@bongos/core 1.21.32 → 1.21.33

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.32",
-  "core_contract": "1.21.32",
-  "source_commit": "dc621db8394a42d17e812d259ae034b2d9ff2e49",
+  "core_version": "1.21.33",
+  "core_contract": "1.21.33",
+  "source_commit": "30d1db91ef10db933cab72b3137a473db54a0f5a",
   "source_ref": "HEAD",
-  "built_at": "2026-10-03T20:09:59.517Z",
+  "built_at": "2026-10-03T20:48:28.006Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 581,
+    "docs_redacted": 582,
     "agent_docs_stubbed": 27,
-    "functional_verbatim": 2904,
+    "functional_verbatim": 2906,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3513,
-  "tree_sha256": "90d84e8130f69ebcd5a15d34b53ac41e6728ff754955ee11a4a9c62dda2dd54b",
+  "file_count": 3516,
+  "tree_sha256": "5c679542be1ab90675f9aef4d272309207d9776a26e96d7f95653c165e9eaf74",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -317,12 +317,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "69d42ead01d9c96a8728c306701ade8dc9f1682cfa82513c2411a9d3a265c48d"
+      "sha256": "0ff95bf12579c65f3339ac4bf0cc282d7d0132a4872a159042954907b36abfa3"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "134bfb4b226537fdeaf31519c764926dc250b713e4eb3968e65068d0fc460740"
+      "sha256": "d7d4b4c0235d41edfa9348e2953c7f30e97d1c967f1c3d40d32b9a788981826f"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -332,17 +332,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "319671c677ec2bbcadbb8b054b47acf4e943e823720edba32416b6a23c46c90b"
+      "sha256": "4f3cba7f1b570870e2f407e2fbe4d407337a71c882b55e064e814bb653bd77be"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "07246b400a63caa5586a45ec1af6b60c04e616f06515015653d6e7dc48b3fe4f"
+      "sha256": "8daa0216a1a98d91c1c5430f04a1801d3a5f44159de38c707ae929633f6ec27b"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "1a8057d83c6ab453ce6251991f30b8502edb0cd9cebd90d427f706187073f3c2"
+      "sha256": "1a0e9c95b879d23b2ed6035e27de9c8a4c830dcb2b8614cfdb6b887028684ca3"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -2152,7 +2152,7 @@
     {
       "path": "docs/adr/0338-modules-travel-through-a-bongos-hosted-store.md",
       "mode": "0000644",
-      "sha256": "5acb8ac6e656a909ef6392f845f7a479d44d7b7619197e9f66b4879e16a6971c"
+      "sha256": "eadc3bb809b213bbd14dabeab23169c4b4f94393182362b840fef15a2aa59df1"
     },
     {
       "path": "docs/adr/0339-a-projects-owner-upgrades-it-and-a-hosted-project-hands-off-to-the-hub-door.md",
@@ -2292,17 +2292,17 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "0d8593234a315be3d3e03f23612ee7248ee742bca086e24c6b835d28f137c443"
+      "sha256": "12abe3c6207d5ea31ff769856aea0211f6285193a4fca9af56bb16214d05fd04"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "0b0b87bbe13d992d896a7145f86d1ef09d7f80c2922d968ea45bcbff38479e11"
+      "sha256": "8d3ffd1391e96fcaef1009476a3068d3eca0520bd0237130981ea037743c0d3a"
     },
     {
       "path": "docs/architecture.md",
       "mode": "0000644",
-      "sha256": "aa092ac83b6b23e3b030d463860a194bd024fc12d31e07bbeb036ac3a23d4a35"
+      "sha256": "5236bf63df238c4b93e515a9982e76e0908382d049bf38035b5bda2a3ceda11b"
     },
     {
       "path": "docs/branding-contract.md",
@@ -2322,18 +2322,23 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "48ed28854a75411af0098e31dd92f99b1cceff4e969dc1d1811a5e1bf9ccf696"
+      "sha256": "63b57d53d62211c652eb5be9ab8a6cc7c86d7073dd391bf830d616521939faea"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "13b018cc4a49c755c7f6b598079fdd0f028008e2c63b1e1bb18c14871b786d1f"
+      "sha256": "60f2163d148fc345d5cd72f5a1215e941359b59707d9ad16579a105a4eea047d"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
       "mode": "0000644",
       "sha256": "b4f9fdf5a44373217d59acadcdb2d17fd44018a4d30647bc518bd401f2876756"
     },
+    {
+      "path": "docs/design/craft-mode-direction.md",
+      "mode": "0000644",
+      "sha256": "083f40e17073b4c7a7d78205fa23299ecd1357fce13894d27c29365004a70f34"
+    },
     {
       "path": "docs/design/demonolith-plan.md",
       "mode": "0000644",
@@ -2832,7 +2837,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "c0f0ecb9abea0a0d26109fbdc1022b7496ef6e9bdbfe84f1d2555bde8400149e"
+      "sha256": "d1617c68d9ddf112ee4e3724e6a8e8c20862eadcf13b28ed1477357cb0d4f306"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2922,7 +2927,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "8ba0324ffe4260864ca53f1e42198491c42e60dd328e9886380e3ffb2e3087be"
+      "sha256": "6e1cdceef490555e75212809c1feb37ab072b4d1065a448ba55fb2110be0a779"
     },
     {
       "path": "docs/project-context.template.md",
@@ -4852,7 +4857,7 @@
     {
       "path": "modules/government/catalog.js",
       "mode": "0000644",
-      "sha256": "300d99ff9a8c8c59f70179367e0b262c774f2cfa91376347d13e62296dbf132a"
+      "sha256": "1592e5e388887cfffc79c69be88e31728d2a44a0c7db70f6b262d2df551aba44"
     },
     {
       "path": "modules/government/charter.js",
@@ -5054,6 +5059,11 @@
       "mode": "0000644",
       "sha256": "e839988918bee95e0a5f11bbfe71bd6d3304ad6d8a00a6b78593a34c3e36a6c4"
     },
+    {
+      "path": "modules/government/migrations/government_025_module_delist.sql",
+      "mode": "0000644",
+      "sha256": "5bcdd9defa3927adda5612d990d25dc8efaea8f2a0c159b5bd1b4154364512df"
+    },
     {
       "path": "modules/government/module.json",
       "mode": "0000644",
@@ -5862,7 +5872,7 @@
     {
       "path": "modules/hall-ui/public/modules.js",
       "mode": "0000644",
-      "sha256": "01fbd0bd0ac6910e9deb91599598c5c4aa1f5139b9cdcc05aeed4def50359c55"
+      "sha256": "6f960241607ea3921cce5d40bf5fbb6d17595d26213601cbc6a7195448624b11"
     },
     {
       "path": "modules/hall-ui/public/modules.states.json",
@@ -9807,12 +9817,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "98c7377fe080c344a720b0ec5e306d6229bd9c330fb051838c1d9e6f653dbbe6"
+      "sha256": "9c33acea5e84be12568db8431cae6c00c0becce9ebf25f887d959cb1453f256a"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "6bb8d1ab2b6db8876f1e38077a19483cb12ebe4c8a9971e4964f563298a0866c"
+      "sha256": "19635f61cb2a318a048e664315953ad7f7a8df8ae7db54ca9f3ad72bf1b4f676"
     },
     {
       "path": "public-docs/index.html",
@@ -9832,7 +9842,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "71b4fa8ec2f99c846ba0ee0d7f3451613e624841fcf4fc6790b40f5f086a3a4c"
+      "sha256": "0492fe5c14bf9b67c7155a3b29fd3b361775c5b93d7ab790c4c6b39b83296936"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -10712,7 +10722,7 @@
     {
       "path": "scripts/gds/module.js",
       "mode": "0000644",
-      "sha256": "240a50d80078e81b692cea24d823340d797f3193afd6bec0dcb5d9afb0669c54"
+      "sha256": "eeabf40fafbfdd7e83eeaec6b3898ee913a3f9235b334c952d5d545fd42ad26c"
     },
     {
       "path": "scripts/gds/move-escalation.js",
@@ -11832,7 +11842,7 @@
     {
       "path": "src/bongos/module-store.js",
       "mode": "0000644",
-      "sha256": "4d4cb32e7fdc80c2f31c76a04d939c62980515eb06f7d3862a91c5163a9a70ce"
+      "sha256": "373a0ff03c6644ea622ff859edfe9003fcfa94ea7eb5ca937059865c3eeb317f"
     },
     {
       "path": "src/bongos/module-submissions.js",
@@ -11897,7 +11907,7 @@
     {
       "path": "src/bongos/route-rank-check.js",
       "mode": "0000644",
-      "sha256": "932376cc890d5b7cd05d871e7ae346b2a877c867ae05d330f930b5779c88ad2e"
+      "sha256": "a72e24f1cc5f4f27e7f8827de5b936e773d0e0e9ffe39e2de4da97e42b35e3af"
     },
     {
       "path": "src/bongos/routes.js",
@@ -11982,7 +11992,7 @@
     {
       "path": "src/bongos/routes/modules.js",
       "mode": "0000644",
-      "sha256": "84ae1e60b25ea68796b57b193294f1322f4349633867c419a63b888713fcd158"
+      "sha256": "88fdc1c7d0904c8a7dcea9f87a61848982f9db73a1b66a0dba81ac2220c34bfa"
     },
     {
       "path": "src/bongos/routes/my-sessions.js",
@@ -12057,7 +12067,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "3b1ea1c35af115635ef7cacc489bf5ba30bbc7aa205cec47e38602934574393d"
+      "sha256": "18734fe8e41cc0acf97d24f1d444c78b22c4ec7197ff906f045c4f13ec517cae"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -14292,7 +14302,7 @@
     {
       "path": "tests/hall_catalog_world.mjs",
       "mode": "0000644",
-      "sha256": "9a2434b3d54cbc23b3874e757d5d2fc6ab5b50e239c07d013f8cfe1409c11806"
+      "sha256": "11f0ac50c5424a76371591b31275c796ded853db0cd35798b9adc878cdd88c88"
     },
     {
       "path": "tests/hall_city.mjs",
@@ -15252,7 +15262,7 @@
     {
       "path": "tests/module_catalog.mjs",
       "mode": "0000644",
-      "sha256": "dfb3bdda7a25328490f2c07ee9434eae0b9b87b2676e0152d29ea40d9e9ef43f"
+      "sha256": "4b2e3b067ddaed61f032f5a825402971e053326a65a75b969e0484f9b183fb7e"
     },
     {
       "path": "tests/module_cli.mjs",
@@ -15309,6 +15319,11 @@
       "mode": "0000644",
       "sha256": "ba4233ed072c87df9dbc5c75af10655ad8eaaf9d8ccbe69df146052467a1279e"
     },
+    {
+      "path": "tests/module_store_delist.mjs",
+      "mode": "0000644",
+      "sha256": "6689e5b56ba80fceff4981266886222a94d8a9fca24a8cbd07ab240ba3ff2037"
+    },
     {
       "path": "tests/module_store_howto.mjs",
       "mode": "0000644",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 501 operations across 73 resource groups
+- 502 operations across 73 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -1103,6 +1103,8 @@ function createClient(opts = {}) {
       postStoreModulesKeyAcquire: (args) => request("POST", "/store/modules/{key}/acquire", { hasBody: true }, args),
       // POST /store/modules/{key}/acquired — rank: any-builder — POST /store/modules/:key/acquired
       postStoreModulesKeyAcquired: (args) => request("POST", "/store/modules/{key}/acquired", { hasBody: true }, args),
+      // POST /store/modules/{key}/delist — rank: metic+archon — POST /store/modules/:key/delist
+      postStoreModulesKeyDelist: (args) => request("POST", "/store/modules/{key}/delist", { hasBody: true }, args),
       // GET /store/modules/{key}/entitlement — rank: any-builder — GET /store/modules/:key/entitlement
       getStoreModulesKeyEntitlement: (args) => request("GET", "/store/modules/{key}/entitlement", { hasBody: false }, args),
       // POST /store/modules/{key}/versions — rank: metic+archon — POST /store/modules/:key/versions

package/clients/bongos-client/index.cjs

@@ -1102,6 +1102,8 @@ function createClient(opts = {}) {
       postStoreModulesKeyAcquire: (args) => request("POST", "/store/modules/{key}/acquire", { hasBody: true }, args),
       // POST /store/modules/{key}/acquired — rank: any-builder — POST /store/modules/:key/acquired
       postStoreModulesKeyAcquired: (args) => request("POST", "/store/modules/{key}/acquired", { hasBody: true }, args),
+      // POST /store/modules/{key}/delist — rank: metic+archon — POST /store/modules/:key/delist
+      postStoreModulesKeyDelist: (args) => request("POST", "/store/modules/{key}/delist", { hasBody: true }, args),
       // GET /store/modules/{key}/entitlement — rank: any-builder — GET /store/modules/:key/entitlement
       getStoreModulesKeyEntitlement: (args) => request("GET", "/store/modules/{key}/entitlement", { hasBody: false }, args),
       // POST /store/modules/{key}/versions — rank: metic+archon — POST /store/modules/:key/versions

package/clients/bongos-client/index.d.ts

@@ -482,6 +482,8 @@ export interface PostStoreModulesKeyAcquireRequest { version?: string }
 export interface PostStoreModulesKeyAcquireResponse { ok: boolean; module_key: unknown; version: unknown; core_version: unknown; tarball_sha256: unknown; tree_sha256: unknown; tarball_bytes: unknown; channel: unknown; entitlement: unknown }
 export interface PostStoreModulesKeyAcquiredRequest { version: string }
 export interface PostStoreModulesKeyAcquiredResponse { ok: boolean; entitlement: unknown }
+export interface PostStoreModulesKeyDelistRequest { reason?: string }
+export interface PostStoreModulesKeyDelistResponse { ok: boolean; module_key: unknown; status: unknown; delisted_at: unknown }
 export interface PostStoreModulesKeyVersionsResponse { ok: boolean; created_module: unknown; version: unknown }
 export interface PostStoreModulesKeyVersionsVersionReassessRequest { reason?: string }
 export interface PostStoreModulesKeyVersionsVersionReassessResponse { ok: boolean; queued: boolean; module_key: unknown; version: unknown; version_id: unknown }
@@ -1570,6 +1572,8 @@ export interface BongosClient {
     postStoreModulesKeyAcquire(args?: RequestArgs & { body?: PostStoreModulesKeyAcquireRequest }): Promise<PostStoreModulesKeyAcquireResponse>;
     /** POST /store/modules/{key}/acquired — rank: any-builder */
     postStoreModulesKeyAcquired(args: RequestArgs & { body: PostStoreModulesKeyAcquiredRequest }): Promise<PostStoreModulesKeyAcquiredResponse>;
+    /** POST /store/modules/{key}/delist — rank: metic+archon */
+    postStoreModulesKeyDelist(args?: RequestArgs & { body?: PostStoreModulesKeyDelistRequest }): Promise<PostStoreModulesKeyDelistResponse>;
     /** GET /store/modules/{key}/entitlement — rank: any-builder */
     getStoreModulesKeyEntitlement(args?: RequestArgs): Promise<ApiResponse>;
     /** POST /store/modules/{key}/versions — rank: metic+archon */

package/clients/bongos-client/index.mjs

@@ -1099,6 +1099,8 @@ export function createClient(opts = {}) {
       postStoreModulesKeyAcquire: (args) => request("POST", "/store/modules/{key}/acquire", { hasBody: true }, args),
       // POST /store/modules/{key}/acquired — rank: any-builder — POST /store/modules/:key/acquired
       postStoreModulesKeyAcquired: (args) => request("POST", "/store/modules/{key}/acquired", { hasBody: true }, args),
+      // POST /store/modules/{key}/delist — rank: metic+archon — POST /store/modules/:key/delist
+      postStoreModulesKeyDelist: (args) => request("POST", "/store/modules/{key}/delist", { hasBody: true }, args),
       // GET /store/modules/{key}/entitlement — rank: any-builder — GET /store/modules/:key/entitlement
       getStoreModulesKeyEntitlement: (args) => request("GET", "/store/modules/{key}/entitlement", { hasBody: false }, args),
       // POST /store/modules/{key}/versions — rank: metic+archon — POST /store/modules/:key/versions

package/docs/adr/0338-modules-travel-through-a-bongos-hosted-store.md

@@ -87,6 +87,13 @@ store entry is otherwise deleted:
 The artifact an instance acquired is already on that instance, so this costs the store nothing
 to honour: it simply never deletes or disables what it has handed over.
 
+*Implemented by task 1003797 (2026-10-01):* `POST /store/modules/:key/delist` with a required
+reason, behind the `module.delist` atom (Metic floor). It flips `store_modules.status` and
+nothing else — holders keep their entitlement and their working copy, the module loader never
+asks the store, and a delist writes no score (ADR 0359). The holder is told by `bongos upgrade`,
+`bongos module list` (DELISTED) and the hall's Modules tab ("delisted · no more updates").
+A delist is one-way for now; relisting would be a separate task.
+
 The refund path in task 1003789 is the one place an entitlement can end, and it is a separate,
 buyer-initiated act — a delist is not a refund.
 

package/docs/api/openapi.json

@@ -20554,6 +20554,72 @@
         ]
       }
     },
+    "/store/modules/{key}/delist": {
+      "post": {
+        "operationId": "post_store_modules_key_delist",
+        "tags": [
+          "store"
+        ],
+        "summary": "POST /store/modules/:key/delist",
+        "description": "POST /api/bongos/store/modules/:key/delist — a Metic+ person takes a module out of the store (task 1003797, ADR 0338 D2). It leaves the catalog, cannot be newly acquired, takes no new versions and serves no further downloads: every store read already refuses a delisted key, so this flips the one status. What it never does: revoke an entitlement, reach into an instance that already holds the module (that copy keeps working; `bongos upgrade` and the hall tell the holder no more versions will come), or touch a score (ADR 0359). A reason is required; the audit middleware records it with who asked. There is no relist route yet.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `module.delist` (all required).",
+        "x-rank": "metic+archon",
+        "x-source": "src/bongos/routes/modules.js",
+        "x-permissions": [
+          "module.delist"
+        ],
+        "parameters": [
+          {
+            "name": "key",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `key`."
+          }
+        ],
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostStoreModulesKeyDelistRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostStoreModulesKeyDelistResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/store/modules/{key}/entitlement": {
       "get": {
         "operationId": "get_store_modules_key_entitlement",
@@ -31003,6 +31069,33 @@
           "entitlement"
         ]
       },
+      "PostStoreModulesKeyDelistRequest": {
+        "type": "object",
+        "properties": {
+          "reason": {
+            "type": "string",
+            "maxLength": 2000
+          }
+        },
+        "additionalProperties": false
+      },
+      "PostStoreModulesKeyDelistResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "module_key": {},
+          "status": {},
+          "delisted_at": {}
+        },
+        "required": [
+          "ok",
+          "module_key",
+          "status",
+          "delisted_at"
+        ]
+      },
       "PostStoreModulesKeyVersionsResponse": {
         "type": "object",
         "properties": {
@@ -32077,9 +32170,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 501,
-  "x-schema-count": 534,
+  "x-endpoint-count": 502,
+  "x-schema-count": 536,
   "x-undocumented-bodies": 12,
-  "x-response-schemas": 355,
+  "x-response-schemas": 356,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 501 endpoints across 92 route files.
+> **Generated from the live route files** — the route file is authoritative. 502 endpoints across 92 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -781,13 +781,14 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/sso/pubkey` | `public` | — | GET /sso/pubkey — the hub's Ed25519 assertion-verification key (public). |
 | POST | `/api/bongos/sso/token` | `public` | `client_id`, `client_secret`, `code`, `redirect_uri` | POST /sso/token — server-to-server code redemption. |
 
-## `store` (9)
+## `store` (10)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
 | GET | `/api/bongos/store/entitlements` | `any-builder` | — | GET /api/bongos/store/entitlements and /store/modules/:key/entitlement — the read side of the entitlement record (task 1003813, ADR 0338 … |
 | POST | `/api/bongos/store/modules/:key/acquire` | `any-builder` | `version` | ---- install: acquire → download → record (task 1003785, ADR 0338 D1) ---- The server end of `bongos module install`. |
 | POST | `/api/bongos/store/modules/:key/acquired` | `any-builder` | `version` |  |
+| POST | `/api/bongos/store/modules/:key/delist` | `metic+archon` | `reason` | POST /api/bongos/store/modules/:key/delist — a Metic+ person takes a module out of the store (task 1003797, ADR 0338 D2). |
 | GET | `/api/bongos/store/modules/:key/entitlement` | `any-builder` | — |  |
 | POST | `/api/bongos/store/modules/:key/versions` | `metic+archon` | _undocumented_ | POST /api/bongos/store/modules/:key/versions — publish one module version to the store (task 1004271, ADR 0338 D1). |
 | GET | `/api/bongos/store/modules/:key/versions/:version/howto` | `any-builder` | — | GET /api/bongos/store/modules/:key/versions/:version/howto — the how-to a version shipped with (task 1004366, ADR 0347 D1/D3), read from … |

package/docs/architecture.md

@@ -293,6 +293,7 @@ Bongos views: `claimable_tasks` (rebuilt in 006 to use SELECT t.*; rebuilt again
 - Criterion rollup + task↔criterion links ([ADR 0025](adr/0025-structured-criterion-task-link.md), [#435](https://example.com/builders#/task/435)/[#438](https://example.com/builders#/task/438)): `GET /versions/:id/progress` rolls up each done-when criterion → its gating tasks (via `task_criteria`) → live status counts + the not-yet-shipped `remaining[]` + `unattributed_tasks` (the read behind the `/status` skill, in `src/bongos/done-when.js criterionProgress`). The link CRUD mirrors the dependency endpoints: `GET /tasks/:id/criteria`, `POST /tasks/:id/criteria` (**metic+** — [ADR 0090](adr/0090-metic-task-authoring.md)) and `DELETE /tasks/:id/criteria/:criterionId` (**metic+**). A criterion ref is a numeric `done_when_criteria.id`, a positional `"Cn"` token, or a `criterion_id` slug, resolved against the task's version (`POST /tasks` links at create time so `/status` counts the task with no backfill).
 - Module store publish (ADR 0338 D1, task 1004271): `POST /store/modules/:key/versions` (`requireBuilder` + `requirePermission('module.submit')`, Metic floor). The body is the raw gzip tarball `bongos module publish` builds (own `express.raw` parser, 5 MB cap; 16 MB / 2000 files unpacked). `scripts/gds/module-artifact.js` re-verifies every hash and the publish gate, then `src/bongos/module-store.js` keeps the file under `var/module-store/` and inserts the `store_module_versions` row in one transaction. The first publish makes the caller the author; later versions are author-only, newer than the last and never overwritten; a delisted key takes none.
 - Module store install (ADR 0338 D1, task 1003785), all `requireBuilder` and own-scoped (the holder is the caller): `POST /store/modules/:key/acquire` (`{version?}`; grants a free entitlement — no price row, or a zero price, is free — or `402 payment_required` for a priced module; refuses a delisted one), `GET /store/modules/:key/versions/:version/tarball` (served only to a live entitlement holder; `X-Tarball-Sha256`), `POST /store/modules/:key/acquired` (`{version}` → `recordAcquired`). Read side in `src/bongos/module-store.js` (`resolveAcquirable`, `isFreePrice`, `versionArtifactFile`). No channel check yet (tasks 1003815, 1003805). `bongos module update` (task 1003786) reuses the same three calls; the acquire route reads price only for a caller with no entitlement, so a holder is never charged again.
+- Module store delist (ADR 0338 D2, task 1003797): `POST /store/modules/:key/delist` (`requireBuilder` + `requirePermission('module.delist')`, Metic floor, granted by `government_022`; strict body `{reason}`, reason required, recorded by the audit middleware). Sets `store_modules.status='delisted'` and `delisted_at` — one-way, no relist route. Every store read already refuses a delisted key (acquire, tarball, acquired, publish), while `GET /store/modules/latest` still answers with the status so `bongos upgrade` warns the holder. `GET /modules` sets `store_delisted` on an instance-tree module the store delisted (hall pill "delisted · no more updates"), and `bongos module list` marks it DELISTED (fail-soft store check, instance modules only). Never revokes an entitlement, never reaches an installed copy, never writes a score (ADR 0359). 404 unknown key, 409 `already_delisted`.
 - Server-mediated branch publish (ADR 0055 / [#1025](https://example.com/builders#/task/1025) — lets a checkout with no GitHub push credential ship). Owner-gated like ship: `POST /tasks/:id/publish-branch` (`requireBuilder` + `gateTaskOwnership`; own 32 MB json parser for the base64 thin-bundle body, 20 MB decoded cap; the server pushes the branch + opens the PR + auto-merges with a server-side push credential — a **GitHub App** installation token (short-lived, repo-scoped; preferred, [ADR 0055](adr/0055-server-mediated-branch-publish.md) update / task 1028) or the `GITHUB_PUSH_TOKEN` PAT fallback; `503 push_unconfigured` when neither is set; `400 tip_mismatch` if the bundle tip ≠ the claimed `head_sha`) and `GET /tasks/:id/publish-status?branch=…` (polls PR + deploy-prod state derived live from GitHub). `branch` is optional: without it the server finds the task's own PR by its `task <id>: …` title, and the answer names the `branch` it used and its `branch_source` (`query` / `task_pr`, or `null` with a `branch_hint` when there is no such PR) — never a `400` (task 1003764). When the PR is still open it also carries `merge_driver`, whose `reason` says why it has not merged; on a red PR `failing_tests` names the failing unit tests (read from the `unit-report` commit status the `unit` workflow posts) and `checks_unreadable: true` says the check list is blind because the App lacks `Checks: read` — so an empty `checks[]` is never read as "nothing failed" (task 1003988, ADR 0301). Because the server's credential is the PR's AUTHOR, publish also **assigns the PR to the task's claim holder** and names them in the body (`modules/lifecycle/pr-assign.js`, task 1003991) — best-effort: the 201 carries `pr_assignee` (the login, or `null` when GitHub would not assign it) and a failed assignment never fails the publish. `ship.js` uses these in `ci` mode only when `pushVia()` resolves to server (no authenticated `gh` on the machine, or `<PREFIX>_PUSH_VIA_SERVER=1`); a machine with `gh` keeps the local push path unchanged. Implementation in `src/bongos/github-push.js`.
 - Archon monitoring reads backing the `/watch` page (ADR 0036): `GET /builders/roster`, `GET /grades/by-builder[?days=N]` (**archon-only**, [#726](https://example.com/builders#/task/726) — per-builder grade breakdown for the MARKS section; the project-wide aggregate stays public at `/public/grades`), `GET /audit-log`, `GET /override-requests`, `GET /access-requests`, `GET /security/reports`. Personal-prefs writes backing `/settings`: `GET/PATCH /me/skill-prefs`, `PATCH /me/disciplines`.
 - Per-builder "needs" + own Gemini key ([ADR 0073](adr/0073-builder-needs-signal-and-byok-gemini-key.md), [#1013](https://example.com/builders#/task/1013)): `GET /me` now also carries `needs` ({items, action_needed_count} — the consistent "the system needs an input from you" signal; `modules/builder-settings/builder-needs.js` is the SSOT — carved out in BV1.R80, resolved by `GET /me` via the `builder-settings` kernel port — rendered by the hall Standing card + the CLI `printNeedsNudge`). The own-key (pragmatic BYOK) endpoints, all own-scoped: `GET /me/art-key/own` (masked meta — last4 only), `PUT /me/art-key/own` (validate-on-save via a Google list-models call → encrypt with `src/bongos/secret-box.js` → store; `503 storage_not_configured` until `BUILDER_SECRET_KEY` is set, `422 invalid_key` on a bad key), `DELETE /me/art-key/own`. The existing `GET /me/art-key` (shared-key delivery) is extended to also deliver the decrypted own key, which `scripts/gds/fetch-art-key.js` syncs into the local `gemini_api_key` slot (own key wins in the `gen_api.py` cascade).

package/docs/copy-inventory.md

@@ -4,13 +4,13 @@
 > Deterministic on a given tree — regenerate and commit rather than hand-editing.
 > Machine-readable twin: [`copy-registry.json`](copy-registry.json).
 
-**2422 strings** across 3 surfaces · 2105 distinct pieces of copy · 2422 certain, 0 heuristic · 220 shown in more than one place.
+**2424 strings** across 3 surfaces · 2107 distinct pieces of copy · 2424 certain, 0 heuristic · 220 shown in more than one place.
 
 ## Surfaces
 
 | surface | lives at | files | strings |
 |---|---|---|---|
-| `builders-hall` | `modules/hall-ui/public` | 130 | 1773 |
+| `builders-hall` | `modules/hall-ui/public` | 130 | 1775 |
 | `status-dashboard` | `modules/status-ui/public` | 4 | 100 |
 | `landing` | `modules/public-landing/public` | 6 | 549 |
 
@@ -78,7 +78,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `2287c62afcdd` | 3x | The street | modules/hall-ui/public/street.html:54, modules/hall-ui/public/street.html:54, modules/hall-ui/public/street.html:92 |
 | … | | _180 more in the JSON registry_ | |
 
-## `builders-hall` — 1773 strings
+## `builders-hall` — 1775 strings
 
 | id | conf | text | where |
 |---|---|---|---|
@@ -342,7 +342,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `90691bceaf68` | certain | Could not load | `modules/hall-ui/public/project-settings.js:242` |
 | `90691bceaf68` | certain | Could not load | `modules/hall-ui/public/task.js:1022` |
 | `589a4cfc5442` | certain | Could not load idea {…}. | `modules/hall-ui/public/ideas.js:1018` |
-| `192c893fc64e` | certain | Could not load modules. | `modules/hall-ui/public/modules.js:328` |
+| `192c893fc64e` | certain | Could not load modules. | `modules/hall-ui/public/modules.js:335` |
 | `9912c3835136` | certain | Could not load requests — reload to try again. | `modules/hall-ui/public/collab.js:845` |
 | `7775fec0fa85` | certain | Could not load sessions. | `modules/hall-ui/public/sessions.js:504` |
 | `7775fec0fa85` | certain | Could not load sessions. | `modules/hall-ui/public/sessions.js:542` |
@@ -362,7 +362,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `64f9d51f0fa2` | certain | Could not load your settings. | `modules/hall-ui/public/settings.js:1199` |
 | `de244c45d916` | certain | Could not load {…} | `modules/hall-ui/public/task.js:1015` |
 | `2366356926b4` | certain | Could not mark the primer just now. Try again. | `modules/hall-ui/public/primer.js:259` |
-| `753987b5da13` | certain | Could not reach the submit endpoint. | `modules/hall-ui/public/modules.js:307` |
+| `753987b5da13` | certain | Could not reach the submit endpoint. | `modules/hall-ui/public/modules.js:314` |
 | `6f500726f0ac` | certain | Could not read the report: {…} | `modules/hall-ui/public/watch.js:669` |
 | `21c2f33168a3` | certain | Could not read this project's deploy state: {…} | `modules/hall-ui/public/deploy.js:619` |
 | `21a782f1af26` | certain | Could not read what this would bring in: {…}. The check below still applies. | `modules/hall-ui/public/deploy.js:537` |
@@ -816,7 +816,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `9ac63d97239a` | certain | Nothing newer is published that this box can take. There is nothing to deploy. | `modules/hall-ui/public/deploy.js:599` |
 | `43626cff7071` | certain | Nothing of that kind in your sky. | `modules/hall-ui/public/sky-panel.js:123` |
 | `ad9a17a8a5eb` | certain | Nothing shipped yet. | `modules/hall-ui/public/profile.js:297` |
-| `f326632f2013` | certain | Nothing to submit — every module here ships with the core. | `modules/hall-ui/public/modules.js:268` |
+| `f326632f2013` | certain | Nothing to submit — every module here ships with the core. | `modules/hall-ui/public/modules.js:275` |
 | `27c0d872db2d` | certain | Nothing you have typed above is lost by opening this. | `modules/hall-ui/public/ideas.html:155` |
 | `26a07b64f49d` | certain | Now running core {…} | `modules/hall-ui/public/deploy.js:395` |
 | `21cb60a8a96a` | certain | Now running core {…} — but GitHub was not updated. | `modules/hall-ui/public/deploy.js:385` |
@@ -1127,6 +1127,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `93fa2e97dd35` | certain | System default for this skill | `modules/hall-ui/public/settings.js:72` |
 | `4894b1d9b0de` | certain | System oversight: people, operations and security. | `modules/hall-ui/public/watch.js:1364` |
 | `aa8da34fe237` | certain | Take the next page, or pick one from the studio. | `modules/hall-ui/public/tweak-editor.js:564` |
+| `8b3cdb88b0f4` | certain | Taken out of the store. Your copy keeps working, but it will get no more updates. | `modules/hall-ui/public/modules.js:113` |
 | `e604fc3ace79` | certain | Task # | `modules/hall-ui/public/blockers.js:139` |
 | `a0f384b022fd` | certain | Task dependencies | `modules/hall-ui/public/goals.html:132` |
 | `91576eb7c880` | certain | Task dependency forest — scrolls sideways inside this box | `modules/hall-ui/public/goal-forest-render.js:146` |
@@ -1513,6 +1514,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `0e2bef756977` | certain | days ({…}–{…}) | `modules/hall-ui/public/project-settings.js:113` |
 | `4adbb8da9999` | certain | default ({…}) | `modules/hall-ui/public/settings-render.js:64` |
 | `4a287afb0892` | certain | default for your rank | `modules/hall-ui/public/settings.js:420` |
+| `953f99598871` | certain | delisted · no more updates | `modules/hall-ui/public/modules.js:113` |
 | `563e03d200c6` | certain | designed, task-tracked, not yet built | `modules/hall-ui/public/diagrams.html:43` |
 | `a3fd52d9513b` | certain | document{…} you added · learned | `modules/hall-ui/public/settings-specialities.js:322` |
 | `fcec9cad1c69` | certain | download .docx | `modules/hall-ui/public/tweak-editor.html:65` |
@@ -1654,7 +1656,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `c8c2551006dc` | certain | skip the tour | `modules/hall-ui/public/goal-map.html:121` |
 | `c8c2551006dc` | certain | skip the tour | `modules/hall-ui/public/thinking.html:122` |
 | `1e737a57eb20` | certain | start governing | `modules/hall-ui/public/city.html:79` |
-| `0215b2cdca8c` | certain | submit for review | `modules/hall-ui/public/modules.js:142` |
+| `0215b2cdca8c` | certain | submit for review | `modules/hall-ui/public/modules.js:149` |
 | `43e6f1592ae3` | certain | submit it in the editor | `modules/hall-ui/public/studio.js:797` |
 | `9ec19e32f86f` | certain | submit page | `modules/hall-ui/public/tweak-editor.html:68` |
 | `da30b952a60b` | certain | system / unattributed | `modules/hall-ui/public/goals-page.js:269` |
@@ -1750,7 +1752,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `6c08bfe92e2b` | certain | {…} This project is invite-only: the {…} invites each builder, and there is nothing to apply for here. | `modules/hall-ui/public/hall-render.js:289` |
 | `c5623d60015d` | certain | {…} Your standing is {…}. | `modules/hall-ui/public/hall-render.js:845` |
 | `a91e1e702d4d` | certain | {…} achieved, {…} in progress, {…} not started of {…} goals | `modules/hall-ui/public/roadmap.js:73` |
-| `a65d371b5cb3` | certain | {…} and above can enable or disable a module | `modules/hall-ui/public/modules.js:140` |
+| `a65d371b5cb3` | certain | {…} and above can enable or disable a module | `modules/hall-ui/public/modules.js:147` |
 | `98b1c674fc37` | certain | {…} and up | `modules/hall-ui/public/sessions.js:289` |
 | `111b71a9acaf` | certain | {…} and up. | `modules/hall-ui/public/sessions.js:287` |
 | `56b00d773232` | certain | {…} and {…} | `modules/hall-ui/public/profile-nudge.js:77` |
@@ -1789,7 +1791,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `3ad8f32dd43b` | certain | {…} you have sent | `modules/hall-ui/public/profile-connections.js:146` |
 | `2f75f69cdb2f` | certain | {…} {…} changed | `modules/hall-ui/public/profile-crafts.js:218` |
 | `8186b562553a` | certain | {…} {…} waiting | `modules/hall-ui/public/work.js:420` |
-| `a9216af9b05e` | certain | {…} {…} — how-to | `modules/hall-ui/public/modules.js:383` |
+| `a9216af9b05e` | certain | {…} {…} — how-to | `modules/hall-ui/public/modules.js:390` |
 | `0d4016a5531c` | certain | {…} {…}{…} | `modules/hall-ui/public/watch.js:503` |
 | `0d4016a5531c` | certain | {…} {…}{…} | `modules/hall-ui/public/work.js:265` |
 | `b3757ba3bb46` | certain | {…} · Stored encrypted; never shown again after saving. | `modules/hall-ui/public/settings.js:873` |
@@ -1797,7 +1799,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `d73256fbc395` | certain | {…} · who votes, and how it {…} | `modules/hall-ui/public/board-room.js:458` |
 | `cab2a4296aec` | certain | {…} · {…} · {…}{…} | `modules/hall-ui/public/goal-inbox.js:458` |
 | `1ac723849449` | certain | {…} · {…}{…} | `modules/hall-ui/public/sky-interaction.js:33` |
-| `ddd2bfc1fb60` | certain | {…} — how to use it | `modules/hall-ui/public/modules.js:385` |
+| `ddd2bfc1fb60` | certain | {…} — how to use it | `modules/hall-ui/public/modules.js:392` |
 | `085f93f3f775` | certain | {…} — see all standings | `modules/hall-ui/public/hall-render.js:80` |
 | `2a2728a4ec4f` | certain | {…}% of tasks complete | `modules/hall-ui/public/roadmap.js:63` |
 | `15e545eb3ce2` | certain | {…}, no such task | `modules/hall-ui/public/task.js:1002` |
@@ -1812,7 +1814,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `97e27ab169ae` | certain | {…}{…} session{…} across {…} builder{…}. | `modules/hall-ui/public/sessions.js:443` |
 | `3d74668f69e5` | certain | {…}{…} · {…} | `modules/hall-ui/public/task.js:639` |
 | `7f79bedecf60` | certain | {…}{…} — open it to see what went | `modules/hall-ui/public/goal-inbox.js:374` |
-| `1026fd5f68b7` | certain | · version | `modules/hall-ui/public/modules.js:388` |
+| `1026fd5f68b7` | certain | · version | `modules/hall-ui/public/modules.js:395` |
 | `4a5ff4f662df` | certain | — ${…} of ${…} this month ({…}%). {…} | `modules/hall-ui/public/hall-render.js:520` |
 | `a6ae9cbdee30` | certain | — all builders — | `modules/hall-ui/public/builders.js:711` |
 | `729d4ce22b99` | certain | — any — | `modules/hall-ui/public/hall-widgets.js:163` |