@bongos/core 1.21.32 → 1.21.34

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.32",
-  "core_contract": "1.21.32",
-  "source_commit": "dc621db8394a42d17e812d259ae034b2d9ff2e49",
+  "core_version": "1.21.34",
+  "core_contract": "1.21.34",
+  "source_commit": "d939d974306568b0ad522f60c604fbfcade76007",
   "source_ref": "HEAD",
-  "built_at": "2026-10-03T20:09:59.517Z",
+  "built_at": "2026-10-03T21:33:14.512Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 581,
+    "docs_redacted": 582,
     "agent_docs_stubbed": 27,
-    "functional_verbatim": 2904,
+    "functional_verbatim": 2908,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3513,
-  "tree_sha256": "90d84e8130f69ebcd5a15d34b53ac41e6728ff754955ee11a4a9c62dda2dd54b",
+  "file_count": 3518,
+  "tree_sha256": "04811e065d483036054f8d14fc95f12f28a8c4d07abac32b8fd41880b934f0ef",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -317,12 +317,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "69d42ead01d9c96a8728c306701ade8dc9f1682cfa82513c2411a9d3a265c48d"
+      "sha256": "0ff95bf12579c65f3339ac4bf0cc282d7d0132a4872a159042954907b36abfa3"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "134bfb4b226537fdeaf31519c764926dc250b713e4eb3968e65068d0fc460740"
+      "sha256": "d7d4b4c0235d41edfa9348e2953c7f30e97d1c967f1c3d40d32b9a788981826f"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -332,17 +332,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "319671c677ec2bbcadbb8b054b47acf4e943e823720edba32416b6a23c46c90b"
+      "sha256": "4f3cba7f1b570870e2f407e2fbe4d407337a71c882b55e064e814bb653bd77be"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "07246b400a63caa5586a45ec1af6b60c04e616f06515015653d6e7dc48b3fe4f"
+      "sha256": "8daa0216a1a98d91c1c5430f04a1801d3a5f44159de38c707ae929633f6ec27b"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "1a8057d83c6ab453ce6251991f30b8502edb0cd9cebd90d427f706187073f3c2"
+      "sha256": "1a0e9c95b879d23b2ed6035e27de9c8a4c830dcb2b8614cfdb6b887028684ca3"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -2152,7 +2152,7 @@
     {
       "path": "docs/adr/0338-modules-travel-through-a-bongos-hosted-store.md",
       "mode": "0000644",
-      "sha256": "5acb8ac6e656a909ef6392f845f7a479d44d7b7619197e9f66b4879e16a6971c"
+      "sha256": "eadc3bb809b213bbd14dabeab23169c4b4f94393182362b840fef15a2aa59df1"
     },
     {
       "path": "docs/adr/0339-a-projects-owner-upgrades-it-and-a-hosted-project-hands-off-to-the-hub-door.md",
@@ -2292,17 +2292,17 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "0d8593234a315be3d3e03f23612ee7248ee742bca086e24c6b835d28f137c443"
+      "sha256": "12abe3c6207d5ea31ff769856aea0211f6285193a4fca9af56bb16214d05fd04"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "0b0b87bbe13d992d896a7145f86d1ef09d7f80c2922d968ea45bcbff38479e11"
+      "sha256": "8d3ffd1391e96fcaef1009476a3068d3eca0520bd0237130981ea037743c0d3a"
     },
     {
       "path": "docs/architecture.md",
       "mode": "0000644",
-      "sha256": "aa092ac83b6b23e3b030d463860a194bd024fc12d31e07bbeb036ac3a23d4a35"
+      "sha256": "5236bf63df238c4b93e515a9982e76e0908382d049bf38035b5bda2a3ceda11b"
     },
     {
       "path": "docs/branding-contract.md",
@@ -2322,18 +2322,23 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "48ed28854a75411af0098e31dd92f99b1cceff4e969dc1d1811a5e1bf9ccf696"
+      "sha256": "af2fcfa8af78417d14e7e3be9c7edec902ee1687a9dec3030973e4b4eec8e511"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "13b018cc4a49c755c7f6b598079fdd0f028008e2c63b1e1bb18c14871b786d1f"
+      "sha256": "d320fed484e811c8ed76eb71f92967850cb4946ee531e3073a263d2b7f9172bc"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
       "mode": "0000644",
       "sha256": "b4f9fdf5a44373217d59acadcdb2d17fd44018a4d30647bc518bd401f2876756"
     },
+    {
+      "path": "docs/design/craft-mode-direction.md",
+      "mode": "0000644",
+      "sha256": "083f40e17073b4c7a7d78205fa23299ecd1357fce13894d27c29365004a70f34"
+    },
     {
       "path": "docs/design/demonolith-plan.md",
       "mode": "0000644",
@@ -2832,7 +2837,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "c0f0ecb9abea0a0d26109fbdc1022b7496ef6e9bdbfe84f1d2555bde8400149e"
+      "sha256": "42ef101bab692519c3f3b26ac5e5f72ad1392448c2d5dd3a52ec502539338522"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2917,12 +2922,12 @@
     {
       "path": "docs/page-inventory.json",
       "mode": "0000644",
-      "sha256": "52b6dd8fa1e637cd6c17a3fca4f2ada8127bf2517cf7ad3528a2c6f061911d97"
+      "sha256": "b7466fc3fc72e057675f890bb65472f6e79fcb07d342aff486d1e7a2483db17d"
     },
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "8ba0324ffe4260864ca53f1e42198491c42e60dd328e9886380e3ffb2e3087be"
+      "sha256": "ce39c79473cd4362cdb2298426a87df6b20e212e80fec05f15f61ed4a830d72b"
     },
     {
       "path": "docs/project-context.template.md",
@@ -4852,7 +4857,7 @@
     {
       "path": "modules/government/catalog.js",
       "mode": "0000644",
-      "sha256": "300d99ff9a8c8c59f70179367e0b262c774f2cfa91376347d13e62296dbf132a"
+      "sha256": "1592e5e388887cfffc79c69be88e31728d2a44a0c7db70f6b262d2df551aba44"
     },
     {
       "path": "modules/government/charter.js",
@@ -5054,6 +5059,11 @@
       "mode": "0000644",
       "sha256": "e839988918bee95e0a5f11bbfe71bd6d3304ad6d8a00a6b78593a34c3e36a6c4"
     },
+    {
+      "path": "modules/government/migrations/government_025_module_delist.sql",
+      "mode": "0000644",
+      "sha256": "5bcdd9defa3927adda5612d990d25dc8efaea8f2a0c159b5bd1b4154364512df"
+    },
     {
       "path": "modules/government/module.json",
       "mode": "0000644",
@@ -5862,7 +5872,7 @@
     {
       "path": "modules/hall-ui/public/modules.js",
       "mode": "0000644",
-      "sha256": "01fbd0bd0ac6910e9deb91599598c5c4aa1f5139b9cdcc05aeed4def50359c55"
+      "sha256": "6f960241607ea3921cce5d40bf5fbb6d17595d26213601cbc6a7195448624b11"
     },
     {
       "path": "modules/hall-ui/public/modules.states.json",
@@ -6184,6 +6194,11 @@
       "mode": "0000644",
       "sha256": "01d0c16945bb9735cae05fbf6584227d60708a6591dcb15a6338b6731f7a69d0"
     },
+    {
+      "path": "modules/hall-ui/public/street-desk.js",
+      "mode": "0000644",
+      "sha256": "52180dc2730a83597836d1c44f58f660685f609fa921e202f11376b1850b290e"
+    },
     {
       "path": "modules/hall-ui/public/street-draw.js",
       "mode": "0000644",
@@ -6192,27 +6207,27 @@
     {
       "path": "modules/hall-ui/public/street-inside.js",
       "mode": "0000644",
-      "sha256": "8da3f686f78f1a176e9b2b9254c144b91601241d5263c849b72aa819e0e0d4bc"
+      "sha256": "958d265b46ec751cd7c82e828e5820c19784f4cd2683d620d28be8010407b478"
     },
     {
       "path": "modules/hall-ui/public/street.css",
       "mode": "0000644",
-      "sha256": "8e18cca74b5aab38f72accdb11537a598e8d8ef26f01ef4ba342906419a09534"
+      "sha256": "274742582e70386c1dd875c63c8ae2f6856088b1952dfad4b99ef34cf885e940"
     },
     {
       "path": "modules/hall-ui/public/street.html",
       "mode": "0000644",
-      "sha256": "cc202b184d4e9ac263900f6c559f74d0cec9ad14681b773abc558ed3aa7cbe5a"
+      "sha256": "40f1abd249ab974cfb6747217fd0161fd07f9d6162c307d59ef82bf02814b398"
     },
     {
       "path": "modules/hall-ui/public/street.js",
       "mode": "0000644",
-      "sha256": "af886924ad4efb2031763831257c80d566a82518f329c455e4d5e1defa6d8a81"
+      "sha256": "c9525c383a58e11d3b9151f24c70a212664ceefef32871933d2d3a9c49311e31"
     },
     {
       "path": "modules/hall-ui/public/street.states.json",
       "mode": "0000644",
-      "sha256": "3c0a1dd8608788ab9a1454c836b2a43bfb4ed6e27cc0557444879bd85df74982"
+      "sha256": "d46e639801c06de9846c2748280e8660c98a80499dc9bf3f01108f6c19eaa7c9"
     },
     {
       "path": "modules/hall-ui/public/studio-lib.js",
@@ -9807,12 +9822,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "98c7377fe080c344a720b0ec5e306d6229bd9c330fb051838c1d9e6f653dbbe6"
+      "sha256": "4f1f108f932da387171a2bacbb112a582e161c706f48e76a92b11c86a6ba074f"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "6bb8d1ab2b6db8876f1e38077a19483cb12ebe4c8a9971e4964f563298a0866c"
+      "sha256": "456bd96e3f424bb2ade59c4acfe5484c49ad0f469e4626e7de5edea5bdca6000"
     },
     {
       "path": "public-docs/index.html",
@@ -9832,7 +9847,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "71b4fa8ec2f99c846ba0ee0d7f3451613e624841fcf4fc6790b40f5f086a3a4c"
+      "sha256": "d6a8a34007ddc0a18d7548d46548f6b8e1349eeeafd7ef5bac4319c455d3c57e"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -10712,7 +10727,7 @@
     {
       "path": "scripts/gds/module.js",
       "mode": "0000644",
-      "sha256": "240a50d80078e81b692cea24d823340d797f3193afd6bec0dcb5d9afb0669c54"
+      "sha256": "eeabf40fafbfdd7e83eeaec6b3898ee913a3f9235b334c952d5d545fd42ad26c"
     },
     {
       "path": "scripts/gds/move-escalation.js",
@@ -11832,7 +11847,7 @@
     {
       "path": "src/bongos/module-store.js",
       "mode": "0000644",
-      "sha256": "4d4cb32e7fdc80c2f31c76a04d939c62980515eb06f7d3862a91c5163a9a70ce"
+      "sha256": "373a0ff03c6644ea622ff859edfe9003fcfa94ea7eb5ca937059865c3eeb317f"
     },
     {
       "path": "src/bongos/module-submissions.js",
@@ -11897,7 +11912,7 @@
     {
       "path": "src/bongos/route-rank-check.js",
       "mode": "0000644",
-      "sha256": "932376cc890d5b7cd05d871e7ae346b2a877c867ae05d330f930b5779c88ad2e"
+      "sha256": "a72e24f1cc5f4f27e7f8827de5b936e773d0e0e9ffe39e2de4da97e42b35e3af"
     },
     {
       "path": "src/bongos/routes.js",
@@ -11982,7 +11997,7 @@
     {
       "path": "src/bongos/routes/modules.js",
       "mode": "0000644",
-      "sha256": "84ae1e60b25ea68796b57b193294f1322f4349633867c419a63b888713fcd158"
+      "sha256": "88fdc1c7d0904c8a7dcea9f87a61848982f9db73a1b66a0dba81ac2220c34bfa"
     },
     {
       "path": "src/bongos/routes/my-sessions.js",
@@ -12057,7 +12072,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "3b1ea1c35af115635ef7cacc489bf5ba30bbc7aa205cec47e38602934574393d"
+      "sha256": "324317d722ad7ecf0ab94d6f14cbabc18aa8629fcec113eb85b72606d926afbd"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -14292,7 +14307,7 @@
     {
       "path": "tests/hall_catalog_world.mjs",
       "mode": "0000644",
-      "sha256": "9a2434b3d54cbc23b3874e757d5d2fc6ab5b50e239c07d013f8cfe1409c11806"
+      "sha256": "11f0ac50c5424a76371591b31275c796ded853db0cd35798b9adc878cdd88c88"
     },
     {
       "path": "tests/hall_city.mjs",
@@ -14342,7 +14357,7 @@
     {
       "path": "tests/hall_matter_card.mjs",
       "mode": "0000644",
-      "sha256": "079ce93d4f2a0c7da7c00807496a043620b57da74da867bf0024055a460e17eb"
+      "sha256": "b6322560371fa21eac463b6360ec70af0d68c5256ff1979337cf77deeedf246c"
     },
     {
       "path": "tests/hall_mine_lens.mjs",
@@ -14437,17 +14452,22 @@
     {
       "path": "tests/hall_street.mjs",
       "mode": "0000644",
-      "sha256": "0873916ec49d3ed5d4e21e990a2f9ed3b7834a5b71a06f78c161b61c18549cb5"
+      "sha256": "a84e6cb75ffda77c7c583ff36b0bdc7b80fd29d811ee780def246486b0dcde80"
     },
     {
       "path": "tests/hall_street_amend.mjs",
       "mode": "0000644",
-      "sha256": "6c799d2bc5688f05f865f3cec8426b49ecce9a19ff53aca336221389e2adafae"
+      "sha256": "01b9f3f6201e48cd4914fcdc519fe79c50860ca2decbd877cd5356170105521c"
+    },
+    {
+      "path": "tests/hall_street_desk.mjs",
+      "mode": "0000644",
+      "sha256": "2044841cb78fdbcbbb701b1530f6bfa90e4130fce2e2a7ab5a375f51a2d09a97"
     },
     {
       "path": "tests/hall_street_inside.mjs",
       "mode": "0000644",
-      "sha256": "9cc7fcf3d94e2e5e8a1d192c6c644e555895cd319dfe95e9ff6786b05c6fa7c4"
+      "sha256": "27988066ed09c4b85a53a81be5ca8b3e5a7e60f80f27ddc0c451f0bd8f8e8235"
     },
     {
       "path": "tests/hall_studio_home.mjs",
@@ -15252,7 +15272,7 @@
     {
       "path": "tests/module_catalog.mjs",
       "mode": "0000644",
-      "sha256": "dfb3bdda7a25328490f2c07ee9434eae0b9b87b2676e0152d29ea40d9e9ef43f"
+      "sha256": "4b2e3b067ddaed61f032f5a825402971e053326a65a75b969e0484f9b183fb7e"
     },
     {
       "path": "tests/module_cli.mjs",
@@ -15309,6 +15329,11 @@
       "mode": "0000644",
       "sha256": "ba4233ed072c87df9dbc5c75af10655ad8eaaf9d8ccbe69df146052467a1279e"
     },
+    {
+      "path": "tests/module_store_delist.mjs",
+      "mode": "0000644",
+      "sha256": "6689e5b56ba80fceff4981266886222a94d8a9fca24a8cbd07ab240ba3ff2037"
+    },
     {
       "path": "tests/module_store_howto.mjs",
       "mode": "0000644",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 501 operations across 73 resource groups
+- 502 operations across 73 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -1103,6 +1103,8 @@ function createClient(opts = {}) {
       postStoreModulesKeyAcquire: (args) => request("POST", "/store/modules/{key}/acquire", { hasBody: true }, args),
       // POST /store/modules/{key}/acquired — rank: any-builder — POST /store/modules/:key/acquired
       postStoreModulesKeyAcquired: (args) => request("POST", "/store/modules/{key}/acquired", { hasBody: true }, args),
+      // POST /store/modules/{key}/delist — rank: metic+archon — POST /store/modules/:key/delist
+      postStoreModulesKeyDelist: (args) => request("POST", "/store/modules/{key}/delist", { hasBody: true }, args),
       // GET /store/modules/{key}/entitlement — rank: any-builder — GET /store/modules/:key/entitlement
       getStoreModulesKeyEntitlement: (args) => request("GET", "/store/modules/{key}/entitlement", { hasBody: false }, args),
       // POST /store/modules/{key}/versions — rank: metic+archon — POST /store/modules/:key/versions

package/clients/bongos-client/index.cjs

@@ -1102,6 +1102,8 @@ function createClient(opts = {}) {
       postStoreModulesKeyAcquire: (args) => request("POST", "/store/modules/{key}/acquire", { hasBody: true }, args),
       // POST /store/modules/{key}/acquired — rank: any-builder — POST /store/modules/:key/acquired
       postStoreModulesKeyAcquired: (args) => request("POST", "/store/modules/{key}/acquired", { hasBody: true }, args),
+      // POST /store/modules/{key}/delist — rank: metic+archon — POST /store/modules/:key/delist
+      postStoreModulesKeyDelist: (args) => request("POST", "/store/modules/{key}/delist", { hasBody: true }, args),
       // GET /store/modules/{key}/entitlement — rank: any-builder — GET /store/modules/:key/entitlement
       getStoreModulesKeyEntitlement: (args) => request("GET", "/store/modules/{key}/entitlement", { hasBody: false }, args),
       // POST /store/modules/{key}/versions — rank: metic+archon — POST /store/modules/:key/versions

package/clients/bongos-client/index.d.ts

@@ -482,6 +482,8 @@ export interface PostStoreModulesKeyAcquireRequest { version?: string }
 export interface PostStoreModulesKeyAcquireResponse { ok: boolean; module_key: unknown; version: unknown; core_version: unknown; tarball_sha256: unknown; tree_sha256: unknown; tarball_bytes: unknown; channel: unknown; entitlement: unknown }
 export interface PostStoreModulesKeyAcquiredRequest { version: string }
 export interface PostStoreModulesKeyAcquiredResponse { ok: boolean; entitlement: unknown }
+export interface PostStoreModulesKeyDelistRequest { reason?: string }
+export interface PostStoreModulesKeyDelistResponse { ok: boolean; module_key: unknown; status: unknown; delisted_at: unknown }
 export interface PostStoreModulesKeyVersionsResponse { ok: boolean; created_module: unknown; version: unknown }
 export interface PostStoreModulesKeyVersionsVersionReassessRequest { reason?: string }
 export interface PostStoreModulesKeyVersionsVersionReassessResponse { ok: boolean; queued: boolean; module_key: unknown; version: unknown; version_id: unknown }
@@ -1570,6 +1572,8 @@ export interface BongosClient {
     postStoreModulesKeyAcquire(args?: RequestArgs & { body?: PostStoreModulesKeyAcquireRequest }): Promise<PostStoreModulesKeyAcquireResponse>;
     /** POST /store/modules/{key}/acquired — rank: any-builder */
     postStoreModulesKeyAcquired(args: RequestArgs & { body: PostStoreModulesKeyAcquiredRequest }): Promise<PostStoreModulesKeyAcquiredResponse>;
+    /** POST /store/modules/{key}/delist — rank: metic+archon */
+    postStoreModulesKeyDelist(args?: RequestArgs & { body?: PostStoreModulesKeyDelistRequest }): Promise<PostStoreModulesKeyDelistResponse>;
     /** GET /store/modules/{key}/entitlement — rank: any-builder */
     getStoreModulesKeyEntitlement(args?: RequestArgs): Promise<ApiResponse>;
     /** POST /store/modules/{key}/versions — rank: metic+archon */

package/clients/bongos-client/index.mjs

@@ -1099,6 +1099,8 @@ export function createClient(opts = {}) {
       postStoreModulesKeyAcquire: (args) => request("POST", "/store/modules/{key}/acquire", { hasBody: true }, args),
       // POST /store/modules/{key}/acquired — rank: any-builder — POST /store/modules/:key/acquired
       postStoreModulesKeyAcquired: (args) => request("POST", "/store/modules/{key}/acquired", { hasBody: true }, args),
+      // POST /store/modules/{key}/delist — rank: metic+archon — POST /store/modules/:key/delist
+      postStoreModulesKeyDelist: (args) => request("POST", "/store/modules/{key}/delist", { hasBody: true }, args),
       // GET /store/modules/{key}/entitlement — rank: any-builder — GET /store/modules/:key/entitlement
       getStoreModulesKeyEntitlement: (args) => request("GET", "/store/modules/{key}/entitlement", { hasBody: false }, args),
       // POST /store/modules/{key}/versions — rank: metic+archon — POST /store/modules/:key/versions

package/docs/adr/0338-modules-travel-through-a-bongos-hosted-store.md

@@ -87,6 +87,13 @@ store entry is otherwise deleted:
 The artifact an instance acquired is already on that instance, so this costs the store nothing
 to honour: it simply never deletes or disables what it has handed over.
 
+*Implemented by task 1003797 (2026-10-01):* `POST /store/modules/:key/delist` with a required
+reason, behind the `module.delist` atom (Metic floor). It flips `store_modules.status` and
+nothing else — holders keep their entitlement and their working copy, the module loader never
+asks the store, and a delist writes no score (ADR 0359). The holder is told by `bongos upgrade`,
+`bongos module list` (DELISTED) and the hall's Modules tab ("delisted · no more updates").
+A delist is one-way for now; relisting would be a separate task.
+
 The refund path in task 1003789 is the one place an entitlement can end, and it is a separate,
 buyer-initiated act — a delist is not a refund.
 

package/docs/api/openapi.json

@@ -20554,6 +20554,72 @@
         ]
       }
     },
+    "/store/modules/{key}/delist": {
+      "post": {
+        "operationId": "post_store_modules_key_delist",
+        "tags": [
+          "store"
+        ],
+        "summary": "POST /store/modules/:key/delist",
+        "description": "POST /api/bongos/store/modules/:key/delist — a Metic+ person takes a module out of the store (task 1003797, ADR 0338 D2). It leaves the catalog, cannot be newly acquired, takes no new versions and serves no further downloads: every store read already refuses a delisted key, so this flips the one status. What it never does: revoke an entitlement, reach into an instance that already holds the module (that copy keeps working; `bongos upgrade` and the hall tell the holder no more versions will come), or touch a score (ADR 0359). A reason is required; the audit middleware records it with who asked. There is no relist route yet.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `module.delist` (all required).",
+        "x-rank": "metic+archon",
+        "x-source": "src/bongos/routes/modules.js",
+        "x-permissions": [
+          "module.delist"
+        ],
+        "parameters": [
+          {
+            "name": "key",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `key`."
+          }
+        ],
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostStoreModulesKeyDelistRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostStoreModulesKeyDelistResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/store/modules/{key}/entitlement": {
       "get": {
         "operationId": "get_store_modules_key_entitlement",
@@ -31003,6 +31069,33 @@
           "entitlement"
         ]
       },
+      "PostStoreModulesKeyDelistRequest": {
+        "type": "object",
+        "properties": {
+          "reason": {
+            "type": "string",
+            "maxLength": 2000
+          }
+        },
+        "additionalProperties": false
+      },
+      "PostStoreModulesKeyDelistResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "module_key": {},
+          "status": {},
+          "delisted_at": {}
+        },
+        "required": [
+          "ok",
+          "module_key",
+          "status",
+          "delisted_at"
+        ]
+      },
       "PostStoreModulesKeyVersionsResponse": {
         "type": "object",
         "properties": {
@@ -32077,9 +32170,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 501,
-  "x-schema-count": 534,
+  "x-endpoint-count": 502,
+  "x-schema-count": 536,
   "x-undocumented-bodies": 12,
-  "x-response-schemas": 355,
+  "x-response-schemas": 356,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 501 endpoints across 92 route files.
+> **Generated from the live route files** — the route file is authoritative. 502 endpoints across 92 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -781,13 +781,14 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/sso/pubkey` | `public` | — | GET /sso/pubkey — the hub's Ed25519 assertion-verification key (public). |
 | POST | `/api/bongos/sso/token` | `public` | `client_id`, `client_secret`, `code`, `redirect_uri` | POST /sso/token — server-to-server code redemption. |
 
-## `store` (9)
+## `store` (10)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
 | GET | `/api/bongos/store/entitlements` | `any-builder` | — | GET /api/bongos/store/entitlements and /store/modules/:key/entitlement — the read side of the entitlement record (task 1003813, ADR 0338 … |
 | POST | `/api/bongos/store/modules/:key/acquire` | `any-builder` | `version` | ---- install: acquire → download → record (task 1003785, ADR 0338 D1) ---- The server end of `bongos module install`. |
 | POST | `/api/bongos/store/modules/:key/acquired` | `any-builder` | `version` |  |
+| POST | `/api/bongos/store/modules/:key/delist` | `metic+archon` | `reason` | POST /api/bongos/store/modules/:key/delist — a Metic+ person takes a module out of the store (task 1003797, ADR 0338 D2). |
 | GET | `/api/bongos/store/modules/:key/entitlement` | `any-builder` | — |  |
 | POST | `/api/bongos/store/modules/:key/versions` | `metic+archon` | _undocumented_ | POST /api/bongos/store/modules/:key/versions — publish one module version to the store (task 1004271, ADR 0338 D1). |
 | GET | `/api/bongos/store/modules/:key/versions/:version/howto` | `any-builder` | — | GET /api/bongos/store/modules/:key/versions/:version/howto — the how-to a version shipped with (task 1004366, ADR 0347 D1/D3), read from … |

package/docs/architecture.md

@@ -293,6 +293,7 @@ Bongos views: `claimable_tasks` (rebuilt in 006 to use SELECT t.*; rebuilt again
 - Criterion rollup + task↔criterion links ([ADR 0025](adr/0025-structured-criterion-task-link.md), [#435](https://example.com/builders#/task/435)/[#438](https://example.com/builders#/task/438)): `GET /versions/:id/progress` rolls up each done-when criterion → its gating tasks (via `task_criteria`) → live status counts + the not-yet-shipped `remaining[]` + `unattributed_tasks` (the read behind the `/status` skill, in `src/bongos/done-when.js criterionProgress`). The link CRUD mirrors the dependency endpoints: `GET /tasks/:id/criteria`, `POST /tasks/:id/criteria` (**metic+** — [ADR 0090](adr/0090-metic-task-authoring.md)) and `DELETE /tasks/:id/criteria/:criterionId` (**metic+**). A criterion ref is a numeric `done_when_criteria.id`, a positional `"Cn"` token, or a `criterion_id` slug, resolved against the task's version (`POST /tasks` links at create time so `/status` counts the task with no backfill).
 - Module store publish (ADR 0338 D1, task 1004271): `POST /store/modules/:key/versions` (`requireBuilder` + `requirePermission('module.submit')`, Metic floor). The body is the raw gzip tarball `bongos module publish` builds (own `express.raw` parser, 5 MB cap; 16 MB / 2000 files unpacked). `scripts/gds/module-artifact.js` re-verifies every hash and the publish gate, then `src/bongos/module-store.js` keeps the file under `var/module-store/` and inserts the `store_module_versions` row in one transaction. The first publish makes the caller the author; later versions are author-only, newer than the last and never overwritten; a delisted key takes none.
 - Module store install (ADR 0338 D1, task 1003785), all `requireBuilder` and own-scoped (the holder is the caller): `POST /store/modules/:key/acquire` (`{version?}`; grants a free entitlement — no price row, or a zero price, is free — or `402 payment_required` for a priced module; refuses a delisted one), `GET /store/modules/:key/versions/:version/tarball` (served only to a live entitlement holder; `X-Tarball-Sha256`), `POST /store/modules/:key/acquired` (`{version}` → `recordAcquired`). Read side in `src/bongos/module-store.js` (`resolveAcquirable`, `isFreePrice`, `versionArtifactFile`). No channel check yet (tasks 1003815, 1003805). `bongos module update` (task 1003786) reuses the same three calls; the acquire route reads price only for a caller with no entitlement, so a holder is never charged again.
+- Module store delist (ADR 0338 D2, task 1003797): `POST /store/modules/:key/delist` (`requireBuilder` + `requirePermission('module.delist')`, Metic floor, granted by `government_022`; strict body `{reason}`, reason required, recorded by the audit middleware). Sets `store_modules.status='delisted'` and `delisted_at` — one-way, no relist route. Every store read already refuses a delisted key (acquire, tarball, acquired, publish), while `GET /store/modules/latest` still answers with the status so `bongos upgrade` warns the holder. `GET /modules` sets `store_delisted` on an instance-tree module the store delisted (hall pill "delisted · no more updates"), and `bongos module list` marks it DELISTED (fail-soft store check, instance modules only). Never revokes an entitlement, never reaches an installed copy, never writes a score (ADR 0359). 404 unknown key, 409 `already_delisted`.
 - Server-mediated branch publish (ADR 0055 / [#1025](https://example.com/builders#/task/1025) — lets a checkout with no GitHub push credential ship). Owner-gated like ship: `POST /tasks/:id/publish-branch` (`requireBuilder` + `gateTaskOwnership`; own 32 MB json parser for the base64 thin-bundle body, 20 MB decoded cap; the server pushes the branch + opens the PR + auto-merges with a server-side push credential — a **GitHub App** installation token (short-lived, repo-scoped; preferred, [ADR 0055](adr/0055-server-mediated-branch-publish.md) update / task 1028) or the `GITHUB_PUSH_TOKEN` PAT fallback; `503 push_unconfigured` when neither is set; `400 tip_mismatch` if the bundle tip ≠ the claimed `head_sha`) and `GET /tasks/:id/publish-status?branch=…` (polls PR + deploy-prod state derived live from GitHub). `branch` is optional: without it the server finds the task's own PR by its `task <id>: …` title, and the answer names the `branch` it used and its `branch_source` (`query` / `task_pr`, or `null` with a `branch_hint` when there is no such PR) — never a `400` (task 1003764). When the PR is still open it also carries `merge_driver`, whose `reason` says why it has not merged; on a red PR `failing_tests` names the failing unit tests (read from the `unit-report` commit status the `unit` workflow posts) and `checks_unreadable: true` says the check list is blind because the App lacks `Checks: read` — so an empty `checks[]` is never read as "nothing failed" (task 1003988, ADR 0301). Because the server's credential is the PR's AUTHOR, publish also **assigns the PR to the task's claim holder** and names them in the body (`modules/lifecycle/pr-assign.js`, task 1003991) — best-effort: the 201 carries `pr_assignee` (the login, or `null` when GitHub would not assign it) and a failed assignment never fails the publish. `ship.js` uses these in `ci` mode only when `pushVia()` resolves to server (no authenticated `gh` on the machine, or `<PREFIX>_PUSH_VIA_SERVER=1`); a machine with `gh` keeps the local push path unchanged. Implementation in `src/bongos/github-push.js`.
 - Archon monitoring reads backing the `/watch` page (ADR 0036): `GET /builders/roster`, `GET /grades/by-builder[?days=N]` (**archon-only**, [#726](https://example.com/builders#/task/726) — per-builder grade breakdown for the MARKS section; the project-wide aggregate stays public at `/public/grades`), `GET /audit-log`, `GET /override-requests`, `GET /access-requests`, `GET /security/reports`. Personal-prefs writes backing `/settings`: `GET/PATCH /me/skill-prefs`, `PATCH /me/disciplines`.
 - Per-builder "needs" + own Gemini key ([ADR 0073](adr/0073-builder-needs-signal-and-byok-gemini-key.md), [#1013](https://example.com/builders#/task/1013)): `GET /me` now also carries `needs` ({items, action_needed_count} — the consistent "the system needs an input from you" signal; `modules/builder-settings/builder-needs.js` is the SSOT — carved out in BV1.R80, resolved by `GET /me` via the `builder-settings` kernel port — rendered by the hall Standing card + the CLI `printNeedsNudge`). The own-key (pragmatic BYOK) endpoints, all own-scoped: `GET /me/art-key/own` (masked meta — last4 only), `PUT /me/art-key/own` (validate-on-save via a Google list-models call → encrypt with `src/bongos/secret-box.js` → store; `503 storage_not_configured` until `BUILDER_SECRET_KEY` is set, `422 invalid_key` on a bad key), `DELETE /me/art-key/own`. The existing `GET /me/art-key` (shared-key delivery) is extended to also deliver the decrypted own key, which `scripts/gds/fetch-art-key.js` syncs into the local `gemini_api_key` slot (own key wins in the `gen_api.py` cascade).