@bongos/core 1.21.22 → 1.21.24

package/modules/hall-ui/public/shell.js

@@ -513,9 +513,16 @@
   // not a drill-down and shows none: the sidebar click leaves a one-shot note
   // (sessionStorage) naming its target, and the page it lands on reads it.
   // The origin is `?from=` (a link that knows where it came from), else the
-  // same-origin referrer. A page drawing its own back link (.rec-back — task,
-  // idea — or any element marked data-own-back, the tweak editor's "← studio")
-  // keeps it and the bar adds no second one.
+  // same-origin referrer.
+  //
+  // task 1004477: this is the ONLY place a hall page's way back is decided —
+  // no page draws its own Back link any more. Two hooks cover what the page
+  // copies used to:
+  //   - <body data-back-fallback="/work"> names where Back goes when there is
+  //     no origin at all (a deep-linked task or idea, the tweak editor);
+  //   - a link marked [data-shell-exit] is a second exit the page places (an
+  //     error state's button, the tweak editor's bar in full screen, where the
+  //     top bar is hidden), and the shell fills its address and its words.
   var NAV_HOP_KEY = 'hall-nav-hop';
   function hallPath(url) {
     return String(url.pathname).replace(/^\/builders(?=\/|$)/, '').replace(/\.html$/, '').replace(/\/index$/, '') || '/';
@@ -527,8 +534,10 @@
       window.sessionStorage.removeItem(NAV_HOP_KEY);
     } catch (_) { /* private mode: no note, so fall through */ }
     if (hop && hop === hallPath(location)) return null;
-    if (!document.querySelector || document.querySelector('.rec-back, [data-own-back]')) return null;
-    var here = hallPath(location) + (location.search || '');
+    return linkOrigin() || fallbackOrigin();
+  }
+  // The page this one was opened from: ?from=, then a same-origin referrer.
+  function linkOrigin() {
     var from = null;
     var viaReferrer = false;
     try {
@@ -544,9 +553,48 @@
     var params = new URLSearchParams(from.search);
     params.delete('from');
     var search = params.toString() ? '?' + params.toString() : '';
+    // This page's address without its own ?from=, so `?from=` naming the page
+    // itself (a loop, not a way back) is caught like any other self-link.
+    var ownParams = new URLSearchParams(location.search || '');
+    ownParams.delete('from');
+    var here = hallPath(location) + (ownParams.toString() ? '?' + ownParams.toString() : '');
     if (path + search === here) return null;
     return { href: path + search + (from.hash || ''), path: path, label: backLabel(path, from.hash), viaReferrer: viaReferrer };
   }
+  // Where Back goes with no origin: the page's own <body data-back-fallback>,
+  // honoured only as a path on this host (one leading slash, never the API).
+  function fallbackOrigin() {
+    var f = document.body && document.body.dataset && document.body.dataset.backFallback;
+    if (!f || !/^\/(?!\/)/.test(f) || /[\\\s]/.test(f)) return null;
+    var u;
+    try { u = new URL(f, location.origin); } catch (_) { return null; }
+    if (u.origin !== location.origin) return null;
+    var path = hallPath(u);
+    if (/^\/(api|auth|lib)(\/|$)/.test(path) || path === hallPath(location)) return null;
+    return { href: path + (u.search || '') + (u.hash || ''), path: path, label: backLabel(path, u.hash), viaReferrer: false };
+  }
+  // "Back to tasks", "Back to goal 12": a nav label reads as a place mid-sentence,
+  // so it is lowercased unless it carries an acronym ("API docs").
+  function exitWords(label) {
+    return 'Back to ' + (/[A-Z]{2}/.test(label) ? label : label.toLowerCase());
+  }
+  // Fill every [data-shell-exit] link under `root` with the way back. With no
+  // way back at all the exit still works: it goes home. A page script that
+  // renders an exit later (task.js's failure states) calls this once it has.
+  function fillExits(root) {
+    var scope = root || document;
+    if (!scope.querySelectorAll) return;
+    var target = BACK || { href: '/', label: 'Home', viaReferrer: false };
+    var links = scope.querySelectorAll('[data-shell-exit]');
+    for (var i = 0; i < links.length; i++) {
+      links[i].setAttribute('href', target.href);
+      links[i].textContent = exitWords(target.label);
+      if (!links[i].dataset.shellExitWired) {
+        links[i].dataset.shellExitWired = '1';
+        links[i].addEventListener('click', onBackClick);
+      }
+    }
+  }
   function backLabel(path, hash) {
     if (path === '/') {
       var m = /^#\/(task|idea|blocker)\/(\d+)/.exec(hash || '');
@@ -1381,6 +1429,7 @@
   applyFullscreen(storedFullscreen());
   applyAccess(null); // default: everything gated until access is known
   wire();
+  fillExits();
   if (IS_INDEX) {
     route({ scroll: false });
   } else {
@@ -1407,5 +1456,7 @@
     // task 1004544: a page with its own light/dark switch (the governor city
     // and street) repaints the top bar's after writing 'hall-theme'.
     applyTheme: applyTheme,
+    // task 1004477: a page that renders an exit after boot asks the shell to fill it.
+    fillExits: fillExits,
   };
 })();

package/modules/hall-ui/public/street.html

@@ -203,7 +203,7 @@
   </div>
 </div>
 
-<script src="/builders/shell.js?v=2026-10-02-theme"></script>
+<script src="/builders/shell.js?v=2026-10-02-back"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/city-draw.js?v=2026-10-02-street1"></script>
 <script src="/builders/street-draw.js?v=2026-10-02-street1"></script>

package/modules/hall-ui/public/studio.html

@@ -176,7 +176,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-10-02-theme"></script>
+<script src="/builders/shell.js?v=2026-10-02-back"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <!-- The kit, for its ONE renderer: the full-size ship-time visual figure

package/modules/hall-ui/public/task.html

@@ -15,7 +15,7 @@
   <link rel="stylesheet" href="/builders/record.css">
   <link rel="stylesheet" href="/builders/task.css">
 </head>
-<body data-page="task" data-page-title="Task">
+<body data-page="task" data-page-title="Task" data-back-fallback="/work">
 
 <div class="app">
   <aside class="app-sidebar" id="app-sidebar" aria-label="Primary"></aside>
@@ -24,14 +24,11 @@
     <header class="app-topbar" id="app-topbar"></header>
     <div class="app-content">
       <div class="page-head">
-        <!-- task 2175: the breadcrumb sits in the page head, above the card, so a
-             deep-linked visitor (this page is deliberately not in the nav) has a
-             way back before the task body has loaded. task 1003468: task.js
-             points it at where the reader came from (?from=, then the
-             referrer); /work is only the fallback it ships with. -->
+        <!-- task 1004477: the way back is the shell's top-bar Back link, set
+             before the task body loads. This page is deliberately not in the
+             nav, so <body data-back-fallback> gives a deep-linked visitor one
+             even with no ?from= and no referrer. -->
         <div class="rec-crumb">
-          <a class="rec-back" id="task-back" href="/work">
-            <svg class="rec-back__ic" viewBox="0 0 16 16" aria-hidden="true"><path d="M9.4 3.6 5 8l4.4 4.4"/><path d="M5 8h7.2"/></svg><span id="task-back-label">Back to tasks</span></a>
           <p class="rec-sub" id="task-sub">Loading task</p>
         </div>
       </div>
@@ -57,7 +54,7 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
-<script src="/builders/shell.js?v=2026-10-02-theme"></script>
+<script src="/builders/shell.js?v=2026-10-02-back"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so task.js can pull from it. -->

package/modules/hall-ui/public/task.js

@@ -182,57 +182,20 @@
     return m ? m[1] : null;
   }
 
-  // task 1003468 — where the reader came from, so the record can send them back
-  // there rather than always to the work board. Precedence: `?from=` (written
-  // by the list that opened the record — a query param so it survives a reload
-  // and a copied link) → a same-origin referrer → the work board. A value is
-  // honoured only as a path on THIS host: one leading slash (a second is another
-  // origin), no backslash (browsers read `/\host` as `//host`), no whitespace,
-  // never the API and never this same record.
-  const EXIT_MAX_LEN = 2048;
-  function safeHallPath(v) {
-    if (typeof v !== 'string' || !v || v.length > EXIT_MAX_LEN) return null;
-    if (!/^\/(?!\/)/.test(v) || /[\\\s]/.test(v)) return null;
-    if (/^(\/builders)?\/(api|lib)\//.test(v)) return null;
-    if (v.split(/[?#]/)[0] === location.pathname) return null;
-    return v;
-  }
-  function referrerPath() {
-    let u;
-    try { u = new URL(document.referrer); } catch (_) { return null; }
-    if (u.origin !== location.origin) return null;
-    return safeHallPath(u.pathname + u.search + u.hash);
-  }
-  // "goal 1000081", "task 12", "the work board", "sessions" — said the way the
-  // sidebar says it, so the exit reads as a place and not as a URL.
-  function exitLabel(href) {
-    const rel = href.replace(/^\/builders(?=[/?#]|$)/, '');
-    let m;
-    if ((m = /#\/goal\/(\d+)/.exec(rel))) return `goal ${m[1]}`;
-    if ((m = /^\/(task|idea)\/(\d+)/.exec(rel))) return `${m[1]} ${m[2]}`;
-    const seg = (/^\/([a-z][a-z-]*)/.exec(rel) || [])[1];
-    if (!seg) return 'home';
-    if (seg === 'work') return 'the work board';
-    return seg.replace(/-/g, ' ');
-  }
-  function exitTarget() {
-    let from = null;
-    try { from = new URLSearchParams(location.search).get('from'); } catch (_) { /* no query */ }
-    const href = safeHallPath(from) || referrerPath() || `${hallBase()}/work`;
-    return { href, label: exitLabel(href) };
-  }
+  // task 1004477 — the way back is the SHELL's, not this page's. task 1003468
+  // worked out where the reader came from here (?from=, then the referrer, then
+  // the board); shell.js now decides that for every hall page, and this page
+  // only places the exit: a [data-shell-exit] link the shell fills with the same
+  // address and words as its top-bar Back link. The static href is what a
+  // reader without the shell (a failed script) still gets.
   function exitLinkHtml() {
-    const { href, label } = exitTarget();
-    return `<a class="td-btn" href="${escapeHtml(href)}">Back to ${escapeHtml(label)}</a>`;
+    return `<a class="td-btn" data-shell-exit href="${hallBase()}/work">Back to tasks</a>`;
   }
-  // The crumb in the page head is set before the fetch, so the way back exists
-  // in every state — loading, not found, failed — not just the happy one.
-  function applyExit() {
-    const { href, label } = exitTarget();
-    const back = $('#task-back');
-    if (back) back.href = href;
-    const lbl = $('#task-back-label');
-    if (lbl) lbl.textContent = `Back to ${label}`;
+  // Called after every render that places an exit, so the button and the top
+  // bar never disagree about where Back goes.
+  function fillExits(root) {
+    const shell = window.OTBShell;
+    if (shell && typeof shell.fillExits === 'function') shell.fillExits(root);
   }
 
   function rankText(rr) {
@@ -852,6 +815,7 @@
 
     const body = $('#task-body');
     if (body) body.innerHTML = parts.join('');
+    fillExits(body);
     announceShown(t);
 
     const copyBtn = $('#copy-prompt-btn');
@@ -1043,6 +1007,7 @@
     `;
     const sub = $('#task-sub');
     if (sub) sub.textContent = 'Not found';
+    fillExits(body);
   }
 
   function renderError(id) {
@@ -1055,10 +1020,10 @@
     `;
     const sub = $('#task-sub');
     if (sub) sub.textContent = 'Could not load';
+    fillExits(body);
   }
 
   async function load() {
-    applyExit();
     const id = taskIdFromPath();
     if (!id) { renderNotFound(''); return; }
     try {

package/modules/hall-ui/public/task.states.json

@@ -8,7 +8,7 @@
   "ignoreConsole": ["/api/(gds|bongos)/", "\\b401\\b", "\\b404\\b", "Unauthorized", "Not Found", "load failed"],
   "states": {
     "record": { "auth": true, "actions": [["wait", 600]], "expect": { "visible": ["#task-body", "#task-grade", "#task-sessions", "#copy-prompt-btn"] } },
-    "from-goal": { "auth": true, "url": "/task/2166?from=%2Fgoals%23%2Fgoal%2F1000081", "actions": [["wait", 600]], "expect": { "visible": ["#task-back", "#copy-prompt-btn"], "attr": [["#task-back", "href", "/goals#/goal/1000081"]] } },
+    "from-goal": { "auth": true, "url": "/task/2166?from=%2Fgoals%23%2Fgoal%2F1000081", "actions": [["wait", 600]], "expect": { "visible": ["#topbar-back", "#copy-prompt-btn"], "attr": [["#topbar-back", "href", "/goals#/goal/1000081"]] } },
     "missing": { "auth": true, "url": "/task/1003999", "actions": [["wait", 600]], "expect": { "visible": ["#task-h"] } }
   },
   "reducedMotion": { "auth": true, "actions": [["wait", 600]] }

package/modules/hall-ui/public/thinking.html

@@ -138,7 +138,7 @@
   </div>
 </div>
 
-<script src="/builders/shell.js?v=2026-10-02-theme"></script>
+<script src="/builders/shell.js?v=2026-10-02-back"></script>
 <script src="/builders/palette.js" defer></script>
 
 <script src="/builders/idea-objects.js?v=2026-09-27-split"></script>

package/modules/hall-ui/public/tweak-editor.css

@@ -177,6 +177,10 @@ html[data-fullscreen="on"] .tw-bar { width: min(1200px, calc(100% - 144px)); }
 /* With the chrome showing, the shell's fixed top bar holds the window's top,
    so the stuck bar stops under it instead of sliding beneath it. */
 html:not([data-fullscreen="on"]) .tw-bar { top: calc(var(--topbar-h, 56px) + 12px); }
+/* task 1004477: the bar's exit is the shell's Back link, filled by shell.js.
+   With the chrome showing, the top bar already carries it, so the bar shows it
+   only in full screen and the page never offers two. */
+html:not([data-fullscreen="on"]) .tw-stage .tw-back { display: none; }
 .tw-stage .tw-back {
   display: inline-flex;
   align-items: center;

package/modules/hall-ui/public/tweak-editor.html

@@ -29,7 +29,7 @@
      data-fullscreen-switch: the shell's full-screen switch (task 1004327). The
      artboard is the editor over the whole window, so the editor opens full
      screen the first time (tweak-editor.js), and the switch is remembered. -->
-<body data-page="tweak-editor" data-page-title="Tweak a page" data-fullscreen-switch>
+<body data-page="tweak-editor" data-page-title="Tweak a page" data-fullscreen-switch data-back-fallback="/studio">
 
 <div class="app">
   <aside class="app-sidebar" id="app-sidebar" aria-label="Primary"></aside>
@@ -49,7 +49,9 @@
         <!-- A <div>, not a <header>: the shell's top bar is the page's one
              <header> (the kit's one-header-main-h1 floor). -->
         <div class="tw-bar" id="tw-bar">
-          <a class="tw-back" data-own-back href="/builders/studio">← studio</a>
+          <!-- task 1004477: the shell's exit, shown only in full screen, where the
+               top bar (and its Back link) is hidden. The shell fills it. -->
+          <a class="tw-back" data-shell-exit href="/builders/studio">Back to studio</a>
           <span class="tw-name"><span id="tw-name">Tweak a page</span> <span class="tw-surface" id="tw-surface"></span></span>
           <span class="tw-counter" id="tw-counter" aria-live="polite"></span>
           <div class="tw-actions">
@@ -140,7 +142,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-10-02-theme"></script>
+<script src="/builders/shell.js?v=2026-10-02-back"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <script src="/builders/brand-holes.js?v=2026-09-29-aqfix"></script>

package/modules/hall-ui/public/watch.html

@@ -162,7 +162,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-10-02-theme"></script>
+<script src="/builders/shell.js?v=2026-10-02-back"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before watch.js, which pulls from it. -->

package/modules/hall-ui/public/work.html

@@ -171,7 +171,7 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
-<script src="/builders/shell.js?v=2026-10-02-theme"></script>
+<script src="/builders/shell.js?v=2026-10-02-back"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so work.js can pull from it. -->

package/modules/hall-ui/records/hall-navigation.md

@@ -1,4 +1,4 @@
-# Hall navigation — the Back link and the standard full-screen switch (task 1004430)
+# Hall navigation — the Back link and the standard full-screen switch (tasks 1004430, 1004477)
 
 Covers: every shelled hall page (`shell.js`, `style.css`), plus `goal-map.html` joining the chrome.
 
@@ -7,16 +7,19 @@ Covers: every shelled hall page (`shell.js`, `style.css`), plus `goal-map.html`
 - `shell.js` renders `#topbar-back` ("← <label>") at the head of the top bar when the page was reached from INSIDE another hall page. The origin is `?from=` first, then a same-origin `document.referrer`; the label is that page's `NAV` label (or "task N" / "idea N" / "goal N" for a record).
 - **A sidebar hop is not a drill-down.** A sidebar link click writes a one-shot `sessionStorage['hall-nav-hop']` naming its target; the page it lands on reads and deletes it, and shows no Back link. Without this every page reached from the sidebar would carry a Back link, which is just history.
 - When the origin came from the referrer, the click runs `history.back()`, so a list comes back with its scroll and filters; the `href` is still the real address for a new tab.
-- A page drawing its own record back link (`.rec-back` — `task.html`, `idea.html`) keeps it; the bar adds no second one. The origin's own `?from=` is dropped so back links never chain.
+- **No page draws its own Back link (task 1004477).** `task.html`, `idea.html` and the tweak editor used to, and the bar skipped its link on those pages. Now the shell decides the way back for every page, with two hooks:
+  - `<body data-back-fallback="/work">` names where Back goes when there is no origin (a deep-linked task falls back to Tasks, an idea to Your thinking, the tweak editor to Studio). It is honoured only as a path on this host; a sidebar hop still shows nothing.
+  - A link marked `[data-shell-exit]` is a second exit a page places: the task record's actions row and its two failure renders, the primer and drachmae error notes, and the tweak editor's bar. The shell fills its `href` and its words ("Back to goal 12", "Back to tasks"), and with no way back at all it goes home. A page that renders one after boot calls `OTBShell.fillExits(root)`.
+  - The origin's own `?from=` is dropped so back links never chain, and a `?from=` naming the page itself is refused.
 - `/profile?id=N` highlights **Builders**, not your own Profile, unless `/me` says the id is yours.
 
 ## Full screen is standard
 
 - Every shelled page gets the switch. `<body data-fullscreen-switch="off">` opts out. The bare attribute means "this page lays itself out for full screen" (sky, studio, tweak editor); a page without it is **plain**, and the shell sets `html[data-fullscreen-plain="on"]` so `style.css` pads `.app-content` clear of the corner button.
-- In full screen the button is a labelled pill, an icon plus "Exit full screen", in `--bg-card` with a ring and a drop shadow, not the hall's near-clear glass. Under 640px it drops the words, and the tweak editor keeps the 36px round button because its bar is laid out for one. A page whose own back link is not `.rec-back` marks it `data-own-back`. On the black sky in the light theme the glass button was a dark icon on black, and because the choice is remembered per page, `/thinking` looked stuck with no bars. Entering full screen (or a page opening in it) also shows a 4.5s `#fullscreen-hint` saying how to leave.
+- In full screen the button is a labelled pill, an icon plus "Exit full screen", in `--bg-card` with a ring and a drop shadow, not the hall's near-clear glass. Under 640px it drops the words, and the tweak editor keeps the 36px round button because its bar is laid out for one. Full screen hides the top bar and its Back link, so the tweak editor's bar carries the shell's exit and shows it only in full screen (`tweak-editor.css`); with the chrome showing, the page never offers two. On the black sky in the light theme the glass button was a dark icon on black, and because the choice is remembered per page, `/thinking` looked stuck with no bars. Entering full screen (or a page opening in it) also shows a 4.5s `#fullscreen-hint` saying how to leave.
 
 ## The project sky joined the hall
 
 `goal-map.html` now uses thinking.html's structure: sidebar and top-bar mounts, `style.css`, `shell.js`, the sky inside `<main id="hall-main" class="sky-stage">`, and a `<div class="brand">` because the shell's bar is the page's one `<header>`. In `thinking.css` both pages share one stage rule, `body[data-page] .sky-stage`. No hall page is standalone any more (`tests/hall_audit.mjs` `STANDALONE_EXEMPT` is empty).
 
-Tests: `tests/hall_fullscreen.mjs` (the standard switch, `plain`, Back link cases), `tests/goal_map_page.mjs`, `tests/hall_audit.mjs` §8.
+Tests: `tests/hall_fullscreen.mjs` (the standard switch, `plain`, Back link, fallback and exit cases), `tests/hall_record_world.mjs` §10 (the record places its exit), `tests/goal_map_page.mjs`, `tests/hall_audit.mjs` §8.

package/modules/sessions/db.js

@@ -585,6 +585,10 @@ const SESSION_SUMMARY_COLS = `
   -- here means the row predates the classifier and the backfill has not reached
   -- it, which the ledger renders as a dash rather than claiming a verdict.
   sr.session_type,
+  -- ADR 0051 / task 1002830: whether a full transcript is stored, so the ledger only
+  -- offers a Read door where there is something behind it (rows that predate
+  -- transcript capture have none, and a door to a 404 is worse than no door).
+  EXISTS (SELECT 1 FROM session_transcripts st WHERE st.session_id = sr.session_id) AS has_transcript,
   sr.uploaded_at`;
 
 // searchSessions — cross-builder search over the corpus, filtered by session

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.22",
+  "version": "1.21.24",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.22",
+      "version": "1.21.24",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.22",
+  "version": "1.21.24",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8888,5 +8888,17 @@
       "id": "1004556",
       "text": "New projects are now always started on the latest released version of Cloud Bongos, even when the service that sets them up is running an older one. Until now, a lagging setup service passed its own old version to every new pr"
     }
+  ],
+  "1.21.23": [
+    {
+      "id": "1004477",
+      "text": "Every page in the builders hall now goes back the same way: one Back button in the top bar. Task and idea pages used to draw their own back links, and the tweak editor had its own too. Opened from a goal, a task now shows \"Bac"
+    }
+  ],
+  "1.21.24": [
+    {
+      "id": "1002830",
+      "text": "Sessions now has a Read button on each row that opens the full conversation for that session. Only the session's owner or an administrator can read it, and administrator reads are logged."
+    }
   ]
 }

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.22'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.24'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/hall_fullscreen.mjs

@@ -28,10 +28,12 @@ const read = (f) => fs.readFileSync(path.join(HALL, f), 'utf8');
 // is SHARED across boots on purpose: a second boot over the same store is a reload.
 // `optIn`: true = the bare attribute (the page lays itself out for full screen),
 // null = no attribute (a plain page — the switch is standard since task
-// 1004430), 'off' = the page opts out. `referrer` / `search` / `session` /
-// `recBack` drive the top bar's Back link (task 1004430).
+// 1004430), 'off' = the page opts out. `referrer` / `search` / `session` drive
+// the top bar's Back link (task 1004430); `fallback` is the page's
+// <body data-back-fallback> and `exits` how many [data-shell-exit] links the
+// page placed for the shell to fill (task 1004477).
 function boot({ page = 'thinking', optIn = true, store = {}, storageThrows = false,
-  referrer = '', search = '', session = {}, recBack = false, path = null, meId = null } = {}) {
+  referrer = '', search = '', session = {}, fallback = null, exits = 0, path = null, meId = null } = {}) {
   const els = new Map();
   const windowListeners = {};
   const timers = [];
@@ -65,9 +67,10 @@ function boot({ page = 'thinking', optIn = true, store = {}, storageThrows = fal
     return { href, dataset: {}, getAttribute: (k) => (k === 'href' ? href : null),
       classList: { add: (c) => cls.add(c), remove: (c) => cls.delete(c), contains: (c) => cls.has(c) } };
   });
+  const exitLinks = Array.from({ length: exits }, () => makeEl(null));
   const attr = optIn === true ? '' : optIn === false ? null : optIn;
   const body = {
-    dataset: { page },
+    dataset: fallback == null ? { page } : { page, backFallback: fallback },
     hasAttribute: (k) => k === 'data-fullscreen-switch' && attr !== null,
     getAttribute: (k) => (k === 'data-fullscreen-switch' ? attr : null),
     appendChild() {},
@@ -77,8 +80,9 @@ function boot({ page = 'thinking', optIn = true, store = {}, storageThrows = fal
     referrer,
     documentElement: { dataset: {}, style: {}, classList: { add() {}, remove() {}, toggle() { return false; }, contains() { return false; } } },
     getElementById,
-    querySelector: (sel) => (/\.rec-back/.test(sel) && recBack ? {} : null),
-    querySelectorAll: (sel) => (sel === '#app-sidebar .nav-item' ? navItems : []),
+    querySelector: () => null,
+    querySelectorAll: (sel) => (sel === '#app-sidebar .nav-item' ? navItems
+      : sel === '[data-shell-exit]' ? exitLinks : []),
     createElement() { return makeEl(null); },
     addEventListener() {}, dispatchEvent() {},
     get cookie() { return ''; }, set cookie(_v) {},
@@ -123,6 +127,8 @@ function boot({ page = 'thinking', optIn = true, store = {}, storageThrows = fal
     plain: () => root.dataset.fullscreenPlain === 'on',
     active: () => navItems.filter((a) => a.classList.contains('nav-item--active')).map((a) => a.href),
     topbar: () => topbar._html,
+    exits: () => exitLinks.map((a) => ({ href: a.getAttribute('href'), text: a.textContent, wired: !!(a._on && a._on.click) })),
+    shell: () => windowObj.OTBShell,
     session,
     resizes: () => resizes,
     // Press a key the way the browser dispatches it: every window listener,
@@ -170,14 +176,69 @@ test('Back: ?from= wins over the referrer, and a record origin is named as the r
   assert.match(p.topbar(), />task 42<\/span>/);
 });
 
-test('Back: none after a sidebar hop, from another site, from the page itself, or where the page draws its own', () => {
+test('Back: none after a sidebar hop, from another site, or from the page itself', () => {
   const hop = boot({ page: 'goals', optIn: false, referrer: 'https://h/work', session: { 'hall-nav-hop': '/goals' } });
   assert.doesNotMatch(hop.topbar(), /topbar-back/, 'the sidebar is not a drill-down');
   assert.equal(hop.session['hall-nav-hop'], undefined, 'the note is one-shot');
   assert.doesNotMatch(boot({ page: 'goals', optIn: false, referrer: 'https://elsewhere.example/roster' }).topbar(), /topbar-back/);
   assert.doesNotMatch(boot({ page: 'goals', optIn: false, referrer: 'https://h/goals' }).topbar(), /topbar-back/);
-  assert.doesNotMatch(boot({ page: 'task', optIn: false, path: '/task/9', referrer: 'https://h/goals', recBack: true }).topbar(), /topbar-back/,
-    'the task record keeps its own back link, and the bar adds no second one');
+});
+
+// task 1004477: no page draws its own Back any more, so the shell's is the
+// record's too — the task page opened from a goal shows Back to that goal.
+test('Back: a record page gets the bar\'s Back like every other page', () => {
+  const p = boot({ page: 'task', optIn: false, path: '/task/9', search: '?from=' + encodeURIComponent('/goals#/goal/12'), fallback: '/work' });
+  assert.match(p.topbar(), /<a class="topbar-back" id="topbar-back" href="\/goals#\/goal\/12"/);
+  assert.match(p.topbar(), />goal 12<\/span>/);
+  assert.doesNotMatch(SHELL, /rec-back|data-own-back/, 'the suppression for page-drawn links is gone');
+});
+
+test('Back: with no origin, the page\'s data-back-fallback is the way back', () => {
+  const task = boot({ page: 'task', optIn: false, path: '/task/9', fallback: '/work' });
+  assert.match(task.topbar(), /href="\/work"/, 'a deep-linked task falls back to the board');
+  assert.match(task.topbar(), />Tasks<\/span>/);
+  const idea = boot({ page: 'idea', optIn: false, path: '/idea/4', referrer: 'https://elsewhere.example/', fallback: '/thinking' });
+  assert.match(idea.topbar(), /href="\/thinking"/, 'a cross-site arrival falls back too');
+  assert.doesNotMatch(boot({ page: 'goals', optIn: false }).topbar(), /topbar-back/, 'a page with no fallback still shows none');
+  assert.doesNotMatch(boot({ page: 'studio', optIn: false, path: '/studio', fallback: '/studio' }).topbar(), /topbar-back/,
+    'a fallback to the page itself is not a way back');
+});
+
+test('Back: a hostile ?from= is refused, and the fallback stands in', () => {
+  const bad = ['//evil.example', '/\\evil.example', 'javascript:alert(1)', 'https://evil.example/x',
+    '/api/gds/auth/web/callback', '/lib/bongos-client.js', '/task/9'];
+  for (const from of bad) {
+    const p = boot({ page: 'task', optIn: false, path: '/task/9', search: '?from=' + encodeURIComponent(from), fallback: '/work' });
+    assert.match(p.topbar(), /id="topbar-back" href="\/work"/, `from=${JSON.stringify(from)}`);
+  }
+  for (const fallback of ['//evil.example', 'https://evil.example/', '/api/x', 'work']) {
+    assert.doesNotMatch(boot({ page: 'task', optIn: false, path: '/task/9', fallback }).topbar(), /topbar-back/,
+      `a fallback is a path on this host or nothing: ${JSON.stringify(fallback)}`);
+  }
+});
+
+test('Back: a sidebar hop beats the fallback — the sidebar is still not a drill-down', () => {
+  const p = boot({ page: 'studio', optIn: false, path: '/studio', fallback: '/work', session: { 'hall-nav-hop': '/studio' } });
+  assert.doesNotMatch(p.topbar(), /topbar-back/);
+});
+
+test('exits: every [data-shell-exit] link carries the bar\'s way back, in a sentence', () => {
+  const p = boot({ page: 'task', optIn: false, path: '/task/9', search: '?from=' + encodeURIComponent('/goals#/goal/12'), exits: 2 });
+  assert.deepEqual(p.exits(), [
+    { href: '/goals#/goal/12', text: 'Back to goal 12', wired: true },
+    { href: '/goals#/goal/12', text: 'Back to goal 12', wired: true },
+  ]);
+  const board = boot({ page: 'task', optIn: false, path: '/task/9', fallback: '/work', exits: 1 });
+  assert.deepEqual(board.exits()[0], { href: '/work', text: 'Back to tasks', wired: true }, 'a nav label reads lowercase mid-sentence');
+  const lost = boot({ page: 'primer', optIn: false, path: '/primer', exits: 1 });
+  assert.deepEqual(lost.exits()[0], { href: '/', text: 'Back to home', wired: true }, 'with no way back at all, an exit goes home');
+});
+
+test('exits: a page that renders one later asks the shell, and asking twice wires it once', () => {
+  const p = boot({ page: 'task', optIn: false, path: '/task/9', fallback: '/work', exits: 1 });
+  assert.equal(typeof p.shell().fillExits, 'function', 'the shell exposes it');
+  p.shell().fillExits();
+  assert.deepEqual(p.exits()[0], { href: '/work', text: 'Back to tasks', wired: true });
 });
 
 test('someone else\'s profile highlights Builders; your own hands the mark back to Profile', async () => {
@@ -191,9 +252,24 @@ test('someone else\'s profile highlights Builders; your own hands the mark back
   assert.deepEqual(boot({ page: 'profile', optIn: false }).active(), ['/profile'], 'no id: your own profile');
 });
 
-test('Back: a page\'s own back link (data-own-back, the tweak editor\'s "← studio") suppresses the bar\'s', () => {
-  assert.match(read('tweak-editor.html'), /<a class="tw-back" data-own-back href="\/builders\/studio">/);
-  assert.match(SHELL, /querySelector\('\.rec-back, \[data-own-back\]'\)/);
+// task 1004477: the pages that used to draw their own. Source checks, labelled
+// as such: what each page now CARRIES is markup, and the behaviour of what it
+// carries is the shell's, driven above.
+test('no hall page draws its own back link; each carries the shell\'s hooks instead', () => {
+  const editor = read('tweak-editor.html');
+  assert.match(editor, /<a class="tw-back" data-shell-exit href="\/builders\/studio">/,
+    'the editor\'s bar keeps an exit, because full screen hides the top bar');
+  assert.match(editor, /<body [^>]*data-back-fallback="\/studio"/);
+  assert.match(read('tweak-editor.css'), /html:not\(\[data-fullscreen="on"\]\) \.tw-stage \.tw-back \{ display: none; \}/,
+    'and shows it only in full screen, so the page never offers two');
+  assert.match(read('idea.html'), /<body [^>]*data-back-fallback="\/thinking"/);
+  for (const f of ['primer.html', 'drachmae.html']) {
+    assert.match(read(f), /<a class="btn btn--ghost" data-shell-exit href="\/builders">/, `${f}: its error exit is the shell's`);
+  }
+  for (const f of fs.readdirSync(HALL).filter((n) => n.endsWith('.html'))) {
+    assert.doesNotMatch(read(f), /class="rec-back|data-own-back/, `${f} draws no back link of its own`);
+  }
+  assert.doesNotMatch(read('record.css'), /\.rec-back/, 'and the archetype sheet styles none');
 });
 
 test('Back: an origin\'s own ?from= is dropped, so one page\'s way back never chains into the next', () => {