@bongos/core 1.20.59 → 1.20.61

package/modules/autonomy/db.js

@@ -162,11 +162,11 @@ async function disallowGoal(goalId) {
 // recordRunnerHeartbeat — upsert one host's check-in. ON CONFLICT so the normal
 // case is one write, and `host` is the key so a second runner appears as a second
 // row rather than silently overwriting the first.
-async function recordRunnerHeartbeat({ builderId, host, pid = null, startedAt = null, mode = null, consecutiveFailures = null, lastEvent = null, workingTaskId = null, workingGoalId = null }) {
+async function recordRunnerHeartbeat({ builderId, host, pid = null, startedAt = null, mode = null, consecutiveFailures = null, lastEvent = null, workingTaskId = null, workingGoalId = null, head = null, diskHead = null, mainHead = null, claudeAccount = null }) {
   const { rows } = await pool.query(
     `INSERT INTO autonomy_runner_heartbeat
-       (builder_id, host, pid, started_at, mode, consecutive_failures, last_event, working_task_id, working_goal_id, last_seen_at, updated_at)
-     VALUES ($8, $1, $2, $3, $4, $5, $6, $7, $9, now(), now())
+       (builder_id, host, pid, started_at, mode, consecutive_failures, last_event, working_task_id, working_goal_id, head, disk_head, main_head, claude_account, last_seen_at, updated_at)
+     VALUES ($8, $1, $2, $3, $4, $5, $6, $7, $9, $10, $11, $12, $13, now(), now())
      ON CONFLICT (builder_id, host) DO UPDATE SET
        pid = EXCLUDED.pid,
        started_at = COALESCE(EXCLUDED.started_at, autonomy_runner_heartbeat.started_at),
@@ -175,10 +175,16 @@ async function recordRunnerHeartbeat({ builderId, host, pid = null, startedAt =
        last_event = EXCLUDED.last_event,
        working_task_id = EXCLUDED.working_task_id,
        working_goal_id = EXCLUDED.working_goal_id,
+       -- Overwritten, never COALESCEd (task 1004407): a fresh process that cannot
+       -- read its own commit must say "unknown", not inherit the last process's.
+       head = EXCLUDED.head,
+       disk_head = EXCLUDED.disk_head,
+       main_head = EXCLUDED.main_head,
+       claude_account = EXCLUDED.claude_account,
        last_seen_at = now(),
        updated_at = now()
-     RETURNING host, pid, started_at, mode, consecutive_failures, last_event, working_task_id, working_goal_id, last_seen_at`,
-    [String(host).toLowerCase().slice(0, 255), pid, startedAt, mode, consecutiveFailures, lastEvent, workingTaskId, builderId, workingGoalId]
+     RETURNING host, pid, started_at, mode, consecutive_failures, last_event, working_task_id, working_goal_id, head, disk_head, main_head, claude_account, last_seen_at`,
+    [String(host).toLowerCase().slice(0, 255), pid, startedAt, mode, consecutiveFailures, lastEvent, workingTaskId, builderId, workingGoalId, head, diskHead, mainHead, claudeAccount]
   );
   return rows[0] || null;
 }
@@ -193,7 +199,8 @@ async function recordRunnerHeartbeat({ builderId, host, pid = null, startedAt =
 // liveness view entirely (grader finding, task 1003905).
 async function readRunnerHeartbeats(builderId) {
   const { rows } = await pool.query(
-    `SELECT host, pid, started_at, mode, consecutive_failures, last_event, working_task_id, working_goal_id, last_seen_at
+    `SELECT host, pid, started_at, mode, consecutive_failures, last_event, working_task_id, working_goal_id,
+            head, disk_head, main_head, claude_account, last_seen_at
        FROM autonomy_runner_heartbeat
       WHERE builder_id = $1
       ORDER BY last_seen_at DESC

package/modules/autonomy/migrations/autonomy_004_runner_identity.sql

@@ -0,0 +1,30 @@
+-- autonomy_004_runner_identity.sql — what the runner card can say about a runner
+-- (task 1004407).
+--
+-- Owner ruling, 2026-10-01: the gate page must show which code each runner is
+-- running, whether it is live or restarting, which always-on PC it is on, and
+-- which Claude account its workers spend. `host` already names the PC
+-- (autonomy_002); these four columns carry the rest.
+--
+--   head          the commit the supervisor process is RUNNING (40-char hex)
+--   disk_head     the commit on disk, when the checkout was refreshed in place
+--                 past what is running (task 1004406) — null otherwise
+--   main_head     the newest main the runner has seen, so the card can say
+--                 "behind main" without the server reaching GitHub
+--   claude_account a LABEL for the Claude login its workers use (an email, or
+--                 "API key" / "Claude token" when one is set). Never a token or
+--                 a key: the route caps it at 200 characters and the runner only
+--                 ever sends the label.
+--
+-- Nullable, no defaults: a runner that predates this reports nothing, and the
+-- card says nothing rather than guessing. Additive and idempotent.
+
+BEGIN;
+
+ALTER TABLE autonomy_runner_heartbeat
+  ADD COLUMN IF NOT EXISTS head text,
+  ADD COLUMN IF NOT EXISTS disk_head text,
+  ADD COLUMN IF NOT EXISTS main_head text,
+  ADD COLUMN IF NOT EXISTS claude_account text;
+
+COMMIT;

package/modules/autonomy/routes/autonomy.js

@@ -52,6 +52,11 @@ function runsLimit(raw) {
   return Math.min(RUNS_MAX_LIMIT, Math.max(1, n));
 }
 
+// commitOrNull — a full lowercase commit sha, or null (task 1004407).
+function commitOrNull(v) {
+  return typeof v === 'string' && /^[0-9a-f]{40}$/.test(v) ? v : null;
+}
+
 module.exports = function buildAutonomyRouter() {
   const router = express.Router();
 
@@ -219,6 +224,11 @@ module.exports = function buildAutonomyRouter() {
       last_event: { type: 'string', maxLength: 64 },
       working_task_id: { type: 'number' },
       working_goal_id: { type: 'number' },
+      // What the runner card says about the runner (task 1004407).
+      head: { type: 'string', maxLength: 40 },
+      disk_head: { type: 'string', maxLength: 40 },
+      main_head: { type: 'string', maxLength: 40 },
+      claude_account: { type: 'string', maxLength: 200 },
     })) return;
     const b = req.body || {};
     try {
@@ -234,6 +244,12 @@ module.exports = function buildAutonomyRouter() {
         lastEvent: b.last_event || null,
         workingTaskId: Number.isInteger(b.working_task_id) ? b.working_task_id : null,
         workingGoalId: Number.isInteger(b.working_goal_id) ? b.working_goal_id : null,
+        // A commit is stored only if it IS one: anything that is not 40 hex
+        // characters is dropped to null rather than rendered as a version.
+        head: commitOrNull(b.head),
+        diskHead: commitOrNull(b.disk_head),
+        mainHead: commitOrNull(b.main_head),
+        claudeAccount: typeof b.claude_account === 'string' && b.claude_account.trim() ? b.claude_account.trim() : null,
       });
       res.json({ ok: true, heartbeat: row });
     } catch (err) {

package/modules/autonomy/runner-health.js

@@ -19,6 +19,11 @@
 //     exactly what it is for, and crying dead every time it works is worse than
 //     saying nothing.
 //   · dead       — quiet longer than any legitimate explanation.
+//   · restarting — its last word was "exiting to pick up new code" (upgrade_exit,
+//     task 1004406), and that was recently. The wrapper fetches, resets and
+//     relaunches, which takes a minute or two, and the owner ruled that a restart
+//     must read as a restart, never as a death (task 1004407). Past RESTART_S the
+//     relaunch has failed and it is dead again — with a detail that says so.
 
 // Reasoned from the runner's own numbers, not picked. The loop beats at the top of
 // every pass and again on each poll inside a wait (every 60s), so a healthy runner
@@ -28,6 +33,43 @@ const ALIVE_S = 15 * 60;
 // worker holds the loop for its whole run. Two hours is that ceiling plus room for
 // the ship, the grade and the verify that follow it.
 const LATE_S = 2 * 60 * 60;
+// A relaunch is fetch + reset + boot + the first beat. Ten minutes is several
+// times that, so a slow fetch is not called a death, and short enough that a
+// relaunch which never happened is noticed the same evening.
+const RESTART_S = 10 * 60;
+
+const SHA_RE = /^[0-9a-f]{40}$/;
+const sha = (v) => (typeof v === 'string' && SHA_RE.test(v) ? v : null);
+
+// describeCode — what the card says about the code a runner is on (task 1004407).
+// `behind` is true only when BOTH sides are known and differ: the runner reports
+// the newest main it has seen, and an unknown is never drawn as "out of date".
+// A checkout refreshed in place counts by what is on disk, because that is what
+// every worker and child process runs (task 1004406).
+function describeCode(hb) {
+  const head = sha(hb && hb.head);
+  if (!head) return null;
+  const disk = sha(hb.disk_head);
+  const main = sha(hb.main_head);
+  const current = disk || head;
+  return {
+    head, short: head.slice(0, 8),
+    diskShort: disk && disk !== head ? disk.slice(0, 8) : null,
+    mainShort: main ? main.slice(0, 8) : null,
+    behind: main ? main !== current : null,
+  };
+}
+
+// What the runner was last doing, in words. Keyed on the run-log event names the
+// runner sends as last_event; an unknown event says nothing rather than guessing.
+const ACTIVITY = {
+  boot: 'just started',
+  waiting: 'waiting for work',
+  code_refreshed: 'updated its code in place',
+  nothing_claimable: 'waiting — nothing to claim',
+  fenced: 'held by the fence',
+  hold: 'pausing',
+};
 
 function ageS(lastSeenAt, nowMs) {
   const t = Date.parse(lastSeenAt || '');
@@ -68,19 +110,38 @@ function describeRunner(heartbeat, { nowMs = Date.now(), aliveS = ALIVE_S, lateS
   const mode = heartbeat.mode === 'probing' ? 'probing' : (heartbeat.mode === 'full' ? 'full' : null);
   const working = heartbeat.working_task_id ? String(heartbeat.working_task_id) : null;
   const where = host ? ` on ${host}` : '';
+  const ident = {
+    host, mode, workingTaskId: working,
+    account: typeof heartbeat.claude_account === 'string' && heartbeat.claude_account ? heartbeat.claude_account : null,
+    code: describeCode(heartbeat),
+  };
+
+  if (heartbeat.last_event === 'upgrade_exit') {
+    if (age <= RESTART_S) {
+      return {
+        state: 'restarting', ok: true, ageS: age, age: humanAge(age), ...ident,
+        detail: `restarting${where} to pick up new code`,
+      };
+    }
+    return {
+      state: 'dead', ok: false, ageS: age, age: humanAge(age), ...ident,
+      detail: `exited${where} ${humanAge(age)} ago to restart on new code and has not come back`,
+    };
+  }
 
   if (age <= aliveS) {
+    const doing = ACTIVITY[heartbeat.last_event];
     return {
-      state: 'alive', ok: true, ageS: age, age: humanAge(age), host, mode, workingTaskId: working,
+      state: 'alive', ok: true, ageS: age, age: humanAge(age), ...ident,
       detail: working
         ? `working task ${working}${where}`
-        : `${mode === 'probing' ? 'probing after failures' : 'running'}${where}`,
+        : `${mode === 'probing' ? 'probing after failures' : (doing || 'running')}${where}`,
     };
   }
 
   if (age <= lateS) {
     return {
-      state: 'late', ok: true, ageS: age, age: humanAge(age), host, mode, workingTaskId: working,
+      state: 'late', ok: true, ageS: age, age: humanAge(age), ...ident,
       // Deliberately NOT an alarm. This is what a runner doing its job looks like.
       detail: working
         ? `quiet for ${humanAge(age)} — expected while task ${working} builds`
@@ -89,9 +150,9 @@ function describeRunner(heartbeat, { nowMs = Date.now(), aliveS = ALIVE_S, lateS
   }
 
   return {
-    state: 'dead', ok: false, ageS: age, age: humanAge(age), host, mode, workingTaskId: working,
+    state: 'dead', ok: false, ageS: age, age: humanAge(age), ...ident,
     detail: `no check-in for ${humanAge(age)}${where} — longer than any worker takes, so the runner is not running`,
   };
 }
 
-module.exports = { ALIVE_S, LATE_S, ageS, humanAge, describeRunner };
+module.exports = { ALIVE_S, LATE_S, RESTART_S, ageS, humanAge, describeRunner };

package/modules/hall-ui/public/atlas.html

@@ -91,7 +91,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/atlas.js?v=2026-09-02-index" defer></script>

package/modules/hall-ui/public/blockers.html

@@ -50,7 +50,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB — rank labels, number formats) + the

package/modules/hall-ui/public/board-room.html

@@ -60,7 +60,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-board"></script>

package/modules/hall-ui/public/collab.html

@@ -148,7 +148,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <script src="/builders/collab-lib.js?v=2026-09-24-archive"></script>

package/modules/hall-ui/public/commands.html

@@ -54,7 +54,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>

package/modules/hall-ui/public/copy-desk.html

@@ -177,7 +177,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <script src="/builders/hall-kit.js"></script>

package/modules/hall-ui/public/deploy.html

@@ -74,7 +74,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>
 <script src="/builders/hall-kit.js"></script>

package/modules/hall-ui/public/diagrams.html

@@ -97,7 +97,7 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/diagram-viewer.js?v=2026-06-14-diagviewer-1" defer></script>

package/modules/hall-ui/public/drachmae.html

@@ -98,7 +98,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/md-reader.js?v=2026-09-02-mdreader-2"></script>

package/modules/hall-ui/public/fleet.html

@@ -54,7 +54,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>
 <script src="/builders/hall-kit.js"></script>

package/modules/hall-ui/public/gate.html

@@ -76,7 +76,7 @@
 <div id="gate-modal-root"></div>
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>

package/modules/hall-ui/public/gate.js

@@ -358,7 +358,7 @@
   // exist here, resolved to inherited grey, and drew a dead runner in exactly the
   // same colour as a healthy one. Named classes cannot fail that way silently —
   // a missing class is visible in the stylesheet, a missing var is not.
-  const HEALTH_CLASS = { alive: 'fact-pill--ok', late: 'fact-pill--warn', dead: 'fact-pill--danger', never_seen: 'fact-pill--info' };
+  const HEALTH_CLASS = { alive: 'fact-pill--ok', late: 'fact-pill--warn', dead: 'fact-pill--danger', never_seen: 'fact-pill--info', restarting: 'fact-pill--info' };
 
   async function loadRunners() {
     const el = document.getElementById('fence-runner');
@@ -384,13 +384,29 @@
       // NOT the word "running": the switch below already uses it for a different
       // thing (allowed to work), and the two lines sit one above the other. A
       // reader should never have to work out which sense is meant.
-      const label = { dead: 'Not checking in', late: 'Quiet', alive: 'Checking in' }[h.state] || 'Unknown';
-      return `<p class="ov-foot" style="display:flex;align-items:baseline;gap:10px;flex-wrap:wrap;">
-        <span class="fact-pill ${cls}">${escapeHtml(label)}</span>
-        <span>${escapeHtml(h.detail || '')}</span>
-        ${r.working_goal_id ? `<span class="ov-fact">from goal ${escapeHtml(String(r.working_goal_id))}</span>` : ''}
-        <span class="ov-fact">last check-in ${escapeHtml(h.age || 'unknown')} ago</span>
-      </p>`;
+      const label = { dead: 'Not checking in', late: 'Quiet', alive: 'Checking in', restarting: 'Restarting' }[h.state] || 'Unknown';
+      // Which PC, which Claude account, which code (task 1004407). Each line is
+      // drawn only when the runner reported it, so an older runner shows less
+      // rather than a guess.
+      const facts = [];
+      if (h.host) facts.push(`<span class="ov-fact">PC <strong>${escapeHtml(h.host)}</strong></span>`);
+      if (h.account) facts.push(`<span class="ov-fact">Claude account ${escapeHtml(h.account)}</span>`);
+      if (h.code) {
+        const c = h.code;
+        const status = c.behind === true ? ` — behind main (${escapeHtml(c.mainShort)})`
+          : c.behind === false ? ' — up to date' : '';
+        const disk = c.diskShort ? `, updated in place to ${escapeHtml(c.diskShort)}` : '';
+        facts.push(`<span class="ov-fact">code <code>${escapeHtml(c.short)}</code>${disk}${status}</span>`);
+      }
+      return `<div class="ov-foot">
+        <p style="display:flex;align-items:baseline;gap:10px;flex-wrap:wrap;margin:0;">
+          <span class="fact-pill ${cls}">${escapeHtml(label)}</span>
+          <span>${escapeHtml(h.detail || '')}</span>
+          ${r.working_goal_id ? `<span class="ov-fact">from goal ${escapeHtml(String(r.working_goal_id))}</span>` : ''}
+          <span class="ov-fact">last check-in ${escapeHtml(h.age || 'unknown')} ago</span>
+        </p>
+        ${facts.length ? `<p style="display:flex;gap:14px;flex-wrap:wrap;margin:4px 0 0;">${facts.join('')}</p>` : ''}
+      </div>`;
     }).join('');
   }
 

package/modules/hall-ui/public/goal-map.html

@@ -137,7 +137,7 @@
   </div>
 </div>
 
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <script src="/builders/palette.js" defer></script>
 
 <script src="/builders/idea-objects.js?v=2026-09-27-split"></script>

package/modules/hall-ui/public/goals.html

@@ -230,7 +230,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>

package/modules/hall-ui/public/government.html

@@ -134,7 +134,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>

package/modules/hall-ui/public/idea.html

@@ -52,7 +52,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib" defer></script>
 <!-- task-detail.js still owns the #/idea/N and #/blocker/N overlay, so a ref

package/modules/hall-ui/public/ideas.html

@@ -225,7 +225,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <!-- task 1003069 (R08) — the quick-filing form's routed result links a task

package/modules/hall-ui/public/index.html

@@ -106,7 +106,7 @@
 <script src="/builders/brand-apply.js?v=2026-06-27-r75" defer></script>
 <!-- The app shell (sidebar + top bar + view router). Dependency-free; loaded
      BEFORE builders.js so the chrome ids exist when events are wired. -->
-<script src="/builders/shell.js?v=2026-09-30-navback2" defer></script>
+<script src="/builders/shell.js?v=2026-10-01-look" defer></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- task 2166: the shared component kit (window.OTBKit) — pager/ledger/rail.

package/modules/hall-ui/public/modules.html

@@ -101,7 +101,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>

package/modules/hall-ui/public/primer.html

@@ -115,7 +115,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- the shared markdown reader (window.OTBMdReader) — primer.js renders through

package/modules/hall-ui/public/profile.html

@@ -187,7 +187,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before profile.js, which pulls from it. -->

package/modules/hall-ui/public/project-settings.html

@@ -58,7 +58,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>

package/modules/hall-ui/public/ranks.html

@@ -77,7 +77,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before ranks.js, which pulls from it. -->

package/modules/hall-ui/public/roadmap.html

@@ -41,7 +41,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>

package/modules/hall-ui/public/roster.html

@@ -50,7 +50,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB — rank labels, number formats) + the

package/modules/hall-ui/public/sessions.html

@@ -99,7 +99,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded BEFORE sessions.js so it can pull from it. -->

package/modules/hall-ui/public/settings.html

@@ -400,7 +400,7 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page scripts run. -->
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded before consuming IIFEs. -->

package/modules/hall-ui/public/shell.js

@@ -442,7 +442,11 @@
 
     el.innerHTML =
       '<div class="app-sidebar__brand"><a class="brand-mark" href="/" id="brand-mark">' +
-        '<span class="brand-mark__dot" aria-hidden="true"></span>' +
+        // A project's logo (ADR 0358, task 1004421) takes the dot's place; the
+        // platform validated it as an https image address before it was pushed.
+        (brand.theme && brand.theme.logo
+          ? '<img class="brand-mark__logo" src="' + esc(brand.theme.logo) + '" alt="" width="24" height="24" decoding="async">'
+          : '<span class="brand-mark__dot" aria-hidden="true"></span>') +
         '<span class="brand-mark__name" id="brand-name"></span></a></div>' +
       '<nav class="app-sidebar__nav" aria-label="Primary">' + groups + '</nav>' +
       '<div class="app-sidebar__foot">' +

package/modules/hall-ui/public/studio.html

@@ -176,7 +176,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <!-- The kit, for its ONE renderer: the full-size ship-time visual figure

package/modules/hall-ui/public/style.css

@@ -561,6 +561,14 @@ main:focus { outline: none; }
   background: none;
   flex-shrink: 0;
 }
+/* A project's logo in the dot's place (ADR 0358): the image is the founder's, so
+   it gets a soft square, never a recolour. */
+.brand-mark__logo {
+  width: 24px; height: 24px;
+  border-radius: 6px;
+  object-fit: contain;
+  flex-shrink: 0;
+}
 .brand-mark__name {
   display: none;
   white-space: nowrap;

package/modules/hall-ui/public/task.html

@@ -57,7 +57,7 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so task.js can pull from it. -->

package/modules/hall-ui/public/thinking.html

@@ -138,7 +138,7 @@
   </div>
 </div>
 
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <script src="/builders/palette.js" defer></script>
 
 <script src="/builders/idea-objects.js?v=2026-09-27-split"></script>

package/modules/hall-ui/public/tweak-editor.html

@@ -140,7 +140,7 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
-<script src="/builders/shell.js?v=2026-09-30-navback2"></script>
+<script src="/builders/shell.js?v=2026-10-01-look"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <script src="/builders/brand-holes.js?v=2026-09-29-aqfix"></script>