@bongos/core 1.23.4 → 1.23.5

package/release-notes.json

@@ -10407,5 +10407,11 @@
       "id": "1003811",
       "text": "Builders can now browse the module store from the terminal with bongos module store, and it always shows the same modules in the same order as the hall."
     }
+  ],
+  "1.23.5": [
+    {
+      "id": "1004895",
+      "text": "A broken module version can now be pulled back from the store, so new installs and updates stop getting it while projects that already have it are told."
+    }
   ]
 }

package/scripts/bongos/module.js

@@ -712,7 +712,7 @@ async function gatherUpdates(rows, { request } = {}) {
   // A 404 here is a server whose core predates this route, not a missing module.
   if (res.status === 404) return { checked: false, reason: "this server's store does not answer update checks yet (its core is older)" };
   if (!res.ok) return { checked: false, reason: `the store answered ${storeError(res)}` };
-  return { checked: true, latest: (res.data && res.data.latest) || {} };
+  return { checked: true, latest: (res.data && res.data.latest) || {}, withdrawn: (res.data && res.data.withdrawn) || {} };
 }
 
 // Decide what is stale from rows + the store's answer (pure — tests drive it).
@@ -722,13 +722,22 @@ async function gatherUpdates(rows, { request } = {}) {
 // installed module the store has delisted: it keeps working, but no further
 // versions will come (ADR 0338 D2). Neither ever blocks — an update is news, and
 // what blocks `bongos upgrade` is still only an incompatible ENABLED module.
-function evaluateUpdates(rows = [], latest = {}, core) {
+function evaluateUpdates(rows = [], latest = {}, core, withdrawnByKey = {}) {
   const { satisfies } = require('../../src/module-loader/semver');
   const updates = [];
   const delisted = [];
+  const withdrawn = [];
   for (const r of rows) {
     const store = latest[r.key];
     const have = r.version && parseVersion(String(r.version));
+    // WITHDRAWN (task 1004895) = the store took back the exact version installed
+    // here. It keeps working; the update below, when there is one, is the way off it.
+    const taken = have && (withdrawnByKey[r.key] || [])
+      .map((w) => (typeof w === 'string' ? { version: w, note: null } : w))
+      .find((w) => w && w.version === String(r.version));
+    if (taken) {
+      withdrawn.push({ key: r.key, installed: r.version, latest: store ? store.version : null, enabled: r.enabled, note: taken.note || null });
+    }
     if (!store || !have) continue;
     if (store.status === 'delisted') { delisted.push({ key: r.key, installed: r.version, enabled: r.enabled }); continue; }
     const next = parseVersion(String(store.version));
@@ -737,7 +746,7 @@ function evaluateUpdates(rows = [], latest = {}, core) {
     try { fits = !!(core && store.core_version && satisfies(core, store.core_version)); } catch { fits = false; }
     updates.push({ key: r.key, installed: r.version, latest: store.version, coreVersion: store.core_version, enabled: r.enabled, fits });
   }
-  return { updates, delisted };
+  return { updates, delisted, withdrawn };
 }
 
 function reportUpdates(found, verdict, { log, errlog }) {
@@ -746,7 +755,7 @@ function reportUpdates(found, verdict, { log, errlog }) {
     log(`  not checked — ${found.reason}. The compatibility check above still stands.`);
     return;
   }
-  const { updates, delisted } = evaluateUpdates(verdict.rows, found.latest, verdict.core);
+  const { updates, delisted, withdrawn } = evaluateUpdates(verdict.rows, found.latest, verdict.core, found.withdrawn);
   for (const u of updates) {
     const how = u.fits
       ? `run \`bongos module update ${u.key}\``
@@ -756,7 +765,17 @@ function reportUpdates(found, verdict, { log, errlog }) {
   for (const d of delisted) {
     errlog(`  ! ${d.key.padEnd(18)} ${d.installed}  — delisted in the store: it keeps working, but no further versions will come`);
   }
-  if (!updates.length && !delisted.length) log('  every installed store module is on its newest version.');
+  for (const w of withdrawn) {
+    // Update only moves forward, so an OLDER served version is no way off it: until a
+    // fixed version is published, say so rather than name a command that refuses.
+    const newer = w.latest && parseVersion(String(w.latest))
+      && cmp(parseVersion(String(w.latest)), parseVersion(String(w.installed))) > 0;
+    const next = newer
+      ? `move to ${w.latest} with \`bongos module update ${w.key}\``
+      : 'no newer version is out yet; `bongos upgrade` will offer the fix once one is published';
+    errlog(`  ! ${w.key.padEnd(18)} ${w.installed}  — withdrawn in the store${w.note ? ` (${w.note})` : ''}: it keeps working here, but ${next}`);
+  }
+  if (!updates.length && !delisted.length && !withdrawn.length) log('  every installed store module is on its newest version.');
 }
 
 async function cmdUpgrade(args = [], { log = console.log, errlog = console.error, gather = gatherUpgrade, checkUpdates = gatherUpdates } = {}) {

package/src/bongos/module-store.js

@@ -383,6 +383,47 @@ async function latestVersions(keys, { db, channelsFor = null } = {}) {
   return out;
 }
 
+// Withdraw one version (task 1004895, criterion wa5-staged-rollout): the store
+// stops handing it out. Staged rollout catches a bad version on the tester channel;
+// this is the way back once one has reached general. It is one channel row,
+// 'withdrawn' (core_276), which servedChannels never serves, so acquire, install,
+// update and the update check all stop offering it with no other change. Like a
+// delist it reaches nothing a project already holds: an installed copy keeps
+// working (ADR 0338 D2), and `bongos upgrade` and the hall tell its holder, with
+// `note` — the reason the person gave, kept on the row (core_281). The insert only
+// lands while the version is not already withdrawn, so two people withdrawing at
+// once write one row. Returns { ok: true, channel } or { ok: false, status, code, message }.
+const WITHDRAWN_CHANNEL = 'withdrawn';
+
+async function withdrawVersion(versionId, builderId, note, { db } = {}) {
+  const pool = db || require('./pool').pool;
+  const { rowCount } = await pool.query(
+    `INSERT INTO store_module_version_channels (version_id, channel, reason, set_by, note)
+     SELECT $1, '${WITHDRAWN_CHANNEL}', 'withdrawn_by_person', $2, $3
+      WHERE (SELECT c.channel FROM store_module_version_channels c
+              WHERE c.version_id = $1 ORDER BY c.set_at DESC, c.id DESC LIMIT 1)
+            IS DISTINCT FROM '${WITHDRAWN_CHANNEL}'`, [versionId, builderId, note]);
+  if (rowCount === 1) return { ok: true, channel: WITHDRAWN_CHANNEL };
+  return { ok: false, status: 409, code: 'already_withdrawn', message: 'This version is already withdrawn: the store does not hand it out.' };
+}
+
+// Which versions of these module keys are withdrawn, as { key: [{ version, note }] }
+// — so the update check and the hall can tell a project that the version it runs
+// was taken back, and why. `note` is the reason from the withdrawing row.
+async function withdrawnVersions(keys, { db } = {}) {
+  if (!keys.length) return {};
+  const pool = db || require('./pool').pool;
+  const { rows } = await pool.query(
+    `SELECT v.module_key, v.version,
+            (SELECT c.note FROM store_module_version_channels c
+              WHERE c.version_id = v.id ORDER BY c.set_at DESC, c.id DESC LIMIT 1) AS note
+       FROM store_module_versions v
+      WHERE v.module_key = ANY($1) AND ${currentChannelSql('v.id')} = '${WITHDRAWN_CHANNEL}'`, [keys]);
+  const out = {};
+  for (const r of rows) (out[r.module_key] = out[r.module_key] || []).push({ version: r.version, note: r.note || null });
+  return out;
+}
+
 // Delist a module (task 1003797, ADR 0338 D2): it leaves the catalog, takes no new
 // acquisitions or versions, and serves no further downloads — every read above
 // already refuses on status 'delisted', so this one UPDATE is the whole act. It
@@ -427,5 +468,5 @@ function versionArtifactFile(row, { dir = storeDir() } = {}) {
 module.exports = {
   stageArtifact, commitArtifact, removeArtifact, relativeArtifactPath, publishVersion,
   isFreePrice, servedChannels, resolveAcquirable, resolveReadable, publishedVersionSet, latestVersions, versionArtifactFile,
-  delistModule, delistedKeySet, storeDir, storeDirFor, migrateLegacyStore,
+  delistModule, delistedKeySet, withdrawVersion, withdrawnVersions, storeDir, storeDirFor, migrateLegacyStore,
 };

package/src/bongos/route-rank-check.js

@@ -253,6 +253,9 @@ const EXPECTED_RANKS = {
   // Releasing a version the promotion gate held on tester (task 1003804) hands it to
   // every project; the owner put it on the delist atom (2026-10-23), so it is pinned.
   'POST /store/modules/:key/versions/:version/release': 'perm:module.delist',
+  // Withdrawing a version (task 1004895) stops it being handed to every project, the
+  // same reach as a delist, so it rides the delist atom and is pinned.
+  'POST /store/modules/:key/versions/:version/withdraw': 'perm:module.delist',
 };
 
 // The authz-core route pins (ADR 0174). Paths and the gating atom were renamed

package/src/bongos/routes/modules.js

@@ -97,7 +97,7 @@ const { checkEntitlement, listEntitlements, grantEntitlement, recordAcquired } =
 const {
   stageArtifact, commitArtifact, removeArtifact, relativeArtifactPath, publishVersion,
   servedChannels, resolveAcquirable, resolveReadable, publishedVersionSet, latestVersions, versionArtifactFile,
-  delistModule, delistedKeySet, migrateLegacyStore,
+  delistModule, delistedKeySet, withdrawVersion, withdrawnVersions, migrateLegacyStore,
 } = require('../module-store');
 const {
   isOptedOut, setReporting, installReportError, errorCountError, recordInstallReport, recordErrorCount,
@@ -272,6 +272,11 @@ module.exports = function buildModulesRouter() {
     let delistedKeys = new Set();
     try { delistedKeys = await delistedKeySet(all.filter((m) => m.source === 'instance').map((m) => m.key)); }
     catch (e) { log.warn({ err: e.message }, 'store status unreadable for the modules list'); }
+    // Which installed store modules run a version the store took back (task 1004895),
+    // so the row says so, with the reason. Same tolerance.
+    let withdrawn = {};
+    try { withdrawn = await withdrawnVersions(all.filter((m) => m.source === 'instance').map((m) => m.key)); }
+    catch (e) { log.warn({ err: e.message }, 'withdrawn versions unreadable for the modules list'); }
     for (const m of all) {
       m.enabled_source = sources[m.key] || 'default';
       m.override = byKey.has(m.key)
@@ -283,6 +288,9 @@ module.exports = function buildModulesRouter() {
         ? `/builders/modules?howto=${encodeURIComponent(m.key)}&version=${encodeURIComponent(String(m.version))}`
         : null;
       m.store_delisted = m.source === 'instance' && delistedKeys.has(m.key);
+      const taken = m.source === 'instance' && m.version
+        ? (withdrawn[m.key] || []).find((w) => w.version === String(m.version)) : null;
+      m.store_withdrawn = taken ? { version: taken.version, note: taken.note } : null;
       // what of this module still waits for a restart to match its toggle (task 1004463)
       m.restart_pending = restartPendingFor(m.key, m.enabled === true);
     }
@@ -637,6 +645,35 @@ module.exports = function buildModulesRouter() {
       res.json({ ok: true, module_key: key, version, channel: out.channel, reason: out.reason });
     }));
 
+  // POST /api/bongos/store/modules/:key/versions/:version/withdraw — a Metic+ person
+  // takes one version back (task 1004895, criterion wa5-staged-rollout). The store
+  // stops handing it out: acquire, install, update and the update check skip it, and
+  // the newest version still served is offered instead. A project that already runs
+  // it keeps it, and `bongos upgrade` and the hall's Modules tab tell it the version
+  // was withdrawn, with the reason. Withdrawing the only served version is allowed;
+  // acquire then says nothing can be handed out. A reason is required: it is kept on
+  // the channel row (core_281) and shown to holders, and the audit middleware also
+  // records it with who asked. The permission is module.delist, the one that already
+  // guards delist and release.
+  router.post('/store/modules/:key/versions/:version/withdraw', auth.requireBuilder, auth.requirePermission('module.delist'),
+    asyncHandler('POST /store/modules/:key/versions/:version/withdraw', async (req, res) => {
+      if (validateOrRespond(req, res, { reason: { type: 'string', maxLength: 2000 } })) return;
+      const { key, version } = req.params;
+      if (!KEY_RE.test(key) || !parseVersion(version)) {
+        return res.fail('bad_request', { status: 400, message: 'A module key is lowercase kebab-case and a version is exact X.Y.Z.' });
+      }
+      const reason = String(req.body?.reason || '').trim();
+      if (!reason) {
+        return res.fail('reason_required', { status: 400, message: 'Say why this version is being taken back, in reason. Projects that already run it keep it.' });
+      }
+      const r = await resolveReadable(key, version);
+      if (!r.ok) return res.fail(r.code, { status: r.status, message: r.message });
+      const out = await withdrawVersion(r.version.id, req.builder.id, reason);
+      if (!out.ok) return res.fail(out.code, { status: out.status, message: out.message });
+      log.info({ versionId: r.version.id, builderId: req.builder.id, reason }, `${key} ${version} withdrawn from the store`);
+      res.json({ ok: true, module_key: key, version, channel: out.channel, reason });
+    }));
+
   // GET /api/bongos/store/entitlements and /store/modules/:key/entitlement — the
   // read side of the entitlement record (task 1003813, ADR 0338 D1). Own-scoped
   // like /me/sessions: the holder is ALWAYS the caller (holder_kind 'builder',
@@ -832,9 +869,14 @@ module.exports = function buildModulesRouter() {
       if (!keys.length || keys.length > STORE_LATEST_MAX_KEYS || !keys.every((k) => KEY_RE.test(k))) {
         return res.fail('bad_request', { status: 400, message: `keys is a comma-separated list of 1 to ${STORE_LATEST_MAX_KEYS} module keys (lowercase kebab-case).` });
       }
-      const latest = await latestVersions(keys, { channelsFor: await projectChannels() });
+      // Which of these keys have versions taken back (task 1004895), so a project
+      // running one is told, with the reason; a key with none is absent.
+      const [latest, withdrawn] = await Promise.all([
+        latestVersions(keys, { channelsFor: await projectChannels() }),
+        withdrawnVersions(keys),
+      ]);
       res.set('Cache-Control', 'no-store');
-      res.json({ latest });
+      res.json({ latest, withdrawn });
     }));
 
   // The store catalog under the quality floor (task 1003807, ADR 0343 D2/D5): each

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.23.4'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.23.5'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/hall_catalog_world.mjs

@@ -58,7 +58,7 @@ test('modules: the row is the oversight row — title with the mono key, clamped
   assert.match(js, /<span class="ov-row__title">\$\{escapeHtml\(m\.title \|\| m\.key\)\}<span class="ov-mono">\$\{escapeHtml\(m\.key\)\}<\/span>/, 'the key rides inside the title in mono');
   assert.match(js, /class="ov-row__sub mod-row__desc"/, 'the description is the sub line');
   assert.match(js, /<details class="mod-more"/, 'a details disclosure opens the rest');
-  assert.match(js, /<div class="ov-row__facts">\$\{provenancePill\(m\)\}\$\{categoryFact\(m\)\}\$\{attributionFacts\(m\)\}\$\{upkeepFact\(m\)\}\$\{howtoFact\(m\)\}\$\{delistedFact\(m\)\}\$\{restartFact\(m\)\}<\/div>/, 'provenance, (task 1003784) the category, credit, upkeep, (for a store version, task 1004366) the how-to link and (task 1003797) the delisted pill and (task 1004463) the waits-for-a-restart pill are the facts line');
+  assert.match(js, /<div class="ov-row__facts">\$\{provenancePill\(m\)\}\$\{categoryFact\(m\)\}\$\{attributionFacts\(m\)\}\$\{upkeepFact\(m\)\}\$\{howtoFact\(m\)\}\$\{delistedFact\(m\)\}\$\{withdrawnFact\(m\)\}\$\{restartFact\(m\)\}<\/div>/, 'provenance, (task 1003784) the category, credit, upkeep, (for a store version, task 1004366) the how-to link and (task 1003797) the delisted pill, (task 1004895) the withdrawn pill and (task 1004463) the waits-for-a-restart pill are the facts line');
   assert.match(js, /<div class="ov-row__right mod-row__right">\$\{rightHtml\(m\)\}<\/div>/, 'the right column is one function');
   const css = read('modules.css');
   assert.match(css, /\.mod-row__desc \{[^}]*-webkit-line-clamp: 2/, 'the description clamps to two lines');

package/tests/module_store_withdraw.mjs

@@ -0,0 +1,201 @@
+// tests/module_store_withdraw.mjs — a Metic+ person can take one version back, and
+// the store stops handing it out while every project that runs it keeps it (task
+// 1004895, criterion wa5-staged-rollout). Drives the real POST
+// /store/modules/:key/versions/:version/withdraw handler and the real update-check
+// route off the real router, the real store reads behind acquire, and the real
+// `bongos upgrade` report, against a stand-in pool that keeps the channel history
+// (no port, no real DB — the module_store_delist.mjs harness).
+//
+// Run:  node tests/module_store_withdraw.mjs
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+const version = (id, v) => ({ id, module_key: 'weather', version: v, core_version: '^1.20.0', tree_sha256: 't', tarball_sha256: 'x', tarball_bytes: 10, artifact_path: `weather/weather-${v}.tgz`, published_at: 't' });
+const fresh = () => ({
+  modules: { weather: { module_key: 'weather', title: 'Weather', author_id: 42, status: 'listed' } },
+  versions: [version(1, '1.0.0'), version(2, '1.1.0')],
+  // The channel HISTORY; the current channel is the newest row per version.
+  channels: [
+    { version_id: 1, channel: 'general', reason: 'predates_staged_rollout', set_by: null },
+    { version_id: 2, channel: 'general', reason: 'promoted_after_7_days', set_by: null },
+  ],
+});
+let state = fresh();
+const current = (versionId) => {
+  const rows = state.channels.filter((c) => c.version_id === Number(versionId));
+  return rows.length ? rows[rows.length - 1].channel : null;
+};
+const query = async (sql, params = []) => {
+  if (/^\s*INSERT INTO store_module_version_channels/.test(sql)) {
+    assert.match(sql, /IS DISTINCT FROM 'withdrawn'/, 'the insert only lands while the version is not already withdrawn');
+    if (current(params[0]) === 'withdrawn') return { rowCount: 0, rows: [] };
+    state.channels.push({ version_id: Number(params[0]), channel: 'withdrawn', reason: 'withdrawn_by_person', set_by: params[1], note: params[2] });
+    return { rowCount: 1, rows: [] };
+  }
+  if (/FROM store_modules WHERE module_key = \$1/.test(sql)) {
+    const m = state.modules[params[0]]; return { rows: m ? [m] : [] };
+  }
+  if (/FROM store_module_versions WHERE module_key = \$1 AND version = \$2/.test(sql)) {
+    return { rows: state.versions.filter((v) => v.module_key === params[0] && v.version === params[1]) };
+  }
+  if (/FROM store_module_versions WHERE module_key = \$1/.test(sql)) {
+    return { rows: state.versions.filter((v) => v.module_key === params[0]).map((v) => ({ ...v, channel: current(v.id) })) };
+  }
+  if (/AS note\s+FROM store_module_versions v/.test(sql)) {
+    const noteOf = (id) => state.channels.filter((c) => c.version_id === id).at(-1).note;
+    return { rows: state.versions.filter((v) => params[0].includes(v.module_key) && current(v.id) === 'withdrawn').map((v) => ({ ...v, note: noteOf(v.id) })) };
+  }
+  if (/JOIN store_modules m/.test(sql)) {
+    return { rows: state.versions.filter((v) => params[0].includes(v.module_key)).map((v) => ({ ...v, status: state.modules[v.module_key].status, channel: current(v.id) })) };
+  }
+  return { rows: [] };
+};
+const pool = { connect: async () => ({ query, release() {} }), query };
+const poolPath = require.resolve('../src/bongos/pool.js');
+require.cache[poolPath] = { id: poolPath, filename: poolPath, loaded: true, exports: { pool } };
+
+const store = require('../src/bongos/module-store.js');
+const buildModulesRouter = require('../src/bongos/routes/modules.js');
+const mod = require('../scripts/bongos/module.js');
+
+function handlerFor(method, p) {
+  const layer = buildModulesRouter().stack.find((l) => l.route && l.route.path === p && l.route.methods[method]);
+  assert.ok(layer, `no ${method.toUpperCase()} ${p} on the router`);
+  const stack = layer.route.stack;
+  return { handle: stack[stack.length - 1].handle, depth: stack.length };
+}
+async function invoke(handle, req) {
+  const res = {
+    statusCode: 200, body: undefined,
+    json(b) { this.body = b; return this; },
+    status(c) { this.statusCode = c; return this; },
+    set() { return this; },
+    fail(code, opts, details) { const o = typeof opts === 'number' ? { status: opts, details } : (opts || {}); this.statusCode = o.status; this.body = { error: code, ...o }; return this; },
+  };
+  let nextErr = null;
+  await handle({ builder: { id: 3 }, query: {}, body: {}, ...req }, res, (err) => { nextErr = err; });
+  if (nextErr) throw nextErr;
+  return res;
+}
+
+const WITHDRAW = '/store/modules/:key/versions/:version/withdraw';
+const withdraw = (version, reason = 'crashes on start') =>
+  invoke(handlerFor('post', WITHDRAW).handle, { params: { key: 'weather', version }, body: { reason } });
+
+test('the route is gated by module.delist, the permission behind delist and release, and pinned', () => {
+  assert.ok(handlerFor('post', WITHDRAW).depth >= 3, 'requireBuilder + requirePermission sit in front of the handler');
+  const rank = fs.readFileSync(path.join(ROOT, 'src/bongos/route-rank-check.js'), 'utf8');
+  assert.match(rank, /'POST \/store\/modules\/:key\/versions\/:version\/withdraw': 'perm:module\.delist'/);
+  const catalog = fs.readFileSync(path.join(ROOT, 'modules/government/catalog.js'), 'utf8');
+  assert.match(catalog, /key: 'module\.delist'[^\n]*\/withdraw/, 'the permission says what it guards');
+});
+
+test('a reason is required, and an unknown version or a bad path is refused', async () => {
+  state = fresh();
+  assert.equal((await withdraw('1.1.0', '  ')).statusCode, 400);
+  assert.equal((await withdraw('9.9.9')).statusCode, 404);
+  const bad = await invoke(handlerFor('post', WITHDRAW).handle, { params: { key: 'Weather', version: '1.1.0' }, body: { reason: 'x' } });
+  assert.equal(bad.statusCode, 400);
+  assert.equal(state.channels.length, 2, 'nothing was written');
+});
+
+test('withdrawing writes one withdrawn row naming who did it; a second time is refused', async () => {
+  state = fresh();
+  const first = await withdraw('1.1.0');
+  assert.equal(first.statusCode, 200);
+  assert.deepEqual(first.body, { ok: true, module_key: 'weather', version: '1.1.0', channel: 'withdrawn', reason: 'crashes on start' });
+  assert.deepEqual(state.channels.at(-1), { version_id: 2, channel: 'withdrawn', reason: 'withdrawn_by_person', set_by: 3, note: 'crashes on start' },
+    'the person\'s reason is kept on the row (core_281), the machine code beside it');
+  const again = await withdraw('1.1.0');
+  assert.equal(again.statusCode, 409);
+  assert.equal(again.body.error, 'already_withdrawn');
+  assert.equal(state.channels.length, 3, 'one row, however many times it is asked');
+});
+
+test('the store stops handing it out: acquire offers the newest version still served, and refuses the withdrawn one by name', async () => {
+  state = fresh();
+  await withdraw('1.1.0');
+  const general = store.servedChannels(false);
+  const newest = await store.resolveAcquirable('weather', { channels: general });
+  assert.equal(newest.ok, true);
+  assert.equal(newest.version.version, '1.0.0', 'the withdrawn 1.1.0 is skipped');
+  const exact = await store.resolveAcquirable('weather', { version: '1.1.0', channels: store.servedChannels(true) });
+  assert.equal(exact.ok, false, 'not even a tester project is handed it');
+  assert.match(exact.message, /1\.1\.0 was withdrawn: it is no longer handed out/);
+});
+
+test('withdrawing the only served version leaves nothing to hand out, and acquire says so', async () => {
+  state = fresh();
+  await withdraw('1.0.0');
+  await withdraw('1.1.0');
+  const r = await store.resolveAcquirable('weather', { channels: store.servedChannels(false) });
+  assert.equal(r.ok, false);
+  assert.equal(r.code, 'no_versions_on_channel');
+  assert.match(r.message, /every version was withdrawn/);
+});
+
+test('the update check names withdrawn versions beside the newest served one', async () => {
+  state = fresh();
+  await withdraw('1.1.0');
+  const res = await invoke(handlerFor('get', '/store/modules/latest').handle, { query: { keys: 'weather' } });
+  assert.equal(res.statusCode, 200);
+  assert.equal(res.body.latest.weather.version, '1.0.0');
+  assert.deepEqual(res.body.withdrawn, { weather: [{ version: '1.1.0', note: 'crashes on start' }] });
+});
+
+test('the hall\'s module list marks an installed module whose version was withdrawn, with the reason', async () => {
+  state = fresh();
+  await withdraw('1.1.0', 'security flaw, update now');
+  const routes = require('../src/bongos/routes/modules.js');
+  const realList = routes.listModules;
+  const src = fs.readFileSync(path.join(ROOT, 'src/bongos/routes/modules.js'), 'utf8');
+  assert.match(src, /m\.store_withdrawn = taken \? \{ version: taken\.version, note: taken\.note \} : null;/, 'the row carries version and note');
+  assert.equal(typeof realList, 'function');
+  const hall = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/modules.js'), 'utf8');
+  const fn = hall.match(/function withdrawnFact\(m\) \{[\s\S]*?\n  \}/)[0];
+  const withdrawnFact = new Function('escapeHtml', `${fn}; return withdrawnFact;`)((t) => String(t).replace(/[&<>"]/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' }[c])));
+  assert.equal(withdrawnFact({ store_withdrawn: null }), '', 'nothing to say when the version was not taken back');
+  const pill = withdrawnFact({ store_withdrawn: { version: '1.1.0', note: 'security flaw, "update" <now>' } });
+  assert.match(pill, /withdrawn · update when a fix is out/);
+  assert.match(pill, /Taken back from the store: security flaw, &quot;update&quot; &lt;now&gt;/, 'the reason is shown, escaped');
+  assert.match(hall, /\$\{delistedFact\(m\)\}\$\{withdrawnFact\(m\)\}/, 'and it is rendered on the row');
+});
+
+const row = (key, version) => ({ key, version, enabled: true, coreVersion: '^1.0.0', satisfied: true });
+function sink() { const s = { out: [], err: [] }; s.log = (l) => s.out.push(l); s.errlog = (l) => s.err.push(l); return s; }
+
+test('bongos upgrade tells a project its version was withdrawn, and names the way off only when one exists', async () => {
+  const run = async (installed, latest, withdrawn) => {
+    const s = sink();
+    const code = await mod.cmdUpgrade([], {
+      ...s,
+      gather: () => ({ core: '1.21.0', errors: [], rows: [row('weather', installed)] }),
+      checkUpdates: async () => ({ checked: true, latest: { weather: { version: latest, core_version: '^1.0.0', status: 'listed' } }, withdrawn }),
+    });
+    return { code, err: s.err.join('\n'), out: s.out.join('\n') };
+  };
+  const fixed = await run('1.1.0', '1.2.0', { weather: [{ version: '1.1.0', note: 'crashes on start' }] });
+  assert.equal(fixed.code, 0, 'a withdrawal is news, never a refusal');
+  assert.match(fixed.err, /weather\s+1\.1\.0\s+— withdrawn in the store \(crashes on start\): it keeps working here, but move to 1\.2\.0 with `bongos module update weather`/);
+  const stuck = await run('1.1.0', '1.0.0', { weather: ['1.1.0'] }); // an older server's plain list still works
+  assert.match(stuck.err, /withdrawn in the store: it keeps working here, but no newer version is out yet/, 'update only moves forward, so the older 1.0.0 is not offered');
+  assert.doesNotMatch(stuck.out, /every installed store module is on its newest version/);
+  const other = await run('1.0.0', '1.0.0', { weather: ['1.1.0'] });
+  assert.doesNotMatch(other.err, /withdrawn/, 'a project on a version that was NOT withdrawn hears nothing');
+  const older = await run('1.0.0', '1.0.0', undefined);
+  assert.equal(older.code, 0, 'a server that predates withdraw answers no withdrawn map, and that is fine');
+});
+
+test('evaluateUpdates: a withdrawn install is reported, whether or not an update exists', () => {
+  const { withdrawn, updates } = mod.evaluateUpdates([row('weather', '1.1.0')], { weather: { version: '1.2.0', core_version: '^1.0.0', status: 'listed' } }, '1.21.0', { weather: [{ version: '1.1.0', note: 'crashes' }] });
+  assert.deepEqual(withdrawn, [{ key: 'weather', installed: '1.1.0', latest: '1.2.0', enabled: true, note: 'crashes' }]);
+  assert.equal(updates.length, 1, 'the update is still listed: it is the way off');
+});