fix(newos4): take the UI shell off the startup path until the crash reports are explained

Symptom: operator reports newOS4 "started to crash since the last ui update"; a
user (Max) reports his browser crashed. Order: roll back, do not re-enable until
it is verified in a dev environment.

Root cause: not yet established, and the log work rules out the obvious suspect.
- 0 requests for modules/ext/ui-*.js in the entire access log: no interface mode
  has ever mounted in production, so a mode's own chrome cannot be the cause.
- all six modes driven on one page in headless Chromium at 390x844: no crash, no
  page errors, one #terminal-container, heap flat at 10 MB over a 25 s idle.
- the six errors.json entries that read like a crash report (SPA is not defined,
  DOM harness FAILED: N, "...reading 'makeInstance'") exist in no shipped file -
  grep on the served 1.29 MB bundle returns 0 - so they came from a harness run
  inside that one browser session.

Two real defects were found instead, both planned not bundled here:
- /ollama/api/chat inherits nginx's 1 MB default client_max_body_size and
  refused a 1,063,595-byte agent context with 413 (only 413 in 7 days).
- module-aiassist.js:2576 const originalPath = a.path || '' then .replace on a
  model-supplied non-string: TypeError, 3 events on tool:list_files, 32 sites
  with the same shape.

Fix: the UIShellModule registration in terminal.js is commented out with a dated
note and the revert recipe; bundles rebuilt from source; LATEST_VER v4.6.156 ->
v4.6.157; main.html's three ?v= refs bumped. The six modes are lazy ext files
whose first line is `if (!terminal.uiShell) return;`, so an accidental load is a
no-op and no first-run picker appears.

Verified: served core-bundle.js?v=v4.6.157 is cmp-identical to disk (1,298,695 B)
and the registration exists only as a comment (core-bundle.js:4082). Playwright
390x844: shellPresent false, uiShellModuleRegistered false, uiRoot false,
pickerNode false, moduleCount 47, help renders 21,802 chars, pageerrors [].

Workaround: none needed - users get classic only. Re-enable = restore the line,
rebuild, bump LATEST_VER + main.html, re-run admin/scripts/probe-ui-modes.py.
Plan: .hermes/plans/2026-11-09_224409-newos4-ui-rollback-dev-verify.md

3 files changed, 19 insertions, 3 deletions

diff --git a/modules/core/core-bundle.js b/modules/core/core-bundle.js
index c2b52d0..2b95828 100644
--- a/modules/core/core-bundle.js
+++ b/modules/core/core-bundle.js
@@ -4071,7 +4071,15 @@ Only output XML function calls for tool tasks. If no tool is needed, answer norm
                 this._safeRegister('SmartContextModule', 'smart context');
                 this._safeRegister('SimpleGUIModule', 'simple GUI builder');
                 this._safeRegister('DebugSupervisorModule', 'debug supervisor');
-                this._safeRegister('UIShellModule', 'UI shell');
+                // 2026-11-09 — UI shell DISABLED from startup (operator order after crash reports).
+                // The six interface modes (v4.6.152–156) are not in extKeys, so with the shell
+                // unregistered no mode can mount, no first-run picker appears, and `ui` does not
+                // exist: newOS4 boots to classic only. The ext ui-*.js files all begin with
+                // `if (!terminal.uiShell) return;`, so an accidental load is a no-op.
+                // Re-enable = restore this line, rebuild the bundle (scripts/rebuild-bundles.py),
+                // bump LATEST_VER + main.html ?v=, re-run admin/scripts/probe-ui-modes.py.
+                // Tracked in .hermes/plans/2026-11-09_*-newos4-ui-rollback.md
+                // this._safeRegister('UIShellModule', 'UI shell');
                 // v4.5.47: Critical ext modules promoted to boot path
                 this._safeRegister('EditorModule', 'editor');
                 this._safeRegister('ShellModule', 'shell');
diff --git a/modules/core/module-loader.js b/modules/core/module-loader.js
index 67be01b..685b5fd 100644
--- a/modules/core/module-loader.js
+++ b/modules/core/module-loader.js
@@ -4,7 +4,7 @@
     // Core module bundle loaded synchronously in main.html.
     // This loader only handles version cache-busting, splash, terminal init, and optional ext modules.
 
-    const LATEST_VER = 'v4.6.156';
+    const LATEST_VER = 'v4.6.157';
     const CACHE = '?v=' + LATEST_VER;
     // Exposed so ext modules can register their own URL with the same cache-busting version
     // instead of an unversioned path the browser may already have cached (shell.js did).
diff --git a/modules/core/terminal.js b/modules/core/terminal.js
index f0259fc..91bea4c 100644
--- a/modules/core/terminal.js
+++ b/modules/core/terminal.js
@@ -1382,7 +1382,15 @@
                 this._safeRegister('SmartContextModule', 'smart context');
                 this._safeRegister('SimpleGUIModule', 'simple GUI builder');
                 this._safeRegister('DebugSupervisorModule', 'debug supervisor');
-                this._safeRegister('UIShellModule', 'UI shell');
+                // 2026-11-09 — UI shell DISABLED from startup (operator order after crash reports).
+                // The six interface modes (v4.6.152–156) are not in extKeys, so with the shell
+                // unregistered no mode can mount, no first-run picker appears, and `ui` does not
+                // exist: newOS4 boots to classic only. The ext ui-*.js files all begin with
+                // `if (!terminal.uiShell) return;`, so an accidental load is a no-op.
+                // Re-enable = restore this line, rebuild the bundle (scripts/rebuild-bundles.py),
+                // bump LATEST_VER + main.html ?v=, re-run admin/scripts/probe-ui-modes.py.
+                // Tracked in .hermes/plans/2026-11-09_*-newos4-ui-rollback.md
+                // this._safeRegister('UIShellModule', 'UI shell');
                 // v4.5.47: Critical ext modules promoted to boot path
                 this._safeRegister('EditorModule', 'editor');
                 this._safeRegister('ShellModule', 'shell');