@bongos/core 1.23.4 → 1.23.5

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/bongos/package-core.js",
-  "core_version": "1.23.4",
-  "core_contract": "1.23.4",
-  "source_commit": "b78c52677b921b7b2a6f25834c77b7d516810aa9",
+  "core_version": "1.23.5",
+  "core_contract": "1.23.5",
+  "source_commit": "ef90f2c64f5ccf45c2234df0071be94480b00ce3",
   "source_ref": "HEAD",
-  "built_at": "2026-10-26T21:43:52.539Z",
+  "built_at": "2026-10-26T23:08:05.615Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 616,
     "agent_docs_stubbed": 29,
-    "functional_verbatim": 3552,
+    "functional_verbatim": 3554,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 4198,
-  "tree_sha256": "e5ed2ca130fbbb98e21c941d9c51e72760f74f72e2d48d6d91a4e789bdd6ce10",
+  "file_count": 4200,
+  "tree_sha256": "99ecba7bea108a791c4ce0f59605662920c26580844031a96841acdc4855cda4",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -317,12 +317,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "8537c645efe282dc1ee9a620b555ac6bbd8919eaf8747c1be84df7c99007a48a"
+      "sha256": "869af14d8b121b4738dc05522c0c659b363b08f2e55b595e096063958562917c"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "8554475255239e0e2a5c84f1287c09e93d54c4dab513248c13f243f5d21fda1d"
+      "sha256": "66be8c0256cbc1e0dceedbe68b609b76b47caacbae1d709fb94afc7867a20753"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -332,17 +332,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "34b88b9a4038b95a62f4528a83aa5bfe25f504ab545417c8edeea2a2afbfef69"
+      "sha256": "6fd5c25f0950eac9e1bdb0d8798dccc5718ef1d3cc1082607121b2d26ac97b90"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "a30cb8c16c64fd7b3eba677268411c31b0c98df4a207d5a60745bca5235d8c15"
+      "sha256": "fb18d3d0dfa564c7fdaa7cc1d0e18c16d835665e37fb00a7ce0bb56e73c2fe1d"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "29badc2ef299498e66224b7ee031be479d10cfcacd8a752c3e06eb05f1d1e64e"
+      "sha256": "1a549fe8b3fb3f3377ae771c8d5b185d6db052063d655aa428e6457676e616f9"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -2392,12 +2392,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "fbad9b37dd44c344ef532638550d666cf94de9813c0df8d4f2e004e0b7f62582"
+      "sha256": "1fdb6d8a5788e30d6277c2b4ad8226688b06202892ddb22685987b1bd795609a"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "10545c86dc834e1c0654ff6da45caecded2e547a00818b221e16c9e60c16b8b5"
+      "sha256": "2939822457141134ad9b645095278bfd5026b35b42e49d1bd80791031022922c"
     },
     {
       "path": "docs/architecture.md",
@@ -2422,12 +2422,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "fe7ddc06964ea4f6bf4515778376b3e02f19fff1047d2b3869cb25e8e03667f3"
+      "sha256": "698489ed0ecdf125ef705bbcb953830453c22ae8632edb437d8f3ddd685d3561"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "3bee89d2827b7e92f805aad5d6d296319c82700a4470024122797debb765c99a"
+      "sha256": "aea042d0a416623e897295c7b959d0eeed8c4d2759d859e35e4715d5c18eb936"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2937,12 +2937,12 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "3907ee1e7036c99afa1790df344933c6652b4d9ffe972715551ad9bdb2bb12d9"
+      "sha256": "0ca024400f00e16a1e03ffca04d90242e414de5f70e10c7466cd0eee842deebc"
     },
     {
       "path": "docs/modules-contract.md",
       "mode": "0000644",
-      "sha256": "ed7ab0d4799a935bb296457ebdba667c38dcfea5ebaec72e61968cd3ad91a6eb"
+      "sha256": "4b622fadde0eb87d5b9b9b5117d2f895f443e036e164d208383e83ed0c17dab7"
     },
     {
       "path": "docs/onboarding/diagrams/01-task-lifecycle.mmd",
@@ -3027,7 +3027,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "a7675f3e800076b5122d404884bb217f95120082d3720748b94422d8ece8d6d7"
+      "sha256": "3fa8c79139ee97fb0bc2b7ab3ce5d194984797f294ba9cedb78e322e95d6fa8d"
     },
     {
       "path": "docs/project-context.template.md",
@@ -4194,6 +4194,11 @@
       "mode": "0000644",
       "sha256": "b795f6a5596ebd12a0fbcf8d98f40b24e12fb819ec5abe5d42ca592147db32bc"
     },
+    {
+      "path": "migrations/core_281_module_version_withdraw_note.sql",
+      "mode": "0000644",
+      "sha256": "ff4a3f2e7ba50bc891cfcfa146325f28731086ce4aeab4b1011dc0412f002c68"
+    },
     {
       "path": "modules/agents/CLAUDE.md",
       "mode": "0000644",
@@ -5092,7 +5097,7 @@
     {
       "path": "modules/government/catalog.js",
       "mode": "0000644",
-      "sha256": "9a3d3fee34144d44b5af811fc8e81e7bec74559eae538cf1e6015a2d54321df3"
+      "sha256": "fb54482dcb0771a3eb378fa27afb250c9f8f1f659862af05615c90d95b50d6d7"
     },
     {
       "path": "modules/government/charter.js",
@@ -6267,7 +6272,7 @@
     {
       "path": "modules/hall-ui/public/modules.js",
       "mode": "0000644",
-      "sha256": "6ca8722bbf65ad5aa275f8d26b6df5bff5ff25a5916df54139a365bf5b596d14"
+      "sha256": "33841de9baea493a540f1b8361d8cb08c71ce599cb8da963930fc3d1d7ba5c13"
     },
     {
       "path": "modules/hall-ui/public/modules.states.json",
@@ -10832,12 +10837,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "793a3d85e023eafb3f0eb63e7a1c1b10f07a66e331adfb63d06a05921ad2f451"
+      "sha256": "bdab863c7dbf290520a865fb25ca6bbb853a2b6581dc4e5f864188e5489abc0a"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "db95c78d828b9fd2117b5a7b4e12d741fb21856022a6830b6cd286017a065f6f"
+      "sha256": "aad2cfe7215eeae48f25d3e5ff2b2ff75521951b796eefe1c0559e826df1e9d9"
     },
     {
       "path": "public-docs/index.html",
@@ -10857,7 +10862,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "a491785c22b68e414bdf9668ca809f671a8927d06560aabfbc04ce3d56dfc131"
+      "sha256": "39dc035c346baea1e6712cf27eb0697dd387ec1644655740a0367b423ea7325f"
     },
     {
       "path": "scripts/bongos/CLAUDE.md",
@@ -11747,7 +11752,7 @@
     {
       "path": "scripts/bongos/module.js",
       "mode": "0000644",
-      "sha256": "6fc19f18daa947837ee09d9d06010380144022ee6f637f3fd444f56cf558bfab"
+      "sha256": "cd383da37a1210e8581b04e9feda566c3958945a488b7187ba151fcc08566e97"
     },
     {
       "path": "scripts/bongos/move-escalation.js",
@@ -14452,7 +14457,7 @@
     {
       "path": "src/bongos/module-store.js",
       "mode": "0000644",
-      "sha256": "1f7fc7251a2b77c80da33b471fcb5ff180bbbd969407a0c636e9085b654dc525"
+      "sha256": "a0a1eee5faf70e37a2ea9a5a20c1f12964bf6c1b08f4213925a3f66254cd7985"
     },
     {
       "path": "src/bongos/module-subcategories.js",
@@ -14537,7 +14542,7 @@
     {
       "path": "src/bongos/route-rank-check.js",
       "mode": "0000644",
-      "sha256": "249ff48a954c7e904d705e636766b92924203dae3a6c08f688cbc68d0734dcb4"
+      "sha256": "05ea4b0fd219d2e03969a26c100556b18567c9b331c8c0fb69befacd46714e0d"
     },
     {
       "path": "src/bongos/routes.js",
@@ -14622,7 +14627,7 @@
     {
       "path": "src/bongos/routes/modules.js",
       "mode": "0000644",
-      "sha256": "4a210c0d6fe7e5f29612c4b7616ed34c1805f69c7618062ebcc50d0586a320dc"
+      "sha256": "32d325edb4dc0720d608051974045d5cec8fe70e82856c7f77797315ba3b1e09"
     },
     {
       "path": "src/bongos/routes/my-passkeys.js",
@@ -14712,7 +14717,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "e9850d0157caab4215194a5e69e04420b0d9e3b97a8d1867f8f84e9087b88930"
+      "sha256": "67513cbbff215d18612fd9c8102f4163311c21b526daa4627343e269b5e9c111"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -17252,7 +17257,7 @@
     {
       "path": "tests/hall_catalog_world.mjs",
       "mode": "0000644",
-      "sha256": "843039f4e14492045c94c9ce803d22208d0e68d607330da6391e56d75d4c8186"
+      "sha256": "201c7755757f250932472bec09cb36a1c036ac5762fe9f91db7554d8c4268df1"
     },
     {
       "path": "tests/hall_city.mjs",
@@ -18534,6 +18539,11 @@
       "mode": "0000644",
       "sha256": "ad29d45c767e14f0dcef7ccd44107545fa3ab54182ad8b0cf7b51bf00243eac5"
     },
+    {
+      "path": "tests/module_store_withdraw.mjs",
+      "mode": "0000644",
+      "sha256": "a1fdcee205b8b8686d915d34ccd0a26debdb5673d957eade23e56bf7686ae638"
+    },
     {
       "path": "tests/module_submissions.mjs",
       "mode": "0000644",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 582 operations across 76 resource groups
+- 583 operations across 76 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -1267,6 +1267,8 @@ function createClient(opts = {}) {
       postStoreModulesKeyVersionsVersionRelease: (args) => request("POST", "/store/modules/{key}/versions/{version}/release", { hasBody: true }, args),
       // GET /store/modules/{key}/versions/{version}/tarball — rank: any-builder — GET /store/modules/:key/versions/:version/tarball
       getStoreModulesKeyVersionsVersionTarball: (args) => request("GET", "/store/modules/{key}/versions/{version}/tarball", { hasBody: false }, args),
+      // POST /store/modules/{key}/versions/{version}/withdraw — rank: metic+archon — POST /store/modules/:key/versions/:version/withdraw
+      postStoreModulesKeyVersionsVersionWithdraw: (args) => request("POST", "/store/modules/{key}/versions/{version}/withdraw", { hasBody: true }, args),
       // GET /store/modules/latest — rank: any-builder — GET /store/modules/latest
       getStoreModulesLatest: (args) => request("GET", "/store/modules/latest", { hasBody: false }, args),
       // GET /store/subcategories — rank: any-builder — GET /store/subcategories

package/clients/bongos-client/index.cjs

@@ -1266,6 +1266,8 @@ function createClient(opts = {}) {
       postStoreModulesKeyVersionsVersionRelease: (args) => request("POST", "/store/modules/{key}/versions/{version}/release", { hasBody: true }, args),
       // GET /store/modules/{key}/versions/{version}/tarball — rank: any-builder — GET /store/modules/:key/versions/:version/tarball
       getStoreModulesKeyVersionsVersionTarball: (args) => request("GET", "/store/modules/{key}/versions/{version}/tarball", { hasBody: false }, args),
+      // POST /store/modules/{key}/versions/{version}/withdraw — rank: metic+archon — POST /store/modules/:key/versions/:version/withdraw
+      postStoreModulesKeyVersionsVersionWithdraw: (args) => request("POST", "/store/modules/{key}/versions/{version}/withdraw", { hasBody: true }, args),
       // GET /store/modules/latest — rank: any-builder — GET /store/modules/latest
       getStoreModulesLatest: (args) => request("GET", "/store/modules/latest", { hasBody: false }, args),
       // GET /store/subcategories — rank: any-builder — GET /store/subcategories

package/clients/bongos-client/index.d.ts

@@ -184,7 +184,7 @@ export interface GetSpecialitiesResponse { specialities: unknown }
 export interface GetSsoPubkeyResponse { alg: unknown; format: unknown; public_key_b64: unknown }
 export interface GetStoreEntitlementsResponse { entitlements: unknown }
 export interface GetStoreModulesKeyVersionsVersionHowtoResponse { module_key: unknown; title: unknown; version: unknown; published_at: unknown; delisted: unknown; markdown: unknown; artifact_url: unknown }
-export interface GetStoreModulesLatestResponse { latest: unknown }
+export interface GetStoreModulesLatestResponse { latest: unknown; withdrawn: unknown }
 export interface GetStoreUsageReportingResponse { enabled: unknown }
 export interface GetTaskRecommendationsForMeResponse { recommendations: unknown; count: unknown }
 export interface GetTaskRecommendationsMineResponse { recommendations: unknown; count: unknown }
@@ -569,6 +569,8 @@ export interface PostStoreModulesKeyVersionsVersionReassessRequest { reason?: st
 export interface PostStoreModulesKeyVersionsVersionReassessResponse { ok: boolean; queued: boolean; module_key: unknown; version: unknown; version_id: unknown }
 export interface PostStoreModulesKeyVersionsVersionReleaseRequest { reason?: string }
 export interface PostStoreModulesKeyVersionsVersionReleaseResponse { ok: boolean; module_key: unknown; version: unknown; channel: unknown; reason: unknown }
+export interface PostStoreModulesKeyVersionsVersionWithdrawRequest { reason?: string }
+export interface PostStoreModulesKeyVersionsVersionWithdrawResponse { ok: boolean; module_key: unknown; version: unknown; channel: unknown; reason: unknown }
 export interface PostStoreSubcategoriesIdApproveRequest { label?: string; sub_key?: string }
 export interface PostStoreSubcategoriesIdMergeRequest { into?: unknown }
 export interface PostStoreUsageReportingRequest { enabled: boolean }
@@ -1824,6 +1826,8 @@ export interface BongosClient {
     postStoreModulesKeyVersionsVersionRelease(args?: RequestArgs & { body?: PostStoreModulesKeyVersionsVersionReleaseRequest }): Promise<PostStoreModulesKeyVersionsVersionReleaseResponse>;
     /** GET /store/modules/{key}/versions/{version}/tarball — rank: any-builder */
     getStoreModulesKeyVersionsVersionTarball(args?: RequestArgs): Promise<ApiResponse>;
+    /** POST /store/modules/{key}/versions/{version}/withdraw — rank: metic+archon */
+    postStoreModulesKeyVersionsVersionWithdraw(args?: RequestArgs & { body?: PostStoreModulesKeyVersionsVersionWithdrawRequest }): Promise<PostStoreModulesKeyVersionsVersionWithdrawResponse>;
     /** GET /store/modules/latest — rank: any-builder */
     getStoreModulesLatest(args?: RequestArgs): Promise<GetStoreModulesLatestResponse>;
     /** GET /store/subcategories — rank: any-builder */

package/clients/bongos-client/index.mjs

@@ -1263,6 +1263,8 @@ export function createClient(opts = {}) {
       postStoreModulesKeyVersionsVersionRelease: (args) => request("POST", "/store/modules/{key}/versions/{version}/release", { hasBody: true }, args),
       // GET /store/modules/{key}/versions/{version}/tarball — rank: any-builder — GET /store/modules/:key/versions/:version/tarball
       getStoreModulesKeyVersionsVersionTarball: (args) => request("GET", "/store/modules/{key}/versions/{version}/tarball", { hasBody: false }, args),
+      // POST /store/modules/{key}/versions/{version}/withdraw — rank: metic+archon — POST /store/modules/:key/versions/:version/withdraw
+      postStoreModulesKeyVersionsVersionWithdraw: (args) => request("POST", "/store/modules/{key}/versions/{version}/withdraw", { hasBody: true }, args),
       // GET /store/modules/latest — rank: any-builder — GET /store/modules/latest
       getStoreModulesLatest: (args) => request("GET", "/store/modules/latest", { hasBody: false }, args),
       // GET /store/subcategories — rank: any-builder — GET /store/subcategories

package/docs/api/openapi.json

@@ -24344,6 +24344,81 @@
         ]
       }
     },
+    "/store/modules/{key}/versions/{version}/withdraw": {
+      "post": {
+        "operationId": "post_store_modules_key_versions_version_withdraw",
+        "tags": [
+          "store"
+        ],
+        "summary": "POST /store/modules/:key/versions/:version/withdraw",
+        "description": "POST /api/bongos/store/modules/:key/versions/:version/withdraw — a Metic+ person takes one version back (task 1004895, criterion wa5-staged-rollout). The store stops handing it out: acquire, install, update and the update check skip it, and the newest version still served is offered instead. A project that already runs it keeps it, and `bongos upgrade` and the hall's Modules tab tell it the version was withdrawn, with the reason. Withdrawing the only served version is allowed; acquire then says nothing can be handed out. A reason is required: it is kept on the channel row (core_281) and shown to holders, and the audit middleware also records it with who asked. The permission is module.delist, the one that already guards delist and release.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `module.delist` (all required).",
+        "x-rank": "metic+archon",
+        "x-source": "src/bongos/routes/modules.js",
+        "x-permissions": [
+          "module.delist"
+        ],
+        "parameters": [
+          {
+            "name": "key",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `key`."
+          },
+          {
+            "name": "version",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `version`."
+          }
+        ],
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostStoreModulesKeyVersionsVersionWithdrawRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostStoreModulesKeyVersionsVersionWithdrawResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/store/subcategories": {
       "get": {
         "operationId": "get_store_subcategories",
@@ -29679,10 +29754,12 @@
       "GetStoreModulesLatestResponse": {
         "type": "object",
         "properties": {
-          "latest": {}
+          "latest": {},
+          "withdrawn": {}
         },
         "required": [
-          "latest"
+          "latest",
+          "withdrawn"
         ]
       },
       "GetStoreUsageReportingResponse": {
@@ -36090,6 +36167,35 @@
           "reason"
         ]
       },
+      "PostStoreModulesKeyVersionsVersionWithdrawRequest": {
+        "type": "object",
+        "properties": {
+          "reason": {
+            "type": "string",
+            "maxLength": 2000
+          }
+        },
+        "additionalProperties": false
+      },
+      "PostStoreModulesKeyVersionsVersionWithdrawResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "module_key": {},
+          "version": {},
+          "channel": {},
+          "reason": {}
+        },
+        "required": [
+          "ok",
+          "module_key",
+          "version",
+          "channel",
+          "reason"
+        ]
+      },
       "PostStoreSubcategoriesIdApproveRequest": {
         "type": "object",
         "properties": {
@@ -37186,9 +37292,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 582,
-  "x-schema-count": 624,
+  "x-endpoint-count": 583,
+  "x-schema-count": 626,
   "x-undocumented-bodies": 12,
-  "x-response-schemas": 404,
+  "x-response-schemas": 405,
   "x-generated-by": "scripts/bongos/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 582 endpoints across 98 route files.
+> **Generated from the live route files** — the route file is authoritative. 583 endpoints across 98 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -863,7 +863,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/sso/pubkey` | `public` | — | GET /sso/pubkey — the hub's Ed25519 assertion-verification key (public). |
 | POST | `/api/bongos/sso/token` | `public` | `client_id`, `client_secret`, `code`, `redirect_uri` | POST /sso/token — server-to-server code redemption. |
 
-## `store` (22)
+## `store` (23)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -882,6 +882,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/store/modules/:key/versions/:version/reassess` | `metic+archon` | `reason` | POST /api/bongos/store/modules/:key/versions/:version/reassess — a Metic+ person asks for a published version's assessment to run again: … |
 | POST | `/api/bongos/store/modules/:key/versions/:version/release` | `metic+archon` | `reason` | POST /api/bongos/store/modules/:key/versions/:version/release — a Metic+ person releases a version the promotion gate HELD on tester (a t… |
 | GET | `/api/bongos/store/modules/:key/versions/:version/tarball` | `any-builder` | — |  |
+| POST | `/api/bongos/store/modules/:key/versions/:version/withdraw` | `metic+archon` | `reason` | POST /api/bongos/store/modules/:key/versions/:version/withdraw — a Metic+ person takes one version back (task 1004895, criterion wa5-stag… |
 | GET | `/api/bongos/store/modules/latest` | `any-builder` | — | The newest published version of each named module — what `bongos upgrade` compares an instance's installed store modules against to repor… |
 | GET | `/api/bongos/store/subcategories` | `any-builder` | — | GET /api/bongos/store/subcategories — the approved sub-categories under each of the eight parents (task 1004355, ADR 0342 D3): what an au… |
 | POST | `/api/bongos/store/subcategories/:id/approve` | `metic+archon` | `label`, `sub_key` | POST /api/bongos/store/subcategories/:id/approve { label?, sub_key? } — make a proposal live, optionally renamed first. |