@bongos/core 1.20.60 → 1.20.61

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.20.60",
-  "core_contract": "1.20.60",
-  "source_commit": "1c5e4ffeb15746f66de752df791062c4e2d8db52",
+  "core_version": "1.20.61",
+  "core_contract": "1.20.61",
+  "source_commit": "dfbe913b447708d16a0e3bd1b01f22a3423078ca",
   "source_ref": "HEAD",
-  "built_at": "2026-10-01T07:32:53.914Z",
+  "built_at": "2026-10-01T10:03:11.617Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 572,
     "agent_docs_stubbed": 27,
-    "functional_verbatim": 2779,
+    "functional_verbatim": 2781,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3379,
-  "tree_sha256": "e38bb61977874c88e1e344e1f977fcf6b8e8343eaeca0e52f68ae46701b33c4b",
+  "file_count": 3381,
+  "tree_sha256": "de019aef7d57c2169e2176dd4ee7d0461fbd0c1ec64e475bbca8b3afc13c9eae",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -337,7 +337,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "b6b2151a51f9d0da572ec9381110c187e9ff257c4611f9a3037600e2fff45b94"
+      "sha256": "d4bb4d0fc24c4ad077f939eb4e899d6b0eeeceef7d922ef35ce55bb2c8db4c41"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -2262,12 +2262,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "7c1cd2f16f6b0cf1122c3ef3dc1fae1dc4cd772a3171f8493c51824350ce3958"
+      "sha256": "f527f77fcc1957831e89e46991a2916966dca81ffcf5a63832bf3cb6a23ef38f"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "7c8f74463c832b0177b2e92535c3056eab14c383ebbaceca6cffc935ba3b6191"
+      "sha256": "4411ebb2e8bf4dbdd6d403671af60d030294a9171807e466b611acb3274eda2b"
     },
     {
       "path": "docs/architecture.md",
@@ -2292,12 +2292,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "4088ded5782ee2f7f814e77429d02bf80d7332b232012548bd2726fecf5532ee"
+      "sha256": "2daaf44779e2c5870d95d87f76a1e03f96d51e9e24e49ba88dedafde3b041554"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "d5d915abaca83b33070be430d0d26266c3cc5c4592aca9dd79e6552bdabe0ce0"
+      "sha256": "c2c3e3a91b2f005cea4795176fef9065db8b617126dafb6f9f9fe0b06183a376"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2802,7 +2802,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "d14e109f4db1aea7e159d1402cf5a3894621ecea1a670447ea234abe7ec4ec91"
+      "sha256": "2c33e494daebf6147d0587edb3f3125cc3cc5a5f647c3a1db2d7968f05fa4184"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2892,7 +2892,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "53b501d71b929e013a66b79542a4e553880f25f1d1969c3553271470fc45d321"
+      "sha256": "b9606273995e2ffc2079ee7c93dc1b13177ecdeded8e2a2e2a7e0bb1d768cdab"
     },
     {
       "path": "docs/project-context.template.md",
@@ -4092,7 +4092,7 @@
     {
       "path": "modules/autonomy/db.js",
       "mode": "0000644",
-      "sha256": "e561325ef0d63653dfaf7682214b529e92561f65913a5632a66bdef243c60741"
+      "sha256": "7a35aedbf486079f1330b060280abe70898ce676f1bd0f01fe3bc0b3ab8b967c"
     },
     {
       "path": "modules/autonomy/digest.js",
@@ -4124,6 +4124,11 @@
       "mode": "0000644",
       "sha256": "5cee946899d3cbf9c73c02977a6441ce34b0f41e36997dbf27cb11f90fb89178"
     },
+    {
+      "path": "modules/autonomy/migrations/autonomy_004_runner_identity.sql",
+      "mode": "0000644",
+      "sha256": "84b2cea5e4991017c907f07cedd5a75448f5f4dc5cdc009df46b0ad2bd89780c"
+    },
     {
       "path": "modules/autonomy/module.json",
       "mode": "0000644",
@@ -4137,12 +4142,12 @@
     {
       "path": "modules/autonomy/routes/autonomy.js",
       "mode": "0000644",
-      "sha256": "f6283e3dfbb5c420b41eaec0cee963c4045b2ecbf8a7954db4fff14b2c95272d"
+      "sha256": "bd2d65b731ff1e9eea66cb028ec246fe95b8e1e867386baa9ad6fc9f79bd2a5b"
     },
     {
       "path": "modules/autonomy/runner-health.js",
       "mode": "0000644",
-      "sha256": "3752cff6742e0d72b83697948e14547afb2b7b158e5fef57bfa75cf68ce525cf"
+      "sha256": "24c56042659ce118ef552da93610d75b9d4e17c3ea49f2fe78667892c943d43a"
     },
     {
       "path": "modules/builder-settings/CLAUDE.md",
@@ -5432,7 +5437,7 @@
     {
       "path": "modules/hall-ui/public/gate.js",
       "mode": "0000644",
-      "sha256": "595402cd77879c6c81ab5d7997eb6947c9c3a29a72e8cd171578737256975b66"
+      "sha256": "2bd2d51a984ea6cab821d46ec9f1480e7231c5f4b32a46ce2d3c01a7adc21967"
     },
     {
       "path": "modules/hall-ui/public/gate.states.json",
@@ -9412,12 +9417,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "9324dcd074a5dfd4ad4e2a98a9ab732ea05d4084dee8a30087164769254b7e76"
+      "sha256": "ab6fcfd7d4d42e1528dd531ec990be71b3b4d2221654c735ae4e1301726bb8a8"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "a1200cc1e8a1aea6abafa7f0529d5da06c43f36da1f416178a08d432c059aad7"
+      "sha256": "24ea0d2cdd97a8a47824d23c4dabce026af3fe98273b3df4c07427466d983866"
     },
     {
       "path": "public-docs/index.html",
@@ -9437,7 +9442,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "937158bc61be2048ddce75860d05299007420de12cdfbb4413b2c8fd6795c631"
+      "sha256": "027d1fbff3c739f12f9de1f3853a4e8cdb3f2dd7acc50e5a6b623a208186eeac"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -9597,7 +9602,7 @@
     {
       "path": "scripts/gds/autobongos-run.js",
       "mode": "0000644",
-      "sha256": "c87e0ed439bee651517c6bd2bac4aadeac66fc6b6e271a212b1ccbe7f7d1be24"
+      "sha256": "05dd20d28db2ddbb19710bb32fd1c3df560da4e9a2150b9f9f315956682c52ee"
     },
     {
       "path": "scripts/gds/autobongos-service.cmd",
@@ -11612,7 +11617,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "430d2964f2eea97d2fc9460cc81c611a115f84279ac2db6c4c5a15a191aa6632"
+      "sha256": "54e3ec3b65078a04894736e6f52c1bf1d31b0f56fa9d9d4b439fdf60623b7a11"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12119,6 +12124,11 @@
       "mode": "0000644",
       "sha256": "e5dc6ec6261a18113876f4e362e8cb801d78f5266e077f0b8a27eeda70fe800b"
     },
+    {
+      "path": "tests/autonomy_runner_identity.mjs",
+      "mode": "0000644",
+      "sha256": "2bc963a47a41a90711bec4d23fef9e4a51203136f446a0abab272d78d2f6f6bf"
+    },
     {
       "path": "tests/backfill_sessions.mjs",
       "mode": "0000644",

package/clients/bongos-client/index.d.ts

@@ -257,7 +257,7 @@ export interface PostAutonomyFenceGoalsRequest { goal_id: StringifiableId; note?
 export interface PostAutonomyFenceGoalsResponse { goal: unknown }
 export interface PostAutonomyFencePriorityRequest { goal_id?: StringifiableId }
 export interface PostAutonomyFenceRequest { enabled: boolean; reason?: string }
-export interface PostAutonomyHeartbeatRequest { host: string; pid?: number; started_at?: string; mode?: string; consecutive_failures?: number; last_event?: string; working_task_id?: number; working_goal_id?: number }
+export interface PostAutonomyHeartbeatRequest { host: string; pid?: number; started_at?: string; mode?: string; consecutive_failures?: number; last_event?: string; working_task_id?: number; working_goal_id?: number; head?: string; disk_head?: string; main_head?: string; claude_account?: string }
 export interface PostAutonomyHeartbeatResponse { ok: boolean; heartbeat: unknown }
 export interface PostBackupTriggerResponse { ok: boolean; message: unknown; started_at: unknown }
 export interface PostBlockersIdLinkRequest { task_id: StringifiableId }

package/docs/api/openapi.json

@@ -26060,6 +26060,22 @@
           },
           "working_goal_id": {
             "type": "number"
+          },
+          "head": {
+            "type": "string",
+            "maxLength": 40
+          },
+          "disk_head": {
+            "type": "string",
+            "maxLength": 40
+          },
+          "main_head": {
+            "type": "string",
+            "maxLength": 40
+          },
+          "claude_account": {
+            "type": "string",
+            "maxLength": 200
           }
         },
         "required": [

package/docs/api-reference.md

@@ -90,7 +90,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/autonomy/fence/goals` | `archon` | `goal_id`, `note` | Add a goal to the allowlist. |
 | DELETE | `/api/bongos/autonomy/fence/goals/:goalId` | `archon` | — | Revoke one. |
 | POST | `/api/bongos/autonomy/fence/priority` | `archon` | `goal_id` | The priority goal (task 1004453): which allowlisted goal the runner works first. |
-| POST | `/api/bongos/autonomy/heartbeat` | `any-builder` | `host`, `pid`, `started_at`, `mode`, `consecutive_failures`, `last_event`, `working_task_id`, `working_goal_id` | The runner's check-in, once per loop. |
+| POST | `/api/bongos/autonomy/heartbeat` | `any-builder` | `host`, `pid`, `started_at`, `mode`, `consecutive_failures`, `last_event`, `working_task_id`, `working_goal_id`, `head`, `disk_head`, `main_head`, `claude_account` | The runner's check-in, once per loop. |
 | GET | `/api/bongos/autonomy/precheck` | `metic+archon` | — |  |
 | GET | `/api/bongos/autonomy/runners` | `any-builder` | — | What the hall renders: the CALLER'S OWN runners, with the pure verdict attached so the page and any future alert cannot disagree about wh… |
 | GET | `/api/bongos/autonomy/runs` | `metic+archon` | — | The gate's past decisions — did a routine fire, and what did it decide, and why (task 1002669). |

package/docs/copy-inventory.md

@@ -4,13 +4,13 @@
 > Deterministic on a given tree — regenerate and commit rather than hand-editing.
 > Machine-readable twin: [`copy-registry.json`](copy-registry.json).
 
-**2317 strings** across 3 surfaces · 1996 distinct pieces of copy · 2317 certain, 0 heuristic · 221 shown in more than one place.
+**2318 strings** across 3 surfaces · 1997 distinct pieces of copy · 2318 certain, 0 heuristic · 221 shown in more than one place.
 
 ## Surfaces
 
 | surface | lives at | files | strings |
 |---|---|---|---|
-| `builders-hall` | `modules/hall-ui/public` | 116 | 1717 |
+| `builders-hall` | `modules/hall-ui/public` | 116 | 1718 |
 | `status-dashboard` | `modules/status-ui/public` | 4 | 100 |
 | `landing` | `modules/public-landing/public` | 6 | 500 |
 
@@ -78,7 +78,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `4e25e6872321` | 3x | Your projects | modules/public-landing/public/index.html:691, modules/public-landing/public/projects.html:586, modules/public-landing/public/projects.html:748 |
 | … | | _181 more in the JSON registry_ | |
 
-## `builders-hall` — 1717 strings
+## `builders-hall` — 1718 strings
 
 | id | conf | text | where |
 |---|---|---|---|
@@ -257,7 +257,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `906c2947dfc1` | certain | Changes save at once and take effect the next time you start a session on this machine. | `modules/hall-ui/public/settings.html:346` |
 | `52384bdc035c` | certain | Changes save at once. Your new choice plays the next time that event fires. | `modules/hall-ui/public/settings.html:359` |
 | `cab7a9526ca1` | certain | Changes save the moment you pick. “Default” clears your override and falls back to the system's choice. | `modules/hall-ui/public/settings.html:329` |
-| `4b714191b423` | certain | Changes touching protected build surfaces, held for your approval. | `modules/hall-ui/public/gate.js:432` |
+| `4b714191b423` | certain | Changes touching protected build surfaces, held for your approval. | `modules/hall-ui/public/gate.js:448` |
 | `864503935eca` | certain | Changing the rule… | `modules/hall-ui/public/deploy.js:671` |
 | `55ad21bd03eb` | certain | Chart the routes | `modules/hall-ui/public/goal-map.html:100` |
 | `55ad21bd03eb` | certain | Chart the routes | `modules/hall-ui/public/thinking.html:108` |
@@ -281,6 +281,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `c10806b50c61` | certain | Claim task {…} | `modules/hall-ui/public/work.js:482` |
 | `84664050c372` | certain | Claimed by another builder | `modules/hall-ui/public/goals-render.js:372` |
 | `18a03475e536` | certain | Claude Code | `modules/hall-ui/public/hall-render.js:832` |
+| `fe6fab20b149` | certain | Claude account {…} | `modules/hall-ui/public/gate.js:393` |
 | `ccb94814e3c2` | certain | Claude can start it when you ask in plain words. | `modules/hall-ui/public/commands.html:36` |
 | `6cb414d119be` | certain | Claude sees it and can start it when you ask in plain words | `modules/hall-ui/public/commands-lib.js:94` |
 | `5b3b75ee0596` | certain | Claude's notes on this goal | `modules/hall-ui/public/goals.html:86` |
@@ -1518,7 +1519,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `6b530a7007bc` | certain | jump to a goal or a thought | `modules/hall-ui/public/goal-map.html:84` |
 | `6b530a7007bc` | certain | jump to a goal or a thought | `modules/hall-ui/public/thinking.html:92` |
 | `9328033a890a` | certain | land every shuttle | `modules/hall-ui/public/sky-interaction.js:45` |
-| `966b32c8af7e` | certain | last check-in {…} ago | `modules/hall-ui/public/gate.js:391` |
+| `966b32c8af7e` | certain | last check-in {…} ago | `modules/hall-ui/public/gate.js:405` |
 | `9018bf6e99eb` | certain | last used {…} · signed in {…} | `modules/hall-ui/public/settings-sessions.js:46` |
 | `2ce7738b1eb0` | certain | loading goals… | `modules/hall-ui/public/task-detail.js:482` |
 | `754bdec368ed` | certain | lowest credits | `modules/hall-ui/public/hall-widgets.js:167` |

package/docs/copy-registry.json

@@ -3,9 +3,9 @@
   "generator": "scripts/gds/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 2317,
-    "unique_ids": 1996,
-    "certain": 2317,
+    "strings": 2318,
+    "unique_ids": 1997,
+    "certain": 2318,
     "heuristic": 0,
     "duplicate_ids": 221
   },
@@ -13,7 +13,7 @@
     "builders-hall": {
       "at": "modules/hall-ui/public",
       "files": 116,
-      "strings": 1717
+      "strings": 1718
     },
     "status-dashboard": {
       "at": "modules/status-ui/public",
@@ -3930,7 +3930,7 @@
       "surface": "builders-hall",
       "text": "Changes touching protected build surfaces, held for your approval.",
       "file": "modules/hall-ui/public/gate.js",
-      "line": 432,
+      "line": 448,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -4141,6 +4141,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "fe6fab20b149",
+      "surface": "builders-hall",
+      "text": "Claude account {…}",
+      "file": "modules/hall-ui/public/gate.js",
+      "line": 393,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "ccb94814e3c2",
       "surface": "builders-hall",
@@ -15279,7 +15288,7 @@
       "surface": "builders-hall",
       "text": "last check-in {…} ago",
       "file": "modules/hall-ui/public/gate.js",
-      "line": 391,
+      "line": 405,
       "origin": "js-markup",
       "confidence": "certain"
     },

package/docs/module-api-changelog.md

@@ -2777,5 +2777,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.20.58 with no explicit bump. run 36828212808. (task 1002620)
   1.20.60 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.20.59 with no explicit bump. run 36830884810. (task 1002620)
+  1.20.61 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.60 with no explicit bump. run 36846600005. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/page-readings.json

@@ -946,7 +946,7 @@
       "surface": "builders",
       "title": "Gate",
       "states_read": ["queue","out","approve"],
-      "files_hash": "3e862af3bb2c5b18",
+      "files_hash": "fce003b152adb982",
       "reading_hash": "08d3e5d3657e5afb",
       "counts": {"lines":41,"placed":17,"shared":5,"unplaced":19},
       "omitted": {"data":34},
@@ -957,7 +957,7 @@
         {"key":"L0003","section":"top bar","text":"Jump to…","placement":"shared","file":"modules/hall-ui/public/shell.js","line":495,"string_id":"eba610d25523"},
         {"key":"L0004","section":"top bar","text":"Ctrl K","placement":"shared"},
         {"key":"L0005","section":"Gate","text":"Gate","placement":"unplaced"},
-        {"key":"L0006","section":"Gate","text":"Changes touching protected build surfaces, held for your approval.","placement":"placed","file":"modules/hall-ui/public/gate.js","line":432,"string_id":"4b714191b423"},
+        {"key":"L0006","section":"Gate","text":"Changes touching protected build surfaces, held for your approval.","placement":"placed","file":"modules/hall-ui/public/gate.js","line":448,"string_id":"4b714191b423"},
         {"key":"L0007","section":"Gate","text":"Awaiting your approval","placement":"unplaced"},
         {"key":"L0008","section":"Gate","text":"held at the gate check","placement":"unplaced"},
         {"key":"L0009","section":"Gate","text":"Hard-floor holds","placement":"unplaced"},

package/modules/autonomy/db.js

@@ -162,11 +162,11 @@ async function disallowGoal(goalId) {
 // recordRunnerHeartbeat — upsert one host's check-in. ON CONFLICT so the normal
 // case is one write, and `host` is the key so a second runner appears as a second
 // row rather than silently overwriting the first.
-async function recordRunnerHeartbeat({ builderId, host, pid = null, startedAt = null, mode = null, consecutiveFailures = null, lastEvent = null, workingTaskId = null, workingGoalId = null }) {
+async function recordRunnerHeartbeat({ builderId, host, pid = null, startedAt = null, mode = null, consecutiveFailures = null, lastEvent = null, workingTaskId = null, workingGoalId = null, head = null, diskHead = null, mainHead = null, claudeAccount = null }) {
   const { rows } = await pool.query(
     `INSERT INTO autonomy_runner_heartbeat
-       (builder_id, host, pid, started_at, mode, consecutive_failures, last_event, working_task_id, working_goal_id, last_seen_at, updated_at)
-     VALUES ($8, $1, $2, $3, $4, $5, $6, $7, $9, now(), now())
+       (builder_id, host, pid, started_at, mode, consecutive_failures, last_event, working_task_id, working_goal_id, head, disk_head, main_head, claude_account, last_seen_at, updated_at)
+     VALUES ($8, $1, $2, $3, $4, $5, $6, $7, $9, $10, $11, $12, $13, now(), now())
      ON CONFLICT (builder_id, host) DO UPDATE SET
        pid = EXCLUDED.pid,
        started_at = COALESCE(EXCLUDED.started_at, autonomy_runner_heartbeat.started_at),
@@ -175,10 +175,16 @@ async function recordRunnerHeartbeat({ builderId, host, pid = null, startedAt =
        last_event = EXCLUDED.last_event,
        working_task_id = EXCLUDED.working_task_id,
        working_goal_id = EXCLUDED.working_goal_id,
+       -- Overwritten, never COALESCEd (task 1004407): a fresh process that cannot
+       -- read its own commit must say "unknown", not inherit the last process's.
+       head = EXCLUDED.head,
+       disk_head = EXCLUDED.disk_head,
+       main_head = EXCLUDED.main_head,
+       claude_account = EXCLUDED.claude_account,
        last_seen_at = now(),
        updated_at = now()
-     RETURNING host, pid, started_at, mode, consecutive_failures, last_event, working_task_id, working_goal_id, last_seen_at`,
-    [String(host).toLowerCase().slice(0, 255), pid, startedAt, mode, consecutiveFailures, lastEvent, workingTaskId, builderId, workingGoalId]
+     RETURNING host, pid, started_at, mode, consecutive_failures, last_event, working_task_id, working_goal_id, head, disk_head, main_head, claude_account, last_seen_at`,
+    [String(host).toLowerCase().slice(0, 255), pid, startedAt, mode, consecutiveFailures, lastEvent, workingTaskId, builderId, workingGoalId, head, diskHead, mainHead, claudeAccount]
   );
   return rows[0] || null;
 }
@@ -193,7 +199,8 @@ async function recordRunnerHeartbeat({ builderId, host, pid = null, startedAt =
 // liveness view entirely (grader finding, task 1003905).
 async function readRunnerHeartbeats(builderId) {
   const { rows } = await pool.query(
-    `SELECT host, pid, started_at, mode, consecutive_failures, last_event, working_task_id, working_goal_id, last_seen_at
+    `SELECT host, pid, started_at, mode, consecutive_failures, last_event, working_task_id, working_goal_id,
+            head, disk_head, main_head, claude_account, last_seen_at
        FROM autonomy_runner_heartbeat
       WHERE builder_id = $1
       ORDER BY last_seen_at DESC

package/modules/autonomy/migrations/autonomy_004_runner_identity.sql

@@ -0,0 +1,30 @@
+-- autonomy_004_runner_identity.sql — what the runner card can say about a runner
+-- (task 1004407).
+--
+-- Owner ruling, 2026-10-01: the gate page must show which code each runner is
+-- running, whether it is live or restarting, which always-on PC it is on, and
+-- which Claude account its workers spend. `host` already names the PC
+-- (autonomy_002); these four columns carry the rest.
+--
+--   head          the commit the supervisor process is RUNNING (40-char hex)
+--   disk_head     the commit on disk, when the checkout was refreshed in place
+--                 past what is running (task 1004406) — null otherwise
+--   main_head     the newest main the runner has seen, so the card can say
+--                 "behind main" without the server reaching GitHub
+--   claude_account a LABEL for the Claude login its workers use (an email, or
+--                 "API key" / "Claude token" when one is set). Never a token or
+--                 a key: the route caps it at 200 characters and the runner only
+--                 ever sends the label.
+--
+-- Nullable, no defaults: a runner that predates this reports nothing, and the
+-- card says nothing rather than guessing. Additive and idempotent.
+
+BEGIN;
+
+ALTER TABLE autonomy_runner_heartbeat
+  ADD COLUMN IF NOT EXISTS head text,
+  ADD COLUMN IF NOT EXISTS disk_head text,
+  ADD COLUMN IF NOT EXISTS main_head text,
+  ADD COLUMN IF NOT EXISTS claude_account text;
+
+COMMIT;

package/modules/autonomy/routes/autonomy.js

@@ -52,6 +52,11 @@ function runsLimit(raw) {
   return Math.min(RUNS_MAX_LIMIT, Math.max(1, n));
 }
 
+// commitOrNull — a full lowercase commit sha, or null (task 1004407).
+function commitOrNull(v) {
+  return typeof v === 'string' && /^[0-9a-f]{40}$/.test(v) ? v : null;
+}
+
 module.exports = function buildAutonomyRouter() {
   const router = express.Router();
 
@@ -219,6 +224,11 @@ module.exports = function buildAutonomyRouter() {
       last_event: { type: 'string', maxLength: 64 },
       working_task_id: { type: 'number' },
       working_goal_id: { type: 'number' },
+      // What the runner card says about the runner (task 1004407).
+      head: { type: 'string', maxLength: 40 },
+      disk_head: { type: 'string', maxLength: 40 },
+      main_head: { type: 'string', maxLength: 40 },
+      claude_account: { type: 'string', maxLength: 200 },
     })) return;
     const b = req.body || {};
     try {
@@ -234,6 +244,12 @@ module.exports = function buildAutonomyRouter() {
         lastEvent: b.last_event || null,
         workingTaskId: Number.isInteger(b.working_task_id) ? b.working_task_id : null,
         workingGoalId: Number.isInteger(b.working_goal_id) ? b.working_goal_id : null,
+        // A commit is stored only if it IS one: anything that is not 40 hex
+        // characters is dropped to null rather than rendered as a version.
+        head: commitOrNull(b.head),
+        diskHead: commitOrNull(b.disk_head),
+        mainHead: commitOrNull(b.main_head),
+        claudeAccount: typeof b.claude_account === 'string' && b.claude_account.trim() ? b.claude_account.trim() : null,
       });
       res.json({ ok: true, heartbeat: row });
     } catch (err) {

package/modules/autonomy/runner-health.js

@@ -19,6 +19,11 @@
 //     exactly what it is for, and crying dead every time it works is worse than
 //     saying nothing.
 //   · dead       — quiet longer than any legitimate explanation.
+//   · restarting — its last word was "exiting to pick up new code" (upgrade_exit,
+//     task 1004406), and that was recently. The wrapper fetches, resets and
+//     relaunches, which takes a minute or two, and the owner ruled that a restart
+//     must read as a restart, never as a death (task 1004407). Past RESTART_S the
+//     relaunch has failed and it is dead again — with a detail that says so.
 
 // Reasoned from the runner's own numbers, not picked. The loop beats at the top of
 // every pass and again on each poll inside a wait (every 60s), so a healthy runner
@@ -28,6 +33,43 @@ const ALIVE_S = 15 * 60;
 // worker holds the loop for its whole run. Two hours is that ceiling plus room for
 // the ship, the grade and the verify that follow it.
 const LATE_S = 2 * 60 * 60;
+// A relaunch is fetch + reset + boot + the first beat. Ten minutes is several
+// times that, so a slow fetch is not called a death, and short enough that a
+// relaunch which never happened is noticed the same evening.
+const RESTART_S = 10 * 60;
+
+const SHA_RE = /^[0-9a-f]{40}$/;
+const sha = (v) => (typeof v === 'string' && SHA_RE.test(v) ? v : null);
+
+// describeCode — what the card says about the code a runner is on (task 1004407).
+// `behind` is true only when BOTH sides are known and differ: the runner reports
+// the newest main it has seen, and an unknown is never drawn as "out of date".
+// A checkout refreshed in place counts by what is on disk, because that is what
+// every worker and child process runs (task 1004406).
+function describeCode(hb) {
+  const head = sha(hb && hb.head);
+  if (!head) return null;
+  const disk = sha(hb.disk_head);
+  const main = sha(hb.main_head);
+  const current = disk || head;
+  return {
+    head, short: head.slice(0, 8),
+    diskShort: disk && disk !== head ? disk.slice(0, 8) : null,
+    mainShort: main ? main.slice(0, 8) : null,
+    behind: main ? main !== current : null,
+  };
+}
+
+// What the runner was last doing, in words. Keyed on the run-log event names the
+// runner sends as last_event; an unknown event says nothing rather than guessing.
+const ACTIVITY = {
+  boot: 'just started',
+  waiting: 'waiting for work',
+  code_refreshed: 'updated its code in place',
+  nothing_claimable: 'waiting — nothing to claim',
+  fenced: 'held by the fence',
+  hold: 'pausing',
+};
 
 function ageS(lastSeenAt, nowMs) {
   const t = Date.parse(lastSeenAt || '');
@@ -68,19 +110,38 @@ function describeRunner(heartbeat, { nowMs = Date.now(), aliveS = ALIVE_S, lateS
   const mode = heartbeat.mode === 'probing' ? 'probing' : (heartbeat.mode === 'full' ? 'full' : null);
   const working = heartbeat.working_task_id ? String(heartbeat.working_task_id) : null;
   const where = host ? ` on ${host}` : '';
+  const ident = {
+    host, mode, workingTaskId: working,
+    account: typeof heartbeat.claude_account === 'string' && heartbeat.claude_account ? heartbeat.claude_account : null,
+    code: describeCode(heartbeat),
+  };
+
+  if (heartbeat.last_event === 'upgrade_exit') {
+    if (age <= RESTART_S) {
+      return {
+        state: 'restarting', ok: true, ageS: age, age: humanAge(age), ...ident,
+        detail: `restarting${where} to pick up new code`,
+      };
+    }
+    return {
+      state: 'dead', ok: false, ageS: age, age: humanAge(age), ...ident,
+      detail: `exited${where} ${humanAge(age)} ago to restart on new code and has not come back`,
+    };
+  }
 
   if (age <= aliveS) {
+    const doing = ACTIVITY[heartbeat.last_event];
     return {
-      state: 'alive', ok: true, ageS: age, age: humanAge(age), host, mode, workingTaskId: working,
+      state: 'alive', ok: true, ageS: age, age: humanAge(age), ...ident,
       detail: working
         ? `working task ${working}${where}`
-        : `${mode === 'probing' ? 'probing after failures' : 'running'}${where}`,
+        : `${mode === 'probing' ? 'probing after failures' : (doing || 'running')}${where}`,
     };
   }
 
   if (age <= lateS) {
     return {
-      state: 'late', ok: true, ageS: age, age: humanAge(age), host, mode, workingTaskId: working,
+      state: 'late', ok: true, ageS: age, age: humanAge(age), ...ident,
       // Deliberately NOT an alarm. This is what a runner doing its job looks like.
       detail: working
         ? `quiet for ${humanAge(age)} — expected while task ${working} builds`
@@ -89,9 +150,9 @@ function describeRunner(heartbeat, { nowMs = Date.now(), aliveS = ALIVE_S, lateS
   }
 
   return {
-    state: 'dead', ok: false, ageS: age, age: humanAge(age), host, mode, workingTaskId: working,
+    state: 'dead', ok: false, ageS: age, age: humanAge(age), ...ident,
     detail: `no check-in for ${humanAge(age)}${where} — longer than any worker takes, so the runner is not running`,
   };
 }
 
-module.exports = { ALIVE_S, LATE_S, ageS, humanAge, describeRunner };
+module.exports = { ALIVE_S, LATE_S, RESTART_S, ageS, humanAge, describeRunner };

package/modules/hall-ui/public/gate.js

@@ -358,7 +358,7 @@
   // exist here, resolved to inherited grey, and drew a dead runner in exactly the
   // same colour as a healthy one. Named classes cannot fail that way silently —
   // a missing class is visible in the stylesheet, a missing var is not.
-  const HEALTH_CLASS = { alive: 'fact-pill--ok', late: 'fact-pill--warn', dead: 'fact-pill--danger', never_seen: 'fact-pill--info' };
+  const HEALTH_CLASS = { alive: 'fact-pill--ok', late: 'fact-pill--warn', dead: 'fact-pill--danger', never_seen: 'fact-pill--info', restarting: 'fact-pill--info' };
 
   async function loadRunners() {
     const el = document.getElementById('fence-runner');
@@ -384,13 +384,29 @@
       // NOT the word "running": the switch below already uses it for a different
       // thing (allowed to work), and the two lines sit one above the other. A
       // reader should never have to work out which sense is meant.
-      const label = { dead: 'Not checking in', late: 'Quiet', alive: 'Checking in' }[h.state] || 'Unknown';
-      return `<p class="ov-foot" style="display:flex;align-items:baseline;gap:10px;flex-wrap:wrap;">
-        <span class="fact-pill ${cls}">${escapeHtml(label)}</span>
-        <span>${escapeHtml(h.detail || '')}</span>
-        ${r.working_goal_id ? `<span class="ov-fact">from goal ${escapeHtml(String(r.working_goal_id))}</span>` : ''}
-        <span class="ov-fact">last check-in ${escapeHtml(h.age || 'unknown')} ago</span>
-      </p>`;
+      const label = { dead: 'Not checking in', late: 'Quiet', alive: 'Checking in', restarting: 'Restarting' }[h.state] || 'Unknown';
+      // Which PC, which Claude account, which code (task 1004407). Each line is
+      // drawn only when the runner reported it, so an older runner shows less
+      // rather than a guess.
+      const facts = [];
+      if (h.host) facts.push(`<span class="ov-fact">PC <strong>${escapeHtml(h.host)}</strong></span>`);
+      if (h.account) facts.push(`<span class="ov-fact">Claude account ${escapeHtml(h.account)}</span>`);
+      if (h.code) {
+        const c = h.code;
+        const status = c.behind === true ? ` — behind main (${escapeHtml(c.mainShort)})`
+          : c.behind === false ? ' — up to date' : '';
+        const disk = c.diskShort ? `, updated in place to ${escapeHtml(c.diskShort)}` : '';
+        facts.push(`<span class="ov-fact">code <code>${escapeHtml(c.short)}</code>${disk}${status}</span>`);
+      }
+      return `<div class="ov-foot">
+        <p style="display:flex;align-items:baseline;gap:10px;flex-wrap:wrap;margin:0;">
+          <span class="fact-pill ${cls}">${escapeHtml(label)}</span>
+          <span>${escapeHtml(h.detail || '')}</span>
+          ${r.working_goal_id ? `<span class="ov-fact">from goal ${escapeHtml(String(r.working_goal_id))}</span>` : ''}
+          <span class="ov-fact">last check-in ${escapeHtml(h.age || 'unknown')} ago</span>
+        </p>
+        ${facts.length ? `<p style="display:flex;gap:14px;flex-wrap:wrap;margin:4px 0 0;">${facts.join('')}</p>` : ''}
+      </div>`;
     }).join('');
   }
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.60",
+  "version": "1.20.61",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.60",
+      "version": "1.20.61",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.60",
+  "version": "1.20.61",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8477,5 +8477,11 @@
       "id": "1004421",
       "text": "Every project can now have its own look, so builders who work in several projects always know which hall they are in. Creating a project has a new Look step: four ready-made looks or your own colour, a switch to tint dark mode"
     }
+  ],
+  "1.20.61": [
+    {
+      "id": "1004407",
+      "text": "The Gate page now shows, for each Autobongos runner, which PC it is on, which Claude account it is spending, which code version it runs (and whether that is behind), and says \"Restarting\" while it relaunches for new code inste"
+    }
   ]
 }

package/scripts/gds/autobongos-run.js

@@ -368,7 +368,7 @@ const MAX_CLAIM_ATTEMPTS = 5;
 const LIMIT_UNKNOWN_RESET_MS = 30 * 60 * 1000;
 
 function newRunnerState() {
-  return { setAside: new Map(), queueGate: null, limitUntil: null, diskHead: null };
+  return { setAside: new Map(), queueGate: null, limitUntil: null, diskHead: null, mainHead: null };
 }
 const RUNNER_STATE = newRunnerState();
 
@@ -703,6 +703,43 @@ function writeHeartbeat(now = Date.now(), runnerState = RUNNER_STATE) {
 // is the signal.
 const RUNNER_STARTED_AT = new Date().toISOString();
 
+// claudeAccountLabel — WHICH Claude account this machine's workers spend
+// (task 1004407), as a label and never a secret. Workers inherit
+// ANTHROPIC_API_KEY and CLAUDE_CODE_OAUTH_TOKEN from this process
+// (WORKER_ENV_ALLOW), and either one outranks the stored login, so those are
+// named first, by the variable that is set and never by its value. Otherwise it
+// is the login Claude Code itself records in ~/.claude.json (oauthAccount): the
+// email, plus the organisation when it has one. Read on every beat, so signing
+// a different account in shows up without a restart; null when nothing can be
+// read, which the card leaves blank rather than guessing.
+function claudeAccountLabel({ env = process.env, readFile = (p) => fs.readFileSync(p, 'utf8') } = {}) {
+  if (env.ANTHROPIC_API_KEY) return 'an API key (ANTHROPIC_API_KEY)';
+  if (env.CLAUDE_CODE_OAUTH_TOKEN) return 'a Claude token (CLAUDE_CODE_OAUTH_TOKEN)';
+  try {
+    const dir = env.CLAUDE_CONFIG_DIR || os.homedir();
+    const acct = JSON.parse(readFile(path.join(dir, '.claude.json'))).oauthAccount || {};
+    const email = typeof acct.emailAddress === 'string' ? acct.emailAddress.trim() : '';
+    if (!email) return null;
+    const org = typeof acct.organizationName === 'string' ? acct.organizationName.trim() : '';
+    return (org ? `${email} · ${org}` : email).slice(0, 200);
+  } catch (_) { return null; }
+}
+
+// heartbeatIdentity — the fields that say which code and which account (task
+// 1004407). Undefined fields are dropped, so a runner that cannot read its own
+// commit sends nothing for it rather than an empty string the route would refuse.
+function heartbeatIdentity(deps = {}) {
+  const st = deps.state || RUNNER_STATE;
+  const out = {
+    head: LOADED_HEAD || undefined,
+    disk_head: st.diskHead && st.diskHead !== LOADED_HEAD ? st.diskHead : undefined,
+    main_head: st.mainHead || undefined,
+    claude_account: (deps.claudeAccountLabel || claudeAccountLabel)() || undefined,
+  };
+  for (const k of Object.keys(out)) if (out[k] === undefined) delete out[k];
+  return out;
+}
+
 async function postHeartbeat(fields = {}, deps = {}) {
   try {
     const api = deps.api || await (require('./cli-lib').cliClient)();
@@ -711,6 +748,7 @@ async function postHeartbeat(fields = {}, deps = {}) {
         host: os.hostname(),
         pid: process.pid,
         started_at: RUNNER_STARTED_AT,
+        ...heartbeatIdentity(deps),
         ...fields,
       },
     });
@@ -870,6 +908,9 @@ async function codeDrifted(deps = {}) {
   let tip = null;
   try { tip = await runFetchHead(deps); } catch (_) { return null; }
   if (!tip) return null;
+  // Kept for the heartbeat (task 1004407), so the hall can say "behind main"
+  // without the server ever reaching GitHub itself.
+  (deps.state || RUNNER_STATE).mainHead = tip;
   return tip !== base ? { from: base.slice(0, 8), to: String(tip).slice(0, 8) } : false;
 }
 
@@ -1147,6 +1188,6 @@ module.exports = {
   readArgv, pickTask, iteration, record, logPath, spawnWorker, workerEnv, WORKER_ENV_ALLOW, resolveWorkerBin,
   worktreeName, readFence, reconcileLeftoverClaims, pollSignals, waitOrJump, forever, CLAIM_PREFIX, codeDrifted, loadedHead, UPGRADE_EXIT_CODE, MIN_UPTIME_BEFORE_UPGRADE_MS,
   heartbeatPath, writeHeartbeat, readHeartbeat, pidAlive, anotherRunnerIsAlive, HEARTBEAT_STALE_MS,
-  isRunnerTree, RUNNER_TREE_RE, postHeartbeat, RUNNER_STARTED_AT, failureReason,
+  isRunnerTree, RUNNER_TREE_RE, postHeartbeat, claudeAccountLabel, RUNNER_STARTED_AT, failureReason,
   newRunnerState, loadedFiles, supervisorTouched, refreshCheckout, LIMIT_UNKNOWN_RESET_MS, QUEUE_GATED_EXIT, CLAIM_SET_ASIDE_MS, MAX_CLAIM_ATTEMPTS, owedTaskIds,
 };

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.60'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.61'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/autonomy_runner_identity.mjs

@@ -0,0 +1,215 @@
+// tests/autonomy_runner_identity.mjs — the runner card says which PC, which Claude
+// account, which code, and whether the runner is live or restarting (task 1004407).
+//
+// Owner ruling, 2026-10-01: showing the code version is good, and showing when it
+// is restarting versus live is better, along with which always-on PC and which
+// Claude account it runs on. These pin each of those from the runner that reports
+// them, through the route and the SQL, to the verdict the hall renders. The rule
+// that holds across all of it: an unknown is shown as nothing, never as a guess,
+// and a secret is never what gets sent.
+//
+// DB-free, no network. Run:  node --test tests/autonomy_runner_identity.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const req = createRequire(import.meta.url);
+const express = req('express');
+const { attachFail } = req(path.join(ROOT, 'src/bongos/middleware/error-envelope.js'));
+const health = req(path.join(ROOT, 'modules/autonomy/runner-health.js'));
+const runner = req(path.join(ROOT, 'scripts/gds/autobongos-run.js'));
+
+const NOW = Date.parse('2026-10-01T12:00:00.000Z');
+const agoS = (s) => new Date(NOW - s * 1000).toISOString();
+const A = 'a'.repeat(40);
+const B = 'b'.repeat(40);
+const hb = (over = {}) => ({ host: 'gmk-always-on', mode: 'full', last_event: 'loop', last_seen_at: agoS(30), ...over });
+
+// ── live or restarting ───────────────────────────────────────────────────────────
+
+test('a runner that just exited to pick up new code reads RESTARTING, not dead', () => {
+  const d = health.describeRunner(hb({ last_event: 'upgrade_exit', last_seen_at: agoS(90) }), { nowMs: NOW });
+  assert.equal(d.state, 'restarting');
+  assert.equal(d.ok, true, 'a restart is not a fault');
+  assert.match(d.detail, /restarting on gmk-always-on to pick up new code/);
+});
+
+test('a restart that never came back is dead, and says it was a restart', () => {
+  const d = health.describeRunner(hb({ last_event: 'upgrade_exit', last_seen_at: agoS(health.RESTART_S + 60) }), { nowMs: NOW });
+  assert.equal(d.state, 'dead');
+  assert.equal(d.ok, false);
+  assert.match(d.detail, /exited on gmk-always-on .* to restart on new code and has not come back/);
+});
+
+test('the restart window ends exactly at RESTART_S', () => {
+  assert.equal(health.describeRunner(hb({ last_event: 'upgrade_exit', last_seen_at: agoS(health.RESTART_S) }), { nowMs: NOW }).state, 'restarting');
+  assert.equal(health.describeRunner(hb({ last_event: 'upgrade_exit', last_seen_at: agoS(health.RESTART_S + 1) }), { nowMs: NOW }).state, 'dead');
+});
+
+test('a live runner says what it last did, in words', () => {
+  assert.match(health.describeRunner(hb({ last_event: 'code_refreshed' }), { nowMs: NOW }).detail, /updated its code in place on gmk-always-on/);
+  assert.match(health.describeRunner(hb({ last_event: 'waiting' }), { nowMs: NOW }).detail, /waiting for work/);
+  assert.match(health.describeRunner(hb({ last_event: 'loop' }), { nowMs: NOW }).detail, /^running on/, 'an event with no words keeps the old wording');
+  assert.match(health.describeRunner(hb({ working_task_id: '4242', last_event: 'worked' }), { nowMs: NOW }).detail, /working task 4242/);
+});
+
+// ── which code ───────────────────────────────────────────────────────────────────
+
+test('the code version is shown short, and flagged when it is behind main', () => {
+  const d = health.describeRunner(hb({ head: A, main_head: B }), { nowMs: NOW });
+  assert.equal(d.code.short, 'aaaaaaaa');
+  assert.equal(d.code.behind, true);
+  assert.equal(d.code.mainShort, 'bbbbbbbb');
+  assert.equal(health.describeRunner(hb({ head: A, main_head: A }), { nowMs: NOW }).code.behind, false);
+});
+
+test('an unknown main is never drawn as "out of date"', () => {
+  const c = health.describeRunner(hb({ head: A }), { nowMs: NOW }).code;
+  assert.equal(c.behind, null);
+  assert.equal(c.mainShort, null);
+});
+
+test('a checkout refreshed in place is current by what is on DISK', () => {
+  // Workers and child processes run what is on disk (task 1004406), so a
+  // refreshed runner whose own process is older is still up to date.
+  const c = health.describeRunner(hb({ head: A, disk_head: B, main_head: B }), { nowMs: NOW }).code;
+  assert.equal(c.behind, false);
+  assert.equal(c.diskShort, 'bbbbbbbb');
+});
+
+test('no head, or a head that is not a commit, shows no code line at all', () => {
+  for (const head of [null, undefined, '', 'abc', 'Z'.repeat(40), A.toUpperCase()]) {
+    assert.equal(health.describeRunner(hb({ head }), { nowMs: NOW }).code, null, String(head));
+  }
+});
+
+// ── which PC and which account ───────────────────────────────────────────────────
+
+test('the PC and the Claude account ride on every state, dead included', () => {
+  for (const [over, state] of [[{}, 'alive'], [{ last_seen_at: agoS(health.LATE_S + 1) }, 'dead'], [{ last_event: 'upgrade_exit' }, 'restarting']]) {
+    const d = health.describeRunner(hb({ claude_account: 'me@example.com', head: A, ...over }), { nowMs: NOW });
+    assert.equal(d.state, state);
+    assert.equal(d.host, 'gmk-always-on');
+    assert.equal(d.account, 'me@example.com', `${state} must still say whose account it spent`);
+    assert.ok(d.code, `${state} must still say which code`);
+  }
+});
+
+test('the account label names a key or a token by its variable, never its value', () => {
+  const secret = 'sk-ant-SECRET-VALUE';
+  const viaKey = runner.claudeAccountLabel({ env: { ANTHROPIC_API_KEY: secret }, readFile: () => { throw new Error('unread'); } });
+  assert.equal(viaKey, 'an API key (ANTHROPIC_API_KEY)');
+  const viaToken = runner.claudeAccountLabel({ env: { CLAUDE_CODE_OAUTH_TOKEN: secret }, readFile: () => { throw new Error('unread'); } });
+  assert.equal(viaToken, 'a Claude token (CLAUDE_CODE_OAUTH_TOKEN)');
+  assert.ok(!viaKey.includes(secret) && !viaToken.includes(secret));
+});
+
+test('otherwise the label is the login Claude Code records, with its organisation', () => {
+  const seen = [];
+  const file = (o) => (p) => { seen.push(p); return JSON.stringify({ oauthAccount: o, primaryApiKey: 'never-read' }); };
+  assert.equal(runner.claudeAccountLabel({ env: { CLAUDE_CONFIG_DIR: '/cfg' }, readFile: file({ emailAddress: 'me@example.com', organizationName: 'Acme' }) }), 'me@example.com · Acme');
+  assert.equal(path.normalize(seen[0]), path.normalize('/cfg/.claude.json'), 'CLAUDE_CONFIG_DIR is where Claude Code keeps it when set');
+  assert.equal(runner.claudeAccountLabel({ env: {}, readFile: file({ emailAddress: 'me@example.com' }) }), 'me@example.com');
+  assert.equal(runner.claudeAccountLabel({ env: {}, readFile: file({}) }), null, 'no login reads as unknown');
+  assert.equal(runner.claudeAccountLabel({ env: {}, readFile: () => 'not json' }), null);
+  assert.equal(runner.claudeAccountLabel({ env: {}, readFile: () => { throw new Error('ENOENT'); } }), null);
+});
+
+// ── the runner sends it ──────────────────────────────────────────────────────────
+
+test('every server check-in carries the code and the account, and the newest main seen', async () => {
+  const bodies = [];
+  const api = { autonomy: { postAutonomyHeartbeat: async ({ body }) => { bodies.push(body); return { ok: true }; } } };
+  const state = runner.newRunnerState();
+  // codeDrifted is what learns main's tip; it must keep it for the heartbeat.
+  await runner.codeDrifted({ loadedHead: async () => A, run: async () => ({ ok: true, stdout: `${B}\trefs/heads/main\n` }), state });
+  assert.equal(state.mainHead, B);
+  await runner.loadedHead({ run: async () => ({ ok: true, stdout: `${A}\n` }) });
+  await runner.postHeartbeat({ last_event: 'loop' }, { api, state, claudeAccountLabel: () => 'me@example.com' });
+  assert.equal(bodies[0].head, A);
+  assert.equal(bodies[0].main_head, B);
+  assert.equal(bodies[0].claude_account, 'me@example.com');
+  assert.equal(bodies[0].last_event, 'loop');
+  assert.equal('disk_head' in bodies[0], false, 'no refresh in place, so no disk_head');
+
+  state.diskHead = B;
+  await runner.postHeartbeat({}, { api, state, claudeAccountLabel: () => null });
+  assert.equal(bodies[1].disk_head, B);
+  assert.equal('claude_account' in bodies[1], false, 'an unknown account is left out, not sent empty');
+});
+
+// ── the route and the SQL ────────────────────────────────────────────────────────
+
+function autonomyRouter() {
+  const api = req(path.join(ROOT, 'src/module-api.js'));
+  const saved = { b: api.requireBuilder, p: api.requirePermission };
+  api.requireBuilder = (r, _s, next) => { r.builder = { id: 3, rank: 'archon' }; next(); };
+  api.requirePermission = () => (_r, _s, next) => next();
+  const routePath = req.resolve(path.join(ROOT, 'modules/autonomy/routes/autonomy.js'));
+  delete req.cache[routePath];
+  try { return req(routePath)(); } finally { api.requireBuilder = saved.b; api.requirePermission = saved.p; }
+}
+
+test('the route stores a commit only if it is one, and the account label as sent', async () => {
+  const db = req(path.join(ROOT, 'modules/autonomy/db.js'));
+  const saved = db.recordRunnerHeartbeat;
+  const seen = [];
+  db.recordRunnerHeartbeat = async (a) => { seen.push(a); return {}; };
+  const app = express(); app.use(express.json()); app.use(attachFail); app.use(autonomyRouter());
+  const server = app.listen(0); await new Promise((r) => server.once('listening', r));
+  const post = (body) => fetch(`http://127.0.0.1:${server.address().port}/autonomy/heartbeat`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) });
+  try {
+    let r = await post({ host: 'gmk-always-on', head: A, disk_head: B, main_head: B, claude_account: '  me@example.com  ' });
+    assert.equal(r.status, 200);
+    assert.deepEqual([seen[0].head, seen[0].diskHead, seen[0].mainHead, seen[0].claudeAccount], [A, B, B, 'me@example.com']);
+    r = await post({ host: 'gmk-always-on', head: 'not-a-commit', main_head: A.toUpperCase(), claude_account: '' });
+    assert.equal(r.status, 200, 'a bad version never costs the runner its check-in');
+    assert.deepEqual([seen[1].head, seen[1].mainHead, seen[1].claudeAccount], [null, null, null]);
+    r = await post({ host: 'gmk-always-on', claude_account: 'x'.repeat(201) });
+    assert.equal(r.status, 400, 'the label is capped, so a key pasted into it by mistake is refused, not stored');
+  } finally {
+    server.close();
+    db.recordRunnerHeartbeat = saved;
+  }
+});
+
+test('the heartbeat SQL overwrites the identity every beat and reads it back', async () => {
+  const api = req(path.join(ROOT, 'src/module-api.js'));
+  const db = req(path.join(ROOT, 'modules/autonomy/db.js'));
+  const saved = api.pool.query;
+  const calls = [];
+  api.pool.query = async (sql, params) => { calls.push({ sql, params }); return { rows: [{ head: A }] }; };
+  try {
+    await db.recordRunnerHeartbeat({ builderId: 3, host: 'gmk-always-on', head: A, diskHead: B, mainHead: B, claudeAccount: 'me@example.com' });
+    for (const col of ['head', 'disk_head', 'main_head', 'claude_account']) {
+      assert.match(calls[0].sql, new RegExp(`\\b${col} = EXCLUDED\\.${col}\\b`), `${col} is overwritten, never kept from the last process`);
+    }
+    assert.deepEqual(calls[0].params.slice(9), [A, B, B, 'me@example.com']);
+    await db.readRunnerHeartbeats(3);
+    assert.match(calls[1].sql, /head, disk_head, main_head, claude_account/);
+  } finally {
+    api.pool.query = saved;
+  }
+});
+
+test('the migration adds the four columns, additively', () => {
+  const sql = fs.readFileSync(path.join(ROOT, 'modules/autonomy/migrations/autonomy_004_runner_identity.sql'), 'utf8')
+    .split('\n').filter((l) => !l.trim().startsWith('--')).join('\n');
+  for (const col of ['head', 'disk_head', 'main_head', 'claude_account']) {
+    assert.match(sql, new RegExp(`ADD COLUMN IF NOT EXISTS ${col} text`));
+  }
+  assert.doesNotMatch(sql, /\bDROP\b/i);
+});
+
+test('the gate card draws the PC, the account, the code and the restarting label', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/gate.js'), 'utf8');
+  assert.match(src, /restarting: 'Restarting'/);
+  assert.match(src, /PC <strong>\$\{escapeHtml\(h\.host\)\}<\/strong>/);
+  assert.match(src, /Claude account \$\{escapeHtml\(h\.account\)\}/);
+  assert.match(src, /behind main/);
+});