diff --git a/agent/BACKLOG.md b/agent/BACKLOG.md
index bcedf8d..b35323a 100644
--- a/agent/BACKLOG.md
+++ b/agent/BACKLOG.md
@@ -25,16 +25,6 @@ next, in what order*.
 *Items 21–27: real-hardware QA findings from the Latitude 5410
 (Bernardo, 2026-07-04) — bugs found on metal outrank the queue.*
 
-### 24. "Back" audit — every list menu ends in ↩ Back
-Reported: some submenu items/tools still lack a Back option. The "Back
-everywhere" pass covered the hand-rolled dmenu lists at the time; audit
-what's been added since (VPN, Display, power-profile, printers…) and
-the external/plugin modules (networkmanager_dmenu, rofi-pulse-select,
-rofi-calc/emoji modi) — hand-rolled lists get the shared `back` helper;
-external modi that can't take an injected row get documented as such
-(and Esc always works). **Verify:** V1 + a grep-the-generated-script
-audit listing which menus have/lack Back; V3 spot-check.
-
 ### 6. Full docs review & restructure
 ROADMAP § Full docs review. The roadmap/backlog split is done (this
 file); remaining: reconcile every README option table against the live
diff --git a/agent/HARDWARE-QUEUE.md b/agent/HARDWARE-QUEUE.md
index 87eca0e..e3047ff 100644
--- a/agent/HARDWARE-QUEUE.md
+++ b/agent/HARDWARE-QUEUE.md
@@ -49,6 +49,10 @@ QA machine), the **T14s** (webcam case).
       row, dimmed inactive workspaces / muted volume visible-but-dim),
       rofi inputbar/alternate rows show text. Spot-check one dark theme
       (e.g. tokyo-night) for no visual regression in the same spots.
+- [ ] **Back-audit spot-check** (item 24) — the keybinds cheatsheet
+      (SUPER+? / root menu › Keybindings) now ends in ↩ Back and
+      returns to the root picker; spot a couple of submenus (Display,
+      VPN › Tailscale) still Back correctly after the audit pass.
 - [ ] **Network menu has no blank rows** (item 22 fix, needs Wi-Fi) —
       after `home-update`, open Tools › Network: no empty separator
       rows between the ethernet/wifi/VPN sections (compact = True).
diff --git a/agent/JOURNAL.md b/agent/JOURNAL.md
index a479e32..07ab647 100644
--- a/agent/JOURNAL.md
+++ b/agent/JOURNAL.md
@@ -17,6 +17,22 @@ Template:
 
 ---
 
+## 2026-07-04 — Back audit (iteration #12, item 24)
+- **Task:** BACKLOG NOW#24 — every list menu ends in ↩ Back.
+- **Did:** audited every `rofi -dmenu` call site in the generated
+  nomarchy-menu + nomarchy-vpn. Already compliant: power, power-profile,
+  theme, clipboard, files, audio, display (both stages), capture,
+  tools, system, VPN main/import/exit-node/tailscale. Fixed: keybinds
+  cheatsheet (Enter was a silent exit) now ends in ↩ Back → root
+  picker. Documented the exceptions in rofi.nix: external modi
+  (calc/emoji/networkmanager_dmenu/rofi-pulse-select) can't take an
+  injected row (Esc = back); free-text prompts (web/ask) have no list.
+- **Verified:** V0; V1 — built nomarchy-menu, bash -n OK; awk audit
+  over the generated script: only rows lacking back are the root
+  picker (by design) and the free-text prompt. V3 spot-check queued.
+- **Pending:** V3 spot-check. NOW now holds only item 6 (docs, [big]).
+- **Next suggestion:** item 6 first slice, or NEXT#8 (viewers+mime).
+
 ## 2026-07-04 — network menu blank rows (iteration #11, item 22)
 - **Task:** BACKLOG NOW#22 — nameless entries in the network picker.
 - **Did:** read the pinned networkmanager_dmenu 2.6.2 source: with
diff --git a/modules/home/rofi.nix b/modules/home/rofi.nix
index d63cce3..401f6a4 100644
--- a/modules/home/rofi.nix
+++ b/modules/home/rofi.nix
@@ -155,6 +155,10 @@ let
     # rofi has show-icons (on globally; passed explicitly on the icon menus).
     row() { printf '%s\0icon\x1f%s\n' "$1" "$2"; }
 
+    # Back-audit exceptions (item 24): external modi/tools (calc, emoji,
+    # networkmanager_dmenu, rofi-pulse-select) can't take an injected row —
+    # Esc is their back path; free-text prompts (web, ask) have no list to
+    # append to — Esc cancels. Everything hand-rolled gets the row below.
     # General menu convention: every list menu ends with a "↩ Back" entry that
     # returns one level up (so you never have to Esc out and reopen). `back`
     # emits it with an icon; plain pick-lists append the bare label instead.
@@ -249,6 +253,7 @@ ${themeRows}
         # Native rofi wifi/VPN picker (networkmanager_dmenu) over the system
         # NetworkManager — replaces the old nmtui-in-a-terminal flow. Reads
         # its config from xdg.configFile below (told to drive rofi).
+        # External tool: no injected ↩ Back row possible — Esc closes.
         exec networkmanager_dmenu ;;
 
       vpn)
@@ -357,7 +362,12 @@ ${themeRows}
 
       keybinds)
         # Read-only cheatsheet, generated from keybinds.nix at build time.
-        rofi -dmenu -i -p keys < ${cheatsheetFile} >/dev/null || exit 0 ;;
+        # Enter on a row is a deliberate no-op (nothing to launch); ↩ Back
+        # returns to the root picker, which is also where it's launched.
+        sel=$( { cat ${cheatsheetFile}; printf '%s\n' "$BACK"; } \
+          | rofi -dmenu -i -p keys ) || exit 0
+        [ "$sel" = "$BACK" ] && exec "$0"
+        exit 0 ;;
 
       ask)
         # Free-text question → claude CLI in a terminal (OAuth, no API key).