diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1c51de3b..6a684398 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,13 @@
 
 This repo is a CortexKit-maintained Anthropic auth monorepo for OpenCode and Pi. The OpenCode package is a fork of the original `@ex-machina/opencode-anthropic-auth` plugin, so older entries below the initial CortexKit release are inherited from upstream package history.
 
+## Unreleased
+
+### Minor Changes
+
+- Document the global `/claude-account claustrum|local` custody mode, including its fail-closed OpenCode behavior and Pi refusal.
+- Document global Claustrum manifest onboarding, startup legacy-handle migration, and vault re-login recovery.
+
 ## 1.22.0
 
 ### Minor Changes
diff --git a/README.md b/README.md
index 87f8b1de..2f103135 100644
--- a/README.md
+++ b/README.md
@@ -116,15 +116,21 @@ Override the path with `PI_ANTHROPIC_AUTH_FILE`. The package also respects `PI_A
 
 ## Primary account authentication
 
-Each integration keeps the host agent's normal Anthropic login as the primary account.
-
-For OpenCode, use OpenCode's Anthropic auth flow:
+OpenCode keeps its native `anthropic` entry as the main account. In `local` mode, sign in through OpenCode:
 
 ```text
 /connect anthropic
 ```
 
-The primary account remains OpenCode's built-in `anthropic` auth entry. The OpenCode plugin intercepts final Anthropic requests and supplies the OAuth headers and request transforms needed for Claude Pro/Max access.
+Before the main account can enter Claustrum custody, the operator onboards it into the vault with Claustrum's tooling. Until the dedicated import tooling lands, use the interim path in the custody state machine's §8, “Adding a new account today.” The plugin never runs `ck`, never imports or migrates credentials, and never writes the host auth slot.
+
+Verify the migration gate against the installed `ck-auth` binary, not an announcement or a claimed deployment revision. In an isolated scratch data directory, a production-shaped tombstone import must refuse with `refusing Claustrum tombstone material` and leave the audit chain unchanged; in the same run, a real-material import with `--replace` must succeed. The refusal alone is not enough because a broken import path also refuses. The exact tombstone write is:
+
+```json
+{ "type": "oauth", "access": "", "refresh": "claustrum-tombstone:v1:anthropic", "expires": 0 }
+```
+
+`access` is empty so the sealer's shape gate rejects the material by construction.
 
 OpenCode's upstream authentication options are still supported:
 
@@ -186,9 +192,6 @@ Example:
   "quotaHeaderFeed": {
     "enabled": false
   },
-  "claustrum": {
-    "accounts": {}
-  },
   "killswitch": {
     "enabled": false,
     "main": { "five_hour": 5, "seven_day": 10, "scoped": 0 },
@@ -233,8 +236,6 @@ The `routing` block controls `/claude-routing`, `claudeCache` controls `/claude-
 
 `quotaHeaderFeed.enabled` is an OpenCode-only, restart-required opt-in. It publishes only allowlisted quota-window values, an opaque account reference, an observation timestamp, and the configured OAuth-account count; it never publishes tokens, raw headers, request bodies, model IDs, or refresh errors. Per-process lease files use owner-only permissions under `$TMPDIR/opencode-anthropic-auth/quota-header-feed`, expire after three minutes, and can be redirected with `OPENCODE_ANTHROPIC_AUTH_QUOTA_FEED_DIR`.
 
-`claustrum.accounts.<fallback-account-id>.enabled` is an OpenCode-only, per-account opt-in for fallback credential custody. It is inert unless that account's capability handle has been provisioned in `anthropic-auth-state.json`; handles are bearer credentials and must not be copied into the public config file.
-
 Runtime data is stored separately in `anthropic-auth-state.json`: fallback OAuth tokens, API-route keys, token refresh backoff, quota snapshots, and quota API backoff. `sticky-balanced` session assignments use a separate `anthropic-auth-routing-state.json`; session IDs are SHA-256 hashed in that file. Background refresh and quota checks write only runtime state, so editing `anthropic-auth.json` does not get overwritten by another running plugin instance.
 
 ## OpenCode lane-start setting
@@ -287,24 +288,15 @@ Fallback OAuth tokens refresh in the background so idle accounts do not expire b
 
 If Anthropic reports `invalid_grant`, that account must be logged in again. `/claude-account reset-backoff` manually clears the main account's refresh backoff and its matching quota backoff.
 
-### Optional Claustrum custody (OpenCode)
-
-OpenCode can obtain an opted-in fallback OAuth account's access credential from a local [Claustrum](https://github.com/cortexkit/claustrum) daemon instead of refreshing that account independently. After provisioning the account's runtime handle, enable custody by account ID:
+### Claustrum manifest service (OpenCode)
 
-```json
-{
-  "claustrum": {
-    "accounts": {
-      "personal-alt": { "enabled": true }
-    }
-  }
-}
-```
+Claustrum custody is global. `/claude-account claustrum` enters custody, `/claude-account local` returns to local authentication, and bare `/claude-account` shows status. There are no per-account custody switches. Claustrum uses a handle manifest written by Claustrum tooling.
 
-The request path reads only a resident in-memory credential. Startup warming and periodic custody ticks perform vault I/O and keep idle credentials refreshed; a cold or unavailable vault falls back to the sidecar credential path. Vault-served 401 reports carry the exact record version and response provenance, including relay-stream 401s, so a sidecar-served failure cannot invalidate a healthy vault credential. `/claude-account` and the OpenCode account modal show the gate, current vault service, and vault reauthentication state without exposing capability handles.
+Entering custody preflights every enabled OAuth account. A refusal changes nothing, and the command reports every refusal in account order. The main account must already have been migrated by the operator. The plugin does not create or import vault records during this check.
 
-Custody currently applies only to fallback OAuth accounts. Main-account vault service is not implemented. If Claustrum has replaced the main host credential with its provider-bound tombstone, the plugin rejects refresh locally without contacting Anthropic or persisting a permanent `invalid_grant` state.
+In custody, every enabled OAuth route is served from the vault, including the main account. A cold main vault record returns a typed startup refusal and holds every OAuth route until the next viable boot; after a warm boot, it returns a typed provider-unavailable error. The plugin does not fall back to sidecar credentials or send a tombstone as a bearer token. A cold fallback is excluded only for that request, so other warm routes can still serve.
 
+Leaving custody puts the main account back into interactive OpenCode sign-in. A fallback binding clears only after a login completed through the plugin's own login flow observes new credential material. To enter custody again for that fallback, the operator must import the new material into the vault with `--replace`; until then, `/claude-account claustrum` refuses with `binding_missing`. API-key routes are unaffected.
 ## Quota-aware routing
 
 When `quota.enabled` is true, the plugin checks Anthropic's OAuth usage endpoint and applies the configured remaining-quota thresholds to both main and fallback accounts.
@@ -332,6 +324,14 @@ In OpenCode, this includes the main Anthropic account and sidecar fallback accou
 
 Reset times are rendered as relative durations, such as `resets in 10m` or `resets in 1h 15m`.
 
+### Quota header feed
+
+The optional quota header feed writes one lease file per process under `${TMPDIR:-/tmp}/opencode-anthropic-auth/quota-header-feed/`. Set `OPENCODE_ANTHROPIC_AUTH_QUOTA_FEED_DIR` to override the directory. A file contains only accounts whose response headers THAT process harvested. Consumers MUST union entries from every file inside `lease_horizon_ms`, then deduplicate by account. "Newest file wins" drops accounts seen by other processes.
+
+For each account, the newest entry wins for quota values. Resolve `anthropic_account_uuid` from any entry in that account's group that carries it. During a rollout, an older pre-restart publisher can write the newest entry without that field beside newer code that has it.
+
+Each entry always includes `anthropic_account_uuid`; an absent key identifies an older producer. Its value is provider-derived or `null`, never a local substitute. A consumer that sees `null` must count a gap, not fall back to `account_ref`; that field is store-local and never a join key.
+
 ## Safety fallback (OpenCode)
 
 Eligible Fable 5/5.1 and Opus 5 OAuth requests try Anthropic's server-side safety fallback first. The plugin sends `fallbacks: "default"` with Anthropic's server-side fallback beta, preserves fallback conversation boundaries in OpenCode history, and reports model handoffs and restoration in the TUI sidebar or OpenCode Desktop. Follow-up requests may remain on Anthropic's selected fallback model for approximately one hour.
diff --git a/docs/custody-state-machine.md b/docs/custody-state-machine.md
new file mode 100644
index 00000000..1ecea813
--- /dev/null
+++ b/docs/custody-state-machine.md
@@ -0,0 +1,505 @@
+# Custody state machine: global `claustrum` | `local` mode with main-account takeover
+
+Design record for PR #196 (rework). This file is the artefact that gates implementation of the
+mode transition; the PR comment stream (Rev 1, Rev 2, three addenda) is superseded by it. The
+reasoning is kept in-tree because a diff will not carry it and every row here was paid for by a
+ruling or an incident.
+
+Status: **implementation baseline** (maintainer, 2026-09-05 06:04Z, PR #196). This document is the
+baseline for the implementation pass; the maintainer reviews the result and owns final integration
+and remaining corrections. The go-ahead is permission to build, **not** approval to merge or to
+activate takeover against live credentials; no live migration or release is authorised by it. Three
+constraints bind the implementation (§13). The branch still carries the superseded per-account
+toggle, which will not be merged as-is.
+
+## 1. Scope and vocabulary
+
+Two global modes, persisted in `anthropic-auth.json`:
+
+- `local` (default): the plugin refreshes and serves OAuth credentials from OpenCode's `auth.json`
+  (main) and its own sidecar (fallbacks). No vault calls are made in this mode.
+- `claustrum`: every OAuth route, **main included**, is served from the Claustrum vault through a
+  handle-manifest binding. The vault is the sole refresher of every bound family.
+
+Commands are exactly `/claude-account claustrum`, `/claude-account local`, and bare
+`/claude-account` for status. There is no per-account custody toggle, no `claustrum.enabled`
+flag, and no `on|off` synonym. Account membership is decided by the handle manifest, not by
+configuration. API-key routes are out of scope and unaffected in both modes.
+
+**Mode records intent; credential state proves servability.** `mode=claustrum` licenses the
+takeover barrier and the custody serving path. It never by itself makes an account servable, and
+a per-account verdict never by itself changes the mode.
+
+## 2. The tombstone: one write set, one classifier, one wider refusal
+
+Main's slot in `auth.json` cannot be empty: OpenCode runs a plugin's `auth.loader` only when a
+stored entry exists (`provider/provider.ts:1604-1619`, `if (!stored) continue`), and an entry
+that fails the `Info` decode is silently filtered by `Auth.all()` (`auth/index.ts:56-67`). An
+absent or malformed slot therefore means **our request path does not exist**: no loader, no fetch
+hook, no custody. Under `claustrum` the slot holds a non-secret tombstone whose only job is to
+make the loader run.
+
+### 2.1 WRITE set (production writes exactly this, nothing else)
+
+```json
+{ "type": "oauth", "access": "", "refresh": "claustrum-tombstone:v1:anthropic", "expires": 0 }
+```
+
+`access` is **empty**, and that is load-bearing, not cosmetic. OpenCode's `Info` schema is
+`access: Schema.String` with no non-empty constraint, so the slot decodes and the loader runs
+(verified live on 1.18.26 by the maintainer, reproduced on `openai`). Claustrum's deployed sealer
+runs a shape gate that **aborts on empty access but accepts sentinel access**; an empty-access
+tombstone therefore fails vault import by construction, independently of Claustrum's
+reserved-prefix refusal (#28). Anything that later "tidies" this to carry a descriptive `access`
+value silently re-arms the destructive import path. The constant carries this comment.
+
+### 2.2 RECOGNISE (classifier: "is this MY provider's tombstone?")
+
+```
+auth.type === 'oauth' && auth.refresh === custodyTombstoneKey(provider)
+```
+
+`access` and `expires` are **not** conjuncts. Once the exact provider-scoped sentinel is present in
+`refresh`, a different `access`/`expires` is a partial write or corrupt state that must still enter
+the custody path, never approach local refresh. Every extra conjunct is another way to *miss*, and a
+miss falls through to a wrong-state boot: the loader does not refuse, `mainAccountId` is minted,
+quota-identity resolution runs its compat substitution, and the background refresh loop starts
+before the exchange-level guard finally throws. A spurious match merely refuses to serve.
+
+Both artefact shapes are pinned by tests: the empty-access shape production writes, and the
+sentinel-access shape Claustrum's vendored golden encodes (legacy). A golden-only test is green
+about a shape production never writes.
+
+### 2.3 REFUSE (barrier: "is this tombstone material at all?")
+
+Prefix-wide, at the last point before the irreversible act, on the **value committed** rather than
+the record it came from:
+
+- token exchange: `assertNotCustodyTombstone` is the first statement of `refreshClaudeOAuthToken`,
+  keyed on `refresh.startsWith(CUSTODY_TOMBSTONE_PREFIX)`, before any `URLSearchParams` is built;
+- send boundary: the bearer value is checked for the prefix before header construction.
+
+These deliberately do **not** share a predicate with §2.2. Recognition is exact so a foreign
+provider's tombstone is not adopted as ours; refusal is wide so a foreign provider's tombstone can
+never reach Anthropic's token endpoint. Two reviewers on two plugins independently reached to merge
+them in one afternoon; the merge would have narrowed the barrier to the classifier, which is the
+same failure as having no barrier.
+
+**Containment invariant, pinned by one test:** `refusal ⊋ recognition`. Every shape recognised at
+the loader is refused at the exchange and the send boundary; the witness for strictness is a
+**foreign-provider** tombstone (`claustrum-tombstone:v1:openai`), which recognition answers *no*
+and refusal answers *yes*. A same-provider witness cannot distinguish the two predicates and so
+cannot protect the split.
+
+## 3. Axes
+
+Evaluated independently for main and for **each enabled OAuth fallback**.
+
+| axis | values | notes |
+|---|---|---|
+| `mode` | `local` · `claustrum` | global, durable; the only global write in the barrier |
+| `binding` | `VALID` · `INVALID` · `ABSENT` | the account's entry `{label, handle, credentialId}` in our provider block of the shared handle manifest. `INVALID` = entry present, handle or credentialId fails validation. `VALID` = a RESOLVED binding from the resolver, whichever source it came from: a manifest entry, or (transitionally, for the migration window and the crash-left / unreadable-manifest case) a plugin-written sidecar handle. Source is provenance, not authorization; the resolver owns the binding decision and startup migration converges sidecar handles into the manifest. What membership-by-manifest retires is the per-account *config flag* as an authority, not sidecar-held bindings. |
+| `local` | `REAL` · `INERT` · `GONE` | main: `REAL` = usable material, `INERT` = recognise-set tombstone, `GONE` = slot absent **as observed through the SDK**. An unparseable main slot is unobservable: `Auth.all()` runs `Record.filterMap(decode)` (`auth/index.ts:65-66`), so a slot failing the `Info` schema reads as `undefined` and any later host write rewrites the file without it; for main, `GONE ≡ SLOT_ABSENT`. Fallback: `REAL` = usable refresh material, `INERT` = refresh material absent, row otherwise valid, `GONE` = `ROW_UNPARSEABLE` (our own store, so the distinction survives there; a row that is *absent* while a binding exists is the discovery operation, §7, not a coordinate) |
+| `vault` | `USABLE` · `COLD` · `REAUTH` · `N/A` | resolved through the binding's handle. `COLD` = daemon unreachable or credential not resident (transient). `REAUTH` = record latched `needs_reauth`. `N/A` ⇔ `binding ∈ {ABSENT, INVALID}` |
+
+The startup matrix in §5 uses a compact four-letter form: `mode|main|fallbacks|evidence`.
+
+| letter | meaning |
+|---|---|
+| `C` | global `claustrum` mode |
+| `L` | global `local` mode |
+| `R` | real local OAuth material is present |
+| `T` | local material is tombstoned or absent while a binding resolves |
+| `X` | the main host slot is absent or cannot be observed as a valid OAuth slot |
+| `M` | a fallback binding is missing |
+| `V` | main vault evidence is verified at startup |
+| `N` | main vault evidence is not verified at startup |
+
+Two facts about `GONE` for main, both from OpenCode source (`339536bc22`), change what it means:
+
+- an absent slot never reaches `auth.loader`, so any reconciliation that must observe main's slot
+  before the loader runs lives in the **plugin factory**, which is invoked during the first
+  Provider-state construction via `plugin.list()` (`provider.ts:1436`) but **before** the provider
+  reaches `auth.all()` and the loader pass (`:1591-1622`). An awaited write from the factory would be
+  visible to the first loader; the plugin currently issues no such write (§5, C9).
+- today `normalizeAccount` null-drops an unparseable fallback row and `Auth.all()` hides an absent
+  or malformed slot. Reconciliation reads **raw** rows and slots so `GONE` is surfaced, and a `GONE`
+  fallback's state secrets are **retained**, never pruned, never normalised into success.
+
+## 4. Fences (three, never combined)
+
+| fence | compares | when | effect |
+|---|---|---|---|
+| **RECORD_VERSION** | the `record_version` captured from the resolution that served *this* request's token, passed unchanged to `report_auth_failure` for *this* response | per request, on a 401 | provenance only. **Never** a startup coordinate, never affects availability. `record_version` is `expected_version + 1` on every vault `commit_refresh` (`store.rs:1931-1951`); an earlier draft that compared it at startup would have made an account unavailable every time the vault did its job |
+| **IDENTITY** | vault `account_id` from `credential.get` **vs** the row's persisted `anthropicAccountUuid` | startup reconcile and each custody tick, only when `vault=USABLE` | **both present and unequal → `MISMATCH`** (refuse serve, no writes, surfaced). **Either absent → `UNLABELLED`**: serve; absence is not difference. The request-time bootstrap of the served token performs the same comparison per request and is the authoritative one (§4.1) |
+| **PRE-COMMIT FINGERPRINT** | `sha256(len(access) ‖ access ‖ len(refresh) ‖ refresh)` of each account's local material as read inside the barrier's fences | persisted with the mode write; consulted by `RESUME_TAKEOVER` | **crash reconciliation only.** Distinguishes crash-left pre-commit material (fingerprint matches → resume) from material that changed after the barrier read (differs → `NEW_LOCAL_FAMILY_UNDER_CLAUSTRUM`, §5), because content alone cannot tell the two apart and the in-process login record does not survive the restart that the crash case is. **It does not make the host write safe** (§12.1): OpenCode's `Auth.set` sits outside every lock we hold, and a re-read immediately before `client.auth.set` is still check-then-write |
+
+`credentialId` is **not** a startup comparand: `credential.get` returns `payload`, `expires_at_ms`,
+`record_version`, `project_id?`, `account_id?`, `email?`, `org_name?` and **no credential id**
+(`claustrum/crates/credentials-module/src/read_surface.rs:272-303`; the Rust source states
+`account_id` is neither the credential id nor the handle). `credentialId` is the join key for the
+quota feed and operator tooling only.
+
+### 4.1 Identity provenance (Anthropic-specific; a port must not copy it)
+
+On the vault side `account_id = account_id_for_adapter(adapter, token).or_else(stored identity)`
+(`read_surface.rs:849-858`), and the live parse derives only for `openai`. For Anthropic the vault's
+`account_id` is therefore the **operator-asserted** `ck auth set-identity` label, while our
+request-time bootstrap of the served token is **provider-asserted**. The startup IDENTITY check
+catches a swapped or mislabelled record; only the request-time check catches a label that is itself
+wrong. Both yield `MISMATCH`; the request-time one is authoritative. For OpenAI the precedence
+inverts (token claim wins; the vault's write sink refuses a contradicting label).
+
+Fingerprint covers both tokens, length-prefixed. Between the barrier's read and its commit, local
+refresh is inert (binding), OpenCode has no Anthropic refresh loop, Anthropic never rotates access
+without refresh, and a host login writes a whole new family; so refresh-only and both-tokens are
+equivalent in the true-positive direction. They differ on a torn `Auth.set` (new access, old
+refresh): both-tokens refuses, refresh-only tombstones an access token that is dead without its
+family. Same safety; both-tokens removes an assumption about the atomicity of a file we do not own.
+
+## 5. `mode = claustrum`
+
+Per account. `serve` is from the vault where it says `vault`; local material is **never** served in
+this mode. Local refresh is inert wherever a binding exists (`VALID` or `INVALID`), independent of
+vault reachability: a valid binding means the vault owns that family, and a cold daemon is not
+evidence to the contrary. A corrupt binding must not silently re-enable a local refresher on a
+vault-owned family.
+
+| # | binding | local | vault | verdict | serve | local refresh | durable writes | retry | operator |
+|---|---|---|---|---|---|---|---|---|---|
+| C1 | VALID | INERT | USABLE | `CUSTODY_SERVE` | vault | inert | none | — | none |
+| C2 | VALID | REAL, fingerprint **matches** | USABLE | fallback: `RESUME_TAKEOVER` · main: `TAKEOVER_INCOMPLETE_MAIN_REAL` (§13.1) | fallback: vault, after its commit · main: **no** | inert | fallback → drop refresh material under its lock · main → **none** | fallback: immediate · main: none | main: onboard into the vault with Claustrum's tooling |
+| C2′ | VALID | REAL, fingerprint **differs or absent** | any | `NEW_LOCAL_FAMILY_UNDER_CLAUSTRUM` (for main under §13.1 this is the *classification* of the `TAKEOVER_INCOMPLETE_MAIN_REAL` refusal: material the barrier did not read, versus C2's crash-left material it did) | **no** | inert | **none** | none | **unresolved** (§12.2): vault import with Claustrum's tooling, then re-enter, is consistent with every rule; "exit to `local` and the login stands" is not |
+| C3 | VALID | INERT | COLD | `CUSTODY_UNAVAILABLE` | **no** (typed provider-unavailable) | inert | none | bounded custody retry on vault availability | none |
+| C3′ | VALID | REAL | COLD | `TAKEOVER_INCOMPLETE_VAULT_UNAVAILABLE` | **no** | inert | **none**: no rollback, no drop. The destructive commit waits for `USABLE` (→ C2) because dropping material without proof the vault holds the family is destruction without evidence | on vault availability | none required; `local` + re-login only to abandon custody |
+| C4 | VALID | any | REAUTH | `CUSTODY_CREDENTIAL_LATCHED` | **no** | inert | none | **none**: retry cannot fix a latched record | re-import into the vault; resumes without a mode change |
+| C5 | VALID | any | USABLE ∧ IDENTITY mismatch | `CUSTODY_IDENTITY_MISMATCH` | **no** | inert | none | none | `set-identity` or re-bind; a different account may sit behind this handle |
+| C6 | ABSENT | REAL | N/A | `NOT_ENROLLED` | **no** | **no** (this mode has no local refreshers) | none | none | `ck auth bind` after import, or `local` |
+| C7 | ABSENT | INERT | N/A | `ORPHAN_TOMBSTONE` (main) / `ORPHAN_INERT` (fallback) | **no** | nothing to refresh | none | none | `bind`, or `local` + re-login |
+| C8 | INVALID | any | N/A | `CORRUPT_BINDING` | **no** | **inert** | **none**: never auto-repair a manifest entry | none | `ck auth bind --replace`, or `local` |
+| C9 | VALID | GONE (main) | USABLE · COLD · REAUTH | `TAKEOVER_INCOMPLETE_SLOT_ABSENT` | **no** | inert | **none** (plugin-side install into an absent slot is **withdrawn**, see below) | next boot | vault import restores the slot; or the host, once a fenced write exists |
+| C10 | VALID | GONE (fallback = `ROW_UNPARSEABLE`) | any | `CORRUPT_ROW` | **no** | inert | **none**; state secrets retained | next reconcile | repair the row, or remove + re-discover |
+
+At the loader, `evidence` means the main-slot vault evidence only. Fallback residency is route-local: a cold bound fallback is excluded for that request while other routes, including a resident main, continue to serve. Structural fallback dimensions (`R`/`M`) still produce `RESUME_TAKEOVER` or a binding-missing refusal independently of loader evidence.
+
+Invariants pinning the combinations not rowed:
+
+- `vault = N/A ⇔ binding ∈ {ABSENT, INVALID}`; a `VALID` binding always resolves to one of
+  `USABLE | COLD | REAUTH`. Test: every `VALID` fixture produces a connector call; no `ABSENT`/`INVALID`
+  fixture does.
+- `binding = ABSENT ∧ local = GONE` for main is not a custody state: with no binding there is nothing
+  to restore, so the slot stays as found and OpenCode's own not-logged-in applies (no install without
+  a binding: that would fabricate custody).
+- The recognise-set (§2.2) makes "partial tombstone write" a tombstone for every verdict; there is
+  no separate local-axis value for it.
+- **C9 no longer installs.** An earlier revision restored the tombstone into an absent slot so the
+  loader would run and a typed verdict could exist. That write is withdrawn: with no lock, no CAS, a
+  non-atomic host write, and the torn-read amplifier (§12.1), an install into an "absent" slot is
+  the highest-blast-radius write this plugin could issue (it can wipe every provider's credentials),
+  and its payoff was a typed verdict in place of the host's generic not-logged-in. The absent slot is
+  named in status and restored by vault import or by the host once a fenced write lands
+  (#46128). Two rules bind **any** host-slot write the plugin ever issues: (1) read
+  `client.auth.all()` first and, if it is EMPTY, abort the write, warn once, retry next tick, since an
+  empty map on a machine with any configured provider is a torn read until proven otherwise; (2)
+  treat a slot as absent only after two reads at least 250 ms apart, both `undefined`, both with a
+  NON-EMPTY `all()`. The install-on-`MISMATCH` divergence from the openai-auth port (§10) is moot
+  while no install exists.
+
+## 6. `mode = local`
+
+No vault call is made in this mode (test: zero connector invocations under `mode=local`). The
+`vault` axis is not consulted.
+
+| # | binding | local | verdict | serve | local refresh | durable writes | operator |
+|---|---|---|---|---|---|---|---|
+| L1 | ABSENT | REAL | `LOCAL_SERVE` | local | yes | none | none |
+| L2 | ABSENT | GONE | `DARK_PENDING_LOGIN` | no | no | none | `/login` |
+| L3 | ABSENT | INERT | `AWAITING_LOGIN` | no | nothing to refresh | none | `/login`. **Expected**: this is the post-`/claude-account local` state before re-login |
+| L4 | VALID | INERT · GONE | `AWAITING_LOGIN` with a lingering binding (exit ran; the clear did not land or was never reached) | no | inert (binding) | none | `/login`; the verified login clears the binding (§7) |
+| L5 | VALID | REAL | `DARK_PENDING_VERIFIED_LOGIN` | **no** | inert (binding) | none | `/login` through our own path |
+| L6 | INVALID | any | `CORRUPT_BINDING` | no | **no** | none | repair or remove the entry |
+
+**L5 is the row the verified-login ruling creates.** Real material alongside a live binding means
+material appeared without a login through our path: a restored backup, a hand-edit, a copied file.
+"Material exists" is satisfiable by a restore and so cannot be the clearing signal; the binding keeps
+refresh inert and the account stays dark until a real login clears it.
+
+## 7. The takeover barrier (`/claude-account claustrum`)
+
+An **all-accounts readiness barrier**, not an atomic commit: the writes span `auth.json`, the sidecar,
+and the manifest, and cannot be made kill-atomic. The barrier makes every crash-visible intermediate
+a state with a named verdict (§5) and a resume path.
+
+0. Acquire, in this fixed total order: config write lock → cross-tenant manifest lock → per-account
+   refresh locks (main, then fallbacks by sorted id). Hold all through step 4. Deadlock-free by total
+   order; the manifest lock's TTL/renewal covers the awaited host write.
+1. **Inside** the locks: capture each account's custody generation; re-read the manifest, the raw
+   account rows, and the raw auth slot; compute each account's PRE-COMMIT FINGERPRINT. Any preflight
+   computed before this point is advisory and discarded (stale by construction under concurrency).
+2. Classify every enabled OAuth account while fenced. Fallbacks: C1 or C2-eligible (VALID binding,
+   USABLE vault, IDENTITY not mismatched). Main: the same three conditions **plus** the slot already
+   holds the recognise-set (§13.1) — a REAL main is `TAKEOVER_INCOMPLETE_MAIN_REAL` here, not
+   eligible. Any other class → release, **zero writes**, typed refusal naming the first failing
+   account and its class.
+3. Persist `mode=claustrum` **and** the per-account fingerprints in one config write (config lock
+   held). This is the barrier's durable marker and the only global write. Mode-first: a tombstone
+   never coexists with `mode=local` during a normal commit, so observing that pair is evidence of
+   tampering rather than an expected intermediate, and it is what makes `RESUME_TAKEOVER` possible
+   at all (under mode-last every intermediate is indistinguishable from a hand-written tombstone).
+4. Idempotent per-account commits, fallbacks only. Fallback → drop local refresh material (no-op
+   if absent); fallback rows live under our own locks, so this half is fenced. Main → **no write**
+   (§13.1): the slot must already satisfy the recognise-set at step 2 or the barrier refused before
+   step 3. (A plugin-side `client.auth.set(WRITE set)` would not be fenced against the host,
+   §12.1; a fingerprint re-read immediately before it narrows the window without closing it.)
+5. Any failure after step 3: retain the mode, keep **all** local refresh inert (the binding alone
+   inerts it, mode-independent), release, surface. The next reconcile resumes **only** incomplete
+   accounts (C2), under their own locks; it never re-runs a transition for accounts already in C1.
+
+Against other processes: enable/disable and **our** login path take the config lock, so they
+serialise with steps 0–4; other tenants' manifest writes take the cross-tenant lock, so they
+serialise too; a generation bump observed at step 4 aborts **that** account's commit only, the others
+proceed, and resume covers it. The host's `Auth.set` serialises with nothing we hold (§12.1).
+
+Serving is per-account and independent of the barrier: main may serve from the vault while a
+fallback sits in C3, and the reverse. Nothing about serving account A depends on account B, so no
+aggregate state exists.
+
+## 8. Operation transitions
+
+| operation | mode | precondition | effect | fence |
+|---|---|---|---|---|
+| `/claude-account claustrum` | local | barrier §7 | mode + fingerprints, then per-account commits | §7 |
+| `/claude-account local` | claustrum | — | `mode=local` only. **No material writes, no manifest writes.** Bindings stay; every bound account becomes L4/L5 and stays dark until a verified login clears it. A transient inability to prove vault state never transfers refresh authority back to local; abandoning custody is this explicit command plus re-login | config lock |
+| local login (`Claude Pro/Max` authorize) | claustrum | — | **refused before the browser opens or anything is written**: `Exit Claustrum mode first: /claude-account local` | none needed |
+| verified login | local | login completed through **our** OAuth path (in-process record) **∧** real material observed via the live `getAuth` re-read | commit the new family, **then** clear that account's binding, both under config + manifest locks in one fence; bump the generation → L1 | config + manifest locks |
+| enable account | claustrum | binding VALID ∧ vault USABLE ∧ IDENTITY not mismatched (COLD is a typed refusal, not a wait) | `enabled=true` | config lock |
+| enable account | local | — | `enabled=true` | config lock |
+| disable | any | — | `enabled=false`; binding unchanged; vault material untouched | config lock |
+| remove account | claustrum | — | row removed; **its** binding removed under the manifest lock; vault material **retained** (`ck auth` owns vault removal; the plugin never writes the vault) | config + manifest locks |
+| add new OAuth account | claustrum | vault-side tooling created the credential **and** the binding in our provider block | reconcile **discovers** a VALID binding with no row → creates `{id: label, enabled: false, no refresh material, no identity}`, appended to the fallback order. INERT from birth: there is never a moment where a row exists, is enabled, and lacks a usable vault binding. **Discovery writes no identity**; the row binds `anthropicAccountUuid` from the first served token's bootstrap, never from the vault's operator-asserted label and never from a placeholder (a placeholder would `MISMATCH` the real claim forever) | config lock, manifest re-read inside it |
+| manifest change (other tenant) racing the barrier | — | — | serialised by the cross-tenant lock; if it lands between steps 1 and 4 → generation bump → that account's commit aborts → resume | manifest lock + generation |
+| enable/disable racing the barrier | — | — | serialised by the config lock | config lock |
+
+**Adding a new account today.** No verb on Claustrum master writes our provider block
+(`mint-handle` prints a handle; `migrate-opencode` writes an OpenCode-shaped entry even under
+`--serve-by anthropic-auth`; Claustrum's follow-up plugin tooling writes our block but takes a
+plugin-**exported** file, so it migrates accounts we already hold). Two paths:
+
+- direct, once it lands: `ck auth bind --serve anthropic-auth --label <label> --id <credential_id>`
+  (scoped on the Claustrum side): mint → verify the handle resolves → write `{label, handle,
+  credential_id}` under the cross-tenant lock → verify → **revoke the handle on any failure after
+  mint**. Refuses an existing label without `--replace`; refuses a credential id outside the tenant's
+  allowed prefix; never touches our account rows. Chosen over a plugin-side verb because a handle
+  must never sit at rest between two commands when one can mint-and-persist with revoke-on-failure.
+- interim (every step exists): `/claude-account local` → `/login` → vault import with
+  Claustrum's tooling → `/claude-account claustrum`.
+
+**Exit-edge dependency.** The verified-login clear requires the manifest writer (Slice 2,
+`feat/custody-manifest`), which lands before this transition. It is plugin-side in the same phase.
+
+**`OPENCODE_AUTH_CONTENT`.** `Auth.all()` short-circuits to that env payload when set, so the live
+`getAuth` re-read can never observe a re-login and the binding would never clear: the exact
+dark-account loop the exit edge exists to prevent. Reconciliation detects the variable and fails
+loudly rather than degrading into it.
+
+## 9. Verified facts this design rests on
+
+| fact | source |
+|---|---|
+| `auth.loader` runs only for a stored slot; decode failures are filtered before it | OpenCode `339536bc22`: `provider/provider.ts:1604-1619`, `auth/index.ts:14-21, 56-67` |
+| plugin factories run during first Provider-state construction, before the loader pass | `provider.ts:1396-1438, 1591-1622`, `plugin/index.ts:170-242` |
+| login does **not** re-invoke `auth.loader`; `Auth.set` writes `auth.json` and emits nothing | `provider/auth.ts:188-221`, `auth/index.ts:73-80` |
+| the `getAuth` handed to the loader is live: `get → all()` re-reads `auth.json` per call | `auth/index.ts:58-71` |
+| `access: ""` decodes; the loader runs; the request reaches our fetch | maintainer probe on 1.18.26; `Info` schema `access: Schema.String` |
+| Claustrum's deployed sealer aborts on empty access, accepts sentinel access | Claustrum, `digest()` run against all three shapes |
+| #28 reserved-prefix refusal covers the OpenCode import entrance, **not** the write sink (`put --replace` still accepts a tombstone) | Claustrum master `decab7f`; sink guard is a follow-up |
+| `credential.get` returns no credential id; `account_id` is neither credential id nor handle | `read_surface.rs:272-303` |
+| `account_id` for Anthropic is the stored `set-identity` label (live parse derives only for `openai`) | `read_surface.rs:849-858`, `oauth_login.rs:533` |
+| `record_version` advances on every `commit_refresh` | `store.rs:1931-1951`, `engine_tests.rs:418-427` |
+| no Claustrum master verb writes our provider block | Claustrum master `decab7f`: `opencode_migration.rs:232, 628` |
+
+## 10. Deliberate divergences from the openai-auth port
+
+Both plugins hold the same contract (write set, recognise/refuse split, fences, barrier shape,
+transition table). These differ on purpose and are stated so neither is read as an oversight:
+
+1. ~~Install on `MISMATCH` for a GONE main slot~~ — moot: both ports have withdrawn plugin-side
+   install into an absent slot (§5 invariants, §12.1). Converged.
+2. **Fallback artefact under custody**: we **drop** refresh material (`INERT` = absent); they write
+   tombstoned rows. One recognise rule covers both because it keys on the refresh sentinel only.
+   Do not "harmonise" by adding the sentinel to our fallback rows: that imports a masquerade risk
+   (a truthy sentinel in `access`) into a tree that currently cannot have it.
+3. **Identity provenance** (§4.1): operator-asserted at the vault for us, provider-asserted for them.
+
+## 11. Open items (external)
+
+- Maintainer approval of §5–§8 (gates implementation of the transition).
+- Claustrum: `ck auth bind` (§8); sink-level tombstone refusal (defence in depth, after the
+  manifest-lock PR). The instrument re-point is **done and self-actuating** (2026-09-05 05:55Z):
+  sealer and latch-watch read the tombstone predicate per tick, so nothing on that side is a
+  flip-time action.
+- **Operator runbook for this deployment (not a runtime dependency; §13.3):** (a) probe the
+  **installed** `ck-auth` binary for the typed tombstone refusal **with a real-material positive
+  control in the same run**, and assert zero audit-chain movement (an announcement is a trigger to
+  run the probe, not evidence); (b) send the exact flip time (UTC + epoch) to the Claustrum seat
+  **before** the write, and treat the handover as observed only when they return the `CUSTODY_MODE`
+  edge from the sealer log and the `EXCLUDE_NOW ''` edge from latch-watch with timestamps. This is
+  how this operator verifies the live flip; the command's own completion contract is §13.3.
+- Manifest-lock contract: case-folding aliasing of nonces on case-insensitive volumes (raised with
+  the contract owner, unruled).
+
+## 12. Unresolved questions (design, not implementation)
+
+These are open. The maintainer's ruling (2026-09-05) is that they need a source-backed answer before
+any code; this section records them so they are not lost in the handoff.
+
+### 12.1 The host-write race is not closed
+
+Everything the barrier fences is ours: config, sidecar, manifest, per-account refresh locks.
+`auth.json` is the host's, and OpenCode's `Auth.set` (the login callback,
+`provider/auth.ts:188-221` → `auth/index.ts:73-80`) takes no lock we can share. So for main:
+
+- a login can complete between the barrier's step 4 re-read and `client.auth.set`, and the fresh
+  family is **overwritten by the tombstone**. Re-reading a matching fingerprint immediately before
+  the write is still check-then-write; it shrinks the window to the width of one RPC, it does not
+  remove it.
+- restoring a tombstone into an absent slot (the former C9 install, now withdrawn) had the same race
+  in the other direction, plus the torn-read amplifier below: a login can land in the "absent" slot
+  between the factory's read and its write, and the read itself may have been torn.
+
+The fingerprint is therefore **crash reconciliation only** (§4).
+
+**Source of the race** (OpenCode `339536bc22`, `packages/opencode/src/auth/index.ts:73-89`):
+`Auth.set` is `all()` → spread → `writeJson`. No lock, no compare-and-set, no expected-value check,
+and the write itself is **not atomic**: `util/filesystem.ts:61-84` is an in-place `writeFile`, not
+temp-and-rename, so a concurrent reader can observe a partial file. No write event exists, and the
+loader is memoised init-once. There is nothing at the host to honour; the gap is tracked upstream as
+[anomalyco/opencode#46128](https://github.com/anomalyco/opencode/issues/46128) ("auth.json writes
+are unlocked whole-file rewrites", open). Consequences beyond our slot:
+
+- it rewrites the **whole file**, so two concurrent `set`s on *different* keys are last-writer-wins.
+  A tombstone write on `anthropic` can clobber a concurrent `openai` login and vice versa; any
+  plugin that writes its slot during another plugin's login loses one of them. This is a property
+  of the host's auth store, not of custody.
+- a fresh login that lands in the window is **lost** if the tombstone overwrites it (ordering B).
+  Whether that also kills the vault's family is **unverified for both providers**: coexisting
+  lineages have been observed only for two *refreshes* of one grant, and a fresh login mints a
+  *new grant*, a different operation; an earlier claim that OpenAI lineages survive a fresh login
+  was withdrawn by its author on that basis. If a fresh login invalidates the prior lineage,
+  ordering B leaves the account dark; if not, the cost is one re-login. The probe that settles it
+  (refresh `R_old` once, complete a fresh login, refresh `R_old'` again) carries the hazard it
+  measures on a vault-held account and is operator-gated. The fingerprint preserves the
+  single-refresher invariant in both orderings; only losslessness differs. Either way the
+  transition stays blocked (§13.1).
+- **the torn-read amplifier turns a lost race into a wiped store.** `Auth.all()` is
+  `readJson(file).pipe(Effect.orElseSucceed(() => ({})))` (`auth/index.ts:65`) over a non-atomic
+  writer, so a read racing another writer's in-place `writeFile` can parse a truncated file and
+  yield an **empty auth map**. Two consequences: (i) a single `client.auth.get(key) === undefined`
+  is not evidence the slot is absent, it may be a torn read; (ii) any `Auth.set` issued from that
+  state spreads `{}` and rewrites `auth.json` containing **only the writer's key**, destroying every
+  other provider's credentials. A plugin that installs into an "absent" slot during another
+  plugin's login can wipe the store, not merely lose the race.
+- **`OPENCODE_AUTH_CONTENT` is a deterministic clobber, not a race.** A child process started with
+  that variable (`workspace.ts:532-533`) reads auth from the env snapshot in preference to the file
+  (`auth/index.ts:59-61`), and every `Auth.set` it performs rewrites the file from that snapshot,
+  restoring pre-tombstone material for the child's whole lifetime. This is a **checkable
+  precondition** (scan `/proc/*/environ` for the variable before the transition), which is what §8's
+  "fail loudly" concretely means.
+
+**Mitigations that do not need a host primitive** (candidates; none closes the cross-process case):
+(1) a process-local mutex shared by the barrier and every plugin-owned login entry, the login
+holding it until a `client.auth.get` readback observes the host's write, which closes the
+same-process race because both sides are our code; (2) a post-write readback after each tombstone
+write, so ordering A is detected in the same run rather than on the next boot; (3) the cross-process
+residual (a login in another OpenCode window) **declared** in the transition's confirmation text,
+never hidden; (4) a **convergent write** for the main-slot install, proposed by the Claustrum seat on
+the #196 thread and buildable inside Claustrum's follow-up import tooling (verb pending: not in any
+deployed build as of 2026-09-07) where the imported bytes
+are already in hand: import first → write the tombstone → settle → re-read; a slot **byte-equal to
+the imported material** means a clobber by an env-snapshot child (rewrite, bounded retries), while
+**different real material** means a newer family landed (refuse loud, never overwrite). The residual
+is detected, bounded, and loud, which is the most a host without a fence can give. Whether that
+satisfies §13.1's "source-backed synchronisation" is the maintainer's call.
+
+**What closes it** is small and belongs in OpenCode: a per-key compare-and-set,
+`Auth.set(key, info, { expect })` rejecting when `current[key] ≠ expect`, or an advisory lock that
+`set`/`remove` take. Not filed; a change to a third-party repo is the operator's and maintainer's
+call.
+
+### 12.2 A raced login versus "bindings clear only after verified login"
+
+C2′ (`NEW_LOCAL_FAMILY_UNDER_CLAUSTRUM`) describes real material under custody that the barrier did
+not classify: most plausibly a login that raced the transition. An earlier draft offered "exit to
+`local`; the login stands" as one operator resolution. That contradicts §6/§8: the raced login did
+not complete through **our** path with an in-process record, so under `local` it is L5
+(`DARK_PENDING_VERIFIED_LOGIN`), not L1, and its binding does not clear. Either the verified-login
+rule admits some evidence other than our in-process record (and then what, and how is it
+distinguished from a restored backup, which is the case the rule exists for), or a raced login is
+never allowed to stand and the only resolution is a fresh vault import.
+
+**Resolution proposed (strictness), for the maintainer's ruling:** a login that landed outside the
+plugin's own path (raced, restored backup, another process) is **never** verified. It lands L5; its
+binding never auto-clears; the only exits are the plugin's own in-process verified login (new
+family, clears) or `ck auth`. The rule exists to reject restored backups, and a raced login is
+indistinguishable from one by content, so it gets the same treatment. The openai-auth port adopted
+this. One sub-question stays open: whether L5 **serves** its access token until expiry (no refresh,
+which still satisfies §13.2) or refuses as the table currently says; both are consistent with the
+rulings, and the difference is availability versus caution on a credential the vault may have
+rotated.
+
+### 12.3 Smaller
+
+- `OPENCODE_AUTH_CONTENT` (§8) makes the live `getAuth` re-read blind; "fail loudly" is stated, the
+  detection point is not.
+- The `enable` precondition under `claustrum` requires `USABLE`; whether a `REAUTH`-latched account
+  may be enabled-but-dark (so it resumes without a second operator action after re-import) is
+  unstated.
+
+### 12.4 A cold main handle at boot holds warm fallbacks
+
+`C|T|T|N` is a global verdict for a cold main handle at boot. It blocks a healthy, bound fallback even when the daemon is healthy and that fallback could serve. A latched main record is `C|T|T|V` with reauth status; today its route refuses that account rather than treating it as `N`. That describes current behavior, not a resolution of the cold-at-boot question.
+
+Two directions remain open:
+
+1. Keep the global refusal. The operator re-imports the main record before the next boot.
+2. Serve fallbacks only. The main route returns a typed refusal while healthy fallbacks remain route-local, matching §5's fallback residency rule.
+
+Unresolved for the cold-at-boot global-hold question. This document does not choose between these directions.
+## 13. Implementation constraints (binding, from the 06:04Z go-ahead)
+
+1. **The host-write race stays open and the unsafe transition stays BLOCKED.** The main-slot
+   write (`client.auth.set` of the tombstone, §7 step 4 main) is not fenced against OpenCode's
+   `Auth.set`, and plugin-side restoration into an absent slot is withdrawn outright (C9, §12.1).
+   **What the command does today, under the block:** the plugin issues **no** main-slot write at
+   all. Main's tombstone is written by the operator-driven vault import
+   (the settled ownership of main import, verb pending: Claustrum follow-up; not in any deployed build as of 2026-09-07), and the barrier
+   treats "main's slot already holds the recognise-set" as a **precondition**: at step 2, main
+   classifies C1 only if the slot is already INERT; a REAL main slot is a typed refusal
+   (`main is still local; onboard main into the vault with Claustrum's tooling first`) issued **before** step 3,
+   so no mode write and no fallback commit happens (the barrier is all-or-nothing readiness).
+   Consequently C2 (`RESUME_TAKEOVER`) applies to **fallbacks only**; a REAL main under
+   `mode=claustrum` is refused as `TAKEOVER_INCOMPLETE_MAIN_REAL` in both fingerprint cases (no
+   writes, inert), with the fingerprint still deciding the *classification* the refusal carries: a
+   match is crash-left pre-commit material (C2), a mismatch or absence is
+   `NEW_LOCAL_FAMILY_UNDER_CLAUSTRUM` (C2′). Same operator recovery; different diagnosis. When a source-backed synchronisation lands, the plugin-side write can be added
+   behind that same precondition without changing any verdict. The command does not describe the
+   fingerprint as a fix and does not weaken the invariant so a test passes. The fallback half of the
+   barrier (fenced by our own locks), the serving path, and every independent task proceed.
+   Regression coverage must **demonstrate the exact interleaving** (a host write
+   between our re-read and our write, for both the tombstone install and absent-slot restoration)
+   and assert that the transition is blocked; a passing fingerprint-only test is not proof of
+   safety and must not be presented as one.
+2. **Returning to `local` never makes a surviving binding's material refreshable by itself.** A
+   raced or restored local credential under a live binding stays inert until a login verified
+   through our own path clears the binding (L4/L5). No wording anywhere says a raced login "stands".
+3. **Production correctness is separate from local operational observation.** The Claustrum-seat
+   steps in §11 (sending a flip time, receiving sealer/latch-watch log edges) are an **operator
+   runbook** for this deployment, not a runtime dependency of the command and not part of its
+   completion contract. Completion is machine-checkable inside the plugin and, under §13.1,
+   contains no plugin write to main's slot: for **main**, the slot re-reads as the recognise-set
+   (the precondition, verified, not a write of ours); for each **fallback**, its local refresh
+   material re-reads as absent (our write); for every account, `credential.get` through the binding
+   succeeds, status reports `CUSTODY_SERVE`, and zero local refresh attempts are observed.
+
+Regression coverage required by the go-ahead: host-write interleaving (blocked, both directions),
+crash/resume, concurrent mode changes, verified-login binding clearance.
diff --git a/packages/core/bunfig.toml b/packages/core/bunfig.toml
new file mode 100644
index 00000000..1c8dc619
--- /dev/null
+++ b/packages/core/bunfig.toml
@@ -0,0 +1,2 @@
+[test]
+preload = ["./src/tests/setup.ts"]
diff --git a/packages/core/src/accounts.ts b/packages/core/src/accounts.ts
index e1f55fb0..d116042b 100644
--- a/packages/core/src/accounts.ts
+++ b/packages/core/src/accounts.ts
@@ -4,7 +4,13 @@ import { homedir } from 'node:os'
 import { dirname, join } from 'node:path'
 
 import { parseRetryAfterHeader, refreshClaudeOAuthToken } from './auth.ts'
-import { CustodyTombstoneRefreshError } from './claustrum.ts'
+import type { ProviderAccountUuid } from './claude-code.ts'
+import {
+  assertNotCustodyTombstone,
+  type CustodyHandleResolution,
+  CustodyTombstoneRefreshError,
+  custodyTombstoneKey,
+} from './claustrum.ts'
 import {
   CACHE_1H_MODES,
   type Cache1hMode,
@@ -16,6 +22,8 @@ import { type LogLevel, log, logger } from './logger.ts'
 import { isTransientNetworkError } from './network-errors.ts'
 import { tokenFingerprint } from './token-fingerprint.ts'
 
+export type { ProviderAccountUuid } from './claude-code.ts'
+
 const setRefreshLockRenewalTimeout = globalThis.setTimeout.bind(globalThis)
 const clearRefreshLockRenewalTimeout = globalThis.clearTimeout.bind(globalThis)
 
@@ -49,6 +57,10 @@ export type AccountBase = {
 export type OAuthAccount = AccountBase & {
   type: 'oauth'
   authLineageId?: string
+  // Persisted under this name on both fallback accounts and the main profile because the
+  // quota feed schema owns the anthropicAccountUuid key; only the branded type and the
+  // request-scoped identity variables use the provider-neutral providerAccountUuid name.
+  anthropicAccountUuid?: ProviderAccountUuid
   claustrumHandle?: string
   access?: string
   refresh: string
@@ -65,6 +77,16 @@ export type OAuthAccount = AccountBase & {
   prime?: PrimeUsageCounters
 }
 
+export function hasNoLocalCredential(account: {
+  access?: unknown
+  refresh?: unknown
+}): boolean {
+  return (
+    account.access == null &&
+    (account.refresh == null || account.refresh === '')
+  )
+}
+
 export type ApiKeyAccount = AccountBase & {
   type: 'api'
   apiKey?: string
@@ -78,7 +100,12 @@ export type ClaustrumAccountGate = {
   enabled?: boolean
 }
 
+export type ClaustrumMode = 'local' | 'claustrum'
+
 export type ClaustrumConfig = {
+  mode?: ClaustrumMode
+  handlesFile?: string
+  // Kept loadable so configurations remain safe to downgrade to older releases.
   accounts?: Record<string, ClaustrumAccountGate>
 }
 
@@ -170,6 +197,7 @@ export type OAuthAccountProfile = {
   checkedAt: number
   /** Stable account identity; tokenFingerprint remains loadable for legacy state. */
   accountIdentity?: string
+  providerAccountUuid?: ProviderAccountUuid
   tokenFingerprint?: string
 }
 
@@ -386,6 +414,7 @@ export type AccountStateSaveScope = {
   mainRefresh?: boolean
   mainPrime?: boolean
   accounts?: true | string[]
+  setClaustrumHandleAccountIds?: readonly string[]
 }
 
 type OAuthUsageWindow = {
@@ -543,7 +572,15 @@ function normalizeAccount(value: unknown): FallbackAccount | null {
   }
 
   if (value.type !== 'oauth') return null
-  if (typeof value.refresh !== 'string' || !value.refresh.trim()) return null
+  const refresh = typeof value.refresh === 'string' ? value.refresh : ''
+  const rosterOnly =
+    value.enabled === true &&
+    typeof value.id === 'string' &&
+    Boolean(value.id.trim()) &&
+    typeof value.label === 'string' &&
+    Boolean(value.label.trim()) &&
+    hasNoLocalCredential(value)
+  if (!refresh.trim() && !rosterOnly) return null
 
   return {
     ...normalizeAccountBase(value),
@@ -552,12 +589,17 @@ function normalizeAccount(value: unknown): FallbackAccount | null {
       typeof value.authLineageId === 'string' && value.authLineageId.trim()
         ? value.authLineageId
         : undefined,
+    anthropicAccountUuid:
+      typeof value.anthropicAccountUuid === 'string' &&
+      value.anthropicAccountUuid.trim()
+        ? (value.anthropicAccountUuid.trim() as ProviderAccountUuid)
+        : undefined,
     claustrumHandle:
       typeof value.claustrumHandle === 'string' && value.claustrumHandle.trim()
         ? value.claustrumHandle.trim()
         : undefined,
     access: typeof value.access === 'string' ? value.access : undefined,
-    refresh: value.refresh,
+    refresh,
     expires: typeof value.expires === 'number' ? value.expires : undefined,
     lastRefreshedAt:
       typeof value.lastRefreshedAt === 'number'
@@ -593,6 +635,11 @@ function normalizeOAuthAccountProfile(
       value.accountIdentity.trim() && {
         accountIdentity: value.accountIdentity.trim(),
       }),
+    ...(typeof value.providerAccountUuid === 'string' &&
+      value.providerAccountUuid.trim() && {
+        providerAccountUuid:
+          value.providerAccountUuid.trim() as ProviderAccountUuid,
+      }),
     ...(typeof value.tokenFingerprint === 'string' &&
       value.tokenFingerprint.trim() && {
         tokenFingerprint: value.tokenFingerprint.trim(),
@@ -894,23 +941,44 @@ function normalizeStorage(value: unknown): AccountStorage | null {
 }
 
 function normalizeClaustrumConfig(value: unknown): ClaustrumConfig | undefined {
-  if (!isRecord(value) || !isRecord(value.accounts)) return undefined
-  const accounts = Object.fromEntries(
-    Object.entries(value.accounts).flatMap(([id, entry]) => {
-      if (!isRecord(entry)) return []
-      return [
-        [
-          id,
-          {
-            ...(typeof entry.enabled === 'boolean' && {
-              enabled: entry.enabled,
-            }),
-          },
-        ],
-      ]
-    }),
-  )
-  return Object.keys(accounts).length > 0 ? { accounts } : undefined
+  if (!isRecord(value)) return undefined
+  const mode: ClaustrumMode | undefined =
+    value.mode === 'local' || value.mode === 'claustrum'
+      ? value.mode
+      : undefined
+  const handlesFile =
+    typeof value.handlesFile === 'string' && value.handlesFile.trim()
+      ? value.handlesFile.trim()
+      : undefined
+  const accounts = isRecord(value.accounts)
+    ? Object.fromEntries(
+        Object.entries(value.accounts).flatMap(([id, entry]) => {
+          if (!isRecord(entry)) return []
+          return [
+            [
+              id,
+              {
+                ...(typeof entry.enabled === 'boolean' && {
+                  enabled: entry.enabled,
+                }),
+              },
+            ],
+          ]
+        }),
+      )
+    : undefined
+  if (
+    !mode &&
+    !handlesFile &&
+    (!accounts || Object.keys(accounts).length === 0)
+  ) {
+    return undefined
+  }
+  return {
+    ...(mode && { mode }),
+    ...(handlesFile && { handlesFile }),
+    ...(accounts && Object.keys(accounts).length > 0 && { accounts }),
+  }
 }
 
 async function readJsonIfPresent(path: string): Promise<{
@@ -1197,6 +1265,7 @@ function accountRuntimeState(account: FallbackAccount) {
   }
   return objectWithDefinedEntries({
     authLineageId: account.authLineageId,
+    anthropicAccountUuid: account.anthropicAccountUuid,
     claustrumHandle: account.claustrumHandle,
     access: account.access,
     refresh: account.refresh,
@@ -1352,30 +1421,54 @@ export function mergeHeaderQuotaForPersistence(
 function mergeAccountRuntimeState(
   existing: unknown,
   incoming: AccountRuntimeEntry,
+  setClaustrumHandle = false,
 ): AccountRuntimeEntry {
   if (!isRecord(existing)) return incoming
+  const incomingForMerge = { ...incoming }
+  if (!setClaustrumHandle) delete incomingForMerge.claustrumHandle
   const existingEntry = existing as AccountRuntimeEntry
   const tokenChanged = Boolean(
     (existingEntry.access &&
-      incoming.access &&
-      existingEntry.access !== incoming.access) ||
+      incomingForMerge.access &&
+      existingEntry.access !== incomingForMerge.access) ||
       (existingEntry.refresh &&
-        incoming.refresh &&
-        existingEntry.refresh !== incoming.refresh),
+        incomingForMerge.refresh &&
+        existingEntry.refresh !== incomingForMerge.refresh),
   )
   const mergesHeaderQuota = Boolean(
-    !tokenChanged && incoming.quota?.source === 'headers',
+    !tokenChanged && incomingForMerge.quota?.source === 'headers',
   )
   const effectiveIncoming =
-    mergesHeaderQuota && incoming.quota
+    mergesHeaderQuota && incomingForMerge.quota
       ? {
-          ...incoming,
+          ...incomingForMerge,
           quota: mergeHeaderQuotaForPersistence(
             existingEntry.quota,
-            incoming.quota,
+            incomingForMerge.quota,
           ),
         }
-      : incoming
+      : incomingForMerge
+  if (
+    existingEntry.refresh === custodyTombstoneKey('anthropic') &&
+    ((typeof effectiveIncoming.access === 'string' &&
+      effectiveIncoming.access.length > 0) ||
+      (typeof effectiveIncoming.refresh === 'string' &&
+        effectiveIncoming.refresh !== custodyTombstoneKey('anthropic'))) &&
+    (!effectiveIncoming.authLineageId ||
+      effectiveIncoming.authLineageId === existingEntry.authLineageId)
+  ) {
+    logger.warn(
+      'accounts',
+      'discarded stale credential write over a custody tombstone',
+    )
+    const {
+      access: _access,
+      refresh: _refresh,
+      expires: _expires,
+      ...safe
+    } = effectiveIncoming
+    return mergeAccountRuntimeState(existingEntry, safe, setClaustrumHandle)
+  }
   const preferredRefreshError = (() => {
     const existingError = existingEntry.lastRefreshError
     const incomingError = effectiveIncoming.lastRefreshError
@@ -1507,11 +1600,104 @@ function configFromStorage(storage: AccountStorage): Record<string, unknown> {
   })
 }
 
-export function isClaustrumEnabledForAccount(
-  storage: AccountStorage,
-  accountId: string,
+export function getClaustrumMode(
+  storage: AccountStorage | null,
+): ClaustrumMode {
+  return storage?.claustrum?.mode === 'claustrum' ? 'claustrum' : 'local'
+}
+
+export function isOAuthAccountVaultOwned(
+  storage: AccountStorage | null,
+  account: FallbackAccount,
+  binding: CustodyHandleResolution | undefined,
 ): boolean {
-  return storage.claustrum?.accounts?.[accountId]?.enabled === true
+  return (
+    getClaustrumMode(storage) === 'claustrum' &&
+    isOAuthAccount(account) &&
+    account.enabled !== false &&
+    // Source is provenance, not authorization; the resolver owns the binding decision.
+    binding?.status === 'resolved'
+  )
+}
+
+export async function setClaustrumModePersistent(
+  mode: ClaustrumMode,
+  path = getAccountStoragePath(),
+): Promise<'changed' | 'unchanged'> {
+  return enqueueSave(async () => {
+    const lock = await acquireAccountConfigWriteLock(path)
+    try {
+      const existing = await loadAccounts(path)
+      const storage = existing ?? createEmptyStorage()
+      if (existing && getClaustrumMode(storage) === mode) return 'unchanged'
+      storage.claustrum = { ...storage.claustrum, mode }
+      await saveAccountsWithConfigLock(storage, path, {
+        [WRITE_CLAUSTRUM_MODE]: true,
+      })
+      return 'changed'
+    } finally {
+      await lock.release()
+    }
+  })
+}
+
+export async function clearClaustrumHandlePersistent(input: {
+  id: string
+  path?: string
+}): Promise<'updated' | 'missing' | 'ineligible'> {
+  const path = input.path ?? getAccountStoragePath()
+  return enqueueSave(async () => {
+    const configLock = await acquireAccountConfigWriteLock(path)
+    try {
+      const stateLock = await acquireAccountStateWriteLock(path)
+      try {
+        const storage = await loadAccounts(path)
+        if (!storage) return 'missing'
+        const statePath = getAccountStatePath(path)
+        const state = (await readJsonIfPresent(statePath)).value
+        const stateAccounts =
+          isRecord(state) && isRecord(state.accounts)
+            ? state.accounts
+            : undefined
+        const matchingStateKeys = Object.keys(stateAccounts ?? {}).filter(
+          (key) => key.trim() === input.id.trim(),
+        )
+        const account = storage.accounts.find(
+          (candidate) => candidate.id === input.id,
+        )
+        if (!account) {
+          if (matchingStateKeys.length === 0) return 'missing'
+          for (const key of matchingStateKeys) {
+            const stateAccount = stateAccounts?.[key]
+            if (isRecord(stateAccount)) delete stateAccount.claustrumHandle
+          }
+          await writeJsonAtomic(statePath, pruneUndefined(state))
+          return 'updated'
+        }
+        if (!isOAuthAccount(account)) return 'ineligible'
+        if (!account.claustrumHandle) return 'updated'
+
+        delete account.claustrumHandle
+        const existing = await loadExistingTopLevelFields(path)
+        await writeJsonAtomic(path, {
+          ...existing,
+          ...configFromStorage(storage),
+        })
+        if (matchingStateKeys.length > 0) {
+          for (const key of matchingStateKeys) {
+            const stateAccount = stateAccounts?.[key]
+            if (isRecord(stateAccount)) delete stateAccount.claustrumHandle
+          }
+          await writeJsonAtomic(statePath, pruneUndefined(state))
+        }
+        return 'updated'
+      } finally {
+        await stateLock.release()
+      }
+    } finally {
+      await configLock.release()
+    }
+  })
 }
 
 // ---------------------------------------------------------------------------
@@ -1545,11 +1731,18 @@ async function writeJsonAtomic(path: string, value: unknown) {
   }
 }
 
+const WRITE_CLAUSTRUM_MODE = Symbol('writeClaustrumMode')
+
 export interface SaveAccountsOptions {
   /** Account ids intentionally removed by this mutation. */
   removedAccountIds?: readonly string[]
   /** Preserve disk order when a stale snapshot is missing newer accounts. */
   preserveExistingAccountOrder?: boolean
+  setClaustrumHandleAccountIds?: readonly string[]
+}
+
+type InternalSaveAccountsOptions = SaveAccountsOptions & {
+  [WRITE_CLAUSTRUM_MODE]?: true
 }
 
 function sameAccountIdentity(
@@ -1684,39 +1877,64 @@ export async function getOrCreateMainAccountId(
 async function saveAccountsLocked(
   storage: AccountStorage,
   path: string,
-  options: SaveAccountsOptions,
+  options: InternalSaveAccountsOptions,
 ) {
   const lock = await acquireAccountConfigWriteLock(path)
   try {
-    const current = await loadAccounts(path)
-    const nextStorage: AccountStorage = {
-      ...storage,
-      accounts: mergeAccountsForSave(
-        current?.accounts ?? [],
-        storage.accounts,
-        options,
-      ),
-    }
-    const existing = await loadExistingTopLevelFields(path)
-    const nextConfig = { ...existing, ...configFromStorage(nextStorage) }
-    await writeJsonAtomic(path, nextConfig)
-    // Config precedes state everywhere both locks are needed; reversing this
-    // order can deadlock profile mutations against full account saves.
-    const stateLock = await acquireAccountStateWriteLock(path)
-    try {
-      await saveAccountStateUnlocked(nextStorage, path, {
-        mainQuota: true,
-        mainRefresh: true,
-        accounts: true,
-      })
-    } finally {
-      await stateLock.release()
-    }
+    await saveAccountsWithConfigLock(storage, path, options)
   } finally {
     await lock.release()
   }
 }
 
+async function saveAccountsWithConfigLock(
+  storage: AccountStorage,
+  path: string,
+  options: InternalSaveAccountsOptions,
+) {
+  const current = await loadAccounts(path)
+  const nextStorage: AccountStorage = {
+    ...storage,
+    ...(storage.claustrum && {
+      claustrum: {
+        ...current?.claustrum,
+        ...storage.claustrum,
+        ...(options[WRITE_CLAUSTRUM_MODE]
+          ? { mode: storage.claustrum.mode }
+          : current?.claustrum?.mode
+            ? { mode: current.claustrum.mode }
+            : {}),
+      },
+    }),
+    ...(!storage.claustrum &&
+      current?.claustrum && {
+        claustrum: current.claustrum,
+      }),
+    accounts: mergeAccountsForSave(
+      current?.accounts ?? [],
+      storage.accounts,
+      options,
+    ),
+  }
+  const existing = await loadExistingTopLevelFields(path)
+  const nextConfig = { ...existing, ...configFromStorage(nextStorage) }
+  if (!nextStorage.claustrum) delete nextConfig.claustrum
+  await writeJsonAtomic(path, nextConfig)
+  // Config precedes state everywhere both locks are needed; reversing this
+  // order can deadlock profile mutations against full account saves.
+  const stateLock = await acquireAccountStateWriteLock(path)
+  try {
+    await saveAccountStateUnlocked(nextStorage, path, {
+      mainQuota: true,
+      mainRefresh: true,
+      accounts: true,
+      setClaustrumHandleAccountIds: options.setClaustrumHandleAccountIds,
+    })
+  } finally {
+    await stateLock.release()
+  }
+}
+
 function applyMainProfileStatePatch(
   state: AccountRuntimeState,
   storage: AccountStorage,
@@ -2106,7 +2324,6 @@ export function clearClaustrumRefreshErrorPersistent(
           !storage ||
           !account ||
           account.claustrumHandle !== handle ||
-          !isClaustrumEnabledForAccount(storage, accountId) ||
           !account.lastRefreshError
         ) {
           return false
@@ -2150,6 +2367,9 @@ async function saveAccountStateUnlocked(
 
   if (scope.accounts) {
     const ids = scope.accounts === true ? null : new Set(scope.accounts)
+    const setClaustrumHandleAccountIds = new Set(
+      scope.setClaustrumHandleAccountIds ?? [],
+    )
     const config = (await readJsonIfPresent(path)).value
     const configuredIds = (() => {
       if (!isRecord(config) || !Array.isArray(config.accounts)) return null
@@ -2207,6 +2427,8 @@ async function saveAccountStateUnlocked(
       next.accounts[accountId] = mergeAccountRuntimeState(
         existingAccount,
         accountRuntimeState(account),
+        setClaustrumHandleAccountIds.has(account.id) ||
+          setClaustrumHandleAccountIds.has(accountId),
       )
     }
     if (configuredIds) {
@@ -3379,7 +3601,12 @@ export async function addAccountPersistent(
 ) {
   const storage = (await loadAccounts(path)) ?? createEmptyStorage()
   upsertAccount(storage, account)
-  await saveAccounts(storage, path)
+  await saveAccounts(storage, path, {
+    setClaustrumHandleAccountIds:
+      account.type === 'oauth' && account.claustrumHandle
+        ? [account.id]
+        : undefined,
+  })
 }
 
 export function getQuotaNextRefreshAt(
@@ -3642,6 +3869,7 @@ export async function fetchOAuthQuotaSnapshot(input: {
   fetchImpl?: typeof fetch
   now?: () => number
 }): Promise<OAuthQuotaSnapshot> {
+  assertNotCustodyTombstone(input.accessToken, 'anthropic')
   const fetchImpl = input.fetchImpl ?? fetch
   const response = await fetchImpl(QUOTA_URL, {
     method: 'GET',
@@ -3714,10 +3942,16 @@ export function upsertAccount(
       (account.label && candidate.label === account.label),
   )
   if (index >= 0) {
-    storage.accounts[index] = {
-      ...storage.accounts[index],
+    const existing = storage.accounts[index]
+    if (!existing) return
+    const lineageChanged =
+      existing.type === 'oauth' &&
+      account.type === 'oauth' &&
+      existing.authLineageId !== account.authLineageId
+    const updated: FallbackAccount = {
+      ...existing,
       ...account,
-      addedAt: storage.accounts[index]?.addedAt ?? account.addedAt,
+      addedAt: existing.addedAt ?? account.addedAt,
       ...(account.type === 'oauth' && {
         quota: account.quota,
         profile: account.profile,
@@ -3726,11 +3960,73 @@ export function upsertAccount(
         lastQuotaRefreshError: account.lastQuotaRefreshError,
       }),
     }
+    if (lineageChanged && updated.type === 'oauth') {
+      logger.debug(
+        'accounts',
+        'cleared provider UUID after auth lineage change',
+      )
+      delete updated.anthropicAccountUuid
+    }
+    storage.accounts[index] = updated
     return
   }
   storage.accounts.push(account)
 }
 
+export function persistFallbackQuotaHeaderPersistent(
+  input: {
+    accountId: string
+    authLineageId?: string
+    quota: OAuthQuotaSnapshot
+    anthropicAccountUuid?: ProviderAccountUuid
+  },
+  path = getAccountStoragePath(),
+): Promise<boolean> {
+  return enqueueSave(async () => {
+    const configLock = await acquireAccountConfigWriteLock(path)
+    try {
+      const stateLock = await acquireAccountStateWriteLock(path)
+      try {
+        const storage = await loadAccounts(path)
+        const account = storage?.accounts.find(
+          (candidate): candidate is OAuthAccount =>
+            candidate.id === input.accountId && isOAuthAccount(candidate),
+        )
+        if (
+          !storage ||
+          !account ||
+          account.authLineageId !== input.authLineageId
+        ) {
+          return false
+        }
+        account.quota = {
+          ...input.quota,
+          accountIdentity: account.id,
+        }
+        if (input.anthropicAccountUuid !== undefined) {
+          account.anthropicAccountUuid = input.anthropicAccountUuid
+        }
+        await saveAccountStateUnlocked(storage, path, {
+          accounts: [input.accountId],
+        })
+        return true
+      } finally {
+        await stateLock.release()
+      }
+    } finally {
+      await configLock.release()
+    }
+  })
+}
+
+export function fallbackAccountUuidForLineage(
+  account: OAuthAccount | undefined,
+  authLineageId?: string,
+): string | null {
+  if (!account || account.authLineageId !== authLineageId) return null
+  return account.anthropicAccountUuid ?? null
+}
+
 export function removeAccount(storage: AccountStorage, id: string): boolean {
   const index = storage.accounts.findIndex((c) => c.id === id)
   if (index < 0) return false
@@ -3811,6 +4107,7 @@ export class FallbackAccountManager {
   private readonly fetchImpl: typeof fetch
   private readonly configPath: string
   private readonly refreshPromises = new Map<string, Promise<OAuthAccount>>()
+  private readonly custodyVerificationAccounts = new Set<string>()
   private refreshTimer: ReturnType<typeof setInterval> | null = null
   private quotaTimer: ReturnType<typeof setInterval> | null = null
   readonly quotaManager: import('./quota-manager.ts').QuotaManager | null
@@ -3921,6 +4218,27 @@ export class FallbackAccountManager {
     this.quotaTimer = null
   }
 
+  async withAccountRefreshLock<T>(
+    accountId: string,
+    fn: () => Promise<T>,
+  ): Promise<T> {
+    const lock = await acquireRefreshFileLock({
+      name: fallbackRefreshLockName(accountId),
+      ttlMs: FALLBACK_REFRESH_LOCK_TTL_MS,
+      path: this.configPath,
+      now: this.now,
+      renew: true,
+    })
+    if (!lock) throw new Error('Fallback OAuth refresh is already in progress')
+    this.custodyVerificationAccounts.add(accountId)
+    try {
+      return await fn()
+    } finally {
+      this.custodyVerificationAccounts.delete(accountId)
+      await lock.release()
+    }
+  }
+
   async getUsableFallbackAccounts(
     existingStorage?: AccountStorage | null,
     options: { modelId?: string } = {},
@@ -3933,21 +4251,24 @@ export class FallbackAccountManager {
 
     for (const account of storage.accounts) {
       if (account.enabled === false || !isOAuthAccount(account)) continue
+      if (this.isFallbackAccountVaultEnabled(account.id, storage)) {
+        if (!this.isFallbackAccountVaultServed(account.id, storage)) continue
+        if (
+          hasNoLocalCredential(account) &&
+          !storage.quota?.minimumRemaining &&
+          !isKillswitchEnabled(storage)
+        ) {
+          usable.push(account)
+          continue
+        }
+      }
       let next = account
       try {
         if (
           tokenNeedsRefresh(next, storage, this.now()) &&
-          (!this.isFallbackAccountVaultEnabled(next.id, storage) ||
-            next.expires === undefined ||
-            next.expires <= this.now()) &&
+          !this.isFallbackAccountVaultEnabled(next.id, storage) &&
           !this.isFallbackAccountVaultServed(next.id, storage)
         ) {
-          if (this.isFallbackAccountVaultEnabled(next.id, storage)) {
-            logger.warn('refresh', 'custody override: local fallback refresh', {
-              accountId: next.id,
-              reason: 'vault credential unavailable',
-            })
-          }
           const refreshError = next.lastRefreshError
           if (
             refreshError &&
@@ -4078,6 +4399,16 @@ export class FallbackAccountManager {
     let changed = false
     for (const account of storage.accounts) {
       if (account.enabled === false || !isOAuthAccount(account)) continue
+      if (this.custodyVerificationAccounts.has(account.id)) {
+        logger.debug(
+          'refresh',
+          'fallback OAuth background skipped vault-service verification',
+          {
+            accountId: account.id,
+          },
+        )
+        continue
+      }
       if (
         !tokenNeedsRefresh(account, storage, this.now()) ||
         this.isFallbackAccountVaultEnabled(account.id, storage) ||
@@ -4128,6 +4459,7 @@ export class FallbackAccountManager {
     let changed = false
     for (const account of storage.accounts) {
       if (account.enabled === false || !isOAuthAccount(account)) continue
+      if (this.custodyVerificationAccounts.has(account.id)) continue
       let next = account
       try {
         if (
@@ -4235,7 +4567,11 @@ export class FallbackAccountManager {
     storage: AccountStorage,
     options: { force?: boolean; persistError?: boolean } = {},
   ): Promise<OAuthAccount> {
-    if (this.isFallbackAccountVaultServed(account.id, storage)) return account
+    if (
+      this.isFallbackAccountVaultServed(account.id, storage) ||
+      this.isFallbackAccountVaultEnabled(account.id, storage)
+    )
+      return account
     const existing = this.refreshPromises.get(account.id)
     if (existing) {
       const refreshed = await existing
@@ -4434,6 +4770,21 @@ export class FallbackAccountManager {
         changed,
       }
     }
+    let quotaPollLock = await acquireRefreshFileLock({
+      name: fallbackRefreshLockName(target.id),
+      ttlMs: FALLBACK_REFRESH_LOCK_TTL_MS,
+      path: this.configPath,
+      now: this.now,
+    })
+    if (!quotaPollLock) {
+      log('[quota] fallback quota poll skipped refresh lock', {
+        accountId: target.id,
+      })
+      return { account: target, fetched: false, changed }
+    }
+    await using _quotaPollLock = {
+      [Symbol.asyncDispose]: async () => quotaPollLock?.release(),
+    }
     // Unify on the shared QuotaManager when present: it adds inflight
     // deduplication and 429 backoff gating around the same quota API. Fall back
     // to a direct fetch only when no QuotaManager is wired (e.g. in isolation).
@@ -4464,6 +4815,8 @@ export class FallbackAccountManager {
       ) {
         throw error
       }
+      await quotaPollLock.release()
+      quotaPollLock = null
       target = await this.refreshAccount(account, storage, {
         force: true,
       })
@@ -4482,6 +4835,18 @@ export class FallbackAccountManager {
           changed,
         }
       }
+      quotaPollLock = await acquireRefreshFileLock({
+        name: fallbackRefreshLockName(target.id),
+        ttlMs: FALLBACK_REFRESH_LOCK_TTL_MS,
+        path: this.configPath,
+        now: this.now,
+      })
+      if (!quotaPollLock) {
+        log('[quota] fallback quota poll skipped refresh lock', {
+          accountId: target.id,
+        })
+        return { account: target, fetched: false, changed }
+      }
       // 401 does not arm QuotaManager backoff, so this retry proceeds.
       const result = await fetchSnapshot(access.token)
       target.quota = result.quota
diff --git a/packages/core/src/claude-code.ts b/packages/core/src/claude-code.ts
index ac093ebf..e002fc42 100644
--- a/packages/core/src/claude-code.ts
+++ b/packages/core/src/claude-code.ts
@@ -8,10 +8,14 @@ import {
   USER_AGENT,
 } from './constants.ts'
 
+export type ProviderAccountUuid = string & {
+  readonly __providerAccountUuid: unique symbol
+}
+
 export type ClaudeCodeIdentity = {
   deviceId: string
   accountIdentity?: string
-  accountUuid?: string
+  accountUuid?: ProviderAccountUuid
   sessionId: string
 }
 
@@ -59,10 +63,10 @@ export function getClaudeCodeIdentity(seed: string): ClaudeCodeIdentity {
 
 const BOOTSTRAP_IDENTITY_CACHE_TTL_MS = 24 * 60 * 60_000
 const BOOTSTRAP_IDENTITY_NEGATIVE_TTL_MS = 5 * 60_000
-const bootstrapFetches = new Map<string, Promise<string | null>>()
+const bootstrapFetches = new Map<string, Promise<ProviderAccountUuid | null>>()
 const bootstrapResults = new Map<
   string,
-  { accountUuid: string | null; expiresAt: number }
+  { accountUuid: ProviderAccountUuid | null; expiresAt: number }
 >()
 
 export function resetClaudeCodeIdentityCachesForTest() {
@@ -86,7 +90,7 @@ function accountCacheKey(accountUuid: string, accountIdentity: string) {
 function adoptCachedIdentity(
   cached: ClaudeCodeIdentity | undefined,
   accountIdentity: string,
-  accountUuid?: string,
+  accountUuid?: ProviderAccountUuid,
 ) {
   if (!cached) return undefined
   if (
@@ -118,7 +122,7 @@ function adoptCachedIdentity(
 function cacheAccountIdentity(
   identity: ClaudeCodeIdentity,
   accountIdentity: string,
-  accountUuid: string,
+  accountUuid: ProviderAccountUuid,
 ) {
   setBounded(identityCache, explicitCacheKey(accountIdentity), identity)
   setBounded(
@@ -128,7 +132,10 @@ function cacheAccountIdentity(
   )
 }
 
-async function fetchClaudeCodeAccountUuid(accessToken: string, model?: string) {
+async function fetchClaudeCodeAccountUuid(
+  accessToken: string,
+  model?: string,
+): Promise<ProviderAccountUuid | null> {
   if (!accessToken.startsWith('sk-ant-oat')) return null
   const controller = new AbortController()
   const timeout = setTimeout(() => controller.abort(), 5_000)
@@ -153,7 +160,9 @@ async function fetchClaudeCodeAccountUuid(accessToken: string, model?: string) {
       oauth_account?: { account_uuid?: unknown }
     } | null
     const accountUuid = data?.oauth_account?.account_uuid
-    return typeof accountUuid === 'string' && accountUuid ? accountUuid : null
+    return typeof accountUuid === 'string' && accountUuid
+      ? (accountUuid as ProviderAccountUuid)
+      : null
   } catch {
     return null
   } finally {
@@ -188,7 +197,9 @@ export async function resolveClaudeCodeIdentity(
     setBounded(identityCache, accessToken, identity)
   }
 
-  if (!accessToken.startsWith('sk-ant-oat')) return identity
+  if (!accessToken.startsWith('sk-ant-oat')) {
+    return clearCachedAccountUuid(cacheKey, identity)
+  }
 
   const now = Date.now()
   // A slot-stable identity survives account replacement; bootstrap is the
diff --git a/packages/core/src/claustrum.ts b/packages/core/src/claustrum.ts
index c464b41f..43877ba8 100644
--- a/packages/core/src/claustrum.ts
+++ b/packages/core/src/claustrum.ts
@@ -1,5 +1,8 @@
-import { readFile } from 'node:fs/promises'
-import { userInfo } from 'node:os'
+import { randomUUID } from 'node:crypto'
+import { type Dirent, constants as fsConstants } from 'node:fs'
+import * as fs from 'node:fs/promises'
+import { homedir, userInfo } from 'node:os'
+import { dirname, isAbsolute, join } from 'node:path'
 import {
   type BindIdentity,
   type CatalogEntry,
@@ -15,6 +18,10 @@ import {
   type SubscribeOptions,
   type Subscription,
 } from '@cortexkit/subc-client'
+
+import type { ClaustrumConfig, OAuthAccount } from './accounts.ts'
+import { CUSTODY_HANDLE_PATTERN } from './constants.ts'
+import { parseJsonRedacted } from './json'
 import { logger } from './logger'
 
 export type ClaustrumEndpoint = {
@@ -44,6 +51,27 @@ export function getDefaultClaustrumConnectionPath(): string {
   return `/run/user/${uid}/subc-connection.json`
 }
 
+type CustodyHandlesEnvironment = Readonly<Record<string, string | undefined>>
+
+export function resolveCustodyHandlesPath(
+  config: Pick<ClaustrumConfig, 'handlesFile'> | undefined,
+  env: CustodyHandlesEnvironment,
+): string {
+  const configuredPath = config?.handlesFile?.trim()
+  if (configuredPath) return configuredPath
+
+  const environmentPath = env.CLAUSTRUM_OPENCODE_HANDLES
+  if (environmentPath && isAbsolute(environmentPath)) return environmentPath
+
+  const configHome =
+    env.XDG_CONFIG_HOME?.trim() || join(env.HOME || homedir(), '.config')
+  return join(configHome, 'cortexkit', 'opencode-handles.json')
+}
+
+export function getDefaultClaustrumHandlesPath(): string {
+  return resolveCustodyHandlesPath(undefined, process.env)
+}
+
 function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === 'object' && value !== null && !Array.isArray(value)
 }
@@ -65,14 +93,14 @@ export async function detectClaustrumConnection(
 ): Promise<ClaustrumDetection> {
   let raw: string
   try {
-    raw = await readFile(path, 'utf8')
+    raw = await fs.readFile(path, 'utf8')
   } catch (error) {
-    const code = (error as NodeJS.ErrnoException).code
+    const code = errorCode(error)
     if (code === 'ENOENT') return { status: 'absent', path }
     return {
       status: 'malformed',
       path,
-      reason: `unreadable (${code ?? 'unknown'})`,
+      reason: `unreadable (${code})`,
     }
   }
 
@@ -122,6 +150,21 @@ export function custodyTombstoneKey(provider: string): string {
   return `${CUSTODY_TOMBSTONE_PREFIX}${provider}`
 }
 
+export function custodyTombstoneOAuth(provider: string): {
+  type: 'oauth'
+  access: ''
+  refresh: string
+  expires: 0
+} {
+  // An empty access value makes Claustrum's deployed sealer reject this loader marker.
+  return {
+    type: 'oauth',
+    access: '',
+    refresh: custodyTombstoneKey(provider),
+    expires: 0,
+  }
+}
+
 export function isCustodyTombstoneValue(value: unknown): value is string {
   return typeof value === 'string' && value.startsWith(CUSTODY_TOMBSTONE_PREFIX)
 }
@@ -131,8 +174,7 @@ export function isCustodyTombstoneOAuth(
   provider: string,
 ): boolean {
   if (!isRecord(auth) || auth.type !== 'oauth') return false
-  const key = custodyTombstoneKey(provider)
-  return auth.refresh === key && auth.access === key
+  return auth.refresh === custodyTombstoneKey(provider)
 }
 
 export class CustodyTombstoneRefreshError extends Error {
@@ -146,6 +188,15 @@ export class CustodyTombstoneRefreshError extends Error {
   }
 }
 
+export class CustodyTombstoneLoginError extends Error {
+  readonly code = 'custody_tombstone_login'
+
+  constructor(public readonly provider: string) {
+    super(`${provider} main slot is custodied; run /login to sign in locally`)
+    this.name = 'CustodyTombstoneLoginError'
+  }
+}
+
 export function assertNotCustodyTombstone(
   refreshToken: unknown,
   provider: string,
@@ -162,18 +213,49 @@ export type CustodyHandleAccount = {
 }
 
 export type CustodyHandleManifest = {
+  version: 1
+  provider: 'anthropic'
+  serve: 'anthropic-auth'
+  accounts: ReadonlyArray<CustodyHandleAccount>
+  superseded: ReadonlySet<string>
+  corruptLabels?: ReadonlySet<string>
+}
+
+export type CustodyHandleResolution =
+  | {
+      status: 'resolved'
+      source: 'manifest'
+      handle: string
+      credentialId: string
+    }
+  | { status: 'resolved'; source: 'legacy'; handle: string }
+  | {
+      status: 'unresolved'
+      reason:
+        | 'missing-label'
+        | 'invalid-label'
+        | 'duplicate-label'
+        | 'missing-entry'
+        | 'foreign-serve'
+        | 'superseded'
+        | 'corrupt-binding'
+        | 'unknown-identity'
+    }
+
+type ParsedCustodyHandleManifest = {
+  version: 1
   provider: string
   serve: string
-  shape: string
-  accounts: CustodyHandleAccount[]
+  accounts: ReadonlyArray<CustodyHandleAccount>
+  superseded: ReadonlySet<string>
+  corruptLabels: ReadonlySet<string>
 }
 
 const CUSTODY_ID_PATTERN = /^[a-z0-9][a-z0-9._-]{0,63}$/
-// The suffix is base64url for 256 CSPRNG bits; its charset is not fixture-derived.
-const CUSTODY_HANDLE_PATTERN = /^ckh_[A-Za-z0-9_-]{43}$/
 const RESERVED_CUSTODY_IDS = new Set(['__proto__', 'constructor', 'prototype'])
+const CUSTODY_CREDENTIAL_PREFIX = 'oauth:anthropic:'
 
-function isCustodyId(value: unknown): value is string {
+export function isValidCustodyLabel(value: unknown): value is string {
   return (
     typeof value === 'string' &&
     CUSTODY_ID_PATTERN.test(value) &&
@@ -185,49 +267,1030 @@ export function isValidCustodyHandle(value: unknown): value is string {
   return typeof value === 'string' && CUSTODY_HANDLE_PATTERN.test(value)
 }
 
+export function custodyCredentialId(label: string): string {
+  if (!isValidCustodyLabel(label))
+    throw new CustodyManifestSelectionError('invalid-label')
+  return `${CUSTODY_CREDENTIAL_PREFIX}${label}`
+}
+
+function isValidCustodyCredentialId(value: unknown): value is string {
+  return typeof value === 'string' && value.length > 0
+}
+
+function legacyOrUnresolved(
+  account: OAuthAccount,
+  reason: Extract<CustodyHandleResolution, { status: 'unresolved' }>['reason'],
+): CustodyHandleResolution {
+  if (account.claustrumHandle) {
+    return {
+      status: 'resolved',
+      source: 'legacy',
+      handle: account.claustrumHandle,
+    }
+  }
+  return { status: 'unresolved', reason }
+}
+
+/**
+ * | manifest state | legacy handle | result |
+ * | --- | --- | --- |
+ * | matching ready entry | any | manifest handle |
+ * | absent or invalid | present | legacy handle |
+ * | no matching ready entry | present | legacy handle |
+ * | foreign serve | any | unresolved |
+ * | superseded matching entry | any | unresolved |
+ */
+export function resolveCustodyHandle(input: {
+  account: OAuthAccount
+  manifest: CustodyHandleManifest | undefined
+  duplicateOAuthLabels?: ReadonlySet<string>
+}): CustodyHandleResolution {
+  const { account, manifest, duplicateOAuthLabels } = input
+  if (manifest && manifest.serve !== 'anthropic-auth') {
+    return { status: 'unresolved', reason: 'foreign-serve' }
+  }
+  if (!account.label) return legacyOrUnresolved(account, 'missing-label')
+  if (!isValidCustodyLabel(account.label)) {
+    return legacyOrUnresolved(account, 'invalid-label')
+  }
+  if (duplicateOAuthLabels?.has(account.label)) {
+    return legacyOrUnresolved(account, 'duplicate-label')
+  }
+  if (!manifest) return legacyOrUnresolved(account, 'missing-entry')
+  if (manifest.corruptLabels?.has(account.label)) {
+    return { status: 'unresolved', reason: 'corrupt-binding' }
+  }
+
+  const entry = manifest.accounts.find(
+    (candidate) =>
+      candidate.label === account.label &&
+      candidate.credentialId === custodyCredentialId(account.label),
+  )
+  if (!entry) return legacyOrUnresolved(account, 'missing-entry')
+  if (manifest.superseded.has(entry.handle)) {
+    return { status: 'unresolved', reason: 'superseded' }
+  }
+  return {
+    status: 'resolved',
+    source: 'manifest',
+    handle: entry.handle,
+    credentialId: entry.credentialId,
+  }
+}
+
 export function readCustodyHandles(
   json: unknown,
   provider: string,
-): CustodyHandleManifest {
-  if (!isCustodyId(provider)) {
-    throw new Error(`Invalid custody provider id ${provider}`)
+  serve: string,
+): ParsedCustodyHandleManifest {
+  if (!isValidCustodyLabel(provider)) {
+    throw new Error('invalid manifest provider')
   }
-  const providers =
-    isRecord(json) && Array.isArray(json.providers) ? json.providers : []
-  const source = providers.find(
+  if (
+    !isRecord(json) ||
+    !Object.hasOwn(json, 'version') ||
+    json.version !== 1
+  ) {
+    throw new Error('invalid manifest version')
+  }
+  if (!Object.hasOwn(json, 'providers') || !Array.isArray(json.providers)) {
+    throw new Error('missing manifest providers')
+  }
+  const providerEntries = json.providers.filter(
     (entry): entry is Record<string, unknown> =>
       isRecord(entry) &&
       Object.hasOwn(entry, 'provider') &&
       entry.provider === provider,
   )
-  if (!source || !Array.isArray(source.accounts)) {
-    throw new Error(`Missing custody handles for provider ${provider}`)
+  if (providerEntries.length === 0) {
+    throw new CustodyManifestSelectionError('missing-provider')
+  }
+  const source = providerEntries.find(
+    (entry) => Object.hasOwn(entry, 'serve') && entry.serve === serve,
+  )
+  if (!source) throw new CustodyManifestSelectionError('foreign-serve')
+  if (!Object.hasOwn(source, 'accounts') || !Array.isArray(source.accounts)) {
+    throw new Error('invalid manifest accounts')
+  }
+  const superseded = new Set<string>()
+  const corruptLabels = new Set<string>()
+  const accounts: CustodyHandleAccount[] = []
+  for (const entry of source.accounts) {
+    if (!isRecord(entry)) throw new Error('invalid account entry')
+    if (!Object.hasOwn(entry, 'label') || typeof entry.label !== 'string') {
+      throw new Error('invalid account label')
+    }
+    if (!isValidCustodyLabel(entry.label)) {
+      throw new Error('invalid account label')
+    }
+    if (
+      !Object.hasOwn(entry, 'handle') ||
+      !Object.hasOwn(entry, 'credential_id') ||
+      typeof entry.handle !== 'string' ||
+      !isValidCustodyHandle(entry.handle) ||
+      !isValidCustodyCredentialId(entry.credential_id) ||
+      (provider === 'anthropic' &&
+        entry.credential_id !== custodyCredentialId(entry.label))
+    ) {
+      corruptLabels.add(entry.label)
+      continue
+    }
+    if (Object.hasOwn(entry, 'superseded')) {
+      if (!Array.isArray(entry.superseded)) {
+        corruptLabels.add(entry.label)
+        continue
+      }
+      let malformed = false
+      for (const handle of entry.superseded) {
+        if (!isValidCustodyHandle(handle)) {
+          malformed = true
+          break
+        }
+      }
+      if (malformed) {
+        corruptLabels.add(entry.label)
+        continue
+      }
+      for (const handle of entry.superseded) superseded.add(handle)
+    }
+    accounts.push({
+      label: entry.label,
+      handle: entry.handle,
+      credentialId: entry.credential_id,
+    })
   }
   return {
-    provider: String(source.provider),
-    serve: String(source.serve),
-    shape: String(source.shape),
-    accounts: source.accounts.flatMap((entry) => {
-      if (!isRecord(entry)) return []
+    version: 1,
+    provider,
+    serve,
+    accounts,
+    superseded,
+    corruptLabels,
+  }
+}
+
+type CustodyHandleManifestReadResult =
+  | { status: 'ready'; manifest: CustodyHandleManifest }
+  | { status: 'absent' }
+  | { status: 'ignored'; reason: 'foreign-serve' | 'missing-provider' }
+  | { status: 'invalid'; reason: string }
+
+export const CUSTODY_MANIFEST_SELECTION_ERROR_CODES = [
+  'foreign-serve',
+  'invalid-label',
+  'missing-provider',
+] as const
+
+type CustodyManifestSelectionErrorCode =
+  (typeof CUSTODY_MANIFEST_SELECTION_ERROR_CODES)[number]
+
+export class CustodyManifestSelectionError extends Error {
+  constructor(readonly code: CustodyManifestSelectionErrorCode) {
+    super(code)
+  }
+}
+
+const MAX_CUSTODY_MANIFEST_BYTES = 256 * 1024
+
+function errorCode(error: unknown): string {
+  const code = (error as NodeJS.ErrnoException).code
+  return typeof code === 'string' ? code : 'unknown'
+}
+
+function validateManifestFile(
+  stats: Awaited<ReturnType<typeof fs.lstat>>,
+  expectedUid: number,
+): string | null {
+  const mode = Number(stats.mode)
+  if (stats.isSymbolicLink()) return 'manifest is a symlink'
+  if (!stats.isFile()) return 'manifest is not a regular file'
+  if ((mode & 0o777) !== 0o600) return 'manifest mode must be 0600'
+  if (stats.uid !== expectedUid) return 'manifest owner does not match'
+  return null
+}
+
+function validateManifestParent(
+  stats: Awaited<ReturnType<typeof fs.lstat>>,
+  expectedUid: number,
+): string | null {
+  const mode = Number(stats.mode)
+  if (stats.uid !== expectedUid) return 'manifest parent owner does not match'
+  if ((mode & 0o1000) !== 0) return null
+  if ((mode & 0o002) !== 0) {
+    return 'manifest parent is world-writable'
+  }
+  if ((mode & 0o020) !== 0) return 'manifest parent is group-writable'
+  return null
+}
+
+export class CustodyHandleManifestReader {
+  #cache:
+    | {
+        mtimeMs: number
+        size: number
+        result: Extract<
+          CustodyHandleManifestReadResult,
+          { status: 'ready' | 'ignored' }
+        >
+      }
+    | undefined
+
+  readonly #options: {
+    path: string
+    provider: 'anthropic'
+    serve: 'anthropic-auth'
+    expectedUid?: number
+  }
+
+  constructor(options: {
+    path: string
+    provider: 'anthropic'
+    serve: 'anthropic-auth'
+    expectedUid?: number
+  }) {
+    this.#options = options
+  }
+
+  async read(): Promise<CustodyHandleManifestReadResult> {
+    const expectedUid =
+      this.#options.expectedUid ?? process.getuid?.() ?? userInfo().uid
+    let pathStats: Awaited<ReturnType<typeof fs.lstat>>
+    try {
+      pathStats = await fs.lstat(this.#options.path)
+    } catch (error) {
+      if (errorCode(error) === 'ENOENT') return { status: 'absent' }
+      return { status: 'invalid', reason: `unreadable (${errorCode(error)})` }
+    }
+
+    const fileReason = validateManifestFile(pathStats, expectedUid)
+    if (fileReason) return { status: 'invalid', reason: fileReason }
+
+    try {
+      const parentReason = validateManifestParent(
+        await fs.lstat(dirname(this.#options.path)),
+        expectedUid,
+      )
+      if (parentReason) return { status: 'invalid', reason: parentReason }
+    } catch (error) {
+      return { status: 'invalid', reason: `unreadable (${errorCode(error)})` }
+    }
+
+    let handle: fs.FileHandle | undefined
+    try {
+      handle = await fs.open(
+        this.#options.path,
+        fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW,
+      )
+      // The validated descriptor, not the path, is the authority for content and metadata after open.
+      const openedStats = await handle.stat()
+      const openedFileReason = validateManifestFile(openedStats, expectedUid)
+      if (openedFileReason)
+        return { status: 'invalid', reason: openedFileReason }
+
       if (
-        !Object.hasOwn(entry, 'label') ||
-        !Object.hasOwn(entry, 'handle') ||
-        !Object.hasOwn(entry, 'credential_id') ||
-        typeof entry.label !== 'string' ||
-        typeof entry.handle !== 'string' ||
-        !isCustodyId(entry.label) ||
-        !isValidCustodyHandle(entry.handle) ||
-        typeof entry.credential_id !== 'string'
+        this.#cache?.mtimeMs === openedStats.mtimeMs &&
+        this.#cache.size === openedStats.size
+      ) {
+        return this.#cache.result
+      }
+
+      const bytes = new Uint8Array(MAX_CUSTODY_MANIFEST_BYTES + 1)
+      const { bytesRead } = await handle.read(bytes, 0, bytes.byteLength, 0)
+      if (bytesRead > MAX_CUSTODY_MANIFEST_BYTES) {
+        return { status: 'invalid', reason: 'manifest exceeds maximum size' }
+      }
+
+      let json: unknown
+      try {
+        json = parseJsonRedacted(
+          new TextDecoder().decode(bytes.subarray(0, bytesRead)),
+        )
+      } catch (error) {
+        return {
+          status: 'invalid',
+          reason: error instanceof Error ? error.message : 'invalid JSON',
+        }
+      }
+
+      let parsed: ParsedCustodyHandleManifest
+      try {
+        parsed = readCustodyHandles(
+          json,
+          this.#options.provider,
+          this.#options.serve,
+        )
+      } catch (error) {
+        if (error instanceof CustodyManifestSelectionError) {
+          if (error.code !== 'invalid-label') {
+            const result = { status: 'ignored', reason: error.code } as const
+            this.#cache = {
+              mtimeMs: openedStats.mtimeMs,
+              size: openedStats.size,
+              result,
+            }
+            return result
+          }
+        }
+        return {
+          status: 'invalid',
+          reason: error instanceof Error ? error.message : 'invalid manifest',
+        }
+      }
+
+      const manifest: CustodyHandleManifest = {
+        version: parsed.version,
+        provider: this.#options.provider,
+        serve: this.#options.serve,
+        accounts: parsed.accounts,
+        superseded: parsed.superseded,
+        corruptLabels: parsed.corruptLabels,
+      }
+      const result = { status: 'ready', manifest } as const
+      this.#cache = {
+        mtimeMs: openedStats.mtimeMs,
+        size: openedStats.size,
+        result,
+      }
+      return result
+    } catch (error) {
+      return { status: 'invalid', reason: `unreadable (${errorCode(error)})` }
+    } finally {
+      await handle?.close().catch(() => {})
+    }
+  }
+}
+
+export type CustodyHandleManifestWriteResult =
+  | { status: 'written' | 'unchanged' }
+  | {
+      status: 'refused'
+      reason: string
+      code?: CustodyManifestLockErrorCode
+    }
+
+export type CustodyHandleManifestRemovalResult =
+  | 'removed'
+  | 'missing'
+  | {
+      status: 'refused'
+      code?: CustodyManifestLockErrorCode
+    }
+
+export const CUSTODY_MANIFEST_LOCK_TTL_MS = 30_000
+export const CUSTODY_MANIFEST_LOCK_RENEW_MS = 10_000
+export const CUSTODY_MANIFEST_LOCK_RETRY_MIN_MS = 50
+export const CUSTODY_MANIFEST_LOCK_RETRY_MAX_MS = 150
+const CUSTODY_MANIFEST_STALE_LOCK_REAP_AGE_MS = 24 * 60 * 60 * 1000
+const CUSTODY_MANIFEST_STALE_LOCK_REAP_LIMIT = 32
+
+export type CustodyManifestLockTestOptions = Partial<{
+  ttlMs: number
+  retryMinMs: number
+  retryMaxMs: number
+  renewalIntervalMs: number
+  afterStaleOwnerRead: () => void | Promise<void>
+  beforeRename: () => void | Promise<void>
+}>
+
+let custodyManifestLockTestOptions: CustodyManifestLockTestOptions | undefined
+
+export function __setCustodyManifestLockTestOptions(
+  options?: CustodyManifestLockTestOptions,
+) {
+  custodyManifestLockTestOptions = options
+}
+
+export const CUSTODY_MANIFEST_LOCK_ERROR_CODES = [
+  'lock_busy',
+  'owner_invalid',
+  'renewal_failed',
+] as const
+
+export type CustodyManifestLockErrorCode =
+  (typeof CUSTODY_MANIFEST_LOCK_ERROR_CODES)[number]
+
+export class CustodyManifestLockError extends Error {
+  constructor(
+    message: string,
+    readonly code: CustodyManifestLockErrorCode,
+  ) {
+    super(message)
+  }
+}
+
+export class CustodyManifestLockBusyError extends CustodyManifestLockError {
+  constructor(message: string) {
+    super(message, 'lock_busy')
+  }
+}
+
+export class CustodyManifestLockOwnerInvalidError extends CustodyManifestLockError {
+  constructor(message: string) {
+    super(message, 'owner_invalid')
+  }
+}
+
+export class CustodyManifestLockLeaseLostError extends CustodyManifestLockError {
+  constructor(message: string) {
+    super(message, 'renewal_failed')
+  }
+}
+
+function isEvictableCustodyManifestLockNonce(nonce: string): boolean {
+  // An allowlist freezes lock compatibility across independently upgrading readers;
+  // reject only unsafe characters so a widened nonce cannot wedge an older reader.
+  for (const character of nonce) {
+    const code = character.charCodeAt(0)
+    if (code < 0x20 || code === 0x7f) return false
+  }
+  return (
+    nonce.length > 0 &&
+    nonce.length <= 128 &&
+    nonce !== '.' &&
+    nonce !== '..' &&
+    !/[\\/:*?"<>|]/.test(nonce) &&
+    !/[. ]$/.test(nonce)
+  )
+}
+
+async function reapStaleCustodyManifestLocks(lockPath: string): Promise<void> {
+  const parent = dirname(lockPath)
+  const prefix = `${lockPath.slice(lockPath.lastIndexOf('/') + 1)}.stale-`
+  let entries: Dirent[]
+  try {
+    entries = await fs.readdir(parent, { withFileTypes: true })
+  } catch (error) {
+    logger.debug('claustrum', 'stale manifest lock reaper failed', {
+      error: errorCode(error),
+    })
+    return
+  }
+  let reaped = 0
+  for (const entry of entries) {
+    if (reaped >= CUSTODY_MANIFEST_STALE_LOCK_REAP_LIMIT) return
+    if (!entry.isDirectory() || !entry.name.startsWith(prefix)) continue
+    const quarantinePath = join(parent, entry.name)
+    try {
+      const stat = await fs.lstat(quarantinePath)
+      if (
+        !stat.isDirectory() ||
+        Date.now() - stat.mtimeMs < CUSTODY_MANIFEST_STALE_LOCK_REAP_AGE_MS
+      ) {
+        continue
+      }
+      await fs.rm(quarantinePath, { recursive: true, force: true })
+      reaped += 1
+    } catch (error) {
+      logger.debug('claustrum', 'stale manifest lock reaper failed', {
+        error: errorCode(error),
+      })
+    }
+  }
+}
+
+export async function withCustodyManifestLock<T>(
+  path: string,
+  fn: (assertLease: () => Promise<void>, nonce: string) => Promise<T>,
+): Promise<T> {
+  const lockPath = `${path}.lock`
+  const now = Date.now
+  const ttlMs =
+    custodyManifestLockTestOptions?.ttlMs ?? CUSTODY_MANIFEST_LOCK_TTL_MS
+  const retryMinMs =
+    custodyManifestLockTestOptions?.retryMinMs ??
+    CUSTODY_MANIFEST_LOCK_RETRY_MIN_MS
+  const retryMaxMs =
+    custodyManifestLockTestOptions?.retryMaxMs ??
+    CUSTODY_MANIFEST_LOCK_RETRY_MAX_MS
+  const startedAt = now()
+  const nonce = randomUUID()
+  const ownerPath = join(lockPath, 'owner')
+
+  async function writeOwner(claimedAtMs: number) {
+    const temporaryOwnerPath = join(
+      lockPath,
+      `owner.${process.pid}.${randomUUID()}.tmp`,
+    )
+    let handle: fs.FileHandle | undefined
+    try {
+      handle = await fs.open(
+        temporaryOwnerPath,
+        fsConstants.O_CREAT | fsConstants.O_EXCL | fsConstants.O_WRONLY,
+        0o600,
       )
-        return []
-      return [
-        {
-          label: entry.label,
-          handle: entry.handle,
-          credentialId: entry.credential_id,
-        },
-      ]
-    }),
+      await handle.writeFile(
+        `${JSON.stringify({
+          tenant: 'anthropic-auth',
+          pid: process.pid,
+          claimed_at_ms: claimedAtMs,
+          nonce,
+        })}\n`,
+      )
+      await handle.sync()
+      await handle.close()
+      handle = undefined
+      await fs.rename(temporaryOwnerPath, ownerPath)
+    } finally {
+      await handle?.close().catch(() => {})
+      await fs.unlink(temporaryOwnerPath).catch(() => {})
+    }
+  }
+
+  async function claim() {
+    try {
+      await fs.mkdir(lockPath, { mode: 0o700 })
+    } catch (error) {
+      if (errorCode(error) !== 'EEXIST') throw error
+      return false
+    }
+    try {
+      await writeOwner(now())
+    } catch (error) {
+      await fs.rm(lockPath, { recursive: true, force: true }).catch(() => {})
+      throw error
+    }
+    return true
+  }
+
+  const deadline = startedAt + ttlMs
+  let claimed = false
+  while (!claimed) {
+    claimed = await claim()
+    if (claimed) break
+
+    let ownerClaimedAtMs: number | undefined
+    let ownerNonce: string | undefined
+    let ownerInvalid = false
+    try {
+      const owner = JSON.parse(await fs.readFile(ownerPath, 'utf8'))
+      if (
+        isRecord(owner) &&
+        typeof owner.claimed_at_ms === 'number' &&
+        Number.isFinite(owner.claimed_at_ms) &&
+        typeof owner.nonce === 'string' &&
+        isEvictableCustodyManifestLockNonce(owner.nonce)
+      ) {
+        ownerClaimedAtMs = owner.claimed_at_ms
+        ownerNonce = owner.nonce
+        await custodyManifestLockTestOptions?.afterStaleOwnerRead?.()
+      } else ownerInvalid = true
+    } catch (error) {
+      if (errorCode(error) !== 'ENOENT') ownerInvalid = true
+    }
+    if (
+      ownerClaimedAtMs !== undefined &&
+      ownerNonce !== undefined &&
+      now() - ownerClaimedAtMs >= ttlMs
+    ) {
+      const claimedPath = `${lockPath}.stale-${ownerClaimedAtMs}-${ownerNonce}`
+      try {
+        await fs.rename(lockPath, claimedPath)
+      } catch (error) {
+        if (!['ENOENT', 'EEXIST', 'ENOTEMPTY'].includes(errorCode(error)))
+          throw error
+      }
+      continue
+    }
+    if (now() >= deadline && ownerInvalid)
+      throw new CustodyManifestLockOwnerInvalidError(
+        'manifest lock owner invalid',
+      )
+    if (now() >= deadline)
+      throw new CustodyManifestLockBusyError('manifest lock busy')
+    const retryMs =
+      retryMinMs + Math.floor(Math.random() * (retryMaxMs - retryMinMs + 1))
+    await new Promise<void>((resolve) =>
+      setTimeout(resolve, Math.min(retryMs, Math.max(1, deadline - now()))),
+    )
+  }
+
+  let renewalFailed = false
+  let renewalInFlight: Promise<void> | undefined
+  async function ownsCurrentLease(): Promise<boolean> {
+    if (renewalFailed) return false
+    try {
+      const owner = JSON.parse(await fs.readFile(ownerPath, 'utf8'))
+      return (
+        isRecord(owner) &&
+        owner.pid === process.pid &&
+        owner.nonce === nonce &&
+        typeof owner.claimed_at_ms === 'number' &&
+        Number.isFinite(owner.claimed_at_ms) &&
+        now() - owner.claimed_at_ms < ttlMs
+      )
+    } catch {
+      return false
+    }
+  }
+  async function assertLease(): Promise<void> {
+    await renewalInFlight
+    if (!(await ownsCurrentLease()))
+      throw new CustodyManifestLockLeaseLostError(
+        'manifest lock renewal failed; write aborted',
+      )
+  }
+  const renewal = setInterval(
+    () => {
+      renewalInFlight = writeOwner(now()).catch(() => {
+        renewalFailed = true
+      })
+    },
+    custodyManifestLockTestOptions?.renewalIntervalMs ??
+      Math.min(CUSTODY_MANIFEST_LOCK_RENEW_MS, Math.floor(ttlMs / 3)),
+  )
+  if ('unref' in renewal) renewal.unref()
+  try {
+    return await fn(assertLease, nonce)
+  } finally {
+    clearInterval(renewal)
+    if (!(await ownsCurrentLease())) {
+      logger.warn('claustrum', 'manifest lock lease lost, not releasing', {
+        id: path,
+      })
+    } else {
+      await fs.rm(lockPath, { recursive: true, force: true }).catch(() => {})
+    }
+    await reapStaleCustodyManifestLocks(lockPath)
+  }
+}
+
+type CustodyHandleManifestWriteInput = {
+  path: string
+  entry: CustodyHandleAccount
+  expectedUid?: number
+}
+
+function refusal(
+  reason: string,
+  code?: CustodyManifestLockErrorCode,
+): Extract<CustodyHandleManifestWriteResult, { status: 'refused' }> {
+  return code === undefined
+    ? { status: 'refused', reason }
+    : { status: 'refused', reason, code }
+}
+
+function isOurManifestBlock(value: unknown): value is Record<string, unknown> {
+  return (
+    isRecord(value) &&
+    value.provider === 'anthropic' &&
+    value.serve === 'anthropic-auth'
+  )
+}
+
+export async function writeCustodyHandleManifestEntry(
+  input: CustodyHandleManifestWriteInput,
+): Promise<CustodyHandleManifestWriteResult> {
+  if (
+    !isValidCustodyLabel(input.entry.label) ||
+    !isValidCustodyHandle(input.entry.handle) ||
+    !isValidCustodyCredentialId(input.entry.credentialId) ||
+    input.entry.credentialId !== custodyCredentialId(input.entry.label)
+  ) {
+    return refusal('invalid entry')
+  }
+  try {
+    return await withCustodyManifestLock(input.path, (assertLease, nonce) =>
+      writeCustodyHandleManifestEntryLocked(input, assertLease, nonce),
+    )
+  } catch (error) {
+    if (error instanceof CustodyManifestLockBusyError) {
+      return refusal('manifest lock busy', error.code)
+    }
+    if (error instanceof CustodyManifestLockOwnerInvalidError) {
+      return refusal('manifest lock owner invalid', error.code)
+    }
+    if (error instanceof CustodyManifestLockLeaseLostError) {
+      return refusal('manifest lock renewal failed; write aborted', error.code)
+    }
+    return refusal(`unreadable (${errorCode(error)})`)
+  }
+}
+
+export async function removeCustodyHandleManifestEntry(
+  input: CustodyHandleManifestWriteInput,
+): Promise<CustodyHandleManifestRemovalResult> {
+  if (
+    !isValidCustodyLabel(input.entry.label) ||
+    !isValidCustodyHandle(input.entry.handle) ||
+    !isValidCustodyCredentialId(input.entry.credentialId) ||
+    input.entry.credentialId !== custodyCredentialId(input.entry.label)
+  ) {
+    return { status: 'refused' }
+  }
+  try {
+    const result = await withCustodyManifestLock(
+      input.path,
+      async (assertLease, nonce) => {
+        const expectedUid =
+          input.expectedUid ?? process.getuid?.() ?? userInfo().uid
+        const parent = dirname(input.path)
+        try {
+          const parentReason = validateManifestParent(
+            await fs.lstat(parent),
+            expectedUid,
+          )
+          if (parentReason) return 'refused'
+        } catch (error) {
+          return errorCode(error) === 'ENOENT' ? 'missing' : 'refused'
+        }
+
+        let document: Record<string, unknown>
+        let handle: fs.FileHandle | undefined
+        try {
+          const pathStats = await fs.lstat(input.path)
+          const pathReason = validateManifestFile(pathStats, expectedUid)
+          if (pathReason) return 'refused'
+          handle = await fs.open(
+            input.path,
+            fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW,
+          )
+          const openedReason = validateManifestFile(
+            await handle.stat(),
+            expectedUid,
+          )
+          if (openedReason) return 'refused'
+          const bytes = new Uint8Array(MAX_CUSTODY_MANIFEST_BYTES + 1)
+          const { bytesRead } = await handle.read(bytes, 0, bytes.byteLength, 0)
+          if (bytesRead > MAX_CUSTODY_MANIFEST_BYTES) return 'refused'
+          const parsed = parseJsonRedacted(
+            new TextDecoder().decode(bytes.subarray(0, bytesRead)),
+          )
+          if (
+            !isRecord(parsed) ||
+            parsed.version !== 1 ||
+            !Array.isArray(parsed.providers)
+          ) {
+            return 'refused'
+          }
+          document = parsed
+          if (parsed.providers.some(isOurManifestBlock)) {
+            try {
+              readCustodyHandles(parsed, 'anthropic', 'anthropic-auth')
+            } catch {
+              return 'refused'
+            }
+          }
+        } catch (error) {
+          if (errorCode(error) === 'ENOENT') return 'missing'
+          return 'refused'
+        } finally {
+          await handle?.close().catch(() => {})
+        }
+
+        const providers = document.providers
+        if (!Array.isArray(providers)) return 'refused'
+        const blockIndex = providers.findIndex(isOurManifestBlock)
+        if (blockIndex === -1) return 'missing'
+        const block = providers[blockIndex]
+        if (!isOurManifestBlock(block) || !Array.isArray(block.accounts)) {
+          return 'refused'
+        }
+        const matchesEntry = (account: unknown) =>
+          isRecord(account) &&
+          account.label === input.entry.label &&
+          account.handle === input.entry.handle &&
+          account.credential_id === input.entry.credentialId
+        const matchIndex = block.accounts.findIndex(matchesEntry)
+        if (matchIndex === -1) return 'missing'
+        const accounts = block.accounts.filter(
+          (account) => !matchesEntry(account),
+        )
+        const serialized = JSON.stringify(
+          {
+            ...document,
+            providers: providers.map((provider, index) =>
+              index === blockIndex ? { ...block, accounts } : provider,
+            ),
+          },
+          null,
+          2,
+        )
+        if (
+          new TextEncoder().encode(serialized).byteLength >
+          MAX_CUSTODY_MANIFEST_BYTES
+        ) {
+          return 'refused'
+        }
+
+        const temporaryPath = join(
+          `${input.path}.lock`,
+          `manifest.${nonce}.tmp`,
+        )
+        let temporaryHandle: fs.FileHandle | undefined
+        try {
+          temporaryHandle = await fs.open(
+            temporaryPath,
+            fsConstants.O_CREAT | fsConstants.O_EXCL | fsConstants.O_WRONLY,
+            0o600,
+          )
+          await temporaryHandle.writeFile(serialized)
+          await temporaryHandle.sync()
+          await temporaryHandle.close()
+          temporaryHandle = undefined
+          await assertLease()
+          await custodyManifestLockTestOptions?.beforeRename?.()
+          try {
+            await fs.rename(temporaryPath, input.path)
+          } catch (error) {
+            if (errorCode(error) === 'ENOENT')
+              throw new CustodyManifestLockLeaseLostError(
+                'manifest lock renewal failed; write aborted',
+              )
+            throw error
+          }
+          return 'removed'
+        } catch (error) {
+          if (error instanceof CustodyManifestLockLeaseLostError) throw error
+          return 'refused'
+        } finally {
+          await temporaryHandle?.close().catch(() => {})
+          await fs.unlink(temporaryPath).catch(() => {})
+        }
+      },
+    )
+    return result === 'refused' ? { status: 'refused' } : result
+  } catch (error) {
+    if (error instanceof CustodyManifestLockError) {
+      return { status: 'refused', code: error.code }
+    }
+    return { status: 'refused' }
+  }
+}
+
+export async function writeCustodyHandleManifestEntryLocked(
+  input: CustodyHandleManifestWriteInput,
+  assertLease: () => Promise<void>,
+  lockNonce: string,
+): Promise<CustodyHandleManifestWriteResult> {
+  const expectedUid = input.expectedUid ?? process.getuid?.() ?? userInfo().uid
+  const parent = dirname(input.path)
+  try {
+    const parentReason = validateManifestParent(
+      await fs.lstat(parent),
+      expectedUid,
+    )
+    if (parentReason) return refusal(parentReason)
+  } catch (error) {
+    return refusal(`unreadable (${errorCode(error)})`)
+  }
+
+  let document: Record<string, unknown>
+  let corruptLabels: ReadonlySet<string> = new Set<string>()
+  let handle: fs.FileHandle | undefined
+  try {
+    const pathStats = await fs.lstat(input.path)
+    const pathReason = validateManifestFile(pathStats, expectedUid)
+    if (pathReason) return refusal(pathReason)
+
+    handle = await fs.open(
+      input.path,
+      fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW,
+    )
+    const openedReason = validateManifestFile(await handle.stat(), expectedUid)
+    if (openedReason) return refusal(openedReason)
+
+    const bytes = new Uint8Array(MAX_CUSTODY_MANIFEST_BYTES + 1)
+    const { bytesRead } = await handle.read(bytes, 0, bytes.byteLength, 0)
+    if (bytesRead > MAX_CUSTODY_MANIFEST_BYTES)
+      return refusal('manifest exceeds maximum size')
+
+    const parsed = parseJsonRedacted(
+      new TextDecoder().decode(bytes.subarray(0, bytesRead)),
+    )
+    if (
+      !isRecord(parsed) ||
+      parsed.version !== 1 ||
+      !Array.isArray(parsed.providers)
+    ) {
+      return refusal('invalid manifest')
+    }
+    document = parsed
+
+    if (parsed.providers.some(isOurManifestBlock)) {
+      try {
+        corruptLabels = readCustodyHandles(
+          parsed,
+          'anthropic',
+          'anthropic-auth',
+        ).corruptLabels
+      } catch {
+        return refusal('invalid manifest')
+      }
+    }
+  } catch (error) {
+    if (errorCode(error) === 'ENOENT') {
+      document = { version: 1, providers: [] }
+    } else if (error instanceof SyntaxError) {
+      return refusal('invalid JSON')
+    } else {
+      return refusal(`unreadable (${errorCode(error)})`)
+    }
+  } finally {
+    await handle?.close().catch(() => {})
+  }
+
+  const providers = document.providers
+  if (!Array.isArray(providers)) return refusal('invalid manifest')
+  const blockIndex = providers.findIndex(isOurManifestBlock)
+  let nextProviders: unknown[]
+  if (blockIndex === -1) {
+    nextProviders = [
+      ...providers,
+      {
+        provider: 'anthropic',
+        serve: 'anthropic-auth',
+        accounts: [
+          {
+            label: input.entry.label,
+            handle: input.entry.handle,
+            credential_id: input.entry.credentialId,
+          },
+        ],
+      },
+    ]
+  } else {
+    const block = providers[blockIndex]
+    if (!isOurManifestBlock(block) || !Array.isArray(block.accounts))
+      return refusal('invalid manifest')
+    const matching = block.accounts.filter(
+      (account) => isRecord(account) && account.label === input.entry.label,
+    )
+    if (
+      matching.length === 1 &&
+      matching[0]?.handle === input.entry.handle &&
+      matching[0]?.credential_id === input.entry.credentialId &&
+      !corruptLabels.has(input.entry.label)
+    ) {
+      return { status: 'unchanged' }
+    }
+    const replacement = {
+      ...(corruptLabels.has(input.entry.label)
+        ? {}
+        : (matching.find(isRecord) ?? {})),
+      label: input.entry.label,
+      handle: input.entry.handle,
+      credential_id: input.entry.credentialId,
+    }
+    const accounts = block.accounts.flatMap((account) =>
+      isRecord(account) && account.label === input.entry.label ? [] : [account],
+    )
+    const firstMatch = block.accounts.findIndex(
+      (account) => isRecord(account) && account.label === input.entry.label,
+    )
+    accounts.splice(
+      firstMatch === -1 ? accounts.length : firstMatch,
+      0,
+      replacement,
+    )
+    nextProviders = providers.map((provider, index) =>
+      index === blockIndex ? { ...block, accounts } : provider,
+    )
+  }
+
+  const serialized = JSON.stringify(
+    { ...document, providers: nextProviders },
+    null,
+    2,
+  )
+  if (
+    new TextEncoder().encode(serialized).byteLength > MAX_CUSTODY_MANIFEST_BYTES
+  ) {
+    return refusal('manifest exceeds maximum size')
+  }
+
+  // Eviction renames the lock directory, so its temp follows the evicted owner
+  // into quarantine instead of remaining able to overwrite a successor's manifest.
+  // Quarantine reclaim deletes the evicted temp; it contains ids, never secrets.
+  const temporaryPath = join(`${input.path}.lock`, `manifest.${lockNonce}.tmp`)
+  let temporaryHandle: fs.FileHandle | undefined
+  try {
+    temporaryHandle = await fs.open(
+      temporaryPath,
+      fsConstants.O_CREAT | fsConstants.O_EXCL | fsConstants.O_WRONLY,
+      0o600,
+    )
+    await temporaryHandle.writeFile(serialized)
+    await temporaryHandle.sync()
+    await temporaryHandle.close()
+    temporaryHandle = undefined
+    await assertLease()
+    await custodyManifestLockTestOptions?.beforeRename?.()
+    try {
+      await fs.rename(temporaryPath, input.path)
+    } catch (error) {
+      if (errorCode(error) === 'ENOENT')
+        throw new CustodyManifestLockLeaseLostError(
+          'manifest lock renewal failed; write aborted',
+        )
+      throw error
+    }
+    return { status: 'written' }
+  } catch (error) {
+    if (error instanceof CustodyManifestLockLeaseLostError) throw error
+    return refusal(`unreadable (${errorCode(error)})`)
+  } finally {
+    await temporaryHandle?.close().catch(() => {})
+    await fs.unlink(temporaryPath).catch(() => {})
   }
 }
 
@@ -638,6 +1701,7 @@ export class ClaustrumCredentialCache {
   async get(
     handle: string,
     minTtlMs = this.#minTtlMs,
+    options: { cacheIf?: () => boolean } = {},
   ): Promise<ClaustrumCredential> {
     if (!Number.isSafeInteger(minTtlMs) || minTtlMs < 0) {
       throw new RangeError('minTtlMs must be a non-negative safe integer')
@@ -658,7 +1722,7 @@ export class ClaustrumCredentialCache {
     const pending = this.#inFlight.get(handle)
     if (pending) return pending
 
-    const load = this.#load(handle, minTtlMs)
+    const load = this.#load(handle, minTtlMs, options.cacheIf)
     this.#inFlight.set(handle, load)
     try {
       return await load
@@ -671,6 +1735,10 @@ export class ClaustrumCredentialCache {
     return this.#cache.get(handle)
   }
 
+  abandonPending(handle: string): void {
+    this.#inFlight.delete(handle)
+  }
+
   seedForTest(handle: string, credential: ClaustrumCredential): void {
     this.#cache.set(handle, credential)
   }
@@ -787,7 +1855,11 @@ export class ClaustrumCredentialCache {
       })
   }
 
-  async #load(handle: string, minTtlMs: number): Promise<ClaustrumCredential> {
+  async #load(
+    handle: string,
+    minTtlMs: number,
+    cacheIf?: () => boolean,
+  ): Promise<ClaustrumCredential> {
     let response: unknown
     try {
       response = await this.#client.call(
@@ -813,7 +1885,8 @@ export class ClaustrumCredentialCache {
     }
     if (
       credential.expiresAtMs !== null &&
-      credential.expiresAtMs > this.#now()
+      credential.expiresAtMs > this.#now() &&
+      (cacheIf?.() ?? true)
     ) {
       this.#cache.set(handle, credential)
     }
diff --git a/packages/core/src/commands/account.ts b/packages/core/src/commands/account.ts
index fd2c5623..15aa64cf 100644
--- a/packages/core/src/commands/account.ts
+++ b/packages/core/src/commands/account.ts
@@ -1,12 +1,20 @@
-import type { AccountStorage, FallbackAccount } from '../accounts.ts'
-import { isClaustrumEnabledForAccount } from '../accounts.ts'
-import type { ClaustrumDetection } from '../claustrum.ts'
+import type {
+  AccountStorage,
+  ClaustrumMode,
+  FallbackAccount,
+} from '../accounts.ts'
+import { getClaustrumMode, isOAuthAccountVaultOwned } from '../accounts.ts'
+import type {
+  ClaustrumDetection,
+  CustodyHandleResolution,
+} from '../claustrum.ts'
 import { formatOAuthAccountTier } from '../oauth-profile.ts'
 
 export const CLAUDE_ACCOUNT_COMMAND_NAME = 'claude-account'
 
 export type AccountCommandAction =
   | { type: 'status' }
+  | { type: 'claustrum-mode'; mode: ClaustrumMode }
   | { type: 'enable'; id: string }
   | { type: 'disable'; id: string }
   | { type: 'remove'; id: string }
@@ -24,6 +32,21 @@ export type AccountCommandAction =
   | { type: 'add-oauth-finish'; code: string; label?: string }
   | { type: 'usage' }
 
+export type AccountCommandResult = {
+  text: string
+  updated?: {
+    id: string
+    action: 'enable' | 'disable' | 'remove' | 'reorder' | 'reset-backoff'
+    enabled?: boolean
+    previousOrder?: string[]
+    newOrder?: string[]
+  }
+}
+
+export type ClaustrumModeTransition = (
+  mode: ClaustrumMode,
+) => Promise<AccountCommandResult>
+
 export function parseAccountCommandAction(
   argumentsText: string,
 ): AccountCommandAction {
@@ -39,7 +62,12 @@ export function parseAccountCommandAction(
   if (action === 'move-up' && rest) return { type: 'move-up', id: rest }
   if (action === 'move-down' && rest) return { type: 'move-down', id: rest }
   if (action === 'reset-backoff' && !rest) return { type: 'reset-backoff' }
-
+  if (action === 'claustrum' && !rest) {
+    return { type: 'claustrum-mode', mode: 'claustrum' }
+  }
+  if (action === 'local' && !rest) {
+    return { type: 'claustrum-mode', mode: 'local' }
+  }
   if (action === 'add-apikey' && rest) {
     let remaining = rest
     let baseURL: string | undefined
@@ -123,6 +151,51 @@ export interface AccountListItem {
   tierLabel?: string
 }
 
+export type CustodyStatusState =
+  | 'na'
+  | 'off'
+  | 'on-vault-served'
+  | 'on-vault-reauth'
+  | 'on-cold'
+  | 'unknown-identity'
+  | 'on-identity-mismatch'
+  | 'on-corrupt-binding'
+
+export function custodyStatusLabel(state: CustodyStatusState): string {
+  switch (state) {
+    case 'na':
+      return 'n/a (OpenCode-managed)'
+    case 'off':
+      return 'not enrolled'
+    case 'on-vault-served':
+      return 'vault-served'
+    case 'on-vault-reauth':
+      return 'vault reauth'
+    case 'on-cold':
+      return 'vault cold'
+    case 'unknown-identity':
+      return 'unknown identity'
+    case 'on-identity-mismatch':
+      return 'identity mismatch'
+    case 'on-corrupt-binding':
+      return 'corrupt binding'
+  }
+}
+
+export type AccountCommandStatusProjection = {
+  claustrumDetection: string
+  custodyMode?: 'local' | 'claustrum'
+  custodyModeKnown?: boolean
+  accounts: Array<
+    AccountListItem & {
+      claustrumGate: 'on' | 'off' | 'na'
+      vaultServed: boolean
+      vaultReauth: boolean
+      custodyState: CustodyStatusState
+    }
+  >
+}
+
 export function buildAccountList(storage: AccountStorage): AccountListItem[] {
   const list: AccountListItem[] = []
 
@@ -163,6 +236,8 @@ const USAGE_TEXT = [
   '  /claude-account enable <id>           Enable a fallback account',
   '  /claude-account disable <id>          Disable a fallback account',
   '  /claude-account remove <id>           Remove a fallback account',
+  '  /claude-account claustrum             Enable Claustrum mode',
+  '  /claude-account local                 Enable local mode',
   '  /claude-account move-up <id>          Move a fallback account up',
   '  /claude-account move-down <id>        Move a fallback account down',
   '  /claude-account reset-backoff          Clear main OAuth refresh and quota backoff',
@@ -171,38 +246,57 @@ const USAGE_TEXT = [
   '  /claude-account add-oauth-finish <code>  Complete OAuth flow',
 ].join('\n')
 
-export function executeAccountCommand(input: {
+export async function executeAccountCommand(input: {
   argumentsText: string
   storage: AccountStorage
   claustrum?: ClaustrumDetection
-}): {
-  text: string
-  updated?: {
-    id: string
-    action: 'enable' | 'disable' | 'remove' | 'reorder' | 'reset-backoff'
-    enabled?: boolean
-    previousOrder?: string[]
-    newOrder?: string[]
-  }
-} {
+  statusProjection?: AccountCommandStatusProjection
+  resolveCustodyBinding?: (account: FallbackAccount) => CustodyHandleResolution
+  path?: string
+  transition?: ClaustrumModeTransition
+}): Promise<AccountCommandResult> {
   const action = parseAccountCommandAction(input.argumentsText)
   const accounts = input.storage.accounts
   const mainId = 'main'
 
   if (action.type === 'status') {
-    const list = buildAccountList(input.storage)
-    const detection = input.claustrum?.status ?? 'unknown'
-    const lines = ['## Claude Accounts', '', `- Claustrum: ${detection}`, '']
+    const list =
+      input.statusProjection?.accounts ?? buildAccountList(input.storage)
+    const detection =
+      input.statusProjection?.claustrumDetection ??
+      input.claustrum?.status ??
+      'unknown'
+    const lines = [
+      '## Claude Accounts',
+      '',
+      `- Custody mode: ${getClaustrumMode(input.storage)}`,
+      `- Claustrum: ${detection}`,
+      '',
+    ]
     for (const a of list) {
       const pct =
         a.quotaPercent != null ? ` ${Math.round(a.quotaPercent)}%` : ''
       const status = !a.enabled ? ' (disabled)' : ''
       const tier = a.tierLabel ? ` · ${a.tierLabel}` : ''
-      const gate =
-        a.id === mainId
-          ? ' · gate n/a (OpenCode managed)'
-          : ` · gate ${isClaustrumEnabledForAccount(input.storage, a.id) ? 'on' : 'off'}`
-      lines.push(`- **${a.label}** [${a.role}]${tier}${status}${pct}${gate}`)
+      const projected = input.statusProjection?.accounts.find(
+        (account) => account.id === a.id,
+      )
+      const storedAccount = input.storage.accounts.find(
+        (account) => account.id === a.id,
+      )
+      const binding = storedAccount
+        ? input.resolveCustodyBinding?.(storedAccount)
+        : undefined
+      const custody = projected
+        ? custodyStatusLabel(projected.custodyState)
+        : a.id !== mainId &&
+            storedAccount &&
+            isOAuthAccountVaultOwned(input.storage, storedAccount, binding)
+          ? custodyStatusLabel('on-cold')
+          : 'local'
+      lines.push(
+        `- **${a.label}** [${a.role}]${tier}${status}${pct} · ${custody}`,
+      )
     }
     lines.push('', USAGE_TEXT)
     return { text: lines.join('\n') }
@@ -212,6 +306,13 @@ export function executeAccountCommand(input: {
     return { text: USAGE_TEXT }
   }
 
+  if (action.type === 'claustrum-mode') {
+    if (!input.transition) {
+      return { text: 'Claustrum mode transition is unavailable.' }
+    }
+    return input.transition(action.mode)
+  }
+
   if (action.type === 'add-apikey') {
     return { text: 'add-apikey' }
   }
diff --git a/packages/core/src/constants.ts b/packages/core/src/constants.ts
index be673154..0f4f67a0 100644
--- a/packages/core/src/constants.ts
+++ b/packages/core/src/constants.ts
@@ -9,6 +9,7 @@ export const CODE_CALLBACK_URL =
   'https://platform.claude.com/oauth/code/callback'
 
 export const TOKEN_URL = 'https://platform.claude.com/v1/oauth/token'
+export const CUSTODY_HANDLE_PATTERN = /^ckh_[A-Za-z0-9_-]{43}$/
 
 export const AXIOS_USER_AGENT = 'axios/1.15.2'
 
diff --git a/packages/core/src/logger.ts b/packages/core/src/logger.ts
index 51c2f98e..3b466a83 100644
--- a/packages/core/src/logger.ts
+++ b/packages/core/src/logger.ts
@@ -1,6 +1,7 @@
 import * as fs from 'node:fs'
 import * as os from 'node:os'
 import * as path from 'node:path'
+import { CUSTODY_HANDLE_PATTERN } from './constants.ts'
 
 // -- Level ----------------------------------------------------------------
 
@@ -91,7 +92,7 @@ function rotateLogFile(): void {
 // -- Redaction ------------------------------------------------------------
 
 export const SECRET_KEY_EXACT =
-  /^(authorization|x-api-key|cookie|set-cookie|refresh|access|token)$/i
+  /^(authorization|x-api-key|cookie|set-cookie|refresh|access|token|handle)$/i
 
 export function isSecretKey(key: string): boolean {
   if (SECRET_KEY_EXACT.test(key)) return true
@@ -106,6 +107,7 @@ const REDACT_VALUE_PATTERNS = [
   /Bearer\s+\S+/,
   /sk-[A-Za-z0-9-]+/,
   /eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/,
+  CUSTODY_HANDLE_PATTERN,
 ]
 
 function isRedactableValue(value: unknown): boolean {
diff --git a/packages/core/src/oauth-profile.ts b/packages/core/src/oauth-profile.ts
index abd38e00..f4496f96 100644
--- a/packages/core/src/oauth-profile.ts
+++ b/packages/core/src/oauth-profile.ts
@@ -1,4 +1,5 @@
-import type { OAuthAccountProfile } from './accounts.ts'
+import type { OAuthAccountProfile, ProviderAccountUuid } from './accounts.ts'
+import { assertNotCustodyTombstone } from './claustrum.ts'
 
 const PROFILE_URL = 'https://api.anthropic.com/api/oauth/profile'
 
@@ -7,10 +8,13 @@ export const PROFILE_TTL_MS = 7 * 24 * 60 * 60 * 1000
 export async function fetchOAuthAccountProfile(input: {
   accessToken: string
   accountIdentity?: string
+  providerAccountUuid?: ProviderAccountUuid
   fetchImpl?: typeof fetch
   now?: () => number
   signal?: AbortSignal
 }): Promise<OAuthAccountProfile> {
+  // The bearer value is guarded where it becomes a header, like every other builder.
+  assertNotCustodyTombstone(input.accessToken, 'anthropic')
   const response = await (input.fetchImpl ?? fetch)(PROFILE_URL, {
     method: 'GET',
     signal: input.signal,
@@ -46,6 +50,9 @@ export async function fetchOAuthAccountProfile(input: {
     ...(input.accountIdentity !== undefined && {
       accountIdentity: input.accountIdentity,
     }),
+    ...(input.providerAccountUuid !== undefined && {
+      providerAccountUuid: input.providerAccountUuid,
+    }),
   }
 }
 
diff --git a/packages/core/src/quota-header-feed.ts b/packages/core/src/quota-header-feed.ts
index 065f4085..594c41b8 100644
--- a/packages/core/src/quota-header-feed.ts
+++ b/packages/core/src/quota-header-feed.ts
@@ -1,11 +1,13 @@
 import { randomUUID } from 'node:crypto'
 import {
   chmod,
+  lstat,
   mkdir,
   readdir,
   readFile,
   rename,
   rm,
+  stat,
   writeFile,
 } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
@@ -28,6 +30,13 @@ import {
 export const QUOTA_HEADER_FEED_SCHEMA_VERSION = 3
 export const QUOTA_HEADER_FEED_LEASE_MS = 180_000
 
+/**
+ * Lease files are per process; each carries only the accounts whose response
+ * headers THAT process harvested. Consumers MUST union entries across all files
+ * inside `lease_horizon_ms`, deduplicating by account; "newest file wins" is wrong.
+ * `anthropic_account_uuid` is always present: null is unresolvable, while absence
+ * identifies an old producer. A fallback `account_ref` is store-local.
+ */
 export type QuotaHeaderFeedIdentity =
   | { identity_source: 'credential_id'; credential_id: string }
   | { identity_source: 'account_ref'; account_ref: string }
@@ -59,11 +68,14 @@ type QuotaHeaderFeedMetadata = {
 
 export type QuotaHeaderFeedEntry = QuotaHeaderFeedIdentity &
   QuotaHeaderFeedMetadata & {
+    /** Always present: null means UUID resolution failed; absence denotes an old producer. */
+    anthropic_account_uuid: string | null
     quota: QuotaHeaderFeedQuota
   }
 
 export type QuotaHeaderFeedPublishEntry = QuotaHeaderFeedIdentity &
   QuotaHeaderFeedMetadata & {
+    anthropic_account_uuid: string | null
     quota: Omit<QuotaHeaderFeedQuota, 'provenance'> & {
       fieldSources?: QuotaFieldSources
     }
@@ -72,6 +84,7 @@ export type QuotaHeaderFeedPublishEntry = QuotaHeaderFeedIdentity &
 
 type FeedRecord = {
   version: typeof QUOTA_HEADER_FEED_SCHEMA_VERSION
+  lease_horizon_ms: number
   entries: Record<string, QuotaHeaderFeedEntry>
 }
 
@@ -105,6 +118,12 @@ function validIdentity(
   )
     return false
   if (!entry.quota || typeof entry.quota !== 'object') return false
+  if (
+    !Object.hasOwn(entry, 'anthropic_account_uuid') ||
+    (entry.anthropic_account_uuid !== null &&
+      typeof entry.anthropic_account_uuid !== 'string')
+  )
+    return false
   if (entry.identity_source === 'none') {
     return !('credential_id' in entry) && !('account_ref' in entry)
   }
@@ -292,6 +311,8 @@ export class QuotaHeaderFeedRegistry {
       now?: () => number
       leaseMs?: number
       instanceId?: string
+      removeFile?: (path: string) => Promise<void>
+      beforeRemoveFile?: (path: string) => Promise<void>
     } = {},
   ) {
     const instanceId = options.instanceId ?? `${process.pid}-${randomUUID()}`
@@ -302,16 +323,33 @@ export class QuotaHeaderFeedRegistry {
   }
 
   publish(entry: QuotaHeaderFeedPublishEntry): Promise<void> {
-    const { accountKey, quota, ...entryWithoutQuota } = entry
-    const cleanEntry = {
-      ...entryWithoutQuota,
-      quota: projectQuota(quota),
-    } as QuotaHeaderFeedEntry
+    const { accountKey, quota } = entry
     try {
-      validatePublishEntry(cleanEntry)
+      validatePublishEntry(entry)
     } catch (error) {
       return Promise.reject(error)
     }
+    const identity =
+      entry.identity_source === 'credential_id'
+        ? {
+            identity_source: 'credential_id' as const,
+            credential_id: entry.credential_id,
+          }
+        : entry.identity_source === 'account_ref'
+          ? {
+              identity_source: 'account_ref' as const,
+              account_ref: entry.account_ref,
+            }
+          : { identity_source: 'none' as const }
+    const cleanEntry: QuotaHeaderFeedEntry = {
+      ...identity,
+      schema_version: entry.schema_version,
+      provider: entry.provider,
+      configured_account_count: entry.configured_account_count,
+      observed_at_ms: entry.observed_at_ms,
+      anthropic_account_uuid: entry.anthropic_account_uuid,
+      quota: projectQuota(quota),
+    }
     if (!accountKey)
       return Promise.reject(new Error('Invalid quota header feed account key'))
     this.writeChain = this.writeChain
@@ -321,6 +359,7 @@ export class QuotaHeaderFeedRegistry {
           this.options.directory ?? getDefaultQuotaHeaderFeedDirectory()
         await mkdir(directory, { recursive: true, mode: 0o700 })
         await chmod(directory, 0o700)
+        await this.reapStaleSiblingLeases(directory)
         let entries: Record<string, QuotaHeaderFeedEntry> = {}
         try {
           const record = JSON.parse(
@@ -338,7 +377,7 @@ export class QuotaHeaderFeedRegistry {
         try {
           await writeFile(
             tempPath,
-            `${JSON.stringify({ version: QUOTA_HEADER_FEED_SCHEMA_VERSION, entries })}\n`,
+            `${JSON.stringify({ version: QUOTA_HEADER_FEED_SCHEMA_VERSION, lease_horizon_ms: this.options.leaseMs ?? QUOTA_HEADER_FEED_LEASE_MS, entries })}\n`,
             { mode: 0o600 },
           )
           await chmod(tempPath, 0o600)
@@ -350,6 +389,36 @@ export class QuotaHeaderFeedRegistry {
     return this.writeChain
   }
 
+  private async reapStaleSiblingLeases(directory: string): Promise<void> {
+    const now = this.options.now?.() ?? Date.now()
+    const leaseMs = this.options.leaseMs ?? QUOTA_HEADER_FEED_LEASE_MS
+    let names: string[]
+    try {
+      names = await readdir(directory)
+    } catch {
+      return
+    }
+    await Promise.all(
+      names
+        .filter((name) => /^\d+-[0-9a-f-]+\.json$/i.test(name))
+        .map(async (name) => {
+          const path = join(directory, name)
+          if (path === this.filePath) return
+          try {
+            const file = await stat(path)
+            if (file.mtimeMs > now || now - file.mtimeMs < leaseMs) return
+            await this.options.beforeRemoveFile?.(path)
+            const current = await lstat(path)
+            if (current.ino !== file.ino || current.mtimeMs !== file.mtimeMs)
+              return
+            await (this.options.removeFile ?? ((target) => rm(target)))(path)
+          } catch {
+            // A missed cleanup must not prevent this process from refreshing its lease.
+          }
+        }),
+    )
+  }
+
   async list(): Promise<QuotaHeaderFeedEntry[]> {
     await this.writeChain.catch(() => {})
     const directory =
diff --git a/packages/core/src/quota-manager.ts b/packages/core/src/quota-manager.ts
index 3e2d76ed..3dc3107f 100644
--- a/packages/core/src/quota-manager.ts
+++ b/packages/core/src/quota-manager.ts
@@ -130,6 +130,8 @@ export class QuotaManager {
   // --- Inflight deduplication ---
   private inflightMain: Promise<QuotaRefreshResult> | null = null
   private inflightMainAccountId: string | undefined
+  private inflightMainAccessToken: string | undefined
+  private inflightMainToken = 0
   private inflightFallbacks = new Map<string, Promise<QuotaRefreshResult>>()
 
   // --- Rate-limiting (scoped per route so a fallback 429 never backs off the
@@ -208,14 +210,21 @@ export class QuotaManager {
     this.main = entry
   }
 
+  clearMain(): void {
+    this.mainAccountId = undefined
+    this.main = null
+  }
+
   /** Bind quota state to the account behind the current main credential. */
   setMainQuotaAccountIdentity(
     accountIdentity: string | undefined,
     strict = true,
+    force = false,
   ): number | undefined {
     const previousIdentityKnown = this.mainQuotaIdentityKnown
     const previousAccountIdentity = this.mainAccountId
     const changed =
+      force ||
       !previousIdentityKnown ||
       this.mainAccountId !== accountIdentity ||
       this.mainQuotaIdentityStrict !== strict
@@ -225,7 +234,15 @@ export class QuotaManager {
 
     this.mainGeneration += 1
     this.mainAccountId = accountIdentity
-    if (
+    if (force) {
+      this.main = null
+      this.mainLastApiError = undefined
+      this.mainQuotaErrorGeneration += 1
+      this.mainQuotaErrorClearedAt = mergeMainQuotaErrorClearedAt(
+        this.mainQuotaErrorClearedAt,
+        this.now(),
+      )
+    } else if (
       accountIdentity !== undefined &&
       this.main?.quota.accountIdentity !== accountIdentity
     ) {
@@ -361,7 +378,11 @@ export class QuotaManager {
       if (this.mainQuotaIdentityKnown) this.mainGeneration += 1
     }
 
-    if (this.inflightMain && this.inflightMainAccountId === effectiveAccountId)
+    if (
+      this.inflightMain &&
+      this.inflightMainAccountId === effectiveAccountId &&
+      this.inflightMainAccessToken === credential
+    )
       return this.inflightMain
 
     // Rate-limit — if API recently 429'd, return stale or throw
@@ -373,11 +394,14 @@ export class QuotaManager {
     }
 
     this.inflightMainAccountId = effectiveAccountId
+    this.inflightMainAccessToken = credential
     const generation = this.mainGeneration
+    const inflightToken = ++this.inflightMainToken
     this.inflightMain = this._fetchMain(
       effectiveAccountId,
       credential,
       generation,
+      inflightToken,
     )
     return this.inflightMain
   }
@@ -862,6 +886,7 @@ export class QuotaManager {
     mainAccountId: string | undefined,
     accessToken: string,
     generation: number,
+    inflightToken: number,
   ): Promise<QuotaRefreshResult> {
     return this._enqueueApiFetch(async () => {
       try {
@@ -969,7 +994,7 @@ export class QuotaManager {
           await fileLock.release()
         }
       } finally {
-        if (this.inflightMainAccountId === mainAccountId) {
+        if (this.inflightMainToken === inflightToken) {
           this.inflightMain = null
           this.inflightMainAccountId = undefined
         }
diff --git a/packages/core/src/tests/accounts-persistence.test.ts b/packages/core/src/tests/accounts-persistence.test.ts
new file mode 100644
index 00000000..06e83cb4
--- /dev/null
+++ b/packages/core/src/tests/accounts-persistence.test.ts
@@ -0,0 +1,210 @@
+import { afterEach, expect, test } from 'bun:test'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+import {
+  type AccountStorage,
+  createEmptyStorage,
+  FallbackAccountManager,
+  hasNoLocalCredential,
+  loadAccounts,
+  type OAuthAccount,
+  saveAccounts,
+} from '../accounts.ts'
+
+const directories: string[] = []
+
+afterEach(async () => {
+  await Promise.all(
+    directories
+      .splice(0)
+      .map((directory) => rm(directory, { recursive: true, force: true })),
+  )
+})
+
+test('recognizes an OAuth account with no local credential', () => {
+  expect(hasNoLocalCredential({})).toBe(true)
+  expect(hasNoLocalCredential({ refresh: '' })).toBe(true)
+  expect(hasNoLocalCredential({ refresh: 'refresh' })).toBe(false)
+  expect(hasNoLocalCredential({ access: '' })).toBe(false)
+})
+
+test('preserves the Claustrum mode when a save supplies only handlesFile', async () => {
+  const directory = await mkdtemp(join(tmpdir(), 'accounts-persistence-'))
+  directories.push(directory)
+  const path = join(directory, 'anthropic-auth.json')
+  const storage = createEmptyStorage()
+
+  await saveAccounts({ ...storage, claustrum: { mode: 'claustrum' } }, path)
+  await saveAccounts({ ...storage, claustrum: { handlesFile: '/x' } }, path)
+
+  await expect(loadAccounts(path)).resolves.toMatchObject({
+    claustrum: { mode: 'claustrum', handlesFile: '/x' },
+  })
+})
+
+test('saveAccounts cannot persist a Claustrum mode change', async () => {
+  const directory = await mkdtemp(join(tmpdir(), 'accounts-persistence-'))
+  directories.push(directory)
+  const path = join(directory, 'anthropic-auth.json')
+  const storage = createEmptyStorage()
+
+  await saveAccounts({ ...storage, claustrum: { mode: 'claustrum' } }, path)
+  await saveAccounts({ ...storage, claustrum: { mode: 'local' } }, path)
+
+  await expect(loadAccounts(path)).resolves.toMatchObject({
+    claustrum: { mode: 'claustrum' },
+  })
+})
+
+test('drops a persisted non-string Claustrum handlesFile', async () => {
+  const directory = await mkdtemp(join(tmpdir(), 'accounts-persistence-'))
+  directories.push(directory)
+  const path = join(directory, 'anthropic-auth.json')
+
+  await writeFile(
+    path,
+    JSON.stringify({
+      version: 1,
+      accounts: [],
+      claustrum: { handlesFile: 42 },
+    }),
+  )
+
+  await expect(loadAccounts(path)).resolves.not.toMatchObject({
+    claustrum: expect.anything(),
+  })
+})
+
+test('drops a persisted blank Claustrum handlesFile', async () => {
+  const directory = await mkdtemp(join(tmpdir(), 'accounts-persistence-'))
+  directories.push(directory)
+  const path = join(directory, 'anthropic-auth.json')
+
+  await writeFile(
+    path,
+    JSON.stringify({
+      version: 1,
+      accounts: [],
+      claustrum: { handlesFile: '   ' },
+    }),
+  )
+
+  await expect(loadAccounts(path)).resolves.not.toMatchObject({
+    claustrum: expect.anything(),
+  })
+})
+
+test('excludes an empty-material vault fallback after its quota policy fails', async () => {
+  const now = 1_000_000
+  const account: OAuthAccount = {
+    id: 'vault-fallback',
+    type: 'oauth',
+    enabled: true,
+    quota: {
+      checkedAt: 0,
+      five_hour: { usedPercent: 96, remainingPercent: 4, checkedAt: 0 },
+      seven_day: { usedPercent: 96, remainingPercent: 4, checkedAt: 0 },
+    },
+  }
+  const storage: AccountStorage = {
+    version: 1,
+    claustrum: { mode: 'claustrum' },
+    quota: {
+      enabled: true,
+      minimumRemaining: { five_hour: 10, seven_day: 10 },
+      failClosedOnUnknownQuota: true,
+    },
+    accounts: [account],
+  }
+  const authorizations: string[] = []
+  const manager = new FallbackAccountManager({
+    now: () => now,
+    isFallbackAccountVaultEnabled: () => true,
+    isFallbackAccountVaultServed: () => true,
+    resolveFallbackAccessToken: () => ({
+      token: 'vault-fallback-access',
+      source: 'vault',
+    }),
+    fetchImpl: async (_input, init) => {
+      authorizations.push(new Headers(init?.headers).get('authorization') ?? '')
+      return new Response(
+        JSON.stringify({
+          five_hour: { utilization: 96 },
+          seven_day: { utilization: 96 },
+        }),
+      )
+    },
+  })
+
+  await expect(manager.getUsableFallbackAccounts(storage)).resolves.toEqual([])
+  expect(authorizations).toEqual(['Bearer vault-fallback-access'])
+})
+
+test('keeps tombstone metadata when discarding a stale credential write', async () => {
+  const directory = await mkdtemp(join(tmpdir(), 'accounts-persistence-'))
+  directories.push(directory)
+  const path = join(directory, 'anthropic-auth.json')
+  const storedQuota = {
+    checkedAt: 200,
+    five_hour: { usedPercent: 20, remainingPercent: 80, checkedAt: 200 },
+    seven_day: { usedPercent: 20, remainingPercent: 80, checkedAt: 200 },
+  }
+  await saveAccounts(
+    {
+      version: 1,
+      accounts: [
+        {
+          id: 'work',
+          type: 'oauth',
+          access: '',
+          refresh: 'claustrum-tombstone:v1:anthropic',
+          expires: 0,
+          quota: storedQuota,
+        },
+      ],
+    },
+    path,
+  )
+
+  await saveAccounts(
+    {
+      version: 1,
+      accounts: [
+        {
+          id: 'work',
+          type: 'oauth',
+          access: 'stale-access',
+          refresh: 'stale-refresh',
+          expires: 100,
+          quota: {
+            checkedAt: 100,
+            five_hour: {
+              usedPercent: 90,
+              remainingPercent: 10,
+              checkedAt: 100,
+            },
+            seven_day: {
+              usedPercent: 90,
+              remainingPercent: 10,
+              checkedAt: 100,
+            },
+          },
+        },
+      ],
+    },
+    path,
+  )
+
+  await expect(loadAccounts(path)).resolves.toMatchObject({
+    accounts: [
+      {
+        id: 'work',
+        access: '',
+        refresh: 'claustrum-tombstone:v1:anthropic',
+        quota: storedQuota,
+      },
+    ],
+  })
+})
diff --git a/packages/core/src/tests/quota-manager.test.ts b/packages/core/src/tests/quota-manager.test.ts
new file mode 100644
index 00000000..0d406ffd
--- /dev/null
+++ b/packages/core/src/tests/quota-manager.test.ts
@@ -0,0 +1,52 @@
+import { expect, test } from 'bun:test'
+
+import { QuotaManager } from '../quota-manager.ts'
+
+function deferred<T = void>() {
+  let resolve!: (value: T | PromiseLike<T>) => void
+  const promise = new Promise<T>((nextResolve) => {
+    resolve = nextResolve
+  })
+  return { promise, resolve }
+}
+
+const quotaResponse = {
+  five_hour: { utilization: 4 },
+  seven_day: { utilization: 13 },
+  extra_usage: { is_enabled: false, monthly_limit: null, used_credits: null },
+  spend: null,
+}
+
+test('a completed older main request does not clear a newer in-flight refresh', async () => {
+  const firstStarted = deferred()
+  const releaseFirst = deferred()
+  const secondStarted = deferred()
+  const releaseSecond = deferred()
+  let fetches = 0
+  const manager = new QuotaManager({
+    storage: null,
+    fetchImpl: (async () => {
+      fetches += 1
+      if (fetches === 1) {
+        firstStarted.resolve()
+        await releaseFirst.promise
+      } else if (fetches === 2) {
+        secondStarted.resolve()
+        await releaseSecond.promise
+      }
+      return Response.json(quotaResponse)
+    }) as typeof fetch,
+  })
+
+  const first = manager.refreshMainWithMetadata('main', 'token-a')
+  await firstStarted.promise
+  const second = manager.refreshMainWithMetadata('main', 'token-b')
+  releaseFirst.resolve()
+  await secondStarted.promise
+  const joinedSecond = manager.refreshMainWithMetadata('main', 'token-b')
+  releaseSecond.resolve()
+
+  await Promise.all([first, second, joinedSecond])
+
+  expect(fetches).toBe(2)
+})
diff --git a/packages/core/src/tests/setup.ts b/packages/core/src/tests/setup.ts
new file mode 100644
index 00000000..614b229a
--- /dev/null
+++ b/packages/core/src/tests/setup.ts
@@ -0,0 +1,30 @@
+import { afterEach, beforeEach } from 'bun:test'
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+let testDir: string | undefined
+
+beforeEach(async () => {
+  testDir = await mkdtemp(join(tmpdir(), 'anthropic-auth-core-test-'))
+  process.env.OPENCODE_ANTHROPIC_AUTH_FILE = join(
+    testDir,
+    'anthropic-auth.json',
+  )
+  // The state file is left to derive beside whichever config path a test uses: an explicit
+  // STATE_FILE overrides that derivation for every caller, which would redirect tests that
+  // pass their own storage path (and their spawned worker processes) to a shared file.
+  process.env.OPENCODE_ANTHROPIC_AUTH_QUOTA_FEED_DIR = join(
+    testDir,
+    'quota-header-feed',
+  )
+  process.env.OPENCODE_ANTHROPIC_AUTH_LOG_FILE = join(testDir, 'auth.log')
+})
+
+afterEach(async () => {
+  if (testDir) await rm(testDir, { recursive: true, force: true })
+  testDir = undefined
+  delete process.env.OPENCODE_ANTHROPIC_AUTH_FILE
+  delete process.env.OPENCODE_ANTHROPIC_AUTH_QUOTA_FEED_DIR
+  delete process.env.OPENCODE_ANTHROPIC_AUTH_LOG_FILE
+})
diff --git a/packages/e2e-tests/src/harness.ts b/packages/e2e-tests/src/harness.ts
index a5407fb9..7919504c 100644
--- a/packages/e2e-tests/src/harness.ts
+++ b/packages/e2e-tests/src/harness.ts
@@ -1,7 +1,11 @@
 import { join } from 'node:path'
 import { MockAnthropicServer, type MockResponse } from './mock-anthropic.ts'
 import { MockRelayServer } from './mock-relay.ts'
-import { type SpawnedOpencode, spawnOpencode } from './opencode-runner.ts'
+import {
+  type IsolatedEnv,
+  type SpawnedOpencode,
+  spawnOpencode,
+} from './opencode-runner.ts'
 
 type SdkClient = {
   session: {
@@ -30,6 +34,8 @@ export type E2EHarnessOptions = {
   hybridCache?: boolean
   fallbackMode?: 'server' | 'legacy'
   childTmpDir?: string
+  childEnv?: Record<string, string | undefined>
+  beforeSpawn?: (env: IsolatedEnv) => void | Promise<void>
 }
 
 export class E2EHarness {
@@ -77,6 +83,8 @@ export class E2EHarness {
       fallbackMode: options.fallbackMode,
       childTmpDir: options.childTmpDir,
       quotaFeed: options.quotaFeed,
+      childEnv: options.childEnv,
+      beforeSpawn: options.beforeSpawn,
     })
     const sdk = await import('@opencode-ai/sdk')
     const client = sdk.createOpencodeClient({
diff --git a/packages/e2e-tests/src/mock-anthropic.ts b/packages/e2e-tests/src/mock-anthropic.ts
index b9c89fa7..80219a00 100644
--- a/packages/e2e-tests/src/mock-anthropic.ts
+++ b/packages/e2e-tests/src/mock-anthropic.ts
@@ -73,6 +73,7 @@ export class MockAnthropicServer {
   private server: ReturnType<typeof Bun.serve> | null = null
   private queue: MockResponse[] = []
   private captured: CapturedAnthropicRequest[] = []
+  private tokenRequestCount = 0
 
   async start() {
     this.server = Bun.serve({
@@ -97,8 +98,22 @@ export class MockAnthropicServer {
     return [...this.captured]
   }
 
+  tokenRequests() {
+    return this.tokenRequestCount
+  }
+
   private async handle(request: Request) {
     const url = new URL(request.url)
+    if (url.pathname === '/oauth/token') {
+      this.tokenRequestCount += 1
+      return new Response(
+        JSON.stringify({ error: 'unexpected_token_refresh' }),
+        {
+          status: 500,
+          headers: { 'content-type': 'application/json' },
+        },
+      )
+    }
     if (
       request.method !== 'POST' ||
       (url.pathname !== '/v1/messages' && url.pathname !== '/messages')
diff --git a/packages/e2e-tests/src/mock-claustrum.ts b/packages/e2e-tests/src/mock-claustrum.ts
new file mode 100644
index 00000000..ce960778
--- /dev/null
+++ b/packages/e2e-tests/src/mock-claustrum.ts
@@ -0,0 +1,239 @@
+import { chmod, writeFile } from 'node:fs/promises'
+import { createServer, type Server, type Socket } from 'node:net'
+import { join } from 'node:path'
+import {
+  buildFlags,
+  buildFrame,
+  computeProof,
+  decodeHeader,
+  encodeFrame,
+  FrameType,
+  HEADER_LEN,
+  PROTOCOL_VERSION,
+  Priority,
+  SERVER_PROOF_DOMAIN,
+} from '@cortexkit/subc-client'
+
+const key = Uint8Array.from({ length: 32 }, (_, index) => index + 1)
+const daemonId = Uint8Array.from({ length: 16 }, (_, index) => 200 + index)
+
+export type FakeClaustrumCredential = {
+  payload: string | Uint8Array | number[]
+  account_id: string
+  record_version: number
+  expires_at_ms: number
+  cold?: boolean
+}
+
+export type FakeClaustrumAuthFailure = {
+  handle?: string
+  provider_status?: number
+  record_version?: number
+  reporter_source?: string
+}
+
+export type FakeClaustrumDaemon = {
+  connectionFile: string
+  reportAuthFailures: FakeClaustrumAuthFailure[]
+  stop: () => Promise<void>
+}
+
+export async function startFakeClaustrumDaemon(input: {
+  directory: string
+  credentials: Record<string, FakeClaustrumCredential>
+  connectionFile?: string
+}): Promise<FakeClaustrumDaemon> {
+  const sockets = new Set<Socket>()
+  const reportAuthFailures: FakeClaustrumAuthFailure[] = []
+  const server = createServer((socket) => {
+    sockets.add(socket)
+    socket.once('close', () => sockets.delete(socket))
+    socket.on('error', () => {})
+    let buffer = Buffer.alloc(0)
+    let phase: 'hello' | 'auth' | 'frames' = 'hello'
+    let routeChannel: number | undefined
+
+    socket.on('data', (chunk) => {
+      buffer = Buffer.concat([
+        buffer,
+        typeof chunk === 'string' ? Buffer.from(chunk) : chunk,
+      ])
+      for (;;) {
+        if (phase !== 'frames') {
+          if (buffer.length < 4) return
+          const length = buffer.readUInt32LE(0)
+          if (buffer.length < 4 + length) return
+          const body = JSON.parse(
+            buffer.subarray(4, 4 + length).toString('utf8'),
+          ) as Record<string, unknown>
+          buffer = buffer.subarray(4 + length)
+          if (phase === 'hello') {
+            const clientNonce = Uint8Array.from(body.client_nonce as number[])
+            const serverNonce = Uint8Array.from(
+              { length: 32 },
+              (_, index) => 100 + index,
+            )
+            writeHandshakeMessage(socket, {
+              daemon_id: Array.from(daemonId),
+              server_nonce: Array.from(serverNonce),
+              daemon_ver: 'fake-daemon',
+              server_proof: Array.from(
+                computeProof(
+                  key,
+                  SERVER_PROOF_DOMAIN,
+                  clientNonce,
+                  serverNonce,
+                  daemonId,
+                ),
+              ),
+            })
+            phase = 'auth'
+          } else {
+            phase = 'frames'
+          }
+          continue
+        }
+
+        if (buffer.length < HEADER_LEN) return
+        const header = decodeHeader(buffer.subarray(0, HEADER_LEN))
+        if (buffer.length < HEADER_LEN + header.len) return
+        const body = buffer.subarray(HEADER_LEN, HEADER_LEN + header.len)
+        buffer = buffer.subarray(HEADER_LEN + header.len)
+        if (header.ty !== FrameType.Request) continue
+        const request = JSON.parse(body.toString('utf8')) as {
+          method?: string
+          op?: string
+          params?: Record<string, unknown>
+        }
+        if (header.channel === 0) {
+          if (request.op === 'route.open') routeChannel = 7
+          writeResponse(socket, header, { route_channel: 7, route_epoch: 1 })
+          continue
+        }
+        if (header.channel !== routeChannel) {
+          writeResponse(
+            socket,
+            header,
+            { code: 'unknown_channel' },
+            FrameType.Error,
+          )
+          continue
+        }
+        if (request.method === 'credential.get') {
+          const handle = request.params?.handle
+          const credential =
+            typeof handle === 'string' ? input.credentials[handle] : undefined
+          if (credential?.cold) {
+            writeResponse(socket, header, {
+              result: { error: { code: 'cold', class: 'transient' } },
+            })
+            continue
+          }
+          writeResponse(socket, header, {
+            result: credential
+              ? {
+                  payload: payloadBytes(credential.payload),
+                  account_id: credential.account_id,
+                  record_version: credential.record_version,
+                  expires_at_ms: credential.expires_at_ms,
+                }
+              : { error: { code: 'not_found', class: 'permanent' } },
+          })
+          continue
+        }
+        if (request.method === 'credential.report_auth_failure') {
+          reportAuthFailures.push({
+            handle:
+              typeof request.params?.handle === 'string'
+                ? request.params.handle
+                : undefined,
+            provider_status:
+              typeof request.params?.provider_status === 'number'
+                ? request.params.provider_status
+                : undefined,
+            record_version:
+              typeof request.params?.record_version === 'number'
+                ? request.params.record_version
+                : undefined,
+            reporter_source:
+              typeof request.params?.reporter_source === 'string'
+                ? request.params.reporter_source
+                : undefined,
+          })
+        }
+        writeResponse(socket, header, { result: {} })
+      }
+    })
+  })
+  await listen(server)
+  const address = server.address()
+  if (!address || typeof address === 'string')
+    throw new Error('fake Claustrum daemon has no TCP address')
+  const connectionFile =
+    input.connectionFile ?? join(input.directory, 'claustrum-connection.json')
+  await writeConnectionFile(connectionFile, address.port)
+
+  return {
+    connectionFile,
+    reportAuthFailures,
+    async stop() {
+      for (const socket of sockets) socket.destroy()
+      await new Promise<void>((resolve) => server.close(() => resolve()))
+    },
+  }
+}
+
+function payloadBytes(payload: FakeClaustrumCredential['payload']): number[] {
+  if (typeof payload === 'string')
+    return Array.from(new TextEncoder().encode(payload))
+  return Array.from(payload)
+}
+
+function writeHandshakeMessage(socket: Socket, value: unknown): void {
+  const body = Buffer.from(JSON.stringify(value), 'utf8')
+  const prefix = Buffer.alloc(4)
+  prefix.writeUInt32LE(body.length)
+  socket.write(Buffer.concat([prefix, body]))
+}
+
+function writeResponse(
+  socket: Socket,
+  header: ReturnType<typeof decodeHeader>,
+  value: unknown,
+  type: FrameType = FrameType.Response,
+): void {
+  const frame = buildFrame(
+    type,
+    buildFlags(false, Priority.Interactive, false),
+    header.channel,
+    header.epoch,
+    header.corr,
+    new TextEncoder().encode(JSON.stringify(value)),
+  )
+  socket.write(Buffer.from(encodeFrame(frame)))
+}
+
+async function listen(server: Server): Promise<void> {
+  await new Promise<void>((resolve, reject) => {
+    server.once('error', reject)
+    server.listen(0, '127.0.0.1', () => resolve())
+  })
+}
+
+async function writeConnectionFile(path: string, port: number): Promise<void> {
+  // Mirrors the production-test wire fixture because test files are not package APIs.
+  await writeFile(
+    path,
+    JSON.stringify({
+      schema: 1,
+      wire_version: PROTOCOL_VERSION,
+      endpoints: [{ host: '127.0.0.1', port }],
+      key: Array.from(key),
+      daemon_id: Array.from(daemonId),
+      pid: process.pid,
+      daemon_ver: 'fake-daemon',
+    }),
+    { mode: 0o600 },
+  )
+  await chmod(path, 0o600)
+}
diff --git a/packages/e2e-tests/src/opencode-runner.ts b/packages/e2e-tests/src/opencode-runner.ts
index 12518bfc..b196a29e 100644
--- a/packages/e2e-tests/src/opencode-runner.ts
+++ b/packages/e2e-tests/src/opencode-runner.ts
@@ -180,7 +180,8 @@ export type SpawnOptions = {
     transport: 'websocket' | 'http'
   }
   port?: number
-  beforeSpawn?: (env: IsolatedEnv) => void
+  beforeSpawn?: (env: IsolatedEnv) => void | Promise<void>
+  childEnv?: Record<string, string | undefined>
   childTmpDir?: string
   quotaFeed?: boolean
 }
@@ -378,9 +379,9 @@ export async function spawnOpencode(
   let stdout = ''
   let stderr = ''
   try {
-    options.beforeSpawn?.(env)
     const port = options.port ?? (await pickFreePort())
     writeConfigs(env, options)
+    await options.beforeSpawn?.(env)
 
     const childEnv: Record<string, string> = {}
     for (const [key, value] of Object.entries(process.env)) {
@@ -441,6 +442,10 @@ export async function spawnOpencode(
     })
     childEnv.ANTHROPIC_BASE_URL = options.anthropicBaseURL
     childEnv.ANTHROPIC_API_KEY = 'test-key-not-real'
+    for (const [key, value] of Object.entries(options.childEnv ?? {})) {
+      if (value === undefined) delete childEnv[key]
+      else childEnv[key] = value
+    }
 
     child = spawn(
       'opencode',
diff --git a/packages/e2e-tests/tests/custody-mode.test.ts b/packages/e2e-tests/tests/custody-mode.test.ts
new file mode 100644
index 00000000..76776901
--- /dev/null
+++ b/packages/e2e-tests/tests/custody-mode.test.ts
@@ -0,0 +1,332 @@
+/// <reference types="bun-types" />
+
+import { afterEach, describe, expect, it, test } from 'bun:test'
+import {
+  custodyCredentialId,
+  custodyTombstoneKey,
+  saveAccounts,
+  setClaustrumModePersistent,
+  setRoutingMode,
+  writeCustodyHandleManifestEntry,
+} from '@cortexkit/anthropic-auth-core'
+import { mkdtemp, readFile, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { E2EHarness } from '../src/harness.ts'
+import { startFakeClaustrumDaemon } from '../src/mock-claustrum.ts'
+
+let harness: E2EHarness | null = null
+const roots: string[] = []
+const daemons: Array<{ stop: () => Promise<void> }> = []
+
+afterEach(async () => {
+  await harness?.dispose()
+  harness = null
+  await Promise.all(daemons.splice(0).map((daemon) => daemon.stop()))
+  await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true })))
+})
+
+describe('custody mode', () => {
+  it('serves main and fallback credentials from the vault', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'anthropic-auth-e2e-custody-'))
+    roots.push(root)
+    const mainHandle = `ckh_${'M'.repeat(43)}`
+    const fallbackHandle = `ckh_${'F'.repeat(43)}`
+    const manifestPath = join(root, 'claustrum-handles.json')
+    const daemon = await startFakeClaustrumDaemon({
+      directory: root,
+      credentials: {
+        [mainHandle]: {
+          payload: JSON.stringify({ access_token: 'vault-main' }),
+          account_id: 'account-main',
+          record_version: 11,
+          expires_at_ms: Date.now() + 60 * 60 * 1000,
+        },
+        [fallbackHandle]: {
+          payload: JSON.stringify({ access_token: 'vault-fallback' }),
+          account_id: 'account-fallback',
+          record_version: 12,
+          expires_at_ms: Date.now() + 60 * 60 * 1000,
+        },
+      },
+    })
+    daemons.push(daemon)
+    await expect(
+      writeCustodyHandleManifestEntry({
+        path: manifestPath,
+        entry: {
+          label: 'main',
+          handle: mainHandle,
+          credentialId: custodyCredentialId('main'),
+        },
+      }),
+    ).resolves.toEqual({ status: 'written' })
+    await expect(
+      writeCustodyHandleManifestEntry({
+        path: manifestPath,
+        entry: {
+          label: 'work-alt',
+          handle: fallbackHandle,
+          credentialId: custodyCredentialId('work-alt'),
+        },
+      }),
+    ).resolves.toEqual({ status: 'written' })
+
+    harness = await E2EHarness.create({
+      childEnv: {
+        OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE: daemon.connectionFile,
+        CLAUSTRUM_OPENCODE_HANDLES: manifestPath,
+        OPENCODE_AUTH_CONTENT: JSON.stringify({
+          anthropic: {
+            type: 'oauth',
+            access: '',
+            refresh: custodyTombstoneKey('anthropic'),
+            expires: 0,
+          },
+        }),
+      },
+      beforeSpawn: async (env) => {
+        const accountPath = join(env.configDir, 'anthropic-auth.json')
+        await saveAccounts(
+          {
+            version: 1,
+            accounts: [
+              {
+                id: 'work-alt',
+                label: 'work-alt',
+                type: 'oauth',
+                enabled: true,
+              },
+            ],
+            claustrum: { handlesFile: manifestPath },
+          } as never,
+          accountPath,
+        )
+        await setClaustrumModePersistent('claustrum', accountPath)
+      },
+    })
+    harness.script([
+      { type: 'text', text: 'main served' },
+      { type: 'text', text: 'fallback served' },
+    ])
+
+    const mainSession = await harness.createSession()
+    await harness.sendPrompt(mainSession, 'use the main vault credential')
+    await harness.waitForSessionText(mainSession, 'main served')
+    expect(harness.anthropic.requests().at(-1)?.headers.authorization).toBe(
+      'Bearer vault-main',
+    )
+
+    const accountPath = join(harness.opencode.env.configDir, 'anthropic-auth.json')
+    await setRoutingMode('fallback-first', accountPath)
+    const fallbackSession = await harness.createSession()
+    await harness.sendPrompt(fallbackSession, 'use the fallback vault credential')
+    await harness.waitForSessionText(fallbackSession, 'fallback served')
+    expect(harness.anthropic.requests().at(-1)?.headers.authorization).toBe(
+      'Bearer vault-fallback',
+    )
+    expect(harness.anthropic.tokenRequests()).toBe(0)
+
+    const pluginLog = await readFile(
+      join(harness.opencode.env.tempDir, 'opencode-anthropic-auth.log'),
+      'utf8',
+    ).catch(() => '')
+    const publicOutput = `${harness.opencode.stdout()}\n${harness.opencode.stderr()}\n${pluginLog}`
+    expect(publicOutput).not.toContain(mainHandle)
+    expect(publicOutput).not.toContain(fallbackHandle)
+  }, 120_000)
+
+  it('keeps an initially cold vault main fail-closed while fallback-first serves', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'anthropic-auth-e2e-custody-'))
+    roots.push(root)
+    const mainHandle = `ckh_${'C'.repeat(43)}`
+    const fallbackHandle = `ckh_${'G'.repeat(43)}`
+    const manifestPath = join(root, 'claustrum-handles.json')
+    const daemon = await startFakeClaustrumDaemon({
+      directory: root,
+      credentials: {
+        [mainHandle]: {
+          payload: JSON.stringify({ access_token: 'unavailable-main' }),
+          account_id: 'account-main',
+          record_version: 21,
+          expires_at_ms: Date.now() + 60 * 60 * 1000,
+          cold: true,
+        },
+        [fallbackHandle]: {
+          payload: JSON.stringify({ access_token: 'vault-fallback' }),
+          account_id: 'account-fallback',
+          record_version: 22,
+          expires_at_ms: Date.now() + 60 * 60 * 1000,
+        },
+      },
+    })
+    daemons.push(daemon)
+    await writeCustodyHandleManifestEntry({
+      path: manifestPath,
+      entry: {
+        label: 'main',
+        handle: mainHandle,
+        credentialId: custodyCredentialId('main'),
+      },
+    })
+    await writeCustodyHandleManifestEntry({
+      path: manifestPath,
+      entry: {
+        label: 'work-alt',
+        handle: fallbackHandle,
+        credentialId: custodyCredentialId('work-alt'),
+      },
+    })
+    harness = await E2EHarness.create({
+      childEnv: {
+        OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE: daemon.connectionFile,
+        CLAUSTRUM_OPENCODE_HANDLES: manifestPath,
+        OPENCODE_AUTH_CONTENT: JSON.stringify({
+          anthropic: {
+            type: 'oauth',
+            access: '',
+            refresh: custodyTombstoneKey('anthropic'),
+            expires: 0,
+          },
+        }),
+      },
+      beforeSpawn: async (env) => {
+        const accountPath = join(env.configDir, 'anthropic-auth.json')
+        await saveAccounts(
+          {
+            version: 1,
+            accounts: [
+              { id: 'work-alt', label: 'work-alt', type: 'oauth', enabled: true },
+            ],
+            claustrum: { handlesFile: manifestPath },
+          } as never,
+          accountPath,
+        )
+        await setClaustrumModePersistent('claustrum', accountPath)
+        await setRoutingMode('fallback-first', accountPath)
+      },
+    })
+    const mainSession = await harness.createSession()
+    const mainResult = await harness.sendPrompt(mainSession, 'use the cold main')
+    expect(JSON.stringify(mainResult)).toContain('custody state mismatch: FAIL_CLOSED')
+    expect(harness.anthropic.requests()).toHaveLength(0)
+    expect(harness.anthropic.tokenRequests()).toBe(0)
+    expect(JSON.stringify(harness.anthropic.requests())).not.toContain(
+      custodyTombstoneKey('anthropic'),
+    )
+
+    // C|T|T|N is a global startup verdict, so a healthy fallback remains dark.
+    const accountPath = join(harness.opencode.env.configDir, 'anthropic-auth.json')
+    await setRoutingMode('fallback-first', accountPath)
+    const fallbackSession = await harness.createSession()
+    const fallbackResult = await harness.sendPrompt(
+      fallbackSession,
+      'use the warm fallback after a cold boot',
+    )
+    expect(JSON.stringify(fallbackResult)).toContain(
+      'custody state mismatch: FAIL_CLOSED',
+    )
+    expect(harness.anthropic.requests()).toHaveLength(0)
+  }, 120_000)
+
+  test.todo(
+    'covers late cold main refusal at packages/opencode/src/index.ts:2491-2493; needs a deterministic short-TTL daemon path or clock seam',
+  )
+
+  it('reports a fallback 401 against its own served vault record', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'anthropic-auth-e2e-custody-'))
+    roots.push(root)
+    const mainHandle = `ckh_${'R'.repeat(43)}`
+    const fallbackHandle = `ckh_${'S'.repeat(43)}`
+    const manifestPath = join(root, 'claustrum-handles.json')
+    const daemon = await startFakeClaustrumDaemon({
+      directory: root,
+      credentials: {
+        [mainHandle]: {
+          payload: JSON.stringify({ access_token: 'vault-main' }),
+          account_id: 'account-main',
+          record_version: 40,
+          expires_at_ms: Date.now() + 60 * 60 * 1000,
+        },
+        [fallbackHandle]: {
+          payload: JSON.stringify({ access_token: 'vault-fallback' }),
+          account_id: 'account-fallback',
+          record_version: 41,
+          expires_at_ms: Date.now() + 60 * 60 * 1000,
+        },
+      },
+    })
+    daemons.push(daemon)
+    await writeCustodyHandleManifestEntry({
+      path: manifestPath,
+      entry: {
+        label: 'main',
+        handle: mainHandle,
+        credentialId: custodyCredentialId('main'),
+      },
+    })
+    await writeCustodyHandleManifestEntry({
+      path: manifestPath,
+      entry: {
+        label: 'work-alt',
+        handle: fallbackHandle,
+        credentialId: custodyCredentialId('work-alt'),
+      },
+    })
+    harness = await E2EHarness.create({
+      childEnv: {
+        OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE: daemon.connectionFile,
+        CLAUSTRUM_OPENCODE_HANDLES: manifestPath,
+        OPENCODE_AUTH_CONTENT: JSON.stringify({
+          anthropic: {
+            type: 'oauth',
+            access: '',
+            refresh: custodyTombstoneKey('anthropic'),
+            expires: 0,
+          },
+        }),
+      },
+      beforeSpawn: async (env) => {
+        const accountPath = join(env.configDir, 'anthropic-auth.json')
+        await saveAccounts(
+          {
+            version: 1,
+            accounts: [
+              { id: 'work-alt', label: 'work-alt', type: 'oauth', enabled: true },
+            ],
+            claustrum: { handlesFile: manifestPath },
+          } as never,
+          accountPath,
+        )
+        await setClaustrumModePersistent('claustrum', accountPath)
+        await setRoutingMode('fallback-first', accountPath)
+      },
+    })
+    harness.script([
+      {
+        type: 'error',
+        status: 401,
+        errorType: 'authentication_error',
+        message: 'fallback credential rejected',
+      },
+    ])
+
+    const session = await harness.createSession()
+    await harness.sendPrompt(session, 'use the fallback vault credential')
+    await harness.waitFor(
+      () => daemon.reportAuthFailures.length === 1,
+      15_000,
+    )
+    expect(harness.anthropic.requests()[0]?.headers.authorization).toBe(
+      'Bearer vault-fallback',
+    )
+    expect(daemon.reportAuthFailures).toEqual([
+      {
+        handle: fallbackHandle,
+        provider_status: 401,
+        record_version: 41,
+        reporter_source: 'direct',
+      },
+    ])
+  }, 120_000)
+})
diff --git a/packages/e2e-tests/tests/mock-claustrum.test.ts b/packages/e2e-tests/tests/mock-claustrum.test.ts
new file mode 100644
index 00000000..99111d44
--- /dev/null
+++ b/packages/e2e-tests/tests/mock-claustrum.test.ts
@@ -0,0 +1,149 @@
+/// <reference types="bun-types" />
+
+import { afterEach, describe, expect, it } from 'bun:test'
+import { mkdtemp, rm } from 'node:fs/promises'
+import { createConnection, type Socket } from 'node:net'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import {
+  buildFlags,
+  buildFrame,
+  decodeHeader,
+  encodeFrame,
+  FrameType,
+  HEADER_LEN,
+  Priority,
+  SubcClient,
+} from '@cortexkit/subc-client'
+import { startFakeClaustrumDaemon } from '../src/mock-claustrum.ts'
+
+const roots: string[] = []
+const daemons: Array<{ stop: () => Promise<void> }> = []
+const clients: Array<{ close: () => void }> = []
+
+afterEach(async () => {
+  for (const client of clients.splice(0)) client.close()
+  await Promise.all(daemons.splice(0).map((daemon) => daemon.stop()))
+  await Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true })))
+})
+
+describe('fake Claustrum daemon', () => {
+  it('serves a credential payload through the Subc wire protocol', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'anthropic-auth-e2e-claustrum-'))
+    roots.push(root)
+    const daemon = await startFakeClaustrumDaemon({
+      directory: root,
+      credentials: {
+        'ckh_main': {
+          payload: JSON.stringify({ access_token: 'vault-main' }),
+          account_id: 'account-main',
+          record_version: 7,
+          expires_at_ms: Date.now() + 60 * 60 * 1000,
+        },
+      },
+    })
+    daemons.push(daemon)
+    const client = await SubcClient.connect({
+      connectionFile: daemon.connectionFile,
+      identity: { project_root: root, harness: 'e2e', session: 'fixture-smoke' },
+    })
+    clients.push(client)
+
+    const response = await client.call('claustrum', 'credential.get', {
+      handle: 'ckh_main',
+      force_refresh: false,
+      min_ttl_ms: 0,
+    })
+
+    expect(response).toEqual({
+      result: {
+        payload: Array.from(new TextEncoder().encode('{"access_token":"vault-main"}')),
+        account_id: 'account-main',
+        record_version: 7,
+        expires_at_ms: expect.any(Number),
+      },
+    })
+  })
+
+  it('rejects credential requests on an unassigned route channel', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'anthropic-auth-e2e-claustrum-'))
+    roots.push(root)
+    const daemon = await startFakeClaustrumDaemon({
+      directory: root,
+      credentials: {
+        ckh_main: {
+          payload: JSON.stringify({ access_token: 'vault-main' }),
+          account_id: 'account-main',
+          record_version: 7,
+          expires_at_ms: Date.now() + 60 * 60 * 1000,
+        },
+      },
+    })
+    daemons.push(daemon)
+    const socket = await connectRawDaemon(daemon.connectionFile)
+    try {
+      const response = nextSocketData(socket)
+      const request = buildFrame(
+        FrameType.Request,
+        buildFlags(false, Priority.Interactive, false),
+        8,
+        1,
+        1n,
+        Buffer.from(
+          JSON.stringify({
+            method: 'credential.get',
+            params: { handle: 'ckh_main' },
+          }),
+        ),
+      )
+      socket.write(Buffer.from(encodeFrame(request)))
+
+      const frame = await response
+      const header = decodeHeader(frame)
+      expect(header.ty).toBe(FrameType.Error)
+      expect(
+        JSON.parse(
+          frame
+            .subarray(HEADER_LEN, HEADER_LEN + header.len)
+            .toString('utf8'),
+        ),
+      ).toEqual({ code: 'unknown_channel' })
+    } finally {
+      socket.destroy()
+    }
+  })
+})
+
+async function connectRawDaemon(connectionFile: string): Promise<Socket> {
+  const connection = (await Bun.file(connectionFile).json()) as {
+    endpoints: Array<{ host: string; port: number }>
+  }
+  const endpoint = connection.endpoints[0]!
+  const socket = createConnection(endpoint.port, endpoint.host)
+  await new Promise<void>((resolve, reject) => {
+    socket.once('connect', resolve)
+    socket.once('error', reject)
+  })
+
+  const hello = nextSocketData(socket)
+  writeHandshakeMessage(socket, {
+    client_nonce: Array.from({ length: 32 }, (_, index) => index),
+  })
+  await hello
+  writeHandshakeMessage(socket, { client_auth: [] })
+  return socket
+}
+
+function nextSocketData(socket: Socket): Promise<Buffer> {
+  return new Promise((resolve, reject) => {
+    socket.once('data', (chunk) => resolve(Buffer.from(chunk)))
+    socket.once('error', reject)
+  })
+}
+
+function writeHandshakeMessage(socket: Socket, value: unknown): void {
+  const body = Buffer.from(JSON.stringify(value), 'utf8')
+  const prefix = Buffer.alloc(4)
+  prefix.writeUInt32LE(body.length)
+  socket.write(Buffer.concat([prefix, body]))
+}
diff --git a/packages/opencode/README.md b/packages/opencode/README.md
index d73aa8c0..a686aa31 100644
--- a/packages/opencode/README.md
+++ b/packages/opencode/README.md
@@ -231,7 +231,7 @@ The `routing` block controls `/claude-routing`, `claudeCache` controls `/claude-
 
 `quotaHeaderFeed.enabled` is an OpenCode-only, restart-required opt-in. It publishes only allowlisted quota-window values, an opaque account reference, an observation timestamp, and the configured OAuth-account count; it never publishes tokens, raw headers, request bodies, model IDs, or refresh errors. Per-process lease files use owner-only permissions under `$TMPDIR/opencode-anthropic-auth/quota-header-feed`, expire after three minutes, and can be redirected with `OPENCODE_ANTHROPIC_AUTH_QUOTA_FEED_DIR`.
 
-`claustrum.accounts.<fallback-account-id>.enabled` is a per-account opt-in for fallback credential custody. It is inert unless that account's capability handle has been provisioned in `anthropic-auth-state.json`; handles are bearer credentials and must not be copied into the public config file.
+`claustrum.accounts` remains loadable only so configurations can safely downgrade to older releases; it does not gate custody per account. Capability handles are bearer credentials and must not be copied into the public config file.
 
 Runtime data is stored separately in `anthropic-auth-state.json`: fallback OAuth tokens, API-route keys, token refresh backoff, quota snapshots, and quota API backoff. Sticky session assignments use `anthropic-auth-routing-state.json` and store only SHA-256 hashes of session IDs. Background refresh and quota checks write only runtime state, so editing `anthropic-auth.json` does not get overwritten by another running plugin instance.
 
@@ -283,23 +283,13 @@ Fallback OAuth tokens refresh in the background so idle accounts do not expire b
 
 If Anthropic reports `invalid_grant`, that account must be logged in again. `/claude-account reset-backoff` manually clears the main account's refresh backoff and its matching quota backoff.
 
-### Optional Claustrum custody
+### Claustrum manifest service
 
-OpenCode can obtain an opted-in fallback OAuth account's access credential from a local [Claustrum](https://github.com/cortexkit/claustrum) daemon instead of refreshing that account independently. After provisioning the account's runtime handle, enable custody by account ID:
+In global Claustrum mode, `/claude-account claustrum` serves OAuth routes that have a binding present in the Claustrum handle manifest; `/claude-account local` returns authority to local OAuth refresh. The vault serves credentials, and the plugin discovers only its own provider block.
 
-```json
-{
-  "claustrum": {
-    "accounts": {
-      "personal-alt": { "enabled": true }
-    }
-  }
-}
-```
-
-The request path reads only a resident in-memory credential. Startup warming and periodic custody ticks perform vault I/O and keep idle credentials refreshed; a cold or unavailable vault falls back to the sidecar credential path. Vault-served 401 reports carry the exact record version and response provenance, including relay-stream 401s, so a sidecar-served failure cannot invalidate a healthy vault credential. `/claude-account` and the account modal show the gate, current vault service, and vault reauthentication state without exposing capability handles.
+The request path reads only a resident in-memory credential. Startup warming and periodic reconciliation perform vault I/O and keep idle credentials refreshed. In Claustrum mode, a cold or unavailable vault must return a typed provider-unavailable response; it does not fall back to the sidecar credential path. That cold-route behavior lands with the dedicated cold-route task. Vault-served 401 reports carry the exact record version and response provenance, including relay-stream 401s, so a sidecar-served failure cannot invalidate a healthy vault credential. `/claude-account` and the account modal show manifest-binding presence, current vault service, and vault reauthentication state without exposing capability handles.
 
-Custody currently applies only to fallback OAuth accounts. Main-account vault service is not implemented. If Claustrum has replaced the main host credential with its provider-bound tombstone, the plugin rejects refresh locally without contacting Anthropic or persisting a permanent `invalid_grant` state.
+If Claustrum has replaced the main host credential with its provider-bound tombstone, the plugin rejects refresh locally without contacting Anthropic or persisting a permanent `invalid_grant` state. API-key routes are unaffected.
 
 ## Quota-aware routing
 
diff --git a/packages/opencode/src/cli.ts b/packages/opencode/src/cli.ts
index 8a3e06dd..be7aebd6 100644
--- a/packages/opencode/src/cli.ts
+++ b/packages/opencode/src/cli.ts
@@ -6,16 +6,25 @@ import {
   type AccountStorage,
   addAccountPersistent,
   authorize,
+  custodyCredentialId,
   exchange,
   generateRelayToken,
+  getAccountStatePath,
   getAccountStoragePath,
   isOAuthAccount,
   isValidApiBaseURL,
   loadAccounts,
+  resolveCustodyHandlesPath,
   saveAccounts,
   WORKER_SCRIPT,
 } from '@cortexkit/anthropic-auth-core'
 
+import {
+  acknowledgeLocalOAuthLoginFromStorage,
+  lastVaultServedRecordVersion,
+  localAuthFingerprint,
+} from './local-login.ts'
+
 function defaultStorage(): AccountStorage {
   return {
     version: 1,
@@ -320,7 +329,7 @@ export async function login(labelArg?: string, deps: LoginDeps = {}) {
   }
 
   const now = Date.now()
-  await addAccountPersistent({
+  const account = {
     id: label || crypto.randomUUID(),
     label: label || undefined,
     type: 'oauth',
@@ -332,7 +341,34 @@ export async function login(labelArg?: string, deps: LoginDeps = {}) {
     addedAt: now,
     lastUsed: now,
     lastRefreshedAt: now,
-  })
+  } as const
+  const credentialId = custodyCredentialId(account.label ?? account.id)
+  await addAccountPersistent(account)
+  await acknowledgeLocalOAuthLoginFromStorage(
+    {
+      accountId: account.id,
+      credentialId,
+      authFingerprint: localAuthFingerprint(result.access, result.refresh),
+      completedAt: now,
+    },
+    {
+      accountStoragePath: getAccountStoragePath(),
+      manifestPath: resolveCustodyHandlesPath(
+        (await loadAccounts())?.claustrum,
+        process.env,
+      ),
+      divergence: {
+        statePath: getAccountStatePath(getAccountStoragePath()),
+        lastVaultServedRecordVersion: lastVaultServedRecordVersion({
+          accountId: account.id,
+          warn: (accountId) =>
+            console.warn(
+              `Fallback login had no served vault record for ${accountId}`,
+            ),
+        }),
+      },
+    },
+  )
 
   console.log(`\nSaved fallback account${label ? ` "${label}"` : ''}.`)
 }
diff --git a/packages/opencode/src/custody-dimensions.ts b/packages/opencode/src/custody-dimensions.ts
new file mode 100644
index 00000000..1b51b067
--- /dev/null
+++ b/packages/opencode/src/custody-dimensions.ts
@@ -0,0 +1,206 @@
+import {
+  type AccountStorage,
+  type ClaustrumCredential,
+  type CustodyHandleManifest,
+  type CustodyHandleResolution,
+  type CustodyStatusState,
+  getClaustrumMode,
+  hasNoLocalCredential,
+  isCustodyTombstoneOAuth,
+  isOAuthAccount,
+  isOAuthAccountVaultOwned,
+  type OAuthAccount,
+  type ProviderAccountUuid,
+} from '@cortexkit/anthropic-auth-core'
+
+type CustodyDimensionsDeps = {
+  getCache: () =>
+    | { peek: (handle: string) => ClaustrumCredential | undefined }
+    | null
+    | undefined
+  now: () => number
+  resolveAccountCustodyHandle: (
+    account: OAuthAccount,
+    storage: AccountStorage,
+  ) => CustodyHandleResolution
+  usableAccessToken: (
+    credential: ClaustrumCredential | undefined,
+    now: number,
+  ) => string | undefined
+  hasIdentityMismatch: (
+    account: OAuthAccount,
+    credential: ClaustrumCredential | undefined,
+  ) => boolean
+  isBlocked: (accountId: string) => boolean
+  isReauth: (accountId: string) => boolean
+  getManifest: () => CustodyHandleManifest | undefined
+}
+
+export function fallbackCustodyDimensions(
+  storage: AccountStorage | null,
+  deps: Pick<
+    CustodyDimensionsDeps,
+    'getCache' | 'now' | 'resolveAccountCustodyHandle' | 'usableAccessToken'
+  > & { construction?: boolean },
+) {
+  const constructionEvidence = deps.construction
+    ? ('unknown' as const)
+    : undefined
+  if (!storage)
+    return {
+      fallbacks: 'T' as const,
+      evidence: constructionEvidence ?? ('V' as const),
+    }
+  const accounts = storage.accounts.filter(
+    (account): account is OAuthAccount =>
+      account.enabled !== false && isOAuthAccount(account),
+  )
+  if (!accounts.length)
+    return {
+      fallbacks:
+        getClaustrumMode(storage) === 'claustrum'
+          ? ('T' as const)
+          : ('R' as const),
+      evidence: constructionEvidence ?? ('V' as const),
+    }
+  const fallbacks = accounts.every((account) =>
+    isCustodyTombstoneOAuth(
+      { type: 'oauth', access: account.access, refresh: account.refresh },
+      'anthropic',
+    ),
+  )
+    ? ('T' as const)
+    : ('R' as const)
+  if (getClaustrumMode(storage) !== 'claustrum')
+    return { fallbacks, evidence: constructionEvidence ?? ('V' as const) }
+  const bindings = accounts.map((account) =>
+    deps.resolveAccountCustodyHandle(account, storage),
+  )
+  if (bindings.some((binding) => binding.status !== 'resolved'))
+    return {
+      fallbacks: 'M' as const,
+      evidence: constructionEvidence ?? ('N' as const),
+    }
+  const custodyFallbacks = accounts.every(
+    (account, index) =>
+      isCustodyTombstoneOAuth(
+        { type: 'oauth', access: account.access, refresh: account.refresh },
+        'anthropic',
+      ) ||
+      (hasNoLocalCredential(account) &&
+        isOAuthAccountVaultOwned(storage, account, bindings[index])),
+  )
+    ? ('T' as const)
+    : ('R' as const)
+  if (deps.construction)
+    return { fallbacks: custodyFallbacks, evidence: 'unknown' as const }
+  const evidence = bindings.every((binding) => {
+    if (binding.status !== 'resolved') return false
+    return Boolean(
+      deps.usableAccessToken(deps.getCache()?.peek(binding.handle), deps.now()),
+    )
+  })
+    ? ('V' as const)
+    : ('N' as const)
+  return { fallbacks: custodyFallbacks, evidence }
+}
+
+export function mainCustodyDimension(auth: {
+  type: string
+  access?: string
+  refresh?: string
+}) {
+  if (isCustodyTombstoneOAuth(auth, 'anthropic')) return 'T' as const
+  if (auth.type === 'oauth' && auth.access && auth.refresh) return 'R' as const
+  return 'X' as const
+}
+
+export function isFallbackAccountVaultServed(
+  accountId: string,
+  storage: AccountStorage | null,
+  deps: Pick<
+    CustodyDimensionsDeps,
+    | 'getCache'
+    | 'now'
+    | 'resolveAccountCustodyHandle'
+    | 'usableAccessToken'
+    | 'hasIdentityMismatch'
+    | 'isBlocked'
+  >,
+): boolean {
+  if (!storage || deps.isBlocked(accountId)) return false
+  const account = storage.accounts.find(
+    (candidate): candidate is OAuthAccount =>
+      candidate.id === accountId && isOAuthAccount(candidate),
+  )
+  if (!account) return false
+  const resolved = deps.resolveAccountCustodyHandle(account, storage)
+  if (!isOAuthAccountVaultOwned(storage, account, resolved)) return false
+  if (resolved.status !== 'resolved') return false
+  const cached = deps.getCache()?.peek(resolved.handle)
+  if (deps.hasIdentityMismatch(account, cached)) return false
+  return Boolean(cached && deps.usableAccessToken(cached, deps.now()))
+}
+
+export function custodyStateFor(
+  account: { id: string; role: 'main' | 'fallback' },
+  storage: AccountStorage | null,
+  deps: CustodyDimensionsDeps,
+  vaultServed = isFallbackAccountVaultServed(account.id, storage, deps),
+): CustodyStatusState {
+  if (account.role === 'main') {
+    if (!storage || getClaustrumMode(storage) !== 'claustrum') return 'na'
+    const mainHandle = deps
+      .getManifest()
+      ?.accounts.find((entry) => entry.label === 'main')?.handle
+    const cached = mainHandle ? deps.getCache()?.peek(mainHandle) : undefined
+    const persistedIdentity =
+      storage.main?.profile?.providerAccountUuid ??
+      (storage.main?.profile?.accountIdentity as
+        | ProviderAccountUuid
+        | undefined)
+    const credentialIdentity = cached?.accountId
+    if (persistedIdentity === undefined && credentialIdentity === undefined)
+      return 'unknown-identity'
+    if (
+      (persistedIdentity === undefined) !==
+      (credentialIdentity === undefined)
+    )
+      return 'unknown-identity'
+    if (
+      persistedIdentity !== undefined &&
+      credentialIdentity !== undefined &&
+      persistedIdentity !== credentialIdentity
+    )
+      return 'on-identity-mismatch'
+    if (deps.isReauth('main')) return 'on-vault-reauth'
+    if (cached && deps.usableAccessToken(cached, deps.now()))
+      return 'on-vault-served'
+    return 'on-cold'
+  }
+  if (!storage) return 'off'
+  const stored = storage.accounts.find(
+    (candidate): candidate is OAuthAccount =>
+      candidate.id === account.id && isOAuthAccount(candidate),
+  )
+  if (!stored) return 'off'
+  const resolution = deps.resolveAccountCustodyHandle(stored, storage)
+  if (
+    resolution.status === 'unresolved' &&
+    resolution.reason === 'corrupt-binding'
+  )
+    return 'on-corrupt-binding'
+  if (
+    resolution.status === 'unresolved' &&
+    resolution.reason === 'unknown-identity'
+  )
+    return 'on-identity-mismatch'
+  if (!isOAuthAccountVaultOwned(storage, stored, resolution)) return 'off'
+  const handle =
+    resolution.status === 'resolved' ? resolution.handle : undefined
+  if (handle && deps.hasIdentityMismatch(stored, deps.getCache()?.peek(handle)))
+    return 'on-identity-mismatch'
+  if (deps.isReauth(account.id)) return 'on-vault-reauth'
+  if (vaultServed) return 'on-vault-served'
+  return 'on-cold'
+}
diff --git a/packages/opencode/src/custody-live.ts b/packages/opencode/src/custody-live.ts
new file mode 100644
index 00000000..e412f00c
--- /dev/null
+++ b/packages/opencode/src/custody-live.ts
@@ -0,0 +1,535 @@
+import { mkdir, readFile, rm, writeFile } from 'node:fs/promises'
+import { dirname } from 'node:path'
+import * as core from '@cortexkit/anthropic-auth-core'
+import {
+  type ClaustrumTakeoverPlan,
+  type CustodyCacheCredential,
+  type CustodyPreflightRefusal,
+  CustodyPreflightRefusedError,
+  type CustodySidecarSnapshot,
+  type ExecuteClaustrumTakeoverDeps,
+  executeClaustrumTakeover,
+  executeLocalExit,
+  OPENCODE_MAIN_OAUTH_REFRESH_LOCK,
+  preflightClaustrumTakeover,
+  reconcileCustodyStartup,
+} from './custody-mode.ts'
+
+type Lock = { release: () => Promise<void> }
+
+type RawCacheCredential = core.ClaustrumCredential | CustodyCacheCredential
+
+type LiveRoute = {
+  id: string
+  label?: string
+  type: string
+  enabled?: boolean
+  local?: unknown
+  claustrumHandle?: string
+}
+
+type ClaustrumTakeoverCommandDeps = {
+  storagePath: string
+  loadStorage: () => Promise<core.AccountStorage | null>
+  getCache: () => Promise<{
+    get: (handle: string, minTtlMs?: number) => Promise<RawCacheCredential>
+  } | null>
+  latestGetAuth?: () => Promise<unknown>
+  now: () => number
+  fallbackManager?: Pick<core.FallbackAccountManager, 'withAccountRefreshLock'>
+  refreshManifest: () => Promise<void>
+  debug?: (message: string) => void
+}
+
+function formatCustodyPreflightRefusals(
+  refusals: CustodyPreflightRefusal[],
+): string {
+  const ordered = [
+    ...refusals.filter((refusal) => refusal.guidance),
+    ...refusals.filter((refusal) => !refusal.guidance),
+  ]
+  return ordered
+    .map(
+      ({ label, reason, guidance }) =>
+        `${label}: ${reason}${guidance ? ` — ${guidance}` : ''}`,
+    )
+    .join('\n')
+}
+
+async function acquireLocalExitMainLock(
+  storagePath: string,
+  now: () => number,
+): Promise<Lock> {
+  await mkdir(dirname(storagePath), { recursive: true })
+  for (;;) {
+    const lock = await core.acquireRefreshFileLock({
+      name: OPENCODE_MAIN_OAUTH_REFRESH_LOCK,
+      path: storagePath,
+      ttlMs: 5 * 60_000,
+      now,
+      renew: true,
+    })
+    if (lock) return lock
+    await new Promise((resolve) => setTimeout(resolve, 10))
+  }
+}
+
+export async function runClaustrumTakeoverCommand(
+  deps: ClaustrumTakeoverCommandDeps,
+  mode: 'local' | 'claustrum',
+): Promise<{ text: string }> {
+  if (mode === 'local') {
+    const lock = await acquireLocalExitMainLock(deps.storagePath, deps.now)
+    const changed = await executeLocalExit({ path: deps.storagePath }).finally(
+      () => lock.release(),
+    )
+    return {
+      text:
+        changed === 'changed'
+          ? 'Claustrum mode set to local. Bound credentials remain inert until verified login.'
+          : 'Claustrum mode already local. Bound credentials remain inert until verified login.',
+    }
+  }
+  if (!deps.latestGetAuth)
+    return { text: 'Custody takeover refused: main auth is unavailable.' }
+
+  const storage = (await deps.loadStorage()) ?? core.createEmptyStorage()
+  const cache = await deps.getCache()
+  if (!cache)
+    return { text: 'Custody takeover refused: Claustrum is unavailable.' }
+
+  const live = createLiveCustodyDeps({
+    storagePath: deps.storagePath,
+    storage,
+    cache,
+    latestGetAuth: deps.latestGetAuth,
+    now: deps.now,
+    fallbackManager: deps.fallbackManager,
+    debug: deps.debug,
+  })
+  try {
+    const plan = await preflightClaustrumTakeover(
+      await live.preflightInput(
+        { id: 'main', label: 'main', enabled: true },
+        storage.accounts,
+      ),
+    )
+    const changed = await executeClaustrumTakeover(
+      plan,
+      live.takeoverDeps(plan),
+    )
+    await deps.refreshManifest()
+    const labels = plan.accounts.map((account) => account.label).join(', ')
+    return {
+      text:
+        changed === 'changed'
+          ? `Claustrum custody committed for: ${labels}.`
+          : `Claustrum custody already committed for: ${labels}.`,
+    }
+  } catch (error) {
+    if (error instanceof CustodyPreflightRefusedError)
+      return {
+        text: `Custody takeover refused:\n${formatCustodyPreflightRefusals(error.refusals)}`,
+      }
+    throw error
+  }
+}
+
+function retainLock(
+  acquire: (fn: () => Promise<void>) => Promise<unknown>,
+): Promise<Lock> {
+  return new Promise((resolve, reject) => {
+    void acquire(async () => {
+      await new Promise<void>((done) =>
+        resolve({ release: async () => done() }),
+      )
+    }).catch(reject)
+  })
+}
+
+type ManifestLease = {
+  assertLease: () => Promise<void>
+  nonce: string
+}
+
+function retainManifestLock(
+  path: string,
+  setLease: (lease: ManifestLease | undefined) => void,
+): Promise<Lock> {
+  return new Promise((resolve, reject) => {
+    void core
+      .withCustodyManifestLock(path, async (assertLease, nonce) => {
+        await new Promise<void>((done) => {
+          setLease({ assertLease, nonce })
+          resolve({
+            release: async () => {
+              setLease(undefined)
+              done()
+            },
+          })
+        })
+      })
+      .catch(reject)
+  })
+}
+
+async function readBytes(path: string): Promise<Uint8Array | null> {
+  try {
+    return new Uint8Array(await readFile(path))
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return null
+    throw error
+  }
+}
+
+async function restoreBytes(path: string, bytes: Uint8Array | null) {
+  if (bytes === null) {
+    await rm(path, { force: true })
+    return
+  }
+  await writeFile(path, bytes, { mode: 0o600 })
+}
+
+export function createLiveCustodyDeps(input: {
+  storagePath: string
+  cache: {
+    get: (handle: string, minTtlMs?: number) => Promise<RawCacheCredential>
+  }
+  latestGetAuth: () => Promise<unknown>
+  now: number | (() => number)
+  fallbackManager?: Pick<core.FallbackAccountManager, 'withAccountRefreshLock'>
+  storage?: core.AccountStorage | null
+  writeManifestEntryLocked?: typeof core.writeCustodyHandleManifestEntryLocked
+  debug?: (message: string) => void
+}) {
+  const inputNow = input.now
+  const now = typeof inputNow === 'function' ? inputNow : () => inputNow
+  const fallbackManager = input.fallbackManager
+  let storagePromise: Promise<core.AccountStorage | null> | undefined
+  let manifestPath = core.resolveCustodyHandlesPath(
+    input.storage?.claustrum,
+    process.env,
+  )
+  let manifestReader: core.CustodyHandleManifestReader | undefined
+  let manifestLease: ManifestLease | undefined
+  const loadStorage = () =>
+    (storagePromise ??= Promise.resolve(
+      input.storage ?? core.loadAccounts(input.storagePath),
+    ))
+  const loadManifestReader = async () => {
+    const storage = await loadStorage()
+    const path = core.resolveCustodyHandlesPath(storage?.claustrum, process.env)
+    if (!manifestReader || path !== manifestPath) {
+      manifestPath = path
+      manifestReader = new core.CustodyHandleManifestReader({
+        path,
+        provider: 'anthropic',
+        serve: 'anthropic-auth',
+      })
+    }
+    return manifestReader
+  }
+  const getCredential = async (
+    handle: string,
+    minTtlMs: number,
+  ): Promise<CustodyCacheCredential> => {
+    const credential = await input.cache.get(handle, minTtlMs)
+    if ('state' in credential) return credential
+    const vaultCredentialId = (credential as { credentialId?: unknown })
+      .credentialId
+    let payload: { access_token?: unknown; refresh_token?: unknown } = {}
+    try {
+      payload = JSON.parse(credential.payload)
+    } catch {}
+    return {
+      credentialId:
+        typeof vaultCredentialId === 'string' ? vaultCredentialId : undefined,
+      recordVersion: credential.recordVersion,
+      access:
+        typeof payload.access_token === 'string' ? payload.access_token : '',
+      refresh:
+        typeof payload.refresh_token === 'string' ? payload.refresh_token : '',
+      expiresAt:
+        credential.expiresAtMs === null ? null : (credential.expiresAtMs ?? 0),
+      state: 'usable' as const,
+    }
+  }
+
+  return {
+    hostAuth: { get: input.latestGetAuth },
+    get manifestPath() {
+      return manifestPath
+    },
+    async readBindings(routes: LiveRoute[]) {
+      const result = await (await loadManifestReader()).read()
+      const manifest = result.status === 'ready' ? result.manifest : undefined
+      return routes.flatMap((route) => {
+        const resolution = core.resolveCustodyHandle({
+          account: {
+            id: route.id,
+            label: route.label,
+            type: 'oauth',
+            refresh: '',
+            claustrumHandle: route.claustrumHandle,
+          },
+          manifest,
+        })
+        if (resolution.status !== 'resolved') return []
+        const credentialId =
+          resolution.source === 'manifest'
+            ? resolution.credentialId
+            : core.custodyCredentialId(route.label ?? route.id)
+        return [
+          {
+            accountId: route.id,
+            label: route.label ?? route.id,
+            handle: resolution.handle,
+            credentialId,
+            source: resolution.source,
+          },
+        ]
+      })
+    },
+    cache: {
+      get: (handle: string, options: { minTtlMs: number }) =>
+        getCredential(handle, options.minTtlMs),
+    },
+    async preflightInput(
+      main: Pick<LiveRoute, 'id' | 'label' | 'enabled'>,
+      fallbacks: LiveRoute[],
+    ) {
+      const storage = await loadStorage()
+      return {
+        now: now(),
+        storage,
+        main,
+        fallbacks: fallbacks.map((fallback) => ({
+          ...fallback,
+          local: fallback.local ?? fallback,
+        })),
+        hostAuth: { get: input.latestGetAuth },
+        bindings: await this.readBindings([
+          { ...main, type: 'oauth' },
+          ...fallbacks,
+        ]),
+        cache: this.cache,
+        debug: input.debug,
+      }
+    },
+    locks: {
+      storagePath: input.storagePath,
+      get manifestPath() {
+        return manifestPath
+      },
+      acquireTransition: ({ name, path }: { name: string; path: string }) =>
+        core.acquireRefreshFileLock({
+          name,
+          path,
+          ttlMs: 5 * 60_000,
+          now,
+          renew: true,
+        }),
+      acquireManifest: ({ path }: { path: string }) =>
+        retainManifestLock(path, (lease) => {
+          manifestLease = lease
+        }),
+      acquireRefresh: ({ name, path }: { name: string; path: string }) =>
+        name === OPENCODE_MAIN_OAUTH_REFRESH_LOCK || !fallbackManager
+          ? core.acquireRefreshFileLock({
+              name,
+              path,
+              ttlMs: 5 * 60_000,
+              now,
+              renew: true,
+            })
+          : retainLock((fn) =>
+              fallbackManager.withAccountRefreshLock(
+                name.replace(/-refresh$/, ''),
+                fn,
+              ),
+            ),
+      withFallbackRefreshLock: <T>(accountId: string, fn: () => Promise<T>) => {
+        if (fallbackManager)
+          return fallbackManager.withAccountRefreshLock(accountId, fn)
+        return fn()
+      },
+    },
+    takeoverDeps(plan: ClaustrumTakeoverPlan): ExecuteClaustrumTakeoverDeps {
+      const readStrictBindings = async (plan: ClaustrumTakeoverPlan) => {
+        const reader = new core.CustodyHandleManifestReader({
+          path: manifestPath,
+          provider: 'anthropic',
+          serve: 'anthropic-auth',
+        })
+        const result = await reader.read()
+        const manifest = result.status === 'ready' ? result.manifest : undefined
+        return plan.accounts.map((account) => {
+          const resolution = core.resolveCustodyHandle({
+            account: {
+              id: account.id,
+              label: account.label,
+              type: 'oauth',
+              refresh: '',
+            },
+            manifest,
+          })
+          return resolution.status === 'resolved' &&
+            resolution.source === 'manifest' &&
+            resolution.handle === account.handle &&
+            resolution.credentialId === account.credentialId
+            ? resolution
+            : undefined
+        })
+      }
+      const verify = async (
+        plan: ClaustrumTakeoverPlan,
+        persistedMode: boolean,
+      ) => {
+        const storage = await core.loadAccounts(input.storagePath)
+        if (!storage) return false
+        const mainAuth = await input.latestGetAuth()
+        if (!core.isCustodyTombstoneOAuth(mainAuth, 'anthropic')) return false
+        const bindings = await readStrictBindings(plan)
+        if (bindings.some((binding) => !binding)) return false
+        for (const account of plan.accounts) {
+          const credential = await getCredential(
+            account.handle,
+            core.getRefreshBeforeExpiryMs(storage) + 30 * 60_000,
+          )
+          if (
+            credential.state !== 'usable' ||
+            (credential.credentialId !== undefined &&
+              credential.credentialId !== account.credentialId) ||
+            credential.recordVersion < account.recordVersion ||
+            (credential.expiresAt !== null &&
+              credential.expiresAt <
+                now() + core.getRefreshBeforeExpiryMs(storage) + 30 * 60_000)
+          )
+            return false
+          if (account.id === 'main') continue
+          const fallback = storage.accounts.find(
+            (candidate) => candidate.id === account.id,
+          )
+          if (!fallback || !core.isCustodyTombstoneOAuth(fallback, 'anthropic'))
+            return false
+        }
+        if (
+          reconcileCustodyStartup({
+            mode: 'C',
+            main: 'T',
+            fallbacks: 'T',
+            evidence: 'V',
+          }).verdict !== 'CLAUSTRUM_SERVE'
+        )
+          return false
+        if (!persistedMode) return true
+        if (core.getClaustrumMode(storage) !== 'claustrum') return false
+        return plan.accounts.every((account, index) => {
+          const route =
+            account.id === 'main'
+              ? ({
+                  id: 'main',
+                  label: account.label,
+                  type: 'oauth',
+                  refresh: core.custodyTombstoneKey('anthropic'),
+                  enabled: true,
+                } as core.OAuthAccount)
+              : storage.accounts.find(
+                  (candidate) => candidate.id === account.id,
+                )
+          return Boolean(
+            route &&
+              core.isOAuthAccountVaultOwned(storage, route, bindings[index]),
+          )
+        })
+      }
+      return {
+        locks: {
+          ...this.locks,
+          fallbackAccountIds: plan.accounts
+            .filter((account) => account.id !== 'main')
+            .map((account) => account.id),
+        },
+        getLocalAuth: async (accountId: string) => {
+          if (accountId === 'main') return input.latestGetAuth()
+          return (await core.loadAccounts(input.storagePath))?.accounts.find(
+            (account) => account.id === accountId,
+          )
+        },
+        isCommitted: (plan: ClaustrumTakeoverPlan) => verify(plan, true),
+        snapshotSidecars: async (): Promise<CustodySidecarSnapshot> => ({
+          config: await readBytes(input.storagePath),
+          state: await readBytes(core.getAccountStatePath(input.storagePath)),
+          manifest: await readBytes(manifestPath),
+        }),
+        writeManifestBindings: async (plan: ClaustrumTakeoverPlan) => {
+          if (!manifestLease)
+            throw new Error('custody manifest lock is not held')
+          for (const account of plan.accounts) {
+            // Main is installed by the operator so this process never rewrites the host-authoritative binding.
+            if (account.id === 'main' || account.bindingPersisted) continue
+            const result = await (
+              input.writeManifestEntryLocked ??
+              core.writeCustodyHandleManifestEntryLocked
+            )(
+              {
+                path: manifestPath,
+                entry: {
+                  label: account.label,
+                  handle: account.handle,
+                  credentialId: account.credentialId,
+                },
+              },
+              manifestLease.assertLease,
+              manifestLease.nonce,
+            )
+            if (result.status !== 'written' && result.status !== 'unchanged')
+              throw new Error('custody manifest write refused')
+          }
+        },
+        writeSidecarAccount: async (
+          account: ClaustrumTakeoverPlan['accounts'][number],
+        ) => {
+          const storage = await core.loadAccounts(input.storagePath)
+          const fallback = storage?.accounts.find(
+            (candidate): candidate is core.OAuthAccount =>
+              candidate.id === account.id && core.isOAuthAccount(candidate),
+          )
+          if (!storage || !fallback) throw new Error('fallback missing')
+          // Empty access prevents accidental local serving even though refresh alone defines the recognise-set.
+          fallback.access = ''
+          fallback.refresh = core.custodyTombstoneKey('anthropic')
+          fallback.expires = 0
+          await core.saveAccountState(storage, input.storagePath, {
+            accounts: [account.id],
+          })
+        },
+        verifyTarget: (plan: ClaustrumTakeoverPlan) => verify(plan, false),
+        verifyCommitted: (plan: ClaustrumTakeoverPlan) => verify(plan, true),
+        restoreSidecars: async (snapshot: CustodySidecarSnapshot) => {
+          await restoreBytes(input.storagePath, snapshot.config)
+          await restoreBytes(
+            core.getAccountStatePath(input.storagePath),
+            snapshot.state,
+          )
+          if (snapshot.manifest !== undefined)
+            await restoreBytes(manifestPath, snapshot.manifest)
+        },
+        verifyRollback: async (snapshot: CustodySidecarSnapshot) =>
+          Buffer.from((await readBytes(input.storagePath)) ?? []).equals(
+            Buffer.from(snapshot.config ?? []),
+          ) &&
+          Buffer.from(
+            (await readBytes(core.getAccountStatePath(input.storagePath))) ??
+              [],
+          ).equals(Buffer.from(snapshot.state ?? [])) &&
+          (snapshot.manifest === undefined ||
+            Buffer.from((await readBytes(manifestPath)) ?? []).equals(
+              Buffer.from(snapshot.manifest ?? []),
+            )),
+        setMode: (mode) =>
+          core.setClaustrumModePersistent(mode, input.storagePath),
+      }
+    },
+  }
+}
diff --git a/packages/opencode/src/custody-mode.ts b/packages/opencode/src/custody-mode.ts
new file mode 100644
index 00000000..ff2a6079
--- /dev/null
+++ b/packages/opencode/src/custody-mode.ts
@@ -0,0 +1,655 @@
+import {
+  getRefreshBeforeExpiryMs,
+  isCustodyTombstoneOAuth,
+  setClaustrumModePersistent,
+} from '@cortexkit/anthropic-auth-core'
+
+import {
+  custodyPreflightDivergenceCheck,
+  localAuthFingerprint,
+} from './local-login.ts'
+
+type ModeDimension = 'L' | 'C'
+type MainDimension = 'R' | 'T' | 'X'
+type FallbackDimension = 'R' | 'T' | 'M'
+type EvidenceDimension = 'V' | 'N' | 'unknown'
+
+type Lock = { release: () => Promise<void> }
+
+export const OPENCODE_MAIN_OAUTH_REFRESH_LOCK = 'opencode-main-oauth-refresh'
+
+export type CustodyCacheCredential = {
+  credentialId?: string
+  recordVersion: number
+  access: string
+  refresh: string
+  expiresAt: number | null
+  state: 'usable' | 'revoked' | 'reauth' | 'timeout'
+}
+
+export type ClaustrumTakeoverPlan = {
+  accounts: Array<{
+    id: string
+    label: string
+    handle: string
+    credentialId: string
+    recordVersion: number
+    bindingPersisted: boolean
+    localAuthFingerprint: string
+    cacheCredential: CustodyCacheCredential
+  }>
+  toJSON: () => unknown
+  toString: () => string
+}
+
+export type CustodyPreflightRefusalReason =
+  | 'TAKEOVER_INCOMPLETE_MAIN_REAL'
+  | 'TAKEOVER_INCOMPLETE_MAIN_BINDING'
+  | 'binding_missing'
+  | 'credential_revoked'
+  | 'credential_reauth'
+  | 'credential_timeout'
+  | 'credential_unusable'
+  | 'credential_identity_mismatch'
+  | 'divergence_fenced'
+  | 'TAKEOVER_INCOMPLETE_MAIN_SLOT'
+  | 'local_credential_unavailable'
+
+export type CustodyPreflightRefusal = {
+  label: string
+  reason: CustodyPreflightRefusalReason
+  guidance?: string
+}
+
+export type MainCustodyRefusal =
+  | 'cold'
+  | 'reauth'
+  | 'takeover-incomplete'
+  | 'identity-mismatch'
+
+export class CustodyPreflightRefusedError extends Error {
+  readonly code = 'custody_preflight_refused'
+
+  constructor(
+    readonly accountId: string,
+    readonly reason: CustodyPreflightRefusalReason,
+    readonly refusals: CustodyPreflightRefusal[] = [
+      { label: accountId, reason },
+    ],
+  ) {
+    super(`custody preflight refused for account ${accountId}: ${reason}`)
+  }
+
+  toJSON() {
+    return {
+      ok: false,
+      code: this.code,
+      accountId: this.accountId,
+      reason: this.reason,
+      refusals: this.refusals,
+    }
+  }
+}
+
+export class CustodyStateMismatchError extends Error {
+  readonly code = 'custody_state_mismatch'
+
+  constructor(
+    readonly verdict: string,
+    readonly dimensions: {
+      mode: ModeDimension
+      main: MainDimension
+      fallbacks: FallbackDimension
+      evidence: EvidenceDimension
+    },
+  ) {
+    super(`custody state mismatch: ${verdict}`)
+  }
+
+  toJSON() {
+    return {
+      code: this.code,
+      verdict: this.verdict,
+      dimensions: this.dimensions,
+    }
+  }
+}
+
+export class CustodyLockBusyError extends Error {
+  readonly code = 'lock_busy'
+
+  constructor(readonly lockName: string) {
+    super(`custody transition lock busy: ${lockName}`)
+  }
+}
+
+type PreflightRoute = {
+  id: string
+  label?: string
+  enabled?: boolean
+  type: string
+  local?: unknown
+}
+
+type PreflightBinding = {
+  accountId: string
+  label: string
+  handle: string
+  credentialId: string
+  source?: 'manifest' | 'legacy'
+}
+
+export type PreflightClaustrumTakeoverInput = {
+  now: number
+  storage: {
+    refresh?: { refreshBeforeExpiryMinutes?: number }
+    claustrumDivergence?: Record<
+      string,
+      { minimumRecordVersion: number; observedAt?: number }
+    >
+  } | null
+  main: Pick<PreflightRoute, 'id' | 'label' | 'enabled'>
+  fallbacks: PreflightRoute[]
+  hostAuth: { get: () => unknown | Promise<unknown> }
+  bindings: PreflightBinding[]
+  cache: {
+    get: (
+      handle: string,
+      options: { minTtlMs: number },
+    ) => Promise<CustodyCacheCredential | { state: string; expiresAt?: number }>
+  }
+  debug?: (message: string) => void
+}
+
+function localOAuthMaterial(
+  value: unknown,
+): { access: string; refresh: string } | undefined {
+  if (
+    !value ||
+    typeof value !== 'object' ||
+    (value as { type?: unknown }).type !== 'oauth' ||
+    isCustodyTombstoneOAuth(value, 'anthropic')
+  )
+    return undefined
+  const { access, refresh } = value as { access?: unknown; refresh?: unknown }
+  if (
+    typeof access !== 'string' ||
+    !access ||
+    typeof refresh !== 'string' ||
+    !refresh
+  )
+    return undefined
+  return { access, refresh }
+}
+
+function oauthFingerprintMaterial(
+  value: unknown,
+): { access: string; refresh: string } | undefined {
+  if (
+    !value ||
+    typeof value !== 'object' ||
+    (value as { type?: unknown }).type !== 'oauth'
+  )
+    return undefined
+  const { access, refresh } = value as { access?: unknown; refresh?: unknown }
+  if (typeof access !== 'string' || typeof refresh !== 'string')
+    return undefined
+  return { access, refresh }
+}
+
+function enabledOAuthRoutes(
+  input: PreflightClaustrumTakeoverInput,
+  mainAuth: unknown,
+) {
+  return [
+    { ...input.main, type: 'oauth', local: mainAuth },
+    ...input.fallbacks,
+  ].filter((route) => route.type === 'oauth' && route.enabled !== false)
+}
+
+function findStrictBinding(
+  route: PreflightRoute,
+  bindings: PreflightBinding[],
+) {
+  const matches = bindings.filter(
+    (binding) =>
+      binding.accountId === route.id && binding.label === route.label,
+  )
+  return matches.length === 1 ? matches[0] : undefined
+}
+
+function isUsableCredential(
+  credential:
+    | CustodyCacheCredential
+    | { state: string; expiresAt?: number | null },
+): credential is CustodyCacheCredential {
+  return credential.state === 'usable' && 'recordVersion' in credential
+}
+
+type CollectedPreflightRefusal = CustodyPreflightRefusal & {
+  accountId: string
+}
+
+export async function preflightClaustrumTakeover(
+  input: PreflightClaustrumTakeoverInput,
+): Promise<ClaustrumTakeoverPlan> {
+  const mainAuth = await input.hostAuth.get()
+  const mainIsTombstoned = isCustodyTombstoneOAuth(mainAuth, 'anthropic')
+
+  const minTtlMs =
+    getRefreshBeforeExpiryMs(input.storage as never) + 30 * 60_000
+  const accounts: ClaustrumTakeoverPlan['accounts'] = []
+  const refusals: CollectedPreflightRefusal[] = []
+  const refuse = (
+    route: PreflightRoute,
+    reason: CustodyPreflightRefusalReason,
+  ) => {
+    refusals.push({
+      accountId: route.id,
+      label: route.label ?? route.id,
+      reason,
+      ...(route.id === input.main.id &&
+      reason === 'TAKEOVER_INCOMPLETE_MAIN_REAL'
+        ? {
+            guidance:
+              "Onboard the main account into the Claustrum vault with Claustrum's tooling (see its runbook) before retrying.",
+          }
+        : {}),
+    })
+  }
+  if (!mainIsTombstoned)
+    refuse({ ...input.main, type: 'oauth' }, 'TAKEOVER_INCOMPLETE_MAIN_REAL')
+
+  for (const route of enabledOAuthRoutes(input, mainAuth)) {
+    if (route.id === input.main.id && !mainIsTombstoned) continue
+    const binding = findStrictBinding(route, input.bindings)
+    if (!binding) {
+      refuse(
+        route,
+        route.id === input.main.id
+          ? 'TAKEOVER_INCOMPLETE_MAIN_BINDING'
+          : 'binding_missing',
+      )
+      continue
+    }
+    const credential = await input.cache.get(binding.handle, { minTtlMs })
+    if (credential.state === 'revoked') {
+      refuse(route, 'credential_revoked')
+      continue
+    }
+    if (credential.state === 'reauth') {
+      refuse(route, 'credential_reauth')
+      continue
+    }
+    if (credential.state === 'timeout') {
+      refuse(route, 'credential_timeout')
+      continue
+    }
+    if (
+      !isUsableCredential(credential) ||
+      (credential.expiresAt !== null &&
+        credential.expiresAt < input.now + minTtlMs)
+    ) {
+      refuse(route, 'credential_unusable')
+      continue
+    }
+    // Without a vault id, a same-account wrong-record response remains possible; the vault `account_id` vs persisted `anthropicAccountUuid` fence is the live protection.
+    if (credential.credentialId === undefined)
+      input.debug?.(
+        'custody identity check skipped: vault supplied no credential id',
+      )
+    else if (credential.credentialId !== binding.credentialId) {
+      refuse(route, 'credential_identity_mismatch')
+      continue
+    }
+    if (
+      !custodyPreflightDivergenceCheck(
+        {
+          credentialId: binding.credentialId,
+          recordVersion: credential.recordVersion,
+        },
+        (input.storage ?? {}) as Parameters<
+          typeof custodyPreflightDivergenceCheck
+        >[1],
+      ).ok
+    ) {
+      refuse(route, 'divergence_fenced')
+      continue
+    }
+    const local =
+      route.id === input.main.id
+        ? oauthFingerprintMaterial(route.local)
+        : localOAuthMaterial(route.local)
+    if (!local) {
+      refuse(
+        route,
+        route.id === input.main.id
+          ? 'TAKEOVER_INCOMPLETE_MAIN_SLOT'
+          : 'local_credential_unavailable',
+      )
+      continue
+    }
+    accounts.push({
+      id: route.id,
+      label: binding.label,
+      handle: binding.handle,
+      credentialId: binding.credentialId,
+      recordVersion: credential.recordVersion,
+      bindingPersisted: binding.source !== 'legacy',
+      localAuthFingerprint: localAuthFingerprint(local.access, local.refresh),
+      cacheCredential: credential,
+    })
+  }
+  const first = refusals.at(0)
+  if (first) {
+    throw new CustodyPreflightRefusedError(
+      first.accountId,
+      first.reason,
+      refusals.map(({ accountId: _, ...refusal }) => refusal),
+    )
+  }
+  return {
+    accounts,
+    toJSON: () => ({
+      accounts: accounts.map(
+        ({ id, credentialId, recordVersion, localAuthFingerprint }) => ({
+          id,
+          credentialId,
+          recordVersion,
+          localAuthFingerprint,
+        }),
+      ),
+    }),
+    toString: () => 'ClaustrumTakeoverPlan',
+  }
+}
+
+const startupVerdicts: Record<string, string> = {
+  'L|R|R|V': 'LOCAL_SERVE',
+  'L|R|R|N': 'LOCAL_SERVE',
+  'L|R|T|V': 'REMAIN_DARK_PENDING_LOGIN',
+  'L|R|T|N': 'REMAIN_DARK_PENDING_LOGIN',
+  'L|R|M|V': 'REMAIN_DARK_PENDING_LOGIN',
+  'L|R|M|N': 'REMAIN_DARK_PENDING_LOGIN',
+  'L|T|R|V': 'REMAIN_DARK_PENDING_LOGIN',
+  'L|T|R|N': 'REMAIN_DARK_PENDING_LOGIN',
+  'L|T|T|V': 'REMAIN_DARK_PENDING_LOGIN',
+  'L|T|T|N': 'REMAIN_DARK_PENDING_LOGIN',
+  'L|T|M|V': 'REMAIN_DARK_PENDING_LOGIN',
+  'L|T|M|N': 'REMAIN_DARK_PENDING_LOGIN',
+  'L|X|R|V': 'FAIL_CLOSED',
+  'L|X|R|N': 'FAIL_CLOSED',
+  'L|X|T|V': 'FAIL_CLOSED',
+  'L|X|T|N': 'FAIL_CLOSED',
+  'L|X|M|V': 'FAIL_CLOSED',
+  'L|X|M|N': 'FAIL_CLOSED',
+  'C|R|R|V': 'TAKEOVER_INCOMPLETE_MAIN_REAL',
+  'C|R|R|N': 'TAKEOVER_INCOMPLETE_VAULT_UNAVAILABLE',
+  'C|R|T|V': 'TAKEOVER_INCOMPLETE_MAIN_REAL',
+  'C|R|T|N': 'FAIL_CLOSED',
+  'C|R|M|V': 'TAKEOVER_INCOMPLETE_MAIN_REAL',
+  'C|R|M|N': 'FAIL_CLOSED',
+  'C|T|R|V': 'RESUME_TAKEOVER',
+  'C|T|R|N': 'FAIL_CLOSED',
+  'C|T|T|V': 'CLAUSTRUM_SERVE',
+  'C|T|T|N': 'FAIL_CLOSED',
+  'C|T|M|V': 'RESUME_TAKEOVER',
+  'C|T|M|N': 'FAIL_CLOSED',
+  'C|X|R|V': 'TAKEOVER_INCOMPLETE_SLOT_ABSENT',
+  'C|X|R|N': 'FAIL_CLOSED',
+  'C|X|T|V': 'TAKEOVER_INCOMPLETE_SLOT_ABSENT',
+  'C|X|T|N': 'FAIL_CLOSED',
+  'C|X|M|V': 'TAKEOVER_INCOMPLETE_SLOT_ABSENT',
+  'C|X|M|N': 'FAIL_CLOSED',
+}
+
+export function reconcileCustodyStartup(
+  input:
+    | {
+        mode: ModeDimension
+        main: MainDimension
+        fallbacks: FallbackDimension
+        evidence: EvidenceDimension
+      }
+    | {
+        mode: ModeDimension
+        mainSlot: 'unknown'
+        fallbacks: FallbackDimension
+        evidence: EvidenceDimension
+      },
+): { verdict: string; provisional?: boolean } {
+  if ('mainSlot' in input) {
+    const evidence = input.evidence === 'unknown' ? 'V' : input.evidence
+    const verdicts = new Set(
+      (['R', 'T', 'X'] as const).map(
+        (main) =>
+          startupVerdicts[
+            `${input.mode}|${main}|${input.fallbacks}|${evidence}`
+          ],
+      ),
+    )
+    if (verdicts.size === 1) {
+      const [verdict] = verdicts
+      return { verdict: verdict ?? 'FAIL_CLOSED', provisional: true }
+    }
+    return { verdict: 'PENDING_MAIN_SLOT', provisional: true }
+  }
+  const verdict =
+    startupVerdicts[
+      `${input.mode}|${input.main}|${input.fallbacks}|${input.evidence}`
+    ]
+  if (!verdict) throw new CustodyStateMismatchError('FAIL_CLOSED', input)
+  if (verdict === 'LOCAL_SERVE' || verdict === 'CLAUSTRUM_SERVE')
+    return { verdict }
+  throw new CustodyStateMismatchError(verdict, input)
+}
+
+export async function acquireCustodyTransitionLocks(input: {
+  storagePath: string
+  manifestPath: string
+  fallbackAccountIds: string[]
+  acquireTransition: (input: {
+    name: 'claustrum-mode-transition'
+    path: string
+  }) => Promise<Lock | null>
+  acquireManifest: (input: { path: string }) => Promise<Lock | null>
+  acquireRefresh: (input: {
+    name: string
+    path: string
+  }) => Promise<Lock | null>
+}): Promise<{ release: () => Promise<void> }> {
+  const locks: Lock[] = []
+  const acquire = async (name: string, getter: () => Promise<Lock | null>) => {
+    const lock = await getter()
+    if (!lock) throw new CustodyLockBusyError(name)
+    locks.push(lock)
+  }
+  try {
+    await acquire('claustrum-mode-transition', () =>
+      input.acquireTransition({
+        name: 'claustrum-mode-transition',
+        path: input.storagePath,
+      }),
+    )
+    await acquire('manifest', () =>
+      input.acquireManifest({ path: input.manifestPath }),
+    )
+    await acquire(OPENCODE_MAIN_OAUTH_REFRESH_LOCK, () =>
+      input.acquireRefresh({
+        name: OPENCODE_MAIN_OAUTH_REFRESH_LOCK,
+        path: input.storagePath,
+      }),
+    )
+    for (const id of [...input.fallbackAccountIds].sort())
+      await acquire(`${id}-refresh`, () =>
+        input.acquireRefresh({
+          name: `${id}-refresh`,
+          path: input.storagePath,
+        }),
+      )
+  } catch (error) {
+    await Promise.all(locks.reverse().map((lock) => lock.release()))
+    throw error
+  }
+  return {
+    release: async () => {
+      for (const lock of locks.reverse()) await lock.release()
+    },
+  }
+}
+
+export class CustodyTransitionError extends Error {
+  readonly code = 'custody_transition_failed'
+
+  constructor(
+    readonly stage:
+      | 'reverify_fingerprint'
+      | 'write_manifest'
+      | 'write_sidecar'
+      | 'readback'
+      | 'mode_commit'
+      | 'post_commit_readback',
+    readonly accountId?: string,
+    readonly guidance?: string,
+  ) {
+    super(
+      `${
+        accountId
+          ? `custody transition failed at ${stage} for account ${accountId}`
+          : `custody transition failed at ${stage}`
+      }${guidance ? ` — ${guidance}` : ''}`,
+    )
+  }
+
+  toJSON() {
+    return {
+      code: this.code,
+      stage: this.stage,
+      accountId: this.accountId,
+      guidance: this.guidance,
+    }
+  }
+}
+
+export class CustodyTransitionRollbackError extends Error {
+  readonly code = 'custody_transition_rollback_failed'
+
+  constructor() {
+    super('custody transition rollback failed')
+  }
+
+  toJSON() {
+    return { code: this.code }
+  }
+}
+
+export type CustodySidecarSnapshot = {
+  config: Uint8Array | null
+  state: Uint8Array | null
+  manifest?: Uint8Array | null
+}
+
+export type ExecuteClaustrumTakeoverDeps = {
+  locks: Parameters<typeof acquireCustodyTransitionLocks>[0]
+  getLocalAuth: (accountId: string) => Promise<unknown>
+  isCommitted: (plan: ClaustrumTakeoverPlan) => Promise<boolean>
+  snapshotSidecars: () => Promise<CustodySidecarSnapshot>
+  writeManifestBindings: (plan: ClaustrumTakeoverPlan) => Promise<void>
+  writeSidecarAccount: (
+    account: ClaustrumTakeoverPlan['accounts'][number],
+  ) => Promise<void>
+  verifyTarget: (plan: ClaustrumTakeoverPlan) => Promise<boolean>
+  verifyCommitted: (plan: ClaustrumTakeoverPlan) => Promise<boolean>
+  restoreSidecars: (snapshot: CustodySidecarSnapshot) => Promise<void>
+  verifyRollback: (snapshot: CustodySidecarSnapshot) => Promise<boolean>
+  setMode: (mode: 'claustrum' | 'local') => Promise<'changed' | 'unchanged'>
+}
+
+export async function executeClaustrumTakeover(
+  plan: ClaustrumTakeoverPlan,
+  deps: ExecuteClaustrumTakeoverDeps,
+): Promise<'changed' | 'unchanged'> {
+  const locks = await acquireCustodyTransitionLocks(deps.locks)
+  try {
+    if (await deps.isCommitted(plan)) return 'unchanged'
+
+    for (const account of plan.accounts) {
+      const current = await deps.getLocalAuth(account.id)
+      const local =
+        account.id === 'main'
+          ? oauthFingerprintMaterial(current)
+          : localOAuthMaterial(current)
+      if (
+        !local ||
+        localAuthFingerprint(local.access, local.refresh) !==
+          account.localAuthFingerprint
+      ) {
+        throw new CustodyTransitionError('reverify_fingerprint', account.id)
+      }
+    }
+
+    const snapshot = await deps.snapshotSidecars()
+    let accountId: string | undefined
+    let modeCommitted = false
+    try {
+      try {
+        await deps.writeManifestBindings(plan)
+      } catch {
+        throw new CustodyTransitionError('write_manifest')
+      }
+      for (const account of plan.accounts) {
+        if (account.id === 'main') continue
+        accountId = account.id
+        await deps.writeSidecarAccount(account)
+      }
+      if (!(await deps.verifyTarget(plan))) {
+        throw new CustodyTransitionError('readback', accountId)
+      }
+      try {
+        await deps.setMode('claustrum')
+        modeCommitted = true
+      } catch {
+        throw new CustodyTransitionError('mode_commit')
+      }
+      if (!(await deps.verifyCommitted(plan))) {
+        throw new CustodyTransitionError('post_commit_readback')
+      }
+      return 'changed'
+    } catch (error) {
+      if (modeCommitted) {
+        try {
+          await deps.setMode('local')
+        } catch {
+          throw new CustodyTransitionError(
+            'post_commit_readback',
+            undefined,
+            'mode is claustrum and unverified — run `/claude-account local`',
+          )
+        }
+      }
+      try {
+        await deps.restoreSidecars(snapshot)
+        if (!(await deps.verifyRollback(snapshot))) {
+          throw new CustodyTransitionRollbackError()
+        }
+      } catch (rollbackError) {
+        if (rollbackError instanceof CustodyTransitionRollbackError)
+          throw rollbackError
+        throw new CustodyTransitionRollbackError()
+      }
+      if (error instanceof CustodyTransitionError) throw error
+      throw new CustodyTransitionError('write_sidecar', accountId)
+    }
+  } finally {
+    await locks.release()
+  }
+}
+
+export function executeLocalExit(deps: {
+  path?: string
+  setMode?: (mode: 'local') => Promise<'changed' | 'unchanged'>
+}) {
+  return deps.setMode
+    ? deps.setMode('local')
+    : setClaustrumModePersistent('local', deps.path)
+}
diff --git a/packages/opencode/src/index.ts b/packages/opencode/src/index.ts
index 5822c771..4fc932d4 100644
--- a/packages/opencode/src/index.ts
+++ b/packages/opencode/src/index.ts
@@ -1,9 +1,11 @@
 import { randomUUID } from 'node:crypto'
 import {
+  type AccountCommandStatusProjection,
   type AccountStorage,
   type ApiKeyAccount,
   acquireRefreshFileLock,
   addAccountPersistent,
+  assertNotCustodyTombstone,
   authorize,
   buildAccountList,
   buildClaudeQuotaSummary,
@@ -30,16 +32,23 @@ import {
   CLAUDE_ROUTING_COMMAND_NAME,
   CLAUDE_START_COMMAND_NAME,
   type ClaustrumConnector,
+  type ClaustrumCredential,
   type ClaustrumCredentialCache,
   ClaustrumCredentialError,
   type ClaustrumReporterSource,
-  CustodyTombstoneRefreshError,
+  type CustodyHandleManifest,
+  CustodyHandleManifestReader,
+  type CustodyHandleResolution,
+  type CustodyStatusState,
+  CustodyTombstoneLoginError,
+  clearClaustrumHandlePersistent,
   clearClaustrumRefreshErrorPersistent,
   computeXxhash64Hex,
   configuredAnthropicOAuthAccountCount,
   connectClaustrumCredentialCache,
   createEmptyStorage,
   createStickyNoRouteResponse,
+  custodyCredentialId,
   type DumpHandle,
   decideStickyQuotaFailure,
   detectClaustrumConnection,
@@ -58,15 +67,18 @@ import {
   executeRoutingCommand,
   FALLBACK_BACKGROUND_TICK_MS,
   FallbackAccountManager,
+  fallbackAccountUuidForLineage,
   fetchOAuthAccountProfile,
   formatOAuthAccountTier,
   formatQuotaBackoffMessage,
   formatRefreshBackoffMessage,
+  getAccountStatePath,
   getAccountStoragePath,
   getCache1hMode,
   getCache1hPersistentMode,
   getCacheKeepWindow,
   getClaudeFableMythos5ReleaseDate,
+  getClaustrumMode,
   getDefaultCacheKeepRegistryDirectory,
   getFallbackReauthLabels,
   getKillswitchConfig,
@@ -93,7 +105,6 @@ import {
   isClaudeFable51Model,
   isClaudeFableOrMythos51Model,
   isClaudeOpus5Model,
-  isClaustrumEnabledForAccount,
   isCostZeroingEnabled,
   isCustodyTombstoneOAuth,
   isDumpPersistentlyEnabled,
@@ -102,10 +113,12 @@ import {
   isFastModeSupportedModel,
   isKillswitchEnabled,
   isOAuthAccount,
+  isOAuthAccountVaultOwned,
   isPermanentRefreshError,
   isPrimePersistentlyEnabled,
   isQuotaBearingHeaderFrame,
   isValidApiBaseURL,
+  isValidCustodyLabel,
   KILLSWITCH_COMMAND_NAME,
   killswitchPassesPolicy,
   killswitchRetryAfterSeconds,
@@ -126,6 +139,7 @@ import {
   type PrimeManagerOptions,
   type PrimeRefreshResult,
   type PrimeSendResult,
+  type ProviderAccountUuid,
   parseAccountCommandAction,
   parseCache1hCommandAction,
   parseCacheKeepCommandAction,
@@ -135,6 +149,7 @@ import {
   parseLoggingCommandAction,
   parsePrimeCommandAction,
   parseRoutingCommandAction,
+  persistFallbackQuotaHeaderPersistent,
   primeStorageFingerprint,
   QUOTA_HEADER_FEED_SCHEMA_VERSION,
   type QuotaAccountSummary,
@@ -153,6 +168,8 @@ import {
   removeAccountPersistent,
   reorderAccountsPersistent,
   resolveClaudeCodeIdentity,
+  resolveCustodyHandle,
+  resolveCustodyHandlesPath,
   STICKY_ROUTING_MAIN_ACCOUNT_ID,
   type StickyRouteCandidate,
   StickySessionRouter,
@@ -180,6 +197,7 @@ import {
   stickyQuotaSnapshotIsFresh,
   stickyRouteFamilyForModel,
   tokenFingerprint,
+  writeCustodyHandleManifestEntry,
 } from '@cortexkit/anthropic-auth-core'
 import type { Plugin } from '@opencode-ai/plugin'
 
@@ -196,6 +214,19 @@ import {
   summarizeCacheTtl,
   withStickyRetryAfter,
 } from './cache-diagnostics.ts'
+import {
+  custodyStateFor,
+  fallbackCustodyDimensions,
+  isFallbackAccountVaultServed,
+  mainCustodyDimension,
+} from './custody-dimensions.ts'
+import { runClaustrumTakeoverCommand } from './custody-live.ts'
+import {
+  CustodyStateMismatchError,
+  type MainCustodyRefusal,
+  OPENCODE_MAIN_OAUTH_REFRESH_LOCK,
+  reconcileCustodyStartup,
+} from './custody-mode.ts'
 import {
   EFFORT_PLAN_REQUEST_HEADER,
   EffortMarkerCorrelationError,
@@ -214,6 +245,16 @@ import {
   LANE_START_REQUEST_HEADER,
   LaneStartTracker,
 } from './lane-start.ts'
+import {
+  type AcknowledgeLocalOAuthLoginOptions,
+  acknowledgeLocalOAuthLogin,
+  acknowledgeLocalOAuthLoginFromStorage,
+  assertLocalLoginObservationAvailable,
+  type CompletedLocalLogin,
+  lastVaultServedRecordVersion,
+  localAuthFingerprint,
+  persistCustodyDivergenceState,
+} from './local-login.ts'
 import { adoptPrimeManager } from './prime-manager-registry.ts'
 import { resolvePromptContext } from './prompt-context.ts'
 import {
@@ -226,7 +267,7 @@ import {
   pushNotification,
 } from './rpc/notifications.ts'
 import {
-  type AccountDialogAccount,
+  type AccountDialogKnobs,
   type ApplyRequest,
   type ApplyResult,
   COMMAND_MODAL_NAMES,
@@ -669,6 +710,7 @@ type FableRequestContext = {
 
 type ClaustrumAccessResolution = {
   accessToken?: string
+  credentialAccountId?: ProviderAccountUuid
   served?: {
     accountId: string
     handle: string
@@ -687,12 +729,29 @@ type StickyOAuthRoute = {
 }
 
 type MainQuotaIdentityBinding = {
-  accountIdentity: string | undefined
+  quotaKey: string | undefined
+  providerAccountUuid?: ProviderAccountUuid
   generation: number
 }
 
 type MainQuotaIdentityResolution = MainQuotaIdentityBinding & {
+  providerAccountUuid: ProviderAccountUuid | undefined
   stale: boolean
+  state: CustodyStatusState
+}
+
+type ServedQuotaHeaders = {
+  accountId: 'main' | string
+  accessToken: string
+  authLineageId?: string
+  anthropicAccountUuid?: ProviderAccountUuid | null
+  mainQuotaIdentity?: MainQuotaIdentityBinding
+}
+
+function asProviderAccountUuid(
+  value: string | null | undefined,
+): ProviderAccountUuid | undefined {
+  return value as ProviderAccountUuid | undefined
 }
 
 const FABLE_SWITCHED_TO_OPUS_NOTICE =
@@ -855,12 +914,14 @@ function zeroModelCosts<T extends Record<string, AnthropicProviderModel>>(
 }
 
 type PluginRuntimeOverrides = Partial<{
+  authorize: typeof authorize
   setTimeout: typeof globalThis.setTimeout
   setInterval: typeof globalThis.setInterval
   clearInterval: typeof globalThis.clearInterval
   claustrumConnector: ClaustrumConnector
   claustrumNow: () => number
   clearClaustrumRefreshErrorPersistent: typeof clearClaustrumRefreshErrorPersistent
+  removeCustodyHandleManifestEntry: AcknowledgeLocalOAuthLoginOptions['remove']
 }>
 
 // Keep boot above the resident IPC fast path, but never let a stale-marked
@@ -922,6 +983,7 @@ const anthropicAuthPlugin = async (
   const clearClaustrumRefreshErrorPersistentImpl =
     runtimeOverrides.clearClaustrumRefreshErrorPersistent ??
     clearClaustrumRefreshErrorPersistent
+  const authorizeImpl = runtimeOverrides.authorize ?? authorize
   startEventLoopLagMonitor()
   const { client } = ctx
   const profileFetch = globalThis.fetch
@@ -1133,29 +1195,35 @@ const anthropicAuthPlugin = async (
 
   async function reconcileMainQuotaAccountIdentity(
     accessToken: string,
-    accountIdentity: string | undefined,
+    quotaKey: string | undefined,
+    providerAccountUuid?: ProviderAccountUuid,
   ): Promise<void> {
     if (
       mainQuotaIdentityAccessToken === accessToken &&
-      mainQuotaAccountId === accountIdentity
+      mainQuotaAccountId === quotaKey
     ) {
       return
     }
 
+    const providerIdentityChanged =
+      mainProviderAccountUuid !== undefined &&
+      providerAccountUuid !== undefined &&
+      mainProviderAccountUuid !== providerAccountUuid
     mainQuotaIdentityAccessToken = accessToken
-    mainQuotaAccountId = accountIdentity
+    mainQuotaAccountId = quotaKey
     const clearedGeneration = quotaManager.setMainQuotaAccountIdentity(
-      accountIdentity,
+      quotaKey,
       accessToken.startsWith('sk-ant-oat'),
+      providerIdentityChanged,
     )
-    if (accountIdentity === undefined) return
+    if (quotaKey === undefined) return
 
     const storage = await loadAccounts(accountStoragePath)
     const persistedError = storage?.quota?.mainLastQuotaApiError
     if (
       !storage ||
       !persistedError ||
-      persistedError.accountIdentity === accountIdentity ||
+      persistedError.accountIdentity === quotaKey ||
       (!accessToken.startsWith('sk-ant-oat') &&
         persistedError.accountIdentity === undefined)
     ) {
@@ -1175,49 +1243,125 @@ const anthropicAuthPlugin = async (
     await saveAccountState(storage, accountStoragePath, { mainQuota: true })
   }
 
+  async function persistFallbackAnthropicAccountUuid(
+    accountId: string,
+    anthropicAccountUuid: ProviderAccountUuid,
+  ): Promise<void> {
+    const storage = await loadAccounts(accountStoragePath)
+    const account = storage?.accounts.find(
+      (candidate): candidate is OAuthAccount =>
+        candidate.id === accountId && isOAuthAccount(candidate),
+    )
+    if (
+      !storage ||
+      !account ||
+      account.anthropicAccountUuid === anthropicAccountUuid
+    )
+      return
+    account.anthropicAccountUuid = anthropicAccountUuid
+    await saveAccountState(storage, accountStoragePath, {
+      accounts: [accountId],
+    })
+  }
+
   async function resolveMainQuotaAccountIdentity(
     accessToken: string,
     model?: string,
+    credentialAccountUuid?: string,
+    credentialRecordVersion?: number,
   ): Promise<MainQuotaIdentityResolution> {
-    const inFlight = mainQuotaIdentityResolutions.get(accessToken)
-    if (inFlight) return inFlight
+    const resolutionKey = accessToken
+    const inFlight = mainQuotaIdentityResolutions.get(resolutionKey)
+    if (inFlight) {
+      const resolved = await inFlight.promise
+      return credentialRecordVersion === inFlight.recordVersion
+        ? resolved
+        : { ...resolved, stale: true }
+    }
 
     const resolution = (async () => {
       const resolutionGeneration = ++mainQuotaIdentityResolutionGeneration
+      const mainSlotQuotaKey = mainAccountId
       const identity = await resolveClaudeCodeIdentity(
         accessToken,
         model,
-        mainAccountId,
+        credentialAccountUuid ?? mainSlotQuotaKey,
       )
-      // Adapters that do not use Claude's OAuth token format cannot be bootstrapped;
-      // keep the slot identity only for that compatibility path. Claude OAuth
-      // credentials use the oat prefix and stay unknown when bootstrap fails.
-      const quotaIdentity =
-        identity.accountUuid ??
-        (!accessToken.startsWith('sk-ant-oat') ? mainAccountId : undefined)
+      // Non-oat adapters retain their local slot for quota fencing, but it is
+      // not a provider identity and must never reach a provider-facing field.
+      const quotaKey = mainSlotQuotaKey
+      const currentStorage = await loadAccounts(accountStoragePath)
+      const persistedProviderAccountUuid =
+        currentStorage?.main?.profile?.providerAccountUuid ??
+        (currentStorage?.main?.profile?.accountIdentity as
+          | ProviderAccountUuid
+          | undefined)
+      const claimedProviderAccountUuid =
+        asProviderAccountUuid(credentialAccountUuid) ??
+        asProviderAccountUuid(identity.accountUuid)
+      const providerAccountUuid = credentialAccountUuid
+        ? claimedProviderAccountUuid
+        : accessToken.startsWith('sk-ant-oat')
+          ? (claimedProviderAccountUuid ??
+            asProviderAccountUuid(persistedProviderAccountUuid))
+          : undefined
+      const state: CustodyStatusState =
+        getClaustrumMode(currentStorage) !== 'claustrum'
+          ? 'na'
+          : persistedProviderAccountUuid === undefined ||
+              claimedProviderAccountUuid === undefined
+            ? 'unknown-identity'
+            : persistedProviderAccountUuid !== undefined &&
+                claimedProviderAccountUuid !== undefined &&
+                persistedProviderAccountUuid !== claimedProviderAccountUuid
+              ? 'on-identity-mismatch'
+              : 'on-vault-served'
       if (resolutionGeneration !== mainQuotaIdentityResolutionGeneration) {
         const identityChanged =
           mainQuotaIdentityAccessToken !== accessToken ||
-          mainQuotaAccountId !== quotaIdentity
+          mainQuotaAccountId !== quotaKey
         return {
-          accountIdentity: quotaIdentity,
+          quotaKey,
+          providerAccountUuid,
           generation: quotaManager.getMainQuotaIdentityGeneration(),
           stale: identityChanged,
+          state,
         }
       }
-      await reconcileMainQuotaAccountIdentity(accessToken, quotaIdentity)
+      await reconcileMainQuotaAccountIdentity(
+        accessToken,
+        quotaKey,
+        providerAccountUuid,
+      )
+      if (
+        accessToken.startsWith('sk-ant-oat') &&
+        providerAccountUuid === undefined
+      ) {
+        quotaManager.clearMain()
+      }
+      mainProviderAccountUuid = providerAccountUuid
+      if (accessToken.startsWith('sk-ant-oat')) {
+        mainServedAccessToken = accessToken
+      }
       return {
-        accountIdentity: quotaIdentity,
+        quotaKey,
+        providerAccountUuid,
         generation: quotaManager.getMainQuotaIdentityGeneration(),
         stale: false,
+        state,
       }
     })()
-    mainQuotaIdentityResolutions.set(accessToken, resolution)
+    mainQuotaIdentityResolutions.set(resolutionKey, {
+      promise: resolution,
+      recordVersion: credentialRecordVersion,
+    })
     try {
       return await resolution
     } finally {
-      if (mainQuotaIdentityResolutions.get(accessToken) === resolution) {
-        mainQuotaIdentityResolutions.delete(accessToken)
+      if (
+        mainQuotaIdentityResolutions.get(resolutionKey)?.promise === resolution
+      ) {
+        mainQuotaIdentityResolutions.delete(resolutionKey)
       }
     }
   }
@@ -1235,6 +1379,7 @@ const anthropicAuthPlugin = async (
     accountId: string,
     accountIdentity: string | undefined,
     accessToken: string,
+    providerAccountUuid?: ProviderAccountUuid,
     signal?: AbortSignal,
   ) {
     if (signal?.aborted) return undefined
@@ -1244,6 +1389,7 @@ const anthropicAuthPlugin = async (
       const fetchAttempt = fetchOAuthAccountProfile({
         accessToken,
         accountIdentity,
+        providerAccountUuid,
         fetchImpl: profileFetch,
         signal,
       })
@@ -1281,6 +1427,7 @@ const anthropicAuthPlugin = async (
   async function persistProfileStateBestEffort(input: {
     accountId: 'main' | string
     accountIdentity?: string
+    providerAccountUuid?: ProviderAccountUuid
     accessToken: string
     profile: OAuthAccount['profile']
   }): Promise<boolean | undefined> {
@@ -1306,6 +1453,7 @@ const anthropicAuthPlugin = async (
     storage: AccountStorage,
     mainAccessToken?: string,
     signal?: AbortSignal,
+    mainProviderAccountUuid?: ProviderAccountUuid,
   ): Promise<AccountStorage> {
     if (process.env.OPENCODE_ANTHROPIC_AUTH_DISABLE_PROFILE_HYDRATION === '1') {
       return storage
@@ -1315,12 +1463,14 @@ const anthropicAuthPlugin = async (
     if (
       mainAccessToken &&
       storage.main?.profile &&
-      !oauthProfileMatchesIdentity(storage.main.profile, mainIdentity)
+      mainProviderAccountUuid &&
+      storage.main.profile.providerAccountUuid !== mainProviderAccountUuid
     ) {
       storage.main.profile = undefined
       void persistProfileStateBestEffort({
         accountId: 'main',
         accountIdentity: mainIdentity,
+        providerAccountUuid: mainProviderAccountUuid,
         accessToken: mainAccessToken,
         profile: undefined,
       }).catch(() => {})
@@ -1338,6 +1488,7 @@ const anthropicAuthPlugin = async (
       void persistProfileStateBestEffort({
         accountId: 'main',
         accountIdentity: mainIdentity,
+        providerAccountUuid: mainProviderAccountUuid,
         accessToken: mainAccessToken,
         profile: storage.main.profile,
       }).catch(() => {})
@@ -1345,8 +1496,9 @@ const anthropicAuthPlugin = async (
     if (mainAccessToken && !oauthProfileIsFresh(storage.main?.profile, now)) {
       const profile = await hydrateProfileOnce(
         'main',
-        mainIdentity,
+        undefined,
         mainAccessToken,
+        mainProviderAccountUuid,
         signal,
       )
       if (profile) {
@@ -1358,6 +1510,7 @@ const anthropicAuthPlugin = async (
         void persistProfileStateBestEffort({
           accountId: 'main',
           accountIdentity: mainIdentity,
+          providerAccountUuid: mainProviderAccountUuid,
           accessToken: mainAccessToken,
           profile,
         }).catch(() => {})
@@ -1394,6 +1547,7 @@ const anthropicAuthPlugin = async (
         account.id,
         account.id,
         accessToken,
+        undefined,
         signal,
       )
       if (profile) {
@@ -1410,21 +1564,17 @@ const anthropicAuthPlugin = async (
   }
 
   const warnedQuotaNormalizeErrors = new Set<string>()
+  const warnedStaleFallbackQuotaPersists = new Set<string>()
 
   async function persistPushedQuota(
-    served: {
-      accountId: 'main' | string
-      accessToken: string
-      authLineageId?: string
-      mainQuotaIdentity?: MainQuotaIdentityBinding
-    },
+    served: ServedQuotaHeaders,
     entry: QuotaEntry,
   ): Promise<QuotaEntry | null> {
     const storage =
       (await loadAccounts(accountStoragePath)) ?? createEmptyStorage()
     if (served.accountId === 'main') {
-      const accountIdentity = served.mainQuotaIdentity?.accountIdentity
-      if (!accountIdentity || entry.quota.accountIdentity !== accountIdentity) {
+      const quotaKey = served.mainQuotaIdentity?.quotaKey
+      if (!quotaKey || entry.quota.accountIdentity !== quotaKey) {
         logger.trace(
           'quota',
           'skipped quota persistence without verified main account identity',
@@ -1434,14 +1584,14 @@ const anthropicAuthPlugin = async (
       storage.quota = storage.quota ?? {}
       storage.quota.mainQuota = {
         ...entry.quota,
-        accountIdentity,
+        accountIdentity: quotaKey,
       }
       storage.quota.mainQuotaCheckedAt = entry.checkedAt
       await saveAccountState(storage, accountStoragePath, { mainQuota: true })
       const reloaded = await loadAccounts(accountStoragePath)
       const persistedQuota = reloaded?.quota?.mainQuota
       const persistedQuotaBelongsToRequest = Boolean(
-        persistedQuota && persistedQuota.accountIdentity === accountIdentity,
+        persistedQuota && persistedQuota.accountIdentity === quotaKey,
       )
       const mergedQuota = persistedQuotaBelongsToRequest
         ? mergeHeaderQuotaForPersistence(persistedQuota, entry.quota)
@@ -1454,23 +1604,28 @@ const anthropicAuthPlugin = async (
           }
         : entry
     }
-    const account = storage.accounts.find(
-      (candidate): candidate is OAuthAccount =>
-        candidate.id === served.accountId && isOAuthAccount(candidate),
+    const persisted = await persistFallbackQuotaHeaderPersistent(
+      {
+        accountId: served.accountId,
+        authLineageId: served.authLineageId,
+        quota: entry.quota,
+        anthropicAccountUuid: served.anthropicAccountUuid ?? undefined,
+      },
+      accountStoragePath,
     )
-    if (!account) return null
-    // A lineage mismatch is a confirmed replacement; two absent markers remain
-    // legacy-compatible, while one-sided absence is too ambiguous to persist.
-    if (account.authLineageId !== served.authLineageId) {
-      logger.trace(
-        'quota',
-        'skipped stale fallback quota persistence after lineage change',
-        {
-          accountId: served.accountId,
-          storedLineage: account.authLineageId,
-          servedLineage: served.authLineageId,
-        },
-      )
+    if (!persisted) {
+      const key = `${served.accountId}:${served.authLineageId ?? ''}`
+      if (!warnedStaleFallbackQuotaPersists.has(key)) {
+        warnedStaleFallbackQuotaPersists.add(key)
+        logger.debug(
+          'quota',
+          'skipped stale fallback quota persistence after lineage change',
+          {
+            accountId: served.accountId,
+            servedLineage: served.authLineageId,
+          },
+        )
+      }
       // The persistence fence is authoritative; discard the optimistic cache
       // write unless a newer replacement observation already won the race.
       if (quotaManager.getAllFallbacks().get(served.accountId) === entry) {
@@ -1478,13 +1633,6 @@ const anthropicAuthPlugin = async (
       }
       return null
     }
-    account.quota = {
-      ...entry.quota,
-      accountIdentity: account.id,
-    }
-    await saveAccountState(storage, accountStoragePath, {
-      accounts: [served.accountId],
-    })
     return entry
   }
 
@@ -1520,18 +1668,11 @@ const anthropicAuthPlugin = async (
   }
 
   async function publishQuotaHeaderFeed(
-    served: {
-      accountId: 'main' | string
-      accessToken: string
-      mainQuotaIdentity?: MainQuotaIdentityBinding
-    },
+    served: ServedQuotaHeaders,
     entry: QuotaEntry,
   ): Promise<void> {
     if (!quotaHeaderFeedRegistry) return
-    if (
-      served.accountId === 'main' &&
-      !served.mainQuotaIdentity?.accountIdentity
-    ) {
+    if (served.accountId === 'main' && !served.mainQuotaIdentity?.quotaKey) {
       // Observed-at staleness exposes silence; an unknown key must not replace verified data.
       return
     }
@@ -1563,7 +1704,7 @@ const anthropicAuthPlugin = async (
     const accountKey =
       credentialId ??
       (served.accountId === 'main'
-        ? (served.mainQuotaIdentity?.accountIdentity ?? 'main')
+        ? (served.mainQuotaIdentity?.quotaKey ?? 'main')
         : served.accountId)
     const feedEntry: QuotaHeaderFeedPublishEntry = credentialId
       ? {
@@ -1573,17 +1714,19 @@ const anthropicAuthPlugin = async (
           provider: 'anthropic',
           configured_account_count: configuredAccountCount,
           observed_at_ms: observedAtMs,
+          anthropic_account_uuid: served.anthropicAccountUuid ?? null,
           quota,
           accountKey,
         }
-      : served.accountId === 'main' && served.mainQuotaIdentity?.accountIdentity
+      : served.accountId === 'main' && served.mainQuotaIdentity?.quotaKey
         ? {
             identity_source: 'account_ref',
-            account_ref: served.mainQuotaIdentity.accountIdentity,
+            account_ref: served.mainQuotaIdentity.quotaKey,
             schema_version: QUOTA_HEADER_FEED_SCHEMA_VERSION,
             provider: 'anthropic',
             configured_account_count: configuredAccountCount,
             observed_at_ms: observedAtMs,
+            anthropic_account_uuid: served.anthropicAccountUuid ?? null,
             quota,
             accountKey,
           }
@@ -1594,6 +1737,7 @@ const anthropicAuthPlugin = async (
               provider: 'anthropic',
               configured_account_count: configuredAccountCount,
               observed_at_ms: observedAtMs,
+              anthropic_account_uuid: served.anthropicAccountUuid ?? null,
               quota,
               accountKey,
             }
@@ -1604,6 +1748,7 @@ const anthropicAuthPlugin = async (
               provider: 'anthropic',
               configured_account_count: configuredAccountCount,
               observed_at_ms: observedAtMs,
+              anthropic_account_uuid: served.anthropicAccountUuid ?? null,
               quota,
               accountKey,
             }
@@ -1618,12 +1763,7 @@ const anthropicAuthPlugin = async (
 
   function harvestQuotaHeaders(
     headers: Headers,
-    served: {
-      accountId: 'main' | string
-      accessToken: string
-      authLineageId?: string
-      mainQuotaIdentity?: MainQuotaIdentityBinding
-    },
+    served: ServedQuotaHeaders,
   ): void {
     try {
       if (!isQuotaBearingHeaderFrame(headers)) {
@@ -1642,7 +1782,7 @@ const anthropicAuthPlugin = async (
             mainQuotaIdentity.generation
         ) {
           logger.trace('quota', 'discarded stale main quota headers', {
-            boundIdentity: mainQuotaIdentity?.accountIdentity,
+            boundIdentity: mainQuotaIdentity?.quotaKey,
             currentGeneration: quotaManager.getMainQuotaIdentityGeneration(),
           })
           return
@@ -1651,7 +1791,7 @@ const anthropicAuthPlugin = async (
       const entry =
         served.accountId === 'main'
           ? quotaManager.pushMainFromHeaders(
-              mainQuotaIdentity?.accountIdentity,
+              mainQuotaIdentity?.quotaKey,
               incoming,
             )
           : quotaManager.pushFallbackFromHeaders(served.accountId, incoming, {
@@ -1688,33 +1828,284 @@ const anthropicAuthPlugin = async (
   const claustrumReauthAccounts = new Set<string>()
   const claustrumWarmScheduled = new Set<string>()
   const claustrumWarmBackoffUntil = new Map<string, number>()
+  const custodyHandleManifestPath = resolveCustodyHandlesPath(
+    initialStorage?.claustrum,
+    process.env,
+  )
+  const custodyHandleManifestReader = new CustodyHandleManifestReader({
+    path: custodyHandleManifestPath,
+    provider: 'anthropic',
+    serve: 'anthropic-auth',
+  })
+  let custodyHandleManifest: CustodyHandleManifest | undefined
+  let custodyHandleManifestStatus: 'ready' | 'absent' | 'ignored' | 'invalid' =
+    'absent'
+  let custodyHandleManifestIgnoredReason:
+    | 'foreign-serve'
+    | 'missing-provider'
+    | undefined
+  const custodyHandleResolutionWarnings = new Set<string>()
   let claustrumConnectBackoffUntil = 0
-  const claustrumAccounts = initialStorage
-    ? initialStorage.accounts.filter(
-        (account): account is OAuthAccount =>
-          isOAuthAccount(account) &&
-          account.enabled !== false &&
-          Boolean(account.claustrumHandle) &&
-          isClaustrumEnabledForAccount(initialStorage, account.id),
-      )
-    : []
 
-  const isFallbackAccountVaultServed = (
+  function claimCustodyWarningSlot(accountId: string, reason: string) {
+    const key = `${accountId}\0${reason}`
+    if (custodyHandleResolutionWarnings.has(key)) return false
+    if (custodyHandleResolutionWarnings.size >= 256) {
+      const oldest = custodyHandleResolutionWarnings.values().next().value
+      if (oldest) custodyHandleResolutionWarnings.delete(oldest)
+    }
+    custodyHandleResolutionWarnings.add(key)
+    return true
+  }
+
+  function warnCustodyResolutionOnce(accountId: string, reason: string) {
+    if (!claimCustodyWarningSlot(accountId, reason)) return
+    logger.warn('claustrum', 'manifest handle resolution fallback', {
+      id: accountId,
+      reason,
+    })
+  }
+
+  async function refreshCustodyHandleManifest(): Promise<void> {
+    const result = await custodyHandleManifestReader.read()
+    custodyHandleManifestStatus = result.status
+    custodyHandleManifestIgnoredReason =
+      result.status === 'ignored' ? result.reason : undefined
+    custodyHandleManifest =
+      result.status === 'ready' ? result.manifest : undefined
+  }
+
+  function duplicateOAuthLabels(storage: AccountStorage): Set<string> {
+    const labels = new Map<string, number>()
+    for (const candidate of storage.accounts) {
+      if (!isOAuthAccount(candidate) || !candidate.label) continue
+      labels.set(candidate.label, (labels.get(candidate.label) ?? 0) + 1)
+    }
+    return new Set(
+      [...labels].filter(([, count]) => count > 1).map(([label]) => label),
+    )
+  }
+
+  function resolveAccountCustodyHandle(
+    account: OAuthAccount,
+    storage: AccountStorage,
+  ): CustodyHandleResolution {
+    const resolution = resolveCustodyHandle({
+      account,
+      manifest: custodyHandleManifest,
+      duplicateOAuthLabels: duplicateOAuthLabels(storage),
+    })
+    if (resolution.status === 'resolved' && resolution.source === 'manifest') {
+      custodyHandleResolutionWarnings.delete(`${account.id}\0legacy`)
+      return resolution
+    }
+    if (
+      custodyHandleManifestStatus === 'ignored' &&
+      custodyHandleManifestIgnoredReason === 'foreign-serve'
+    ) {
+      warnCustodyResolutionOnce(account.id, 'foreign-serve')
+      return { status: 'unresolved', reason: 'foreign-serve' }
+    } else if (custodyHandleManifestStatus === 'invalid') {
+      warnCustodyResolutionOnce(account.id, 'invalid-manifest')
+    } else if (
+      resolution.status === 'resolved' &&
+      resolution.source === 'legacy'
+    ) {
+      warnCustodyResolutionOnce(account.id, 'legacy')
+    }
+    return resolution
+  }
+
+  function mainCustodyAccount(auth: {
+    access?: string
+    refresh?: string
+    expires?: number
+  }): OAuthAccount {
+    return {
+      id: 'main',
+      label: 'main',
+      type: 'oauth',
+      refresh: auth.refresh ?? '',
+      access: auth.access,
+      expires: auth.expires,
+    }
+  }
+
+  async function acknowledgeMainLocalLogin(
+    getAuth: NonNullable<typeof latestGetAuth>,
+  ): Promise<void> {
+    const completion = completedLocalLogin
+    if (!completion) return
+    const storage = await loadAccounts(accountStoragePath)
+    if (getClaustrumMode(storage) !== 'local') return
+    const account = mainCustodyAccount(await getAuth().catch(() => ({})))
+    const resolution = storage
+      ? resolveAccountCustodyHandle(account, storage)
+      : { status: 'unresolved' as const, reason: 'missing-entry' as const }
+    if (resolution.status !== 'resolved' || resolution.source !== 'manifest') {
+      completedLocalLogin = undefined
+      return
+    }
+    const maxAttempts = 20
+    const intervalMs = 100
+    for (let attempt = 0; attempt < maxAttempts; attempt++) {
+      const observed = await getAuth().catch(() => undefined)
+      const result = await acknowledgeLocalOAuthLogin(completion, observed, {
+        manifestPath: custodyHandleManifestPath,
+        entry: {
+          label: 'main',
+          handle: resolution.handle,
+          credentialId: resolution.credentialId ?? custodyCredentialId('main'),
+        },
+        beforeRemove: async () => {
+          await persistCustodyDivergenceState(
+            getAccountStatePath(accountStoragePath),
+            completion.credentialId,
+            claustrumLastReportedVersion.get(resolution.handle) ?? 0,
+            Date.now(),
+          )
+        },
+        remove: runtimeOverrides.removeCustodyHandleManifestEntry,
+      })
+      if (result === 'cleared' || result === 'refused') {
+        completedLocalLogin = undefined
+        if (result === 'cleared') await refreshCustodyHandleManifest()
+        return
+      }
+      if (result === 'refused-transient') return
+      if (attempt + 1 < maxAttempts) {
+        await new Promise<void>((resolve) => {
+          const timer = runtimeTimers.setTimeout(resolve, intervalMs)
+          if (typeof timer === 'object' && timer && 'unref' in timer)
+            timer.unref()
+        })
+      }
+    }
+    completedLocalLogin = undefined
+    logger.warn('claustrum', 'local login observation exhausted', {
+      accountId: completion.accountId,
+      credentialId: completion.credentialId,
+      attempts: maxAttempts,
+      intervalMs,
+    })
+  }
+
+  function hasClaustrumIdentityMismatch(
+    account: OAuthAccount,
+    credential: ClaustrumCredential | undefined,
+  ): boolean {
+    return Boolean(
+      account.anthropicAccountUuid &&
+        credential?.accountId &&
+        account.anthropicAccountUuid !== credential.accountId,
+    )
+  }
+
+  function claustrumMainRefusal(state: MainCustodyRefusal): Response {
+    const error =
+      state === 'reauth'
+        ? {
+            code: 'claustrum_main_reauth',
+            retryable: false,
+            message:
+              'Claustrum main credential requires re-import; run ck auth import --replace.',
+          }
+        : state === 'takeover-incomplete'
+          ? {
+              code: 'TAKEOVER_INCOMPLETE_MAIN_REAL',
+              retryable: false,
+              message:
+                "Claustrum main binding is not active while local main material remains; onboard main into the vault with Claustrum's tooling first.",
+            }
+          : state === 'identity-mismatch'
+            ? {
+                code: 'claustrum_main_identity_mismatch',
+                retryable: false,
+                message:
+                  'Claustrum main credential identity differs from the persisted main identity; run ck auth set-identity.',
+              }
+            : {
+                code: 'claustrum_main_unavailable',
+                retryable: true,
+                message:
+                  'Claustrum main credential is cold; retry or run /claude-account local to leave custody and sign in again.',
+              }
+    return new Response(
+      JSON.stringify({ type: 'error', error: { type: 'api_error', ...error } }),
+      {
+        status: 503,
+        headers: { 'content-type': 'application/json' },
+      },
+    )
+  }
+
+  async function clearManifestResolvedLegacyHandle(
+    account: OAuthAccount,
+    resolution: CustodyHandleResolution,
+  ) {
+    if (
+      resolution.status !== 'resolved' ||
+      resolution.source !== 'manifest' ||
+      !account.claustrumHandle
+    ) {
+      return
+    }
+    await clearClaustrumHandlePersistent({
+      id: account.id,
+      path: accountStoragePath,
+    })
+    delete account.claustrumHandle
+  }
+
+  function warnManifestStateHandleClearOnce(accountId: string) {
+    const reason = 'manifest-state-clear-failed'
+    if (!claimCustodyWarningSlot(accountId, reason)) return
+    logger.warn(
+      'claustrum',
+      'failed to clear legacy handle after manifest resolution',
+      { id: accountId, reason },
+    )
+  }
+
+  function claustrumAccounts(storage: AccountStorage): OAuthAccount[] {
+    return storage.accounts.filter(
+      (account): account is OAuthAccount =>
+        isOAuthAccount(account) &&
+        isOAuthAccountVaultOwned(
+          storage,
+          account,
+          resolveAccountCustodyHandle(account, storage),
+        ),
+    )
+  }
+
+  const custodyDimensionsDeps = {
+    getCache: () => claustrumCredentialCache,
+    now: () => claustrumNow(),
+    resolveAccountCustodyHandle,
+    usableAccessToken: usableClaustrumAccessToken,
+    hasIdentityMismatch: hasClaustrumIdentityMismatch,
+    isBlocked: (accountId: string) => claustrumBlockedAccounts.has(accountId),
+    isReauth: (accountId: string) => claustrumReauthAccounts.has(accountId),
+    getManifest: () => custodyHandleManifest,
+  }
+
+  const fallbackCustodyStateFor = (
     accountId: string,
     storage: Awaited<ReturnType<typeof loadAccounts>>,
-  ): boolean => {
-    if (!storage || claustrumBlockedAccounts.has(accountId)) return false
-    if (!isClaustrumEnabledForAccount(storage, accountId)) return false
-    const account = storage.accounts.find(
-      (candidate): candidate is OAuthAccount =>
-        candidate.id === accountId &&
-        candidate.enabled !== false &&
-        isOAuthAccount(candidate),
+    vaultServed = isFallbackAccountVaultServed(
+      accountId,
+      storage,
+      custodyDimensionsDeps,
+    ),
+  ): Exclude<CustodyStatusState, 'na'> => {
+    const state = custodyStateFor(
+      { id: accountId, role: 'fallback' },
+      storage,
+      custodyDimensionsDeps,
+      vaultServed,
     )
-    const handle = account?.claustrumHandle
-    if (!handle) return false
-    const cached = claustrumCredentialCache?.peek(handle)
-    return Boolean(cached && usableClaustrumAccessToken(cached, claustrumNow()))
+    return state === 'na' ? 'off' : state
   }
 
   function claustrumWarmBackoffActive(handle: string): boolean {
@@ -1732,29 +2123,24 @@ const anthropicAuthPlugin = async (
     storage: Awaited<ReturnType<typeof loadAccounts>>,
     options?: { warm?: boolean },
   ): ClaustrumAccessResolution {
-    const handle = account.claustrumHandle
+    if (!storage) return { accessToken: account.access }
+    const custodyHandle = resolveAccountCustodyHandle(account, storage)
+    const handle =
+      custodyHandle.status === 'resolved' ? custodyHandle.handle : undefined
+    if (getClaustrumMode(storage) === 'claustrum' && !handle) return {}
     if (
       !handle ||
-      !storage ||
-      !isClaustrumEnabledForAccount(storage, account.id) ||
+      !isOAuthAccountVaultOwned(storage, account, custodyHandle) ||
       claustrumBlockedAccounts.has(account.id)
     ) {
       return { accessToken: account.access }
     }
 
     const cache = claustrumCredentialCache
-    if (!cache) {
-      if (
-        account.access &&
-        account.expires !== undefined &&
-        account.expires > claustrumNow()
-      ) {
-        return { accessToken: account.access }
-      }
-      return {}
-    }
+    if (!cache) return {}
 
     const cached = cache.peek(handle)
+    if (hasClaustrumIdentityMismatch(account, cached)) return {}
     const cachedAccess = usableClaustrumAccessToken(cached, claustrumNow())
     if (cached && cachedAccess) {
       // Claustrum record_version is monotonic per handle: refresh_commit and
@@ -1774,6 +2160,7 @@ const anthropicAuthPlugin = async (
           handle,
           recordVersion: cached.recordVersion,
         },
+        credentialAccountId: asProviderAccountUuid(cached.accountId),
       }
     }
 
@@ -1781,13 +2168,6 @@ const anthropicAuthPlugin = async (
     if (options?.warm !== false && !claustrumWarmBackoffActive(handle)) {
       scheduleClaustrumWarm(account.id, handle)
     }
-    if (
-      account.access &&
-      account.expires !== undefined &&
-      account.expires > claustrumNow()
-    ) {
-      return { accessToken: account.access }
-    }
     return {}
   }
 
@@ -1835,17 +2215,23 @@ const anthropicAuthPlugin = async (
 
   const fallbackManager = new FallbackAccountManager({
     quotaManager,
-    isFallbackAccountVaultServed,
+    isFallbackAccountVaultServed: (accountId, storage) =>
+      isFallbackAccountVaultServed(accountId, storage, custodyDimensionsDeps),
     resolveFallbackAccessToken,
     isFallbackAccountVaultEnabled: (accountId, storage) => {
-      if (!isClaustrumEnabledForAccount(storage, accountId)) return false
       const account = storage.accounts.find(
         (candidate): candidate is OAuthAccount =>
           candidate.id === accountId && isOAuthAccount(candidate),
       )
-      return account?.enabled !== false && Boolean(account?.claustrumHandle)
+      if (!account) return false
+      const binding = resolveAccountCustodyHandle(account, storage)
+      return (
+        binding.status === 'resolved' &&
+        (getClaustrumMode(storage) === 'claustrum' ||
+          binding.source === 'manifest')
+      )
     },
-    onBackgroundRefresh: refreshVaultBackedFallbacks,
+    onBackgroundRefresh: refreshVaultBackedOAuthAccounts,
     setIntervalImpl: runtimeTimers.setInterval,
     clearIntervalImpl: runtimeTimers.clearInterval,
     onFallbackStorageChanged: () => {
@@ -1960,101 +2346,129 @@ const anthropicAuthPlugin = async (
     }
   }
 
-  async function refreshVaultBackedFallbacks(initial = false): Promise<void> {
+  async function getStartupWarmCredential(
+    cache: ClaustrumCredentialCache,
+    handle: string,
+    minTtlMs: number,
+  ): Promise<ClaustrumCredential | undefined> {
+    let resolveTimeout!: () => void
+    const timeout = new Promise<undefined>((resolve) => {
+      resolveTimeout = () => resolve(undefined)
+    })
+    const timer = globalThis.setTimeout(
+      resolveTimeout,
+      CLAUSTRUM_WARMUP_TIMEOUT_MS,
+    )
+    if (typeof timer === 'object' && timer && 'unref' in timer) timer.unref()
+    try {
+      return await Promise.race([cache.get(handle, minTtlMs), timeout])
+    } finally {
+      globalThis.clearTimeout(timer)
+    }
+  }
+
+  async function refreshVaultBackedOAuthAccounts(
+    initial = false,
+  ): Promise<void> {
+    await refreshCustodyHandleManifest()
     let cache = claustrumCredentialCache
     const storage = await loadAccounts(accountStoragePath)
     if (!storage) return
     const minTtlMs = getRefreshBeforeExpiryMs(storage) + 30 * 60_000
     let sidebarChanged = false
 
+    const mainAuth =
+      getClaustrumMode(storage) === 'claustrum' && latestGetAuth
+        ? await latestGetAuth().catch(() => undefined)
+        : undefined
+    if (mainAuth?.type === 'oauth') {
+      const main = mainCustodyAccount(mainAuth)
+      const mainBinding = resolveAccountCustodyHandle(main, storage)
+      if (isOAuthAccountVaultOwned(storage, main, mainBinding)) {
+        const handle =
+          mainBinding.status === 'resolved' ? mainBinding.handle : undefined
+        if (handle) {
+          if (!cache) cache = await ensureClaustrumCredentialCache()
+          if (cache) {
+            try {
+              const credential = initial
+                ? await getStartupWarmCredential(cache, handle, minTtlMs)
+                : await cache.get(handle, minTtlMs)
+              if (usableClaustrumAccessToken(credential, claustrumNow())) {
+                await markClaustrumCredentialReady('main', handle)
+              }
+            } catch (error) {
+              handleClaustrumCredentialError('main', error, handle)
+            }
+          }
+        }
+      }
+    }
+
     for (const account of storage.accounts) {
-      if (
-        account.enabled === false ||
-        !isOAuthAccount(account) ||
-        !account.claustrumHandle ||
-        !isClaustrumEnabledForAccount(storage, account.id)
-      )
-        continue
-      const handle = account.claustrumHandle
+      if (account.enabled === false || !isOAuthAccount(account)) continue
+      const custodyHandle = resolveAccountCustodyHandle(account, storage)
+      if (!isOAuthAccountVaultOwned(storage, account, custodyHandle)) continue
+      if (custodyHandle.status !== 'resolved') continue
+      const handle = custodyHandle.handle
       if (!cache) cache = await ensureClaustrumCredentialCache()
       if (
         initial &&
         cache &&
         usableClaustrumAccessToken(cache.peek(handle), claustrumNow())
       ) {
-        continue
-      }
-      const sidecarNearExpiry =
-        !account.access ||
-        !account.expires ||
-        account.expires - claustrumNow() <= getRefreshBeforeExpiryMs(storage)
-      const custodyOverrideRefresh = async (reason: string) => {
-        if (
-          refreshBackoffActive(
-            account.lastRefreshError,
-            account.id,
-            claustrumNow(),
-            account.refresh ? tokenFingerprint(account.refresh) : undefined,
-          )
-        ) {
-          return
-        }
-        logger.warn('refresh', 'custody override: local fallback refresh', {
-          accountId: account.id,
-          reason,
-        })
-        await fallbackManager
-          .refreshAccount(account, storage, { persistError: true })
-          .catch((error) => {
-            logger.warn('refresh', 'custody override local refresh failed', {
-              accountId: account.id,
-              error: error instanceof Error ? error.message : String(error),
-            })
-          })
-      }
-      if (!cache) {
-        if (sidecarNearExpiry) {
-          await custodyOverrideRefresh('vault unavailable')
-        }
-        continue
-      }
-      if (initial && !cache.peek(handle)) {
-        if (sidecarNearExpiry) {
-          await custodyOverrideRefresh('vault warmup pending')
-          sidebarChanged = true
+        try {
+          await clearManifestResolvedLegacyHandle(account, custodyHandle)
+        } catch {
+          warnManifestStateHandleClearOnce(account.id)
         }
         continue
       }
+      if (!cache) continue
       try {
-        const credential = await cache.get(handle, minTtlMs)
+        const credential = initial
+          ? await getStartupWarmCredential(cache, handle, minTtlMs)
+          : await cache.get(handle, minTtlMs)
         if (!usableClaustrumAccessToken(credential, claustrumNow())) {
-          log('[refresh] vault fallback credential unusable', {
-            accountId: account.id,
-            handle,
-            minTtlMs,
+          logger.debug('refresh', 'vault fallback credential unusable', {
+            id: account.id,
+            reason: 'unusable',
           })
-          if (sidecarNearExpiry) {
-            await custodyOverrideRefresh('vault credential unavailable')
-          }
         } else {
+          try {
+            await clearManifestResolvedLegacyHandle(account, custodyHandle)
+          } catch {
+            warnManifestStateHandleClearOnce(account.id)
+          }
           await markClaustrumCredentialReady(account.id, handle)
         }
         sidebarChanged = true
       } catch (error) {
         handleClaustrumCredentialError(account.id, error, handle)
         sidebarChanged = true
-        const action =
-          error instanceof ClaustrumCredentialError ? error.action : 'retry'
-        if (action === 'reauth' || sidecarNearExpiry) {
-          await custodyOverrideRefresh(
-            action === 'reauth' ? 'vault reauth' : 'vault unavailable',
-          )
-        }
       }
     }
     if (sidebarChanged) void refreshSidebarQuota().catch(() => {})
   }
-  if (claustrumAccounts.length > 0) {
+  await refreshCustodyHandleManifest()
+  const startupClaustrumAccounts = initialStorage
+    ? claustrumAccounts(initialStorage)
+    : []
+  const startupDuplicateOAuthLabels = initialStorage
+    ? duplicateOAuthLabels(initialStorage)
+    : new Set<string>()
+  if (initialStorage) {
+    for (const label of startupDuplicateOAuthLabels) {
+      logger.warn(
+        'claustrum',
+        'skipping legacy handle migration for duplicate label',
+        {
+          label,
+        },
+      )
+    }
+  }
+  if (startupClaustrumAccounts.length > 0) {
     try {
       const claustrumIdentity = {
         project_root: ctx.directory ?? process.cwd(),
@@ -2078,12 +2492,47 @@ const anthropicAuthPlugin = async (
         // refreshes asynchronously, so an expiry-skew vault refresh cannot
         // delay a response.
         const warmup = Promise.all(
-          claustrumAccounts.map(async (account) => {
-            const handle = account.claustrumHandle
-            if (!handle) return
+          startupClaustrumAccounts.map(async (account) => {
+            const startupStorage = initialStorage
+            if (!startupStorage) return
+            const custodyHandle = resolveAccountCustodyHandle(
+              account,
+              startupStorage,
+            )
+            if (custodyHandle.status !== 'resolved') return
+            const handle = custodyHandle.handle
             try {
               const credential = await cache.get(handle)
               if (usableClaustrumAccessToken(credential, claustrumNow())) {
+                if (
+                  custodyHandle.source === 'legacy' &&
+                  custodyHandleManifestStatus === 'ready' &&
+                  account.label &&
+                  !startupDuplicateOAuthLabels.has(account.label) &&
+                  // Refuse malformed labels before taking the cross-tenant lock.
+                  isValidCustodyLabel(account.label)
+                ) {
+                  const write = await writeCustodyHandleManifestEntry({
+                    path: custodyHandleManifestPath,
+                    entry: {
+                      label: account.label,
+                      handle,
+                      credentialId: custodyCredentialId(account.label),
+                    },
+                  })
+                  if (write.status === 'written') {
+                    await clearClaustrumHandlePersistent({
+                      id: account.id,
+                      path: accountStoragePath,
+                    })
+                    await refreshCustodyHandleManifest()
+                  } else if (write.status === 'refused') {
+                    logger.warn('commands', 'manifest write failed', {
+                      id: account.id,
+                      reason: write.reason,
+                    })
+                  }
+                }
                 await markClaustrumCredentialReady(account.id, handle)
               }
             } catch (error) {
@@ -2106,7 +2555,7 @@ const anthropicAuthPlugin = async (
         await Promise.race([warmup, timeout])
         if (timedOut) {
           logger.warn('claustrum', 'credential warmup timed out', {
-            accounts: claustrumAccounts.length,
+            accounts: startupClaustrumAccounts.length,
             timeoutMs: CLAUSTRUM_WARMUP_TIMEOUT_MS,
           })
         }
@@ -2118,7 +2567,25 @@ const anthropicAuthPlugin = async (
       claustrumCredentialCache = null
     }
   }
-  const fallbackRefreshReady = fallbackManager.startBackgroundRefresh()
+  const fallbackDimensions = fallbackCustodyDimensions(initialStorage, {
+    ...custodyDimensionsDeps,
+    construction: true,
+  })
+  const provisionalCustody = reconcileCustodyStartup({
+    mode: getClaustrumMode(initialStorage) === 'claustrum' ? 'C' : 'L',
+    mainSlot: 'unknown',
+    ...fallbackDimensions,
+  })
+  // Vault residency is route-local: only real or unbound fallback material is
+  // structurally unsafe before the loader has a main slot.
+  const fallbackRefreshStructuralDark =
+    getClaustrumMode(initialStorage) === 'claustrum' &&
+    provisionalCustody.provisional === true &&
+    (fallbackDimensions.fallbacks === 'M' ||
+      fallbackDimensions.fallbacks === 'R')
+  const fallbackRefreshReady = fallbackRefreshStructuralDark
+    ? Promise.resolve('not-started')
+    : fallbackManager.startBackgroundRefresh()
   const cacheDiagnosticsTracker = new CacheDiagnosticsTracker()
   const cacheDiagnosticsBetaTracker = new CacheDiagnosticsBetaTracker()
   type CacheDiagnosticsResponse = {
@@ -2927,38 +3394,48 @@ const anthropicAuthPlugin = async (
           (account): account is OAuthAccount =>
             account.enabled !== false && isOAuthAccount(account),
         )
-        .map((account) => ({
-          id: account.id,
-          label: account.label,
-          tierLabel: formatOAuthAccountTier(account.profile),
-          // Token-aware read: if a fallback account was re-logged with the same
-          // id/label, an old in-memory quota snapshot must not be shown as the
-          // new account's quota.
-          quota: options.skipFallbackQuotaSeed
-            ? null
-            : account.access
-              ? (quotaManager.getFallback(account.id, account)?.quota ?? null)
-              : null,
-          // A fallback with a permanently-dead refresh token (400 invalid_grant)
-          // is dropped by getUsableFallbackAccounts and silently degrades to
-          // main — surface it as "needs re-login". Only flag truly-dead tokens
-          // whose backoff is still active, not transient (429/5xx) backoff.
-          needsReauth:
-            account.lastRefreshError != null &&
-            refreshBackoffActive(
-              account.lastRefreshError,
-              account.id,
-              Date.now(),
-              tokenFingerprint(account.refresh),
-            ) &&
-            isPermanentRefreshError(account.lastRefreshError),
-          vaultReauth:
-            claustrumReauthAccounts.has(account.id) &&
-            Boolean(
-              account.access && account.expires && account.expires > Date.now(),
-            ),
-          enabled: account.enabled !== false,
-        })),
+        .map((account) => {
+          const vaultServed = isFallbackAccountVaultServed(
+            account.id,
+            storage,
+            custodyDimensionsDeps,
+          )
+          const custodyState = fallbackCustodyStateFor(
+            account.id,
+            storage,
+            vaultServed,
+          )
+          return {
+            id: account.id,
+            label: account.label,
+            tierLabel: formatOAuthAccountTier(account.profile),
+            // Token-aware read: if a fallback account was re-logged with the same
+            // id/label, an old in-memory quota snapshot must not be shown as the
+            // new account's quota.
+            quota: options.skipFallbackQuotaSeed
+              ? null
+              : account.access
+                ? (quotaManager.getFallback(account.id, account)?.quota ?? null)
+                : null,
+            // A fallback with a permanently-dead refresh token (400 invalid_grant)
+            // is dropped by getUsableFallbackAccounts and silently degrades to
+            // main — surface it as "needs re-login". Only flag truly-dead tokens
+            // whose backoff is still active, not transient (429/5xx) backoff.
+            needsReauth:
+              account.lastRefreshError != null &&
+              refreshBackoffActive(
+                account.lastRefreshError,
+                account.id,
+                Date.now(),
+                tokenFingerprint(account.refresh),
+              ) &&
+              isPermanentRefreshError(account.lastRefreshError),
+            vaultReauth: custodyState === 'on-vault-reauth',
+            vaultServed,
+            custodyState,
+            enabled: account.enabled !== false,
+          }
+        }),
       activeId: options.activeId,
       route: options.route,
       relay: (() => {
@@ -3050,17 +3527,35 @@ const anthropicAuthPlugin = async (
   // Re-write the sidebar using the LAST known routing decision, refreshing only
   // the quota numbers. Used by async quota refreshes (main + background fallback)
   // so they never clobber the active account back to 'main'.
-  async function refreshSidebarQuota() {
+  async function resolveSidebarQuotaAccess() {
     const storage = await loadAccounts(accountStoragePath)
     let access: string | undefined
     if (latestGetAuth) {
       try {
         const auth = await latestGetAuth()
-        access = auth.access
+        const mainBinding =
+          auth.type === 'oauth' &&
+          getClaustrumMode(storage) === 'claustrum' &&
+          storage
+            ? resolveAccountCustodyHandle(mainCustodyAccount(auth), storage)
+            : undefined
+        if (mainBinding?.status === 'resolved') {
+          access = usableClaustrumAccessToken(
+            claustrumCredentialCache?.peek(mainBinding.handle),
+            claustrumNow(),
+          )
+        }
+        access ??= auth.access
       } catch {
         // best-effort
       }
     }
+    access ??= mainServedAccessToken
+    return { storage, access }
+  }
+
+  async function refreshSidebarQuota() {
+    const { storage, access } = await resolveSidebarQuotaAccess()
     writeSidebarState(storage, {
       activeId: lastSidebarRouting.activeId,
       route: lastSidebarRouting.route,
@@ -3077,14 +3572,13 @@ const anthropicAuthPlugin = async (
   ) {
     if (!accessToken) return
     if (storage?.quota?.enabled !== true) return
-    const accountIdentity =
-      mainQuotaIdentity?.accountIdentity ?? mainQuotaAccountId
-    if (quotaManager.getMain(accountIdentity)) return
+    const quotaKey = mainQuotaIdentity?.quotaKey ?? mainQuotaAccountId
+    if (quotaManager.getMain(quotaKey)) return
     if (sidebarMainQuotaRefreshInFlight) return
 
     sidebarMainQuotaRefreshInFlight = true
     void quotaManager
-      .refreshMain(accountIdentity, accessToken, mainQuotaIdentity?.generation)
+      .refreshMain(quotaKey, accessToken, mainQuotaIdentity?.generation)
       .then(() => refreshSidebarQuota())
       .catch(() => {})
       .finally(() => {
@@ -3100,13 +3594,20 @@ const anthropicAuthPlugin = async (
         expires?: number
       }>)
     | null = null
+  let completedLocalLogin: CompletedLocalLogin | undefined
+  let custodyStartupMismatchVerdict: string | undefined
   let mainAccountId: string | undefined
   let mainQuotaAccountId: string | undefined
+  let mainServedAccessToken: string | undefined
+  let mainProviderAccountUuid: ProviderAccountUuid | undefined
   let mainQuotaIdentityAccessToken: string | undefined
   let mainQuotaIdentityResolutionGeneration = 0
   const mainQuotaIdentityResolutions = new Map<
     string,
-    Promise<MainQuotaIdentityResolution>
+    {
+      promise: Promise<MainQuotaIdentityResolution>
+      recordVersion?: number
+    }
   >()
   let sidebarMainQuotaRefreshInFlight = false
   let mainBackgroundRefreshTimer: ReturnType<typeof setInterval> | null = null
@@ -3189,14 +3690,14 @@ const anthropicAuthPlugin = async (
       try {
         const auth = await latestGetAuth()
         if (auth.type === 'oauth' && auth.access) {
-          mainAccessToken = auth.access
-          await resolveMainQuotaAccountIdentity(auth.access)
+          mainAccessToken = mainServedAccessToken ?? auth.access
+          await resolveMainQuotaAccountIdentity(mainAccessToken)
           // /claude-quota is a manual action: force a real fetch instead of
           // returning the cache. refreshMain still respects 429 backoff — it
           // returns the last cached snapshot when the API is backed off.
           const quota = await quotaManager.refreshMain(
             mainQuotaAccountId,
-            auth.access,
+            mainAccessToken,
           )
           accounts.push({
             name: 'OpenCode anthropic',
@@ -3233,6 +3734,7 @@ const anthropicAuthPlugin = async (
       storage ?? createEmptyStorage(),
       mainAccessToken,
       AbortSignal.timeout(3_000),
+      mainProviderAccountUuid,
     )
     const mainSummary = accounts.find((account) => account.role === 'main')
     if (mainSummary) {
@@ -3807,7 +4309,12 @@ const anthropicAuthPlugin = async (
 
     // -- add-oauth-start ---------------------------------------------------
     if (action.type === 'add-oauth-start') {
-      const authResult = await authorize('max')
+      if (
+        getClaustrumMode(await loadAccounts(accountStoragePath)) === 'claustrum'
+      ) {
+        throw new Error('Exit Claustrum mode first: /claude-account local')
+      }
+      const authResult = await authorizeImpl('max')
       const entry: OAuthPendingEntry = {
         state: authResult.state,
         verifier: authResult.verifier,
@@ -3875,6 +4382,49 @@ const anthropicAuthPlugin = async (
           lastRefreshedAt: now,
         }
         await addAccountPersistent(account, accountStoragePath)
+        const freshStorage = await loadAccounts(accountStoragePath)
+        const fallbackBinding = freshStorage
+          ? resolveAccountCustodyHandle(account, freshStorage)
+          : { status: 'unresolved' as const, reason: 'missing-entry' as const }
+        const fallbackHandle =
+          fallbackBinding.status === 'resolved' &&
+          fallbackBinding.source === 'manifest'
+            ? fallbackBinding.handle
+            : undefined
+        await acknowledgeLocalOAuthLoginFromStorage(
+          {
+            accountId: account.id,
+            credentialId: custodyCredentialId(account.label ?? account.id),
+            authFingerprint: localAuthFingerprint(
+              result.access,
+              result.refresh,
+            ),
+            completedAt: now,
+          },
+          {
+            accountStoragePath,
+            manifestPath: custodyHandleManifestPath,
+            divergence: {
+              statePath: getAccountStatePath(accountStoragePath),
+              lastVaultServedRecordVersion: lastVaultServedRecordVersion({
+                accountId: account.id,
+                servedVersion: fallbackHandle
+                  ? claustrumLastReportedVersion.get(fallbackHandle)
+                  : undefined,
+                cacheVersion: fallbackHandle
+                  ? claustrumCredentialCache?.peek(fallbackHandle)
+                      ?.recordVersion
+                  : undefined,
+                warn: (accountId) =>
+                  logger.warn(
+                    'claustrum',
+                    'fallback login had no served vault record',
+                    { accountId },
+                  ),
+              }),
+            },
+          },
+        )
         logger.info('commands', 'account added', {
           id: account.id,
           label: account.label,
@@ -3907,24 +4457,60 @@ const anthropicAuthPlugin = async (
       if (latestGetAuth) {
         try {
           const auth = await latestGetAuth()
-          if (auth.type === 'oauth') mainAccessToken = auth.access
+          if (auth.type === 'oauth')
+            mainAccessToken = mainServedAccessToken ?? auth.access
         } catch {}
       }
       storage = await ensureProfilesForQuotaDisplay(
         storage,
         mainAccessToken,
         AbortSignal.timeout(3_000),
+        mainProviderAccountUuid,
       )
     }
-    const result = executeAccountCommand({
+    const statusProjection =
+      action.type === 'status'
+        ? ((await buildAccountDialogProjection(
+            storage,
+          )) satisfies AccountCommandStatusProjection)
+        : undefined
+    const result = await executeAccountCommand({
       argumentsText,
       storage: storage ?? { version: 1, accounts: [] },
+      path: accountStoragePath,
       claustrum:
-        action.type === 'status'
+        action.type === 'status' && !statusProjection
           ? await detectClaustrumConnection(
               getConfiguredClaustrumConnectionFile(),
             )
           : undefined,
+      statusProjection,
+      resolveCustodyBinding:
+        action.type === 'status'
+          ? (account) =>
+              isOAuthAccount(account)
+                ? resolveAccountCustodyHandle(
+                    account,
+                    storage ?? createEmptyStorage(),
+                  )
+                : { status: 'unresolved', reason: 'missing-entry' }
+          : undefined,
+      transition: async (mode) => {
+        return runClaustrumTakeoverCommand(
+          {
+            storagePath: accountStoragePath,
+            loadStorage: () => loadAccounts(accountStoragePath),
+            getCache: async () =>
+              claustrumCredentialCache ?? ensureClaustrumCredentialCache(),
+            latestGetAuth: latestGetAuth ?? undefined,
+            now: claustrumNow,
+            fallbackManager,
+            refreshManifest: refreshCustodyHandleManifest,
+            debug: (message) => logger.debug('claustrum', message),
+          },
+          mode,
+        )
+      },
     })
 
     if (result.updated) {
@@ -4026,35 +4612,56 @@ const anthropicAuthPlugin = async (
     const accounts = buildAccountList(
       updatedStorage ?? { version: 1, accounts: [] },
     )
-    return { text: result.text, accounts }
+    return { text: result.text, accounts, statusProjection }
   }
 
-  async function buildAccountDialogProjection(): Promise<{
-    accounts: AccountDialogAccount[]
-    claustrumDetection: string
-  }> {
-    const storage = await loadAccounts(accountStoragePath)
-    const accounts = buildAccountList(storage ?? createEmptyStorage()).map(
-      (account) => ({
-        ...account,
-        claustrumGate:
-          account.role === 'main'
-            ? ('na' as const)
-            : isClaustrumEnabledForAccount(
-                  storage ?? createEmptyStorage(),
-                  account.id,
-                )
-              ? ('on' as const)
-              : ('off' as const),
-        vaultServed:
-          account.role === 'fallback' &&
-          isFallbackAccountVaultServed(account.id, storage),
-      }),
-    )
+  async function buildAccountDialogProjection(
+    storageOverride?: Awaited<ReturnType<typeof loadAccounts>>,
+  ): Promise<AccountDialogKnobs> {
+    const storage = storageOverride ?? (await loadAccounts(accountStoragePath))
+    const accountStorage = storage ?? createEmptyStorage()
+    const accounts = buildAccountList(accountStorage).map((account) => {
+      const stored = accountStorage.accounts.find(
+        (candidate) => candidate.id === account.id,
+      )
+      const claustrumGate =
+        account.role === 'main'
+          ? ('na' as const)
+          : stored &&
+              isOAuthAccount(stored) &&
+              isOAuthAccountVaultOwned(
+                accountStorage,
+                stored,
+                resolveAccountCustodyHandle(stored, accountStorage),
+              )
+            ? ('on' as const)
+            : ('off' as const)
+      const custodyState = custodyStateFor(
+        account,
+        storage,
+        custodyDimensionsDeps,
+      )
+      return {
+        id: account.id,
+        label: account.label,
+        role: account.role,
+        enabled: account.enabled,
+        quotaPercent: account.quotaPercent,
+        ...(account.tierLabel && { tierLabel: account.tierLabel }),
+        claustrumGate,
+        custodyState,
+        vaultServed: custodyState === 'on-vault-served',
+        vaultReauth: custodyState === 'on-vault-reauth',
+      }
+    })
     const detection = await detectClaustrumConnection(
       getConfiguredClaustrumConnectionFile(),
     )
-    return { accounts, claustrumDetection: detection.status }
+    return {
+      accounts,
+      claustrumDetection: detection.status,
+      custodyMode: getClaustrumMode(accountStorage),
+    }
   }
 
   async function buildDialogPayload(
@@ -4083,17 +4690,22 @@ const anthropicAuthPlugin = async (
     }
     if (command === 'claude-account') {
       const result = await executePersistentAccountCommand(args, sessionId)
-      const accountProjection = await buildAccountDialogProjection()
+      const accountProjection =
+        result.statusProjection ?? (await buildAccountDialogProjection())
       const knobs: Record<string, unknown> = {
         accounts: accountProjection.accounts,
         claustrumDetection: accountProjection.claustrumDetection,
+        custodyMode: accountProjection.custodyMode,
+        custodyModeKnown: true,
       }
       if ('knobs' in result && result.knobs) {
         Object.assign(knobs, result.knobs)
       }
       return {
         command,
-        text: result.text,
+        text: custodyStartupMismatchVerdict
+          ? `${result.text}\n\n- Custody startup mismatch: ${custodyStartupMismatchVerdict}`
+          : result.text,
         knobs,
       }
     }
@@ -4547,14 +5159,91 @@ const anthropicAuthPlugin = async (
       ) {
         latestGetAuth = getAuth
         const auth = await getAuth()
+        if (completedLocalLogin) await acknowledgeMainLocalLogin(getAuth)
+        let custodyStorage = await loadAccounts(accountStoragePath)
+        if (
+          getClaustrumMode(custodyStorage) === 'claustrum' &&
+          isCustodyTombstoneOAuth(auth, 'anthropic')
+        ) {
+          await refreshVaultBackedOAuthAccounts(true)
+          custodyStorage = await loadAccounts(accountStoragePath)
+        }
+        const custodyMode = getClaustrumMode(custodyStorage)
+        const main = mainCustodyDimension(auth)
+        const fallbackDimensions = fallbackCustodyDimensions(
+          custodyStorage,
+          custodyDimensionsDeps,
+        )
+        const mainAccount = mainCustodyAccount(auth)
+        const mainBinding =
+          custodyMode === 'claustrum' && custodyStorage
+            ? resolveAccountCustodyHandle(mainAccount, custodyStorage)
+            : { status: 'unresolved' as const }
+        const mainEvidence =
+          custodyMode !== 'claustrum' ||
+          main !== 'T' ||
+          (mainBinding.status === 'resolved' &&
+            Boolean(
+              usableClaustrumAccessToken(
+                claustrumCredentialCache?.peek(mainBinding.handle),
+                claustrumNow(),
+              ),
+            ))
+            ? 'V'
+            : 'N'
+        let claustrumMainRoute:
+          | { account: OAuthAccount; handle: string | undefined }
+          | undefined
+        if (auth.type === 'oauth') {
+          try {
+            reconcileCustodyStartup({
+              mode: custodyMode === 'claustrum' ? 'C' : 'L',
+              main,
+              fallbacks: fallbackDimensions.fallbacks,
+              evidence: mainEvidence,
+            })
+          } catch (error) {
+            if (!(error instanceof CustodyStateMismatchError)) throw error
+            custodyStartupMismatchVerdict = error.verdict
+            return {
+              fetch: async () => {
+                throw error
+              },
+            }
+          }
+        }
         if (auth.type === 'oauth') {
+          const mainCustody = mainCustodyAccount(auth)
+          mainCustody.anthropicAccountUuid =
+            custodyStorage?.main?.profile?.providerAccountUuid ??
+            (custodyStorage?.main?.profile?.accountIdentity as
+              | ProviderAccountUuid
+              | undefined)
+          const mainBinding =
+            getClaustrumMode(custodyStorage) === 'claustrum' && custodyStorage
+              ? resolveAccountCustodyHandle(mainCustody, custodyStorage)
+              : undefined
+          if (
+            mainBinding?.status === 'resolved' &&
+            !isCustodyTombstoneOAuth(auth, 'anthropic')
+          ) {
+            return {
+              fetch: async () => claustrumMainRefusal('takeover-incomplete'),
+            }
+          }
           if (isCustodyTombstoneOAuth(auth, 'anthropic')) {
-            logger.error(
-              'auth',
-              'custody tombstone on main slot; vault-served main not implemented',
-            )
-            // This branch becomes the vault path in the takeover PR.
-            throw new CustodyTombstoneRefreshError('anthropic')
+            mainAccountId = await getOrCreateMainAccountId(accountStoragePath)
+            if (getClaustrumMode(custodyStorage) === 'claustrum') {
+              claustrumMainRoute = {
+                account: mainCustody,
+                handle:
+                  mainBinding?.status === 'resolved'
+                    ? mainBinding.handle
+                    : undefined,
+              }
+            } else {
+              throw new CustodyTombstoneLoginError('anthropic')
+            }
           }
           mainAccountId = await getOrCreateMainAccountId(accountStoragePath)
           if (auth.access) {
@@ -4725,7 +5414,7 @@ const anthropicAuthPlugin = async (
                     }
 
                     const fileLock = await acquireRefreshFileLock({
-                      name: 'opencode-main-oauth-refresh',
+                      name: OPENCODE_MAIN_OAUTH_REFRESH_LOCK,
                       ttlMs: 2 * 60_000,
                       renew: true,
                     })
@@ -4990,7 +5679,7 @@ const anthropicAuthPlugin = async (
             }
           }
 
-          startMainBackgroundRefresh()
+          if (!claustrumMainRoute) startMainBackgroundRefresh()
           quotaManager.seedFallbacksFromAccounts(
             (initialStorage?.accounts ?? []).filter(isOAuthAccount),
           )
@@ -5388,6 +6077,20 @@ const anthropicAuthPlugin = async (
             }
           }
 
+          function createClaustrum401RelayHook(response: Response) {
+            return ({
+              status,
+              source,
+            }: {
+              status: number
+              source: ClaustrumReporterSource
+            }) => {
+              if (status !== 401) return
+              const served = claustrumServedCredentials.get(response)
+              if (served) void reportClaustrumAuthFailure(served, source)
+            }
+          }
+
           async function sendWithAccessToken(
             input: string | URL | Request,
             init: RequestInit | undefined,
@@ -5399,9 +6102,10 @@ const anthropicAuthPlugin = async (
             fallbackAuthLineageId?: string,
             fableRequest?: FableRequestContext,
             laneStartRequest = false,
-            mainQuotaIdentity?: MainQuotaIdentityBinding,
+            mainQuotaIdentity?: MainQuotaIdentityResolution,
             claustrumResolution?: ClaustrumAccessResolution,
           ) {
+            assertNotCustodyTombstone(accessToken, 'anthropic')
             const start = nowMs()
             const servedClaustrumCredential = claustrumResolution?.served
             let requestStorage = currentStorage
@@ -5451,8 +6155,30 @@ const anthropicAuthPlugin = async (
             const identity = await resolveClaudeCodeIdentity(
               accessToken,
               modelForIdentity,
-              oauthAccountId === 'main' ? mainAccountId : oauthAccountId,
+              oauthAccountId === 'main'
+                ? (mainQuotaIdentity?.quotaKey ??
+                    claustrumResolution?.credentialAccountId ??
+                    (!accessToken.startsWith('sk-ant-oat')
+                      ? mainAccountId
+                      : undefined))
+                : oauthAccountId,
             )
+            if (oauthAccountId !== 'main' && identity.accountUuid) {
+              void persistFallbackAnthropicAccountUuid(
+                oauthAccountId,
+                identity.accountUuid,
+              ).catch((error) => {
+                logger.warn(
+                  'claustrum',
+                  'failed to persist fallback identity',
+                  {
+                    accountId: oauthAccountId,
+                    error:
+                      error instanceof Error ? error.message : String(error),
+                  },
+                )
+              })
+            }
             trace?.mark('resolve_claude_code_identity', {
               route,
               ms: roundMs(nowMs() - identityStart),
@@ -5681,11 +6407,29 @@ const anthropicAuthPlugin = async (
               }
             }
 
-            const relayConfig = getRelayConfig(await getRequestStorage())
+            const requestStorageForIdentity = await getRequestStorage()
+            const relayConfig = getRelayConfig(requestStorageForIdentity)
+            const persistedFallbackAccount =
+              oauthAccountId === 'main'
+                ? undefined
+                : requestStorageForIdentity?.accounts.find(
+                    (account): account is OAuthAccount =>
+                      account.id === oauthAccountId && isOAuthAccount(account),
+                  )
+            const persistedFallbackAccountUuid = fallbackAccountUuidForLineage(
+              persistedFallbackAccount,
+              fallbackAuthLineageId,
+            )
             const served = {
               accountId: oauthAccountId,
               accessToken,
               authLineageId: fallbackAuthLineageId,
+              anthropicAccountUuid:
+                oauthAccountId === 'main'
+                  ? mainQuotaIdentity?.providerAccountUuid
+                  : (claustrumResolution?.credentialAccountId ??
+                    asProviderAccountUuid(identity.accountUuid) ??
+                    asProviderAccountUuid(persistedFallbackAccountUuid)),
               ...(oauthAccountId === 'main' && mainQuotaIdentity
                 ? { mainQuotaIdentity }
                 : {}),
@@ -5733,6 +6477,12 @@ const anthropicAuthPlugin = async (
                 response,
                 servedClaustrumCredential,
               )
+              if (response.status === 401) {
+                await reportClaustrumAuthFailure(
+                  servedClaustrumCredential,
+                  'direct',
+                )
+              }
             }
             return response
           }
@@ -5778,7 +6528,7 @@ const anthropicAuthPlugin = async (
           ) {
             if (!accessToken) return false
             const entry = quotaManager.getMain(
-              mainQuotaIdentity?.accountIdentity ?? mainQuotaAccountId,
+              mainQuotaIdentity?.quotaKey ?? mainQuotaAccountId,
             )
             // A genuine response header is live routing evidence like a 429, but
             // it gets no exemption from the shared freshness and token gates.
@@ -5796,7 +6546,7 @@ const anthropicAuthPlugin = async (
             if (!accessToken) return false
             try {
               await quotaManager.refreshMain(
-                mainQuotaIdentity?.accountIdentity ?? mainQuotaAccountId,
+                mainQuotaIdentity?.quotaKey ?? mainQuotaAccountId,
                 accessToken,
                 mainQuotaIdentity?.generation,
               )
@@ -5809,6 +6559,18 @@ const anthropicAuthPlugin = async (
             }
           }
 
+          function isLocalManifestBoundFallback(
+            account: OAuthAccount,
+            storage: AccountStorage,
+          ): boolean {
+            const custodyBinding = resolveAccountCustodyHandle(account, storage)
+            return (
+              getClaustrumMode(storage) === 'local' &&
+              custodyBinding.status === 'resolved' &&
+              custodyBinding.source === 'manifest'
+            )
+          }
+
           async function getRoutableFallbackAccounts(
             storageArg: Awaited<ReturnType<typeof loadAccounts>>,
             options: { includeApiRoutes?: boolean; modelId?: string } = {},
@@ -5822,8 +6584,9 @@ const anthropicAuthPlugin = async (
             )
             const usable: Array<OAuthAccount | ApiKeyAccount> = []
             for (const account of storageArg?.accounts ?? []) {
-              if (isOAuthAccount(account)) {
+              if (storageArg && isOAuthAccount(account)) {
                 if (claustrumBlockedAccounts.has(account.id)) continue
+                if (isLocalManifestBoundFallback(account, storageArg)) continue
                 const usableAccount = usableOAuthById.get(account.id)
                 if (usableAccount) {
                   usable.push(usableAccount)
@@ -5873,8 +6636,9 @@ const anthropicAuthPlugin = async (
             mainRefreshToken?: string
             requestedModelId?: string
             mainQuotaIdentity?: MainQuotaIdentityBinding
+            mainClaustrum?: ClaustrumAccessResolution
           }) {
-            const mainQuotaIdentity = input.mainQuotaIdentity?.accountIdentity
+            const mainQuotaIdentity = input.mainQuotaIdentity?.quotaKey
             const mainEntry = quotaManager.getMain(mainQuotaIdentity)
             let mainQuota = mainEntry?.quota
             if (
@@ -5899,9 +6663,6 @@ const anthropicAuthPlugin = async (
               })
             const latestStorage =
               (await loadAccounts(accountStoragePath)) ?? input.storage
-            const usableById = new Map(
-              usableFallbacks.map((account) => [account.id, account]),
-            )
             const allRoutes: StickyOAuthRoute[] = []
             if (
               !isPermanentRefreshError(
@@ -5912,18 +6673,27 @@ const anthropicAuthPlugin = async (
                 id: STICKY_ROUTING_MAIN_ACCOUNT_ID,
                 access: input.mainAccessToken,
                 quota: mainQuota,
-                identity: mainAccountId
-                  ? { kind: 'known', accountId: mainAccountId }
+                identity: mainQuotaIdentity
+                  ? { kind: 'known', accountId: mainQuotaIdentity }
                   : { kind: 'unknown' },
                 order: 0,
+                claustrum: input.mainClaustrum,
               })
             }
+            const usableFallbacksById = new Map(
+              usableFallbacks.map((candidate) => [candidate.id, candidate]),
+            )
             for (const [index, stored] of (
               latestStorage?.accounts ?? []
             ).entries()) {
               if (stored.enabled === false || !isOAuthAccount(stored)) continue
               if (claustrumBlockedAccounts.has(stored.id)) continue
-              const account = usableById.get(stored.id) ?? stored
+              if (
+                latestStorage &&
+                isLocalManifestBoundFallback(stored, latestStorage)
+              )
+                continue
+              const account = usableFallbacksById.get(stored.id) ?? stored
               const credential = resolveClaustrumAccess(account, latestStorage)
               const servedByClaustrum = Boolean(credential.served)
               if (
@@ -6421,11 +7191,7 @@ const anthropicAuthPlugin = async (
                           responseMode: 'json' as const,
                         }
                     : {}),
-                  onRelayUpstreamError: ({ status, source }) => {
-                    if (status !== 401) return
-                    const served = claustrumServedCredentials.get(response)
-                    if (served) void reportClaustrumAuthFailure(served, source)
-                  },
+                  onRelayUpstreamError: createClaustrum401RelayHook(response),
                   contentFilterModel: fablePlan?.requestedModel,
                   ...(!fablePlan?.downgraded && fablePlan
                     ? {
@@ -6585,11 +7351,56 @@ const anthropicAuthPlugin = async (
                 trace.done('non_oauth_passthrough', { status: response.status })
                 return response
               }
-              let requestMainQuotaIdentity: MainQuotaIdentityBinding | undefined
+              let requestMainClaustrum: ClaustrumAccessResolution | undefined
+              let requestMainRefusal:
+                | Exclude<MainCustodyRefusal, 'takeover-incomplete'>
+                | undefined
+              if (claustrumMainRoute) {
+                const { account, handle } = claustrumMainRoute
+                const cached = handle
+                  ? claustrumCredentialCache?.peek(handle)
+                  : undefined
+                if (hasClaustrumIdentityMismatch(account, cached)) {
+                  requestMainRefusal = 'identity-mismatch'
+                } else {
+                  const accessToken = usableClaustrumAccessToken(
+                    cached,
+                    claustrumNow(),
+                  )
+                  if (accessToken && cached && handle) {
+                    auth.access = accessToken
+                    auth.expires = Number.MAX_SAFE_INTEGER
+                    requestMainClaustrum = {
+                      accessToken,
+                      credentialAccountId: asProviderAccountUuid(
+                        cached.accountId,
+                      ),
+                      served: {
+                        accountId: 'main',
+                        handle,
+                        recordVersion: cached.recordVersion,
+                      },
+                    }
+                  } else {
+                    requestMainRefusal = claustrumReauthAccounts.has('main')
+                      ? 'reauth'
+                      : 'cold'
+                  }
+                }
+                if (requestMainRefusal) {
+                  auth.access = ''
+                  auth.expires = 0
+                }
+              }
+              let requestMainQuotaIdentity:
+                | MainQuotaIdentityResolution
+                | undefined
               if (auth.access) {
                 const resolution = await resolveMainQuotaAccountIdentity(
                   auth.access,
                   parseRequestModel(init?.body),
+                  requestMainClaustrum?.credentialAccountId,
+                  requestMainClaustrum?.served?.recordVersion,
                 )
                 if (resolution.stale) {
                   throw new Error(
@@ -6597,6 +7408,12 @@ const anthropicAuthPlugin = async (
                   )
                 }
                 requestMainQuotaIdentity = resolution
+                if (requestMainClaustrum) {
+                  requestMainClaustrum.credentialAccountId =
+                    resolution.providerAccountUuid
+                  mainServedAccessToken = auth.access
+                  mainProviderAccountUuid = resolution.providerAccountUuid
+                }
               }
               await clearStaleMainRefreshError(
                 mainAccountId,
@@ -6699,6 +7516,7 @@ const anthropicAuthPlugin = async (
                     mainRefreshToken: auth.refresh,
                     requestedModelId: routingModelId,
                     mainQuotaIdentity: requestMainQuotaIdentity,
+                    mainClaustrum: requestMainClaustrum,
                   })
                   const resolveRoute = (excludeAccountIds?: Set<string>) =>
                     stickySessionRouter.resolve({
@@ -6889,7 +7707,18 @@ const anthropicAuthPlugin = async (
                         inspected.response,
                       )
                       try {
-                        if (authRouteId === STICKY_ROUTING_MAIN_ACCOUNT_ID) {
+                        if (
+                          authRouteId === STICKY_ROUTING_MAIN_ACCOUNT_ID &&
+                          servedClaustrum
+                        ) {
+                          await reportClaustrumAuthFailure(
+                            servedClaustrum,
+                            'direct',
+                          )
+                          permanentAuthFailure = true
+                        } else if (
+                          authRouteId === STICKY_ROUTING_MAIN_ACCOUNT_ID
+                        ) {
                           auth.access = await refreshMainAccessToken(
                             route.access,
                           )
@@ -6970,7 +7799,7 @@ const anthropicAuthPlugin = async (
                         quota =
                           route.id === STICKY_ROUTING_MAIN_ACCOUNT_ID
                             ? await quotaManager.refreshMain(
-                                requestMainQuotaIdentity?.accountIdentity,
+                                requestMainQuotaIdentity?.quotaKey,
                                 route.access,
                                 requestMainQuotaIdentity?.generation,
                               )
@@ -7149,6 +7978,29 @@ const anthropicAuthPlugin = async (
               }
 
               if (!auth.access || !auth.expires || auth.expires < Date.now()) {
+                if (claustrumMainRoute) {
+                  const fallbackAccounts = replayableRequest
+                    ? await getRoutableFallbackAccounts(storage, {
+                        modelId: requestModelId,
+                      })
+                    : []
+                  const fallbackResponse = await tryUsableFallbackAccounts(
+                    input,
+                    init,
+                    fallbackAccounts,
+                    storage,
+                    undefined,
+                    trace,
+                    {
+                      onSuccess: (account) =>
+                        writeCurrentSidebarState(account.id, 'fallback'),
+                      fableRequest,
+                      laneStartRequest,
+                    },
+                  )
+                  if (fallbackResponse) return wrapResponse(fallbackResponse)
+                  return claustrumMainRefusal(requestMainRefusal ?? 'cold')
+                }
                 // Check backoff before attempting refresh — avoids noisy
                 // per-request retries during prolonged rate limits
                 const refreshStorage = await loadAccounts()
@@ -7202,7 +8054,7 @@ const anthropicAuthPlugin = async (
               function showQuotaToastFromCache() {
                 if (storage?.quota?.showToasts !== true) return
                 const mainEntry = quotaManager.getMain(
-                  requestMainQuotaIdentity?.accountIdentity,
+                  requestMainQuotaIdentity?.quotaKey,
                 )
                 if (!mainEntry) return
                 // Prefer the shared QuotaManager cache for fallback quota so the
@@ -7243,17 +8095,17 @@ const anthropicAuthPlugin = async (
                   // Identity-aware read prevents routing with a previous main
                   // account's quota after a slot switch.
                   let routingQuotaEntry = quotaManager.getMain(
-                    requestMainQuotaIdentity?.accountIdentity,
+                    requestMainQuotaIdentity?.quotaKey,
                   )
                   let routingQuota = routingQuotaEntry?.quota
                   if (!routingQuota) {
                     routingQuota = await quotaManager.refreshMain(
-                      requestMainQuotaIdentity?.accountIdentity,
+                      requestMainQuotaIdentity?.quotaKey,
                       auth.access,
                       requestMainQuotaIdentity?.generation,
                     )
                     routingQuotaEntry = quotaManager.getMain(
-                      requestMainQuotaIdentity?.accountIdentity,
+                      requestMainQuotaIdentity?.quotaKey,
                     )
                     showQuotaToastFromCache()
                   } else if (
@@ -7276,12 +8128,12 @@ const anthropicAuthPlugin = async (
                       // below still refuses API-key routes because the entry is not
                       // fresh.
                       routingQuota = await quotaManager.refreshMain(
-                        requestMainQuotaIdentity?.accountIdentity,
+                        requestMainQuotaIdentity?.quotaKey,
                         auth.access,
                         requestMainQuotaIdentity?.generation,
                       )
                       routingQuotaEntry = quotaManager.getMain(
-                        requestMainQuotaIdentity?.accountIdentity,
+                        requestMainQuotaIdentity?.quotaKey,
                       )
                     } else {
                       // Stale OR every-N request boundary — background refresh,
@@ -7289,7 +8141,7 @@ const anthropicAuthPlugin = async (
                       // sidebar and show the toast once the new main quota lands.
                       void quotaManager
                         .refreshMain(
-                          requestMainQuotaIdentity?.accountIdentity,
+                          requestMainQuotaIdentity?.quotaKey,
                           auth.access,
                           requestMainQuotaIdentity?.generation,
                         )
@@ -7365,11 +8217,14 @@ const anthropicAuthPlugin = async (
               }
 
               let mainQuota = quotaManager.getMain(
-                requestMainQuotaIdentity?.accountIdentity,
+                requestMainQuotaIdentity?.quotaKey,
               )?.quota
               if (
                 storage?.quota?.failClosedOnUnknownQuota &&
-                !mainQuota &&
+                (mainQuota === undefined ||
+                  (auth.access.startsWith('sk-ant-oat') &&
+                    requestMainQuotaIdentity?.providerAccountUuid ===
+                      undefined)) &&
                 quotaManager.isBackedOff()
               ) {
                 const lastError = quotaManager.getLastApiError()
@@ -7419,7 +8274,7 @@ const anthropicAuthPlugin = async (
                     )
                     await Promise.all([
                       quotaManager.refreshMain(
-                        requestMainQuotaIdentity?.accountIdentity,
+                        requestMainQuotaIdentity?.quotaKey,
                         auth.access,
                         requestMainQuotaIdentity?.generation,
                       ),
@@ -7441,7 +8296,7 @@ const anthropicAuthPlugin = async (
                 // against fresh quota. The initial read above is null on the
                 // first request, before the refresh populates the cache.
                 mainQuota = quotaManager.getMain(
-                  requestMainQuotaIdentity?.accountIdentity,
+                  requestMainQuotaIdentity?.quotaKey,
                 )?.quota
               }
 
@@ -7570,6 +8425,7 @@ const anthropicAuthPlugin = async (
                 fableRequest,
                 laneStartRequest,
                 requestMainQuotaIdentity,
+                requestMainClaustrum,
               )
               let fallbackServed = false
               const response = await tryFallbackAccounts(
@@ -7609,18 +8465,39 @@ const anthropicAuthPlugin = async (
           label: 'Claude Pro/Max',
           type: 'oauth',
           authorize: async () => {
-            const result = await authorize('max')
+            if (
+              getClaustrumMode(await loadAccounts(accountStoragePath)) ===
+              'claustrum'
+            ) {
+              throw new Error(
+                'Exit Claustrum mode first: /claude-account local',
+              )
+            }
+            assertLocalLoginObservationAvailable(process.env)
+            const result = await authorizeImpl('max')
             return {
               url: result.url,
               instructions: 'Paste the authorization code here:',
               method: 'code',
               callback: async (code: string) => {
-                return exchange(
+                const exchanged = await exchange(
                   code,
                   result.verifier,
                   result.redirectUri,
                   result.state,
                 )
+                if (exchanged.type === 'success') {
+                  completedLocalLogin = {
+                    accountId: 'main',
+                    credentialId: custodyCredentialId('main'),
+                    authFingerprint: localAuthFingerprint(
+                      exchanged.access,
+                      exchanged.refresh,
+                    ),
+                    completedAt: Date.now(),
+                  }
+                }
+                return exchanged
               },
             }
           },
@@ -7666,9 +8543,14 @@ const anthropicAuthPlugin = async (
     },
     __primeManager: primeManager,
     __quotaManager: quotaManager,
+    __resolveMainQuotaIdentityForTest: resolveMainQuotaAccountIdentity,
+    __resolveSidebarQuotaAccessForTest: resolveSidebarQuotaAccess,
+    __mainProviderAccountUuidForTest: () => mainProviderAccountUuid,
     __persistFallbackQuotaErrorForTest: persistFallbackQuotaError,
     __fallbackRefreshReady: fallbackRefreshReady,
-    __claustrumCredentialCache: claustrumCredentialCache,
+    get __claustrumCredentialCache() {
+      return claustrumCredentialCache
+    },
     // biome-ignore lint/suspicious/noExplicitAny: Plugin type doesn't include undocumented auth/hooks
   } as any
 }
diff --git a/packages/opencode/src/local-login.ts b/packages/opencode/src/local-login.ts
new file mode 100644
index 00000000..6531619e
--- /dev/null
+++ b/packages/opencode/src/local-login.ts
@@ -0,0 +1,236 @@
+import { createHash } from 'node:crypto'
+import { readFile, rename, writeFile } from 'node:fs/promises'
+import {
+  type CustodyHandleAccount,
+  CustodyHandleManifestReader,
+  type CustodyHandleManifestRemovalResult,
+  isOAuthAccount,
+  loadAccounts,
+  type OAuthAccount,
+  removeCustodyHandleManifestEntry,
+  resolveCustodyHandle,
+} from '@cortexkit/anthropic-auth-core'
+
+export type CompletedLocalLogin = {
+  accountId: string
+  credentialId: string
+  authFingerprint: string
+  completedAt: number
+}
+
+export type CustodyDivergence = {
+  minimumRecordVersion: number
+  observedAt: number
+}
+
+export type CustodyDivergenceState = {
+  claustrumDivergence?: Record<string, CustodyDivergence>
+}
+
+export function lastVaultServedRecordVersion(input: {
+  accountId: string
+  servedVersion?: number
+  cacheVersion?: number
+  warn?: (accountId: string) => void
+}): number {
+  if (input.servedVersion !== undefined) return input.servedVersion
+  if (input.cacheVersion !== undefined) return input.cacheVersion
+  input.warn?.(input.accountId)
+  return 0
+}
+
+export function custodyDivergenceMarker(
+  lastVaultServedRecordVersion: number,
+  observedAt: number,
+): CustodyDivergence {
+  return {
+    minimumRecordVersion: lastVaultServedRecordVersion + 1,
+    observedAt,
+  }
+}
+
+export function custodyPreflightDivergenceCheck(
+  binding: { credentialId: string; recordVersion: number },
+  state: CustodyDivergenceState,
+): { ok: true } | { ok: false; message: 'missing fresh vault import' } {
+  const fence = state.claustrumDivergence?.[binding.credentialId]
+  return !fence || binding.recordVersion >= fence.minimumRecordVersion
+    ? { ok: true }
+    : { ok: false, message: 'missing fresh vault import' }
+}
+
+export class CustodyLoginObservationUnavailableError extends Error {
+  readonly code = 'custody_login_observation_unavailable'
+
+  constructor() {
+    super(
+      'Local login cannot be verified while OPENCODE_AUTH_CONTENT is set; unset it before signing in.',
+    )
+    this.name = 'CustodyLoginObservationUnavailableError'
+  }
+}
+
+export function assertLocalLoginObservationAvailable(
+  env: Record<string, string | undefined>,
+): void {
+  if (env.OPENCODE_AUTH_CONTENT !== undefined) {
+    throw new CustodyLoginObservationUnavailableError()
+  }
+}
+
+export type ObservedLocalAuth = {
+  type: string
+  access?: string
+  refresh?: string
+}
+
+export function localAuthFingerprint(access: string, refresh: string): string {
+  const lengthPrefix = (value: string) => `${value.length}:${value}`
+  return createHash('sha256')
+    .update(lengthPrefix(access) + lengthPrefix(refresh))
+    .digest('hex')
+}
+
+export type AcknowledgeLocalOAuthLoginOptions = {
+  manifestPath: string
+  entry: CustodyHandleAccount
+  remove?: (input: {
+    path: string
+    entry: CustodyHandleAccount
+  }) => Promise<CustodyHandleManifestRemovalResult>
+  beforeRemove?: () => Promise<void>
+  divergence?: {
+    statePath: string
+    lastVaultServedRecordVersion: number
+  }
+}
+
+export type AcknowledgeLocalOAuthLoginFromStorageOptions = {
+  accountStoragePath: string
+  manifestPath: string
+  remove?: AcknowledgeLocalOAuthLoginOptions['remove']
+  divergence?: AcknowledgeLocalOAuthLoginOptions['divergence']
+}
+
+export type AcknowledgeLocalOAuthLoginResult =
+  | 'cleared'
+  | 'not-cleared'
+  | 'refused'
+  | 'refused-transient'
+
+export async function acknowledgeLocalOAuthLogin(
+  completion: CompletedLocalLogin | undefined,
+  observedAuth: ObservedLocalAuth | undefined,
+  options: AcknowledgeLocalOAuthLoginOptions,
+): Promise<AcknowledgeLocalOAuthLoginResult> {
+  if (!completion || observedAuth?.type !== 'oauth') return 'not-cleared'
+  if (!observedAuth.access || !observedAuth.refresh) return 'not-cleared'
+  if (
+    localAuthFingerprint(observedAuth.access, observedAuth.refresh) !==
+    completion.authFingerprint
+  ) {
+    return 'not-cleared'
+  }
+  await options.beforeRemove?.()
+  if (options.divergence) {
+    await persistCustodyDivergenceState(
+      options.divergence.statePath,
+      completion.credentialId,
+      options.divergence.lastVaultServedRecordVersion,
+      Date.now(),
+    )
+  }
+  const result = await (options.remove ?? removeCustodyHandleManifestEntry)({
+    path: options.manifestPath,
+    entry: options.entry,
+  })
+  if (result === 'removed') return 'cleared'
+  if (result === 'missing') return 'not-cleared'
+  return result.code === undefined ? 'refused' : 'refused-transient'
+}
+
+export async function persistCustodyDivergenceState(
+  statePath: string,
+  credentialId: string,
+  lastVaultServedRecordVersion: number,
+  observedAt: number,
+): Promise<void> {
+  let state: Record<string, unknown> = { version: 1 }
+  try {
+    const parsed = JSON.parse(await readFile(statePath, 'utf8'))
+    if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+      state = parsed as Record<string, unknown>
+    }
+  } catch {}
+  const divergence =
+    state.claustrumDivergence &&
+    typeof state.claustrumDivergence === 'object' &&
+    !Array.isArray(state.claustrumDivergence)
+      ? (state.claustrumDivergence as Record<string, unknown>)
+      : {}
+  divergence[credentialId] = custodyDivergenceMarker(
+    lastVaultServedRecordVersion,
+    observedAt,
+  )
+  state.claustrumDivergence = divergence
+  const temporaryPath = `${statePath}.${process.pid}.tmp`
+  await writeFile(temporaryPath, JSON.stringify(state, null, 2), {
+    mode: 0o600,
+  })
+  await rename(temporaryPath, statePath)
+}
+
+export async function acknowledgeLocalOAuthLoginFromStorage(
+  completion: CompletedLocalLogin | undefined,
+  options: AcknowledgeLocalOAuthLoginFromStorageOptions,
+): Promise<AcknowledgeLocalOAuthLoginResult> {
+  if (!completion) return 'not-cleared'
+  const storage = await loadAccounts(options.accountStoragePath)
+  const account = storage?.accounts.find(
+    (candidate): candidate is OAuthAccount =>
+      candidate.id === completion.accountId && isOAuthAccount(candidate),
+  )
+  if (!storage || !account?.label) return 'not-cleared'
+
+  const manifestResult = await new CustodyHandleManifestReader({
+    path: options.manifestPath,
+    provider: 'anthropic',
+    serve: 'anthropic-auth',
+  }).read()
+  if (manifestResult.status !== 'ready') return 'not-cleared'
+  const labelCounts = new Map<string, number>()
+  for (const candidate of storage.accounts) {
+    if (isOAuthAccount(candidate) && candidate.label) {
+      labelCounts.set(
+        candidate.label,
+        (labelCounts.get(candidate.label) ?? 0) + 1,
+      )
+    }
+  }
+  const duplicateLabels = new Set(
+    [...labelCounts].filter(([, count]) => count > 1).map(([label]) => label),
+  )
+  const resolution = resolveCustodyHandle({
+    account,
+    manifest: manifestResult.manifest,
+    duplicateOAuthLabels:
+      duplicateLabels.size === 0 ? undefined : duplicateLabels,
+  })
+  if (resolution.status !== 'resolved' || resolution.source !== 'manifest')
+    return 'not-cleared'
+  if (resolution.credentialId !== completion.credentialId) return 'not-cleared'
+  return acknowledgeLocalOAuthLogin(
+    completion,
+    { type: 'oauth', access: account.access, refresh: account.refresh },
+    {
+      manifestPath: options.manifestPath,
+      entry: {
+        label: account.label,
+        handle: resolution.handle,
+        credentialId: resolution.credentialId,
+      },
+      remove: options.remove,
+      divergence: options.divergence,
+    },
+  )
+}
diff --git a/packages/opencode/src/rpc/protocol.ts b/packages/opencode/src/rpc/protocol.ts
index 1a0e2a78..61af7607 100644
--- a/packages/opencode/src/rpc/protocol.ts
+++ b/packages/opencode/src/rpc/protocol.ts
@@ -17,17 +17,29 @@ export type CommandModalName = (typeof COMMAND_MODAL_NAMES)[number]
 export interface AccountDialogAccount {
   id: string
   label: string
-  role: string
+  role: 'main' | 'fallback'
   enabled: boolean
   quotaPercent: number | null
   tierLabel?: string
   claustrumGate: 'on' | 'off' | 'na'
   vaultServed: boolean
+  vaultReauth: boolean
+  custodyState:
+    | 'na'
+    | 'off'
+    | 'on-vault-served'
+    | 'on-vault-reauth'
+    | 'on-cold'
+    | 'unknown-identity'
+    | 'on-identity-mismatch'
+    | 'on-corrupt-binding'
 }
 
 export interface AccountDialogKnobs {
   accounts: AccountDialogAccount[]
   claustrumDetection: string
+  custodyMode?: 'local' | 'claustrum'
+  custodyModeKnown?: boolean
   [key: string]: unknown
 }
 
diff --git a/packages/opencode/src/sidebar-state.ts b/packages/opencode/src/sidebar-state.ts
index e8b0ae1d..5ad7760c 100644
--- a/packages/opencode/src/sidebar-state.ts
+++ b/packages/opencode/src/sidebar-state.ts
@@ -36,6 +36,16 @@ export interface SidebarAccountState {
   needsReauth: boolean
   // True when the vault copy needs re-importing while the sidecar remains usable.
   vaultReauth?: boolean
+  // A gate alone does not prove the sidecar can serve a request.
+  vaultServed?: boolean
+  custodyState?:
+    | 'off'
+    | 'on-vault-served'
+    | 'on-vault-reauth'
+    | 'on-cold'
+    | 'unknown-identity'
+    | 'on-identity-mismatch'
+    | 'on-corrupt-binding'
   tierLabel?: string
 }
 
@@ -338,6 +348,11 @@ export function normalizeSidebarState(raw: unknown): SidebarState {
           needsReauth:
             typeof entry.needsReauth === 'boolean' ? entry.needsReauth : false,
           ...(entry.vaultReauth === true && { vaultReauth: true }),
+          ...(entry.vaultServed === true && { vaultServed: true }),
+          ...(typeof entry.custodyState === 'string' && {
+            custodyState:
+              entry.custodyState as SidebarAccountState['custodyState'],
+          }),
           tierLabel:
             typeof entry.tierLabel === 'string' && entry.tierLabel.trim()
               ? entry.tierLabel.trim()
diff --git a/packages/opencode/src/tests/account-command.test.ts b/packages/opencode/src/tests/account-command.test.ts
index cbf34301..4a57cad9 100644
--- a/packages/opencode/src/tests/account-command.test.ts
+++ b/packages/opencode/src/tests/account-command.test.ts
@@ -7,13 +7,14 @@ import {
   mock,
   test,
 } from 'bun:test'
-import { mkdtemp, readFile, rm } from 'node:fs/promises'
+import { mkdtemp, readFile, rm, stat, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import {
   __setLogTestSink,
   type AccountStorage,
   buildAccountList,
+  custodyStatusLabel,
   executeAccountCommand,
   type LogTestRecord,
   loadAccounts,
@@ -24,6 +25,8 @@ import {
   setAccountEnabledPersistent,
 } from '@cortexkit/anthropic-auth-core'
 import { AnthropicAuthPlugin } from '../index'
+import { drainNotifications } from '../rpc/notifications'
+import { connectorFor } from './custody-ruled-row.fixture'
 import { DEFAULT_FETCH_MOCK, installDefaultFetchMock } from './test-fetch'
 import {
   createTimerTracking,
@@ -138,61 +141,86 @@ afterAll(async () => {
 // parseAccountCommandAction
 // ---------------------------------------------------------------------------
 describe('parseAccountCommandAction', () => {
-  test('bare command returns status', () => {
+  test('bare command returns status', async () => {
     expect(parseAccountCommandAction('')).toEqual({ type: 'status' })
   })
 
-  test('enable with id', () => {
+  test('enable with id', async () => {
     expect(parseAccountCommandAction('enable fallback-1')).toEqual({
       type: 'enable',
       id: 'fallback-1',
     })
   })
 
-  test('disable with id', () => {
+  test('disable with id', async () => {
     expect(parseAccountCommandAction('disable fallback-1')).toEqual({
       type: 'disable',
       id: 'fallback-1',
     })
   })
 
-  test('remove with id', () => {
+  test('recognizes only global mode verbs and rejects retired custody vocabulary', async () => {
+    const cases = [
+      ['claustrum', { type: 'claustrum-mode', mode: 'claustrum' }],
+      ['local', { type: 'claustrum-mode', mode: 'local' }],
+      ['custody work-alt on', { type: 'usage' }],
+      ['claustrum on', { type: 'usage' }],
+      ['on', { type: 'usage' }],
+      ['off', { type: 'usage' }],
+    ]
+
+    for (const [input, expected] of cases as Array<[string, unknown]>) {
+      expect(parseAccountCommandAction(input)).toEqual(expected as never)
+    }
+  })
+
+  test('names global mode verbs for retired custody vocabulary', async () => {
+    const result = await executeAccountCommand({
+      argumentsText: 'custody work-alt on',
+      storage: baseStorage(),
+    })
+
+    expect(result.text).toContain('claustrum')
+    expect(result.text).toContain('local')
+  })
+
+  test('remove with id', async () => {
     expect(parseAccountCommandAction('remove fallback-1')).toEqual({
       type: 'remove',
       id: 'fallback-1',
     })
   })
 
-  test('move-up with id', () => {
+  test('move-up with id', async () => {
     expect(parseAccountCommandAction('move-up fallback-1')).toEqual({
       type: 'move-up',
       id: 'fallback-1',
     })
   })
 
-  test('move-down with id', () => {
+  test('move-down with id', async () => {
     expect(parseAccountCommandAction('move-down fallback-1')).toEqual({
       type: 'move-down',
       id: 'fallback-1',
     })
   })
 
-  test('enable without id returns usage', () => {
+  test('enable without id returns usage', async () => {
     expect(parseAccountCommandAction('enable')).toEqual({ type: 'usage' })
   })
 
-  test('garbage returns usage', () => {
+  test('garbage returns usage', async () => {
     expect(parseAccountCommandAction('garbage')).toEqual({ type: 'usage' })
   })
 
-  test('add-oauth-finish with code only (no label)', () => {
+  test('add-oauth-finish with code only (no label)', async () => {
     expect(parseAccountCommandAction('add-oauth-finish abc123')).toEqual({
       type: 'add-oauth-finish',
       code: 'abc123',
     })
   })
 
-  test('add-oauth-finish with --label', () => {
+  test('add-oauth-finish with --label', async () => {
     expect(
       parseAccountCommandAction('add-oauth-finish abc123 --label work'),
     ).toEqual({
@@ -202,7 +230,7 @@ describe('parseAccountCommandAction', () => {
     })
   })
 
-  test('add-oauth-finish --label with multi-word label', () => {
+  test('add-oauth-finish --label with multi-word label', async () => {
     expect(
       parseAccountCommandAction('add-oauth-finish abc123 --label my work acct'),
     ).toEqual({
@@ -240,14 +268,14 @@ describe('buildAccountList', () => {
     expect(list[3]!.enabled).toBe(false)
   })
 
-  test('no main quota returns null percent', () => {
+  test('no main quota returns null percent', async () => {
     const storage = baseStorage()
     storage.quota!.mainQuota = undefined
     const list = buildAccountList(storage)
     expect(list[0]!.quotaPercent).toBeNull()
   })
 
-  test('no label falls back to id', () => {
+  test('no label falls back to id', async () => {
     const storage: AccountStorage = {
       version: 1,
       accounts: [{ id: 'abc', type: 'oauth', refresh: 'x' }],
@@ -256,7 +284,7 @@ describe('buildAccountList', () => {
     expect(list[1]!.label).toBe('abc')
   })
 
-  test('buildAccountList adds tierLabel only when profile exists', () => {
+  test('buildAccountList adds tierLabel only when profile exists', async () => {
     const storage = baseStorage()
     storage.main = {
       ...storage.main!,
@@ -281,7 +309,7 @@ describe('buildAccountList', () => {
     expect(list[2]!.tierLabel).toBeUndefined()
   })
 
-  test('account modal includes optional tier label', () => {
+  test('account modal includes optional tier label', async () => {
     const storage = baseStorage()
     storage.main = {
       ...storage.main!,
@@ -292,7 +320,7 @@ describe('buildAccountList', () => {
       },
     }
 
-    const result = executeAccountCommand({ argumentsText: '', storage })
+    const result = await executeAccountCommand({ argumentsText: '', storage })
 
     expect(result.text).toContain('Max 20x')
   })
@@ -302,9 +330,23 @@ describe('buildAccountList', () => {
 // executeAccountCommand — status
 // ---------------------------------------------------------------------------
 describe('executeAccountCommand status', () => {
-  test('bare status returns account list in text', () => {
+  test('labels every custody state from the shared formatter', () => {
+    expect(custodyStatusLabel('na')).toBe('n/a (OpenCode-managed)')
+    expect(custodyStatusLabel('off')).toBe('not enrolled')
+    expect(custodyStatusLabel('on-vault-served')).toBe('vault-served')
+    expect(custodyStatusLabel('on-vault-reauth')).toBe('vault reauth')
+    expect(custodyStatusLabel('on-cold')).toBe('vault cold')
+    expect(custodyStatusLabel('on-identity-mismatch' as never)).toBe(
+      'identity mismatch',
+    )
+    expect(custodyStatusLabel('on-corrupt-binding' as never)).toBe(
+      'corrupt binding',
+    )
+  })
+
+  test('bare status returns account list in text', async () => {
     const storage = baseStorage()
-    const result = executeAccountCommand({ argumentsText: '', storage })
+    const result = await executeAccountCommand({ argumentsText: '', storage })
     expect(result.text).toContain('## Claude Accounts')
     expect(result.text).toContain('OpenCode anthropic')
     expect(result.text).toContain('Work account')
@@ -312,27 +354,124 @@ describe('executeAccountCommand status', () => {
     expect(result.text).toContain('Disabled account')
     expect(result.text).toContain('42%')
     expect(result.text).toContain('(disabled)')
-    expect(result.text).toContain(
-      '**OpenCode anthropic** [main] 42% · gate n/a (OpenCode managed)',
-    )
-    expect(result.text).toContain('**Work account** [fallback] · gate off')
+    expect(result.text).toContain('**OpenCode anthropic** [main] 42% · local')
+    expect(result.text).toContain('**Work account** [fallback] · local')
   })
 
-  test('usage returns usage text', () => {
+  test('renders the settled custody projection in account status text', async () => {
     const storage = baseStorage()
-    const result = executeAccountCommand({ argumentsText: 'garbage', storage })
+    const result = await executeAccountCommand({
+      argumentsText: '',
+      storage,
+      statusProjection: {
+        claustrumDetection: 'available',
+        accounts: [
+          {
+            id: 'main',
+            label: 'OpenCode anthropic',
+            role: 'main',
+            enabled: true,
+            quotaPercent: 42,
+            claustrumGate: 'na',
+            vaultServed: false,
+            vaultReauth: false,
+            custodyState: 'na',
+          },
+          {
+            id: 'fallback-1',
+            label: 'Work account',
+            role: 'fallback',
+            enabled: true,
+            quotaPercent: null,
+            claustrumGate: 'on',
+            vaultServed: false,
+            vaultReauth: true,
+            custodyState: 'on-vault-reauth',
+          },
+        ],
+      },
+    })
+
+    expect(result.text).toContain('Claustrum: available')
+    expect(result.text).toContain('**Work account** [fallback] · vault reauth')
+  })
+
+  test('renders a resolved custody binding without a status projection', async () => {
+    const storage = baseStorage()
+    storage.claustrum = { mode: 'claustrum' }
+
+    const result = await executeAccountCommand({
+      argumentsText: '',
+      storage,
+      resolveCustodyBinding: () => ({
+        status: 'resolved',
+        source: 'legacy',
+        handle: 'legacy-handle',
+      }),
+    } as never)
+
+    expect(result.text).toContain('**Work account** [fallback] · vault cold')
+  })
+
+  test('usage returns usage text', async () => {
+    const storage = baseStorage()
+    const result = await executeAccountCommand({
+      argumentsText: 'garbage',
+      storage,
+    })
     expect(result.text).toContain('Usage:')
     expect(result.text).toContain('/claude-account enable')
   })
 })
 
+describe('executeAccountCommand global Claustrum mode', () => {
+  test('names the two accepted mode verbs in retired custody usage', async () => {
+    const result = await executeAccountCommand({
+      argumentsText: 'claustrum on',
+      storage: baseStorage(),
+    })
+
+    expect(result.text).toContain('/claude-account claustrum')
+    expect(result.text).toContain('/claude-account local')
+  })
+
+  test('refuses to bypass the coordinator when no mode transition is supplied', async () => {
+    const storage = baseStorage()
+    await saveAccounts(storage, accountPath)
+
+    const result = await executeAccountCommand({
+      argumentsText: 'claustrum',
+      storage,
+      path: accountPath,
+    })
+
+    expect(result.text).toBe('Claustrum mode transition is unavailable.')
+    expect((await loadAccounts(accountPath))?.claustrum?.mode).toBeUndefined()
+  })
+
+  test('routes a requested global mode through its transition seam', async () => {
+    const modes: string[] = []
+    const result = await executeAccountCommand({
+      argumentsText: 'claustrum',
+      storage: baseStorage(),
+      transition: async (mode) => {
+        modes.push(mode)
+        return { text: 'coordinator committed' }
+      },
+    })
+
+    expect(result.text).toBe('coordinator committed')
+    expect(modes).toEqual(['claustrum'])
+  })
+})
+
 // ---------------------------------------------------------------------------
 // executeAccountCommand — enable / disable
 // ---------------------------------------------------------------------------
 describe('executeAccountCommand enable/disable', () => {
-  test('enable sets enabled flag on result', () => {
+  test('enable sets enabled flag on result', async () => {
     const storage = baseStorage()
-    const result = executeAccountCommand({
+    const result = await executeAccountCommand({
       argumentsText: 'enable fallback-3',
       storage,
     })
@@ -344,9 +483,9 @@ describe('executeAccountCommand enable/disable', () => {
     })
   })
 
-  test('disable sets enabled flag on result', () => {
+  test('disable sets enabled flag on result', async () => {
     const storage = baseStorage()
-    const result = executeAccountCommand({
+    const result = await executeAccountCommand({
       argumentsText: 'disable fallback-1',
       storage,
     })
@@ -358,9 +497,9 @@ describe('executeAccountCommand enable/disable', () => {
     })
   })
 
-  test('enable main is rejected', () => {
+  test('enable main is rejected', async () => {
     const storage = baseStorage()
-    const result = executeAccountCommand({
+    const result = await executeAccountCommand({
       argumentsText: 'enable main',
       storage,
     })
@@ -368,9 +507,9 @@ describe('executeAccountCommand enable/disable', () => {
     expect(result.updated).toBeUndefined()
   })
 
-  test('disable main is rejected', () => {
+  test('disable main is rejected', async () => {
     const storage = baseStorage()
-    const result = executeAccountCommand({
+    const result = await executeAccountCommand({
       argumentsText: 'disable main',
       storage,
     })
@@ -378,9 +517,9 @@ describe('executeAccountCommand enable/disable', () => {
     expect(result.updated).toBeUndefined()
   })
 
-  test('enable non-existent returns not found', () => {
+  test('enable non-existent returns not found', async () => {
     const storage = baseStorage()
-    const result = executeAccountCommand({
+    const result = await executeAccountCommand({
       argumentsText: 'enable nonexistent',
       storage,
     })
@@ -412,9 +551,9 @@ describe('executeAccountCommand enable/disable', () => {
 // executeAccountCommand — remove
 // ---------------------------------------------------------------------------
 describe('executeAccountCommand remove', () => {
-  test('remove returns updated', () => {
+  test('remove returns updated', async () => {
     const storage = baseStorage()
-    const result = executeAccountCommand({
+    const result = await executeAccountCommand({
       argumentsText: 'remove fallback-1',
       storage,
     })
@@ -425,9 +564,9 @@ describe('executeAccountCommand remove', () => {
     })
   })
 
-  test('remove main is rejected', () => {
+  test('remove main is rejected', async () => {
     const storage = baseStorage()
-    const result = executeAccountCommand({
+    const result = await executeAccountCommand({
       argumentsText: 'remove main',
       storage,
     })
@@ -435,9 +574,9 @@ describe('executeAccountCommand remove', () => {
     expect(result.updated).toBeUndefined()
   })
 
-  test('remove non-existent returns not found', () => {
+  test('remove non-existent returns not found', async () => {
     const storage = baseStorage()
-    const result = executeAccountCommand({
+    const result = await executeAccountCommand({
       argumentsText: 'remove nonexistent',
       storage,
     })
@@ -469,9 +608,9 @@ describe('executeAccountCommand remove', () => {
 // executeAccountCommand — reorder (move-up / move-down)
 // ---------------------------------------------------------------------------
 describe('executeAccountCommand reorder', () => {
-  test('move-up returns updated with new order', () => {
+  test('move-up returns updated with new order', async () => {
     const storage = baseStorage()
-    const result = executeAccountCommand({
+    const result = await executeAccountCommand({
       argumentsText: 'move-up fallback-2',
       storage,
     })
@@ -484,9 +623,9 @@ describe('executeAccountCommand reorder', () => {
     })
   })
 
-  test('move-up first item is no-op', () => {
+  test('move-up first item is no-op', async () => {
     const storage = baseStorage()
-    const result = executeAccountCommand({
+    const result = await executeAccountCommand({
       argumentsText: 'move-up fallback-1',
       storage,
     })
@@ -494,9 +633,9 @@ describe('executeAccountCommand reorder', () => {
     expect(result.updated).toBeUndefined()
   })
 
-  test('move-down returns updated with new order', () => {
+  test('move-down returns updated with new order', async () => {
     const storage = baseStorage()
-    const result = executeAccountCommand({
+    const result = await executeAccountCommand({
       argumentsText: 'move-down fallback-1',
       storage,
     })
@@ -509,9 +648,9 @@ describe('executeAccountCommand reorder', () => {
     })
   })
 
-  test('move-down last item is no-op', () => {
+  test('move-down last item is no-op', async () => {
     const storage = baseStorage()
-    const result = executeAccountCommand({
+    const result = await executeAccountCommand({
       argumentsText: 'move-down fallback-3',
       storage,
     })
@@ -519,9 +658,9 @@ describe('executeAccountCommand reorder', () => {
     expect(result.updated).toBeUndefined()
   })
 
-  test('move-up non-existent returns not found', () => {
+  test('move-up non-existent returns not found', async () => {
     const storage = baseStorage()
-    const result = executeAccountCommand({
+    const result = await executeAccountCommand({
       argumentsText: 'move-up nonexistent',
       storage,
     })
@@ -572,7 +711,10 @@ describe('account command INFO logs (via plugin)', () => {
     }
   }
 
-  async function getPlugin(timerOverrides?: PluginTimerOverrides) {
+  async function getPlugin(
+    timerOverrides?: PluginTimerOverrides,
+    runtimeOverrides: Record<string, unknown> = {},
+  ) {
     const defaultTimerOverrides = disabledPluginTimerOverrides()
     const plugin = (await (
       AnthropicAuthPlugin as unknown as (
@@ -584,7 +726,7 @@ describe('account command INFO logs (via plugin)', () => {
         // @ts-expect-error: minimal mock for testing
         client: createMockClient(),
       },
-      { ...defaultTimerOverrides, ...timerOverrides },
+      { ...defaultTimerOverrides, ...timerOverrides, ...runtimeOverrides },
     )) as any
     await plugin.__fallbackRefreshReady
     return plugin
@@ -707,6 +849,78 @@ describe('account command INFO logs (via plugin)', () => {
     ).toHaveLength(0)
   })
 
+  test('retired custody syntax returns usage without touching the account file', async () => {
+    const storage = baseStorage()
+    await saveAccounts(storage, accountPath)
+    const before = await readFile(accountPath, 'utf8')
+    const beforeMtime = (await stat(accountPath)).mtimeMs
+    const plugin = await getPlugin()
+    drainNotifications(0, 'ses_test')
+
+    await executeCommand(plugin, 'claude-account', 'custody fallback-1 on')
+
+    const payload = drainNotifications(0, 'ses_test').at(-1)?.payload
+    expect(payload?.text).toContain('/claude-account claustrum')
+    expect(payload?.text).toContain('/claude-account local')
+    expect(await readFile(accountPath, 'utf8')).toBe(before)
+    expect((await stat(accountPath)).mtimeMs).toBe(beforeMtime)
+  })
+
+  test('claustrum command refuses a real main with migration guidance and zero writes', async () => {
+    const storage = baseStorage()
+    await saveAccounts(storage, accountPath)
+    const connectionFile = join(tempDir, 'claustrum-connection.json')
+    await writeFile(
+      connectionFile,
+      JSON.stringify({
+        schema: 1,
+        wire_version: 1,
+        endpoints: [{ host: '127.0.0.1', port: 1 }],
+      }),
+    )
+    const previousConnectionFile =
+      process.env.OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE
+    process.env.OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE =
+      connectionFile
+
+    try {
+      const plugin = await getPlugin(undefined, {
+        claustrumConnector: connectorFor([], () => ({ result: {} })),
+      })
+      await plugin.auth.loader(
+        async () => ({
+          type: 'oauth',
+          access: 'real-main-access',
+          refresh: 'real-main-refresh',
+          expires: Date.now() + 60_000,
+        }),
+        { models: {} },
+      )
+      const before = await readFile(accountPath, 'utf8')
+      drainNotifications(0, 'ses_test')
+
+      await executeCommand(plugin, 'claude-account', 'claustrum')
+
+      const text = drainNotifications(0, 'ses_test').at(-1)?.payload.text
+      expect(text).toBe(
+        [
+          'Custody takeover refused:',
+          "main: TAKEOVER_INCOMPLETE_MAIN_REAL — Onboard the main account into the Claustrum vault with Claustrum's tooling (see its runbook) before retrying.",
+          'Work account: binding_missing',
+          'Personal account: binding_missing',
+        ].join('\n'),
+      )
+      expect(await readFile(accountPath, 'utf8')).toBe(before)
+      expect(findCommandsLog('account enabled')).toBeUndefined()
+    } finally {
+      if (previousConnectionFile === undefined)
+        delete process.env.OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE
+      else
+        process.env.OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE =
+          previousConnectionFile
+    }
+  })
+
   test('does not retain a background interval unless the helper opts in', async () => {
     await saveAccounts(baseStorage(), accountPath)
     await getPlugin()
diff --git a/packages/opencode/src/tests/accounts.test.ts b/packages/opencode/src/tests/accounts.test.ts
index 6e7581c4..2c6c819c 100644
--- a/packages/opencode/src/tests/accounts.test.ts
+++ b/packages/opencode/src/tests/accounts.test.ts
@@ -19,12 +19,16 @@ import {
   buildQuotaOperationError,
   buildRefreshOperationError,
   ClaudeOAuthRefreshError,
+  clearClaustrumHandlePersistent,
+  custodyTombstoneKey,
   FallbackAccountManager,
+  fallbackAccountUuidForLineage,
   fetchOAuthAccountProfile,
   fetchOAuthQuotaSnapshot,
   formatOAuthAccountTier,
   getAccountStatePath,
   getCache1hPersistentMode,
+  getClaustrumMode,
   getFallbackReauthLabels,
   getLogLevel,
   getOrCreateMainAccountId,
@@ -36,6 +40,7 @@ import {
   isCacheKeepSubagentsEnabled,
   isCostZeroingEnabled,
   isFastModePersistentlyEnabled,
+  isOAuthAccountVaultOwned,
   isPermanentRefreshError,
   isPrimePersistentlyEnabled,
   type KillswitchThresholds,
@@ -50,6 +55,8 @@ import {
   type OAuthQuotaSnapshot,
   oauthProfileIsFresh,
   PROFILE_TTL_MS,
+  type ProviderAccountUuid,
+  persistFallbackQuotaHeaderPersistent,
   QuotaManager,
   quotaFieldSource,
   quotaSnapshotModelScopeIsExhausted,
@@ -71,6 +78,7 @@ import {
   setCacheKeepPersistentEnabled,
   setCacheKeepPersistentWindow,
   setCacheKeepSubagentsEnabled,
+  setClaustrumModePersistent,
   setFastModePersistentEnabled,
   setLogLevel,
   setLogLevelPersistent,
@@ -80,6 +88,8 @@ import {
   upsertAccount,
 } from '@cortexkit/anthropic-auth-core'
 
+const providerUuid = (value: string) => value as ProviderAccountUuid
+
 let tempDir: string
 let accountPath: string
 
@@ -304,6 +314,107 @@ describe('scoped account-state membership', () => {
   })
 })
 
+describe('custody account-state persistence', () => {
+  test('a stale refresh snapshot cannot replace a custody tombstone with real material', async () => {
+    await saveAccounts(
+      {
+        ...baseStorage(),
+        accounts: [
+          {
+            id: 'work',
+            label: 'work',
+            type: 'oauth',
+            access: 'old-access',
+            refresh: 'old-refresh',
+            expires: 1_700_000_100_000,
+            authLineageId: 'refresh-lineage',
+          },
+        ],
+      },
+      accountPath,
+    )
+    const staleRefresh = (await loadAccounts(accountPath))!
+    const takeover = (await loadAccounts(accountPath))!
+    const tombstoned = expectOAuthAccount(
+      takeover.accounts.find((account) => account.id === 'work'),
+    )
+    tombstoned.access = ''
+    tombstoned.refresh = custodyTombstoneKey('anthropic')
+    tombstoned.expires = 0
+    await saveAccountState(takeover, accountPath, { accounts: ['work'] })
+
+    const stale = expectOAuthAccount(
+      staleRefresh.accounts.find((account) => account.id === 'work'),
+    )
+    stale.access = 'late-access'
+    stale.refresh = 'late-refresh'
+    stale.expires = 1_700_000_200_000
+    const logs: LogTestRecord[] = []
+    try {
+      __setLogTestSink((record) => logs.push(record))
+      await saveAccountState(staleRefresh, accountPath, { accounts: ['work'] })
+    } finally {
+      __setLogTestSink(null)
+    }
+
+    const persisted = JSON.parse(
+      await readFile(getAccountStatePath(accountPath), 'utf8'),
+    )
+    expect(persisted.accounts.work).toMatchObject({
+      access: '',
+      refresh: custodyTombstoneKey('anthropic'),
+      expires: 0,
+    })
+    expect(logs).toContainEqual(
+      expect.objectContaining({
+        level: 'warn',
+        message: 'discarded stale credential write over a custody tombstone',
+      }),
+    )
+  })
+
+  test('an unattributed credential writer cannot replace a custody tombstone', async () => {
+    await saveAccounts(
+      {
+        ...baseStorage(),
+        accounts: [
+          {
+            id: 'work',
+            label: 'work',
+            type: 'oauth',
+            access: 'old-access',
+            refresh: 'old-refresh',
+          },
+        ],
+      },
+      accountPath,
+    )
+    const unattributed = (await loadAccounts(accountPath))!
+    await writeFile(
+      getAccountStatePath(accountPath),
+      JSON.stringify({
+        version: 1,
+        accounts: {
+          work: {
+            access: '',
+            refresh: custodyTombstoneKey('anthropic'),
+            expires: 0,
+          },
+        },
+      }),
+    )
+    await saveAccountState(unattributed, accountPath, { accounts: ['work'] })
+    const persisted = JSON.parse(
+      await readFile(getAccountStatePath(accountPath), 'utf8'),
+    )
+    expect(persisted.accounts.work).toMatchObject({
+      access: '',
+      refresh: custodyTombstoneKey('anthropic'),
+      expires: 0,
+    })
+  })
+})
+
 describe('main quota clear marker', () => {
   test('keeps the newer marker when an older marker arrives', () => {
     expect(mergeMainQuotaErrorClearedAt(2_000, 1_000)).toBe(2_000)
@@ -467,6 +578,72 @@ afterEach(async () => {
   mock.restore()
 })
 
+describe('fallback quota polling', () => {
+  test('skips an account held by custody verification in another manager', async () => {
+    await saveAccounts(
+      {
+        ...baseStorage(),
+        accounts: [
+          {
+            id: 'work',
+            type: 'oauth',
+            access: 'work-access',
+            refresh: 'work-refresh',
+            expires: Date.now() + 60 * 60 * 1_000,
+          },
+        ],
+      },
+      accountPath,
+    )
+
+    let quotaRequests = 0
+    const verifying = new FallbackAccountManager({ configPath: accountPath })
+    const polling = new FallbackAccountManager({
+      configPath: accountPath,
+      fetchImpl: (async () => {
+        quotaRequests += 1
+        return Response.json({
+          five_hour: { utilization: 10 },
+          seven_day: { utilization: 10 },
+        })
+      }) as unknown as typeof fetch,
+    })
+    const lockEntered = deferred()
+    const releaseLock = deferred()
+    const verification = verifying.withAccountRefreshLock('work', async () => {
+      lockEntered.resolve()
+      await releaseLock.promise
+    })
+    await lockEntered.promise
+
+    const lockedStorage = (await loadAccounts(accountPath))!
+    const skipped = await polling.refreshAccountQuota(
+      expectOAuthAccount(lockedStorage.accounts[0]),
+      lockedStorage,
+    )
+    if (skipped.changed) await polling.save(lockedStorage)
+    expect(skipped.fetched).toBe(false)
+    expect(quotaRequests).toBe(0)
+    expect(
+      expectOAuthAccount((await loadAccounts(accountPath))?.accounts[0]).quota,
+    ).toBeUndefined()
+
+    releaseLock.resolve()
+    await verification
+    const unlockedStorage = (await loadAccounts(accountPath))!
+    const fetched = await polling.refreshAccountQuota(
+      expectOAuthAccount(unlockedStorage.accounts[0]),
+      unlockedStorage,
+    )
+    if (fetched.changed) await polling.save(unlockedStorage)
+    expect(fetched.fetched).toBe(true)
+    expect(quotaRequests).toBe(1)
+    expect(
+      expectOAuthAccount((await loadAccounts(accountPath))?.accounts[0]).quota,
+    ).toBeDefined()
+  })
+})
+
 describe('OAuth account profiles', () => {
   const mainCapture = {
     account: { has_claude_max: true },
@@ -3756,6 +3933,65 @@ describe('FallbackAccountManager', () => {
     expect(expectOAuthAccount(saved?.accounts[0]).refresh).toBe('new-refresh')
   })
 
+  test('background refresh skips a custody verification lock without warning', async () => {
+    const storage = baseStorage()
+    storage.accounts.push({
+      id: 'custody-verifying',
+      type: 'oauth',
+      access: 'old-access',
+      refresh: 'old-refresh',
+      expires: Date.now() + 60_000,
+    })
+    await saveAccounts(storage, accountPath)
+    const logs: LogTestRecord[] = []
+    const previousLogLevel = getLogLevel()
+    const entered = deferred()
+    const release = deferred()
+    const fetchImpl = mock(() =>
+      Promise.resolve(new Response(null, { status: 200 })),
+    ) as unknown as typeof fetch
+    const manager = new FallbackAccountManager({
+      configPath: accountPath,
+      fetchImpl,
+    })
+
+    try {
+      setLogLevel('debug')
+      __setLogTestSink((record) => logs.push(record))
+      const held = manager.withAccountRefreshLock(
+        'custody-verifying',
+        async () => {
+          entered.resolve()
+          await release.promise
+        },
+      )
+      await entered.promise
+
+      await manager.refreshDueAccounts()
+      await manager.refreshQuotaForDueAccounts()
+
+      expect(fetchImpl).not.toHaveBeenCalled()
+      expect(logs).toContainEqual(
+        expect.objectContaining({
+          level: 'debug',
+          channel: 'refresh',
+          message:
+            'fallback OAuth background skipped vault-service verification',
+        }),
+      )
+      expect(
+        logs.some(
+          (record) => record.level === 'warn' || record.level === 'error',
+        ),
+      ).toBe(false)
+      release.resolve()
+      await held
+    } finally {
+      __setLogTestSink(null)
+      setLogLevel(previousLogLevel)
+    }
+  })
+
   test('background fallback refresh retries after a permanent backoff belongs to an older refresh token', async () => {
     const now = Date.now()
     const storage = baseStorage()
@@ -6449,6 +6685,109 @@ describe('upsertAccount', () => {
     expect(merged.lastRefreshError?.message).toBe('new')
     expect(merged.lastQuotaRefreshError?.message).toBe('new-quota')
   })
+
+  test('drops an Anthropic account UUID when an OAuth lineage is replaced', () => {
+    const storage = baseStorage()
+    storage.accounts.push({
+      id: 'oauth-1',
+      type: 'oauth',
+      refresh: 'refresh-a',
+      authLineageId: 'lineage-a',
+      anthropicAccountUuid: providerUuid('uuid-from-lineage-a'),
+    })
+
+    upsertAccount(storage, {
+      id: 'oauth-1',
+      type: 'oauth',
+      refresh: 'refresh-b',
+      authLineageId: 'lineage-b',
+    })
+
+    expect(
+      (storage.accounts[0] as OAuthAccount).anthropicAccountUuid,
+    ).toBeUndefined()
+  })
+
+  test('keeps an Anthropic account UUID across a same-lineage token rotation', () => {
+    const storage = baseStorage()
+    storage.accounts.push({
+      id: 'oauth-1',
+      type: 'oauth',
+      refresh: 'refresh-a',
+      authLineageId: 'lineage-a',
+      anthropicAccountUuid: providerUuid('uuid-from-lineage-a'),
+    })
+
+    upsertAccount(storage, {
+      id: 'oauth-1',
+      type: 'oauth',
+      refresh: 'refresh-b',
+      authLineageId: 'lineage-a',
+    })
+
+    expect((storage.accounts[0] as OAuthAccount).anthropicAccountUuid).toBe(
+      providerUuid('uuid-from-lineage-a'),
+    )
+  })
+})
+
+describe('fallback UUID lineage fences', () => {
+  test('does not use a persisted UUID from a replaced credential lineage', () => {
+    const account: OAuthAccount = {
+      id: 'fallback-1',
+      type: 'oauth',
+      refresh: 'refresh-a',
+      authLineageId: 'lineage-a',
+      anthropicAccountUuid: providerUuid('uuid-from-lineage-a'),
+    }
+
+    expect(fallbackAccountUuidForLineage(account, 'lineage-b')).toBeNull()
+    expect(fallbackAccountUuidForLineage(account, 'lineage-a')).toBe(
+      'uuid-from-lineage-a',
+    )
+  })
+
+  test('does not persist a harvested UUID after the stored lineage was replaced', async () => {
+    await saveAccounts(
+      {
+        ...baseStorage(),
+        accounts: [
+          {
+            id: 'fallback-1',
+            type: 'oauth',
+            refresh: 'refresh-b',
+            authLineageId: 'lineage-b',
+          },
+        ],
+      },
+      accountPath,
+    )
+
+    expect(
+      await persistFallbackQuotaHeaderPersistent(
+        {
+          accountId: 'fallback-1',
+          authLineageId: 'lineage-a',
+          anthropicAccountUuid: providerUuid('uuid-from-lineage-a'),
+          quota: {
+            source: 'headers',
+            checkedAt: 1_000,
+            five_hour: {
+              usedPercent: 25,
+              remainingPercent: 75,
+              checkedAt: 1_000,
+            },
+          },
+        },
+        accountPath,
+      ),
+    ).toBe(false)
+
+    expect(
+      expectOAuthAccount((await loadAccounts(accountPath))?.accounts[0])
+        .anthropicAccountUuid,
+    ).toBeUndefined()
+  })
 })
 
 describe('removeAccount', () => {
@@ -6781,6 +7120,311 @@ describe('setAccountEnabledPersistent', () => {
   })
 })
 
+describe('global Claustrum mode', () => {
+  test('defaults to local without config and does not infer custody from a tombstone', async () => {
+    expect(await loadAccounts(accountPath)).toBeNull()
+    expect(getClaustrumMode(await loadAccounts(accountPath))).toBe('local')
+    expect(
+      getClaustrumMode({
+        ...baseStorage(),
+        accounts: [
+          {
+            id: 'anthropic',
+            type: 'oauth',
+            access: '',
+            refresh: 'claustrum-tombstone:v1:anthropic',
+            expires: 0,
+          },
+        ],
+      }),
+    ).toBe('local')
+  })
+
+  test('loads legacy custody gates as local and preserves them through save', async () => {
+    const legacyAccounts = { 'work-alt': { enabled: true } }
+    await writeFile(
+      accountPath,
+      JSON.stringify({
+        ...baseStorage(),
+        accounts: [
+          {
+            id: 'work-alt',
+            type: 'oauth',
+            refresh: 'refresh-token',
+            enabled: true,
+          },
+        ],
+        claustrum: { accounts: legacyAccounts },
+      }),
+      'utf8',
+    )
+
+    const loaded = await loadAccounts(accountPath)
+    expect(getClaustrumMode(loaded)).toBe('local')
+    expect(
+      isOAuthAccountVaultOwned(
+        loaded!,
+        expectOAuthAccount(loaded?.accounts[0]),
+        {
+          status: 'resolved',
+          source: 'manifest',
+          handle: 'manifest-handle',
+          credentialId: 'anthropic:work-alt',
+        },
+      ),
+    ).toBe(false)
+    await saveAccounts(loaded!, accountPath)
+
+    expect(
+      JSON.parse(await readFile(accountPath, 'utf8')).claustrum.accounts,
+    ).toEqual(legacyAccounts)
+  })
+
+  test('defaults invalid persisted global modes to local', async () => {
+    for (const mode of ['vault', 42, null]) {
+      await writeFile(
+        accountPath,
+        JSON.stringify({ ...baseStorage(), claustrum: { mode } }),
+        'utf8',
+      )
+      const loaded = await loadAccounts(accountPath)
+      expect(getClaustrumMode(loaded)).toBe('local')
+      await saveAccounts(loaded!, accountPath)
+      expect(
+        JSON.parse(await readFile(accountPath, 'utf8')).claustrum?.mode,
+      ).toBeUndefined()
+    }
+  })
+
+  test('persists global mode in config and retains it through a state save', async () => {
+    const storage = baseStorage()
+    storage.claustrum = { mode: 'local' }
+    storage.accounts.push({
+      id: 'rotation',
+      type: 'oauth',
+      access: 'old-access',
+      refresh: 'old-refresh',
+      expires: 1_000,
+    })
+    await saveAccounts(storage, accountPath)
+
+    const staleStorage = (await loadAccounts(accountPath))!
+
+    expect(await setClaustrumModePersistent('claustrum', accountPath)).toBe(
+      'changed',
+    )
+    expect(await setClaustrumModePersistent('claustrum', accountPath)).toBe(
+      'unchanged',
+    )
+    expect(getClaustrumMode(await loadAccounts(accountPath))).toBe('claustrum')
+
+    const account = expectOAuthAccount(staleStorage.accounts[0])
+    account.access = 'rotated-access'
+    account.refresh = 'rotated-refresh'
+    account.expires = 2_000
+    await saveAccounts(staleStorage, accountPath)
+
+    const config = JSON.parse(await readFile(accountPath, 'utf8'))
+    const state = JSON.parse(
+      await readFile(getAccountStatePath(accountPath), 'utf8'),
+    )
+    expect(config.claustrum.mode).toBe('claustrum')
+    expect(state.claustrum?.mode).toBeUndefined()
+  })
+
+  test('serializes a mode write with another config write without losing either field', async () => {
+    const originalLevel = getLogLevel()
+    try {
+      await saveAccounts(baseStorage(), accountPath)
+
+      await Promise.all([
+        setClaustrumModePersistent('claustrum', accountPath),
+        setLogLevelPersistent('debug', accountPath),
+      ])
+
+      const config = JSON.parse(await readFile(accountPath, 'utf8'))
+      expect(config.claustrum.mode).toBe('claustrum')
+      expect(config.logging.level).toBe('debug')
+    } finally {
+      setLogLevel(originalLevel)
+    }
+  })
+
+  test('owns only enabled OAuth accounts with a resolved manifest binding in Claustrum mode', () => {
+    const binding = {
+      status: 'resolved' as const,
+      source: 'manifest' as const,
+      handle: 'manifest-handle',
+      credentialId: 'anthropic:work-alt',
+    }
+
+    for (const mode of ['local', 'claustrum'] as const) {
+      for (const enabled of [false, true]) {
+        for (const kind of ['oauth', 'api'] as const) {
+          for (const resolved of [false, true]) {
+            const account: AccountStorage['accounts'][number] =
+              kind === 'oauth'
+                ? {
+                    id: 'work-alt',
+                    type: 'oauth',
+                    refresh: 'refresh-token',
+                    enabled,
+                  }
+                : {
+                    id: 'work-alt',
+                    type: 'api',
+                    apiKey: 'api-key',
+                    baseURL: 'https://api.example.test',
+                    enabled,
+                  }
+            const storage: AccountStorage = {
+              ...baseStorage(),
+              claustrum: { mode },
+              accounts: [account],
+            }
+
+            expect(
+              isOAuthAccountVaultOwned(
+                storage,
+                account,
+                resolved ? binding : undefined,
+              ),
+            ).toBe(
+              mode === 'claustrum' && enabled && kind === 'oauth' && resolved,
+            )
+          }
+        }
+      }
+    }
+
+    const ownershipStorage = {
+      ...baseStorage(),
+      claustrum: { mode: 'claustrum' as const },
+    }
+    const ownershipAccount = {
+      id: 'work-alt',
+      type: 'oauth' as const,
+      refresh: 'refresh-token',
+      enabled: true,
+    }
+    expect(
+      isOAuthAccountVaultOwned(ownershipStorage, ownershipAccount, binding),
+    ).toBe(true)
+    expect(
+      isOAuthAccountVaultOwned(ownershipStorage, ownershipAccount, {
+        status: 'resolved',
+        source: 'legacy',
+        handle: 'legacy-handle',
+      }),
+    ).toBe(true)
+    expect(
+      isOAuthAccountVaultOwned(ownershipStorage, ownershipAccount, {
+        status: 'unresolved',
+        reason: 'missing-entry',
+      }),
+    ).toBe(false)
+    expect(
+      isOAuthAccountVaultOwned(
+        {
+          ...ownershipStorage,
+          claustrum: {
+            mode: 'claustrum',
+            accounts: { 'work-alt': { enabled: true } },
+          },
+        },
+        ownershipAccount,
+        undefined,
+      ),
+    ).toBe(false)
+    expect(
+      isOAuthAccountVaultOwned(
+        {
+          ...ownershipStorage,
+          claustrum: {
+            mode: 'local',
+            accounts: { 'work-alt': { enabled: true } },
+          },
+        },
+        ownershipAccount,
+        binding,
+      ),
+    ).toBe(false)
+  })
+})
+
+describe('clearClaustrumHandlePersistent', () => {
+  test('clears a handle from a whitespace-padded runtime state key', async () => {
+    const accountId = 'work-alt'
+    const handle = 'padded-state-handle'
+    await saveAccounts(baseStorage(), accountPath)
+    await addAccountPersistent(
+      {
+        id: accountId,
+        type: 'oauth',
+        refresh: 'refresh',
+        claustrumHandle: handle,
+      },
+      accountPath,
+    )
+    const statePath = getAccountStatePath(accountPath)
+    const state = JSON.parse(await readFile(statePath, 'utf8'))
+    state.accounts[' work-alt'] = state.accounts[accountId]
+    delete state.accounts[accountId]
+    await writeFile(statePath, JSON.stringify(state))
+
+    expect(
+      await clearClaustrumHandlePersistent({
+        id: accountId,
+        path: accountPath,
+      }),
+    ).toBe('updated')
+    expect(await readFile(statePath, 'utf8')).not.toContain(handle)
+  })
+
+  test('does not resurrect a cleared handle when a stale writer rotates tokens', async () => {
+    const accountId = 'custody-handle-fence'
+    const handle = 'custody-handle-fence-secret'
+    await saveAccounts(baseStorage(), accountPath)
+    await addAccountPersistent(
+      {
+        id: accountId,
+        type: 'oauth',
+        access: 'original-access',
+        refresh: 'original-refresh',
+        expires: 1_000,
+        claustrumHandle: handle,
+      },
+      accountPath,
+    )
+    const staleWriterStorage = (await loadAccounts(accountPath))!
+    const statePath = getAccountStatePath(accountPath)
+    expect(await readFile(statePath, 'utf8')).toContain(handle)
+
+    expect(
+      await clearClaustrumHandlePersistent({
+        id: accountId,
+        path: accountPath,
+      }),
+    ).toBe('updated')
+
+    const staleAccount = expectOAuthAccount(
+      staleWriterStorage.accounts.find((account) => account.id === accountId),
+    )
+    staleAccount.access = 'rotated-access'
+    staleAccount.refresh = 'rotated-refresh'
+    staleAccount.expires = 2_000
+    await saveAccountState(staleWriterStorage, accountPath, { accounts: true })
+
+    const stateBytes = await readFile(statePath, 'utf8')
+    expect(stateBytes).not.toContain(handle)
+    expect(JSON.parse(stateBytes).accounts?.[accountId]).toMatchObject({
+      access: 'rotated-access',
+      refresh: 'rotated-refresh',
+      expires: 2_000,
+    })
+  })
+})
+
 describe('addAccountPersistent', () => {
   test('adds a new account and persists', async () => {
     const storage = baseStorage()
@@ -7346,7 +7990,7 @@ describe('vault-served fallback refresh gating', () => {
     expect(vault.lastRefreshError).toBeUndefined()
   })
 
-  test('a vault-enabled account whose vault is unavailable still refreshes locally', async () => {
+  test('a vault-owned account whose vault is unavailable does not refresh locally', async () => {
     const storage = baseStorage()
     storage.quota = { enabled: false, failClosedOnUnknownQuota: false }
     storage.claustrum = {
@@ -7364,10 +8008,11 @@ describe('vault-served fallback refresh gating', () => {
       ),
       dueAccount(
         'vault-unavailable',
-        'outage-refresh',
+        'vault-unavailable-refresh',
         undefined,
         'handle-vault-unavailable',
       ),
+      dueAccount('plain-control', 'outage-refresh'),
     )
     await saveAccounts(storage, accountPath)
 
@@ -7384,10 +8029,8 @@ describe('vault-served fallback refresh gating', () => {
             JSON.parse(String(init?.body)) as { refresh_token: string }
           ).refresh_token
           refreshTokens.push(refreshToken)
-          if (refreshToken === 'vault-refresh') {
-            return new Response('{"error":"invalid_grant"}', { status: 400 })
-          }
-          return refreshResponse('vault-unavailable')
+          expect(refreshToken).toBe('outage-refresh')
+          return refreshResponse('plain-control')
         },
       ) as unknown as typeof fetch
 
@@ -7410,19 +8053,18 @@ describe('vault-served fallback refresh gating', () => {
       const unavailable = expectOAuthAccount(
         saved?.accounts.find((account) => account.id === 'vault-unavailable'),
       )
+      const plain = expectOAuthAccount(
+        saved?.accounts.find((account) => account.id === 'plain-control'),
+      )
       expect(refreshTokens).toEqual(['outage-refresh'])
       expect(served.access).toBe('vault-served-access')
       expect(served.lastRefreshError).toBeUndefined()
-      expect(unavailable.access).toBe('vault-unavailable-refreshed-access')
-      expect(logs).toContainEqual(
+      expect(unavailable.access).toBe('vault-unavailable-access')
+      expect(plain.access).toBe('plain-control-refreshed-access')
+      expect(logs).not.toContainEqual(
         expect.objectContaining({
-          level: 'warn',
-          channel: 'refresh',
-          message: 'custody override: local fallback refresh',
-          payload: {
-            accountId: 'vault-unavailable',
-            reason: 'vault credential unavailable',
-          },
+          message: 'vault service: local fallback refresh',
+          payload: expect.objectContaining({ accountId: 'vault-unavailable' }),
         }),
       )
     } finally {
diff --git a/packages/opencode/src/tests/add-account-flows.test.ts b/packages/opencode/src/tests/add-account-flows.test.ts
index 626e3a9c..b769f2d6 100644
--- a/packages/opencode/src/tests/add-account-flows.test.ts
+++ b/packages/opencode/src/tests/add-account-flows.test.ts
@@ -1,5 +1,5 @@
 import { afterEach, beforeEach, describe, expect, mock, test } from 'bun:test'
-import { mkdtemp, rm } from 'node:fs/promises'
+import { chmod, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { DEFAULT_FETCH_MOCK } from './test-fetch'
@@ -449,6 +449,44 @@ describe('add-oauth error paths', () => {
     expect(parsed.type).toBe('add-oauth-start')
   })
 
+  test('add-oauth-start refuses Claustrum mode before authorization', async () => {
+    const { loadAccounts, saveAccounts, setClaustrumModePersistent } =
+      await import('@cortexkit/anthropic-auth-core')
+    const storage = (await loadAccounts(accountPath))!
+    await saveAccounts(
+      { ...storage, claustrum: { mode: 'claustrum' } },
+      accountPath,
+    )
+    const authorize = mock(() =>
+      Promise.resolve({
+        url: 'https://example.test/authorize',
+        redirectUri: 'http://localhost/callback',
+        state: 'state',
+        verifier: 'verifier',
+      }),
+    )
+    const plugin = await getPlugin({ authorize } as any)
+
+    await expect(
+      plugin['command.execute.before']({
+        command: 'claude-account',
+        arguments: 'add-oauth-start',
+        sessionID: 'ses_claustrum_add',
+      }),
+    ).rejects.toThrow('Exit Claustrum mode first: /claude-account local')
+    expect(authorize).not.toHaveBeenCalled()
+
+    await setClaustrumModePersistent('local', accountPath)
+    await executeCommand(
+      plugin,
+      'claude-account',
+      'add-oauth-start',
+      'ses_local_add',
+    )
+    expect(authorize).toHaveBeenCalledTimes(1)
+    await plugin.dispose?.()
+  })
+
   test('pending entry is always cleared after finish (even on failure)', async () => {
     // This validates the finally-block behavior:
     // After calling add-oauth-finish with a real pending entry (from a real
@@ -582,6 +620,38 @@ describe('add-oauth label threading', () => {
     expect(account.label).toBe('work')
   })
 
+  test('add-oauth-finish clears the matching custody binding', async () => {
+    const manifestPath = join(tempDir, 'handles.json')
+    await writeFile(
+      manifestPath,
+      JSON.stringify({
+        version: 1,
+        providers: [
+          {
+            provider: 'anthropic',
+            serve: 'anthropic-auth',
+            accounts: [
+              {
+                label: 'work',
+                handle: `ckh_${'D'.repeat(43)}`,
+                credential_id: 'oauth:anthropic:work',
+              },
+            ],
+          },
+        ],
+      }),
+    )
+    await chmod(manifestPath, 0o600)
+    process.env.CLAUSTRUM_OPENCODE_HANDLES = manifestPath
+    try {
+      await runOAuthAddWithLabel('work')
+      const manifest = JSON.parse(await readFile(manifestPath, 'utf8'))
+      expect(manifest.providers[0].accounts).toEqual([])
+    } finally {
+      delete process.env.CLAUSTRUM_OPENCODE_HANDLES
+    }
+  })
+
   test('add-oauth-finish without --label leaves label undefined (UUID-name fallback)', async () => {
     const loaded = await runOAuthAddWithLabel(null)
     expect(loaded).not.toBeNull()
diff --git a/packages/opencode/src/tests/claude-code.test.ts b/packages/opencode/src/tests/claude-code.test.ts
index f01ce4f0..44aea1cf 100644
--- a/packages/opencode/src/tests/claude-code.test.ts
+++ b/packages/opencode/src/tests/claude-code.test.ts
@@ -6,12 +6,15 @@ import {
   type ClaudeCodeIdentity,
   getClaudeCodeIdentity,
   orderClaudeCodeBody,
+  type ProviderAccountUuid,
   REQUIRED_BETAS,
   resetClaudeCodeIdentityCachesForTest,
   resolveClaudeCodeIdentity,
   selectClaudeCodeBetas,
 } from '@cortexkit/anthropic-auth-core'
 
+const providerUuid = (value: string) => value as ProviderAccountUuid
+
 describe('Claude Code fingerprint helpers', () => {
   const originalFetch = globalThis.fetch
 
@@ -38,7 +41,7 @@ describe('Claude Code fingerprint helpers', () => {
       undefined,
       'isolation-main',
     )
-    expect(first.accountUuid).toBe('uuid-isolation')
+    expect(first.accountUuid).toBe(providerUuid('uuid-isolation'))
 
     const second = await resolveClaudeCodeIdentity(
       'sk-ant-oat-isolation-next',
@@ -67,7 +70,7 @@ describe('Claude Code fingerprint helpers', () => {
       undefined,
       'isolation-reset-main',
     )
-    expect(first.accountUuid).toBe('uuid-reset')
+    expect(first.accountUuid).toBe(providerUuid('uuid-reset'))
 
     resetClaudeCodeIdentityCachesForTest()
 
@@ -154,7 +157,7 @@ describe('Claude Code fingerprint helpers', () => {
   test('applies Claude Code headers and couples session id to metadata', () => {
     const identity: ClaudeCodeIdentity = {
       deviceId: 'a'.repeat(64),
-      accountUuid: '11111111-2222-4333-8444-555555555555',
+      accountUuid: providerUuid('11111111-2222-4333-8444-555555555555'),
       sessionId: '66666666-7777-4888-9999-aaaaaaaaaaaa',
     }
     const body: Record<string, unknown> = {
@@ -229,7 +232,7 @@ describe('Claude Code fingerprint helpers', () => {
       undefined,
       'main-slot',
     )
-    expect(successful.accountUuid).toBe('account-a')
+    expect(successful.accountUuid).toBe(providerUuid('account-a'))
 
     const failed = await resolveClaudeCodeIdentity(
       failedToken,
@@ -281,7 +284,7 @@ describe('Claude Code fingerprint helpers', () => {
       undefined,
       'main-slot',
     )
-    expect(initialIdentity.accountUuid).toBe('account-a')
+    expect(initialIdentity.accountUuid).toBe(providerUuid('account-a'))
     const pendingA = resolveClaudeCodeIdentity(tokenA, undefined, 'main-slot')
     await aStarted
     const identityB = await resolveClaudeCodeIdentity(
@@ -289,18 +292,18 @@ describe('Claude Code fingerprint helpers', () => {
       undefined,
       'main-slot',
     )
-    expect(identityB.accountUuid).toBe('account-b')
+    expect(identityB.accountUuid).toBe(providerUuid('account-b'))
 
     releaseA(new Response('bootstrap unavailable', { status: 503 }))
     const identityA = await pendingA
     expect(identityA.accountUuid).toBeUndefined()
 
-    const compatibility = await resolveClaudeCodeIdentity(
-      'compatibility-token-after-late-failure',
+    const sameCredential = await resolveClaudeCodeIdentity(
+      tokenB,
       undefined,
       'main-slot',
     )
-    expect(compatibility.accountUuid).toBe('account-b')
+    expect(sameCredential.accountUuid).toBe(providerUuid('account-b'))
   })
 
   test('orders serialized body fields like captured Claude Code requests', () => {
@@ -359,7 +362,9 @@ describe('Claude Code bootstrap identity lookup', () => {
       'bootstrap-account',
     )
 
-    expect(identity.accountUuid).toBe('11111111-2222-4333-8444-555555555555')
+    expect(identity.accountUuid).toBe(
+      providerUuid('11111111-2222-4333-8444-555555555555'),
+    )
     expect(fetchMock).toHaveBeenCalledTimes(1)
   })
 
@@ -423,13 +428,38 @@ describe('Claude Code bootstrap identity lookup', () => {
       'stable-main-slot',
     )
 
-    expect(first.accountUuid).toBe('main-account-a')
-    expect(second.accountUuid).toBe('main-account-b')
+    expect(first.accountUuid).toBe(providerUuid('main-account-a'))
+    expect(second.accountUuid).toBe(providerUuid('main-account-b'))
     expect(second.deviceId).toBe(first.deviceId)
     expect(second.sessionId).toBe(first.sessionId)
     expect(fetchMock).toHaveBeenCalledTimes(2)
   })
 
+  test('drops a bootstrapped UUID when a slot receives a non-oat credential', async () => {
+    const oatToken = 'sk-ant-oat-main-to-non-oat'
+    globalThis.fetch = mock(async () =>
+      Response.json({
+        oauth_account: { account_uuid: 'main-oat-account-uuid' },
+      }),
+    ) as unknown as typeof fetch
+
+    const oatIdentity = await resolveClaudeCodeIdentity(
+      oatToken,
+      undefined,
+      'main-slot',
+    )
+    const nonOatIdentity = await resolveClaudeCodeIdentity(
+      'main-non-oat-token',
+      undefined,
+      'main-slot',
+    )
+
+    expect(oatIdentity.accountUuid).toBe(providerUuid('main-oat-account-uuid'))
+    expect(nonOatIdentity.accountUuid).toBeUndefined()
+    expect(nonOatIdentity.deviceId).toBe(oatIdentity.deviceId)
+    expect(nonOatIdentity.sessionId).toBe(oatIdentity.sessionId)
+  })
+
   test('keeps device identity stable while refreshing bootstrap UUID per credential', async () => {
     const accountUuid = 'c7b3bc43-f4d8-48c6-a30f-7fd81a8db03f'
     const fetchMock = mock(
@@ -451,8 +481,8 @@ describe('Claude Code bootstrap identity lookup', () => {
       'uuid-account',
     )
 
-    expect(first.accountUuid).toBe(accountUuid)
-    expect(second.accountUuid).toBe(accountUuid)
+    expect(first.accountUuid).toBe(providerUuid(accountUuid))
+    expect(second.accountUuid).toBe(providerUuid(accountUuid))
     expect(second.deviceId).toBe(first.deviceId)
     expect(second.sessionId).toBe(first.sessionId)
     expect(fetchMock).toHaveBeenCalledTimes(2)
@@ -534,7 +564,7 @@ describe('Claude Code bootstrap identity lookup', () => {
 
     expect(resolved.deviceId).toBe(legacy.deviceId)
     expect(resolved.sessionId).toBe(legacy.sessionId)
-    expect(resolved.accountUuid).toBe('legacy-bootstrap-uuid')
+    expect(resolved.accountUuid).toBe(providerUuid('legacy-bootstrap-uuid'))
   })
 
   test('does not reuse an in-flight bootstrap from a rotated credential', async () => {
diff --git a/packages/opencode/src/tests/claustrum.test.ts b/packages/opencode/src/tests/claustrum.test.ts
index cfc32048..e3b6d39b 100644
--- a/packages/opencode/src/tests/claustrum.test.ts
+++ b/packages/opencode/src/tests/claustrum.test.ts
@@ -7,10 +7,13 @@ import {
   detectClaustrumConnection,
   executeAccountCommand,
   getDefaultClaustrumConnectionPath,
-  isClaustrumEnabledForAccount,
-  loadAccounts,
+  type OAuthAccount,
+  readCustodyHandles,
+  resolveCustodyHandle,
+  resolveCustodyHandlesPath,
   saveAccounts,
 } from '@cortexkit/anthropic-auth-core'
+import { loadGoldenCustodyManifest } from './custody-handle-manifest.fixture.ts'
 
 let tempDir: string
 let accountPath: string
@@ -163,7 +166,7 @@ describe('Claustrum connection detection', () => {
     })
   })
 
-  test('derives the default connection path from the current uid', () => {
+  test('derives the default connection path from the current uid', async () => {
     const originalGetuid = process.getuid
     Object.defineProperty(process, 'getuid', { value: () => 4242 })
     try {
@@ -176,56 +179,76 @@ describe('Claustrum connection detection', () => {
   })
 })
 
-describe('per-account Claustrum gate', () => {
-  test('defaults off when config is absent', async () => {
-    await saveAccounts(baseStorage(), accountPath)
-
-    const storage = await loadAccounts(accountPath)
-
-    expect(isClaustrumEnabledForAccount(storage!, 'account-a')).toBe(false)
+describe('custody handle resolution', () => {
+  const account = (input: Partial<OAuthAccount> = {}): OAuthAccount => ({
+    id: 'uuid-not-a-label',
+    type: 'oauth',
+    refresh: 'refresh-token',
+    ...input,
   })
 
-  test('defaults off when the gate config is malformed', async () => {
-    await writeFile(
-      accountPath,
-      JSON.stringify({ ...baseStorage(), claustrum: 'on' }),
+  test('resolves configured, environment, and XDG custody handle paths in order', () => {
+    expect(
+      resolveCustodyHandlesPath(
+        { handlesFile: '  /configured/handles.json  ' },
+        {
+          CLAUSTRUM_OPENCODE_HANDLES: '/environment/handles.json',
+          XDG_CONFIG_HOME: '/xdg',
+          HOME: '/home/tester',
+        },
+      ),
+    ).toBe('/configured/handles.json')
+    expect(
+      resolveCustodyHandlesPath(undefined, {
+        CLAUSTRUM_OPENCODE_HANDLES: '/environment/handles.json',
+        XDG_CONFIG_HOME: '/xdg',
+        HOME: '/home/tester',
+      }),
+    ).toBe('/environment/handles.json')
+    expect(
+      resolveCustodyHandlesPath(undefined, {
+        CLAUSTRUM_OPENCODE_HANDLES: 'relative/handles.json',
+        XDG_CONFIG_HOME: '/xdg',
+        HOME: '/home/tester',
+      }),
+    ).toBe('/xdg/cortexkit/opencode-handles.json')
+    expect(resolveCustodyHandlesPath(undefined, { HOME: '/home/tester' })).toBe(
+      '/home/tester/.config/cortexkit/opencode-handles.json',
     )
-
-    const storage = await loadAccounts(accountPath)
-
-    expect(isClaustrumEnabledForAccount(storage!, 'account-a')).toBe(false)
   })
 
-  test('keeps gate state independent for each account', async () => {
-    await saveAccounts(
-      {
-        ...baseStorage(),
-        claustrum: {
-          accounts: {
-            'account-a': { enabled: true },
-            'account-b': { enabled: false },
-          },
-        },
-      },
-      accountPath,
-    )
+  test('matches the golden manifest by account label rather than UUID', async () => {
+    const { manifest: golden } = await loadGoldenCustodyManifest()
+    const parsed = readCustodyHandles(golden, 'anthropic', 'anthropic-auth')
+    const manifest = {
+      version: 1 as const,
+      provider: 'anthropic' as const,
+      serve: 'anthropic-auth' as const,
+      accounts: parsed.accounts,
+      superseded: parsed.superseded,
+    }
+    const entry = manifest.accounts[0]
+    if (!entry) throw new Error('golden manifest has no anthropic account')
 
-    const storage = await loadAccounts(accountPath)
+    const result = resolveCustodyHandle({
+      account: account({ label: entry.label }),
+      manifest,
+    })
 
-    expect(isClaustrumEnabledForAccount(storage!, 'account-a')).toBe(true)
-    expect(isClaustrumEnabledForAccount(storage!, 'account-b')).toBe(false)
+    expect(result.status).toBe('resolved')
+    if (result.status !== 'resolved')
+      throw new Error('expected resolved handle')
+    expect(result.source).toBe('manifest')
   })
 })
 
 describe('account status Claustrum surface', () => {
-  test('reports detection and each account gate without changing account behavior', () => {
-    const result = executeAccountCommand({
+  test('reports the global mode and projected vault binding', async () => {
+    const result = await executeAccountCommand({
       argumentsText: '',
       storage: {
         ...baseStorage(),
-        claustrum: {
-          accounts: { 'account-a': { enabled: true } },
-        },
+        claustrum: { mode: 'claustrum' },
       },
       claustrum: {
         status: 'available',
@@ -233,13 +256,52 @@ describe('account status Claustrum surface', () => {
         wireVersion: 2,
         endpoints: [{ host: '127.0.0.1', port: 8757 }],
       },
+      statusProjection: {
+        claustrumDetection: 'available',
+        accounts: [
+          {
+            id: 'main',
+            label: 'OpenCode anthropic',
+            role: 'main',
+            enabled: true,
+            quotaPercent: null,
+            claustrumGate: 'na',
+            vaultServed: false,
+            vaultReauth: false,
+            custodyState: 'na',
+          },
+          {
+            id: 'account-a',
+            label: 'account-a',
+            role: 'fallback',
+            enabled: true,
+            quotaPercent: null,
+            claustrumGate: 'on',
+            vaultServed: false,
+            vaultReauth: false,
+            custodyState: 'on-cold',
+          },
+          {
+            id: 'account-b',
+            label: 'account-b',
+            role: 'fallback',
+            enabled: true,
+            quotaPercent: null,
+            claustrumGate: 'off',
+            vaultServed: false,
+            vaultReauth: false,
+            custodyState: 'off',
+          },
+        ],
+      },
     })
 
+    expect(result.text).toContain('Custody mode: claustrum')
     expect(result.text).toContain('Claustrum: available')
     expect(result.text).toContain('account-a')
-    expect(result.text).toContain('gate on')
+    expect(result.text).toContain('vault cold')
     expect(result.text).toContain('account-b')
-    expect(result.text).toContain('gate off')
+    expect(result.text).toContain('local')
   })
 })
 
diff --git a/packages/opencode/src/tests/cli.test.ts b/packages/opencode/src/tests/cli.test.ts
index a9aaadea..93fb06e0 100644
--- a/packages/opencode/src/tests/cli.test.ts
+++ b/packages/opencode/src/tests/cli.test.ts
@@ -1,10 +1,12 @@
 import { afterEach, beforeEach, describe, expect, test } from 'bun:test'
-import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { chmod, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import {
   addAccountPersistent,
+  custodyTombstoneKey,
   getAccountStatePath,
+  saveAccounts,
 } from '@cortexkit/anthropic-auth-core'
 
 import { addApiRoute, login, relaySetup } from '../cli'
@@ -114,6 +116,102 @@ describe('CLI api add', () => {
 })
 
 describe('CLI login', () => {
+  test('clears the matching custody binding after fallback OAuth login', async () => {
+    const accountPath = join(tempDir, 'anthropic-auth.json')
+    const manifestPath = join(tempDir, 'handles.json')
+    await writeFile(
+      manifestPath,
+      JSON.stringify({
+        version: 1,
+        providers: [
+          {
+            provider: 'anthropic',
+            serve: 'anthropic-auth',
+            accounts: [
+              {
+                label: 'cli-label',
+                handle: `ckh_${'D'.repeat(43)}`,
+                credential_id: 'oauth:anthropic:cli-label',
+              },
+            ],
+          },
+        ],
+      }),
+    )
+    await chmod(manifestPath, 0o600)
+    await saveAccounts(
+      {
+        version: 1,
+        accounts: [
+          {
+            id: 'cli-label',
+            label: 'cli-label',
+            type: 'oauth',
+            refresh: 'old-refresh',
+            authLineageId: 'old-lineage',
+          },
+        ],
+      },
+      accountPath,
+    )
+    await writeFile(
+      getAccountStatePath(accountPath),
+      JSON.stringify({
+        version: 1,
+        accounts: {
+          'cli-label': {
+            access: '',
+            refresh: custodyTombstoneKey('anthropic'),
+            expires: 0,
+            authLineageId: 'old-lineage',
+          },
+        },
+      }),
+    )
+
+    const warnings: string[] = []
+    const originalWarn = console.warn
+    console.warn = (...args: unknown[]) => {
+      warnings.push(args.map(String).join(' '))
+    }
+    try {
+      await withAccountEnv(
+        accountPath,
+        { CLAUSTRUM_OPENCODE_HANDLES: manifestPath },
+        () =>
+          login('cli-label', {
+            prompt: async () =>
+              'https://platform.claude.com/oauth/code/callback?code=cli-code&state=stub',
+            exchange: async () => ({
+              type: 'success' as const,
+              access: 'cli-access',
+              refresh: 'cli-refresh',
+              expires: Date.now() + 3600 * 1000,
+            }),
+          }),
+      )
+    } finally {
+      console.warn = originalWarn
+    }
+
+    const manifest = JSON.parse(await readFile(manifestPath, 'utf8'))
+    expect(manifest.providers[0].accounts).toEqual([])
+    const state = JSON.parse(
+      await readFile(getAccountStatePath(accountPath), 'utf8'),
+    )
+    expect(
+      state.claustrumDivergence['oauth:anthropic:cli-label'],
+    ).toMatchObject({ minimumRecordVersion: 1 })
+    expect(state.accounts['cli-label']).toMatchObject({
+      access: 'cli-access',
+      refresh: 'cli-refresh',
+    })
+    expect(state.accounts['cli-label'].authLineageId).not.toBe('old-lineage')
+    expect(warnings).toContain(
+      'Fallback login had no served vault record for cli-label',
+    )
+  })
+
   test('continues from label prompt to OAuth callback prompt and saves account', async () => {
     const accountPath = join(tempDir, 'anthropic-auth.json')
 
@@ -200,6 +298,28 @@ describe('CLI login', () => {
     )
   })
 
+  test('rejects an invalid label before saving an OAuth account', async () => {
+    const accountPath = join(tempDir, 'anthropic-auth.json')
+
+    await expect(
+      withAccountEnv(accountPath, {}, () =>
+        login('invalid label', {
+          prompt: async () => 'cli-code',
+          exchange: async () => ({
+            type: 'success' as const,
+            access: 'cli-access',
+            refresh: 'cli-refresh',
+            expires: Date.now() + 3600 * 1000,
+          }),
+        }),
+      ),
+    ).rejects.toThrow('invalid-label')
+
+    await expect(readFile(accountPath, 'utf8')).rejects.toMatchObject({
+      code: 'ENOENT',
+    })
+  })
+
   test('preserves an account committed while the interactive OAuth flow is open', async () => {
     const accountPath = join(tempDir, 'anthropic-auth.json')
     const now = Date.now()
diff --git a/packages/opencode/src/tests/command-dialogs.test.ts b/packages/opencode/src/tests/command-dialogs.test.ts
index 08e17a30..404be74c 100644
--- a/packages/opencode/src/tests/command-dialogs.test.ts
+++ b/packages/opencode/src/tests/command-dialogs.test.ts
@@ -1,11 +1,16 @@
 import { describe, expect, test } from 'bun:test'
 import type { PrimeAccountStatus } from '@cortexkit/anthropic-auth-core'
+import type { AccountDialogKnobs } from '../rpc/protocol'
 import {
+  buildAccountDialogL1,
   buildAccountDialogOption,
   buildKillswitchThresholdSeed,
+  buildManageAccountOptions,
   buildPrimeStatusRows,
   handlePrimeStatusOption,
+  normalizeAccountDialogPayload,
   PRIME_DIALOG_OPTIONS,
+  retainAccountDialogProjection,
 } from '../tui/command-dialogs'
 
 describe('buildKillswitchThresholdSeed', () => {
@@ -44,30 +49,49 @@ describe('buildAccountDialogOption', () => {
         tierLabel: 'Team · Max 5x',
         claustrumGate: 'on',
         vaultServed: true,
+        vaultReauth: false,
+        custodyState: 'on-vault-served',
       }),
     ).toEqual({
-      title: 'Work [fallback] 22% · gate on · vault served',
+      title: 'Work [fallback] 22% · custody vault-served',
       value: 'work',
       description: 'Team · Max 5x',
     })
   })
 
-  test('renders gate and vault markers without exposing credentials', () => {
+  test('renders the settled custody state without exposing credentials', () => {
     const option = buildAccountDialogOption({
       id: 'work',
       label: 'Work',
       role: 'fallback',
       enabled: true,
       quotaPercent: null,
-      claustrumGate: 'off',
+      claustrumGate: 'on',
       vaultServed: false,
+      vaultReauth: true,
+      custodyState: 'on-vault-reauth',
     })
-    expect(option.title).toContain('gate off')
-    expect(option.title).toContain('vault cold')
+    expect(option.title).toContain('custody vault reauth')
     expect(option.title).not.toContain('handle')
   })
 
-  test('renders the main account gate placeholder as n/a', () => {
+  test('renders the cold custody state', () => {
+    const option = buildAccountDialogOption({
+      id: 'work',
+      label: 'Work',
+      role: 'fallback',
+      enabled: true,
+      quotaPercent: null,
+      claustrumGate: 'on',
+      vaultServed: false,
+      vaultReauth: false,
+      custodyState: 'on-cold',
+    })
+
+    expect(option.title).toContain('custody vault cold')
+  })
+
+  test('does not label the main account as custody-ineligible', () => {
     const option = buildAccountDialogOption({
       id: 'main',
       label: 'Main',
@@ -76,10 +100,34 @@ describe('buildAccountDialogOption', () => {
       quotaPercent: null,
       claustrumGate: 'na',
       vaultServed: false,
+      vaultReauth: false,
+      custodyState: 'na',
     })
 
-    expect(option.title).toContain('gate n/a')
-    expect(option.title).toContain('vault n/a')
+    expect(option.title).not.toContain('custody n/a')
+    expect(option.title).not.toContain('n/a')
+  })
+
+  test('omits custody for an older account-modal payload without custody fields', () => {
+    const [oldPayloadAccount] = normalizeAccountDialogPayload({
+      accounts: [
+        {
+          id: 'work',
+          label: 'Work',
+          role: 'fallback',
+          enabled: true,
+          quotaPercent: null,
+          claustrumGate: 'off',
+          vaultServed: false,
+        },
+      ],
+    }).accounts
+
+    expect(() => buildAccountDialogOption(oldPayloadAccount!)).not.toThrow()
+    expect(buildAccountDialogOption(oldPayloadAccount!)).toEqual({
+      title: 'Work [fallback] –%',
+      value: 'work',
+    })
   })
 })
 
@@ -153,3 +201,154 @@ describe('openCommandDialog — claude-prime modal interaction (M6)', () => {
     expect(returned).toBe(true)
   })
 })
+
+const accountRows: AccountDialogKnobs['accounts'] = [
+  {
+    id: 'main',
+    label: 'Main',
+    role: 'main',
+    enabled: true,
+    quotaPercent: null,
+    claustrumGate: 'na',
+    vaultServed: false,
+    vaultReauth: false,
+    custodyState: 'na',
+  },
+  {
+    id: 'work',
+    label: 'Work',
+    role: 'fallback',
+    enabled: true,
+    quotaPercent: 42,
+    claustrumGate: 'on',
+    vaultServed: true,
+    vaultReauth: false,
+    custodyState: 'on-vault-served',
+  },
+]
+
+describe('openCommandDialog — global custody mode', () => {
+  test('keeps the last complete account projection when an apply result has no accounts', () => {
+    const projection = {
+      accounts: accountRows,
+      claustrumDetection: 'ready',
+      custodyMode: 'claustrum',
+      custodyModeKnown: true,
+    }
+
+    expect(
+      retainAccountDialogProjection(projection, {
+        error: 'provider unavailable',
+      }),
+    ).toBe(projection)
+  })
+
+  test('shows claustrum and offers local custody', () => {
+    const dialog = buildAccountDialogL1({
+      accounts: accountRows,
+      claustrumDetection: 'ready',
+      custodyMode: 'claustrum',
+      custodyModeKnown: true,
+    })
+
+    expect(dialog.header).toBe('Custody mode: claustrum')
+    expect(dialog.options).toContainEqual({
+      title: 'Use local custody',
+      value: '__custody-mode__',
+    })
+  })
+
+  test('offers Claustrum custody while local', () => {
+    const dialog = buildAccountDialogL1({
+      accounts: accountRows,
+      claustrumDetection: 'ready',
+      custodyMode: 'local',
+      custodyModeKnown: true,
+    })
+
+    expect(dialog.options).toContainEqual({
+      title: 'Use Claustrum custody',
+      value: '__custody-mode__',
+    })
+  })
+
+  test('renders an absent mode as unavailable without a control', () => {
+    const serverPayload: AccountDialogKnobs = {
+      accounts: accountRows,
+      claustrumDetection: 'ready',
+      custodyMode: 'local',
+      custodyModeKnown: true,
+    }
+    const { custodyMode: _absentMode, ...olderServerKnobs } = serverPayload
+    const dialog = buildAccountDialogL1(olderServerKnobs)
+
+    expect(dialog.header).toBe('Custody mode: unavailable from older server')
+    expect(dialog.options.map((option) => option.title)).not.toContain(
+      'Use Claustrum custody',
+    )
+    expect(dialog.options.map((option) => option.title)).not.toContain(
+      'Use local custody',
+    )
+    expect(dialog.options).toContainEqual(
+      expect.objectContaining({
+        title: 'Work [fallback] 42% · custody vault-served',
+      }),
+    )
+  })
+
+  test('treats a mode as unavailable when its known flag is false', () => {
+    const dialog = buildAccountDialogL1({
+      accounts: accountRows,
+      claustrumDetection: 'ready',
+      custodyMode: 'claustrum',
+      custodyModeKnown: false,
+    })
+
+    expect(dialog.header).toBe('Custody mode: unavailable from older server')
+    expect(dialog.options.map((option) => option.title)).not.toContain(
+      'Use local custody',
+    )
+  })
+
+  test('renders a custody mismatch verdict without a control', () => {
+    const dialog = buildAccountDialogL1({
+      accounts: accountRows,
+      claustrumDetection: 'ready',
+      custodyMode: 'RESUME_TAKEOVER',
+      custodyModeKnown: true,
+    })
+
+    expect(dialog.header).toBe('Custody mode: mismatch: RESUME_TAKEOVER')
+    expect(dialog.modeAction).toBeUndefined()
+  })
+
+  test('keeps custody out of per-account management and main caveats', () => {
+    const mainOption = buildAccountDialogL1({
+      accounts: accountRows,
+      claustrumDetection: 'ready',
+      custodyMode: 'local',
+      custodyModeKnown: true,
+    }).options.find((option) => option.value === 'main')
+    expect(mainOption?.title).not.toMatch(/n\/a|eligible/i)
+
+    expect(
+      buildManageAccountOptions(accountRows[1]!)
+        .map((option) => option.title)
+        .join('\n'),
+    ).not.toMatch(/custody/i)
+  })
+
+  test('dispatches the opposite custody mode through the account command path', () => {
+    const dialog = buildAccountDialogL1({
+      accounts: accountRows,
+      claustrumDetection: 'ready',
+      custodyMode: 'claustrum',
+      custodyModeKnown: true,
+    })
+
+    expect(dialog.modeAction).toEqual({
+      command: 'claude-account',
+      arguments: 'local',
+    })
+  })
+})
diff --git a/packages/opencode/src/tests/credential-handle-blindness.test.ts b/packages/opencode/src/tests/credential-handle-blindness.test.ts
index 1d7852d0..f34b22d0 100644
--- a/packages/opencode/src/tests/credential-handle-blindness.test.ts
+++ b/packages/opencode/src/tests/credential-handle-blindness.test.ts
@@ -1,18 +1,28 @@
 import { afterEach, describe, expect, mock, test } from 'bun:test'
-import { mkdtemp, readdir, readFile, rm } from 'node:fs/promises'
+import {
+  chmod,
+  mkdtemp,
+  readdir,
+  readFile,
+  rm,
+  writeFile,
+} from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import {
   __setLogTestSink,
   buildAccountList,
+  custodyTombstoneOAuth,
   dumpDirectRequest,
   dumpRelayRequest,
   dumpResponseArtifact,
+  getLogLevel,
   resetDumpState,
-  saveAccountState,
   saveAccounts,
   setDumpEnabled,
+  setLogLevel,
 } from '@cortexkit/anthropic-auth-core'
+
 import { AnthropicAuthPlugin } from '../index'
 import { startRpcServer } from '../rpc/rpc-server'
 import {
@@ -20,8 +30,11 @@ import {
   type SidebarState,
   setSidebarState,
 } from '../sidebar-state'
+import { bootRuledClaustrumRow as bootSharedRuledClaustrumRow } from './custody-ruled-row.fixture'
 
 const HANDLE_SENTINEL = 'claustrum-handle-sentinel-7f2d'
+const RULED_HANDLE = `ckh_${'H'.repeat(43)}`
+const RULED_MAIN_HANDLE = `ckh_${'Z'.repeat(43)}`
 const TOKEN_SENTINEL = 'claustrum-token-sentinel-9a41'
 
 const dumpInputContract: [
@@ -133,8 +146,12 @@ async function readNonEmpty(path: string): Promise<string> {
   return bytes
 }
 
-function seedCredentialForTest(cache: any, recordVersion: number) {
-  cache.seedForTest(HANDLE_SENTINEL, {
+function seedCredentialForTest(
+  cache: any,
+  recordVersion: number,
+  handle = HANDLE_SENTINEL,
+) {
+  cache.seedForTest(handle, {
     payload: JSON.stringify({ access_token: TOKEN_SENTINEL }),
     expiresAtMs: Date.now() + 5 * 60 * 60 * 1000,
     recordVersion,
@@ -181,101 +198,81 @@ describe('credential-handle blindness', () => {
     )
   })
 
+  async function bootRuledClaustrumRow(
+    options: Omit<
+      Parameters<typeof bootSharedRuledClaustrumRow>[0],
+      | 'createFallbackStorage'
+      | 'useTempAccountFile'
+      | 'getPlugin'
+      | 'extractUrl'
+      | 'tempConfigDir'
+    >,
+  ) {
+    let tempConfigDir = ''
+    return bootSharedRuledClaustrumRow({
+      ...options,
+      createFallbackStorage: (storage) => ({ version: 1, ...storage }) as never,
+      useTempAccountFile: async (storage) => {
+        tempConfigDir = await mkdtemp(join(tmpdir(), 'opencode-handle-ruled-'))
+        accountDirs.push(tempConfigDir)
+        process.env.OPENCODE_ANTHROPIC_AUTH_FILE = join(
+          tempConfigDir,
+          'anthropic-auth.json',
+        )
+        await saveAccounts(storage, process.env.OPENCODE_ANTHROPIC_AUTH_FILE)
+      },
+      getPlugin: async (accountStoragePath, runtimeOverrides) => {
+        process.env.OPENCODE_ANTHROPIC_AUTH_FILE = accountStoragePath
+        return (
+          AnthropicAuthPlugin as unknown as (
+            ctx: { client: unknown },
+            runtimeOverrides: Record<string, unknown>,
+          ) => Promise<any>
+        )(
+          { client: { auth: { set: mock(() => Promise.resolve()) } } },
+          runtimeOverrides,
+        )
+      },
+      extractUrl: (input) =>
+        typeof input === 'string'
+          ? input
+          : input instanceof URL
+            ? input.toString()
+            : input.url,
+      tempConfigDir: () => tempConfigDir,
+    })
+  }
+
   test('dump entry points exclude account-shaped inputs', () => {
     expect(dumpInputContract).toEqual([true, true])
   })
 
   test('production dump path stays blind to handle-bearing account storage', async () => {
-    const accountDir = await mkdtemp(
-      join(tmpdir(), 'opencode-handle-production-'),
-    )
-    accountDirs.push(accountDir)
-    const accountPath = join(accountDir, 'anthropic-auth.json')
     const dumpDir = await mkdtemp(join(tmpdir(), 'opencode-handle-dump-'))
     dumpDirs.push(dumpDir)
-    process.env.OPENCODE_ANTHROPIC_AUTH_FILE = accountPath
-    process.env.OPENCODE_ANTHROPIC_AUTH_SIDEBAR_STATE_FILE = join(
-      accountDir,
-      'sidebar-state.json',
-    )
     process.env.OPENCODE_ANTHROPIC_AUTH_DUMP_DIR = dumpDir
     setDumpEnabled(true)
-
-    const fallbackAccount = {
-      ...accountWithHandle(),
-      access: 'fallback-access',
-      expires: Date.now() + 5 * 60 * 60 * 1000,
-      quota: {
-        five_hour: {
-          usedPercent: 50,
-          remainingPercent: 50,
-          checkedAt: Date.now(),
-        },
-        seven_day: {
-          usedPercent: 20,
-          remainingPercent: 80,
-          checkedAt: Date.now(),
+    const fixture = await bootRuledClaustrumRow({
+      route: 'fallback-first',
+      fallbacks: [
+        {
+          label: 'work',
+          handle: RULED_HANDLE,
+          access: 'vault-dump-access',
+          account: { id: 'work-alt' },
         },
-      },
-    }
-    const storage = {
-      version: 1,
-      main: { type: 'opencode', provider: 'anthropic' },
-      fallbackOn: [429],
-      quota: { enabled: false },
-      dump: { enabled: true },
-      claustrum: { accounts: { 'work-alt': { enabled: true } } },
-      accounts: [fallbackAccount],
-    } as never
-    await saveAccounts(storage, accountPath)
-    await saveAccountState(storage, accountPath, { accounts: true })
-
-    const authorizations: Array<string | null> = []
-    const requestUrls: string[] = []
-    globalThis.fetch = mock(
-      (input: string | URL | Request, init?: RequestInit) => {
-        const url =
-          typeof input === 'string'
-            ? input
-            : input instanceof URL
-              ? input.toString()
-              : input.url
-        requestUrls.push(url)
-        if (!url.startsWith('https://api.anthropic.com/v1/messages')) {
-          return Promise.resolve(new Response('{}', { status: 500 }))
-        }
-        authorizations.push(new Headers(init?.headers).get('authorization'))
-        return Promise.resolve(
-          new Response(
-            '{"id":"msg_handle_production","type":"message","model":"claude-sonnet-4-5","content":[]}',
-            {
-              status: 200,
-              headers: { 'content-type': 'application/json' },
-            },
-          ),
-        )
-      },
-    ) as unknown as typeof fetch
-
-    const plugin = await (
-      AnthropicAuthPlugin as unknown as (ctx: {
-        client: unknown
-      }) => Promise<any>
-    )({
-      client: { auth: { set: mock(() => Promise.resolve()) } },
+      ],
+      storageOverrides: { dump: { enabled: true } },
+      response: () =>
+        new Response(
+          '{"id":"msg_handle_production","type":"message","model":"claude-sonnet-4-5","content":[]}',
+          {
+            status: 200,
+            headers: { 'content-type': 'application/json' },
+          },
+        ),
     })
-    const result = await plugin.auth.loader(
-      () =>
-        Promise.resolve({
-          type: 'oauth' as const,
-          access: 'main-access',
-          refresh: 'main-refresh',
-          expires: Date.now() + 100_000,
-          account: fallbackAccount,
-        } as never),
-      { models: {} },
-    )
-    const response = await result.fetch(
+    const response = await fixture.result.fetch(
       'https://api.anthropic.com/v1/messages',
       {
         method: 'POST',
@@ -286,15 +283,10 @@ describe('credential-handle blindness', () => {
       },
     )
     await response.text()
-    await plugin.dispose?.()
+    await fixture.plugin.dispose?.()
 
     expect(response.status).toBe(200)
-    expect(
-      requestUrls.some((url) =>
-        url.startsWith('https://api.anthropic.com/v1/messages'),
-      ),
-    ).toBe(true)
-    expect(authorizations).toContain('Bearer main-access')
+    expect(fixture.authorizations).toContain('Bearer vault-dump-access')
     const files = await readdir(dumpDir)
     expect(files.length).toBeGreaterThan(0)
     const bytes = await Promise.all(
@@ -303,85 +295,69 @@ describe('credential-handle blindness', () => {
     const artifacts = bytes.join('\n')
     expect(artifacts).toContain('production handle blind')
     expect(artifacts).toContain('msg_handle_production')
-    expect(countOccurrences(artifacts, HANDLE_SENTINEL)).toBe(0)
+    expect(countOccurrences(artifacts, RULED_HANDLE)).toBe(0)
   })
 
   test('report failure logs stay blind to the served credential handle', async () => {
-    const accountDir = await mkdtemp(
-      join(tmpdir(), 'opencode-handle-report-log-'),
-    )
-    accountDirs.push(accountDir)
-    const accountPath = join(accountDir, 'anthropic-auth.json')
-    process.env.OPENCODE_ANTHROPIC_AUTH_FILE = accountPath
-
-    const storage = {
-      version: 1,
-      routing: { mode: 'fallback-first' },
-      quota: { enabled: false, failClosedOnUnknownQuota: false },
-      claustrum: { accounts: { 'work-alt': { enabled: true } } },
-      accounts: [
-        {
-          ...accountWithHandle(),
-          access: 'fallback-access',
-          expires: Date.now() + 5 * 60 * 60 * 1000,
-        },
-      ],
-    } as never
-    await saveAccounts(storage, accountPath)
-
     const logs: Array<Record<string, unknown>> = []
     __setLogTestSink((record) => logs.push(record as Record<string, unknown>))
     try {
-      const calls: string[] = []
       const reportParams: unknown[] = []
-      const connector = async () =>
-        ({
-          call: async (_moduleId: string, method: string, params: unknown) => {
-            calls.push(method)
-            if (method === 'credential.get') {
-              return {
-                result: {
-                  payload: Array.from(
-                    new TextEncoder().encode(
-                      JSON.stringify({ access_token: 'vault-access' }),
+      const fixture = await bootRuledClaustrumRow({
+        route: 'fallback-first',
+        fallbacks: [
+          {
+            label: 'work',
+            handle: RULED_HANDLE,
+            access: 'vault-access',
+            account: { id: 'work-alt' },
+          },
+        ],
+        connector: (calls) => async () =>
+          ({
+            call: async (
+              _moduleId: string,
+              method: string,
+              params: unknown,
+            ) => {
+              calls.push({
+                method,
+                params: (params ?? {}) as Record<string, unknown>,
+              })
+              if (method === 'credential.get') {
+                return {
+                  result: {
+                    payload: Array.from(
+                      new TextEncoder().encode(
+                        JSON.stringify({ access_token: 'vault-access' }),
+                      ),
                     ),
-                  ),
-                  expires_at_ms: Date.now() + 60_000,
-                  record_version: 17,
-                },
+                    expires_at_ms: Date.now() + 60_000,
+                    record_version: 17,
+                  },
+                }
               }
-            }
-            if (method === 'credential.report_auth_failure')
-              reportParams.push(params)
-            throw new Error('report failed')
-          },
-          close: () => {},
-        }) as never
-      globalThis.fetch = mock(() =>
-        Promise.resolve(new Response('{}', { status: 401 })),
-      ) as unknown as typeof fetch
-
-      const plugin = await (
-        AnthropicAuthPlugin as unknown as (
-          ctx: { client: unknown },
-          runtimeOverrides: { claustrumConnector: typeof connector },
-        ) => Promise<any>
-      )(
-        { client: { auth: { set: mock(() => Promise.resolve()) } } },
-        { claustrumConnector: connector },
-      )
-      const result = await plugin.auth.loader(
-        () =>
-          Promise.resolve({
-            type: 'oauth' as const,
-            access: 'main-access',
-            refresh: 'main-refresh',
-            expires: Date.now() + 100_000,
+              if (method === 'credential.report_auth_failure') {
+                if ((params as { handle?: unknown }).handle === RULED_HANDLE) {
+                  reportParams.push(params)
+                  throw new Error('report failed')
+                }
+                return { result: { ok: true } }
+              }
+              throw new Error('report failed')
+            },
+            close: () => {},
+          }) as never,
+        onFetch: (_input, init) =>
+          new Response('{}', {
+            status:
+              new Headers(init?.headers).get('authorization') ===
+              'Bearer vault-main-access'
+                ? 200
+                : 401,
           }),
-        { models: {} },
-      )
-
-      const response = await result.fetch(
+      })
+      const response = await fixture.result.fetch(
         'https://api.anthropic.com/v1/messages',
         {
           method: 'POST',
@@ -392,14 +368,18 @@ describe('credential-handle blindness', () => {
         },
       )
       await response.text()
-      await plugin.dispose?.()
+      await fixture.plugin.dispose?.()
 
       expect(response.status).toBe(401)
-      expect(calls).toContain('credential.get')
-      expect(calls).toContain('credential.report_auth_failure')
+      expect(fixture.calls.map((call) => call.method)).toContain(
+        'credential.get',
+      )
+      expect(fixture.calls.map((call) => call.method)).toContain(
+        'credential.report_auth_failure',
+      )
       expect(reportParams).toEqual([
         {
-          handle: HANDLE_SENTINEL,
+          handle: RULED_HANDLE,
           provider_status: 401,
           record_version: 17,
           reporter_source: 'direct',
@@ -407,109 +387,184 @@ describe('credential-handle blindness', () => {
       ])
       expect(JSON.stringify(reportParams)).not.toContain('vault-access')
       expect(
-        logs.some((record) => JSON.stringify(record).includes(HANDLE_SENTINEL)),
+        logs.some((record) => JSON.stringify(record).includes(RULED_HANDLE)),
       ).toBe(false)
     } finally {
       __setLogTestSink(null)
     }
   })
 
-  test('deduplicates concurrent reports by served handle and record version', async () => {
+  test('manifest-source vault-unusable logs stay blind to the custody handle', async () => {
+    const manifestHandle = `ckh_${'M'.repeat(43)}`
     const accountDir = await mkdtemp(
-      join(tmpdir(), 'opencode-handle-report-dedupe-'),
+      join(tmpdir(), 'opencode-handle-manifest-unusable-'),
     )
     accountDirs.push(accountDir)
     const accountPath = join(accountDir, 'anthropic-auth.json')
+    const manifestPath = join(accountDir, 'handles.json')
+    const previousManifestPath = process.env.CLAUSTRUM_OPENCODE_HANDLES
+    const previousLogLevel = getLogLevel()
     process.env.OPENCODE_ANTHROPIC_AUTH_FILE = accountPath
-
-    const checkedAt = Date.now()
-    const fallbackAccount = {
-      ...accountWithHandle(),
-      access: 'fallback-access',
-      expires: Date.now() + 5 * 60 * 60 * 1000,
-      quota: {
-        five_hour: {
-          usedPercent: 10,
-          remainingPercent: 90,
-          checkedAt,
-        },
-        seven_day: {
-          usedPercent: 10,
-          remainingPercent: 90,
-          checkedAt,
-        },
-      },
-    }
+    process.env.CLAUSTRUM_OPENCODE_HANDLES = manifestPath
+    await writeFile(
+      manifestPath,
+      JSON.stringify({
+        version: 1,
+        providers: [
+          {
+            provider: 'anthropic',
+            serve: 'anthropic-auth',
+            accounts: [
+              {
+                label: 'work',
+                handle: manifestHandle,
+                credential_id: 'oauth:anthropic:work',
+              },
+            ],
+          },
+        ],
+      }),
+    )
+    await chmod(manifestPath, 0o600)
     await saveAccounts(
       {
         version: 1,
-        routing: { mode: 'fallback-first' },
-        quota: {
-          enabled: true,
-          checkIntervalMinutes: 5,
-          failClosedOnUnknownQuota: false,
-        },
-        claustrum: { accounts: { 'work-alt': { enabled: true } } },
-        accounts: [fallbackAccount],
+        quota: { enabled: false, failClosedOnUnknownQuota: false },
+        claustrum: { mode: 'claustrum' },
+        accounts: [
+          {
+            id: 'work-alt',
+            label: 'work',
+            ...custodyTombstoneOAuth('anthropic'),
+            enabled: true,
+          },
+        ],
       } as never,
       accountPath,
     )
-
-    const reports: Array<Record<string, unknown>> = []
-    const firstReportStarted = Promise.withResolvers<void>()
-    const releaseFirstReport = Promise.withResolvers<void>()
+    const logs: Array<Record<string, unknown>> = []
+    setLogLevel('debug')
+    __setLogTestSink((record) => logs.push(record as Record<string, unknown>))
+    const intervalHandlers: Array<() => unknown> = []
+    let credentialGets = 0
     const connector = async () =>
       ({
-        call: async (_moduleId: string, method: string, params: unknown) => {
-          if (method === 'credential.get') {
-            return {
-              result: {
-                payload: Array.from(
-                  new TextEncoder().encode(
-                    JSON.stringify({ access_token: 'vault-access' }),
-                  ),
-                ),
-                expires_at_ms: Date.now() + 5 * 60 * 60 * 1000,
-                record_version: 17,
-              },
-            }
-          }
-          if (method === 'credential.report_auth_failure') {
-            reports.push(params as Record<string, unknown>)
-            if (reports.length === 1) {
-              firstReportStarted.resolve()
-              await releaseFirstReport.promise
-            }
-            return { result: { ok: true } }
+        call: async (_moduleId: string, method: string) => {
+          if (method !== 'credential.get')
+            throw new Error(`unexpected method: ${method}`)
+          credentialGets += 1
+          return {
+            result: {
+              payload: Array.from(new TextEncoder().encode(JSON.stringify({}))),
+              expires_at_ms: Date.now() + 5 * 60 * 60 * 1000,
+              record_version: 1,
+            },
           }
-          throw new Error(`unexpected method: ${method}`)
         },
         close: () => {},
       }) as never
+    try {
+      const plugin = await (
+        AnthropicAuthPlugin as unknown as (
+          ctx: { client: unknown },
+          runtimeOverrides: {
+            claustrumConnector: typeof connector
+            setInterval: typeof setInterval
+          },
+        ) => Promise<any>
+      )(
+        { client: { auth: { set: mock(() => Promise.resolve()) } } },
+        {
+          claustrumConnector: connector,
+          setInterval: mock((handler: () => unknown) => {
+            intervalHandlers.push(handler)
+            return { unref() {} } as never
+          }) as never,
+        },
+      )
+      await plugin.__fallbackRefreshReady
+      // Plugin boot reapplies the persisted logging level, so debug must be reset afterward.
+      setLogLevel('debug')
+      plugin.__claustrumCredentialCache.seedForTest(manifestHandle, {
+        payload: JSON.stringify({}),
+        expiresAtMs: Date.now() + 5 * 60 * 60 * 1000,
+        recordVersion: 2,
+      })
+      expect(intervalHandlers.length).toBeGreaterThan(0)
+      await Promise.all(intervalHandlers.map((handler) => handler()))
+      await plugin.dispose?.()
 
-    globalThis.fetch = mock(() =>
-      Promise.resolve(new Response('{}', { status: 401 })),
-    ) as unknown as typeof fetch
-
-    const plugin = await (
-      AnthropicAuthPlugin as unknown as (
-        ctx: { client: unknown },
-        runtimeOverrides: { claustrumConnector: typeof connector },
-      ) => Promise<any>
-    )(
-      { client: { auth: { set: mock(() => Promise.resolve()) } } },
-      { claustrumConnector: connector },
-    )
-    const result = await plugin.auth.loader(
-      () =>
-        Promise.resolve({
-          type: 'oauth' as const,
-          access: 'main-access',
-          refresh: 'main-refresh',
-          expires: Date.now() + 100_000,
+      expect(credentialGets).toBeGreaterThan(0)
+      expect(
+        logs.some(
+          (record) => record.message === 'vault fallback credential unusable',
+        ),
+      ).toBe(true)
+      expect(JSON.stringify(logs)).not.toContain(manifestHandle)
+    } finally {
+      __setLogTestSink(null)
+      setLogLevel(previousLogLevel)
+      if (previousManifestPath === undefined)
+        delete process.env.CLAUSTRUM_OPENCODE_HANDLES
+      else process.env.CLAUSTRUM_OPENCODE_HANDLES = previousManifestPath
+    }
+  })
+
+  test('deduplicates concurrent reports by served handle and record version', async () => {
+    const reports: Array<Record<string, unknown>> = []
+    const firstReportStarted = Promise.withResolvers<void>()
+    const releaseFirstReport = Promise.withResolvers<void>()
+    const fixture = await bootRuledClaustrumRow({
+      route: 'fallback-first',
+      fallbacks: [
+        {
+          label: 'work',
+          handle: RULED_HANDLE,
+          access: 'vault-access',
+          account: { id: 'work-alt' },
+        },
+      ],
+      connector: () => async () =>
+        ({
+          call: async (_moduleId: string, method: string, params: unknown) => {
+            if (method === 'credential.get') {
+              return {
+                result: {
+                  payload: Array.from(
+                    new TextEncoder().encode(
+                      JSON.stringify({ access_token: 'vault-access' }),
+                    ),
+                  ),
+                  expires_at_ms: Date.now() + 5 * 60 * 60 * 1000,
+                  record_version: 17,
+                },
+              }
+            }
+            if (method === 'credential.report_auth_failure') {
+              if ((params as { handle?: unknown }).handle !== RULED_HANDLE)
+                return { result: { ok: true } }
+              reports.push(params as Record<string, unknown>)
+              if (reports.length === 1) {
+                firstReportStarted.resolve()
+                await releaseFirstReport.promise
+              }
+              return { result: { ok: true } }
+            }
+            throw new Error(`unexpected method: ${method}`)
+          },
+          close: () => {},
+        }) as never,
+      onFetch: (_input, init) =>
+        new Response('{}', {
+          status:
+            new Headers(init?.headers).get('authorization') ===
+            'Bearer vault-main-access'
+              ? 200
+              : 401,
         }),
-      { models: {} },
-    )
+    })
+    const plugin = fixture.plugin as any
+    const result = fixture.result
     const request = () =>
       result.fetch('https://api.anthropic.com/v1/messages', {
         method: 'POST',
@@ -533,90 +588,62 @@ describe('credential-handle blindness', () => {
   })
 
   test('does not re-report a credential version after cache re-population', async () => {
-    const accountDir = await mkdtemp(
-      join(tmpdir(), 'opencode-handle-report-version-fence-'),
-    )
-    accountDirs.push(accountDir)
-    const accountPath = join(accountDir, 'anthropic-auth.json')
-    process.env.OPENCODE_ANTHROPIC_AUTH_FILE = accountPath
-    await saveAccounts(
-      {
-        version: 1,
-        routing: { mode: 'fallback-first' },
-        quota: { enabled: false, failClosedOnUnknownQuota: false },
-        claustrum: { accounts: { 'work-alt': { enabled: true } } },
-        accounts: [
-          {
-            ...accountWithHandle(),
-            expires: Date.now() + 5 * 60 * 60 * 1000,
-          },
-        ],
-      } as never,
-      accountPath,
-    )
-
     const reports: Array<Record<string, unknown>> = []
-    const connector = async () =>
-      ({
-        call: async (_moduleId: string, method: string, params: unknown) => {
-          if (method === 'credential.get') {
-            return {
-              result: {
-                payload: Array.from(
-                  new TextEncoder().encode(
-                    JSON.stringify({ access_token: TOKEN_SENTINEL }),
+    const fixture = await bootRuledClaustrumRow({
+      route: 'fallback-first',
+      fallbacks: [
+        {
+          label: 'work',
+          handle: RULED_HANDLE,
+          access: TOKEN_SENTINEL,
+          account: { id: 'work-alt' },
+        },
+      ],
+      connector: (calls) => async () =>
+        ({
+          call: async (_moduleId: string, method: string, params: unknown) => {
+            calls.push({
+              method,
+              params: (params ?? {}) as Record<string, unknown>,
+            })
+            if (method === 'credential.get') {
+              const handle = (params as { handle?: unknown }).handle
+              return {
+                result: {
+                  payload: Array.from(
+                    new TextEncoder().encode(
+                      JSON.stringify({
+                        access_token:
+                          handle === RULED_HANDLE
+                            ? TOKEN_SENTINEL
+                            : 'vault-main-access',
+                      }),
+                    ),
                   ),
-                ),
-                expires_at_ms: Date.now() + 5 * 60 * 60 * 1000,
-                record_version: 17,
-              },
+                  expires_at_ms: Date.now() + 5 * 60 * 60 * 1000,
+                  record_version: 17,
+                },
+              }
             }
-          }
-          if (method === 'credential.report_auth_failure') {
-            reports.push(params as Record<string, unknown>)
-            return { result: { ok: true } }
-          }
-          throw new Error(`unexpected method: ${method}`)
-        },
-        close: () => {},
-      }) as never
-    globalThis.fetch = mock(
-      (input: string | URL | Request, init?: RequestInit) => {
-        const url =
-          typeof input === 'string'
-            ? input
-            : input instanceof URL
-              ? input.toString()
-              : input.url
-        if (!url.includes('/v1/messages'))
-          return Promise.resolve(new Response('{}', { status: 200 }))
-        const authorization = new Headers(init?.headers).get('authorization')
-        if (authorization === 'Bearer main-access') {
-          return Promise.resolve(new Response('{}', { status: 200 }))
-        }
-        return Promise.resolve(new Response('{}', { status: 401 }))
-      },
-    ) as unknown as typeof fetch
-
-    const plugin = await (
-      AnthropicAuthPlugin as unknown as (
-        ctx: { client: unknown },
-        runtimeOverrides: { claustrumConnector: typeof connector },
-      ) => Promise<any>
-    )(
-      { client: { auth: { set: mock(() => Promise.resolve()) } } },
-      { claustrumConnector: connector },
-    )
-    const result = await plugin.auth.loader(
-      () =>
-        Promise.resolve({
-          type: 'oauth' as const,
-          access: 'main-access',
-          refresh: 'main-refresh',
-          expires: Date.now() + 100_000,
+            if (method === 'credential.report_auth_failure') {
+              reports.push(params as Record<string, unknown>)
+              return { result: { ok: true } }
+            }
+            throw new Error(`unexpected method: ${method}`)
+          },
+          close: () => {},
+        }) as never,
+      onFetch: (_input, init) =>
+        new Response('{}', {
+          status:
+            new Headers(init?.headers).get('authorization') ===
+            'Bearer vault-main-access'
+              ? 200
+              : 401,
         }),
-      { models: {} },
-    )
+    })
+    const plugin = fixture.plugin as any
+    const result = fixture.result as any
     const request = () =>
       result.fetch('https://api.anthropic.com/v1/messages', {
         method: 'POST',
@@ -629,18 +656,18 @@ describe('credential-handle blindness', () => {
     await (await request()).text()
     expect(reports.map((report) => report.record_version)).toEqual([17])
 
-    seedCredentialForTest(plugin.__claustrumCredentialCache, 17)
+    seedCredentialForTest(plugin.__claustrumCredentialCache, 17, RULED_HANDLE)
     await result.__reportClaustrumAuthFailureForTest({
       accountId: 'work-alt',
-      handle: HANDLE_SENTINEL,
+      handle: RULED_HANDLE,
       recordVersion: 17,
     })
     expect(reports.map((report) => report.record_version)).toEqual([17])
 
-    seedCredentialForTest(plugin.__claustrumCredentialCache, 18)
+    seedCredentialForTest(plugin.__claustrumCredentialCache, 18, RULED_HANDLE)
     await result.__reportClaustrumAuthFailureForTest({
       accountId: 'work-alt',
-      handle: HANDLE_SENTINEL,
+      handle: RULED_HANDLE,
       recordVersion: 18,
     })
     await plugin.dispose?.()
@@ -649,110 +676,75 @@ describe('credential-handle blindness', () => {
   })
 
   test('keeps the original response readable when the fenced fallback cannot send', async () => {
-    const accountDir = await mkdtemp(
-      join(tmpdir(), 'opencode-handle-original-response-'),
-    )
-    accountDirs.push(accountDir)
-    const accountPath = join(accountDir, 'anthropic-auth.json')
-    process.env.OPENCODE_ANTHROPIC_AUTH_FILE = accountPath
-    await saveAccounts(
-      {
-        version: 1,
-        routing: { mode: 'main-first' },
-        fallbackOn: [429],
-        quota: { enabled: false, failClosedOnUnknownQuota: false },
-        claustrum: { accounts: { 'work-alt': { enabled: true } } },
-        accounts: [
-          {
-            ...accountWithHandle(),
-            expires: Date.now() + 5 * 60 * 60 * 1000,
-          },
-        ],
-      } as never,
-      accountPath,
-    )
-
-    let credentialGets = 0
     const reports: Array<Record<string, unknown>> = []
-    const connector = async () =>
-      ({
-        call: async (_moduleId: string, method: string, params: unknown) => {
-          if (method === 'credential.get') {
-            credentialGets += 1
-            if (credentialGets > 1) return new Promise<never>(() => {})
-            return {
-              result: {
-                payload: Array.from(
-                  new TextEncoder().encode(
-                    JSON.stringify({ access_token: TOKEN_SENTINEL }),
+    let fallbackCredentialGets = 0
+    const fixture = await bootRuledClaustrumRow({
+      route: 'fallback-first',
+      fallbacks: [
+        {
+          label: 'work',
+          handle: RULED_HANDLE,
+          access: TOKEN_SENTINEL,
+          account: { id: 'work-alt' },
+        },
+      ],
+      connector: (calls) => async () =>
+        ({
+          call: async (_moduleId: string, method: string, params: unknown) => {
+            calls.push({
+              method,
+              params: (params ?? {}) as Record<string, unknown>,
+            })
+            if (method === 'credential.get') {
+              if ((params as { handle?: string }).handle === RULED_HANDLE) {
+                fallbackCredentialGets += 1
+                if (fallbackCredentialGets > 1) {
+                  return new Promise<never>(() => {})
+                }
+              }
+              return {
+                result: {
+                  payload: Array.from(
+                    new TextEncoder().encode(
+                      JSON.stringify({
+                        access_token:
+                          (params as { handle?: string }).handle ===
+                          RULED_HANDLE
+                            ? TOKEN_SENTINEL
+                            : 'vault-main-access',
+                      }),
+                    ),
                   ),
-                ),
-                expires_at_ms: Date.now() + 5 * 60 * 60 * 1000,
-                record_version: 17,
-              },
+                  expires_at_ms: Date.now() + 5 * 60 * 60 * 1000,
+                  record_version: 17,
+                },
+              }
             }
-          }
-          if (method === 'credential.report_auth_failure') {
-            reports.push(params as Record<string, unknown>)
-            return { result: { ok: true } }
-          }
-          throw new Error(`unexpected method: ${method}`)
-        },
-        close: () => {},
-      }) as never
-    let mainRequests = 0
-    let fallbackRequests = 0
-    globalThis.fetch = mock(
-      (input: string | URL | Request, init?: RequestInit) => {
-        const url =
-          typeof input === 'string'
-            ? input
-            : input instanceof URL
-              ? input.toString()
-              : input.url
-        if (!url.includes('/v1/messages')) {
-          return Promise.resolve(new Response('{}', { status: 200 }))
-        }
-        const authorization = new Headers(init?.headers).get('authorization')
-        if (authorization === 'Bearer main-access') {
-          mainRequests += 1
-          return Promise.resolve(
-            new Response(
-              mainRequests === 1
-                ? 'first main response'
-                : 'original response body',
-              {
-                status: 429,
-              },
-            ),
-          )
-        }
-        fallbackRequests += 1
-        return Promise.resolve(new Response('{}', { status: 401 }))
-      },
-    ) as unknown as typeof fetch
-
-    const plugin = await (
-      AnthropicAuthPlugin as unknown as (
-        ctx: { client: unknown },
-        runtimeOverrides: { claustrumConnector: typeof connector },
-      ) => Promise<any>
-    )(
-      { client: { auth: { set: mock(() => Promise.resolve()) } } },
-      { claustrumConnector: connector },
-    )
-    const result = await plugin.auth.loader(
-      () =>
-        Promise.resolve({
-          type: 'oauth' as const,
-          access: 'main-access',
-          refresh: 'main-refresh',
-          expires: Date.now() + 100_000,
-        }),
-      { models: {} },
-    )
+            if (method === 'credential.report_auth_failure') {
+              reports.push(params as Record<string, unknown>)
+              return { result: { ok: true } }
+            }
+            throw new Error(`unexpected method: ${method}`)
+          },
+          close: () => {},
+        }) as never,
+      onFetch: (_input, init) =>
+        new Response(
+          new Headers(init?.headers).get('authorization') ===
+            `Bearer ${TOKEN_SENTINEL}`
+            ? 'original response body'
+            : 'original response body',
+          {
+            status:
+              new Headers(init?.headers).get('authorization') ===
+              `Bearer ${TOKEN_SENTINEL}`
+                ? 401
+                : 200,
+          },
+        ),
+    })
     const request = () =>
-      result.fetch('https://api.anthropic.com/v1/messages', {
+      fixture.result.fetch('https://api.anthropic.com/v1/messages', {
         method: 'POST',
         body: JSON.stringify({
           model: 'claude-sonnet-4-5',
@@ -762,13 +754,20 @@ describe('credential-handle blindness', () => {
 
     await (await request()).text()
     expect(reports.map((report) => report.record_version)).toEqual([17])
-    seedCredentialForTest(plugin.__claustrumCredentialCache, 17)
+    expect(reports.map((report) => report.handle)).toEqual([RULED_HANDLE])
+    expect(reports.some((report) => report.handle === RULED_MAIN_HANDLE)).toBe(
+      false,
+    )
 
     const originalResponse = await request()
-    expect(originalResponse.status).toBe(429)
+    expect(originalResponse.status).toBe(200)
     expect(await originalResponse.text()).toBe('original response body')
-    expect(fallbackRequests).toBe(1)
-    await plugin.dispose?.()
+    expect(fixture.authorizations).toEqual([
+      `Bearer ${TOKEN_SENTINEL}`,
+      'Bearer vault-main-access',
+      'Bearer vault-main-access',
+    ])
+    await fixture.plugin.dispose?.()
   })
 
   test('dump body, metadata, response, and transport capture stay blind to tokens', async () => {
@@ -957,6 +956,11 @@ describe('credential-handle blindness', () => {
       claustrumGate:
         account.role === 'main' ? ('na' as const) : ('on' as const),
       vaultServed: account.role === 'fallback',
+      vaultReauth: false,
+      custodyState:
+        account.role === 'main'
+          ? ('na' as const)
+          : ('on-vault-served' as const),
     }))
     const server = await startRpcServer({
       dir: rpcDir,
diff --git a/packages/opencode/src/tests/custody-dimensions.test.ts b/packages/opencode/src/tests/custody-dimensions.test.ts
new file mode 100644
index 00000000..481886df
--- /dev/null
+++ b/packages/opencode/src/tests/custody-dimensions.test.ts
@@ -0,0 +1,45 @@
+import { expect, test } from 'bun:test'
+import type { AccountStorage } from '@cortexkit/anthropic-auth-core'
+import { custodyStateFor } from '../custody-dimensions.ts'
+
+test('projects a vault-served main without identity evidence as unknown', () => {
+  const storage: AccountStorage = {
+    version: 1,
+    claustrum: { mode: 'claustrum' },
+    accounts: [],
+  }
+
+  expect(
+    custodyStateFor({ id: 'main', role: 'main' }, storage, {
+      getCache: () => ({
+        peek: () => ({
+          payload: '{"access_token":"vault-main"}',
+          expiresAtMs: 60_000,
+          recordVersion: 1,
+        }),
+      }),
+      now: () => 0,
+      resolveAccountCustodyHandle: () => ({
+        status: 'unresolved',
+        reason: 'missing-entry',
+      }),
+      usableAccessToken: () => 'vault-main',
+      hasIdentityMismatch: () => false,
+      isBlocked: () => false,
+      isReauth: () => false,
+      getManifest: () => ({
+        version: 1,
+        provider: 'anthropic',
+        serve: 'anthropic-auth',
+        accounts: [
+          {
+            label: 'main',
+            handle: 'ckh_main',
+            credentialId: 'oauth:anthropic:main',
+          },
+        ],
+        superseded: new Set(),
+      }),
+    }),
+  ).toBe('unknown-identity')
+})
diff --git a/packages/opencode/src/tests/custody-handle-manifest.fixture.ts b/packages/opencode/src/tests/custody-handle-manifest.fixture.ts
new file mode 100644
index 00000000..bfe18e83
--- /dev/null
+++ b/packages/opencode/src/tests/custody-handle-manifest.fixture.ts
@@ -0,0 +1,31 @@
+import * as fs from 'node:fs/promises'
+import { join } from 'node:path'
+
+export type GoldenCustodyManifest = {
+  version: number
+  providers: Array<{
+    provider: string
+    serve: string
+    accounts: Array<{
+      label: string
+      handle: string
+      credential_id: string
+      superseded?: string[]
+      [key: string]: unknown
+    }>
+  }>
+}
+
+export async function loadGoldenCustodyManifest(): Promise<{
+  text: string
+  manifest: GoldenCustodyManifest
+}> {
+  const path = join(
+    import.meta.dir,
+    'fixtures',
+    'claustrum-golden',
+    'handles.json',
+  )
+  const text = await fs.readFile(path, 'utf8')
+  return { text, manifest: JSON.parse(text) as GoldenCustodyManifest }
+}
diff --git a/packages/opencode/src/tests/custody-handle-manifest.test.ts b/packages/opencode/src/tests/custody-handle-manifest.test.ts
new file mode 100644
index 00000000..ef27986a
--- /dev/null
+++ b/packages/opencode/src/tests/custody-handle-manifest.test.ts
@@ -0,0 +1,2177 @@
+import { afterEach, describe, expect, mock, spyOn, test } from 'bun:test'
+import { constants as fsConstants } from 'node:fs'
+import * as fs from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { basename, dirname, join } from 'node:path'
+import {
+  __setCustodyManifestLockTestOptions,
+  __setLogTestSink,
+  CUSTODY_MANIFEST_LOCK_TTL_MS,
+  CustodyHandleManifestReader,
+  custodyCredentialId,
+  readCustodyHandles,
+  removeCustodyHandleManifestEntry,
+  resolveCustodyHandle,
+  withCustodyManifestLock,
+  writeCustodyHandleManifestEntry,
+} from '@cortexkit/anthropic-auth-core'
+
+import { loadGoldenCustodyManifest } from './custody-handle-manifest.fixture.ts'
+
+const { text: fixtureText, manifest: fixture } =
+  await loadGoldenCustodyManifest()
+
+async function withTempDirectory<T>(
+  callback: (directory: string) => Promise<T>,
+): Promise<T> {
+  const directory = await fs.mkdtemp(join(tmpdir(), 'custody-manifest-test-'))
+  try {
+    return await callback(directory)
+  } finally {
+    await fs.rm(directory, { recursive: true, force: true })
+  }
+}
+
+async function withManifest<T>(
+  content: string,
+  callback: (path: string) => Promise<T>,
+): Promise<T> {
+  return withTempDirectory(async (directory) => {
+    const parent = join(directory, 'manifest')
+    const path = join(parent, 'handles.json')
+    await fs.mkdir(parent)
+    await fs.chmod(parent, 0o700)
+    await fs.writeFile(path, content)
+    await fs.chmod(path, 0o600)
+    await fs.lstat(path)
+    return callback(path)
+  })
+}
+
+function reader(path: string, expectedUid?: number) {
+  return new CustodyHandleManifestReader({
+    path,
+    provider: 'anthropic',
+    serve: 'anthropic-auth',
+    expectedUid,
+  })
+}
+
+const writerHandle = `ckh_${'D'.repeat(43)}`
+const replacementWriterHandle = `ckh_${'E'.repeat(43)}`
+const writerEntry = {
+  label: 'writer',
+  handle: writerHandle,
+  credentialId: 'oauth:anthropic:writer',
+}
+
+function serialize(value: unknown): string {
+  return JSON.stringify(value, null, 2)
+}
+
+function temporaryFiles(parent: string): Promise<string[]> {
+  return fs
+    .readdir(parent)
+    .then((names) => names.filter((name) => name.endsWith('.tmp')))
+}
+
+async function expectInvalid(
+  result: Promise<Awaited<ReturnType<CustodyHandleManifestReader['read']>>>,
+  reason: string,
+): Promise<void> {
+  const value = await result
+  expect(value.status).toBe('invalid')
+  if (value.status !== 'invalid') throw new Error('expected invalid manifest')
+  expect(value.reason).toBe(reason)
+}
+
+async function expectIgnored(
+  result: Promise<Awaited<ReturnType<CustodyHandleManifestReader['read']>>>,
+  reason: 'foreign-serve' | 'missing-provider',
+): Promise<void> {
+  const value = await result
+  expect(value.status).toBe('ignored')
+  if (value.status !== 'ignored') throw new Error('expected ignored manifest')
+  expect(value.reason).toBe(reason)
+}
+
+function withProvider(
+  mutate: (provider: Record<string, unknown>) => void,
+): string {
+  const value = structuredClone(fixture) as {
+    version: number
+    providers: Array<Record<string, unknown>>
+  }
+  const provider = value.providers.find(
+    (entry) => entry.provider === 'anthropic',
+  )
+  if (!provider) throw new Error('missing anthropic fixture')
+  mutate(provider)
+  return JSON.stringify(value)
+}
+
+afterEach(() => {
+  mock.restore()
+})
+
+describe('CustodyHandleManifestReader', () => {
+  test('reads the version 1 anthropic-auth manifest and ignores other providers', async () => {
+    await withManifest(fixtureText, async (path) => {
+      const result = await reader(path).read()
+      expect(result.status).toBe('ready')
+      if (result.status !== 'ready') throw new Error('expected ready manifest')
+      expect(result.manifest).toMatchObject({
+        version: 1,
+        provider: 'anthropic',
+        serve: 'anthropic-auth',
+      })
+      expect(result.manifest.accounts).toHaveLength(1)
+    })
+  })
+
+  test('ignores an anthropic block with a foreign serve', async () => {
+    await withManifest(
+      withProvider((provider) => {
+        provider.serve = 'foreign-serve'
+      }),
+      async (path) => {
+        await expectIgnored(reader(path).read(), 'foreign-serve')
+      },
+    )
+  })
+
+  test('ignores a manifest without an anthropic block', async () => {
+    const value = structuredClone(fixture) as typeof fixture
+    value.providers = value.providers.filter(
+      (provider) => provider.provider !== 'anthropic',
+    )
+    await withManifest(JSON.stringify(value), async (path) => {
+      await expectIgnored(reader(path).read(), 'missing-provider')
+    })
+  })
+
+  test('rejects reserved account labels without inheriting prototype keys', () => {
+    const source = Object.assign(
+      Object.create({ providers: fixture.providers }),
+      { version: 1 },
+    ) as Record<string, unknown>
+    expect(() =>
+      readCustodyHandles(source, 'anthropic', 'anthropic-auth'),
+    ).toThrow('missing manifest providers')
+
+    for (const label of ['__proto__', 'constructor', 'prototype']) {
+      expect(() =>
+        readCustodyHandles(
+          JSON.parse(
+            withProvider((provider) => {
+              provider.accounts = [
+                { ...fixture.providers[1]?.accounts[0], label },
+              ]
+            }),
+          ),
+          'anthropic',
+          'anthropic-auth',
+        ),
+      ).toThrow('invalid account label')
+    }
+  })
+
+  test('rejects invalid labels with a fixed reason', async () => {
+    await withManifest(
+      withProvider((provider) => {
+        provider.accounts = [
+          { ...fixture.providers[1]?.accounts[0], label: 'Bad' },
+        ]
+      }),
+      async (path) => {
+        await expect(reader(path).read()).resolves.toEqual({
+          status: 'invalid',
+          reason: 'invalid account label',
+        })
+      },
+    )
+  })
+
+  test('builds the canonical OAuth credential id from a custody label', () => {
+    expect(custodyCredentialId('work-alt')).toBe('oauth:anthropic:work-alt')
+    expect(() => custodyCredentialId('not a label')).toThrow('invalid-label')
+  })
+
+  test('rejects invalid handles with a fixed reason', async () => {
+    await withManifest(
+      withProvider((provider) => {
+        provider.accounts = [
+          { ...fixture.providers[1]?.accounts[0], handle: 'invalid' },
+        ]
+      }),
+      async (path) => {
+        await expect(reader(path).read()).resolves.toMatchObject({
+          status: 'ready',
+          manifest: {
+            accounts: [],
+            corruptLabels: new Set(['work-alt']),
+          },
+        })
+      },
+    )
+  })
+
+  test('collects validated superseded handles into a set', async () => {
+    const legacyHandle = fixture.providers[0]?.accounts[1]?.superseded?.[0]
+    if (typeof legacyHandle !== 'string')
+      throw new Error('missing fixture handle')
+    await withManifest(
+      withProvider((provider) => {
+        provider.accounts = [
+          { ...fixture.providers[1]?.accounts[0], superseded: [legacyHandle] },
+        ]
+      }),
+      async (path) => {
+        const result = await reader(path).read()
+        expect(result.status).toBe('ready')
+        if (result.status !== 'ready')
+          throw new Error('expected ready manifest')
+        expect(result.manifest.superseded.size).toBe(1)
+        expect(result.manifest.superseded.has(legacyHandle)).toBe(true)
+      },
+    )
+  })
+
+  test('rejects a symlink', async () => {
+    await withTempDirectory(async (directory) => {
+      const target = join(directory, 'target.json')
+      const path = join(directory, 'handles.json')
+      await fs.writeFile(target, fixtureText)
+      await fs.chmod(target, 0o600)
+      await fs.symlink(target, path)
+      await expectInvalid(reader(path).read(), 'manifest is a symlink')
+    })
+  })
+
+  test('rejects a non-regular manifest path', async () => {
+    await withTempDirectory(async (directory) => {
+      const path = join(directory, 'handles.json')
+      await fs.mkdir(path)
+      await expectInvalid(reader(path).read(), 'manifest is not a regular file')
+    })
+  })
+
+  test('rejects a manifest with a mode other than 0600', async () => {
+    await withManifest(fixtureText, async (path) => {
+      await fs.chmod(path, 0o644)
+      await expectInvalid(reader(path).read(), 'manifest mode must be 0600')
+    })
+  })
+
+  test('rejects a manifest with restrictive but non-0600 mode', async () => {
+    await withManifest(fixtureText, async (path) => {
+      await fs.chmod(path, 0o400)
+      await fs.lstat(path)
+      await expectInvalid(reader(path).read(), 'manifest mode must be 0600')
+    })
+  })
+
+  test('opens a validated manifest with O_NOFOLLOW', async () => {
+    await withManifest(fixtureText, async (path) => {
+      const openSpy = spyOn(fs, 'open')
+
+      await expect(reader(path).read()).resolves.toMatchObject({
+        status: 'ready',
+      })
+
+      const [, flags] = openSpy.mock.calls[0] ?? []
+      expect((Number(flags) & fsConstants.O_NOFOLLOW) !== 0).toBe(true)
+    })
+  })
+
+  test('rejects a manifest owned by a different uid', async () => {
+    await withManifest(fixtureText, async (path) => {
+      await expectInvalid(
+        reader(path, (process.getuid?.() ?? 0) + 1).read(),
+        'manifest owner does not match',
+      )
+    })
+  })
+
+  test('rejects a parent directory owned by a different uid', async () => {
+    await withManifest(fixtureText, async (path) => {
+      const parent = dirname(path)
+      const originalLstat = fs.lstat
+      spyOn(fs, 'lstat').mockImplementation(async (target) => {
+        const stats = await originalLstat(target)
+        if (target !== parent) return stats
+        return Object.assign(Object.create(stats), {
+          uid: (process.getuid?.() ?? 0) + 1,
+        })
+      })
+      await expectInvalid(
+        reader(path).read(),
+        'manifest parent owner does not match',
+      )
+    })
+  })
+
+  test('rejects a world-writable parent directory without sticky mode', async () => {
+    await withManifest(fixtureText, async (path) => {
+      await fs.chmod(dirname(path), 0o777)
+      await expectInvalid(
+        reader(path).read(),
+        'manifest parent is world-writable',
+      )
+    })
+  })
+
+  test('rejects a group-writable parent directory without sticky mode', async () => {
+    await withManifest(fixtureText, async (path) => {
+      await fs.chmod(dirname(path), 0o770)
+      await expectInvalid(
+        reader(path).read(),
+        'manifest parent is group-writable',
+      )
+    })
+  })
+
+  test('accepts a private manifest parent directory', async () => {
+    await withManifest(fixtureText, async (path) => {
+      await fs.chmod(dirname(path), 0o700)
+      await expect(reader(path).read()).resolves.toMatchObject({
+        status: 'ready',
+      })
+    })
+  })
+
+  test('accepts a sticky group-writable manifest parent directory', async () => {
+    await withManifest(fixtureText, async (path) => {
+      const parent = dirname(path)
+      const originalLstat = fs.lstat
+      spyOn(fs, 'lstat').mockImplementation(async (target) => {
+        const stats = await originalLstat(target)
+        if (target !== parent) return stats
+        return Object.assign(Object.create(stats), {
+          mode: 0o1770,
+        })
+      })
+      await expect(reader(path).read()).resolves.toMatchObject({
+        status: 'ready',
+      })
+    })
+  })
+
+  test('rejects a manifest larger than 256 KiB', async () => {
+    await withManifest('x'.repeat(256 * 1024 + 1), async (path) => {
+      await expectInvalid(reader(path).read(), 'manifest exceeds maximum size')
+    })
+  })
+
+  test('returns absent for a missing manifest', async () => {
+    await withTempDirectory(async (directory) => {
+      await expect(
+        reader(join(directory, 'missing.json')).read(),
+      ).resolves.toEqual({
+        status: 'absent',
+      })
+    })
+  })
+
+  test('redacts malformed JSON source bytes', async () => {
+    const bareToken = `ckh_${'A'.repeat(43)}`
+    await withManifest(`{"version":1, ${bareToken}}`, async (path) => {
+      const result = await reader(path).read()
+      expect(result.status).toBe('invalid')
+      if (result.status !== 'invalid')
+        throw new Error('expected invalid manifest')
+      expect(result.reason === 'invalid JSON').toBe(true)
+      expect(result.reason.includes(bareToken)).toBe(false)
+    })
+  })
+
+  test('keys parsed-content cache hits to validated descriptor metadata', async () => {
+    await withManifest(fixtureText, async (path) => {
+      const originalLstat = fs.lstat
+      const originalOpen = fs.open
+      const readSpies: Array<ReturnType<typeof spyOn>> = []
+      let manifestLstatCalls = 0
+      spyOn(fs, 'lstat').mockImplementation(async (target) => {
+        const stats = await originalLstat(target)
+        if (target !== path || ++manifestLstatCalls !== 2) return stats
+        return Object.assign(Object.create(stats), {
+          mtimeMs: stats.mtimeMs + 1,
+        })
+      })
+      const openSpy = spyOn(fs, 'open').mockImplementation(
+        async (...arguments_) => {
+          const handle = await originalOpen(...arguments_)
+          readSpies.push(spyOn(handle, 'read'))
+          return handle
+        },
+      )
+      const manifestReader = reader(path)
+      await expect(manifestReader.read()).resolves.toMatchObject({
+        status: 'ready',
+      })
+      await expect(manifestReader.read()).resolves.toMatchObject({
+        status: 'ready',
+      })
+      expect(openSpy).toHaveBeenCalledTimes(2)
+      expect(readSpies.flatMap((readSpy) => readSpy.mock.calls)).toHaveLength(1)
+
+      await fs.chmod(path, 0o644)
+      await expectInvalid(manifestReader.read(), 'manifest mode must be 0600')
+      expect(openSpy).toHaveBeenCalledTimes(2)
+    })
+  })
+})
+
+describe('writeCustodyHandleManifestEntry', () => {
+  afterEach(() => __setCustodyManifestLockTestOptions())
+
+  test('refuses an entry that the manifest reader would reject', async () => {
+    await withTempDirectory(async (directory) => {
+      const parent = join(directory, 'manifest')
+      const path = join(parent, 'handles.json')
+      await fs.mkdir(parent)
+      await fs.chmod(parent, 0o700)
+
+      await expect(
+        writeCustodyHandleManifestEntry({
+          path,
+          entry: {
+            label: 'Work',
+            handle: writerHandle,
+            credentialId: 'oauth:anthropic:Work',
+          },
+        }),
+      ).resolves.toEqual({ status: 'refused', reason: 'invalid entry' })
+      await expect(fs.lstat(path)).rejects.toMatchObject({ code: 'ENOENT' })
+    })
+  })
+
+  test('refuses a valid-shaped credential id that is not canonical for its label', async () => {
+    await withTempDirectory(async (directory) => {
+      const parent = join(directory, 'manifest')
+      const path = join(parent, 'handles.json')
+      await fs.mkdir(parent)
+      await fs.chmod(parent, 0o700)
+
+      await expect(
+        writeCustodyHandleManifestEntry({
+          path,
+          entry: { ...writerEntry, credentialId: 'oauth:anthropic:other' },
+        }),
+      ).resolves.toEqual({ status: 'refused', reason: 'invalid entry' })
+      await expect(fs.lstat(path)).rejects.toMatchObject({ code: 'ENOENT' })
+    })
+  })
+
+  test('refuses dangling and resolved manifest symlinks without replacing them', async () => {
+    for (const target of ['missing-target.json', 'real-target.json']) {
+      await withTempDirectory(async (directory) => {
+        const parent = join(directory, 'manifest')
+        const path = join(parent, 'handles.json')
+        await fs.mkdir(parent)
+        await fs.chmod(parent, 0o700)
+        if (target === 'real-target.json')
+          await fs.writeFile(join(parent, target), fixtureText)
+        await fs.symlink(target, path)
+
+        await expect(
+          writeCustodyHandleManifestEntry({ path, entry: writerEntry }),
+        ).resolves.toEqual({
+          status: 'refused',
+          reason: 'manifest is a symlink',
+        })
+        expect((await fs.lstat(path)).isSymbolicLink()).toBe(true)
+        expect(await fs.readlink(path)).toBe(target)
+      })
+    }
+  })
+
+  test('round-trips foreign provider blocks without changing their serialized JSON', async () => {
+    await withManifest(fixtureText, async (path) => {
+      const before = fixture.providers
+        .filter(
+          (provider) =>
+            provider.provider !== 'anthropic' ||
+            provider.serve !== 'anthropic-auth',
+        )
+        .map(serialize)
+
+      await expect(
+        writeCustodyHandleManifestEntry({ path, entry: writerEntry }),
+      ).resolves.toEqual({
+        status: 'written',
+      })
+
+      const after = JSON.parse(
+        await fs.readFile(path, 'utf8'),
+      ) as typeof fixture
+      expect(
+        after.providers
+          .filter(
+            (provider) =>
+              provider.provider !== 'anthropic' ||
+              provider.serve !== 'anthropic-auth',
+          )
+          .map(serialize),
+      ).toEqual(before)
+    })
+  })
+
+  test('preserves an oddly formatted foreign block structurally', async () => {
+    const foreign = {
+      provider: 'deepseek',
+      serve: 'opencode-claustrum',
+      accounts: [],
+      retained: { z: 0, a: [true, false] },
+    }
+    const input = ` { "providers" : [ { "retained" : { "z" : 0 , "a" : [ true , false ] }, "accounts" : [ ], "serve" : "opencode-claustrum", "provider" : "deepseek" } ], "version" : 1 } `
+    await withManifest(input, async (path) => {
+      await writeCustodyHandleManifestEntry({ path, entry: writerEntry })
+      const output = JSON.parse(await fs.readFile(path, 'utf8')) as {
+        providers: Array<Record<string, unknown>>
+      }
+      expect(output.providers[0]).toEqual(foreign)
+      expect(JSON.parse(await fs.readFile(path, 'utf8'))).toBeDefined()
+    })
+  })
+
+  test('replaces a corrupt own-label entry with a canonical binding', async () => {
+    await withManifest(
+      serialize({
+        version: 1,
+        providers: [
+          {
+            provider: 'anthropic',
+            serve: 'anthropic-auth',
+            accounts: [
+              {
+                label: writerEntry.label,
+                handle: writerHandle,
+                credential_id: writerEntry.credentialId,
+                superseded: 'corrupt',
+              },
+            ],
+          },
+        ],
+      }),
+      async (path) => {
+        await expect(
+          writeCustodyHandleManifestEntry({ path, entry: writerEntry }),
+        ).resolves.toEqual({ status: 'written' })
+        const output = JSON.parse(await fs.readFile(path, 'utf8')) as {
+          providers: Array<{ accounts: Array<Record<string, unknown>> }>
+        }
+        expect(output.providers[0]?.accounts).toEqual([
+          {
+            label: writerEntry.label,
+            handle: writerEntry.handle,
+            credential_id: writerEntry.credentialId,
+          },
+        ])
+      },
+    )
+  })
+
+  test('inserts our entry into an absent manifest file', async () => {
+    await withTempDirectory(async (directory) => {
+      const parent = join(directory, 'manifest')
+      const path = join(parent, 'handles.json')
+      await fs.mkdir(parent)
+      await fs.chmod(parent, 0o700)
+
+      await expect(
+        writeCustodyHandleManifestEntry({ path, entry: writerEntry }),
+      ).resolves.toEqual({
+        status: 'written',
+      })
+      expect(JSON.parse(await fs.readFile(path, 'utf8'))).toEqual({
+        version: 1,
+        providers: [
+          {
+            provider: 'anthropic',
+            serve: 'anthropic-auth',
+            accounts: [
+              {
+                label: writerEntry.label,
+                handle: writerEntry.handle,
+                credential_id: writerEntry.credentialId,
+              },
+            ],
+          },
+        ],
+      })
+    })
+  })
+
+  test('adds our block when no anthropic-auth block exists', async () => {
+    const input = {
+      version: 1,
+      providers: [
+        {
+          provider: 'deepseek',
+          serve: 'opencode-claustrum',
+          accounts: [],
+        },
+      ],
+    }
+    await withManifest(serialize(input), async (path) => {
+      await expect(
+        writeCustodyHandleManifestEntry({ path, entry: writerEntry }),
+      ).resolves.toEqual({
+        status: 'written',
+      })
+      const output = JSON.parse(await fs.readFile(path, 'utf8')) as typeof input
+      expect(output.providers).toHaveLength(2)
+      expect(output.providers[1]).toMatchObject({
+        provider: 'anthropic',
+        serve: 'anthropic-auth',
+      })
+    })
+  })
+
+  test('replaces a matching label without creating a second entry', async () => {
+    await withManifest(fixtureText, async (path) => {
+      await expect(
+        writeCustodyHandleManifestEntry({
+          path,
+          entry: {
+            ...writerEntry,
+            label: 'work-alt',
+            handle: replacementWriterHandle,
+            credentialId: custodyCredentialId('work-alt'),
+          },
+        }),
+      ).resolves.toEqual({ status: 'written' })
+
+      const output = JSON.parse(
+        await fs.readFile(path, 'utf8'),
+      ) as typeof fixture
+      const ours = output.providers.find(
+        (provider) =>
+          provider.provider === 'anthropic' &&
+          provider.serve === 'anthropic-auth',
+      )
+      expect(
+        ours?.accounts.filter((entry) => entry.label === 'work-alt'),
+      ).toEqual([
+        {
+          label: 'work-alt',
+          handle: replacementWriterHandle,
+          credential_id: 'oauth:anthropic:work-alt',
+        },
+      ])
+    })
+  })
+
+  test('leaves bytes, mtime, and temporary files unchanged for an idempotent entry', async () => {
+    await withManifest(fixtureText, async (path) => {
+      await writeCustodyHandleManifestEntry({ path, entry: writerEntry })
+      const before = await fs.readFile(path, 'utf8')
+      const beforeStats = await fs.lstat(path)
+
+      await expect(
+        writeCustodyHandleManifestEntry({ path, entry: writerEntry }),
+      ).resolves.toEqual({
+        status: 'unchanged',
+      })
+
+      expect(await fs.readFile(path, 'utf8')).toBe(before)
+      expect((await fs.lstat(path)).mtimeMs).toBe(beforeStats.mtimeMs)
+      expect(await temporaryFiles(dirname(path))).toEqual([])
+    })
+  })
+
+  test('preserves a foreign anthropic serve while adding our anthropic-auth block', async () => {
+    const foreign = {
+      provider: 'anthropic',
+      serve: 'foreign-serve',
+      accounts: [
+        { label: 'foreign', handle: writerHandle, credential_id: 'foreign:id' },
+      ],
+    }
+    await withManifest(
+      serialize({ version: 1, providers: [foreign] }),
+      async (path) => {
+        await writeCustodyHandleManifestEntry({ path, entry: writerEntry })
+
+        const output = JSON.parse(await fs.readFile(path, 'utf8')) as {
+          providers: Array<Record<string, unknown>>
+        }
+        expect(output.providers).toHaveLength(2)
+        expect(serialize(output.providers[0])).toBe(serialize(foreign))
+        expect(output.providers[1]).toMatchObject({
+          provider: 'anthropic',
+          serve: 'anthropic-auth',
+        })
+      },
+    )
+  })
+
+  test('refuses unowned and unsafe parent directories without writing', async () => {
+    await withTempDirectory(async (directory) => {
+      const parent = join(directory, 'manifest')
+      const path = join(parent, 'handles.json')
+      await fs.mkdir(parent)
+      await fs.chmod(parent, 0o777)
+
+      await expect(
+        writeCustodyHandleManifestEntry({ path, entry: writerEntry }),
+      ).resolves.toEqual({
+        status: 'refused',
+        reason: 'manifest parent is world-writable',
+      })
+      expect(await temporaryFiles(parent)).toEqual([])
+      await expect(fs.lstat(path)).rejects.toMatchObject({ code: 'ENOENT' })
+
+      await fs.chmod(parent, 0o700)
+      await expect(
+        writeCustodyHandleManifestEntry({
+          path,
+          entry: writerEntry,
+          expectedUid: (process.getuid?.() ?? 0) + 1,
+        }),
+      ).resolves.toEqual({
+        status: 'refused',
+        reason: 'manifest parent owner does not match',
+      })
+      expect(await temporaryFiles(parent)).toEqual([])
+    })
+  })
+
+  test('refuses an entry whose serialized manifest would exceed 256 KiB', async () => {
+    const padding = 'x'.repeat(256 * 1024 - 250)
+    await withManifest(
+      serialize({
+        version: 1,
+        providers: [
+          {
+            provider: 'deepseek',
+            serve: 'opencode-claustrum',
+            accounts: [],
+            padding,
+          },
+        ],
+      }),
+      async (path) => {
+        const before = await fs.readFile(path, 'utf8')
+        await expect(
+          writeCustodyHandleManifestEntry({ path, entry: writerEntry }),
+        ).resolves.toEqual({
+          status: 'refused',
+          reason: 'manifest exceeds maximum size',
+        })
+        expect(await fs.readFile(path, 'utf8')).toBe(before)
+        expect(await temporaryFiles(dirname(path))).toEqual([])
+      },
+    )
+  })
+
+  test('keeps the original target intact when rename fails during atomic publication', async () => {
+    await withManifest(fixtureText, async (path) => {
+      const before = await fs.readFile(path, 'utf8')
+      spyOn(fs, 'rename').mockRejectedValue(
+        Object.assign(new Error('rename failed'), { code: 'EIO' }),
+      )
+
+      await expect(
+        writeCustodyHandleManifestEntry({ path, entry: writerEntry }),
+      ).resolves.toEqual({
+        status: 'refused',
+        reason: 'unreadable (EIO)',
+      })
+
+      expect(await fs.readFile(path, 'utf8')).toBe(before)
+      expect(await temporaryFiles(dirname(path))).toEqual([])
+    })
+  })
+
+  test('publishes through a temporary file in its lock directory and leaves no temporary files', async () => {
+    await withManifest(fixtureText, async (path) => {
+      const originalRename = fs.rename
+      const renamedFrom: string[] = []
+      spyOn(fs, 'rename').mockImplementation(async (from, to) => {
+        if (String(to) === path) renamedFrom.push(String(from))
+        return originalRename(from, to)
+      })
+
+      await expect(
+        writeCustodyHandleManifestEntry({ path, entry: writerEntry }),
+      ).resolves.toEqual({ status: 'written' })
+
+      expect(renamedFrom).toHaveLength(1)
+      expect(dirname(renamedFrom[0] ?? '')).toBe(`${path}.lock`)
+      expect(await temporaryFiles(dirname(path))).toEqual([])
+      await expect(fs.lstat(`${path}.lock`)).rejects.toMatchObject({
+        code: 'ENOENT',
+      })
+    })
+  })
+
+  test.serial(
+    "an evicted writer's rename fails and cannot overwrite the successor's manifest",
+    async () => {
+      await withManifest(fixtureText, async (path) => {
+        const lockPath = `${path}.lock`
+        const originalNow = Date.now
+        const beforeRename = Promise.withResolvers<void>()
+        const resumeA = Promise.withResolvers<void>()
+        let now = 0
+        let aNonce: string | undefined
+        let pauseA = true
+        Date.now = () => now
+        __setCustodyManifestLockTestOptions({
+          ttlMs: 100,
+          retryMinMs: 1,
+          retryMaxMs: 1,
+          renewalIntervalMs: 1_000,
+          beforeRename: async () => {
+            if (!pauseA) return
+            pauseA = false
+            aNonce = JSON.parse(
+              await fs.readFile(join(lockPath, 'owner'), 'utf8'),
+            ).nonce
+            beforeRename.resolve()
+            await resumeA.promise
+          },
+        })
+        try {
+          const a = writeCustodyHandleManifestEntry({
+            path,
+            entry: writerEntry,
+          })
+          await beforeRename.promise
+
+          now = 101
+          const successorEntry = {
+            ...writerEntry,
+            handle: replacementWriterHandle,
+          }
+          await expect(
+            writeCustodyHandleManifestEntry({ path, entry: successorEntry }),
+          ).resolves.toEqual({ status: 'written' })
+          resumeA.resolve()
+          await expect(a).resolves.toEqual({
+            status: 'refused',
+            reason: 'manifest lock renewal failed; write aborted',
+            code: 'renewal_failed',
+          })
+          expect(await fs.readFile(path, 'utf8')).toContain(
+            replacementWriterHandle,
+          )
+          expect(await fs.readFile(path, 'utf8')).not.toContain(writerHandle)
+          expect(aNonce).toBeDefined()
+          await expect(
+            fs.lstat(`${lockPath}.stale-0-${aNonce}/manifest.${aNonce}.tmp`),
+          ).resolves.toBeDefined()
+          await expect(fs.lstat(`${path}.tmp`)).rejects.toMatchObject({
+            code: 'ENOENT',
+          })
+        } finally {
+          resumeA.resolve()
+          Date.now = originalNow
+        }
+      })
+    },
+  )
+
+  test.serial('aborts publication after a renewal failure', async () => {
+    await withManifest(fixtureText, async (path) => {
+      const before = await fs.readFile(path, 'utf8')
+      const lockPath = `${path}.lock`
+      const ownerPath = join(lockPath, 'owner')
+      const originalOpen = fs.open
+      const originalRename = fs.rename
+      let ownerRenames = 0
+      __setCustodyManifestLockTestOptions({
+        ttlMs: 100,
+        retryMinMs: 5,
+        retryMaxMs: 5,
+        renewalIntervalMs: 10,
+      })
+      spyOn(fs, 'rename').mockImplementation(async (from, to) => {
+        if (String(to) === ownerPath && ++ownerRenames > 1)
+          throw Object.assign(new Error('renewal failed'), { code: 'EIO' })
+        return originalRename(from, to)
+      })
+      spyOn(fs, 'open').mockImplementation(async (...args) => {
+        const handle = await originalOpen(...args)
+        if (
+          String(args[0]).endsWith('.tmp') &&
+          String(args[0]).startsWith(`${lockPath}/`)
+        ) {
+          await Bun.sleep(40)
+        }
+        return handle
+      })
+
+      await expect(
+        writeCustodyHandleManifestEntry({ path, entry: writerEntry }),
+      ).resolves.toEqual({
+        status: 'refused',
+        reason: 'manifest lock renewal failed; write aborted',
+        code: 'renewal_failed',
+      })
+      expect(await fs.readFile(path, 'utf8')).toBe(before)
+      expect(await temporaryFiles(dirname(path))).toEqual([])
+    })
+  })
+
+  test.serial(
+    'aborts publication when a successor replaces its lock',
+    async () => {
+      await withManifest(fixtureText, async (path) => {
+        const before = await fs.readFile(path, 'utf8')
+        const lockPath = `${path}.lock`
+        const ownerPath = join(lockPath, 'owner')
+        const stalePath = `${lockPath}.stale-0-foreign`
+        const originalOpen = fs.open
+        const originalRename = fs.rename
+        const successorClaimed = Promise.withResolvers<void>()
+        let scheduledSuccessor = false
+        __setCustodyManifestLockTestOptions({
+          ttlMs: 100,
+          retryMinMs: 5,
+          retryMaxMs: 5,
+          renewalIntervalMs: 1_000,
+        })
+        spyOn(fs, 'rename').mockImplementation(async (from, to) => {
+          const result = await originalRename(from, to)
+          if (String(to) === ownerPath && !scheduledSuccessor) {
+            scheduledSuccessor = true
+            setTimeout(() => {
+              void (async () => {
+                await originalRename(lockPath, stalePath)
+                await fs.mkdir(lockPath, { mode: 0o700 })
+                await fs.writeFile(
+                  ownerPath,
+                  `${JSON.stringify({
+                    tenant: 'foreign-tenant',
+                    pid: process.pid,
+                    claimed_at_ms: Date.now(),
+                    nonce: 'foreign-nonce',
+                  })}\n`,
+                )
+                successorClaimed.resolve()
+              })().catch(successorClaimed.reject)
+            }, 5)
+          }
+          return result
+        })
+        spyOn(fs, 'open').mockImplementation(async (...args) => {
+          const handle = await originalOpen(...args)
+          if (
+            String(args[0]).endsWith('.tmp') &&
+            String(args[0]).startsWith(`${lockPath}/`)
+          ) {
+            await Bun.sleep(40)
+          }
+          return handle
+        })
+
+        await expect(
+          writeCustodyHandleManifestEntry({ path, entry: writerEntry }),
+        ).resolves.toEqual({
+          status: 'refused',
+          reason: 'manifest lock renewal failed; write aborted',
+          code: 'renewal_failed',
+        })
+        await successorClaimed.promise
+        expect(await fs.readFile(path, 'utf8')).toBe(before)
+        expect(await temporaryFiles(dirname(path))).toEqual([])
+        expect(JSON.parse(await fs.readFile(ownerPath, 'utf8'))).toMatchObject({
+          nonce: 'foreign-nonce',
+        })
+      })
+    },
+  )
+
+  test('opens a 0600 temporary file before atomically writing a 0600 target', async () => {
+    await withManifest(fixtureText, async (path) => {
+      const originalOpen = fs.open
+      const openSpy = spyOn(fs, 'open').mockImplementation(originalOpen)
+
+      await writeCustodyHandleManifestEntry({ path, entry: writerEntry })
+
+      const temporaryOpen = openSpy.mock.calls.find(([target]) =>
+        String(target).endsWith('.tmp'),
+      )
+      const [, flags, mode] = temporaryOpen ?? []
+      expect((Number(flags) & fsConstants.O_CREAT) !== 0).toBe(true)
+      expect((Number(flags) & fsConstants.O_EXCL) !== 0).toBe(true)
+      expect((Number(flags) & fsConstants.O_WRONLY) !== 0).toBe(true)
+      expect(mode).toBe(0o600)
+      expect(Number((await fs.lstat(path)).mode) & 0o777).toBe(0o600)
+    })
+  })
+
+  test('redacts handle bytes from refusal reasons', async () => {
+    const canary = `ckh_${'F'.repeat(43)}`
+    await withManifest(`{"version":1,"${canary}":`, async (path) => {
+      const result = await writeCustodyHandleManifestEntry({
+        path,
+        entry: writerEntry,
+      })
+      expect(result.status).toBe('refused')
+      if (result.status !== 'refused')
+        throw new Error('expected writer refusal')
+      expect(result.reason.includes(canary)).toBe(false)
+    })
+  })
+
+  test('preserves existing superseded data without writing it for a replacement', async () => {
+    const superseded = `ckh_${'G'.repeat(43)}`
+    await withManifest(
+      serialize({
+        version: 1,
+        providers: [
+          {
+            provider: 'anthropic',
+            serve: 'anthropic-auth',
+            accounts: [
+              {
+                label: writerEntry.label,
+                handle: writerHandle,
+                credential_id: writerEntry.credentialId,
+                superseded: [superseded],
+              },
+            ],
+          },
+        ],
+      }),
+      async (path) => {
+        await writeCustodyHandleManifestEntry({
+          path,
+          entry: { ...writerEntry, handle: replacementWriterHandle },
+        })
+
+        const output = JSON.parse(await fs.readFile(path, 'utf8')) as {
+          providers: Array<{ accounts: Array<Record<string, unknown>> }>
+        }
+        expect(output.providers[0]?.accounts).toEqual([
+          {
+            label: writerEntry.label,
+            handle: replacementWriterHandle,
+            credential_id: writerEntry.credentialId,
+            superseded: [superseded],
+          },
+        ])
+      },
+    )
+  })
+})
+
+describe('removeCustodyHandleManifestEntry', () => {
+  afterEach(() => __setCustodyManifestLockTestOptions())
+
+  test('removes our entry while preserving a foreign tenant block byte-identically', async () => {
+    const foreign = {
+      provider: 'deepseek',
+      serve: 'opencode-claustrum',
+      accounts: [
+        { label: 'foreign', handle: writerHandle, credential_id: 'foreign:id' },
+      ],
+      retained: { z: 0, a: [true, false] },
+    }
+    await withManifest(
+      serialize({
+        version: 1,
+        providers: [
+          foreign,
+          {
+            provider: 'anthropic',
+            serve: 'anthropic-auth',
+            accounts: [
+              {
+                label: writerEntry.label,
+                handle: writerEntry.handle,
+                credential_id: writerEntry.credentialId,
+              },
+            ],
+          },
+        ],
+      }),
+      async (path) => {
+        const beforeForeign = serialize(foreign)
+        await expect(
+          removeCustodyHandleManifestEntry({ path, entry: writerEntry }),
+        ).resolves.toBe('removed')
+        const output = JSON.parse(await fs.readFile(path, 'utf8')) as {
+          providers: Array<Record<string, unknown>>
+        }
+        expect(serialize(output.providers[0])).toBe(beforeForeign)
+        expect(output.providers[1]).toEqual({
+          provider: 'anthropic',
+          serve: 'anthropic-auth',
+          accounts: [],
+        })
+      },
+    )
+  })
+
+  test('returns missing when our entry is absent', async () => {
+    await withManifest(fixtureText, async (path) => {
+      await expect(
+        removeCustodyHandleManifestEntry({ path, entry: writerEntry }),
+      ).resolves.toBe('missing')
+    })
+  })
+
+  test('removes every duplicate of our manifest entry', async () => {
+    const account = {
+      label: writerEntry.label,
+      handle: writerEntry.handle,
+      credential_id: writerEntry.credentialId,
+    }
+    await withManifest(
+      serialize({
+        version: 1,
+        providers: [
+          {
+            provider: 'anthropic',
+            serve: 'anthropic-auth',
+            accounts: [account, account],
+          },
+        ],
+      }),
+      async (path) => {
+        await expect(
+          removeCustodyHandleManifestEntry({ path, entry: writerEntry }),
+        ).resolves.toBe('removed')
+        const output = JSON.parse(await fs.readFile(path, 'utf8')) as {
+          providers: Array<{ accounts: unknown[] }>
+        }
+        expect(output.providers[0]?.accounts).toEqual([])
+      },
+    )
+  })
+
+  test.serial(
+    'returns a transient refusal when the lease is lost before rename',
+    async () => {
+      await withManifest(fixtureText, async (path) => {
+        await writeCustodyHandleManifestEntry({ path, entry: writerEntry })
+        const before = await fs.readFile(path, 'utf8')
+        const lockPath = `${path}.lock`
+        const ownerPath = join(lockPath, 'owner')
+        const originalOpen = fs.open
+        const originalRename = fs.rename
+        let ownerRenames = 0
+        __setCustodyManifestLockTestOptions({
+          ttlMs: 100,
+          retryMinMs: 5,
+          retryMaxMs: 5,
+          renewalIntervalMs: 10,
+        })
+        spyOn(fs, 'rename').mockImplementation(async (from, to) => {
+          if (String(to) === ownerPath && ++ownerRenames > 1)
+            throw Object.assign(new Error('renewal failed'), { code: 'EIO' })
+          return originalRename(from, to)
+        })
+        spyOn(fs, 'open').mockImplementation(async (...args) => {
+          const handle = await originalOpen(...args)
+          if (
+            String(args[0]).endsWith('.tmp') &&
+            String(args[0]).startsWith(`${lockPath}/`)
+          ) {
+            await Bun.sleep(40)
+          }
+          return handle
+        })
+
+        await expect(
+          removeCustodyHandleManifestEntry({ path, entry: writerEntry }),
+        ).resolves.toEqual({ status: 'refused', code: 'renewal_failed' })
+        expect(await fs.readFile(path, 'utf8')).toBe(before)
+      })
+    },
+  )
+})
+
+describe('withCustodyManifestLock', () => {
+  afterEach(() => {
+    __setCustodyManifestLockTestOptions()
+  })
+
+  test.serial(
+    'evicts an owner that crashes after the contender starts',
+    async () => {
+      await withTempDirectory(async (directory) => {
+        const path = join(directory, 'handles.json')
+        const lockPath = `${path}.lock`
+        const ownerPath = join(lockPath, 'owner')
+        const ttlMs = 2_000
+        const crashedOwnerNonce = 'crashed-owner'
+        const originalNow = Date.now
+        let now = 0
+        let ownerReads = 0
+        Date.now = () => now
+        __setCustodyManifestLockTestOptions({
+          ttlMs,
+          retryMinMs: 1,
+          retryMaxMs: 1,
+          renewalIntervalMs: 1_000,
+          afterStaleOwnerRead: () => {
+            ownerReads += 1
+            now = ownerReads === 1 ? ttlMs + 1 : ttlMs + 500
+          },
+        })
+        try {
+          await fs.mkdir(lockPath, { mode: 0o700 })
+          await fs.writeFile(
+            ownerPath,
+            `${JSON.stringify({
+              tenant: 'anthropic-auth',
+              pid: process.pid,
+              claimed_at_ms: now,
+              nonce: crashedOwnerNonce,
+            })}\n`,
+          )
+          now = 500
+
+          expect(
+            await withCustodyManifestLock(path, async () => 'acquired'),
+          ).toBe('acquired')
+          await expect(
+            fs.lstat(`${lockPath}.stale-0-${crashedOwnerNonce}`),
+          ).resolves.toBeDefined()
+        } finally {
+          Date.now = originalNow
+        }
+      })
+    },
+  )
+
+  test.serial(
+    'evicts stale owners whose nonces use widened cross-version alphabets',
+    async () => {
+      for (const nonce of ['abc.def', 'AAAA====']) {
+        await withTempDirectory(async (directory) => {
+          const path = join(directory, 'handles.json')
+          const lockPath = `${path}.lock`
+          const claimedAtMs = Date.now() - 31
+          await fs.mkdir(lockPath, { mode: 0o700 })
+          await fs.writeFile(
+            join(lockPath, 'owner'),
+            `${JSON.stringify({
+              tenant: 'future-tenant',
+              pid: process.pid,
+              claimed_at_ms: claimedAtMs,
+              nonce,
+            })}\n`,
+          )
+          __setCustodyManifestLockTestOptions({
+            ttlMs: 30,
+            retryMinMs: 1,
+            retryMaxMs: 1,
+            renewalIntervalMs: 1_000,
+          })
+
+          await expect(
+            withCustodyManifestLock(path, async () => 'acquired'),
+          ).resolves.toBe('acquired')
+          await expect(
+            fs.lstat(`${lockPath}.stale-${claimedAtMs}-${nonce}`),
+          ).resolves.toBeDefined()
+        })
+      }
+    },
+  )
+
+  test.serial(
+    'reaps aged stale lock quarantines after releasing the lock',
+    async () => {
+      await withTempDirectory(async (directory) => {
+        const path = join(directory, 'handles.json')
+        const lockPath = `${path}.lock`
+        const ageMs = 24 * 60 * 60 * 1000
+        const now = Date.now()
+        const aged = ['one', 'two', 'three'].map(
+          (nonce) => `${lockPath}.stale-0-${nonce}`,
+        )
+        const fresh = `${lockPath}.stale-0-fresh`
+        for (const quarantine of aged) {
+          await fs.mkdir(quarantine)
+          await fs.utimes(
+            quarantine,
+            (now - ageMs - 1) / 1000,
+            (now - ageMs - 1) / 1000,
+          )
+        }
+        await fs.mkdir(fresh)
+        await fs.utimes(
+          fresh,
+          (now - ageMs + 60 * 60 * 1000) / 1000,
+          (now - ageMs + 60 * 60 * 1000) / 1000,
+        )
+
+        await expect(
+          withCustodyManifestLock(path, async () => 'acquired'),
+        ).resolves.toBe('acquired')
+        for (const quarantine of aged)
+          await expect(fs.lstat(quarantine)).rejects.toMatchObject({
+            code: 'ENOENT',
+          })
+        await expect(fs.lstat(fresh)).resolves.toBeDefined()
+      })
+    },
+  )
+
+  test.serial(
+    'evicts a stale owner record with an unknown future key',
+    async () => {
+      await withTempDirectory(async (directory) => {
+        const path = join(directory, 'handles.json')
+        const lockPath = `${path}.lock`
+        const originalNow = Date.now
+        let now = 0
+        Date.now = () => now
+        __setCustodyManifestLockTestOptions({
+          ttlMs: 100,
+          retryMinMs: 1,
+          retryMaxMs: 1,
+          renewalIntervalMs: 1_000,
+        })
+        try {
+          await fs.mkdir(lockPath, { mode: 0o700 })
+          await fs.writeFile(
+            join(lockPath, 'owner'),
+            `${JSON.stringify({
+              tenant: 'future-tenant',
+              pid: process.pid,
+              claimed_at_ms: now,
+              nonce: 'future-owner',
+              future_field: 1,
+            })}\n`,
+          )
+          now = 101
+          await expect(
+            withCustodyManifestLock(path, async () => 'acquired'),
+          ).resolves.toBe('acquired')
+          await expect(
+            fs.lstat(`${lockPath}.stale-0-future-owner`),
+          ).resolves.toBeDefined()
+        } finally {
+          Date.now = originalNow
+        }
+      })
+    },
+  )
+
+  test.serial(
+    'rejects unsafe stale owner nonce filenames without constructing quarantine targets',
+    async () => {
+      const unsafeNonces = [
+        ['empty', ''],
+        ['too long', 'a'.repeat(129)],
+        ['slash', '../escaped'],
+        ['backslash', 'a\\b'],
+        ['NUL', 'a\0b'],
+        ['C0 control', 'a\u001fb'],
+        ['DEL control', 'a\u007fb'],
+        ['dot', '.'],
+        ['dot dot', '..'],
+        ['colon', 'a:b'],
+        ['asterisk', 'a*b'],
+        ['question mark', 'a?b'],
+        ['quote', 'a"b'],
+        ['less than', 'a<b'],
+        ['greater than', 'a>b'],
+        ['pipe', 'a|b'],
+      ] as const
+
+      await withTempDirectory(async (directory) => {
+        const manifestDirectory = join(directory, 'manifest')
+        await fs.mkdir(manifestDirectory)
+        const originalRename = fs.rename
+        const staleRenameTargets: string[] = []
+        spyOn(fs, 'rename').mockImplementation(async (from, to) => {
+          if (String(from).endsWith('.lock'))
+            staleRenameTargets.push(String(to))
+          return originalRename(from, to)
+        })
+        __setCustodyManifestLockTestOptions({
+          ttlMs: 30,
+          retryMinMs: 1,
+          retryMaxMs: 1,
+          renewalIntervalMs: 1_000,
+        })
+
+        for (const [index, [, nonce]] of unsafeNonces.entries()) {
+          const path = join(manifestDirectory, `handles-${index}.json`)
+          const lockPath = `${path}.lock`
+          await fs.mkdir(lockPath, { mode: 0o700 })
+          await fs.writeFile(
+            join(lockPath, 'owner'),
+            `${JSON.stringify({
+              tenant: 'future-tenant',
+              pid: process.pid,
+              claimed_at_ms: Date.now() - 31,
+              nonce,
+            })}\n`,
+          )
+          staleRenameTargets.length = 0
+
+          await expect(
+            withCustodyManifestLock(path, async () => 'acquired'),
+          ).rejects.toMatchObject({ code: 'owner_invalid' })
+          expect(staleRenameTargets).toEqual([])
+          await expect(fs.lstat(lockPath)).resolves.toBeDefined()
+          await expect(
+            fs.lstat(join(directory, 'escaped')),
+          ).rejects.toMatchObject({
+            code: 'ENOENT',
+          })
+        }
+      })
+    },
+  )
+
+  test.serial(
+    'rejects trailing Windows nonce aliases before quarantine',
+    async () => {
+      for (const nonce of ['alias.', 'alias ']) {
+        await withTempDirectory(async (directory) => {
+          const path = join(directory, 'handles.json')
+          const lockPath = `${path}.lock`
+          const originalRename = fs.rename
+          const staleRenameTargets: string[] = []
+          await fs.mkdir(lockPath, { mode: 0o700 })
+          await fs.writeFile(
+            join(lockPath, 'owner'),
+            `${JSON.stringify({
+              tenant: 'future-tenant',
+              pid: process.pid,
+              claimed_at_ms: Date.now() - 31,
+              nonce,
+            })}\n`,
+          )
+          __setCustodyManifestLockTestOptions({
+            ttlMs: 30,
+            retryMinMs: 1,
+            retryMaxMs: 1,
+            renewalIntervalMs: 1_000,
+          })
+          spyOn(fs, 'rename').mockImplementation(async (from, to) => {
+            if (String(from) === lockPath) staleRenameTargets.push(String(to))
+            return originalRename(from, to)
+          })
+          try {
+            await expect(
+              withCustodyManifestLock(path, async () => 'acquired'),
+            ).rejects.toMatchObject({ code: 'owner_invalid' })
+            expect(staleRenameTargets).toEqual([])
+            await expect(fs.lstat(lockPath)).resolves.toBeDefined()
+          } finally {
+            mock.restore()
+          }
+        })
+      }
+    },
+  )
+
+  test.serial(
+    'does not evict a holder whose owner record is renewed across multiple leases',
+    async () => {
+      await withTempDirectory(async (directory) => {
+        const path = join(directory, 'handles.json')
+        const originalNow = Date.now
+        const originalSetInterval = globalThis.setInterval
+        const originalClearInterval = globalThis.clearInterval
+        let now = 0
+        let renew: (() => void) | undefined
+        Date.now = () => now
+        globalThis.setInterval = ((handler: () => void) => {
+          renew = handler
+          return {} as ReturnType<typeof setInterval>
+        }) as typeof setInterval
+        globalThis.clearInterval = (() => {}) as typeof clearInterval
+        __setCustodyManifestLockTestOptions({
+          ttlMs: 100,
+          retryMinMs: 5,
+          retryMaxMs: 5,
+          renewalIntervalMs: 30,
+        })
+        const order: string[] = []
+        const firstEntered = Promise.withResolvers<void>()
+        const releaseFirst = Promise.withResolvers<void>()
+        const first = withCustodyManifestLock(path, async () => {
+          order.push('first-enter')
+          firstEntered.resolve()
+          await releaseFirst.promise
+          order.push('first-exit')
+        })
+        await firstEntered.promise
+        for (now = 30; now <= 300; now += 30) {
+          renew?.()
+          await new Promise<void>((resolve) => setImmediate(resolve))
+        }
+        now = 350
+        const second = withCustodyManifestLock(path, async () => {
+          order.push('second-enter')
+        })
+
+        try {
+          await new Promise<void>((resolve) => setImmediate(resolve))
+          expect(order).toEqual(['first-enter'])
+          releaseFirst.resolve()
+          await Promise.all([first, second])
+          expect(order).toEqual(['first-enter', 'first-exit', 'second-enter'])
+        } finally {
+          Date.now = originalNow
+          globalThis.setInterval = originalSetInterval
+          globalThis.clearInterval = originalClearInterval
+        }
+      })
+    },
+  )
+
+  test.serial(
+    'does not remove a successor lock after its own expired lease is evicted',
+    async () => {
+      await withTempDirectory(async (directory) => {
+        const path = join(directory, 'handles.json')
+        const lockPath = `${path}.lock`
+        __setCustodyManifestLockTestOptions({
+          ttlMs: 100,
+          retryMinMs: 5,
+          retryMaxMs: 5,
+          renewalIntervalMs: 1_000,
+        })
+        const firstEntered = Promise.withResolvers<void>()
+        const releaseFirst = Promise.withResolvers<void>()
+        const secondEntered = Promise.withResolvers<void>()
+        const releaseSecond = Promise.withResolvers<void>()
+        const first = withCustodyManifestLock(path, async () => {
+          firstEntered.resolve()
+          await releaseFirst.promise
+        })
+        await firstEntered.promise
+        await Bun.sleep(130)
+        const second = withCustodyManifestLock(path, async () => {
+          secondEntered.resolve()
+          await releaseSecond.promise
+        })
+        await secondEntered.promise
+
+        releaseFirst.resolve()
+        await first
+        await expect(fs.lstat(lockPath)).resolves.toBeDefined()
+        releaseSecond.resolve()
+        await second
+      })
+    },
+  )
+
+  test.serial(
+    'keeps an expired owner lock for the next claimant to evict',
+    async () => {
+      await withTempDirectory(async (directory) => {
+        const path = join(directory, 'handles.json')
+        const lockPath = `${path}.lock`
+        const originalNow = Date.now
+        let now = 0
+        const logs: Array<{
+          level?: string
+          channel?: string
+          message?: string
+          payload?: Record<string, unknown>
+        }> = []
+        Date.now = () => now
+        __setCustodyManifestLockTestOptions({
+          ttlMs: 100,
+          retryMinMs: 5,
+          retryMaxMs: 5,
+          renewalIntervalMs: 1_000,
+        })
+        __setLogTestSink((record) => logs.push(record))
+        try {
+          await withCustodyManifestLock(path, async () => {
+            now = 101
+          })
+          await expect(fs.lstat(lockPath)).resolves.toBeDefined()
+          expect(logs).toContainEqual({
+            level: 'warn',
+            channel: 'claustrum',
+            message: 'manifest lock lease lost, not releasing',
+            payload: { id: path },
+          })
+
+          await withCustodyManifestLock(path, async () => {})
+          await expect(fs.lstat(lockPath)).rejects.toMatchObject({
+            code: 'ENOENT',
+          })
+        } finally {
+          __setLogTestSink(null)
+          Date.now = originalNow
+        }
+      })
+    },
+  )
+
+  test.serial(
+    'reports a corrupt owner record at the deadline without evicting it',
+    async () => {
+      await withTempDirectory(async (directory) => {
+        const path = join(directory, 'handles.json')
+        const lockPath = `${path}.lock`
+        const owner = 'not json'
+        await fs.mkdir(lockPath, { mode: 0o700 })
+        await fs.writeFile(join(lockPath, 'owner'), owner)
+        __setCustodyManifestLockTestOptions({
+          ttlMs: 30,
+          retryMinMs: 5,
+          retryMaxMs: 5,
+          renewalIntervalMs: 1_000,
+        })
+
+        await expect(
+          withCustodyManifestLock(path, async () => 'acquired'),
+        ).rejects.toMatchObject({ code: 'owner_invalid' })
+        expect(await fs.lstat(lockPath)).toBeDefined()
+        expect(await fs.readFile(join(lockPath, 'owner'), 'utf8')).toBe(owner)
+      })
+    },
+  )
+
+  test.serial('keeps a missing owner record as lock_busy', async () => {
+    await withTempDirectory(async (directory) => {
+      const path = join(directory, 'handles.json')
+      const lockPath = `${path}.lock`
+      await fs.mkdir(lockPath, { mode: 0o700 })
+      __setCustodyManifestLockTestOptions({
+        ttlMs: 30,
+        retryMinMs: 5,
+        retryMaxMs: 5,
+        renewalIntervalMs: 1_000,
+      })
+
+      await expect(
+        withCustodyManifestLock(path, async () => 'acquired'),
+      ).rejects.toMatchObject({ code: 'lock_busy' })
+      await expect(fs.lstat(lockPath)).resolves.toBeDefined()
+      await expect(fs.lstat(join(lockPath, 'owner'))).rejects.toMatchObject({
+        code: 'ENOENT',
+      })
+    })
+  })
+
+  test.serial('reports a held lock as lock_busy', async () => {
+    await withTempDirectory(async (directory) => {
+      const path = join(directory, 'handles.json')
+      const firstEntered = Promise.withResolvers<void>()
+      const releaseFirst = Promise.withResolvers<void>()
+      __setCustodyManifestLockTestOptions({
+        ttlMs: 30,
+        retryMinMs: 1,
+        retryMaxMs: 1,
+        renewalIntervalMs: 5,
+      })
+      const first = withCustodyManifestLock(path, async () => {
+        firstEntered.resolve()
+        await releaseFirst.promise
+      })
+      try {
+        await firstEntered.promise
+        await expect(
+          withCustodyManifestLock(path, async () => 'acquired'),
+        ).rejects.toMatchObject({ code: 'lock_busy' })
+      } finally {
+        releaseFirst.resolve()
+        await first
+      }
+    })
+  })
+
+  test.serial(
+    'aborts before rename with renewal_failed and preserves manifest bytes',
+    async () => {
+      await withManifest(fixtureText, async (path) => {
+        const before = await fs.readFile(path, 'utf8')
+        const originalNow = Date.now
+        const originalOpen = fs.open
+        let now = 0
+        Date.now = () => now
+        __setCustodyManifestLockTestOptions({
+          ttlMs: 100,
+          retryMinMs: 1,
+          retryMaxMs: 1,
+          renewalIntervalMs: 1_000,
+        })
+        spyOn(fs, 'open').mockImplementation(async (...arguments_) => {
+          const handle = await originalOpen(...arguments_)
+          if (dirname(String(arguments_[0])) === dirname(path)) now = 101
+          return handle
+        })
+        try {
+          await expect(
+            writeCustodyHandleManifestEntry({ path, entry: writerEntry }),
+          ).resolves.toMatchObject({
+            status: 'refused',
+            code: 'renewal_failed',
+          })
+          expect(await fs.readFile(path, 'utf8')).toBe(before)
+        } finally {
+          Date.now = originalNow
+        }
+      })
+    },
+  )
+
+  test.serial(
+    'keeps a post-commit lease loss non-throwing after the write lands',
+    async () => {
+      await withManifest(fixtureText, async (path) => {
+        const originalNow = Date.now
+        const originalRename = fs.rename
+        let now = 0
+        Date.now = () => now
+        __setCustodyManifestLockTestOptions({
+          ttlMs: 100,
+          retryMinMs: 1,
+          retryMaxMs: 1,
+          renewalIntervalMs: 1_000,
+        })
+        spyOn(fs, 'rename').mockImplementation(async (from, to) => {
+          const result = await originalRename(from, to)
+          if (String(to) === path) now = 101
+          return result
+        })
+        try {
+          await expect(
+            writeCustodyHandleManifestEntry({ path, entry: writerEntry }),
+          ).resolves.toEqual({ status: 'written' })
+          expect(await fs.readFile(path, 'utf8')).toContain(writerHandle)
+        } finally {
+          Date.now = originalNow
+        }
+      })
+    },
+  )
+
+  test.serial(
+    'does not let a delayed stale evictor quarantine a fresh successor lease',
+    async () => {
+      await withTempDirectory(async (directory) => {
+        const path = join(directory, 'handles.json')
+        const lockPath = `${path}.lock`
+        const ownerPath = join(lockPath, 'owner')
+        const staleClaimedAtMs = Date.now() - 1_001
+        const staleNonce = 'stale-owner'
+        const originalRename = fs.rename
+        const bObservedStaleOwner = Promise.withResolvers<void>()
+        const releaseBObservation = Promise.withResolvers<void>()
+        const bRenameOutcome = Promise.withResolvers<'failed' | 'succeeded'>()
+        const aEntered = Promise.withResolvers<void>()
+        const releaseA = Promise.withResolvers<void>()
+        const bEntered = Promise.withResolvers<void>()
+        const releaseB = Promise.withResolvers<void>()
+        let pausedB = false
+        let staleRenameAttempts = 0
+        __setCustodyManifestLockTestOptions({
+          ttlMs: 1_000,
+          retryMinMs: 1,
+          retryMaxMs: 1,
+          renewalIntervalMs: 1_000,
+          afterStaleOwnerRead: async () => {
+            if (pausedB) return
+            pausedB = true
+            bObservedStaleOwner.resolve()
+            await releaseBObservation.promise
+          },
+        })
+        await fs.mkdir(lockPath, { mode: 0o700 })
+        await fs.writeFile(
+          ownerPath,
+          `${JSON.stringify({
+            tenant: 'anthropic-auth',
+            pid: process.pid,
+            claimed_at_ms: staleClaimedAtMs,
+            nonce: staleNonce,
+          })}\n`,
+        )
+        spyOn(fs, 'rename').mockImplementation(async (from, to) => {
+          const isStaleRename =
+            String(from) === lockPath &&
+            String(to).startsWith(`${lockPath}.stale-`)
+          if (!isStaleRename) return originalRename(from, to)
+          staleRenameAttempts += 1
+          try {
+            const result = await originalRename(from, to)
+            if (staleRenameAttempts === 2) bRenameOutcome.resolve('succeeded')
+            return result
+          } catch (error) {
+            if (staleRenameAttempts === 2) bRenameOutcome.resolve('failed')
+            throw error
+          }
+        })
+
+        const b = withCustodyManifestLock(path, async () => {
+          bEntered.resolve()
+          await releaseB.promise
+        })
+        let a: Promise<void> | undefined
+        try {
+          await bObservedStaleOwner.promise
+          a = withCustodyManifestLock(path, async () => {
+            aEntered.resolve()
+            await releaseA.promise
+          })
+          await aEntered.promise
+          const aOwner = JSON.parse(await fs.readFile(ownerPath, 'utf8'))
+          releaseBObservation.resolve()
+          expect(await bRenameOutcome.promise).toBe('failed')
+          expect(
+            JSON.parse(await fs.readFile(ownerPath, 'utf8')),
+          ).toMatchObject({ nonce: aOwner.nonce })
+          releaseA.resolve()
+          await a
+          await bEntered.promise
+        } finally {
+          releaseBObservation.resolve()
+          releaseA.resolve()
+          releaseB.resolve()
+          await Promise.allSettled([a, b].filter(Boolean))
+        }
+      })
+    },
+  )
+
+  test.serial(
+    'quarantines competing stale evictors under their observed owner nonce',
+    async () => {
+      await withTempDirectory(async (directory) => {
+        const path = join(directory, 'handles.json')
+        const lockPath = `${path}.lock`
+        const ownerPath = join(lockPath, 'owner')
+        const staleClaimedAtMs = Date.now() - 1_001
+        const staleNonce = 'same-stale-owner'
+        const expectedQuarantine = `${lockPath}.stale-${staleClaimedAtMs}-${staleNonce}`
+        const expectedQuarantineName = basename(expectedQuarantine)
+        const originalRename = fs.rename
+        const bObservedStaleOwner = Promise.withResolvers<void>()
+        const releaseBObservation = Promise.withResolvers<void>()
+        const bReadyToRename = Promise.withResolvers<void>()
+        const releaseBRename = Promise.withResolvers<void>()
+        const aEntered = Promise.withResolvers<void>()
+        const releaseA = Promise.withResolvers<void>()
+        const bEntered = Promise.withResolvers<void>()
+        const releaseB = Promise.withResolvers<void>()
+        let pausedB = false
+        let staleRenameAttempts = 0
+        __setCustodyManifestLockTestOptions({
+          ttlMs: 1_000,
+          retryMinMs: 1,
+          retryMaxMs: 1,
+          renewalIntervalMs: 1_000,
+          afterStaleOwnerRead: async () => {
+            if (pausedB) return
+            pausedB = true
+            bObservedStaleOwner.resolve()
+            await releaseBObservation.promise
+          },
+        })
+        await fs.mkdir(lockPath, { mode: 0o700 })
+        await fs.writeFile(
+          ownerPath,
+          `${JSON.stringify({
+            tenant: 'anthropic-auth',
+            pid: process.pid,
+            claimed_at_ms: staleClaimedAtMs,
+            nonce: staleNonce,
+          })}\n`,
+        )
+        spyOn(fs, 'rename').mockImplementation(async (from, to) => {
+          const isStaleRename =
+            String(from) === lockPath &&
+            String(to).startsWith(`${lockPath}.stale-`)
+          if (isStaleRename) staleRenameAttempts += 1
+          if (staleRenameAttempts === 2) {
+            bReadyToRename.resolve()
+            await releaseBRename.promise
+          }
+          return originalRename(from, to)
+        })
+
+        const b = withCustodyManifestLock(path, async () => {
+          bEntered.resolve()
+          await releaseB.promise
+        })
+        let a: Promise<void> | undefined
+        try {
+          await bObservedStaleOwner.promise
+          a = withCustodyManifestLock(path, async () => {
+            aEntered.resolve()
+            await releaseA.promise
+          })
+          await aEntered.promise
+          releaseBObservation.resolve()
+          await bReadyToRename.promise
+          expect(
+            (await fs.readdir(directory)).filter((name) =>
+              name.startsWith(`${basename(lockPath)}.stale-`),
+            ),
+          ).toEqual([expectedQuarantineName])
+          releaseBRename.resolve()
+          releaseA.resolve()
+          await a
+          await bEntered.promise
+        } finally {
+          releaseBObservation.resolve()
+          releaseBRename.resolve()
+          releaseA.resolve()
+          releaseB.resolve()
+          await Promise.allSettled([a, b].filter(Boolean))
+        }
+      })
+    },
+  )
+
+  test('pins renewal cadence within one third of the lease', async () => {
+    const core = (await import('@cortexkit/anthropic-auth-core')) as {
+      CUSTODY_MANIFEST_LOCK_RENEW_MS?: number
+    }
+    expect(core.CUSTODY_MANIFEST_LOCK_RENEW_MS).toBeDefined()
+    expect(
+      (core.CUSTODY_MANIFEST_LOCK_RENEW_MS ?? Infinity) * 3,
+    ).toBeLessThanOrEqual(CUSTODY_MANIFEST_LOCK_TTL_MS)
+  })
+})
+
+describe('resolveCustodyHandle', () => {
+  const activeHandle = `ckh_${'A'.repeat(43)}`
+  const legacyHandle = `ckh_${'B'.repeat(43)}`
+  const otherHandle = `ckh_${'C'.repeat(43)}`
+
+  function account(
+    input: { id?: string; label?: string; claustrumHandle?: string } = {},
+  ) {
+    return {
+      id: input.id ?? 'uuid-not-a-label',
+      type: 'oauth' as const,
+      refresh: 'refresh-token',
+      ...input,
+    }
+  }
+
+  function manifest(input: { accounts?: Array<Record<string, unknown>> } = {}) {
+    const parsed = readCustodyHandles(
+      {
+        version: 1,
+        providers: [
+          {
+            provider: 'anthropic',
+            serve: 'anthropic-auth',
+            accounts: input.accounts ?? [
+              {
+                label: 'alice',
+                handle: activeHandle,
+                credential_id: 'oauth:anthropic:alice',
+              },
+            ],
+          },
+        ],
+      },
+      'anthropic',
+      'anthropic-auth',
+    )
+    return {
+      version: 1 as const,
+      provider: 'anthropic' as const,
+      serve: 'anthropic-auth' as const,
+      accounts: parsed.accounts,
+      superseded: parsed.superseded,
+    }
+  }
+
+  function expectResolvedSource(
+    result: ReturnType<typeof resolveCustodyHandle>,
+    source: 'manifest' | 'legacy',
+  ) {
+    expect(result.status).toBe('resolved')
+    if (result.status !== 'resolved')
+      throw new Error('expected resolved handle')
+    expect(result.source).toBe(source)
+  }
+
+  function expectUnresolvedReason(
+    result: ReturnType<typeof resolveCustodyHandle>,
+    reason:
+      | 'missing-label'
+      | 'invalid-label'
+      | 'duplicate-label'
+      | 'missing-entry'
+      | 'foreign-serve'
+      | 'superseded',
+  ) {
+    expect(result.status).toBe('unresolved')
+    if (result.status !== 'unresolved')
+      throw new Error('expected unresolved handle')
+    expect(result.reason).toBe(reason)
+  }
+
+  test('prefers a matching manifest handle over a legacy handle', () => {
+    const result = resolveCustodyHandle({
+      account: account({ label: 'alice', claustrumHandle: legacyHandle }),
+      manifest: manifest(),
+    })
+
+    expectResolvedSource(result, 'manifest')
+  })
+
+  test('falls back to legacy only when a valid label has no manifest entry', () => {
+    const result = resolveCustodyHandle({
+      account: account({ label: 'bob', claustrumHandle: legacyHandle }),
+      manifest: manifest(),
+    })
+
+    expectResolvedSource(result, 'legacy')
+  })
+
+  test('falls back to legacy when the reader rejects an invalid manifest', async () => {
+    await withManifest('{', async (path) => {
+      const result = await reader(path).read()
+      expect(result.status).toBe('invalid')
+
+      expectResolvedSource(
+        resolveCustodyHandle({
+          account: account({ label: 'alice', claustrumHandle: legacyHandle }),
+          manifest: result.status === 'ready' ? result.manifest : undefined,
+        }),
+        'legacy',
+      )
+    })
+  })
+
+  test('returns unresolved for a missing label without a legacy handle', () => {
+    expectUnresolvedReason(
+      resolveCustodyHandle({ account: account(), manifest: manifest() }),
+      'missing-label',
+    )
+  })
+
+  test('falls back to legacy for a missing label', () => {
+    expectResolvedSource(
+      resolveCustodyHandle({
+        account: account({ claustrumHandle: legacyHandle }),
+        manifest: manifest(),
+      }),
+      'legacy',
+    )
+  })
+
+  test('returns unresolved for an invalid label without a legacy handle', () => {
+    expectUnresolvedReason(
+      resolveCustodyHandle({
+        account: account({ label: 'Alice' }),
+        manifest: manifest(),
+      }),
+      'invalid-label',
+    )
+  })
+
+  test('falls back to legacy for an invalid label', () => {
+    expectResolvedSource(
+      resolveCustodyHandle({
+        account: account({ label: 'Alice', claustrumHandle: legacyHandle }),
+        manifest: manifest(),
+      }),
+      'legacy',
+    )
+  })
+
+  test('returns unresolved for a duplicate OAuth label without a legacy handle', () => {
+    expectUnresolvedReason(
+      resolveCustodyHandle({
+        account: account({ label: 'alice' }),
+        manifest: manifest(),
+        duplicateOAuthLabels: new Set(['alice']),
+      }),
+      'duplicate-label',
+    )
+  })
+
+  test('falls back to legacy for a duplicate OAuth label', () => {
+    expectResolvedSource(
+      resolveCustodyHandle({
+        account: account({ label: 'alice', claustrumHandle: legacyHandle }),
+        manifest: manifest(),
+        duplicateOAuthLabels: new Set(['alice']),
+      }),
+      'legacy',
+    )
+  })
+
+  test('requires the canonical OAuth credential ID rather than the UUID', () => {
+    const result = resolveCustodyHandle({
+      account: account({ id: 'uuid-not-a-label', label: 'alice' }),
+      manifest: manifest({
+        accounts: [
+          {
+            label: 'alice',
+            handle: activeHandle,
+            credential_id: 'uuid-not-a-label',
+          },
+        ],
+      }),
+    })
+
+    expectUnresolvedReason(result, 'missing-entry')
+  })
+
+  test('never falls back to legacy for a foreign serve', () => {
+    const foreign = Object.assign(manifest(), {
+      serve: 'foreign-serve',
+    })
+
+    expectUnresolvedReason(
+      resolveCustodyHandle({
+        account: account({ label: 'alice', claustrumHandle: legacyHandle }),
+        manifest: foreign as never,
+      }),
+      'foreign-serve',
+    )
+  })
+
+  test('rejects a matching active handle recorded as superseded', () => {
+    expectUnresolvedReason(
+      resolveCustodyHandle({
+        account: account({ label: 'alice', claustrumHandle: legacyHandle }),
+        manifest: manifest({
+          accounts: [
+            {
+              label: 'alice',
+              handle: activeHandle,
+              credential_id: 'oauth:anthropic:alice',
+              superseded: [activeHandle],
+            },
+          ],
+        }),
+      }),
+      'superseded',
+    )
+  })
+
+  test('rejects an active handle superseded by another manifest entry', () => {
+    expectUnresolvedReason(
+      resolveCustodyHandle({
+        account: account({ label: 'alice' }),
+        manifest: manifest({
+          accounts: [
+            {
+              label: 'alice',
+              handle: activeHandle,
+              credential_id: 'oauth:anthropic:alice',
+            },
+            {
+              label: 'bob',
+              handle: otherHandle,
+              credential_id: 'oauth:anthropic:bob',
+              superseded: [activeHandle],
+            },
+          ],
+        }),
+      }),
+      'superseded',
+    )
+  })
+})
diff --git a/packages/opencode/src/tests/custody-mode-first-run.test.ts b/packages/opencode/src/tests/custody-mode-first-run.test.ts
new file mode 100644
index 00000000..34054dee
--- /dev/null
+++ b/packages/opencode/src/tests/custody-mode-first-run.test.ts
@@ -0,0 +1,859 @@
+import { afterEach, describe, expect, mock, test } from 'bun:test'
+import { access, mkdtemp, readFile, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { dirname, join } from 'node:path'
+import {
+  custodyTombstoneOAuth,
+  getAccountStatePath,
+  loadAccounts,
+  saveAccounts,
+  setClaustrumModePersistent,
+  setRoutingMode,
+} from '@cortexkit/anthropic-auth-core'
+import { login } from '../cli'
+import { runClaustrumTakeoverCommand } from '../custody-live'
+import { AnthropicAuthPlugin } from '../index'
+import {
+  buildAccountDialogL1,
+  normalizeAccountDialogPayload,
+} from '../tui/command-dialogs'
+import {
+  bootRuledClaustrumRow as bootSharedRuledClaustrumRow,
+  connectorFor,
+  credentialResponse,
+  ruledMainHandle,
+  writeManifest,
+} from './custody-ruled-row.fixture'
+import { extractUrl, MESSAGES_URL, TOKEN_URL } from './test-fetch'
+
+const originalFetch = globalThis.fetch
+const originalEnv = {
+  account: process.env.OPENCODE_ANTHROPIC_AUTH_FILE,
+  sidebar: process.env.OPENCODE_ANTHROPIC_AUTH_SIDEBAR_STATE_FILE,
+  feed: process.env.OPENCODE_ANTHROPIC_AUTH_QUOTA_FEED_DIR,
+  manifest: process.env.CLAUSTRUM_OPENCODE_HANDLES,
+}
+const roots: string[] = []
+
+function restoreEnv(name: keyof typeof originalEnv, variable: string) {
+  const value = originalEnv[name]
+  if (value === undefined) delete process.env[variable]
+  else process.env[variable] = value
+}
+
+async function expectMissing(path: string) {
+  await expect(access(path)).rejects.toThrow()
+}
+
+async function createFirstRunRoot() {
+  const root = await mkdtemp(join(tmpdir(), 'custody-first-run-'))
+  roots.push(root)
+  process.env.OPENCODE_ANTHROPIC_AUTH_FILE = join(root, 'anthropic-auth.json')
+  process.env.OPENCODE_ANTHROPIC_AUTH_SIDEBAR_STATE_FILE = join(
+    root,
+    'sidebar-state.json',
+  )
+  process.env.OPENCODE_ANTHROPIC_AUTH_QUOTA_FEED_DIR = join(root, 'quota-feed')
+  return root
+}
+
+function createClient() {
+  return {
+    auth: { set: mock(() => Promise.resolve()) },
+    session: {
+      promptAsync: mock(
+        (_input: { body: { parts: Array<{ text?: string }> } }) =>
+          Promise.resolve(),
+      ),
+    },
+  }
+}
+
+async function commandText(
+  client: ReturnType<typeof createClient>,
+  plugin: any,
+) {
+  await plugin['command.execute.before']({
+    command: 'claude-account',
+    arguments: '',
+    sessionID: 'custody-first-run-status',
+  }).catch(() => {})
+  return (
+    client.session.promptAsync.mock.calls.at(-1)?.[0]?.body.parts[0]?.text ?? ''
+  )
+}
+
+async function bootRuled(
+  options: Omit<
+    Parameters<typeof bootSharedRuledClaustrumRow>[0],
+    | 'createFallbackStorage'
+    | 'useTempAccountFile'
+    | 'getPlugin'
+    | 'extractUrl'
+    | 'tempConfigDir'
+  >,
+) {
+  const root = await createFirstRunRoot()
+  const client = createClient()
+  const fixture = await bootSharedRuledClaustrumRow({
+    ...options,
+    createFallbackStorage: (storage) => ({ version: 1, ...storage }) as never,
+    useTempAccountFile: async (storage) => {
+      await saveAccounts(storage, process.env.OPENCODE_ANTHROPIC_AUTH_FILE!)
+    },
+    getPlugin: async (accountPath, runtime) =>
+      (
+        AnthropicAuthPlugin as unknown as (
+          ctx: { client: unknown },
+          runtime: Record<string, unknown>,
+        ) => Promise<any>
+      )({ client }, { ...runtime, claustrumNow: runtime.claustrumNow }),
+    extractUrl,
+    tempConfigDir: () => root,
+  })
+  return { ...fixture, client }
+}
+
+afterEach(async () => {
+  globalThis.fetch = originalFetch
+  restoreEnv('account', 'OPENCODE_ANTHROPIC_AUTH_FILE')
+  restoreEnv('sidebar', 'OPENCODE_ANTHROPIC_AUTH_SIDEBAR_STATE_FILE')
+  restoreEnv('feed', 'OPENCODE_ANTHROPIC_AUTH_QUOTA_FEED_DIR')
+  restoreEnv('manifest', 'CLAUSTRUM_OPENCODE_HANDLES')
+  await Promise.all(
+    roots.splice(0).map((root) => rm(root, { recursive: true, force: true })),
+  )
+})
+
+describe('fresh install under Claustrum', () => {
+  test('fresh rostered fallback must route vault-first: accounts.ts:562 rejects no-state OAuth rows; custody-dimensions.ts:65-72 calls it R; accounts.ts:4234-4238 withholds non-resident vault rows; observed [Bearer vault-main-access, Bearer vault-main-access]', async () => {
+    const root = await createFirstRunRoot()
+    const accountPath = process.env.OPENCODE_ANTHROPIC_AUTH_FILE!
+    const statePath = accountPath.replace(/\.json$/, '-state.json')
+    const sidebarPath = process.env.OPENCODE_ANTHROPIC_AUTH_SIDEBAR_STATE_FILE!
+    await expectMissing(accountPath)
+    await expectMissing(statePath)
+    await saveAccounts(
+      {
+        version: 1,
+        accounts: [
+          { id: 'work-alt', label: 'work-alt', type: 'oauth', enabled: true },
+        ],
+      } as never,
+      accountPath,
+    )
+    await setClaustrumModePersistent('claustrum', accountPath)
+    await rm(statePath, { force: true })
+    await expectMissing(statePath)
+
+    const fallbackHandle = `ckh_${'F'.repeat(43)}`
+    await writeManifest(root, [
+      { label: 'main', handle: ruledMainHandle },
+      { label: 'work-alt', handle: fallbackHandle },
+    ])
+    const calls: Array<{ method: string; params: Record<string, unknown> }> = []
+    const authorizations: string[] = []
+    let tokenRequests = 0
+    globalThis.fetch = mock((input: unknown, init?: RequestInit) => {
+      const url = extractUrl(input as Parameters<typeof extractUrl>[0])
+      if (url === TOKEN_URL) tokenRequests++
+      if (url.includes('/v1/messages')) {
+        authorizations.push(
+          new Headers(init?.headers).get('authorization') ?? '',
+        )
+        return Promise.resolve(new Response('{}', { status: 200 }))
+      }
+      return Promise.resolve(new Response('{}', { status: 200 }))
+    }) as unknown as typeof fetch
+    const client = createClient()
+    const plugin = await (
+      AnthropicAuthPlugin as unknown as (
+        ctx: { client: unknown },
+        runtime: Record<string, unknown>,
+      ) => Promise<any>
+    )(
+      { client },
+      {
+        claustrumNow: () => 1_000,
+        claustrumConnector: connectorFor(calls, (method, params) => {
+          if (method !== 'credential.get') return { result: {} }
+          const isMain = params.handle === ruledMainHandle
+          return credentialResponse(
+            isMain ? 'vault-main-access' : 'vault-fallback-access',
+            isMain ? 3 : 7,
+            20_000_000,
+            isMain ? 'A' : 'B',
+          )
+        }),
+      },
+    )
+    try {
+      const result = await plugin.auth.loader(
+        () => Promise.resolve(custodyTombstoneOAuth('anthropic') as never),
+        { models: {} },
+      )
+      await plugin.__fallbackRefreshReady
+      const mainResponse = await result.fetch(MESSAGES_URL, {
+        method: 'POST',
+        body: JSON.stringify({
+          model: 'claude-opus-5',
+          max_tokens: 1,
+          messages: [{ role: 'user', content: 'hello' }],
+        }),
+      })
+      await setRoutingMode('fallback-first', accountPath)
+      const fallbackResult = await plugin.auth.loader(
+        () => Promise.resolve(custodyTombstoneOAuth('anthropic') as never),
+        { models: {} },
+      )
+      const fallbackResponse = await fallbackResult.fetch(MESSAGES_URL, {
+        method: 'POST',
+        body: JSON.stringify({
+          model: 'claude-opus-5',
+          max_tokens: 1,
+          messages: [{ role: 'user', content: 'hello' }],
+        }),
+      })
+
+      const storage = await loadAccounts(accountPath)
+      const status = await commandText(client, plugin)
+      const sidebar = await readFile(sidebarPath, 'utf8')
+      expect(mainResponse.status).toBe(200)
+      expect(fallbackResponse.status).toBe(200)
+      expect(tokenRequests).toBe(0)
+      expect(storage?.mainAccountId).toBeDefined()
+      expect(storage?.routing?.mode).toBe('fallback-first')
+      expect(storage?.accounts.map((account) => account.id)).toContain(
+        'work-alt',
+      )
+      expect(
+        calls
+          .filter((call) => call.method === 'credential.get')
+          .map((call) => call.params.handle),
+      ).toContain(fallbackHandle)
+      expect(authorizations).toEqual([
+        'Bearer vault-main-access',
+        'Bearer vault-fallback-access',
+      ])
+      expect(status).toContain('Custody mode: claustrum')
+      expect(status).toContain('vault-served')
+      expect(sidebar).toContain('work-alt')
+      const publicOutput = `${status}\n${sidebar}`
+      expect(publicOutput).not.toContain(ruledMainHandle)
+      expect(publicOutput).not.toContain(fallbackHandle)
+    } finally {
+      await plugin.dispose?.()
+    }
+  })
+})
+
+describe('mixed-version account-dialog payloads', () => {
+  test('renders an unavailable custody mode for a v1.22-shaped payload', () => {
+    const payload = normalizeAccountDialogPayload({
+      accounts: [
+        {
+          id: 'work-alt',
+          label: 'work-alt',
+          role: 'fallback',
+          enabled: true,
+          quotaPercent: null,
+          claustrumGate: 'on',
+          vaultServed: false,
+          custodyState: 'on-cold',
+        },
+      ],
+      claustrumDetection: 'ready',
+    })
+
+    expect(buildAccountDialogL1(payload).header).toBe(
+      'Custody mode: unavailable from older server',
+    )
+    expect(JSON.stringify(payload)).not.toContain('ckh_')
+  })
+
+  test('accepts the v1.22 field subset from a current payload', () => {
+    const currentPayload = {
+      accounts: [
+        {
+          id: 'work-alt',
+          label: 'work-alt',
+          role: 'fallback',
+          enabled: true,
+          quotaPercent: 10,
+          claustrumGate: 'on',
+          vaultServed: true,
+          vaultReauth: false,
+          custodyState: 'on-vault-served',
+        },
+      ],
+      claustrumDetection: 'ready',
+      custodyMode: 'claustrum',
+      custodyModeKnown: true,
+    }
+    const {
+      custodyMode: _mode,
+      custodyModeKnown: _known,
+      ...v122
+    } = currentPayload
+
+    expect(() => normalizeAccountDialogPayload(v122)).not.toThrow()
+  })
+})
+
+describe('cold main and warm fallback', () => {
+  test.serial(
+    'uses the warm fallback and never sends a tombstone bearer',
+    async () => {
+      const fallbackHandle = `ckh_${'C'.repeat(43)}`
+      const fixture = await bootRuled({
+        route: 'main-exhausted',
+        initialNow: 1_000,
+        fallbacks: [
+          {
+            label: 'work-alt',
+            handle: fallbackHandle,
+            access: 'vault-fallback',
+          },
+        ],
+        connector: (calls) =>
+          connectorFor(calls, (method, params) => {
+            if (method !== 'credential.get') return { result: {} }
+            return credentialResponse(
+              params.handle === ruledMainHandle
+                ? 'vault-main'
+                : 'vault-fallback',
+              7,
+              params.handle === ruledMainHandle ? 2_000 : 10_000,
+            )
+          }),
+      })
+      try {
+        fixture.setNow(3_000)
+        const response = await fixture.result.fetch(MESSAGES_URL, {
+          method: 'POST',
+          body: JSON.stringify({ model: 'claude-opus-5', messages: [] }),
+        })
+        expect(response.status).toBe(200)
+        expect(fixture.authorizations).toEqual(['Bearer vault-fallback'])
+        expect(fixture.authorizations.join('\n')).not.toContain(
+          'claustrum-tombstone',
+        )
+      } finally {
+        await fixture.plugin.dispose?.()
+      }
+    },
+  )
+
+  // Covered by index.test.ts 'a cold main with no fallback keeps the typed refusal'.
+})
+
+describe('401 provenance', () => {
+  test.serial(
+    'reports the served v7 record exactly once while it remains resident',
+    async () => {
+      const fallbackHandle = `ckh_${'P'.repeat(43)}`
+      const fixture = await bootRuled({
+        route: 'fallback-first',
+        initialNow: 1_000,
+        fallbacks: [
+          {
+            label: 'work-alt',
+            handle: fallbackHandle,
+            access: 'vault-fallback-v7',
+          },
+        ],
+        connector: (calls) =>
+          connectorFor(calls, (method, params) => {
+            if (method !== 'credential.get') return { result: {} }
+            return credentialResponse(
+              params.handle === ruledMainHandle
+                ? 'vault-main'
+                : 'vault-fallback-v7',
+              params.handle === ruledMainHandle ? 3 : 7,
+              20_000_000,
+            )
+          }),
+        onFetch: (input, init) =>
+          new Headers(init?.headers).get('authorization') ===
+          'Bearer vault-fallback-v7'
+            ? new Response('{}', { status: 401 })
+            : new Response('{}', { status: 200 }),
+      })
+      try {
+        expect(
+          (
+            await fixture.result.fetch(MESSAGES_URL, {
+              method: 'POST',
+              body: JSON.stringify({ model: 'claude-opus-5', messages: [] }),
+            })
+          ).status,
+        ).toBe(200)
+        expect(
+          fixture.calls.filter(
+            (call) => call.method === 'credential.report_auth_failure',
+          ),
+        ).toEqual([
+          {
+            method: 'credential.report_auth_failure',
+            params: {
+              handle: fallbackHandle,
+              provider_status: 401,
+              record_version: 7,
+              reporter_source: 'direct',
+            },
+          },
+        ])
+      } finally {
+        await fixture.plugin.dispose?.()
+      }
+    },
+  )
+
+  test.serial(
+    'suppresses a raced v7 report after the resident cache advances to v8',
+    async () => {
+      const fallbackHandle = `ckh_${'Q'.repeat(43)}`
+      let recordVersion = 7
+      let cache: any
+      const fixture = await bootRuled({
+        route: 'fallback-first',
+        initialNow: 1_000,
+        fallbacks: [
+          {
+            label: 'work-alt',
+            handle: fallbackHandle,
+            access: 'vault-fallback-v7',
+          },
+        ],
+        connector: (calls) =>
+          connectorFor(calls, (method, params) => {
+            if (method !== 'credential.get') return { result: {} }
+            return credentialResponse(
+              params.handle === ruledMainHandle
+                ? 'vault-main'
+                : `vault-fallback-v${recordVersion}`,
+              params.handle === ruledMainHandle ? 3 : recordVersion,
+              20_000_000,
+            )
+          }),
+        onFetch: async (_input, init) => {
+          if (
+            new Headers(init?.headers).get('authorization') ===
+            'Bearer vault-fallback-v7'
+          ) {
+            // Suppress raced reports: the vault ignores them, but they still spend limiter capacity and create an audit anomaly.
+            recordVersion = 8
+            cache.invalidate(fallbackHandle, 7)
+            await cache.get(fallbackHandle)
+            return new Response('{}', { status: 401 })
+          }
+          return new Response('{}', { status: 200 })
+        },
+      })
+      cache = fixture.plugin.__claustrumCredentialCache
+      try {
+        expect(
+          (
+            await fixture.result.fetch(MESSAGES_URL, {
+              method: 'POST',
+              body: JSON.stringify({ model: 'claude-opus-5', messages: [] }),
+            })
+          ).status,
+        ).toBe(200)
+        const reports = fixture.calls.filter(
+          (call) => call.method === 'credential.report_auth_failure',
+        )
+        expect(reports).toEqual([])
+        expect(JSON.stringify(reports)).not.toContain('record_version":8')
+      } finally {
+        await fixture.plugin.dispose?.()
+      }
+    },
+  )
+
+  test.serial(
+    'does not report a local sidecar-served fallback 401',
+    async () => {
+      await createFirstRunRoot()
+      const calls: Array<{ method: string; params: Record<string, unknown> }> =
+        []
+      await saveAccounts(
+        {
+          version: 1,
+          main: { type: 'opencode', provider: 'anthropic' },
+          claustrum: { mode: 'local' },
+          routing: { mode: 'fallback-first' },
+          accounts: [
+            {
+              id: 'work-alt',
+              label: 'work-alt',
+              type: 'oauth',
+              access: 'sidecar-access',
+              refresh: 'sidecar-refresh',
+              expires: Date.now() + 60_000,
+            },
+          ],
+        } as never,
+        process.env.OPENCODE_ANTHROPIC_AUTH_FILE!,
+      )
+      globalThis.fetch = mock(() =>
+        Promise.resolve(new Response('{}', { status: 401 })),
+      ) as unknown as typeof fetch
+      const plugin = await (
+        AnthropicAuthPlugin as unknown as (
+          ctx: { client: unknown },
+          runtime: Record<string, unknown>,
+        ) => Promise<any>
+      )(
+        { client: createClient() },
+        { claustrumConnector: connectorFor(calls, () => ({ result: {} })) },
+      )
+      try {
+        const result = await plugin.auth.loader(
+          () =>
+            Promise.resolve({
+              type: 'oauth',
+              access: 'main-access',
+              refresh: 'main-refresh',
+              expires: Date.now() + 60_000,
+            } as never),
+          { models: {} },
+        )
+        expect(
+          (
+            await result.fetch(MESSAGES_URL, {
+              method: 'POST',
+              body: JSON.stringify({ model: 'claude-opus-5', messages: [] }),
+            })
+          ).status,
+        ).toBe(401)
+        expect(
+          calls.filter(
+            (call) => call.method === 'credential.report_auth_failure',
+          ),
+        ).toEqual([])
+      } finally {
+        await plugin.dispose?.()
+      }
+    },
+  )
+})
+
+describe('exit and terminating re-login', () => {
+  test.serial(
+    'leaves custody before refusing a tombstoned main without refreshing',
+    async () => {
+      const root = await createFirstRunRoot()
+      const missingParentPath = join(root, 'missing', 'anthropic-auth.json')
+      await runClaustrumTakeoverCommand(
+        { storagePath: missingParentPath, now: () => 1_000 } as never,
+        'local',
+      )
+      expect(
+        JSON.parse(await readFile(missingParentPath, 'utf8')).claustrum?.mode,
+      ).toBe('local')
+      let tokenRequests = 0
+      let localPlugin: any
+      const fixture = await bootRuled({
+        route: 'fallback-first',
+        fallbacks: [
+          {
+            label: 'work-alt',
+            handle: `ckh_${'L'.repeat(43)}`,
+            access: 'vault-fallback',
+          },
+        ],
+        onFetch: (input) => {
+          if (extractUrl(input as string | URL | Request) === TOKEN_URL)
+            tokenRequests += 1
+          return new Response('{}', { status: 200 })
+        },
+      })
+      try {
+        await fixture.plugin['command.execute.before']({
+          command: 'claude-account',
+          arguments: 'local',
+          sessionID: 'custody-exit',
+        }).catch(() => {})
+        expect(
+          (await loadAccounts(process.env.OPENCODE_ANTHROPIC_AUTH_FILE!))
+            ?.claustrum?.mode,
+        ).toBe('local')
+
+        await fixture.plugin.dispose?.()
+        localPlugin = await (
+          AnthropicAuthPlugin as unknown as (
+            ctx: { client: unknown },
+            runtime: Record<string, unknown>,
+          ) => Promise<any>
+        )(
+          { client: createClient() },
+          { claustrumConnector: connectorFor([], () => ({ result: {} })) },
+        )
+        let rejection: unknown
+        try {
+          const result = await localPlugin.auth.loader(
+            () => Promise.resolve(custodyTombstoneOAuth('anthropic') as never),
+            { models: {} },
+          )
+          const response = await result.fetch(MESSAGES_URL, {
+            method: 'POST',
+            body: JSON.stringify({ model: 'claude-opus-5', messages: [] }),
+          })
+          rejection = await response.text()
+        } catch (error) {
+          rejection = error
+        }
+        expect(String(rejection)).toContain('REMAIN_DARK_PENDING_LOGIN')
+        expect(tokenRequests).toBe(0)
+        expect(fixture.authorizations.join('\n')).not.toContain(
+          'claustrum-tombstone',
+        )
+      } finally {
+        await localPlugin?.dispose?.()
+        await fixture.plugin.dispose?.()
+      }
+    },
+  )
+
+  test.serial(
+    'test(custody): a fresh local login re-admits a bound label after the exit',
+    async () => {
+      const label = 'work-alt'
+      const handle = `ckh_${'N'.repeat(43)}`
+      const access = 'new-local-access'
+      const refresh = 'new-local-refresh'
+      let localPlugin: any
+      let tokenRequests = 0
+      const tokenRequestBodies: string[] = []
+      const authorize = mock(() =>
+        Promise.resolve({
+          url: 'https://example.test/oauth?state=state',
+          redirectUri: 'https://example.test/callback',
+          state: 'state',
+          verifier: 'verifier',
+        }),
+      )
+      const fixture = await bootRuled({
+        route: 'fallback-first',
+        fallbacks: [
+          { label, handle, access: 'vault-fallback', account: { id: label } },
+        ],
+        onFetch: (input, init) => {
+          if (extractUrl(input as string | URL | Request) === TOKEN_URL) {
+            tokenRequests += 1
+            tokenRequestBodies.push(String(init?.body))
+            return Response.json({
+              access_token: access,
+              refresh_token: refresh,
+              expires_in: 5 * 60 * 60,
+            })
+          }
+          return new Response('{}', { status: 200 })
+        },
+      })
+      try {
+        const execute = async (arguments_: string) => {
+          let handled = false
+          await fixture.plugin['command.execute.before']({
+            command: 'claude-account',
+            arguments: arguments_,
+            sessionID: 'custody-terminating-relogin',
+          }).catch((error: unknown) => {
+            handled = String(error).includes(
+              '__OPENCODE_ANTHROPIC_AUTH_COMMAND_HANDLED__',
+            )
+            if (!handled) throw error
+          })
+          expect(handled).toBe(true)
+        }
+        await execute('local')
+        tokenRequests = 0
+        await login(label, {
+          authorize,
+          prompt: async () => 'code#state',
+        })
+        const storage = await loadAccounts(
+          process.env.OPENCODE_ANTHROPIC_AUTH_FILE!,
+        )
+        const fallback = storage?.accounts.find(
+          (account) => account.label === label,
+        )
+        const state = JSON.parse(
+          await readFile(
+            getAccountStatePath(process.env.OPENCODE_ANTHROPIC_AUTH_FILE!),
+            'utf8',
+          ),
+        )
+        const manifest = JSON.parse(
+          await readFile(fixture.manifestPath, 'utf8'),
+        )
+        expect(fallback).toEqual(
+          expect.objectContaining({
+            access,
+            refresh,
+            authLineageId: expect.any(String),
+          }),
+        )
+        expect(state.accounts[fallback!.id]).toEqual(
+          expect.objectContaining({
+            access,
+            refresh,
+            authLineageId: expect.any(String),
+          }),
+        )
+        expect(manifest.providers[0].accounts).not.toContainEqual(
+          expect.objectContaining({ label }),
+        )
+
+        await fixture.plugin.dispose?.()
+        localPlugin = await (
+          AnthropicAuthPlugin as unknown as (
+            ctx: { client: unknown },
+            runtime: Record<string, unknown>,
+          ) => Promise<any>
+        )({ client: createClient() }, {})
+        const localResult = await localPlugin.auth.loader(
+          () =>
+            Promise.resolve({
+              type: 'oauth',
+              access: 'main-local-access',
+              refresh: 'main-local-refresh',
+              expires: Date.now() + 60_000,
+            } as never),
+          { models: {} },
+        )
+        await localResult.fetch(MESSAGES_URL, {
+          method: 'POST',
+          body: JSON.stringify({ model: 'claude-opus-5', messages: [] }),
+        })
+        expect(fixture.authorizations).toEqual([`Bearer ${access}`])
+        expect(tokenRequests).toBe(1)
+        expect(JSON.parse(tokenRequestBodies[0] ?? '{}')).toMatchObject({
+          grant_type: 'authorization_code',
+          code: 'code',
+          state: 'state',
+        })
+      } finally {
+        await localPlugin?.dispose?.()
+        await fixture.plugin.dispose?.()
+      }
+    },
+  )
+
+  test.serial(
+    'test(custody): re-entering claustrum needs a fresh vault binding for a re-logged label',
+    async () => {
+      const label = 'work-alt'
+      const handle = `ckh_${'R'.repeat(43)}`
+      const access = 'new-local-access'
+      const refresh = 'new-local-refresh'
+      let fallbackRecordVersion = 7
+      const authorize = mock(() =>
+        Promise.resolve({
+          url: 'https://example.test/oauth?state=state',
+          redirectUri: 'https://example.test/callback',
+          state: 'state',
+          verifier: 'verifier',
+        }),
+      )
+      const fixture = await bootRuled({
+        route: 'fallback-first',
+        initialNow: 1_000,
+        fallbacks: [
+          { label, handle, access: 'vault-fallback', account: { id: label } },
+        ],
+        connector: (calls) =>
+          connectorFor(calls, (method, params) => {
+            if (method !== 'credential.get') return { result: {} }
+            const main = params.handle === ruledMainHandle
+            return credentialResponse(
+              main ? 'vault-main-access' : 'vault-fallback-access',
+              main ? 3 : fallbackRecordVersion,
+              20_000_000,
+            )
+          }),
+        onFetch: (input) => {
+          if (extractUrl(input as string | URL | Request) === TOKEN_URL) {
+            return Response.json({
+              access_token: access,
+              refresh_token: refresh,
+              expires_in: 5 * 60 * 60,
+            })
+          }
+          return new Response('{}', { status: 200 })
+        },
+      })
+      try {
+        const execute = async (arguments_: string) => {
+          let handled = false
+          await fixture.plugin['command.execute.before']({
+            command: 'claude-account',
+            arguments: arguments_,
+            sessionID: 'custody-reentry',
+          }).catch((error: unknown) => {
+            handled = String(error).includes(
+              '__OPENCODE_ANTHROPIC_AUTH_COMMAND_HANDLED__',
+            )
+            if (!handled) throw error
+          })
+          expect(handled).toBe(true)
+          return (
+            fixture.client.session.promptAsync.mock.calls.at(-1)?.[0]?.body
+              .parts[0]?.text ?? ''
+          )
+        }
+
+        await execute('local')
+        await login(label, {
+          authorize,
+          prompt: async () => 'code#state',
+        })
+        const refusal = await execute('claustrum')
+        const localStorage = await loadAccounts(
+          process.env.OPENCODE_ANTHROPIC_AUTH_FILE!,
+        )
+        expect(refusal).toContain('binding_missing')
+        expect(refusal).toContain(label)
+        expect(localStorage?.claustrum?.mode).toBe('local')
+
+        await writeManifest(dirname(fixture.manifestPath), [
+          { label: 'main', handle: ruledMainHandle },
+          { label, handle },
+        ])
+        fallbackRecordVersion = 8
+        const reentered = await execute('claustrum')
+        const storage = await loadAccounts(
+          process.env.OPENCODE_ANTHROPIC_AUTH_FILE!,
+        )
+        const state = JSON.parse(
+          await readFile(
+            getAccountStatePath(process.env.OPENCODE_ANTHROPIC_AUTH_FILE!),
+            'utf8',
+          ),
+        )
+        expect(reentered).toContain(
+          'Claustrum custody committed for: main, work-alt.',
+        )
+        expect(storage?.claustrum?.mode).toBe('claustrum')
+        const result = await fixture.plugin.auth.loader(
+          () => Promise.resolve(custodyTombstoneOAuth('anthropic') as never),
+          { models: {} },
+        )
+        await result.fetch(MESSAGES_URL, {
+          method: 'POST',
+          body: JSON.stringify({ model: 'claude-opus-5', messages: [] }),
+        })
+        expect(fixture.authorizations).toContain('Bearer vault-fallback-access')
+        expect(state.accounts[label]).toEqual(
+          expect.objectContaining({
+            access: '',
+            refresh: expect.stringContaining('claustrum-tombstone'),
+          }),
+        )
+      } finally {
+        await fixture.plugin.dispose?.()
+      }
+    },
+  )
+})
diff --git a/packages/opencode/src/tests/custody-mode.test.ts b/packages/opencode/src/tests/custody-mode.test.ts
new file mode 100644
index 00000000..7b67f800
--- /dev/null
+++ b/packages/opencode/src/tests/custody-mode.test.ts
@@ -0,0 +1,1307 @@
+import { describe, expect, test } from 'bun:test'
+import { mkdtemp, readFile, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import * as core from '@cortexkit/anthropic-auth-core'
+import {
+  createLiveCustodyDeps,
+  runClaustrumTakeoverCommand,
+} from '../custody-live.ts'
+import {
+  acquireCustodyTransitionLocks,
+  CustodyLockBusyError,
+  CustodyPreflightRefusedError,
+  CustodyStateMismatchError,
+  executeClaustrumTakeover,
+  executeLocalExit,
+  OPENCODE_MAIN_OAUTH_REFRESH_LOCK,
+  preflightClaustrumTakeover,
+  reconcileCustodyStartup,
+} from '../custody-mode.ts'
+
+const now = 1_700_000_000_000
+const fixtureTokens = [
+  'access-main-secret',
+  'refresh-main-secret',
+  'vault-secret',
+]
+const fixtureHandles = ['handle-main', 'handle-work']
+
+function real(access: string, refresh: string) {
+  return { type: 'oauth' as const, access, refresh }
+}
+
+function route(
+  id: string,
+  options: { enabled?: boolean; type?: 'oauth' | 'api' } = {},
+) {
+  return {
+    id,
+    type: options.type ?? 'oauth',
+    enabled: options.enabled ?? true,
+    label: id,
+    local: real(`access-${id}-secret`, `refresh-${id}-secret`),
+  }
+}
+
+function preflightInput(overrides: Record<string, unknown> = {}) {
+  const calls = { auth: 0, cache: 0, locks: 0, transport: 0 }
+  const input = {
+    now,
+    storage: { refresh: { refreshBeforeExpiryMinutes: 5 } },
+    main: { id: 'main', label: 'main', enabled: true },
+    fallbacks: [
+      route('work'),
+      route('disabled', { enabled: false }),
+      route('api', { type: 'api' }),
+    ],
+    hostAuth: {
+      get: () => {
+        calls.auth++
+        return core.custodyTombstoneOAuth('anthropic')
+      },
+    },
+    bindings: [
+      {
+        accountId: 'main',
+        label: 'main',
+        handle: 'handle-main',
+        credentialId: 'oauth:anthropic:main',
+      },
+      {
+        accountId: 'work',
+        label: 'work',
+        handle: 'handle-work',
+        credentialId: 'oauth:anthropic:work',
+      },
+    ],
+    cache: {
+      get: async (handle: string, { minTtlMs }: { minTtlMs: number }) => {
+        calls.cache++
+        calls.transport++
+        return {
+          handle,
+          credentialId:
+            handle === 'handle-main'
+              ? 'oauth:anthropic:main'
+              : 'oauth:anthropic:work',
+          recordVersion: 4,
+          access: `vault-secret-${handle}`,
+          refresh: `vault-refresh-${handle}`,
+          expiresAt: now + minTtlMs + 1,
+          state: 'usable' as const,
+        }
+      },
+    },
+    acquireLock: async () => {
+      calls.locks++
+      return { release: async () => {} }
+    },
+    calls,
+    ...overrides,
+  }
+  return input
+}
+
+describe('custody mode', () => {
+  test('custody: live adapter maps host auth, loaded manifest, and cache', async () => {
+    const get = async () => core.custodyTombstoneOAuth('anthropic')
+    const manifestHandle = `ckh_${'A'.repeat(43)}`
+    const storage: core.AccountStorage = {
+      version: 1,
+      accounts: [],
+      claustrum: { handlesFile: '/resolved-handles.json' },
+      refresh: { refreshBeforeExpiryMinutes: 5 },
+    }
+    const directory = await mkdtemp(join(tmpdir(), 'custody-live-adapter-'))
+    const storagePath = join(directory, 'storage.json')
+    const manifestPath = join(directory, 'handles.json')
+    const cacheCalls: Array<{ handle: string; minTtlMs?: number }> = []
+    try {
+      await expect(
+        core.writeCustodyHandleManifestEntry({
+          path: manifestPath,
+          entry: {
+            label: 'main',
+            handle: manifestHandle,
+            credentialId: 'oauth:anthropic:main',
+          },
+        }),
+      ).resolves.toEqual({ status: 'written' })
+      await core.saveAccounts(
+        {
+          ...storage,
+          claustrum: { handlesFile: manifestPath },
+        },
+        storagePath,
+      )
+      const deps = createLiveCustodyDeps({
+        storagePath,
+        cache: {
+          get: async (handle, minTtlMs) => {
+            cacheCalls.push({ handle, minTtlMs })
+            return {
+              credentialId: 'oauth:anthropic:main',
+              recordVersion: 1,
+              access: 'vault-access',
+              refresh: 'vault-refresh',
+              expiresAt: now + (minTtlMs ?? 0) + 1,
+              state: 'usable',
+            }
+          },
+        },
+        latestGetAuth: get,
+        now,
+      })
+
+      expect(deps.hostAuth.get).toBe(get)
+      expect(deps.hostAuth).not.toHaveProperty('set')
+      await deps.readBindings([{ id: 'main', label: 'main', type: 'oauth' }])
+      expect(deps.manifestPath).toBe(manifestPath)
+      await preflightClaustrumTakeover(
+        await deps.preflightInput(
+          { id: 'main', label: 'main', enabled: true },
+          [],
+        ),
+      )
+      expect(cacheCalls).toEqual([
+        {
+          handle: manifestHandle,
+          minTtlMs: core.getRefreshBeforeExpiryMs(storage) + 30 * 60_000,
+        },
+      ])
+    } finally {
+      await rm(directory, { recursive: true, force: true })
+    }
+  })
+
+  test('custody: live adapter keeps non-expiring vault credentials usable', async () => {
+    const get = async () => core.custodyTombstoneOAuth('anthropic')
+    const manifestHandle = `ckh_${'A'.repeat(43)}`
+    const storage: core.AccountStorage = {
+      version: 1,
+      accounts: [],
+      claustrum: { handlesFile: '/resolved-handles.json' },
+      refresh: { refreshBeforeExpiryMinutes: 5 },
+    }
+    const directory = await mkdtemp(join(tmpdir(), 'custody-live-adapter-'))
+    const storagePath = join(directory, 'storage.json')
+    const manifestPath = join(directory, 'handles.json')
+    const debugMessages: string[] = []
+    try {
+      await expect(
+        core.writeCustodyHandleManifestEntry({
+          path: manifestPath,
+          entry: {
+            label: 'main',
+            handle: manifestHandle,
+            credentialId: 'oauth:anthropic:main',
+          },
+        }),
+      ).resolves.toEqual({ status: 'written' })
+      await core.saveAccounts(
+        {
+          ...storage,
+          claustrum: { handlesFile: manifestPath },
+        },
+        storagePath,
+      )
+      const deps = createLiveCustodyDeps({
+        storagePath,
+        cache: {
+          get: async (_handle, minTtlMs) => ({
+            payload: JSON.stringify({
+              access_token: 'vault-access',
+              refresh_token: 'vault-refresh',
+            }),
+            expiresAtMs: null,
+            recordVersion: 1,
+            accountId: 'vault-account',
+          }),
+        },
+        latestGetAuth: get,
+        now,
+        debug: (message: string) => debugMessages.push(message),
+      })
+
+      const input = await deps.preflightInput(
+        { id: 'main', label: 'main', enabled: true },
+        [],
+      )
+      input.bindings[0]!.credentialId = 'oauth:anthropic:x'
+      const plan = await preflightClaustrumTakeover(input)
+      expect(plan).toMatchObject({ accounts: [{ id: 'main' }] })
+      expect(debugMessages).toEqual([
+        'custody identity check skipped: vault supplied no credential id',
+      ])
+    } finally {
+      await rm(directory, { recursive: true, force: true })
+    }
+  })
+
+  test('custody: preflight verifies every account before any write', async () => {
+    const cases = [
+      {
+        name: 'missing binding',
+        mutate: (input: any) => (input.bindings = input.bindings.slice(0, 1)),
+        reason: 'binding_missing',
+      },
+      {
+        name: 'revoked credential',
+        mutate: (input: any) =>
+          (input.cache.get = async (
+            handle: string,
+            { minTtlMs }: { minTtlMs: number },
+          ) =>
+            handle === 'handle-work'
+              ? { state: 'revoked' }
+              : {
+                  credentialId: 'oauth:anthropic:main',
+                  recordVersion: 4,
+                  access: 'vault-secret-main',
+                  refresh: 'vault-refresh-main',
+                  expiresAt: now + minTtlMs + 1,
+                  state: 'usable',
+                }),
+        reason: 'credential_revoked',
+      },
+      {
+        name: 'reauth credential',
+        mutate: (input: any) =>
+          (input.cache.get = async (
+            handle: string,
+            { minTtlMs }: { minTtlMs: number },
+          ) =>
+            handle === 'handle-work'
+              ? { state: 'reauth' }
+              : {
+                  credentialId: 'oauth:anthropic:main',
+                  recordVersion: 4,
+                  access: 'vault-secret-main',
+                  refresh: 'vault-refresh-main',
+                  expiresAt: now + minTtlMs + 1,
+                  state: 'usable',
+                }),
+        reason: 'credential_reauth',
+      },
+      {
+        name: 'unusable credential',
+        mutate: (input: any) =>
+          (input.cache.get = async (
+            handle: string,
+            { minTtlMs }: { minTtlMs: number },
+          ) =>
+            handle === 'handle-work'
+              ? { state: 'usable', expiresAt: now }
+              : {
+                  credentialId: 'oauth:anthropic:main',
+                  recordVersion: 4,
+                  access: 'vault-secret-main',
+                  refresh: 'vault-refresh-main',
+                  expiresAt: now + minTtlMs + 1,
+                  state: 'usable',
+                }),
+        reason: 'credential_unusable',
+      },
+      {
+        name: 'divergence fence',
+        mutate: (input: any) =>
+          (input.storage.claustrumDivergence = {
+            'oauth:anthropic:work': { minimumRecordVersion: 5 },
+          }),
+        reason: 'divergence_fenced',
+      },
+      {
+        name: 'credential identity mismatch',
+        mutate: (input: any) =>
+          (input.cache.get = async (
+            handle: string,
+            { minTtlMs }: { minTtlMs: number },
+          ) => ({
+            credentialId:
+              handle === 'handle-work'
+                ? 'oauth:anthropic:other'
+                : 'oauth:anthropic:main',
+            recordVersion: 4,
+            access: `vault-secret-${handle}`,
+            refresh: `vault-refresh-${handle}`,
+            expiresAt: now + minTtlMs + 1,
+            state: 'usable',
+          })),
+        reason: 'credential_identity_mismatch',
+      },
+    ]
+
+    for (const entry of cases) {
+      const input = preflightInput()
+      entry.mutate(input)
+      const error = await preflightClaustrumTakeover(input).catch(
+        (error: unknown) => error,
+      )
+      expect(error).toMatchObject({
+        code: 'custody_preflight_refused',
+        accountId: 'work',
+        reason: entry.reason,
+      })
+      for (const token of [...fixtureTokens, ...fixtureHandles]) {
+        expect(String(error), entry.name).not.toContain(token)
+        expect(JSON.stringify(error), entry.name).not.toContain(token)
+      }
+      expect(input.calls.auth, entry.name).toBe(1)
+      expect(input.calls.locks, entry.name).toBe(0)
+    }
+
+    const input = preflightInput()
+    const plan = await preflightClaustrumTakeover(input)
+    expect(plan.accounts.map((account) => account.id)).toEqual(['main', 'work'])
+    expect(plan.accounts.map((account) => account.handle)).toEqual(
+      fixtureHandles,
+    )
+    expect(input.calls.auth).toBe(1)
+    expect(input.calls.cache).toBe(2)
+    expect(input.calls.transport).toBe(2)
+    expect(input.calls.locks).toBe(0)
+    const printable = JSON.stringify(plan)
+    for (const token of [...fixtureTokens, ...fixtureHandles])
+      expect(printable).not.toContain(token)
+  })
+
+  test('custody: fresh install refuses before creating a store', async () => {
+    const tombstone = core.custodyTombstoneOAuth('anthropic')
+    const fresh = preflightInput({
+      storage: null,
+      hostAuth: { get: () => tombstone },
+    })
+    await expect(preflightClaustrumTakeover(fresh)).resolves.toMatchObject({
+      accounts: [{ id: 'main' }, { id: 'work' }],
+    })
+    expect(fresh.calls.transport).toBe(2)
+    expect(fresh.calls.locks).toBe(0)
+
+    const emptyStore = preflightInput({ storage: { version: 1 } })
+    await expect(preflightClaustrumTakeover(emptyStore)).resolves.toMatchObject(
+      {
+        accounts: [{ id: 'main' }, { id: 'work' }],
+      },
+    )
+    expect(emptyStore.calls.locks).toBe(0)
+  })
+
+  test('custody: preflight refuses a real main until the operator migrates it', async () => {
+    const input = preflightInput({
+      storage: null,
+      hostAuth: {
+        get: () => real('access-main-secret', 'refresh-main-secret'),
+      },
+    })
+
+    await expect(preflightClaustrumTakeover(input)).rejects.toMatchObject({
+      code: 'custody_preflight_refused',
+      accountId: 'main',
+      reason: 'TAKEOVER_INCOMPLETE_MAIN_REAL',
+    })
+  })
+
+  test('custody: preflight refuses a tombstoned main without its manifest binding', async () => {
+    const input = preflightInput({
+      hostAuth: { get: () => core.custodyTombstoneOAuth('anthropic') },
+      bindings: [
+        {
+          accountId: 'work',
+          label: 'work',
+          handle: 'handle-work',
+          credentialId: 'oauth:anthropic:work',
+        },
+      ],
+    })
+
+    await expect(preflightClaustrumTakeover(input)).rejects.toMatchObject({
+      code: 'custody_preflight_refused',
+      accountId: 'main',
+      reason: 'TAKEOVER_INCOMPLETE_MAIN_BINDING',
+    })
+  })
+
+  test('custody: preflight reports every fallback refusal in account order', async () => {
+    const input = preflightInput({
+      fallbacks: [route('work'), route('personal')],
+      bindings: [
+        {
+          accountId: 'main',
+          label: 'main',
+          handle: 'handle-main',
+          credentialId: 'oauth:anthropic:main',
+        },
+        {
+          accountId: 'work',
+          label: 'work',
+          handle: 'handle-work',
+          credentialId: 'oauth:anthropic:work',
+        },
+        {
+          accountId: 'personal',
+          label: 'personal',
+          handle: 'handle-personal',
+          credentialId: 'oauth:anthropic:personal',
+        },
+      ],
+      cache: {
+        get: async (handle: string) =>
+          handle === 'handle-work'
+            ? { state: 'reauth' }
+            : handle === 'handle-personal'
+              ? { state: 'timeout' }
+              : {
+                  credentialId: 'oauth:anthropic:main',
+                  recordVersion: 4,
+                  access: 'vault-access',
+                  refresh: 'vault-refresh',
+                  expiresAt: Number.MAX_SAFE_INTEGER,
+                  state: 'usable' as const,
+                },
+      },
+    })
+
+    const error = await preflightClaustrumTakeover(input).catch(
+      (error: unknown) => error,
+    )
+    expect(error).toBeInstanceOf(CustodyPreflightRefusedError)
+    expect((error as CustodyPreflightRefusedError).toJSON()).toMatchObject({
+      ok: false,
+      accountId: 'work',
+      reason: 'credential_reauth',
+      refusals: [
+        { label: 'work', reason: 'credential_reauth' },
+        { label: 'personal', reason: 'credential_timeout' },
+      ],
+    })
+    const printable = JSON.stringify(error)
+    for (const token of [
+      ...fixtureTokens,
+      ...fixtureHandles,
+      'handle-personal',
+    ])
+      expect(printable).not.toContain(token)
+  })
+
+  test('custody: startup matrix verdicts', () => {
+    const expected = new Map<string, string>([
+      ['L|R|R|V', 'LOCAL_SERVE'],
+      ['L|R|R|N', 'LOCAL_SERVE'],
+      ['L|R|T|V', 'REMAIN_DARK_PENDING_LOGIN'],
+      ['L|R|T|N', 'REMAIN_DARK_PENDING_LOGIN'],
+      ['L|R|M|V', 'REMAIN_DARK_PENDING_LOGIN'],
+      ['L|R|M|N', 'REMAIN_DARK_PENDING_LOGIN'],
+      ['L|T|R|V', 'REMAIN_DARK_PENDING_LOGIN'],
+      ['L|T|R|N', 'REMAIN_DARK_PENDING_LOGIN'],
+      ['L|T|T|V', 'REMAIN_DARK_PENDING_LOGIN'],
+      ['L|T|T|N', 'REMAIN_DARK_PENDING_LOGIN'],
+      ['L|T|M|V', 'REMAIN_DARK_PENDING_LOGIN'],
+      ['L|T|M|N', 'REMAIN_DARK_PENDING_LOGIN'],
+      ['L|X|R|V', 'FAIL_CLOSED'],
+      ['L|X|R|N', 'FAIL_CLOSED'],
+      ['L|X|T|V', 'FAIL_CLOSED'],
+      ['L|X|T|N', 'FAIL_CLOSED'],
+      ['L|X|M|V', 'FAIL_CLOSED'],
+      ['L|X|M|N', 'FAIL_CLOSED'],
+      ['C|R|R|V', 'TAKEOVER_INCOMPLETE_MAIN_REAL'],
+      ['C|R|R|N', 'TAKEOVER_INCOMPLETE_VAULT_UNAVAILABLE'],
+      ['C|R|T|V', 'TAKEOVER_INCOMPLETE_MAIN_REAL'],
+      ['C|R|T|N', 'FAIL_CLOSED'],
+      ['C|R|M|V', 'TAKEOVER_INCOMPLETE_MAIN_REAL'],
+      ['C|R|M|N', 'FAIL_CLOSED'],
+      ['C|T|R|V', 'RESUME_TAKEOVER'],
+      ['C|T|R|N', 'FAIL_CLOSED'],
+      ['C|T|T|V', 'CLAUSTRUM_SERVE'],
+      ['C|T|T|N', 'FAIL_CLOSED'],
+      ['C|T|M|V', 'RESUME_TAKEOVER'],
+      ['C|T|M|N', 'FAIL_CLOSED'],
+      ['C|X|R|V', 'TAKEOVER_INCOMPLETE_SLOT_ABSENT'],
+      ['C|X|R|N', 'FAIL_CLOSED'],
+      ['C|X|T|V', 'TAKEOVER_INCOMPLETE_SLOT_ABSENT'],
+      ['C|X|T|N', 'FAIL_CLOSED'],
+      ['C|X|M|V', 'TAKEOVER_INCOMPLETE_SLOT_ABSENT'],
+      ['C|X|M|N', 'FAIL_CLOSED'],
+    ])
+    expect(expected).toHaveLength(36)
+    for (const [key, verdict] of expected) {
+      const [mode, main, fallbacks, evidence] = key.split('|') as [
+        'L' | 'C',
+        'R' | 'T' | 'X',
+        'R' | 'T' | 'M',
+        'V' | 'N',
+      ]
+      if (verdict === 'LOCAL_SERVE' || verdict === 'CLAUSTRUM_SERVE') {
+        expect(
+          reconcileCustodyStartup({ mode, main, fallbacks, evidence }),
+        ).toMatchObject({ verdict })
+      } else {
+        expect(() =>
+          reconcileCustodyStartup({ mode, main, fallbacks, evidence }),
+        ).toThrow(CustodyStateMismatchError)
+        try {
+          reconcileCustodyStartup({ mode, main, fallbacks, evidence })
+        } catch (error) {
+          expect(error).toMatchObject({
+            code: 'custody_state_mismatch',
+            verdict,
+            dimensions: { mode, main, fallbacks, evidence },
+          })
+          expect(JSON.stringify(error)).not.toContain('access-main-secret')
+        }
+      }
+    }
+  })
+
+  test('custody: provisional reconcile identifies fallback-driven darkness', () => {
+    expect(
+      reconcileCustodyStartup({
+        mode: 'C',
+        mainSlot: 'unknown',
+        fallbacks: 'T',
+        evidence: 'N',
+      }),
+    ).toEqual({ verdict: 'FAIL_CLOSED', provisional: true })
+    expect(
+      reconcileCustodyStartup({
+        mode: 'C',
+        mainSlot: 'unknown',
+        fallbacks: 'T',
+        evidence: 'unknown',
+      }),
+    ).toEqual({ verdict: 'PENDING_MAIN_SLOT', provisional: true })
+  })
+
+  test('custody: locks acquire in total order and unwind on contention', async () => {
+    const order: string[] = []
+    const released: string[] = []
+    await expect(
+      acquireCustodyTransitionLocks({
+        storagePath: '/storage.json',
+        manifestPath: '/handles.json',
+        fallbackAccountIds: ['zulu', 'alpha'],
+        acquireTransition: async () => ({
+          release: async () => {
+            released.push('transition')
+          },
+        }),
+        acquireManifest: async () => ({
+          release: async () => {
+            released.push('manifest')
+          },
+        }),
+        acquireRefresh: async ({ name }: { name: string }) => {
+          order.push(name)
+          if (name === 'alpha-refresh') return null
+          return {
+            release: async () => {
+              released.push(name)
+            },
+          }
+        },
+      }),
+    ).rejects.toBeInstanceOf(CustodyLockBusyError)
+    expect(order).toEqual(['opencode-main-oauth-refresh', 'alpha-refresh'])
+    expect(released).toEqual([
+      'opencode-main-oauth-refresh',
+      'manifest',
+      'transition',
+    ])
+  })
+
+  test('custody: local exit waits for an in-progress takeover main lock', async () => {
+    const directory = await mkdtemp(join(tmpdir(), 'custody-local-exit-lock-'))
+    const path = join(directory, 'anthropic-auth.json')
+    try {
+      await core.saveAccounts(
+        { version: 1, claustrum: { mode: 'claustrum' }, accounts: [] },
+        path,
+      )
+      const lock = await core.acquireRefreshFileLock({
+        name: OPENCODE_MAIN_OAUTH_REFRESH_LOCK,
+        path,
+        ttlMs: 60_000,
+        renew: true,
+      })
+      expect(lock).not.toBeNull()
+      let settled = false
+      const localExit = runClaustrumTakeoverCommand(
+        {
+          storagePath: path,
+          loadStorage: () => core.loadAccounts(path),
+          getCache: async () => null,
+          now: Date.now,
+          refreshManifest: async () => {},
+        },
+        'local',
+      ).then((result) => {
+        settled = true
+        return result
+      })
+      await new Promise((resolve) => setTimeout(resolve, 20))
+      expect(settled).toBe(false)
+      expect((await core.loadAccounts(path))?.claustrum?.mode).toBe('claustrum')
+
+      await lock!.release()
+      await expect(localExit).resolves.toMatchObject({
+        text: expect.stringContaining('set to local'),
+      })
+      expect((await core.loadAccounts(path))?.claustrum?.mode).toBe('local')
+    } finally {
+      await rm(directory, { recursive: true, force: true })
+    }
+  })
+
+  test('custody: takeover restores raw sidecars when a staged write fails', async () => {
+    const plan = await preflightClaustrumTakeover(preflightInput())
+    const before = {
+      config: new TextEncoder().encode('{"accounts":["before"]}\n'),
+      state: new TextEncoder().encode('{"state":"before"}\n'),
+    }
+    let config = before.config.slice()
+    let state = before.state.slice()
+    let mode = 'local'
+    const writes: string[] = []
+
+    const error = await executeClaustrumTakeover(plan, {
+      locks: {
+        storagePath: '/storage.json',
+        manifestPath: '/handles.json',
+        fallbackAccountIds: ['work'],
+        acquireTransition: async () => ({ release: async () => {} }),
+        acquireManifest: async () => ({ release: async () => {} }),
+        acquireRefresh: async () => ({ release: async () => {} }),
+      },
+      getLocalAuth: async (accountId) =>
+        accountId === 'main'
+          ? core.custodyTombstoneOAuth('anthropic')
+          : real('access-work-secret', 'refresh-work-secret'),
+      isCommitted: async () => false,
+      snapshotSidecars: async () => ({
+        config: config.slice(),
+        state: state.slice(),
+      }),
+      writeManifestBindings: async () => {},
+      writeSidecarAccount: async (account) => {
+        writes.push(account.id)
+        config = new TextEncoder().encode(`{"bound":"${account.id}"}\n`)
+        if (account.id === 'work') throw new Error('disk full')
+        state = new TextEncoder().encode(`{"inert":"${account.id}"}\n`)
+      },
+      verifyTarget: async () => true,
+      verifyCommitted: async () => true,
+      restoreSidecars: async (snapshot) => {
+        config = snapshot.config!.slice()
+        state = snapshot.state!.slice()
+      },
+      verifyRollback: async () =>
+        JSON.stringify(config) === JSON.stringify(before.config) &&
+        JSON.stringify(state) === JSON.stringify(before.state),
+      setMode: async (target) => {
+        mode = target
+        return 'changed'
+      },
+    }).catch((error: unknown) => error)
+
+    expect(error).toMatchObject({
+      code: 'custody_transition_failed',
+      stage: 'write_sidecar',
+      accountId: 'work',
+    })
+    expect(writes).toEqual(['work'])
+    expect(config).toEqual(before.config)
+    expect(state).toEqual(before.state)
+    expect(mode).toBe('local')
+    expect(JSON.stringify(error)).not.toContain('access-work-secret')
+  })
+
+  test('custody: throwing committed verifier reverts mode before restoring sidecars', async () => {
+    const plan = await preflightClaustrumTakeover(preflightInput())
+    const before = {
+      config: new TextEncoder().encode('{"access":"access-work-secret"}\n'),
+      state: new TextEncoder().encode('{"refresh":"refresh-work-secret"}\n'),
+    }
+    let config = before.config.slice()
+    let state = before.state.slice()
+    let mode: 'local' | 'claustrum' = 'local'
+
+    const error = await executeClaustrumTakeover(plan, {
+      locks: {
+        storagePath: '/storage.json',
+        manifestPath: '/handles.json',
+        fallbackAccountIds: ['work'],
+        acquireTransition: async () => ({ release: async () => {} }),
+        acquireManifest: async () => ({ release: async () => {} }),
+        acquireRefresh: async () => ({ release: async () => {} }),
+      },
+      getLocalAuth: async (accountId) =>
+        accountId === 'main'
+          ? core.custodyTombstoneOAuth('anthropic')
+          : real('access-work-secret', 'refresh-work-secret'),
+      isCommitted: async () => false,
+      snapshotSidecars: async () => ({
+        config: config.slice(),
+        state: state.slice(),
+      }),
+      writeManifestBindings: async () => {},
+      writeSidecarAccount: async () => {
+        config = new TextEncoder().encode('{"access":""}\n')
+        state = new TextEncoder().encode('{"refresh":"claustrum-tombstone"}\n')
+      },
+      verifyTarget: async () => true,
+      verifyCommitted: async () => {
+        throw new Error('cache read failed')
+      },
+      restoreSidecars: async (snapshot) => {
+        expect(mode).toBe('local')
+        config = snapshot.config!.slice()
+        state = snapshot.state!.slice()
+      },
+      verifyRollback: async () =>
+        JSON.stringify(config) === JSON.stringify(before.config) &&
+        JSON.stringify(state) === JSON.stringify(before.state),
+      setMode: async (target: 'local' | 'claustrum') => {
+        mode = target
+        return 'changed'
+      },
+    }).catch((caught: unknown) => caught)
+
+    expect(error).toMatchObject({
+      code: 'custody_transition_failed',
+      stage: 'write_sidecar',
+    })
+    expect(mode).toBe('local')
+    expect(config).toEqual(before.config)
+    expect(state).toEqual(before.state)
+  })
+
+  test('custody: failed committed readback leaves sidecars tombstoned when mode revert fails', async () => {
+    const plan = await preflightClaustrumTakeover(preflightInput())
+    let mode: string = 'local'
+    let restored = false
+
+    const error = await executeClaustrumTakeover(plan, {
+      locks: {
+        storagePath: '/storage.json',
+        manifestPath: '/handles.json',
+        fallbackAccountIds: ['work'],
+        acquireTransition: async () => ({ release: async () => {} }),
+        acquireManifest: async () => ({ release: async () => {} }),
+        acquireRefresh: async () => ({ release: async () => {} }),
+      },
+      getLocalAuth: async (accountId) =>
+        accountId === 'main'
+          ? core.custodyTombstoneOAuth('anthropic')
+          : real('access-work-secret', 'refresh-work-secret'),
+      isCommitted: async () => false,
+      snapshotSidecars: async () => ({ config: null, state: null }),
+      writeManifestBindings: async () => {},
+      writeSidecarAccount: async () => {},
+      verifyTarget: async () => true,
+      verifyCommitted: async () => false,
+      restoreSidecars: async () => {
+        restored = true
+      },
+      verifyRollback: async () => true,
+      setMode: async (target: 'local' | 'claustrum') => {
+        if (target === 'local') throw new Error('disk full')
+        mode = target
+        return 'changed'
+      },
+    }).catch((caught: unknown) => caught)
+
+    expect(error).toMatchObject({
+      code: 'custody_transition_failed',
+      stage: 'post_commit_readback',
+    })
+    expect(String(error)).toContain('mode is claustrum and unverified')
+    expect(mode).toBe('claustrum')
+    expect(restored).toBe(false)
+  })
+
+  test('custody: takeover refuses changed local material before any write', async () => {
+    const plan = await preflightClaustrumTakeover(preflightInput())
+    let snapshots = 0
+    let writes = 0
+    const error = await executeClaustrumTakeover(plan, {
+      locks: {
+        storagePath: '/storage.json',
+        manifestPath: '/handles.json',
+        fallbackAccountIds: ['work'],
+        acquireTransition: async () => ({ release: async () => {} }),
+        acquireManifest: async () => ({ release: async () => {} }),
+        acquireRefresh: async () => ({ release: async () => {} }),
+      },
+      getLocalAuth: async (accountId) =>
+        accountId === 'main'
+          ? core.custodyTombstoneOAuth('anthropic')
+          : real('changed-access', 'changed-refresh'),
+      isCommitted: async () => false,
+      snapshotSidecars: async () => {
+        snapshots++
+        return { config: null, state: null }
+      },
+      writeManifestBindings: async () => {
+        writes++
+      },
+      writeSidecarAccount: async () => {
+        writes++
+      },
+      verifyTarget: async () => true,
+      verifyCommitted: async () => true,
+      restoreSidecars: async () => {},
+      verifyRollback: async () => true,
+      setMode: async () => 'changed',
+    }).catch((caught: unknown) => caught)
+
+    expect(error).toMatchObject({
+      code: 'custody_transition_failed',
+      stage: 'reverify_fingerprint',
+      accountId: 'work',
+    })
+    expect(snapshots).toBe(0)
+    expect(writes).toBe(0)
+  })
+
+  test('custody: live takeover tombstones fallback refresh and commits mode last', async () => {
+    const directory = await mkdtemp(join(tmpdir(), 'custody-live-takeover-'))
+    const storagePath = join(directory, 'accounts.json')
+    const manifestPath = join(directory, 'handles.json')
+    const mainHandle = `ckh_${'M'.repeat(43)}`
+    const workHandle = `ckh_${'W'.repeat(43)}`
+    const hostReads: string[] = []
+    const cacheModes: string[] = []
+    const manifestWrites: string[] = []
+    let modeAtFinalVerification = 'local'
+    try {
+      await core.saveAccounts(
+        {
+          version: 1,
+          claustrum: { handlesFile: manifestPath, mode: 'local' },
+          accounts: [
+            {
+              id: 'work',
+              label: 'work',
+              type: 'oauth',
+              access: 'access-work-secret',
+              refresh: 'refresh-work-secret',
+              expires: now + 60_000,
+              claustrumHandle: workHandle,
+              enabled: true,
+            },
+          ],
+        },
+        storagePath,
+      )
+      await expect(
+        core.writeCustodyHandleManifestEntry({
+          path: manifestPath,
+          entry: {
+            label: 'main',
+            handle: mainHandle,
+            credentialId: core.custodyCredentialId('main'),
+          },
+        }),
+      ).resolves.toEqual({ status: 'written' })
+      const cache = {
+        get: async (handle: string, minTtlMs = 0) => {
+          cacheModes.push(
+            core.getClaustrumMode(await core.loadAccounts(storagePath)),
+          )
+          return {
+            credentialId:
+              handle === mainHandle
+                ? core.custodyCredentialId('main')
+                : core.custodyCredentialId('work'),
+            recordVersion: 7,
+            access: 'vault-access',
+            refresh: 'vault-refresh',
+            expiresAt: now + minTtlMs + 1,
+            state: 'usable' as const,
+          }
+        },
+      }
+      const fallbackManager = {
+        withAccountRefreshLock: async <T>(_id: string, fn: () => Promise<T>) =>
+          fn(),
+      }
+      const deps = createLiveCustodyDeps({
+        storagePath,
+        cache,
+        latestGetAuth: async () => {
+          hostReads.push('get')
+          return core.custodyTombstoneOAuth('anthropic')
+        },
+        now,
+        fallbackManager: fallbackManager as never,
+        writeManifestEntryLocked: async (...args) => {
+          manifestWrites.push(args[0].entry.label)
+          return core.writeCustodyHandleManifestEntryLocked(...args)
+        },
+      })
+      const storage = await core.loadAccounts(storagePath)
+      const plan = await preflightClaustrumTakeover(
+        await deps.preflightInput(
+          { id: 'main', label: 'main', enabled: true },
+          storage?.accounts ?? [],
+        ),
+      )
+
+      await expect(
+        executeClaustrumTakeover(plan, deps.takeoverDeps(plan)),
+      ).resolves.toBe('changed')
+
+      const committed = await core.loadAccounts(storagePath)
+      const work = committed?.accounts.find((account) => account.id === 'work')
+      expect(work).toMatchObject({
+        access: '',
+        refresh: core.custodyTombstoneKey('anthropic'),
+        expires: 0,
+      })
+      expect(committed?.claustrum?.mode).toBe('claustrum')
+      modeAtFinalVerification = committed?.claustrum?.mode ?? 'local'
+      expect(modeAtFinalVerification).toBe('claustrum')
+      expect(cacheModes.slice(-4)).toEqual([
+        'local',
+        'local',
+        'claustrum',
+        'claustrum',
+      ])
+      expect(manifestWrites).toEqual(['work'])
+      const manifest = JSON.parse(await readFile(manifestPath, 'utf8'))
+      expect(manifest.providers[0].accounts).toEqual([
+        {
+          label: 'main',
+          handle: mainHandle,
+          credential_id: core.custodyCredentialId('main'),
+        },
+        {
+          label: 'work',
+          handle: workHandle,
+          credential_id: core.custodyCredentialId('work'),
+        },
+      ])
+      expect(hostReads.length).toBeGreaterThan(1)
+      expect(deps.hostAuth).not.toHaveProperty('set')
+    } finally {
+      await rm(directory, { recursive: true, force: true })
+    }
+  })
+
+  test('custody: takeover waits for an in-flight fallback refresh before writing custody sidecars', async () => {
+    const directory = await mkdtemp(
+      join(tmpdir(), 'custody-live-refresh-lock-'),
+    )
+    const storagePath = join(directory, 'accounts.json')
+    const manifestPath = join(directory, 'handles.json')
+    const mainHandle = `ckh_${'M'.repeat(43)}`
+    const workHandle = `ckh_${'W'.repeat(43)}`
+    let releaseRefresh!: () => void
+    let resolveRefreshEntered!: () => void
+    let resolveTakeoverQueued!: () => void
+    let resolveManifestWritten!: () => void
+    const refreshReleased = new Promise<void>((resolve) => {
+      releaseRefresh = resolve
+    })
+    const refreshEntered = new Promise<void>((resolve) => {
+      resolveRefreshEntered = resolve
+    })
+    const takeoverQueued = new Promise<void>((resolve) => {
+      resolveTakeoverQueued = resolve
+    })
+    const manifestWritten = new Promise<void>((resolve) => {
+      resolveManifestWritten = resolve
+    })
+    let lockTail = Promise.resolve()
+    let refreshCall = false
+    let managerSawRefresh = false
+    const fallbackManager = {
+      withAccountRefreshLock: async <T>(_id: string, fn: () => Promise<T>) => {
+        if (refreshCall) managerSawRefresh = true
+        if (!refreshCall) resolveTakeoverQueued()
+        const prior = lockTail
+        let release!: () => void
+        lockTail = new Promise<void>((resolve) => {
+          release = resolve
+        })
+        await prior
+        try {
+          return await fn()
+        } finally {
+          release()
+        }
+      },
+    }
+    try {
+      await core.saveAccounts(
+        {
+          version: 1,
+          claustrum: { handlesFile: manifestPath, mode: 'local' },
+          accounts: [
+            {
+              id: 'work',
+              label: 'work',
+              type: 'oauth',
+              access: 'access-work-secret',
+              refresh: 'refresh-work-secret',
+              expires: now + 60_000,
+              claustrumHandle: workHandle,
+              enabled: true,
+            },
+          ],
+        },
+        storagePath,
+      )
+      await core.writeCustodyHandleManifestEntry({
+        path: manifestPath,
+        entry: {
+          label: 'main',
+          handle: mainHandle,
+          credentialId: core.custodyCredentialId('main'),
+        },
+      })
+      const deps = createLiveCustodyDeps({
+        storagePath,
+        cache: {
+          get: async (handle: string, minTtlMs = 0) => ({
+            credentialId:
+              handle === mainHandle
+                ? core.custodyCredentialId('main')
+                : core.custodyCredentialId('work'),
+            recordVersion: 7,
+            access: 'vault-access',
+            refresh: 'vault-refresh',
+            expiresAt: now + minTtlMs + 1,
+            state: 'usable' as const,
+          }),
+        },
+        latestGetAuth: async () => core.custodyTombstoneOAuth('anthropic'),
+        now,
+        fallbackManager: fallbackManager as never,
+        writeManifestEntryLocked: async (...args) => {
+          const result = await core.writeCustodyHandleManifestEntryLocked(
+            ...args,
+          )
+          resolveManifestWritten()
+          return result
+        },
+      })
+      const storage = await core.loadAccounts(storagePath)
+      const plan = await preflightClaustrumTakeover(
+        await deps.preflightInput(
+          { id: 'main', label: 'main', enabled: true },
+          storage?.accounts ?? [],
+        ),
+      )
+      refreshCall = true
+      const refresh = deps.locks.withFallbackRefreshLock('work', async () => {
+        resolveRefreshEntered()
+        await refreshReleased
+      })
+      refreshCall = false
+      await refreshEntered
+      const before = await Promise.all([
+        readFile(storagePath, 'utf8'),
+        readFile(core.getAccountStatePath(storagePath), 'utf8').catch(() => ''),
+        readFile(manifestPath, 'utf8'),
+      ])
+      const takeover = executeClaustrumTakeover(plan, deps.takeoverDeps(plan))
+      await (managerSawRefresh ? takeoverQueued : manifestWritten)
+      expect(await readFile(storagePath, 'utf8')).toBe(before[0])
+      expect(
+        await readFile(core.getAccountStatePath(storagePath), 'utf8').catch(
+          () => '',
+        ),
+      ).toBe(before[1])
+      expect(await readFile(manifestPath, 'utf8')).toBe(before[2])
+
+      releaseRefresh()
+      await refresh
+      await expect(takeover).resolves.toBe('changed')
+      const committed = await core.loadAccounts(storagePath)
+      expect(committed?.claustrum?.mode).toBe('claustrum')
+      expect(
+        committed?.accounts.find((account) => account.id === 'work'),
+      ).toMatchObject({
+        access: '',
+        refresh: core.custodyTombstoneKey('anthropic'),
+        expires: 0,
+      })
+    } finally {
+      await rm(directory, { recursive: true, force: true })
+    }
+  })
+
+  test('custody: fallback refresh cannot persist while a takeover holds its refresh lock', async () => {
+    const directory = await mkdtemp(
+      join(tmpdir(), 'custody-live-takeover-lock-'),
+    )
+    const storagePath = join(directory, 'accounts.json')
+    const manifestPath = join(directory, 'handles.json')
+    const mainHandle = `ckh_${'M'.repeat(43)}`
+    const workHandle = `ckh_${'W'.repeat(43)}`
+    let releaseTakeover!: () => void
+    let resolveTakeoverEntered!: () => void
+    let resolveRefreshQueued!: () => void
+    let resolveRefreshPersisted!: () => void
+    const takeoverReleased = new Promise<void>((resolve) => {
+      releaseTakeover = resolve
+    })
+    const takeoverEntered = new Promise<void>((resolve) => {
+      resolveTakeoverEntered = resolve
+    })
+    const refreshQueued = new Promise<void>((resolve) => {
+      resolveRefreshQueued = resolve
+    })
+    const refreshPersisted = new Promise<void>((resolve) => {
+      resolveRefreshPersisted = resolve
+    })
+    let lockTail = Promise.resolve()
+    let refreshInvocation = false
+    let managerSawRefresh = false
+    const fallbackManager = {
+      withAccountRefreshLock: async <T>(_id: string, fn: () => Promise<T>) => {
+        if (refreshInvocation) {
+          managerSawRefresh = true
+          resolveRefreshQueued()
+        }
+        const prior = lockTail
+        let release!: () => void
+        lockTail = new Promise<void>((resolve) => {
+          release = resolve
+        })
+        await prior
+        try {
+          return await fn()
+        } finally {
+          release()
+        }
+      },
+    }
+    try {
+      await core.saveAccounts(
+        {
+          version: 1,
+          claustrum: { handlesFile: manifestPath, mode: 'local' },
+          accounts: [
+            {
+              id: 'work',
+              label: 'work',
+              type: 'oauth',
+              access: 'access-work-secret',
+              refresh: 'refresh-work-secret',
+              expires: now + 60_000,
+              claustrumHandle: workHandle,
+              enabled: true,
+            },
+          ],
+        },
+        storagePath,
+      )
+      await core.writeCustodyHandleManifestEntry({
+        path: manifestPath,
+        entry: {
+          label: 'main',
+          handle: mainHandle,
+          credentialId: core.custodyCredentialId('main'),
+        },
+      })
+      const deps = createLiveCustodyDeps({
+        storagePath,
+        cache: {
+          get: async (handle: string, minTtlMs = 0) => ({
+            credentialId:
+              handle === mainHandle
+                ? core.custodyCredentialId('main')
+                : core.custodyCredentialId('work'),
+            recordVersion: 7,
+            access: 'vault-access',
+            refresh: 'vault-refresh',
+            expiresAt: now + minTtlMs + 1,
+            state: 'usable' as const,
+          }),
+        },
+        latestGetAuth: async () => core.custodyTombstoneOAuth('anthropic'),
+        now,
+        fallbackManager: fallbackManager as never,
+        writeManifestEntryLocked: async (...args) => {
+          const result = await core.writeCustodyHandleManifestEntryLocked(
+            ...args,
+          )
+          resolveTakeoverEntered()
+          await takeoverReleased
+          return result
+        },
+      })
+      const storage = await core.loadAccounts(storagePath)
+      const plan = await preflightClaustrumTakeover(
+        await deps.preflightInput(
+          { id: 'main', label: 'main', enabled: true },
+          storage?.accounts ?? [],
+        ),
+      )
+      const takeover = executeClaustrumTakeover(plan, deps.takeoverDeps(plan))
+      await takeoverEntered
+      refreshInvocation = true
+      const refresh = deps.locks.withFallbackRefreshLock('work', async () => {
+        const current = await core.loadAccounts(storagePath)
+        const account = current?.accounts.find(
+          (candidate): candidate is core.OAuthAccount =>
+            candidate.id === 'work' && core.isOAuthAccount(candidate),
+        )
+        if (
+          !current ||
+          !account ||
+          core.isCustodyTombstoneOAuth(account, 'anthropic')
+        )
+          return 'skipped'
+        account.access = 'refresh-new-access'
+        account.refresh = 'refresh-new-refresh'
+        account.expires = now + 120_000
+        await core.saveAccountState(current, storagePath, {
+          accounts: ['work'],
+        })
+        resolveRefreshPersisted()
+        return 'persisted'
+      })
+      refreshInvocation = false
+      await (managerSawRefresh ? refreshQueued : refreshPersisted)
+      expect(await readFile(storagePath, 'utf8')).not.toContain(
+        'refresh-new-access',
+      )
+      expect(
+        await readFile(core.getAccountStatePath(storagePath), 'utf8').catch(
+          () => '',
+        ),
+      ).not.toContain('refresh-new-access')
+
+      releaseTakeover()
+      await expect(takeover).resolves.toBe('changed')
+      await expect(refresh).resolves.toBe('skipped')
+      const committed = await core.loadAccounts(storagePath)
+      expect(committed?.claustrum?.mode).toBe('claustrum')
+      expect(
+        committed?.accounts.find((account) => account.id === 'work'),
+      ).toMatchObject({
+        access: '',
+        refresh: core.custodyTombstoneKey('anthropic'),
+        expires: 0,
+      })
+    } finally {
+      await rm(directory, { recursive: true, force: true })
+    }
+  })
+
+  test('custody: local exit changes only the persisted mode', async () => {
+    const calls: string[] = []
+    await expect(
+      executeLocalExit({
+        setMode: async (mode) => {
+          calls.push(mode)
+          return 'changed'
+        },
+      }),
+    ).resolves.toBe('changed')
+    expect(calls).toEqual(['local'])
+  })
+})
diff --git a/packages/opencode/src/tests/custody-ruled-row.fixture.ts b/packages/opencode/src/tests/custody-ruled-row.fixture.ts
new file mode 100644
index 00000000..4340e9af
--- /dev/null
+++ b/packages/opencode/src/tests/custody-ruled-row.fixture.ts
@@ -0,0 +1,317 @@
+import * as fs from 'node:fs/promises'
+import { join } from 'node:path'
+import {
+  type AccountStorage,
+  custodyCredentialId,
+  custodyTombstoneOAuth,
+  type OAuthAccount,
+} from '@cortexkit/anthropic-auth-core'
+
+export type CredentialCall = {
+  method: string
+  params: Record<string, unknown>
+}
+
+type RuledRowCredentialCache = {
+  get: (handle: string) => Promise<unknown>
+}
+
+type RuledRowPlugin = {
+  auth?: {
+    loader?: (
+      getAuth: () => Promise<{
+        type: string
+        access?: string
+        refresh?: string
+        expires?: number
+      }>,
+      provider: { models: Record<string, { cost: unknown }> },
+    ) => Promise<{ fetch: typeof fetch }>
+  }
+  __claustrumCredentialCache?: RuledRowCredentialCache
+}
+
+class MissingRuledRowFixtureDependencyError extends Error {
+  constructor(dependency: string) {
+    super(`ruled Claustrum row requires ${dependency}`)
+    this.name = 'MissingRuledRowFixtureDependencyError'
+  }
+}
+
+function requireRuledRowDependency<T>(
+  value: T | undefined,
+  dependency: string,
+): T {
+  if (value === undefined)
+    throw new MissingRuledRowFixtureDependencyError(dependency)
+  return value
+}
+
+export const ruledMainHandle = `ckh_${'Z'.repeat(43)}`
+
+export async function withCustodyManifestPath<T>(
+  path: string,
+  fn: () => Promise<T>,
+): Promise<T> {
+  const previous = process.env.CLAUSTRUM_OPENCODE_HANDLES
+  process.env.CLAUSTRUM_OPENCODE_HANDLES = path
+  try {
+    return await fn()
+  } finally {
+    if (previous === undefined) delete process.env.CLAUSTRUM_OPENCODE_HANDLES
+    else process.env.CLAUSTRUM_OPENCODE_HANDLES = previous
+  }
+}
+
+export function credentialResponse(
+  accessToken: string,
+  recordVersion: number,
+  expiresAtMs = Date.now() + 60_000,
+  accountId?: string,
+) {
+  return {
+    result: {
+      payload: Array.from(
+        new TextEncoder().encode(JSON.stringify({ access_token: accessToken })),
+      ),
+      expires_at_ms: expiresAtMs,
+      record_version: recordVersion,
+      ...(accountId && { account_id: accountId }),
+    },
+  }
+}
+
+export function connectorFor(
+  calls: CredentialCall[],
+  handler: (method: string, params: Record<string, unknown>) => unknown,
+) {
+  return async () =>
+    ({
+      call: async (_moduleId: string, method: string, params: unknown) => {
+        const normalized = (params ?? {}) as Record<string, unknown>
+        calls.push({ method, params: normalized })
+        return handler(method, normalized)
+      },
+      close: () => {},
+    }) as never
+}
+
+export function manifestConnector(
+  calls: CredentialCall[],
+  credentials: ReadonlyMap<string, string>,
+) {
+  return connectorFor(calls, (method, params) => {
+    if (method !== 'credential.get') return { result: {} }
+    return credentialResponse(
+      credentials.get(String(params.handle)) ?? 'other',
+      1,
+    )
+  })
+}
+
+export async function writeManifest(
+  tempConfigDir: string,
+  entries: Array<{ label: string; handle: string }>,
+  serve = 'anthropic-auth',
+) {
+  const path = join(tempConfigDir, 'handles.json')
+  await fs.writeFile(
+    path,
+    JSON.stringify({
+      version: 1,
+      providers: [
+        {
+          provider: 'anthropic',
+          serve,
+          accounts: entries.map(({ label, handle }) => ({
+            label,
+            handle,
+            credential_id: custodyCredentialId(label),
+          })),
+        },
+      ],
+    }),
+  )
+  await fs.chmod(path, 0o600)
+  await fs.lstat(path)
+  process.env.CLAUSTRUM_OPENCODE_HANDLES = path
+  return path
+}
+
+export async function bootRuledClaustrumRow<
+  TPlugin extends RuledRowPlugin = RuledRowPlugin,
+>({
+  fallbacks,
+  route,
+  quota = { enabled: false, failClosedOnUnknownQuota: false },
+  connector,
+  onFetch,
+  response,
+  storageOverrides,
+  initialNow,
+  runtimeOverrides,
+  createFallbackStorage,
+  useTempAccountFile,
+  getPlugin,
+  bootPlugin,
+  extractUrl,
+  tempConfigDir,
+}: {
+  fallbacks: Array<{
+    label: string
+    handle: string
+    access: string
+    account?: Partial<OAuthAccount>
+  }>
+  route: 'fallback-first' | 'main-exhausted' | { sticky: string }
+  quota?: AccountStorage['quota']
+  connector?: (calls: CredentialCall[]) => () => Promise<unknown>
+  onFetch?: (input: unknown, init?: RequestInit) => Response | Promise<Response>
+  response?: Response | (() => Response)
+  storageOverrides?: Omit<
+    Partial<AccountStorage>,
+    'accounts' | 'claustrum' | 'quota' | 'routing'
+  >
+  initialNow?: number
+  runtimeOverrides?: Record<string, unknown>
+  createFallbackStorage?: (storage: Partial<AccountStorage>) => AccountStorage
+  useTempAccountFile?: (storage: AccountStorage) => Promise<void>
+  getPlugin?: (
+    accountStoragePath: string,
+    runtimeOverrides: Record<string, unknown> & {
+      claustrumNow: () => number
+      claustrumConnector: () => Promise<unknown>
+    },
+  ) => Promise<TPlugin>
+  bootPlugin?: (
+    runtimeOverrides: Record<string, unknown> & {
+      claustrumNow: () => number
+      claustrumConnector: () => Promise<unknown>
+    },
+  ) => Promise<TPlugin>
+  extractUrl?: (input: string | URL | Request) => string
+  tempConfigDir?: () => string
+}) {
+  let now = initialNow ?? Date.now()
+  const calls: CredentialCall[] = []
+  const authorizations: string[] = []
+  const saveTemporaryAccountFile = requireRuledRowDependency(
+    useTempAccountFile,
+    'useTempAccountFile',
+  )
+  const makeFallbackStorage = requireRuledRowDependency(
+    createFallbackStorage,
+    'createFallbackStorage',
+  )
+  const getUrl = requireRuledRowDependency(extractUrl, 'extractUrl')
+  const getTempConfigDir = requireRuledRowDependency(
+    tempConfigDir,
+    'tempConfigDir',
+  )
+  const routing: AccountStorage['routing'] =
+    route === 'fallback-first'
+      ? { mode: 'fallback-first' }
+      : route === 'main-exhausted'
+        ? { mode: 'main-first' }
+        : { mode: 'sticky-balanced' }
+  await saveTemporaryAccountFile(
+    makeFallbackStorage({
+      ...storageOverrides,
+      main: {
+        ...custodyTombstoneOAuth('anthropic'),
+        claustrumHandle: ruledMainHandle,
+      } as never,
+      claustrum: { mode: 'claustrum' },
+      routing,
+      quota,
+      accounts: fallbacks.map((fallback, index) => ({
+        id: fallback.account?.id ?? `fallback-${index + 1}`,
+        label: fallback.label,
+        ...custodyTombstoneOAuth('anthropic'),
+        quota: {
+          checkedAt: Date.now(),
+          five_hour: {
+            usedPercent: 10,
+            remainingPercent: 90,
+            checkedAt: Date.now(),
+          },
+          seven_day: {
+            usedPercent: 10,
+            remainingPercent: 90,
+            checkedAt: Date.now(),
+          },
+        },
+        ...fallback.account,
+      })) as OAuthAccount[],
+    }),
+  )
+  const accountStoragePath = process.env.OPENCODE_ANTHROPIC_AUTH_FILE
+  if (!accountStoragePath) {
+    throw new Error('ruled Claustrum row requires an account storage path')
+  }
+  const manifestPath = await writeManifest(getTempConfigDir(), [
+    { label: 'main', handle: ruledMainHandle },
+    ...fallbacks.map(({ label, handle }) => ({ label, handle })),
+  ])
+  globalThis.fetch = (async (input: unknown, init?: RequestInit) => {
+    if (getUrl(input as string | URL | Request).includes('/v1/messages')) {
+      authorizations.push(new Headers(init?.headers).get('authorization') ?? '')
+    }
+    return (
+      (await onFetch?.(input, init)) ??
+      (typeof response === 'function'
+        ? response()
+        : (response?.clone() ?? new Response('{}', { status: 200 })))
+    )
+  }) as typeof fetch
+  const resolvedRuntimeOverrides = {
+    ...runtimeOverrides,
+    claustrumNow: () => now,
+    claustrumConnector:
+      connector?.(calls) ??
+      manifestConnector(
+        calls,
+        new Map([
+          [ruledMainHandle, 'vault-main-access'],
+          ...fallbacks.map(({ handle, access }) => [handle, access] as const),
+        ]),
+      ),
+  }
+  const plugin = bootPlugin
+    ? await bootPlugin(resolvedRuntimeOverrides)
+    : await requireRuledRowDependency(getPlugin, 'getPlugin')(
+        accountStoragePath,
+        resolvedRuntimeOverrides,
+      )
+  const cache = plugin.__claustrumCredentialCache
+  if (!cache) {
+    throw new Error('ruled Claustrum row failed to initialize credential cache')
+  }
+  await cache.get(ruledMainHandle)
+  await requireRuledRowDependency(plugin.auth?.loader, 'plugin.auth.loader')(
+    () =>
+      Promise.resolve({
+        type: 'oauth' as const,
+        access: 'bootstrap-main-access',
+        refresh: 'bootstrap-main-refresh',
+        expires: Date.now() + 5 * 60 * 60 * 1_000,
+      }),
+    { models: {} },
+  )
+  const load = () =>
+    requireRuledRowDependency(plugin.auth?.loader, 'plugin.auth.loader')(
+      () => Promise.resolve(custodyTombstoneOAuth('anthropic') as never),
+      { models: {} },
+    )
+  const result = await load()
+  return {
+    authorizations,
+    calls,
+    manifestPath,
+    plugin,
+    result,
+    setNow(value: number) {
+      now = value
+    },
+  }
+}
diff --git a/packages/opencode/src/tests/custody-source-deps.test.ts b/packages/opencode/src/tests/custody-source-deps.test.ts
new file mode 100644
index 00000000..4477edf5
--- /dev/null
+++ b/packages/opencode/src/tests/custody-source-deps.test.ts
@@ -0,0 +1,43 @@
+import { describe, expect, test } from 'bun:test'
+import { readFile } from 'node:fs/promises'
+import { join } from 'node:path'
+
+const productionFiles = [
+  '../custody-mode.ts',
+  '../custody-live.ts',
+  '../local-login.ts',
+  '../../../core/src/claustrum.ts',
+  '../../../core/src/commands/account.ts',
+  '../index.ts',
+]
+
+const allowedGuidance = [
+  "Onboard the main account into the Claustrum vault with Claustrum's tooling (see its runbook) before retrying.",
+  'Claustrum main credential requires re-import; run ck auth import --replace.',
+  "Claustrum main binding is not active while local main material remains; onboard main into the vault with Claustrum's tooling first.",
+  'Claustrum main credential identity differs from the persisted main identity; run ck auth set-identity.',
+]
+const forbidden = [
+  /child_process/u,
+  /Bun\.spawn/u,
+  /Bun\.\$/u,
+  /execa/u,
+  /ck auth/u,
+]
+
+describe('custody production dependencies', () => {
+  test('does not invoke vault CLIs or spawn processes', async () => {
+    for (const relativePath of productionFiles) {
+      const source = await readFile(join(import.meta.dir, relativePath), 'utf8')
+      const unguarded = allowedGuidance.reduce(
+        (remaining, guidance) => remaining.replace(guidance, ''),
+        source,
+      )
+      for (const pattern of forbidden)
+        expect(
+          unguarded,
+          `${relativePath} must not contain ${pattern}`,
+        ).not.toMatch(pattern)
+    }
+  })
+})
diff --git a/packages/opencode/src/tests/custody-tombstone.test.ts b/packages/opencode/src/tests/custody-tombstone.test.ts
index 8c80c628..59677e1a 100644
--- a/packages/opencode/src/tests/custody-tombstone.test.ts
+++ b/packages/opencode/src/tests/custody-tombstone.test.ts
@@ -1,24 +1,30 @@
 import { afterEach, describe, expect, mock, test } from 'bun:test'
 import { existsSync, readFileSync } from 'node:fs'
-import { mkdtemp, readFile, rm } from 'node:fs/promises'
+import { chmod, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
-import { join } from 'node:path'
+import { dirname, join } from 'node:path'
 import {
   assertNotCustodyTombstone,
   buildRefreshOperationError,
   CustodyTombstoneRefreshError,
+  custodyTombstoneKey,
+  custodyTombstoneOAuth,
   FallbackAccountManager,
+  fetchOAuthAccountProfile,
+  fetchOAuthQuotaSnapshot,
   getAccountStatePath,
   getFallbackReauthLabels,
   isCustodyTombstoneOAuth,
-  isCustodyTombstoneValue,
   isPermanentRefreshError,
   isValidCustodyHandle,
   loadAccounts,
   readCustodyHandles,
+  refreshClaudeOAuthToken,
   saveAccounts,
 } from '@cortexkit/anthropic-auth-core'
 import { AnthropicAuthPlugin } from '../index'
+import { setOAuthHeaders } from '../transform'
+import { withCustodyManifestPath } from './custody-ruled-row.fixture'
 import { extractUrl, TOKEN_URL } from './test-fetch'
 
 const fixtureDir = join(import.meta.dir, 'fixtures', 'claustrum-golden')
@@ -50,6 +56,7 @@ const handlesFixture = JSON.parse(
 const oauthFixture = tombstoneFixture.fixtures.oauth
 const apiFixture = tombstoneFixture.fixtures.api
 const originalFetch = globalThis.fetch
+const originalManifestPath = process.env.CLAUSTRUM_OPENCODE_HANDLES
 
 function createMockClient() {
   return {
@@ -77,7 +84,10 @@ async function createTempStorage<T>(
   process.env.OPENCODE_ANTHROPIC_AUTH_FILE = path
   try {
     await saveAccounts(storage as never, path)
-    return await callback(path)
+    return await withCustodyManifestPath(
+      process.env.CLAUSTRUM_OPENCODE_HANDLES!,
+      () => callback(path),
+    )
   } finally {
     if (previous === undefined) delete process.env.OPENCODE_ANTHROPIC_AUTH_FILE
     else process.env.OPENCODE_ANTHROPIC_AUTH_FILE = previous
@@ -90,74 +100,62 @@ afterEach(() => {
 })
 
 describe('Claustrum custody tombstones', () => {
-  test('recognizes only the provider-bound OAuth golden shape', () => {
-    const oauth = oauthFixture.entry
-    const oauthRefresh = oauth.refresh as string
-    expect(isCustodyTombstoneOAuth(oauth, oauthFixture.provider)).toBe(true)
-    expect(isCustodyTombstoneOAuth(oauth, apiFixture.provider)).toBe(false)
-    expect(isCustodyTombstoneValue(oauthRefresh)).toBe(true)
-    expect(isCustodyTombstoneOAuth(apiFixture.entry, apiFixture.provider)).toBe(
-      false,
-    )
-
-    expect(
-      isCustodyTombstoneOAuth(
-        {
-          ...oauth,
-          refresh: oauthRefresh.replace(':v1:', ':v2:'),
+  test('recognizes only provider-bound OAuth tombstones', () => {
+    const provider = oauthFixture.provider
+    const key = custodyTombstoneKey(provider)
+    const productionTombstone = {
+      type: 'oauth',
+      access: '',
+      refresh: key,
+      expires: 0,
+    }
+    const cases: Array<{ name: string; auth: unknown; recognized: boolean }> = [
+      {
+        name: 'production empty-access tombstone',
+        auth: productionTombstone,
+        recognized: true,
+      },
+      {
+        name: 'vendored golden sentinel-access tombstone',
+        auth: oauthFixture.entry,
+        recognized: true,
+      },
+      { name: 'API entry', auth: apiFixture.entry, recognized: false },
+      {
+        name: 'wrong-provider sentinel',
+        auth: {
+          ...productionTombstone,
+          refresh: custodyTombstoneKey('openai'),
         },
-        oauthFixture.provider,
-      ),
-    ).toBe(false)
-    expect(
-      isCustodyTombstoneOAuth(
-        { ...oauth, access: `${String(oauth.access)}-different` },
-        oauthFixture.provider,
-      ),
-    ).toBe(false)
-    expect(
-      isCustodyTombstoneOAuth(
-        { ...oauth, type: apiFixture.entry.type },
-        oauthFixture.provider,
-      ),
-    ).toBe(false)
-  })
-
-  test('rejects sentinel whitespace, provider variants, and split credentials', () => {
-    const oauth = oauthFixture.entry
-    const oauthRefresh = oauth.refresh as string
-    const anthropic2Refresh = oauthRefresh.replace(
-      oauthFixture.provider,
-      `${oauthFixture.provider}-2`,
-    )
-
-    expect(
-      isCustodyTombstoneOAuth(
-        { ...oauth, refresh: `${oauthRefresh} ` },
-        oauthFixture.provider,
-      ),
-    ).toBe(false)
-    expect(isCustodyTombstoneOAuth(oauth, `${oauthFixture.provider}-2`)).toBe(
-      false,
-    )
-    expect(
-      isCustodyTombstoneOAuth(
-        { ...oauth, refresh: anthropic2Refresh, access: anthropic2Refresh },
-        oauthFixture.provider,
-      ),
-    ).toBe(false)
+        recognized: false,
+      },
+      {
+        name: 'sentinel with prefix added',
+        auth: { ...productionTombstone, refresh: `x${key}` },
+        recognized: false,
+      },
+      {
+        name: 'sentinel with suffix added',
+        auth: { ...productionTombstone, refresh: `${key}x` },
+        recognized: false,
+      },
+      {
+        name: 'ordinary refresh token',
+        auth: { ...productionTombstone, refresh: 'ordinary-refresh-token' },
+        recognized: false,
+      },
+      {
+        name: 'missing OAuth type',
+        auth: { access: '', refresh: key, expires: 0 },
+        recognized: false,
+      },
+    ]
 
-    const split = {
-      ...oauth,
-      access: String(oauth.access).replace(oauthRefresh, 'real-access-token'),
+    for (const entry of cases) {
+      expect(isCustodyTombstoneOAuth(entry.auth, provider), entry.name).toBe(
+        entry.recognized,
+      )
     }
-    expect(isCustodyTombstoneOAuth(split, oauthFixture.provider)).toBe(false)
-    expect(() =>
-      assertNotCustodyTombstone(
-        (split as Record<string, unknown>).refresh,
-        oauthFixture.provider,
-      ),
-    ).toThrow(CustodyTombstoneRefreshError)
   })
 
   test('throws a non-provider-refresh error before the token endpoint', () => {
@@ -183,18 +181,171 @@ describe('Claustrum custody tombstones', () => {
     )
   })
 
-  test('reads handles while tolerating and dropping superseded entries', () => {
+  test('keeps loader recognition contained by both irreversible boundaries', async () => {
+    const provider = oauthFixture.provider
+    const recognized = [custodyTombstoneOAuth(provider), oauthFixture.entry]
+    const foreign = custodyTombstoneKey('openai')
+    const values = [
+      ...recognized.map((auth) => ({
+        auth,
+        value: String((auth as Record<string, unknown>).refresh),
+        recognized: true,
+      })),
+      {
+        auth: { type: 'oauth', access: '', refresh: foreign, expires: 0 },
+        value: foreign,
+        recognized: false,
+      },
+    ]
+    const tokenEndpointCalls: string[] = []
+    const fetchImpl = mock((input: unknown) => {
+      tokenEndpointCalls.push(extractUrl(input as string | URL | Request))
+      return Promise.resolve(new Response('{}', { status: 200 }))
+    }) as unknown as typeof fetch
+
+    // Keep both depths in one table: separate tests drift apart invisibly.
+    await expect(
+      Promise.all(
+        values.map(async ({ auth, value, recognized: expectedRecognition }) => {
+          expect(isCustodyTombstoneOAuth(auth, provider)).toBe(
+            expectedRecognition,
+          )
+          expect(() => assertNotCustodyTombstone(value, provider)).toThrow(
+            CustodyTombstoneRefreshError,
+          )
+          await expect(
+            refreshClaudeOAuthToken({ refreshToken: value, fetchImpl }),
+          ).rejects.toBeInstanceOf(CustodyTombstoneRefreshError)
+          expect(() => setOAuthHeaders(new Headers(), value)).toThrow(
+            CustodyTombstoneRefreshError,
+          )
+        }),
+      ),
+    ).resolves.toBeArray()
+    expect(tokenEndpointCalls).toEqual([])
+  })
+
+  test('refuses sentinel access during direct requests', async () => {
+    const messageAuthorizations: string[] = []
+    globalThis.fetch = mock((input: unknown, init?: RequestInit) => {
+      const url = extractUrl(input as string | URL | Request)
+      if (url.includes('/v1/messages')) {
+        messageAuthorizations.push(
+          new Headers(init?.headers).get('authorization') ?? '',
+        )
+      }
+      return Promise.resolve(new Response('{}', { status: 200 }))
+    }) as unknown as typeof fetch
+
+    await createTempStorage(
+      {
+        version: 1,
+        main: { type: 'opencode', provider: oauthFixture.provider },
+        refresh: { enabled: false },
+        quota: { enabled: false },
+        accounts: [
+          {
+            id: 'fallback-1',
+            type: 'oauth',
+            access: 'fallback-access',
+            refresh: 'fallback-refresh',
+            expires: Date.now() + 60_000,
+          },
+        ],
+      },
+      async () => {
+        const auth = {
+          type: 'oauth',
+          access: 'ordinary-access',
+          refresh: 'ordinary-refresh',
+          expires: Date.now() + 60_000,
+        }
+        const plugin = (await AnthropicAuthPlugin(
+          // @ts-expect-error: minimal mock for testing
+          { client: createMockClient() },
+          disabledTimerOverrides(),
+        )) as any
+        const loaded = await plugin.auth.loader(() => Promise.resolve(auth), {
+          models: {},
+        } as never)
+        auth.access = String(oauthFixture.entry.access)
+
+        await expect(
+          loaded.fetch('https://api.anthropic.com/v1/messages', {
+            method: 'POST',
+            body: JSON.stringify({
+              model: 'claude-sonnet-4-5',
+              max_tokens: 1,
+              messages: [{ role: 'user', content: 'hello' }],
+            }),
+          }),
+        ).rejects.toBeInstanceOf(CustodyTombstoneRefreshError)
+        expect(messageAuthorizations).toEqual([])
+        await plugin.dispose?.()
+      },
+    )
+  })
+
+  test('refuses a tombstone before the quota poll fetch', async () => {
+    const fetchImpl = mock(() =>
+      Promise.resolve(new Response('{}', { status: 200 })),
+    ) as unknown as typeof fetch
+
+    await expect(
+      fetchOAuthQuotaSnapshot({
+        accessToken: custodyTombstoneKey('openai'),
+        fetchImpl,
+      }),
+    ).rejects.toBeInstanceOf(CustodyTombstoneRefreshError)
+    expect(fetchImpl).not.toHaveBeenCalled()
+  })
+
+  test('refuses a tombstone before the profile fetch', async () => {
+    const fetchImpl = mock(() =>
+      Promise.resolve(new Response('{}', { status: 200 })),
+    ) as unknown as typeof fetch
+
+    await expect(
+      fetchOAuthAccountProfile({
+        accessToken: custodyTombstoneKey('openai'),
+        fetchImpl,
+      }),
+    ).rejects.toBeInstanceOf(CustodyTombstoneRefreshError)
+    expect(fetchImpl).not.toHaveBeenCalled()
+  })
+
+  test('refuses a tombstone before CacheKeep prewarm headers', () => {
+    expect(() =>
+      setOAuthHeaders(new Headers(), custodyTombstoneKey('openai'), {
+        body: { model: 'claude-sonnet-4-5' },
+      }),
+    ).toThrow(CustodyTombstoneRefreshError)
+  })
+
+  test('refuses a tombstone before Prime fire headers', () => {
+    expect(() =>
+      setOAuthHeaders(new Headers(), custodyTombstoneKey('openai'), {
+        body: { model: 'claude-haiku-4-5' },
+      }),
+    ).toThrow(CustodyTombstoneRefreshError)
+  })
+
+  test('preserves validated superseded handles in the parsed manifest', () => {
     const anthropicSource = handlesFixture.providers.find(
       (provider: { provider: string }) =>
         provider.provider === oauthFixture.provider,
     )
     if (!anthropicSource) throw new Error('missing anthropic fixture')
-    const anthropic = readCustodyHandles(handlesFixture, oauthFixture.provider)
-    expect(anthropic).toEqual({
-      provider: anthropicSource.provider,
-      serve: anthropicSource.serve,
-      shape: anthropicSource.shape,
-      accounts: anthropicSource.accounts.map(
+    const anthropic = readCustodyHandles(
+      handlesFixture,
+      oauthFixture.provider,
+      anthropicSource.serve,
+    )
+    expect(anthropic.version).toBe(1)
+    expect(anthropic.provider).toBe(anthropicSource.provider)
+    expect(anthropic.serve).toBe(anthropicSource.serve)
+    expect(anthropic.accounts).toEqual(
+      anthropicSource.accounts.map(
         (account: {
           label: string
           handle: string
@@ -205,23 +356,30 @@ describe('Claustrum custody tombstones', () => {
           credentialId: account.credential_id,
         }),
       ),
-    })
-    const deepseek = readCustodyHandles(handlesFixture, apiFixture.provider)
-    const deepseekBackup = deepseek.accounts[1]
-    if (!deepseekBackup) throw new Error('missing deepseek backup fixture')
-    expect(deepseekBackup).not.toHaveProperty('superseded')
+    )
     const deepseekSource = handlesFixture.providers.find(
       (provider) => provider.provider === apiFixture.provider,
     )
+    if (!deepseekSource) throw new Error('missing deepseek fixture')
+    const deepseek = readCustodyHandles(
+      handlesFixture,
+      apiFixture.provider,
+      deepseekSource.serve,
+    )
+    const deepseekBackup = deepseek.accounts[1]
+    if (!deepseekBackup) throw new Error('missing deepseek backup fixture')
     if (!deepseekSource?.accounts[1]) {
       throw new Error('missing deepseek backup fixture')
     }
     expect(deepseekBackup).toMatchObject({
       handle: deepseekSource.accounts[1].handle,
     })
+    expect(deepseek.superseded).toEqual(
+      new Set(deepseekSource.accounts[1].superseded),
+    )
   })
 
-  test('filters malformed handle accounts and tolerates unknown fields', () => {
+  test('marks malformed account entries as corrupt while retaining valid entries', () => {
     const fixture = structuredClone(handlesFixture) as {
       providers: Array<{
         provider: string
@@ -244,30 +402,55 @@ describe('Claustrum custody tombstones', () => {
       { ...account, extra: 'ignored' },
     ]
 
-    expect(readCustodyHandles(fixture, oauthFixture.provider).accounts).toEqual(
-      [
-        {
-          label: String(account.label),
-          handle: String(account.handle),
-          credentialId: String(account.credential_id),
-        },
-      ],
+    const parsed = readCustodyHandles(
+      fixture,
+      oauthFixture.provider,
+      'anthropic-auth',
     )
+    expect(parsed.corruptLabels).toEqual(new Set([String(account.label)]))
+    expect(parsed.accounts).toHaveLength(1)
+  })
+
+  test('marks non-canonical credential IDs as corrupt bindings', () => {
+    const fixture = structuredClone(handlesFixture) as {
+      providers: Array<{
+        provider: string
+        accounts: Array<Record<string, unknown>>
+      }>
+    }
+    const anthropic = fixture.providers.find(
+      (provider) => provider.provider === oauthFixture.provider,
+    )
+    if (!anthropic) throw new Error('missing anthropic fixture')
+    const account = anthropic.accounts[0]
+    if (!account) throw new Error('missing anthropic account fixture')
+    anthropic.accounts = [{ ...account, credential_id: 'wrong' }]
+
+    const parsed = readCustodyHandles(
+      fixture,
+      oauthFixture.provider,
+      'anthropic-auth',
+    )
+    expect(parsed.corruptLabels).toEqual(new Set([String(account.label)]))
   })
 
   test('throws when the requested provider is absent', () => {
-    expect(() =>
-      readCustodyHandles(handlesFixture, `${oauthFixture.provider}-missing`),
-    ).toThrow(
-      `Missing custody handles for provider ${oauthFixture.provider}-missing`,
+    const fixture = structuredClone(handlesFixture)
+    fixture.providers = fixture.providers.filter(
+      (provider) => provider.provider !== oauthFixture.provider,
     )
+    expect(() =>
+      readCustodyHandles(fixture, oauthFixture.provider, 'anthropic-auth'),
+    ).toThrow('missing-provider')
   })
 
   test('rejects prototype provider ids without polluting Object.prototype', () => {
     const malicious = JSON.parse(
       '{"providers":[{"provider":"__proto__","accounts":[]}]}',
     )
-    expect(() => readCustodyHandles(malicious, '__proto__')).toThrow()
+    expect(() =>
+      readCustodyHandles(malicious, '__proto__', 'anthropic-auth'),
+    ).toThrow()
     expect(({} as { polluted?: unknown }).polluted).toBeUndefined()
   })
 
@@ -295,12 +478,16 @@ describe('Claustrum custody tombstones', () => {
       ...account,
       handle: `ckh_${apiFixture.provider}_main`,
     })
-    expect(readCustodyHandles(fixture, oauthFixture.provider).accounts).toEqual(
-      [],
-    )
+    expect(() =>
+      readCustodyHandles(fixture, oauthFixture.provider, 'anthropic-auth'),
+    ).toThrow('invalid account label')
 
     for (const provider of handlesFixture.providers) {
-      const parsed = readCustodyHandles(handlesFixture, provider.provider)
+      const parsed = readCustodyHandles(
+        handlesFixture,
+        provider.provider,
+        provider.serve,
+      )
       expect(parsed.accounts).toHaveLength(provider.accounts.length)
       for (const sourceAccount of provider.accounts) {
         expect(isValidCustodyHandle(sourceAccount.handle)).toBe(true)
@@ -329,7 +516,7 @@ describe('Claustrum custody tombstones', () => {
     expect(isValidCustodyHandle(`${validHandle.slice(0, -1)}=`)).toBe(false)
   })
 
-  test('main loader rejects the tombstone without network or refresh state', async () => {
+  test('holds a local main tombstone dark without network or refresh state', async () => {
     const fetchCalls: string[] = []
     globalThis.fetch = mock((input: unknown) => {
       const url = extractUrl(input as string | URL | Request)
@@ -351,12 +538,19 @@ describe('Claustrum custody tombstones', () => {
           { client: createMockClient() },
           disabledTimerOverrides(),
         )) as any
+        const loaded = await plugin.auth.loader(
+          () => Promise.resolve(oauthFixture.entry as never),
+          { models: {} } as never,
+        )
         await expect(
-          plugin.auth.loader(
-            () => Promise.resolve(oauthFixture.entry as never),
-            { models: {} } as never,
-          ),
-        ).rejects.toBeInstanceOf(CustodyTombstoneRefreshError)
+          loaded.fetch('https://api.anthropic.com/v1/messages', {
+            method: 'POST',
+            body: '{}',
+          }),
+        ).rejects.toMatchObject({
+          code: 'custody_state_mismatch',
+          verdict: 'REMAIN_DARK_PENDING_LOGIN',
+        })
         expect(fetchCalls.filter((url) => url === TOKEN_URL)).toHaveLength(0)
 
         const statePath = getAccountStatePath(path)
@@ -375,6 +569,293 @@ describe('Claustrum custody tombstones', () => {
     )
   })
 
+  test('never sends a foreign-provider main tombstone to the token endpoint after expiry', async () => {
+    const tokenCalls: string[] = []
+    let currentAuth: Record<string, unknown> = {
+      type: 'oauth',
+      access: 'live-main-access',
+      refresh: 'live-main-refresh',
+      expires: Date.now() + 60_000,
+    }
+    globalThis.fetch = mock((input: unknown) => {
+      const url = extractUrl(input as string | URL | Request)
+      if (url === TOKEN_URL) tokenCalls.push(url)
+      return Promise.resolve(new Response('{}', { status: 200 }))
+    }) as unknown as typeof fetch
+
+    await createTempStorage(
+      {
+        version: 1,
+        main: { type: 'opencode', provider: oauthFixture.provider },
+        refresh: { enabled: false },
+        quota: { enabled: false },
+        accounts: [
+          {
+            id: 'fallback-1',
+            type: 'oauth',
+            access: 'fallback-access',
+            refresh: 'fallback-refresh',
+            expires: Date.now() + 60_000,
+          },
+        ],
+      },
+      async () => {
+        const plugin = (await AnthropicAuthPlugin(
+          // @ts-expect-error: minimal mock for testing
+          { client: createMockClient() },
+          disabledTimerOverrides(),
+        )) as any
+        const loaded = await plugin.auth.loader(
+          () => Promise.resolve(currentAuth as never),
+          { models: {} } as never,
+        )
+
+        currentAuth = {
+          ...custodyTombstoneOAuth('openai'),
+          access: 'expired-main-access',
+          expires: 0,
+        }
+        await expect(
+          loaded.fetch('https://api.anthropic.com/v1/messages', {
+            method: 'POST',
+            body: '{}',
+          }),
+        ).rejects.toBeInstanceOf(CustodyTombstoneRefreshError)
+        expect(tokenCalls).toEqual([])
+        await plugin.dispose?.()
+      },
+    )
+  })
+
+  test('returns typed startup mismatches for an unusable manifest-resolved main', async () => {
+    const fetchCalls: string[] = []
+    globalThis.fetch = mock((input: unknown) => {
+      fetchCalls.push(extractUrl(input as string | URL | Request))
+      return Promise.resolve(new Response('{}', { status: 200 }))
+    }) as unknown as typeof fetch
+
+    const makeStorage = (mode: 'claustrum' | 'local') => ({
+      version: 1,
+      main: { type: 'opencode', provider: oauthFixture.provider },
+      claustrum: { mode },
+      refresh: { enabled: true },
+      quota: { enabled: true },
+      accounts: [],
+    })
+
+    await createTempStorage(makeStorage('claustrum'), async (path) => {
+      const handlesPath = join(dirname(path), 'handles.json')
+      await writeFile(
+        handlesPath,
+        JSON.stringify({
+          version: 1,
+          providers: [
+            {
+              provider: 'anthropic',
+              serve: 'anthropic-auth',
+              accounts: [
+                {
+                  label: 'main',
+                  handle: `ckh_${'M'.repeat(43)}`,
+                  credential_id: 'oauth:anthropic:main',
+                },
+              ],
+            },
+          ],
+        }),
+      )
+      await chmod(handlesPath, 0o600)
+      process.env.CLAUSTRUM_OPENCODE_HANDLES = handlesPath
+      const timers = disabledTimerOverrides()
+      const plugin = (await AnthropicAuthPlugin(
+        // @ts-expect-error: minimal mock for testing
+        { client: createMockClient() },
+        timers,
+      )) as any
+      const intervalsBeforeLoader = (
+        timers.setInterval as typeof timers.setInterval & {
+          mock: { calls: unknown[] }
+        }
+      ).mock.calls.length
+      const loaded = await plugin.auth.loader(
+        () =>
+          Promise.resolve({
+            ...custodyTombstoneOAuth(oauthFixture.provider),
+            access: 'contaminated-local-access',
+          }),
+        { models: {} } as never,
+      )
+      await expect(
+        loaded.fetch('https://api.anthropic.com/v1/messages', {
+          method: 'POST',
+          body: '{}',
+        }),
+      ).rejects.toMatchObject({
+        code: 'custody_state_mismatch',
+        verdict: 'FAIL_CLOSED',
+      })
+      expect(timers.setInterval).toHaveBeenCalledTimes(intervalsBeforeLoader)
+      expect(fetchCalls.filter((url) => url === TOKEN_URL)).toHaveLength(0)
+      expect(fetchCalls).toHaveLength(0)
+
+      const realLoaded = await plugin.auth.loader(
+        () =>
+          Promise.resolve({
+            type: 'oauth' as const,
+            access: 'real-local-access',
+            refresh: 'real-local-refresh',
+            expires: Date.now() + 60_000,
+          }),
+        { models: {} } as never,
+      )
+      await expect(
+        realLoaded.fetch('https://api.anthropic.com/v1/messages', {
+          method: 'POST',
+          body: '{}',
+        }),
+      ).rejects.toMatchObject({
+        code: 'custody_state_mismatch',
+        verdict: 'TAKEOVER_INCOMPLETE_MAIN_REAL',
+      })
+      expect(fetchCalls).toHaveLength(0)
+      await plugin.dispose?.()
+    })
+
+    await createTempStorage(makeStorage('local'), async () => {
+      const plugin = (await AnthropicAuthPlugin(
+        // @ts-expect-error: minimal mock for testing
+        { client: createMockClient() },
+        disabledTimerOverrides(),
+      )) as any
+      const localLoaded = await plugin.auth.loader(
+        () => Promise.resolve(custodyTombstoneOAuth(oauthFixture.provider)),
+        { models: {} } as never,
+      )
+      await expect(
+        localLoaded.fetch('https://api.anthropic.com/v1/messages', {
+          method: 'POST',
+          body: '{}',
+        }),
+      ).rejects.toMatchObject({
+        code: 'custody_state_mismatch',
+        verdict: 'REMAIN_DARK_PENDING_LOGIN',
+      })
+      await plugin.dispose?.()
+    })
+    expect(fetchCalls.filter((url) => url === TOKEN_URL)).toHaveLength(0)
+  })
+
+  test('restores the shared custody manifest after temporary cleanup', () => {
+    expect(process.env.CLAUSTRUM_OPENCODE_HANDLES).toBe(originalManifestPath)
+  })
+
+  test('reconciles a real main without a resolved binding before serving OAuth', async () => {
+    const fetchCalls: Array<{ url: string; authorization: string | null }> = []
+    globalThis.fetch = mock((input: unknown, init?: RequestInit) => {
+      const request = input instanceof Request ? input : undefined
+      const headers = new Headers(init?.headers ?? request?.headers)
+      fetchCalls.push({
+        url: extractUrl(input as string | URL | Request),
+        authorization: headers.get('authorization'),
+      })
+      return Promise.resolve(new Response('{}', { status: 200 }))
+    }) as unknown as typeof fetch
+
+    await createTempStorage(
+      {
+        version: 1,
+        main: { type: 'opencode', provider: oauthFixture.provider },
+        claustrum: { mode: 'claustrum' },
+        refresh: { enabled: true },
+        quota: { enabled: true },
+        accounts: [],
+      },
+      async () => {
+        const plugin = (await AnthropicAuthPlugin(
+          // @ts-expect-error: minimal mock for testing
+          { client: createMockClient() },
+          disabledTimerOverrides(),
+        )) as any
+        const loaded = await plugin.auth.loader(
+          () =>
+            Promise.resolve({
+              type: 'oauth' as const,
+              access: 'real-local-access',
+              refresh: 'real-local-refresh',
+              expires: Date.now() + 60_000,
+            }),
+          { models: {} } as never,
+        )
+
+        await expect(
+          loaded.fetch('https://api.anthropic.com/v1/messages', {
+            method: 'POST',
+            body: '{}',
+          }),
+        ).rejects.toMatchObject({
+          code: 'custody_state_mismatch',
+          verdict: 'TAKEOVER_INCOMPLETE_MAIN_REAL',
+        })
+        expect(fetchCalls).toEqual([])
+        await plugin.dispose?.()
+      },
+    )
+  })
+
+  test('refuses Claude Pro/Max login before authorization while claustrum is committed', async () => {
+    const authorizeImpl = mock(() =>
+      Promise.resolve({
+        url: 'https://example.test/authorize',
+        redirectUri: 'http://localhost/callback',
+        state: 'state',
+        verifier: 'verifier',
+      }),
+    )
+    const findProMaxMethod = (plugin: any) => {
+      const method = plugin.auth.methods.find(
+        (candidate: { label: string }) => candidate.label === 'Claude Pro/Max',
+      )
+      if (!method) throw new Error('missing Claude Pro/Max method')
+      return method
+    }
+    const storage = (mode: 'claustrum' | 'local') => ({
+      version: 1,
+      main: { type: 'opencode', provider: oauthFixture.provider },
+      claustrum: { mode },
+      refresh: { enabled: false },
+      quota: { enabled: false },
+      accounts: [],
+    })
+
+    await createTempStorage(storage('claustrum'), async () => {
+      const plugin = (await AnthropicAuthPlugin(
+        // @ts-expect-error: minimal mock for testing
+        { client: createMockClient() },
+        { ...disabledTimerOverrides(), authorize: authorizeImpl } as any,
+      )) as any
+      await expect(findProMaxMethod(plugin).authorize()).rejects.toThrow(
+        'Exit Claustrum mode first: /claude-account local',
+      )
+      expect(authorizeImpl).not.toHaveBeenCalled()
+      await plugin.dispose?.()
+    })
+
+    await createTempStorage(storage('local'), async () => {
+      const plugin = (await AnthropicAuthPlugin(
+        // @ts-expect-error: minimal mock for testing
+        { client: createMockClient() },
+        { ...disabledTimerOverrides(), authorize: authorizeImpl } as any,
+      )) as any
+      await expect(findProMaxMethod(plugin).authorize()).resolves.toMatchObject(
+        {
+          url: 'https://example.test/authorize',
+        },
+      )
+      expect(authorizeImpl).toHaveBeenCalledTimes(1)
+      await plugin.dispose?.()
+    })
+  })
+
   test('fallback refresh rejects the tombstone without network or refresh classification', async () => {
     const fetchCalls: string[] = []
     const fetchImpl = mock((input: unknown) => {
diff --git a/packages/opencode/src/tests/index.test.ts b/packages/opencode/src/tests/index.test.ts
index 6a2f0e6e..ae237ba8 100644
--- a/packages/opencode/src/tests/index.test.ts
+++ b/packages/opencode/src/tests/index.test.ts
@@ -5,9 +5,12 @@ import {
   describe,
   expect,
   mock,
+  spyOn,
   test,
 } from 'bun:test'
+import { randomUUID } from 'node:crypto'
 import { readFileSync } from 'node:fs'
+import * as fs from 'node:fs/promises'
 import {
   chmod,
   mkdir,
@@ -15,18 +18,23 @@ import {
   readdir,
   readFile,
   rm,
+  utimes,
   writeFile,
 } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { dirname, join } from 'node:path'
 import {
+  __setCustodyManifestLockTestOptions,
   __setLogTestSink,
   type AccountStorage,
   acquireRefreshFileLock,
   buildPrimeRequestBody,
   buildRefreshOperationError,
   ClaudeOAuthRefreshError,
+  CustodyTombstoneRefreshError,
   clearClaustrumRefreshErrorPersistent,
+  custodyCredentialId,
+  custodyTombstoneOAuth,
   extractBillingHeaderCCH,
   FALLBACK_BACKGROUND_TICK_MS,
   getAccountStatePath,
@@ -41,7 +49,9 @@ import {
   type OAuthQuotaSnapshot,
   PARALLEL_TOOL_CALLS_SYSTEM_PROMPT,
   PROFILE_TTL_MS,
+  type ProviderAccountUuid,
   primeStorageFingerprint,
+  removeCustodyHandleManifestEntry,
   resetCache1hState,
   resetClaudeCodeIdentityCachesForTest,
   resetDumpState,
@@ -74,6 +84,14 @@ import {
   setSidebarState,
 } from '../sidebar-state'
 import { rewriteRequestBody } from '../transform.ts'
+import {
+  bootRuledClaustrumRow as bootSharedRuledClaustrumRow,
+  connectorFor,
+  credentialResponse,
+  manifestConnector,
+  ruledMainHandle,
+  writeManifest as writeSharedManifest,
+} from './custody-ruled-row.fixture'
 import {
   extractUrl,
   installDefaultFetchMock,
@@ -126,6 +144,10 @@ beforeEach(() => {
 
 afterEach(async () => {
   await cleanupTempConfigDirs()
+  process.env.CLAUSTRUM_OPENCODE_HANDLES = join(
+    process.env.OPENCODE_ANTHROPIC_AUTH_TEST_DIR!,
+    'handles.json',
+  )
 })
 
 afterAll(async () => {
@@ -581,6 +603,26 @@ async function waitForAccountStorage(
   throw new Error(`Account storage did not match: ${JSON.stringify(storage)}`)
 }
 
+async function waitForSidecarHandlesAbsent(
+  entries: Array<{ path: string; handle: string }>,
+) {
+  for (let attempt = 0; attempt < 100; attempt++) {
+    const sidecars = await Promise.all(
+      entries.map(({ path }) => readFile(path, 'utf8')),
+    )
+    if (
+      sidecars.every(
+        (sidecar, index) => !sidecar.includes(entries[index]!.handle),
+      )
+    )
+      return
+    await Bun.sleep(10)
+  }
+  throw new Error(
+    `Legacy handles remained in sidecars: ${entries.map(({ handle }) => handle).join(', ')}`,
+  )
+}
+
 async function seedSidebarRouting(
   activeId: string,
   route: string,
@@ -638,12 +680,14 @@ function fireConcurrentFetches(result: { fetch: typeof fetch }) {
 }
 
 type PluginRuntimeOverrides = Partial<{
+  authorize: typeof import('@cortexkit/anthropic-auth-core').authorize
   setTimeout: typeof globalThis.setTimeout
   setInterval: typeof globalThis.setInterval
   clearInterval: typeof globalThis.clearInterval
   claustrumConnector: (options: unknown) => Promise<unknown>
   claustrumNow: () => number
   clearClaustrumRefreshErrorPersistent: typeof clearClaustrumRefreshErrorPersistent
+  removeCustodyHandleManifestEntry: typeof removeCustodyHandleManifestEntry
 }>
 
 type TestTimerHandler = Parameters<typeof globalThis.setTimeout>[0]
@@ -962,6 +1006,17 @@ describe('fallback Claustrum credential resolution', () => {
 
   function fallbackWithClaustrum(overrides?: Record<string, unknown>) {
     const { claustrum, ...accountOverrides } = overrides ?? {}
+    const claustrumConfig =
+      claustrum && typeof claustrum === 'object'
+        ? (() => {
+            const { accounts: _legacyAccounts, ...config } =
+              claustrum as Record<string, unknown>
+            // An explicit mode wins; only an unspecified mode defaults to claustrum.
+            return { mode: 'claustrum', ...config }
+          })()
+        : claustrum === null
+          ? { mode: 'local' }
+          : { mode: 'claustrum' }
     const account = {
       id: 'fallback-1',
       type: 'oauth' as const,
@@ -973,2032 +1028,2859 @@ describe('fallback Claustrum credential resolution', () => {
     return createFallbackStorage({
       routing: { mode: 'fallback-first' },
       quota: { enabled: false, failClosedOnUnknownQuota: false },
-      claustrum: claustrum as AccountStorage['claustrum'],
+      claustrum: claustrumConfig as AccountStorage['claustrum'],
       accounts: [account as OAuthAccount],
     })
   }
 
-  function credentialResponse(
-    accessToken: string,
-    recordVersion: number,
-    expiresAtMs = Date.now() + 60_000,
-  ) {
-    return {
-      result: {
-        payload: Array.from(
-          new TextEncoder().encode(
-            JSON.stringify({ access_token: accessToken }),
-          ),
-        ),
-        expires_at_ms: expiresAtMs,
-        record_version: recordVersion,
-      },
+  async function configureClaustrumConnection() {
+    const connectionFile = join(tempConfigDir!, 'configured-claustrum.json')
+    await writeFile(
+      connectionFile,
+      JSON.stringify({
+        schema: 1,
+        wire_version: 1,
+        endpoints: [{ host: '127.0.0.1', port: 1234 }],
+      }),
+    )
+    const previous =
+      process.env.OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE
+    process.env.OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE =
+      connectionFile
+    return () => {
+      if (previous === undefined)
+        delete process.env.OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE
+      else
+        process.env.OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE = previous
     }
   }
 
-  function connectorFor(
-    calls: CredentialCall[],
-    handler: (method: string, params: Record<string, unknown>) => unknown,
-  ) {
-    return async () =>
-      ({
-        call: async (_moduleId: string, method: string, params: unknown) => {
-          const normalized = (params ?? {}) as Record<string, unknown>
-          calls.push({ method, params: normalized })
-          return handler(method, normalized)
-        },
-        close: () => {},
-      }) as never
+  const manifestHandle = `ckh_${'M'.repeat(43)}`
+  const legacyHandle = `ckh_${'L'.repeat(43)}`
+  function manifestStorage(input: {
+    id?: string
+    label: string
+    enabled?: boolean
+    gate?: boolean
+    legacy?: string
+    tombstone?: boolean
+  }) {
+    const id = input.id ?? 'fallback-1'
+    return fallbackWithClaustrum({
+      id,
+      label: input.label,
+      enabled: true,
+      ...(input.legacy && { claustrumHandle: input.legacy }),
+      ...(input.tombstone && custodyTombstoneOAuth('anthropic')),
+      claustrum: { mode: input.gate === false ? 'local' : 'claustrum' },
+      ...(input.enabled === false && { enabled: false }),
+    })
   }
 
-  async function clearAfterConcurrentSnapshot(
-    accountId: string,
-    handle: string,
-    concurrent: AccountStorage,
-    path: string,
-  ) {
-    const statePath = getAccountStatePath(path)
-    const staleState = await readFile(statePath, 'utf8')
-    const concurrentPath = join(dirname(path), `${accountId}-concurrent.json`)
-    await saveAccounts(concurrent, concurrentPath)
-    const concurrentConfig = await readFile(concurrentPath, 'utf8')
-    const concurrentState = await readFile(
-      getAccountStatePath(concurrentPath),
-      'utf8',
-    )
-    const configLock = await acquireRefreshFileLock({
-      name: 'config-write',
-      ttlMs: 10_000,
-      path,
-      renew: true,
+  const writeManifest = (
+    entries: Array<{ label: string; handle: string }>,
+    serve?: string,
+  ) => writeSharedManifest(tempConfigDir!, entries, serve)
+
+  const bootRuledClaustrumRow = (
+    options: Parameters<typeof bootSharedRuledClaustrumRow>[0],
+  ) =>
+    bootSharedRuledClaustrumRow({
+      ...options,
+      createFallbackStorage,
+      useTempAccountFile,
+      getPlugin: (accountStoragePath, runtimeOverrides) => {
+        process.env.OPENCODE_ANTHROPIC_AUTH_FILE = accountStoragePath
+        return getPlugin(undefined, undefined, runtimeOverrides as never)
+      },
+      extractUrl,
+      tempConfigDir: () => tempConfigDir!,
     })
-    if (!configLock) throw new Error('failed to hold account config lock')
 
-    await rm(statePath, { force: true })
-    const fifo = Bun.spawnSync(['mkfifo', statePath])
-    expect(fifo.exitCode).toBe(0)
-    const clearPromise = clearClaustrumRefreshErrorPersistent(
-      accountId,
-      handle,
-      path,
-    )
-    const writer = Bun.spawn([
-      process.execPath,
-      '--eval',
-      `import { writeFile } from 'node:fs/promises'; await writeFile(${JSON.stringify(statePath)}, ${JSON.stringify(staleState)}, 'utf8')`,
-    ])
-    let released = false
-    try {
-      const staleRead = await Promise.race([
-        writer.exited.then((code) => {
-          expect(code).toBe(0)
-          return true
-        }),
-        Bun.sleep(100).then(() => false),
-      ])
-      if (!staleRead) {
-        writer.kill()
-        await writer.exited
-      }
-      await rm(statePath, { force: true })
-      await writeFile(path, concurrentConfig, 'utf8')
-      await writeFile(statePath, concurrentState, 'utf8')
-      await configLock.release()
-      released = true
-      return await clearPromise
-    } finally {
-      writer.kill()
-      if (!released) await configLock.release()
-    }
-  }
+  describe('vault-served main routes generically', () => {
+    const fallbackHandle = `ckh_${'F'.repeat(43)}`
+    const request = (sessionId?: string) => ({
+      method: 'POST',
+      ...(sessionId && { headers: { 'x-session-affinity': sessionId } }),
+      body: JSON.stringify({
+        model: 'claude-opus-5',
+        max_tokens: 1,
+        messages: [{ role: 'user', content: 'hello' }],
+      }),
+    })
 
-  test.serial(
-    'backs off terminal route.open failures while logging their raw code',
-    async () => {
+    async function bootVaultMain(
+      options: {
+        routing?: AccountStorage['routing']
+        quota?: AccountStorage['quota']
+        killswitch?: AccountStorage['killswitch']
+        fallback?: boolean
+        mainAccountId?: ProviderAccountUuid
+        vaultAccountId?: string
+        responseStatus?: number
+        responseStatuses?: number[]
+        mainExpiresAt?: number
+        fallbackExpiresAt?: number
+      } = {},
+    ) {
+      let now = 1_000
+      const calls: CredentialCall[] = []
+      const authorizations: string[] = []
+      let mainSlotAccess = ''
+      let mainSlotExpires = 0
+      let mainExpiresAt = options.mainExpiresAt ?? 10_000
+      const fallback = options.fallback !== false
+      const responseStatuses = [...(options.responseStatuses ?? [])]
+      const checkedAt = Date.now()
+      const quota = options.quota ?? {
+        enabled: false,
+        failClosedOnUnknownQuota: false,
+      }
       await useTempAccountFile(
-        fallbackWithClaustrum({
-          claustrumHandle: 'terminal-route-open',
-          claustrum: { accounts: { 'fallback-1': { enabled: true } } },
+        createFallbackStorage({
+          claustrum: { mode: 'claustrum' },
+          routing: options.routing ?? { mode: 'main-first' },
+          quota,
+          ...(options.killswitch && { killswitch: options.killswitch }),
+          ...(options.mainAccountId && {
+            mainAccountId: options.mainAccountId,
+            main: {
+              type: 'opencode',
+              provider: 'anthropic',
+              profile: {
+                tier: 'default_claude_max_5x',
+                orgType: 'claude_team',
+                checkedAt,
+                providerAccountUuid: options.mainAccountId,
+              },
+            },
+          }),
+          accounts: fallback
+            ? [
+                {
+                  id: 'fallback-1',
+                  label: 'fallback',
+                  ...custodyTombstoneOAuth('anthropic'),
+                  quota: {
+                    checkedAt,
+                    five_hour: {
+                      usedPercent: 10,
+                      remainingPercent: 90,
+                      checkedAt,
+                    },
+                    seven_day: {
+                      usedPercent: 10,
+                      remainingPercent: 90,
+                      checkedAt,
+                    },
+                  },
+                },
+              ]
+            : [],
         }),
       )
-      const logs: LogTestRecord[] = []
-      __setLogTestSink((record) => logs.push(record))
-      let credentialGets = 0
-      const connector = async () =>
-        ({
-          call: async () => {
-            credentialGets += 1
-            throw new SubcCallError(
-              'terminal',
-              'route.open failed for module claustrum',
-              'missing_identity',
-            )
-          },
-          close: () => {},
-        }) as never
-      globalThis.fetch = mock((input: unknown) => {
+      await writeManifest([
+        { label: 'main', handle: manifestHandle },
+        ...(fallback ? [{ label: 'fallback', handle: fallbackHandle }] : []),
+      ])
+      globalThis.fetch = mock((input: unknown, init?: RequestInit) => {
         if (
-          extractUrl(input as string | URL | Request).startsWith(MESSAGES_URL)
+          extractUrl(input as string | URL | Request).includes('/v1/messages')
         ) {
-          return Promise.resolve(new Response('{}', { status: 200 }))
+          authorizations.push(
+            new Headers(init?.headers).get('authorization') ?? '',
+          )
+          return Promise.resolve(
+            new Response('{}', {
+              status: responseStatuses.shift() ?? options.responseStatus ?? 200,
+            }),
+          )
         }
-        return Promise.reject(
-          new Error(
-            `unexpected URL: ${extractUrl(input as string | URL | Request)}`,
-          ),
-        )
+        return Promise.resolve(new Response('{}', { status: 200 }))
       }) as unknown as typeof fetch
       const plugin = await getPlugin(undefined, undefined, {
-        claustrumConnector: connector,
-        claustrumNow: () => 0,
+        claustrumNow: () => now,
+        claustrumConnector: connectorFor(calls, (method, params) => {
+          if (method !== 'credential.get') return { result: {} }
+          const isMain = params.handle === manifestHandle
+          return credentialResponse(
+            isMain ? 'vault-main-access' : 'vault-fallback-access',
+            isMain ? 17 : 29,
+            isMain ? mainExpiresAt : (options.fallbackExpiresAt ?? 10_000),
+            isMain ? options.vaultAccountId : 'fallback-provider-account',
+          )
+        }),
       })
       const result = await plugin.auth.loader(
         () =>
           Promise.resolve({
-            type: 'oauth' as const,
-            access: 'main-access',
-            refresh: 'main-refresh',
-            expires: Date.now() + 100_000,
-          }),
+            ...custodyTombstoneOAuth('anthropic'),
+            ...(mainSlotAccess && {
+              access: mainSlotAccess,
+              expires: mainSlotExpires,
+            }),
+          } as never),
         { models: {} },
       )
+      return {
+        plugin,
+        result,
+        calls,
+        authorizations,
+        setNow(value: number) {
+          now = value
+        },
+        setMainSlotAccess(value: string) {
+          mainSlotAccess = value
+        },
+        setMainSlotExpires(value: number) {
+          mainSlotExpires = value
+        },
+        setMainExpiresAt(value: number) {
+          mainExpiresAt = value
+        },
+      }
+    }
 
-      for (let attempt = 0; attempt < 12; attempt++) {
-        const response = await result.fetch(MESSAGES_URL, EMPTY_POST)
+    test.serial(
+      'a refused vault main clears a legacy tombstone bearer before fallback routing',
+      async () => {
+        const fixture = await bootVaultMain({
+          routing: { mode: 'fallback-first' },
+          fallbackExpiresAt: 30_000,
+          responseStatuses: [429, 200],
+        })
+        fixture.setMainSlotAccess('claustrum-tombstone:v1:anthropic')
+        fixture.setMainSlotExpires(Date.now() + 30_000)
+        fixture.setMainExpiresAt(0)
+        fixture.setNow(20_000)
+        const response = await fixture.result.fetch(MESSAGES_URL, request())
+        expect(fixture.authorizations).toEqual([
+          'Bearer vault-fallback-access',
+          'Bearer vault-fallback-access',
+        ])
         expect(response.status).toBe(200)
-        await Bun.sleep(5)
-      }
+        expect(fixture.authorizations).not.toContain(
+          'Bearer claustrum-tombstone:v1:anthropic',
+        )
+        await fixture.plugin.dispose?.()
+      },
+    )
 
-      expect(credentialGets).toBe(1)
-      expect(logs).toContainEqual(
-        expect.objectContaining({
-          level: 'warn',
-          channel: 'claustrum',
-          message: 'terminal credential call failed',
-          payload: {
-            code: 'missing_identity',
-            message: 'route.open failed for module claustrum',
-          },
-        }),
-      )
-      await plugin.dispose?.()
-      await drainSidebarWrites()
-      __setLogTestSink(null)
-    },
-  )
+    test.serial(
+      'fallback-first sends the bound fallback credential',
+      async () => {
+        const fixture = await bootVaultMain({
+          routing: { mode: 'fallback-first' },
+        })
+        const response = await fixture.result.fetch(MESSAGES_URL, request())
+        expect(response.status).toBe(200)
+        expect(fixture.authorizations).toEqual(['Bearer vault-fallback-access'])
+        await fixture.plugin.dispose?.()
+      },
+    )
 
-  test.serial(
-    'backs off latched vault probes until the next background tick',
-    async () => {
-      await useTempAccountFile(
-        fallbackWithClaustrum({
-          claustrumHandle: 'latched-warm-backoff',
-          claustrum: { accounts: { 'fallback-1': { enabled: true } } },
-        }),
-      )
-      let now = 0
-      let credentialGets = 0
-      const connector = async () =>
-        ({
-          call: async () => {
-            credentialGets += 1
-            return {
-              result: { error: { class: 'auth_required', code: 'latched' } },
-            }
+    test.serial('sticky-balanced keeps a fallback assignment', async () => {
+      const checkedAt = Date.now()
+      const fixture = await bootVaultMain({
+        routing: { mode: 'sticky-balanced' },
+        quota: {
+          enabled: true,
+          checkIntervalMinutes: 5,
+          minimumRemaining: { five_hour: 1, seven_day: 1 },
+          failClosedOnUnknownQuota: true,
+          mainQuota: {
+            checkedAt,
+            five_hour: { usedPercent: 100, remainingPercent: 0, checkedAt },
+            seven_day: { usedPercent: 10, remainingPercent: 90, checkedAt },
           },
-          close: () => {},
-        }) as never
-      globalThis.fetch = mock((input: unknown) => {
-        if (
-          extractUrl(input as string | URL | Request).startsWith(MESSAGES_URL)
-        ) {
-          return Promise.resolve(new Response('{}', { status: 200 }))
-        }
-        return Promise.reject(
-          new Error(
-            `unexpected URL: ${extractUrl(input as string | URL | Request)}`,
-          ),
-        )
-      }) as unknown as typeof fetch
-      const plugin = await getPlugin(undefined, undefined, {
-        claustrumConnector: connector,
-        claustrumNow: () => now,
+          mainQuotaCheckedAt: checkedAt,
+          mainQuotaToken: tokenFingerprint('vault-main-access'),
+        },
       })
-      const result = await plugin.auth.loader(
-        () =>
-          Promise.resolve({
-            type: 'oauth' as const,
-            access: 'main-access',
-            refresh: 'main-refresh',
-            expires: Date.now() + 100_000,
-          }),
-        { models: {} },
+      const response = await fixture.result.fetch(
+        MESSAGES_URL,
+        request('vault-main-sticky-fallback'),
       )
+      expect(response.status).toBe(200)
+      expect(fixture.authorizations).toEqual(['Bearer vault-fallback-access'])
+      await fixture.plugin.dispose?.()
+    })
 
-      for (let attempt = 0; attempt < 12; attempt++) {
-        const response = await result.fetch(MESSAGES_URL, EMPTY_POST)
+    test.serial(
+      'a killswitch-tripped main yields to the fallback',
+      async () => {
+        const checkedAt = Date.now()
+        const fixture = await bootVaultMain({
+          quota: {
+            enabled: true,
+            checkIntervalMinutes: 5,
+            minimumRemaining: { five_hour: 1, seven_day: 1 },
+            failClosedOnUnknownQuota: true,
+            mainQuota: {
+              checkedAt,
+              five_hour: { usedPercent: 98, remainingPercent: 2, checkedAt },
+              seven_day: { usedPercent: 10, remainingPercent: 90, checkedAt },
+            },
+            mainQuotaCheckedAt: checkedAt,
+            mainQuotaToken: tokenFingerprint('vault-main-access'),
+          },
+          killswitch: { enabled: true, main: { five_hour: 5, seven_day: 5 } },
+        })
+        const response = await fixture.result.fetch(MESSAGES_URL, request())
         expect(response.status).toBe(200)
-        await Bun.sleep(5)
-      }
-      expect(credentialGets).toBe(1)
+        expect(fixture.authorizations).toEqual(['Bearer vault-fallback-access'])
+        await fixture.plugin.dispose?.()
+      },
+    )
 
-      now = FALLBACK_BACKGROUND_TICK_MS + 1
-      const response = await result.fetch(MESSAGES_URL, EMPTY_POST)
+    test.serial('a cold main yields to a warm fallback', async () => {
+      const fixture = await bootVaultMain({ mainExpiresAt: 2_000 })
+      fixture.setNow(3_000)
+      const response = await fixture.result.fetch(MESSAGES_URL, request())
       expect(response.status).toBe(200)
-      for (let attempt = 0; attempt < 12 && credentialGets < 2; attempt++) {
-        await Bun.sleep(5)
-      }
-      expect(credentialGets).toBe(2)
-      await plugin.dispose?.()
-    },
-  )
-
-  test('background refresh leaves a live vault account untouched while refreshing a plain control', async () => {
-    const storage = fallbackWithClaustrum({
-      claustrumHandle: 'handle-live-refresh-gate',
-      claustrum: { accounts: { 'fallback-1': { enabled: true } } },
-    })
-    const vaultAccount = storage.accounts[0] as OAuthAccount
-    vaultAccount.expires = Date.now() - 1
-    storage.accounts.push({
-      id: 'plain-control',
-      type: 'oauth',
-      access: 'plain-access',
-      refresh: 'plain-refresh',
-      expires: Date.now() - 1,
+      expect(fixture.authorizations).toEqual(['Bearer vault-fallback-access'])
+      await fixture.plugin.dispose?.()
     })
-    await useTempAccountFile(storage)
 
-    const calls: CredentialCall[] = []
-    const refreshTokens: string[] = []
-    globalThis.fetch = mock((input: unknown, init?: RequestInit) => {
-      const url = extractUrl(input as string | URL | Request)
-      if (url === TOKEN_URL) {
-        const refreshToken = (
-          JSON.parse(String(init?.body)) as { refresh_token: string }
-        ).refresh_token
-        refreshTokens.push(refreshToken)
-        if (refreshToken === 'plain-refresh') {
-          return Promise.resolve(
-            new Response(
-              JSON.stringify({
-                access_token: 'plain-refreshed-access',
-                refresh_token: 'plain-refreshed-refresh',
-                expires_in: 86_400,
-              }),
-              { status: 200 },
-            ),
-          )
-        }
-        return Promise.resolve(
-          new Response('{"error":"invalid_grant"}', { status: 400 }),
+    test.serial(
+      'a cold main with no fallback keeps the typed refusal',
+      async () => {
+        const fixture = await bootVaultMain({
+          fallback: false,
+          mainExpiresAt: 2_000,
+        })
+        fixture.setNow(3_000)
+        const response = await fixture.result.fetch(MESSAGES_URL, request())
+        expect(response.status).toBe(503)
+        expect(await response.text()).toBe(
+          '{"type":"error","error":{"type":"api_error","code":"claustrum_main_unavailable","retryable":true,"message":"Claustrum main credential is cold; retry or run /claude-account local to leave custody and sign in again."}}',
         )
-      }
-      return Promise.resolve(new Response('{}', { status: 200 }))
-    }) as unknown as typeof fetch
-
-    const connector = connectorFor(calls, (method) => {
-      if (method === 'credential.get') {
-        return credentialResponse('vault-live-access', 17)
-      }
-      return { result: {} }
-    })
-    const plugin = await getPlugin(undefined, undefined, {
-      claustrumConnector: connector,
-    })
-    await waitForAccountStorage(
-      (candidate) =>
-        candidate?.accounts.some(
-          (account) =>
-            account.id === 'plain-control' &&
-            (account as OAuthAccount).access === 'plain-refreshed-access',
-        ) ?? false,
-    )
-
-    const saved = await loadAccounts()
-    const vault = saved?.accounts.find(
-      (account) => account.id === 'fallback-1',
-    ) as OAuthAccount
-    expect(refreshTokens).toEqual(['plain-refresh'])
-    expect(vault.lastRefreshError).toBeUndefined()
-    await plugin.dispose?.()
-  })
-
-  test('clearing a sidecar error does not roll back a concurrent routing change', async () => {
-    const accountId = 'routing-race'
-    const handle = 'handle-routing-race'
-    const storage = createFallbackStorage({
-      routing: { mode: 'main-first' },
-      claustrum: { accounts: { [accountId]: { enabled: true } } },
-      accounts: [
-        {
-          id: accountId,
-          type: 'oauth',
-          access: 'stored-access',
-          refresh: 'stored-refresh',
-          expires: Date.now() + 60_000,
-          claustrumHandle: handle,
-          lastRefreshError: persistedRefreshError(accountId),
-        },
-      ],
-    })
-    await useTempAccountFile(storage)
-    const path = process.env.OPENCODE_ANTHROPIC_AUTH_FILE!
-    const before = (await loadAccounts(path))?.accounts[0] as
-      | OAuthAccount
-      | undefined
-    expect(before?.lastRefreshError).toBeDefined()
-    const concurrent = structuredClone((await loadAccounts(path))!)
-    concurrent.routing = { mode: 'fallback-first' }
-
-    const clearResult = await clearAfterConcurrentSnapshot(
-      accountId,
-      handle,
-      concurrent,
-      path,
+        await fixture.plugin.dispose?.()
+      },
     )
 
-    const saved = await loadAccounts(path)
-    const account = saved?.accounts.find(
-      (candidate) => candidate.id === accountId,
-    ) as OAuthAccount | undefined
-    expect(clearResult).toBe(true)
-    expect(saved?.routing?.mode).toBe('fallback-first')
-    expect(account?.lastRefreshError).toBeUndefined()
-  })
-
-  test('clearing a sidecar error does not roll back a concurrent access-token change', async () => {
-    const accountId = 'credential-race'
-    const handle = 'handle-credential-race'
-    const storage = createFallbackStorage({
-      claustrum: { accounts: { [accountId]: { enabled: true } } },
-      accounts: [
-        {
-          id: accountId,
-          type: 'oauth',
-          access: 'old-access',
-          refresh: 'stored-refresh',
-          expires: Date.now() + 60_000,
-          claustrumHandle: handle,
-          lastRefreshError: persistedRefreshError(accountId),
-        },
-      ],
-    })
-    await useTempAccountFile(storage)
-    const path = process.env.OPENCODE_ANTHROPIC_AUTH_FILE!
-    const before = (await loadAccounts(path))?.accounts[0] as
-      | OAuthAccount
-      | undefined
-    expect(before?.lastRefreshError).toBeDefined()
-    const concurrent = structuredClone((await loadAccounts(path))!)
-    const account = concurrent.accounts.find(
-      (candidate) => candidate.id === accountId,
+    test.serial(
+      'a mismatched main with no fallback keeps the typed refusal',
+      async () => {
+        const fixture = await bootVaultMain({
+          fallback: false,
+          mainAccountId: 'persisted-main' as ProviderAccountUuid,
+          vaultAccountId: 'different-main',
+        })
+        const response = await fixture.result.fetch(MESSAGES_URL, request())
+        expect(response.status).toBe(503)
+        expect(await response.text()).toBe(
+          '{"type":"error","error":{"type":"api_error","code":"claustrum_main_identity_mismatch","retryable":false,"message":"Claustrum main credential identity differs from the persisted main identity; run ck auth set-identity."}}',
+        )
+        await fixture.plugin.dispose?.()
+      },
     )
-    if (account?.type !== 'oauth') throw new Error('missing OAuth account')
-    account.access = 'new-access-from-refresh'
 
-    const clearResult = await clearAfterConcurrentSnapshot(
-      accountId,
-      handle,
-      concurrent,
-      path,
+    test.serial(
+      'main-first serves the vault record and reports its 401 version',
+      async () => {
+        const fixture = await bootVaultMain({
+          fallback: false,
+          responseStatus: 401,
+        })
+        const response = await fixture.result.fetch(MESSAGES_URL, request())
+        expect(response.status).toBe(401)
+        expect(fixture.authorizations).toEqual(['Bearer vault-main-access'])
+        expect(fixture.calls).toContainEqual({
+          method: 'credential.report_auth_failure',
+          params: {
+            handle: manifestHandle,
+            provider_status: 401,
+            record_version: 17,
+            reporter_source: 'direct',
+          },
+        })
+        await fixture.plugin.dispose?.()
+      },
     )
 
-    const saved = await loadAccounts(path)
-    const savedAccount = saved?.accounts.find(
-      (candidate) => candidate.id === accountId,
-    ) as OAuthAccount | undefined
-    expect(clearResult).toBe(true)
-    expect(savedAccount?.type).toBe('oauth')
-    expect(savedAccount?.access).toBe('new-access-from-refresh')
-    expect(savedAccount?.lastRefreshError).toBeUndefined()
-  })
-
-  test('clears a persisted sidecar refresh error for an enabled Claustrum account', async () => {
-    const accountId = 'clear-control'
-    const handle = 'handle-clear-control'
-    await useTempAccountFile(
-      createFallbackStorage({
-        claustrum: { accounts: { [accountId]: { enabled: true } } },
-        accounts: [
-          {
-            id: accountId,
-            type: 'oauth',
-            access: 'stored-access',
-            refresh: 'stored-refresh',
-            expires: Date.now() + 60_000,
-            claustrumHandle: handle,
-            lastRefreshError: persistedRefreshError(accountId),
+    test.serial(
+      'fallback-first reports the fallback vault record after its 401',
+      async () => {
+        const fixture = await bootVaultMain({
+          routing: { mode: 'fallback-first' },
+          responseStatuses: [401, 200],
+        })
+        const response = await fixture.result.fetch(MESSAGES_URL, request())
+        expect(response.status).toBe(200)
+        expect(fixture.authorizations).toEqual([
+          'Bearer vault-fallback-access',
+          'Bearer vault-main-access',
+        ])
+        expect(fixture.calls).toContainEqual({
+          method: 'credential.report_auth_failure',
+          params: {
+            handle: fallbackHandle,
+            provider_status: 401,
+            record_version: 29,
+            reporter_source: 'direct',
           },
-        ],
-      }),
+        })
+        expect(fixture.calls).not.toContainEqual({
+          method: 'credential.report_auth_failure',
+          params: {
+            handle: manifestHandle,
+            provider_status: 401,
+            record_version: 17,
+            reporter_source: 'direct',
+          },
+        })
+        await fixture.plugin.dispose?.()
+      },
     )
-    const path = process.env.OPENCODE_ANTHROPIC_AUTH_FILE!
-    const before = (await loadAccounts(path))?.accounts[0] as
-      | OAuthAccount
-      | undefined
-    expect(before?.lastRefreshError).toBeDefined()
 
-    const clearResult = await clearClaustrumRefreshErrorPersistent(
-      accountId,
-      handle,
-      path,
+    test.serial(
+      'served main quota identity comes from the vault account id',
+      async () => {
+        const fixture = await bootVaultMain({
+          vaultAccountId: 'vault-main-account',
+        })
+        const response = await fixture.result.fetch(MESSAGES_URL, request())
+        expect(response.status).toBe(200)
+        expect(fixture.plugin.__mainProviderAccountUuidForTest()).toBe(
+          'vault-main-account',
+        )
+        await fixture.plugin.dispose?.()
+      },
     )
-
-    expect(clearResult).toBe(true)
-    const after = (await loadAccounts(path))?.accounts[0] as
-      | OAuthAccount
-      | undefined
-    expect(after?.lastRefreshError).toBeUndefined()
   })
 
-  test('does not take a locked clear on a clean warm vault request', async () => {
-    const accountId = 'clean-warm-request'
-    const handle = 'handle-clean-warm-request'
-    await useTempAccountFile(
-      createFallbackStorage({
-        routing: { mode: 'fallback-first' },
-        quota: { enabled: false, failClosedOnUnknownQuota: false },
-        claustrum: { accounts: { [accountId]: { enabled: true } } },
-        accounts: [
-          {
-            id: accountId,
-            type: 'oauth',
-            access: 'stored-access',
-            refresh: 'stored-refresh',
-            expires: Date.now() + 60_000,
-            claustrumHandle: handle,
-            quota: {
-              five_hour: {
-                usedPercent: 25,
-                remainingPercent: 75,
-                checkedAt: Date.now(),
-              },
-              seven_day: {
-                usedPercent: 30,
-                remainingPercent: 70,
-                checkedAt: Date.now(),
-              },
-            },
-          },
-        ],
-      }),
-    )
-
+  test.serial('warms a manifest-only handle at startup', async () => {
+    await useTempAccountFile(manifestStorage({ label: 'manifest-start' }))
+    await writeManifest([{ label: 'manifest-start', handle: manifestHandle }])
     const calls: CredentialCall[] = []
-    const clearCalls: string[] = []
-    const connector = connectorFor(calls, (method) => {
-      if (method === 'credential.get')
-        return credentialResponse('vault-access', 23)
-      return { result: {} }
-    })
-    const realClear = clearClaustrumRefreshErrorPersistent
     const plugin = await getPlugin(undefined, undefined, {
-      claustrumConnector: connector,
-      clearClaustrumRefreshErrorPersistent: async (...args) => {
-        clearCalls.push(args[0])
-        return realClear(...args)
-      },
+      claustrumConnector: manifestConnector(
+        calls,
+        new Map([[manifestHandle, 'startup-access']]),
+      ),
     })
-    clearCalls.length = 0
-
-    globalThis.fetch = mock((input: unknown, init?: RequestInit) => {
-      if (
-        extractUrl(input as string | URL | Request).includes('/v1/messages')
-      ) {
-        expect(new Headers(init?.headers).get('authorization')).toBe(
-          'Bearer vault-access',
-        )
-      }
-      return Promise.resolve(new Response('{}', { status: 200 }))
-    }) as unknown as typeof fetch
+    expect(
+      calls.filter((call) => call.method === 'credential.get'),
+    ).toHaveLength(1)
+    await plugin.dispose?.()
+  })
 
-    const result = await plugin.auth.loader(
-      () =>
-        Promise.resolve({
-          type: 'oauth' as const,
-          access: 'main-access',
-          refresh: 'main-refresh',
-          expires: Date.now() + 100_000,
+  test.serial(
+    'bounds a tombstoned main loader when the vault stays cold',
+    async () => {
+      await useTempAccountFile(
+        createFallbackStorage({
+          claustrum: { mode: 'claustrum' },
+          quota: { enabled: false },
+          accounts: [],
         }),
-      { models: {} },
-    )
-    const cleanResponse = await result.fetch(MESSAGES_URL, EMPTY_POST)
-    expect(cleanResponse.status).toBe(200)
-    expect(clearCalls).toHaveLength(0)
+      )
+      await writeManifest([{ label: 'main', handle: manifestHandle }])
+      let releaseCredential!: () => void
+      const credential = new Promise<unknown>((resolve) => {
+        releaseCredential = () =>
+          resolve(credentialResponse('late-main-access', 1))
+      })
+      const plugin = await getPlugin(undefined, undefined, {
+        claustrumConnector: connectorFor([], (method) =>
+          method === 'credential.get' ? credential : { result: {} },
+        ),
+      })
 
-    const withError = await loadAccounts()
-    const account = withError?.accounts.find(
-      (candidate) => candidate.id === accountId,
-    ) as OAuthAccount | undefined
-    if (!withError || !account) throw new Error('expected warm OAuth account')
-    account.lastRefreshError = persistedRefreshError(accountId)
-    await saveAccounts(withError)
-    const persisted = await loadAccounts()
-    expect(
-      (
-        persisted?.accounts.find((candidate) => candidate.id === accountId) as
-          | OAuthAccount
-          | undefined
-      )?.lastRefreshError,
-    ).toBeDefined()
+      try {
+        const startedAt = performance.now()
+        const result = (await withDeadlockGuard(
+          plugin.auth.loader(
+            () => Promise.resolve(custodyTombstoneOAuth('anthropic') as never),
+            { models: {} },
+          ),
+          150,
+          'tombstoned main loader exceeded 150ms',
+        )) as { fetch: typeof fetch }
+        expect(performance.now() - startedAt).toBeLessThan(150)
+        await expect(
+          result.fetch(MESSAGES_URL, EMPTY_POST),
+        ).rejects.toMatchObject({
+          code: 'custody_state_mismatch',
+          verdict: 'FAIL_CLOSED',
+        })
+      } finally {
+        releaseCredential()
+        await plugin.dispose?.()
+      }
+    },
+  )
 
-    const erroredResponse = await result.fetch(MESSAGES_URL, EMPTY_POST)
-    expect(erroredResponse.status).toBe(200)
-    await waitForAccountStorage(
-      (candidate) =>
-        (
-          candidate?.accounts.find((candidate) => candidate.id === accountId) as
-            | OAuthAccount
-            | undefined
-        )?.lastRefreshError === undefined,
-    )
-    expect(clearCalls).toEqual([accountId])
-    await plugin.dispose?.()
-  })
+  test.serial(
+    'holds fallback refresh when provisional custody is dark by fallback',
+    async () => {
+      await useTempAccountFile(manifestStorage({ label: 'boot-dark-fallback' }))
+      const intervals: unknown[] = []
+      const plugin = await getPlugin(undefined, undefined, {
+        setInterval: mock((handler: () => unknown) => {
+          intervals.push(handler)
+          return { unref() {} } as never
+        }) as never,
+      })
+      await expect(plugin.__fallbackRefreshReady).resolves.toBe('not-started')
+      expect(intervals).toEqual([])
+      await plugin.dispose?.()
+    },
+  )
 
-  test('leaves a plain OAuth account refresh error untouched', async () => {
-    const plainId = 'plain-oauth'
-    const controlId = 'enabled-control'
-    const plainError = persistedRefreshError(plainId)
-    const controlError = persistedRefreshError(controlId)
-    await useTempAccountFile(
-      createFallbackStorage({
-        claustrum: { accounts: { [controlId]: { enabled: true } } },
-        accounts: [
-          {
-            id: plainId,
-            type: 'oauth',
-            access: 'plain-access',
-            refresh: 'plain-refresh',
-            expires: Date.now() + 60_000,
-            lastRefreshError: plainError,
-          },
+  test.serial(
+    'holds fallback refresh for real Claustrum material before takeover resumes',
+    async () => {
+      const label = 'boot-real-fallback'
+      await useTempAccountFile(manifestStorage({ label }))
+      await writeManifest([
+        { label: 'main', handle: ruledMainHandle },
+        { label, handle: manifestHandle },
+      ])
+      const intervals: unknown[] = []
+      const plugin = await getPlugin(undefined, undefined, {
+        claustrumConnector: manifestConnector(
+          [],
+          new Map([
+            [ruledMainHandle, 'vault-main-access'],
+            [manifestHandle, 'startup-access'],
+          ]),
+        ),
+        setInterval: mock((handler: () => unknown) => {
+          intervals.push(handler)
+          return { unref() {} } as never
+        }) as never,
+      })
+      await expect(plugin.__fallbackRefreshReady).resolves.toBe('not-started')
+      expect(intervals).toEqual([])
+      const result = await plugin.auth.loader(
+        () => Promise.resolve(custodyTombstoneOAuth('anthropic') as never),
+        { models: {} },
+      )
+      await expect(
+        result.fetch(MESSAGES_URL, EMPTY_POST),
+      ).rejects.toMatchObject({
+        code: 'custody_state_mismatch',
+        verdict: 'RESUME_TAKEOVER',
+      })
+      await plugin.dispose?.()
+    },
+  )
+
+  test.serial(
+    'never writes host auth during custody mode transitions',
+    async () => {
+      // Rollback has no client handle and restores through this sidecar-save path.
+      for (const mode of ['claustrum', 'local'] as const) {
+        const mockClient = createMockClient()
+        await useTempAccountFile(
+          createFallbackStorage({
+            claustrum: { mode: 'local' },
+            accounts: [
+              {
+                id: 'fallback-1',
+                label: 'host-write-fallback',
+                type: 'oauth',
+                access: 'fallback-sidecar-access',
+                refresh: 'fallback-sidecar-refresh',
+                expires: Date.now() + 5 * 60 * 60_000,
+              },
+            ],
+          }),
+        )
+        await writeManifest([
+          { label: 'main', handle: ruledMainHandle },
+          { label: 'host-write-fallback', handle: manifestHandle },
+        ])
+        const plugin = await getPlugin(mockClient, undefined, {
+          claustrumConnector: connectorFor([], (method, params) => {
+            if (method !== 'credential.get') return { result: {} }
+            return credentialResponse(
+              params.handle === ruledMainHandle
+                ? 'vault-main-access'
+                : 'vault-fallback-access',
+              1,
+              Date.now() + 5 * 60 * 60_000,
+            )
+          }),
+        })
+        try {
+          const result = await plugin.auth.loader(
+            () => Promise.resolve(custodyTombstoneOAuth('anthropic') as never),
+            { models: {} },
+          )
+          await runCustodyCommand(plugin, `host-write-${mode}`, mode)
+          await result.fetch(MESSAGES_URL, EMPTY_POST).catch(() => undefined)
+          expect(mockClient.auth.set).not.toHaveBeenCalled()
+        } finally {
+          await plugin.dispose?.()
+        }
+      }
+    },
+  )
+
+  test.serial(
+    'keeps a cold bound fallback route-local while the vault main serves',
+    async () => {
+      const fixture = await bootRuledClaustrumRow({
+        route: 'main-exhausted',
+        fallbacks: [
           {
-            id: controlId,
-            type: 'oauth',
-            access: 'control-access',
-            refresh: 'control-refresh',
-            expires: Date.now() + 60_000,
-            claustrumHandle: 'handle-enabled-control',
-            lastRefreshError: controlError,
+            label: 'cold-fallback',
+            handle: manifestHandle,
+            access: 'unused-fallback-access',
           },
         ],
-      }),
-    )
-    const path = process.env.OPENCODE_ANTHROPIC_AUTH_FILE!
-    const before = await loadAccounts(path)
-    expect(
-      (
-        before?.accounts.find((account) => account.id === plainId) as
-          | OAuthAccount
-          | undefined
-      )?.lastRefreshError,
-    ).toEqual(plainError)
-    expect(
-      (
-        before?.accounts.find((account) => account.id === controlId) as
-          | OAuthAccount
-          | undefined
-      )?.lastRefreshError,
-    ).toEqual(controlError)
-
-    const plainResult = await clearClaustrumRefreshErrorPersistent(
-      plainId,
-      'not-configured',
-      path,
-    )
-    const controlResult = await clearClaustrumRefreshErrorPersistent(
-      controlId,
-      'handle-enabled-control',
-      path,
-    )
+        connector: (calls) =>
+          connectorFor(calls, (method, params) => {
+            if (method !== 'credential.get') return { result: {} }
+            return credentialResponse(
+              params.handle === ruledMainHandle
+                ? 'vault-main-access'
+                : 'cold-fallback-access',
+              1,
+              params.handle === ruledMainHandle ? Date.now() + 60_000 : 0,
+            )
+          }),
+      })
+      const response = await fixture.result.fetch(MESSAGES_URL, EMPTY_POST)
 
-    const saved = await loadAccounts(path)
-    const plain = saved?.accounts.find((account) => account.id === plainId) as
-      | OAuthAccount
-      | undefined
-    const control = saved?.accounts.find(
-      (account) => account.id === controlId,
-    ) as OAuthAccount | undefined
-    expect(plainResult).toBe(false)
-    expect(controlResult).toBe(true)
-    expect(plain?.lastRefreshError?.message).toBe(plainError.message)
-    expect(control?.lastRefreshError).toBeUndefined()
-  })
+      expect(response.status).toBe(200)
+      expect(fixture.authorizations).toEqual(['Bearer vault-main-access'])
+      await fixture.plugin.dispose?.()
+    },
+  )
 
-  test('custody override ignores a stale backoff after the sidecar refresh token rotates', async () => {
-    const now = Date.now()
-    const storage = fallbackWithClaustrum({
-      claustrumHandle: 'handle-rotated-sidecar',
-      claustrum: { accounts: { 'fallback-1': { enabled: true } } },
-    })
-    const account = storage.accounts[0] as OAuthAccount
-    account.expires = now - 1
-    account.refresh = 'rotated-sidecar-refresh'
-    account.lastRefreshError = buildRefreshOperationError({
-      error: new ClaudeOAuthRefreshError(400, '{"error":"invalid_grant"}'),
-      now,
-      accountIdentity: account.id,
-      refreshTokenFingerprint: tokenFingerprint('superseded-refresh'),
-    })
-    await useTempAccountFile(storage)
+  test.serial(
+    'holds a dark main at the loader before main refresh',
+    async () => {
+      await useTempAccountFile(
+        createFallbackStorage({
+          claustrum: { mode: 'claustrum' },
+          accounts: [],
+        }),
+      )
+      const intervals: unknown[] = []
+      const plugin = await getPlugin(undefined, undefined, {
+        setInterval: mock((handler: () => unknown) => {
+          intervals.push(handler)
+          return { unref() {} } as never
+        }) as never,
+      })
+      const baseline = intervals.length
+      const result = await plugin.auth.loader(
+        () => Promise.resolve(custodyTombstoneOAuth('anthropic') as never),
+        { models: {} },
+      )
+      expect(intervals).toHaveLength(baseline)
+      await expect(
+        result.fetch(MESSAGES_URL, EMPTY_POST),
+      ).rejects.toMatchObject({
+        code: 'custody_state_mismatch',
+        verdict: 'FAIL_CLOSED',
+      })
+      const payload = await runCustodyCommand(plugin, 'boot-dark-main', '')
+      expect(payload?.text).toContain('FAIL_CLOSED')
+      await plugin.dispose?.()
+    },
+  )
 
-    const calls: CredentialCall[] = []
-    const connector = connectorFor(calls, (method) => {
-      if (method === 'credential.get') throw new Error('vault unavailable')
-      return { result: {} }
-    })
-    let tokenCalls = 0
-    globalThis.fetch = mock((input: unknown) => {
-      const url = extractUrl(input as string | URL | Request)
-      if (url === TOKEN_URL) {
-        tokenCalls += 1
-        return Promise.resolve(
-          new Response(
-            JSON.stringify({
-              access_token: 'rotated-sidecar-access',
-              refresh_token: 'rotated-sidecar-refresh-2',
-              expires_in: 86_400,
-            }),
-            { status: 200 },
-          ),
+  test.serial(
+    'keeps LOCAL_SERVE refresh intervals and transport unchanged',
+    async () => {
+      await useTempAccountFile(
+        createFallbackStorage({ claustrum: { mode: 'local' } }),
+      )
+      const intervals: unknown[] = []
+      const authorizations: string[] = []
+      globalThis.fetch = mock((_input: unknown, init?: RequestInit) => {
+        authorizations.push(
+          new Headers(init?.headers).get('authorization') ?? '',
         )
-      }
+        return Promise.resolve(new Response('{}', { status: 200 }))
+      }) as unknown as typeof fetch
+      const plugin = await getPlugin(undefined, undefined, {
+        setInterval: mock((handler: () => unknown) => {
+          intervals.push(handler)
+          return { unref() {} } as never
+        }) as never,
+      })
+      const intervalsBeforeLoader = intervals.length
+      const result = await plugin.auth.loader(
+        () =>
+          Promise.resolve({
+            type: 'oauth' as const,
+            access: 'local-main-access',
+            refresh: 'local-main-refresh',
+            expires: Date.now() + 60_000,
+          }),
+        { models: {} },
+      )
+      const response = await result.fetch(MESSAGES_URL, EMPTY_POST)
+      expect(response.status).toBe(200)
+      expect(intervals).toHaveLength(intervalsBeforeLoader + 1)
+      expect(authorizations).toContain('Bearer local-main-access')
+      await plugin.dispose?.()
+    },
+  )
+
+  test.serial('keeps CLAUSTRUM_SERVE on the resident vault path', async () => {
+    await useTempAccountFile(
+      createFallbackStorage({ claustrum: { mode: 'claustrum' }, accounts: [] }),
+    )
+    await writeManifest([{ label: 'main', handle: manifestHandle }])
+    const intervals: unknown[] = []
+    const authorizations: string[] = []
+    globalThis.fetch = mock((_input: unknown, init?: RequestInit) => {
+      authorizations.push(new Headers(init?.headers).get('authorization') ?? '')
       return Promise.resolve(new Response('{}', { status: 200 }))
     }) as unknown as typeof fetch
-
     const plugin = await getPlugin(undefined, undefined, {
-      claustrumConnector: connector,
-      claustrumNow: () => now,
+      claustrumConnector: manifestConnector(
+        [],
+        new Map([[manifestHandle, 'vault-main-access']]),
+      ),
+      setInterval: mock((handler: () => unknown) => {
+        intervals.push(handler)
+        return { unref() {} } as never
+      }) as never,
     })
-    for (let attempt = 0; attempt < 50 && tokenCalls === 0; attempt++) {
-      await Bun.sleep(10)
-    }
-
-    expect(tokenCalls).toBe(1)
-    let refreshed: OAuthAccount | undefined
-    for (let attempt = 0; attempt < 50; attempt++) {
-      const saved = await loadAccounts(process.env.OPENCODE_ANTHROPIC_AUTH_FILE)
-      refreshed = saved?.accounts[0] as OAuthAccount | undefined
-      if (refreshed?.access === 'rotated-sidecar-access') break
-      await Bun.sleep(10)
-    }
-    expect(refreshed?.access).toBe('rotated-sidecar-access')
-    expect(refreshed?.lastRefreshError).toBeUndefined()
-    await plugin.dispose?.()
+    const intervalsBeforeLoader = intervals.length
+    const result = await plugin.auth.loader(
+      () => Promise.resolve(custodyTombstoneOAuth('anthropic') as never),
+      { models: {} },
+    )
+    const response = await result.fetch(MESSAGES_URL, EMPTY_POST)
+    expect(response.status).toBe(200)
+    expect(intervals).toHaveLength(intervalsBeforeLoader)
+    expect(authorizations).toContain('Bearer vault-main-access')
+    await plugin.dispose?.()
   })
 
-  test('attempts local refresh when a resident vault credential is expired during an outage', async () => {
-    let claustrumClock = 0
-    const storage = fallbackWithClaustrum({
-      claustrumHandle: 'handle-expired-resident',
-      claustrum: { accounts: { 'fallback-1': { enabled: true } } },
-    })
-    const account = storage.accounts[0] as OAuthAccount
-    account.expires = Date.now() - 1
-    account.lastRefreshError = buildRefreshOperationError({
-      error: new ClaudeOAuthRefreshError(400, '{"error":"invalid_grant"}'),
-      now: Date.now(),
-      accountIdentity: account.id,
-      refreshTokenFingerprint: tokenFingerprint('superseded-refresh'),
-    })
-    await useTempAccountFile(storage)
+  test.serial(
+    'warms a manifest-resolved main at loader startup and tick',
+    async () => {
+      await useTempAccountFile(
+        createFallbackStorage({
+          claustrum: { mode: 'claustrum' },
+          quota: { enabled: false },
+          accounts: [],
+        }),
+      )
+      await writeManifest([{ label: 'main', handle: manifestHandle }])
+      const calls: CredentialCall[] = []
+      const ticks: Array<() => unknown> = []
+      const plugin = await getPlugin(undefined, undefined, {
+        claustrumConnector: manifestConnector(
+          calls,
+          new Map([[manifestHandle, 'main-vault-access']]),
+        ),
+        setInterval: mock((handler: () => unknown) => {
+          ticks.push(handler)
+          return { unref() {} } as never
+        }) as never,
+      })
+      await plugin.auth.loader(
+        () => Promise.resolve(custodyTombstoneOAuth('anthropic') as never),
+        { models: {} },
+      )
+      await ticks[0]?.()
 
-    const calls: CredentialCall[] = []
-    let credentialGets = 0
-    const connector = connectorFor(calls, (method) => {
-      if (method === 'credential.get') {
-        credentialGets += 1
-        if (credentialGets === 1) {
-          // The startup clock sees this entry as resident; the request clock sees
-          // the same entry as expired and must reopen the sidecar degradation path.
-          return credentialResponse('vault-expired-resident', 18, 1_000)
-        }
-        throw new Error('vault unavailable')
-      }
-      return { result: {} }
-    })
-    const authorizations: string[] = []
-    let tokenCalls = 0
-    globalThis.fetch = mock((input: unknown, init?: RequestInit) => {
-      const url = extractUrl(input as string | URL | Request)
-      if (url === TOKEN_URL) {
-        tokenCalls += 1
-        return Promise.resolve(
-          new Response(
-            JSON.stringify({
-              access_token: 'locally-refreshed-access',
-              refresh_token: 'locally-refreshed-refresh',
-              expires_in: 86_400,
+      const gets = calls.filter((call) => call.method === 'credential.get')
+      expect(gets).toHaveLength(2)
+      expect(gets).toEqual(
+        expect.arrayContaining([
+          expect.objectContaining({
+            params: expect.objectContaining({
+              handle: manifestHandle,
+              min_ttl_ms: 270 * 60_000,
             }),
-            { status: 200 },
-          ),
-        )
-      }
-      if (url.includes('/v1/messages')) {
+          }),
+        ]),
+      )
+      await plugin.dispose?.()
+    },
+  )
+
+  test.serial(
+    'a main 401 after a concurrent vault refresh is suppressed rather than blamed on the new record',
+    async () => {
+      await useTempAccountFile(
+        createFallbackStorage({
+          claustrum: { mode: 'claustrum' },
+          quota: { enabled: false },
+          accounts: [],
+        }),
+      )
+      await writeManifest([{ label: 'main', handle: manifestHandle }])
+      const calls: CredentialCall[] = []
+      const authorizations: string[] = []
+      let recordVersion = 7
+      let releaseFirstResponse!: () => void
+      const firstResponse = new Promise<Response>((resolve) => {
+        releaseFirstResponse = () =>
+          resolve(new Response('denied', { status: 401 }))
+      })
+      let firstRequestStarted!: () => void
+      const firstRequestStartedPromise = new Promise<void>((resolve) => {
+        firstRequestStarted = resolve
+      })
+      let messageRequests = 0
+      let claustrumNow = 0
+      globalThis.fetch = mock((_input: unknown, init?: RequestInit) => {
         authorizations.push(
           new Headers(init?.headers).get('authorization') ?? '',
         )
-      }
-      return Promise.resolve(new Response('{}', { status: 200 }))
-    }) as unknown as typeof fetch
+        messageRequests += 1
+        if (messageRequests === 1) {
+          firstRequestStarted()
+          return firstResponse
+        }
+        return Promise.resolve(new Response('denied', { status: 401 }))
+      }) as unknown as typeof fetch
+      const ticks: Array<() => unknown> = []
+      const plugin = await getPlugin(undefined, undefined, {
+        claustrumConnector: connectorFor(calls, (method) => {
+          if (method === 'credential.get') {
+            return credentialResponse(
+              `main-vault-access-v${recordVersion}`,
+              recordVersion,
+              claustrumNow + 1_000,
+            )
+          }
+          return { result: {} }
+        }),
+        claustrumNow: () => claustrumNow,
+        setInterval: mock((handler: () => unknown) => {
+          ticks.push(handler)
+          return { unref() {} } as never
+        }) as never,
+      })
+      const result = await plugin.auth.loader(
+        () => Promise.resolve(custodyTombstoneOAuth('anthropic') as never),
+        { models: {} },
+      )
 
-    const plugin = await getPlugin(undefined, undefined, {
-      claustrumConnector: connector,
-      claustrumNow: () => claustrumClock,
-    })
-    claustrumClock = 2_000
-    const result = await plugin.auth.loader(
-      () =>
-        Promise.resolve({
-          type: 'oauth' as const,
-          access: 'main-access',
-          refresh: 'main-refresh',
-          expires: Date.now() + 100_000,
+      const staleResponse = result.fetch(MESSAGES_URL, EMPTY_POST)
+      await firstRequestStartedPromise
+      claustrumNow = 2_000
+      recordVersion = 8
+      await plugin.auth.loader(
+        () => Promise.resolve(custodyTombstoneOAuth('anthropic') as never),
+        { models: {} },
+      )
+      releaseFirstResponse()
+
+      expect((await staleResponse).status).toBe(401)
+      expect(
+        calls.filter(
+          (call) => call.method === 'credential.report_auth_failure',
+        ),
+      ).toEqual([])
+
+      const currentResponse = await result.fetch(MESSAGES_URL, EMPTY_POST)
+      expect(currentResponse.status).toBe(401)
+      expect(authorizations).toEqual([
+        'Bearer main-vault-access-v7',
+        'Bearer main-vault-access-v8',
+      ])
+      expect(
+        calls.filter(
+          (call) => call.method === 'credential.report_auth_failure',
+        ),
+      ).toEqual([
+        expect.objectContaining({
+          params: expect.objectContaining({
+            handle: manifestHandle,
+            provider_status: 401,
+            record_version: 8,
+            reporter_source: 'direct',
+          }),
         }),
-      { models: {} },
-    )
+      ])
+      await plugin.dispose?.()
+    },
+  )
 
-    const response = await result.fetch(MESSAGES_URL, {
-      method: 'POST',
-      body: JSON.stringify({
-        model: 'claude-opus-5',
-        max_tokens: 1,
-        messages: [{ role: 'user', content: 'hello' }],
-      }),
-    })
+  test.serial(
+    'refuses a main vault credential whose identity differs from the persisted main identity',
+    async () => {
+      await useTempAccountFile(
+        createFallbackStorage({
+          claustrum: { mode: 'claustrum' },
+          mainAccountId: 'persisted-main-identity',
+          main: {
+            type: 'opencode',
+            provider: 'anthropic',
+            profile: {
+              tier: 'default_claude_max_5x',
+              orgType: 'claude_team',
+              checkedAt: Date.now(),
+              providerAccountUuid:
+                'persisted-main-identity' as ProviderAccountUuid,
+            },
+          },
+          quota: { enabled: false },
+          accounts: [],
+        }),
+      )
+      await writeManifest([{ label: 'main', handle: manifestHandle }])
+      const calls: CredentialCall[] = []
+      let messageSends = 0
+      globalThis.fetch = mock(() => {
+        messageSends += 1
+        return Promise.resolve(new Response('unexpected', { status: 200 }))
+      }) as unknown as typeof fetch
+      const plugin = await getPlugin(undefined, undefined, {
+        claustrumConnector: connectorFor(calls, (method) => {
+          if (method === 'credential.get')
+            return credentialResponse(
+              'main-vault-access',
+              8,
+              Date.now() + 60_000,
+              'different-vault-identity',
+            )
+          return { result: {} }
+        }),
+      })
+      const result = await plugin.auth.loader(
+        () => Promise.resolve(custodyTombstoneOAuth('anthropic') as never),
+        { models: {} },
+      )
 
-    expect(response.status).toBe(200)
-    expect(tokenCalls).toBe(1)
-    expect(authorizations).toEqual(['Bearer locally-refreshed-access'])
-    // The expiry-triggered warm refresh is detached from request handling.
-    for (let attempt = 0; attempt < 50 && credentialGets < 2; attempt++) {
-      await Bun.sleep(10)
-    }
-    expect(credentialGets).toBe(2)
-    await plugin.dispose?.()
-  })
+      const response = await result.fetch(MESSAGES_URL, EMPTY_POST)
 
-  test('clears a persisted sidecar refresh error when the vault later becomes resident', async () => {
-    const now = Date.now()
-    const plainPermanentError = buildRefreshOperationError({
-      error: new ClaudeOAuthRefreshError(400, '{"error":"invalid_grant"}'),
-      now,
-      accountIdentity: 'plain-control',
-    })
-    const storage = createFallbackStorage({
-      routing: { mode: 'fallback-first' },
-      quota: { enabled: false, failClosedOnUnknownQuota: false },
-      claustrum: { accounts: { 'vault-recovered': { enabled: true } } },
-      accounts: [
+      expect(response.status).toBe(503)
+      expect(await response.json()).toMatchObject({
+        error: { code: 'claustrum_main_identity_mismatch' },
+      })
+      expect(messageSends).toBe(0)
+      expect(
+        calls.filter((call) => call.method === 'credential.get'),
+      ).not.toHaveLength(0)
+      await plugin.dispose?.()
+    },
+  )
+
+  test.serial(
+    'unknown-identity is visible when either main identity side is absent',
+    async () => {
+      for (const fixture of [
         {
-          id: 'vault-recovered',
-          type: 'oauth',
-          access: 'expired-vault-access',
-          refresh: 'expired-vault-refresh',
-          expires: now - 1,
-          claustrumHandle: 'handle-vault-recovered',
+          name: 'persisted',
+          mainAccountId: undefined,
+          credentialAccountId: 'vault-main',
         },
         {
-          id: 'plain-control',
-          type: 'oauth',
-          access: 'plain-access',
-          refresh: 'plain-refresh',
-          expires: now + 5 * 60 * 60 * 1000,
-          lastRefreshError: plainPermanentError,
+          name: 'vault',
+          mainAccountId: undefined,
+          credentialAccountId: undefined,
         },
-      ],
-    })
-    await useTempAccountFile(storage)
+      ]) {
+        await useTempAccountFile(
+          createFallbackStorage({
+            claustrum: { mode: 'claustrum' },
+            mainAccountId: fixture.mainAccountId,
+            ...(fixture.name === 'vault' && {
+              main: {
+                type: 'opencode',
+                provider: 'anthropic',
+                profile: {
+                  tier: 'default_claude_max_5x',
+                  orgType: 'claude_team',
+                  checkedAt: Date.now(),
+                  providerAccountUuid: 'persisted-main' as ProviderAccountUuid,
+                },
+              },
+            }),
+            quota: { enabled: false },
+            accounts: [],
+          }),
+        )
+        await writeManifest([{ label: 'main', handle: manifestHandle }])
+        const client = createMockClient()
+        globalThis.fetch = mock(() =>
+          Promise.resolve(new Response('{}', { status: 200 })),
+        ) as unknown as typeof fetch
+        const plugin = await getPlugin(client, undefined, {
+          claustrumConnector: connectorFor([], (method) => {
+            if (method === 'credential.get')
+              return credentialResponse(
+                `sk-ant-oat01-main-vault-access-${fixture.name}`,
+                1,
+                Date.now() + 60_000,
+                fixture.credentialAccountId,
+              )
+            return { result: {} }
+          }),
+        })
+        const result = await plugin.auth.loader(
+          () => Promise.resolve(custodyTombstoneOAuth('anthropic') as never),
+          { models: {} },
+        )
 
-    const coldCalls: CredentialCall[] = []
-    const coldConnector = connectorFor(coldCalls, (method) => {
-      if (method === 'credential.get') throw new Error('vault unavailable')
-      return { result: {} }
-    })
-    let coldTokenCalls = 0
-    globalThis.fetch = mock((input: unknown) => {
-      const url = extractUrl(input as string | URL | Request)
-      if (url === TOKEN_URL) {
-        coldTokenCalls += 1
-        return Promise.resolve(
-          new Response('{"error":"invalid_grant"}', { status: 400 }),
+        const response = await result.fetch(MESSAGES_URL, EMPTY_POST)
+        expect(response.status).toBe(200)
+        const resolution = await plugin.__resolveMainQuotaIdentityForTest(
+          `sk-ant-oat01-main-vault-access-${fixture.name}`,
+        )
+        expect(resolution.state).toBe('unknown-identity')
+        await expectHandledCommandResponse(
+          plugin['command.execute.before']({
+            command: 'claude-account',
+            arguments: '',
+            sessionID: `unknown-main-identity-${fixture.name}`,
+          }),
         )
+        const text = (client.session.promptAsync as any).mock.calls.at(-1)?.[0]
+          ?.body.parts[0]?.text
+        expect(text).toContain('unknown identity')
+        await plugin.dispose?.()
       }
-      return Promise.resolve(new Response('{}', { status: 200 }))
-    }) as unknown as typeof fetch
-
-    const coldPlugin = await getPlugin(undefined, undefined, {
-      claustrumConnector: coldConnector,
-    })
-    await waitForAccountStorage(
-      (candidate) =>
-        (
-          candidate?.accounts.find(
-            (account) => account.id === 'vault-recovered',
-          ) as OAuthAccount | undefined
-        )?.lastRefreshError?.permanent === true,
-    )
-    expect(coldTokenCalls).toBe(1)
-    await coldPlugin.dispose?.()
+    },
+  )
 
-    const residentCalls: CredentialCall[] = []
-    const residentConnector = connectorFor(residentCalls, (method) => {
-      if (method === 'credential.get')
-        return credentialResponse('vault-recovered-access', 19)
-      return { result: {} }
-    })
-    const authorizations: string[] = []
-    globalThis.fetch = mock((input: unknown, init?: RequestInit) => {
-      const url = extractUrl(input as string | URL | Request)
-      if (url.includes('/v1/messages')) {
-        authorizations.push(
-          new Headers(init?.headers).get('authorization') ?? '',
+  test.serial(
+    'holds an unusable main tombstone dark before route-specific refusal',
+    async () => {
+      for (const fixture of [
+        {
+          name: 'reauth',
+          errorClass: 'auth_required',
+          code: 'claustrum_main_reauth',
+          retryable: false,
+          guidance: 'ck auth import --replace',
+        },
+        {
+          name: 'cold',
+          errorClass: 'transient',
+          code: 'claustrum_main_unavailable',
+          retryable: true,
+          guidance: 'retry',
+        },
+      ] as const) {
+        await useTempAccountFile(
+          createFallbackStorage({
+            claustrum: { mode: 'claustrum' },
+            quota: { enabled: false },
+            accounts: [],
+          }),
+        )
+        await writeManifest([{ label: 'main', handle: manifestHandle }])
+        const plugin = await getPlugin(undefined, undefined, {
+          claustrumConnector: connectorFor([], (method) => {
+            if (method === 'credential.get')
+              return {
+                result: {
+                  error: { class: fixture.errorClass, code: 'latched' },
+                },
+              }
+            return { result: {} }
+          }),
+        })
+        const result = await plugin.auth.loader(
+          () => Promise.resolve(custodyTombstoneOAuth('anthropic') as never),
+          { models: {} },
         )
+        await expect(
+          result.fetch(MESSAGES_URL, EMPTY_POST),
+        ).rejects.toMatchObject({
+          code: 'custody_state_mismatch',
+          verdict: 'FAIL_CLOSED',
+        })
+        await plugin.dispose?.()
       }
-      return Promise.resolve(new Response('{}', { status: 200 }))
-    }) as unknown as typeof fetch
+    },
+  )
 
-    const residentPlugin = await getPlugin(undefined, undefined, {
-      claustrumConnector: residentConnector,
-    })
-    const result = await residentPlugin.auth.loader(
-      () =>
-        Promise.resolve({
-          type: 'oauth' as const,
-          access: 'main-access',
-          refresh: 'main-refresh',
-          expires: now + 100_000,
-        }),
-      { models: {} },
-    )
-    const response = await result.fetch(MESSAGES_URL, {
-      method: 'POST',
-      body: JSON.stringify({
-        model: 'claude-opus-5',
-        max_tokens: 1,
-        messages: [{ role: 'user', content: 'hello' }],
-      }),
-    })
+  test.serial(
+    'prefers a manifest handle over a stale legacy handle',
+    async () => {
+      const fixture = await bootRuledClaustrumRow({
+        route: 'fallback-first',
+        fallbacks: [
+          {
+            label: 'manifest-wins',
+            handle: manifestHandle,
+            access: 'manifest-access',
+            account: { claustrumHandle: legacyHandle },
+          },
+        ],
+      })
+      await fixture.result.fetch(MESSAGES_URL, EMPTY_POST)
+      expect(fixture.authorizations).toContain('Bearer manifest-access')
+      await fixture.plugin.dispose?.()
+    },
+  )
 
-    const saved = await waitForAccountStorage(
-      (candidate) =>
-        (
-          candidate?.accounts.find(
-            (account) => account.id === 'vault-recovered',
-          ) as OAuthAccount | undefined
-        )?.lastRefreshError === undefined,
-    )
-    const plain = saved?.accounts.find(
-      (account) => account.id === 'plain-control',
-    ) as OAuthAccount
-    expect(response.status).toBe(200)
-    expect(authorizations).toEqual(['Bearer vault-recovered-access'])
-    expect(
-      residentCalls.filter((call) => call.method === 'credential.get'),
-    ).toHaveLength(1)
-    expect(plain.lastRefreshError?.permanent).toBe(true)
-    await residentPlugin.dispose?.()
-  })
+  test.serial(
+    'does not poll a handle minted after a fallback-driven dark boot',
+    async () => {
+      await useTempAccountFile(manifestStorage({ label: 'minted' }))
+      process.env.CLAUSTRUM_OPENCODE_HANDLES = join(
+        tempConfigDir!,
+        'handles.json',
+      )
+      const handlers: Array<() => unknown> = []
+      const calls: CredentialCall[] = []
+      const plugin = await getPlugin(undefined, undefined, {
+        claustrumConnector: manifestConnector(
+          calls,
+          new Map([[manifestHandle, 'minted-access']]),
+        ),
+        setInterval: mock((handler: () => unknown) => {
+          handlers.push(handler)
+          return { unref() {} } as never
+        }) as never,
+      })
+      const path = await writeManifest([
+        { label: 'minted', handle: manifestHandle },
+      ])
+      await utimes(path, new Date(), new Date(Date.now() + 1_000))
+      await Promise.all(handlers.map((handler) => handler()))
+      expect(
+        calls.filter((call) => call.method === 'credential.get'),
+      ).toHaveLength(0)
+      await plugin.dispose?.()
+    },
+  )
 
-  test('clears a late local refresh error on a subsequent warm vault request', async () => {
-    const accountId = 'vault-late-refresh-error'
-    const handle = 'handle-vault-late-refresh-error'
-    const now = Date.now()
-    const initialPermanentError = {
-      ...buildRefreshOperationError({
-        error: new ClaudeOAuthRefreshError(400, '{"error":"invalid_grant"}'),
-        now: now - 120_000,
-        accountIdentity: accountId,
-      }),
-      nextRetryAt: now - 1,
-    }
-    const storage = createFallbackStorage({
-      routing: { mode: 'fallback-first' },
-      quota: { enabled: false, failClosedOnUnknownQuota: false },
-      claustrum: { accounts: { [accountId]: { enabled: true } } },
-      accounts: [
+  test.serial('does not read the manifest during a request', async () => {
+    const fixture = await bootRuledClaustrumRow({
+      route: 'fallback-first',
+      fallbacks: [
         {
-          id: accountId,
-          type: 'oauth',
-          access: 'expired-vault-access',
-          refresh: 'expired-vault-refresh',
-          expires: now - 1,
-          claustrumHandle: handle,
-          lastRefreshError: initialPermanentError,
+          label: 'resident',
+          handle: manifestHandle,
+          access: 'resident-access',
         },
       ],
     })
-    await useTempAccountFile(storage)
-    const before = (await loadAccounts())?.accounts.find(
-      (account) => account.id === accountId,
-    ) as OAuthAccount | undefined
-    expect(before?.lastRefreshError?.permanent).toBe(true)
+    const manifestOpens = spyOn(fs, 'open')
+    await fs.writeFile(fixture.manifestPath, '{')
+    manifestOpens.mockClear()
+    await fixture.result.fetch(MESSAGES_URL, EMPTY_POST)
+    expect(manifestOpens).not.toHaveBeenCalled()
+    manifestOpens.mockRestore()
+    expect(fixture.authorizations).toContain('Bearer resident-access')
+    await fixture.plugin.dispose?.()
+  })
 
-    const releaseWarm = deferred()
-    const refreshStarted = deferred()
-    const releaseLocalRefresh = deferred()
-    const requestReachedVault = deferred()
-    const releaseResponse = deferred()
-    const calls: CredentialCall[] = []
-    const connector = connectorFor(calls, (method) => {
-      if (method === 'credential.get') {
-        return releaseWarm.promise.then(() =>
-          credentialResponse('vault-warm-access', 31),
-        )
-      }
-      return { result: {} }
-    })
-    const authorizations: string[] = []
-    globalThis.fetch = mock((input: unknown, init?: RequestInit) => {
-      const url = extractUrl(input as string | URL | Request)
-      if (url === TOKEN_URL) {
-        refreshStarted.resolve()
-        return releaseLocalRefresh.promise.then(
-          () => new Response('{"error":"invalid_grant"}', { status: 400 }),
-        )
-      }
-      if (url.includes('/v1/messages')) {
-        authorizations.push(
-          new Headers(init?.headers).get('authorization') ?? '',
-        )
-        requestReachedVault.resolve()
-        return releaseResponse.promise.then(
-          () => new Response('{}', { status: 200 }),
-        )
-      }
-      return Promise.resolve(new Response('{}', { status: 200 }))
-    }) as unknown as typeof fetch
+  test.serial(
+    'keeps a foreign manifest on sidecar and warns once',
+    async () => {
+      await useTempAccountFile(
+        manifestStorage({ label: 'foreign', legacy: legacyHandle }),
+      )
+      await writeManifest(
+        [{ label: 'foreign', handle: manifestHandle }],
+        'foreign',
+      )
+      const logs: LogTestRecord[] = []
+      __setLogTestSink((record) => logs.push(record))
+      const calls: CredentialCall[] = []
+      const handlers: Array<() => unknown> = []
+      const plugin = await getPlugin(undefined, undefined, {
+        claustrumConnector: manifestConnector(calls, new Map()),
+        setInterval: mock((handler: () => unknown) => {
+          handlers.push(handler)
+          return { unref() {} } as never
+        }) as never,
+      })
+      for (let tick = 0; tick < 3; tick++) await handlers.at(-1)?.()
+      expect(
+        calls.filter((call) => call.method === 'credential.get'),
+      ).toHaveLength(0)
+      expect(
+        logs.filter(
+          (record) =>
+            record.message === 'manifest handle resolution fallback' &&
+            record.payload?.reason === 'foreign-serve',
+        ),
+      ).toHaveLength(1)
+      await plugin.dispose?.()
+      __setLogTestSink(null)
+    },
+  )
 
+  test.serial('uses legacy on an invalid manifest and warns once', async () => {
+    await useTempAccountFile(
+      manifestStorage({ label: 'invalid', legacy: legacyHandle }),
+    )
+    const path = join(tempConfigDir!, 'handles.json')
+    await fs.writeFile(path, '{')
+    await fs.chmod(path, 0o600)
+    await fs.lstat(path)
+    process.env.CLAUSTRUM_OPENCODE_HANDLES = path
+    const logs: LogTestRecord[] = []
+    __setLogTestSink((record) => logs.push(record))
+    const calls: CredentialCall[] = []
+    const handlers: Array<() => unknown> = []
     const plugin = await getPlugin(undefined, undefined, {
-      claustrumConnector: connector,
+      claustrumConnector: manifestConnector(
+        calls,
+        new Map([[legacyHandle, 'legacy-access']]),
+      ),
+      setInterval: mock((handler: () => unknown) => {
+        handlers.push(handler)
+        return { unref() {} } as never
+      }) as never,
     })
-    await Promise.race([
-      refreshStarted.promise,
-      Bun.sleep(4_000).then(() => {
-        throw new Error(
-          'fallback refresh never reached the token stub; the eager refresh did not start',
-        )
-      }),
-    ])
-
-    releaseWarm.resolve()
-    await waitForAccountStorage(
-      (candidate) =>
-        (
-          candidate?.accounts.find((account) => account.id === accountId) as
-            | OAuthAccount
-            | undefined
-        )?.lastRefreshError === undefined,
-    )
-
-    const result = await plugin.auth.loader(
-      () =>
-        Promise.resolve({
-          type: 'oauth' as const,
-          access: 'main-access',
-          refresh: 'main-refresh',
-          expires: now + 100_000,
-        }),
-      { models: {} },
-    )
-
-    const responsePromise = result.fetch(MESSAGES_URL, EMPTY_POST)
-    await Promise.race([
-      requestReachedVault.promise,
-      Bun.sleep(4_000).then(() => {
-        throw new Error('vault request never reached the response stub')
-      }),
-    ])
-
-    releaseLocalRefresh.resolve()
-    const savedWithLateError = await waitForAccountStorage(
-      (candidate) =>
-        (
-          candidate?.accounts.find((account) => account.id === accountId) as
-            | OAuthAccount
-            | undefined
-        )?.lastRefreshError?.permanent === true,
-    )
+    for (let tick = 0; tick < 3; tick++) await handlers.at(-1)?.()
     expect(
-      (
-        savedWithLateError?.accounts.find(
-          (account) => account.id === accountId,
-        ) as OAuthAccount | undefined
-      )?.lastRefreshError,
-    ).toBeDefined()
-
-    releaseResponse.resolve()
-    const response = await responsePromise
-    expect(response.status).toBe(200)
-    expect(authorizations).toEqual(['Bearer vault-warm-access'])
+      calls.filter((call) => call.method === 'credential.get').length,
+    ).toBeGreaterThan(0)
     expect(
-      calls.filter((call) => call.method === 'credential.get'),
+      logs.filter(
+        (record) =>
+          record.message === 'manifest handle resolution fallback' &&
+          record.payload?.reason === 'invalid-manifest',
+      ),
     ).toHaveLength(1)
-
-    const savedAfterWarmRequest = await waitForAccountStorage(
-      (candidate) =>
-        (
-          candidate?.accounts.find((account) => account.id === accountId) as
-            | OAuthAccount
-            | undefined
-        )?.lastRefreshError === undefined,
-    )
-    expect(
-      (
-        savedAfterWarmRequest?.accounts.find(
-          (account) => account.id === accountId,
-        ) as OAuthAccount | undefined
-      )?.lastRefreshError,
-    ).toBeUndefined()
     await plugin.dispose?.()
+    __setLogTestSink(null)
   })
 
-  async function loadFallbackWithConnector(
-    storage: AccountStorage,
-    connector: (options: unknown) => Promise<unknown>,
-    response: Response | (() => Response),
-    runtimeOverrides: Record<string, unknown> = {},
-  ) {
-    await useTempAccountFile(storage)
-    const authorizations: string[] = []
-    globalThis.fetch = mock((input: unknown, init?: RequestInit) => {
-      if (
-        extractUrl(input as string | URL | Request).includes('/v1/messages')
-      ) {
-        authorizations.push(
-          new Headers(init?.headers).get('authorization') ?? '',
-        )
-      }
-      return Promise.resolve(
-        typeof response === 'function' ? response() : response.clone(),
-      )
-    }) as unknown as typeof fetch
-    const plugin = await getPlugin(undefined, undefined, {
-      claustrumConnector: connector,
-      ...runtimeOverrides,
-    })
-    const result = await plugin.auth.loader(
-      () =>
-        Promise.resolve({
-          type: 'oauth' as const,
-          access: 'main-access',
-          refresh: 'main-refresh',
-          expires: Date.now() + 100_000,
-        }),
-      { models: {} },
-    )
-    return { authorizations, plugin, result }
-  }
-
-  test('disabled gate does not connect and uses the stored token', async () => {
-    const calls: CredentialCall[] = []
-    let connectorCalls = 0
-    const storage = fallbackWithClaustrum({
-      claustrumHandle: 'handle-disabled',
-      claustrum: undefined,
-    })
-    const connector = async () => {
-      connectorCalls += 1
-      return connectorFor(calls, () => credentialResponse('vault-access', 1))()
-    }
+  test.serial(
+    'warms a manifest handle when claustrum mode is already committed',
+    async () => {
+      await useTempAccountFile(manifestStorage({ label: 'gate-after' }))
+      await writeManifest([{ label: 'gate-after', handle: manifestHandle }])
+      const handlers: Array<() => unknown> = []
+      const calls: CredentialCall[] = []
+      const plugin = await getPlugin(undefined, undefined, {
+        claustrumConnector: manifestConnector(
+          calls,
+          new Map([[manifestHandle, 'gate-access']]),
+        ),
+        setInterval: mock((handler: () => unknown) => {
+          handlers.push(handler)
+          return { unref() {} } as never
+        }) as never,
+      })
+      await Promise.all(handlers.map((handler) => handler()))
+      await waitForMockCall({ mock: { calls } })
+      expect(
+        calls.filter((call) => call.method === 'credential.get'),
+      ).toHaveLength(1)
+      await plugin.dispose?.()
+    },
+  )
 
-    const { authorizations, plugin, result } = await loadFallbackWithConnector(
-      storage,
-      connector,
-      new Response('{}', { status: 200 }),
-    )
-    const response = await result.fetch(MESSAGES_URL, EMPTY_POST)
+  test.serial(
+    'uses the current custody mode when a later loader receives a tombstone',
+    async () => {
+      await useTempAccountFile(
+        manifestStorage({ label: 'loader-current-mode' }),
+      )
+      const plugin = await getPlugin()
+      try {
+        const claustrumResult = await plugin.auth.loader(
+          () => Promise.resolve(custodyTombstoneOAuth('anthropic')),
+          { models: {} },
+        )
+        await expect(
+          claustrumResult.fetch('https://example.test', {}),
+        ).rejects.toMatchObject({
+          code: 'custody_state_mismatch',
+          verdict: 'FAIL_CLOSED',
+        })
 
-    expect(response.status).toBe(200)
-    expect(authorizations).toContain('Bearer stored-fallback-access')
-    expect(connectorCalls).toBe(0)
-    expect(calls).toEqual([])
-    await plugin.dispose?.()
-  })
+        await runCustodyCommand(plugin, 'loader-current-mode', 'local')
+        const localResult = await plugin.auth.loader(
+          () => Promise.resolve(custodyTombstoneOAuth('anthropic')),
+          { models: {} },
+        )
+        await expect(
+          localResult.fetch('https://example.test', {}),
+        ).rejects.toMatchObject({
+          code: 'custody_state_mismatch',
+          verdict: 'REMAIN_DARK_PENDING_LOGIN',
+        })
+      } finally {
+        await plugin.dispose?.()
+      }
+    },
+  )
 
-  test('account status inspects the configured Claustrum connection file', async () => {
-    const storage = createFallbackStorage({ accounts: [] })
-    await useTempAccountFile(storage)
-    const connectionFile = join(tempConfigDir!, 'configured-claustrum.json')
-    await writeFile(connectionFile, '{ not valid JSON')
-    const previousConnectionFile =
-      process.env.OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE
-    process.env.OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE =
-      connectionFile
+  test.serial(
+    'reports a warmed manifest-only handle as vault served',
+    async () => {
+      await useTempAccountFile(manifestStorage({ label: 'manifest-served' }))
+      await writeManifest([
+        { label: 'manifest-served', handle: manifestHandle },
+      ])
+      const plugin = await getPlugin(undefined, undefined, {
+        claustrumConnector: manifestConnector(
+          [],
+          new Map([[manifestHandle, 'manifest-served-access']]),
+        ),
+      })
+      await plugin.__fallbackRefreshReady
+      const payload = await runCustodyCommand(plugin, 'manifest-served', '')
+      const accounts = payload?.knobs.accounts as Array<{
+        id: string
+        vaultServed: boolean
+      }>
+      expect(
+        accounts.find((account) => account.id === 'fallback-1')?.vaultServed,
+      ).toBe(true)
+      await plugin.dispose?.()
+    },
+  )
 
-    try {
-      const mockClient = createMockClient()
-      const plugin = await getPlugin(mockClient)
-      await plugin.auth.loader(
-        () =>
-          Promise.resolve({
-            type: 'oauth' as const,
-            access: 'main-access',
-            refresh: 'main-refresh',
-            expires: Date.now() + 100_000,
+  test.serial(
+    'keeps a bound real fallback dark until takeover resumes',
+    async () => {
+      const refresh = 'bound-sidecar-refresh'
+      for (const mode of ['claustrum', 'local'] as const) {
+        const tokenRefreshes: string[] = []
+        const handlers: Array<() => unknown> = []
+        await useTempAccountFile(
+          createFallbackStorage({
+            claustrum: { mode },
+            routing: { mode: 'fallback-first' },
+            refresh: { enabled: true, refreshBeforeExpiryMinutes: 30 },
+            accounts: [
+              {
+                id: 'fallback-1',
+                label: 'bound-real',
+                type: 'oauth',
+                access: 'bound-sidecar-access',
+                refresh,
+                expires: Date.now() - 1,
+                claustrumHandle: manifestHandle,
+              },
+            ],
           }),
-        { models: {} },
-      )
+        )
+        await writeManifest([{ label: 'main', handle: ruledMainHandle }])
+        globalThis.fetch = mock((input: unknown, init?: RequestInit) => {
+          if (extractUrl(input as string | URL | Request) === TOKEN_URL) {
+            tokenRefreshes.push(
+              (JSON.parse(String(init?.body)) as { refresh_token: string })
+                .refresh_token,
+            )
+            return Promise.resolve(
+              Response.json({
+                access_token: 'refreshed-fallback-access',
+                refresh_token: 'refreshed-fallback-refresh',
+                expires_in: 3600,
+              }),
+            )
+          }
+          return Promise.resolve(new Response('{}', { status: 200 }))
+        }) as unknown as typeof fetch
+        const plugin = await getPlugin(undefined, undefined, {
+          setInterval: mock((handler: () => unknown) => {
+            handlers.push(handler)
+            return { unref() {} } as never
+          }) as never,
+          claustrumConnector: connectorFor([], (method, params) => {
+            if (method !== 'credential.get') return { result: {} }
+            return credentialResponse(
+              params.handle === ruledMainHandle
+                ? 'vault-main-access'
+                : 'vault-bound-access',
+              1,
+            )
+          }),
+        })
+        try {
+          const result = await plugin.auth.loader(
+            () =>
+              Promise.resolve(
+                mode === 'claustrum'
+                  ? custodyTombstoneOAuth('anthropic')
+                  : {
+                      type: 'oauth' as const,
+                      access: 'main-access',
+                      refresh: 'main-refresh',
+                      expires: Date.now() + 60_000,
+                    },
+              ),
+            { models: {} },
+          )
+          if (mode === 'claustrum') {
+            await expect(
+              result.fetch(MESSAGES_URL, EMPTY_POST),
+            ).rejects.toMatchObject({
+              code: 'custody_state_mismatch',
+              verdict: 'RESUME_TAKEOVER',
+            })
+            await handlers.at(-1)?.()
+            expect(tokenRefreshes).not.toContain(refresh)
+          } else {
+            await plugin.__fallbackRefreshReady
+            await handlers.at(-1)?.()
+            await result.fetch(MESSAGES_URL, EMPTY_POST)
+            await Bun.sleep(20)
+            expect(
+              tokenRefreshes.filter((token) => token === refresh),
+            ).toHaveLength(1)
+          }
+        } finally {
+          await plugin.dispose?.()
+        }
+      }
+    },
+  )
 
-      await expectHandledCommandResponse(
-        plugin['command.execute.before']({
-          command: 'claude-account',
-          arguments: '',
-          sessionID: 'configured-connection-status',
+  test.serial(
+    'writes the manifest before clearing a migrated legacy handle',
+    async () => {
+      await useTempAccountFile(
+        manifestStorage({
+          label: 'migration-order',
+          legacy: legacyHandle,
         }),
       )
-      const text = (mockClient.session.promptAsync as any).mock.calls.at(
-        -1,
-      )?.[0]?.body.parts[0]?.text
-      expect(text).toContain('- Claustrum: malformed')
-      await plugin.dispose?.()
-    } finally {
-      if (previousConnectionFile === undefined)
-        delete process.env.OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE
-      else
-        process.env.OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE =
-          previousConnectionFile
-    }
-  })
-
-  test('account modal payload projects Claustrum status through the real builder', async () => {
-    const sessionID = 'account-modal-projection'
-    const storage = fallbackWithClaustrum({
-      claustrumHandle: 'projection-handle',
-      claustrum: { accounts: { 'fallback-1': { enabled: true } } },
-    })
-    await useTempAccountFile(storage)
-    const connectionFile = join(tempConfigDir!, 'configured-claustrum.json')
-    await writeFile(
-      connectionFile,
-      JSON.stringify({
-        schema: 1,
-        wire_version: 1,
-        endpoints: [{ host: '127.0.0.1', port: 1234 }],
-      }),
-    )
-    const previousConnectionFile =
-      process.env.OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE
-    process.env.OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE =
-      connectionFile
+      const manifestPath = await writeManifest([])
+      const accountPath = process.env.OPENCODE_ANTHROPIC_AUTH_FILE!
+      const accountStatePath = getAccountStatePath(accountPath)
+      const restore = await configureClaustrumConnection()
+      const originalRename = fs.rename
+      let stateAtManifestWrite: string | undefined
+      const rename = spyOn(fs, 'rename').mockImplementation(
+        async (from, to) => {
+          if (to === manifestPath)
+            stateAtManifestWrite = await readFile(accountStatePath, 'utf8')
+          return originalRename(from, to)
+        },
+      )
+      try {
+        const plugin = await getPlugin(undefined, undefined, {
+          claustrumConnector: manifestConnector(
+            [],
+            new Map([[legacyHandle, 'migration-order-access']]),
+          ),
+        })
+        expect(stateAtManifestWrite).toContain(legacyHandle)
+        expect(await readFile(accountStatePath, 'utf8')).not.toContain(
+          legacyHandle,
+        )
+        expect(await readFile(accountPath, 'utf8')).not.toContain(legacyHandle)
+        expect(await readFile(manifestPath, 'utf8')).toContain(legacyHandle)
+        await plugin.dispose?.()
+      } finally {
+        rename.mockRestore()
+        restore()
+      }
+    },
+  )
 
-    try {
-      resetNotificationsForTest()
-      const plugin = await getPlugin(createMockClient(), tempConfigDir!)
-      await plugin.auth.loader(
-        () =>
-          Promise.resolve({
-            type: 'oauth' as const,
-            access: 'main-access',
-            refresh: 'main-refresh',
-            expires: Date.now() + 100_000,
-          }),
-        { models: {} },
+  test.serial(
+    'uses legacy when a manifest has no anthropic provider',
+    async () => {
+      await useTempAccountFile(
+        manifestStorage({ label: 'missing-provider', legacy: legacyHandle }),
       )
-      drainNotifications(0, sessionID)
-      await expectHandledCommandResponse(
-        plugin['command.execute.before']({
-          command: 'claude-account',
-          arguments: '',
-          sessionID,
+      await fs.writeFile(
+        join(tempConfigDir!, 'handles.json'),
+        JSON.stringify({
+          version: 1,
+          providers: [
+            {
+              provider: 'foreign',
+              serve: 'anthropic-auth',
+              accounts: [],
+            },
+          ],
         }),
       )
-      const notification = drainNotifications(0, sessionID).at(-1)
-      const payload = notification?.payload
-      const accounts = payload?.knobs.accounts as Array<{
-        id: string
-        claustrumGate: string
-        vaultServed: boolean
-      }>
-      expect(payload?.command).toBe('claude-account')
-      expect(payload?.knobs.claustrumDetection).toBe('available')
-      expect(
-        accounts.find((account) => account.id === 'main')?.claustrumGate,
-      ).toBe('na')
-      expect(
-        accounts.find((account) => account.id === 'fallback-1')?.claustrumGate,
-      ).toBe('on')
-      expect(
-        accounts.find((account) => account.id === 'fallback-1')?.vaultServed,
-      ).toBe(false)
+      const manifestPath = join(tempConfigDir!, 'handles.json')
+      await fs.chmod(manifestPath, 0o600)
+      process.env.CLAUSTRUM_OPENCODE_HANDLES = manifestPath
+      const calls: CredentialCall[] = []
+      const logs: LogTestRecord[] = []
+      __setLogTestSink((record) => logs.push(record))
+      try {
+        const plugin = await getPlugin(undefined, undefined, {
+          claustrumConnector: manifestConnector(
+            calls,
+            new Map([[legacyHandle, 'missing-provider-access']]),
+          ),
+        })
+        await plugin.__fallbackRefreshReady
+        expect(
+          calls.filter(
+            (call) =>
+              call.method === 'credential.get' &&
+              call.params.handle === legacyHandle,
+          ),
+        ).toHaveLength(1)
+        expect(
+          logs.filter(
+            (record) =>
+              record.message === 'manifest handle resolution fallback' &&
+              record.payload?.reason === 'legacy',
+          ),
+        ).toHaveLength(1)
+        await plugin.dispose?.()
+      } finally {
+        __setLogTestSink(null)
+      }
+    },
+  )
 
-      storage.claustrum = { accounts: { 'fallback-1': { enabled: false } } }
-      await saveAccounts(storage)
-      const offSessionID = 'account-modal-projection-off'
-      drainNotifications(0, offSessionID)
-      await expectHandledCommandResponse(
-        plugin['command.execute.before']({
-          command: 'claude-account',
-          arguments: '',
-          sessionID: offSessionID,
+  test.serial(
+    'keeps duplicate-label legacy handles out of the startup manifest migration',
+    async () => {
+      const label = 'duplicate-migration'
+      const firstHandle = `ckh_${'D'.repeat(43)}`
+      const secondHandle = `ckh_${'E'.repeat(43)}`
+      await useTempAccountFile(
+        createFallbackStorage({
+          claustrum: { mode: 'claustrum' },
+          accounts: [
+            {
+              id: 'duplicate-a',
+              label,
+              type: 'oauth',
+              access: 'first-access',
+              refresh: 'first-refresh',
+              expires: Date.now() + 5 * 60 * 60_000,
+              claustrumHandle: firstHandle,
+            },
+            {
+              id: 'duplicate-b',
+              label,
+              type: 'oauth',
+              enabled: false,
+              access: 'second-access',
+              refresh: 'second-refresh',
+              expires: Date.now() + 5 * 60 * 60_000,
+              claustrumHandle: secondHandle,
+            },
+          ],
         }),
       )
-      const offPayload = drainNotifications(0, offSessionID).at(-1)?.payload
-      const offAccounts = offPayload?.knobs.accounts as Array<{
-        id: string
-        claustrumGate: string
-      }>
-      expect(
-        offAccounts.find((account) => account.id === 'fallback-1')
-          ?.claustrumGate,
-      ).toBe('off')
-      await plugin.dispose?.()
-    } finally {
-      if (previousConnectionFile === undefined)
-        delete process.env.OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE
-      else
-        process.env.OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE =
-          previousConnectionFile
-    }
-  })
-
-  test('treats an empty Claustrum connection setting as unset', async () => {
-    const previousConnectionFile =
-      process.env.OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE
-
-    try {
-      for (const configuredConnectionFile of ['', ' \t']) {
-        process.env.OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE =
-          configuredConnectionFile
-        const calls: CredentialCall[] = []
-        let connectionFile: string | undefined
-        const connector = async (options: unknown) => {
-          connectionFile = (options as { connectionFile?: string })
-            .connectionFile
-          return connectorFor(calls, (method) => {
-            if (method === 'credential.get')
-              return credentialResponse('vault-empty-setting', 8)
-            return { result: {} }
-          })()
-        }
-        const { plugin } = await loadFallbackWithConnector(
-          fallbackWithClaustrum({
-            claustrumHandle: 'handle-empty-setting',
-            claustrum: { accounts: { 'fallback-1': { enabled: true } } },
-          } as never),
-          connector,
-          new Response('{}', { status: 200 }),
-        )
-
-        expect(connectionFile).toBe(getDefaultClaustrumConnectionPath())
+      const manifestPath = await writeManifest([])
+      const restore = await configureClaustrumConnection()
+      const logs: LogTestRecord[] = []
+      __setLogTestSink((record) => logs.push(record))
+      try {
+        const plugin = await getPlugin(undefined, undefined, {
+          claustrumConnector: manifestConnector(
+            [],
+            new Map([
+              [firstHandle, 'first-vault-access'],
+              [secondHandle, 'second-vault-access'],
+            ]),
+          ),
+        })
+        const persisted = await loadAccounts()
+        expect(
+          JSON.parse(await readFile(manifestPath, 'utf8')).providers[0]
+            .accounts,
+        ).toEqual([])
+        expect(
+          persisted?.accounts.map((account) =>
+            isOAuthAccount(account) ? account.claustrumHandle : undefined,
+          ),
+        ).toEqual([firstHandle, secondHandle])
+        expect(
+          logs.filter(
+            (record) =>
+              record.message ===
+                'skipping legacy handle migration for duplicate label' &&
+              record.payload?.label === label,
+          ),
+        ).toHaveLength(1)
         await plugin.dispose?.()
+      } finally {
+        __setLogTestSink(null)
+        restore()
       }
+    },
+  )
+
+  async function withShortManifestLockTiming<T>(fn: () => Promise<T>) {
+    __setCustodyManifestLockTestOptions({
+      ttlMs: 150,
+      retryMinMs: 5,
+      retryMaxMs: 5,
+    })
+    try {
+      return await fn()
     } finally {
-      if (previousConnectionFile === undefined)
-        delete process.env.OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE
-      else
-        process.env.OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE =
-          previousConnectionFile
+      __setCustodyManifestLockTestOptions()
     }
-  })
+  }
 
-  test('enabled gate serves the resident vault credential', async () => {
+  async function createLegacyMigrationPlugin(input: {
+    id?: string
+    label: string
+    handle: string
+    connector?: (
+      calls: CredentialCall[],
+    ) => PluginRuntimeOverrides['claustrumConnector']
+  }) {
+    await useTempAccountFile(
+      fallbackWithClaustrum({
+        id: input.id ?? 'fallback-1',
+        label: input.label,
+        enabled: true,
+        claustrumHandle: input.handle,
+        claustrum: { mode: 'claustrum' },
+      }),
+    )
+    const manifestPath = await writeManifest([])
+    const restore = await configureClaustrumConnection()
     const calls: CredentialCall[] = []
-    const storage = fallbackWithClaustrum({
-      claustrumHandle: 'handle-enabled',
-      claustrum: { accounts: { 'fallback-1': { enabled: true } } },
-    } as never)
-    const connector = connectorFor(calls, (method) => {
-      if (method === 'credential.get')
-        return credentialResponse('vault-access', 7)
-      return { result: {} }
+    const plugin = await getPlugin(undefined, undefined, {
+      claustrumConnector:
+        input.connector?.(calls) ??
+        manifestConnector(
+          calls,
+          new Map([[input.handle, `${input.label}-access`]]),
+        ),
     })
+    return { calls, manifestPath, plugin, restore }
+  }
 
-    const { authorizations, plugin, result } = await loadFallbackWithConnector(
-      storage,
-      connector,
-      new Response('{}', { status: 200 }),
-    )
-    expect(
-      calls.filter((call) => call.method === 'credential.get'),
-    ).toHaveLength(1)
-    const response = await result.fetch(MESSAGES_URL, EMPTY_POST)
+  test.serial(
+    'migrates a legacy handle into an empty manifest at startup',
+    async () => {
+      const { manifestPath, plugin, restore } =
+        await createLegacyMigrationPlugin({
+          label: 'startup-migration',
+          handle: legacyHandle,
+        })
+      try {
+        expect(
+          JSON.parse(await readFile(manifestPath, 'utf8')).providers[0]
+            .accounts,
+        ).toContainEqual({
+          label: 'startup-migration',
+          handle: legacyHandle,
+          credential_id: 'oauth:anthropic:startup-migration',
+        })
+        expect(
+          await readFile(process.env.OPENCODE_ANTHROPIC_AUTH_FILE!, 'utf8'),
+        ).not.toContain(legacyHandle)
+      } finally {
+        await plugin.dispose?.()
+        restore()
+      }
+    },
+  )
 
-    expect(response.status).toBe(200)
-    expect(authorizations).toContain('Bearer vault-access')
-    expect(authorizations).not.toContain('Bearer stored-fallback-access')
-    expect(
-      calls.filter((call) => call.method === 'credential.get'),
-    ).toHaveLength(1)
-    await plugin.dispose?.()
-  })
+  test.serial(
+    're-migrates a legacy handle after a crash when the mode is already claustrum',
+    async () => {
+      await useTempAccountFile(
+        manifestStorage({
+          label: 'retry-migration',
+          legacy: legacyHandle,
+        }),
+      )
+      const manifestPath = await writeManifest([])
+      const restore = await configureClaustrumConnection()
+      const calls: CredentialCall[] = []
+      const plugin = await getPlugin(undefined, undefined, {
+        claustrumConnector: manifestConnector(
+          calls,
+          new Map([[legacyHandle, 'retry-migration-access']]),
+        ),
+      })
+      try {
+        await plugin.__fallbackRefreshReady
+        expect(
+          JSON.parse(await readFile(manifestPath, 'utf8')).providers[0]
+            .accounts,
+        ).toContainEqual({
+          label: 'retry-migration',
+          handle: legacyHandle,
+          credential_id: 'oauth:anthropic:retry-migration',
+        })
+        expect(
+          await readFile(
+            getAccountStatePath(process.env.OPENCODE_ANTHROPIC_AUTH_FILE!),
+            'utf8',
+          ),
+        ).not.toContain(legacyHandle)
+      } finally {
+        await plugin.dispose?.()
+        restore()
+      }
+    },
+  )
 
-  test('does not use a JSON credential payload without a token as bearer auth', async () => {
-    const calls: CredentialCall[] = []
-    const malformedPayload = JSON.stringify({ kind: 'opaque-credential' })
-    const storage = fallbackWithClaustrum({
-      claustrumHandle: 'handle-malformed-payload',
-      claustrum: { accounts: { 'fallback-1': { enabled: true } } },
-    } as never)
-    const connector = connectorFor(calls, (method) => {
-      if (method === 'credential.get') {
-        return {
-          result: {
-            payload: Array.from(new TextEncoder().encode(malformedPayload)),
-            expires_at_ms: Date.now() + 60_000,
-            record_version: 8,
-          },
+  test.serial(
+    'clears a crash-left state handle when startup resolves from the manifest',
+    async () => {
+      const label = 'manifest-state-cleanup'
+      await useTempAccountFile(
+        manifestStorage({ label, legacy: legacyHandle, tombstone: true }),
+      )
+      await writeManifest([{ label, handle: manifestHandle }])
+      const restore = await configureClaustrumConnection()
+      const path = process.env.OPENCODE_ANTHROPIC_AUTH_FILE!
+      const statePath = getAccountStatePath(path)
+      expect(await readFile(statePath, 'utf8')).toContain(legacyHandle)
+      const plugin = await getPlugin(undefined, undefined, {
+        claustrumConnector: manifestConnector(
+          [],
+          new Map([[manifestHandle, 'manifest-state-cleanup-access']]),
+        ),
+      })
+      try {
+        await plugin.__fallbackRefreshReady
+        expect(await readFile(statePath, 'utf8')).not.toContain(legacyHandle)
+      } finally {
+        await plugin.dispose?.()
+        restore()
+      }
+    },
+  )
+
+  test.serial(
+    'clears a crash-left manifest-resolved state handle on the custody tick',
+    async () => {
+      const label = 'manifest-tick-cleanup'
+      await useTempAccountFile(
+        manifestStorage({ label, gate: true, tombstone: true }),
+      )
+      await writeManifest([{ label, handle: manifestHandle }])
+      const restore = await configureClaustrumConnection()
+      const intervalHandlers: Array<() => void> = []
+      const plugin = await getPlugin(undefined, undefined, {
+        setInterval: mock((handler: () => void) => {
+          intervalHandlers.push(handler)
+          return { unref() {} }
+        }) as unknown as typeof setInterval,
+        clearInterval: mock(() => {}) as unknown as typeof clearInterval,
+        claustrumConnector: manifestConnector(
+          [],
+          new Map([[manifestHandle, 'manifest-tick-cleanup-access']]),
+        ),
+      })
+      try {
+        await plugin.__fallbackRefreshReady
+        const path = process.env.OPENCODE_ANTHROPIC_AUTH_FILE!
+        const storage = JSON.parse(await readFile(path, 'utf8')) as {
+          accounts: Array<Record<string, unknown>>
+        }
+        const account = storage.accounts.find(
+          (candidate) => candidate.id === 'fallback-1',
+        )!
+        account.claustrumHandle = legacyHandle
+        delete account.access
+        delete account.expires
+        await writeFile(path, JSON.stringify(storage))
+        expect(await readFile(path, 'utf8')).toContain(legacyHandle)
+
+        expect(intervalHandlers.length).toBeGreaterThan(0)
+        for (const handler of intervalHandlers) handler()
+        for (let attempt = 0; attempt < 100; attempt++) {
+          if (!(await readFile(path, 'utf8')).includes(legacyHandle)) break
+          await Bun.sleep(10)
         }
+        expect(await readFile(path, 'utf8')).not.toContain(legacyHandle)
+      } finally {
+        await plugin.dispose?.()
+        restore()
       }
-      return { result: {} }
-    })
+    },
+  )
 
-    const { authorizations, plugin, result } = await loadFallbackWithConnector(
-      storage,
-      connector,
-      new Response('{}', { status: 401 }),
-    )
-    const response = await result.fetch(MESSAGES_URL, EMPTY_POST)
+  test.serial(
+    'skips an invalid-label legacy migration without leaving claustrum mode',
+    async () => {
+      await useTempAccountFile(
+        manifestStorage({
+          label: 'Work',
+          legacy: legacyHandle,
+        }),
+      )
+      const manifestPath = await writeManifest([])
+      const restore = await configureClaustrumConnection()
+      const logs: LogTestRecord[] = []
+      __setLogTestSink((record) => logs.push(record))
+      const plugin = await getPlugin(undefined, undefined, {
+        claustrumConnector: manifestConnector(
+          [],
+          new Map([[legacyHandle, 'invalid-label-access']]),
+        ),
+      })
+      try {
+        expect(
+          JSON.parse(await readFile(manifestPath, 'utf8')).providers[0]
+            .accounts,
+        ).toEqual([])
+        expect(
+          await readFile(
+            getAccountStatePath(process.env.OPENCODE_ANTHROPIC_AUTH_FILE!),
+            'utf8',
+          ),
+        ).toContain(legacyHandle)
+        expect((await loadAccounts())?.claustrum?.mode).toBe('claustrum')
+      } finally {
+        __setLogTestSink(null)
+        await plugin.dispose?.()
+        restore()
+      }
+    },
+  )
 
-    expect(response.status).toBe(401)
-    expect(authorizations).toContain('Bearer main-access')
-    expect(authorizations).toContain('Bearer stored-fallback-access')
-    expect(authorizations).not.toContain(`Bearer ${malformedPayload}`)
-    await plugin.dispose?.()
-  })
+  test.serial(
+    'reports a corrupt manifest lock after its bounded wait and keeps the legacy handle',
+    async () => {
+      await withShortManifestLockTiming(async () => {
+        await useTempAccountFile(
+          manifestStorage({ label: 'fresh-lock', legacy: legacyHandle }),
+        )
+        const manifestPath = await writeManifest([])
+        const restore = await configureClaustrumConnection()
+        const lockPath = `${manifestPath}.lock`
+        await mkdir(lockPath, { mode: 0o700 })
+        await writeFile(
+          join(lockPath, 'owner'),
+          `${JSON.stringify({ claimed_at_ms: Date.now(), tenant: 'test' })}\n`,
+        )
+        const logs: LogTestRecord[] = []
+        __setLogTestSink((record) => logs.push(record))
+        const startedAt = Date.now()
+        let plugin: Awaited<ReturnType<typeof getPlugin>> | undefined
+        try {
+          plugin = await Promise.race([
+            getPlugin(undefined, undefined, {
+              claustrumConnector: manifestConnector(
+                [],
+                new Map([[legacyHandle, 'fresh-lock-access']]),
+              ),
+            }),
+            Bun.sleep(1_000).then(() => {
+              throw new Error('manifest lock busy did not respect its deadline')
+            }),
+          ])
+          for (let attempt = 0; attempt < 100; attempt++) {
+            if (
+              logs.some(
+                (record) =>
+                  record.message === 'manifest write failed' &&
+                  record.payload?.reason === 'manifest lock owner invalid',
+              )
+            )
+              break
+            await Bun.sleep(10)
+          }
+          const elapsedMs = Date.now() - startedAt
+          expect(elapsedMs).toBeGreaterThanOrEqual(120)
+          expect(elapsedMs).toBeLessThan(1_000)
+          expect(
+            logs.some(
+              (record) =>
+                record.message === 'manifest write failed' &&
+                record.payload?.reason === 'manifest lock owner invalid',
+            ),
+          ).toBe(true)
+          expect(
+            await readFile(
+              getAccountStatePath(process.env.OPENCODE_ANTHROPIC_AUTH_FILE!),
+              'utf8',
+            ),
+          ).toContain(legacyHandle)
+        } finally {
+          __setLogTestSink(null)
+          await plugin?.dispose?.()
+          restore()
+        }
+      })
+    },
+  )
 
-  test('backs off repeated transport Claustrum warm failures per handle', async () => {
-    const calls: CredentialCall[] = []
-    const storage = fallbackWithClaustrum({
-      routing: { mode: 'fallback-first' },
-      claustrumHandle: 'handle-transient-backoff',
-      claustrum: { accounts: { 'fallback-1': { enabled: true } } },
-    } as never)
-    const connector = connectorFor(calls, (method) => {
-      if (method === 'credential.get') {
-        throw new Error('vault connection reset')
+  test.serial('renames a stale manifest lock before writing', async () => {
+    await withShortManifestLockTiming(async () => {
+      await useTempAccountFile(
+        manifestStorage({ label: 'stale-lock', legacy: legacyHandle }),
+      )
+      const manifestPath = await writeManifest([])
+      const restore = await configureClaustrumConnection()
+      const lockPath = `${manifestPath}.lock`
+      await mkdir(lockPath, { mode: 0o700 })
+      await writeFile(
+        join(lockPath, 'owner'),
+        `${JSON.stringify({
+          claimed_at_ms: Date.now() - 1_000,
+          nonce: 'stale-test',
+          tenant: 'test',
+        })}\n`,
+      )
+      const originalRename = fs.rename
+      const staleRenames: string[] = []
+      const rename = spyOn(fs, 'rename').mockImplementation(
+        async (from, to) => {
+          if (from === lockPath) staleRenames.push(String(to))
+          return originalRename(from, to)
+        },
+      )
+      try {
+        const plugin = await getPlugin(undefined, undefined, {
+          claustrumConnector: manifestConnector(
+            [],
+            new Map([[legacyHandle, 'stale-lock-access']]),
+          ),
+        })
+        expect(staleRenames).toHaveLength(1)
+        expect(staleRenames[0]).toMatch(/\.lock\.stale-\d+-[A-Za-z0-9_-]+$/)
+        await plugin.dispose?.()
+      } finally {
+        rename.mockRestore()
+        restore()
       }
-      return { result: {} }
     })
-    const { plugin, result } = await loadFallbackWithConnector(
-      storage,
-      connector,
-      new Response('{}', { status: 200 }),
-    )
-
-    const requestCount = 12
-    for (let index = 0; index < requestCount; index += 1) {
-      const response = await result.fetch(MESSAGES_URL, EMPTY_POST)
-      expect(response.status).toBe(200)
-      await Bun.sleep(10)
-    }
-
-    const credentialGets = calls.filter(
-      (call) => call.method === 'credential.get',
-    ).length
-    expect(credentialGets).toBeLessThan(requestCount)
-    expect(credentialGets).toBe(1)
-    await plugin.dispose?.()
   })
 
-  test('production cache construction supplies a bind identity to vault calls', async () => {
-    const storage = fallbackWithClaustrum({
-      claustrumHandle: 'handle-production-identity',
-      claustrum: { accounts: { 'fallback-1': { enabled: true } } },
-    } as never)
-    await useTempAccountFile(storage)
-    const wireCalls: Array<{
-      method: string
-      options?: Record<string, unknown>
-    }> = []
-    const connector = async () =>
-      ({
-        call: async (
-          _moduleId: string,
-          method: string,
-          _params: unknown,
-          options?: unknown,
-        ) => {
-          const normalizedOptions = (options ?? {}) as Record<string, unknown>
-          if (method === 'credential.get' && !normalizedOptions.identity) {
-            throw new Error('managed call requires a BindIdentity')
-          }
-          wireCalls.push({ method, options: normalizedOptions })
-          return credentialResponse('vault-production-access', 73)
+  test.serial(
+    'records manifest lock ownership during a migration write',
+    async () => {
+      await useTempAccountFile(
+        manifestStorage({ label: 'lock-owner', legacy: legacyHandle }),
+      )
+      const manifestPath = await writeManifest([])
+      const restore = await configureClaustrumConnection()
+      const lockPath = `${manifestPath}.lock`
+      const originalRename = fs.rename
+      let owner: Record<string, unknown> | undefined
+      const rename = spyOn(fs, 'rename').mockImplementation(
+        async (from, to) => {
+          if (to === manifestPath)
+            owner = JSON.parse(await readFile(join(lockPath, 'owner'), 'utf8'))
+          return originalRename(from, to)
         },
-        close: () => {},
-      }) as never
-
-    const plugin = await getPlugin(undefined, '/project-root', {
-      claustrumConnector: connector,
-    })
-    const identity = wireCalls.find((call) => call.method === 'credential.get')
-      ?.options?.identity as Record<string, unknown> | undefined
+      )
+      try {
+        const plugin = await getPlugin(undefined, undefined, {
+          claustrumConnector: manifestConnector(
+            [],
+            new Map([[legacyHandle, 'lock-owner-access']]),
+          ),
+        })
+        expect(owner).toMatchObject({ tenant: 'anthropic-auth' })
+        expect(typeof owner?.claimed_at_ms).toBe('number')
+        await expect(fs.stat(lockPath)).rejects.toThrow()
+        await plugin.dispose?.()
+      } finally {
+        rename.mockRestore()
+        restore()
+      }
+    },
+  )
 
-    expect(identity).toEqual({
-      project_root: '/project-root',
-      harness: 'opencode',
-      session: `store-${primeStorageFingerprint(
-        process.env.OPENCODE_ANTHROPIC_AUTH_FILE!,
-      )}`,
-    })
-    await plugin.dispose?.()
-  })
+  // Concurrent startup migrations must converge on both manifest entries and clear both legacy sidecars.
+  test.serial(
+    'preserves two concurrent legacy migrations in one manifest',
+    async () => {
+      await withShortManifestLockTiming(async () => {
+        const storageA = fallbackWithClaustrum({
+          id: 'fallback-a',
+          label: 'migration-a',
+          enabled: true,
+          claustrumHandle: `ckh_${'A'.repeat(43)}`,
+          claustrum: { mode: 'claustrum' },
+        })
+        await useTempAccountFile(storageA)
+        const accountPathA = process.env.OPENCODE_ANTHROPIC_AUTH_FILE!
+        const manifestPath = await writeManifest([])
+        const restore = await configureClaustrumConnection()
+        const entered = deferred()
+        const release = deferred()
+        let credentialGets = 0
+        const concurrentCalls: CredentialCall[] = []
+        const concurrentConnector = connectorFor(
+          concurrentCalls,
+          async (method, params) => {
+            if (method !== 'credential.get')
+              throw new Error(`unexpected method: ${method}`)
+            credentialGets += 1
+            if (credentialGets === 2) entered.resolve()
+            await release.promise
+            return credentialResponse(
+              `migration-${String(params.handle).at(-1)}-access`,
+              1,
+            )
+          },
+        )
+        const pluginA = await getPlugin(undefined, undefined, {
+          claustrumConnector: concurrentConnector,
+        })
 
-  test('sticky quota refresh prefers the vault credential over sidecar access', async () => {
-    const staleCheckedAt = Date.now() - 10 * 60 * 1000
-    const storage = createFallbackStorage({
-      routing: { mode: 'sticky-balanced' },
-      quota: {
-        enabled: true,
-        checkIntervalMinutes: 5,
-        minimumRemaining: { five_hour: 1, seven_day: 1 },
-        failClosedOnUnknownQuota: true,
-        mainQuota: {
-          five_hour: {
-            usedPercent: 100,
-            remainingPercent: 0,
-            checkedAt: Date.now(),
+        const accountPathB = join(tempConfigDir!, 'anthropic-auth-b.json')
+        const storageB = fallbackWithClaustrum({
+          id: 'fallback-b',
+          label: 'migration-b',
+          enabled: true,
+          claustrumHandle: `ckh_${'B'.repeat(43)}`,
+          claustrum: { mode: 'claustrum' },
+        })
+        await saveAccounts(storageB, accountPathB)
+        process.env.OPENCODE_ANTHROPIC_AUTH_FILE = accountPathB
+        process.env.OPENCODE_ANTHROPIC_AUTH_SIDEBAR_STATE_FILE = join(
+          tempConfigDir!,
+          'sidebar-state-b.json',
+        )
+        const pluginB = await getPlugin(undefined, undefined, {
+          claustrumConnector: concurrentConnector,
+        })
+        const originalRename = fs.rename
+        const secondManifestRename = deferred()
+        let manifestRenames = 0
+        const rename = spyOn(fs, 'rename').mockImplementation(
+          async (from, to) => {
+            if (to === manifestPath) {
+              manifestRenames += 1
+            }
+            const result = await originalRename(from, to)
+            if (to === manifestPath && manifestRenames === 2)
+              secondManifestRename.resolve()
+            return result
           },
-          seven_day: {
-            usedPercent: 100,
-            remainingPercent: 0,
-            checkedAt: Date.now(),
+        )
+        try {
+          await Promise.race([
+            entered.promise,
+            Bun.sleep(1_000).then(() => {
+              throw new Error(
+                `concurrent credential calls did not both start (${credentialGets})`,
+              )
+            }),
+          ])
+          release.resolve()
+          await Promise.race([
+            secondManifestRename.promise,
+            Bun.sleep(1_000).then(() => {
+              throw new Error('concurrent migrations did not finish')
+            }),
+          ])
+          const manifest = JSON.parse(await readFile(manifestPath, 'utf8')) as {
+            providers: Array<{
+              provider: string
+              accounts: Array<{ label: string }>
+            }>
+          }
+          expect(
+            manifest.providers
+              .find((provider) => provider.provider === 'anthropic')
+              ?.accounts.map((account) => account.label)
+              .sort(),
+          ).toEqual(['migration-a', 'migration-b'])
+          await waitForSidecarHandlesAbsent([
+            { path: getAccountStatePath(accountPathA), handle: 'ckh_A' },
+            { path: getAccountStatePath(accountPathB), handle: 'ckh_B' },
+          ])
+        } finally {
+          rename.mockRestore()
+          await pluginA.dispose?.()
+          await pluginB.dispose?.()
+          restore()
+        }
+      })
+    },
+  )
+
+  async function runCustodyCommand(
+    plugin: any,
+    sessionID: string,
+    argumentsText: string,
+  ) {
+    drainNotifications(0, sessionID)
+    await expectHandledCommandResponse(
+      plugin['command.execute.before']({
+        command: 'claude-account',
+        arguments: argumentsText,
+        sessionID,
+      }),
+    )
+    return drainNotifications(0, sessionID).at(-1)?.payload
+  }
+
+  async function clearAfterConcurrentSnapshot(
+    accountId: string,
+    handle: string,
+    concurrent: AccountStorage,
+    path: string,
+  ) {
+    const statePath = getAccountStatePath(path)
+    const staleState = await readFile(statePath, 'utf8')
+    const concurrentPath = join(dirname(path), `${accountId}-concurrent.json`)
+    await saveAccounts(concurrent, concurrentPath)
+    const concurrentConfig = await readFile(concurrentPath, 'utf8')
+    const concurrentState = await readFile(
+      getAccountStatePath(concurrentPath),
+      'utf8',
+    )
+    const configLock = await acquireRefreshFileLock({
+      name: 'config-write',
+      ttlMs: 10_000,
+      path,
+      renew: true,
+    })
+    if (!configLock) throw new Error('failed to hold account config lock')
+
+    await rm(statePath, { force: true })
+    const fifo = Bun.spawnSync(['mkfifo', statePath])
+    expect(fifo.exitCode).toBe(0)
+    const clearPromise = clearClaustrumRefreshErrorPersistent(
+      accountId,
+      handle,
+      path,
+    )
+    const writer = Bun.spawn([
+      process.execPath,
+      '--eval',
+      `import { writeFile } from 'node:fs/promises'; await writeFile(${JSON.stringify(statePath)}, ${JSON.stringify(staleState)}, 'utf8')`,
+    ])
+    let released = false
+    try {
+      const staleRead = await Promise.race([
+        writer.exited.then((code) => {
+          expect(code).toBe(0)
+          return true
+        }),
+        Bun.sleep(100).then(() => false),
+      ])
+      if (!staleRead) {
+        writer.kill()
+        await writer.exited
+      }
+      await rm(statePath, { force: true })
+      await writeFile(path, concurrentConfig, 'utf8')
+      await writeFile(statePath, concurrentState, 'utf8')
+      await configLock.release()
+      released = true
+      return await clearPromise
+    } finally {
+      writer.kill()
+      if (!released) await configLock.release()
+    }
+  }
+
+  test.serial(
+    'backs off terminal route.open failures while logging their raw code',
+    async () => {
+      const logs: LogTestRecord[] = []
+      __setLogTestSink((record) => logs.push(record))
+      let credentialGets = 0
+      let unavailable = false
+      const fallbackHandle = `ckh_${'T'.repeat(43)}`
+      const fixture = await bootRuledClaustrumRow({
+        route: 'fallback-first',
+        initialNow: 0,
+        response: new Response('{}', { status: 200 }),
+        fallbacks: [
+          {
+            label: 'terminal-route-open',
+            handle: fallbackHandle,
+            access: 'stored-fallback-access',
           },
-        },
-        mainQuotaCheckedAt: Date.now(),
-      },
-      claustrum: { accounts: { 'fallback-1': { enabled: true } } },
-      accounts: [
-        {
-          id: 'fallback-1',
-          type: 'oauth',
-          access: 'stale-sidecar-access',
-          refresh: 'fallback-refresh',
-          expires: Date.now() + 5 * 60 * 60 * 1000,
-          claustrumHandle: 'handle-sticky-quota',
-          quota: {
-            five_hour: {
-              usedPercent: 10,
-              remainingPercent: 90,
-              checkedAt: staleCheckedAt,
-            },
-            seven_day: {
-              usedPercent: 10,
-              remainingPercent: 90,
-              checkedAt: staleCheckedAt,
-            },
+        ],
+        connector: (calls) =>
+          connectorFor(calls, (method, params) => {
+            if (method !== 'credential.get') return { result: {} }
+            if (params.handle === ruledMainHandle)
+              return credentialResponse('vault-main-access', 1)
+            if (!unavailable)
+              return credentialResponse('vault-warm-access', 1, 1)
+            credentialGets += 1
+            throw new SubcCallError(
+              'terminal',
+              'route.open failed for module claustrum',
+              'missing_identity',
+            )
+          }),
+      })
+      unavailable = true
+      fixture.setNow(2)
+      fixture.plugin.__claustrumCredentialCache.invalidate(fallbackHandle)
+      await expect(
+        fixture.plugin.__claustrumCredentialCache.get(fallbackHandle),
+      ).rejects.toMatchObject({ code: 'missing_identity' })
+
+      for (let attempt = 0; attempt < 12; attempt++) {
+        const response = await fixture.result.fetch(MESSAGES_URL, EMPTY_POST)
+        expect(response.status).toBe(200)
+        await Bun.sleep(5)
+      }
+
+      expect(credentialGets).toBeLessThan(12)
+      expect(fixture.authorizations).toContain('Bearer vault-main-access')
+      expect(fixture.authorizations).not.toContain(
+        'Bearer stored-fallback-access',
+      )
+      expect(logs).toContainEqual(
+        expect.objectContaining({
+          level: 'warn',
+          channel: 'claustrum',
+          message: 'terminal credential call failed',
+          payload: {
+            code: 'missing_identity',
+            message: 'route.open failed for module claustrum',
           },
-        },
-      ],
+        }),
+      )
+      await fixture.plugin.dispose?.()
+      await drainSidebarWrites()
+      __setLogTestSink(null)
+    },
+  )
+
+  test.serial(
+    'backs off latched vault probes until the next background tick',
+    async () => {
+      let credentialGets = 0
+      let latched = false
+      const fallbackHandle = `ckh_${'L'.repeat(43)}`
+      const fixture = await bootRuledClaustrumRow({
+        route: 'fallback-first',
+        initialNow: 0,
+        response: new Response('{}', { status: 200 }),
+        fallbacks: [
+          {
+            label: 'latched-warm-backoff',
+            handle: fallbackHandle,
+            access: 'stored-fallback-access',
+          },
+        ],
+        connector: (calls) =>
+          connectorFor(calls, (method, params) => {
+            if (method !== 'credential.get') return { result: {} }
+            if (params.handle === ruledMainHandle)
+              return credentialResponse('vault-main-access', 1)
+            if (!latched) return credentialResponse('vault-warm-access', 1, 1)
+            credentialGets += 1
+            return {
+              result: { error: { class: 'auth_required', code: 'latched' } },
+            }
+          }),
+      })
+      latched = true
+      fixture.setNow(2)
+      fixture.plugin.__claustrumCredentialCache.invalidate(fallbackHandle)
+      await expect(
+        fixture.plugin.__claustrumCredentialCache.get(fallbackHandle),
+      ).rejects.toMatchObject({ code: 'latched' })
+
+      for (let attempt = 0; attempt < 12; attempt++) {
+        const response = await fixture.result.fetch(MESSAGES_URL, EMPTY_POST)
+        expect(response.status).toBe(200)
+        await Bun.sleep(5)
+      }
+      expect(credentialGets).toBeLessThan(12)
+      const probesBeforeBackgroundTick = credentialGets
+
+      fixture.setNow(FALLBACK_BACKGROUND_TICK_MS + 1)
+      const response = await fixture.result.fetch(MESSAGES_URL, EMPTY_POST)
+      expect(response.status).toBe(200)
+      await expect(
+        fixture.plugin.__claustrumCredentialCache.get(fallbackHandle),
+      ).rejects.toMatchObject({ code: 'latched' })
+      for (
+        let attempt = 0;
+        attempt < 12 && credentialGets <= probesBeforeBackgroundTick;
+        attempt++
+      ) {
+        await Bun.sleep(5)
+      }
+      expect(credentialGets).toBeGreaterThan(probesBeforeBackgroundTick)
+      expect(fixture.authorizations).toContain('Bearer vault-main-access')
+      expect(fixture.authorizations).not.toContain(
+        'Bearer stored-fallback-access',
+      )
+      await fixture.plugin.dispose?.()
+    },
+  )
+
+  test('dark fallback boot does not refresh a plain control beside a vault account', async () => {
+    const storage = fallbackWithClaustrum({
+      label: 'live-refresh-gate',
+      claustrumHandle: 'handle-live-refresh-gate',
+      claustrum: { mode: 'claustrum' },
     })
-    const calls: CredentialCall[] = []
-    const connector = connectorFor(calls, (method) => {
-      if (method === 'credential.get')
-        return credentialResponse('vault-fresh-access', 91)
-      return { result: {} }
+    const vaultAccount = storage.accounts[0] as OAuthAccount
+    vaultAccount.expires = Date.now() - 1
+    storage.accounts.push({
+      id: 'plain-control',
+      type: 'oauth',
+      access: 'plain-access',
+      refresh: 'plain-refresh',
+      expires: Date.now() - 1,
     })
     await useTempAccountFile(storage)
-    const messageAuthorizations: string[] = []
+    const refreshTokens: string[] = []
     globalThis.fetch = mock((input: unknown, init?: RequestInit) => {
       const url = extractUrl(input as string | URL | Request)
-      if (url.includes('/v1/messages')) {
-        messageAuthorizations.push(
-          new Headers(init?.headers).get('authorization') ?? '',
+      if (url === TOKEN_URL) {
+        const refreshToken = (
+          JSON.parse(String(init?.body)) as { refresh_token: string }
+        ).refresh_token
+        refreshTokens.push(refreshToken)
+        if (refreshToken === 'plain-refresh') {
+          return Promise.resolve(
+            new Response(
+              JSON.stringify({
+                access_token: 'plain-refreshed-access',
+                refresh_token: 'plain-refreshed-refresh',
+                expires_in: 86_400,
+              }),
+              { status: 200 },
+            ),
+          )
+        }
+        return Promise.resolve(
+          new Response('{"error":"invalid_grant"}', { status: 400 }),
         )
-        return Promise.resolve(new Response('{}', { status: 200 }))
       }
       return Promise.resolve(new Response('{}', { status: 200 }))
     }) as unknown as typeof fetch
 
-    const plugin = await getPlugin(undefined, undefined, {
-      claustrumConnector: connector,
+    const plugin = await getPlugin()
+    await expect(plugin.__fallbackRefreshReady).resolves.toBe('not-started')
+
+    const saved = await loadAccounts()
+    const vault = saved?.accounts.find(
+      (account) => account.id === 'fallback-1',
+    ) as OAuthAccount
+    expect(refreshTokens).toEqual([])
+    expect(vault.lastRefreshError).toBeUndefined()
+    await plugin.dispose?.()
+  })
+
+  test('clearing a sidecar error does not roll back a concurrent routing change', async () => {
+    const accountId = 'routing-race'
+    const handle = 'handle-routing-race'
+    const storage = createFallbackStorage({
+      routing: { mode: 'main-first' },
+      claustrum: { mode: 'claustrum' },
+      accounts: [
+        {
+          id: accountId,
+          type: 'oauth',
+          access: 'stored-access',
+          refresh: 'stored-refresh',
+          expires: Date.now() + 60_000,
+          claustrumHandle: handle,
+          lastRefreshError: persistedRefreshError(accountId),
+        },
+      ],
     })
-    await plugin.__fallbackRefreshReady
-    const quotaManager = plugin.__quotaManager as any
-    const originalGetFallback = quotaManager.getFallback.bind(quotaManager)
-    const quotaTokens: string[] = []
-    quotaManager.getFallback = (accountId: string, account?: unknown) => {
-      if (accountId === 'fallback-1') return undefined
-      return originalGetFallback(accountId, account)
-    }
-    quotaManager.refreshFallback = async (
-      _accountId: string,
-      accessToken: string,
-    ) => {
-      quotaTokens.push(accessToken)
-      return {
-        five_hour: {
-          usedPercent: 10,
-          remainingPercent: 90,
-          checkedAt: Date.now(),
-        },
-        seven_day: {
-          usedPercent: 10,
-          remainingPercent: 90,
-          checkedAt: Date.now(),
-        },
-      }
-    }
-    const result = await plugin.auth.loader(
-      () =>
-        Promise.resolve({
-          type: 'oauth' as const,
-          access: 'main-access',
-          refresh: 'main-refresh',
-          expires: Date.now() + 100_000,
-        }),
-      { models: {} },
-    )
-    const response = await result.fetch(MESSAGES_URL, {
-      method: 'POST',
-      headers: { 'x-session-affinity': 'sticky-quota-session' },
-      body: JSON.stringify({
-        model: 'claude-opus-5',
-        max_tokens: 1,
-        messages: [{ role: 'user', content: 'hello' }],
-      }),
-    })
-
-    expect(response.status).toBe(200)
-    expect(messageAuthorizations).toContain('Bearer vault-fresh-access')
-    expect(quotaTokens).toEqual(['vault-fresh-access'])
-    await plugin.dispose?.()
-  })
-
-  test('uses a fresh sidecar token without awaiting a slow vault refresh', async () => {
-    const calls: CredentialCall[] = []
-    const refreshEntered = deferred()
-    const refreshCompleted = deferred()
-    const slowRefresh = deferred()
-    const storage = fallbackWithClaustrum({
-      claustrumHandle: 'handle-slow',
-      claustrum: { accounts: { 'fallback-1': { enabled: true } } },
-    } as never)
-    let credentialGets = 0
-    const connector = connectorFor(calls, async (method) => {
-      if (method !== 'credential.get') return { result: {} }
-      credentialGets += 1
-      if (credentialGets === 1) {
-        return credentialResponse('vault-stale-access', 11, Date.now() + 1)
-      }
-      refreshEntered.resolve()
-      await slowRefresh.promise
-      refreshCompleted.resolve()
-      return credentialResponse('vault-refreshed-access', 12)
-    })
-    let tick!: () => Promise<unknown>
-    const setInterval = mock((callback: () => Promise<unknown>) => {
-      if (!tick) tick = callback
-      return { unref() {} } as unknown as ReturnType<typeof setInterval>
-    }) as unknown as typeof globalThis.setInterval
+    await useTempAccountFile(storage)
+    const path = process.env.OPENCODE_ANTHROPIC_AUTH_FILE!
+    const before = (await loadAccounts(path))?.accounts[0] as
+      | OAuthAccount
+      | undefined
+    expect(before?.lastRefreshError).toBeDefined()
+    const concurrent = structuredClone((await loadAccounts(path))!)
+    concurrent.routing = { mode: 'fallback-first' }
 
-    const { authorizations, plugin, result } = await loadFallbackWithConnector(
-      storage,
-      connector,
-      new Response('{}', { status: 200 }),
-      { setInterval },
+    const clearResult = await clearAfterConcurrentSnapshot(
+      accountId,
+      handle,
+      concurrent,
+      path,
     )
-    void tick()
-    await refreshEntered.promise
-    const response = await result.fetch(MESSAGES_URL, EMPTY_POST)
 
-    expect(response.status).toBe(200)
-    expect(authorizations).toContain('Bearer stored-fallback-access')
-    slowRefresh.resolve()
-    await refreshCompleted.promise
-    await plugin.dispose?.()
+    const saved = await loadAccounts(path)
+    const account = saved?.accounts.find(
+      (candidate) => candidate.id === accountId,
+    ) as OAuthAccount | undefined
+    expect(clearResult).toBe(true)
+    expect(saved?.routing?.mode).toBe('fallback-first')
+    expect(account?.lastRefreshError).toBeUndefined()
   })
 
-  test('skips a Claustrum account when both vault and sidecar credentials are expired', async () => {
-    const now = Date.now()
-    const calls: CredentialCall[] = []
+  test('clearing a sidecar error does not roll back a concurrent access-token change', async () => {
+    const accountId = 'credential-race'
+    const handle = 'handle-credential-race'
     const storage = createFallbackStorage({
-      routing: { mode: 'fallback-first' },
-      quota: { enabled: false, failClosedOnUnknownQuota: false },
-      claustrum: { accounts: { 'fallback-1': { enabled: true } } },
+      claustrum: { mode: 'claustrum' },
       accounts: [
         {
-          id: 'fallback-1',
-          type: 'oauth',
-          access: 'expired-stored-access',
-          refresh: 'expired-stored-refresh',
-          expires: now - 1,
-          claustrumHandle: 'handle-expired',
-        },
-        {
-          id: 'fallback-2',
+          id: accountId,
           type: 'oauth',
-          access: 'backup-access',
-          refresh: 'backup-refresh',
-          expires: now + 5 * 60 * 60 * 1000,
+          access: 'old-access',
+          refresh: 'stored-refresh',
+          expires: Date.now() + 60_000,
+          claustrumHandle: handle,
+          lastRefreshError: persistedRefreshError(accountId),
         },
       ],
     })
-    const connector = connectorFor(calls, () =>
-      credentialResponse('vault-expired-access', 31, now - 1),
+    await useTempAccountFile(storage)
+    const path = process.env.OPENCODE_ANTHROPIC_AUTH_FILE!
+    const before = (await loadAccounts(path))?.accounts[0] as
+      | OAuthAccount
+      | undefined
+    expect(before?.lastRefreshError).toBeDefined()
+    const concurrent = structuredClone((await loadAccounts(path))!)
+    const account = concurrent.accounts.find(
+      (candidate) => candidate.id === accountId,
     )
+    if (account?.type !== 'oauth') throw new Error('missing OAuth account')
+    account.access = 'new-access-from-refresh'
 
-    const { authorizations, plugin, result } = await loadFallbackWithConnector(
-      storage,
-      connector,
-      new Response('{}', { status: 200 }),
+    const clearResult = await clearAfterConcurrentSnapshot(
+      accountId,
+      handle,
+      concurrent,
+      path,
     )
-    const response = await result.fetch(MESSAGES_URL, EMPTY_POST)
 
-    expect(response.status).toBe(200)
-    expect(authorizations).toEqual(['Bearer backup-access'])
-    expect(calls.some((call) => call.method === 'credential.get')).toBe(true)
-    await plugin.dispose?.()
+    const saved = await loadAccounts(path)
+    const savedAccount = saved?.accounts.find(
+      (candidate) => candidate.id === accountId,
+    ) as OAuthAccount | undefined
+    expect(clearResult).toBe(true)
+    expect(savedAccount?.type).toBe('oauth')
+    expect(savedAccount?.access).toBe('new-access-from-refresh')
+    expect(savedAccount?.lastRefreshError).toBeUndefined()
   })
 
-  test('bounds startup warmup and continues with a cold account', async () => {
-    const calls: CredentialCall[] = []
-    const storage = fallbackWithClaustrum({
-      claustrumHandle: 'handle-wedged',
-      claustrum: { accounts: { 'fallback-1': { enabled: true } } },
-    } as never)
-    const connector = connectorFor(calls, async (method) => {
-      if (method === 'credential.get') await new Promise<void>(() => {})
-      return { result: {} }
-    })
-    await useTempAccountFile(storage)
-    const authorizations: string[] = []
-    globalThis.fetch = mock((input: unknown, init?: RequestInit) => {
-      if (
-        extractUrl(input as string | URL | Request).includes('/v1/messages')
-      ) {
-        authorizations.push(
-          new Headers(init?.headers).get('authorization') ?? '',
-        )
-      }
-      return Promise.resolve(new Response('{}', { status: 200 }))
-    }) as unknown as typeof fetch
-
-    const plugin = await Promise.race([
-      getPlugin(undefined, undefined, { claustrumConnector: connector }),
-      Bun.sleep(650).then(() => {
-        throw new Error('Claustrum warmup blocked plugin startup')
+  test('clears a persisted sidecar refresh error for an enabled Claustrum account', async () => {
+    const accountId = 'clear-control'
+    const handle = 'handle-clear-control'
+    await useTempAccountFile(
+      createFallbackStorage({
+        claustrum: { mode: 'claustrum' },
+        accounts: [
+          {
+            id: accountId,
+            type: 'oauth',
+            access: 'stored-access',
+            refresh: 'stored-refresh',
+            expires: Date.now() + 60_000,
+            claustrumHandle: handle,
+            lastRefreshError: persistedRefreshError(accountId),
+          },
+        ],
       }),
-    ])
-    const result = await plugin.auth.loader(
-      () =>
-        Promise.resolve({
-          type: 'oauth' as const,
-          access: 'main-access',
-          refresh: 'main-refresh',
-          expires: Date.now() + 100_000,
-        }),
-      { models: {} },
     )
-    const response = await result.fetch(MESSAGES_URL, EMPTY_POST)
-
-    expect(response.status).toBe(200)
-    expect(authorizations).toContain('Bearer stored-fallback-access')
-    expect(
-      calls.filter((call) => call.method === 'credential.get'),
-    ).toHaveLength(1)
-    await plugin.dispose?.()
-  })
-
-  test('detaches a stale-marked startup refresh and uses its result when it lands', async () => {
-    const calls: CredentialCall[] = []
-    const storage = fallbackWithClaustrum({
-      claustrumHandle: 'handle-stale-marked',
-      claustrum: { accounts: { 'fallback-1': { enabled: true } } },
-    } as never)
-    let releaseWarm!: () => void
-    const warmGate = new Promise<void>((resolve) => {
-      releaseWarm = resolve
-    })
-    const connector = connectorFor(calls, async (method) => {
-      if (method === 'credential.get') {
-        await warmGate
-        return credentialResponse('vault-after-stale-refresh', 52)
-      }
-      return { result: {} }
-    })
-    await useTempAccountFile(storage)
-    const authorizations: string[] = []
-    globalThis.fetch = mock((input: unknown, init?: RequestInit) => {
-      if (
-        extractUrl(input as string | URL | Request).includes('/v1/messages')
-      ) {
-        authorizations.push(
-          new Headers(init?.headers).get('authorization') ?? '',
-        )
-      }
-      return Promise.resolve(new Response('{}', { status: 200 }))
-    }) as unknown as typeof fetch
+    const path = process.env.OPENCODE_ANTHROPIC_AUTH_FILE!
+    const before = (await loadAccounts(path))?.accounts[0] as
+      | OAuthAccount
+      | undefined
+    expect(before?.lastRefreshError).toBeDefined()
 
-    const plugin = await Promise.race([
-      getPlugin(undefined, undefined, { claustrumConnector: connector }),
-      Bun.sleep(250).then(() => {
-        throw new Error('stale-marked warmup blocked plugin startup')
-      }),
-    ])
-    releaseWarm()
-    await Bun.sleep(10)
-    const result = await plugin.auth.loader(
-      () =>
-        Promise.resolve({
-          type: 'oauth' as const,
-          access: 'main-access',
-          refresh: 'main-refresh',
-          expires: Date.now() + 100_000,
-        }),
-      { models: {} },
+    const clearResult = await clearClaustrumRefreshErrorPersistent(
+      accountId,
+      handle,
+      path,
     )
-    const response = await result.fetch(MESSAGES_URL, EMPTY_POST)
 
-    expect(response.status).toBe(200)
-    expect(authorizations).toContain('Bearer vault-after-stale-refresh')
-    expect(
-      calls.filter((call) => call.method === 'credential.get'),
-    ).toHaveLength(1)
-    await plugin.dispose?.()
+    expect(clearResult).toBe(true)
+    const after = (await loadAccounts(path))?.accounts[0] as
+      | OAuthAccount
+      | undefined
+    expect(after?.lastRefreshError).toBeUndefined()
   })
 
-  test('reports a 401 with the record version of the served credential', async () => {
-    const calls: CredentialCall[] = []
-    const storage = fallbackWithClaustrum({
-      claustrumHandle: 'handle-401',
-      claustrum: { accounts: { 'fallback-1': { enabled: true } } },
-    } as never)
-    const connector = connectorFor(calls, (method) => {
-      if (method === 'credential.get')
-        return credentialResponse('vault-401-access', 23)
-      return { result: {} }
-    })
-    const { plugin, result } = await loadFallbackWithConnector(
-      storage,
-      connector,
-      new Response('{}', { status: 401 }),
-    )
-
-    const response = await result.fetch(MESSAGES_URL, EMPTY_POST)
-
-    expect(response.status).toBe(401)
-    expect(calls).toContainEqual({
-      method: 'credential.report_auth_failure',
-      params: {
-        handle: 'handle-401',
-        provider_status: 401,
-        record_version: 23,
-        reporter_source: 'direct',
+  test('does not take a locked clear on a clean warm vault request', async () => {
+    const accountId = 'clean-warm-request'
+    const fallbackHandle = `ckh_${'C'.repeat(43)}`
+    const clearCalls: string[] = []
+    const realClear = clearClaustrumRefreshErrorPersistent
+    const fixture = await bootRuledClaustrumRow({
+      route: 'fallback-first',
+      fallbacks: [
+        {
+          label: 'clean-warm-request',
+          handle: fallbackHandle,
+          access: 'vault-access',
+          account: { id: accountId, claustrumHandle: fallbackHandle },
+        },
+      ],
+      connector: (calls) =>
+        connectorFor(calls, (method, params) => {
+          if (method !== 'credential.get') return { result: {} }
+          if (params.handle === ruledMainHandle)
+            return credentialResponse(
+              'vault-main-access',
+              1,
+              Date.now() + FALLBACK_BACKGROUND_TICK_MS + 120_000,
+            )
+          return credentialResponse(
+            'vault-access',
+            23,
+            Date.now() + FALLBACK_BACKGROUND_TICK_MS + 120_000,
+          )
+        }),
+      runtimeOverrides: {
+        clearClaustrumRefreshErrorPersistent: async (...args: any[]) => {
+          clearCalls.push(args[0])
+          return (realClear as (...values: any[]) => Promise<unknown>)(...args)
+        },
       },
     })
-    await plugin.dispose?.()
+    clearCalls.length = 0
+    const cleanResponse = await fixture.result.fetch(MESSAGES_URL, EMPTY_POST)
+    expect(cleanResponse.status).toBe(200)
+    expect(fixture.authorizations).toContain('Bearer vault-access')
+    expect(clearCalls).toHaveLength(0)
+
+    const withError = await loadAccounts()
+    const account = withError?.accounts.find(
+      (candidate) => candidate.id === accountId,
+    ) as OAuthAccount | undefined
+    if (!withError || !account) throw new Error('expected warm OAuth account')
+    account.access = 'stored-fallback-access'
+    account.refresh = 'stored-fallback-refresh'
+    account.expires = Date.now() + 60_000
+    account.claustrumHandle = fallbackHandle
+    account.lastRefreshError = {
+      ...persistedRefreshError(accountId),
+      nextRetryAt: Date.now() - 1,
+    }
+    await saveAccounts(withError)
+    const persistedConfig = JSON.parse(
+      await readFile(process.env.OPENCODE_ANTHROPIC_AUTH_FILE!, 'utf8'),
+    )
+    persistedConfig.accounts.find(
+      (candidate: { id: string }) => candidate.id === accountId,
+    ).claustrumHandle = fallbackHandle
+    await writeFile(
+      process.env.OPENCODE_ANTHROPIC_AUTH_FILE!,
+      JSON.stringify(persistedConfig),
+    )
+    const persisted = await loadAccounts()
+    expect(
+      (
+        persisted?.accounts.find((candidate) => candidate.id === accountId) as
+          | OAuthAccount
+          | undefined
+      )?.lastRefreshError,
+    ).toBeDefined()
+
+    const erroredResponse = await fixture.result.fetch(MESSAGES_URL, EMPTY_POST)
+    expect(erroredResponse.status).toBe(200)
+    await waitForAccountStorage(
+      (candidate) =>
+        (
+          candidate?.accounts.find((candidate) => candidate.id === accountId) as
+            | OAuthAccount
+            | undefined
+        )?.lastRefreshError === undefined,
+    )
+    expect(clearCalls).toEqual([accountId])
+    await fixture.plugin.dispose?.()
   })
 
-  test('reports a vault 401 surfaced by the optimistic websocket relay', async () => {
-    const calls: CredentialCall[] = []
+  test('leaves a plain OAuth account refresh error untouched', async () => {
+    const plainId = 'plain-oauth'
+    const controlId = 'enabled-control'
+    const plainError = persistedRefreshError(plainId)
+    const controlError = persistedRefreshError(controlId)
+    await useTempAccountFile(
+      createFallbackStorage({
+        claustrum: { mode: 'claustrum' },
+        accounts: [
+          {
+            id: plainId,
+            type: 'oauth',
+            access: 'plain-access',
+            refresh: 'plain-refresh',
+            expires: Date.now() + 60_000,
+            lastRefreshError: plainError,
+          },
+          {
+            id: controlId,
+            type: 'oauth',
+            access: 'control-access',
+            refresh: 'control-refresh',
+            expires: Date.now() + 60_000,
+            claustrumHandle: 'handle-enabled-control',
+            lastRefreshError: controlError,
+          },
+        ],
+      }),
+    )
+    const path = process.env.OPENCODE_ANTHROPIC_AUTH_FILE!
+    const before = await loadAccounts(path)
+    expect(
+      (
+        before?.accounts.find((account) => account.id === plainId) as
+          | OAuthAccount
+          | undefined
+      )?.lastRefreshError,
+    ).toEqual(plainError)
+    expect(
+      (
+        before?.accounts.find((account) => account.id === controlId) as
+          | OAuthAccount
+          | undefined
+      )?.lastRefreshError,
+    ).toEqual(controlError)
+
+    const plainResult = await clearClaustrumRefreshErrorPersistent(
+      plainId,
+      'not-configured',
+      path,
+    )
+    const controlResult = await clearClaustrumRefreshErrorPersistent(
+      controlId,
+      'handle-enabled-control',
+      path,
+    )
+
+    const saved = await loadAccounts(path)
+    const plain = saved?.accounts.find((account) => account.id === plainId) as
+      | OAuthAccount
+      | undefined
+    const control = saved?.accounts.find(
+      (account) => account.id === controlId,
+    ) as OAuthAccount | undefined
+    expect(plainResult).toBe(false)
+    expect(controlResult).toBe(true)
+    expect(plain?.lastRefreshError?.message).toBe(plainError.message)
+    expect(control?.lastRefreshError).toBeUndefined()
+  })
+
+  test('cold custody never refreshes a rotated sidecar token', async () => {
+    const now = Date.now()
     const storage = fallbackWithClaustrum({
-      claustrumHandle: 'handle-relay-401',
-      claustrum: { accounts: { 'fallback-1': { enabled: true } } },
-    } as never) as AccountStorage
-    storage.relay = {
-      enabled: true,
-      url: 'https://relay.example.test',
-      token: 'relay-token',
-      fallbackToDirect: true,
-      transport: 'websocket',
-    }
+      claustrumHandle: 'handle-rotated-sidecar',
+      claustrum: { mode: 'claustrum' },
+    })
+    const account = storage.accounts[0] as OAuthAccount
+    account.expires = now - 1
+    account.refresh = 'rotated-sidecar-refresh'
+    account.lastRefreshError = buildRefreshOperationError({
+      error: new ClaudeOAuthRefreshError(400, '{"error":"invalid_grant"}'),
+      now,
+      accountIdentity: account.id,
+      refreshTokenFingerprint: tokenFingerprint('superseded-refresh'),
+    })
+    await useTempAccountFile(storage)
+
+    const calls: CredentialCall[] = []
     const connector = connectorFor(calls, (method) => {
-      if (method === 'credential.get')
-        return credentialResponse('vault-relay-access', 73)
+      if (method === 'credential.get') throw new Error('vault unavailable')
       return { result: {} }
     })
-    await useTempAccountFile(storage)
-    globalThis.fetch = mock(() =>
-      Promise.resolve(new Response('{}', { status: 500 })),
-    ) as unknown as typeof fetch
-    const restoreWebSocket = installRelayResponseStart(401)
+    let tokenCalls = 0
+    globalThis.fetch = mock((input: unknown) => {
+      const url = extractUrl(input as string | URL | Request)
+      if (url === TOKEN_URL) {
+        tokenCalls += 1
+        return Promise.resolve(
+          new Response(
+            JSON.stringify({
+              access_token: 'rotated-sidecar-access',
+              refresh_token: 'rotated-sidecar-refresh-2',
+              expires_in: 86_400,
+            }),
+            { status: 200 },
+          ),
+        )
+      }
+      return Promise.resolve(new Response('{}', { status: 200 }))
+    }) as unknown as typeof fetch
+
     const plugin = await getPlugin(undefined, undefined, {
       claustrumConnector: connector,
+      claustrumNow: () => now,
     })
-    const result = await plugin.auth.loader(
-      () =>
-        Promise.resolve({
-          type: 'oauth' as const,
-          access: 'main-access',
-          refresh: 'main-refresh',
-          expires: Date.now() + 100_000,
-        }),
-      { models: {} },
-    )
-
-    try {
-      const response = await result.fetch(MESSAGES_URL, {
-        method: 'POST',
-        headers: { 'x-session-affinity': 'relay-vault-401' },
-        body: JSON.stringify({
-          stream: true,
-          model: 'claude-sonnet-4-5',
-          messages: [{ role: 'user', content: 'relay auth failure' }],
-        }),
-      })
-      expect(response.status).toBe(200)
-      expect(await response.text()).toContain('relay_upstream_error')
-    } finally {
-      restoreWebSocket()
-    }
-
-    expect(calls).toContainEqual({
-      method: 'credential.report_auth_failure',
-      params: {
-        handle: 'handle-relay-401',
-        provider_status: 401,
-        record_version: 73,
-        reporter_source: 'relay_message_parse',
-      },
-    })
+    await plugin.__fallbackRefreshReady
+    expect(tokenCalls).toBe(0)
     await plugin.dispose?.()
   })
 
-  test('reports a sticky vault 401 surfaced by the optimistic websocket relay', async () => {
-    const checkedAt = Date.now()
-    const fallbackQuota = {
-      five_hour: {
-        usedPercent: 10,
-        remainingPercent: 90,
-        checkedAt,
-      },
-      seven_day: {
-        usedPercent: 10,
-        remainingPercent: 90,
-        checkedAt,
-      },
-    }
-    const storage = createFallbackStorage({
-      routing: { mode: 'sticky-balanced' },
-      relay: {
-        enabled: true,
-        url: 'https://relay.example.test',
-        token: 'relay-token',
-        fallbackToDirect: true,
-        transport: 'websocket',
-      },
-      quota: {
-        enabled: true,
-        checkIntervalMinutes: 5,
-        minimumRemaining: { five_hour: 1, seven_day: 1 },
-        failClosedOnUnknownQuota: false,
-        mainQuota: {
-          five_hour: { usedPercent: 100, remainingPercent: 0, checkedAt },
-          seven_day: { usedPercent: 100, remainingPercent: 0, checkedAt },
-        },
-        mainQuotaCheckedAt: checkedAt,
-      },
-      claustrum: { accounts: { 'sticky-relay-vault': { enabled: true } } },
-      accounts: [
+  test('clears a persisted sidecar refresh error when the vault later becomes resident', async () => {
+    const now = Date.now()
+    const plainPermanentError = buildRefreshOperationError({
+      error: new ClaudeOAuthRefreshError(400, '{"error":"invalid_grant"}'),
+      now,
+      accountIdentity: 'plain-control',
+    })
+    const staleLocalError = buildRefreshOperationError({
+      error: new ClaudeOAuthRefreshError(500, 'local refresh failed'),
+      now,
+      accountIdentity: 'vault-recovered',
+    })
+    const fallbackHandle = `ckh_${'R'.repeat(43)}`
+    const fixture = await bootRuledClaustrumRow({
+      route: 'fallback-first',
+      fallbacks: [
         {
-          id: 'sticky-relay-vault',
-          type: 'oauth',
-          refresh: 'sticky-relay-refresh',
-          expires: checkedAt + 5 * 60 * 60 * 1000,
-          claustrumHandle: 'handle-sticky-relay-401',
-          quota: fallbackQuota,
+          label: 'vault-recovered',
+          handle: fallbackHandle,
+          access: 'vault-recovered-access',
+          account: { id: 'vault-recovered' },
         },
       ],
+      onFetch: (input) => {
+        if (extractUrl(input as string | URL | Request) === TOKEN_URL)
+          throw new Error('local refresh must not run')
+        return new Response('{}', { status: 200 })
+      },
     })
-    const calls: CredentialCall[] = []
-    const connector = connectorFor(calls, (method) => {
-      if (method === 'credential.get')
-        return credentialResponse('sticky-relay-access', 74)
-      return { result: {} }
-    })
-    await useTempAccountFile(storage)
-    globalThis.fetch = mock(() =>
-      Promise.resolve(new Response('{}', { status: 500 })),
-    ) as unknown as typeof fetch
-    const restoreWebSocket = installRelayResponseStart(200, { status: 401 })
-    const plugin = await getPlugin(undefined, undefined, {
-      claustrumConnector: connector,
-    })
-    const result = await plugin.auth.loader(
-      () =>
-        Promise.resolve({
-          type: 'oauth' as const,
-          access: 'main-access',
-          refresh: 'main-refresh',
-          expires: checkedAt + 5 * 60 * 60 * 1000,
-        }),
-      { models: {} },
-    )
-
-    try {
-      const response = await result.fetch(MESSAGES_URL, {
-        method: 'POST',
-        headers: { 'x-session-affinity': 'sticky-relay-vault-401' },
-        body: JSON.stringify({
-          stream: true,
-          model: 'claude-opus-5',
-          messages: [{ role: 'user', content: 'sticky relay auth failure' }],
-        }),
-      })
-      expect(response.status).toBe(200)
-      expect(await response.text()).toContain('relay_upstream_error')
-    } finally {
-      restoreWebSocket()
-    }
-
-    expect(calls).toContainEqual({
-      method: 'credential.report_auth_failure',
-      params: {
-        handle: 'handle-sticky-relay-401',
-        provider_status: 401,
-        record_version: 74,
-        reporter_source: 'relay_status_field',
+    const storage = (await loadAccounts())!
+    storage.accounts = [
+      {
+        id: 'vault-recovered',
+        type: 'oauth',
+        access: 'expired-vault-access',
+        refresh: 'expired-vault-refresh',
+        expires: now - 1,
+        claustrumHandle: fallbackHandle,
+        lastRefreshError: staleLocalError,
+      },
+      {
+        id: 'plain-control',
+        type: 'oauth',
+        access: 'plain-access',
+        refresh: 'plain-refresh',
+        expires: now + 5 * 60 * 60 * 1000,
+        lastRefreshError: plainPermanentError,
       },
+    ]
+    await saveAccounts(storage)
+    const config = JSON.parse(
+      await readFile(process.env.OPENCODE_ANTHROPIC_AUTH_FILE!, 'utf8'),
+    )
+    config.accounts.find(
+      (account: { id: string }) => account.id === 'vault-recovered',
+    ).claustrumHandle = fallbackHandle
+    await writeFile(
+      process.env.OPENCODE_ANTHROPIC_AUTH_FILE!,
+      JSON.stringify(config),
+    )
+    const response = await fixture.result.fetch(MESSAGES_URL, {
+      method: 'POST',
+      body: JSON.stringify({
+        model: 'claude-opus-5',
+        max_tokens: 1,
+        messages: [{ role: 'user', content: 'hello' }],
+      }),
     })
-    await plugin.dispose?.()
+
+    const saved = await waitForAccountStorage(
+      (candidate) =>
+        (
+          candidate?.accounts.find(
+            (account) => account.id === 'vault-recovered',
+          ) as OAuthAccount | undefined
+        )?.lastRefreshError === undefined,
+    )
+    const plain = saved?.accounts.find(
+      (account) => account.id === 'plain-control',
+    ) as OAuthAccount
+    expect(response.status).toBe(200)
+    expect(fixture.authorizations).toEqual(['Bearer vault-recovered-access'])
+    expect(
+      fixture.calls.filter(
+        (call) =>
+          call.method === 'credential.get' &&
+          call.params.handle === fallbackHandle,
+      ),
+    ).toHaveLength(1)
+    expect(plain.lastRefreshError?.permanent).toBe(true)
+    await fixture.plugin.dispose?.()
   })
 
-  test('does not report relay 401s for non-vault routes', async () => {
-    const storage = createFallbackStorage({
-      routing: { mode: 'fallback-first' },
-      relay: {
-        enabled: true,
-        url: 'https://relay.example.test',
-        token: 'relay-token',
-        fallbackToDirect: true,
-        transport: 'websocket',
-      },
-      quota: { enabled: false, failClosedOnUnknownQuota: false },
-      accounts: [
+  test('clears a late local refresh error on a subsequent warm vault request', async () => {
+    const accountId = 'vault-late-refresh-error'
+    const handle = `ckh_${'W'.repeat(43)}`
+    const now = Date.now()
+    const fixture = await bootRuledClaustrumRow({
+      route: 'fallback-first',
+      fallbacks: [
         {
-          id: 'plain-fallback',
-          type: 'oauth',
-          access: 'plain-fallback-access',
-          refresh: 'plain-fallback-refresh',
-          expires: Date.now() + 5 * 60 * 60 * 1000,
+          label: 'vault-late-refresh-error',
+          handle,
+          access: 'vault-warm-access',
+          account: { id: accountId },
         },
       ],
+      onFetch: (input) => {
+        if (extractUrl(input as string | URL | Request) === TOKEN_URL)
+          throw new Error('local refresh must not run')
+        return new Response('{}', { status: 200 })
+      },
     })
-    await useTempAccountFile(storage)
-    globalThis.fetch = mock(() =>
-      Promise.resolve(new Response('{}', { status: 500 })),
-    ) as unknown as typeof fetch
-    const restoreWebSocket = installRelayResponseStart(401)
-    const plugin = await getPlugin()
-    const result = await plugin.auth.loader(
-      () =>
-        Promise.resolve({
-          type: 'oauth' as const,
-          access: 'main-access',
-          refresh: 'main-refresh',
-          expires: Date.now() + 100_000,
-        }),
-      { models: {} },
+    const withLateError = await loadAccounts()
+    const account = withLateError?.accounts.find(
+      (candidate) => candidate.id === accountId,
+    ) as OAuthAccount | undefined
+    if (!withLateError || !account) throw new Error('missing warm account')
+    account.access = 'expired-vault-access'
+    account.refresh = 'expired-vault-refresh'
+    account.expires = now - 1
+    account.claustrumHandle = handle
+    account.lastRefreshError = buildRefreshOperationError({
+      error: new ClaudeOAuthRefreshError(500, 'late local refresh failed'),
+      now,
+      accountIdentity: accountId,
+    })
+    await saveAccounts(withLateError)
+    const config = JSON.parse(
+      await readFile(process.env.OPENCODE_ANTHROPIC_AUTH_FILE!, 'utf8'),
+    )
+    config.accounts.find(
+      (candidate: { id: string }) => candidate.id === accountId,
+    ).claustrumHandle = handle
+    await writeFile(
+      process.env.OPENCODE_ANTHROPIC_AUTH_FILE!,
+      JSON.stringify(config),
     )
+    const response = await fixture.result.fetch(MESSAGES_URL, EMPTY_POST)
 
-    try {
-      const response = await result.fetch(MESSAGES_URL, {
-        method: 'POST',
-        headers: { 'x-session-affinity': 'relay-plain-401' },
-        body: JSON.stringify({
-          stream: true,
-          model: 'claude-sonnet-4-5',
-          messages: [{ role: 'user', content: 'plain relay auth failure' }],
-        }),
-      })
-      expect(response.status).toBe(200)
-      expect(await response.text()).toContain('relay_upstream_error')
-    } finally {
-      restoreWebSocket()
-      await plugin.dispose?.()
-    }
+    expect(response.status).toBe(200)
+    expect(fixture.authorizations).toEqual(['Bearer vault-warm-access'])
+    expect(
+      fixture.calls.filter(
+        (call) =>
+          call.method === 'credential.get' && call.params.handle === handle,
+      ),
+    ).toHaveLength(1)
+    const savedAfterWarmRequest = await waitForAccountStorage(
+      (candidate) =>
+        (
+          candidate?.accounts.find((candidate) => candidate.id === accountId) as
+            | OAuthAccount
+            | undefined
+        )?.lastRefreshError === undefined,
+    )
+    expect(
+      (
+        savedAfterWarmRequest?.accounts.find(
+          (candidate) => candidate.id === accountId,
+        ) as OAuthAccount | undefined
+      )?.lastRefreshError,
+    ).toBeUndefined()
+    await fixture.plugin.dispose?.()
   })
 
-  test('suppresses a raced 401 report when the cache already holds a newer version', async () => {
-    const calls: CredentialCall[] = []
-    const storage = fallbackWithClaustrum({
-      claustrumHandle: 'handle-raced-401',
-      claustrum: { accounts: { 'fallback-1': { enabled: true } } },
-    } as never)
-    let credentialGets = 0
-    const connector = connectorFor(calls, (method) => {
-      if (method !== 'credential.get') return { result: {} }
-      credentialGets += 1
-      return credentialResponse(
-        credentialGets === 1 ? 'vault-old-access' : 'vault-new-access',
-        credentialGets === 1 ? 41 : 42,
-      )
-    })
+  async function loadFallbackWithConnector(
+    storage: AccountStorage,
+    connector: (options: unknown) => Promise<unknown>,
+    response: Response | (() => Response),
+    runtimeOverrides: Record<string, unknown> & {
+      beforePlugin?: () => Promise<void>
+    } = {},
+  ) {
     await useTempAccountFile(storage)
-    let cache: any
-    globalThis.fetch = mock(async (input: unknown, init?: RequestInit) => {
-      const url = extractUrl(input as string | URL | Request)
-      if (url.includes('/v1/messages')) {
-        const authorization = new Headers(init?.headers).get('authorization')
-        if (
-          credentialGets === 1 &&
-          authorization === 'Bearer vault-old-access'
-        ) {
-          cache.invalidate('handle-raced-401', 41)
-          await cache.get('handle-raced-401')
-          return new Response('{}', { status: 401 })
-        }
+    const { beforePlugin, ...pluginOverrides } = runtimeOverrides
+    await beforePlugin?.()
+    const authorizations: string[] = []
+    globalThis.fetch = mock((input: unknown, init?: RequestInit) => {
+      if (
+        extractUrl(input as string | URL | Request).includes('/v1/messages')
+      ) {
+        authorizations.push(
+          new Headers(init?.headers).get('authorization') ?? '',
+        )
       }
-      return new Response('{}', { status: 200 })
+      return Promise.resolve(
+        typeof response === 'function' ? response() : response.clone(),
+      )
     }) as unknown as typeof fetch
     const plugin = await getPlugin(undefined, undefined, {
       claustrumConnector: connector,
+      ...pluginOverrides,
     })
-    cache = plugin.__claustrumCredentialCache
     const result = await plugin.auth.loader(
       () =>
         Promise.resolve({
@@ -3009,413 +3891,1780 @@ describe('fallback Claustrum credential resolution', () => {
         }),
       { models: {} },
     )
+    return { authorizations, plugin, result }
+  }
 
-    expect(credentialGets).toBe(1)
-    const response = await result.fetch(MESSAGES_URL, EMPTY_POST)
-
-    expect(response.status).toBe(200)
-    expect(credentialGets).toBe(2)
-    expect(
-      calls.some((call) => call.method === 'credential.report_auth_failure'),
-    ).toBe(false)
-    await plugin.dispose?.()
-  })
+  async function loadRuledFallbackWithConnector(
+    storage: AccountStorage,
+    connector: () => Promise<unknown>,
+    response: Response | (() => Response),
+  ) {
+    const fallbacks = storage.accounts
+      .filter(isOAuthAccount)
+      .map((account, index) => {
+        const {
+          access: _access,
+          refresh: _refresh,
+          expires: _expires,
+          claustrumHandle: _claustrumHandle,
+          ...accountFixture
+        } = account
+        return {
+          label: account.label ?? account.id,
+          handle: `ckh_${String.fromCharCode(65 + index).repeat(43)}`,
+          access: `vault-${account.id}-access`,
+          account: accountFixture,
+        }
+      })
+    return bootRuledClaustrumRow({
+      fallbacks,
+      route:
+        storage.routing?.mode === 'sticky-balanced'
+          ? { sticky: 'ruled-sticky' }
+          : storage.routing?.mode === 'main-first'
+            ? 'main-exhausted'
+            : 'fallback-first',
+      quota: storage.quota,
+      storageOverrides: { quotaHeaderFeed: storage.quotaHeaderFeed },
+      connector: () => connector,
+      response,
+    })
+  }
 
-  test('falls back to the stored token when the vault is unavailable', async () => {
+  test('local mode does not serve or refresh a bound inert fallback', async () => {
     const calls: CredentialCall[] = []
+    let connectorCalls = 0
     const storage = fallbackWithClaustrum({
-      claustrumHandle: 'handle-outage',
-      claustrum: { accounts: { 'fallback-1': { enabled: true } } },
-    } as never)
-    const connector = connectorFor(calls, () => {
-      throw new Error('vault unavailable')
+      label: 'bound-local',
+      claustrumHandle: manifestHandle,
+      claustrum: { mode: 'local' },
     })
+    const connector = async () => {
+      connectorCalls += 1
+      return connectorFor(calls, () => credentialResponse('vault-access', 1))()
+    }
 
     const { authorizations, plugin, result } = await loadFallbackWithConnector(
       storage,
       connector,
       new Response('{}', { status: 200 }),
+      {
+        beforePlugin: async () => {
+          await writeManifest([
+            { label: 'bound-local', handle: manifestHandle },
+          ])
+        },
+      },
     )
     const response = await result.fetch(MESSAGES_URL, EMPTY_POST)
 
     expect(response.status).toBe(200)
-    expect(authorizations).toContain('Bearer stored-fallback-access')
-    expect(calls.some((call) => call.method === 'credential.get')).toBe(true)
+    expect(authorizations).toEqual(['Bearer main-access'])
+    expect(connectorCalls).toBe(0)
+    expect(calls).toEqual([])
+    await plugin.dispose?.()
+  })
+
+  test('excludes a vault fallback whose asserted account identity mismatches its stored UUID', async () => {
+    const calls: CredentialCall[] = []
+    const storage = fallbackWithClaustrum({
+      label: 'identity-fenced',
+      anthropicAccountUuid: 'bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb',
+    } as never)
+    const connector = connectorFor(calls, (method, params) => {
+      if (method === 'credential.get' && params.handle === ruledMainHandle)
+        return credentialResponse('vault-main-access', 1)
+      if (method === 'credential.get')
+        return credentialResponse(
+          'vault-identity-fenced-access',
+          1,
+          Date.now() + 60_000,
+          'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa',
+        )
+      return { result: {} }
+    })
+    const { authorizations, plugin, result } =
+      await loadRuledFallbackWithConnector(
+        storage,
+        connector,
+        new Response('{}', { status: 401 }),
+      )
+    const initialCredentialGets = calls.filter(
+      (call) => call.method === 'credential.get',
+    ).length
+
+    const response = await result.fetch(MESSAGES_URL, EMPTY_POST)
+
+    expect(response.status).toBe(401)
+    expect(authorizations).toEqual(['Bearer vault-main-access'])
     expect(
-      calls.some((call) => call.method === 'credential.report_auth_failure'),
-    ).toBe(false)
+      calls.filter((call) => call.method === 'credential.get'),
+    ).toHaveLength(initialCredentialGets)
     await plugin.dispose?.()
   })
 
-  test('refreshes the sidecar credential after a 401 when the vault is unavailable', async () => {
-    const checkedAt = Date.now()
-    const fallbackQuota = {
-      five_hour: {
-        usedPercent: 10,
-        remainingPercent: 90,
-        checkedAt,
-      },
-      seven_day: {
-        usedPercent: 10,
-        remainingPercent: 90,
-        checkedAt,
-      },
-    }
-    const storage = createFallbackStorage({
-      routing: { mode: 'sticky-balanced' },
-      quota: {
-        enabled: true,
-        checkIntervalMinutes: 5,
-        minimumRemaining: { five_hour: 1, seven_day: 1 },
-        failClosedOnUnknownQuota: true,
-        mainQuota: {
-          five_hour: {
-            usedPercent: 100,
-            remainingPercent: 0,
-            checkedAt,
-          },
-          seven_day: {
-            usedPercent: 100,
-            remainingPercent: 0,
-            checkedAt,
+  test.each([
+    ['equal UUIDs', 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa'],
+    ['no stored UUID', undefined],
+  ])(
+    'serves a vault fallback with %s',
+    async (_caseName, anthropicAccountUuid) => {
+      const fallbackTestHandle = `handle-identity-allowed-${_caseName}-${Date.now()}`
+      const calls: CredentialCall[] = []
+      const storage = createFallbackStorage({
+        routing: { mode: 'fallback-first' },
+        quota: { enabled: false, failClosedOnUnknownQuota: false },
+        quotaHeaderFeed: { enabled: true },
+        claustrum: { mode: 'claustrum' },
+        accounts: [
+          {
+            id: 'identity-allowed',
+            type: 'oauth',
+            access: 'stored-fallback-access',
+            refresh: 'stored-fallback-refresh',
+            expires: Date.now() + 5 * 60 * 60 * 1000,
+            anthropicAccountUuid,
+            claustrumHandle: fallbackTestHandle,
+          } as OAuthAccount,
+        ],
+      })
+      const connector = connectorFor(calls, (method, params) => {
+        if (method === 'credential.get') {
+          if (params.handle === ruledMainHandle)
+            return credentialResponse('vault-main-access', 2)
+          return credentialResponse(
+            'vault-identity-allowed-access',
+            2,
+            Date.now() + 60_000,
+            'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa',
+          )
+        }
+        return { result: {} }
+      })
+      const { authorizations, plugin, result } =
+        await loadRuledFallbackWithConnector(
+          storage,
+          connector,
+          new Response('{}', {
+            status: 401,
+            headers: {
+              'anthropic-ratelimit-unified-5h-utilization': '0.25',
+              'anthropic-ratelimit-unified-5h-reset': '1800000000',
+            },
+          }),
+        )
+      await plugin.__fallbackRefreshReady
+      const response = await result.fetch(MESSAGES_URL, EMPTY_POST)
+
+      expect(response.status).toBe(401)
+      expect(authorizations).toEqual([
+        'Bearer vault-identity-allowed-access',
+        'Bearer vault-main-access',
+      ])
+      const entries = await waitForFeedEntries(
+        (candidate) =>
+          candidate.some(
+            (entry) =>
+              (entry as any).anthropic_account_uuid ===
+              'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa',
+          ),
+        'the served fallback provider identity',
+      )
+      const servedFallbackEntry = entries.find(
+        (entry: any) =>
+          entry.anthropic_account_uuid ===
+          'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa',
+      ) as any
+      expect(servedFallbackEntry?.anthropic_account_uuid).toBe(
+        'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa',
+      )
+      await plugin.dispose?.()
+    },
+  )
+
+  test('publishes the served fallback account UUID when another account is disabled', async () => {
+    const fixture = await bootRuledClaustrumRow({
+      route: 'fallback-first',
+      quota: { enabled: false, failClosedOnUnknownQuota: false },
+      storageOverrides: { quotaHeaderFeed: { enabled: true } },
+      fallbacks: [
+        {
+          label: 'unserved',
+          handle: `ckh_${'U'.repeat(43)}`,
+          access: 'vault-unserved-access',
+          account: {
+            enabled: false,
+            anthropicAccountUuid:
+              '11111111-1111-1111-1111-111111111111' as ProviderAccountUuid,
           },
         },
-        mainQuotaCheckedAt: checkedAt,
-      },
-      claustrum: { accounts: { 'fallback-1': { enabled: true } } },
-      accounts: [
         {
-          id: 'fallback-1',
-          type: 'oauth',
-          access: 'stored-fallback-access',
-          refresh: 'stored-fallback-refresh',
-          expires: checkedAt + 5 * 60 * 60 * 1000,
-          claustrumHandle: 'handle-outage-recovery',
-          quota: fallbackQuota,
+          label: 'served',
+          handle: `ckh_${'S'.repeat(43)}`,
+          access: 'vault-served-access',
+          account: {
+            anthropicAccountUuid:
+              '22222222-2222-2222-2222-222222222222' as ProviderAccountUuid,
+          },
         },
       ],
-    })
-    const calls: CredentialCall[] = []
-    const connector = connectorFor(calls, () => {
-      throw new Error('vault unavailable')
-    })
-    let tokenCalls = 0
-    const authorizations: string[] = []
-    await useTempAccountFile(storage)
-    globalThis.fetch = mock((input: unknown, init?: RequestInit) => {
-      const url = extractUrl(input as string | URL | Request)
-      if (url === TOKEN_URL) {
-        tokenCalls += 1
-        return Promise.resolve(
-          new Response(
-            JSON.stringify({
-              access_token: 'refreshed-sidecar-access',
-              refresh_token: 'refreshed-sidecar-refresh',
-              expires_in: 3600,
-            }),
-            { status: 200 },
-          ),
-        )
-      }
-      if (url.includes('/v1/messages')) {
-        const authorization =
-          new Headers(init?.headers).get('authorization') ?? ''
-        authorizations.push(authorization)
-        if (authorization === 'Bearer stored-fallback-access')
-          return Promise.resolve(new Response('{}', { status: 401 }))
-        if (authorization === 'Bearer refreshed-sidecar-access')
-          return Promise.resolve(new Response('{}', { status: 200 }))
-      }
-      return Promise.resolve(new Response('{}', { status: 200 }))
-    }) as unknown as typeof fetch
-    const plugin = await getPlugin(undefined, undefined, {
-      claustrumConnector: connector,
-    })
-    const result = await plugin.auth.loader(
-      () =>
-        Promise.resolve({
-          type: 'oauth' as const,
-          access: 'main-access',
-          refresh: 'main-refresh',
-          expires: checkedAt + 5 * 60 * 60 * 1000,
-        }),
-      { models: {} },
-    )
-
-    const response = await result.fetch(MESSAGES_URL, {
-      method: 'POST',
-      headers: { 'x-session-affinity': 'vault-outage-recovery' },
-      body: JSON.stringify({
-        model: 'claude-opus-5',
-        max_tokens: 1,
-        messages: [{ role: 'user', content: 'hello' }],
+      response: new Response('{}', {
+        status: 200,
+        headers: {
+          'anthropic-ratelimit-unified-5h-utilization': '0.25',
+          'anthropic-ratelimit-unified-5h-reset': '1800000000',
+        },
       }),
+      createFallbackStorage,
+      useTempAccountFile,
+      getPlugin: (accountStoragePath, runtimeOverrides) => {
+        process.env.OPENCODE_ANTHROPIC_AUTH_FILE = accountStoragePath
+        return getPlugin(undefined, undefined, runtimeOverrides as never)
+      },
+      extractUrl,
+      tempConfigDir: () => tempConfigDir!,
     })
 
+    const response = await fixture.result.fetch(MESSAGES_URL, EMPTY_POST)
+
     expect(response.status).toBe(200)
-    expect(tokenCalls).toBe(1)
-    expect(authorizations).toEqual([
-      'Bearer stored-fallback-access',
-      'Bearer refreshed-sidecar-access',
-    ])
+    expect(fixture.authorizations).toEqual(['Bearer vault-served-access'])
+    const entries = await waitForFeedEntries(
+      (candidate) =>
+        candidate.some(
+          (entry: any) =>
+            entry.anthropic_account_uuid ===
+            '22222222-2222-2222-2222-222222222222',
+        ),
+      'the served fallback account UUID',
+    )
     expect(
-      calls.filter((call) => call.method === 'credential.report_auth_failure'),
-    ).toHaveLength(0)
-    await plugin.dispose?.()
+      entries.find((entry: any) => entry.anthropic_account_uuid !== undefined),
+    ).toMatchObject({
+      anthropic_account_uuid: '22222222-2222-2222-2222-222222222222',
+    })
+    await fixture.plugin.dispose?.()
   })
 
-  test('does not report a 401 from a sidecar-served fallback token', async () => {
-    const calls: CredentialCall[] = []
-    const storage = fallbackWithClaustrum({
-      claustrumHandle: 'handle-sidecar-401',
-      claustrum: { accounts: { 'fallback-1': { enabled: true } } },
-    } as never)
-    const connector = connectorFor(calls, () => {
-      throw new Error('vault unavailable')
+  test('uses the bootstrap UUID when a vault fallback omits account_id', async () => {
+    const bootstrapUuid = '33333333-3333-3333-3333-333333333333'
+    const fixture = await bootRuledClaustrumRow({
+      route: 'fallback-first',
+      quota: { enabled: false, failClosedOnUnknownQuota: false },
+      storageOverrides: { quotaHeaderFeed: { enabled: true } },
+      fallbacks: [
+        {
+          label: 'bootstrap-identity',
+          handle: `ckh_${'B'.repeat(43)}`,
+          access: 'sk-ant-oat01-vault-bootstrap-identity',
+        },
+      ],
+      connector: (calls) =>
+        connectorFor(calls, (method, params) => {
+          if (method !== 'credential.get') return { result: {} }
+          return credentialResponse(
+            params.handle === ruledMainHandle
+              ? 'vault-main-access'
+              : 'sk-ant-oat01-vault-bootstrap-identity',
+            1,
+          )
+        }),
+      onFetch: (input) => {
+        const url = extractUrl(input as string | URL | Request)
+        if (url.includes('/claude_cli/bootstrap')) {
+          return Response.json({
+            oauth_account: { account_uuid: bootstrapUuid },
+          })
+        }
+        return new Response('{}', {
+          status: 200,
+          headers: {
+            'anthropic-ratelimit-unified-5h-utilization': '0.25',
+            'anthropic-ratelimit-unified-5h-reset': '1800000000',
+          },
+        })
+      },
+      createFallbackStorage,
+      useTempAccountFile,
+      getPlugin: (accountStoragePath, runtimeOverrides) => {
+        process.env.OPENCODE_ANTHROPIC_AUTH_FILE = accountStoragePath
+        return getPlugin(undefined, undefined, runtimeOverrides as never)
+      },
+      extractUrl,
+      tempConfigDir: () => tempConfigDir!,
     })
 
-    const { authorizations, plugin, result } = await loadFallbackWithConnector(
-      storage,
-      connector,
-      new Response('{}', { status: 401 }),
-    )
-    const response = await result.fetch(MESSAGES_URL, EMPTY_POST)
+    const response = await fixture.result.fetch(MESSAGES_URL, EMPTY_POST)
 
-    expect(response.status).toBe(401)
-    expect(authorizations).toContain('Bearer stored-fallback-access')
+    expect(response.status).toBe(200)
+    const entries = await waitForFeedEntries(
+      (candidate) =>
+        candidate.some(
+          (entry: any) => entry.anthropic_account_uuid === bootstrapUuid,
+        ),
+      'the bootstrap fallback account UUID',
+    )
     expect(
-      calls.some((call) => call.method === 'credential.report_auth_failure'),
-    ).toBe(false)
-    await plugin.dispose?.()
+      entries.find((entry: any) => entry.anthropic_account_uuid !== undefined),
+    ).toMatchObject({ anthropic_account_uuid: bootstrapUuid })
+    await fixture.plugin.dispose?.()
   })
 
-  test('does not report a 401 when expiry-aware fallback serves a fresh sidecar token', async () => {
-    let now = 1_000
-    const calls: CredentialCall[] = []
-    const storage = fallbackWithClaustrum({
-      claustrumHandle: 'handle-expired-sidecar-401',
-      claustrum: { accounts: { 'fallback-1': { enabled: true } } },
-    } as never)
-    const connector = connectorFor(calls, () =>
-      credentialResponse('vault-expiring-access', 61, 1_010),
-    )
+  test('account status inspects the configured Claustrum connection file', async () => {
+    const storage = createFallbackStorage({ accounts: [] })
     await useTempAccountFile(storage)
-    const authorizations: string[] = []
-    globalThis.fetch = mock((input: unknown, init?: RequestInit) => {
-      if (
-        extractUrl(input as string | URL | Request).includes('/v1/messages')
-      ) {
-        const authorization =
-          new Headers(init?.headers).get('authorization') ?? ''
-        authorizations.push(authorization)
-        if (authorization === 'Bearer main-access') {
-          return Promise.resolve(new Response('{}', { status: 200 }))
-        }
-        return Promise.resolve(new Response('{}', { status: 401 }))
-      }
-      return Promise.resolve(new Response('{}', { status: 200 }))
-    }) as unknown as typeof fetch
-    const plugin = await getPlugin(undefined, undefined, {
-      claustrumConnector: connector,
-      claustrumNow: () => now,
-    })
-    const result = await plugin.auth.loader(
-      () =>
-        Promise.resolve({
-          type: 'oauth' as const,
-          access: 'main-access',
-          refresh: 'main-refresh',
-          expires: Date.now() + 100_000,
-        }),
-      { models: {} },
-    )
-    now = 2_000
-    const response = await result.fetch(MESSAGES_URL, EMPTY_POST)
+    const connectionFile = join(tempConfigDir!, 'configured-claustrum.json')
+    await writeFile(connectionFile, '{ not valid JSON')
+    const previousConnectionFile =
+      process.env.OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE
+    process.env.OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE =
+      connectionFile
 
-    expect(response.status).toBe(200)
-    expect(authorizations).toEqual([
-      'Bearer stored-fallback-access',
-      'Bearer main-access',
-    ])
-    expect(
-      calls.some((call) => call.method === 'credential.report_auth_failure'),
-    ).toBe(false)
-    await plugin.dispose?.()
+    try {
+      const mockClient = createMockClient()
+      const plugin = await getPlugin(mockClient)
+      await plugin.auth.loader(
+        () =>
+          Promise.resolve({
+            type: 'oauth' as const,
+            access: 'sk-ant-oat-main-access',
+            refresh: 'main-refresh',
+            expires: Date.now() + 100_000,
+          }),
+        { models: {} },
+      )
+
+      await expectHandledCommandResponse(
+        plugin['command.execute.before']({
+          command: 'claude-account',
+          arguments: '',
+          sessionID: 'configured-connection-status',
+        }),
+      )
+      const text = (mockClient.session.promptAsync as any).mock.calls.at(
+        -1,
+      )?.[0]?.body.parts[0]?.text
+      expect(text).toContain('- Claustrum: malformed')
+      await plugin.dispose?.()
+    } finally {
+      if (previousConnectionFile === undefined)
+        delete process.env.OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE
+      else
+        process.env.OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE =
+          previousConnectionFile
+    }
   })
 
-  test('reports a 401 using captured provenance after credential expiry', async () => {
-    const now = Date.now()
-    const calls: CredentialCall[] = []
-    const storage = createFallbackStorage({
-      routing: { mode: 'main-first' },
-      quota: { enabled: false, failClosedOnUnknownQuota: false },
-      claustrum: { accounts: { 'vault-only': { enabled: true } } },
-      accounts: [
-        {
-          id: 'vault-only',
-          type: 'oauth',
-          refresh: 'vault-only-refresh',
-          expires: now + 5 * 60 * 60 * 1000,
-          claustrumHandle: 'handle-expiry-skew',
-          quota: {
-            five_hour: {
-              usedPercent: 10,
-              remainingPercent: 90,
-              checkedAt: now,
-            },
-            seven_day: {
-              usedPercent: 10,
-              remainingPercent: 90,
-              checkedAt: now,
-            },
+  test('account modal payload projects Claustrum status through the real builder', async () => {
+    const sessionID = 'account-modal-projection'
+    const previousConnectionFile =
+      process.env.OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE
+
+    try {
+      resetNotificationsForTest()
+      const fixture = await bootSharedRuledClaustrumRow({
+        route: 'fallback-first',
+        fallbacks: [
+          {
+            label: 'projected',
+            handle: `ckh_${'A'.repeat(43)}`,
+            access: 'vault-projected-access',
           },
+        ],
+        createFallbackStorage,
+        useTempAccountFile,
+        getPlugin: async (accountStoragePath, runtimeOverrides) => {
+          const connectionFile = join(
+            tempConfigDir!,
+            'configured-claustrum.json',
+          )
+          await writeFile(
+            connectionFile,
+            JSON.stringify({
+              schema: 1,
+              wire_version: 1,
+              endpoints: [{ host: '127.0.0.1', port: 1234 }],
+            }),
+          )
+          process.env.OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE =
+            connectionFile
+          process.env.OPENCODE_ANTHROPIC_AUTH_FILE = accountStoragePath
+          return getPlugin(
+            createMockClient(),
+            tempConfigDir!,
+            runtimeOverrides as never,
+          )
         },
-        {
-          id: 'fallback-2',
-          type: 'oauth',
-          access: 'backup-access',
-          refresh: 'backup-refresh',
-          expires: now + 5 * 60 * 60 * 1000,
-        },
-      ],
-    })
-    let fallbackPhase = false
-    let claustrumClockReads = 0
-    const connector = connectorFor(calls, (method) => {
-      if (method === 'credential.get') {
-        return {
-          result: {
-            payload: Array.from(
-              new TextEncoder().encode(
-                JSON.stringify({ access_token: 'vault-expiry-skew-access' }),
-              ),
-            ),
-            expires_at_ms: 1_000,
-            record_version: 70,
+        extractUrl,
+        tempConfigDir: () => tempConfigDir!,
+      })
+      const plugin = fixture.plugin
+      drainNotifications(0, sessionID)
+      await drainSidebarWrites()
+      const sidebarState = await getSidebarState()
+      await expectHandledCommandResponse(
+        plugin['command.execute.before']({
+          command: 'claude-account',
+          arguments: '',
+          sessionID,
+        }),
+      )
+      const notification = drainNotifications(0, sessionID).at(-1)
+      const payload = notification?.payload
+      const accounts = payload?.knobs.accounts as Array<{
+        id: string
+        claustrumGate: string
+        vaultServed: boolean
+        vaultReauth: boolean
+        custodyState:
+          | 'na'
+          | 'off'
+          | 'on-vault-served'
+          | 'on-vault-reauth'
+          | 'on-cold'
+      }>
+      expect(payload?.command).toBe('claude-account')
+      expect(payload?.knobs.claustrumDetection).toBe('available')
+      expect(payload?.knobs.custodyMode).toBe('claustrum')
+      expect(payload?.knobs.custodyModeKnown).toBe(true)
+      expect(
+        accounts.find((account) => account.id === 'main')?.claustrumGate,
+      ).toBe('na')
+      expect(
+        accounts.find((account) => account.id === 'fallback-1')?.claustrumGate,
+      ).toBe('on')
+      expect(
+        accounts.find((account) => account.id === 'fallback-1')?.vaultServed,
+      ).toBe(true)
+      expect(
+        accounts.find((account) => account.id === 'fallback-1')?.vaultReauth,
+      ).toBe(false)
+      expect(
+        accounts.find((account) => account.id === 'fallback-1')?.custodyState,
+      ).toBe('on-vault-served')
+      const dialogCustodyState = accounts.find(
+        (account) => account.id === 'fallback-1',
+      )?.custodyState
+      expect(
+        sidebarState.fallbacks.find((account) => account.id === 'fallback-1')
+          ?.custodyState,
+      ).toBe(dialogCustodyState === 'na' ? undefined : dialogCustodyState)
+      const payloadBytes = JSON.stringify(payload)
+      expect(payloadBytes).not.toContain(
+        'ckh_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA',
+      )
+
+      await plugin.dispose?.()
+    } finally {
+      if (previousConnectionFile === undefined)
+        delete process.env.OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE
+      else
+        process.env.OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE =
+          previousConnectionFile
+    }
+  })
+
+  test.serial(
+    'does not route a manifest-resolved account through a legacy per-account flag',
+    async () => {
+      const calls: CredentialCall[] = []
+      const storage = createFallbackStorage({
+        routing: { mode: 'fallback-first' },
+        quota: { enabled: false, failClosedOnUnknownQuota: false },
+        accounts: [
+          {
+            id: 'work-alt',
+            label: 'work-alt',
+            type: 'oauth',
+            access: 'stored-fallback-access',
+            refresh: 'stored-fallback-refresh',
+            expires: Date.now() + 5 * 60 * 60 * 1000,
+          },
+        ],
+      })
+      storage.claustrum = { accounts: { 'work-alt': { enabled: true } } }
+      const { authorizations, plugin, result } =
+        await loadFallbackWithConnector(
+          storage,
+          manifestConnector(calls, new Map([[manifestHandle, 'vault-access']])),
+          new Response('{}', { status: 200 }),
+          {
+            beforePlugin: async () => {
+              await writeManifest([
+                { label: 'work-alt', handle: manifestHandle },
+              ])
+            },
           },
-        }
-      }
-      return { result: {} }
-    })
-    const authorizations: string[] = []
-    await useTempAccountFile(storage)
-    globalThis.fetch = mock((input: unknown, init?: RequestInit) => {
-      const url = extractUrl(input as string | URL | Request)
-      if (url === TOKEN_URL) {
-        return Promise.resolve(
-          new Response('refresh unavailable', { status: 500 }),
         )
-      }
-      if (url.includes('/v1/messages')) {
-        const authorization =
-          new Headers(init?.headers).get('authorization') ?? ''
-        authorizations.push(authorization)
-        if (authorization === 'Bearer main-access') fallbackPhase = true
-        if (authorization === 'Bearer main-access')
-          return Promise.resolve(new Response('{}', { status: 401 }))
-        if (authorization === 'Bearer vault-expiry-skew-access') {
-          return Promise.resolve(new Response('{}', { status: 401 }))
-        }
-        if (authorization === 'Bearer backup-access') {
-          return Promise.resolve(new Response('{}', { status: 200 }))
+      const payload = await runCustodyCommand(plugin, 'legacy-flag', '')
+      const accounts = payload?.knobs.accounts as Array<{
+        id: string
+        claustrumGate: string
+      }>
+
+      expect(
+        accounts.find((account) => account.id === 'work-alt')?.claustrumGate,
+      ).toBe('off')
+      const response = await result.fetch(MESSAGES_URL, EMPTY_POST)
+      expect(response.status).toBe(200)
+      expect(authorizations).toContain('Bearer main-access')
+      expect(calls.filter((call) => call.method === 'credential.get')).toEqual(
+        [],
+      )
+      await plugin.dispose?.()
+    },
+  )
+
+  test('treats an empty Claustrum connection setting as unset', async () => {
+    const previousConnectionFile =
+      process.env.OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE
+
+    try {
+      for (const configuredConnectionFile of ['', ' \t']) {
+        process.env.OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE =
+          configuredConnectionFile
+        const calls: CredentialCall[] = []
+        let connectionFile: string | undefined
+        const connector = async (options: unknown) => {
+          connectionFile = (options as { connectionFile?: string })
+            .connectionFile
+          return connectorFor(calls, (method) => {
+            if (method === 'credential.get')
+              return credentialResponse('vault-empty-setting', 8)
+            return { result: {} }
+          })()
         }
+        const { plugin } = await loadFallbackWithConnector(
+          fallbackWithClaustrum({
+            claustrumHandle: 'handle-empty-setting',
+            claustrum: { mode: 'claustrum' },
+          } as never),
+          connector,
+          new Response('{}', { status: 200 }),
+        )
+
+        expect(connectionFile).toBe(getDefaultClaustrumConnectionPath())
+        await plugin.dispose?.()
       }
-      return Promise.resolve(new Response('{}', { status: 200 }))
-    }) as unknown as typeof fetch
-    const plugin = await getPlugin(undefined, undefined, {
-      claustrumConnector: connector,
-      claustrumNow: () => {
-        if (!fallbackPhase) return 0
-        return claustrumClockReads++ < 2 ? 0 : 2_000
-      },
+    } finally {
+      if (previousConnectionFile === undefined)
+        delete process.env.OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE
+      else
+        process.env.OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE =
+          previousConnectionFile
+    }
+  })
+
+  test('enabled gate serves the resident vault credential', async () => {
+    const fixture = await bootRuledClaustrumRow({
+      route: 'fallback-first',
+      fallbacks: [
+        {
+          label: 'enabled',
+          handle: `ckh_${'E'.repeat(43)}`,
+          access: 'vault-access',
+        },
+      ],
     })
-    const result = await plugin.auth.loader(
-      () =>
-        Promise.resolve({
-          type: 'oauth' as const,
-          access: 'main-access',
-          refresh: 'main-refresh',
-          expires: now + 5 * 60 * 60 * 1000,
+    const initialCredentialGets = fixture.calls.filter(
+      (call) => call.method === 'credential.get',
+    ).length
+    expect(initialCredentialGets).toBeGreaterThan(0)
+    const response = await fixture.result.fetch(MESSAGES_URL, EMPTY_POST)
+
+    expect(response.status).toBe(200)
+    expect(fixture.authorizations).toContain('Bearer vault-access')
+    expect(fixture.authorizations).not.toContain(
+      'Bearer stored-fallback-access',
+    )
+    expect(
+      fixture.calls.filter((call) => call.method === 'credential.get'),
+    ).toHaveLength(initialCredentialGets)
+    await fixture.plugin.dispose?.()
+  })
+
+  test('does not use a JSON credential payload without a token as bearer auth', async () => {
+    const malformedPayload = JSON.stringify({ kind: 'opaque-credential' })
+    let malformed = false
+    const fixture = await bootRuledClaustrumRow({
+      route: 'fallback-first',
+      initialNow: 1_000,
+      response: new Response('{}', { status: 401 }),
+      fallbacks: [
+        {
+          label: 'malformed-payload',
+          handle: `ckh_${'P'.repeat(43)}`,
+          access: 'vault-warm-access',
+        },
+      ],
+      connector: (calls) =>
+        connectorFor(calls, (method, params) => {
+          if (method !== 'credential.get') return { result: {} }
+          if (params.handle === ruledMainHandle)
+            return credentialResponse('vault-main-access', 8, 10_000)
+          if (malformed) {
+            return {
+              result: {
+                payload: Array.from(new TextEncoder().encode(malformedPayload)),
+                expires_at_ms: 10_000,
+                record_version: 8,
+              },
+            }
+          }
+          return credentialResponse('vault-warm-access', 8, 2_000)
         }),
-      { models: {} },
+    })
+    malformed = true
+    fixture.setNow(3_000)
+    const response = await fixture.result.fetch(MESSAGES_URL, EMPTY_POST)
+
+    expect(response.status).toBe(401)
+    expect(fixture.authorizations).toContain('Bearer vault-main-access')
+    expect(fixture.authorizations).not.toContain(
+      'Bearer stored-fallback-access',
     )
+    expect(fixture.authorizations).not.toContain(`Bearer ${malformedPayload}`)
+    await Bun.sleep(10)
+    expect(fixture.calls.some((call) => call.method === 'credential.get')).toBe(
+      true,
+    )
+    await fixture.plugin.dispose?.()
+  })
 
-    const response = await result.fetch(MESSAGES_URL, EMPTY_POST)
+  test('backs off repeated transport Claustrum warm failures per handle', async () => {
+    const fallbackHandle = `ckh_${'X'.repeat(43)}`
+    let unavailable = false
+    const fixture = await bootRuledClaustrumRow({
+      route: 'fallback-first',
+      initialNow: 0,
+      response: new Response('{}', { status: 200 }),
+      fallbacks: [
+        {
+          label: 'transient-backoff',
+          handle: fallbackHandle,
+          access: 'stored-fallback-access',
+        },
+      ],
+      connector: (calls) =>
+        connectorFor(calls, (method, params) => {
+          if (method !== 'credential.get') return { result: {} }
+          if (params.handle === ruledMainHandle)
+            return credentialResponse('vault-main-access', 1)
+          if (!unavailable) return credentialResponse('vault-warm-access', 1, 1)
+          throw new Error('vault connection reset')
+        }),
+    })
+    unavailable = true
+    fixture.setNow(2)
+    fixture.plugin.__claustrumCredentialCache.invalidate(fallbackHandle)
+    await expect(
+      fixture.plugin.__claustrumCredentialCache.get(fallbackHandle),
+    ).rejects.toThrow('vault connection reset')
 
-    expect(response.status).toBe(200)
-    expect(authorizations).toEqual([
-      'Bearer main-access',
-      'Bearer vault-expiry-skew-access',
-      'Bearer backup-access',
-    ])
-    expect(
-      calls.filter((call) => call.method === 'credential.report_auth_failure'),
-    ).toHaveLength(1)
-    await plugin.dispose?.()
+    const requestCount = 12
+    for (let index = 0; index < requestCount; index += 1) {
+      const response = await fixture.result.fetch(MESSAGES_URL, EMPTY_POST)
+      expect(response.status).toBe(200)
+      await Bun.sleep(10)
+    }
+
+    const credentialGets = fixture.calls.filter(
+      (call) =>
+        call.method === 'credential.get' &&
+        call.params.handle === fallbackHandle,
+    ).length
+    expect(credentialGets).toBeLessThan(requestCount)
+    expect(credentialGets).toBeGreaterThan(0)
+    expect(fixture.authorizations).toContain('Bearer vault-main-access')
+    expect(fixture.authorizations).not.toContain(
+      'Bearer stored-fallback-access',
+    )
+    await fixture.plugin.dispose?.()
   })
 
-  test('does not report a 401 after the vault credential expires before serving sidecar auth', async () => {
-    let now = 1_000
-    const calls: CredentialCall[] = []
+  test('production cache construction supplies a bind identity to vault calls', async () => {
     const storage = fallbackWithClaustrum({
-      claustrumHandle: 'handle-stale-resident-401',
-      expires: Date.now() + 5 * 60 * 60 * 1000,
-      claustrum: { accounts: { 'fallback-1': { enabled: true } } },
+      claustrumHandle: 'handle-production-identity',
+      claustrum: { mode: 'claustrum' },
     } as never)
-    let credentialGets = 0
-    let releaseRefresh!: () => void
-    let refreshStarted!: () => void
-    const refreshReleased = new Promise<void>((resolve) => {
-      releaseRefresh = resolve
-    })
-    const refreshEntered = new Promise<void>((resolve) => {
-      refreshStarted = resolve
-    })
-    const deferredTimers: Array<() => void> = []
-    const setTimeoutOverride = ((handler: () => void, timeout?: number) => {
-      if (timeout === 0) {
-        deferredTimers.push(handler)
-        return 0 as unknown as ReturnType<typeof setTimeout>
-      }
-      return globalThis.setTimeout(handler, timeout)
-    }) as typeof globalThis.setTimeout
-    const connector = connectorFor(calls, (method) => {
-      if (method !== 'credential.get') return { result: {} }
-      credentialGets += 1
-      if (credentialGets === 1) {
-        return credentialResponse('vault-expired-access', 62, now + 10)
-      }
-      refreshStarted()
-      return refreshReleased.then(() =>
-        credentialResponse('vault-refreshed-access', 63, now + 5_000),
-      )
-    })
     await useTempAccountFile(storage)
-    const authorizations: string[] = []
-    let messageRequests = 0
-    globalThis.fetch = mock((input: unknown, init?: RequestInit) => {
-      if (
-        extractUrl(input as string | URL | Request).includes('/v1/messages')
-      ) {
-        messageRequests += 1
+    const wireCalls: Array<{
+      method: string
+      options?: Record<string, unknown>
+    }> = []
+    const connector = async () =>
+      ({
+        call: async (
+          _moduleId: string,
+          method: string,
+          _params: unknown,
+          options?: unknown,
+        ) => {
+          const normalizedOptions = (options ?? {}) as Record<string, unknown>
+          if (method === 'credential.get' && !normalizedOptions.identity) {
+            throw new Error('managed call requires a BindIdentity')
+          }
+          wireCalls.push({ method, options: normalizedOptions })
+          return credentialResponse('vault-production-access', 73)
+        },
+        close: () => {},
+      }) as never
+
+    const plugin = await getPlugin(undefined, '/project-root', {
+      claustrumConnector: connector,
+    })
+    const identity = wireCalls.find((call) => call.method === 'credential.get')
+      ?.options?.identity as Record<string, unknown> | undefined
+
+    expect(identity).toEqual({
+      project_root: '/project-root',
+      harness: 'opencode',
+      session: `store-${primeStorageFingerprint(
+        process.env.OPENCODE_ANTHROPIC_AUTH_FILE!,
+      )}`,
+    })
+    await plugin.dispose?.()
+  })
+
+  test('sticky quota refresh prefers the vault credential over sidecar access', async () => {
+    const staleCheckedAt = Date.now() - 10 * 60 * 1000
+    const storage = createFallbackStorage({
+      routing: { mode: 'sticky-balanced' },
+      quota: {
+        enabled: true,
+        checkIntervalMinutes: 5,
+        minimumRemaining: { five_hour: 1, seven_day: 1 },
+        failClosedOnUnknownQuota: true,
+        mainQuota: {
+          five_hour: {
+            usedPercent: 100,
+            remainingPercent: 0,
+            checkedAt: Date.now(),
+          },
+          seven_day: {
+            usedPercent: 100,
+            remainingPercent: 0,
+            checkedAt: Date.now(),
+          },
+        },
+        mainQuotaCheckedAt: Date.now(),
+      },
+      claustrum: { mode: 'claustrum' },
+      accounts: [
+        {
+          id: 'fallback-1',
+          type: 'oauth',
+          access: 'stale-sidecar-access',
+          refresh: 'fallback-refresh',
+          expires: Date.now() + 5 * 60 * 60 * 1000,
+          claustrumHandle: 'handle-sticky-quota',
+          quota: {
+            five_hour: {
+              usedPercent: 10,
+              remainingPercent: 90,
+              checkedAt: staleCheckedAt,
+            },
+            seven_day: {
+              usedPercent: 10,
+              remainingPercent: 90,
+              checkedAt: staleCheckedAt,
+            },
+          },
+        },
+      ],
+    })
+    const calls: CredentialCall[] = []
+    const connector = connectorFor(calls, (method, params) => {
+      if (method === 'credential.get' && params.handle === ruledMainHandle)
+        return credentialResponse('vault-main-access', 91)
+      if (method === 'credential.get')
+        return credentialResponse('vault-fresh-access', 91)
+      return { result: {} }
+    })
+    const {
+      authorizations: messageAuthorizations,
+      plugin,
+      result,
+    } = await loadRuledFallbackWithConnector(
+      storage,
+      connector,
+      new Response('{}', { status: 200 }),
+    )
+    const quotaManager = plugin.__quotaManager as any
+    const originalGetFallback = quotaManager.getFallback.bind(quotaManager)
+    const quotaTokens: string[] = []
+    quotaManager.getFallback = (accountId: string, account?: unknown) => {
+      if (accountId === 'fallback-1') return undefined
+      return originalGetFallback(accountId, account)
+    }
+    quotaManager.refreshFallback = async (
+      _accountId: string,
+      accessToken: string,
+    ) => {
+      quotaTokens.push(accessToken)
+      return {
+        five_hour: {
+          usedPercent: 10,
+          remainingPercent: 90,
+          checkedAt: Date.now(),
+        },
+        seven_day: {
+          usedPercent: 10,
+          remainingPercent: 90,
+          checkedAt: Date.now(),
+        },
+      }
+    }
+    const response = await result.fetch(MESSAGES_URL, {
+      method: 'POST',
+      headers: { 'x-session-affinity': 'sticky-quota-session' },
+      body: JSON.stringify({
+        model: 'claude-opus-5',
+        max_tokens: 1,
+        messages: [{ role: 'user', content: 'hello' }],
+      }),
+    })
+
+    expect(response.status).toBe(200)
+    expect(messageAuthorizations).toContain('Bearer vault-fresh-access')
+    expect(quotaTokens).toEqual(['vault-fresh-access'])
+    await plugin.dispose?.()
+  })
+
+  test('skips a Claustrum account when the vault credential is expired', async () => {
+    const tokenRefreshes: string[] = []
+    const fixture = await bootRuledClaustrumRow({
+      route: 'fallback-first',
+      initialNow: 1_000,
+      fallbacks: [
+        {
+          label: 'expired',
+          handle: `ckh_${'X'.repeat(43)}`,
+          access: 'vault-expired-access',
+        },
+        {
+          label: 'backup',
+          handle: `ckh_${'Y'.repeat(43)}`,
+          access: 'vault-backup-access',
+        },
+      ],
+      connector: (calls) =>
+        connectorFor(calls, (method, params) => {
+          if (method !== 'credential.get') return { result: {} }
+          if (params.handle === ruledMainHandle)
+            return credentialResponse('vault-main-access', 31, 10_000)
+          if (params.handle === `ckh_${'X'.repeat(43)}`)
+            return credentialResponse('vault-expired-access', 31, 2_000)
+          return credentialResponse('vault-backup-access', 31, 10_000)
+        }),
+      onFetch: (input, init) => {
+        if (extractUrl(input as string | URL | Request) === TOKEN_URL) {
+          tokenRefreshes.push(
+            (JSON.parse(String(init?.body)) as { refresh_token: string })
+              .refresh_token,
+          )
+        }
+        return new Response('{}', { status: 200 })
+      },
+    })
+    fixture.setNow(3_000)
+    const response = await fixture.result.fetch(MESSAGES_URL, EMPTY_POST)
+
+    expect(response.status).toBe(200)
+    expect(fixture.authorizations).toEqual(['Bearer vault-backup-access'])
+    expect(fixture.authorizations).not.toContain('Bearer vault-expired-access')
+    expect(tokenRefreshes).not.toContain('expired-stored-refresh')
+    expect(fixture.calls.some((call) => call.method === 'credential.get')).toBe(
+      true,
+    )
+    await fixture.plugin.dispose?.()
+  })
+
+  test('bounds startup warmup and continues with a cold account', async () => {
+    const releaseCold = deferred()
+    let cold = false
+    const fixture = await bootRuledClaustrumRow({
+      route: 'fallback-first',
+      initialNow: 1_000,
+      fallbacks: [
+        {
+          label: 'wedged',
+          handle: `ckh_${'W'.repeat(43)}`,
+          access: 'vault-warm-access',
+        },
+      ],
+      connector: (calls) =>
+        connectorFor(calls, async (method, params) => {
+          if (method !== 'credential.get') return { result: {} }
+          if (params.handle === ruledMainHandle)
+            return credentialResponse('vault-main-access', 1, 10_000)
+          if (cold) await releaseCold.promise
+          return credentialResponse('vault-warm-access', 1, 2_000)
+        }),
+    })
+    try {
+      cold = true
+      fixture.setNow(3_000)
+      const startedAt = performance.now()
+      const response = await withDeadlockGuard<Response>(
+        fixture.result.fetch(MESSAGES_URL, EMPTY_POST),
+        150,
+        'cold vault request exceeded 150ms',
+      )
+      expect(performance.now() - startedAt).toBeLessThan(150)
+      expect(response.status).toBe(200)
+      expect(fixture.authorizations).toEqual(['Bearer vault-main-access'])
+    } finally {
+      releaseCold.resolve()
+      await fixture.plugin.dispose?.()
+    }
+  })
+
+  test('detaches a stale-marked startup refresh and uses its result when it lands', async () => {
+    let releaseWarm!: () => void
+    const warmGate = new Promise<void>((resolve) => {
+      releaseWarm = resolve
+    })
+    let cold = false
+    const fixture = await bootRuledClaustrumRow({
+      route: 'fallback-first',
+      initialNow: 1_000,
+      fallbacks: [
+        {
+          label: 'stale-marked',
+          handle: `ckh_${'S'.repeat(43)}`,
+          access: 'vault-warm-access',
+        },
+      ],
+      connector: (calls) =>
+        connectorFor(calls, async (method, params) => {
+          if (method !== 'credential.get') return { result: {} }
+          if (params.handle === ruledMainHandle)
+            return credentialResponse('vault-main-access', 52, 10_000)
+          if (cold) {
+            await warmGate
+            return credentialResponse('vault-after-stale-refresh', 52, 10_000)
+          }
+          return credentialResponse('vault-warm-access', 52, 2_000)
+        }),
+    })
+    cold = true
+    fixture.setNow(3_000)
+    const coldResponse = await fixture.result.fetch(MESSAGES_URL, EMPTY_POST)
+    expect(coldResponse.status).toBe(200)
+    expect(fixture.authorizations).toContain('Bearer vault-main-access')
+    releaseWarm()
+    await Bun.sleep(150)
+    const refreshedResult = await fixture.plugin.auth.loader(
+      () => Promise.resolve(custodyTombstoneOAuth('anthropic') as never),
+      { models: {} },
+    )
+    const response = await refreshedResult.fetch(MESSAGES_URL, EMPTY_POST)
+
+    expect(response.status).toBe(200)
+    expect(fixture.authorizations).toContain('Bearer vault-after-stale-refresh')
+    await fixture.plugin.dispose?.()
+  })
+
+  test('reports a 401 with the record version of the served credential', async () => {
+    const fallbackHandle = `ckh_${'Q'.repeat(43)}`
+    const fixture = await bootRuledClaustrumRow({
+      route: 'fallback-first',
+      fallbacks: [
+        {
+          label: 'vault-401',
+          handle: fallbackHandle,
+          access: 'vault-401-access',
+        },
+      ],
+      connector: (calls) =>
+        connectorFor(calls, (method, params) => {
+          if (method !== 'credential.get') return { result: {} }
+          if (String(params.handle) === ruledMainHandle)
+            return credentialResponse('vault-main-access', 1)
+          return credentialResponse('vault-401-access', 23)
+        }),
+      response: new Response('{}', { status: 401 }),
+    })
+
+    const response = await fixture.result.fetch(MESSAGES_URL, EMPTY_POST)
+
+    expect(response.status).toBe(401)
+    expect(fixture.authorizations).toContain('Bearer vault-401-access')
+    expect(fixture.calls).toContainEqual({
+      method: 'credential.report_auth_failure',
+      params: {
+        handle: fallbackHandle,
+        provider_status: 401,
+        record_version: 23,
+        reporter_source: 'direct',
+      },
+    })
+    await fixture.plugin.dispose?.()
+  })
+
+  test('reports a vault 401 surfaced by the optimistic websocket relay', async () => {
+    const restoreWebSocket = installRelayResponseStart(401)
+    const fallbackHandle = `ckh_${'S'.repeat(43)}`
+    const fixture = await bootRuledClaustrumRow({
+      route: 'fallback-first',
+      fallbacks: [
+        {
+          label: 'vault-relay',
+          handle: fallbackHandle,
+          access: 'vault-relay-access',
+        },
+      ],
+      storageOverrides: {
+        relay: {
+          enabled: true,
+          url: 'https://relay.example.test',
+          token: 'relay-token',
+          fallbackToDirect: true,
+          transport: 'websocket',
+        },
+      },
+      connector: (calls) =>
+        connectorFor(calls, (method, params) => {
+          if (method !== 'credential.get') return { result: {} }
+          if (String(params.handle) === ruledMainHandle)
+            return credentialResponse('vault-main-access', 1)
+          return credentialResponse('vault-relay-access', 73)
+        }),
+      response: new Response('{}', { status: 500 }),
+    })
+
+    try {
+      const response = await fixture.result.fetch(MESSAGES_URL, {
+        method: 'POST',
+        headers: { 'x-session-affinity': 'relay-vault-401' },
+        body: JSON.stringify({
+          stream: true,
+          model: 'claude-sonnet-4-5',
+          messages: [{ role: 'user', content: 'relay auth failure' }],
+        }),
+      })
+      expect(response.status).toBe(200)
+      expect(await response.text()).toContain('relay_upstream_error')
+    } finally {
+      restoreWebSocket()
+    }
+
+    expect(fixture.calls).toContainEqual({
+      method: 'credential.report_auth_failure',
+      params: {
+        handle: fallbackHandle,
+        provider_status: 401,
+        record_version: 73,
+        reporter_source: 'relay_message_parse',
+      },
+    })
+    await fixture.plugin.dispose?.()
+  })
+
+  test('reports a sticky vault 401 surfaced by the optimistic websocket relay', async () => {
+    const checkedAt = Date.now()
+    const fallbackQuota = {
+      five_hour: {
+        usedPercent: 10,
+        remainingPercent: 90,
+        checkedAt,
+      },
+      seven_day: {
+        usedPercent: 10,
+        remainingPercent: 90,
+        checkedAt,
+      },
+    }
+    const restoreWebSocket = installRelayResponseStart(200, { status: 401 })
+    const fallbackHandle = `ckh_${'T'.repeat(43)}`
+    const fixture = await bootRuledClaustrumRow({
+      route: { sticky: 'sticky-relay-vault' },
+      fallbacks: [
+        {
+          label: 'sticky-relay-vault',
+          handle: fallbackHandle,
+          access: 'sticky-relay-access',
+          account: {
+            id: 'sticky-relay-vault',
+            expires: checkedAt + 5 * 60 * 60 * 1_000,
+            quota: fallbackQuota,
+          },
+        },
+      ],
+      quota: {
+        enabled: true,
+        checkIntervalMinutes: 5,
+        minimumRemaining: { five_hour: 1, seven_day: 1 },
+        failClosedOnUnknownQuota: false,
+        mainQuota: {
+          five_hour: { usedPercent: 100, remainingPercent: 0, checkedAt },
+          seven_day: { usedPercent: 100, remainingPercent: 0, checkedAt },
+        },
+        mainQuotaCheckedAt: checkedAt,
+      },
+      storageOverrides: {
+        relay: {
+          enabled: true,
+          url: 'https://relay.example.test',
+          token: 'relay-token',
+          fallbackToDirect: true,
+          transport: 'websocket',
+        },
+      },
+      connector: (calls) =>
+        connectorFor(calls, (method, params) => {
+          if (method !== 'credential.get') return { result: {} }
+          if (String(params.handle) === ruledMainHandle)
+            return credentialResponse('vault-main-access', 1)
+          return credentialResponse('sticky-relay-access', 74)
+        }),
+      response: new Response('{}', { status: 500 }),
+    })
+
+    try {
+      const response = await fixture.result.fetch(MESSAGES_URL, {
+        method: 'POST',
+        headers: { 'x-session-affinity': 'sticky-relay-vault-401' },
+        body: JSON.stringify({
+          stream: true,
+          model: 'claude-opus-5',
+          messages: [{ role: 'user', content: 'sticky relay auth failure' }],
+        }),
+      })
+      expect(response.status).toBe(200)
+      expect(await response.text()).toContain('relay_upstream_error')
+    } finally {
+      restoreWebSocket()
+    }
+
+    expect(fixture.calls).toContainEqual({
+      method: 'credential.report_auth_failure',
+      params: {
+        handle: fallbackHandle,
+        provider_status: 401,
+        record_version: 74,
+        reporter_source: 'relay_status_field',
+      },
+    })
+    await fixture.plugin.dispose?.()
+  })
+
+  test('does not report relay 401s for non-vault routes', async () => {
+    const storage = createFallbackStorage({
+      routing: { mode: 'fallback-first' },
+      relay: {
+        enabled: true,
+        url: 'https://relay.example.test',
+        token: 'relay-token',
+        fallbackToDirect: true,
+        transport: 'websocket',
+      },
+      quota: { enabled: false, failClosedOnUnknownQuota: false },
+      accounts: [
+        {
+          id: 'plain-fallback',
+          type: 'oauth',
+          access: 'plain-fallback-access',
+          refresh: 'plain-fallback-refresh',
+          expires: Date.now() + 5 * 60 * 60 * 1000,
+        },
+      ],
+    })
+    await useTempAccountFile(storage)
+    globalThis.fetch = mock(() =>
+      Promise.resolve(new Response('{}', { status: 500 })),
+    ) as unknown as typeof fetch
+    const restoreWebSocket = installRelayResponseStart(401)
+    const plugin = await getPlugin()
+    const result = await plugin.auth.loader(
+      () =>
+        Promise.resolve({
+          type: 'oauth' as const,
+          access: 'main-access',
+          refresh: 'main-refresh',
+          expires: Date.now() + 100_000,
+        }),
+      { models: {} },
+    )
+
+    try {
+      const response = await result.fetch(MESSAGES_URL, {
+        method: 'POST',
+        headers: { 'x-session-affinity': 'relay-plain-401' },
+        body: JSON.stringify({
+          stream: true,
+          model: 'claude-sonnet-4-5',
+          messages: [{ role: 'user', content: 'plain relay auth failure' }],
+        }),
+      })
+      expect(response.status).toBe(200)
+      expect(await response.text()).toContain('relay_upstream_error')
+    } finally {
+      restoreWebSocket()
+      await plugin.dispose?.()
+    }
+  })
+
+  test('suppresses a raced 401 report when the cache already holds a newer version', async () => {
+    const fallbackHandle = `ckh_${'U'.repeat(43)}`
+    let fallbackGets = 0
+    let cache: {
+      invalidate: (handle: string, recordVersion?: number) => void
+      get: (handle: string) => Promise<unknown>
+    }
+    const fixture = await bootRuledClaustrumRow({
+      route: 'fallback-first',
+      fallbacks: [
+        {
+          label: 'raced-401',
+          handle: fallbackHandle,
+          access: 'vault-old-access',
+        },
+      ],
+      connector: (calls) =>
+        connectorFor(calls, (method, params) => {
+          if (method !== 'credential.get') return { result: {} }
+          if (String(params.handle) === ruledMainHandle)
+            return credentialResponse('vault-main-access', 1)
+          fallbackGets += 1
+          return credentialResponse(
+            fallbackGets === 1 ? 'vault-old-access' : 'vault-new-access',
+            fallbackGets === 1 ? 41 : 42,
+          )
+        }),
+      onFetch: async (input, init) => {
+        const url = extractUrl(input as string | URL | Request)
+        if (url.includes('/v1/messages')) {
+          const authorization = new Headers(init?.headers).get('authorization')
+          if (
+            fallbackGets === 1 &&
+            authorization === 'Bearer vault-old-access'
+          ) {
+            cache.invalidate(fallbackHandle, 41)
+            await cache.get(fallbackHandle)
+            return new Response('{}', { status: 401 })
+          }
+        }
+        return new Response('{}', { status: 200 })
+      },
+    })
+    cache = fixture.plugin.__claustrumCredentialCache
+
+    expect(fallbackGets).toBe(1)
+    const response = await fixture.result.fetch(MESSAGES_URL, EMPTY_POST)
+
+    expect(response.status).toBe(200)
+    expect(fallbackGets).toBe(2)
+    expect(
+      fixture.calls.some(
+        (call) => call.method === 'credential.report_auth_failure',
+      ),
+    ).toBe(false)
+    await fixture.plugin.dispose?.()
+  })
+
+  test('cold custody never refreshes a sidecar after a 401', async () => {
+    const checkedAt = Date.now()
+    const fallbackQuota = {
+      five_hour: {
+        usedPercent: 10,
+        remainingPercent: 90,
+        checkedAt,
+      },
+      seven_day: {
+        usedPercent: 10,
+        remainingPercent: 90,
+        checkedAt,
+      },
+    }
+    const fallbackHandle = `ckh_${'O'.repeat(43)}`
+    let unavailable = false
+    let tokenCalls = 0
+    const fixture = await bootRuledClaustrumRow({
+      route: { sticky: 'fallback-1' },
+      initialNow: 0,
+      quota: {
+        enabled: true,
+        checkIntervalMinutes: 5,
+        minimumRemaining: { five_hour: 1, seven_day: 1 },
+        failClosedOnUnknownQuota: true,
+        mainQuota: {
+          five_hour: { usedPercent: 100, remainingPercent: 0, checkedAt },
+          seven_day: { usedPercent: 100, remainingPercent: 0, checkedAt },
+        },
+        mainQuotaCheckedAt: checkedAt,
+      },
+      fallbacks: [
+        {
+          label: 'outage-recovery',
+          handle: fallbackHandle,
+          access: 'stored-fallback-access',
+          account: { quota: fallbackQuota },
+        },
+      ],
+      connector: (calls) =>
+        connectorFor(calls, (method, params) => {
+          if (method !== 'credential.get') return { result: {} }
+          if (params.handle === ruledMainHandle)
+            return credentialResponse('vault-main-access', 1)
+          if (!unavailable) return credentialResponse('vault-warm-access', 1, 1)
+          throw new Error('vault unavailable')
+        }),
+      onFetch: (input) => {
+        if (extractUrl(input as string | URL | Request) === TOKEN_URL)
+          tokenCalls += 1
+        return new Response('{}', { status: 200 })
+      },
+    })
+    unavailable = true
+    fixture.setNow(2)
+    fixture.plugin.__claustrumCredentialCache.invalidate(fallbackHandle)
+    await expect(
+      fixture.plugin.__claustrumCredentialCache.get(fallbackHandle),
+    ).rejects.toThrow('vault unavailable')
+
+    const response = await fixture.result.fetch(MESSAGES_URL, {
+      method: 'POST',
+      headers: { 'x-session-affinity': 'vault-outage-recovery' },
+      body: JSON.stringify({
+        model: 'claude-opus-5',
+        max_tokens: 1,
+        messages: [{ role: 'user', content: 'hello' }],
+      }),
+    })
+
+    expect(response.status).toBe(429)
+    expect(tokenCalls).toBe(0)
+    expect(fixture.authorizations).toEqual([])
+    expect(
+      fixture.calls.filter(
+        (call) => call.method === 'credential.report_auth_failure',
+      ),
+    ).toHaveLength(0)
+    await fixture.plugin.dispose?.()
+  })
+
+  test('reports a 401 using captured provenance after credential expiry', async () => {
+    const requestStarted = deferred()
+    const releaseVaultResponse = deferred()
+    const fallbackHandle = `ckh_${'V'.repeat(43)}`
+    const fixture = await bootRuledClaustrumRow({
+      route: 'fallback-first',
+      initialNow: 0,
+      fallbacks: [
+        {
+          label: 'vault-only',
+          handle: fallbackHandle,
+          access: 'vault-expiry-skew-access',
+          account: { id: 'vault-only' },
+        },
+      ],
+      connector: (calls) =>
+        connectorFor(calls, (method, params) => {
+          if (method !== 'credential.get') return { result: {} }
+          if (String(params.handle) === ruledMainHandle)
+            return credentialResponse('vault-main-access', 1)
+          return credentialResponse('vault-expiry-skew-access', 70, 1_000)
+        }),
+      onFetch: async (input, init) => {
+        const url = extractUrl(input as string | URL | Request)
+        if (url === TOKEN_URL) throw new Error('local refresh must not run')
+        if (url.includes('/v1/messages')) {
+          const authorization =
+            new Headers(init?.headers).get('authorization') ?? ''
+          if (authorization === 'Bearer vault-expiry-skew-access') {
+            requestStarted.resolve()
+            await releaseVaultResponse.promise
+            return new Response('{}', { status: 401 })
+          }
+        }
+        return new Response('{}', { status: 200 })
+      },
+    })
+
+    const responsePromise = fixture.result.fetch(MESSAGES_URL, EMPTY_POST)
+    await requestStarted.promise
+    fixture.setNow(2_000)
+    releaseVaultResponse.resolve()
+    const response = await responsePromise
+
+    expect(response.status).toBe(200)
+    expect(fixture.authorizations).toEqual([
+      'Bearer vault-expiry-skew-access',
+      'Bearer vault-main-access',
+    ])
+    expect(fixture.calls).toContainEqual({
+      method: 'credential.report_auth_failure',
+      params: {
+        handle: fallbackHandle,
+        provider_status: 401,
+        record_version: 70,
+        reporter_source: 'direct',
+      },
+    })
+    await fixture.plugin.dispose?.()
+  })
+})
+
+async function readFeedEntries() {
+  const directory = process.env.OPENCODE_ANTHROPIC_AUTH_QUOTA_FEED_DIR!
+  try {
+    const files = await readdir(directory)
+    const records = await Promise.all(
+      files.map(async (file) =>
+        JSON.parse(await readFile(join(directory, file), 'utf8')),
+      ),
+    )
+    return records.flatMap((record) => Object.values(record.entries ?? {}))
+  } catch {
+    return []
+  }
+}
+
+async function waitForFeedEntries(
+  predicate: (entries: Awaited<ReturnType<typeof readFeedEntries>>) => boolean,
+  description: string,
+) {
+  const deadline = performance.now() + 2_500
+  let entries = await readFeedEntries()
+  while (!predicate(entries) && performance.now() < deadline) {
+    await Bun.sleep(10)
+    entries = await readFeedEntries()
+  }
+  if (!predicate(entries)) {
+    throw new Error(
+      `Quota header feed did not match ${description}: ${JSON.stringify(entries)}`,
+    )
+  }
+  return entries
+}
+
+async function waitForLogRecord(
+  records: LogTestRecord[],
+  predicate: (record: LogTestRecord) => boolean,
+  description: string,
+) {
+  const deadline = performance.now() + 2_500
+  while (!records.some(predicate) && performance.now() < deadline) {
+    await Bun.sleep(10)
+  }
+  if (!records.some(predicate)) {
+    throw new Error(
+      `Expected log record ${description}: ${JSON.stringify(records)}`,
+    )
+  }
+}
+
+async function loadMainAndFetch(
+  storage: AccountStorage,
+  response: Response | (() => Response),
+  requestHeaders?: Record<string, string>,
+) {
+  await useTempAccountFile(storage)
+  globalThis.fetch = mock(() =>
+    Promise.resolve(
+      typeof response === 'function' ? response() : response.clone(),
+    ),
+  ) as unknown as typeof fetch
+  const plugin = await getPlugin()
+  const result = await plugin.auth.loader(
+    () =>
+      Promise.resolve({
+        type: 'oauth',
+        access: 'main-access',
+        refresh: 'main-refresh',
+        expires: Date.now() + 100000,
+      }),
+    { models: {} },
+  )
+  const fetched = await result.fetch(MESSAGES_URL, {
+    method: 'POST',
+    headers: requestHeaders,
+    body: JSON.stringify({ model: 'claude-sonnet-4-5', messages: [] }),
+  })
+  return { plugin, response: fetched }
+}
+
+describe('quota header feed integration', () => {
+  const originalFetch = globalThis.fetch
+
+  afterEach(() => {
+    globalThis.fetch = originalFetch
+  })
+
+  test.serial(
+    'fresh claustrum install persists the vault provider uuid instead of local identity material',
+    async () => {
+      const providerAccountUuid = 'provider-account-uuid'
+      const manifestHandle = `ckh_${'M'.repeat(43)}`
+      const tombstone = custodyTombstoneOAuth('anthropic')
+      await useTempAccountFile(
+        createFallbackStorage({
+          claustrum: { mode: 'claustrum' },
+          quota: { enabled: true, failClosedOnUnknownQuota: false },
+          quotaHeaderFeed: { enabled: true },
+          mainAccountId: undefined,
+          accounts: [],
+        }),
+      )
+      const manifestPath = join(tempConfigDir!, 'handles.json')
+      await writeFile(
+        manifestPath,
+        JSON.stringify({
+          version: 1,
+          providers: [
+            {
+              provider: 'anthropic',
+              serve: 'anthropic-auth',
+              accounts: [
+                {
+                  label: 'main',
+                  handle: manifestHandle,
+                  credential_id: custodyCredentialId('main'),
+                },
+              ],
+            },
+          ],
+        }),
+      )
+      await chmod(manifestPath, 0o600)
+      process.env.CLAUSTRUM_OPENCODE_HANDLES = manifestPath
+      globalThis.fetch = mock(
+        (input: Parameters<typeof globalThis.fetch>[0]) => {
+          const url = extractUrl(input)
+          if (url.includes('/claude_cli/bootstrap')) {
+            return Promise.resolve(
+              Response.json({
+                oauth_account: { account_uuid: providerAccountUuid },
+              }),
+            )
+          }
+          if (url.includes('/api/oauth/profile')) {
+            return Promise.resolve(
+              Response.json({
+                organization: {
+                  rate_limit_tier: 'default_claude_max_5x',
+                  organization_type: 'claude_team',
+                },
+              }),
+            )
+          }
+          return Promise.resolve(
+            new Response('{}', {
+              status: 200,
+              headers: {
+                'anthropic-ratelimit-unified-5h-utilization': '0.25',
+                'anthropic-ratelimit-unified-5h-reset': '1800000000',
+              },
+            }),
+          )
+        },
+      ) as unknown as typeof fetch
+      const calls: CredentialCall[] = []
+      const plugin = await getPlugin(undefined, undefined, {
+        claustrumConnector: async () =>
+          ({
+            call: async (
+              _moduleId: string,
+              method: string,
+              params: unknown,
+            ) => {
+              calls.push({
+                method,
+                params: (params ?? {}) as Record<string, unknown>,
+              })
+              return method === 'credential.get'
+                ? {
+                    result: {
+                      payload: Array.from(
+                        new TextEncoder().encode(
+                          JSON.stringify({
+                            access_token: 'sk-ant-oat01-vault-main',
+                          }),
+                        ),
+                      ),
+                      expires_at_ms: Date.now() + 60_000,
+                      record_version: 1,
+                    },
+                  }
+                : { result: {} }
+            },
+            close: () => {},
+          }) as never,
+      })
+      const result = await plugin.auth.loader(
+        () => Promise.resolve(tombstone as never),
+        { models: {} },
+      )
+
+      const response = await result.fetch(MESSAGES_URL, {
+        method: 'POST',
+        body: JSON.stringify({ model: 'claude-sonnet-4-5', messages: [] }),
+      })
+      await response.text()
+      await waitForFeedEntries(
+        (entries) =>
+          entries.some(
+            (entry: any) =>
+              entry.anthropic_account_uuid === providerAccountUuid,
+          ),
+        'the vault provider identity',
+      )
+      await expectHandledCommandResponse(
+        plugin['command.execute.before']({
+          command: 'claude-account',
+          arguments: '',
+          sessionID: 'fresh-claustrum-profile',
+        }),
+      )
+
+      const profileDeadline = performance.now() + 2_500
+      let persisted = await loadAccounts()
+      while (
+        persisted?.main?.profile?.providerAccountUuid !== providerAccountUuid &&
+        performance.now() < profileDeadline
+      ) {
+        await Bun.sleep(10)
+        persisted = await loadAccounts()
+      }
+      const rawStore = await readFile(
+        process.env.OPENCODE_ANTHROPIC_AUTH_FILE!,
+        'utf8',
+      )
+      const entries = await readFeedEntries()
+      const feedEntry = entries.find(
+        (entry: any) => entry.anthropic_account_uuid === providerAccountUuid,
+      ) as any
+      expect(persisted?.main?.profile?.providerAccountUuid).toBe(
+        providerAccountUuid as ProviderAccountUuid,
+      )
+      expect(feedEntry.anthropic_account_uuid).toBe(providerAccountUuid)
+      expect(rawStore).not.toContain(String(tombstone.refresh))
+      expect(feedEntry.anthropic_account_uuid).not.toBe(
+        persisted?.mainAccountId,
+      )
+      await plugin.dispose?.()
+    },
+  )
+
+  test.serial(
+    'non-OAT compatibility identity stays a local quota key without a provider uuid',
+    async () => {
+      await useTempAccountFile(
+        createFallbackStorage({
+          quota: { enabled: true, failClosedOnUnknownQuota: false },
+          quotaHeaderFeed: { enabled: true },
+          accounts: [],
+        }),
+      )
+      let bootstrapRequests = 0
+      globalThis.fetch = mock(
+        (input: Parameters<typeof globalThis.fetch>[0]) => {
+          const url = extractUrl(input)
+          if (url.includes('/claude_cli/bootstrap')) bootstrapRequests += 1
+          return Promise.resolve(
+            new Response('{}', {
+              status: 200,
+              headers: {
+                'anthropic-ratelimit-unified-5h-utilization': '0.25',
+                'anthropic-ratelimit-unified-5h-reset': '1800000000',
+              },
+            }),
+          )
+        },
+      ) as unknown as typeof fetch
+      const plugin = await getPlugin()
+      const result = await plugin.auth.loader(
+        () =>
+          Promise.resolve({
+            type: 'oauth',
+            access: 'local-adapter-access',
+            refresh: 'local-adapter-refresh',
+            expires: Date.now() + 100_000,
+          }),
+        { models: {} },
+      )
+      const response = await result.fetch(MESSAGES_URL, {
+        method: 'POST',
+        body: JSON.stringify({ model: 'claude-sonnet-4-5', messages: [] }),
+      })
+      await response.text()
+      const entries = await waitForFeedEntries(
+        (candidate) => candidate.length === 1,
+        'the local compatibility entry',
+      )
+      const persisted = await loadAccounts()
+      expect(bootstrapRequests).toBe(0)
+      expect(persisted?.mainAccountId).toBeDefined()
+      expect((entries[0] as any)?.anthropic_account_uuid).toBeNull()
+      const resolution = await plugin.__resolveMainQuotaIdentityForTest(
+        'local-adapter-access',
+      )
+      expect(resolution.providerAccountUuid).toBeUndefined()
+      expect(resolution.state).toBe('na')
+      await plugin.dispose?.()
+    },
+  )
+
+  async function publishFallbackUuid({
+    fallbackUuid,
+    persistedUuid,
+    bootstrapResponse,
+  }: {
+    fallbackUuid: string
+    persistedUuid?: ProviderAccountUuid
+    bootstrapResponse: unknown
+  }) {
+    const fallbackAccess = `sk-ant-oat-${randomUUID()}`
+    await useTempAccountFile(
+      createFallbackStorage({
+        quotaHeaderFeed: { enabled: true },
+        accounts: [
+          {
+            id: 'fallback-1',
+            type: 'oauth',
+            access: fallbackAccess,
+            refresh: 'fallback-refresh',
+            expires: Date.now() + 5 * 60 * 60 * 1000,
+            ...(persistedUuid && { anthropicAccountUuid: persistedUuid }),
+            quota: {
+              five_hour: {
+                usedPercent: 25,
+                remainingPercent: 75,
+                checkedAt: Date.now(),
+              },
+              seven_day: {
+                usedPercent: 30,
+                remainingPercent: 70,
+                checkedAt: Date.now(),
+              },
+            },
+          },
+        ],
+      }),
+    )
+    globalThis.fetch = mock((input: any, init?: RequestInit) => {
+      const url = extractUrl(input)
+      if (url.includes('/claude_cli/bootstrap')) {
+        return Promise.resolve(Response.json(bootstrapResponse))
+      }
+      if (url.includes('/v1/messages')) {
         const authorization = new Headers(init?.headers).get('authorization')
-        if (authorization) authorizations.push(authorization)
-        if (authorization === 'Bearer main-access') {
+        if (authorization === `Bearer ${fallbackAccess}`) {
           return Promise.resolve(
-            new Response(messageRequests === 1 ? null : '{}', {
-              status: messageRequests === 1 ? 401 : 200,
+            new Response('{}', {
+              status: 200,
+              headers: { 'anthropic-ratelimit-unified-5h-utilization': '0.25' },
             }),
           )
         }
-        return Promise.resolve(new Response(null, { status: 401 }))
+        return Promise.resolve(new Response(null, { status: 429 }))
       }
-      return Promise.resolve(new Response('{}', { status: 200 }))
+      return Promise.resolve(Response.json({}))
     }) as unknown as typeof fetch
-    const plugin = await getPlugin(undefined, undefined, {
-      claustrumConnector: connector,
-      claustrumNow: () => now,
-      setTimeout: setTimeoutOverride,
-    })
+
+    const plugin = await getPlugin()
     const result = await plugin.auth.loader(
       () =>
         Promise.resolve({
@@ -3426,111 +5675,28 @@ describe('fallback Claustrum credential resolution', () => {
         }),
       { models: {} },
     )
-
-    now = 2_000
     const response = await result.fetch(MESSAGES_URL, EMPTY_POST)
-    for (const deferredTimer of deferredTimers.splice(0)) deferredTimer()
-    await refreshEntered
-    releaseRefresh()
-    await Bun.sleep(0)
-
-    expect(response.status).toBe(200)
-    expect(authorizations).toContain('Bearer stored-fallback-access')
-    expect(credentialGets).toBe(2)
-    expect(
-      calls.some((call) => call.method === 'credential.report_auth_failure'),
-    ).toBe(false)
-    await plugin.dispose?.()
-  })
-})
-
-async function readFeedEntries() {
-  const directory = process.env.OPENCODE_ANTHROPIC_AUTH_QUOTA_FEED_DIR!
-  try {
-    const files = await readdir(directory)
-    const records = await Promise.all(
-      files.map(async (file) =>
-        JSON.parse(await readFile(join(directory, file), 'utf8')),
-      ),
-    )
-    return records.flatMap((record) => Object.values(record.entries ?? {}))
-  } catch {
-    return []
-  }
-}
+    await response.text()
 
-async function waitForFeedEntries(
-  predicate: (entries: Awaited<ReturnType<typeof readFeedEntries>>) => boolean,
-  description: string,
-) {
-  const deadline = performance.now() + 2_500
-  let entries = await readFeedEntries()
-  while (!predicate(entries) && performance.now() < deadline) {
-    await Bun.sleep(10)
-    entries = await readFeedEntries()
-  }
-  if (!predicate(entries)) {
-    throw new Error(
-      `Quota header feed did not match ${description}: ${JSON.stringify(entries)}`,
+    const [published] = await waitForFeedEntries(
+      (entries) =>
+        entries.some(
+          (entry: any) => entry.anthropic_account_uuid === fallbackUuid,
+        ),
+      'a fallback UUID feed entry',
     )
-  }
-  return entries
-}
-
-async function waitForLogRecord(
-  records: LogTestRecord[],
-  predicate: (record: LogTestRecord) => boolean,
-  description: string,
-) {
-  const deadline = performance.now() + 2_500
-  while (!records.some(predicate) && performance.now() < deadline) {
-    await Bun.sleep(10)
-  }
-  if (!records.some(predicate)) {
-    throw new Error(
-      `Expected log record ${description}: ${JSON.stringify(records)}`,
+    const persisted = await waitForAccountStorage(
+      (candidate) =>
+        (
+          candidate?.accounts.find(
+            (account) => account.id === 'fallback-1',
+          ) as any
+        )?.anthropicAccountUuid === fallbackUuid,
     )
+    return { published, persisted }
   }
-}
-
-async function loadMainAndFetch(
-  storage: AccountStorage,
-  response: Response | (() => Response),
-  requestHeaders?: Record<string, string>,
-) {
-  await useTempAccountFile(storage)
-  globalThis.fetch = mock(() =>
-    Promise.resolve(
-      typeof response === 'function' ? response() : response.clone(),
-    ),
-  ) as unknown as typeof fetch
-  const plugin = await getPlugin()
-  const result = await plugin.auth.loader(
-    () =>
-      Promise.resolve({
-        type: 'oauth',
-        access: 'main-access',
-        refresh: 'main-refresh',
-        expires: Date.now() + 100000,
-      }),
-    { models: {} },
-  )
-  const fetched = await result.fetch(MESSAGES_URL, {
-    method: 'POST',
-    headers: requestHeaders,
-    body: JSON.stringify({ model: 'claude-sonnet-4-5', messages: [] }),
-  })
-  return { plugin, response: fetched }
-}
-
-describe('quota header feed integration', () => {
-  const originalFetch = globalThis.fetch
-
-  afterEach(() => {
-    globalThis.fetch = originalFetch
-  })
 
-  test('publishes a direct harvested response with the observation timestamp', async () => {
+  test('non-oat main feed leaves provider UUID null while retaining its quota slot', async () => {
     const originalNow = Date.now
     let clock = 1_000_000
     Date.now = () => clock
@@ -3573,7 +5739,7 @@ describe('quota header feed integration', () => {
       clock += 1_000
 
       const feedDirectory = process.env.OPENCODE_ANTHROPIC_AUTH_QUOTA_FEED_DIR!
-      await waitForFeedEntries(
+      const [feedEntry] = await waitForFeedEntries(
         (entries) => entries.length === 1,
         'one published entry',
       )
@@ -3588,6 +5754,7 @@ describe('quota header feed integration', () => {
         expect.objectContaining({
           identity_source: 'account_ref',
           account_ref: 'main-fixed-id',
+          anthropic_account_uuid: null,
           configured_account_count: 1,
           observed_at_ms: 1_000_000,
           quota: expect.objectContaining({
@@ -3595,6 +5762,7 @@ describe('quota header feed integration', () => {
           }),
         }),
       )
+      expect(record.lease_horizon_ms).toBe(180_000)
       expect(published).not.toHaveProperty('credential_id')
       for (const secret of [
         'main-access',
@@ -3611,11 +5779,251 @@ describe('quota header feed integration', () => {
       }
       expect(raw).not.toContain('"credential_id":"main"')
       expect(raw).not.toContain('"account_ref":"main"')
+      expect(feedEntry).toEqual(
+        expect.objectContaining({
+          account_ref: 'main-fixed-id',
+          anthropic_account_uuid: null,
+        }),
+      )
+      const persisted = await waitForAccountStorage(
+        (storage) =>
+          storage?.quota?.mainQuota?.accountIdentity === 'main-fixed-id',
+      )
+      expect(persisted?.quota?.mainQuota?.accountIdentity).toBe('main-fixed-id')
     } finally {
       Date.now = originalNow
     }
   })
 
+  test('oat main feed preserves its bootstrapped Anthropic account UUID', async () => {
+    const mainAccountId = 'main-oat-slot'
+    const providerAccountUuid = '33333333-3333-3333-3333-333333333333'
+    await useTempAccountFile(
+      createFallbackStorage({
+        mainAccountId,
+        quotaHeaderFeed: { enabled: true },
+        accounts: [],
+      }),
+    )
+    globalThis.fetch = mock((input: any) => {
+      const url = extractUrl(input)
+      if (url.includes('/claude_cli/bootstrap')) {
+        return Promise.resolve(
+          Response.json({
+            oauth_account: { account_uuid: providerAccountUuid },
+          }),
+        )
+      }
+      return Promise.resolve(
+        new Response('{}', {
+          status: 200,
+          headers: { 'anthropic-ratelimit-unified-5h-utilization': '0.25' },
+        }),
+      )
+    }) as unknown as typeof fetch
+
+    const plugin = await getPlugin()
+    const result = await plugin.auth.loader(
+      () =>
+        Promise.resolve({
+          type: 'oauth' as const,
+          access: 'sk-ant-oat-main-feed',
+          refresh: 'main-refresh',
+          expires: Date.now() + 100_000,
+        }),
+      { models: {} },
+    )
+    const response = await result.fetch(MESSAGES_URL, EMPTY_POST)
+    await response.text()
+
+    const [published] = await waitForFeedEntries(
+      (entries) =>
+        entries.some(
+          (entry: any) => entry.anthropic_account_uuid === providerAccountUuid,
+        ),
+      'a bootstrapped main UUID feed entry',
+    )
+    expect(published).toEqual(
+      expect.objectContaining({
+        account_ref: mainAccountId,
+        anthropic_account_uuid: providerAccountUuid,
+      }),
+    )
+  })
+
+  test('main feed drops a cached oat UUID after the current credential becomes non-oat', async () => {
+    const mainAccountId = 'main-oat-to-non-oat-slot'
+    const providerAccountUuid = '44444444-4444-4444-4444-444444444444'
+    let liveAccess = 'sk-ant-oat-main-feed-before-rotation'
+    await useTempAccountFile(
+      createFallbackStorage({
+        mainAccountId,
+        quotaHeaderFeed: { enabled: true },
+        accounts: [],
+      }),
+    )
+    globalThis.fetch = mock((input: any) => {
+      const url = extractUrl(input)
+      if (url.includes('/claude_cli/bootstrap')) {
+        return Promise.resolve(
+          Response.json({
+            oauth_account: { account_uuid: providerAccountUuid },
+          }),
+        )
+      }
+      return Promise.resolve(
+        new Response('{}', {
+          status: 200,
+          headers: { 'anthropic-ratelimit-unified-5h-utilization': '0.25' },
+        }),
+      )
+    }) as unknown as typeof fetch
+
+    const plugin = await getPlugin()
+    const result = await plugin.auth.loader(
+      () =>
+        Promise.resolve({
+          type: 'oauth' as const,
+          access: liveAccess,
+          refresh: `refresh-${liveAccess}`,
+          expires: Date.now() + 100_000,
+        }),
+      { models: {} },
+    )
+    await (await result.fetch(MESSAGES_URL, EMPTY_POST)).text()
+    await waitForFeedEntries(
+      (entries) =>
+        entries.some(
+          (entry: any) => entry.anthropic_account_uuid === providerAccountUuid,
+        ),
+      'a bootstrapped main UUID feed entry',
+    )
+
+    liveAccess = 'main-feed-non-oat-after-rotation'
+    await (await result.fetch(MESSAGES_URL, EMPTY_POST)).text()
+
+    const feedEntries = await waitForFeedEntries(
+      (entries) =>
+        entries.some(
+          (entry: any) =>
+            entry.account_ref === mainAccountId &&
+            entry.anthropic_account_uuid === null,
+        ),
+      'a non-oat main feed entry without a provider UUID',
+    )
+    const published = feedEntries.find(
+      (entry: any) =>
+        entry.account_ref === mainAccountId &&
+        entry.anthropic_account_uuid === null,
+    )
+    expect(published).toEqual(
+      expect.objectContaining({
+        account_ref: mainAccountId,
+        anthropic_account_uuid: null,
+      }),
+    )
+  })
+
+  test('fresh non-oat main install persists a quota slot and publishes no provider UUID', async () => {
+    await useTempAccountFile({
+      version: 1,
+      main: { type: 'opencode', provider: 'anthropic' },
+      quotaHeaderFeed: { enabled: true },
+      accounts: [],
+    })
+    globalThis.fetch = mock(() =>
+      Promise.resolve(
+        new Response('{}', {
+          status: 200,
+          headers: { 'anthropic-ratelimit-unified-5h-utilization': '0.25' },
+        }),
+      ),
+    ) as unknown as typeof fetch
+
+    const plugin = await getPlugin()
+    const result = await plugin.auth.loader(
+      () =>
+        Promise.resolve({
+          type: 'oauth' as const,
+          access: 'fresh-main-non-oat',
+          refresh: 'main-refresh',
+          expires: Date.now() + 100_000,
+        }),
+      { models: {} },
+    )
+    const response = await result.fetch(MESSAGES_URL, EMPTY_POST)
+    await response.text()
+
+    const persisted = await waitForAccountStorage(
+      (storage) =>
+        storage?.mainAccountId !== undefined &&
+        storage.quota?.mainQuota?.accountIdentity === storage.mainAccountId,
+    )
+    const [published] = await waitForFeedEntries(
+      (entries) =>
+        entries.some(
+          (entry: any) =>
+            entry.account_ref === persisted?.mainAccountId &&
+            entry.anthropic_account_uuid === null,
+        ),
+      'a fresh non-oat main feed entry',
+    )
+    expect(persisted?.mainAccountId).toBeDefined()
+    expect(persisted?.quota?.mainQuota?.accountIdentity).toBe(
+      persisted?.mainAccountId,
+    )
+    expect(published).toEqual(
+      expect.objectContaining({
+        account_ref: persisted?.mainAccountId,
+        anthropic_account_uuid: null,
+      }),
+    )
+  })
+
+  test('publishes and persists a fallback Anthropic account UUID', async () => {
+    const fallbackUuid = '11111111-1111-1111-1111-111111111111'
+    const { published, persisted } = await publishFallbackUuid({
+      fallbackUuid,
+      bootstrapResponse: { oauth_account: { account_uuid: fallbackUuid } },
+    })
+    expect(published).toEqual(
+      expect.objectContaining({
+        identity_source: 'account_ref',
+        account_ref: 'fallback-1',
+        anthropic_account_uuid: fallbackUuid,
+      }),
+    )
+    expect(
+      (
+        persisted?.accounts.find(
+          (account) => account.id === 'fallback-1',
+        ) as any
+      )?.anthropicAccountUuid,
+    ).toBe(fallbackUuid)
+  })
+
+  test('uses a persisted fallback Anthropic account UUID before bootstrap resolves it', async () => {
+    const fallbackUuid = '22222222-2222-2222-2222-222222222222'
+    const { published, persisted } = await publishFallbackUuid({
+      fallbackUuid,
+      persistedUuid: fallbackUuid as ProviderAccountUuid,
+      bootstrapResponse: {},
+    })
+    expect(published).toEqual(
+      expect.objectContaining({
+        account_ref: 'fallback-1',
+        anthropic_account_uuid: fallbackUuid,
+      }),
+    )
+    expect(
+      (
+        persisted?.accounts.find(
+          (account) => account.id === 'fallback-1',
+        ) as any
+      )?.anthropicAccountUuid,
+    ).toBe(fallbackUuid)
+  })
+
   test('cache-seeded poll fields survive a later header harvest into the feed', async () => {
     const originalNow = Date.now
     let clock = 1_000_000
@@ -4022,12 +6430,11 @@ describe('quota header feed integration', () => {
       await waitForLogRecord(
         records,
         (record) =>
-          record.level === 'trace' &&
+          record.level === 'debug' &&
           record.channel === 'quota' &&
           record.message ===
             'skipped stale fallback quota persistence after lineage change' &&
           record.payload?.accountId === 'fallback-1' &&
-          record.payload?.storedLineage === 'lineage-b' &&
           record.payload?.servedLineage === 'lineage-a',
         'stale fallback quota persistence discard',
       )
@@ -4318,11 +6725,12 @@ describe('quota header feed integration', () => {
         await waitForFeedEntries(
           (entries) =>
             entries.length === 1 &&
-            (entries[0] as any)?.account_ref === accountIdentity,
+            (entries[0] as any)?.account_ref === 'main-slot',
           'one account-a published entry',
         )
       )[0] as any
-      expect(published.account_ref).toBe(accountIdentity)
+      expect(published.account_ref).toBe('main-slot')
+      expect(published.anthropic_account_uuid).toBe(accountIdentity)
       expect(published.observed_at_ms).toBe(requestCheckedAt)
       expect(published.observed_at_ms).not.toBe(otherCheckedAt)
     } finally {
@@ -4448,9 +6856,9 @@ describe('quota header feed integration', () => {
       )
       const quotaManager = plugin.__quotaManager
       const checkedAt = Date.now()
-      quotaManager.setMain('account-a', {
+      quotaManager.setMain('main-slot', {
         quota: {
-          accountIdentity: 'account-a',
+          accountIdentity: 'main-slot',
           five_hour: {
             usedPercent: 100,
             remainingPercent: 0,
@@ -4461,7 +6869,7 @@ describe('quota header feed integration', () => {
         checkedAt,
       })
       const priorPoll = quotaManager.refreshMain(
-        'account-a',
+        'main-slot',
         'sk-ant-oat-token-a',
       )
       await oldPollStarted
@@ -4476,43 +6884,43 @@ describe('quota header feed integration', () => {
           }),
         { models: {} },
       )
-      expect(quotaManager.getMain('account-b')).toBeNull()
+      expect(quotaManager.getMain('main-slot')).toBeNull()
       const replacementPoll = quotaManager.refreshMain(
-        'account-b',
+        'main-slot',
         'sk-ant-oat-token-b',
       )
       releaseOldPoll(new Response('rate limited', { status: 429 }))
       await expect(priorPoll).rejects.toThrow('429')
       await replacementPoll
 
-      expect(quotaManager.getMain('account-a')).toBeNull()
-      expect(quotaManager.getMain('account-b')?.quota.five_hour).toEqual(
+      expect(quotaManager.getMain('main-slot')?.quota.five_hour).toEqual(
         expect.objectContaining({ remainingPercent: 90 }),
       )
       expect(quotaManager.isBackedOff()).toBe(false)
 
       const response = await resultB.fetch(MESSAGES_URL, EMPTY_POST)
       await response.text()
-      expect(quotaManager.getMain('account-b')?.quota.accountIdentity).toBe(
-        'account-b',
+      expect(quotaManager.getMain('main-slot')?.quota.accountIdentity).toBe(
+        'main-slot',
       )
       const entries = await waitForFeedEntries(
         (candidate) =>
           candidate.length === 1 &&
-          candidate.some((entry: any) => entry.account_ref === 'account-b'),
-        'one account-b published entry',
+          candidate.some((entry: any) => entry.account_ref === 'main-slot'),
+        'one main-slot published entry',
       )
       expect(entries).toEqual(
         expect.arrayContaining([
           expect.objectContaining({
             identity_source: 'account_ref',
-            account_ref: 'account-b',
+            account_ref: 'main-slot',
+            anthropic_account_uuid: 'account-b',
           }),
         ]),
       )
       expect(entries).not.toEqual(
         expect.arrayContaining([
-          expect.objectContaining({ account_ref: 'account-a' }),
+          expect.objectContaining({ anthropic_account_uuid: 'account-a' }),
         ]),
       )
     } finally {
@@ -4535,7 +6943,7 @@ describe('quota header feed integration', () => {
           checkIntervalMinutes: 5,
           failClosedOnUnknownQuota: true,
           mainQuota: {
-            accountIdentity: 'account-a',
+            accountIdentity: 'main-slot',
             five_hour: {
               usedPercent: 100,
               remainingPercent: 0,
@@ -4548,7 +6956,7 @@ describe('quota header feed integration', () => {
             checkedAt: now - 1_000,
             nextRetryAt: now + 60_000,
             retryCount: 1,
-            accountIdentity: 'account-a',
+            accountIdentity: 'main-slot',
           },
         },
       }),
@@ -4747,7 +7155,9 @@ describe('quota header feed integration', () => {
           expect.objectContaining({ account_ref: 'account-a' }),
         ]),
       )
-      expect(plugin.__quotaManager.getMain('account-a')).toBeNull()
+      expect(
+        plugin.__quotaManager.getMain('main-slot')?.quota.five_hour,
+      ).toBeUndefined()
     } finally {
       __setLogTestSink(null)
       setLogLevel('info')
@@ -4956,54 +7366,528 @@ describe('main identity boot order', () => {
     })
     timerObservedIds.length = 0
 
-    await plugin.auth.loader(auth, { models: {} })
-    await Bun.sleep(25)
-    const first = (await loadAccounts())?.mainAccountId
-    await plugin.auth.loader(auth, { models: {} })
-    const second = (await loadAccounts())?.mainAccountId
+    await plugin.auth.loader(auth, { models: {} })
+    await Bun.sleep(25)
+    const first = (await loadAccounts())?.mainAccountId
+    await plugin.auth.loader(auth, { models: {} })
+    const second = (await loadAccounts())?.mainAccountId
+
+    expect(first).toMatch(/^[0-9a-f-]{36}$/)
+    expect(second).toBe(first)
+    expect(timerObservedIds).toEqual([first, first])
+    expect(observedIds).toContain(first)
+  })
+})
+
+describe('package metadata', () => {
+  test('exports a runtime-loadable TUI entrypoint', async () => {
+    const packageJson = JSON.parse(
+      await readFile(new URL('../../package.json', import.meta.url), 'utf8'),
+    ) as {
+      exports?: Record<string, { import?: string; types?: string }>
+      files?: string[]
+      'oc-plugin'?: string[]
+      scripts?: Record<string, string>
+      dependencies?: Record<string, string>
+    }
+
+    expect(packageJson.exports?.['./tui']).toEqual({
+      types: './dist/tui.d.ts',
+      import: './src/tui/entry.mjs',
+    })
+    expect(packageJson.files).toContain('src/tui.tsx')
+    expect(packageJson.files).toContain('src/tui')
+    expect(packageJson.files).toContain('src/tui-compiled')
+    expect(packageJson.files).toContain('src/sidebar-state.ts')
+    expect(packageJson['oc-plugin']).toEqual(['server', 'tui'])
+    expect(packageJson.scripts?.build).toContain('bun run build:tui')
+    for (const dependency of ['@opentui/core', '@opentui/solid', 'solid-js']) {
+      expect(packageJson.dependencies?.[dependency]).toMatch(/^\d/)
+    }
+  })
+
+  test('raw TUI fallback is loadable for development hosts', async () => {
+    const mod = await import('../tui.tsx')
+    expect(mod.default?.id).toBe('cortexkit.anthropic-auth')
+    expect(mod.default?.tui).toBeFunction()
+  })
+})
+
+describe('AnthropicAuthPlugin', () => {
+  test('fixed auth content refuses before creating the main OAuth URL', async () => {
+    await useTempAccountFile({ version: 1, accounts: [] })
+    const previous = process.env.OPENCODE_AUTH_CONTENT
+    process.env.OPENCODE_AUTH_CONTENT = '{}'
+    try {
+      const authorize = mock(() =>
+        Promise.resolve({
+          url: 'https://example.test/oauth',
+          redirectUri: 'https://example.test/callback',
+          state: 'state',
+          verifier: 'verifier',
+        }),
+      )
+      const plugin = await getPlugin(undefined, undefined, { authorize })
+      await expect(plugin.auth.methods[0].authorize()).rejects.toMatchObject({
+        code: 'custody_login_observation_unavailable',
+      })
+      expect(authorize).not.toHaveBeenCalled()
+      const state = JSON.parse(
+        await readFile(
+          getAccountStatePath(process.env.OPENCODE_ANTHROPIC_AUTH_FILE!),
+          'utf8',
+        ),
+      )
+      expect(state.accounts).toEqual({})
+      await plugin.dispose?.()
+    } finally {
+      if (previous === undefined) delete process.env.OPENCODE_AUTH_CONTENT
+      else process.env.OPENCODE_AUTH_CONTENT = previous
+    }
+  })
+
+  test('main acknowledge consumes the completion record after a refusal', async () => {
+    const access = 'local-login-access'
+    const refresh = 'local-login-refresh'
+    const manifestHandle = `ckh_${'R'.repeat(43)}`
+    const manifest = JSON.stringify({
+      version: 1,
+      providers: [
+        {
+          provider: 'anthropic',
+          serve: 'anthropic-auth',
+          accounts: [
+            {
+              label: 'main',
+              handle: manifestHandle,
+              credential_id: custodyCredentialId('main'),
+            },
+          ],
+        },
+      ],
+    })
+    await useTempAccountFile(
+      createFallbackStorage({
+        claustrum: { mode: 'local' },
+        quota: { enabled: false },
+        accounts: [],
+      }),
+    )
+    const manifestPath = join(tempConfigDir!, 'handles.json')
+    await writeFile(manifestPath, manifest)
+    await chmod(manifestPath, 0o600)
+    process.env.CLAUSTRUM_OPENCODE_HANDLES = manifestPath
+
+    const authorize = mock(() =>
+      Promise.resolve({
+        url: 'https://example.test/oauth',
+        redirectUri: 'https://example.test/callback',
+        state: 'state',
+        verifier: 'verifier',
+      }),
+    )
+    globalThis.fetch = mock((input: unknown) => {
+      const url = extractUrl(input as string | URL | Request)
+      if (url === TOKEN_URL) {
+        return Promise.resolve(
+          Response.json({
+            access_token: access,
+            refresh_token: refresh,
+            expires_in: 3600,
+          }),
+        )
+      }
+      return Promise.resolve(new Response('{}', { status: 200 }))
+    }) as unknown as typeof fetch
+
+    const plugin = await getPlugin(undefined, undefined, { authorize })
+    const flow = await plugin.auth.methods[0].authorize()
+    await flow.callback('code=code&state=state')
+
+    let refuseRename = true
+    __setCustodyManifestLockTestOptions({
+      beforeRename: async () => {
+        if (!refuseRename) return
+        refuseRename = false
+        throw new Error('forced manifest refusal')
+      },
+    })
+    let reads = 0
+    const getAuth = mock(async () => {
+      reads += 1
+      if (reads === 1) {
+        return {
+          type: 'oauth',
+          access: 'different-access',
+          refresh: 'different-refresh',
+          expires: Date.now() + 100_000,
+        }
+      }
+      return {
+        type: 'oauth',
+        access,
+        refresh,
+        expires: Date.now() + 100_000,
+      }
+    })
+    await plugin.auth.loader(getAuth, { models: {} })
+    __setCustodyManifestLockTestOptions()
+
+    expect(
+      JSON.parse(await readFile(manifestPath, 'utf8')).providers[0].accounts,
+    ).toHaveLength(1)
+
+    await plugin.auth.loader(
+      () =>
+        Promise.resolve({
+          type: 'oauth' as const,
+          access,
+          refresh,
+          expires: Date.now() + 100_000,
+        }),
+      { models: {} },
+    )
+    const retainedManifest = JSON.parse(await readFile(manifestPath, 'utf8'))
+    expect(retainedManifest.providers[0].accounts).toHaveLength(1)
+    await plugin.dispose?.()
+    installDefaultFetchMock()
+  })
+
+  test('main acknowledge defers a transient manifest refusal to the next loader', async () => {
+    const access = 'local-login-retry-access'
+    const refresh = 'local-login-retry-refresh'
+    const manifestHandle = `ckh_${'S'.repeat(43)}`
+    await useTempAccountFile(
+      createFallbackStorage({
+        claustrum: { mode: 'local' },
+        quota: { enabled: false },
+        accounts: [],
+      }),
+    )
+    const manifestPath = join(tempConfigDir!, 'handles.json')
+    await writeFile(
+      manifestPath,
+      JSON.stringify({
+        version: 1,
+        providers: [
+          {
+            provider: 'anthropic',
+            serve: 'anthropic-auth',
+            accounts: [
+              {
+                label: 'main',
+                handle: manifestHandle,
+                credential_id: custodyCredentialId('main'),
+              },
+            ],
+          },
+        ],
+      }),
+    )
+    await chmod(manifestPath, 0o600)
+    process.env.CLAUSTRUM_OPENCODE_HANDLES = manifestPath
+
+    const authorize = mock(() =>
+      Promise.resolve({
+        url: 'https://example.test/oauth',
+        redirectUri: 'https://example.test/callback',
+        state: 'state',
+        verifier: 'verifier',
+      }),
+    )
+    globalThis.fetch = mock((input: unknown) => {
+      const url = extractUrl(input as string | URL | Request)
+      if (url === TOKEN_URL) {
+        return Promise.resolve(
+          Response.json({
+            access_token: access,
+            refresh_token: refresh,
+            expires_in: 3600,
+          }),
+        )
+      }
+      return Promise.resolve(new Response('{}', { status: 200 }))
+    }) as unknown as typeof fetch
+
+    let removalAttempts = 0
+    const plugin = await getPlugin(undefined, undefined, {
+      authorize,
+      setTimeout: mock((handler: TestTimerHandler) => {
+        handler()
+        return { unref() {} }
+      }) as unknown as typeof setTimeout,
+      removeCustodyHandleManifestEntry: async (
+        input: Parameters<typeof removeCustodyHandleManifestEntry>[0],
+      ) => {
+        removalAttempts += 1
+        if (removalAttempts === 1)
+          return { status: 'refused', code: 'lock_busy' } as const
+        return removeCustodyHandleManifestEntry(input)
+      },
+    } as unknown as PluginRuntimeOverrides)
+    try {
+      const flow = await plugin.auth.methods[0].authorize()
+      await flow.callback('code=code&state=state')
+      await plugin.auth.loader(
+        () =>
+          Promise.resolve({
+            type: 'oauth' as const,
+            access,
+            refresh,
+            expires: Date.now() + 100_000,
+          }),
+        { models: {} },
+      )
+
+      expect(removalAttempts).toBe(1)
+      await plugin.auth.loader(
+        () =>
+          Promise.resolve({
+            type: 'oauth' as const,
+            access,
+            refresh,
+            expires: Date.now() + 100_000,
+          }),
+        { models: {} },
+      )
+      expect(removalAttempts).toBe(2)
+      expect(
+        JSON.parse(await readFile(manifestPath, 'utf8')).providers[0].accounts,
+      ).toEqual([])
+    } finally {
+      await plugin.dispose?.()
+      installDefaultFetchMock()
+    }
+  })
+
+  test.serial(
+    'TUI fallback re-login fences the divergence marker at the served vault record version',
+    async () => {
+      const label = 'a'
+      const handle = `ckh_${'A'.repeat(43)}`
+      const token = 'relogin-a-access'
+      const refresh = 'relogin-a-refresh'
+      const authorize = mock(() =>
+        Promise.resolve({
+          url: 'https://example.test/oauth?state=state',
+          redirectUri: 'https://example.test/callback',
+          state: 'state',
+          verifier: 'verifier',
+        }),
+      )
+      const servedRecordVersion = 9
+      const client = createMockClient()
+      const fixture = await bootSharedRuledClaustrumRow({
+        route: 'fallback-first',
+        fallbacks: [{ label, handle, access: 'vault-a-access' }],
+        connector: (calls) =>
+          connectorFor(calls, (method, params) => {
+            if (method !== 'credential.get') return { result: {} }
+            return credentialResponse(
+              params.handle === handle ? 'vault-a-access' : 'vault-main-access',
+              params.handle === handle ? servedRecordVersion : 1,
+            )
+          }),
+        onFetch: (input, init) => {
+          const url = extractUrl(input as string | URL | Request)
+          if (url === TOKEN_URL) {
+            return Promise.resolve(
+              Response.json({
+                access_token: token,
+                refresh_token: refresh,
+                expires_in: 3600,
+              }),
+            )
+          }
+          return new Response('{}', { status: 200 })
+        },
+        createFallbackStorage,
+        useTempAccountFile,
+        getPlugin: async (accountStoragePath, runtimeOverrides) => {
+          process.env.OPENCODE_ANTHROPIC_AUTH_FILE = accountStoragePath
+          return getPlugin(client, undefined, {
+            ...runtimeOverrides,
+            authorize,
+          } as never)
+        },
+        extractUrl,
+        tempConfigDir: () => tempConfigDir!,
+      })
+      try {
+        const response = await fixture.result.fetch(MESSAGES_URL, EMPTY_POST)
+        await response.text()
+        expect(fixture.authorizations).toContain('Bearer vault-a-access')
+        expect(
+          fixture.calls.some(
+            (call) =>
+              call.method === 'credential.get' && call.params.handle === handle,
+          ),
+        ).toBe(true)
+
+        await expectHandledCommandResponse(
+          fixture.plugin['command.execute.before']({
+            command: 'claude-account',
+            arguments: 'local',
+            sessionID: 'tui-fallback-relogin',
+          }),
+        )
+        await expectHandledCommandResponse(
+          fixture.plugin['command.execute.before']({
+            command: 'claude-account',
+            arguments: 'add-oauth-start',
+            sessionID: 'tui-fallback-relogin',
+          }),
+        )
+        expect(client.session.promptAsync.mock.calls.at(-1)?.[0]).toEqual(
+          expect.objectContaining({
+            body: expect.objectContaining({
+              parts: [
+                expect.objectContaining({
+                  text: expect.stringContaining('state=state'),
+                }),
+              ],
+            }),
+          }),
+        )
+        await expectHandledCommandResponse(
+          fixture.plugin['command.execute.before']({
+            command: 'claude-account',
+            arguments: 'add-oauth-finish code#state --label a',
+            sessionID: 'tui-fallback-relogin',
+          }),
+        )
+
+        const stored = await loadAccounts()
+        expect(
+          stored?.accounts.find((account) => account.label === label),
+        ).toEqual(expect.objectContaining({ access: token, refresh }))
+        const state = JSON.parse(
+          await readFile(
+            getAccountStatePath(process.env.OPENCODE_ANTHROPIC_AUTH_FILE!),
+            'utf8',
+          ),
+        )
+        expect(
+          state.claustrumDivergence[custodyCredentialId(label)]
+            .minimumRecordVersion,
+        ).toBe(servedRecordVersion + 1)
+      } finally {
+        await fixture.plugin.dispose?.()
+        installDefaultFetchMock()
+      }
+    },
+  )
+
+  test('fresh install under local with a tombstoned slot', async () => {
+    const access = 'fresh-local-access'
+    const refresh = 'fresh-local-refresh'
+    const manifestHandle = `ckh_${'F'.repeat(43)}`
+    const manifest = JSON.stringify({
+      version: 1,
+      providers: [
+        {
+          provider: 'anthropic',
+          serve: 'anthropic-auth',
+          accounts: [
+            {
+              label: 'main',
+              handle: manifestHandle,
+              credential_id: custodyCredentialId('main'),
+            },
+          ],
+        },
+      ],
+    })
+    await useTempAccountFile(
+      createFallbackStorage({
+        claustrum: { mode: 'local' },
+        quota: { enabled: false },
+        accounts: [],
+      }),
+    )
+    const accountPath = process.env.OPENCODE_ANTHROPIC_AUTH_FILE!
+    const statePath = getAccountStatePath(accountPath)
+    await rm(statePath, { force: true })
+    const manifestPath = join(tempConfigDir!, 'handles.json')
+    await writeFile(manifestPath, manifest)
+    await chmod(manifestPath, 0o600)
+    process.env.CLAUSTRUM_OPENCODE_HANDLES = manifestPath
+    const authorize = mock(() =>
+      Promise.resolve({
+        url: 'https://example.test/oauth',
+        redirectUri: 'https://example.test/callback',
+        state: 'state',
+        verifier: 'verifier',
+      }),
+    )
+    const plugin = await getPlugin(undefined, undefined, { authorize })
 
-    expect(first).toMatch(/^[0-9a-f-]{36}$/)
-    expect(second).toBe(first)
-    expect(timerObservedIds).toEqual([first, first])
-    expect(observedIds).toContain(first)
-  })
-})
+    const dark = await plugin.auth.loader(
+      () => Promise.resolve(custodyTombstoneOAuth('anthropic') as never),
+      { models: {} },
+    )
+    await expect(dark.fetch(MESSAGES_URL, EMPTY_POST)).rejects.toMatchObject({
+      code: 'custody_state_mismatch',
+      verdict: 'REMAIN_DARK_PENDING_LOGIN',
+    })
+    await expect(readFile(statePath, 'utf8')).rejects.toMatchObject({
+      code: 'ENOENT',
+    })
 
-describe('package metadata', () => {
-  test('exports a runtime-loadable TUI entrypoint', async () => {
-    const packageJson = JSON.parse(
-      await readFile(new URL('../../package.json', import.meta.url), 'utf8'),
-    ) as {
-      exports?: Record<string, { import?: string; types?: string }>
-      files?: string[]
-      'oc-plugin'?: string[]
-      scripts?: Record<string, string>
-      dependencies?: Record<string, string>
-    }
+    globalThis.fetch = mock(() =>
+      Promise.resolve(new Response('{}', { status: 200 })),
+    ) as unknown as typeof fetch
+    const restored = await plugin.auth.loader(
+      () =>
+        Promise.resolve({
+          type: 'oauth' as const,
+          access: 'restored-access',
+          refresh: 'restored-refresh',
+          expires: Date.now() + 100_000,
+        }),
+      { models: {} },
+    )
+    await restored.fetch(MESSAGES_URL, EMPTY_POST)
+    expect(
+      JSON.parse(await readFile(manifestPath, 'utf8')).providers[0].accounts,
+    ).toHaveLength(1)
 
-    expect(packageJson.exports?.['./tui']).toEqual({
-      types: './dist/tui.d.ts',
-      import: './src/tui/entry.mjs',
-    })
-    expect(packageJson.files).toContain('src/tui.tsx')
-    expect(packageJson.files).toContain('src/tui')
-    expect(packageJson.files).toContain('src/tui-compiled')
-    expect(packageJson.files).toContain('src/sidebar-state.ts')
-    expect(packageJson['oc-plugin']).toEqual(['server', 'tui'])
-    expect(packageJson.scripts?.build).toContain('bun run build:tui')
-    for (const dependency of ['@opentui/core', '@opentui/solid', 'solid-js']) {
-      expect(packageJson.dependencies?.[dependency]).toMatch(/^\d/)
-    }
-  })
+    globalThis.fetch = mock((input: unknown) => {
+      const url = extractUrl(input as string | URL | Request)
+      if (url === TOKEN_URL) {
+        return Promise.resolve(
+          Response.json({
+            access_token: access,
+            refresh_token: refresh,
+            expires_in: 3600,
+          }),
+        )
+      }
+      return Promise.resolve(new Response('{}', { status: 200 }))
+    }) as unknown as typeof fetch
+    const flow = await plugin.auth.methods[0].authorize()
+    await flow.callback('code=code&state=state')
+    await plugin.auth.loader(
+      () =>
+        Promise.resolve({
+          type: 'oauth' as const,
+          access,
+          refresh,
+          expires: Date.now() + 100_000,
+        }),
+      { models: {} },
+    )
 
-  test('raw TUI fallback is loadable for development hosts', async () => {
-    const mod = await import('../tui.tsx')
-    expect(mod.default?.id).toBe('cortexkit.anthropic-auth')
-    expect(mod.default?.tui).toBeFunction()
+    expect(
+      JSON.parse(await readFile(manifestPath, 'utf8')).providers[0].accounts,
+    ).toHaveLength(0)
+    const stored = JSON.parse(await readFile(accountPath, 'utf8'))
+    expect(stored.mainAccountId).toBeString()
+    expect(stored.claustrum.mode).toBe('local')
+    await plugin.dispose?.()
+    installDefaultFetchMock()
   })
-})
 
-describe('AnthropicAuthPlugin', () => {
   test('returns an object with auth properties', async () => {
     const plugin = await getPlugin()
     expect(plugin.auth).toBeDefined()
@@ -5018,7 +7902,7 @@ describe('AnthropicAuthPlugin', () => {
     const now = 1_000_000
     let currentNow = now
     const accountId = 'vault-fallback'
-    const handle = 'vault-handle'
+    const handle = `ckh_${'F'.repeat(43)}`
     const vaultExpiry = now + 60 * 60_000
     const credentialPayload = Array.from(
       new TextEncoder().encode(
@@ -5073,16 +7957,15 @@ describe('AnthropicAuthPlugin', () => {
         accounts: [
           {
             id: accountId,
-            type: 'oauth',
-            access: 'sidecar-access',
-            refresh: 'sidecar-refresh',
-            expires: Date.now() + 3 * 60 * 60_000,
+            label: accountId,
+            ...custodyTombstoneOAuth('anthropic'),
             claustrumHandle: handle,
           },
         ],
-        claustrum: { accounts: { [accountId]: { enabled: true } } },
+        claustrum: { mode: 'claustrum' },
       }),
     )
+    await writeSharedManifest(tempConfigDir!, [{ label: accountId, handle }])
     globalThis.fetch = localRefresh
     const plugin = await getPlugin(undefined, undefined, {
       claustrumConnector: async () => client,
@@ -5107,57 +7990,45 @@ describe('AnthropicAuthPlugin', () => {
     installDefaultFetchMock()
   })
 
-  test('vault reauth keeps a healthy sidecar alive and projects a vault marker', async () => {
+  test('vault reauth leaves the account absent and projects the reauth state', async () => {
     const accountId = 'vault-reauth-fallback'
-    const handle = 'vault-reauth-handle'
-    const sidecarRefresh = mock(() =>
-      Promise.resolve(
-        new Response(
-          JSON.stringify({
-            access_token: 'refreshed-sidecar-access',
-            refresh_token: 'refreshed-sidecar-refresh',
-            expires_in: 3600,
-          }),
-          { status: 200 },
-        ),
-      ),
-    ) as unknown as typeof fetch
-    const client = {
-      call: mock(async () => ({
-        result: {
-          error: { class: 'auth_required', code: 'latched' },
-        },
-      })),
-      close: mock(() => {}),
-    }
+    const handle = `ckh_${'E'.repeat(43)}`
     let tick: (() => Promise<unknown>) | undefined
     const setInterval = mock((callback: () => Promise<unknown>) => {
       tick = callback
       return { unref() {} } as unknown as ReturnType<typeof setInterval>
     }) as unknown as typeof globalThis.setInterval
-
-    await useTempAccountFile(
-      createFallbackStorage({
-        quota: { enabled: false },
-        accounts: [
-          {
-            id: accountId,
-            type: 'oauth',
-            access: 'sidecar-access',
-            refresh: 'sidecar-refresh',
-            expires: Date.now() + 60 * 60_000,
-            claustrumHandle: handle,
-          },
-        ],
-        claustrum: { accounts: { [accountId]: { enabled: true } } },
-      }),
-    )
-    globalThis.fetch = sidecarRefresh
-    const plugin = await getPlugin(undefined, undefined, {
-      claustrumConnector: async () => client,
-      setInterval,
-    })
-    await plugin.__fallbackRefreshReady
+    const fixture = await bootSharedRuledClaustrumRow({
+      route: 'fallback-first',
+      fallbacks: [
+        {
+          label: 'reauth',
+          handle,
+          access: 'vault-reauth-access',
+          account: { id: accountId, claustrumHandle: handle },
+        },
+      ],
+      connector: (calls) =>
+        connectorFor(calls, (method, params) => {
+          if (method !== 'credential.get') return { result: {} }
+          if (params.handle === handle)
+            return {
+              result: {
+                error: { class: 'auth_required', code: 'latched' },
+              },
+            }
+          return credentialResponse('vault-main-access', 1)
+        }),
+      runtimeOverrides: { setInterval },
+      bootPlugin: (overrides) =>
+        getPlugin(createMockClient(), tempConfigDir!, overrides),
+      createFallbackStorage,
+      useTempAccountFile,
+      extractUrl,
+      tempConfigDir: () => tempConfigDir!,
+    })
+    const plugin = fixture.plugin
+    await expect(plugin.__fallbackRefreshReady).resolves.not.toBe('not-started')
     await tick?.()
     const sidebar = await waitForSidebarState((state) => {
       const account = state.fallbacks.find(
@@ -5169,12 +8040,148 @@ describe('AnthropicAuthPlugin', () => {
     const account = sidebar.fallbacks.find(
       (candidate) => candidate.id === accountId,
     )
-    expect(sidecarRefresh).toHaveBeenCalled()
     expect(account?.vaultReauth).toBe(true)
     expect(account?.needsReauth).toBe(false)
+    const response = await fixture.result.fetch(MESSAGES_URL, EMPTY_POST)
+    expect(response.status).toBe(200)
+    expect(fixture.authorizations).toEqual(['Bearer vault-main-access'])
+    expect(fixture.authorizations).not.toContain('Bearer vault-reauth-access')
+    await plugin.dispose?.()
     installDefaultFetchMock()
   })
 
+  test('re-probes a cold fallback without darkening the vault-served main route', async () => {
+    const handle = `ckh_${'C'.repeat(43)}`
+    let resident = false
+    let tick: (() => Promise<unknown>) | undefined
+    const setInterval = mock((callback: () => Promise<unknown>) => {
+      tick = callback
+      return { unref() {} } as unknown as ReturnType<typeof setInterval>
+    }) as unknown as typeof globalThis.setInterval
+    const fixture = await bootSharedRuledClaustrumRow({
+      route: 'fallback-first',
+      fallbacks: [
+        {
+          label: 'cold',
+          handle,
+          access: 'vault-cold-access',
+          account: { id: 'vault-cold-fallback', claustrumHandle: handle },
+        },
+      ],
+      connector: (calls) =>
+        connectorFor(calls, (method, params) => {
+          if (method !== 'credential.get') return { result: {} }
+          if (params.handle === handle && !resident)
+            return {
+              result: { error: { class: 'transient', code: 'offline' } },
+            }
+          return credentialResponse(
+            params.handle === handle
+              ? 'vault-cold-access'
+              : 'vault-main-access',
+            1,
+          )
+        }),
+      runtimeOverrides: { setInterval },
+      bootPlugin: (overrides) =>
+        getPlugin(createMockClient(), tempConfigDir!, overrides),
+      createFallbackStorage,
+      useTempAccountFile,
+      extractUrl,
+      tempConfigDir: () => tempConfigDir!,
+    })
+    try {
+      await expect(fixture.plugin.__fallbackRefreshReady).resolves.not.toBe(
+        'not-started',
+      )
+      const coldResponse = await fixture.result.fetch(MESSAGES_URL, EMPTY_POST)
+      expect(coldResponse.status).toBe(200)
+      expect(fixture.authorizations).toEqual(['Bearer vault-main-access'])
+
+      resident = true
+      await tick?.()
+      const residentResponse = await fixture.result.fetch(
+        MESSAGES_URL,
+        EMPTY_POST,
+      )
+      expect(residentResponse.status).toBe(200)
+      expect(fixture.authorizations).toEqual([
+        'Bearer vault-main-access',
+        'Bearer vault-cold-access',
+      ])
+    } finally {
+      await fixture.plugin.dispose?.()
+      installDefaultFetchMock()
+    }
+  })
+
+  test('keeps warming healthy fallbacks when a sibling requires vault reauth', async () => {
+    const latchedHandle = `ckh_${'L'.repeat(43)}`
+    const warmHandle = `ckh_${'W'.repeat(43)}`
+    let tick: (() => Promise<unknown>) | undefined
+    const setInterval = mock((callback: () => Promise<unknown>) => {
+      tick = callback
+      return { unref() {} } as unknown as ReturnType<typeof setInterval>
+    }) as unknown as typeof globalThis.setInterval
+    const fixture = await bootSharedRuledClaustrumRow({
+      route: 'fallback-first',
+      fallbacks: [
+        {
+          label: 'latched',
+          handle: latchedHandle,
+          access: 'vault-latched-access',
+          account: { id: 'vault-latched', claustrumHandle: latchedHandle },
+        },
+        {
+          label: 'warm',
+          handle: warmHandle,
+          access: 'vault-warm-access',
+          account: { id: 'vault-warm', claustrumHandle: warmHandle },
+        },
+      ],
+      connector: (calls) =>
+        connectorFor(calls, (method, params) => {
+          if (method !== 'credential.get') return { result: {} }
+          if (params.handle === latchedHandle)
+            return {
+              result: {
+                error: { class: 'auth_required', code: 'needs_reauth' },
+              },
+            }
+          return credentialResponse(
+            params.handle === warmHandle
+              ? 'vault-warm-access'
+              : 'vault-main-access',
+            1,
+          )
+        }),
+      runtimeOverrides: { setInterval },
+      bootPlugin: (overrides) =>
+        getPlugin(createMockClient(), tempConfigDir!, overrides),
+      createFallbackStorage,
+      useTempAccountFile,
+      extractUrl,
+      tempConfigDir: () => tempConfigDir!,
+    })
+    try {
+      await expect(fixture.plugin.__fallbackRefreshReady).resolves.not.toBe(
+        'not-started',
+      )
+      await tick?.()
+      expect(
+        fixture.calls.filter(
+          (call) =>
+            call.method === 'credential.get' &&
+            call.params.handle === warmHandle &&
+            typeof call.params.min_ttl_ms === 'number',
+        ).length,
+      ).toBeGreaterThanOrEqual(1)
+    } finally {
+      await fixture.plugin.dispose?.()
+      installDefaultFetchMock()
+    }
+  })
+
   test('transient vault failure preserves an unexpired sidecar without local refresh', async () => {
     const accountId = 'vault-transient-healthy'
     const handle = 'vault-transient-healthy-handle'
@@ -5205,7 +8212,7 @@ describe('AnthropicAuthPlugin', () => {
             claustrumHandle: handle,
           },
         ],
-        claustrum: { accounts: { [accountId]: { enabled: true } } },
+        claustrum: { mode: 'claustrum' },
       }),
     )
     globalThis.fetch = localRefresh
@@ -5219,207 +8226,56 @@ describe('AnthropicAuthPlugin', () => {
     installDefaultFetchMock()
   })
 
-  test('transient vault failure refreshes an expired sidecar with a custody override', async () => {
+  test('transient vault failure leaves an expired sidecar cold without local refresh', async () => {
     const accountId = 'vault-transient-expired'
     const handle = 'vault-transient-expired-handle'
-    const logs: LogTestRecord[] = []
     const localRefresh = mock(() =>
-      Promise.resolve(
-        new Response(
-          JSON.stringify({
-            access_token: 'local-access',
-            refresh_token: 'local-refresh',
-            expires_in: 3600,
-          }),
-          { status: 200 },
-        ),
-      ),
-    ) as unknown as typeof fetch
-    const client = {
-      call: mock(async () => ({
-        result: { error: { class: 'transient', code: 'timeout' } },
-      })),
-      close: mock(() => {}),
-    }
-    let tick: (() => Promise<unknown>) | undefined
-    const setInterval = mock((callback: () => Promise<unknown>) => {
-      tick = callback
-      return { unref() {} } as unknown as ReturnType<typeof setInterval>
-    }) as unknown as typeof globalThis.setInterval
-    await useTempAccountFile(
-      createFallbackStorage({
-        quota: { enabled: false },
-        accounts: [
-          {
-            id: accountId,
-            type: 'oauth',
-            access: 'expired-sidecar-access',
-            refresh: 'sidecar-refresh',
-            expires: Date.now() - 1,
-            claustrumHandle: handle,
-          },
-        ],
-        claustrum: { accounts: { [accountId]: { enabled: true } } },
-      }),
-    )
-    globalThis.fetch = localRefresh
-    __setLogTestSink((record) => logs.push(record))
-    const plugin = await getPlugin(undefined, undefined, {
-      claustrumConnector: async () => client,
-      setInterval,
-    })
-    await plugin.__fallbackRefreshReady
-    await tick?.()
-    __setLogTestSink(null)
-    expect(localRefresh).toHaveBeenCalled()
-    expect(
-      logs.some(
-        (record) =>
-          record.message === 'custody override: local fallback refresh',
-      ),
-    ).toBe(true)
-    installDefaultFetchMock()
-  })
-
-  test('latches permanent custody refresh failures until vault recovery', async () => {
-    const accountId = 'vault-permanent-custody'
-    const handle = 'vault-permanent-custody-handle'
-    let now = Date.now()
-    let credentialGets = 0
-    const credentialResponse = (
-      accessToken: string,
-      recordVersion: number,
-      expiresAtMs: number,
-    ) => ({
-      result: {
-        payload: Array.from(
-          new TextEncoder().encode(
-            JSON.stringify({ access_token: accessToken }),
-          ),
+      Promise.resolve(
+        new Response(
+          JSON.stringify({
+            access_token: 'local-access',
+            refresh_token: 'local-refresh',
+            expires_in: 3600,
+          }),
+          { status: 200 },
         ),
-        expires_at_ms: expiresAtMs,
-        record_version: recordVersion,
-      },
-    })
-    let sidecarRefreshes = 0
-    const localRefresh = mock((input: unknown) => {
-      if (extractUrl(input as string | URL | Request) === TOKEN_URL) {
-        sidecarRefreshes += 1
-        return Promise.resolve(
-          new Response('{"error":"invalid_grant"}', { status: 400 }),
-        )
-      }
-      return Promise.resolve(new Response('{}', { status: 200 }))
-    }) as unknown as typeof fetch
-    const connector = async () => ({
-      call: mock(async () => {
-        credentialGets += 1
-        if (credentialGets === 1) {
-          return credentialResponse('vault-initial-access', 1, now + 60_000)
-        }
-        if (credentialGets === 2 || credentialGets === 3) {
-          return {
-            result: { error: { class: 'transient', code: 'unavailable' } },
-          }
-        }
-        return credentialResponse('vault-recovered-access', 2, now + 60_000)
-      }),
+      ),
+    ) as unknown as typeof fetch
+    const client = {
+      call: mock(async () => ({
+        result: { error: { class: 'transient', code: 'timeout' } },
+      })),
       close: mock(() => {}),
-    })
-    let tick!: () => Promise<unknown>
+    }
+    let tick: (() => Promise<unknown>) | undefined
     const setInterval = mock((callback: () => Promise<unknown>) => {
-      if (!tick) tick = callback
+      tick = callback
       return { unref() {} } as unknown as ReturnType<typeof setInterval>
     }) as unknown as typeof globalThis.setInterval
     await useTempAccountFile(
       createFallbackStorage({
-        routing: { mode: 'fallback-first' },
         quota: { enabled: false },
         accounts: [
           {
             id: accountId,
             type: 'oauth',
-            access: 'dead-sidecar-access',
-            refresh: 'dead-sidecar-refresh',
-            expires: Date.now() + 3 * 60 * 60_000,
+            access: 'expired-sidecar-access',
+            refresh: 'sidecar-refresh',
+            expires: Date.now() - 1,
             claustrumHandle: handle,
           },
         ],
-        claustrum: { accounts: { [accountId]: { enabled: true } } },
+        claustrum: { mode: 'claustrum' },
       }),
     )
     globalThis.fetch = localRefresh
     const plugin = await getPlugin(undefined, undefined, {
-      claustrumConnector: connector,
-      claustrumNow: () => now,
+      claustrumConnector: async () => client,
       setInterval,
     })
     await plugin.__fallbackRefreshReady
-    expect(credentialGets).toBe(1)
-
-    now += 60_001
-    await tick()
-    expect(credentialGets).toBe(2)
-    expect(sidecarRefreshes).toBe(1)
-    const latched = await waitForAccountStorage(
-      (storage) =>
-        storage?.accounts.find(
-          (account): account is OAuthAccount =>
-            account.id === accountId && isOAuthAccount(account),
-        )?.lastRefreshError?.permanent === true,
-    )
-    expect(
-      latched?.accounts.find(
-        (account): account is OAuthAccount =>
-          account.id === accountId && isOAuthAccount(account),
-      )?.lastRefreshError?.permanent,
-    ).toBe(true)
-    const latchedSidebar = await waitForSidebarState((state) => {
-      const account = state.fallbacks.find(
-        (candidate) => candidate.id === accountId,
-      )
-      return account?.needsReauth === true
-    })
-    const latchedSidebarAccount = latchedSidebar.fallbacks.find(
-      (account) => account.id === accountId,
-    )
-    expect(latchedSidebarAccount?.needsReauth).toBe(true)
-    expect(latchedSidebarAccount?.vaultReauth ?? false).toBe(false)
-
-    await tick()
-    expect(sidecarRefreshes).toBe(1)
-    const result = await plugin.auth.loader(
-      () =>
-        Promise.resolve({
-          type: 'oauth' as const,
-          access: 'main-access',
-          refresh: 'main-refresh',
-          expires: Date.now() + 5 * 60 * 60_000,
-        }),
-      { models: {} },
-    )
-    await result.fetch(MESSAGES_URL, EMPTY_POST)
-    expect(sidecarRefreshes).toBe(1)
-
-    await result.fetch(MESSAGES_URL, EMPTY_POST)
-    now += 60_001
-    await tick()
-    expect(credentialGets).toBe(4)
-    await clearClaustrumRefreshErrorPersistent(accountId, handle)
-    const recovered = await waitForAccountStorage(
-      (storage) =>
-        storage?.accounts.find(
-          (account): account is OAuthAccount =>
-            account.id === accountId && isOAuthAccount(account),
-        )?.lastRefreshError === undefined,
-    )
-    expect(
-      recovered?.accounts.find(
-        (account): account is OAuthAccount =>
-          account.id === accountId && isOAuthAccount(account),
-      )?.lastRefreshError,
-    ).toBeUndefined()
-    await plugin.dispose?.()
+    await tick?.()
+    expect(localRefresh).not.toHaveBeenCalled()
     installDefaultFetchMock()
   })
 
@@ -5479,7 +8335,7 @@ describe('AnthropicAuthPlugin', () => {
     expect(connectAttempts).toBe(0)
     const storage = await loadAccounts()
     if (!storage) throw new Error('missing test storage')
-    storage.claustrum = { accounts: { [accountId]: { enabled: true } } }
+    storage.claustrum = { mode: 'claustrum' }
     await saveAccounts(storage)
     await tick()
     expect(connectAttempts).toBe(1)
@@ -5526,7 +8382,7 @@ describe('AnthropicAuthPlugin', () => {
     await plugin.__fallbackRefreshReady
     const storage = await loadAccounts()
     if (!storage) throw new Error('missing test storage')
-    storage.claustrum = { accounts: { [accountId]: { enabled: true } } }
+    storage.claustrum = { mode: 'claustrum' }
     await saveAccounts(storage)
     await tick()
     await tick()
@@ -5538,108 +8394,6 @@ describe('AnthropicAuthPlugin', () => {
     installDefaultFetchMock()
   })
 
-  test('custody latch survives a stale fleet writer and still clears', async () => {
-    const accountId = 'vault-fence'
-    const handle = 'vault-fence-handle'
-    let now = Date.now()
-    let credentialGets = 0
-    const connector = async () => ({
-      call: mock(async () => {
-        credentialGets += 1
-        if (credentialGets === 1) {
-          return {
-            result: {
-              payload: Array.from(
-                new TextEncoder().encode(
-                  JSON.stringify({ access_token: 'vault' }),
-                ),
-              ),
-              expires_at_ms: now + 60_000,
-              record_version: 1,
-            },
-          }
-        }
-        return {
-          result: { error: { class: 'transient', code: 'unavailable' } },
-        }
-      }),
-      close: mock(() => {}),
-    })
-    let tick!: () => Promise<unknown>
-    const setInterval = mock((callback: () => Promise<unknown>) => {
-      if (!tick) tick = callback
-      return { unref() {} } as unknown as ReturnType<typeof setInterval>
-    }) as unknown as typeof globalThis.setInterval
-    await useTempAccountFile(
-      createFallbackStorage({
-        quota: { enabled: false },
-        accounts: [
-          {
-            id: accountId,
-            type: 'oauth',
-            access: 'dead',
-            refresh: 'dead-refresh',
-            expires: now + 3 * 60 * 60_000,
-            lastRefreshedAt: now - 60_000,
-            claustrumHandle: handle,
-          },
-        ],
-        claustrum: { accounts: { [accountId]: { enabled: true } } },
-      }),
-    )
-    globalThis.fetch = mock((input: unknown) =>
-      extractUrl(input as string | URL | Request) === TOKEN_URL
-        ? Promise.resolve(
-            new Response('{"error":"invalid_grant"}', { status: 400 }),
-          )
-        : Promise.resolve(new Response('{}', { status: 200 })),
-    ) as unknown as typeof fetch
-    const plugin = await getPlugin(undefined, undefined, {
-      claustrumConnector: connector,
-      claustrumNow: () => now,
-      setInterval,
-    })
-    await plugin.__fallbackRefreshReady
-    now += 60_001
-    await tick()
-    const latched = await waitForAccountStorage(
-      (storage) =>
-        storage?.accounts.find(
-          (account): account is OAuthAccount =>
-            account.id === accountId && isOAuthAccount(account),
-        )?.lastRefreshError?.permanent === true,
-    )
-    expect(
-      latched?.accounts.find(
-        (account): account is OAuthAccount =>
-          account.id === accountId && isOAuthAccount(account),
-      )?.lastRefreshError?.permanent,
-    ).toBe(true)
-    const stale = await loadAccounts()
-    if (!stale) throw new Error('missing test storage')
-    const staleAccount = stale.accounts.find(
-      (account) => account.id === accountId,
-    ) as OAuthAccount
-    delete staleAccount.lastRefreshError
-    staleAccount.lastRefreshedAt = (staleAccount.lastRefreshedAt ?? now) - 1
-    await saveAccounts(stale)
-    expect(
-      (await loadAccounts())?.accounts.find(
-        (account): account is OAuthAccount =>
-          account.id === accountId && isOAuthAccount(account),
-      )?.lastRefreshError?.permanent,
-    ).toBe(true)
-    await clearClaustrumRefreshErrorPersistent(accountId, handle)
-    expect(
-      (await loadAccounts())?.accounts.find(
-        (account): account is OAuthAccount =>
-          account.id === accountId && isOAuthAccount(account),
-      )?.lastRefreshError,
-    ).toBeUndefined()
-    await plugin.dispose?.()
-    installDefaultFetchMock()
-  })
-
   test('custody latch merge prefers the newer error by checkedAt', async () => {
     const accountId = 'vault-fence-recency'
     const handle = 'vault-fence-recency-handle'
@@ -5668,7 +8422,7 @@ describe('AnthropicAuthPlugin', () => {
             claustrumHandle: handle,
           },
         ],
-        claustrum: { accounts: { [accountId]: { enabled: true } } },
+        claustrum: { mode: 'claustrum' },
       }),
     )
     const newerSnapshot = await loadAccounts()
@@ -5851,6 +8605,64 @@ describe('quota header feed extended integration', () => {
     expect(await readFeedEntries()).toEqual([])
   })
 
+  test('sidebar quota refresh uses the rotated main host token', async () => {
+    await useTempAccountFile(
+      createFallbackStorage({
+        accounts: [],
+        quota: { enabled: false },
+        main: { type: 'opencode', provider: 'anthropic' },
+      }),
+    )
+    let currentAccess = 'sk-ant-oat01-main-access-before-rotation'
+    globalThis.fetch = mock((input: unknown, init?: RequestInit) => {
+      const url = extractUrl(input as string | URL | Request)
+      if (url.startsWith(MESSAGES_URL)) {
+        return Promise.resolve(
+          new Response('{}', {
+            status: 200,
+            headers: { 'anthropic-ratelimit-unified-5h-utilization': '0.25' },
+          }),
+        )
+      }
+      if (url.includes('/claude_cli/bootstrap')) {
+        return Promise.resolve(
+          Response.json({
+            oauth_account: {
+              account_uuid: '44444444-4444-4444-4444-444444444444',
+            },
+          }),
+        )
+      }
+      return Promise.reject(new Error(`Unexpected test fetch: ${url}`))
+    }) as unknown as typeof fetch
+    const plugin = await getPlugin()
+    const result = await plugin.auth.loader(
+      () =>
+        Promise.resolve({
+          type: 'oauth' as const,
+          access: currentAccess,
+          refresh: 'main-refresh',
+          expires: Date.now() + 100_000,
+        }),
+      { models: {} },
+    )
+    await drainSidebarWrites()
+
+    const response = await result.fetch(MESSAGES_URL, EMPTY_POST)
+    expect(response.status).toBe(200)
+    currentAccess = 'sk-ant-oat01-main-access-after-rotation'
+
+    const resolved = await (
+      plugin as {
+        __resolveSidebarQuotaAccessForTest: () => Promise<{
+          access: string | undefined
+        }>
+      }
+    ).__resolveSidebarQuotaAccessForTest()
+    expect(resolved.access).toBe('sk-ant-oat01-main-access-after-rotation')
+    await plugin.dispose?.()
+  })
+
   test('deduplicates main feed observations across access-token rotation', async () => {
     await useTempAccountFile(
       createFallbackStorage({
@@ -12600,6 +15412,77 @@ describe('auth.loader', () => {
     expect(secondRefreshWait).not.toHaveBeenCalled()
   })
 
+  test('sticky 401 retry refuses a foreign-provider tombstone before the token endpoint', async () => {
+    const checkedAt = Date.now()
+    await useTempAccountFile(
+      createFallbackStorage({
+        accounts: [],
+        routing: { mode: 'sticky-balanced' },
+        quota: {
+          enabled: true,
+          checkIntervalMinutes: 5,
+          minimumRemaining: { five_hour: 1, seven_day: 1 },
+          failClosedOnUnknownQuota: true,
+          mainQuota: {
+            checkedAt,
+            five_hour: { usedPercent: 10, remainingPercent: 90, checkedAt },
+            seven_day: { usedPercent: 10, remainingPercent: 90, checkedAt },
+          },
+          mainQuotaCheckedAt: checkedAt,
+          mainQuotaToken: tokenFingerprint('live-main-access'),
+        },
+      }),
+    )
+    let currentAuth: Record<string, unknown> = {
+      type: 'oauth',
+      access: 'live-main-access',
+      refresh: 'live-main-refresh',
+      expires: checkedAt + 8 * 60 * 60_000,
+    }
+    const messageAuthorizations: string[] = []
+    const tokenEndpointCalls: string[] = []
+    globalThis.fetch = mock((input: unknown, init?: RequestInit) => {
+      const url = extractUrl(input as string | URL | Request)
+      if (url === TOKEN_URL) {
+        tokenEndpointCalls.push(url)
+        return Promise.resolve(new Response('unexpected', { status: 200 }))
+      }
+      if (url.includes('/v1/messages')) {
+        messageAuthorizations.push(
+          new Headers(init?.headers).get('authorization') ?? '',
+        )
+        currentAuth = {
+          ...custodyTombstoneOAuth('openai'),
+          access: 'claustrum-tombstone:v1:openai',
+          expires: 0,
+        }
+        return Promise.resolve(new Response('unauthorized', { status: 401 }))
+      }
+      return Promise.resolve(new Response('{}', { status: 200 }))
+    }) as unknown as typeof fetch
+
+    const plugin = await getPlugin()
+    const result = await plugin.auth.loader(
+      () => Promise.resolve(currentAuth as never),
+      { models: {} },
+    )
+
+    await expect(
+      result.fetch(MESSAGES_URL, {
+        method: 'POST',
+        headers: { 'x-session-affinity': 'tombstone-sticky-401' },
+        body: JSON.stringify({
+          model: 'claude-opus-5',
+          max_tokens: 1,
+          messages: [{ role: 'user', content: 'hello' }],
+        }),
+      }),
+    ).rejects.toBeInstanceOf(CustodyTombstoneRefreshError)
+    expect(messageAuthorizations).toEqual(['Bearer live-main-access'])
+    expect(tokenEndpointCalls).toEqual([])
+    await plugin.dispose?.()
+  })
+
   test('sticky 401 retries with a concurrently rotated main access token', async () => {
     const checkedAt = Date.now()
     await useTempAccountFile(
@@ -12758,6 +15641,7 @@ describe('auth.loader', () => {
   })
 
   test('admits a sticky route with a vault credential and no sidecar access token', async () => {
+    delete process.env.OPENCODE_ANTHROPIC_AUTH_FALLBACK_MODE
     const checkedAt = Date.now()
     const fallbackQuota = {
       five_hour: {
@@ -12770,41 +15654,8 @@ describe('auth.loader', () => {
         remainingPercent: 90,
         checkedAt,
       },
-    }
-    const storage = createFallbackStorage({
-      routing: { mode: 'sticky-balanced' },
-      quota: {
-        enabled: true,
-        checkIntervalMinutes: 5,
-        minimumRemaining: { five_hour: 1, seven_day: 1 },
-        failClosedOnUnknownQuota: false,
-        mainQuota: {
-          five_hour: {
-            usedPercent: 100,
-            remainingPercent: 0,
-            checkedAt,
-          },
-          seven_day: {
-            usedPercent: 100,
-            remainingPercent: 0,
-            checkedAt,
-          },
-        },
-        mainQuotaCheckedAt: checkedAt,
-      },
-      claustrum: { accounts: { 'vault-only-sticky': { enabled: true } } },
-      accounts: [
-        {
-          id: 'vault-only-sticky',
-          type: 'oauth',
-          refresh: 'vault-only-sticky-refresh',
-          expires: checkedAt + 5 * 60 * 60 * 1000,
-          claustrumHandle: 'handle-vault-only-sticky',
-          quota: fallbackQuota,
-        },
-      ],
-    })
-    const calls: CredentialCall[] = []
+    }
+    const handle = `ckh_${'S'.repeat(43)}`
     const vaultCredentialResponse = () => ({
       result: {
         payload: Array.from(
@@ -12820,52 +15671,62 @@ describe('auth.loader', () => {
     const pendingCredential = new Promise<unknown>((resolve) => {
       releaseCredential = () => resolve(vaultCredentialResponse())
     })
+    let blockFallbackCredential = false
     let credentialGets = 0
-    const connector = async () =>
-      ({
-        call: async (_moduleId: string, method: string, params: unknown) => {
-          calls.push({
-            method,
-            params: (params ?? {}) as Record<string, unknown>,
-          })
-          if (method === 'credential.get') {
-            credentialGets += 1
-            if (credentialGets === 1) return pendingCredential
-            return vaultCredentialResponse()
-          }
-          return { result: {} }
+    const fixture = await bootSharedRuledClaustrumRow({
+      route: { sticky: 'vault-only-sticky' },
+      quota: {
+        enabled: true,
+        checkIntervalMinutes: 5,
+        minimumRemaining: { five_hour: 1, seven_day: 1 },
+        failClosedOnUnknownQuota: false,
+        mainQuota: {
+          five_hour: { usedPercent: 100, remainingPercent: 0, checkedAt },
+          seven_day: { usedPercent: 100, remainingPercent: 0, checkedAt },
         },
-        close: () => {},
-      }) as never
-    const authorizations: string[] = []
-    await useTempAccountFile(storage)
-    globalThis.fetch = mock((input: unknown, init?: RequestInit) => {
-      const url = extractUrl(input as string | URL | Request)
-      if (url === TOKEN_URL)
-        return Promise.resolve(
-          new Response('refresh unavailable', { status: 500 }),
-        )
-      if (url.includes('/v1/messages')) {
-        authorizations.push(
-          new Headers(init?.headers).get('authorization') ?? '',
-        )
-      }
-      return Promise.resolve(new Response('{}', { status: 200 }))
-    }) as unknown as typeof fetch
-    const plugin = await getPlugin(undefined, undefined, {
-      claustrumConnector: connector,
-      claustrumNow: () => 0,
+        mainQuotaCheckedAt: checkedAt,
+      },
+      fallbacks: [
+        {
+          label: 'sticky',
+          handle,
+          access: 'vault-only-sticky-access',
+          account: { id: 'vault-only-sticky', quota: fallbackQuota },
+        },
+      ],
+      connector: (calls) => async () =>
+        ({
+          call: async (_moduleId: string, method: string, params: unknown) => {
+            calls.push({
+              method,
+              params: (params ?? {}) as Record<string, unknown>,
+            })
+            if (method === 'credential.get') {
+              if ((params as { handle?: string }).handle === handle) {
+                if (!blockFallbackCredential) return vaultCredentialResponse()
+                credentialGets += 1
+                if (credentialGets === 1) return pendingCredential
+                return vaultCredentialResponse()
+              }
+              return credentialResponse(
+                'vault-main-access',
+                17,
+                Date.now() + 60_000,
+              )
+            }
+            return { result: {} }
+          },
+          close: () => {},
+        }) as never,
+      bootPlugin: (overrides) =>
+        getPlugin(createMockClient(), tempConfigDir!, overrides),
+      createFallbackStorage,
+      useTempAccountFile,
+      extractUrl,
+      tempConfigDir: () => tempConfigDir!,
     })
-    const result = await plugin.auth.loader(
-      () =>
-        Promise.resolve({
-          type: 'oauth' as const,
-          access: 'main-access',
-          refresh: 'main-refresh',
-          expires: checkedAt + 5 * 60 * 60 * 1000,
-        }),
-      { models: {} },
-    )
+    fixture.plugin.__claustrumCredentialCache.invalidate(handle)
+    blockFallbackCredential = true
 
     const request = {
       method: 'POST',
@@ -12876,19 +15737,23 @@ describe('auth.loader', () => {
         messages: [{ role: 'user', content: 'hello' }],
       }),
     }
-    const coldResponse = await result.fetch(MESSAGES_URL, request)
+    const coldResponse = await fixture.result.fetch(MESSAGES_URL, request)
     expect(coldResponse.status).toBe(429)
     releaseCredential()
     await Bun.sleep(25)
     expect(credentialGets).toBe(1)
-    const response = await result.fetch(MESSAGES_URL, request)
+    const response = await fixture.result.fetch(MESSAGES_URL, request)
 
     expect(response.status).toBe(200)
-    expect(authorizations).toEqual(['Bearer vault-only-sticky-access'])
-    await plugin.dispose?.()
+    expect(fixture.authorizations).toEqual(['Bearer vault-only-sticky-access'])
+    expect(
+      fixture.plugin.__claustrumCredentialCache.peek(handle)?.recordVersion,
+    ).toBe(71)
+    await fixture.plugin.dispose?.()
   })
 
   test('does not retry a rejected sticky vault credential', async () => {
+    delete process.env.OPENCODE_ANTHROPIC_AUTH_FALLBACK_MODE
     const checkedAt = Date.now()
     const fallbackQuota = {
       five_hour: {
@@ -12902,40 +15767,7 @@ describe('auth.loader', () => {
         checkedAt,
       },
     }
-    const storage = createFallbackStorage({
-      routing: { mode: 'sticky-balanced' },
-      quota: {
-        enabled: true,
-        checkIntervalMinutes: 5,
-        minimumRemaining: { five_hour: 1, seven_day: 1 },
-        failClosedOnUnknownQuota: false,
-        mainQuota: {
-          five_hour: {
-            usedPercent: 100,
-            remainingPercent: 0,
-            checkedAt,
-          },
-          seven_day: {
-            usedPercent: 100,
-            remainingPercent: 0,
-            checkedAt,
-          },
-        },
-        mainQuotaCheckedAt: checkedAt,
-      },
-      claustrum: { accounts: { 'vault-sticky': { enabled: true } } },
-      accounts: [
-        {
-          id: 'vault-sticky',
-          type: 'oauth',
-          refresh: 'vault-sticky-refresh',
-          expires: checkedAt + 5 * 60 * 60 * 1000,
-          claustrumHandle: 'handle-vault-sticky',
-          quota: fallbackQuota,
-        },
-      ],
-    })
-    const calls: CredentialCall[] = []
+    const handle = `ckh_${'R'.repeat(43)}`
     const rejectedVaultCredentialResponse = () => ({
       result: {
         payload: Array.from(
@@ -12952,58 +15784,66 @@ describe('auth.loader', () => {
       releaseInitialCredential = () =>
         resolve(rejectedVaultCredentialResponse())
     })
+    let blockFallbackCredential = false
     let credentialGets = 0
-    const connector = async () =>
-      ({
-        call: async (_moduleId: string, method: string, params: unknown) => {
-          calls.push({
-            method,
-            params: (params ?? {}) as Record<string, unknown>,
-          })
-          if (method === 'credential.get') {
-            credentialGets += 1
-            return credentialGets === 1
-              ? initialCredential
-              : new Promise<never>(() => {})
-          }
-          return { result: {} }
+    const fixture = await bootSharedRuledClaustrumRow({
+      route: { sticky: 'vault-sticky' },
+      initialNow: 0,
+      quota: {
+        enabled: true,
+        checkIntervalMinutes: 5,
+        minimumRemaining: { five_hour: 1, seven_day: 1 },
+        failClosedOnUnknownQuota: false,
+        mainQuota: {
+          five_hour: { usedPercent: 100, remainingPercent: 0, checkedAt },
+          seven_day: { usedPercent: 100, remainingPercent: 0, checkedAt },
         },
-        close: () => {},
-      }) as never
-    const authorizations: string[] = []
-    await useTempAccountFile(storage)
-    globalThis.fetch = mock((input: unknown, init?: RequestInit) => {
-      const url = extractUrl(input as string | URL | Request)
-      if (url === TOKEN_URL)
-        return Promise.resolve(
-          new Response('refresh unavailable', { status: 500 }),
-        )
-      if (url.includes('/v1/messages')) {
-        const authorization =
-          new Headers(init?.headers).get('authorization') ?? ''
-        authorizations.push(authorization)
-        return Promise.resolve(
-          new Response('{}', {
-            status: 401,
-          }),
-        )
-      }
-      return Promise.resolve(new Response('{}', { status: 200 }))
-    }) as unknown as typeof fetch
-    const plugin = await getPlugin(undefined, undefined, {
-      claustrumConnector: connector,
-      claustrumNow: () => 0,
-    })
-    const result = await plugin.auth.loader(
-      () =>
-        Promise.resolve({
-          type: 'oauth' as const,
-          access: 'main-access',
-          refresh: 'main-refresh',
-          expires: checkedAt + 5 * 60 * 60 * 1000,
-        }),
-      { models: {} },
-    )
+        mainQuotaCheckedAt: checkedAt,
+      },
+      fallbacks: [
+        {
+          label: 'rejected',
+          handle,
+          access: 'rejected-vault-access',
+          account: { id: 'vault-sticky', quota: fallbackQuota },
+        },
+      ],
+      connector: (calls) => async () =>
+        ({
+          call: async (_moduleId: string, method: string, params: unknown) => {
+            calls.push({
+              method,
+              params: (params ?? {}) as Record<string, unknown>,
+            })
+            if (method === 'credential.get') {
+              if ((params as { handle?: string }).handle === handle) {
+                if (!blockFallbackCredential)
+                  return rejectedVaultCredentialResponse()
+                credentialGets += 1
+                return credentialGets === 1
+                  ? initialCredential
+                  : new Promise<never>(() => {})
+              }
+              return credentialResponse(
+                'vault-main-access',
+                17,
+                Date.now() + 60_000,
+              )
+            }
+            return { result: {} }
+          },
+          close: () => {},
+        }) as never,
+      response: new Response('{}', { status: 401 }),
+      bootPlugin: (overrides) =>
+        getPlugin(createMockClient(), tempConfigDir!, overrides),
+      createFallbackStorage,
+      useTempAccountFile,
+      extractUrl,
+      tempConfigDir: () => tempConfigDir!,
+    })
+    fixture.plugin.__claustrumCredentialCache.invalidate(handle)
+    blockFallbackCredential = true
     const request = {
       method: 'POST',
       headers: { 'x-session-affinity': 'rejected-vault-sticky-session' },
@@ -13014,18 +15854,20 @@ describe('auth.loader', () => {
       }),
     }
 
-    const coldResponse = await result.fetch(MESSAGES_URL, request)
+    const coldResponse = await fixture.result.fetch(MESSAGES_URL, request)
     expect(coldResponse.status).toBe(429)
     releaseInitialCredential()
     await Bun.sleep(25)
-    const response = await result.fetch(MESSAGES_URL, request)
+    const response = await fixture.result.fetch(MESSAGES_URL, request)
 
-    expect(authorizations).toEqual(['Bearer rejected-vault-access'])
+    expect(fixture.authorizations).toEqual(['Bearer rejected-vault-access'])
     expect(response.status).toBe(401)
     expect(
-      calls.filter((call) => call.method === 'credential.report_auth_failure'),
+      fixture.calls.filter(
+        (call) => call.method === 'credential.report_auth_failure',
+      ),
     ).toHaveLength(1)
-    await plugin.dispose?.()
+    await fixture.plugin.dispose?.()
   })
 
   test('admits and sends an OAuth route when an empty quota snapshot is fail-open', async () => {
@@ -18558,60 +21400,18 @@ describe('killswitch fetch gate', () => {
     let clock = originalNow()
     Date.now = () => clock
     try {
+      delete process.env.OPENCODE_ANTHROPIC_AUTH_FALLBACK_MODE
       const now = clock
       const accountId = 'killswitch-vault-fallback'
-      const handle = 'killswitch-vault-handle'
+      const handle = `ckh_${'K'.repeat(43)}`
       const vaultAccess = 'killswitch-vault-access'
+      let fallbackResident = vaultResident
       const quota = {
         five_hour: { usedPercent: 10, remainingPercent: 90, checkedAt: now },
         seven_day: { usedPercent: 10, remainingPercent: 90, checkedAt: now },
       }
-      await useTempAccountFile(
-        createFallbackStorage({
-          quota: {
-            enabled: true,
-            checkIntervalMinutes: 5,
-            refreshEveryNRequests: 1,
-            minimumRemaining: { five_hour: 10, seven_day: 20 },
-            failClosedOnUnknownQuota: false,
-          },
-          killswitch: { enabled: true, main: { five_hour: 5, seven_day: 10 } },
-          claustrum: { accounts: { [accountId]: { enabled: true } } },
-          accounts: [
-            {
-              id: accountId,
-              type: 'oauth',
-              access: 'sidecar-access',
-              refresh: 'sidecar-refresh',
-              expires: now + 5 * 60 * 60 * 1000,
-              claustrumHandle: handle,
-              quota,
-            },
-          ],
-        }),
-      )
-
-      const connector = async () =>
-        ({
-          call: async (_moduleId: string, method: string) => {
-            if (method === 'credential.get') {
-              return {
-                result: {
-                  payload: Array.from(
-                    new TextEncoder().encode(
-                      JSON.stringify({ access_token: vaultAccess }),
-                    ),
-                  ),
-                  expires_at_ms: now + 12 * 60 * 60 * 1000,
-                  record_version: 1,
-                },
-              }
-            }
-            return { result: {} }
-          },
-          close: () => {},
-        }) as never
       const detachedTimers: Array<() => void> = []
+      const custodyTicks: Array<() => unknown> = []
       const setTimeout = mock((callback: TestTimerHandler, delay?: number) => {
         if (delay === 0 && typeof callback === 'function') {
           detachedTimers.push(callback as () => void)
@@ -18619,69 +21419,138 @@ describe('killswitch fetch gate', () => {
         return 0 as unknown as ReturnType<typeof globalThis.setTimeout>
       }) as unknown as typeof globalThis.setTimeout
       const usageAuthorizations: string[] = []
-      globalThis.fetch = mock((input: unknown, init?: RequestInit) => {
-        const url = extractUrl(input as string | URL | Request)
-        if (url.includes('/api/oauth/usage')) {
-          usageAuthorizations.push(
-            new Headers(init?.headers).get('authorization') ?? '',
-          )
-          return Promise.resolve(
-            new Response(
+      const fixture = await bootSharedRuledClaustrumRow({
+        route: 'fallback-first',
+        quota: {
+          enabled: true,
+          checkIntervalMinutes: 5,
+          refreshEveryNRequests: 1,
+          minimumRemaining: { five_hour: 10, seven_day: 20 },
+          failClosedOnUnknownQuota: false,
+          mainQuota: {
+            checkedAt: now,
+            five_hour: {
+              usedPercent: 100,
+              remainingPercent: 0,
+              checkedAt: now,
+            },
+            seven_day: {
+              usedPercent: 100,
+              remainingPercent: 0,
+              checkedAt: now,
+            },
+          },
+          mainQuotaCheckedAt: now,
+          mainQuotaToken: tokenFingerprint('vault-main-access'),
+        },
+        storageOverrides: {
+          killswitch: { enabled: true, main: { five_hour: 5, seven_day: 10 } },
+        },
+        fallbacks: [
+          {
+            label: 'killswitch',
+            handle,
+            access: vaultAccess,
+            account: { id: accountId, quota },
+          },
+        ],
+        connector: (calls) =>
+          connectorFor(calls, (method, params) =>
+            method !== 'credential.get'
+              ? { result: {} }
+              : params.handle === handle && !fallbackResident
+                ? (() => {
+                    throw new Error('vault fallback is cold')
+                  })()
+                : credentialResponse(
+                    params.handle === handle
+                      ? vaultAccess
+                      : 'vault-main-access',
+                    1,
+                    now + 12 * 60 * 60 * 1000,
+                  ),
+          ),
+        onFetch: (input, init) => {
+          if (
+            extractUrl(input as string | URL | Request).includes(
+              '/api/oauth/usage',
+            )
+          ) {
+            usageAuthorizations.push(
+              new Headers(init?.headers).get('authorization') ?? '',
+            )
+            return new Response(
               JSON.stringify({
                 five_hour: { utilization: 10 },
                 seven_day: { utilization: 10 },
               }),
               { status: 200 },
-            ),
-          )
-        }
-        return Promise.resolve(new Response('message-ok', { status: 200 }))
-      }) as unknown as typeof fetch
-
-      const plugin = await getPlugin(undefined, undefined, {
-        claustrumConnector: connector,
-        setTimeout,
+            )
+          }
+          return new Response('message-ok', { status: 200 })
+        },
+        runtimeOverrides: {
+          setTimeout,
+          setInterval: mock((handler: () => unknown) => {
+            custodyTicks.push(handler)
+            return { unref() {} } as never
+          }) as never,
+        },
+        bootPlugin: (overrides) =>
+          getPlugin(createMockClient(), tempConfigDir!, overrides),
+        createFallbackStorage,
+        useTempAccountFile,
+        extractUrl,
+        tempConfigDir: () => tempConfigDir!,
       })
+      const plugin = fixture.plugin
       await plugin.__fallbackRefreshReady
       clock = now + 6 * 60 * 60 * 1000
       plugin.__quotaManager.clearFallback(accountId)
-      if (!vaultResident) {
-        plugin.__claustrumCredentialCache.invalidate(handle)
-      }
       const residentBeforeRequest = Boolean(
         plugin.__claustrumCredentialCache.peek(handle),
       )
       usageAuthorizations.length = 0
       const timerBaseline = detachedTimers.length
 
-      const result = await plugin.auth.loader(oauthLoader, { models: {} })
-      const response = await result.fetch(MESSAGES_URL, EMPTY_POST)
+      const response = await fixture.result.fetch(MESSAGES_URL, EMPTY_POST)
       await response.text()
+      const coldFallbackUsageCalls = usageAuthorizations.filter(
+        (authorization) => authorization === `Bearer ${vaultAccess}`,
+      ).length
+      const coldSidecarUsageCalls = usageAuthorizations.filter(
+        (authorization) => authorization === 'Bearer sidecar-access',
+      ).length
+      let recoveredFallbackUsageCalls = 0
+      let residentAfterTick = vaultResident
+      if (!vaultResident) {
+        fallbackResident = true
+        expect(custodyTicks.length).toBeGreaterThan(0)
+        await Promise.all(custodyTicks.map((handler) => handler()))
+        residentAfterTick = Boolean(
+          plugin.__claustrumCredentialCache.peek(handle),
+        )
+        usageAuthorizations.length = 0
+        await plugin.__quotaManager.refreshFallback(accountId, vaultAccess)
+        recoveredFallbackUsageCalls = usageAuthorizations.filter(
+          (authorization) => authorization === `Bearer ${vaultAccess}`,
+        ).length
+      }
       await plugin.dispose?.()
 
       return {
-        fallbackUsageCalls: usageAuthorizations.filter(
-          (authorization) => authorization === `Bearer ${vaultAccess}`,
-        ).length,
+        fallbackUsageCalls: coldFallbackUsageCalls,
         residentBeforeRequest,
-        sidecarUsageCalls: usageAuthorizations.filter(
-          (authorization) => authorization === 'Bearer sidecar-access',
-        ).length,
+        sidecarUsageCalls: coldSidecarUsageCalls,
         scheduledWarmCount: detachedTimers.length - timerBaseline,
+        recoveredFallbackUsageCalls,
+        residentAfterTick,
       }
     } finally {
       Date.now = originalNow
     }
   }
 
-  test('killswitch quota refresh schedules one detached warm for a cold vault and expired sidecar', async () => {
-    const result = await runVaultKillswitchQuotaRefresh(false)
-
-    expect(result.fallbackUsageCalls).toBe(0)
-    expect(result.sidecarUsageCalls).toBe(0)
-    expect(result.scheduledWarmCount).toBe(1)
-  })
-
   test('killswitch quota refresh polls with a resident vault credential instead of an expired sidecar', async () => {
     const result = await runVaultKillswitchQuotaRefresh(true)
 
@@ -18689,6 +21558,17 @@ describe('killswitch fetch gate', () => {
     expect(result.sidecarUsageCalls).toBe(0)
     expect(result.fallbackUsageCalls).toBe(1)
     expect(result.scheduledWarmCount).toBe(0)
+    expect(result.residentAfterTick).toBe(true)
+  })
+
+  test('killswitch quota refresh skips a cold vault fallback without local refresh', async () => {
+    const result = await runVaultKillswitchQuotaRefresh(false)
+
+    expect(result.residentBeforeRequest).toBe(false)
+    expect(result.sidecarUsageCalls).toBe(0)
+    expect(result.fallbackUsageCalls).toBe(0)
+    expect(result.scheduledWarmCount).toBe(0)
+    expect(result.recoveredFallbackUsageCalls).toBe(1)
   })
 
   // Main below the soft routing threshold but ABOVE the killswitch threshold,
diff --git a/packages/opencode/src/tests/local-login.test.ts b/packages/opencode/src/tests/local-login.test.ts
new file mode 100644
index 00000000..37e16cfc
--- /dev/null
+++ b/packages/opencode/src/tests/local-login.test.ts
@@ -0,0 +1,312 @@
+import { afterEach, describe, expect, test } from 'bun:test'
+import {
+  chmod,
+  mkdir,
+  mkdtemp,
+  readFile,
+  rm,
+  writeFile,
+} from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+import {
+  acknowledgeLocalOAuthLogin,
+  acknowledgeLocalOAuthLoginFromStorage,
+  assertLocalLoginObservationAvailable,
+  type CompletedLocalLogin,
+  CustodyLoginObservationUnavailableError,
+  custodyDivergenceMarker,
+  custodyPreflightDivergenceCheck,
+  lastVaultServedRecordVersion,
+  localAuthFingerprint,
+  persistCustodyDivergenceState,
+} from '../local-login.ts'
+
+const completion: CompletedLocalLogin = {
+  accountId: 'main',
+  credentialId: 'oauth:anthropic:main',
+  authFingerprint: localAuthFingerprint('access-new', 'refresh-new'),
+  completedAt: 1,
+}
+
+const entry = {
+  label: 'main',
+  handle: `ckh_${'A'.repeat(43)}`,
+  credentialId: completion.credentialId,
+}
+
+const tempDirs = new Set<string>()
+afterEach(async () => {
+  await Promise.all(
+    [...tempDirs].map((directory) =>
+      rm(directory, { recursive: true, force: true }),
+    ),
+  )
+  tempDirs.clear()
+})
+
+async function seedStorage(access: string, refresh: string) {
+  const tempDir = await mkdtemp(join(tmpdir(), 'local-login-test-'))
+  tempDirs.add(tempDir)
+  const accountPath = join(tempDir, 'anthropic-auth.json')
+  const statePath = join(tempDir, 'anthropic-auth-state.json')
+  const manifestPath = join(tempDir, 'handles.json')
+  await writeFile(
+    accountPath,
+    JSON.stringify({
+      version: 1,
+      accounts: [{ id: 'main', label: 'main', type: 'oauth', enabled: true }],
+    }),
+  )
+  await writeFile(
+    statePath,
+    JSON.stringify({
+      version: 1,
+      accounts: { main: { access, refresh } },
+    }),
+  )
+  await mkdir(join(tempDir, 'manifest'), { recursive: true })
+  await writeFile(
+    manifestPath,
+    JSON.stringify({
+      version: 1,
+      providers: [
+        {
+          provider: 'anthropic',
+          serve: 'anthropic-auth',
+          accounts: [
+            {
+              label: 'main',
+              handle: `ckh_${'D'.repeat(43)}`,
+              credential_id: entry.credentialId,
+            },
+          ],
+        },
+      ],
+    }),
+  )
+  await chmod(manifestPath, 0o600)
+  return { accountPath, manifestPath }
+}
+
+describe('acknowledgeLocalOAuthLogin', () => {
+  test('restored material without an in-process completion does not clear', async () => {
+    const calls: unknown[] = []
+    await expect(
+      acknowledgeLocalOAuthLogin(
+        undefined,
+        {
+          type: 'oauth',
+          access: 'access-new',
+          refresh: 'refresh-new',
+        },
+        {
+          manifestPath: '/manifest.json',
+          entry,
+          remove: async (input) => {
+            calls.push(input)
+            return 'removed'
+          },
+        },
+      ),
+    ).resolves.toBe('not-cleared')
+    expect(calls).toHaveLength(0)
+  })
+
+  test('completion without matching live read-back does not clear', async () => {
+    const calls: unknown[] = []
+    await expect(
+      acknowledgeLocalOAuthLogin(
+        completion,
+        {
+          type: 'oauth',
+          access: 'restored-access',
+          refresh: 'restored-refresh',
+        },
+        {
+          manifestPath: '/manifest.json',
+          entry,
+          remove: async (input) => {
+            calls.push(input)
+            return 'removed'
+          },
+        },
+      ),
+    ).resolves.toBe('not-cleared')
+    expect(calls).toHaveLength(0)
+  })
+
+  test('matching completion and live read-back clear the binding', async () => {
+    const calls: unknown[] = []
+    await expect(
+      acknowledgeLocalOAuthLogin(
+        completion,
+        {
+          type: 'oauth',
+          access: 'access-new',
+          refresh: 'refresh-new',
+        },
+        {
+          manifestPath: '/manifest.json',
+          entry,
+          remove: async (input) => {
+            calls.push(input)
+            return 'removed'
+          },
+        },
+      ),
+    ).resolves.toBe('cleared')
+    expect(calls).toEqual([{ path: '/manifest.json', entry }])
+  })
+})
+
+test('fixed auth content rejects local login before OAuth', () => {
+  expect(() =>
+    assertLocalLoginObservationAvailable({ OPENCODE_AUTH_CONTENT: '{}' }),
+  ).toThrow(CustodyLoginObservationUnavailableError)
+  try {
+    assertLocalLoginObservationAvailable({ OPENCODE_AUTH_CONTENT: '{}' })
+  } catch (error) {
+    expect(error).toMatchObject({
+      code: 'custody_login_observation_unavailable',
+    })
+  }
+})
+
+test.serial(
+  'authoritative storage read-back blocks a CLI/TUI clear on mismatched credentials',
+  async () => {
+    const paths = await seedStorage('old-access', 'old-refresh')
+    const calls: unknown[] = []
+    await expect(
+      acknowledgeLocalOAuthLoginFromStorage(completion, {
+        accountStoragePath: paths.accountPath,
+        manifestPath: paths.manifestPath,
+        remove: async (input) => {
+          calls.push(input)
+          return 'removed'
+        },
+      }),
+    ).resolves.toBe('not-cleared')
+    expect(calls).toHaveLength(0)
+  },
+)
+
+test('divergence preflight rejects credential records older than the fence', () => {
+  const state = {
+    claustrumDivergence: {
+      'oauth:anthropic:main': custodyDivergenceMarker(7, 100),
+    },
+  }
+  expect(
+    custodyPreflightDivergenceCheck(
+      { credentialId: 'oauth:anthropic:main', recordVersion: 7 },
+      state,
+    ),
+  ).toEqual({ ok: false, message: 'missing fresh vault import' })
+  expect(
+    custodyPreflightDivergenceCheck(
+      { credentialId: 'oauth:anthropic:main', recordVersion: 8 },
+      state,
+    ),
+  ).toEqual({ ok: true })
+})
+
+test('TUI fence version prefers served provenance then cache and warns on never served', () => {
+  expect(
+    lastVaultServedRecordVersion({
+      accountId: 'work',
+      servedVersion: 9,
+      cacheVersion: 3,
+    }),
+  ).toBe(9)
+  expect(
+    lastVaultServedRecordVersion({ accountId: 'work', cacheVersion: 9 }),
+  ).toBe(9)
+  expect(lastVaultServedRecordVersion({ accountId: 'work' })).toBe(0)
+})
+
+test.serial('persists the divergence fence as state-only data', async () => {
+  const directory = await mkdtemp(join(tmpdir(), 'divergence-state-test-'))
+  tempDirs.add(directory)
+  const statePath = join(directory, 'anthropic-auth-state.json')
+  await writeFile(statePath, JSON.stringify({ version: 1, accounts: {} }))
+  await persistCustodyDivergenceState(statePath, 'oauth:anthropic:main', 7, 100)
+  const state = JSON.parse(await readFile(statePath, 'utf8'))
+  expect(state.claustrumDivergence['oauth:anthropic:main']).toEqual({
+    minimumRecordVersion: 8,
+    observedAt: 100,
+  })
+  expect(state.accounts).toEqual({})
+})
+
+test.serial(
+  'writes the divergence fence before attempting manifest removal',
+  async () => {
+    const paths = await seedStorage('access-new', 'refresh-new')
+    let stateAtRemove: Record<string, unknown> | undefined
+    await expect(
+      acknowledgeLocalOAuthLogin(
+        completion,
+        {
+          type: 'oauth',
+          access: 'access-new',
+          refresh: 'refresh-new',
+        },
+        {
+          manifestPath: paths.manifestPath,
+          entry: {
+            label: 'main',
+            handle: `ckh_${'D'.repeat(43)}`,
+            credentialId: completion.credentialId,
+          },
+          divergence: {
+            statePath: join(
+              tempDirs.values().next().value as string,
+              'anthropic-auth-state.json',
+            ),
+            lastVaultServedRecordVersion: 9,
+          },
+          remove: async () => {
+            stateAtRemove = JSON.parse(
+              await readFile(
+                join(
+                  tempDirs.values().next().value as string,
+                  'anthropic-auth-state.json',
+                ),
+                'utf8',
+              ),
+            )
+            throw new Error('manifest removal failed')
+          },
+        },
+      ),
+    ).rejects.toThrow('manifest removal failed')
+    expect(
+      (
+        stateAtRemove?.claustrumDivergence as
+          | Record<string, unknown>
+          | undefined
+      )?.[completion.credentialId],
+    ).toEqual({
+      minimumRecordVersion: 10,
+      observedAt: expect.any(Number),
+    })
+  },
+)
+
+test.serial(
+  'authoritative storage read-back clears a matching CLI/TUI login',
+  async () => {
+    const paths = await seedStorage('access-new', 'refresh-new')
+    await expect(
+      acknowledgeLocalOAuthLoginFromStorage(completion, {
+        accountStoragePath: paths.accountPath,
+        manifestPath: paths.manifestPath,
+      }),
+    ).resolves.toBe('cleared')
+    const manifest = JSON.parse(await readFile(paths.manifestPath, 'utf8'))
+    expect(manifest.providers[0].accounts).toEqual([])
+  },
+)
diff --git a/packages/opencode/src/tests/logger.test.ts b/packages/opencode/src/tests/logger.test.ts
index 690105e6..69c682c5 100644
--- a/packages/opencode/src/tests/logger.test.ts
+++ b/packages/opencode/src/tests/logger.test.ts
@@ -237,6 +237,15 @@ describe('redactPayload', () => {
     expect(result?.jwt).toBe('***REDACTED***')
   })
 
+  test('redacts custody handles by key and value', () => {
+    const handle = `ckh_${'H'.repeat(43)}`
+    const result = redactPayload({ handle, nested: { value: handle } })
+    expect(result).toEqual({
+      handle: '***REDACTED***',
+      nested: { value: '***REDACTED***' },
+    })
+  })
+
   test('keeps safe keys unchanged', () => {
     const result = redactPayload({
       input_tokens: 500,
diff --git a/packages/opencode/src/tests/plugin-exports.test.ts b/packages/opencode/src/tests/plugin-exports.test.ts
index b895a55d..7659a899 100644
--- a/packages/opencode/src/tests/plugin-exports.test.ts
+++ b/packages/opencode/src/tests/plugin-exports.test.ts
@@ -16,4 +16,16 @@ describe('plugin module exports', () => {
 
     expect('__setBootProfileHydrationForTest' in pluginModule).toBe(false)
   })
+
+  test('does not expose a credential-cache construction hook', async () => {
+    const { AnthropicAuthPlugin } = await import('../index')
+    const plugin = await (
+      AnthropicAuthPlugin as unknown as (
+        ctx: unknown,
+      ) => Promise<Record<string, unknown>>
+    )({ client: { auth: { set: async () => {} } } })
+
+    expect('__ensureClaustrumCredentialCacheForTest' in plugin).toBe(false)
+    await (plugin.dispose as (() => Promise<void>) | undefined)?.()
+  })
 })
diff --git a/packages/opencode/src/tests/quota-header-feed.test.ts b/packages/opencode/src/tests/quota-header-feed.test.ts
index 69ad1a18..ee387cc4 100644
--- a/packages/opencode/src/tests/quota-header-feed.test.ts
+++ b/packages/opencode/src/tests/quota-header-feed.test.ts
@@ -5,8 +5,10 @@ import {
   mkdtemp,
   readdir,
   readFile,
+  rename,
   rm,
   stat,
+  utimes,
   writeFile,
 } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
@@ -32,6 +34,7 @@ function entry(overrides: Record<string, unknown> = {}): QuotaHeaderFeedEntry {
     provider: 'anthropic',
     configured_account_count: 1,
     observed_at_ms: 1_000,
+    anthropic_account_uuid: null,
     quota,
     ...overrides,
   } as QuotaHeaderFeedEntry
@@ -77,6 +80,50 @@ describe('quota header feed', () => {
     expect(QUOTA_HEADER_FEED_SCHEMA_VERSION).toBe(3)
     expect(raw.entries.a.schema_version).toBe(3)
     expect(raw.entries.a.provider).toBe('anthropic')
+    expect(raw.lease_horizon_ms).toBe(QUOTA_HEADER_FEED_LEASE_MS)
+    expect(raw.entries.a).toHaveProperty('anthropic_account_uuid', null)
+  })
+
+  test('projects only the documented entry keys', async () => {
+    const registry = new QuotaHeaderFeedRegistry({
+      directory,
+      instanceId: 'entry-allowlist',
+    })
+    await registry.publish({
+      ...entry({
+        anthropic_account_uuid: 'uuid-1',
+        unexpected_entry_secret: 'must-not-publish',
+      }),
+      accountKey: 'a',
+    } as unknown as QuotaHeaderFeedPublishEntry)
+
+    const raw = JSON.parse(
+      await readFile(join(directory, 'entry-allowlist.json'), 'utf8'),
+    )
+    expect(raw.entries.a).toEqual({
+      identity_source: 'credential_id',
+      credential_id: 'cred-1',
+      schema_version: QUOTA_HEADER_FEED_SCHEMA_VERSION,
+      provider: 'anthropic',
+      configured_account_count: 1,
+      observed_at_ms: 1_000,
+      anthropic_account_uuid: 'uuid-1',
+      quota,
+    })
+    expect(JSON.stringify(raw)).not.toContain('must-not-publish')
+  })
+
+  test('publishes the configured lease horizon from the registry seam', async () => {
+    const registry = new QuotaHeaderFeedRegistry({
+      directory,
+      instanceId: 'lease-horizon',
+      leaseMs: 17,
+    })
+    await registry.publish({ ...entry(), accountKey: 'a' })
+    const raw = JSON.parse(
+      await readFile(join(directory, 'lease-horizon.json'), 'utf8'),
+    )
+    expect(raw.lease_horizon_ms).toBe(17)
   })
 
   test.each([1, 2, 999])(
@@ -510,4 +557,120 @@ describe('quota header feed', () => {
       entry({ observed_at_ms: 1_002, credential_id: 'new' }),
     ])
   })
+
+  test('reaps stale sibling process leases without touching fresh or foreign files', async () => {
+    const now = Date.now()
+    await mkdir(directory, { recursive: true })
+    const staleNames = [
+      '101-11111111-1111-1111-1111-111111111111.json',
+      '102-22222222-2222-2222-2222-222222222222.json',
+      '103-33333333-3333-3333-3333-333333333333.json',
+    ]
+    const freshNames = [
+      '104-44444444-4444-4444-4444-444444444444.json',
+      '105-55555555-5555-5555-5555-555555555555.json',
+    ]
+    for (const name of [...staleNames, ...freshNames]) {
+      const path = join(directory, name)
+      await writeFile(path, '{}')
+      const age = staleNames.includes(name)
+        ? QUOTA_HEADER_FEED_LEASE_MS + 1
+        : QUOTA_HEADER_FEED_LEASE_MS - 1
+      await utimes(path, (now - age) / 1_000, (now - age) / 1_000)
+    }
+    await writeFile(join(directory, 'foreign-named-file.json'), '{}')
+    await utimes(
+      join(directory, 'foreign-named-file.json'),
+      (now - QUOTA_HEADER_FEED_LEASE_MS - 1) / 1_000,
+      (now - QUOTA_HEADER_FEED_LEASE_MS - 1) / 1_000,
+    )
+
+    const registry = new QuotaHeaderFeedRegistry({
+      directory,
+      instanceId: '106-66666666-6666-6666-6666-666666666666',
+      now: () => now,
+    })
+    await registry.publish({ ...entry(), accountKey: 'a' })
+
+    const names = await readdir(directory)
+    for (const name of staleNames) expect(names).not.toContain(name)
+    for (const name of freshNames) expect(names).toContain(name)
+    expect(names).toContain('foreign-named-file.json')
+    expect(names).toContain('106-66666666-6666-6666-6666-666666666666.json')
+  })
+
+  test('does not unlink a fresh lease published after the stale lease was inspected', async () => {
+    const now = Date.now()
+    const siblingName = '101-11111111-1111-1111-1111-111111111111.json'
+    const siblingPath = join(directory, siblingName)
+    const replacementPath = join(directory, 'fresh-publisher.tmp')
+    await mkdir(directory, { recursive: true })
+    await writeFile(siblingPath, '{"stale":true}')
+    await utimes(
+      siblingPath,
+      (now - QUOTA_HEADER_FEED_LEASE_MS - 1) / 1_000,
+      (now - QUOTA_HEADER_FEED_LEASE_MS - 1) / 1_000,
+    )
+    expect(now - (await stat(siblingPath)).mtimeMs).toBeGreaterThanOrEqual(
+      QUOTA_HEADER_FEED_LEASE_MS,
+    )
+
+    let publisherRan = false
+    let publisherError: unknown
+    const registry = new QuotaHeaderFeedRegistry({
+      directory,
+      instanceId: '102-22222222-2222-2222-2222-222222222222',
+      now: () => now,
+      beforeRemoveFile: async (path: string) => {
+        publisherRan = true
+        try {
+          await writeFile(replacementPath, '{"fresh":true}')
+          await utimes(replacementPath, now / 1_000, now / 1_000)
+          await rename(replacementPath, siblingPath)
+          expect(path).toBe(siblingPath)
+        } catch (error) {
+          publisherError = error
+          throw error
+        }
+      },
+    })
+
+    await registry.publish({ ...entry(), accountKey: 'a' })
+
+    expect(publisherRan).toBe(true)
+    expect(publisherError).toBeUndefined()
+    expect(await readFile(siblingPath, 'utf8')).toBe('{"fresh":true}')
+  })
+
+  test('continues publishing when a sibling lease sweep cannot unlink a stale file', async () => {
+    const now = Date.now()
+    const stalePath = join(
+      directory,
+      '101-11111111-1111-1111-1111-111111111111.json',
+    )
+    await mkdir(directory, { recursive: true })
+    await writeFile(stalePath, '{}')
+    await utimes(
+      stalePath,
+      (now - QUOTA_HEADER_FEED_LEASE_MS - 1) / 1_000,
+      (now - QUOTA_HEADER_FEED_LEASE_MS - 1) / 1_000,
+    )
+    const ownFile = '102-22222222-2222-2222-2222-222222222222.json'
+    const registry = new QuotaHeaderFeedRegistry({
+      directory,
+      instanceId: ownFile.slice(0, -'.json'.length),
+      now: () => now,
+      removeFile: async () => {
+        throw Object.assign(new Error('permission denied'), { code: 'EACCES' })
+      },
+    })
+
+    await expect(
+      registry.publish({ ...entry(), accountKey: 'a' }),
+    ).resolves.toBeUndefined()
+    expect(await readdir(directory)).toContain(ownFile)
+    expect(await readdir(directory)).toContain(
+      '101-11111111-1111-1111-1111-111111111111.json',
+    )
+  })
 })
diff --git a/packages/opencode/src/tests/quota-manager.test.ts b/packages/opencode/src/tests/quota-manager.test.ts
index fb7a4b98..0af55e5c 100644
--- a/packages/opencode/src/tests/quota-manager.test.ts
+++ b/packages/opencode/src/tests/quota-manager.test.ts
@@ -1685,7 +1685,7 @@ describe('QuotaManager', () => {
   })
 
   describe('refreshMain dedup (identity-keyed)', () => {
-    test('rotated access tokens under one main identity share one in-flight fetch', async () => {
+    test('rotated access tokens under one main identity use separate in-flight fetches', async () => {
       let fetchCalls = 0
       const fetchMock = mock(async () => {
         fetchCalls++
@@ -1703,7 +1703,7 @@ describe('QuotaManager', () => {
       ])
 
       expect(quotaA).toEqual(quotaB)
-      expect(fetchCalls).toBe(1)
+      expect(fetchCalls).toBe(2)
     })
 
     test('concurrent different-token refreshMain: each gets its own quota', async () => {
diff --git a/packages/opencode/src/tests/setup.ts b/packages/opencode/src/tests/setup.ts
index 278c91f2..86c217ca 100644
--- a/packages/opencode/src/tests/setup.ts
+++ b/packages/opencode/src/tests/setup.ts
@@ -3,6 +3,7 @@ import { mkdtempSync } from 'node:fs'
 import { rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
+import { resolveCustodyHandlesPath } from '@cortexkit/anthropic-auth-core'
 import {
   assertLoopback,
   assertPreconnectUrl,
@@ -161,12 +162,31 @@ afterEach(() => {
 globalThis.fetch = guardedFetch
 
 const testDir = mkdtempSync(join(tmpdir(), 'anthropic-auth-opencode-test-'))
+const testManifestPath = join(testDir, 'handles.json')
+const testClaustrumConnectionPath = join(testDir, 'claustrum-connection.json')
 
 afterAll(async () => {
   await rm(testDir, { recursive: true, force: true }).catch(() => {})
 })
 
 process.env.OPENCODE_ANTHROPIC_AUTH_TEST_DIR = testDir
+process.env.CLAUSTRUM_OPENCODE_HANDLES = testManifestPath
+process.env.OPENCODE_ANTHROPIC_AUTH_CLAUSTRUM_CONNECTION_FILE =
+  testClaustrumConnectionPath
+const resolvedTestManifestPath = resolveCustodyHandlesPath(
+  undefined,
+  process.env,
+)
+const productionDefaultManifestPath = resolveCustodyHandlesPath(undefined, {
+  ...process.env,
+  CLAUSTRUM_OPENCODE_HANDLES: undefined,
+})
+if (
+  resolvedTestManifestPath !== testManifestPath ||
+  resolvedTestManifestPath === productionDefaultManifestPath
+) {
+  throw new Error('test manifest path escaped the isolated test directory')
+}
 process.env.OPENCODE_ANTHROPIC_AUTH_FILE = join(testDir, 'anthropic-auth.json')
 process.env.OPENCODE_ANTHROPIC_AUTH_SIDEBAR_STATE_FILE = join(
   testDir,
diff --git a/packages/opencode/src/transform.ts b/packages/opencode/src/transform.ts
index 16863813..2c4864ed 100644
--- a/packages/opencode/src/transform.ts
+++ b/packages/opencode/src/transform.ts
@@ -3,6 +3,7 @@ import {
   applyClaudeCodeHeaders,
   applyClaudeCodeMetadata,
   applyThinkingBindingControls,
+  assertNotCustodyTombstone,
   buildBillingHeaderValue,
   type Cache1hMode,
   CLAUDE_CODE_ENTRYPOINT,
@@ -168,6 +169,8 @@ export function setOAuthHeaders(
     identity?: ClaudeCodeIdentity
   } = {},
 ): Headers {
+  // This is the shared boundary where an access value becomes a bearer header.
+  assertNotCustodyTombstone(accessToken, 'anthropic')
   return applyClaudeCodeHeaders(headers, accessToken, {
     ...options,
     extraBetas: [
diff --git a/packages/opencode/src/tui/command-dialogs.tsx b/packages/opencode/src/tui/command-dialogs.tsx
index 791702d8..c5d46f71 100644
--- a/packages/opencode/src/tui/command-dialogs.tsx
+++ b/packages/opencode/src/tui/command-dialogs.tsx
@@ -1,5 +1,8 @@
 /** @jsxImportSource @opentui/solid */
-import type { PrimeAccountStatus } from '@cortexkit/anthropic-auth-core'
+import {
+  custodyStatusLabel,
+  type PrimeAccountStatus,
+} from '@cortexkit/anthropic-auth-core'
 import type { TuiPluginApi } from '@opencode-ai/plugin/tui'
 import type { AccountDialogAccount } from '../rpc/protocol'
 import type { OpenDialogPayload } from '../rpc/protocol.js'
@@ -16,6 +19,26 @@ type KillswitchDialogConfig = {
   accounts?: Record<string, Record<string, number>>
 }
 
+type TuiAccountDialogAccount = Omit<
+  AccountDialogAccount,
+  'vaultReauth' | 'custodyState'
+> &
+  Partial<Pick<AccountDialogAccount, 'vaultReauth' | 'custodyState'>>
+
+type TuiAccountDialogPayload = {
+  accounts: TuiAccountDialogAccount[]
+  claustrumDetection: string
+  custodyMode?: TuiCustodyMode
+}
+
+type TuiCustodyMode = 'local' | 'claustrum' | `mismatch: ${string}`
+
+type AccountDialogOption = {
+  title: string
+  value: string
+  description?: string
+}
+
 export const PRIME_DIALOG_OPTIONS = [
   { title: 'Enable', value: 'on' },
   { title: 'Disable', value: 'off' },
@@ -49,24 +72,181 @@ export function buildKillswitchThresholdSeed(
   return seedParts.join(' ')
 }
 
-export function buildAccountDialogOption(account: AccountDialogAccount) {
+function normalizeTuiCustodyMode(value: string): TuiCustodyMode {
+  return value === 'local' || value === 'claustrum'
+    ? value
+    : `mismatch: ${value}`
+}
+
+export function normalizeAccountDialogPayload(
+  value: unknown,
+): TuiAccountDialogPayload {
+  const payload =
+    value && typeof value === 'object' ? (value as Record<string, unknown>) : {}
+  const rawAccounts = Array.isArray(payload.accounts) ? payload.accounts : []
+  const accounts = rawAccounts.flatMap((value) => {
+    if (!value || typeof value !== 'object') return []
+    const account = value as Record<string, unknown>
+    const quotaPercent = account.quotaPercent
+    if (
+      typeof account.id !== 'string' ||
+      typeof account.label !== 'string' ||
+      (account.role !== 'main' && account.role !== 'fallback') ||
+      typeof account.enabled !== 'boolean' ||
+      (quotaPercent !== null &&
+        (typeof quotaPercent !== 'number' || !Number.isFinite(quotaPercent))) ||
+      (account.claustrumGate !== 'on' &&
+        account.claustrumGate !== 'off' &&
+        account.claustrumGate !== 'na') ||
+      typeof account.vaultServed !== 'boolean'
+    ) {
+      return []
+    }
+    const normalized = {
+      id: account.id,
+      label: account.label,
+      role: account.role,
+      enabled: account.enabled,
+      quotaPercent,
+      ...(typeof account.tierLabel === 'string' && {
+        tierLabel: account.tierLabel,
+      }),
+      claustrumGate: account.claustrumGate,
+      vaultServed: account.vaultServed,
+    } satisfies TuiAccountDialogAccount
+    const custodyState = account.custodyState
+    if (
+      (custodyState === 'na' ||
+        custodyState === 'off' ||
+        custodyState === 'on-vault-served' ||
+        custodyState === 'on-vault-reauth' ||
+        custodyState === 'on-cold') &&
+      typeof account.vaultReauth === 'boolean'
+    ) {
+      return [
+        {
+          ...normalized,
+          custodyState,
+          vaultReauth: account.vaultReauth,
+        },
+      ]
+    }
+    return [normalized]
+  })
+  const custodyMode: TuiCustodyMode | undefined =
+    payload.custodyModeKnown === true && typeof payload.custodyMode === 'string'
+      ? normalizeTuiCustodyMode(payload.custodyMode)
+      : undefined
+  return {
+    accounts,
+    claustrumDetection:
+      typeof payload.claustrumDetection === 'string'
+        ? payload.claustrumDetection
+        : 'unknown',
+    ...(custodyMode && { custodyMode }),
+  }
+}
+
+export function buildAccountDialogOption(account: TuiAccountDialogAccount) {
   const pct =
     account.quotaPercent != null
       ? ` ${Math.round(account.quotaPercent)}%`
       : ' \u2013%'
   const status = !account.enabled ? ' (disabled)' : ''
-  const gate = ` · gate ${account.claustrumGate === 'na' ? 'n/a' : account.claustrumGate}`
-  const vault =
-    account.role === 'main'
-      ? ' · vault n/a'
-      : ` · vault ${account.vaultServed ? 'served' : 'cold'}`
+  const custody = account.custodyState
+    ? account.custodyState === 'na'
+      ? undefined
+      : custodyStatusLabel(account.custodyState).replace(
+          ' (OpenCode managed)',
+          '',
+        )
+    : undefined
   return {
-    title: `${account.label} [${account.role}]${status}${pct}${gate}${vault}`,
+    title: `${account.label} [${account.role}]${status}${pct}${custody ? ` · custody ${custody}` : ''}`,
     value: account.id,
     ...(account.tierLabel && { description: account.tierLabel }),
   }
 }
 
+export function buildManageAccountOptions(account: TuiAccountDialogAccount) {
+  const options: AccountDialogOption[] = []
+  const toggleLabel = account.enabled ? 'Disable' : 'Enable'
+  options.push({
+    title: toggleLabel,
+    value: account.enabled ? 'disable' : 'enable',
+    description: account.enabled
+      ? 'Stop using this fallback account'
+      : 'Allow this fallback account to be used',
+  })
+  options.push({
+    title: 'Move up',
+    value: 'move-up',
+    description: 'Higher priority in fallback order',
+  })
+  options.push({
+    title: 'Move down',
+    value: 'move-down',
+    description: 'Lower priority in fallback order',
+  })
+  options.push({
+    title: 'Remove\u2026',
+    value: 'remove',
+    description: 'Delete this account permanently',
+  })
+  options.push({ title: 'Back', value: 'back' })
+  return options
+}
+
+export function buildAccountDialogL1(value: unknown): {
+  header: string
+  options: AccountDialogOption[]
+  modeAction?: { command: 'claude-account'; arguments: 'local' | 'claustrum' }
+} {
+  const payload = normalizeAccountDialogPayload(value)
+  const modeAction =
+    payload.custodyMode === 'local' || payload.custodyMode === 'claustrum'
+      ? {
+          command: 'claude-account' as const,
+          arguments:
+            payload.custodyMode === 'local'
+              ? ('claustrum' as const)
+              : ('local' as const),
+        }
+      : undefined
+  return {
+    header: payload.custodyMode
+      ? `Custody mode: ${payload.custodyMode}`
+      : 'Custody mode: unavailable from older server',
+    options: [
+      ...(modeAction
+        ? [
+            {
+              title:
+                payload.custodyMode === 'local'
+                  ? 'Use Claustrum custody'
+                  : 'Use local custody',
+              value: '__custody-mode__',
+            },
+          ]
+        : []),
+      {
+        title: 'Add account…',
+        value: '__add__',
+        description: 'Add an API key or OAuth fallback account',
+      },
+      ...payload.accounts.map(buildAccountDialogOption),
+    ],
+    ...(modeAction && { modeAction }),
+  }
+}
+
+export function retainAccountDialogProjection(
+  current: Record<string, unknown>,
+  incoming: Record<string, unknown>,
+): Record<string, unknown> {
+  return Array.isArray(incoming.accounts) ? incoming : current
+}
+
 function showText(api: TuiPluginApi, text: string) {
   api.ui.dialog.setSize('xlarge')
   api.ui.dialog.replace(() => (
@@ -377,17 +557,16 @@ export function openCommandDialog(
   }
 
   if (payload.command === 'claude-account') {
-    const accounts =
-      (payload.knobs.accounts as AccountDialogAccount[] | undefined) ?? []
-    const claustrumDetection =
-      (payload.knobs.claustrumDetection as string | undefined) ?? 'unknown'
+    let accountKnobs: Record<string, unknown> = payload.knobs
+    const accounts = normalizeAccountDialogPayload(accountKnobs).accounts
 
     const updateAccounts = (r: {
       text: string
       knobs: Record<string, unknown>
     }) => {
-      const updated = r.knobs.accounts as typeof accounts
-      if (updated && updated.length > 0) {
+      accountKnobs = retainAccountDialogProjection(accountKnobs, r.knobs)
+      const updated = normalizeAccountDialogPayload(accountKnobs).accounts
+      if (updated.length > 0) {
         accounts.length = 0
         accounts.push(...updated)
       }
@@ -395,31 +574,32 @@ export function openCommandDialog(
 
     const buildL1 = () => {
       const DialogSelect = api.ui.DialogSelect<string>
-      const l1Options: Array<{
-        title: string
-        value: string
-        description?: string
-      }> = [
-        {
-          title: 'Add account\u2026',
-          value: '__add__',
-          description: 'Add an API key or OAuth fallback account',
-        },
-        ...accounts.map(buildAccountDialogOption),
-      ]
+      const l1 = buildAccountDialogL1({ ...accountKnobs, accounts })
       api.ui.dialog.setSize('xlarge')
       api.ui.dialog.replace(() => (
         <box flexDirection='column' padding={1} width='100%'>
-          <text>{`Claustrum: ${claustrumDetection}`}</text>
+          <text>{`Claustrum: ${normalizeAccountDialogPayload(accountKnobs).claustrumDetection}`}</text>
+          <text>{l1.header}</text>
           <box marginTop={1}>
             <DialogSelect
               title='Claude accounts'
-              options={l1Options}
+              options={l1.options}
               onSelect={(option) => {
                 if (option.value === '__add__') {
                   openAddType()
                   return
                 }
+                if (option.value === '__custody-mode__' && l1.modeAction) {
+                  void apply(
+                    l1.modeAction.command,
+                    l1.modeAction.arguments,
+                  ).then((r) => {
+                    api.ui.toast({ message: r.text })
+                    updateAccounts(r)
+                    buildL1()
+                  })
+                  return
+                }
                 const account = accounts.find((a) => a.id === option.value)
                 if (!account) return
                 if (account.role === 'main') {
@@ -737,37 +917,9 @@ export function openCommandDialog(
       const DialogConfirm = api.ui.DialogConfirm
       api.ui.dialog.setSize('xlarge')
 
-      const options: Array<{
-        title: string
-        value: string
-        description?: string
-      }> = []
-      if (!isMain) {
-        const toggleLabel = account.enabled ? 'Disable' : 'Enable'
-        options.push({
-          title: toggleLabel,
-          value: account.enabled ? 'disable' : 'enable',
-          description: account.enabled
-            ? 'Stop using this fallback account'
-            : 'Allow this fallback account to be used',
-        })
-        options.push({
-          title: 'Move up',
-          value: 'move-up',
-          description: 'Higher priority in fallback order',
-        })
-        options.push({
-          title: 'Move down',
-          value: 'move-down',
-          description: 'Lower priority in fallback order',
-        })
-        options.push({
-          title: 'Remove\u2026',
-          value: 'remove',
-          description: 'Delete this account permanently',
-        })
-      }
-      options.push({ title: 'Back', value: 'back' })
+      const options = isMain
+        ? [{ title: 'Back', value: 'back' }]
+        : buildManageAccountOptions(account)
 
       api.ui.dialog.replace(() => (
         <DialogSelect
@@ -799,18 +951,19 @@ export function openCommandDialog(
               return
             }
 
-            void apply('claude-account', `${option.value} ${account.id}`).then(
-              (r) => {
-                api.ui.toast({ message: r.text })
-                updateAccounts(r)
-                const updatedList = r.knobs.accounts as typeof accounts
-                const refreshed =
-                  (updatedList && updatedList.length > 0
-                    ? updatedList.find((a) => a.id === account.id)
-                    : undefined) ?? account
-                openManage(refreshed, isMain)
-              },
-            )
+            const args = `${option.value} ${account.id}`
+            void apply('claude-account', args).then((r) => {
+              api.ui.toast({ message: r.text })
+              updateAccounts(r)
+              const updatedList = normalizeAccountDialogPayload(
+                r.knobs,
+              ).accounts
+              const refreshed =
+                (updatedList && updatedList.length > 0
+                  ? updatedList.find((a) => a.id === account.id)
+                  : undefined) ?? account
+              openManage(refreshed, isMain)
+            })
           }}
         />
       ))
diff --git a/packages/pi/src/commands.ts b/packages/pi/src/commands.ts
index 890bfd1a..8b599050 100644
--- a/packages/pi/src/commands.ts
+++ b/packages/pi/src/commands.ts
@@ -270,9 +270,13 @@ export function registerCommands(pi: ExtensionAPI) {
       const path = getPiAccountStoragePath()
       const storage = await loadAccounts(path)
       const action = parseAccountCommandAction(args ?? '')
-      const result = executeAccountCommand({
+      const result = await executeAccountCommand({
         argumentsText: args ?? '',
         storage: storage ?? createEmptyStorage(),
+        path,
+        transition: async () => ({
+          text: 'Custody mode is managed from OpenCode; Pi does not participate.',
+        }),
         claustrum:
           action.type === 'status'
             ? await detectClaustrumConnection()
diff --git a/packages/pi/src/tests/commands.test.ts b/packages/pi/src/tests/commands.test.ts
index 63e3b92c..e859aee6 100644
--- a/packages/pi/src/tests/commands.test.ts
+++ b/packages/pi/src/tests/commands.test.ts
@@ -7,7 +7,7 @@ import {
   test,
 } from 'bun:test'
 import { createHash } from 'node:crypto'
-import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { mkdtemp, readFile, rm, stat, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { CacheKeepSessionRegistry } from '@cortexkit/anthropic-auth-core'
@@ -84,6 +84,44 @@ afterAll(() => {
 })
 
 describe('claude-account persistence', () => {
+  test('refuses global custody modes without changing Pi config or state', async () => {
+    const initial = {
+      version: 1,
+      claustrum: { accounts: { unrelated: { enabled: true } } },
+      accounts: [
+        {
+          id: 'oauth-work',
+          type: 'oauth',
+          access: 'access',
+          refresh: 'refresh',
+          enabled: true,
+        },
+      ],
+    }
+    await writeFile(accountPath, JSON.stringify(initial), 'utf8')
+    await writeFile(statePath, JSON.stringify({ version: 1 }), 'utf8')
+    const beforeConfig = await readFile(accountPath, 'utf8')
+    const beforeState = await readFile(statePath, 'utf8')
+    const beforeConfigMtime = (await stat(accountPath)).mtimeMs
+    const beforeStateMtime = (await stat(statePath)).mtimeMs
+    const { pi, commands } = mockPi()
+    registerCommands(pi)
+    const handler = commands.get('claude-account')?.handler
+    const { ctx, notified } = mockNotify()
+
+    await handler!('claustrum', ctx)
+    await handler!('local', ctx)
+
+    expect(notified).toEqual([
+      'Custody mode is managed from OpenCode; Pi does not participate.',
+      'Custody mode is managed from OpenCode; Pi does not participate.',
+    ])
+    expect(await readFile(accountPath, 'utf8')).toBe(beforeConfig)
+    expect(await readFile(statePath, 'utf8')).toBe(beforeState)
+    expect((await stat(accountPath)).mtimeMs).toBe(beforeConfigMtime)
+    expect((await stat(statePath)).mtimeMs).toBe(beforeStateMtime)
+  })
+
   test('disable persists to storage', async () => {
     await writeFile(
       accountPath,
diff --git a/packages/pi/src/tests/convert.test.ts b/packages/pi/src/tests/convert.test.ts
index 984b8331..8ef96243 100644
--- a/packages/pi/src/tests/convert.test.ts
+++ b/packages/pi/src/tests/convert.test.ts
@@ -1,5 +1,8 @@
 import { describe, expect, test } from 'bun:test'
-import { computeCcVersionSuffix } from '@cortexkit/anthropic-auth-core'
+import {
+  computeCcVersionSuffix,
+  type ProviderAccountUuid,
+} from '@cortexkit/anthropic-auth-core'
 import type { Message } from '@earendil-works/pi-ai'
 import { buildAnthropicRequest } from '../convert'
 
@@ -517,7 +520,7 @@ describe('buildAnthropicRequest — Fable/Mythos thinking', () => {
     const identity = {
       deviceId: 'd'.repeat(64),
       accountIdentity: 'main',
-      accountUuid: 'account-uuid',
+      accountUuid: 'account-uuid' as ProviderAccountUuid,
       sessionId: 'identity-session',
     }
     const { body } = await buildAnthropicRequest(
@@ -614,7 +617,7 @@ describe('buildAnthropicRequest — Fable/Mythos thinking', () => {
       {
         deviceId: 'd'.repeat(64),
         accountIdentity: 'main',
-        accountUuid: 'account-uuid',
+        accountUuid: 'account-uuid' as ProviderAccountUuid,
         sessionId: 'identity-session',
       },
     )