diff --git a/console/app/components/ExportTargetForm.vue b/console/app/components/ExportTargetForm.vue
index 8d87145..59cc070 100644
--- a/console/app/components/ExportTargetForm.vue
+++ b/console/app/components/ExportTargetForm.vue
@@ -10,10 +10,21 @@
  *
  * **It shows what this format needs, never the union of every field.**
  * Outline wants a collection and offers the picker Bot Settings already
- * has for `document_target`; the two object-store formats want a key
- * prefix, which has no directory to browse and is therefore typed. Which
- * of the two a format wants is `~/utils/exportTargets`' answer, so adding
- * a format is adding an entry there rather than a branch here.
+ * has for `document_target`; the object-store formats want a key prefix,
+ * which has no directory to browse and is therefore typed. Which of the
+ * two a format wants follows from the *sink family* the deployment
+ * reports for it, so a format built tomorrow gets the right field with
+ * nothing added here and nothing added in `~/utils/exportTargets` either.
+ *
+ * **Which formats exist is the deployment's answer, and it arrives as a
+ * prop.** `formats` is `GET /api/export-formats`, parsed. This component
+ * holds no list of its own and no belief about what is buildable, which is
+ * what lets it render an unavailable format as a disabled row saying so —
+ * see the argument at the top of `~/utils/exportTargets`, and #150 for the
+ * position it replaces. When the catalogue could not be read the picker is
+ * empty and says so; it never falls back to a list of guesses, because a
+ * guess is what this component existed for two releases without being able
+ * to correct.
  *
  * **There is no credential field, and that is the point.** A `PUT` on a
  * destination does not touch its secret — the API gives the credential a
@@ -39,7 +50,9 @@ import UiSelect from '~/components/ui/UiSelect.vue'
 import { singleChoices, type NamedRow } from '~/utils/directory'
 import {
   type DraftField,
+  type FormatInfo,
   type TargetDraft,
+  SINK_OUTLINE,
   draftProblems,
   formatChoices,
   formatSpec,
@@ -53,6 +66,12 @@ const props = withDefaults(
     initial: TargetDraft
     /** Names this guild already uses, this destination's own excluded. */
     taken?: readonly string[]
+    /** What this deployment reports it knows of, buildable or not. */
+    formats?: readonly FormatInfo[]
+    /** The catalogue could not be read. Unlike the collections below this
+     *  is not decoration: the format is a required field with a closed set
+     *  of legal values, and this form has no honest way to guess it. */
+    formatsFailed?: boolean
     /** Outline's collections, for the one format that addresses one. */
     collections?: readonly NamedRow[]
     /** The collections could not be read. Decoration failing, not the
@@ -60,7 +79,14 @@ const props = withDefaults(
     collectionsFailed?: boolean
     busy?: boolean
   }>(),
-  { taken: () => [], collections: () => [], collectionsFailed: false, busy: false },
+  {
+    taken: () => [],
+    formats: () => [],
+    formatsFailed: false,
+    collections: () => [],
+    collectionsFailed: false,
+    busy: false,
+  },
 )
 
 const emit = defineEmits<{ submit: [TargetDraft]; cancel: [] }>()
@@ -94,8 +120,25 @@ watch(
   },
 )
 
-const spec = computed(() => formatSpec(draft.value.format))
-const wantsCollection = computed(() => spec.value?.targetKind === 'collection')
+const spec = computed(() => formatSpec(draft.value.format, props.formats))
+const wantsCollection = computed(() => spec.value?.sink === SINK_OUTLINE)
+
+/**
+ * What the address field is called, and the sentence under it.
+ *
+ * Neutral where the deployment has reported no sink family for this
+ * format — because it does not build it, because it has never heard of it,
+ * or because the catalogue could not be read. The previous version fell
+ * back to the object-store wording, which named a rule ("letters, digits,
+ * dot, dash…") that this console has no reason to believe applies. A field
+ * that states a constraint it invented is worse than one that states none:
+ * the API enforces the real rule either way, and only one of the two
+ * teaches the reader something false while they type.
+ */
+const targetLabelKey = computed(
+  () => spec.value?.targetLabelKey ?? 'admin.destinations.addressLabel',
+)
+const targetHintKey = computed(() => spec.value?.targetHintKey ?? 'admin.destinations.addressHint')
 
 /** Whether there is a list to pick from at all. An empty select would say
  *  "this installation has no collections", which is a claim, and the wrong
@@ -105,7 +148,16 @@ const pickerAvailable = computed(
 )
 const picking = computed(() => pickerAvailable.value && !manual.value)
 
-const formatOptions = computed(() => formatChoices(t, props.initial.format))
+/** Whether the deployment reported anything it cannot run. The sentence
+ *  explaining the greyed rows is shown only where there are some. */
+const hasUnavailable = computed(() => props.formats.some((entry) => !entry.available))
+
+// Keyed on `initial.format` rather than on the draft's current one: the
+// row kept for a format the catalogue does not report is kept because this
+// destination *stores* it, and a list that recomputed on every change would
+// drop that row the moment somebody looked at another format and leave
+// nothing to go back to.
+const formatOptions = computed(() => formatChoices(t, props.formats, props.initial.format))
 
 /** The collections, plus the stored id when the copy has no row for it.
  *  Dropping it would render as though nothing were configured and rewrite
@@ -118,7 +170,7 @@ const collectionOptions = computed<UiOption[]>(() =>
   })),
 )
 
-const problems = computed(() => draftProblems(draft.value, props.taken))
+const problems = computed(() => draftProblems(draft.value, props.taken, props.formats))
 const ready = computed(() => problems.value.length === 0)
 
 /** The complaint about one field, once it is the reader's to see. */
@@ -194,8 +246,10 @@ function submit() {
         </p>
       </div>
 
-      <!-- The format. Three rows, and a fourth only when this destination
-           already stores something else. -->
+      <!-- The format. One row per format the deployment reports, the ones
+           it cannot run among them and disabled, plus one more only when
+           this destination already stores something the catalogue does not
+           mention. -->
       <div>
         <span class="block text-sm font-medium">{{ $t('admin.destinations.formatLabel') }}</span>
         <div class="mt-1">
@@ -210,14 +264,33 @@ function submit() {
         <p class="mt-1 text-xs" :style="{ color: 'var(--text-muted)' }">
           {{ $t('admin.destinations.formatHint') }}
         </p>
-        <!-- Where the absent formats are accounted for. One sentence in
-             place of two inert rows, so their absence reads as a fact
-             about this deployment rather than as a list that failed to
-             render — the same answer `video_consent_offered` gets on the
-             consent card. -->
-        <p class="mt-1 text-xs" :style="{ color: 'var(--text-muted)' }">
+        <!-- What the greyed rows are. The list above no longer needs a
+             sentence enumerating which formats exist — the deployment says
+             so, row by row — but it does need one saying why some of them
+             cannot be chosen, because a disabled row with no explanation
+             reads as a fault.
+
+             And only where there is such a row. On a deployment that
+             builds everything it knows of, this sentence would describe
+             nothing on the screen, which is how the old hard-coded version
+             of it came to be wrong. -->
+        <p
+          v-if="hasUnavailable"
+          class="mt-1 text-xs"
+          :style="{ color: 'var(--text-muted)' }"
+        >
           {{ $t('admin.destinations.formatsNote') }}
         </p>
+        <!-- The catalogue itself could not be read. Said plainly rather
+             than papered over with a list of guesses: the picker is empty,
+             and this is why. -->
+        <p
+          v-if="formatsFailed || formats.length === 0"
+          class="mt-1 text-xs"
+          :style="{ color: 'var(--text-muted)' }"
+        >
+          {{ $t('admin.destinations.formatsUnavailable') }}
+        </p>
         <p v-if="complaint('format')" class="mt-1 text-xs" :style="{ color: 'var(--danger)' }">
           {{ say(complaint('format')) }}
         </p>
@@ -231,10 +304,10 @@ function submit() {
           class="block text-sm font-medium"
           :for="`${base}-target`"
         >
-          {{ $t(spec?.targetLabelKey ?? 'admin.destinations.prefixLabel') }}
+          {{ $t(targetLabelKey) }}
         </label>
         <span v-else class="block text-sm font-medium">
-          {{ $t(spec?.targetLabelKey ?? 'admin.destinations.collectionLabel') }}
+          {{ $t(targetLabelKey) }}
         </span>
 
         <div v-if="picking" class="mt-1">
@@ -264,7 +337,7 @@ function submit() {
         >
 
         <p class="mt-1 text-xs" :style="{ color: 'var(--text-muted)' }">
-          {{ $t(spec?.targetHintKey ?? 'admin.destinations.prefixHint') }}
+          {{ $t(targetHintKey) }}
         </p>
         <!-- Why a field that should have been a picker is a text box. The
              list being unreadable must never stop a destination being
diff --git a/console/app/pages/admin/destinations.vue b/console/app/pages/admin/destinations.vue
index 9401a2e..052f2d6 100644
--- a/console/app/pages/admin/destinations.vue
+++ b/console/app/pages/admin/destinations.vue
@@ -27,11 +27,12 @@
  *   until somebody deliberately opens it. An empty password box saved with
  *   the rest of a form is how a working token gets wiped by somebody
  *   correcting a typo in a name.
- * - **It never offers a format a save would refuse.** `pdf` and
- *   `confluence` are not built and the API answers 400 to either; they are
- *   absent from the picker rather than present and inert, and one sentence
- *   under it says which formats this deployment publishes. The argument,
- *   and the two precedents it had to choose between, are at the top of
+ * - **It never decides for itself which formats exist.** `GET
+ *   /api/export-formats` is read here and handed to the form, which is
+ *   what lets a format this deployment does not build appear in the picker
+ *   as a disabled row saying so instead of being silently absent. #150 had
+ *   to be absent because there was no endpoint to ask; the argument for
+ *   changing that answer, now that there is, is at the top of
  *   `~/utils/exportTargets`.
  * - **It never re-reads a guild's destinations under another guild's
  *   heading.** The answer travels with the guild it belongs to, the way
@@ -45,6 +46,7 @@ import { parseCollections } from '~/utils/directory'
 import {
   type ExportTarget,
   type TargetDraft,
+  FORMATS_PATH,
   describeTargetError,
   draftBody,
   draftOf,
@@ -52,6 +54,7 @@ import {
   enabledLabelKey,
   fallbackNote,
   orderTargets,
+  parseFormats,
   parseTargets,
   primaryTarget,
   takenNames,
@@ -131,6 +134,30 @@ const targets = computed(() =>
     : [],
 )
 
+/**
+ * What this deployment can publish, asked once for the whole page.
+ *
+ * Not watched on `selected` and not keyed by guild: the catalogue is a
+ * property of the binary answering, identical for every server, so a guild
+ * switch must not refetch it and a stale answer from another guild is not
+ * a thing that can happen here.
+ *
+ * Its failure is **not** treated like the collection list's. A collection
+ * name is decoration and the field degrades to an id; the format is a
+ * required value with a closed set, so an unreadable catalogue leaves this
+ * page with nothing honest to offer for a *new* destination — and it says
+ * so, rather than falling back to a list of guesses. Everything that does
+ * not need it still works: the existing destinations render with their
+ * stored formats, and switching one off, removing it or writing its
+ * credential asks the catalogue nothing.
+ */
+const { data: formatData, error: formatError } = await useAsyncData(
+  'export-formats',
+  async () => parseFormats(await api(FORMATS_PATH)),
+)
+
+const formats = computed(() => formatData.value ?? [])
+
 /**
  * Outline's collections, for the one format that addresses one.
  *
@@ -463,7 +490,7 @@ function startAdding() {
                   :style="{ background: 'var(--surface-sunken)', color: 'var(--text-muted)' }"
                 >{{ $t('admin.destinations.secretHeading') }}</span>
                 <span class="block w-full truncate text-xs" :style="{ color: 'var(--text-muted)' }">
-                  {{ say(targetSummary(row.target)) }}
+                  {{ say(targetSummary(row.target, formats)) }}
                 </span>
               </span>
             </template>
@@ -543,6 +570,8 @@ function startAdding() {
                   mode="edit"
                   :initial="draftOf(row.target)"
                   :taken="takenNames(targets, row.target.id)"
+                  :formats="formats"
+                  :formats-failed="Boolean(formatError)"
                   :collections="collections"
                   :collections-failed="Boolean(collectionError)"
                   :busy="busy === row.target.id"
@@ -589,8 +618,10 @@ function startAdding() {
             <ExportTargetForm
               v-if="adding"
               mode="add"
-              :initial="emptyDraft()"
+              :initial="emptyDraft(formats)"
               :taken="takenNames(targets)"
+              :formats="formats"
+              :formats-failed="Boolean(formatError)"
               :collections="collections"
               :collections-failed="Boolean(collectionError)"
               :busy="busy === 'new'"
diff --git a/console/app/utils/exportTargets.ts b/console/app/utils/exportTargets.ts
index 9812142..ef2d315 100644
--- a/console/app/utils/exportTargets.ts
+++ b/console/app/utils/exportTargets.ts
@@ -13,42 +13,55 @@
  *
  * Four things here are worth arguing for rather than reading past.
  *
- * **1. The formats this console offers are the three the API accepts, and
- * `pdf` and `confluence` are absent rather than disabled.** They are
- * specified and deliberately not built (`sturnus.application.
- * export_formats`, spec §3.4), and configuring one answers 400. The
- * console has two precedents for an option it cannot honour, and they
- * point opposite ways. The account menu renders two-factor authentication
- * as an inert "coming soon" row, because that is a *promise to the reader
- * about their own account* sitting in a menu of things to read, and an
- * absent row would read as an oversight. `video_consent_offered` goes the
- * other way: when a guild has no video policy the option is **absent** —
- * not greyed — and one sentence beside the control says the server records
- * audio only.
- *
- * This is the second case, twice over. It is a *form field*, and a
- * dropdown exists to be chosen from and saved; a row inside it that a save
- * would refuse is not a promise, it is a trap laid under the cursor of
- * somebody deciding. And more decisively: **which formats exist is the
- * deployment's answer and this console cannot see it.** `supported_formats`
- * is a registry in the API process, there is no endpoint that reads it
- * out, and `apiError.ts` deliberately keeps nothing from a failed response
- * but its status — so the `{"supported": [...]}` a 400 carries never
- * reaches a page. A "PDF — coming soon" row would therefore be this
- * console asserting a fact about a build it cannot inspect, and on the day
- * `pdf` is added to that registry — which `export_formats` promises needs
- * no change anywhere else — the console would still be calling it
- * unavailable until somebody remembered to edit a second list. So the list
- * below is a belief, it is stated as one, and {@link formatChoices} defers
- * to the stored value whenever the two disagree.
- *
- * **2. A stored format this console has never heard of is still rendered,
- * and still choosable while editing that destination.** Exactly the rule
+ * **1. This module holds no list of formats any more. It is told.**
+ * `GET /api/export-formats` reads `sturnus.application.export_formats`
+ * out — every format the deployment knows of, whether this build can run
+ * it, and which sink family carries it — and {@link parseFormats} is what
+ * arrives. The one thing kept here is *words*: {@link formatLabelKey} maps
+ * a name to a translation key, because a sentence in German is not
+ * something an API with no message catalogue can serve, and a name with no
+ * key falls back to rendering itself.
+ *
+ * That inversion is what settles the question #150 could only settle one
+ * way. It argued that `pdf` and `confluence` should be **absent** from the
+ * picker rather than present and disabled, and the decisive half of the
+ * argument was that *the console could not see the registry*: a "PDF — not
+ * built" row would have been this console asserting a fact about a build it
+ * cannot inspect, and it would have gone on asserting it after `pdf` was
+ * built. Neither is true now. The row's text is the deployment's own answer
+ * and it stops being unavailable the moment the deployment says so, with
+ * nothing here to edit.
+ *
+ * So an unavailable format is **rendered, disabled, and labelled with the
+ * reason**. The other half of #150's argument — a dropdown row a save would
+ * refuse is "a trap laid under the cursor" — is an argument against a row
+ * that looks choosable and is not. This one does not: `UiOption.disabled`
+ * is a first-class state that {@link stepEnabled} walks past and that the
+ * control renders as unchoosable, and {@link draftProblems} refuses a draft
+ * naming an unavailable format so that Save is off and the reason sits
+ * under the field. What is left is the fact that PDF exists and this
+ * deployment does not build it — which is exactly what somebody who came to
+ * this page looking for PDF needs to be told, and what an absent row leaves
+ * them to conclude wrongly. The one precedent that cuts the other way,
+ * `video_consent_offered`, is a guild's *policy choice* about its own
+ * server; this is a property of the binary, which is not something an
+ * administrator can go and change.
+ *
+ * **2. A stored format the API does not report is still rendered, and
+ * still choosable while editing that destination.** Exactly the rule
  * `~/utils/directory` applies to a channel id with no row in the mirror:
  * an option that is not rendered is a configuration nobody can remove from
  * this page, and a picker that silently dropped `pdf` would rewrite it to
  * `outline` the next time somebody renamed the destination.
  *
+ * The endpoint answering makes this *more* important rather than less,
+ * because there is now a way for the list to arrive empty: the request
+ * failing. A page that read "this deployment supports nothing" out of a
+ * request that timed out and then rewrote every destination on the next
+ * save would be the worst version of this screen there is. So the stored
+ * value is never filtered against the reported list, anywhere: not in the
+ * picker, not in {@link primaryTarget}, not in {@link targetSummary}.
+ *
  * **3. The first enabled destination is the one Discord announces.**
  * `sturnus.application.exporting.destinations_for` orders by id, oldest
  * first, and `session.document_url` is stamped from that one alone. That
@@ -162,7 +175,7 @@ export function parseTargets(payload: unknown): ExportTarget[] {
 }
 
 /* -------------------------------------------------------------------- */
-/* The formats this console believes the deployment builds               */
+/* The formats, as the deployment reports them                           */
 /* -------------------------------------------------------------------- */
 
 export const FORMAT_OUTLINE = 'outline'
@@ -170,80 +183,174 @@ export const FORMAT_MARKDOWN = 'markdown'
 export const FORMAT_HTML = 'html'
 
 /**
- * What a format's `target` column is.
+ * What carries a format's bytes away, and therefore what its `target` is.
  *
- * `collection` is an Outline collection id, and the page already has a
- * picker over those names — the same one Bot Settings uses for
- * `document_target`. `prefix` is a key prefix in the object store, which
- * has no directory to browse and is therefore typed.
+ * The API's own word (`sturnus.application.export_formats.OUTLINE_SINK`,
+ * `OBJECT_STORE_SINK`) rather than a second vocabulary of this console's.
+ * There used to be a `TargetKind` of `'collection' | 'prefix'` here that
+ * meant exactly these two things under different names, which is one
+ * translation table nobody needs: an Outline sink addresses a collection
+ * and an object-store sink addresses a key prefix, and saying so once is
+ * enough.
  */
-export type TargetKind = 'collection' | 'prefix'
+export type SinkFamily = 'outline' | 'object_store'
 
-export interface FormatSpec {
+export const SINK_OUTLINE = 'outline'
+export const SINK_OBJECT_STORE = 'object_store'
+
+/**
+ * One format, exactly as `GET /api/export-formats` reports it.
+ *
+ * Three fields because the endpoint sends three. `available` is the one
+ * that could not be had before: the difference between a format this
+ * deployment declines to offer and a format that does not exist.
+ *
+ * `sink` is `null` for a format this build does not run, and that null is
+ * load-bearing rather than a gap — nothing in the API has decided what
+ * would carry a PDF, so nothing here may render a field claiming to know.
+ */
+export interface FormatInfo {
   name: string
-  /** What this format is called, under `common.*` rather than under this
-   *  page's own namespace. It is the one string two pages have to say —
-   *  the destinations page names it in a picker, and the recording page
-   *  names it beside a published document — and two copies of a word are
-   *  two words that drift. Everything else here is only ever rendered by
-   *  the destinations page and is keyed there. */
-  labelKey: string
-  /** One sentence saying what this format produces and where it lands. */
+  available: boolean
+  sink: SinkFamily | null
+}
+
+function asSink(value: unknown): SinkFamily | null {
+  return value === SINK_OUTLINE || value === SINK_OBJECT_STORE ? value : null
+}
+
+/**
+ * Every format in a catalogue payload, in the order the API sent them.
+ *
+ * Order is kept because it is part of the answer: the API lists what a
+ * guild has always published to first, and the first row of a picker reads
+ * as the ordinary choice.
+ *
+ * Tolerant in one direction only. A row with no usable `name` is dropped —
+ * there is nothing to store or to render for it. A row whose `sink` is a
+ * word this console does not know becomes `null`, which is the same state
+ * as an unbuilt format's: the address field falls back to a plain box that
+ * accepts anything non-empty, and the API decides. An unparseable payload
+ * is an empty list, which the page reports as the catalogue being
+ * unreadable rather than as a deployment that publishes nothing.
+ */
+export function parseFormats(payload: unknown): FormatInfo[] {
+  if (!isRecord(payload) || !Array.isArray(payload.formats)) return []
+  const formats: FormatInfo[] = []
+  for (const raw of payload.formats) {
+    if (!isRecord(raw)) continue
+    const name = (asText(raw.name) ?? '').trim()
+    if (name === '') continue
+    formats.push({ name, available: raw.available === true, sink: asSink(raw.sink) })
+  }
+  return formats
+}
+
+/**
+ * The word this console has for a format, or `null` where it has none.
+ *
+ * The one thing about a format that stays on this side, and the reason is
+ * that the API has no message catalogue: `common.formatOutline` is
+ * "Outline document" in English and "Outline-Dokument" in German, and an
+ * endpoint that served either would be serving one reader's language to
+ * everybody. Under `common.*` rather than this page's namespace because
+ * two pages say it — the destinations picker and the recording page's list
+ * of published protocols — and two copies of a word are two words that
+ * drift.
+ *
+ * A name with no entry renders as itself. That is not a fallback for a
+ * broken state; it is the correct answer for a format this deployment
+ * builds and this console has never been taught a word for, and it is what
+ * keeps a missing word from being a missing row.
+ */
+const FORMAT_LABEL_KEYS: Readonly<Record<string, string>> = {
+  [FORMAT_OUTLINE]: 'common.formatOutline',
+  [FORMAT_MARKDOWN]: 'common.formatMarkdown',
+  [FORMAT_HTML]: 'common.formatHtml',
+  pdf: 'common.formatPdf',
+  confluence: 'common.formatConfluence',
+}
+
+export function formatLabelKey(name: string): string | null {
+  return FORMAT_LABEL_KEYS[name] ?? null
+}
+
+/**
+ * What the address field is called, hinted and explained — by sink family
+ * and never by format name.
+ *
+ * Which is the whole point of serving the family. Every format on the
+ * object-store family wants a key prefix and calls it the same thing, so
+ * `pdf` arriving in the catalogue one day gets the right field, the right
+ * label and the right sentence with nothing added here. The previous
+ * version of this file had `formatMarkdownNote` and `formatHtmlNote`
+ * holding the same sentence twice, which is what a per-name table always
+ * decays into.
+ */
+interface SinkStrings {
   noteKey: string
-  targetKind: TargetKind
-  /** The label over the field that holds `target`. Every format calls it
-   *  something different, because it *is* something different: a
-   *  collection is a place in Outline, a prefix is part of an object key. */
   targetLabelKey: string
   targetHintKey: string
-  /** Whether this format's documents can be read back through the console.
-   *  True for the object-store family, whose bytes this deployment holds;
-   *  false for Outline, whose document lives in Outline. Mirrors
+  /** Whether documents of this family can be read back through the
+   *  console. True for the object store, whose bytes this deployment
+   *  holds; false for Outline, whose document lives in Outline. Mirrors
    *  `routes_documents._is_readable`. */
   readable: boolean
 }
 
-/**
- * The three formats, in the registry's own order.
- *
- * A belief about the deployment and not a fact about it — see the note at
- * the top of this module for why the console cannot have the fact, and why
- * `pdf` and `confluence` are absent from here rather than present and
- * inert.
- */
-export const EXPORT_FORMATS: readonly FormatSpec[] = [
-  {
-    name: FORMAT_OUTLINE,
-    labelKey: 'common.formatOutline',
-    noteKey: 'admin.destinations.formatOutlineNote',
-    targetKind: 'collection',
+const SINK_STRINGS: Readonly<Record<SinkFamily, SinkStrings>> = {
+  [SINK_OUTLINE]: {
+    noteKey: 'admin.destinations.sinkOutlineNote',
     targetLabelKey: 'admin.destinations.collectionLabel',
     targetHintKey: 'admin.destinations.collectionHint',
     readable: false,
   },
-  {
-    name: FORMAT_MARKDOWN,
-    labelKey: 'common.formatMarkdown',
-    noteKey: 'admin.destinations.formatMarkdownNote',
-    targetKind: 'prefix',
+  [SINK_OBJECT_STORE]: {
+    noteKey: 'admin.destinations.sinkObjectStoreNote',
     targetLabelKey: 'admin.destinations.prefixLabel',
     targetHintKey: 'admin.destinations.prefixHint',
     readable: true,
   },
-  {
-    name: FORMAT_HTML,
-    labelKey: 'common.formatHtml',
-    noteKey: 'admin.destinations.formatHtmlNote',
-    targetKind: 'prefix',
-    targetLabelKey: 'admin.destinations.prefixLabel',
-    targetHintKey: 'admin.destinations.prefixHint',
-    readable: true,
-  },
-] as const
+}
 
-/** The spec for a format, or `null` for one this console does not know. */
-export function formatSpec(name: string): FormatSpec | null {
-  return EXPORT_FORMATS.find((entry) => entry.name === name) ?? null
+/**
+ * Everything the form needs about one format, or `null` when the reported
+ * catalogue does not contain it.
+ *
+ * `null` covers three situations that behave identically and deliberately
+ * so: a format nobody has heard of, a format stored before the catalogue
+ * knew it, and a catalogue that could not be read at all. In each of them
+ * the honest position is the same — this console has no opinion, so it
+ * asks for a plain address and lets the API decide.
+ */
+export interface FormatSpec {
+  name: string
+  available: boolean
+  sink: SinkFamily | null
+  /** `null` where this console has no word for the format. */
+  labelKey: string | null
+  /** `null` for an unbuilt format: there is no sink, so there is nothing
+   *  truthful to say about what it produces or where it lands. */
+  noteKey: string | null
+  targetLabelKey: string | null
+  targetHintKey: string | null
+  readable: boolean
+}
+
+export function formatSpec(name: string, formats: readonly FormatInfo[]): FormatSpec | null {
+  const info = formats.find((entry) => entry.name === name)
+  if (info === undefined) return null
+  const strings = info.sink === null ? null : SINK_STRINGS[info.sink]
+  return {
+    name: info.name,
+    available: info.available,
+    sink: info.sink,
+    labelKey: formatLabelKey(info.name),
+    noteKey: strings?.noteKey ?? null,
+    targetLabelKey: strings?.targetLabelKey ?? null,
+    targetHintKey: strings?.targetHintKey ?? null,
+    readable: strings?.readable ?? false,
+  }
 }
 
 /**
@@ -257,47 +364,83 @@ export function formatSpec(name: string): FormatSpec | null {
  * bad target whatever this file thinks; what this buys is that the reason
  * is legible beside the field instead of arriving as a bare 400 that
  * `apiError` has stripped of its explanation.
+ *
+ * Copied rather than served, and that is on purpose: a `target_pattern` is
+ * a compiled Python regular expression, and `/api/export-formats` sends
+ * the sink family instead. Handing a caller a pattern to re-compile hands
+ * it a dialect — Python and JavaScript disagree about `\d` under Unicode,
+ * about what a bare `$` matches, about inline flags — and a pattern that
+ * parses differently on the two sides is a courtesy that lies. Two
+ * patterns per *family*, which is what the family is for.
  */
 const OUTLINE_TARGET = /^[^\s/][^\s]*$/
 const OBJECT_PREFIX = /^[A-Za-z0-9_-]+(?:[./][A-Za-z0-9_-]+)*$/
 
-/** Whether a format can address that target at all. Unknown formats accept
- *  anything non-empty: this console has no pattern for a format it has
- *  never heard of, and inventing one would refuse a target the deployment
- *  is perfectly happy with. */
-export function acceptsTarget(format: string, target: string): boolean {
-  const spec = formatSpec(format)
-  if (spec === null) return target.trim() !== ''
-  return spec.targetKind === 'collection'
-    ? OUTLINE_TARGET.test(target)
-    : OBJECT_PREFIX.test(target)
+/** Whether a format can address that target at all. A format with no
+ *  reported sink — unknown, unbuilt, or from a catalogue that could not be
+ *  read — accepts anything non-empty: this console has no pattern for one,
+ *  and inventing one would refuse a target the deployment is perfectly
+ *  happy with. */
+export function acceptsTarget(
+  format: string,
+  target: string,
+  formats: readonly FormatInfo[],
+): boolean {
+  const sink = formatSpec(format, formats)?.sink ?? null
+  if (sink === null) return target.trim() !== ''
+  return sink === SINK_OUTLINE ? OUTLINE_TARGET.test(target) : OBJECT_PREFIX.test(target)
 }
 
 /**
  * The rows of the format dropdown.
  *
- * The three this console knows, plus — when a destination already stores a
- * format that is not among them — that one, labelled with its own raw
- * name. Never dropped: a picker that omitted the stored value would render
- * as though `outline` were chosen and rewrite the destination to `outline`
- * on the next save, which is `directory.ts`'s argument for keeping an
- * unresolved id in the list, applied to a word instead of a snowflake.
+ * Every format the deployment reported, in the order it reported them,
+ * plus — when a destination already stores a format that is not among them
+ * — that one, labelled with its own raw name. Never dropped: a picker that
+ * omitted the stored value would render as though the first row were
+ * chosen and rewrite the destination to it on the next save, which is
+ * `directory.ts`'s argument for keeping an unresolved id in the list,
+ * applied to a word instead of a snowflake.
+ *
+ * **An unavailable format is a disabled row, not an absent one.** The row
+ * says what the format is and, in place of what it would produce, that this
+ * deployment does not build it. `UiOption.disabled` is not decoration:
+ * `stepEnabled` walks past it, the control renders it unchoosable, and
+ * `draftProblems` refuses the draft anyway — so this is a fact stated, not
+ * a choice offered and then withdrawn. The argument, and what changed since
+ * #150 decided the other way, is at the top of this module.
+ *
+ * **Except when it is the format this destination already stores.** Then
+ * the row is choosable, because it is not an offer — it is where the
+ * dropdown's own value has to be able to sit. Disabling it would leave the
+ * control pointing at a row it may not select, which is how a picker
+ * silently reports the wrong value.
  *
  * Takes a translator rather than returning keys, the way
  * `recordingTabs(label)` does: a `UiOption.label` is text by contract, and
- * the raw name of an unknown format is text that no key exists for.
+ * the raw name of a format nobody has a word for is text that no key
+ * exists for.
  */
 export function formatChoices(
   label: (key: string) => string,
+  formats: readonly FormatInfo[],
   stored: string | null = null,
 ): UiOption[] {
-  const options: UiOption[] = EXPORT_FORMATS.map((entry) => ({
-    value: entry.name,
-    label: label(entry.labelKey),
-    detail: label(entry.noteKey),
-  }))
   const held = (stored ?? '').trim()
-  if (held !== '' && formatSpec(held) === null) {
+  const options: UiOption[] = formats.map((entry) => {
+    const spec = formatSpec(entry.name, formats)
+    const labelKey = spec?.labelKey ?? null
+    const noteKey = spec?.noteKey ?? null
+    return {
+      value: entry.name,
+      label: labelKey === null ? entry.name : label(labelKey),
+      detail: entry.available
+        ? (noteKey === null ? undefined : label(noteKey))
+        : label('admin.destinations.formatUnavailableDetail'),
+      disabled: !entry.available && entry.name !== held,
+    }
+  })
+  if (held !== '' && !formats.some((entry) => entry.name === held)) {
     options.push({
       value: held,
       label: held,
@@ -372,17 +515,38 @@ export function fallbackNote(targets: readonly ExportTarget[]): Message {
 /* One destination, said out loud                                        */
 /* -------------------------------------------------------------------- */
 
-/** The subtitle under a destination's name in the list: what it publishes
- *  and where, with the format named in words where this console has a word
- *  for it and by its raw name where it does not. */
-export function targetSummary(target: ExportTarget): Message {
-  const spec = formatSpec(target.format)
-  return {
-    key: spec === null
+/**
+ * The subtitle under a destination's name in the list: what it publishes
+ * and where.
+ *
+ * Three sentences, because there are now three things that can be true of
+ * a stored format and they are not the same news:
+ *
+ * - it is reported and this deployment builds it — the ordinary line;
+ * - it is reported and **not** built, which means this destination is
+ *   configured and nothing will ever be published to it. Said in the list,
+ *   beside the destination it is true of, rather than only inside the form
+ *   somebody has to open to find out;
+ * - it is not reported at all, which is what a stored format from a newer
+ *   deployment and an unreadable catalogue both look like. This console
+ *   says it does not know and says the deployment's answer is the one that
+ *   counts — it does **not** say the destination is broken, because from
+ *   here those two look identical.
+ *
+ * The format is named in words where this console has a word for it and by
+ * its raw name where it does not, which is the same rule everywhere else.
+ */
+export function targetSummary(target: ExportTarget, formats: readonly FormatInfo[]): Message {
+  const spec = formatSpec(target.format, formats)
+  const labelKey = spec?.labelKey ?? null
+  const named = labelKey === null ? target.format : { key: labelKey }
+  const key =
+    spec === null
       ? 'admin.destinations.rowUnknownFormat'
-      : 'admin.destinations.rowSummary',
-    params: { format: spec === null ? target.format : { key: spec.labelKey }, target: target.target },
-  }
+      : spec.available
+        ? 'admin.destinations.rowSummary'
+        : 'admin.destinations.rowUnavailableFormat'
+  return { key, params: { format: named, target: target.target } }
 }
 
 /** Whether this destination is publishing, in words. Switched off is a
@@ -469,11 +633,28 @@ export interface TargetDraft {
   enabled: boolean
 }
 
-/** A blank destination, ready to be added. Outline first because it is
- *  what every guild configured before this page existed, and enabled
- *  because somebody adding a destination is adding one to publish to. */
-export function emptyDraft(): TargetDraft {
-  return { format: FORMAT_OUTLINE, name: '', target: '', enabled: true }
+/**
+ * A blank destination, ready to be added.
+ *
+ * The format is **the first one the deployment reports as available**,
+ * which for every deployment shipped so far is `outline` — what every
+ * guild configured before this page existed — but is that because the API
+ * says so rather than because this file used to name it. On a build where
+ * `outline` is not compiled in, a form opening on it would be a form that
+ * opens invalid.
+ *
+ * Blank when nothing was reported, which is what an unreadable catalogue
+ * looks like. Blank rather than a guess: {@link draftProblems} then says
+ * "choose a format" beside an empty picker, and the reader is looking at
+ * the truth — this console does not currently know what may be chosen —
+ * instead of at a default that a save would refuse.
+ *
+ * Enabled, because somebody adding a destination is adding one to publish
+ * to.
+ */
+export function emptyDraft(formats: readonly FormatInfo[] = []): TargetDraft {
+  const first = formats.find((entry) => entry.available)
+  return { format: first?.name ?? '', name: '', target: '', enabled: true }
 }
 
 /** An existing destination, ready to be edited. */
@@ -510,13 +691,22 @@ export interface DraftProblem {
  * `PUT` and ignores whatever the body says, so a rename is a create plus a
  * delete rather than an edit, and complaining that a destination collides
  * with itself would refuse a save that changes something else.
+ *
+ * The format complaint is the one rule here that could not be stated
+ * before `GET /api/export-formats` existed. **It fires only where the
+ * deployment has said the format is unavailable** — never on a format that
+ * is merely unreported, because "this console has not been told about it"
+ * is not evidence of anything and refusing a save on it would make an
+ * unreadable catalogue look like a broken configuration.
  */
 export function draftProblems(
   draft: TargetDraft,
   taken: readonly string[] = [],
+  formats: readonly FormatInfo[] = [],
 ): DraftProblem[] {
   const problems: DraftProblem[] = []
   const name = draft.name.trim()
+  const spec = formatSpec(draft.format, formats)
 
   if (name === '') {
     problems.push({ field: 'name', message: { key: 'admin.destinations.nameEmpty' } })
@@ -526,16 +716,17 @@ export function draftProblems(
 
   if (draft.format.trim() === '') {
     problems.push({ field: 'format', message: { key: 'admin.destinations.formatEmpty' } })
+  } else if (spec !== null && !spec.available) {
+    problems.push({ field: 'format', message: { key: 'admin.destinations.formatUnavailable' } })
   }
 
   if (draft.target.trim() === '') {
     problems.push({ field: 'target', message: { key: 'admin.destinations.targetEmpty' } })
-  } else if (!acceptsTarget(draft.format, draft.target)) {
-    const spec = formatSpec(draft.format)
+  } else if (!acceptsTarget(draft.format, draft.target, formats)) {
     problems.push({
       field: 'target',
       message: {
-        key: spec?.targetKind === 'prefix'
+        key: spec?.sink === SINK_OBJECT_STORE
           ? 'admin.destinations.targetNotPrefix'
           : 'admin.destinations.targetNotCollection',
       },
@@ -554,8 +745,12 @@ export function problemFor(
 }
 
 /** Whether a draft may be submitted at all. */
-export function isDraftReady(draft: TargetDraft, taken: readonly string[] = []): boolean {
-  return draftProblems(draft, taken).length === 0
+export function isDraftReady(
+  draft: TargetDraft,
+  taken: readonly string[] = [],
+  formats: readonly FormatInfo[] = [],
+): boolean {
+  return draftProblems(draft, taken, formats).length === 0
 }
 
 /** The body a create or an update sends. Trimmed the way the API trims,
@@ -586,6 +781,10 @@ export function takenNames(
 /* Where the requests go                                                 */
 /* -------------------------------------------------------------------- */
 
+/** The format catalogue. No guild in it: every format on it is a fact
+ *  about the build, identical for every server this deployment serves. */
+export const FORMATS_PATH = '/export-formats'
+
 export function targetsPath(guildId: string): string {
   return `/guilds/${encodeURIComponent(guildId)}/export-targets`
 }
@@ -610,8 +809,10 @@ export function targetSecretPath(guildId: string, targetId: number): string {
  * accidentally render an internal hostname out of a `$fetch` error. It is
  * enough for every refusal these routes have, because each status means
  * exactly one thing here — including the 400, which after
- * {@link draftProblems} has passed can only mean that this console's list
- * of formats and the deployment's registry disagree.
+ * {@link draftProblems} has passed can only mean that the catalogue this
+ * page is holding is older than the deployment answering the write. The
+ * remedy is the same one every stale read has, and it is what the sentence
+ * says: reload.
  */
 export function describeTargetError(error: unknown): Message {
   const held = (error as { status?: unknown } | null)?.status
diff --git a/console/app/utils/sessionDocuments.ts b/console/app/utils/sessionDocuments.ts
index a4a35ad..08f780d 100644
--- a/console/app/utils/sessionDocuments.ts
+++ b/console/app/utils/sessionDocuments.ts
@@ -39,7 +39,7 @@
  *
  * Keys and {@link Message}s, never prose — see `i18n/README.md`.
  */
-import { formatSpec } from './exportTargets'
+import { formatLabelKey } from './exportTargets'
 import type { Instant, Message } from './message'
 
 /* -------------------------------------------------------------------- */
@@ -134,15 +134,24 @@ export interface ProtocolRow {
   orphaned: boolean
 }
 
-/** One document, ready to render. */
+/**
+ * One document, ready to render.
+ *
+ * Asks `~/utils/exportTargets` only for the *word* for a format, not for
+ * the deployment's catalogue. This page renders what was already published
+ * — the document exists, its link works — so whether the deployment still
+ * builds that format is not a fact about this row, and fetching the
+ * catalogue on the recordings page to answer a question nobody asked would
+ * be a request per recording view for nothing.
+ */
 export function protocolRow(document: SessionDocument): ProtocolRow {
-  const spec = formatSpec(document.provider)
+  const labelKey = formatLabelKey(document.provider)
   const at = document.createdAt === null ? null : new Date(document.createdAt)
   return {
     id: document.targetId === null ? `url:${document.url}` : `target:${document.targetId}`,
-    label: spec === null
+    label: labelKey === null
       ? { key: 'recordings.protocolUnknownFormat', params: { format: document.provider } }
-      : { key: 'recordings.protocolFormat', params: { format: { key: spec.labelKey } } },
+      : { key: 'recordings.protocolFormat', params: { format: { key: labelKey } } },
     url: document.url,
     at: at !== null && !Number.isNaN(at.getTime()) ? { at, format: 'utcMoment' } : null,
     internal: document.readable,
diff --git a/console/i18n/locales/de.json b/console/i18n/locales/de.json
index 8c5c15e..d86becc 100644
--- a/console/i18n/locales/de.json
+++ b/console/i18n/locales/de.json
@@ -10,7 +10,9 @@
     "durationMinutesSeconds": "{minutes} Min. {seconds} Sek.",
     "formatOutline": "Outline-Dokument",
     "formatMarkdown": "Markdown-Datei",
-    "formatHtml": "HTML-Seite"
+    "formatHtml": "HTML-Seite",
+    "formatPdf": "PDF-Datei",
+    "formatConfluence": "Confluence-Seite"
   },
   "nav": {
     "sections": "Bereiche",
@@ -672,11 +674,12 @@
       "nameLockedNote": "Ein Name lässt sich hier nicht ändern. Sturnus spricht ein gespeichertes Ziel über seinen Namen an — umbenennen heißt also, ein Ziel anzulegen und dieses zu entfernen, wofür die beiden Aktionen unten da sind.",
       "formatLabel": "Format",
       "formatHint": "Was geschrieben wird und was es forttransportiert. Das Format entscheidet beides: Ein Outline-Dokument und eine Markdown-Datei sind nicht derselbe Text mit anderer Endung.",
-      "formatOutlineNote": "Wird in einer Sammlung in Outline angelegt",
-      "formatMarkdownNote": "Von Sturnus gespeichert, über diese Konsole lesbar",
-      "formatHtmlNote": "Von Sturnus gespeichert, über diese Konsole lesbar",
+      "sinkOutlineNote": "Wird in einer Sammlung in Outline angelegt",
+      "sinkObjectStoreNote": "Von Sturnus gespeichert, über diese Konsole lesbar",
       "formatUnknownDetail": "Hier konfiguriert, und kein Format, das diese Konsole kennt",
-      "formatsNote": "Das sind die Formate, die diese Installation veröffentlicht. PDF und Confluence sind spezifiziert und nicht gebaut, deshalb stehen sie hier gar nicht erst zur Wahl, statt zur Wahl zu stehen und dann abgelehnt zu werden — eine Wahlmöglichkeit, die das Speichern zurückweist, nimmt auch denen daneben die Glaubwürdigkeit.",
+      "formatUnavailableDetail": "Spezifiziert, und in dieser Installation nicht gebaut",
+      "formatsNote": "Aufgeführt ist jedes Format, von dem diese Installation weiß. Die ausgegrauten sind spezifiziert und in dieser Installation nicht gebaut, also nicht wählbar — sie werden genannt statt verschwiegen, denn „Sturnus kann kein PDF“ und „dieser Build kann kein PDF“ sind zweierlei, wenn man damit wieder geht.",
+      "formatsUnavailable": "Die Formate, die diese Installation veröffentlicht, konnten nicht gelesen werden; hier steht deshalb nichts zur Wahl. Bitte die Seite neu laden — die bereits eingerichteten Ziele sind davon unberührt und lassen sich weiterhin abschalten oder entfernen.",
       "collectionLabel": "Outline-Sammlung",
       "collectionHint": "Die Sammlung, in der jedes Protokoll angelegt wird. Dieselbe Liste, die die Bot-Einstellungen für ihr eigenes document_target anbieten.",
       "collectionsUnavailable": "Die Outline-Sammlungen konnten nicht gelesen werden, deshalb wird hier nach einer Sammlungs-ID gefragt.",
@@ -686,12 +689,15 @@
       "unresolvedCollection": "Zu dieser ID gibt es keine Sammlung in der Kopie, die Sturnus von Outline hält. Vielleicht wurde sie dort gelöscht, vielleicht ist die Kopie noch nicht nachgezogen — so oder so ist dieses Ziel damit konfiguriert.",
       "prefixLabel": "Schlüsselpräfix",
       "prefixHint": "Wo im eigenen Speicher von Sturnus die Datei angelegt wird. Buchstaben, Ziffern, Punkt, Bindestrich, Unterstrich und / dazwischen; Besprechung und Ziel werden angehängt.",
+      "addressLabel": "Wohin geschrieben wird",
+      "addressHint": "Was dieses Format adressiert, beantwortet diese Installation selbst, und sie hat dazu nichts gesagt. Hier ist deshalb alles außer Leerraum zugelassen; beim Speichern entscheidet Sturnus.",
       "enabledLabel": "An dieses Ziel veröffentlichen",
       "enabledHint": "Ein Ziel abzuschalten heißt nicht, seine Konfiguration zu vergessen. Es bleibt stehen, und es wird nichts mehr dorthin veröffentlicht.",
       "stateEnabled": "Veröffentlicht",
       "stateDisabled": "Abgeschaltet",
       "rowSummary": "{format}, nach {target}",
       "rowUnknownFormat": "{format}, nach {target} — ein Format, das diese Konsole nicht kennt. Ob es veröffentlicht werden kann, beantwortet diese Installation selbst.",
+      "rowUnavailableFormat": "{format}, nach {target} — diese Installation baut dieses Format nicht, hier wird also nichts veröffentlicht.",
       "primaryBadge": "In Discord angekündigt",
       "primaryNote": "Eingeschaltete Ziele werden der Reihe nach beschrieben, das älteste zuerst, und der Link, den Sturnus in Discord postet, ist der des ersten. Er wandert nicht, wenn ein Ziel umbenannt wird.",
       "save": "Speichern",
@@ -715,7 +721,7 @@
       "secretSet": "Zugangsdaten speichern",
       "secretReplace": "Zugangsdaten ersetzen",
       "secretNeverShown": "Sturnus zeigt gespeicherte Zugangsdaten nirgends an, hier ebenso wenig: Keine Route gibt sie zurück. Ersetzen und Löschen sind das Einzige, was damit möglich ist, und beides hat eine eigene Schaltfläche — ein leeres Feld neben gespeicherten Zugangsdaten ist der Weg, auf dem sie beim Korrigieren eines Tippfehlers verschwinden.",
-      "secretUnused": "Keines der Formate oben liest bisher gespeicherte Zugangsdaten: Outline wird mit dem Outline-Token dieser Installation veröffentlicht, und die beiden Dateiformate werden in deren eigenen Speicher geschrieben. Was hier hinterlegt wird, bleibt für die Ziele aufgehoben, die es lesen werden.",
+      "secretUnused": "Kein Format, das diese Installation baut, liest bislang eine hinterlegte Zugangsdaten-Angabe: Ein Outline-Dokument wird mit dem eigenen Outline-Token dieser Installation veröffentlicht, und eine gespeicherte Datei landet im eigenen Speicher dieser Installation. Was hier hinterlegt wird, bleibt für die Ziele erhalten, die es lesen werden.",
       "secretInputLabel": "Neue Zugangsdaten",
       "secretSave": "Hinterlegen",
       "secretSaving": "Wird hinterlegt…",
@@ -728,10 +734,11 @@
       "nameEmpty": "Ein Ziel braucht einen Namen.",
       "nameTaken": "Dieser Server hat bereits ein Ziel mit diesem Namen.",
       "formatEmpty": "Ein Format wählen.",
+      "formatUnavailable": "Diese Installation baut dieses Format nicht, an dieses Ziel würde also nie etwas veröffentlicht. Bitte eines wählen, das sie baut.",
       "targetEmpty": "Ein Ziel braucht einen Ort, an den es schreibt.",
       "targetNotCollection": "Eine Outline-Sammlungs-ID: ohne Leerzeichen darin und ohne Schrägstrich davor.",
       "targetNotPrefix": "Buchstaben, Ziffern, Punkt, Bindestrich und Unterstrich, getrennt durch / — kein Schrägstrich davor, keiner dahinter und kein „..“.",
-      "errorRefused": "Sturnus hat dieses Ziel zurückgewiesen. Diese Konsole bietet die Formate an, von denen sie annimmt, dass diese Installation sie baut; eine Zurückweisung heißt also, dass deren eigene Liste davon abweicht.",
+      "errorRefused": "Sturnus hat dieses Ziel zurückgewiesen. Die Formatliste, die diese Seite hält, ist älter als die Installation, die geantwortet hat — bitte die Seite neu laden und es erneut versuchen.",
       "errorSession": "Die Sitzung ist abgelaufen. Erneut anmelden und noch einmal versuchen — es wurde nichts geschrieben.",
       "errorGone": "Sturnus kennt diesen Server oder dieses Ziel nicht mehr, oder dieses Konto administriert ihn nicht mehr — die Antwort ist auf alle drei dieselbe. Seite neu laden.",
       "errorDuplicate": "Dieser Server hat bereits ein Ziel mit diesem Namen.",
diff --git a/console/i18n/locales/en.json b/console/i18n/locales/en.json
index be9297a..eb9f8c0 100644
--- a/console/i18n/locales/en.json
+++ b/console/i18n/locales/en.json
@@ -10,7 +10,9 @@
     "durationMinutesSeconds": "{minutes} min {seconds} s",
     "formatOutline": "Outline document",
     "formatMarkdown": "Markdown file",
-    "formatHtml": "HTML page"
+    "formatHtml": "HTML page",
+    "formatPdf": "PDF file",
+    "formatConfluence": "Confluence page"
   },
   "nav": {
     "sections": "Sections",
@@ -672,11 +674,12 @@
       "nameLockedNote": "A name cannot be changed here. Sturnus addresses a stored destination by its name, so renaming one means adding a destination and removing this one — which is what the two actions below are for.",
       "formatLabel": "Format",
       "formatHint": "What is written and what carries it away. A format decides both: an Outline document and a Markdown file are not the same text with a different extension.",
-      "formatOutlineNote": "Created in a collection in Outline",
-      "formatMarkdownNote": "Stored by Sturnus, read through this console",
-      "formatHtmlNote": "Stored by Sturnus, read through this console",
+      "sinkOutlineNote": "Created in a collection in Outline",
+      "sinkObjectStoreNote": "Stored by Sturnus, read through this console",
       "formatUnknownDetail": "Configured here, and not a format this console knows",
-      "formatsNote": "These are the formats this deployment publishes. PDF and Confluence are specified and not built, so they are not offered here rather than offered and then refused — a choice that a save rejects teaches people not to trust the choices beside it.",
+      "formatUnavailableDetail": "Specified, and not built into this deployment",
+      "formatsNote": "Every format this deployment knows of is listed. The greyed ones are specified and not built into this deployment, so they cannot be chosen — they are named rather than hidden, because “Sturnus has no PDF” and “this build has no PDF” are different things to walk away believing.",
+      "formatsUnavailable": "The formats this deployment publishes could not be read, so there is nothing to choose from here. Reload the page — the destinations already configured are unaffected and can still be switched off or removed.",
       "collectionLabel": "Outline collection",
       "collectionHint": "The collection each protocol is created in. The same list Bot Settings offers for its own document_target.",
       "collectionsUnavailable": "The Outline collections could not be read, so this asks for a collection id.",
@@ -686,12 +689,15 @@
       "unresolvedCollection": "This id matches no collection in the copy Sturnus made of Outline. It may have been deleted there, or the copy may not have caught up — either way it is still what this destination is configured with.",
       "prefixLabel": "Key prefix",
       "prefixHint": "Where in Sturnus’s own store the file is written. Letters, digits, dot, dash, underscore, and / between them; the meeting and the destination are appended.",
+      "addressLabel": "Where it writes",
+      "addressHint": "What this format addresses is this deployment’s own answer and it has not given one, so anything non-empty is offered here and Sturnus decides on save.",
       "enabledLabel": "Publish to this destination",
       "enabledHint": "Switching a destination off is not forgetting how it was configured. It stays here, and nothing is published to it.",
       "stateEnabled": "Publishing",
       "stateDisabled": "Switched off",
       "rowSummary": "{format}, into {target}",
       "rowUnknownFormat": "{format}, into {target} — a format this console does not know. Whether it can be published is this deployment’s own answer.",
+      "rowUnavailableFormat": "{format}, into {target} — this deployment does not build that format, so nothing is published here.",
       "primaryBadge": "Announced in Discord",
       "primaryNote": "Enabled destinations are written oldest first, and the link Sturnus posts in Discord is the first one’s. It does not move when a destination is renamed.",
       "save": "Save",
@@ -715,7 +721,7 @@
       "secretSet": "Store a credential",
       "secretReplace": "Replace the credential",
       "secretNeverShown": "Sturnus never shows a stored credential, here or anywhere: no route returns one. Replacing it and clearing it are the only two things that can be done to it, and each has a button of its own — an empty box rendered beside a stored credential is how one gets wiped by somebody correcting a typo in a name.",
-      "secretUnused": "None of the formats above reads a stored credential yet: Outline is published with this deployment’s own Outline token, and the two file formats are written into this deployment’s own store. One set here is kept for the destinations that will read it.",
+      "secretUnused": "No format this deployment builds reads a stored credential yet: an Outline document is published with this deployment’s own Outline token, and a stored file is written into this deployment’s own store. One set here is kept for the destinations that will read it.",
       "secretInputLabel": "New credential",
       "secretSave": "Store it",
       "secretSaving": "Storing…",
@@ -728,10 +734,11 @@
       "nameEmpty": "A destination needs a name.",
       "nameTaken": "This server already has a destination with that name.",
       "formatEmpty": "Choose a format.",
+      "formatUnavailable": "This deployment does not build that format, so nothing would ever be published to this destination. Choose one it does build.",
       "targetEmpty": "A destination needs somewhere to write to.",
       "targetNotCollection": "An Outline collection id: no spaces in it, and no slash at the front.",
       "targetNotPrefix": "Letters, digits, dot, dash and underscore, separated by / — no slash at the front, none at the end, and no “..”.",
-      "errorRefused": "Sturnus refused that destination. This console offers the formats it believes this deployment builds, so a refusal here means the deployment’s own list differs from it.",
+      "errorRefused": "Sturnus refused that destination. The list of formats this page is holding is older than the deployment that answered — reload the page and try again.",
       "errorSession": "Your session has ended. Sign in again, then retry — nothing was written.",
       "errorGone": "Sturnus no longer knows this server or this destination, or you no longer administer it — it answers the same way to all three. Reload the page.",
       "errorDuplicate": "This server already has a destination with that name.",
diff --git a/console/test/exportTargets.spec.ts b/console/test/exportTargets.spec.ts
index 6f366b4..750aaff 100644
--- a/console/test/exportTargets.spec.ts
+++ b/console/test/exportTargets.spec.ts
@@ -14,10 +14,11 @@ import { resolve } from 'node:path'
 import { describe, expect, it } from 'vitest'
 
 import {
-  EXPORT_FORMATS,
   FORMAT_HTML,
   FORMAT_MARKDOWN,
   FORMAT_OUTLINE,
+  SINK_OBJECT_STORE,
+  SINK_OUTLINE,
   acceptsTarget,
   canSubmitSecret,
   describeTargetError,
@@ -29,9 +30,11 @@ import {
   enabledTargetCount,
   fallbackNote,
   formatChoices,
+  formatLabelKey,
   formatSpec,
   isDraftReady,
   orderTargets,
+  parseFormats,
   parseTarget,
   parseTargets,
   primaryTarget,
@@ -43,6 +46,7 @@ import {
   targetSummary,
   targetsPath,
   type ExportTarget,
+  type FormatInfo,
 } from '../app/utils/exportTargets'
 import type { Message } from '../app/utils/message'
 
@@ -76,6 +80,23 @@ function keysIn(message: Message): string[] {
   return found
 }
 
+/**
+ * What `GET /api/export-formats` says on a deployment built as this one is.
+ *
+ * A fixture rather than a constant imported from the module under test,
+ * which is the whole point of the change these tests cover: the console
+ * holds no list any more, so every one of these assertions has to be handed
+ * the deployment's answer the way the page is handed it. A test that
+ * imported the list would be testing the old design.
+ */
+const CATALOGUE: readonly FormatInfo[] = [
+  { name: FORMAT_OUTLINE, available: true, sink: SINK_OUTLINE },
+  { name: FORMAT_MARKDOWN, available: true, sink: SINK_OBJECT_STORE },
+  { name: FORMAT_HTML, available: true, sink: SINK_OBJECT_STORE },
+  { name: 'pdf', available: false, sink: null },
+  { name: 'confluence', available: false, sink: null },
+]
+
 function target(over: Partial<ExportTarget> = {}): ExportTarget {
   return {
     id: 1,
@@ -165,69 +186,164 @@ describe('reading what the API sent', () => {
   })
 })
 
-describe('which formats are offered', () => {
-  it('offers exactly the three this deployment builds', () => {
-    // `pdf` and `confluence` are specified and deliberately not built, and
-    // configuring one answers 400 with the list of what may be configured
-    // instead. An option a save refuses is not an option.
-    expect(EXPORT_FORMATS.map((entry) => entry.name)).toEqual([
-      FORMAT_OUTLINE,
-      FORMAT_MARKDOWN,
-      FORMAT_HTML,
-    ])
+describe('reading the format catalogue', () => {
+  it('keeps the order the API sent, because the first row is the ordinary choice', () => {
+    const parsed = parseFormats({
+      formats: [
+        { name: 'outline', available: true, sink: 'outline' },
+        { name: 'html', available: true, sink: 'object_store' },
+        { name: 'pdf', available: false, sink: null },
+      ],
+    })
+    expect(parsed.map((entry) => entry.name)).toEqual(['outline', 'html', 'pdf'])
   })
 
-  it('offers no row for a format the API would refuse', () => {
-    // The argument, stated as an assertion: absent, not disabled. The
-    // opposite choice — an inert "PDF (coming soon)" row — is what the
-    // account menu does for two-factor authentication, and the reason it
-    // is wrong here is that this is a form field and the console cannot
-    // see the deployment's registry to know when the row would stop being
-    // true.
-    const values = formatChoices((key) => key).map((option) => option.value)
-    expect(values).not.toContain('pdf')
-    expect(values).not.toContain('confluence')
-    expect(formatSpec('pdf')).toBeNull()
+  it('reads a missing or unknown sink as none rather than guessing one', () => {
+    // The address field follows the sink family. A default here would put
+    // an object-store rule under a field nobody has said takes one.
+    const parsed = parseFormats({
+      formats: [{ name: 'pdf', available: false }, { name: 'zip', available: true, sink: 'tape' }],
+    })
+    expect(parsed.map((entry) => entry.sink)).toEqual([null, null])
+  })
+
+  it('treats a format as unavailable unless the API said otherwise', () => {
+    // Absent is false rather than true, the same way `enabled` is on a
+    // destination: a format this console cannot tell the state of is better
+    // drawn as not buildable — the reader is told to reload — than offered
+    // and then refused on save.
+    expect(parseFormats({ formats: [{ name: 'pdf' }] })[0]!.available).toBe(false)
+  })
+
+  it('drops a row with no name and keeps everything else', () => {
+    // There is nothing to store or to render for a nameless format.
+    const parsed = parseFormats({ formats: [{ available: true }, { name: '  ' }, { name: 'html' }] })
+    expect(parsed.map((entry) => entry.name)).toEqual(['html'])
+  })
+
+  it('answers an empty list for a payload of the wrong shape', () => {
+    // Which the page reports as "the catalogue could not be read", never as
+    // "this deployment publishes nothing".
+    for (const payload of [null, undefined, 'no', 42, {}, { formats: 'no' }]) {
+      expect(parseFormats(payload)).toEqual([])
+    }
   })
+})
 
-  it('offers a stored format it has never heard of, rather than dropping it', () => {
-    // The day this deployment adds `pdf` to its registry, a destination
-    // configured for it must survive being renamed. A picker that omitted
-    // the stored value would render as though `outline` were chosen and
-    // rewrite the destination to `outline` on the next save.
-    const values = formatChoices((key) => key, 'pdf').map((option) => option.value)
-    expect(values).toEqual([FORMAT_OUTLINE, FORMAT_MARKDOWN, FORMAT_HTML, 'pdf'])
+describe('which formats are offered', () => {
+  it('offers exactly what the deployment reported, in the order it reported them', () => {
+    // The property this whole change exists for. There is no list in the
+    // console any more, so there is nothing here that can disagree with the
+    // registry.
+    const values = formatChoices((key) => key, CATALOGUE).map((option) => option.value)
+    expect(values).toEqual([FORMAT_OUTLINE, FORMAT_MARKDOWN, FORMAT_HTML, 'pdf', 'confluence'])
+  })
+
+  it('renders a format this build cannot run as a disabled row saying so', () => {
+    // The decision #150 could not take. It argued for absence, and the
+    // decisive half of the argument was that the console could not see the
+    // registry — so a "PDF, not built" row would have been a claim about a
+    // build it could not inspect, still being made after `pdf` was built.
+    // It can see it now. What is left is that PDF exists and this
+    // deployment does not build it, which is what somebody who came here
+    // looking for PDF needs told rather than left to infer from a gap.
+    const row = formatChoices((key) => key, CATALOGUE).find((option) => option.value === 'pdf')!
+    expect(row.disabled).toBe(true)
+    expect(row.detail).toBe('admin.destinations.formatUnavailableDetail')
+  })
+
+  it('leaves every buildable format choosable', () => {
+    const options = formatChoices((key) => key, CATALOGUE)
+    for (const name of [FORMAT_OUTLINE, FORMAT_MARKDOWN, FORMAT_HTML]) {
+      expect(options.find((option) => option.value === name)!.disabled).toBe(false)
+    }
   })
 
-  it('does not add a second row for a stored format it does know', () => {
-    const values = formatChoices((key) => key, FORMAT_HTML).map((option) => option.value)
-    expect(values).toEqual([FORMAT_OUTLINE, FORMAT_MARKDOWN, FORMAT_HTML])
+  it('leaves the stored format choosable even where the build cannot run it', () => {
+    // A disabled row is a fact stated; a disabled row that the control's
+    // own value sits on is a picker pointing at something it may not
+    // select, which is how the wrong value gets reported silently.
+    const row = formatChoices((key) => key, CATALOGUE, 'pdf').find(
+      (option) => option.value === 'pdf',
+    )!
+    expect(row.disabled).toBe(false)
+  })
+
+  it('offers a stored format the catalogue never mentioned, rather than dropping it', () => {
+    // #150's rule, and it matters more now rather than less: the reported
+    // list can arrive empty because the request failed. A picker that
+    // omitted the stored value would render as though the first row were
+    // chosen and rewrite the destination to it on the next save.
+    const values = formatChoices((key) => key, CATALOGUE, 'zip').map((option) => option.value)
+    expect(values.at(-1)).toBe('zip')
+    const row = formatChoices((key) => key, CATALOGUE, 'zip').at(-1)!
+    expect(row.label).toBe('zip')
+    expect(row.detail).toBe('admin.destinations.formatUnknownDetail')
+    expect(row.disabled).toBeFalsy()
+  })
+
+  it('keeps the stored format even when the catalogue could not be read at all', () => {
+    // The worst version of this page: a timed-out request read as "this
+    // deployment supports nothing", and every destination rewritten on the
+    // next save.
+    const values = formatChoices((key) => key, [], FORMAT_HTML).map((option) => option.value)
+    expect(values).toEqual([FORMAT_HTML])
+  })
+
+  it('does not add a second row for a stored format the catalogue reports', () => {
+    const values = formatChoices((key) => key, CATALOGUE, FORMAT_HTML).map(
+      (option) => option.value,
+    )
+    expect(values).toEqual([FORMAT_OUTLINE, FORMAT_MARKDOWN, FORMAT_HTML, 'pdf', 'confluence'])
   })
 
-  it('labels a stored unknown format with its own raw name', () => {
-    // There is no key for a word this console has never seen, and
-    // inventing a friendly one would be the console guessing at somebody
-    // else's release note.
-    const row = formatChoices((key) => key, 'confluence').at(-1)!
-    expect(row.label).toBe('confluence')
+  it('labels a format it has no word for with that format’s own raw name', () => {
+    // The API has no message catalogue, so the words stay here — and a
+    // format this deployment builds that this console has never been taught
+    // a word for renders as itself rather than as nothing.
+    const row = formatChoices((key) => key, [{ name: 'zip', available: true, sink: null }]).at(0)!
+    expect(row.label).toBe('zip')
+    expect(formatLabelKey('zip')).toBeNull()
+    expect(formatLabelKey(FORMAT_OUTLINE)).toBe('common.formatOutline')
   })
 
-  it('asks each format for a different address, and says so differently', () => {
+  it('asks each sink family for a different address, and says so differently', () => {
     // Outline wants a collection id and the object store wants a key
     // prefix. A form that showed the union of every field would ask for
-    // both.
-    expect(formatSpec(FORMAT_OUTLINE)!.targetKind).toBe('collection')
-    expect(formatSpec(FORMAT_MARKDOWN)!.targetKind).toBe('prefix')
-    expect(formatSpec(FORMAT_HTML)!.targetKind).toBe('prefix')
+    // both. Decided by family and never by name, so a format built tomorrow
+    // gets the right field with nothing added here.
+    expect(formatSpec(FORMAT_OUTLINE, CATALOGUE)!.targetLabelKey).toBe(
+      'admin.destinations.collectionLabel',
+    )
+    expect(formatSpec(FORMAT_MARKDOWN, CATALOGUE)!.targetLabelKey).toBe(
+      'admin.destinations.prefixLabel',
+    )
+    expect(formatSpec(FORMAT_HTML, CATALOGUE)!.targetLabelKey).toBe(
+      'admin.destinations.prefixLabel',
+    )
+  })
+
+  it('says nothing about the address of a format that has no sink', () => {
+    // Nothing in the API has decided what would carry a PDF, so nothing
+    // here may render a field claiming to know.
+    const spec = formatSpec('pdf', CATALOGUE)!
+    expect(spec.sink).toBeNull()
+    expect(spec.targetLabelKey).toBeNull()
+    expect(spec.noteKey).toBeNull()
+  })
+
+  it('has no spec at all for a format the catalogue does not report', () => {
+    expect(formatSpec('zip', CATALOGUE)).toBeNull()
+    expect(formatSpec(FORMAT_OUTLINE, [])).toBeNull()
   })
 
   it('knows which formats this deployment can serve back and which it cannot', () => {
     // An Outline document's bytes live in Outline; the object-store ones
     // are served under the session's own rule. `routes_documents` decides
     // the same thing from the same registry.
-    expect(formatSpec(FORMAT_OUTLINE)!.readable).toBe(false)
-    expect(formatSpec(FORMAT_MARKDOWN)!.readable).toBe(true)
-    expect(formatSpec(FORMAT_HTML)!.readable).toBe(true)
+    expect(formatSpec(FORMAT_OUTLINE, CATALOGUE)!.readable).toBe(false)
+    expect(formatSpec(FORMAT_MARKDOWN, CATALOGUE)!.readable).toBe(true)
+    expect(formatSpec(FORMAT_HTML, CATALOGUE)!.readable).toBe(true)
   })
 })
 
@@ -235,30 +351,34 @@ describe('what a format will accept as an address', () => {
   it('takes an Outline collection id and refuses whitespace in it', () => {
     // The API's `_OUTLINE_TARGET`. What it excludes is a paste that went
     // wrong; the failure otherwise is an unexplained 404 from Outline.
-    expect(acceptsTarget(FORMAT_OUTLINE, 'c0ffee-1234')).toBe(true)
-    expect(acceptsTarget(FORMAT_OUTLINE, 'two words')).toBe(false)
-    expect(acceptsTarget(FORMAT_OUTLINE, ' leading')).toBe(false)
-    expect(acceptsTarget(FORMAT_OUTLINE, '/slashfirst')).toBe(false)
-    expect(acceptsTarget(FORMAT_OUTLINE, '')).toBe(false)
+    expect(acceptsTarget(FORMAT_OUTLINE, 'c0ffee-1234', CATALOGUE)).toBe(true)
+    expect(acceptsTarget(FORMAT_OUTLINE, 'two words', CATALOGUE)).toBe(false)
+    expect(acceptsTarget(FORMAT_OUTLINE, ' leading', CATALOGUE)).toBe(false)
+    expect(acceptsTarget(FORMAT_OUTLINE, '/slashfirst', CATALOGUE)).toBe(false)
+    expect(acceptsTarget(FORMAT_OUTLINE, '', CATALOGUE)).toBe(false)
   })
 
   it('takes an object-store prefix and refuses one that could traverse', () => {
     // The API's `_OBJECT_PREFIX`. `..` cannot appear because a dot may not
     // follow a dot; a leading slash is a key nobody meant to write.
-    expect(acceptsTarget(FORMAT_MARKDOWN, 'minutes/2026')).toBe(true)
-    expect(acceptsTarget(FORMAT_HTML, 'a_b-c.d/e')).toBe(true)
-    expect(acceptsTarget(FORMAT_MARKDOWN, '../secrets')).toBe(false)
-    expect(acceptsTarget(FORMAT_MARKDOWN, '/leading')).toBe(false)
-    expect(acceptsTarget(FORMAT_MARKDOWN, 'trailing/')).toBe(false)
-    expect(acceptsTarget(FORMAT_MARKDOWN, 'a b')).toBe(false)
-  })
-
-  it('accepts anything non-empty for a format it has no pattern for', () => {
-    // This console has no pattern for a format it has never heard of, and
-    // inventing one would refuse a target the deployment is perfectly
-    // happy with.
-    expect(acceptsTarget('pdf', 'whatever a pdf target is')).toBe(true)
-    expect(acceptsTarget('pdf', '  ')).toBe(false)
+    expect(acceptsTarget(FORMAT_MARKDOWN, 'minutes/2026', CATALOGUE)).toBe(true)
+    expect(acceptsTarget(FORMAT_HTML, 'a_b-c.d/e', CATALOGUE)).toBe(true)
+    expect(acceptsTarget(FORMAT_MARKDOWN, '../secrets', CATALOGUE)).toBe(false)
+    expect(acceptsTarget(FORMAT_MARKDOWN, '/leading', CATALOGUE)).toBe(false)
+    expect(acceptsTarget(FORMAT_MARKDOWN, 'trailing/', CATALOGUE)).toBe(false)
+    expect(acceptsTarget(FORMAT_MARKDOWN, 'a b', CATALOGUE)).toBe(false)
+  })
+
+  it('accepts anything non-empty for a format with no reported sink', () => {
+    // This console has no pattern for a format the deployment named no sink
+    // family for, and inventing one would refuse a target the deployment is
+    // perfectly happy with. Three situations reach this and all three want
+    // the same answer: unbuilt, never reported, and a catalogue that could
+    // not be read.
+    expect(acceptsTarget('pdf', 'whatever a pdf target is', CATALOGUE)).toBe(true)
+    expect(acceptsTarget('pdf', '  ', CATALOGUE)).toBe(false)
+    expect(acceptsTarget('zip', 'anything at all', CATALOGUE)).toBe(true)
+    expect(acceptsTarget(FORMAT_MARKDOWN, '../secrets', [])).toBe(true)
   })
 })
 
@@ -362,8 +482,13 @@ describe('the credential', () => {
     // credential, saved along with the rest of the form, silently wiping a
     // token every time somebody corrects a typo in a name. It is not
     // merely avoided, it is unrepresentable — there is no field.
-    expect(Object.keys(emptyDraft()).sort()).toEqual(['enabled', 'format', 'name', 'target'])
-    expect(Object.keys(draftBody(emptyDraft())).sort()).toEqual([
+    expect(Object.keys(emptyDraft(CATALOGUE)).sort()).toEqual([
+      'enabled',
+      'format',
+      'name',
+      'target',
+    ])
+    expect(Object.keys(draftBody(emptyDraft(CATALOGUE))).sort()).toEqual([
       'config',
       'enabled',
       'format',
@@ -373,19 +498,80 @@ describe('the credential', () => {
   })
 })
 
+describe('a blank draft', () => {
+  it('opens on the first format the deployment says it can run', () => {
+    // Not on a name this file used to hold. On every deployment shipped so
+    // far that is `outline` — what every guild configured before this page
+    // existed — but it is that because the API says so.
+    expect(emptyDraft(CATALOGUE).format).toBe(FORMAT_OUTLINE)
+  })
+
+  it('never opens on a format the deployment cannot run', () => {
+    expect(emptyDraft([
+      { name: 'pdf', available: false, sink: null },
+      { name: FORMAT_HTML, available: true, sink: SINK_OBJECT_STORE },
+    ]).format).toBe(FORMAT_HTML)
+  })
+
+  it('opens on nothing when the catalogue could not be read', () => {
+    // Blank rather than a guess: the reader is then looking at the truth —
+    // this console does not currently know what may be chosen — instead of
+    // at a default a save would refuse.
+    expect(emptyDraft([]).format).toBe('')
+    expect(problemFor(draftProblems(emptyDraft([]), [], []), 'format')?.key).toBe(
+      'admin.destinations.formatEmpty',
+    )
+  })
+})
+
 describe('what is wrong with a draft', () => {
   it('is happy with a complete one', () => {
-    expect(draftProblems({ format: FORMAT_OUTLINE, name: 'Wiki', target: 'c0ffee', enabled: true }))
-      .toEqual([])
-    expect(isDraftReady(draftOf(target()))).toBe(true)
+    expect(draftProblems(
+      { format: FORMAT_OUTLINE, name: 'Wiki', target: 'c0ffee', enabled: true },
+      [],
+      CATALOGUE,
+    )).toEqual([])
+    expect(isDraftReady(draftOf(target()), [], CATALOGUE)).toBe(true)
+  })
+
+  it('refuses a format the deployment reported it cannot run', () => {
+    // The rule that could not be stated before `/api/export-formats`
+    // existed. It is the other half of rendering the row at all: the row
+    // says PDF is not built, and this stops Save on a draft that names it,
+    // with the reason beside the field instead of arriving as a bare 400.
+    const problems = draftProblems(
+      { format: 'pdf', name: 'Paper', target: 'minutes', enabled: true },
+      [],
+      CATALOGUE,
+    )
+    expect(problemFor(problems, 'format')?.key).toBe('admin.destinations.formatUnavailable')
+    expect(isDraftReady(
+      { format: 'pdf', name: 'Paper', target: 'minutes', enabled: true }, [], CATALOGUE,
+    )).toBe(false)
+  })
+
+  it('does not refuse a format merely because the catalogue never mentioned it', () => {
+    // "This console has not been told about it" is evidence of nothing. An
+    // unreadable catalogue must not make every stored destination look like
+    // a broken configuration.
+    const problems = draftProblems(
+      { format: 'zip', name: 'Archive', target: 'minutes', enabled: true },
+      [],
+      CATALOGUE,
+    )
+    expect(problemFor(problems, 'format')).toBeNull()
+    expect(isDraftReady(draftOf(target({ format: 'zip' })), [], [])).toBe(true)
   })
 
   it('refuses a name that is blank or only spaces', () => {
     // `_BAD_NAME` in the API: a non-empty string after stripping.
-    expect(problemFor(draftProblems({ ...emptyDraft(), target: 'c0ffee' }), 'name')?.key).toBe(
-      'admin.destinations.nameEmpty',
+    expect(problemFor(
+      draftProblems({ ...emptyDraft(CATALOGUE), target: 'c0ffee' }, [], CATALOGUE),
+      'name',
+    )?.key).toBe('admin.destinations.nameEmpty')
+    const spaces = draftProblems(
+      { ...emptyDraft(CATALOGUE), name: '   ', target: 'c0ffee' }, [], CATALOGUE,
     )
-    const spaces = draftProblems({ ...emptyDraft(), name: '   ', target: 'c0ffee' })
     expect(problemFor(spaces, 'name')?.key).toBe('admin.destinations.nameEmpty')
   })
 
@@ -395,6 +581,7 @@ describe('what is wrong with a draft', () => {
     const problems = draftProblems(
       { format: FORMAT_OUTLINE, name: 'Wiki', target: 'c0ffee', enabled: true },
       ['Wiki', 'Archive'],
+      CATALOGUE,
     )
     expect(problemFor(problems, 'name')?.key).toBe('admin.destinations.nameTaken')
   })
@@ -406,26 +593,26 @@ describe('what is wrong with a draft', () => {
     const stored = target({ id: 4, name: 'Wiki' })
     const others = target({ id: 5, name: 'Archive' })
     expect(takenNames([stored, others], 4)).toEqual(['Archive'])
-    expect(isDraftReady(draftOf(stored), takenNames([stored, others], 4))).toBe(true)
+    expect(isDraftReady(draftOf(stored), takenNames([stored, others], 4), CATALOGUE)).toBe(true)
   })
 
   it('names the field each complaint is about', () => {
     // So the page can put it beside that field rather than in a list of
     // grievances at the bottom.
-    const problems = draftProblems({ format: '', name: '', target: '', enabled: true })
+    const problems = draftProblems({ format: '', name: '', target: '', enabled: true }, [], CATALOGUE)
     expect(problems.map((problem) => problem.field)).toEqual(['name', 'format', 'target'])
   })
 
   it('says the address is wrong in the words of the format that refused it', () => {
     // "Not a collection id" and "not an object prefix" are different
     // sentences, because they are different mistakes.
-    const outline = draftProblems({
-      format: FORMAT_OUTLINE, name: 'Wiki', target: 'two words', enabled: true,
-    })
+    const outline = draftProblems(
+      { format: FORMAT_OUTLINE, name: 'Wiki', target: 'two words', enabled: true }, [], CATALOGUE,
+    )
     expect(problemFor(outline, 'target')?.key).toBe('admin.destinations.targetNotCollection')
-    const markdown = draftProblems({
-      format: FORMAT_MARKDOWN, name: 'Bucket', target: '../up', enabled: true,
-    })
+    const markdown = draftProblems(
+      { format: FORMAT_MARKDOWN, name: 'Bucket', target: '../up', enabled: true }, [], CATALOGUE,
+    )
     expect(problemFor(markdown, 'target')?.key).toBe('admin.destinations.targetNotPrefix')
   })
 
@@ -491,14 +678,25 @@ describe('when a write does not work', () => {
 describe('the sentences this module names', () => {
   /** Every key any function here can return, gathered by calling them. */
   const KEYS = [
-    ...EXPORT_FORMATS.flatMap((entry) => [
-      entry.labelKey, entry.noteKey, entry.targetLabelKey, entry.targetHintKey,
-    ]),
+    // Every word this console has for a format, and every sentence a sink
+    // family carries. Gathered from the catalogue rather than from a list
+    // in the module, which is what makes this check follow a format the
+    // deployment adds instead of one somebody remembered to add here.
+    ...CATALOGUE.flatMap((entry) => {
+      const spec = formatSpec(entry.name, CATALOGUE)!
+      return [spec.labelKey, spec.noteKey, spec.targetLabelKey, spec.targetHintKey]
+    }).filter((key): key is string => key !== null),
     'admin.destinations.formatUnknownDetail',
+    'admin.destinations.formatUnavailableDetail',
+    'admin.destinations.formatsNote',
+    'admin.destinations.formatsUnavailable',
+    'admin.destinations.addressLabel',
+    'admin.destinations.addressHint',
     enabledLabelKey(target()),
     enabledLabelKey(target({ enabled: false })),
-    ...keysIn(targetSummary(target())),
-    ...keysIn(targetSummary(target({ format: 'pdf' }))),
+    ...keysIn(targetSummary(target(), CATALOGUE)),
+    ...keysIn(targetSummary(target({ format: 'pdf' }), CATALOGUE)),
+    ...keysIn(targetSummary(target({ format: 'zip' }), CATALOGUE)),
     ...keysIn(fallbackNote([])),
     ...keysIn(fallbackNote([target()])),
     ...Object.values(secretState(target({ hasSecret: true }))).filter(
@@ -507,15 +705,19 @@ describe('the sentences this module names', () => {
     ...Object.values(secretState(target({ hasSecret: false }))).filter(
       (value): value is string => typeof value === 'string',
     ),
-    ...draftProblems({ format: '', name: '', target: '', enabled: true })
+    ...draftProblems({ format: '', name: '', target: '', enabled: true }, [], CATALOGUE)
       .flatMap((problem) => keysIn(problem.message)),
     ...draftProblems(
       { format: FORMAT_OUTLINE, name: 'Wiki', target: 'two words', enabled: true },
       ['Wiki'],
+      CATALOGUE,
+    ).flatMap((problem) => keysIn(problem.message)),
+    ...draftProblems(
+      { format: FORMAT_MARKDOWN, name: 'Bucket', target: '../up', enabled: true }, [], CATALOGUE,
+    ).flatMap((problem) => keysIn(problem.message)),
+    ...draftProblems(
+      { format: 'pdf', name: 'Paper', target: 'minutes', enabled: true }, [], CATALOGUE,
     ).flatMap((problem) => keysIn(problem.message)),
-    ...draftProblems({
-      format: FORMAT_MARKDOWN, name: 'Bucket', target: '../up', enabled: true,
-    }).flatMap((problem) => keysIn(problem.message)),
     ...[400, 401, 404, 409, 0, 500].flatMap((status) =>
       keysIn(describeTargetError({ status }))),
   ]
diff --git a/console/test/sessionDocuments.spec.ts b/console/test/sessionDocuments.spec.ts
index 4033566..c210511 100644
--- a/console/test/sessionDocuments.spec.ts
+++ b/console/test/sessionDocuments.spec.ts
@@ -97,11 +97,26 @@ describe('reading the listing', () => {
     // document that renders as nothing is worse than one that renders as
     // its own raw name.
     const [row] = parseSessionDocuments({
-      documents: [{ target_id: 1, provider: 'pdf', url: 'https://example/x.pdf' }],
+      documents: [{ target_id: 1, provider: 'zip', url: 'https://example/x.zip' }],
     })
     const rendered = protocolRow(row!)
     expect(rendered.label.key).toBe('recordings.protocolUnknownFormat')
-    expect(rendered.label.params?.format).toBe('pdf')
+    expect(rendered.label.params?.format).toBe('zip')
+  })
+
+  it('names a format it has a word for even where this build cannot publish it', () => {
+    // `pdf` is specified and unbuilt, so no destination here can be
+    // configured for it — but a document published by a deployment that
+    // *did* build it is still a document with a working link, and this page
+    // renders what was published rather than what could be published now.
+    // That is why it asks `~/utils/exportTargets` for the word alone and
+    // never for the catalogue.
+    const [row] = parseSessionDocuments({
+      documents: [{ target_id: 1, provider: 'pdf', url: 'https://example/x.pdf' }],
+    })
+    const rendered = protocolRow(row!)
+    expect(rendered.label.key).toBe('recordings.protocolFormat')
+    expect(rendered.label.params?.format).toEqual({ key: 'common.formatPdf' })
   })
 
   it('answers an empty list for a payload of the wrong shape', () => {
diff --git a/src/sturnus/application/export_formats.py b/src/sturnus/application/export_formats.py
index 6fca77d..8f72724 100644
--- a/src/sturnus/application/export_formats.py
+++ b/src/sturnus/application/export_formats.py
@@ -38,6 +38,15 @@
 the refusal, not accepted and then silently skipped after every meeting.
 When either is built it belongs behind this registry and needs no other
 change.
+
+Absent from `FORMATS`, but **named in `UNBUILT` and reported by
+`catalogue`**. "Which formats exist" and "which of them this build can run"
+are two questions, and until an interface could ask the second it had to
+answer both by hard-coding a list of its own -- which is how the console
+came to hold three separate restatements of this paragraph, each of which
+building `pdf` would have quietly falsified. Moving a name from `UNBUILT`
+into `FORMATS` is now the one edit, in this one file, that the paragraph
+above always claimed it would be.
 """
 
 from __future__ import annotations
@@ -314,3 +323,85 @@ def supported_formats() -> tuple[str, ...]:
     than being left to guess.
     """
     return tuple(FORMATS)
+
+
+# ---------------------------------------------------------------------------
+# The catalogue: what exists, and what this build can run
+# ---------------------------------------------------------------------------
+
+#: The formats the specification names (spec §3.4) and this build does not
+#: implement. Names rather than entries, because an entry is a renderer
+#: paired with a sink and there is neither: writing `pdf` here would be
+#: this module claiming a fact about bytes nothing can produce.
+#:
+#: **Kept beside `FORMATS` rather than in the console, in the API layer, or
+#: in a sentence in a locale file**, and that is the whole reason this
+#: constant exists. `pdf` and `confluence` were documented as unbuilt in
+#: this module's docstring, restated as an absence in the console's own
+#: format list, and restated a third time as English prose under the format
+#: picker. Three copies of one fact, and building `pdf` would have made
+#: liars of the second and third with nothing failing. Moving a name out of
+#: here and into `FORMATS` is now the single edit the module docstring
+#: always promised it would be, and every reader of `catalogue` follows.
+UNBUILT: Final[tuple[str, ...]] = (
+    #: A large native dependency in an image that today holds Python and a
+    #: Whisper model -- a decision about attack surface and image size.
+    "pdf",
+    #: A second wiki API, with its own auth, its own document model and its
+    #: own idea of what a page is.
+    "confluence",
+)
+
+
+@dataclass(frozen=True, slots=True)
+class CatalogueEntry:
+    """One format as somebody outside this process may be told about it.
+
+    Deliberately not `ExportFormat`. That record holds a callable, a media
+    type and a compiled pattern -- everything the *publisher* needs and
+    nothing a reader asking "what may I configure?" can use. This is the
+    other question, and it has three answers in it and no more:
+
+    - `name`, which is what `guild_export_target.format` stores;
+    - `available`, whether this build can actually run it -- the fact no
+      caller outside this process has ever been able to obtain, and the
+      reason `catalogue` exists at all;
+    - `sink`, the family that carries the bytes, which is what decides
+      whether a `target` is an address in Outline or a key prefix in an
+      object store. It is `None` for an unbuilt format, and honestly so:
+      nothing here has decided what would carry a PDF, and naming a family
+      for one would be inventing the answer rather than reporting it.
+
+    No media type and no file extension. They are read by the object-store
+    sink and by the route that serves an artefact back, both of which are
+    inside this process and both of which read `ExportFormat` directly.
+    """
+
+    name: str
+    available: bool
+    sink: str | None
+
+
+def catalogue() -> tuple[CatalogueEntry, ...]:
+    """Every format this deployment knows of, buildable or not.
+
+    `supported_formats` answers "what may be configured"; this answers
+    "what exists, and which of it works here", which is a strictly larger
+    question and the one an interface has to render. A console that can
+    only see the first has to guess at the difference between *not offered*
+    and *not built*, and the only way to guess is to hard-code a second
+    list that this module has no way to correct.
+
+    Buildable entries first, in registry order, then the unbuilt ones.
+    Order is part of the answer: `FORMATS` is ordered so that `outline` --
+    what every guild published to before any of the others existed -- comes
+    first, and a reader offered a list of choices reads the first one as
+    the ordinary one.
+    """
+    return tuple(
+        [
+            CatalogueEntry(name=entry.name, available=True, sink=entry.sink)
+            for entry in FORMATS.values()
+        ]
+        + [CatalogueEntry(name=name, available=False, sink=None) for name in UNBUILT]
+    )
diff --git a/src/sturnus/console/routes_exports.py b/src/sturnus/console/routes_exports.py
index af917da..ebad6be 100644
--- a/src/sturnus/console/routes_exports.py
+++ b/src/sturnus/console/routes_exports.py
@@ -1,5 +1,6 @@
-"""Where a guild publishes: five routes, one authorisation rule, and no secret out.
+"""Where a guild publishes: six routes, one authorisation rule, and no secret out.
 
+- `GET    /api/export-formats`
 - `GET    /api/guilds/{guild_id}/export-targets`
 - `POST   /api/guilds/{guild_id}/export-targets`
 - `PUT    /api/guilds/{guild_id}/export-targets/{target_id}`
@@ -36,6 +37,23 @@
 in this file -- and one that is specified but not built (`pdf`,
 `confluence`) is refused where an administrator can read the refusal rather
 than accepted and silently skipped after every meeting.
+
+**`GET /api/export-formats` is that same answer said before the refusal
+instead of after it.** It is the one route here that is not about a guild,
+and it is here rather than in a module of its own because it reads the
+registry these five routes enforce: a caller cannot be told what
+`_requested_target` will accept by any list except the one it accepts from.
+It carries the unbuilt names too, marked unavailable -- see
+`export_formats.catalogue`. A reader that was told only the buildable
+three would have to invent the difference between *not offered* and *not
+built*, and inventing it means hard-coding a list this deployment has no
+way to correct.
+
+**No audit line, and nothing per-caller in the answer.** Every other route
+in this file either writes or reads a guild's own configuration; this one
+reads a compiled-in constant that is identical for every administrator of
+every guild on this deployment, so there is nothing an access record could
+establish and no guild id to scope one to.
 """
 
 from __future__ import annotations
@@ -46,7 +64,12 @@
 
 from aiohttp import web
 
-from sturnus.application.export_formats import format_named, supported_formats
+from sturnus.application.export_formats import (
+    CatalogueEntry,
+    catalogue,
+    format_named,
+    supported_formats,
+)
 from sturnus.console.ports import ExportTargets
 from sturnus.domain.exports import ExportTarget
 from sturnus.observability.events import Event, log_event
@@ -57,6 +80,10 @@
 #: `register`, matching `routes_settings.SETTINGS_STORE`.
 EXPORT_TARGETS: web.AppKey[ExportTargets] = web.AppKey("export_targets")
 
+#: The one route here that names no guild. Every format on it is the same
+#: for every guild on this deployment, which is why it is not under one.
+_FORMATS_PATH = "/api/export-formats"
+
 _PATH = "/api/guilds/{guild_id}/export-targets"
 _TARGET_PATH = "/api/guilds/{guild_id}/export-targets/{target_id}"
 _SECRET_PATH = "/api/guilds/{guild_id}/export-targets/{target_id}/secret"
@@ -94,6 +121,12 @@ def register(app: web.Application) -> None:
 
     app.add_routes(
         [
+            # Behind a session like everything else, though it holds no
+            # secret and names no guild. `routes_setup.register` makes the
+            # argument for the invite link and it is the same one: public
+            # is not the same as unauthenticated, and an endpoint of this
+            # API that answered without a session would be the only one.
+            web.get(_FORMATS_PATH, require_session(list_formats)),
             web.get(_PATH, require_session(list_targets)),
             web.post(_PATH, require_session(create_target)),
             web.put(_TARGET_PATH, require_session(update_target)),
@@ -107,6 +140,25 @@ def register(app: web.Application) -> None:
     )
 
 
+def format_json(entry: CatalogueEntry) -> dict[str, Any]:
+    """One format, as a caller deciding what to configure may be told it.
+
+    Three fields, and the case for stopping at three is that a fourth
+    would have to be invented here. `media_type` and `file_extension` are
+    on `ExportFormat` and are read by the sink that stores the bytes and
+    by the route that serves them back -- neither of them a caller. A
+    label is a word in a language this process has no catalogue for. And
+    `target_pattern` is a Python regular expression: handing one to a
+    caller to compile is handing over a dialect, not a rule, and the rule
+    is enforced here whatever the caller believes.
+
+    `sink` is `null` for an unbuilt format rather than absent, so that "no
+    sink has been decided for this" and "this response forgot a field" are
+    different things on the wire.
+    """
+    return {"name": entry.name, "available": entry.available, "sink": entry.sink}
+
+
 def target_json(target: ExportTarget) -> dict[str, Any]:
     """One destination, as the console sees it.
 
@@ -139,6 +191,24 @@ def target_json(target: ExportTarget) -> dict[str, Any]:
 # ---------------------------------------------------------------------------
 
 
+async def list_formats(_request: web.Request) -> web.Response:
+    """Every format this deployment knows of, and which of them it can run.
+
+    The unbuilt ones are in the answer, marked `available: false`. Leaving
+    them out would make this endpoint say exactly what a 400's `supported`
+    list already said, and the reason that list was not enough is that a
+    reader who has to distinguish "not offered here" from "not built here"
+    can only do it by keeping a list of its own -- which is a second
+    registry, and a second registry is one that goes stale the day `pdf`
+    is built and nothing fails.
+
+    A list rather than a mapping, because the order is part of the answer:
+    `outline` is what every guild published to before the others existed,
+    and JSON object order is a thing implementations are entitled to lose.
+    """
+    return web.json_response({"formats": [format_json(entry) for entry in catalogue()]})
+
+
 async def list_targets(request: web.Request) -> web.Response:
     """Every destination of this guild, enabled or not.
 
diff --git a/tests/application/test_export_formats.py b/tests/application/test_export_formats.py
index 7575230..5f50506 100644
--- a/tests/application/test_export_formats.py
+++ b/tests/application/test_export_formats.py
@@ -113,6 +113,73 @@ def test_every_entry_names_a_sink_family_and_a_media_type() -> None:
         assert entry.file_extension
 
 
+# ---------------------------------------------------------------------------
+# The catalogue: what exists, and what this build can run
+# ---------------------------------------------------------------------------
+
+
+def test_the_catalogue_names_everything_the_specification_names() -> None:
+    """Five formats, not three. `supported_formats` answers "what may be
+    configured"; the catalogue answers "what exists", which is the question
+    an interface has to render and the larger of the two."""
+    assert {entry.name for entry in export_formats.catalogue()} == {
+        "outline",
+        "markdown",
+        "html",
+        "pdf",
+        "confluence",
+    }
+
+
+def test_a_format_this_build_runs_is_available_and_names_its_sink() -> None:
+    available = {entry.name: entry for entry in export_formats.catalogue() if entry.available}
+    assert set(available) == set(export_formats.supported_formats())
+    for name, entry in available.items():
+        assert entry.sink == export_formats.FORMATS[name].sink
+
+
+def test_an_unbuilt_format_is_reported_as_unavailable_with_no_sink() -> None:
+    """`sink` is `None` rather than a guess.
+
+    A sink family is what decides whether a `target` is an address in
+    Outline or a key prefix in an object store, and nothing here has
+    decided what would carry a PDF. Naming one would be this module
+    inventing an answer and every reader downstream believing it.
+    """
+    unbuilt = {entry.name: entry for entry in export_formats.catalogue() if not entry.available}
+    assert set(unbuilt) == set(export_formats.UNBUILT)
+    for entry in unbuilt.values():
+        assert entry.sink is None
+
+
+def test_no_name_is_both_buildable_and_unbuilt() -> None:
+    """The two halves of the catalogue are what a name is moved *between*
+    when a format is finally built. A name left in both would be reported
+    twice, and a console would render it as choosable and as refused at
+    once."""
+    assert set(export_formats.UNBUILT).isdisjoint(export_formats.FORMATS)
+
+
+def test_the_catalogue_offers_what_a_guild_already_publishes_to_first() -> None:
+    """Order is part of the answer: a reader offered a list reads the first
+    row as the ordinary one, and `outline` is what every guild published to
+    before any of the others existed."""
+    assert [entry.name for entry in export_formats.catalogue()][:3] == list(
+        export_formats.supported_formats()
+    )
+
+
+def test_the_catalogue_carries_no_renderer_and_no_media_type() -> None:
+    """It is the answer to "what may I configure?", and a caller asking
+    that can use none of it. `media_type` and the renderer are read inside
+    this process, from `ExportFormat`, by the sink and by the route that
+    serves an artefact back."""
+    entry = export_formats.catalogue()[0]
+    assert not hasattr(entry, "render")
+    assert not hasattr(entry, "media_type")
+    assert not hasattr(entry, "target_pattern")
+
+
 # ---------------------------------------------------------------------------
 # outline: today's behaviour, unchanged
 # ---------------------------------------------------------------------------
diff --git a/tests/console/test_export_routes.py b/tests/console/test_export_routes.py
index 773f8a3..9fcc040 100644
--- a/tests/console/test_export_routes.py
+++ b/tests/console/test_export_routes.py
@@ -426,6 +426,10 @@ async def test_every_route_refuses_a_request_with_no_session(
 ) -> None:
     client = await aiohttp_client(api())
     assert (await client.get(f"/api/guilds/{GUILD}/export-targets")).status == 401
+    # Including the format catalogue, which holds no secret and names no
+    # guild. Public is not the same as unauthenticated -- `routes_setup`
+    # makes the same argument for the invite link.
+    assert (await client.get("/api/export-formats")).status == 401
 
 
 # ---------------------------------------------------------------------------
@@ -433,6 +437,109 @@ async def test_every_route_refuses_a_request_with_no_session(
 # ---------------------------------------------------------------------------
 
 
+async def test_the_format_catalogue_names_every_format_the_specification_names(
+    aiohttp_client: AiohttpClientFactory, cookies: dict[str, str]
+) -> None:
+    """Five, not the three that may be configured.
+
+    The unbuilt ones are the whole reason this endpoint is not the 400's
+    `supported` list said earlier: a caller told only the buildable three
+    cannot tell "this deployment does not offer PDF" from "PDF is not a
+    thing", and the only way to tell is to keep a list of its own.
+    """
+    client = await aiohttp_client(api())
+    response = await client.get("/api/export-formats", cookies=cookies)
+    assert response.status == 200
+    body = await response.json()
+    assert [entry["name"] for entry in body["formats"]] == [
+        "outline",
+        "markdown",
+        "html",
+        "pdf",
+        "confluence",
+    ]
+
+
+async def test_a_buildable_format_is_available_and_names_its_sink_family(
+    aiohttp_client: AiohttpClientFactory, cookies: dict[str, str]
+) -> None:
+    """The sink family is what tells a caller whether `target` is an
+    address in Outline or a key prefix in an object store -- the one thing
+    beyond the name that an interface needs in order to ask for the right
+    field."""
+    client = await aiohttp_client(api())
+    body = await (await client.get("/api/export-formats", cookies=cookies)).json()
+    by_name = {entry["name"]: entry for entry in body["formats"]}
+    assert by_name["outline"] == {"name": "outline", "available": True, "sink": "outline"}
+    assert by_name["markdown"] == {
+        "name": "markdown",
+        "available": True,
+        "sink": "object_store",
+    }
+    assert by_name["html"] == {"name": "html", "available": True, "sink": "object_store"}
+
+
+async def test_an_unbuilt_format_is_reported_unavailable_with_a_null_sink(
+    aiohttp_client: AiohttpClientFactory, cookies: dict[str, str]
+) -> None:
+    """`null` rather than a missing key, so that "nothing has decided what
+    would carry a PDF" is distinguishable from a response that dropped a
+    field."""
+    client = await aiohttp_client(api())
+    body = await (await client.get("/api/export-formats", cookies=cookies)).json()
+    by_name = {entry["name"]: entry for entry in body["formats"]}
+    assert by_name["pdf"] == {"name": "pdf", "available": False, "sink": None}
+    assert by_name["confluence"] == {"name": "confluence", "available": False, "sink": None}
+
+
+async def test_the_catalogue_agrees_with_what_a_refusal_says_is_supported(
+    aiohttp_client: AiohttpClientFactory, cookies: dict[str, str]
+) -> None:
+    """The two answers come from one registry, and this is what keeps them
+    from becoming two. Anything the catalogue calls available must be
+    something a create accepts -- otherwise the endpoint is offering a
+    choice its neighbour refuses, which is the exact failure it exists to
+    remove."""
+    client = await aiohttp_client(api())
+    body = await (await client.get("/api/export-formats", cookies=cookies)).json()
+    available = {entry["name"] for entry in body["formats"] if entry["available"]}
+
+    refused = await client.post(
+        f"/api/guilds/{GUILD}/export-targets",
+        json=outline_body(format="pdf"),
+        cookies=cookies,
+    )
+    assert set((await refused.json())["supported"]) == available
+
+
+async def test_the_catalogue_carries_no_renderer_detail(
+    aiohttp_client: AiohttpClientFactory, cookies: dict[str, str]
+) -> None:
+    """Name, availability and sink family. A media type is read by the
+    store that holds the bytes and by the route that serves them back, and
+    a `target_pattern` is a Python regular expression -- a dialect rather
+    than a rule, and the rule is enforced here whatever a caller
+    believes."""
+    client = await aiohttp_client(api())
+    body = await (await client.get("/api/export-formats", cookies=cookies)).json()
+    for entry in body["formats"]:
+        assert set(entry) == {"name", "available", "sink"}
+
+
+async def test_the_catalogue_does_not_depend_on_administering_a_guild(
+    aiohttp_client: AiohttpClientFactory,
+) -> None:
+    """Ben administers nothing and every other route here answers him 404.
+
+    This one answers him the same as anybody: it is a fact about the build,
+    identical for every guild, and refusing it would only mean the console
+    could not render a format picker until it had first found a guild.
+    """
+    client = await aiohttp_client(api())
+    response = await client.get("/api/export-formats", cookies={SESSION_COOKIE: signed_cookie(BEN)})
+    assert response.status == 200
+
+
 async def test_a_format_this_deployment_cannot_publish_is_refused(
     aiohttp_client: AiohttpClientFactory, cookies: dict[str, str]
 ) -> None: