@bongos/core 1.21.32 → 1.21.33

package/docs/copy-registry.json

@@ -3,9 +3,9 @@
   "generator": "scripts/gds/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 2422,
-    "unique_ids": 2105,
-    "certain": 2422,
+    "strings": 2424,
+    "unique_ids": 2107,
+    "certain": 2424,
     "heuristic": 0,
     "duplicate_ids": 220
   },
@@ -13,7 +13,7 @@
     "builders-hall": {
       "at": "modules/hall-ui/public",
       "files": 130,
-      "strings": 1773
+      "strings": 1775
     },
     "status-dashboard": {
       "at": "modules/status-ui/public",
@@ -4682,7 +4682,7 @@
       "surface": "builders-hall",
       "text": "Could not load modules.",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 328,
+      "line": 335,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -4862,7 +4862,7 @@
       "surface": "builders-hall",
       "text": "Could not reach the submit endpoint.",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 307,
+      "line": 314,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -8948,7 +8948,7 @@
       "surface": "builders-hall",
       "text": "Nothing to submit — every module here ships with the core.",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 268,
+      "line": 275,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -11742,6 +11742,15 @@
       "origin": "js-text-assign",
       "confidence": "certain"
     },
+    {
+      "id": "8b3cdb88b0f4",
+      "surface": "builders-hall",
+      "text": "Taken out of the store. Your copy keeps working, but it will get no more updates.",
+      "file": "modules/hall-ui/public/modules.js",
+      "line": 113,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "e604fc3ace79",
       "surface": "builders-hall",
@@ -15216,6 +15225,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "953f99598871",
+      "surface": "builders-hall",
+      "text": "delisted · no more updates",
+      "file": "modules/hall-ui/public/modules.js",
+      "line": 113,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "563e03d200c6",
       "surface": "builders-hall",
@@ -16490,7 +16508,7 @@
       "surface": "builders-hall",
       "text": "submit for review",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 142,
+      "line": 149,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -17354,7 +17372,7 @@
       "surface": "builders-hall",
       "text": "{…} and above can enable or disable a module",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 140,
+      "line": 147,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -17705,7 +17723,7 @@
       "surface": "builders-hall",
       "text": "{…} {…} — how-to",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 383,
+      "line": 390,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -17777,7 +17795,7 @@
       "surface": "builders-hall",
       "text": "{…} — how to use it",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 385,
+      "line": 392,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -17912,7 +17930,7 @@
       "surface": "builders-hall",
       "text": "· version",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 388,
+      "line": 395,
       "origin": "js-markup",
       "confidence": "certain"
     },

package/docs/design/craft-mode-direction.md

@@ -0,0 +1,69 @@
+# Craft mode looks — the design direction (task 1004494, goal 1000095 WA6)
+
+> **Input:** the owner's four-mode prototype, <https://claude.ai/artifact/<redacted>> (boards Building, Artistry, Ideating, Governing). On 2026-10-03 the owner named that prototype **the standardized design** this direction takes from. Built by task 1004495; the mode tools are tasks 1004496 to 1004498.
+
+Each craft mode should feel like the place that craft works, not like a recolour. Each mode gets one colour, one header mark and one signature element, and all of them sit inside the live hall.
+
+## The blend rule (what does not change)
+
+This direction follows the blend rule in [`project-startup-direction.md`](project-startup-direction.md#<redacted>). A mode is something the existing hall wears, never a second hall:
+
+- **The shell stays.** That means the v3 glass hall, the 64px rail that opens on hover, the topbar, the nav groups, the panels, both light and dark themes, and every page's content.
+- **The accent stays the project's action colour.** Claim buttons, links and the lit windows keep `--accent` (salmon) in every mode, as the prototype does. The mode colour marks *where you are*, never *what to press*.
+- **Building and Legacy wear no look.** Building is the hall as today (the prototype's Building board reads "no mode tools"); Legacy is the hall as it was. Only Artistry, Ideating and Governing change anything.
+- **Where the prototype's chrome differs from the live hall, the live hall wins.** The prototype's 232px open rail, its own header layout, and rooms that do not exist yet (Store, Treasury, Charter, Page reviews) are illustration. The tabs each mode shows are settled by task 1004493 (`MODE_TABS` in `craft-mode.js`).
+- **Collab, Builders and Profile show in every mode** (owner, 2026-10-03). The always-present list widens from Builders alone to Builders, Collab and Profile, so every mode's sidebar keeps the You and Community groups. Built in task 1004495.
+
+## The three looks
+
+Every value is a token on `html[data-craft="<mode>"]`, with a dark twin on `html[data-theme="dark"][data-craft="<mode>"]`. The dark values are the prototype's. The prototype is dark only, so the light values are derived from it and checked for contrast: each mode colour reads at least 5.4:1 on the hall's light ground, and its pill text at least 5.8:1.
+
+| | Artistry — *the studio · night* | Ideating — *the sky* | Governing — *the city* |
+|---|---|---|---|
+| `--craft` dark | `#f1e6d2` moonlight | `#f2d27a` star gold | `#aabeff` city blue |
+| `--craft` light | `#2e3c6e` night ink | `#7a5a0c` deep gold | `#33479e` council blue |
+| `--craft-on` (pill text) dark / light | `#0c1122` / `#f1e6d2` | `#1d1604` / `#fdf6dd` | `#0a1030` / `#eef1ff` |
+| ground, dark only | `--bg #07080d`, `--bg-frame #0a0b12`, glass tinted night blue | `--bg #05060d`, glass tinted deep space | unchanged black: the city is drawn on the hall's own black |
+| glass edge, dark only | moonlight at 16% | gold at 16% | city blue at 16% |
+
+Light mode keeps the hall's paper ground in every mode. A night-blue page in light mode would be a second theme, and the hall has two already.
+
+### Shared treatment, all three modes
+
+1. **The mode switch.** The current mode's pill fills with `--craft`, with `--craft-on` text, as on every prototype board. Today it is grey glass in every mode.
+2. **The current tab.** Its tint, icon, label and the 2px marker take `--craft` instead of salmon and grey glass.
+3. **The header mark.** The mode's name sits beside the page title as a small uppercase eyebrow in `--craft`, using the prototype's own words: "the studio · night", "the sky", "the city". At phone width it is hidden, because the switch's single pill already says the mode and the topbar has no room.
+4. **The topbar's hairline** takes `--craft` at 30%, so the whole top edge reads as the mode.
+
+### The signature element: the door's scene, framed in the rail
+
+The mode picker (task 1004492) already draws each mode's scene on its door: the night room, the sky of ideas and the governor city. **Each mode puts its own door's scene at the top of the rail**, as a small framed picture under the brand. It is 40px tall while the rail is closed and 64px when it opens. This is the owner's "carry the lo-fi elements into the nav bar so the theme is obvious". It reuses art the hall already ships, so there is one scene per mode and never two versions that drift apart.
+
+- **Artistry:** the night room, with stars, the moon and houses whose windows are lit in the accent colour. Its source is the prototype's Artistry rail plate.
+- **Ideating:** the sky of ideas, with gold stars and protostar rings. Ideating also scatters faint star dust across the rail itself, after the sky in the prototype's Ideating board and the ideator surface ([ADR 0271](../adr/0271-the-ideator-surface-is-two-halves.md), [`ideator-surface-direction.md`](ideator-surface-direction.md)).
+- **Governing:** the isometric governor city, after the prototype's Governing board and the Board Room pages.
+
+**The plate follows the theme** (owner, 2026-10-03). Dark mode shows each scene as the picker draws it; light mode shows its day version:
+
+| Scene | Light-mode version |
+|---|---|
+| Artistry | dawn sky `#dfe3ef`, stars in night ink `#2e3c6e`, a warm low sun `#f3c98b` in the moon's place, ground `#c3c9dc`, houses `#8d97b8`, windows still lit in the accent |
+| Ideating | cream sky `#f6f0dc`, stars in deep gold `#c9a23a` / `#b8891c`, protostar and well rings in `#7a5a0c` |
+| Governing | pale ground `#e9ecf6`, the city's faces flipped to light greys with the glass kept blue |
+
+It is decorative (`aria-hidden`) and drawn from fixed positions, so every visit shows the same picture. It does not animate, and there is no second reduced-motion block.
+
+### Left for the build, and the tools tasks
+
+- **Governing's header tallies** ("needs you 3 · moving 12" on the prototype) need a live count. "Needs you" is the open-blocker count the nav badge mechanism already carries; "moving" has no source yet. The build may ship the plate and colour first and file the tallies as their own task rather than inventing a number.
+- The palette, paintbrush and lightbulb buttons the Artistry and Ideating boards show in the topbar are tasks 1004496 to 1004498, not this look.
+
+## Renders
+
+The renders show the live hall before (today, with each mode's nav from task 1004493) and after this direction is applied through a scratch stylesheet. Each mode is shown on its own room: Studio, Your thinking and Blockers. Every mode was rendered in light and dark, at desktop (1440) and phone (390) widths, and no render has horizontal overflow. The screenshots are reviewed by the owner and not committed: the hall's evidence rule keeps PNGs out of the repo (`modules/hall-ui/CLAUDE.md`, Evidence matrix).
+
+## Provenance
+
+- Owner ask, task 1004494: unique per craft, not a recolour; Artistry carries the lo-fi elements into the nav; Ideating draws on the ideator surface; Governing on the Board Room and government pages; Building stays as today.
+- Owner decision, 2026-10-03: the four-mode prototype is the standardized design.
+- Owner review of the first renders, 2026-10-03: the scene plate follows light and dark; Collab, Builders and Profile stay in every mode's sidebar.

package/docs/module-api-changelog.md

@@ -2891,5 +2891,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.30 with no explicit bump. run 37124963833. (task 1002620)
   1.21.32 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.31 with no explicit bump. run 37150508709. (task 1002620)
+  1.21.33 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.32 with no explicit bump. run 37152823234. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/page-readings.json

@@ -1909,7 +1909,7 @@
       "surface": "builders",
       "title": "Modules",
       "states_read": ["browse","search-empty","lens","details","out"],
-      "files_hash": "87dc9c1fbfb1be20",
+      "files_hash": "735baf73dba8b0e1",
       "reading_hash": "80813af9d392105c",
       "counts": {"lines":52,"placed":20,"shared":10,"unplaced":22},
       "omitted": {"data":74},
@@ -1937,7 +1937,7 @@
         {"key":"L0020","section":"Module catalog","text":"{…} of {…}","placement":"placed","file":"modules/hall-ui/public/sky-panel.js","line":120,"string_id":"73c1372b43d9","state":"lens","occurrences":3},
         {"key":"L0021","section":"Module catalog","text":"modules","placement":"unplaced"},
         {"key":"L0022","section":"Module catalog","text":"16 from the {…}","placement":"unplaced"},
-        {"key":"L0023","section":"Module catalog","text":"of {…}","placement":"placed","file":"modules/hall-ui/public/roadmap.js","line":288,"string_id":"5e7a2220c6a9"},
+        {"key":"L0023","section":"Module catalog","text":"of {…}","placement":"placed","file":"modules/hall-ui/public/roadmap.js","line":341,"string_id":"5e7a2220c6a9"},
         {"key":"L0024","section":"Module catalog","text":"built here","placement":"placed","file":"modules/hall-ui/public/modules.js","line":53,"string_id":"a87a3c30b1b5","occurrences":17},
         {"key":"L0025","section":"Module catalog","text":"can go upstream","placement":"unplaced"},
         {"key":"L0026","section":"Module catalog","text":"no upkeep","placement":"unplaced"},
@@ -1953,7 +1953,7 @@
         {"key":"L0036","section":"Module catalog","text":"{…} file{…}","placement":"placed","file":"modules/hall-ui/public/gate.js","line":151,"string_id":"3efa67dc6e07"},
         {"key":"L0037","section":"Module catalog","text":"sessions","placement":"placed","file":"modules/hall-ui/public/task.js","line":467,"string_id":"732b4c935e36"},
         {"key":"L0038","section":"Module catalog","text":"Built by this project","placement":"placed","file":"modules/hall-ui/public/modules.html","line":70,"string_id":"b51edc826cbe"},
-        {"key":"L0039","section":"Module catalog","text":"submit for review","placement":"placed","file":"modules/hall-ui/public/modules.js","line":142,"string_id":"0215b2cdca8c"},
+        {"key":"L0039","section":"Module catalog","text":"submit for review","placement":"placed","file":"modules/hall-ui/public/modules.js","line":149,"string_id":"0215b2cdca8c"},
         {"key":"L0040","section":"Module catalog","text":"A module built here can be submitted upstream for review, so it can join the shared catalog with your name and this project credited.","placement":"placed","file":"modules/hall-ui/public/modules.html","line":74,"string_id":"2e17d7e236d9"},
         {"key":"L0041","section":"footer","text":"Sign out","placement":"shared","file":"modules/hall-ui/public/shell.js","line":471,"string_id":"1883ad7f07fc"},
         {"key":"L0042","section":"Module catalog","text":"Builders hall · this session","placement":"placed","file":"modules/hall-ui/public/craft-mode.js","line":249,"string_id":"fd1903586e8e"},

package/modules/government/catalog.js

@@ -228,6 +228,9 @@ const PERMISSIONS = [
   // Re-run a store version's automatic assessment (task 1003796, ADR 0359). Never a
   // hand-set score: the owner ruled a person may ask for a re-check, not change the number.
   { key: 'module.assessment.rerun', system: false, floor: 'metic', guards: 'POST /store/modules/:key/versions/:version/reassess' },
+  // Take a module out of the store (task 1003797, ADR 0338 D2). Stops new installs,
+  // versions and downloads; never reaches an instance that already holds it.
+  { key: 'module.delist', system: false, floor: 'metic', guards: 'POST /store/modules/:key/delist' },
   { key: 'security.report.file', system: false, floor: 'metic', guards: 'POST /security/reports, GET /security/adr' },
   { key: 'llm_cache.use', system: false, floor: 'metic', guards: 'POST /llm-cache/{lookup,store}' },
   { key: 'backup.manage', system: false, floor: 'metic', guards: 'GET /backup/status, POST /backup/trigger' },

package/modules/government/migrations/government_025_module_delist.sql

@@ -0,0 +1,36 @@
+-- government_025_module_delist.sql — grant the new `module.delist` atom to Metic
+-- and Archon (task 1003797, ADR 0338 D2).
+--
+-- WHAT IT IS. A Metic+ person may take a module out of the store. It leaves the
+-- catalog and can no longer be newly installed, updated or downloaded. Instances
+-- that already hold it keep it, and it keeps working: a delist never revokes an
+-- entitlement or reaches into an installed copy (ADR 0338 D2), and it never
+-- changes a score (ADR 0359). A reason is required and the audit log records it.
+--
+-- WHY THIS FILE EXISTS. RANK_SEED is derived from the catalog's floors, and the
+-- drift guard (tests/government_seed.mjs) compares it against the union of the
+-- run-once seed plus every later grant migration, per rank. A metic-floor key is
+-- held by metic AND archon, so both are granted here.
+--
+-- Additive only: one new permission key granted to two ranks; nothing is revoked.
+-- Approved by the owner (Will, Archon) on 2026-10-01.
+-- Idempotent (ON CONFLICT DO NOTHING); forward-safe (INSERT only).
+--
+-- The `SELECT '<rank>', unnest(ARRAY[…])` shape is load-bearing: the drift guard
+-- scans for it literally.
+
+BEGIN;
+
+INSERT INTO government_rank_permissions (rank_key, permission_key)
+SELECT 'metic', unnest(ARRAY[
+  'module.delist'
+])
+ON CONFLICT (rank_key, permission_key) DO NOTHING;
+
+INSERT INTO government_rank_permissions (rank_key, permission_key)
+SELECT 'archon', unnest(ARRAY[
+  'module.delist'
+])
+ON CONFLICT (rank_key, permission_key) DO NOTHING;
+
+COMMIT;

package/modules/hall-ui/public/modules.js

@@ -106,6 +106,13 @@
     return `<a class="ov-fact mod-howto" href="${escapeHtml(href)}">how-to</a>`;
   }
 
+  // A store module this instance holds that the store has since delisted (task
+  // 1003797, ADR 0338 D2): it keeps working here, but no more versions will come.
+  function delistedFact(m) {
+    if (m.store_delisted !== true) return '';
+    return '<span class="fact-pill fact-pill--warn" title="Taken out of the store. Your copy keeps working, but it will get no more updates.">delisted · no more updates</span>';
+  }
+
   // The lines the row's details disclosure opens onto: the facts the payload
   // carries that the card never rendered — what the module contributes, the
   // core it needs, who maintains it and what it hands off to.
@@ -152,7 +159,7 @@
         <div class="ov-row__main">
           <span class="ov-row__title">${escapeHtml(m.title || m.key)}<span class="ov-mono">${escapeHtml(m.key)}</span></span>
           ${desc ? `<p class="ov-row__sub mod-row__desc">${escapeHtml(desc)}</p>` : ''}
-          <div class="ov-row__facts">${provenancePill(m)}${attributionFacts(m)}${upkeepFact(m)}${howtoFact(m)}</div>
+          <div class="ov-row__facts">${provenancePill(m)}${attributionFacts(m)}${upkeepFact(m)}${howtoFact(m)}${delistedFact(m)}</div>
           ${lines ? `<details class="mod-more"${openKeys.has(m.key) ? ' open' : ''}><summary aria-label="Details for ${escapeHtml(m.title || m.key)}"></summary>${lines}</details>` : ''}
         </div>
         <div class="ov-row__right mod-row__right">${rightHtml(m)}</div>

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.32",
+  "version": "1.21.33",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.32",
+      "version": "1.21.33",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.32",
+  "version": "1.21.33",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8948,5 +8948,15 @@
       "id": "1004551",
       "text": "An Archon can star a version on the Roadmap as the project's focus; it persists across reloads, and everyone else sees the star read-only (the server refuses non-Archons)."
     }
+  ],
+  "1.21.33": [
+    {
+      "id": "1003797",
+      "text": "Senior builders can now take a module out of the store, with a reason. Nobody can newly install or update it, but anyone who already has it keeps it working and is told no more updates will come."
+    },
+    {
+      "id": "1004494",
+      "text": "The look for each craft mode is decided. Artistry, Ideating and Governing each get their own colour (moonlight, star gold, city blue) on the mode switch, the tab you are on and the top bar, the mode's name beside the page titl"
+    }
   ]
 }

package/scripts/gds/module.js

@@ -433,7 +433,7 @@ function clip(s, n) {
 
 // Pure renderer — every input arrives as a parameter (the tests pass catalog
 // rows straight in), so it touches no disk and no config.
-function formatCatalog(rows, { catalogOnly = false, query = '', core = null } = {}) {
+function formatCatalog(rows, { catalogOnly = false, query = '', core = null, delisted = new Set() } = {}) {
   const scoped = catalogOnly ? catalog.catalogRows(rows) : rows;
   const shown = catalog.searchCatalog(scoped, query);
   const counts = catalog.summarize(rows);
@@ -458,11 +458,14 @@ function formatCatalog(rows, { catalogOnly = false, query = '', core = null } =
     // An inferred credit is marked so it never reads as something the author
     // typed — the catalog's whole job is honest attribution (ADR 0107 §2).
     const suffix = r.credit.inferred ? '*' : '';
-    const upkeep = (r.maintenance && r.maintenance.status) || 'undeclared';
+    const upkeep = ((r.maintenance && r.maintenance.status) || 'undeclared') + (delisted.has(r.key) ? ' · DELISTED' : '');
     out.push(`  ${pad(mark, 5)}${pad(clip(r.key, 19), 20)}${pad(clip(r.version || '—', 8), 9)}${pad(r.source, 10)}${pad(clip((r.credit.author || '—') + suffix, 19), 20)}${pad(clip((r.credit.origin || '—') + suffix, 25), 26)}${pad(clip(r.license || '—', 11), 12)}${upkeep}`);
   }
   out.push('');
   out.push('  [x] enabled here · [ ] available, not enabled');
+  if (shown.some((r) => delisted.has(r.key))) {
+    out.push('  DELISTED = taken out of the store: your copy keeps working, but no more versions will come.');
+  }
   if (shown.some((r) => r.credit.inferred)) {
     out.push(`  * credit not declared in module.json — shown as the platform (${catalog.CORE_PROJECT_NAME}), which ships it.`);
   }
@@ -470,7 +473,18 @@ function formatCatalog(rows, { catalogOnly = false, query = '', core = null } =
   return out.join('\n');
 }
 
-function cmdList(args, { log = console.log, errlog = console.error, gather = gatherCatalog } = {}) {
+// Which installed store modules the store has delisted (task 1003797). Only modules
+// built into this instance's tree can be store installs, so a core checkout asks
+// nothing. Fail-soft like the upgrade check: offline, or no session, lists as before.
+async function gatherDelisted(rows, { checkStore = gatherUpdates } = {}) {
+  const held = rows.filter((r) => r.source === 'instance');
+  if (!held.length) return new Set();
+  const found = await checkStore(held);
+  if (!found.checked) return new Set();
+  return new Set(Object.keys(found.latest).filter((k) => found.latest[k] && found.latest[k].status === 'delisted'));
+}
+
+async function cmdList(args, { log = console.log, errlog = console.error, gather = gatherCatalog, checkStore = gatherUpdates } = {}) {
   const catalogOnly = args.includes('--catalog');
   const json = args.includes('--json');
   const sIdx = args.indexOf('--search');
@@ -484,14 +498,16 @@ function cmdList(args, { log = console.log, errlog = console.error, gather = gat
   try { data = gather(); }
   catch (e) { errlog(`bongos module list: ${e.message}`); return 1; }
 
+  const delisted = await gatherDelisted(data.rows, { checkStore });
+
   if (json) {
     const scoped = catalogOnly ? catalog.catalogRows(data.rows) : data.rows;
-    const modules = catalog.searchCatalog(scoped, query);
+    const modules = catalog.searchCatalog(scoped, query).map((m) => ({ ...m, store_delisted: delisted.has(m.key) }));
     log(JSON.stringify({ core: data.core, summary: catalog.summarize(data.rows), modules }, null, 2));
     return 0;
   }
 
-  log(formatCatalog(data.rows, { catalogOnly, query, core: data.core }));
+  log(formatCatalog(data.rows, { catalogOnly, query, core: data.core, delisted }));
   for (const s of data.skipped) {
     errlog(`  ! ${s.key}: not listed — ${s.reason}`);
   }

package/src/bongos/module-store.js

@@ -232,6 +232,36 @@ async function latestVersions(keys, { db } = {}) {
   return out;
 }
 
+// Delist a module (task 1003797, ADR 0338 D2): it leaves the catalog, takes no new
+// acquisitions or versions, and serves no further downloads — every read above
+// already refuses on status 'delisted', so this one UPDATE is the whole act. It
+// touches nothing else: no entitlement is revoked, no installed copy is reached,
+// and no score row is written (a delist is not a score, ADR 0359). One-way here;
+// there is no relist route yet.
+// Returns { ok: true, module } or { ok: false, status, code, message }.
+async function delistModule(key, { db } = {}) {
+  const pool = db || require('./pool').pool;
+  const { rows: [mod] } = await pool.query(
+    `UPDATE store_modules SET status = 'delisted', delisted_at = now()
+      WHERE module_key = $1 AND status = 'listed'
+      RETURNING module_key, title, status, delisted_at`, [key]);
+  if (mod) return { ok: true, module: mod };
+  const { rows: [have] } = await pool.query(
+    'SELECT module_key, status, delisted_at FROM store_modules WHERE module_key = $1', [key]);
+  if (!have) return { ok: false, status: 404, code: 'module_not_found', message: `The store has no module "${key}".` };
+  return { ok: false, status: 409, code: 'already_delisted', message: `"${key}" is already delisted.` };
+}
+
+// Which of these module keys the store has delisted, as a Set — so the hall's
+// Modules tab can mark an installed store module that will get no more versions.
+async function delistedKeySet(keys, { db } = {}) {
+  if (!keys.length) return new Set();
+  const pool = db || require('./pool').pool;
+  const { rows } = await pool.query(
+    "SELECT module_key FROM store_modules WHERE module_key = ANY($1) AND status = 'delisted'", [keys]);
+  return new Set(rows.map((r) => r.module_key));
+}
+
 // The tarball on disk for a version row. artifact_path is relative to the store dir
 // (relativeArtifactPath), and artifactPath() re-validates key + version, so a row
 // can never point a read outside the store.
@@ -246,4 +276,5 @@ function versionArtifactFile(row, { dir = storeDir() } = {}) {
 module.exports = {
   stageArtifact, commitArtifact, removeArtifact, relativeArtifactPath, publishVersion,
   isFreePrice, resolveAcquirable, resolveReadable, publishedVersionSet, latestVersions, versionArtifactFile,
+  delistModule, delistedKeySet,
 };

package/src/bongos/route-rank-check.js

@@ -240,6 +240,9 @@ const EXPECTED_RANKS = {
   // Re-running a store version's assessment (task 1003796, ADR 0359) spends a Docs
   // grader call and re-opens the Security gate, so it is pinned to its own atom.
   'POST /store/modules/:key/versions/:version/reassess': 'perm:module.assessment.rerun',
+  // Delisting a store module (task 1003797, ADR 0338 D2) stops every new install of
+  // it for every instance, so it is pinned to its own atom.
+  'POST /store/modules/:key/delist': 'perm:module.delist',
 };
 
 // The authz-core route pins (ADR 0174). Paths and the gating atom were renamed

package/src/bongos/routes/modules.js

@@ -35,6 +35,9 @@
 //   GET  /store/modules/:key/versions/:version/howto
 //                               the HOWTO.md that version shipped with, as text for
 //                               the hall's how-to page (task 1004366, ADR 0347).
+//   POST /store/modules/:key/delist
+//                               Metic+ takes a module out of the store; holders
+//                               keep it (task 1003797, ADR 0338 D2).
 //
 // Read is open to any signed-in builder (same gate as the atlas/primer pages);
 // every write (enable/disable, submit) is metic+archon, same rank as
@@ -85,6 +88,7 @@ const { checkEntitlement, listEntitlements, grantEntitlement, recordAcquired } =
 const {
   stageArtifact, commitArtifact, removeArtifact, relativeArtifactPath, publishVersion,
   resolveAcquirable, resolveReadable, publishedVersionSet, latestVersions, versionArtifactFile,
+  delistModule, delistedKeySet,
 } = require('../module-store');
 const { KEY_RE } = require('../../module-loader/manifest-schema');
 const { parseVersion } = require('../../module-loader/semver');
@@ -204,6 +208,11 @@ module.exports = function buildModulesRouter() {
     let published = new Set();
     try { published = await publishedVersionSet(all.map((m) => m.key)); }
     catch (e) { log.warn({ err: e.message }, 'store versions unreadable for the modules list'); }
+    // Which installed store modules the store has delisted (task 1003797), so the row
+    // says it keeps working but gets no more versions (ADR 0338 D2). Same tolerance.
+    let delistedKeys = new Set();
+    try { delistedKeys = await delistedKeySet(all.filter((m) => m.source === 'instance').map((m) => m.key)); }
+    catch (e) { log.warn({ err: e.message }, 'store status unreadable for the modules list'); }
     for (const m of all) {
       m.enabled_source = sources[m.key] || 'default';
       m.override = byKey.has(m.key)
@@ -214,6 +223,7 @@ module.exports = function buildModulesRouter() {
       m.store_howto = m.source === 'instance' && m.version && published.has(`${m.key}@${m.version}`)
         ? `/builders/modules?howto=${encodeURIComponent(m.key)}&version=${encodeURIComponent(String(m.version))}`
         : null;
+      m.store_delisted = m.source === 'instance' && delistedKeys.has(m.key);
     }
     res.json({
       modules: all,
@@ -446,6 +456,31 @@ module.exports = function buildModulesRouter() {
       res.status(202).json({ ok: true, queued: true, module_key: key, version, version_id: r.version.id });
     }));
 
+  // POST /api/bongos/store/modules/:key/delist — a Metic+ person takes a module out
+  // of the store (task 1003797, ADR 0338 D2). It leaves the catalog, cannot be newly
+  // acquired, takes no new versions and serves no further downloads: every store
+  // read already refuses a delisted key, so this flips the one status. What it never
+  // does: revoke an entitlement, reach into an instance that already holds the
+  // module (that copy keeps working; `bongos upgrade` and the hall tell the holder
+  // no more versions will come), or touch a score (ADR 0359). A reason is required;
+  // the audit middleware records it with who asked. There is no relist route yet.
+  router.post('/store/modules/:key/delist', auth.requireBuilder, auth.requirePermission('module.delist'),
+    asyncHandler('POST /store/modules/:key/delist', async (req, res) => {
+      if (validateOrRespond(req, res, { reason: { type: 'string', maxLength: 2000 } })) return;
+      const { key } = req.params;
+      if (!KEY_RE.test(key)) {
+        return res.fail('bad_module_key', { status: 400, message: 'A module key is lowercase kebab-case.' });
+      }
+      const reason = String(req.body?.reason || '').trim();
+      if (!reason) {
+        return res.fail('reason_required', { status: 400, message: 'Say why this module is leaving the store, in reason. People who already hold it keep it.' });
+      }
+      const r = await delistModule(key);
+      if (!r.ok) return res.fail(r.code, { status: r.status, message: r.message });
+      log.info({ key, builderId: req.builder.id }, `${key} delisted from the store`);
+      res.json({ ok: true, module_key: key, status: r.module.status, delisted_at: r.module.delisted_at });
+    }));
+
   // GET /api/bongos/store/entitlements and /store/modules/:key/entitlement — the
   // read side of the entitlement record (task 1003813, ADR 0338 D1). Own-scoped
   // like /me/sessions: the holder is ALWAYS the caller (holder_kind 'builder',

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.32'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.33'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/hall_catalog_world.mjs

@@ -58,7 +58,7 @@ test('modules: the row is the oversight row — title with the mono key, clamped
   assert.match(js, /<span class="ov-row__title">\$\{escapeHtml\(m\.title \|\| m\.key\)\}<span class="ov-mono">\$\{escapeHtml\(m\.key\)\}<\/span>/, 'the key rides inside the title in mono');
   assert.match(js, /class="ov-row__sub mod-row__desc"/, 'the description is the sub line');
   assert.match(js, /<details class="mod-more"/, 'a details disclosure opens the rest');
-  assert.match(js, /<div class="ov-row__facts">\$\{provenancePill\(m\)\}\$\{attributionFacts\(m\)\}\$\{upkeepFact\(m\)\}\$\{howtoFact\(m\)\}<\/div>/, 'provenance, credit, upkeep and (for a store version, task 1004366) the how-to link are the facts line');
+  assert.match(js, /<div class="ov-row__facts">\$\{provenancePill\(m\)\}\$\{attributionFacts\(m\)\}\$\{upkeepFact\(m\)\}\$\{howtoFact\(m\)\}\$\{delistedFact\(m\)\}<\/div>/, 'provenance, credit, upkeep, (for a store version, task 1004366) the how-to link and (task 1003797) the delisted pill are the facts line');
   assert.match(js, /<div class="ov-row__right mod-row__right">\$\{rightHtml\(m\)\}<\/div>/, 'the right column is one function');
   const css = read('modules.css');
   assert.match(css, /\.mod-row__desc \{[^}]*-webkit-line-clamp: 2/, 'the description clamps to two lines');

package/tests/module_catalog.mjs

@@ -225,10 +225,11 @@ test('formatCatalog: a search with no hits says so instead of printing an empty
   assert.ok(!/KEY\s+SOURCE/.test(out), 'no header row over an empty result');
 });
 
-test('cmdList: --json emits the rows + summary, and honours --catalog/--search', () => {
+test('cmdList: --json emits the rows + summary, and honours --catalog/--search', async () => {
   const lines = [];
-  const code = mod.cmdList(['--json', '--catalog', '--search', 'example world'], {
+  const code = await mod.cmdList(['--json', '--catalog', '--search', 'example world'], {
     log: (s) => lines.push(s),
+    checkStore: async () => ({ checked: false, reason: 'offline' }),
     gather: () => ({ rows: sample(), skipped: [], errors: [], core: '1.19.0' }),
   });
   assert.equal(code, 0);
@@ -239,17 +240,18 @@ test('cmdList: --json emits the rows + summary, and honours --catalog/--search',
   assert.deepEqual(payload.modules.map((m) => m.key), ['provisioning']);
 });
 
-test('cmdList: --search with no value is a usage error, not a silent empty listing', () => {
+test('cmdList: --search with no value is a usage error, not a silent empty listing', async () => {
   const errs = [];
-  const code = mod.cmdList(['--search'], { log: () => {}, errlog: (s) => errs.push(s), gather: () => { throw new Error('must not gather'); } });
+  const code = await mod.cmdList(['--search'], { log: () => {}, errlog: (s) => errs.push(s), gather: () => { throw new Error('must not gather'); } });
   assert.equal(code, 2);
   assert.match(errs.join('\n'), /usage: bongos module list/);
 });
 
-test('cmdList: a coreVersion-skipped module is surfaced on stderr, not silently dropped', () => {
+test('cmdList: a coreVersion-skipped module is surfaced on stderr, not silently dropped', async () => {
   const errs = [];
-  const code = mod.cmdList([], {
+  const code = await mod.cmdList([], {
     log: () => {},
+    checkStore: async () => ({ checked: false, reason: 'offline' }),
     errlog: (s) => errs.push(s),
     gather: () => ({ rows: sample(), skipped: [{ key: 'rotted', reason: 'coreVersion "^0.1.0" not satisfied by core 1.19.0' }], errors: [], core: '1.19.0' }),
   });
@@ -257,6 +259,32 @@ test('cmdList: a coreVersion-skipped module is surfaced on stderr, not silently
   assert.match(errs.join('\n'), /rotted: not listed — coreVersion/);
 });
 
+test('cmdList: an installed store module the store delisted is marked, and only instance modules are asked about (task 1003797)', async () => {
+  const lines = [];
+  const asked = [];
+  const code = await mod.cmdList([], {
+    log: (s) => lines.push(s),
+    gather: () => ({ rows: sample(), skipped: [], errors: [], core: '1.19.0' }),
+    checkStore: async (rows) => {
+      asked.push(...rows.map((r) => r.key));
+      return { checked: true, latest: Object.fromEntries(rows.map((r) => [r.key, { version: '9.9.9', status: 'delisted' }])) };
+    },
+  });
+  assert.equal(code, 0);
+  const instanceKeys = sample().filter((r) => r.source === 'instance').map((r) => r.key);
+  assert.deepEqual(asked, instanceKeys, 'a core module is never a store install, so it is not asked about');
+  const out = lines.join('\n');
+  assert.match(out, /DELISTED/);
+  assert.match(out, /your copy keeps working, but no more versions will come/);
+  const json = [];
+  await mod.cmdList(['--json'], {
+    log: (s) => json.push(s),
+    gather: () => ({ rows: sample(), skipped: [], errors: [], core: '1.19.0' }),
+    checkStore: async () => ({ checked: false, reason: 'offline' }),
+  });
+  assert.ok(JSON.parse(json.join('\n')).modules.every((m) => m.store_delisted === false), 'offline: nothing is marked');
+});
+
 // ---------------------------------------------------------------------------
 // The live tree — the catalog must actually describe THIS checkout
 // ---------------------------------------------------------------------------