@bongos/core 1.23.4 → 1.23.6

package/docs/copy-registry.json

@@ -3,9 +3,9 @@
   "generator": "scripts/bongos/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 2735,
-    "unique_ids": 2323,
-    "certain": 2735,
+    "strings": 2737,
+    "unique_ids": 2325,
+    "certain": 2737,
     "heuristic": 0,
     "duplicate_ids": 239
   },
@@ -13,7 +13,7 @@
     "builders-hall": {
       "at": "modules/hall-ui/public",
       "files": 153,
-      "strings": 1916
+      "strings": 1918
     },
     "status-dashboard": {
       "at": "modules/status-ui/public",
@@ -5128,7 +5128,7 @@
       "surface": "builders-hall",
       "text": "Could not load modules.",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 593,
+      "line": 602,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -5317,7 +5317,7 @@
       "surface": "builders-hall",
       "text": "Could not reach the submit endpoint.",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 570,
+      "line": 579,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -9187,7 +9187,7 @@
       "surface": "builders-hall",
       "text": "No real-world data yet, so it is listed but not ranked.",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 334,
+      "line": 343,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9835,7 +9835,7 @@
       "surface": "builders-hall",
       "text": "Nothing to submit — every module here ships with the core.",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 531,
+      "line": 540,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -12985,7 +12985,7 @@
       "surface": "builders-hall",
       "text": "Taken out of the store. Your copy keeps working, but it will get no more updates.",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 125,
+      "line": 134,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -14470,7 +14470,7 @@
       "surface": "builders-hall",
       "text": "This project tests new versions first",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 211,
+      "line": 220,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -16711,7 +16711,7 @@
       "surface": "builders-hall",
       "text": "delisted · no more updates",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 125,
+      "line": 134,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -17161,7 +17161,7 @@
       "surface": "builders-hall",
       "text": "kept on general: {…}",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 207,
+      "line": 216,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -17413,7 +17413,7 @@
       "surface": "builders-hall",
       "text": "not measured yet",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 351,
+      "line": 360,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -17449,7 +17449,7 @@
       "surface": "builders-hall",
       "text": "not testing",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 206,
+      "line": 215,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -17809,7 +17809,7 @@
       "surface": "builders-hall",
       "text": "restart it",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 141,
+      "line": 150,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -18016,7 +18016,7 @@
       "surface": "builders-hall",
       "text": "strong at {…}",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 340,
+      "line": 349,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -18025,7 +18025,7 @@
       "surface": "builders-hall",
       "text": "submit for review",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 286,
+      "line": 295,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -18601,7 +18601,7 @@
       "surface": "builders-hall",
       "text": "waits for a restart",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 139,
+      "line": 148,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -18619,7 +18619,7 @@
       "surface": "builders-hall",
       "text": "weak at {…}",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 342,
+      "line": 351,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -18767,6 +18767,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "caa8962d20c8",
+      "surface": "builders-hall",
+      "text": "withdrawn · update when a fix is out",
+      "file": "modules/hall-ui/public/modules.js",
+      "line": 127,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "80707a00b301",
       "surface": "builders-hall",
@@ -18893,6 +18902,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "8ebfbca38e77",
+      "surface": "builders-hall",
+      "text": "{…} Your copy keeps working; update when a newer version is out.",
+      "file": "modules/hall-ui/public/modules.js",
+      "line": 127,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "c5623d60015d",
       "surface": "builders-hall",
@@ -18916,7 +18934,7 @@
       "surface": "builders-hall",
       "text": "{…} and above can enable or disable a module",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 284,
+      "line": 293,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -18925,7 +18943,7 @@
       "surface": "builders-hall",
       "text": "{…} and above can switch this",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 210,
+      "line": 219,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -19024,7 +19042,7 @@
       "surface": "builders-hall",
       "text": "{…} not measured yet",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 325,
+      "line": 334,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -19231,7 +19249,7 @@
       "surface": "builders-hall",
       "text": "{…} {…} — how-to",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 646,
+      "line": 655,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -19294,7 +19312,7 @@
       "surface": "builders-hall",
       "text": "{…} — how to use it",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 648,
+      "line": 657,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -19420,7 +19438,7 @@
       "surface": "builders-hall",
       "text": "· version",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 651,
+      "line": 660,
       "origin": "js-markup",
       "confidence": "certain"
     },

package/docs/module-api-changelog.md

@@ -3225,5 +3225,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.23.2 with no explicit bump. run 40402796050. (task 1002620)
   1.23.4 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.23.3 with no explicit bump. run 40406624494. (task 1002620)
+  1.23.5 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.23.4 with no explicit bump. run 40417462733. (task 1002620)
+  1.23.6 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.23.5 with no explicit bump. run 40420658396. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/modules-contract.md

@@ -391,6 +391,7 @@ Run `bongos upgrade` to confirm coreVersion compatibility, then `node scripts/bo
 - The version is `module.json`'s `version`. Each version is published **once** and must be newer than the last — bump it to publish a fix.
 - Your first publish of a key makes you its author; only the author can publish later versions, and a delisted key takes none.
 - **Every new version goes to testers first** (task 1003803, [ADR 0344](adr/0344-a-tester-is-a-project-that-opts-in-once.md) D2). A published version, first release or update, is recorded on the `tester` channel (`store_module_version_channels`, reason `new_version`), and the publish response says so as `channel`. A publish cannot name a channel, so there is no flag that sends an untested version to every project. Moving it to `general` is a separate, later step: the promotion gate (task 1003804).
+- **Taking a version back** (task 1004895). Once a version is on `general` the tester stage is behind it, so a Metic+ person can withdraw it: `POST /store/modules/:key/versions/:version/withdraw { reason }` (the `module.delist` permission, the same one that guards delist and release). It writes one `withdrawn` channel row (reason `withdrawn_by_person`, `set_by` the person; the reason text is kept by the audit log), and from then on acquire, install, update and the update check hand out the newest version still served instead; an exact request for the withdrawn one is refused by name. The reason is kept on that row (`note`, core_281). Nothing a project already holds is touched: it keeps running the version, and both `bongos upgrade` and the hall's Modules tab tell it the version was withdrawn, with the reason (`GET /store/modules/latest` returns a `withdrawn` map of `{ version, note }` beside `latest`, and each `GET /modules` row carries `store_withdrawn`). Because update only moves forward, the way off is a newer version: until the author publishes one, the upgrade report says so rather than offering the older release. Withdrawing the only served version is allowed and leaves nothing to hand out. A second withdraw of the same version is refused (`already_withdrawn`). There is no un-withdraw route.
 - **When a tester version reaches everyone** (task 1003804, [ADR 0344](adr/0344-a-tester-is-a-project-that-opts-in-once.md) D3; owner, 2026-10-23). A version on `tester` moves to `general` after **7 days**, or **from day 2** once **5 or more** testers report a clean install, as long as its Security gate has passed and its own tests pass (every test file, or no tests declared; ADR 0343). Any failed tester install or runtime error **holds** it on `tester` (reason `held_tester_errors`); a held version does not move at day 7, and only a Metic+ person releases it, with `POST /store/modules/:key/versions/:version/release { reason }` (the `module.delist` permission). A version is only ever held on evidence, so one nobody tests still moves at day 7. Each move is a new channel row: reason `promoted_after_7_days`, `promoted_early_clean_installs` or `released_by_person`, and `set_by` empty when the system moved it. An hourly sweep in the server applies the rule (`MODULE_PROMOTION_DISABLED=1` switches it off). `GET /store/modules/:key/versions/:version/channel` shows any signed-in builder a version's channel, who moved it and why, the rule in plain words and, on `tester`, the counts it is waiting on and the day it goes to everyone. The rule is `decidePromotion` in `src/bongos/module-promotion.js`.
 - The publish denylist applies (ADR 0098), plus a refusal of credential-named files (`.env*`, `*.pem`, `*.key`, `id_rsa`, …) anywhere in the module. The store re-checks every hash and the denylist itself.
 - Gate: Metic+ (`module.submit`) for now. This is not `bongos module submit`, which proposes a module *into* core.
@@ -399,6 +400,7 @@ Run `bongos upgrade` to confirm coreVersion compatibility, then `node scripts/bo
 - **Tester feedback** (task 1003806, ADR 0344 D5). While a version is on the tester channel, what tester projects report about it becomes its Tester feedback part: the share of testers whose install worked and who hit no runtime errors, blended with ten neutral testers so a small sample cannot score high — `round(100 × (went well + 5) / (testers + 10))`. Reports from after the version left the tester channel, and the author's own, never count; under 3 testers it is not scored yet. The rule is `assessTesterFeedback` in `scripts/bongos/module-assess-installs.js`.
 - **What a module is strong and weak at** (task 1003799, ADR 0343 D4). Each catalog entry also carries `parts` (the current result of Tests, Clean installs, Reliability, Tester feedback and How-to) and a reading of them: `strengths` (a part scored **80 or more**), `weaknesses` (a part scored **below the floor**) and `unmeasured` (a part with no score yet, which is never counted as weak). Each strength and weakness has a one-sentence `detail` saying what the number rests on. Security is not among them: every listed version has passed it. The reading is `readParts` in `src/bongos/module-listing.js`; the hall's Modules tab shows it in its "In the store" group, so two modules with the same overall score can be told apart.
 - **Sorting by a part** (task 1003800). `GET /store/modules?sort=<part>` orders the listed modules by one part a buyer cares about: `tests`, `install`, `reliability`, `tester_feedback` or `docs` (the response lists them as `sort_parts`, and says which one it applied as `sort`). Modules with a score for that part come first, highest first; a tie goes to the higher overall score, then the module key. A module with no score for that part goes last, so missing data never wins or loses a place on its own. New modules are not sorted: they are never ranked. Any other `sort` value is refused with a 400. Without `sort`, the listed modules are in the ranking below; New stays in key order. The rule is `sortByPart` in `src/bongos/module-listing.js`.
+- **Setting a price** (task 1004894). A module's author sets its price with `bongos module price <key> [--cents N] [--credits N]` (or the same two flags on `bongos module publish`, which sets the price right after the upload), or `POST /store/modules/:key/price { cents?, credits? }` (the `module.submit` permission, the same one that publishes, and only the author passes; a delisted module takes no new price). Each amount is a whole number of 0 or more, or null for "not offered in that currency"; at least one is given, and 0 in either makes the module free. Every change appends a row to the price history (in one transaction, the module row locked) naming who set it and when, so the history is the audit of what each price replaced, and the newest is current: it is what the catalog shows and what acquire charges. A paid price may be set before buying exists (owner, 2026-10-26): the catalog lists the module with its price and `buyable: false`, `bongos module store` prints it as not yet buyable, and acquire keeps refusing it without an entitlement. When buying ships (task 1003788), `BUYING_OPEN` in `src/bongos/module-listing.js` is the one switch to flip. Price is never an input to the score (ADR 0343 D6).
 - **The ranking, and a maximum price** (task 1003808, owner decision 2026-10-23). Without `sort`, listed modules are ranked **quality first**: highest overall score first; between equal scores, free modules first, then the lowest cash price, then the lowest credit price, then the module key. Price never buys a better place, it only orders modules the score could not tell apart (and it is never an input to the score, ADR 0343 D6). The response states the rule as `ranking`, and each entry carries its current `price` (`cents`, `credits`, `free`). A buyer may add `?max_cents=` and/or `?max_credits=` (whole numbers, 0 or more): modules that cost more are left out of both lists, free modules always stay, and a priced module stays when it is offered at or under a cap the buyer set. The applied caps come back as `max_price`. The rules are `rankListed` and `withinMaxPrice` in `src/bongos/module-listing.js`.
 - **The cap: at most ten per sub-category** (task 1003809, [ADR 0342](adr/0342-module-categories-are-eight-parents-with-approved-sub-categories.md) D2). Above the floor, at most **ten** modules are listed in each approved sub-category: the first ten in the ranking above, so a buyer's `sort` or maximum price reorders or narrows those ten but never lets the eleventh in. The cap is never applied to a parent. A module whose sub-category is only proposed is listed under its parent and counts toward no cap, and a New module is not ranked, so it neither takes a slot nor is held by one. The catalog returns the cap as `cap`. The rule is `applyCap` in `src/bongos/module-listing.js`.
 - **Why a module is not listed** (task 1003810). `GET /store/modules/:key/listing` says where one module stands, judging the same newest version the catalog does: `listed` (true or false), a `reason` (`not_assessed`, `security_not_passed`, `no_score`, `below_floor`, `delisted`, `no_version`, `over_cap`, `new` or `at_or_above_floor`), `why` in a sentence and `next_step` saying what would change it. A failed Security gate is told apart from one that has not finished, and names what it found to the module's author only (to anyone else it would point at a weakness not fixed yet); below the floor names the score, the floor and the weakest parts. It carries the same `parts`, `strengths`, `weaknesses` and `unmeasured` as the catalog, plus `security`. Any signed-in builder can read it. Past the cap it is `over_cap`, which names the score, the module's place in its sub-category and the cap, so an author can tell being eleventh apart from being below the floor. Both responses carry the module's `category` (`parent`, `parent_title`, and `sub` and `label` once its sub-category is approved). The rule is `explainPlacement` in `src/bongos/module-listing.js`.

package/docs/page-readings.json

@@ -1644,7 +1644,7 @@
       "surface": "builders",
       "title": "Modules",
       "states_read": ["browse","search-empty","lens","details","out"],
-      "files_hash": "d23744d56d3d6024",
+      "files_hash": "29285c080d99ce0e",
       "reading_hash": "d544f93125c23b24",
       "counts": {"lines":58,"placed":26,"shared":8,"unplaced":24},
       "omitted": {"data":106},
@@ -1653,7 +1653,7 @@
         {"key":"L0001","section":"skip link","text":"Skip to content","placement":"shared","file":"modules/hall-ui/public/shell.js","line":868,"string_id":"87cee78ca134"},
         {"key":"L0002","section":"top bar","text":"Modules","placement":"shared"},
         {"key":"L0003","section":"top bar","text":"Jump to…","placement":"shared","file":"modules/hall-ui/public/shell.js","line":540,"string_id":"eba610d25523"},
-        {"key":"L0004","section":"top bar","text":"⌘K","placement":"shared"},
+        {"key":"L0004","section":"top bar","text":"Ctrl K","placement":"shared"},
         {"key":"L0005","section":"top bar","text":"Building","placement":"shared"},
         {"key":"L0006","section":"top bar","text":"Artistry","placement":"shared"},
         {"key":"L0007","section":"top bar","text":"Ideating","placement":"shared"},
@@ -1665,7 +1665,7 @@
         {"key":"L0013","section":"Module catalog","text":"all","placement":"unplaced"},
         {"key":"L0014","section":"Module catalog","text":"enabled","placement":"unplaced","occurrences":16},
         {"key":"L0015","section":"Module catalog","text":"disabled","placement":"unplaced","occurrences":4},
-        {"key":"L0016","section":"Module catalog","text":"{…} of {…}","placement":"placed","file":"modules/hall-ui/public/sky-panel.js","line":120,"string_id":"73c1372b43d9","state":"search-empty","occurrences":3},
+        {"key":"L0016","section":"Module catalog","text":"{…} of {…}","placement":"placed","file":"modules/hall-ui/public/sky-panel.js","line":120,"string_id":"73c1372b43d9","state":"lens","occurrences":4},
         {"key":"L0017","section":"Module catalog","text":"modules","placement":"unplaced"},
         {"key":"L0018","section":"Module catalog","text":"16 from the {…}","placement":"unplaced"},
         {"key":"L0019","section":"Module catalog","text":"of {…}","placement":"placed","file":"modules/hall-ui/public/roadmap.js","line":311,"string_id":"5e7a2220c6a9"},
@@ -1683,20 +1683,20 @@
         {"key":"L0031","section":"Module catalog","text":"{…}-loaded","placement":"unplaced"},
         {"key":"L0032","section":"Module catalog","text":"sessions","placement":"placed","file":"modules/hall-ui/public/task.js","line":483,"string_id":"732b4c935e36"},
         {"key":"L0033","section":"Module catalog","text":"Built by this project","placement":"placed","file":"modules/hall-ui/public/modules.html","line":67,"string_id":"b51edc826cbe"},
-        {"key":"L0034","section":"Module catalog","text":"submit for review","placement":"placed","file":"modules/hall-ui/public/modules.js","line":286,"string_id":"0215b2cdca8c"},
+        {"key":"L0034","section":"Module catalog","text":"submit for review","placement":"placed","file":"modules/hall-ui/public/modules.js","line":295,"string_id":"0215b2cdca8c"},
         {"key":"L0035","section":"Module catalog","text":"A module built here can be sent for review to join the shared catalog, credited to you and this project.","placement":"placed","file":"modules/hall-ui/public/modules.html","line":71,"string_id":"25442a59064e"},
         {"key":"L0036","section":"Module catalog","text":"Testing new versions","placement":"placed","file":"modules/hall-ui/public/modules.html","line":79,"string_id":"d52c87fba7da"},
-        {"key":"L0037","section":"Module catalog","text":"This project tests new versions first","placement":"placed","file":"modules/hall-ui/public/modules.js","line":211,"string_id":"1116d2cad470"},
+        {"key":"L0037","section":"Module catalog","text":"This project tests new versions first","placement":"placed","file":"modules/hall-ui/public/modules.js","line":220,"string_id":"1116d2cad470"},
         {"key":"L0038","section":"Module catalog","text":"testing","placement":"unplaced"},
-        {"key":"L0039","section":"Module catalog","text":"kept on general: {…}","placement":"placed","file":"modules/hall-ui/public/modules.js","line":207,"string_id":"cf5047ea06d8"},
+        {"key":"L0039","section":"Module catalog","text":"kept on general: {…}","placement":"placed","file":"modules/hall-ui/public/modules.js","line":216,"string_id":"cf5047ea06d8"},
         {"key":"L0040","section":"Module catalog","text":"A testing project gets new module versions first, and what it finds feeds their scores. It is never switched on for you. To keep one module on the versions everyone gets, open its details.","placement":"placed","file":"modules/hall-ui/public/modules.html","line":82,"string_id":"a517246720d9"},
         {"key":"L0041","section":"Module catalog","text":"In the store","placement":"placed","file":"modules/hall-ui/public/modules.html","line":91,"string_id":"ecfebcd52894"},
         {"key":"L0042","section":"Module catalog","text":"Sort by","placement":"placed","file":"modules/hall-ui/public/modules.html","line":95,"string_id":"70383b194ec0"},
         {"key":"L0043","section":"Module catalog","text":"Name","placement":"unplaced"},
         {"key":"L0044","section":"Module catalog","text":"No store module matches that {…}.","placement":"unplaced","state":"search-empty"},
         {"key":"L0045","section":"Module catalog","text":"scores","placement":"unplaced","occurrences":2},
-        {"key":"L0046","section":"Module catalog","text":"strong at {…}","placement":"placed","file":"modules/hall-ui/public/modules.js","line":340,"string_id":"e294c3429c2e","occurrences":3},
-        {"key":"L0047","section":"Module catalog","text":"weak at {…}","placement":"placed","file":"modules/hall-ui/public/modules.js","line":342,"string_id":"20318b6da94e"},
+        {"key":"L0046","section":"Module catalog","text":"strong at {…}","placement":"placed","file":"modules/hall-ui/public/modules.js","line":349,"string_id":"e294c3429c2e","occurrences":3},
+        {"key":"L0047","section":"Module catalog","text":"weak at {…}","placement":"placed","file":"modules/hall-ui/public/modules.js","line":351,"string_id":"20318b6da94e"},
         {"key":"L0048","section":"Module catalog","text":"A part is strong at 80 of 100 or more, and weak below the listing floor. Missing data never counts against a module, and a new module is not ranked.","placement":"placed","file":"modules/hall-ui/public/modules.html","line":98,"string_id":"01857ee8cbe3"},
         {"key":"L0049","section":"footer","text":"Sign out","placement":"shared","file":"modules/hall-ui/public/shell.js","line":516,"string_id":"1883ad7f07fc"},
         {"key":"L0050","section":"Module catalog","text":"Builders hall · this session","placement":"placed","file":"modules/hall-ui/public/craft-mode.js","line":670,"string_id":"fd1903586e8e"},

package/migrations/core_281_module_version_withdraw_note.sql

@@ -0,0 +1,25 @@
+-- core_281_module_version_withdraw_note.sql — the reason a person gave when they took
+-- a module version back (task 1004895, criterion wa5-staged-rollout).
+--
+-- WHAT IT IS. One nullable column on the channel history (core_276). A withdraw
+-- writes a 'withdrawn' row; `note` holds the reason the Metic+ person gave, so a
+-- project still running that version is told WHY ("crashes on start", "security
+-- flaw, update now") in `bongos upgrade` and the hall's Modules tab, not just that
+-- it happened. `reason` stays the machine code it always was (^[a-z][a-z0-9_]*$);
+-- `note` is the person's words. Every other move (publish, promote, release) leaves
+-- it NULL, so no existing row or writer changes.
+--
+-- Additive only (one nullable column), so forward-safe: an older release that does
+-- not know the column keeps reading and writing the table as before.
+-- Idempotent: safe to re-run.
+-- Approved by the owner on 2026-10-26 (in chat: "Yes, show the reason").
+
+BEGIN;
+
+ALTER TABLE store_module_version_channels
+  ADD COLUMN IF NOT EXISTS note text CHECK (note IS NULL OR length(note) BETWEEN 1 AND 2000);
+
+INSERT INTO schema_migrations (version) VALUES ('core_281_module_version_withdraw_note')
+  ON CONFLICT (version) DO NOTHING;
+
+COMMIT;

package/modules/government/catalog.js

@@ -240,7 +240,7 @@ const PERMISSIONS = [
   { key: 'module.subcategory.review', system: false, floor: 'metic', guards: 'GET /store/subcategories/queue, POST /store/subcategories/:id/approve, POST /store/subcategories/:id/merge' },
   // Take a module out of the store (task 1003797, ADR 0338 D2). Stops new installs,
   // versions and downloads; never reaches an instance that already holds it.
-  { key: 'module.delist', system: false, floor: 'metic', guards: 'POST /store/modules/:key/delist, POST /store/modules/:key/versions/:version/release (a version the promotion gate held on tester — task 1003804)' },
+  { key: 'module.delist', system: false, floor: 'metic', guards: 'POST /store/modules/:key/delist, POST /store/modules/:key/versions/:version/release (a version the promotion gate held on tester — task 1003804), POST /store/modules/:key/versions/:version/withdraw (take a version back — task 1004895)' },
   { key: 'security.report.file', system: false, floor: 'metic', guards: 'POST /security/reports, GET /security/adr' },
   { key: 'llm_cache.use', system: false, floor: 'metic', guards: 'POST /llm-cache/{lookup,store}' },
   { key: 'backup.manage', system: false, floor: 'metic', guards: 'GET /backup/status, POST /backup/trigger' },

package/modules/hall-ui/public/modules.js

@@ -118,6 +118,15 @@
     return `<a class="ov-fact mod-howto" href="${escapeHtml(href)}">how-to</a>`;
   }
 
+  // A store module this instance runs at a version the store took back (task
+  // 1004895): it keeps working here, and the reason the person gave is the tooltip.
+  function withdrawnFact(m) {
+    const w = m.store_withdrawn;
+    if (!w || typeof w !== 'object') return '';
+    const why = w.note ? `Taken back from the store: ${w.note}` : 'Taken back from the store.';
+    return `<span class="fact-pill fact-pill--warn" title="${escapeHtml(why)} Your copy keeps working; update when a newer version is out.">withdrawn · update when a fix is out</span>`;
+  }
+
   // A store module this instance holds that the store has since delisted (task
   // 1003797, ADR 0338 D2): it keeps working here, but no more versions will come.
   function delistedFact(m) {
@@ -296,7 +305,7 @@
         <div class="ov-row__main">
           <span class="ov-row__title">${escapeHtml(m.title || m.key)}<span class="ov-mono">${escapeHtml(m.key)}</span></span>
           ${desc ? `<p class="ov-row__sub mod-row__desc">${escapeHtml(desc)}</p>` : ''}
-          <div class="ov-row__facts">${provenancePill(m)}${categoryFact(m)}${attributionFacts(m)}${upkeepFact(m)}${howtoFact(m)}${delistedFact(m)}${restartFact(m)}</div>
+          <div class="ov-row__facts">${provenancePill(m)}${categoryFact(m)}${attributionFacts(m)}${upkeepFact(m)}${howtoFact(m)}${delistedFact(m)}${withdrawnFact(m)}${restartFact(m)}</div>
           ${lines ? `<details class="mod-more"${openKeys.has(m.key) ? ' open' : ''}><summary aria-label="Details for ${escapeHtml(m.title || m.key)}"></summary>${lines}</details>` : ''}
         </div>
         <div class="ov-row__right mod-row__right">${rightHtml(m)}</div>

package/modules/onboarding/routes/access-requests.js

@@ -357,9 +357,12 @@ module.exports = function buildAccessRequestsRouter() {
   // (the device_code is spent), so the CLI can't re-poll the flow — it polls this
   // instead, then restarts sign-in once admitted. Exposes nothing the public POST
   // above doesn't already reveal through its 409s (already_member / already_approved).
-  // status ∈ member | invited | expired | pending | dismissed | none; admitted =
-  // member||invited. `expired` is an invite past its 30 days (task 1002969): the door
-  // is shut, and the CLI stops waiting rather than polling a door that will not open.
+  // status ∈ member | invited | not_admitted; admitted = member||invited (ADR 0217 D4,
+  // task 1003359). `not_admitted` covers pending, declined, a lapsed invite and no
+  // request at all, so a caller who is not the subject cannot learn that someone
+  // applied here or was turned down. It does NOT close the membership oracle —
+  // `admitted` still answers that, and the limiter below is what bounds enumeration.
+  // A lapsed invite answering `not_admitted` rather than `expired` amends ADR 0356 D4.
   // rank: public — a would-be builder is by definition outside the system.
   // Declared BEFORE `GET /access-requests` so the literal `/status` path is matched
   // as its own route (not swallowed as a query on the list route).
@@ -370,9 +373,7 @@ module.exports = function buildAccessRequestsRouter() {
   // per-IP budget: core's GET /auth/web/admission-status (the boolean twin of
   // this answer) mounts the very same instance, so the two cannot be alternated
   // for double the rate. The limiter runs before the queries, so a refused probe
-  // costs no DB work. Whether the ANSWER should also collapse — so a caller who
-  // is not the subject cannot tell pending/dismissed/none apart — is the owner's
-  // call and is filed as a blocker, not decided here.
+  // costs no DB work.
   router.get('/access-requests/status', accountExistenceReadRateLimit, async (req, res) => {
     const login = normalizeLogin(req.query.github_login);
     if (!GITHUB_LOGIN_RE.test(login)) {
@@ -386,7 +387,7 @@ module.exports = function buildAccessRequestsRouter() {
       if (member.rows.length > 0) {
         return res.json({ github_login: login, status: 'member', admitted: true });
       }
-      // Prefer an invite that still admits, else the most recent request.
+      // A live invite sorts first, so the top row admits only if it is one.
       const ar = await pool.query(
         `SELECT status, (status = 'invited' AND ${inviteExpiredSql()}) AS expired
            FROM access_requests
@@ -396,8 +397,8 @@ module.exports = function buildAccessRequestsRouter() {
         [login]
       );
       const top = ar.rows[0];
-      const status = !top ? 'none' : top.expired ? 'expired' : top.status;
-      return res.json({ github_login: login, status, admitted: status === 'invited' });
+      const invited = !!top && top.status === 'invited' && !top.expired;
+      return res.json({ github_login: login, status: invited ? 'invited' : 'not_admitted', admitted: invited });
     } catch (err) {
       console.error('[gds] GET /access-requests/status', err);
       return res.fail('status_failed', { status: 500, message: 'internal error' });

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.23.4",
+  "version": "1.23.6",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.23.4",
+      "version": "1.23.6",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.23.4",
+  "version": "1.23.6",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -10407,5 +10407,21 @@
       "id": "1003811",
       "text": "Builders can now browse the module store from the terminal with bongos module store, and it always shows the same modules in the same order as the hall."
     }
+  ],
+  "1.23.5": [
+    {
+      "id": "1004895",
+      "text": "A broken module version can now be pulled back from the store, so new installs and updates stop getting it while projects that already have it are told."
+    }
+  ],
+  "1.23.6": [
+    {
+      "id": "1004894",
+      "text": "Module authors can now set a price for their module, in money or credits; paid modules show their price and are marked not yet buyable until buying opens."
+    },
+    {
+      "id": "1003359",
+      "text": "People checking whether someone has applied to a project can no longer tell a pending, declined or never-filed request apart, and the sign-in tool no longer promises an approval that may never come."
+    }
   ]
 }

package/scripts/bongos/login.js

@@ -43,17 +43,24 @@ function normalizeInstanceBase(raw) {
   return s;
 }
 
-// Decide what an /access-requests/status poll means for the sign-in loop.
+// Decide what an /access-requests/status poll means for the sign-in loop. The probe
+// answers only admitted or not (ADR 0217 D4), so anything else is a wait — even an
+// older instance's `dismissed`/`expired`, which the loop no longer reads.
 function pollDecision(body) {
   if (!body || typeof body !== 'object') return 'wait';
   if (body.admitted === true) return 'admitted';
   if (body.status === 'member' || body.status === 'invited') return 'admitted';
-  if (body.status === 'dismissed') return 'dismissed';
-  // An invite past its 30 days (task 1002969): the door is shut until they invite again.
-  if (body.status === 'expired') return 'expired';
   return 'wait';
 }
 
+// What the loop says when it stops waiting. It cannot know whether the request is
+// still pending, was declined, or rode a lapsed invite, so it promises nothing.
+function waitTimeoutMessage(base) {
+  return "✖ Stopped waiting after 30 minutes — you haven't been let in yet. If your request was turned down "
+    + "or your invite has run out, waiting longer won't change that. Ask the project's owner, "
+    + `then re-run \`bongos login ${base}\`.`;
+}
+
 // --- I/O helpers -------------------------------------------------------------
 
 async function fetchJson(url, opts = {}) {
@@ -300,16 +307,8 @@ async function main() {
         log('\n  ✓ Approved! Finishing sign-in — approve once more in your browser.');
         break;
       }
-      if (decision === 'dismissed') {
-        console.error('\n✖ your access request was declined.');
-        process.exit(1);
-      }
-      if (decision === 'expired') {
-        console.error('\n✖ your invite has expired — ask the project to invite you again.');
-        process.exit(1);
-      }
       if (Date.now() > admitDeadline) {
-        console.error('\n✖ timed out waiting for approval — re-run `bongos login` once an Archon has approved you.');
+        console.error(`\n${waitTimeoutMessage(base)}`);
         process.exit(1);
       }
       process.stdout.write('.');
@@ -357,4 +356,4 @@ if (require.main === module) {
   });
 }
 
-module.exports = { normalizeInstanceBase, pollDecision, runDeviceFlow, logOtherInstances };
+module.exports = { normalizeInstanceBase, pollDecision, waitTimeoutMessage, runDeviceFlow, logOtherInstances };