@bongos/core 1.21.21 → 1.21.23

package/modules/hall-ui/public/task.states.json

@@ -8,7 +8,7 @@
   "ignoreConsole": ["/api/(gds|bongos)/", "\\b401\\b", "\\b404\\b", "Unauthorized", "Not Found", "load failed"],
   "states": {
     "record": { "auth": true, "actions": [["wait", 600]], "expect": { "visible": ["#task-body", "#task-grade", "#task-sessions", "#copy-prompt-btn"] } },
-    "from-goal": { "auth": true, "url": "/task/2166?from=%2Fgoals%23%2Fgoal%2F1000081", "actions": [["wait", 600]], "expect": { "visible": ["#task-back", "#copy-prompt-btn"], "attr": [["#task-back", "href", "/goals#/goal/1000081"]] } },
+    "from-goal": { "auth": true, "url": "/task/2166?from=%2Fgoals%23%2Fgoal%2F1000081", "actions": [["wait", 600]], "expect": { "visible": ["#topbar-back", "#copy-prompt-btn"], "attr": [["#topbar-back", "href", "/goals#/goal/1000081"]] } },
     "missing": { "auth": true, "url": "/task/1003999", "actions": [["wait", 600]], "expect": { "visible": ["#task-h"] } }
   },
   "reducedMotion": { "auth": true, "actions": [["wait", 600]] }

package/modules/hall-ui/public/thinking.html

@@ -138,7 +138,7 @@
   </div>
 </div>
 
-<script src="/builders/shell.js?v=2026-10-02-theme"></script>
+<script src="/builders/shell.js?v=2026-10-02-back"></script>
 <script src="/builders/palette.js" defer></script>
 
 <script src="/builders/idea-objects.js?v=2026-09-27-split"></script>

package/modules/hall-ui/public/tweak-editor.css

@@ -177,6 +177,10 @@ html[data-fullscreen="on"] .tw-bar { width: min(1200px, calc(100% - 144px)); }
 /* With the chrome showing, the shell's fixed top bar holds the window's top,
    so the stuck bar stops under it instead of sliding beneath it. */
 html:not([data-fullscreen="on"]) .tw-bar { top: calc(var(--topbar-h, 56px) + 12px); }
+/* task 1004477: the bar's exit is the shell's Back link, filled by shell.js.
+   With the chrome showing, the top bar already carries it, so the bar shows it
+   only in full screen and the page never offers two. */
+html:not([data-fullscreen="on"]) .tw-stage .tw-back { display: none; }
 .tw-stage .tw-back {
   display: inline-flex;
   align-items: center;

package/modules/hall-ui/public/tweak-editor.html

@@ -29,7 +29,7 @@
      data-fullscreen-switch: the shell's full-screen switch (task 1004327). The
      artboard is the editor over the whole window, so the editor opens full
      screen the first time (tweak-editor.js), and the switch is remembered. -->
-<body data-page="tweak-editor" data-page-title="Tweak a page" data-fullscreen-switch>
+<body data-page="tweak-editor" data-page-title="Tweak a page" data-fullscreen-switch data-back-fallback="/studio">
 
 <div class="app">
   <aside class="app-sidebar" id="app-sidebar" aria-label="Primary"></aside>
@@ -49,7 +49,9 @@
         <!-- A <div>, not a <header>: the shell's top bar is the page's one
              <header> (the kit's one-header-main-h1 floor). -->
         <div class="tw-bar" id="tw-bar">
-          <a class="tw-back" data-own-back href="/builders/studio">← studio</a>
+          <!-- task 1004477: the shell's exit, shown only in full screen, where the
+               top bar (and its Back link) is hidden. The shell fills it. -->
+          <a class="tw-back" data-shell-exit href="/builders/studio">Back to studio</a>
           <span class="tw-name"><span id="tw-name">Tweak a page</span> <span class="tw-surface" id="tw-surface"></span></span>
           <span class="tw-counter" id="tw-counter" aria-live="polite"></span>
           <div class="tw-actions">
@@ -140,7 +142,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-10-02-theme"></script>
+<script src="/builders/shell.js?v=2026-10-02-back"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <script src="/builders/brand-holes.js?v=2026-09-29-aqfix"></script>

package/modules/hall-ui/public/watch.html

@@ -162,7 +162,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-10-02-theme"></script>
+<script src="/builders/shell.js?v=2026-10-02-back"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before watch.js, which pulls from it. -->

package/modules/hall-ui/public/work.html

@@ -171,7 +171,7 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
-<script src="/builders/shell.js?v=2026-10-02-theme"></script>
+<script src="/builders/shell.js?v=2026-10-02-back"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so work.js can pull from it. -->

package/modules/hall-ui/records/hall-navigation.md

@@ -1,4 +1,4 @@
-# Hall navigation — the Back link and the standard full-screen switch (task 1004430)
+# Hall navigation — the Back link and the standard full-screen switch (tasks 1004430, 1004477)
 
 Covers: every shelled hall page (`shell.js`, `style.css`), plus `goal-map.html` joining the chrome.
 
@@ -7,16 +7,19 @@ Covers: every shelled hall page (`shell.js`, `style.css`), plus `goal-map.html`
 - `shell.js` renders `#topbar-back` ("← <label>") at the head of the top bar when the page was reached from INSIDE another hall page. The origin is `?from=` first, then a same-origin `document.referrer`; the label is that page's `NAV` label (or "task N" / "idea N" / "goal N" for a record).
 - **A sidebar hop is not a drill-down.** A sidebar link click writes a one-shot `sessionStorage['hall-nav-hop']` naming its target; the page it lands on reads and deletes it, and shows no Back link. Without this every page reached from the sidebar would carry a Back link, which is just history.
 - When the origin came from the referrer, the click runs `history.back()`, so a list comes back with its scroll and filters; the `href` is still the real address for a new tab.
-- A page drawing its own record back link (`.rec-back` — `task.html`, `idea.html`) keeps it; the bar adds no second one. The origin's own `?from=` is dropped so back links never chain.
+- **No page draws its own Back link (task 1004477).** `task.html`, `idea.html` and the tweak editor used to, and the bar skipped its link on those pages. Now the shell decides the way back for every page, with two hooks:
+  - `<body data-back-fallback="/work">` names where Back goes when there is no origin (a deep-linked task falls back to Tasks, an idea to Your thinking, the tweak editor to Studio). It is honoured only as a path on this host; a sidebar hop still shows nothing.
+  - A link marked `[data-shell-exit]` is a second exit a page places: the task record's actions row and its two failure renders, the primer and drachmae error notes, and the tweak editor's bar. The shell fills its `href` and its words ("Back to goal 12", "Back to tasks"), and with no way back at all it goes home. A page that renders one after boot calls `OTBShell.fillExits(root)`.
+  - The origin's own `?from=` is dropped so back links never chain, and a `?from=` naming the page itself is refused.
 - `/profile?id=N` highlights **Builders**, not your own Profile, unless `/me` says the id is yours.
 
 ## Full screen is standard
 
 - Every shelled page gets the switch. `<body data-fullscreen-switch="off">` opts out. The bare attribute means "this page lays itself out for full screen" (sky, studio, tweak editor); a page without it is **plain**, and the shell sets `html[data-fullscreen-plain="on"]` so `style.css` pads `.app-content` clear of the corner button.
-- In full screen the button is a labelled pill, an icon plus "Exit full screen", in `--bg-card` with a ring and a drop shadow, not the hall's near-clear glass. Under 640px it drops the words, and the tweak editor keeps the 36px round button because its bar is laid out for one. A page whose own back link is not `.rec-back` marks it `data-own-back`. On the black sky in the light theme the glass button was a dark icon on black, and because the choice is remembered per page, `/thinking` looked stuck with no bars. Entering full screen (or a page opening in it) also shows a 4.5s `#fullscreen-hint` saying how to leave.
+- In full screen the button is a labelled pill, an icon plus "Exit full screen", in `--bg-card` with a ring and a drop shadow, not the hall's near-clear glass. Under 640px it drops the words, and the tweak editor keeps the 36px round button because its bar is laid out for one. Full screen hides the top bar and its Back link, so the tweak editor's bar carries the shell's exit and shows it only in full screen (`tweak-editor.css`); with the chrome showing, the page never offers two. On the black sky in the light theme the glass button was a dark icon on black, and because the choice is remembered per page, `/thinking` looked stuck with no bars. Entering full screen (or a page opening in it) also shows a 4.5s `#fullscreen-hint` saying how to leave.
 
 ## The project sky joined the hall
 
 `goal-map.html` now uses thinking.html's structure: sidebar and top-bar mounts, `style.css`, `shell.js`, the sky inside `<main id="hall-main" class="sky-stage">`, and a `<div class="brand">` because the shell's bar is the page's one `<header>`. In `thinking.css` both pages share one stage rule, `body[data-page] .sky-stage`. No hall page is standalone any more (`tests/hall_audit.mjs` `STANDALONE_EXEMPT` is empty).
 
-Tests: `tests/hall_fullscreen.mjs` (the standard switch, `plain`, Back link cases), `tests/goal_map_page.mjs`, `tests/hall_audit.mjs` §8.
+Tests: `tests/hall_fullscreen.mjs` (the standard switch, `plain`, Back link, fallback and exit cases), `tests/hall_record_world.mjs` §10 (the record places its exit), `tests/goal_map_page.mjs`, `tests/hall_audit.mjs` §8.

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.21",
+  "version": "1.21.23",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.21",
+      "version": "1.21.23",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.21",
+  "version": "1.21.23",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8882,5 +8882,17 @@
       "id": "1004544",
       "text": "The governor city and the street now open inside the normal hall, with the sidebar and top bar around them like every other page. A full-screen button in the corner hides both so the city or the street fills the window again,"
     }
+  ],
+  "1.21.22": [
+    {
+      "id": "1004556",
+      "text": "New projects are now always started on the latest released version of Cloud Bongos, even when the service that sets them up is running an older one. Until now, a lagging setup service passed its own old version to every new pr"
+    }
+  ],
+  "1.21.23": [
+    {
+      "id": "1004477",
+      "text": "Every page in the builders hall now goes back the same way: one Back button in the top bar. Task and idea pages used to draw their own back links, and the tweak editor had its own too. Opened from a goal, a task now shows \"Bac"
+    }
   ]
 }

package/scripts/gds/provision-repo.js

@@ -515,8 +515,14 @@ function runningCoreVersion({ instanceRoot, coreV }) {
 // publish as candidates, the platform hall runs ahead of the registry's `latest` label by
 // design — and the ladder below vends whatever the hall runs, so every new project would
 // be born on a version nobody released. When the hall is AHEAD of the release, the project
-// gets the release instead. Equal (or the hall behind it, which a release can't normally
-// produce) → the running core, byte-exact, as before.
+// gets the release instead. Equal → the running core, byte-exact, as before.
+//
+// BEHIND the release is real too (task 1004556): the runner that scaffolds is not always
+// the platform hall. On cloudbongos.com it ran from a patch-channel install that could not
+// cross the 1.21.0 minor, so it sat on 1.20.82 and every new project was born there,
+// without founding mode (1.21+). The release is what ADR 0361 D5 promises a new project,
+// and a released core has already run on the platform hall, so the runner's lag must not
+// set the project's version: behind → the release, packed from the registry, too.
 //
 // No readable label → the running core, deliberately (fail-open). Until candidates are
 // armed the running core IS the release; vendoring is the path that works with no
@@ -525,6 +531,7 @@ function runningCoreVersion({ instanceRoot, coreV }) {
 function projectCoreDecision({ running, released }) {
   if (!released || !isStable(released)) return { version: running, source: 'running', reason: 'no readable released (latest) label — using the core this hall runs' };
   if (compareSemver(running, released) > 0) return { version: released, source: 'released', reason: `this hall runs ${running}, ahead of the release` };
+  if (compareSemver(running, released) < 0) return { version: released, source: 'released', reason: `this runner is on ${running}, behind the release` };
   return { version: running, source: 'running', reason: `this hall runs the released core ${released}` };
 }
 

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.21'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.23'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/hall_fullscreen.mjs

@@ -28,10 +28,12 @@ const read = (f) => fs.readFileSync(path.join(HALL, f), 'utf8');
 // is SHARED across boots on purpose: a second boot over the same store is a reload.
 // `optIn`: true = the bare attribute (the page lays itself out for full screen),
 // null = no attribute (a plain page — the switch is standard since task
-// 1004430), 'off' = the page opts out. `referrer` / `search` / `session` /
-// `recBack` drive the top bar's Back link (task 1004430).
+// 1004430), 'off' = the page opts out. `referrer` / `search` / `session` drive
+// the top bar's Back link (task 1004430); `fallback` is the page's
+// <body data-back-fallback> and `exits` how many [data-shell-exit] links the
+// page placed for the shell to fill (task 1004477).
 function boot({ page = 'thinking', optIn = true, store = {}, storageThrows = false,
-  referrer = '', search = '', session = {}, recBack = false, path = null, meId = null } = {}) {
+  referrer = '', search = '', session = {}, fallback = null, exits = 0, path = null, meId = null } = {}) {
   const els = new Map();
   const windowListeners = {};
   const timers = [];
@@ -65,9 +67,10 @@ function boot({ page = 'thinking', optIn = true, store = {}, storageThrows = fal
     return { href, dataset: {}, getAttribute: (k) => (k === 'href' ? href : null),
       classList: { add: (c) => cls.add(c), remove: (c) => cls.delete(c), contains: (c) => cls.has(c) } };
   });
+  const exitLinks = Array.from({ length: exits }, () => makeEl(null));
   const attr = optIn === true ? '' : optIn === false ? null : optIn;
   const body = {
-    dataset: { page },
+    dataset: fallback == null ? { page } : { page, backFallback: fallback },
     hasAttribute: (k) => k === 'data-fullscreen-switch' && attr !== null,
     getAttribute: (k) => (k === 'data-fullscreen-switch' ? attr : null),
     appendChild() {},
@@ -77,8 +80,9 @@ function boot({ page = 'thinking', optIn = true, store = {}, storageThrows = fal
     referrer,
     documentElement: { dataset: {}, style: {}, classList: { add() {}, remove() {}, toggle() { return false; }, contains() { return false; } } },
     getElementById,
-    querySelector: (sel) => (/\.rec-back/.test(sel) && recBack ? {} : null),
-    querySelectorAll: (sel) => (sel === '#app-sidebar .nav-item' ? navItems : []),
+    querySelector: () => null,
+    querySelectorAll: (sel) => (sel === '#app-sidebar .nav-item' ? navItems
+      : sel === '[data-shell-exit]' ? exitLinks : []),
     createElement() { return makeEl(null); },
     addEventListener() {}, dispatchEvent() {},
     get cookie() { return ''; }, set cookie(_v) {},
@@ -123,6 +127,8 @@ function boot({ page = 'thinking', optIn = true, store = {}, storageThrows = fal
     plain: () => root.dataset.fullscreenPlain === 'on',
     active: () => navItems.filter((a) => a.classList.contains('nav-item--active')).map((a) => a.href),
     topbar: () => topbar._html,
+    exits: () => exitLinks.map((a) => ({ href: a.getAttribute('href'), text: a.textContent, wired: !!(a._on && a._on.click) })),
+    shell: () => windowObj.OTBShell,
     session,
     resizes: () => resizes,
     // Press a key the way the browser dispatches it: every window listener,
@@ -170,14 +176,69 @@ test('Back: ?from= wins over the referrer, and a record origin is named as the r
   assert.match(p.topbar(), />task 42<\/span>/);
 });
 
-test('Back: none after a sidebar hop, from another site, from the page itself, or where the page draws its own', () => {
+test('Back: none after a sidebar hop, from another site, or from the page itself', () => {
   const hop = boot({ page: 'goals', optIn: false, referrer: 'https://h/work', session: { 'hall-nav-hop': '/goals' } });
   assert.doesNotMatch(hop.topbar(), /topbar-back/, 'the sidebar is not a drill-down');
   assert.equal(hop.session['hall-nav-hop'], undefined, 'the note is one-shot');
   assert.doesNotMatch(boot({ page: 'goals', optIn: false, referrer: 'https://elsewhere.example/roster' }).topbar(), /topbar-back/);
   assert.doesNotMatch(boot({ page: 'goals', optIn: false, referrer: 'https://h/goals' }).topbar(), /topbar-back/);
-  assert.doesNotMatch(boot({ page: 'task', optIn: false, path: '/task/9', referrer: 'https://h/goals', recBack: true }).topbar(), /topbar-back/,
-    'the task record keeps its own back link, and the bar adds no second one');
+});
+
+// task 1004477: no page draws its own Back any more, so the shell's is the
+// record's too — the task page opened from a goal shows Back to that goal.
+test('Back: a record page gets the bar\'s Back like every other page', () => {
+  const p = boot({ page: 'task', optIn: false, path: '/task/9', search: '?from=' + encodeURIComponent('/goals#/goal/12'), fallback: '/work' });
+  assert.match(p.topbar(), /<a class="topbar-back" id="topbar-back" href="\/goals#\/goal\/12"/);
+  assert.match(p.topbar(), />goal 12<\/span>/);
+  assert.doesNotMatch(SHELL, /rec-back|data-own-back/, 'the suppression for page-drawn links is gone');
+});
+
+test('Back: with no origin, the page\'s data-back-fallback is the way back', () => {
+  const task = boot({ page: 'task', optIn: false, path: '/task/9', fallback: '/work' });
+  assert.match(task.topbar(), /href="\/work"/, 'a deep-linked task falls back to the board');
+  assert.match(task.topbar(), />Tasks<\/span>/);
+  const idea = boot({ page: 'idea', optIn: false, path: '/idea/4', referrer: 'https://elsewhere.example/', fallback: '/thinking' });
+  assert.match(idea.topbar(), /href="\/thinking"/, 'a cross-site arrival falls back too');
+  assert.doesNotMatch(boot({ page: 'goals', optIn: false }).topbar(), /topbar-back/, 'a page with no fallback still shows none');
+  assert.doesNotMatch(boot({ page: 'studio', optIn: false, path: '/studio', fallback: '/studio' }).topbar(), /topbar-back/,
+    'a fallback to the page itself is not a way back');
+});
+
+test('Back: a hostile ?from= is refused, and the fallback stands in', () => {
+  const bad = ['//evil.example', '/\\evil.example', 'javascript:alert(1)', 'https://evil.example/x',
+    '/api/gds/auth/web/callback', '/lib/bongos-client.js', '/task/9'];
+  for (const from of bad) {
+    const p = boot({ page: 'task', optIn: false, path: '/task/9', search: '?from=' + encodeURIComponent(from), fallback: '/work' });
+    assert.match(p.topbar(), /id="topbar-back" href="\/work"/, `from=${JSON.stringify(from)}`);
+  }
+  for (const fallback of ['//evil.example', 'https://evil.example/', '/api/x', 'work']) {
+    assert.doesNotMatch(boot({ page: 'task', optIn: false, path: '/task/9', fallback }).topbar(), /topbar-back/,
+      `a fallback is a path on this host or nothing: ${JSON.stringify(fallback)}`);
+  }
+});
+
+test('Back: a sidebar hop beats the fallback — the sidebar is still not a drill-down', () => {
+  const p = boot({ page: 'studio', optIn: false, path: '/studio', fallback: '/work', session: { 'hall-nav-hop': '/studio' } });
+  assert.doesNotMatch(p.topbar(), /topbar-back/);
+});
+
+test('exits: every [data-shell-exit] link carries the bar\'s way back, in a sentence', () => {
+  const p = boot({ page: 'task', optIn: false, path: '/task/9', search: '?from=' + encodeURIComponent('/goals#/goal/12'), exits: 2 });
+  assert.deepEqual(p.exits(), [
+    { href: '/goals#/goal/12', text: 'Back to goal 12', wired: true },
+    { href: '/goals#/goal/12', text: 'Back to goal 12', wired: true },
+  ]);
+  const board = boot({ page: 'task', optIn: false, path: '/task/9', fallback: '/work', exits: 1 });
+  assert.deepEqual(board.exits()[0], { href: '/work', text: 'Back to tasks', wired: true }, 'a nav label reads lowercase mid-sentence');
+  const lost = boot({ page: 'primer', optIn: false, path: '/primer', exits: 1 });
+  assert.deepEqual(lost.exits()[0], { href: '/', text: 'Back to home', wired: true }, 'with no way back at all, an exit goes home');
+});
+
+test('exits: a page that renders one later asks the shell, and asking twice wires it once', () => {
+  const p = boot({ page: 'task', optIn: false, path: '/task/9', fallback: '/work', exits: 1 });
+  assert.equal(typeof p.shell().fillExits, 'function', 'the shell exposes it');
+  p.shell().fillExits();
+  assert.deepEqual(p.exits()[0], { href: '/work', text: 'Back to tasks', wired: true });
 });
 
 test('someone else\'s profile highlights Builders; your own hands the mark back to Profile', async () => {
@@ -191,9 +252,24 @@ test('someone else\'s profile highlights Builders; your own hands the mark back
   assert.deepEqual(boot({ page: 'profile', optIn: false }).active(), ['/profile'], 'no id: your own profile');
 });
 
-test('Back: a page\'s own back link (data-own-back, the tweak editor\'s "← studio") suppresses the bar\'s', () => {
-  assert.match(read('tweak-editor.html'), /<a class="tw-back" data-own-back href="\/builders\/studio">/);
-  assert.match(SHELL, /querySelector\('\.rec-back, \[data-own-back\]'\)/);
+// task 1004477: the pages that used to draw their own. Source checks, labelled
+// as such: what each page now CARRIES is markup, and the behaviour of what it
+// carries is the shell's, driven above.
+test('no hall page draws its own back link; each carries the shell\'s hooks instead', () => {
+  const editor = read('tweak-editor.html');
+  assert.match(editor, /<a class="tw-back" data-shell-exit href="\/builders\/studio">/,
+    'the editor\'s bar keeps an exit, because full screen hides the top bar');
+  assert.match(editor, /<body [^>]*data-back-fallback="\/studio"/);
+  assert.match(read('tweak-editor.css'), /html:not\(\[data-fullscreen="on"\]\) \.tw-stage \.tw-back \{ display: none; \}/,
+    'and shows it only in full screen, so the page never offers two');
+  assert.match(read('idea.html'), /<body [^>]*data-back-fallback="\/thinking"/);
+  for (const f of ['primer.html', 'drachmae.html']) {
+    assert.match(read(f), /<a class="btn btn--ghost" data-shell-exit href="\/builders">/, `${f}: its error exit is the shell's`);
+  }
+  for (const f of fs.readdirSync(HALL).filter((n) => n.endsWith('.html'))) {
+    assert.doesNotMatch(read(f), /class="rec-back|data-own-back/, `${f} draws no back link of its own`);
+  }
+  assert.doesNotMatch(read('record.css'), /\.rec-back/, 'and the archetype sheet styles none');
 });
 
 test('Back: an origin\'s own ?from= is dropped, so one page\'s way back never chains into the next', () => {

package/tests/hall_record_world.mjs

@@ -306,7 +306,8 @@ const CLAIM_ACTION_SRC = read('claim-action.js');
 // all of them, because what these tests are actually about is the REQUEST the
 // page issues — `requests` carries paths only and is left alone so the older
 // assertions on it keep meaning what they meant.
-function renderTask(task, { lastClaim = null, viewer = null, goal = null, goalsList = null, patch = null, write = null, status = 200, search = '', referrer = '', withReader = true, grade, sessionLogs, claims } = {}) {
+function renderTask(task, { lastClaim = null, viewer = null, goal = null, goalsList = null, patch = null, write = null, status = 200, search = '', referrer = '', withReader = true, grade, sessionLogs, claims, shell = false } = {}) {
+  const fills = [];   // task 1004477: each time the page asked the shell to fill its exits
   const requests = [];
   const writes = [];
   const toasts = [];
@@ -400,6 +401,9 @@ function renderTask(task, { lastClaim = null, viewer = null, goal = null, goalsL
     confirm: () => true,
     navigator: { clipboard: { writeText: async () => {} } },
   };
+  // task 1004477: the shell is what fills a [data-shell-exit] link. `shell: true`
+  // stands it in so a test can see the page ask; absent, the page must still work.
+  if (shell) windowObj.OTBShell = { fillExits(root) { fills.push(root); } };
   class CustomEvent { constructor(type, init) { this.type = type; this.detail = init && init.detail; } }
   const sandbox = { window: windowObj, document: documentObj, location: windowObj.location, console, setTimeout, clearTimeout, Date, URL, URLSearchParams, CustomEvent };
   sandbox.globalThis = sandbox;
@@ -410,6 +414,7 @@ function renderTask(task, { lastClaim = null, viewer = null, goal = null, goalsL
   assert.ok(onReady, 'task.js registers its DOMContentLoaded boot');
   return {
     boot: onReady,
+    fills,
     html: () => documentObj.getElementById('task-body').innerHTML,
     sub: () => documentObj.getElementById('task-sub').textContent,
     el: (id) => documentObj.getElementById(id),
@@ -536,77 +541,50 @@ test('the idea grade badge IS the archetype pill, not a private copy of it', ()
     'idea.css carried a near-verbatim copy of .rec-pill down to the token triples — a hundred lines waiting to drift');
 });
 
-// ---- 10. the way out — the record exits to where it was opened from ----------
+// ---- 10. the way out — the record exits through the shell's Back ------------
 //
-// task 1003468. task.js hardcoded "Open the work board" in three places and
-// task.html's crumb a fourth, so a builder who walked goal → task had only the
-// browser's own Back, and the two failure renders sent them somewhere they had
-// never been. The list that opens a record now writes `?from=` on the link
-// (task-detail.js's href()) and the record offers THAT as its exit — in the
-// crumb before the fetch lands, and in the actions row of every render
-// including the two failures. A same-origin referrer is the fallback for a link
-// written without it; the board is the fallback for a reader with no history.
-// Every value is honoured only as a path on this host.
-
-const FROM_GOAL = '?from=' + encodeURIComponent('/goals#/goal/1000081');
-
-test('opened from a goal, the record exits to that goal — crumb and actions row alike', async () => {
-  const r = renderTask(BASE_TASK, { search: FROM_GOAL });
-  await r.boot(); await settle();
-  assert.match(r.html(), /<a class="td-btn" href="\/goals#\/goal\/1000081">Back to goal 1000081<\/a>/);
-  assert.doesNotMatch(r.html(), /Open the work board/, 'the hardcoded exit is gone from the happy path');
-  assert.equal(r.el('task-back').href, '/goals#/goal/1000081', 'the crumb points at the goal');
-  assert.equal(r.el('task-back-label').textContent, 'Back to goal 1000081');
-});
-
-test('opened from the board, the exit is the board — on the tab it was opened from', async () => {
-  const r = renderTask(BASE_TASK, { search: '?from=' + encodeURIComponent('/work#backlog') });
-  await r.boot(); await settle();
-  assert.match(r.html(), /href="\/work#backlog">Back to the work board</);
-});
-
-test('without ?from=, a same-origin referrer is the way back', async () => {
-  const r = renderTask(BASE_TASK, { referrer: 'https://builders.cloudbongos.com/sessions?page=2' });
-  await r.boot(); await settle();
-  assert.match(r.html(), /href="\/sessions\?page=2">Back to sessions</);
-});
-
-test('a cross-origin referrer, a broken one, or none, falls back to the work board', async () => {
-  for (const referrer of ['', 'https://example.org/elsewhere', 'not a url']) {
-    const r = renderTask(BASE_TASK, { referrer });
+// task 1003468 taught the record to exit to where it was opened from; task
+// 1004477 moved that decision into shell.js, which now makes it for every hall
+// page (tests/hall_fullscreen.mjs drives the real shell through ?from=, the
+// referrer, the hostile values and the fallback). What stays the record's is
+// PLACING the exit: an actions-row link in every render, the two failures
+// included, marked [data-shell-exit] so the shell fills it with the same
+// address and words as its top-bar Back — and asking the shell to, once the
+// render that placed it has landed.
+
+const EXIT_SLOT = /<a class="td-btn" data-shell-exit href="\/work">Back to tasks<\/a>/;
+
+test('every render places one shell exit — the record and both honest failures', async () => {
+  const cases = [['record', 200], ['not found', 404], ['feed unavailable', 500]];
+  for (const [name, status] of cases) {
+    const r = renderTask(BASE_TASK, { status, shell: true });
     await r.boot(); await settle();
-    assert.match(r.html(), /href="\/work">Back to the work board</, `referrer ${JSON.stringify(referrer)}`);
-    assert.equal(r.el('task-back').href, '/work');
+    assert.equal((r.html().match(/data-shell-exit/g) || []).length, 1, `${name}: one exit`);
+    assert.match(r.html(), EXIT_SLOT, `${name}: the static href is what a reader without the shell still gets`);
+    assert.doesNotMatch(r.html(), /Open the work board/, `${name}: the old hardcoded exit stays gone`);
+    assert.ok(r.fills.length >= 1, `${name}: the page asked the shell to fill the exit it placed`);
   }
 });
 
-test('a hostile or useless ?from= is refused, never followed', async () => {
-  const bad = [
-    '//evil.example', '/\\evil.example', 'javascript:alert(1)', 'https://evil.example/x',
-    '/api/gds/auth/web/callback', '/lib/bongos-client.js',
-    '/task/1003305',          // this same record — a loop, not a way back
-    'work', '/ work', '',
-  ];
-  for (const from of bad) {
-    const r = renderTask(BASE_TASK, { search: '?from=' + encodeURIComponent(from) });
-    await r.boot(); await settle();
-    assert.match(r.html(), /href="\/work">Back to the work board</, `from=${JSON.stringify(from)}`);
-    assert.equal(r.el('task-back').href, '/work', `the crumb refuses from=${JSON.stringify(from)} too`);
-  }
+test('the page no longer decides the way back: ?from= is the shell\'s to read', async () => {
+  const r = renderTask(BASE_TASK, { search: '?from=' + encodeURIComponent('/goals#/goal/1000081'), shell: true });
+  await r.boot(); await settle();
+  assert.doesNotMatch(r.html(), /href="\/goals#\/goal\/1000081"/, 'task.js writes no origin of its own into the exit');
+  assert.doesNotMatch(TASK_SRC, /\bsafeHallPath\b|\breferrerPath\b|\bexitTarget\b|\bapplyExit\b/,
+    'the second copy of the origin logic is gone, so the two cannot drift');
 });
 
-test('the two honest failures exit the same way the record does', async () => {
-  for (const status of [404, 500]) {
-    const r = renderTask(BASE_TASK, { status, search: FROM_GOAL });
-    await r.boot(); await settle();
-    assert.match(r.html(), /href="\/goals#\/goal\/1000081">Back to goal 1000081</, `status ${status}`);
-    assert.doesNotMatch(r.html(), /Open the work board/, `status ${status} still hardcodes the board`);
-  }
+test('without a shell the record still renders, and its exit still goes somewhere', async () => {
+  const r = renderTask(BASE_TASK);
+  await r.boot(); await settle();
+  assert.match(r.html(), EXIT_SLOT);
+  assert.equal(r.fills.length, 0);
 });
 
-test('the crumb is an element task.js can point, with its label apart from the icon', () => {
-  assert.match(taskHtml, /<a class="rec-back" id="task-back" href="\/work">/, 'the static href is the fallback the page ships with');
-  assert.match(taskHtml, /<span id="task-back-label">Back to tasks<\/span>/, 'the label is its own node, so the icon survives a relabel');
+test('the crumb is the record\'s address only; the fallback rides the body', () => {
+  assert.doesNotMatch(taskHtml, /rec-back|task-back/, 'the page-drawn back link is gone');
+  assert.match(taskHtml, /<body [^>]*data-back-fallback="\/work"/, 'a deep-linked task still has a way back');
+  assert.match(taskHtml, /<p class="rec-sub" id="task-sub">/);
 });
 
 // ---- 11. the description is markdown, and renders as it (task 1003465) --------

package/tests/hall_tweak_editor.mjs

@@ -635,12 +635,13 @@ try {
     assert.match(HTML, /<body data-page="tweak-editor"[^>]*data-fullscreen-switch/);
     assert.equal((HTML.match(/<h1\b/g) || []).length, 1);
     assert.ok(HTML.indexOf('tweak-editor-lib.js') < HTML.indexOf('tweak-editor.js?'), 'the lib loads first');
-    assert.match(HTML, /shell\.js\?v=2026-10-02-theme/);
+    assert.match(HTML, /shell\.js\?v=2026-10-02-back/);
     assert.equal(/fonts\.googleapis\.com\/css/.test(HTML), false);
     for (const id of ['tw-bar', 'tw-counter', 'tw-open', 'tw-open-more', 'tw-divider', 'tw-openwrap', 'tw-open-menu', 'tw-open-tab', 'tw-open-split', 'tw-frame', 'tw-frame-view', 'tw-split-close', 'tw-download', 'tw-upload', 'tw-file', 'tw-submit', 'tw-paper', 'tw-doc', 'tw-notice', 'tw-done', 'tw-take', 'tw-pick', 'tw-picks', 'tw-refused', 'tw-refused-title', 'tw-refused-list', 'tw-refused-next', 'tw-refused-download', 'tw-refused-close']) {
       assert.ok(new RegExp(`id="${id}"`).test(HTML), `#${id} is in the markup`);
     }
-    assert.match(HTML, />← studio</);
+    // task 1004477: the bar's exit is the shell's, which fills its words.
+    assert.match(HTML, /<a class="tw-back" data-shell-exit href="\/builders\/studio">Back to studio</);
     assert.match(HTML, />submit page</);
     assert.match(HTML, />back to the studio</);
   });

package/tests/nav_permission_atoms.mjs

@@ -87,7 +87,7 @@ test('the hall-preview fixture carries every atom /me resolves', () => {
 // the file and left the query alone, so a returning browser kept the cached copy —
 // a fix that reaches nobody looks identical to a fix that does not work.
 
-const SHELL_SHA = 'a8dc2884930ca19a';
+const SHELL_SHA = 'e5094c169d5ee6ef';
 
 test('shell.js has not changed without its cache-bust being bumped', () => {
   const actual = crypto.createHash('sha256').update(SHELL).digest('hex').slice(0, 16);

package/tests/provision.mjs

@@ -1078,12 +1078,17 @@ await ta('scaffoldStandaloneRepo: a REGISTRY-pinned consumer control plane PACKS
 // ADR 0361: merges publish as candidates and the platform hall runs them, so the core
 // this hall runs is routinely AHEAD of the registry's `latest` label. A new project —
 // and the pin refresh that runs in the same provisioning pass — must get the release.
-t('projectCoreDecision: the hall ahead of the release → the release; level or unreadable → the running core', () => {
+t('projectCoreDecision: the hall ahead of OR behind the release → the release; level or unreadable → the running core', () => {
   assert.deepEqual(
     (({ version, source }) => ({ version, source }))(RP.projectCoreDecision({ running: '1.19.60', released: '1.19.50' })),
     { version: '1.19.50', source: 'released' });
   assert.equal(RP.projectCoreDecision({ running: '1.19.50', released: '1.19.50' }).source, 'running', 'level → byte-exact running core, no registry pack');
-  assert.equal(RP.projectCoreDecision({ running: '1.19.40', released: '1.19.50' }).version, '1.19.40', 'never moves a project PAST what the hall has run');
+  // task 1004556: a runner BEHIND the release (a patch-channel install stuck on 1.20.82
+  // while 1.21.x was released) must not hand its stale core to a new project
+  assert.deepEqual(
+    (({ version, source }) => ({ version, source }))(RP.projectCoreDecision({ running: '1.20.82', released: '1.21.20' })),
+    { version: '1.21.20', source: 'released' }, 'behind the release → the release, across a minor too');
+  assert.equal(RP.projectCoreDecision({ running: '1.19.40', released: '1.19.50' }).source, 'released', 'and within a minor');
   assert.equal(RP.projectCoreDecision({ running: '1.19.60', released: null }).version, '1.19.60', 'no label → fail-open to the running core');
   assert.equal(RP.projectCoreDecision({ running: '1.19.60', released: '1.19.50-rc.1' }).source, 'running', 'a prerelease label is not a release');
   assert.equal(RP.projectCoreDecision({ running: '1.19.60', released: '1.19.50;touch /tmp/x' }).source, 'running', 'a non-semver label never reaches a shell');