@bongos/core 1.23.1 → 1.23.3

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/bongos/package-core.js",
-  "core_version": "1.23.1",
-  "core_contract": "1.23.1",
-  "source_commit": "0d508b4325781d8f18af3c19307562f8645da4eb",
+  "core_version": "1.23.3",
+  "core_contract": "1.23.3",
+  "source_commit": "a0b45cd71b45f91da068da6eb3e6afef687897c6",
   "source_ref": "HEAD",
-  "built_at": "2026-10-26T04:44:59.306Z",
+  "built_at": "2026-10-26T21:16:36.258Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 616,
     "agent_docs_stubbed": 29,
-    "functional_verbatim": 3547,
+    "functional_verbatim": 3551,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 4193,
-  "tree_sha256": "8e6ded4e4373594cfce4f50eece842671319dd157c1ee92efc32ee38695ab58f",
+  "file_count": 4197,
+  "tree_sha256": "929094e8d49dd75a5e74b18f58a1b869fc50dbc5df600af9e861981227cdb40c",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -317,12 +317,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "18f98f4bd88ad4ae7f4f6ad02dfb11e320382dab75e8005a692d7d6e6d715a22"
+      "sha256": "8537c645efe282dc1ee9a620b555ac6bbd8919eaf8747c1be84df7c99007a48a"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "e208fa1f1c1e63db794e415d5c7f51e4afc6e63b2d5a5f9c1a9d7c5d780b1815"
+      "sha256": "8554475255239e0e2a5c84f1287c09e93d54c4dab513248c13f243f5d21fda1d"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -332,17 +332,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "13f7a3dda499a461f6901742377de291cf8028064478ae190ca1d9b612242748"
+      "sha256": "34b88b9a4038b95a62f4528a83aa5bfe25f504ab545417c8edeea2a2afbfef69"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "5a1de1049b40fd96b76d30c2f04d531585d8641c40ac920ec229943abdfce4bd"
+      "sha256": "a30cb8c16c64fd7b3eba677268411c31b0c98df4a207d5a60745bca5235d8c15"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "56bc729ffbd649b03715b27abb6d7ffae6509990de1234dcd5e160b93166e133"
+      "sha256": "29badc2ef299498e66224b7ee031be479d10cfcacd8a752c3e06eb05f1d1e64e"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -2172,7 +2172,7 @@
     {
       "path": "docs/adr/0342-module-categories-are-eight-parents-with-approved-sub-categories.md",
       "mode": "0000644",
-      "sha256": "f847a769842c5c57a86ef8951e685da3b61474029b54b6620046713de7c6c93c"
+      "sha256": "147fb9513dc05ad242c09162ac37ccd2cbb9457693170b3d0a4427d9d27bbb77"
     },
     {
       "path": "docs/adr/0343-a-module-score-is-a-security-gate-then-an-average-of-visible-parts.md",
@@ -2392,17 +2392,17 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "8c12aef17ad99c34c4d4cddcbdcd26808a7db092b646be8ac92a22a392b4d984"
+      "sha256": "fbad9b37dd44c344ef532638550d666cf94de9813c0df8d4f2e004e0b7f62582"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "482952364793f2dc91ef709fdce1741b92bed62ced1a89ce43ae02d5e1a8acbb"
+      "sha256": "10545c86dc834e1c0654ff6da45caecded2e547a00818b221e16c9e60c16b8b5"
     },
     {
       "path": "docs/architecture.md",
       "mode": "0000644",
-      "sha256": "6e7e0203b4fa5c25e9746d8a71f2fc15ce2070fa23f7944bd52f6755661c06d6"
+      "sha256": "02e9d3d3fe5b69494f4294ee716ac605ce6090b20d48bc4fb72ddead829d6701"
     },
     {
       "path": "docs/branding-contract.md",
@@ -2937,12 +2937,12 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "616c5eaf2a82c232848f5c61a81b9a9fe99971bd4397d4615b4a9b3dfd28b03d"
+      "sha256": "298fea75cd1590bf6dbb3ad5baedf0ec6c81d2eb811cf59a3d138bd15144c021"
     },
     {
       "path": "docs/modules-contract.md",
       "mode": "0000644",
-      "sha256": "9f75271481d22854d944a73ea7b9d5572198e3278c035b3620e82c3c5fbee577"
+      "sha256": "28cbf7f3d10bd67ef74880112746d182fac27a7659c52694c315b17efe5cb325"
     },
     {
       "path": "docs/onboarding/diagrams/01-task-lifecycle.mmd",
@@ -4189,6 +4189,11 @@
       "mode": "0000644",
       "sha256": "088b129b53a87454b574b2bc8b38c672e460fc618730a8bbf20a404aa970a682"
     },
+    {
+      "path": "migrations/core_280_store_subcategories.sql",
+      "mode": "0000644",
+      "sha256": "b795f6a5596ebd12a0fbcf8d98f40b24e12fb819ec5abe5d42ca592147db32bc"
+    },
     {
       "path": "modules/agents/CLAUDE.md",
       "mode": "0000644",
@@ -5087,7 +5092,7 @@
     {
       "path": "modules/government/catalog.js",
       "mode": "0000644",
-      "sha256": "c3af1d48040b3bd8373eb623ef311e5b66e0675130672f44b8ced4a55686d6f9"
+      "sha256": "9a3d3fee34144d44b5af811fc8e81e7bec74559eae538cf1e6015a2d54321df3"
     },
     {
       "path": "modules/government/charter.js",
@@ -5354,6 +5359,11 @@
       "mode": "0000644",
       "sha256": "e0c7dc39dabc43a32df40215c67f48acf25f2da0200ed7efe74242f652948dca"
     },
+    {
+      "path": "modules/government/migrations/government_034_module_subcategory_review.sql",
+      "mode": "0000644",
+      "sha256": "9dac59401fbb83f74c9a0e6f1f594bff9f2be667dbc3516b70a542e33b677241"
+    },
     {
       "path": "modules/government/module.json",
       "mode": "0000644",
@@ -10822,12 +10832,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "e680995ae6ac5c976e99fa19ab0dd56b8b56de9b722583fb8fff1579e5a12c26"
+      "sha256": "4a12dc099ad30270a9f2144f9f243b7183b968c6f9761736c2a10a4471ca08ee"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "ef3e77d8c2eafe7b3e741ff751a23b854640dd14fb1b1b8561041e0f774b24dc"
+      "sha256": "975226f43368c946a43c0ae434ba6132e404175ba6b4960c45fb72b6d109e715"
     },
     {
       "path": "public-docs/index.html",
@@ -10847,7 +10857,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "fed9dfc00b9b4e03e7d398d48b72407d7e03006d7c7e8b4cc1ec6d364d7be35d"
+      "sha256": "de9343583c3ac62144354a65b34a4a44bb4d9442c4abd1b77fafc16558c70f9c"
     },
     {
       "path": "scripts/bongos/CLAUDE.md",
@@ -14417,7 +14427,7 @@
     {
       "path": "src/bongos/module-listing.js",
       "mode": "0000644",
-      "sha256": "f0edc88d351578171d9b4e28fc4f54fb7a2fa3b3f75a2c4d9ca790d242fd902b"
+      "sha256": "3f7013b4e59f72fc89663461d6d5457e412624ae3d4c1df1d2a3b9a8d9168d02"
     },
     {
       "path": "src/bongos/module-overrides.js",
@@ -14442,7 +14452,12 @@
     {
       "path": "src/bongos/module-store.js",
       "mode": "0000644",
-      "sha256": "60446713ba9693befb4c5367ba033eb64f3fbe0ffe4ca6a5fe080e1a9673d70a"
+      "sha256": "1f7fc7251a2b77c80da33b471fcb5ff180bbbd969407a0c636e9085b654dc525"
+    },
+    {
+      "path": "src/bongos/module-subcategories.js",
+      "mode": "0000644",
+      "sha256": "02c02d75c24c9cce5c724ff4af27b5de22edaf3df9dc99dc790fdd92133cee4b"
     },
     {
       "path": "src/bongos/module-submissions.js",
@@ -14522,7 +14537,7 @@
     {
       "path": "src/bongos/route-rank-check.js",
       "mode": "0000644",
-      "sha256": "505a6ba2f4e493078e1b24e5fcebfa42dddb6a5926fb5e86aed88d6e8f729f5d"
+      "sha256": "249ff48a954c7e904d705e636766b92924203dae3a6c08f688cbc68d0734dcb4"
     },
     {
       "path": "src/bongos/routes.js",
@@ -14607,7 +14622,7 @@
     {
       "path": "src/bongos/routes/modules.js",
       "mode": "0000644",
-      "sha256": "74751f74d08ad4feb8a788e59382b2a11b11146e4a588bf6696ad4d4aefe3958"
+      "sha256": "4a210c0d6fe7e5f29612c4b7616ed34c1805f69c7618062ebcc50d0586a320dc"
     },
     {
       "path": "src/bongos/routes/my-passkeys.js",
@@ -14697,7 +14712,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "0d8326ea93d83814b2405d263386b53c0aa9e0f69f94f2e2840e965c47e83693"
+      "sha256": "f87d7162b505fb241f2c33e6dfeaa86cb97d085c6f822384b2b7d923d4eadd1a"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -14717,7 +14732,7 @@
     {
       "path": "src/module-loader/manifest-schema.js",
       "mode": "0000644",
-      "sha256": "a0ecb41fc1b510d635b0b9407ed3953b81a48b39c665a17913ee07b9556e0fb4"
+      "sha256": "8b5185ba1ac863232971a0241d925e21d1572e9dc2a1cff9bdc37025aa423835"
     },
     {
       "path": "src/module-loader/provenance.js",
@@ -16007,7 +16022,7 @@
     {
       "path": "tests/deploy_divergence_line.mjs",
       "mode": "0000644",
-      "sha256": "d9ffe06b3a75ebd31e45ff2faf3f7f88af0d878d592fa3461d8703b73b3cb190"
+      "sha256": "ac3e754b29f10019b58f7b3995b9b145fd8ab25073c4dde3095793291fd72835"
     },
     {
       "path": "tests/deploy_instance.mjs",
@@ -18482,12 +18497,12 @@
     {
       "path": "tests/module_store_instance_root.mjs",
       "mode": "0000644",
-      "sha256": "aa66cdb054eeaef8c3c8babf5238f029d13b668a45a97230efe5f8cfa8908d48"
+      "sha256": "fea6bafeeb548ac1b928a2843325dcae60a126ac8614116610cb979b69159f36"
     },
     {
       "path": "tests/module_store_listing.mjs",
       "mode": "0000644",
-      "sha256": "5ff78feca75178ee59114da484a6746e4aa13aa0d1e080f838f18548e5c6b3e6"
+      "sha256": "5f0cb9cb6e3faf90d342e1d9e1767699b677b8630d874f1c2af9cb7f713ef530"
     },
     {
       "path": "tests/module_store_publish.mjs",
@@ -18509,6 +18524,11 @@
       "mode": "0000644",
       "sha256": "9ed254da26adabfa05a766d8e4dc7f69da9364ca477b19b88c3c76314b94937e"
     },
+    {
+      "path": "tests/module_store_subcategories.mjs",
+      "mode": "0000644",
+      "sha256": "ad29d45c767e14f0dcef7ccd44107545fa3ab54182ad8b0cf7b51bf00243eac5"
+    },
     {
       "path": "tests/module_submissions.mjs",
       "mode": "0000644",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 578 operations across 76 resource groups
+- 582 operations across 76 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -1269,6 +1269,14 @@ function createClient(opts = {}) {
       getStoreModulesKeyVersionsVersionTarball: (args) => request("GET", "/store/modules/{key}/versions/{version}/tarball", { hasBody: false }, args),
       // GET /store/modules/latest — rank: any-builder — GET /store/modules/latest
       getStoreModulesLatest: (args) => request("GET", "/store/modules/latest", { hasBody: false }, args),
+      // GET /store/subcategories — rank: any-builder — GET /store/subcategories
+      getStoreSubcategories: (args) => request("GET", "/store/subcategories", { hasBody: false }, args),
+      // POST /store/subcategories/{id}/approve — rank: metic+archon — POST /store/subcategories/:id/approve
+      postStoreSubcategoriesIdApprove: (args) => request("POST", "/store/subcategories/{id}/approve", { hasBody: true }, args),
+      // POST /store/subcategories/{id}/merge — rank: metic+archon — POST /store/subcategories/:id/merge
+      postStoreSubcategoriesIdMerge: (args) => request("POST", "/store/subcategories/{id}/merge", { hasBody: true }, args),
+      // GET /store/subcategories/queue — rank: metic+archon — GET /store/subcategories/queue
+      getStoreSubcategoriesQueue: (args) => request("GET", "/store/subcategories/queue", { hasBody: false }, args),
       // GET /store/usage-reporting — rank: any-builder — GET /store/usage-reporting
       getStoreUsageReporting: (args) => request("GET", "/store/usage-reporting", { hasBody: false }, args),
       // POST /store/usage-reporting — rank: any-builder — POST /store/usage-reporting

package/clients/bongos-client/index.cjs

@@ -1268,6 +1268,14 @@ function createClient(opts = {}) {
       getStoreModulesKeyVersionsVersionTarball: (args) => request("GET", "/store/modules/{key}/versions/{version}/tarball", { hasBody: false }, args),
       // GET /store/modules/latest — rank: any-builder — GET /store/modules/latest
       getStoreModulesLatest: (args) => request("GET", "/store/modules/latest", { hasBody: false }, args),
+      // GET /store/subcategories — rank: any-builder — GET /store/subcategories
+      getStoreSubcategories: (args) => request("GET", "/store/subcategories", { hasBody: false }, args),
+      // POST /store/subcategories/{id}/approve — rank: metic+archon — POST /store/subcategories/:id/approve
+      postStoreSubcategoriesIdApprove: (args) => request("POST", "/store/subcategories/{id}/approve", { hasBody: true }, args),
+      // POST /store/subcategories/{id}/merge — rank: metic+archon — POST /store/subcategories/:id/merge
+      postStoreSubcategoriesIdMerge: (args) => request("POST", "/store/subcategories/{id}/merge", { hasBody: true }, args),
+      // GET /store/subcategories/queue — rank: metic+archon — GET /store/subcategories/queue
+      getStoreSubcategoriesQueue: (args) => request("GET", "/store/subcategories/queue", { hasBody: false }, args),
       // GET /store/usage-reporting — rank: any-builder — GET /store/usage-reporting
       getStoreUsageReporting: (args) => request("GET", "/store/usage-reporting", { hasBody: false }, args),
       // POST /store/usage-reporting — rank: any-builder — POST /store/usage-reporting

package/clients/bongos-client/index.d.ts

@@ -562,13 +562,15 @@ export interface PostStoreModulesKeyAcquiredRequest { version: string }
 export interface PostStoreModulesKeyAcquiredResponse { ok: boolean; entitlement: unknown }
 export interface PostStoreModulesKeyDelistRequest { reason?: string }
 export interface PostStoreModulesKeyDelistResponse { ok: boolean; module_key: unknown; status: unknown; delisted_at: unknown }
-export interface PostStoreModulesKeyVersionsResponse { ok: boolean; created_module: unknown; version: unknown; channel: unknown }
+export interface PostStoreModulesKeyVersionsResponse { ok: boolean; created_module: unknown; version: unknown; channel: unknown; category: unknown }
 export interface PostStoreModulesKeyVersionsVersionErrorCountRequest { day: string; count: number }
 export interface PostStoreModulesKeyVersionsVersionInstallReportRequest { ok: boolean; error_code?: string }
 export interface PostStoreModulesKeyVersionsVersionReassessRequest { reason?: string }
 export interface PostStoreModulesKeyVersionsVersionReassessResponse { ok: boolean; queued: boolean; module_key: unknown; version: unknown; version_id: unknown }
 export interface PostStoreModulesKeyVersionsVersionReleaseRequest { reason?: string }
 export interface PostStoreModulesKeyVersionsVersionReleaseResponse { ok: boolean; module_key: unknown; version: unknown; channel: unknown; reason: unknown }
+export interface PostStoreSubcategoriesIdApproveRequest { label?: string; sub_key?: string }
+export interface PostStoreSubcategoriesIdMergeRequest { into?: unknown }
 export interface PostStoreUsageReportingRequest { enabled: boolean }
 export interface PostStoreUsageReportingResponse { ok: boolean; enabled: unknown }
 export interface PostTaskRecommendationsRequest { task_id: number; recommended_to: number; reason: string }
@@ -1824,6 +1826,14 @@ export interface BongosClient {
     getStoreModulesKeyVersionsVersionTarball(args?: RequestArgs): Promise<ApiResponse>;
     /** GET /store/modules/latest — rank: any-builder */
     getStoreModulesLatest(args?: RequestArgs): Promise<GetStoreModulesLatestResponse>;
+    /** GET /store/subcategories — rank: any-builder */
+    getStoreSubcategories(args?: RequestArgs): Promise<ApiResponse>;
+    /** POST /store/subcategories/{id}/approve — rank: metic+archon */
+    postStoreSubcategoriesIdApprove(args?: RequestArgs & { body?: PostStoreSubcategoriesIdApproveRequest }): Promise<ApiResponse>;
+    /** POST /store/subcategories/{id}/merge — rank: metic+archon */
+    postStoreSubcategoriesIdMerge(args?: RequestArgs & { body?: PostStoreSubcategoriesIdMergeRequest }): Promise<ApiResponse>;
+    /** GET /store/subcategories/queue — rank: metic+archon */
+    getStoreSubcategoriesQueue(args?: RequestArgs): Promise<ApiResponse>;
     /** GET /store/usage-reporting — rank: any-builder */
     getStoreUsageReporting(args?: RequestArgs): Promise<GetStoreUsageReportingResponse>;
     /** POST /store/usage-reporting — rank: any-builder */

package/clients/bongos-client/index.mjs

@@ -1265,6 +1265,14 @@ export function createClient(opts = {}) {
       getStoreModulesKeyVersionsVersionTarball: (args) => request("GET", "/store/modules/{key}/versions/{version}/tarball", { hasBody: false }, args),
       // GET /store/modules/latest — rank: any-builder — GET /store/modules/latest
       getStoreModulesLatest: (args) => request("GET", "/store/modules/latest", { hasBody: false }, args),
+      // GET /store/subcategories — rank: any-builder — GET /store/subcategories
+      getStoreSubcategories: (args) => request("GET", "/store/subcategories", { hasBody: false }, args),
+      // POST /store/subcategories/{id}/approve — rank: metic+archon — POST /store/subcategories/:id/approve
+      postStoreSubcategoriesIdApprove: (args) => request("POST", "/store/subcategories/{id}/approve", { hasBody: true }, args),
+      // POST /store/subcategories/{id}/merge — rank: metic+archon — POST /store/subcategories/:id/merge
+      postStoreSubcategoriesIdMerge: (args) => request("POST", "/store/subcategories/{id}/merge", { hasBody: true }, args),
+      // GET /store/subcategories/queue — rank: metic+archon — GET /store/subcategories/queue
+      getStoreSubcategoriesQueue: (args) => request("GET", "/store/subcategories/queue", { hasBody: false }, args),
       // GET /store/usage-reporting — rank: any-builder — GET /store/usage-reporting
       getStoreUsageReporting: (args) => request("GET", "/store/usage-reporting", { hasBody: false }, args),
       // POST /store/usage-reporting — rank: any-builder — POST /store/usage-reporting

package/docs/adr/0342-module-categories-are-eight-parents-with-approved-sub-categories.md

@@ -66,8 +66,10 @@ scarce.
 - **Task 1003784** (nested category in the manifest and both catalog surfaces) builds to this:
   `category: { parent, sub }`. `parent` is one of the eight keys, and `sub` is the key of an
   approved sub-category or absent while a proposal is pending.
-- **An approval queue** for proposed sub-categories is new work, not yet filed. It needs a
-  Metic+ permission key and follows the same pattern as the score override (task 1003796).
+- **An approval queue** for proposed sub-categories — built in task 1004355: `core_278`'s
+  `store_subcategories` + `store_module_categories`, the Metic+ atom
+  `module.subcategory.review` (`government_033`), and `/store/subcategories/*` (see
+  docs/modules-contract.md, "Getting listed").
 - **Core modules get categories too**, so the catalog is consistent. The table in D1 is their
   starting assignment.
 - **The cap (task 1003809)** counts listed modules per approved sub-category, never per parent.

package/docs/api/openapi.json

@@ -24344,6 +24344,189 @@
         ]
       }
     },
+    "/store/subcategories": {
+      "get": {
+        "operationId": "get_store_subcategories",
+        "tags": [
+          "store"
+        ],
+        "summary": "GET /store/subcategories",
+        "description": "GET /api/bongos/store/subcategories — the approved sub-categories under each of the eight parents (task 1004355, ADR 0342 D3): what an author names in module.json's `category.sub`. A key not on this list is proposed at publish. rank: any-builder — public store metadata; nothing changed.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "src/bongos/routes/modules.js",
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
+    "/store/subcategories/queue": {
+      "get": {
+        "operationId": "get_store_subcategories_queue",
+        "tags": [
+          "store"
+        ],
+        "summary": "GET /store/subcategories/queue",
+        "description": "GET /api/bongos/store/subcategories/queue — the proposals waiting on a Metic+ decision, oldest first, each with the modules that named it and the near-duplicate names beside it (\"Stripe\" next to \"Stripe payments\"), since stopping near-duplicates is the point of the queue (ADR 0342 D3).\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `module.subcategory.review` (all required).",
+        "x-rank": "metic+archon",
+        "x-source": "src/bongos/routes/modules.js",
+        "x-permissions": [
+          "module.subcategory.review"
+        ],
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
+    "/store/subcategories/{id}/approve": {
+      "post": {
+        "operationId": "post_store_subcategories_id_approve",
+        "tags": [
+          "store"
+        ],
+        "summary": "POST /store/subcategories/:id/approve",
+        "description": "POST /api/bongos/store/subcategories/:id/approve { label?, sub_key? } — make a proposal live, optionally renamed first. A rename onto a key that already exists under the parent is refused with the merge to run instead.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `module.subcategory.review` (all required).",
+        "x-rank": "metic+archon",
+        "x-source": "src/bongos/routes/modules.js",
+        "x-permissions": [
+          "module.subcategory.review"
+        ],
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostStoreSubcategoriesIdApproveRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
+    "/store/subcategories/{id}/merge": {
+      "post": {
+        "operationId": "post_store_subcategories_id_merge",
+        "tags": [
+          "store"
+        ],
+        "summary": "POST /store/subcategories/:id/merge",
+        "description": "POST /api/bongos/store/subcategories/:id/merge { into } — fold a proposal (or an approved duplicate) into an approved sub-category. Every module under it moves to the target.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `module.subcategory.review` (all required).",
+        "x-rank": "metic+archon",
+        "x-source": "src/bongos/routes/modules.js",
+        "x-permissions": [
+          "module.subcategory.review"
+        ],
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostStoreSubcategoriesIdMergeRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/store/usage-reporting": {
       "get": {
         "operationId": "get_store_usage_reporting",
@@ -35803,13 +35986,15 @@
           },
           "created_module": {},
           "version": {},
-          "channel": {}
+          "channel": {},
+          "category": {}
         },
         "required": [
           "ok",
           "created_module",
           "version",
-          "channel"
+          "channel",
+          "category"
         ]
       },
       "PostStoreModulesKeyVersionsVersionErrorCountRequest": {
@@ -35905,6 +36090,27 @@
           "reason"
         ]
       },
+      "PostStoreSubcategoriesIdApproveRequest": {
+        "type": "object",
+        "properties": {
+          "label": {
+            "type": "string",
+            "maxLength": 80
+          },
+          "sub_key": {
+            "type": "string",
+            "maxLength": 80
+          }
+        },
+        "additionalProperties": false
+      },
+      "PostStoreSubcategoriesIdMergeRequest": {
+        "type": "object",
+        "properties": {
+          "into": {}
+        },
+        "additionalProperties": false
+      },
       "PostStoreUsageReportingRequest": {
         "type": "object",
         "properties": {
@@ -36980,8 +37186,8 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 578,
-  "x-schema-count": 622,
+  "x-endpoint-count": 582,
+  "x-schema-count": 624,
   "x-undocumented-bodies": 12,
   "x-response-schemas": 404,
   "x-generated-by": "scripts/bongos/gen-api-docs.js"

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 578 endpoints across 98 route files.
+> **Generated from the live route files** — the route file is authoritative. 582 endpoints across 98 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -863,7 +863,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/sso/pubkey` | `public` | — | GET /sso/pubkey — the hub's Ed25519 assertion-verification key (public). |
 | POST | `/api/bongos/sso/token` | `public` | `client_id`, `client_secret`, `code`, `redirect_uri` | POST /sso/token — server-to-server code redemption. |
 
-## `store` (18)
+## `store` (22)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -883,6 +883,10 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/store/modules/:key/versions/:version/release` | `metic+archon` | `reason` | POST /api/bongos/store/modules/:key/versions/:version/release — a Metic+ person releases a version the promotion gate HELD on tester (a t… |
 | GET | `/api/bongos/store/modules/:key/versions/:version/tarball` | `any-builder` | — |  |
 | GET | `/api/bongos/store/modules/latest` | `any-builder` | — | The newest published version of each named module — what `bongos upgrade` compares an instance's installed store modules against to repor… |
+| GET | `/api/bongos/store/subcategories` | `any-builder` | — | GET /api/bongos/store/subcategories — the approved sub-categories under each of the eight parents (task 1004355, ADR 0342 D3): what an au… |
+| POST | `/api/bongos/store/subcategories/:id/approve` | `metic+archon` | `label`, `sub_key` | POST /api/bongos/store/subcategories/:id/approve { label?, sub_key? } — make a proposal live, optionally renamed first. |
+| POST | `/api/bongos/store/subcategories/:id/merge` | `metic+archon` | `into` | POST /api/bongos/store/subcategories/:id/merge { into } — fold a proposal (or an approved duplicate) into an approved sub-category. |
+| GET | `/api/bongos/store/subcategories/queue` | `metic+archon` | — | GET /api/bongos/store/subcategories/queue — the proposals waiting on a Metic+ decision, oldest first, each with the modules that named it… |
 | GET | `/api/bongos/store/usage-reporting` | `any-builder` | — | The caller's own reporting switch (Settings → Profile and privacy). |
 | POST | `/api/bongos/store/usage-reporting` | `any-builder` | `enabled` |  |