@bongos/core 1.21.31 → 1.21.33

package/modules/government/migrations/government_025_module_delist.sql

@@ -0,0 +1,36 @@
+-- government_025_module_delist.sql — grant the new `module.delist` atom to Metic
+-- and Archon (task 1003797, ADR 0338 D2).
+--
+-- WHAT IT IS. A Metic+ person may take a module out of the store. It leaves the
+-- catalog and can no longer be newly installed, updated or downloaded. Instances
+-- that already hold it keep it, and it keeps working: a delist never revokes an
+-- entitlement or reaches into an installed copy (ADR 0338 D2), and it never
+-- changes a score (ADR 0359). A reason is required and the audit log records it.
+--
+-- WHY THIS FILE EXISTS. RANK_SEED is derived from the catalog's floors, and the
+-- drift guard (tests/government_seed.mjs) compares it against the union of the
+-- run-once seed plus every later grant migration, per rank. A metic-floor key is
+-- held by metic AND archon, so both are granted here.
+--
+-- Additive only: one new permission key granted to two ranks; nothing is revoked.
+-- Approved by the owner (Will, Archon) on 2026-10-01.
+-- Idempotent (ON CONFLICT DO NOTHING); forward-safe (INSERT only).
+--
+-- The `SELECT '<rank>', unnest(ARRAY[…])` shape is load-bearing: the drift guard
+-- scans for it literally.
+
+BEGIN;
+
+INSERT INTO government_rank_permissions (rank_key, permission_key)
+SELECT 'metic', unnest(ARRAY[
+  'module.delist'
+])
+ON CONFLICT (rank_key, permission_key) DO NOTHING;
+
+INSERT INTO government_rank_permissions (rank_key, permission_key)
+SELECT 'archon', unnest(ARRAY[
+  'module.delist'
+])
+ON CONFLICT (rank_key, permission_key) DO NOTHING;
+
+COMMIT;

package/modules/hall-ui/public/modules.js

@@ -106,6 +106,13 @@
     return `<a class="ov-fact mod-howto" href="${escapeHtml(href)}">how-to</a>`;
   }
 
+  // A store module this instance holds that the store has since delisted (task
+  // 1003797, ADR 0338 D2): it keeps working here, but no more versions will come.
+  function delistedFact(m) {
+    if (m.store_delisted !== true) return '';
+    return '<span class="fact-pill fact-pill--warn" title="Taken out of the store. Your copy keeps working, but it will get no more updates.">delisted · no more updates</span>';
+  }
+
   // The lines the row's details disclosure opens onto: the facts the payload
   // carries that the card never rendered — what the module contributes, the
   // core it needs, who maintains it and what it hands off to.
@@ -152,7 +159,7 @@
         <div class="ov-row__main">
           <span class="ov-row__title">${escapeHtml(m.title || m.key)}<span class="ov-mono">${escapeHtml(m.key)}</span></span>
           ${desc ? `<p class="ov-row__sub mod-row__desc">${escapeHtml(desc)}</p>` : ''}
-          <div class="ov-row__facts">${provenancePill(m)}${attributionFacts(m)}${upkeepFact(m)}${howtoFact(m)}</div>
+          <div class="ov-row__facts">${provenancePill(m)}${attributionFacts(m)}${upkeepFact(m)}${howtoFact(m)}${delistedFact(m)}</div>
           ${lines ? `<details class="mod-more"${openKeys.has(m.key) ? ' open' : ''}><summary aria-label="Details for ${escapeHtml(m.title || m.key)}"></summary>${lines}</details>` : ''}
         </div>
         <div class="ov-row__right mod-row__right">${rightHtml(m)}</div>

package/modules/hall-ui/public/roadmap.css

@@ -237,3 +237,8 @@ a.rm-goal__t:hover { color:var(--accent-ink); text-decoration:underline; }
   .rm-goal__dot { display:none; }
   .rm-goal__t { flex:1 0 100%; white-space:normal; }
 }
+/* Focus star (task 1004551): ink-faint when off, accent when on. */
+.rm-star { margin-left:auto; font-size:17px; line-height:1; color:var(--ink-faint); background:none; border:0; padding:0 2px; }
+button.rm-star { cursor:pointer; }
+button.rm-star:hover, button.rm-star:focus-visible { color:var(--accent); }
+.rm-star--on { color:var(--accent); }

package/modules/hall-ui/public/roadmap.js

@@ -147,6 +147,59 @@
     return `<a class="rm-gmore" href="${tasksLink(v.id)}" aria-label="${escapeHtml(label)}" title="${escapeHtml(label)}">View tasks ${arrowSvg}</a>`;
   }
 
+  // The focus star (task 1004551). The focus version is the project's default — chosen by
+  // an Archon here, stored server-side, never inferred. Filled = current focus. Archons
+  // get a button that sets/clears it; everyone else gets the same star read-only. The
+  // button is a convenience: PUT /versions/focus refuses non-Archons on the server.
+  const focus = { id: null, canSet: false };
+  const FOCUS_FAIL = 'Could not change the focus version. Reload and try again.';
+  function starHtml(v) {
+    const on = focus.id === v.id;
+    const glyph = on ? '★' : '☆';
+    const base = `class="rm-star${on ? ' rm-star--on' : ''}" data-vid="${escapeHtml(v.id)}"`;
+    if (focus.canSet) {
+      const tip = on ? 'Clear the focus version.' : 'Make this the project’s focus version.';
+      return `<button type="button" ${base} aria-pressed="${on}" title="${tip}" aria-label="${tip}">${glyph}</button>`;
+    }
+    const tip = (on ? 'This is the project’s focus version. ' : 'Not the focus version. ') + 'Only an Archon can set the focus.';
+    return `<span ${base} role="img" title="${tip}" aria-label="${tip}">${glyph}</span>`;
+  }
+
+  // Never throws except to hand a sign-in redirect back to boot(); a failed focus read
+  // just means no star is lit.
+  async function loadFocus() {
+    try {
+      const f = await getJSON(`${API}/versions/focus`);
+      focus.id = f.focus_version_id || null;
+      focus.canSet = f.can_set === true;
+    } catch (err) {
+      if (err && err.message === 'redirecting to auth') throw err;
+      focus.id = null; focus.canSet = false;
+    }
+  }
+
+  // Flip the stars in place: the PUT already answered with the new focus, so there is
+  // nothing to refetch.
+  function paintStars() {
+    document.querySelectorAll('.rm-star').forEach((el) => {
+      const tmp = document.createElement('div');
+      tmp.innerHTML = starHtml({ id: el.dataset.vid });
+      el.replaceWith(tmp.firstElementChild);
+    });
+  }
+
+  async function toggleFocus(vid) {
+    const next = focus.id === vid ? null : vid;
+    const res = await api.request('PUT', `${API}/versions/focus`, { body: { version_id: next } });
+    if (!res.ok) {
+      const e = res.data && res.data.error;
+      toast((e && e.message) || FOCUS_FAIL);
+      return;
+    }
+    focus.id = res.data.focus_version_id || null;
+    paintStars();
+  }
+
   // ---- card renderers -------------------------------------------------------
 
   function featCard(v) {
@@ -155,7 +208,7 @@
         <div class="rm-featgrid__l">
           <div class="rm-feat-top">
             <div class="rt">
-              <div class="rm-row">${phase(v)}<span class="rm-id">${escapeHtml(v.id)}</span></div>
+              <div class="rm-row">${phase(v)}<span class="rm-id">${escapeHtml(v.id)}</span>${starHtml(v)}</div>
               <h3 class="rm-name">${escapeHtml(v.name)}</h3>
               <p class="rm-desc rm-desc--clamp">${escapeHtml(v.desc)}</p>
             </div>
@@ -176,7 +229,7 @@
     return `<article class="rm-card">
       <div class="rm-feat-top">
         <div class="rt">
-          <div class="rm-row">${phase(v)}<span class="rm-id">${escapeHtml(v.id)}</span></div>
+          <div class="rm-row">${phase(v)}<span class="rm-id">${escapeHtml(v.id)}</span>${starHtml(v)}</div>
           <h3 class="rm-name">${escapeHtml(v.name)}</h3>
           <p class="rm-desc rm-desc--clamp">${escapeHtml(v.desc)}</p>
         </div>
@@ -218,7 +271,7 @@
     return `<article class="rm-card rm-card--staged" style="grid-column:1 / -1">
       <div class="rm-featgrid">
         <div class="rm-featgrid__l">
-          <div class="rm-row">${phase(v)}<span class="rm-id">${escapeHtml(v.id)}</span></div>
+          <div class="rm-row">${phase(v)}<span class="rm-id">${escapeHtml(v.id)}</span>${starHtml(v)}</div>
           <h3 class="rm-name">${escapeHtml(v.name)}</h3>
           <p class="rm-desc rm-desc--clamp">${escapeHtml(v.desc)}</p>
           <div class="rm-staged-state">
@@ -236,7 +289,7 @@
     return `<article class="rm-card rm-card--parked" style="grid-column:1 / -1">
       <div class="rm-feat-top">
         <div class="rt">
-          <div class="rm-row">${phase(v)}<span class="rm-id">${escapeHtml(v.id)}</span></div>
+          <div class="rm-row">${phase(v)}<span class="rm-id">${escapeHtml(v.id)}</span>${starHtml(v)}</div>
           <h3 class="rm-name">${escapeHtml(v.name)}</h3>
           <p class="rm-desc rm-desc--clamp">${escapeHtml(v.desc)}</p>
         </div>
@@ -381,9 +434,10 @@
   async function render() {
     const root = $('#rm-root');
     const [progress, versions] = await Promise.all([
+      loadFocus(),
       getJSON(`${API}/public/progress`).then((d) => d.progress || []),
       getJSON(`${API}/public/versions`).then((d) => d.versions || []).catch(() => []),
-    ]);
+    ]).then(([, p, v]) => [p, v]);
     const all = mergeVersions(progress, versions);
 
     // Goal summaries only for versions we actually show goals on (everything but
@@ -442,5 +496,10 @@
     }
   }
 
+  document.addEventListener('click', (e) => {
+    const b = e.target.closest && e.target.closest('button.rm-star');
+    if (b) toggleFocus(b.dataset.vid).catch(() => toast(FOCUS_FAIL));
+  });
+
   boot();
 })();

package/modules/lifecycle/routes/versions.js

@@ -45,6 +45,26 @@ module.exports = function buildVersionsRouter() {
     res.json({ versions: all.slice(offset, offset + limit), page: api.pageMeta(limit, offset, all.length) });
   });
 
+  // The project's focus version (task 1004551) — the one the Roadmap stars. Read: any signed-in builder. Write: Archon only,
+  // enforced here on the server, not just by the button hiding. No row = no focus.
+  // rank: any-builder — read-only; returns { focus_version_id: string|null, can_set }.
+  // can_set tells the page whether to draw a button — a hint only; PUT is the gate.
+  router.get('/versions/focus', auth.requireBuilder, asyncHandler('GET /versions/focus', async (req, res) => {
+    const rank = String((req.builder && req.builder.rank) || '').toLowerCase();
+    res.json({ focus_version_id: await api.projectSettings.getFocusVersionId(), can_set: rank === 'archon' });
+  }, { message: false }));
+
+  // rank: archon (atom version.focus.set, system) — body { version_id } sets the focus; { version_id: null } clears it.
+  // An unknown version id is refused rather than stored.
+  router.put('/versions/focus', auth.requireBuilder, auth.requirePermission('version.focus.set'), asyncHandler('PUT /versions/focus', async (req, res) => {
+    if (validateOrRespond(req, res, { version_id: { type: 'string', maxLength: 64 } })) return;
+    const raw = (req.body || {}).version_id;
+    if (raw === undefined || (raw !== null && !raw.trim())) return res.fail('bad_version_id', { status: 400, message: 'Pick a version to star, or send null to clear the focus.' });
+    if (raw !== null && !(await db.getVersion(raw.trim()))) return res.fail('unknown_version', { status: 404, message: `There is no version "${raw.trim()}" to star.` });
+    const focus = await api.projectSettings.setFocusVersionId(raw === null ? null : raw.trim(), req.builder && req.builder.id);
+    res.json({ ok: true, focus_version_id: focus });
+  }, { message: false }));
+
   // rank: public — read-only progress aggregate; mirrors /public/progress.
   router.get('/versions/progress', async (_req, res) => {
     const progress = await db.versionProgress();

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.31",
+  "version": "1.21.33",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.31",
+      "version": "1.21.33",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.31",
+  "version": "1.21.33",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8942,5 +8942,21 @@
       "id": "1004550",
       "text": "Setting up a new project is quicker: the final check screen now takes one click to accept, with less text and no per-row confirm buttons."
     }
+  ],
+  "1.21.32": [
+    {
+      "id": "1004551",
+      "text": "An Archon can star a version on the Roadmap as the project's focus; it persists across reloads, and everyone else sees the star read-only (the server refuses non-Archons)."
+    }
+  ],
+  "1.21.33": [
+    {
+      "id": "1003797",
+      "text": "Senior builders can now take a module out of the store, with a reason. Nobody can newly install or update it, but anyone who already has it keeps it working and is told no more updates will come."
+    },
+    {
+      "id": "1004494",
+      "text": "The look for each craft mode is decided. Artistry, Ideating and Governing each get their own colour (moonlight, star gold, city blue) on the mode switch, the tab you are on and the top bar, the mode's name beside the page titl"
+    }
   ]
 }

package/scripts/gds/module.js

@@ -433,7 +433,7 @@ function clip(s, n) {
 
 // Pure renderer — every input arrives as a parameter (the tests pass catalog
 // rows straight in), so it touches no disk and no config.
-function formatCatalog(rows, { catalogOnly = false, query = '', core = null } = {}) {
+function formatCatalog(rows, { catalogOnly = false, query = '', core = null, delisted = new Set() } = {}) {
   const scoped = catalogOnly ? catalog.catalogRows(rows) : rows;
   const shown = catalog.searchCatalog(scoped, query);
   const counts = catalog.summarize(rows);
@@ -458,11 +458,14 @@ function formatCatalog(rows, { catalogOnly = false, query = '', core = null } =
     // An inferred credit is marked so it never reads as something the author
     // typed — the catalog's whole job is honest attribution (ADR 0107 §2).
     const suffix = r.credit.inferred ? '*' : '';
-    const upkeep = (r.maintenance && r.maintenance.status) || 'undeclared';
+    const upkeep = ((r.maintenance && r.maintenance.status) || 'undeclared') + (delisted.has(r.key) ? ' · DELISTED' : '');
     out.push(`  ${pad(mark, 5)}${pad(clip(r.key, 19), 20)}${pad(clip(r.version || '—', 8), 9)}${pad(r.source, 10)}${pad(clip((r.credit.author || '—') + suffix, 19), 20)}${pad(clip((r.credit.origin || '—') + suffix, 25), 26)}${pad(clip(r.license || '—', 11), 12)}${upkeep}`);
   }
   out.push('');
   out.push('  [x] enabled here · [ ] available, not enabled');
+  if (shown.some((r) => delisted.has(r.key))) {
+    out.push('  DELISTED = taken out of the store: your copy keeps working, but no more versions will come.');
+  }
   if (shown.some((r) => r.credit.inferred)) {
     out.push(`  * credit not declared in module.json — shown as the platform (${catalog.CORE_PROJECT_NAME}), which ships it.`);
   }
@@ -470,7 +473,18 @@ function formatCatalog(rows, { catalogOnly = false, query = '', core = null } =
   return out.join('\n');
 }
 
-function cmdList(args, { log = console.log, errlog = console.error, gather = gatherCatalog } = {}) {
+// Which installed store modules the store has delisted (task 1003797). Only modules
+// built into this instance's tree can be store installs, so a core checkout asks
+// nothing. Fail-soft like the upgrade check: offline, or no session, lists as before.
+async function gatherDelisted(rows, { checkStore = gatherUpdates } = {}) {
+  const held = rows.filter((r) => r.source === 'instance');
+  if (!held.length) return new Set();
+  const found = await checkStore(held);
+  if (!found.checked) return new Set();
+  return new Set(Object.keys(found.latest).filter((k) => found.latest[k] && found.latest[k].status === 'delisted'));
+}
+
+async function cmdList(args, { log = console.log, errlog = console.error, gather = gatherCatalog, checkStore = gatherUpdates } = {}) {
   const catalogOnly = args.includes('--catalog');
   const json = args.includes('--json');
   const sIdx = args.indexOf('--search');
@@ -484,14 +498,16 @@ function cmdList(args, { log = console.log, errlog = console.error, gather = gat
   try { data = gather(); }
   catch (e) { errlog(`bongos module list: ${e.message}`); return 1; }
 
+  const delisted = await gatherDelisted(data.rows, { checkStore });
+
   if (json) {
     const scoped = catalogOnly ? catalog.catalogRows(data.rows) : data.rows;
-    const modules = catalog.searchCatalog(scoped, query);
+    const modules = catalog.searchCatalog(scoped, query).map((m) => ({ ...m, store_delisted: delisted.has(m.key) }));
     log(JSON.stringify({ core: data.core, summary: catalog.summarize(data.rows), modules }, null, 2));
     return 0;
   }
 
-  log(formatCatalog(data.rows, { catalogOnly, query, core: data.core }));
+  log(formatCatalog(data.rows, { catalogOnly, query, core: data.core, delisted }));
   for (const s of data.skipped) {
     errlog(`  ! ${s.key}: not listed — ${s.reason}`);
   }

package/src/bongos/module-store.js

@@ -232,6 +232,36 @@ async function latestVersions(keys, { db } = {}) {
   return out;
 }
 
+// Delist a module (task 1003797, ADR 0338 D2): it leaves the catalog, takes no new
+// acquisitions or versions, and serves no further downloads — every read above
+// already refuses on status 'delisted', so this one UPDATE is the whole act. It
+// touches nothing else: no entitlement is revoked, no installed copy is reached,
+// and no score row is written (a delist is not a score, ADR 0359). One-way here;
+// there is no relist route yet.
+// Returns { ok: true, module } or { ok: false, status, code, message }.
+async function delistModule(key, { db } = {}) {
+  const pool = db || require('./pool').pool;
+  const { rows: [mod] } = await pool.query(
+    `UPDATE store_modules SET status = 'delisted', delisted_at = now()
+      WHERE module_key = $1 AND status = 'listed'
+      RETURNING module_key, title, status, delisted_at`, [key]);
+  if (mod) return { ok: true, module: mod };
+  const { rows: [have] } = await pool.query(
+    'SELECT module_key, status, delisted_at FROM store_modules WHERE module_key = $1', [key]);
+  if (!have) return { ok: false, status: 404, code: 'module_not_found', message: `The store has no module "${key}".` };
+  return { ok: false, status: 409, code: 'already_delisted', message: `"${key}" is already delisted.` };
+}
+
+// Which of these module keys the store has delisted, as a Set — so the hall's
+// Modules tab can mark an installed store module that will get no more versions.
+async function delistedKeySet(keys, { db } = {}) {
+  if (!keys.length) return new Set();
+  const pool = db || require('./pool').pool;
+  const { rows } = await pool.query(
+    "SELECT module_key FROM store_modules WHERE module_key = ANY($1) AND status = 'delisted'", [keys]);
+  return new Set(rows.map((r) => r.module_key));
+}
+
 // The tarball on disk for a version row. artifact_path is relative to the store dir
 // (relativeArtifactPath), and artifactPath() re-validates key + version, so a row
 // can never point a read outside the store.
@@ -246,4 +276,5 @@ function versionArtifactFile(row, { dir = storeDir() } = {}) {
 module.exports = {
   stageArtifact, commitArtifact, removeArtifact, relativeArtifactPath, publishVersion,
   isFreePrice, resolveAcquirable, resolveReadable, publishedVersionSet, latestVersions, versionArtifactFile,
+  delistModule, delistedKeySet,
 };

package/src/bongos/project-settings.js

@@ -48,6 +48,7 @@ const { logger } = require('./logger');
 // cannot collide with this one.
 const SETTING_KEYS = {
   ROT_DAYS: 'attention.rot_days',
+  FOCUS_VERSION: 'roadmap.focus_version',
 };
 
 // The last-resort rot timer, in days. 30 because that is the shortest window in
@@ -176,6 +177,31 @@ function describeRotTimer(resolved) {
   return `${base} — ignoring ${r.invalid.where}="${r.invalid.raw}" (${r.invalid.reason})`;
 }
 
+// getFocusVersionId() — the version the project is focused on, or null.
+// NO ROW (or an empty value) MEANS NO FOCUS: the focus is chosen by an Archon in the
+// UI (task 1004551), never inferred in code, so absence is an answer and a default is
+// never seeded. Whether the id still names a real version is the caller's concern —
+// the write path refuses unknown ids, and a reader of a since-deleted version simply
+// finds no card to star.
+async function getFocusVersionId() {
+  const row = await getSetting(SETTING_KEYS.FOCUS_VERSION);
+  return row && row.value ? String(row.value) : null;
+}
+
+// setFocusVersionId(versionId, builderId) — set the focus, or clear it with null.
+// Clearing deletes the row rather than storing '' so "never set" and "cleared" are the
+// same state, as the null-is-meaningful rule on getSetting requires.
+async function setFocusVersionId(versionId, builderId = null) {
+  if (versionId == null || versionId === '') {
+    await pool.query('DELETE FROM project_settings WHERE key = $1', [SETTING_KEYS.FOCUS_VERSION]);
+    // The row is gone, so updated_by cannot say who cleared it; the log line does.
+    logger.info(`project focus version cleared by builder ${builderId == null ? 'unknown' : builderId}`);
+    return null;
+  }
+  await setSetting(SETTING_KEYS.FOCUS_VERSION, versionId, builderId);
+  return String(versionId);
+}
+
 // parseDays is exported for the tests only — the range check and the default are
 // asserted against the SAME constants the resolver reads, because a test that
 // re-typed 30 or 365 would be the second copy of the number this file exists to
@@ -190,4 +216,6 @@ module.exports = {
   setSetting,
   resolveRotDays,
   describeRotTimer,
+  getFocusVersionId,
+  setFocusVersionId,
 };

package/src/bongos/route-rank-check.js

@@ -240,6 +240,9 @@ const EXPECTED_RANKS = {
   // Re-running a store version's assessment (task 1003796, ADR 0359) spends a Docs
   // grader call and re-opens the Security gate, so it is pinned to its own atom.
   'POST /store/modules/:key/versions/:version/reassess': 'perm:module.assessment.rerun',
+  // Delisting a store module (task 1003797, ADR 0338 D2) stops every new install of
+  // it for every instance, so it is pinned to its own atom.
+  'POST /store/modules/:key/delist': 'perm:module.delist',
 };
 
 // The authz-core route pins (ADR 0174). Paths and the gating atom were renamed

package/src/bongos/routes/modules.js

@@ -35,6 +35,9 @@
 //   GET  /store/modules/:key/versions/:version/howto
 //                               the HOWTO.md that version shipped with, as text for
 //                               the hall's how-to page (task 1004366, ADR 0347).
+//   POST /store/modules/:key/delist
+//                               Metic+ takes a module out of the store; holders
+//                               keep it (task 1003797, ADR 0338 D2).
 //
 // Read is open to any signed-in builder (same gate as the atlas/primer pages);
 // every write (enable/disable, submit) is metic+archon, same rank as
@@ -85,6 +88,7 @@ const { checkEntitlement, listEntitlements, grantEntitlement, recordAcquired } =
 const {
   stageArtifact, commitArtifact, removeArtifact, relativeArtifactPath, publishVersion,
   resolveAcquirable, resolveReadable, publishedVersionSet, latestVersions, versionArtifactFile,
+  delistModule, delistedKeySet,
 } = require('../module-store');
 const { KEY_RE } = require('../../module-loader/manifest-schema');
 const { parseVersion } = require('../../module-loader/semver');
@@ -204,6 +208,11 @@ module.exports = function buildModulesRouter() {
     let published = new Set();
     try { published = await publishedVersionSet(all.map((m) => m.key)); }
     catch (e) { log.warn({ err: e.message }, 'store versions unreadable for the modules list'); }
+    // Which installed store modules the store has delisted (task 1003797), so the row
+    // says it keeps working but gets no more versions (ADR 0338 D2). Same tolerance.
+    let delistedKeys = new Set();
+    try { delistedKeys = await delistedKeySet(all.filter((m) => m.source === 'instance').map((m) => m.key)); }
+    catch (e) { log.warn({ err: e.message }, 'store status unreadable for the modules list'); }
     for (const m of all) {
       m.enabled_source = sources[m.key] || 'default';
       m.override = byKey.has(m.key)
@@ -214,6 +223,7 @@ module.exports = function buildModulesRouter() {
       m.store_howto = m.source === 'instance' && m.version && published.has(`${m.key}@${m.version}`)
         ? `/builders/modules?howto=${encodeURIComponent(m.key)}&version=${encodeURIComponent(String(m.version))}`
         : null;
+      m.store_delisted = m.source === 'instance' && delistedKeys.has(m.key);
     }
     res.json({
       modules: all,
@@ -446,6 +456,31 @@ module.exports = function buildModulesRouter() {
       res.status(202).json({ ok: true, queued: true, module_key: key, version, version_id: r.version.id });
     }));
 
+  // POST /api/bongos/store/modules/:key/delist — a Metic+ person takes a module out
+  // of the store (task 1003797, ADR 0338 D2). It leaves the catalog, cannot be newly
+  // acquired, takes no new versions and serves no further downloads: every store
+  // read already refuses a delisted key, so this flips the one status. What it never
+  // does: revoke an entitlement, reach into an instance that already holds the
+  // module (that copy keeps working; `bongos upgrade` and the hall tell the holder
+  // no more versions will come), or touch a score (ADR 0359). A reason is required;
+  // the audit middleware records it with who asked. There is no relist route yet.
+  router.post('/store/modules/:key/delist', auth.requireBuilder, auth.requirePermission('module.delist'),
+    asyncHandler('POST /store/modules/:key/delist', async (req, res) => {
+      if (validateOrRespond(req, res, { reason: { type: 'string', maxLength: 2000 } })) return;
+      const { key } = req.params;
+      if (!KEY_RE.test(key)) {
+        return res.fail('bad_module_key', { status: 400, message: 'A module key is lowercase kebab-case.' });
+      }
+      const reason = String(req.body?.reason || '').trim();
+      if (!reason) {
+        return res.fail('reason_required', { status: 400, message: 'Say why this module is leaving the store, in reason. People who already hold it keep it.' });
+      }
+      const r = await delistModule(key);
+      if (!r.ok) return res.fail(r.code, { status: r.status, message: r.message });
+      log.info({ key, builderId: req.builder.id }, `${key} delisted from the store`);
+      res.json({ ok: true, module_key: key, status: r.module.status, delisted_at: r.module.delisted_at });
+    }));
+
   // GET /api/bongos/store/entitlements and /store/modules/:key/entitlement — the
   // read side of the entitlement record (task 1003813, ADR 0338 D1). Own-scoped
   // like /me/sessions: the holder is ALWAYS the caller (holder_kind 'builder',

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.31'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.33'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');
@@ -444,6 +444,8 @@ module.exports = {
     get KEYS() { return require('./bongos/project-settings').SETTING_KEYS; },
     get get() { return require('./bongos/project-settings').getSetting; },
     get set() { return require('./bongos/project-settings').setSetting; },
+    get getFocusVersionId() { return require('./bongos/project-settings').getFocusVersionId; },
+    get setFocusVersionId() { return require('./bongos/project-settings').setFocusVersionId; },
     get describeRotTimer() { return require('./bongos/project-settings').describeRotTimer; },
     // The RANGE CHECK, shared rather than re-typed. The settings page validates a
     // submitted timer with the very parser the resolver reads it back through, so the

package/tests/focus_version.mjs

@@ -0,0 +1,96 @@
+// tests/focus_version.mjs — the roadmap focus star (task 1004551): the settings accessor,
+// the Archon-only write route and the any-builder read, run against a fake pool and fake
+// requests. No DB needed.
+//
+// Run:  node --test tests/focus_version.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+
+process.env.NODE_ENV = 'test';
+const require = createRequire(import.meta.url);
+
+// A one-table fake pool, installed before project-settings loads.
+const store = new Map();
+const poolPath = require.resolve('../src/bongos/pool.js');
+require(poolPath);
+require.cache[poolPath].exports.pool = {
+  async query(sql, p) {
+    if (/^\s*SELECT/i.test(sql)) { const v = store.get(p[0]); return { rows: v == null ? [] : [{ key: p[0], value: v }] }; }
+    if (/^\s*INSERT/i.test(sql)) { store.set(p[0], p[1]); return { rows: [{ key: p[0], value: p[1] }] }; }
+    if (/^\s*DELETE/i.test(sql)) { store.delete(p[0]); return { rows: [] }; }
+    throw new Error(`unexpected sql: ${sql}`);
+  },
+};
+const ps = require('../src/bongos/project-settings.js');
+const db = require('../modules/lifecycle/db.js');
+const router = require('../modules/lifecycle/routes/versions.js')();
+
+const src = (rel) => readFileSync(new URL('../' + rel, import.meta.url), 'utf8');
+db.getVersion = async (id) => (id === 'BONGOS-V2' ? { id } : null);
+
+// The route's own handler is the LAST layer on its stack (after the auth middleware).
+function handler(method, path) {
+  const layer = router.stack.find((l) => l.route && l.route.path === path && l.route.methods[method]);
+  assert.ok(layer, `${method} ${path} is registered`);
+  return { chain: layer.route.stack, last: layer.route.stack[layer.route.stack.length - 1].handle };
+}
+async function call(method, path, req) {
+  const out = { status: 200, body: null };
+  const res = {
+    status(n) { out.status = n; return this; },
+    json(b) { out.body = b; return this; },
+    fail(code, o) { const a = typeof o === 'number' ? { status: o } : (o || {}); out.status = a.status; out.body = { error: { code, message: a.message || code } }; return this; },
+  };
+  await handler(method, path).last({ body: {}, builder: { id: 9, rank: 'archon' }, ...req }, res, (e) => { throw e; });
+  return out;
+}
+
+test('no row means no focus', async () => {
+  store.clear();
+  assert.equal(await ps.getFocusVersionId(), null);
+});
+
+test('PUT stores a known version and GET returns it', async () => {
+  store.clear();
+  const put = await call('put', '/versions/focus', { body: { version_id: 'BONGOS-V2' } });
+  assert.equal(put.body.focus_version_id, 'BONGOS-V2');
+  assert.equal(store.get(ps.SETTING_KEYS.FOCUS_VERSION), 'BONGOS-V2');
+  const got = await call('get', '/versions/focus', {});
+  assert.deepEqual(got.body, { focus_version_id: 'BONGOS-V2', can_set: true });
+});
+
+test('PUT with null clears the focus (the row is gone, not blank)', async () => {
+  store.set(ps.SETTING_KEYS.FOCUS_VERSION, 'BONGOS-V2');
+  const put = await call('put', '/versions/focus', { body: { version_id: null } });
+  assert.equal(put.body.focus_version_id, null);
+  assert.equal(store.has(ps.SETTING_KEYS.FOCUS_VERSION), false);
+});
+
+test('an unknown version is refused with a readable message and nothing is stored', async () => {
+  store.clear();
+  const put = await call('put', '/versions/focus', { body: { version_id: 'NOPE' } });
+  assert.equal(put.status, 404);
+  assert.match(put.body.error.message, /NOPE/);
+  assert.equal(store.size, 0);
+});
+
+test('a missing or blank version_id is refused, not treated as a clear', async () => {
+  for (const body of [{}, { version_id: '  ' }]) {
+    const put = await call('put', '/versions/focus', { body });
+    assert.equal(put.status, 400);
+  }
+});
+
+test('a non-Archon reads the focus but is told it cannot set it', async () => {
+  store.set(ps.SETTING_KEYS.FOCUS_VERSION, 'BONGOS-V2');
+  const got = await call('get', '/versions/focus', { builder: { id: 4, rank: 'metic' } });
+  assert.deepEqual(got.body, { focus_version_id: 'BONGOS-V2', can_set: false });
+});
+
+test('the write route carries the Archon-only permission gate; the read route does not', () => {
+  assert.match(src('modules/lifecycle/routes/versions.js'), /router\.put\('\/versions\/focus',\s*auth\.requireBuilder,\s*auth\.requirePermission\('version\.focus\.set'\)/);
+  assert.doesNotMatch(src('modules/lifecycle/routes/versions.js').match(/router\.get\('\/versions\/focus',[^\n]*/)[0], /requireRank/);
+});

package/tests/hall_catalog_world.mjs

@@ -58,7 +58,7 @@ test('modules: the row is the oversight row — title with the mono key, clamped
   assert.match(js, /<span class="ov-row__title">\$\{escapeHtml\(m\.title \|\| m\.key\)\}<span class="ov-mono">\$\{escapeHtml\(m\.key\)\}<\/span>/, 'the key rides inside the title in mono');
   assert.match(js, /class="ov-row__sub mod-row__desc"/, 'the description is the sub line');
   assert.match(js, /<details class="mod-more"/, 'a details disclosure opens the rest');
-  assert.match(js, /<div class="ov-row__facts">\$\{provenancePill\(m\)\}\$\{attributionFacts\(m\)\}\$\{upkeepFact\(m\)\}\$\{howtoFact\(m\)\}<\/div>/, 'provenance, credit, upkeep and (for a store version, task 1004366) the how-to link are the facts line');
+  assert.match(js, /<div class="ov-row__facts">\$\{provenancePill\(m\)\}\$\{attributionFacts\(m\)\}\$\{upkeepFact\(m\)\}\$\{howtoFact\(m\)\}\$\{delistedFact\(m\)\}<\/div>/, 'provenance, credit, upkeep, (for a store version, task 1004366) the how-to link and (task 1003797) the delisted pill are the facts line');
   assert.match(js, /<div class="ov-row__right mod-row__right">\$\{rightHtml\(m\)\}<\/div>/, 'the right column is one function');
   const css = read('modules.css');
   assert.match(css, /\.mod-row__desc \{[^}]*-webkit-line-clamp: 2/, 'the description clamps to two lines');