diff --git a/scripts/ops-log b/scripts/ops-log
index e4292fd..fbbf8c7 100755
--- a/scripts/ops-log
+++ b/scripts/ops-log
@@ -83,14 +83,23 @@ OUTCOMES = ("ok", "changed", "failed", "refused", "skipped")
 # ─── identity ──────────────────────────────────────────────────────────────
 
 def agent_id() -> str:
-    """Who is acting. ALTHING_HANDLE is the fleet's agent identity and is set
-    per pane by dev-launch; fall back to user@box so a human shell is still
-    distinguishable rather than anonymous."""
+    """Who is acting. ALTHING_HANDLE is the fleet's agent identity.
+
+    When it is unset the record says so IN THE NAME — `unattributed(user@box)`
+    — rather than quietly recording a unix login as though it were an agent
+    handle. Handles never contain `@` or parentheses, so the fallback can never
+    be misread as one.
+
+    This is not hypothetical: infra-hermes's seat exports ALTHING_HANDLE from
+    `althing-infra-hermes-seat-run.sh`, but neither `hermes-gateway.service`
+    nor his pump unit carries it, so work he does outside that one script logs
+    with no handle. An entry that merely said `lkraven@nh3-dev` would look like
+    an answer while being the absence of one."""
     handle = os.environ.get("ALTHING_HANDLE", "").strip()
     if handle:
         return handle
     user = os.environ.get("USER") or os.environ.get("LOGNAME") or "unknown"
-    return f"{user}@{os.uname().nodename}"
+    return f"unattributed({user}@{os.uname().nodename})"
 
 
 def now_iso() -> str: