@bongos/core 1.21.20 → 1.21.22

package/modules/hall-ui/public/studio.html

@@ -176,7 +176,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-10-01-look"></script>
+<script src="/builders/shell.js?v=2026-10-02-theme"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <!-- The kit, for its ONE renderer: the full-size ship-time visual figure

package/modules/hall-ui/public/task.html

@@ -57,7 +57,7 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
-<script src="/builders/shell.js?v=2026-10-01-look"></script>
+<script src="/builders/shell.js?v=2026-10-02-theme"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so task.js can pull from it. -->

package/modules/hall-ui/public/thinking.html

@@ -138,7 +138,7 @@
   </div>
 </div>
 
-<script src="/builders/shell.js?v=2026-10-01-look"></script>
+<script src="/builders/shell.js?v=2026-10-02-theme"></script>
 <script src="/builders/palette.js" defer></script>
 
 <script src="/builders/idea-objects.js?v=2026-09-27-split"></script>

package/modules/hall-ui/public/tweak-editor.html

@@ -140,7 +140,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-10-01-look"></script>
+<script src="/builders/shell.js?v=2026-10-02-theme"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <script src="/builders/brand-holes.js?v=2026-09-29-aqfix"></script>

package/modules/hall-ui/public/watch.html

@@ -162,7 +162,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-10-01-look"></script>
+<script src="/builders/shell.js?v=2026-10-02-theme"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before watch.js, which pulls from it. -->

package/modules/hall-ui/public/work.html

@@ -171,7 +171,7 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
-<script src="/builders/shell.js?v=2026-10-01-look"></script>
+<script src="/builders/shell.js?v=2026-10-02-theme"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so work.js can pull from it. -->

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.20",
+  "version": "1.21.22",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.20",
+      "version": "1.21.22",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.20",
+  "version": "1.21.22",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8876,5 +8876,17 @@
       "id": "1004527",
       "text": "Inside every Governor City building, the floors now show real numbers instead of \"not recorded yet\". The Charter reads each section from the rules in force. People shows who sits on the council, the testers, the ranks and newc"
     }
+  ],
+  "1.21.21": [
+    {
+      "id": "1004544",
+      "text": "The governor city and the street now open inside the normal hall, with the sidebar and top bar around them like every other page. A full-screen button in the corner hides both so the city or the street fills the window again,"
+    }
+  ],
+  "1.21.22": [
+    {
+      "id": "1004556",
+      "text": "New projects are now always started on the latest released version of Cloud Bongos, even when the service that sets them up is running an older one. Until now, a lagging setup service passed its own old version to every new pr"
+    }
   ]
 }

package/scripts/gds/provision-repo.js

@@ -515,8 +515,14 @@ function runningCoreVersion({ instanceRoot, coreV }) {
 // publish as candidates, the platform hall runs ahead of the registry's `latest` label by
 // design — and the ladder below vends whatever the hall runs, so every new project would
 // be born on a version nobody released. When the hall is AHEAD of the release, the project
-// gets the release instead. Equal (or the hall behind it, which a release can't normally
-// produce) → the running core, byte-exact, as before.
+// gets the release instead. Equal → the running core, byte-exact, as before.
+//
+// BEHIND the release is real too (task 1004556): the runner that scaffolds is not always
+// the platform hall. On cloudbongos.com it ran from a patch-channel install that could not
+// cross the 1.21.0 minor, so it sat on 1.20.82 and every new project was born there,
+// without founding mode (1.21+). The release is what ADR 0361 D5 promises a new project,
+// and a released core has already run on the platform hall, so the runner's lag must not
+// set the project's version: behind → the release, packed from the registry, too.
 //
 // No readable label → the running core, deliberately (fail-open). Until candidates are
 // armed the running core IS the release; vendoring is the path that works with no
@@ -525,6 +531,7 @@ function runningCoreVersion({ instanceRoot, coreV }) {
 function projectCoreDecision({ running, released }) {
   if (!released || !isStable(released)) return { version: running, source: 'running', reason: 'no readable released (latest) label — using the core this hall runs' };
   if (compareSemver(running, released) > 0) return { version: released, source: 'released', reason: `this hall runs ${running}, ahead of the release` };
+  if (compareSemver(running, released) < 0) return { version: released, source: 'released', reason: `this runner is on ${running}, behind the release` };
   return { version: running, source: 'running', reason: `this hall runs the released core ${released}` };
 }
 

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.20'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.22'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/hall_audit.mjs

@@ -375,18 +375,13 @@ test('the module doc still records where the 2179 density pass landed', () => {
 // else is on the page but the wordmark, a sun/moon switch, start governing and
 // one line. It still loads style.css (the hall's tokens, so no private palette:
 // city.css spends var(--bg), var(--ink), var(--accent) …), and reads and writes
-// the hall's own 'hall-theme' preference. Whether it should join the chrome
-// behind the full-screen switch, as the sky did in task 1004327, is the
-// owner's call, named in that task's ship notes.
-// THE STREET (task 1004525) follows the city, for the same reason: the
-// reference design's street view shows nothing on the page but its own header
-// (the wordmark back to the city, needs you, moving, your share, the switch),
-// the street and the six readings. Same terms as the city: style.css and the
-// hall's tokens, the hall's own 'hall-theme' preference, no private palette.
-const STANDALONE_EXEMPT = {
-  'city.html': 'the governor city home: nothing on the page but the prototype home (task 1004524)',
-  'street.html': 'the governor street: nothing on the page but the prototype street view (task 1004525)',
-};
+// the hall's own 'hall-theme' preference. THE STREET (task 1004525) followed
+// it for the same reason. Both left this list in task 1004544 (owner decision
+// 2026-10-02): they sit in the hall chrome now, behind the shell's full-screen
+// switch, exactly as the sky did in task 1004327, so the list is empty again.
+// Neither has a sidebar link (the owner's call): the city is reached by URL and
+// the street from the city's start governing.
+const STANDALONE_EXEMPT = {};
 
 test('every hall page loads style.css and shell.js', () => {
   const missing = [];

package/tests/hall_city.mjs

@@ -241,10 +241,27 @@ test('the page holds only the wordmark, the switch, the city, one button and one
   assert.equal((html.match(/<a\b/g) || []).length, 1, 'one door');
   assert.equal((html.match(/<button\b/g) || []).length, 1, 'one switch');
   assert.match(html, /class="city-mark">\{\{productName\}\}</);
-  assert.doesNotMatch(html, /app-sidebar|shell\.js/, 'no hall chrome on the city');
   assert.equal(City.STREET_HREF, '/builders/street');
 });
 
+// task 1004544 (owner decision 2026-10-02): the city sits in the hall chrome
+// behind the shell's full-screen switch, the sky's mechanism (task 1004327),
+// and still has no sidebar link.
+test('the city sits in the hall chrome, behind the shell\'s full-screen switch', () => {
+  const html = read('city.html').replace(/<!--[\s\S]*?-->/g, '');
+  assert.match(html, /<body data-page="city"[^>]*\sdata-fullscreen-switch>/, 'the bare attribute: the page lays itself out for full screen');
+  for (const id of ['app-sidebar', 'app-scrim', 'app-topbar']) assert.match(html, new RegExp(`id="${id}"`), id);
+  assert.match(html, /<main id="hall-main" class="city-main">\s*<div class="city-top">/, 'the stage is the one <main>, the strip inside it');
+  const scripts = [...html.matchAll(/<script src="\/builders\/([a-z-]+)\.js/g)].map((m) => m[1]);
+  assert.deepEqual(scripts, ['shell', 'palette', 'city-draw', 'city'], 'the shell first, as on every hall page');
+  const css = read('city.css').replace(/\/\*[\s\S]*?\*\//g, '');
+  assert.match(css, /\.city-main \{ position: fixed; top: var\(--topbar-h, 56px\); left: var\(--sidebar-w-rail, 64px\);[^}]*contain: layout paint;/);
+  assert.match(css, /html\[data-fullscreen="on"\] \.city-main \{ top: 0; left: 0; \}/);
+  assert.match(css, /html\[data-fullscreen="on"\] \.city-top \{ right: 184px; \}/, 'the strip steps clear of the corner exit');
+  const shell = read('shell.js');
+  assert.doesNotMatch(shell, /href:\s*'(\/builders)?\/(city|street)'/, 'no sidebar link (owner: leave it off the sidebar)');
+});
+
 test('motion is CSS only and dies under reduced motion; no page :root; no innerHTML', () => {
   const css = read('city.css').replace(/\/\*[\s\S]*?\*\//g, '');
   assert.doesNotMatch(css, /:root/);
@@ -293,7 +310,7 @@ function fakeDom() {
   return { document, byId, html };
 }
 
-async function bootPage({ feeds = {}, stored = null, osDark = true } = {}) {
+async function bootPage({ feeds = {}, stored = null, osDark = true, shell = undefined, stage = null } = {}) {
   const { document, byId, html } = fakeDom();
   const store = new Map(stored ? [['hall-theme', stored]] : []);
   const calls = [];
@@ -308,14 +325,18 @@ async function bootPage({ feeds = {}, stored = null, osDark = true } = {}) {
     const body = feeds[url];
     return Promise.resolve(body === undefined ? { ok: false, json: async () => ({}) } : { ok: true, json: async () => body });
   };
-  const ctx = vm.createContext({ window, document, fetch, Promise, Math, String, Number, Array, Object, JSON, console });
+  const observers = [];
+  class MutationObserver { constructor(fn) { this.fn = fn; observers.push(this); } observe() {} }
+  window.OTBShell = shell;
+  if (stage) { const m = document.createElement('main'); m.setAttribute('id', 'hall-main'); Object.assign(m, stage); }
+  const ctx = vm.createContext({ window, document, fetch, Promise, Math, String, Number, Array, Object, JSON, console, MutationObserver });
   ctx.globalThis = ctx;
   window.GovCity = undefined;
   vm.runInContext(read('city-draw.js'), ctx);
   window.GovCity = ctx.GovCity || ctx.window.GovCity;
   vm.runInContext(read('city.js'), ctx);
   await window.GovCityPage.ready;
-  return { window, byId, html, store, calls };
+  return { window, byId, html, store, calls, observers };
 }
 
 const FEEDS = (ms, goals = [goal(1)], rollups = [rollup(1, { done: 2, active: 1 })]) => ({
@@ -363,6 +384,25 @@ test('the switch reads and writes the hall\'s own theme preference', async () =>
   assert.equal(q.html.attrs['data-theme'], 'dark', 'no stored choice follows the OS');
 });
 
+test('in the hall, the city and the top bar\'s theme switch never disagree (task 1004544)', async () => {
+  let shellPaints = 0;
+  const p = await bootPage({ feeds: FEEDS([]), stored: 'light', osDark: true, shell: { applyTheme() { shellPaints++; } } });
+  assert.equal(p.observers.length, 1, 'the page watches html[data-theme]');
+  p.byId.get('cityMode').fire('click');
+  assert.equal(shellPaints, 1, 'this switch repaints the shell\'s');
+  const before = JSON.stringify(p.byId.get('cityFlat').children[0].attrs);
+  p.store.set('hall-theme', 'light'); p.html.setAttribute('data-theme', 'light'); // the shell's switch
+  p.observers[0].fn();
+  assert.equal(p.byId.get('cityMode').attrs['aria-label'], 'Switch to dark mode', 'this switch follows the shell\'s');
+  assert.notEqual(JSON.stringify(p.byId.get('cityFlat').children[0].attrs), before, 'and the city redraws in that mode');
+  assert.equal(shellPaints, 1, 'following the shell does not echo back to it');
+});
+
+test('the artboard fits the stage the hall chrome leaves, not the window (task 1004544)', async () => {
+  const p = await bootPage({ feeds: FEEDS([]), stage: { clientWidth: 688, clientHeight: 900 } });
+  assert.equal(p.byId.get('cityStage').style['--city-scale'], '0.688');
+});
+
 test('docket text lands as text: a title with markup is never parsed', async () => {
   const p = await bootPage({ feeds: FEEDS([matter({ title: '<img src=x onerror=alert(1)>', short: '<b>x</b>' })]) });
   assert.equal(p.byId.get('cityPins').children.length, 1);

package/tests/hall_street.mjs

@@ -375,12 +375,27 @@ test('the page holds the prototype\'s header, the street, the readings and the c
   assert.equal((html.match(/<h1\b/g) || []).length, 1);
   assert.match(html, /<a class="street-mark" id="streetHome" href="\/builders\/city"[^>]*>\{\{productName\}\}</);
   for (const id of ['hudNeeds', 'hudMoving', 'hudShare', 'streetMode', 'streetSigns', 'streetPins', 'streetDoors', 'streetCard']) assert.match(html, new RegExp(`id="${id}"`), id);
-  assert.doesNotMatch(html, /app-sidebar|shell\.js/, 'no hall chrome, as the city');
   const scripts = [...html.matchAll(/<script src="\/builders\/([a-z-]+)\.js/g)].map((m) => m[1]);
-  assert.deepEqual(scripts, ['city-draw', 'street-draw', 'street-card', 'street-inside', 'street-amend', 'street'], 'the shared kit loads first, then the card (task 1004528), the interiors (task 1004526) and the drafted amendment (task 1004530)');
+  assert.deepEqual(scripts, ['shell', 'palette', 'city-draw', 'street-draw', 'street-card', 'street-inside', 'street-amend', 'street'], 'the hall shell (task 1004544), the shared kit, then the card (task 1004528), the interiors (task 1004526) and the drafted amendment (task 1004530)');
   assert.equal(City.STREET_HREF, '/builders/street', 'the city\'s door is this page');
 });
 
+// task 1004544 (owner decision 2026-10-02): the street sits in the hall chrome
+// behind the shell's full-screen switch, as the city and the sky (task 1004327),
+// and still has no sidebar link.
+test('the street sits in the hall chrome, behind the shell\'s full-screen switch', () => {
+  const html = read('street.html').replace(/<!--[\s\S]*?-->/g, '');
+  assert.match(html, /<body data-page="street"[^>]*\sdata-fullscreen-switch>/, 'the bare attribute: the page lays itself out for full screen');
+  for (const id of ['app-sidebar', 'app-scrim', 'app-topbar']) assert.match(html, new RegExp(`id="${id}"`), id);
+  assert.match(html, /<main id="hall-main" class="street-stage">\s*<div class="street-top">/, 'the stage is the one <main>, the strip inside it');
+  assert.match(html, /<div class="street-window" id="streetWindow">/, 'the street band is a <div> inside the stage');
+  const css = read('street.css').replace(/\/\*[\s\S]*?\*\//g, '');
+  assert.match(css, /\.street-stage \{ position: fixed; top: var\(--topbar-h, 56px\); left: var\(--sidebar-w-rail, 64px\);[^}]*contain: layout paint;/);
+  assert.match(css, /html\[data-fullscreen="on"\] \.street-stage \{ top: 0; left: 0; \}/);
+  assert.match(css, /html\[data-fullscreen="on"\] \.street-top \{ padding-right: 184px; \}/, 'the strip steps clear of the corner exit');
+  assert.doesNotMatch(read('shell.js'), /href:\s*'(\/builders)?\/(city|street)'/, 'no sidebar link (owner: leave it off the sidebar)');
+});
+
 test('motion is CSS only and dies under reduced motion; no page :root; no innerHTML', () => {
   const css = read('street.css').replace(/\/\*[\s\S]*?\*\//g, '');
   assert.doesNotMatch(css, /:root/);
@@ -428,7 +443,7 @@ function fakeDom() {
   return { document, byId, html, focused };
 }
 
-async function bootPage({ feeds = {}, stored = null, osDark = true, hash = '' } = {}) {
+async function bootPage({ feeds = {}, stored = null, osDark = true, hash = '', shell = undefined } = {}) {
   const { document, byId, html, focused } = fakeDom();
   const store = new Map(stored ? [['hall-theme', stored]] : []);
   const calls = [];
@@ -444,7 +459,10 @@ async function bootPage({ feeds = {}, stored = null, osDark = true, hash = '' }
     const body = feeds[url];
     return Promise.resolve(body === undefined ? { ok: false, json: async () => ({}) } : { ok: true, json: async () => body });
   };
-  const ctx = vm.createContext({ window, document, fetch, Promise, Math, String, Number, Array, Object, JSON, Date, console, encodeURIComponent, decodeURIComponent, isNaN });
+  const observers = [];
+  class MutationObserver { constructor(fn) { this.fn = fn; observers.push(this); } observe() {} }
+  window.OTBShell = shell;
+  const ctx = vm.createContext({ window, document, fetch, Promise, Math, String, Number, Array, Object, JSON, Date, console, encodeURIComponent, decodeURIComponent, isNaN, MutationObserver });
   ctx.globalThis = ctx;
   // each file hangs its api on `window`, as the browser loads them
   vm.runInContext(read('city-draw.js'), ctx);
@@ -453,7 +471,7 @@ async function bootPage({ feeds = {}, stored = null, osDark = true, hash = '' }
   vm.runInContext(read('street.js'), ctx);
   await window.GovStreetPage.ready;
   const key = (t, e) => (listeners[t] || []).forEach((fn) => fn(e));
-  return { window, byId, html, store, calls, key, focused };
+  return { window, byId, html, store, calls, key, focused, observers };
 }
 
 const FEEDS = (ms, goals = [goal(1)], rollups = [rollup(1, { done: 2, active: 1 })]) => ({
@@ -509,6 +527,20 @@ test('the switch reads and writes the hall\'s own theme preference and redraws t
   assert.notEqual(JSON.stringify(p.byId.get('streetBlds').children[0].children[0].attrs), before, 'the street redraws in the new mode');
 });
 
+test('in the hall, the street and the top bar\'s theme switch never disagree (task 1004544)', async () => {
+  let shellPaints = 0;
+  const p = await bootPage({ feeds: FEEDS([]), stored: 'light', osDark: true, shell: { applyTheme() { shellPaints++; } } });
+  assert.equal(p.observers.length, 1, 'the page watches html[data-theme]');
+  p.byId.get('streetMode').fire('click');
+  assert.equal(shellPaints, 1, 'this switch repaints the shell\'s');
+  const before = JSON.stringify(p.byId.get('streetBlds').children[0].children[0].attrs);
+  p.store.set('hall-theme', 'light'); p.html.setAttribute('data-theme', 'light'); // the shell's switch
+  p.observers[0].fn();
+  assert.equal(p.byId.get('streetModeWord').textContent, 'dark', 'this switch follows the shell\'s');
+  assert.notEqual(JSON.stringify(p.byId.get('streetBlds').children[0].children[0].attrs), before, 'and the street redraws in that mode');
+  assert.equal(shellPaints, 1, 'following the shell does not echo back to it');
+});
+
 test('arriving through a door marks that building, and a failed docket says so', async () => {
   const p = await bootPage({ feeds: FEEDS([]), hash: '#building=treasury' });
   const here = p.byId.get('streetDoors').children.filter((a) => a.attrs['aria-current'] === 'location');

package/tests/hall_tweak_editor.mjs

@@ -635,7 +635,7 @@ try {
     assert.match(HTML, /<body data-page="tweak-editor"[^>]*data-fullscreen-switch/);
     assert.equal((HTML.match(/<h1\b/g) || []).length, 1);
     assert.ok(HTML.indexOf('tweak-editor-lib.js') < HTML.indexOf('tweak-editor.js?'), 'the lib loads first');
-    assert.match(HTML, /shell\.js\?v=2026-10-01-look/);
+    assert.match(HTML, /shell\.js\?v=2026-10-02-theme/);
     assert.equal(/fonts\.googleapis\.com\/css/.test(HTML), false);
     for (const id of ['tw-bar', 'tw-counter', 'tw-open', 'tw-open-more', 'tw-divider', 'tw-openwrap', 'tw-open-menu', 'tw-open-tab', 'tw-open-split', 'tw-frame', 'tw-frame-view', 'tw-split-close', 'tw-download', 'tw-upload', 'tw-file', 'tw-submit', 'tw-paper', 'tw-doc', 'tw-notice', 'tw-done', 'tw-take', 'tw-pick', 'tw-picks', 'tw-refused', 'tw-refused-title', 'tw-refused-list', 'tw-refused-next', 'tw-refused-download', 'tw-refused-close']) {
       assert.ok(new RegExp(`id="${id}"`).test(HTML), `#${id} is in the markup`);

package/tests/nav_permission_atoms.mjs

@@ -87,7 +87,7 @@ test('the hall-preview fixture carries every atom /me resolves', () => {
 // the file and left the query alone, so a returning browser kept the cached copy —
 // a fix that reaches nobody looks identical to a fix that does not work.
 
-const SHELL_SHA = '51a13ea563542113';
+const SHELL_SHA = 'a8dc2884930ca19a';
 
 test('shell.js has not changed without its cache-bust being bumped', () => {
   const actual = crypto.createHash('sha256').update(SHELL).digest('hex').slice(0, 16);

package/tests/provision.mjs

@@ -1078,12 +1078,17 @@ await ta('scaffoldStandaloneRepo: a REGISTRY-pinned consumer control plane PACKS
 // ADR 0361: merges publish as candidates and the platform hall runs them, so the core
 // this hall runs is routinely AHEAD of the registry's `latest` label. A new project —
 // and the pin refresh that runs in the same provisioning pass — must get the release.
-t('projectCoreDecision: the hall ahead of the release → the release; level or unreadable → the running core', () => {
+t('projectCoreDecision: the hall ahead of OR behind the release → the release; level or unreadable → the running core', () => {
   assert.deepEqual(
     (({ version, source }) => ({ version, source }))(RP.projectCoreDecision({ running: '1.19.60', released: '1.19.50' })),
     { version: '1.19.50', source: 'released' });
   assert.equal(RP.projectCoreDecision({ running: '1.19.50', released: '1.19.50' }).source, 'running', 'level → byte-exact running core, no registry pack');
-  assert.equal(RP.projectCoreDecision({ running: '1.19.40', released: '1.19.50' }).version, '1.19.40', 'never moves a project PAST what the hall has run');
+  // task 1004556: a runner BEHIND the release (a patch-channel install stuck on 1.20.82
+  // while 1.21.x was released) must not hand its stale core to a new project
+  assert.deepEqual(
+    (({ version, source }) => ({ version, source }))(RP.projectCoreDecision({ running: '1.20.82', released: '1.21.20' })),
+    { version: '1.21.20', source: 'released' }, 'behind the release → the release, across a minor too');
+  assert.equal(RP.projectCoreDecision({ running: '1.19.40', released: '1.19.50' }).source, 'released', 'and within a minor');
   assert.equal(RP.projectCoreDecision({ running: '1.19.60', released: null }).version, '1.19.60', 'no label → fail-open to the running core');
   assert.equal(RP.projectCoreDecision({ running: '1.19.60', released: '1.19.50-rc.1' }).source, 'running', 'a prerelease label is not a release');
   assert.equal(RP.projectCoreDecision({ running: '1.19.60', released: '1.19.50;touch /tmp/x' }).source, 'running', 'a non-semver label never reaches a shell');