
 Most BONGOS-V1 module work is not scaffolding a *new* module — it's **carving an existing core domain out of the monolith** (ADR 0091, criterion C7). The reference carve is the kernel slice `src/bongos/db-kernel.js` (BV1.R69); the feature precedents are `modules/discord/db.js` + `modules/game/db.js`. Every later carve (memory R72, grading R73, …) copies this recipe. The invariant is **OTB byte-identical** at every step — you are *moving* code, not changing behavior.

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.69",
+  "version": "1.20.70",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.69",
+      "version": "1.20.70",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.69",
+  "version": "1.20.70",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8543,5 +8543,11 @@
       "id": "1004490",
       "text": "Session notes for today's account-page work are on file, so the next session can pick up without re-discovering what was done."
     }
+  ],
+  "1.20.70": [
+    {
+      "id": "1003787",
+      "text": "Running 'bongos upgrade' now also tells you which installed modules have a newer version in the store, and the command to update each one. It never stops an upgrade on that account."
+    }
   ]
 }

package/scripts/gds/module.js

@@ -58,7 +58,7 @@
 //   bongos module new <key>            scaffold modules/<key>/
 //   bongos module new <key> --force    overwrite an existing modules/<key>/
 //   bongos module list [--catalog]     browse the module catalog (author + origin credit)
-//   bongos upgrade                     pre-check enabled modules vs the core version
+//   bongos upgrade [--no-store]        pre-check enabled modules vs the core version + list store updates
 //   bongos module check <key> [--sign-off "Name <email>"]   AGPL/publish pre-check + DCO sign-off
 //   bongos module install <key> [--version X.Y.Z]   acquire from the store, verify, place (not enabled)
 //   bongos module update <key> [--version X.Y.Z]    move an installed store module forward
@@ -371,10 +371,10 @@ function gatherUpgrade({ modulesDir = MODULES_DIR, core = coreVersion(), env = p
 
   const rows = [];
   for (const { key, manifest } of loaded) {
-    rows.push({ key, coreVersion: manifest.coreVersion, enabled: enabled[key] === true, satisfied: true, ...upkeep(manifest) });
+    rows.push({ key, version: manifest.version || null, coreVersion: manifest.coreVersion, enabled: enabled[key] === true, satisfied: true, ...upkeep(manifest) });
   }
   for (const { key, manifest, reason } of skippedFull) {
-    rows.push({ key, coreVersion: manifest ? manifest.coreVersion : null, enabled: enabled[key] === true, satisfied: false, reason, ...upkeep(manifest) });
+    rows.push({ key, version: (manifest && manifest.version) || null, coreVersion: manifest ? manifest.coreVersion : null, enabled: enabled[key] === true, satisfied: false, reason, ...upkeep(manifest) });
   }
   rows.sort((a, b) => (a.key < b.key ? -1 : a.key > b.key ? 1 : 0));
   return { rows, errors, core };
@@ -663,7 +663,76 @@ function cmdNew(args, { log = console.log, errlog = console.error } = {}) {
   return 0;
 }
 
-function cmdUpgrade(_args, { log = console.log, errlog = console.error, gather = gatherUpgrade } = {}) {
+// ---------------------------------------------------------------------------
+// Available module updates — the store half of `bongos upgrade` (task 1003787)
+// ---------------------------------------------------------------------------
+
+// Ask the store for the newest version of every module here that carries an exact
+// version (the I/O half). A key the store does not know is absent from the answer,
+// so a module built here, or one the core ships, simply has nothing to report.
+// Never throws: no session or an unreachable store comes back as
+// { checked: false, reason }, because the compatibility pre-check must work
+// offline and must never fail on the store's account.
+async function gatherUpdates(rows, { request } = {}) {
+  const keys = rows.filter((r) => r.version && parseVersion(String(r.version))).map((r) => r.key);
+  if (!keys.length) return { checked: true, latest: {} };
+  let call;
+  try { call = request || storeRequest(); }
+  catch (e) { return { checked: false, reason: e.message }; }
+  let res;
+  try { res = await call('GET', `/store/modules/latest?keys=${keys.map(encodeURIComponent).join(',')}`); }
+  catch (e) { return { checked: false, reason: `the store could not be reached — ${e.message}` }; }
+  // A 404 here is a server whose core predates this route, not a missing module.
+  if (res.status === 404) return { checked: false, reason: "this server's store does not answer update checks yet (its core is older)" };
+  if (!res.ok) return { checked: false, reason: `the store answered ${storeError(res)}` };
+  return { checked: true, latest: (res.data && res.data.latest) || {} };
+}
+
+// Decide what is stale from rows + the store's answer (pure — tests drive it).
+// UPDATES = a module whose store version is newer than the one installed; `fits`
+// says whether that newer version can mount on this core (when it cannot, the
+// update waits for the core — it is not something to run now). DELISTED = an
+// installed module the store has delisted: it keeps working, but no further
+// versions will come (ADR 0338 D2). Neither ever blocks — an update is news, and
+// what blocks `bongos upgrade` is still only an incompatible ENABLED module.
+function evaluateUpdates(rows = [], latest = {}, core) {
+  const { satisfies } = require('../../src/module-loader/semver');
+  const updates = [];
+  const delisted = [];
+  for (const r of rows) {
+    const store = latest[r.key];
+    const have = r.version && parseVersion(String(r.version));
+    if (!store || !have) continue;
+    if (store.status === 'delisted') { delisted.push({ key: r.key, installed: r.version, enabled: r.enabled }); continue; }
+    const next = parseVersion(String(store.version));
+    if (!next || cmp(next, have) <= 0) continue;
+    let fits = false;
+    try { fits = !!(core && store.core_version && satisfies(core, store.core_version)); } catch { fits = false; }
+    updates.push({ key: r.key, installed: r.version, latest: store.version, coreVersion: store.core_version, enabled: r.enabled, fits });
+  }
+  return { updates, delisted };
+}
+
+function reportUpdates(found, verdict, { log, errlog }) {
+  log('\nModule updates (from the store):');
+  if (!found.checked) {
+    log(`  not checked — ${found.reason}. The compatibility check above still stands.`);
+    return;
+  }
+  const { updates, delisted } = evaluateUpdates(verdict.rows, found.latest, verdict.core);
+  for (const u of updates) {
+    const how = u.fits
+      ? `run \`bongos module update ${u.key}\``
+      : `needs core ${u.coreVersion}; this core is ${verdict.core}, so it waits until the core moves`;
+    log(`  ↑ ${u.key.padEnd(18)} ${u.installed} → ${u.latest}  — ${how}`);
+  }
+  for (const d of delisted) {
+    errlog(`  ! ${d.key.padEnd(18)} ${d.installed}  — delisted in the store: it keeps working, but no further versions will come`);
+  }
+  if (!updates.length && !delisted.length) log('  every installed store module is on its newest version.');
+}
+
+async function cmdUpgrade(args = [], { log = console.log, errlog = console.error, gather = gatherUpgrade, checkUpdates = gatherUpdates } = {}) {
   const data = gather();
   const verdict = evaluateUpgrade(data);
 
@@ -701,6 +770,11 @@ function cmdUpgrade(_args, { log = console.log, errlog = console.error, gather =
     errlog(`  ! ${verdict.undeclared.length} module(s) declare no \`maintenance\` block — nobody is on the hook for them as the core advances (ADR 0166): ${verdict.undeclared.map((r) => r.key).join(', ')}`);
   }
 
+  // What is stale here, beside what is broken: the store's newer versions of the
+  // modules installed from it. Reported either way, and it never changes the exit
+  // code. `--no-store` skips the read (offline, or a CI pre-check).
+  if (!args.includes('--no-store')) reportUpdates(await checkUpdates(verdict.rows), verdict, { log, errlog });
+
   if (!verdict.ok) {
     errlog(`\nREFUSING: ${verdict.blocking.length} enabled module(s) incompatible with core ${verdict.core}: ${verdict.blocking.map((b) => b.key).join(', ')}.`);
     errlog(`Widen each module's coreVersion to a range that includes ${verdict.core} (or hold the core upgrade) before proceeding.`);
@@ -1200,7 +1274,8 @@ function printHelp(out = console.log) {
   out('  bongos module new <key>     Scaffold modules/<key>/ (manifest + skeleton + sample route + HOWTO.md + CLAUDE.md)');
   out('  bongos module list [--catalog] [--search <text>] [--json]');
   out('                              Browse the module catalog — what you can enable, with author + origin credit');
-  out('  bongos upgrade              Pre-check enabled modules against the core version (fail-closed)');
+  out('  bongos upgrade [--no-store] Pre-check enabled modules against the core version (fail-closed),');
+  out('                              then list newer store versions of installed modules (never blocks)');
   out('  bongos module check <key> [--sign-off "Name <email>"]');
   out('                              AGPL/publish pre-check before upstreaming + record a DCO-style sign-off');
   out('  bongos module submit <key> [--sign-off "Name <email>"]');
@@ -1236,7 +1311,7 @@ async function main(argv) {
 module.exports = {
   main, cmdNew, cmdList, cmdUpgrade, cmdCheck, cmdSubmit, cmdPublish, cmdInstall, cmdUpdate, printHelp,
   gatherCatalog, formatCatalog, ownProjectName,
-  scaffoldModule, gatherUpgrade, evaluateUpgrade, buildManifest,
+  scaffoldModule, gatherUpgrade, evaluateUpgrade, gatherUpdates, evaluateUpdates, buildManifest,
   formatMaintenanceHint, isPastRemoveAfter,
   checkModulePublishability, recordSignOff, readSignOff, DCO_STATEMENT,
   listModuleFiles, packageModuleForSubmission,
@@ -1245,8 +1320,11 @@ module.exports = {
 };
 
 if (require.main === module) {
+  // Set the exit code and drain, never a hard exit: install, update and upgrade end
+  // after a store request, and a hard exit there aborts natively on Windows + Node 24
+  // (task 1002734).
   Promise.resolve(main(process.argv)).then(
-    (code) => process.exit(code),
+    (code) => { process.exitCode = code; },
     (e) => { console.error(e); process.exit(1); }
   );
 }

package/scripts/gds/upgrade.js

@@ -1495,5 +1495,5 @@ module.exports = {
 };
 
 if (require.main === module) {
-  main().then((code) => process.exit(code)).catch((e) => { process.stderr.write(`✖ ${e.message}\n`); process.exit(1); });
+  main().then((code) => { if (arg('--to', process.argv.slice(2))) process.exit(code); else process.exitCode = code; }).catch((e) => { process.stderr.write(`✖ ${e.message}\n`); process.exit(1); }); // bare pre-check drains: it ends after a store read (task 1003787), and a hard exit there aborts on Windows (task 1002734)
 }

package/src/bongos/module-store.js

@@ -208,6 +208,30 @@ async function publishedVersionSet(keys, { db } = {}) {
   return new Set(rows.map((r) => `${r.module_key}@${r.version}`));
 }
 
+// The newest published version of each of these modules, for `bongos upgrade`'s
+// "updates available" report (task 1003787). Read-only: unlike resolveAcquirable it
+// takes no entitlement and refuses nothing, so a delisted module still answers,
+// with its status, and the caller says it gets no further versions (ADR 0338 D2).
+// A key the store does not know is simply absent. One query for the whole list.
+// Returns { [key]: { version, core_version, status } }.
+async function latestVersions(keys, { db } = {}) {
+  if (!keys.length) return {};
+  const pool = db || require('./pool').pool;
+  const { rows } = await pool.query(
+    `SELECT v.module_key, v.version, v.core_version, m.status
+       FROM store_module_versions v JOIN store_modules m ON m.module_key = v.module_key
+      WHERE v.module_key = ANY($1)`, [keys]);
+  const out = {};
+  for (const r of rows) {
+    const next = parseVersion(r.version);
+    if (!next) continue;
+    const have = out[r.module_key];
+    if (have && cmp(parseVersion(have.version), next) >= 0) continue;
+    out[r.module_key] = { version: r.version, core_version: r.core_version, status: r.status };
+  }
+  return out;
+}
+
 // The tarball on disk for a version row. artifact_path is relative to the store dir
 // (relativeArtifactPath), and artifactPath() re-validates key + version, so a row
 // can never point a read outside the store.
@@ -221,5 +245,5 @@ function versionArtifactFile(row, { dir = storeDir() } = {}) {
 
 module.exports = {
   stageArtifact, commitArtifact, removeArtifact, relativeArtifactPath, publishVersion,
-  isFreePrice, resolveAcquirable, resolveReadable, publishedVersionSet, versionArtifactFile,
+  isFreePrice, resolveAcquirable, resolveReadable, publishedVersionSet, latestVersions, versionArtifactFile,
 };

package/src/bongos/routes/modules.js

@@ -81,7 +81,7 @@ const moduleArtifact = require('../../../scripts/gds/module-artifact');
 const { checkEntitlement, listEntitlements, grantEntitlement, recordAcquired } = require('../module-entitlements');
 const {
   stageArtifact, commitArtifact, removeArtifact, relativeArtifactPath, publishVersion,
-  resolveAcquirable, resolveReadable, publishedVersionSet, versionArtifactFile,
+  resolveAcquirable, resolveReadable, publishedVersionSet, latestVersions, versionArtifactFile,
 } = require('../module-store');
 const { KEY_RE } = require('../../module-loader/manifest-schema');
 const { parseVersion } = require('../../module-loader/semver');
@@ -154,6 +154,11 @@ function listModules() {
 // the oldest entry is dropped.
 const HOWTO_CACHE_MAX = 200;
 
+// How many module keys one GET /store/modules/latest may ask about (task 1003787).
+// An instance installs a handful; the cap keeps the query string and the ANY()
+// list bounded.
+const STORE_LATEST_MAX_KEYS = 200;
+
 module.exports = function buildModulesRouter() {
   const router = express.Router();
   // Checked how-tos by "key@version:tarball_sha256". Per router, so a test's fresh
@@ -565,6 +570,26 @@ module.exports = function buildModulesRouter() {
       });
     }));
 
+  // The newest published version of each named module — what `bongos upgrade`
+  // compares an instance's installed store modules against to report the updates
+  // available (task 1003787). `?keys=a,b,c`, at most STORE_LATEST_MAX_KEYS.
+  //
+  // rank: any-builder — a read of public store metadata (version numbers and the
+  // core range each needs, the same facts the how-to page shows). It takes no
+  // entitlement and changes nothing, unlike acquire; a key the store does not know
+  // is simply absent from the answer.
+  router.get('/store/modules/latest', auth.requireBuilder,
+    asyncHandler('GET /store/modules/latest', async (req, res) => {
+      const raw = typeof req.query.keys === 'string' ? req.query.keys : '';
+      const keys = [...new Set(raw.split(',').map((k) => k.trim()).filter(Boolean))];
+      if (!keys.length || keys.length > STORE_LATEST_MAX_KEYS || !keys.every((k) => KEY_RE.test(k))) {
+        return res.fail('bad_request', { status: 400, message: `keys is a comma-separated list of 1 to ${STORE_LATEST_MAX_KEYS} module keys (lowercase kebab-case).` });
+      }
+      const latest = await latestVersions(keys);
+      res.set('Cache-Control', 'no-store');
+      res.json({ latest });
+    }));
+
   router.post('/store/modules/:key/acquired', auth.requireBuilder,
     asyncHandler('POST /store/modules/:key/acquired', async (req, res) => {
       const { key } = req.params;

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.69'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.70'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/module_cli.mjs

@@ -156,14 +156,14 @@ test('gatherUpgrade: a satisfied enabled module passes; the same module disabled
   loader._reset();
 });
 
-test('cmdUpgrade: exit 0 with no modules, exit 1 when an enabled module is incompatible', () => {
+test('cmdUpgrade: exit 0 with no modules, exit 1 when an enabled module is incompatible', async () => {
   const lines = [];
   const sink = { log: (s) => lines.push(String(s)), errlog: (s) => lines.push(String(s)) };
 
-  const empty = mod.cmdUpgrade([], { ...sink, gather: () => ({ rows: [], errors: [], core: '1.0.0' }) });
+  const empty = await mod.cmdUpgrade([], { checkUpdates: async () => ({ checked: true, latest: {} }), ...sink, gather: () => ({ rows: [], errors: [], core: '1.0.0' }) });
   assert.equal(empty, 0);
 
-  const bad = mod.cmdUpgrade([], {
+  const bad = await mod.cmdUpgrade([], { checkUpdates: async () => ({ checked: true, latest: {} }),
     ...sink,
     gather: () => ({ core: '1.0.0', errors: [], rows: [{ key: 'future', version: '1.0.0', coreVersion: '^2.0.0', enabled: true, satisfied: false }] }),
   });
@@ -474,13 +474,13 @@ test('gatherUpgrade: carries each module\'s maintenance posture onto its row', (
   loader._reset();
 });
 
-test('cmdUpgrade: a DISABLED incompatible module is reported with its owner, not silently dropped', () => {
+test('cmdUpgrade: a DISABLED incompatible module is reported with its owner, not silently dropped', async () => {
   // The catalog-rot case: an accepted module ships default:false (ADR 0107 §6), so
   // every rotted catalog entry is disabled by construction. Exit stays 0 — it breaks
   // nothing at boot — but it must be visible and attributed.
   const lines = [];
   const sink = { log: (s) => lines.push(String(s)), errlog: (s) => lines.push(String(s)) };
-  const code = mod.cmdUpgrade([], {
+  const code = await mod.cmdUpgrade([], { checkUpdates: async () => ({ checked: true, latest: {} }),
     ...sink,
     gather: () => ({
       core: '2.0.0',
@@ -498,10 +498,10 @@ test('cmdUpgrade: a DISABLED incompatible module is reported with its owner, not
   assert.match(out, /maintainer Ada <ada@example\.com>/, 'the owner is named so someone can be told');
 });
 
-test('cmdUpgrade: reports an expired deprecation and modules with no declared upkeep', () => {
+test('cmdUpgrade: reports an expired deprecation and modules with no declared upkeep', async () => {
   const lines = [];
   const sink = { log: (s) => lines.push(String(s)), errlog: (s) => lines.push(String(s)) };
-  const code = mod.cmdUpgrade([], {
+  const code = await mod.cmdUpgrade([], { checkUpdates: async () => ({ checked: true, latest: {} }),
     ...sink,
     gather: () => ({
       core: '1.13.0',

package/tests/module_upgrade_updates.mjs

@@ -0,0 +1,256 @@
+// tests/module_upgrade_updates.mjs — `bongos upgrade` reports available module
+// updates beside coreVersion drift (task 1003787, ADR 0338 D1, criterion
+// wa5-module-economy). Two halves, no port and no real DB:
+//   - the CLI: cmdUpgrade against injected rows and a fake store, so one command
+//     answers "what is stale here" — and the exit code is still decided by the
+//     compatibility check alone (an incompatible ENABLED module blocks, a disabled
+//     one never does, an update never does);
+//   - the server: the real GET /store/modules/latest handler off the real router,
+//     with pool.js replaced in the require cache (the module_store_howto.mjs harness).
+//
+// Run:  node tests/module_upgrade_updates.mjs
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+
+// ---- the fake registry the route reads ----
+const state = { modules: {}, versions: [] };
+const pool = {
+  async query(sql, params = []) {
+    if (/FROM store_module_versions v JOIN store_modules m/.test(sql)) {
+      return {
+        rows: state.versions
+          .filter((v) => params[0].includes(v.module_key) && state.modules[v.module_key])
+          .map((v) => ({ ...v, status: state.modules[v.module_key].status })),
+      };
+    }
+    return { rows: [] };
+  },
+};
+const poolPath = require.resolve('../src/bongos/pool.js');
+require.cache[poolPath] = { id: poolPath, filename: poolPath, loaded: true, exports: { pool: { connect: async () => ({ ...pool, release() {} }), query: pool.query } } };
+
+const buildModulesRouter = require('../src/bongos/routes/modules.js');
+const mod = require('../scripts/gds/module.js');
+
+function handlerFor(router, method, p) {
+  const layer = router.stack.find((l) => l.route && l.route.path === p && l.route.methods[method]);
+  assert.ok(layer, `no ${method.toUpperCase()} ${p} on the router`);
+  const stack = layer.route.stack;
+  return { handle: stack[stack.length - 1].handle, names: stack.map((s) => s.name) };
+}
+
+async function invoke(handle, req) {
+  const res = {
+    statusCode: 200, body: undefined, headers: {},
+    json(b) { this.body = b; return this; },
+    status(c) { this.statusCode = c; return this; },
+    set(k, v) { this.headers[k] = v; return this; },
+    fail(code, opts) { this.statusCode = opts.status; this.body = { error: code, ...opts }; return this; },
+  };
+  let nextErr = null;
+  await handle(req, res, (err) => { nextErr = err; });
+  if (nextErr) throw nextErr;
+  return res;
+}
+
+const row = (key, version, extra = {}) => ({ key, version, coreVersion: '^1.0.0', enabled: true, satisfied: true, maintenance: { status: 'maintained' }, maintainer: 'Ada', ...extra });
+const sink = () => { const out = []; const err = []; return { out, err, log: (s) => out.push(String(s)), errlog: (s) => err.push(String(s)) }; };
+
+// ---------------------------------------------------------------------------
+// the decision (pure)
+// ---------------------------------------------------------------------------
+
+test('evaluateUpdates: only a NEWER store version is an update; equal, older and unknown are not', () => {
+  const rows = [row('weather', '1.0.0'), row('clock', '2.0.0'), row('dice', '1.5.0'), row('built-here', '0.1.0')];
+  const latest = {
+    weather: { version: '1.2.0', core_version: '^1.0.0', status: 'listed' },
+    clock: { version: '2.0.0', core_version: '^1.0.0', status: 'listed' },
+    dice: { version: '1.4.0', core_version: '^1.0.0', status: 'listed' },
+  };
+  const { updates, delisted } = mod.evaluateUpdates(rows, latest, '1.19.0');
+  assert.deepEqual(updates.map((u) => [u.key, u.installed, u.latest, u.fits]), [['weather', '1.0.0', '1.2.0', true]]);
+  assert.deepEqual(delisted, []);
+});
+
+test('evaluateUpdates: semver order, not text — 1.10.0 is newer than 1.9.0', () => {
+  const { updates } = mod.evaluateUpdates([row('weather', '1.9.0')], { weather: { version: '1.10.0', core_version: '^1.0.0', status: 'listed' } }, '1.19.0');
+  assert.equal(updates.length, 1);
+});
+
+test('evaluateUpdates: an update that needs a newer core is reported as waiting, not as runnable', () => {
+  const { updates } = mod.evaluateUpdates([row('weather', '1.0.0')], { weather: { version: '2.0.0', core_version: '^2.0.0', status: 'listed' } }, '1.19.0');
+  assert.equal(updates.length, 1);
+  assert.equal(updates[0].fits, false);
+});
+
+test('evaluateUpdates: a delisted module is reported apart, never offered as an update', () => {
+  const { updates, delisted } = mod.evaluateUpdates([row('weather', '1.0.0', { enabled: false })], { weather: { version: '1.2.0', core_version: '^1.0.0', status: 'delisted' } }, '1.19.0');
+  assert.deepEqual(updates, []);
+  assert.deepEqual(delisted.map((d) => d.key), ['weather']);
+});
+
+test('evaluateUpdates: a row with no exact version has nothing to compare against', () => {
+  const { updates } = mod.evaluateUpdates([row('weather', null)], { weather: { version: '1.2.0', core_version: '^1.0.0', status: 'listed' } }, '1.19.0');
+  assert.deepEqual(updates, []);
+});
+
+// ---------------------------------------------------------------------------
+// gatherUpdates (the store read)
+// ---------------------------------------------------------------------------
+
+test('gatherUpdates: one read for every versioned module, keys in the query string', async () => {
+  const calls = [];
+  const request = async (method, urlPath) => { calls.push([method, urlPath]); return { ok: true, status: 200, data: { latest: { weather: { version: '1.2.0' } } } }; };
+  const got = await mod.gatherUpdates([row('weather', '1.0.0'), row('clock', '2.0.0'), row('loose', null)], { request });
+  assert.deepEqual(calls, [['GET', '/store/modules/latest?keys=weather,clock']]);
+  assert.equal(got.checked, true);
+  assert.equal(got.latest.weather.version, '1.2.0');
+});
+
+test('gatherUpdates: it never acquires — no POST, so asking takes no entitlement', async () => {
+  const methods = [];
+  await mod.gatherUpdates([row('weather', '1.0.0')], { request: async (m) => { methods.push(m); return { ok: true, status: 200, data: { latest: {} } }; } });
+  assert.deepEqual(methods, ['GET']);
+});
+
+test('gatherUpdates: an unreachable store or a refusal is "not checked", never a throw', async () => {
+  const down = await mod.gatherUpdates([row('weather', '1.0.0')], { request: async () => { throw new Error('ECONNREFUSED'); } });
+  assert.equal(down.checked, false);
+  assert.match(down.reason, /could not be reached/);
+  const refused = await mod.gatherUpdates([row('weather', '1.0.0')], { request: async () => ({ ok: false, status: 401, data: { error: { message: 'session expired' } } }) });
+  assert.equal(refused.checked, false);
+  assert.match(refused.reason, /session expired/);
+});
+
+test('gatherUpdates: nothing versioned means nothing to ask — no store call at all', async () => {
+  const got = await mod.gatherUpdates([row('loose', null)], { request: async () => { throw new Error('must not be called'); } });
+  assert.deepEqual(got, { checked: true, latest: {} });
+});
+
+// ---------------------------------------------------------------------------
+// cmdUpgrade — one report, the old exit-code asymmetry intact
+// ---------------------------------------------------------------------------
+
+const storeSays = (latest) => async () => ({ checked: true, latest });
+
+test('cmdUpgrade: lists an available update beside the compatibility rows, and still exits 0', async () => {
+  const s = sink();
+  const code = await mod.cmdUpgrade([], {
+    ...s,
+    gather: () => ({ core: '1.19.0', errors: [], rows: [row('weather', '1.0.0')] }),
+    checkUpdates: storeSays({ weather: { version: '1.2.0', core_version: '^1.0.0', status: 'listed' } }),
+  });
+  assert.equal(code, 0, 'an update is news, never a refusal');
+  const out = s.out.join('\n');
+  assert.match(out, /✓ weather/, 'the compatibility row is still there');
+  assert.match(out, /Module updates \(from the store\)/);
+  assert.match(out, /weather\s+1\.0\.0 → 1\.2\.0\s+— run `bongos module update weather`/);
+});
+
+test('cmdUpgrade: an incompatible ENABLED module still refuses, with the updates reported too', async () => {
+  const s = sink();
+  const code = await mod.cmdUpgrade([], {
+    ...s,
+    gather: () => ({ core: '2.0.0', errors: [], rows: [row('weather', '1.0.0', { coreVersion: '^1.0.0', satisfied: false })] }),
+    checkUpdates: storeSays({ weather: { version: '2.0.0', core_version: '^2.0.0', status: 'listed' } }),
+  });
+  assert.equal(code, 1, 'the block is unchanged');
+  assert.match(s.err.join('\n'), /REFUSING: 1 enabled module/);
+  assert.match(s.out.join('\n'), /weather\s+1\.0\.0 → 2\.0\.0\s+— run `bongos module update weather`/, 'and the way out is named: the newer version fits this core');
+});
+
+test('cmdUpgrade: an incompatible DISABLED module never blocks, update or not', async () => {
+  const s = sink();
+  const code = await mod.cmdUpgrade([], {
+    ...s,
+    gather: () => ({ core: '2.0.0', errors: [], rows: [row('weather', '1.0.0', { enabled: false, satisfied: false })] }),
+    checkUpdates: storeSays({ weather: { version: '1.5.0', core_version: '^1.0.0', status: 'listed' } }),
+  });
+  assert.equal(code, 0);
+  assert.match(s.out.join('\n'), /needs core \^1\.0\.0; this core is 2\.0\.0, so it waits until the core moves/);
+});
+
+test('cmdUpgrade: nothing newer says so in one line', async () => {
+  const s = sink();
+  await mod.cmdUpgrade([], { ...s, gather: () => ({ core: '1.19.0', errors: [], rows: [row('weather', '1.2.0')] }), checkUpdates: storeSays({ weather: { version: '1.2.0', core_version: '^1.0.0', status: 'listed' } }) });
+  assert.match(s.out.join('\n'), /every installed store module is on its newest version/);
+});
+
+test('cmdUpgrade: a delisted installed module is flagged', async () => {
+  const s = sink();
+  await mod.cmdUpgrade([], { ...s, gather: () => ({ core: '1.19.0', errors: [], rows: [row('weather', '1.2.0')] }), checkUpdates: storeSays({ weather: { version: '1.2.0', core_version: '^1.0.0', status: 'delisted' } }) });
+  assert.match(s.err.join('\n'), /weather.*delisted in the store: it keeps working, but no further versions will come/);
+});
+
+test('cmdUpgrade: an unreachable store costs the update list, never the pre-check or its exit code', async () => {
+  const s = sink();
+  const code = await mod.cmdUpgrade([], { ...s, gather: () => ({ core: '1.19.0', errors: [], rows: [row('weather', '1.0.0')] }), checkUpdates: async () => ({ checked: false, reason: 'no Bongos session — run `bongos setup` first' }) });
+  assert.equal(code, 0);
+  const out = s.out.join('\n');
+  assert.match(out, /not checked — no Bongos session/);
+  assert.match(out, /OK — every enabled module satisfies core 1\.19\.0/);
+});
+
+test('cmdUpgrade --no-store: the store is not asked at all', async () => {
+  const s = sink();
+  const code = await mod.cmdUpgrade(['--no-store'], { ...s, gather: () => ({ core: '1.19.0', errors: [], rows: [row('weather', '1.0.0')] }), checkUpdates: async () => { throw new Error('must not be called'); } });
+  assert.equal(code, 0);
+  assert.doesNotMatch(s.out.join('\n'), /Module updates/);
+});
+
+test('gatherUpgrade rows carry the installed version, so the store can be compared against', () => {
+  const data = mod.gatherUpgrade({ env: {}, neutral: {}, instance: {} });
+  const versioned = data.rows.filter((r) => r.version);
+  assert.ok(versioned.length > 0, 'the core modules declare a version');
+  for (const r of versioned) assert.equal(typeof r.version, 'string');
+});
+
+// ---------------------------------------------------------------------------
+// GET /store/modules/latest — the server half
+// ---------------------------------------------------------------------------
+
+const router = buildModulesRouter();
+const latestRoute = handlerFor(router, 'get', '/store/modules/latest');
+const ask = (keys) => invoke(latestRoute.handle, { query: keys == null ? {} : { keys }, builder: { id: 7 } });
+
+state.modules = {
+  weather: { module_key: 'weather', status: 'listed' },
+  gone: { module_key: 'gone', status: 'delisted' },
+};
+state.versions = [
+  { module_key: 'weather', version: '1.9.0', core_version: '^1.0.0' },
+  { module_key: 'weather', version: '1.10.0', core_version: '^1.2.0' },
+  { module_key: 'weather', version: '1.2.0', core_version: '^1.0.0' },
+  { module_key: 'gone', version: '0.3.0', core_version: '^1.0.0' },
+];
+
+test('the route is open to any signed-in builder: requireBuilder and no permission gate', () => {
+  assert.deepEqual(latestRoute.names.slice(0, 1), ['requireBuilder']);
+  assert.equal(latestRoute.names.length, 2, 'builder gate, then the handler');
+});
+
+test('the route answers the newest version per key, in semver order', async () => {
+  const r = await ask('weather');
+  assert.equal(r.statusCode, 200, JSON.stringify(r.body));
+  assert.deepEqual(r.body.latest.weather, { version: '1.10.0', core_version: '^1.2.0', status: 'listed' });
+  assert.equal(r.headers['Cache-Control'], 'no-store');
+});
+
+test('the route still answers a delisted module, with its status; an unknown key is absent', async () => {
+  const r = await ask('weather,gone,nope');
+  assert.equal(r.body.latest.gone.status, 'delisted');
+  assert.equal('nope' in r.body.latest, false);
+});
+
+test('the route refuses a missing, malformed or oversized key list', async () => {
+  assert.equal((await ask(null)).statusCode, 400);
+  assert.equal((await ask('')).statusCode, 400);
+  assert.equal((await ask('Not_A_Key')).statusCode, 400);
+  assert.equal((await ask('../etc')).statusCode, 400);
+  const many = Array.from({ length: 201 }, (_, i) => `m-${i}`).join(',');
+  assert.equal((await ask(many)).statusCode, 400);
+});