From 6a00dbb6a1de4606ec7aed2b065c84e622965aef Mon Sep 17 00:00:00 2001
From: iceteaSA <171169159+iceteaSA@users.noreply.github.com>
Date: Wed, 16 Sep 2026 21:10:33 +0200
Subject: [PATCH 1/3] test(custody): make manifest-lock contention tests
 independent of wall clock

The lock TTL serves two opposed roles: it is both the contender's give-up deadline and the holder's staleness threshold. Raising it cannot make these tests deterministic: a starved holder can still become evictable, while the longer contender wait can overrun Bun's 5000ms watchdog.

Use injected clocks and explicit barriers instead. A synthetic fresh owner lets the lock_busy test advance from fresh-owner inspection to deadline exhaustion without elapsed time. Startup migration tests suppress only the test-observed 100ms warmup escape, and concurrent migration waits on entered/release/rename barriers rather than sleeps. Production behavior is untouched.

Under 16 CPU hogs, the unmodified tests were 0/10 and included semantic failures such as 'Expected promise that rejects / Received promise that resolved'. After the change, no lock assertion failed; remaining red runs were exclusively Bun watchdog kills followed by temp-directory cleanup cascades. Green runs clustered below 100ms (the concurrent case occasionally took longer when descheduled), while watchdog failures began at 5.4s. The direct mkdir/write/read lock_busy test was once reported at 7588ms under two-core oversubscription, proving that extreme-load gate measured scheduler starvation rather than lock semantics.
---
 .../src/tests/custody-handle-manifest.test.ts |  35 +--
 packages/opencode/src/tests/index.test.ts     | 265 ++++++++++--------
 2 files changed, 161 insertions(+), 139 deletions(-)

diff --git a/packages/opencode/src/tests/custody-handle-manifest.test.ts b/packages/opencode/src/tests/custody-handle-manifest.test.ts
index 38eb88d1..e81dca50 100644
--- a/packages/opencode/src/tests/custody-handle-manifest.test.ts
+++ b/packages/opencode/src/tests/custody-handle-manifest.test.ts
@@ -1655,27 +1655,30 @@ describe('withCustodyManifestLock', () => {
   test.serial('reports a held lock as lock_busy', async () => {
     await withTempDirectory(async (directory) => {
       const path = join(directory, 'handles.json')
-      const firstEntered = Promise.withResolvers<void>()
-      const releaseFirst = Promise.withResolvers<void>()
+      const lockPath = `${path}.lock`
+      const times = [0, 29, 30]
+      let timeIndex = 0
+      await fs.mkdir(lockPath, { mode: 0o700 })
+      await fs.writeFile(
+        join(lockPath, 'owner'),
+        `${JSON.stringify({
+          tenant: 'anthropic-auth',
+          pid: process.pid,
+          claimed_at_ms: 0,
+          nonce: 'held-test',
+        })}\n`,
+      )
       __setCustodyManifestLockTestOptions({
         ttlMs: 30,
         retryMinMs: 1,
         retryMaxMs: 1,
-        renewalIntervalMs: 5,
-      })
-      const first = withCustodyManifestLock(path, async () => {
-        firstEntered.resolve()
-        await releaseFirst.promise
+        now: () => times[Math.min(timeIndex++, times.length - 1)]!,
       })
-      try {
-        await firstEntered.promise
-        await expect(
-          withCustodyManifestLock(path, async () => 'acquired'),
-        ).rejects.toMatchObject({ code: 'lock_busy' })
-      } finally {
-        releaseFirst.resolve()
-        await first
-      }
+
+      await expect(
+        withCustodyManifestLock(path, async () => 'acquired'),
+      ).rejects.toMatchObject({ code: 'lock_busy' })
+      await expect(fs.lstat(lockPath)).resolves.toBeDefined()
     })
   })
 
diff --git a/packages/opencode/src/tests/index.test.ts b/packages/opencode/src/tests/index.test.ts
index 16b6db32..395aaea6 100644
--- a/packages/opencode/src/tests/index.test.ts
+++ b/packages/opencode/src/tests/index.test.ts
@@ -734,6 +734,26 @@ async function getPlugin(
   return plugin
 }
 
+async function withoutClaustrumWarmupDeadline<T>(
+  fn: () => Promise<T>,
+): Promise<T> {
+  const originalSetTimeout = globalThis.setTimeout
+  const setTimeoutImpl = ((
+    ...arguments_: Parameters<typeof globalThis.setTimeout>
+  ) =>
+    arguments_[1] === 100
+      ? ({ unref() {} } as ReturnType<typeof globalThis.setTimeout>)
+      : originalSetTimeout(...arguments_)) as typeof globalThis.setTimeout
+  const setTimeoutSpy = spyOn(globalThis, 'setTimeout').mockImplementation(
+    setTimeoutImpl,
+  )
+  try {
+    return await fn()
+  } finally {
+    setTimeoutSpy.mockRestore()
+  }
+}
+
 function installRelayResponseStart(
   status: number,
   errorEvent?: { status?: number; message?: string },
@@ -2442,12 +2462,14 @@ describe('fallback Claustrum credential resolution', () => {
         },
       )
       try {
-        const plugin = await getPlugin(undefined, undefined, {
-          claustrumConnector: manifestConnector(
-            [],
-            new Map([[legacyHandle, 'migration-order-access']]),
-          ),
-        })
+        const plugin = await withoutClaustrumWarmupDeadline(() =>
+          getPlugin(undefined, undefined, {
+            claustrumConnector: manifestConnector(
+              [],
+              new Map([[legacyHandle, 'migration-order-access']]),
+            ),
+          }),
+        )
         expect(stateAtManifestWrite).toContain(legacyHandle)
         expect(await readFile(accountStatePath, 'utf8')).not.toContain(
           legacyHandle,
@@ -2588,11 +2610,16 @@ describe('fallback Claustrum credential resolution', () => {
     },
   )
 
-  async function withShortManifestLockTiming<T>(fn: () => Promise<T>) {
+  async function withFixedManifestLockClock<T>(
+    fn: () => Promise<T>,
+    now?: () => number,
+  ) {
+    const fixedNow = Date.now()
     __setCustodyManifestLockTestOptions({
       ttlMs: 150,
       retryMinMs: 5,
       retryMaxMs: 5,
+      now: now ?? (() => fixedNow),
     })
     try {
       return await fn()
@@ -2621,14 +2648,16 @@ describe('fallback Claustrum credential resolution', () => {
     const manifestPath = await writeManifest([])
     const restore = await configureClaustrumConnection()
     const calls: CredentialCall[] = []
-    const plugin = await getPlugin(undefined, undefined, {
-      claustrumConnector:
-        input.connector?.(calls) ??
-        manifestConnector(
-          calls,
-          new Map([[input.handle, `${input.label}-access`]]),
-        ),
-    })
+    const plugin = await withoutClaustrumWarmupDeadline(() =>
+      getPlugin(undefined, undefined, {
+        claustrumConnector:
+          input.connector?.(calls) ??
+          manifestConnector(
+            calls,
+            new Map([[input.handle, `${input.label}-access`]]),
+          ),
+      }),
+    )
     return { calls, manifestPath, plugin, restore }
   }
 
@@ -2671,12 +2700,14 @@ describe('fallback Claustrum credential resolution', () => {
       const manifestPath = await writeManifest([])
       const restore = await configureClaustrumConnection()
       const calls: CredentialCall[] = []
-      const plugin = await getPlugin(undefined, undefined, {
-        claustrumConnector: manifestConnector(
-          calls,
-          new Map([[legacyHandle, 'retry-migration-access']]),
-        ),
-      })
+      const plugin = await withoutClaustrumWarmupDeadline(() =>
+        getPlugin(undefined, undefined, {
+          claustrumConnector: manifestConnector(
+            calls,
+            new Map([[legacyHandle, 'retry-migration-access']]),
+          ),
+        }),
+      )
       try {
         await plugin.__fallbackRefreshReady
         expect(
@@ -2820,72 +2851,59 @@ describe('fallback Claustrum credential resolution', () => {
   test.serial(
     'reports a corrupt manifest lock after its bounded wait and keeps the legacy handle',
     async () => {
-      await withShortManifestLockTiming(async () => {
-        await useTempAccountFile(
-          manifestStorage({ label: 'fresh-lock', legacy: legacyHandle }),
-        )
-        const manifestPath = await writeManifest([])
-        const restore = await configureClaustrumConnection()
-        const lockPath = `${manifestPath}.lock`
-        await mkdir(lockPath, { mode: 0o700 })
-        await writeFile(
-          join(lockPath, 'owner'),
-          `${JSON.stringify({ claimed_at_ms: Date.now(), tenant: 'test' })}\n`,
-        )
-        const logs: LogTestRecord[] = []
-        __setLogTestSink((record) => logs.push(record))
-        const startedAt = Date.now()
-        let plugin: Awaited<ReturnType<typeof getPlugin>> | undefined
-        try {
-          plugin = await Promise.race([
-            getPlugin(undefined, undefined, {
-              claustrumConnector: manifestConnector(
-                [],
-                new Map([[legacyHandle, 'fresh-lock-access']]),
-              ),
-            }),
-            Bun.sleep(1_000).then(() => {
-              throw new Error('manifest lock busy did not respect its deadline')
-            }),
-          ])
-          for (let attempt = 0; attempt < 100; attempt++) {
-            if (
+      const times = [0, 150]
+      let timeIndex = 0
+      await withFixedManifestLockClock(
+        async () => {
+          await useTempAccountFile(
+            manifestStorage({ label: 'fresh-lock', legacy: legacyHandle }),
+          )
+          const manifestPath = await writeManifest([])
+          const restore = await configureClaustrumConnection()
+          const lockPath = `${manifestPath}.lock`
+          await mkdir(lockPath, { mode: 0o700 })
+          await writeFile(
+            join(lockPath, 'owner'),
+            `${JSON.stringify({ claimed_at_ms: 0, tenant: 'test' })}\n`,
+          )
+          const logs: LogTestRecord[] = []
+          __setLogTestSink((record) => logs.push(record))
+          let plugin: Awaited<ReturnType<typeof getPlugin>> | undefined
+          try {
+            plugin = await withoutClaustrumWarmupDeadline(() =>
+              getPlugin(undefined, undefined, {
+                claustrumConnector: manifestConnector(
+                  [],
+                  new Map([[legacyHandle, 'fresh-lock-access']]),
+                ),
+              }),
+            )
+            expect(
               logs.some(
                 (record) =>
                   record.message === 'manifest write failed' &&
                   record.payload?.reason === 'manifest lock owner invalid',
-              )
-            )
-              break
-            await Bun.sleep(10)
+              ),
+            ).toBe(true)
+            expect(
+              await readFile(
+                getAccountStatePath(process.env.OPENCODE_ANTHROPIC_AUTH_FILE!),
+                'utf8',
+              ),
+            ).toContain(legacyHandle)
+          } finally {
+            __setLogTestSink(null)
+            await plugin?.dispose?.()
+            restore()
           }
-          const elapsedMs = Date.now() - startedAt
-          expect(elapsedMs).toBeGreaterThanOrEqual(120)
-          expect(elapsedMs).toBeLessThan(1_000)
-          expect(
-            logs.some(
-              (record) =>
-                record.message === 'manifest write failed' &&
-                record.payload?.reason === 'manifest lock owner invalid',
-            ),
-          ).toBe(true)
-          expect(
-            await readFile(
-              getAccountStatePath(process.env.OPENCODE_ANTHROPIC_AUTH_FILE!),
-              'utf8',
-            ),
-          ).toContain(legacyHandle)
-        } finally {
-          __setLogTestSink(null)
-          await plugin?.dispose?.()
-          restore()
-        }
-      })
+        },
+        () => times[Math.min(timeIndex++, times.length - 1)]!,
+      )
     },
   )
 
   test.serial('renames a stale manifest lock before writing', async () => {
-    await withShortManifestLockTiming(async () => {
+    await withFixedManifestLockClock(async () => {
       await useTempAccountFile(
         manifestStorage({ label: 'stale-lock', legacy: legacyHandle }),
       )
@@ -2945,12 +2963,14 @@ describe('fallback Claustrum credential resolution', () => {
         },
       )
       try {
-        const plugin = await getPlugin(undefined, undefined, {
-          claustrumConnector: manifestConnector(
-            [],
-            new Map([[legacyHandle, 'lock-owner-access']]),
-          ),
-        })
+        const plugin = await withoutClaustrumWarmupDeadline(() =>
+          getPlugin(undefined, undefined, {
+            claustrumConnector: manifestConnector(
+              [],
+              new Map([[legacyHandle, 'lock-owner-access']]),
+            ),
+          }),
+        )
         expect(owner).toMatchObject({ tenant: 'anthropic-auth' })
         expect(typeof owner?.claimed_at_ms).toBe('number')
         await expect(fs.stat(lockPath)).rejects.toThrow()
@@ -2966,7 +2986,7 @@ describe('fallback Claustrum credential resolution', () => {
   test.serial(
     'preserves two concurrent legacy migrations in one manifest',
     async () => {
-      await withShortManifestLockTiming(async () => {
+      await withFixedManifestLockClock(async () => {
         const storageA = fallbackWithClaustrum({
           id: 'fallback-a',
           label: 'migration-a',
@@ -2976,8 +2996,10 @@ describe('fallback Claustrum credential resolution', () => {
         })
         await useTempAccountFile(storageA)
         const accountPathA = process.env.OPENCODE_ANTHROPIC_AUTH_FILE!
+        const accountPathB = join(tempConfigDir!, 'anthropic-auth-b.json')
         const manifestPath = await writeManifest([])
         const restore = await configureClaustrumConnection()
+        const firstEntered = deferred()
         const entered = deferred()
         const release = deferred()
         let credentialGets = 0
@@ -2988,6 +3010,7 @@ describe('fallback Claustrum credential resolution', () => {
             if (method !== 'credential.get')
               throw new Error(`unexpected method: ${method}`)
             credentialGets += 1
+            if (credentialGets === 1) firstEntered.resolve()
             if (credentialGets === 2) entered.resolve()
             await release.promise
             return credentialResponse(
@@ -2996,27 +3019,8 @@ describe('fallback Claustrum credential resolution', () => {
             )
           },
         )
-        const pluginA = await getPlugin(undefined, undefined, {
-          claustrumConnector: concurrentConnector,
-        })
-
-        const accountPathB = join(tempConfigDir!, 'anthropic-auth-b.json')
-        const storageB = fallbackWithClaustrum({
-          id: 'fallback-b',
-          label: 'migration-b',
-          enabled: true,
-          claustrumHandle: `ckh_${'B'.repeat(43)}`,
-          claustrum: { mode: 'claustrum' },
-        })
-        await saveAccounts(storageB, accountPathB)
-        process.env.OPENCODE_ANTHROPIC_AUTH_FILE = accountPathB
-        process.env.OPENCODE_ANTHROPIC_AUTH_SIDEBAR_STATE_FILE = join(
-          tempConfigDir!,
-          'sidebar-state-b.json',
-        )
-        const pluginB = await getPlugin(undefined, undefined, {
-          claustrumConnector: concurrentConnector,
-        })
+        let pluginA: Awaited<ReturnType<typeof getPlugin>> | undefined
+        let pluginB: Awaited<ReturnType<typeof getPlugin>> | undefined
         const originalRename = fs.rename
         const secondManifestRename = deferred()
         let manifestRenames = 0
@@ -3032,21 +3036,36 @@ describe('fallback Claustrum credential resolution', () => {
           },
         )
         try {
-          await Promise.race([
-            entered.promise,
-            Bun.sleep(1_000).then(() => {
-              throw new Error(
-                `concurrent credential calls did not both start (${credentialGets})`,
-              )
-            }),
-          ])
-          release.resolve()
-          await Promise.race([
-            secondManifestRename.promise,
-            Bun.sleep(1_000).then(() => {
-              throw new Error('concurrent migrations did not finish')
-            }),
-          ])
+          await withoutClaustrumWarmupDeadline(async () => {
+            const pluginAPromise = getPlugin(undefined, undefined, {
+              claustrumConnector: concurrentConnector,
+            })
+            await firstEntered.promise
+
+            const storageB = fallbackWithClaustrum({
+              id: 'fallback-b',
+              label: 'migration-b',
+              enabled: true,
+              claustrumHandle: `ckh_${'B'.repeat(43)}`,
+              claustrum: { mode: 'claustrum' },
+            })
+            await saveAccounts(storageB, accountPathB)
+            process.env.OPENCODE_ANTHROPIC_AUTH_FILE = accountPathB
+            process.env.OPENCODE_ANTHROPIC_AUTH_SIDEBAR_STATE_FILE = join(
+              tempConfigDir!,
+              'sidebar-state-b.json',
+            )
+            const pluginBPromise = getPlugin(undefined, undefined, {
+              claustrumConnector: concurrentConnector,
+            })
+            await entered.promise
+            release.resolve()
+            ;[pluginA, pluginB] = await Promise.all([
+              pluginAPromise,
+              pluginBPromise,
+            ])
+          })
+          await secondManifestRename.promise
           const manifest = JSON.parse(await readFile(manifestPath, 'utf8')) as {
             providers: Array<{
               provider: string
@@ -3065,8 +3084,8 @@ describe('fallback Claustrum credential resolution', () => {
           ])
         } finally {
           rename.mockRestore()
-          await pluginA.dispose?.()
-          await pluginB.dispose?.()
+          await pluginA?.dispose?.()
+          await pluginB?.dispose?.()
           restore()
         }
       })

From e8c31f37acf38f0c6e5ed0c3142d0fd36a4bb805 Mon Sep 17 00:00:00 2001
From: iceteaSA <171169159+iceteaSA@users.noreply.github.com>
Date: Wed, 16 Sep 2026 21:43:19 +0200
Subject: [PATCH 2/3] fix(recovery): deliver the restoration notice after the
 final recovery turn

The switch notice was still inside promptAsync when the final cache warm queued the restoration notice. OpenCode published that ignored notice as a user message and a busy status, revoking the idle-delivery lease; the queued restoration then had no later idle event to release it.

Track plugin-generated notice IDs separately from genuine user messages, then re-enter the existing bounded status probe after a successful noReply insertion only when no genuine user message arrived. The live status check and final lease check still gate insertion, so an active prompt cannot adopt the ignored message and duplicate a billed provider turn.
---
 packages/opencode/src/index.ts            | 106 ++++++++++++++++++----
 packages/opencode/src/tests/index.test.ts |  39 ++++++++
 2 files changed, 126 insertions(+), 19 deletions(-)

diff --git a/packages/opencode/src/index.ts b/packages/opencode/src/index.ts
index dfc7a6c5..5d0b4d55 100644
--- a/packages/opencode/src/index.ts
+++ b/packages/opencode/src/index.ts
@@ -625,6 +625,7 @@ async function sendIgnoredMessage(
     noReply?: boolean
     beforeActiveAssistant?: boolean
     canSend?: () => boolean
+    onMessageId?: (messageId: string) => void
   } = {},
 ): Promise<boolean> {
   const session = ctx.client.session as PluginSessionClient | undefined
@@ -653,6 +654,7 @@ async function sendIgnoredMessage(
   // A new user prompt can start while that request is in flight, so re-check the
   // caller's delivery lease immediately before inserting the ignored message.
   if (options.canSend && !options.canSend()) return false
+  if (request.body.messageID) options.onMessageId?.(request.body.messageID)
 
   if (typeof session?.promptAsync === 'function') {
     await session.promptAsync(request)
@@ -1087,6 +1089,8 @@ const anthropicAuthPlugin = async (
   const desktopNoticeSafeSessions = new Set<string>()
   const desktopNoticeLatestUserMessages = new Map<string, string>()
   const desktopNoticeIdleUserMessages = new Map<string, string>()
+  const desktopNoticeMessageIds = new Map<string, Set<string>>()
+  const desktopNoticeUserRevisions = new Map<string, number>()
   const desktopNoticeProbes = new Map<string, number>()
   const stickySessionRouter = new StickySessionRouter({
     path:
@@ -4044,6 +4048,11 @@ const anthropicAuthPlugin = async (
 
   function queueDesktopNotice(sessionId: string, text: string) {
     if (isTuiConnected(sessionId)) return
+    logger.debug('fable-fallback', 'Desktop notification queued', {
+      session: sessionId,
+      safe: desktopNoticeSafeSessions.has(sessionId),
+      text,
+    })
     // OpenCode's prompt endpoints run revert cleanup before honoring noReply.
     // OpenCode awaits event handlers before it evaluates the loop exit condition.
     // Escape the post-idle session update, then probe outside that critical section.
@@ -4063,6 +4072,36 @@ const anthropicAuthPlugin = async (
     }
   }
 
+  function rememberDesktopNoticeMessageId(
+    sessionId: string,
+    messageId: string,
+  ) {
+    const messageIds =
+      desktopNoticeMessageIds.get(sessionId) ?? new Set<string>()
+    messageIds.add(messageId)
+    while (messageIds.size > 8) {
+      const oldest = messageIds.values().next().value
+      if (oldest) messageIds.delete(oldest)
+      else break
+    }
+    desktopNoticeMessageIds.delete(sessionId)
+    desktopNoticeMessageIds.set(sessionId, messageIds)
+    while (desktopNoticeMessageIds.size > 128) {
+      const oldest = desktopNoticeMessageIds.keys().next().value
+      if (oldest) desktopNoticeMessageIds.delete(oldest)
+      else break
+    }
+  }
+
+  function grantDesktopNoticeLease(sessionId: string) {
+    desktopNoticeSafeSessions.add(sessionId)
+    while (desktopNoticeSafeSessions.size > 128) {
+      const oldest = desktopNoticeSafeSessions.values().next().value
+      if (oldest) desktopNoticeSafeSessions.delete(oldest)
+      else break
+    }
+  }
+
   function scheduleDesktopNoticeProbe(sessionId: string, attempt = 0) {
     if (
       !pendingDesktopNotices.has(sessionId) ||
@@ -4090,6 +4129,12 @@ const anthropicAuthPlugin = async (
   }
 
   async function flushDesktopNoticesIfIdle(sessionId: string, attempt: number) {
+    logger.debug('fable-fallback', 'Desktop notification flush considered', {
+      session: sessionId,
+      attempt,
+      safe: desktopNoticeSafeSessions.has(sessionId),
+      pending: pendingDesktopNotices.has(sessionId),
+    })
     if (
       !desktopNoticeSafeSessions.has(sessionId) ||
       !pendingDesktopNotices.has(sessionId)
@@ -4150,13 +4195,28 @@ const anthropicAuthPlugin = async (
           return
         }
         try {
+          const userRevision = desktopNoticeUserRevisions.get(sessionId) ?? 0
           const sent = await sendIgnoredMessage(ctx, sessionId, text, {
             noReply: true,
             beforeActiveAssistant: true,
             canSend: () => desktopNoticeSafeSessions.has(sessionId),
+            onMessageId: (messageId) =>
+              rememberDesktopNoticeMessageId(sessionId, messageId),
           })
           if (!sent) return
           queue.shift()
+          if (
+            !desktopNoticeSafeSessions.has(sessionId) &&
+            pendingDesktopNotices.get(sessionId)?.[0] &&
+            (desktopNoticeUserRevisions.get(sessionId) ?? 0) === userRevision
+          ) {
+            // OpenCode marks its own noReply insertion busy without publishing a
+            // new idle event. Re-enter only through the same live-status probe;
+            // a genuine user message changes the revision and blocks this path.
+            grantDesktopNoticeLease(sessionId)
+            scheduleDesktopNoticeProbe(sessionId)
+            return
+          }
         } catch (error) {
           logger.warn('fable-fallback', 'Desktop notification failed', {
             session: sessionId,
@@ -5237,21 +5297,32 @@ const anthropicAuthPlugin = async (
       if (!sessionId) return
 
       if (value.type === 'message.updated' && info?.role === 'user') {
-        if (typeof info.id === 'string') {
-          desktopNoticeLatestUserMessages.set(sessionId, info.id)
-          if (
-            desktopNoticeSafeSessions.has(sessionId) &&
-            desktopNoticeIdleUserMessages.get(sessionId) !== info.id
-          ) {
-            // A new user message can precede OpenCode's busy status event. Revoke
-            // the idle-delivery lease immediately so an ignored notice cannot
-            // become the active request parent and duplicate a provider turn.
-            // Repeated updates for the user message that produced the current
-            // idle event are harmless and must not suppress delivery forever.
+        // promptAsync publishes ignored notices as user-message updates. They do
+        // not start a provider turn, so only genuine user messages revoke the lease.
+        const isDesktopNotice =
+          typeof info.id === 'string' &&
+          desktopNoticeMessageIds.get(sessionId)?.has(info.id)
+        if (!isDesktopNotice) {
+          desktopNoticeUserRevisions.set(
+            sessionId,
+            (desktopNoticeUserRevisions.get(sessionId) ?? 0) + 1,
+          )
+          if (typeof info.id === 'string') {
+            desktopNoticeLatestUserMessages.set(sessionId, info.id)
+            if (
+              desktopNoticeSafeSessions.has(sessionId) &&
+              desktopNoticeIdleUserMessages.get(sessionId) !== info.id
+            ) {
+              // A new user message can precede OpenCode's busy status event. Revoke
+              // the idle-delivery lease immediately so an ignored notice cannot
+              // become the active request parent and duplicate a provider turn.
+              // Repeated updates for the user message that produced the current
+              // idle event are harmless and must not suppress delivery forever.
+              desktopNoticeSafeSessions.delete(sessionId)
+            }
+          } else {
             desktopNoticeSafeSessions.delete(sessionId)
           }
-        } else {
-          desktopNoticeSafeSessions.delete(sessionId)
         }
       }
 
@@ -5274,12 +5345,7 @@ const anthropicAuthPlugin = async (
         // live status map is still idle. OpenCode 1.18 no longer guarantees a
         // session.updated event after session.idle, so that event cannot be used
         // as the release signal.
-        desktopNoticeSafeSessions.add(sessionId)
-        while (desktopNoticeSafeSessions.size > 128) {
-          const oldest = desktopNoticeSafeSessions.values().next().value
-          if (oldest) desktopNoticeSafeSessions.delete(oldest)
-          else break
-        }
+        grantDesktopNoticeLease(sessionId)
         scheduleDesktopNoticeProbe(sessionId)
       }
 
@@ -5297,6 +5363,8 @@ const anthropicAuthPlugin = async (
         desktopNoticeSafeSessions.delete(sessionId)
         desktopNoticeLatestUserMessages.delete(sessionId)
         desktopNoticeIdleUserMessages.delete(sessionId)
+        desktopNoticeMessageIds.delete(sessionId)
+        desktopNoticeUserRevisions.delete(sessionId)
         for (const recoveryKey of pendingRecoveryDesktopNotices.keys()) {
           if (recoveryKey.startsWith(`${sessionId}\0`)) {
             pendingRecoveryDesktopNotices.delete(recoveryKey)
diff --git a/packages/opencode/src/tests/index.test.ts b/packages/opencode/src/tests/index.test.ts
index 395aaea6..40b58a76 100644
--- a/packages/opencode/src/tests/index.test.ts
+++ b/packages/opencode/src/tests/index.test.ts
@@ -19040,6 +19040,13 @@ describe('auth.loader', () => {
         return {}
       },
     )
+    const switchNoticeCompletion = deferred()
+    let holdSwitchNotice = true
+    mockClient.session.promptAsync = mock(async () => {
+      if (!holdSwitchNotice) return
+      holdSwitchNotice = false
+      await switchNoticeCompletion.promise
+    })
     const plugin = await getPlugin(mockClient)
     const result = await plugin.auth.loader(
       () =>
@@ -19372,6 +19379,38 @@ describe('auth.loader', () => {
     await restored.text()
     expect(normalModels.at(-1)).toBe('claude-fable-5')
 
+    await waitForSidebarState((state) =>
+      Boolean(
+        state.fableRecoveries?.some(
+          (recovery) =>
+            recovery.sessionId === 'ses_fable_filter' &&
+            recovery.mode === 'fable',
+        ),
+      ),
+    )
+    await plugin.event?.({
+      event: {
+        type: 'message.updated',
+        properties: {
+          info: {
+            id: switchNotificationMessageId,
+            sessionID: 'ses_fable_filter',
+            role: 'user',
+          },
+        },
+      },
+    })
+    await plugin.event?.({
+      event: {
+        type: 'session.status',
+        properties: {
+          sessionID: 'ses_fable_filter',
+          status: { type: 'busy' },
+        },
+      },
+    })
+    switchNoticeCompletion.resolve()
+
     await waitForMockCall({
       mock: {
         get calls() {

From c12bc602a4e5ec75ca779636fa374f55173e2d4f Mon Sep 17 00:00:00 2001
From: iceteaSA <171169159+iceteaSA@users.noreply.github.com>
Date: Wed, 16 Sep 2026 20:31:31 +0200
Subject: [PATCH 3/3] fix(custody): carry the vault credential id in manifest
 bindings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A derived identifier encodes a convention as a constraint. The custody
handle manifest derived the expected vault credential id from the
account label (`oauth:anthropic:<label>`) and rejected any entry that
disagreed, so the parse-time comparison could only catch two fields
disagreeing that the same writer wrote together — a corruption check,
not an authorization check.

It blocked a live flip. Main's vault credential id is the unlabelled
provider-default `oauth:anthropic`: writing the true id gave
`corrupt-binding` at parse, writing the derived id gave
`credential_identity_mismatch` at runtime because the vault returns the
real one. Any credential whose id does not match its label hits this.

Carry the identifier verbatim through every layer that touches it —
parse, resolve, write, remove, and the local-exit binding — and verify
it against the vault at use time. Without the write and remove halves
the plugin could not create main's entry, and could never clear it, so
a local re-login would silently leave the account bound. The derivation
survives only where no id exists to read: legacy handle-file migration,
whose comment now states the checkable reason it is safe rather than
implying a permanent property.

Dropping the derivation left the id unscoped, so an id belonging to
another provider parsed inside our own block. The manifest is a
co-tenant file — a sibling plugin writes its own block beside ours —
so the parser now requires the provider to be the id's SECOND
colon-separated segment. The kind prefix (segment 1) is deliberately
unconstrained: `oauth`, `chatgpt`, `antigravity` and `apikey` are all
in use today and the set is open, so constraining it would reject real
credentials. The label (segment 3+) remains unconsulted — provider
scoping and label derivation are different properties, and only the
second was ever wrong.

Label becomes the sole lookup key, so duplicate labels within a provider
block are now rejected — every entry sharing one is marked corrupt
rather than silently picking a winner.

The runtime identity fence skipped when the vault omitted a credential
id, which would have left no identity check at all once the parse-time
derivation was gone. It now refuses. The current daemon always supplies
the id on a successful get, so the branch is unreachable today.

The preflight passed `refresh_floor + 30min` (~4.5h) to `cache.get`. In
Claustrum that is a staleness floor: a get below it forces an upstream
refresh, so a readiness check rotated the credential it was about to
use. Because the vault refreshes on a cadence close to the token
lifetime, main sat below that floor for ~56% of every cycle. Replaced
with a five-minute serving margin; the vault owns rotation.

The credential-id lookup on the custody re-entry path was uncaught, so
an unreadable or partially-written account file rejected the auth
callback and discarded a just-exchanged credential — the failure lands
exactly when someone is re-logging in to recover. It now falls through
to the missing-entry branch the surrounding ternary already handles.
The sibling lookup in `acknowledgeMainLocalLogin` had the same shape.

The `TAKEOVER_INCOMPLETE_MAIN_REAL` guidance named `ck auth
migrate-plugin`, which exists on no deployed Claustrum binary.
---
 packages/core/src/claustrum.ts                |  87 +++++-
 packages/core/src/tests/claustrum.test.ts     | 290 +++++++++++++++++-
 packages/opencode/src/cli.ts                  |   6 +
 packages/opencode/src/custody-live.ts         |  14 +-
 packages/opencode/src/custody-mode.ts         |  31 +-
 packages/opencode/src/index.ts                |  50 ++-
 .../src/tests/account-command.test.ts         |   2 +-
 .../src/tests/custody-handle-manifest.test.ts |  76 ++++-
 .../src/tests/custody-mode-first-run.test.ts  |   3 +
 .../opencode/src/tests/custody-mode.test.ts   | 232 +++++++++++++-
 .../src/tests/custody-ruled-row.fixture.ts    |  10 +
 .../src/tests/custody-source-deps.test.ts     |   4 +-
 .../src/tests/custody-tombstone.test.ts       |  43 ++-
 .../oauth-callback-corrupt-store.test.ts      | 116 +++++++
 14 files changed, 901 insertions(+), 63 deletions(-)
 create mode 100644 packages/opencode/src/tests/oauth-callback-corrupt-store.test.ts

diff --git a/packages/core/src/claustrum.ts b/packages/core/src/claustrum.ts
index c17a7dbb..fe9a3c28 100644
--- a/packages/core/src/claustrum.ts
+++ b/packages/core/src/claustrum.ts
@@ -273,10 +273,48 @@ export function custodyCredentialId(label: string): string {
   return `${CUSTODY_CREDENTIAL_PREFIX}${label}`
 }
 
+// A resolved MANIFEST binding carries the credential id verbatim (the parser
+// stores it as-written and the resolver returns it; round 2 dropped the
+// parse-time derivation check). Anything else — legacy source, unresolved,
+// or a manifest entry whose id happens to be undefined — derives from the
+// label, the only id the caller can construct without a binding in hand.
+// Callers building completion records (local-exit, reachability probe)
+// pass this single rule instead of inlining it.
+export function custodyCredentialIdFromResolution(
+  resolution: CustodyHandleResolution,
+  label: string,
+): string {
+  if (resolution.status === 'resolved' && resolution.source === 'manifest') {
+    return resolution.credentialId ?? custodyCredentialId(label)
+  }
+  return custodyCredentialId(label)
+}
+
 function isValidCustodyCredentialId(value: unknown): value is string {
   return typeof value === 'string' && value.length > 0
 }
 
+// The manifest is a co-tenant file: a sibling plugin (`provider: 'openai'`,
+// `serve: 'openai-auth'`) writes its own block in the same file. Provider
+// scoping is what stops us from binding its handles — the parser has to
+// enforce it because the sibling plugin never talks to us.
+//
+// Scope on the SECOND colon-separated segment (the provider segment). The
+// first segment is a "kind" prefix the vault owner extends (`oauth:`,
+// `chatgpt:`, `antigravity:`, `apikey:`, …) and the rule deliberately does
+// NOT enumerate or constrain it: enumerating the kinds would reject live
+// credentials the moment a new one ships. The third-and-later segments are
+// the label, which is never consulted here — the label is the lookup key
+// elsewhere, not an authorization check.
+function isScopedCustodyCredentialId(
+  value: unknown,
+  provider: string,
+): value is string {
+  if (typeof value !== 'string' || value.length === 0) return false
+  const segments = value.split(':')
+  return segments[1] === provider
+}
+
 function legacyOrUnresolved(
   account: OAuthAccount,
   reason: Extract<CustodyHandleResolution, { status: 'unresolved' }>['reason'],
@@ -321,10 +359,10 @@ export function resolveCustodyHandle(input: {
     return { status: 'unresolved', reason: 'corrupt-binding' }
   }
 
+  // The manifest carries the credential id verbatim; the runtime fence in
+  // custody-mode.ts is the one that compares it against vault ground truth.
   const entry = manifest.accounts.find(
-    (candidate) =>
-      candidate.label === account.label &&
-      candidate.credentialId === custodyCredentialId(account.label),
+    (candidate) => candidate.label === account.label,
   )
   if (!entry) return legacyOrUnresolved(account, 'missing-entry')
   if (manifest.superseded.has(entry.handle)) {
@@ -372,6 +410,27 @@ export function readCustodyHandles(
   if (!Object.hasOwn(source, 'accounts') || !Array.isArray(source.accounts)) {
     throw new Error('invalid manifest accounts')
   }
+  // The label is the sole lookup key; two entries with the same label cannot
+  // tell the resolver which one to bind, so every such entry is marked corrupt
+  // rather than silently picking a winner.
+  const labelCounts = new Map<string, number>()
+  for (const candidate of source.accounts) {
+    if (
+      !isRecord(candidate) ||
+      !Object.hasOwn(candidate, 'label') ||
+      typeof candidate.label !== 'string' ||
+      !isValidCustodyLabel(candidate.label)
+    )
+      continue
+    labelCounts.set(
+      candidate.label,
+      (labelCounts.get(candidate.label) ?? 0) + 1,
+    )
+  }
+  const duplicateLabels = new Set(
+    [...labelCounts].filter(([, count]) => count > 1).map(([label]) => label),
+  )
+
   const superseded = new Set<string>()
   const corruptLabels = new Set<string>()
   const accounts: CustodyHandleAccount[] = []
@@ -388,13 +447,15 @@ export function readCustodyHandles(
       !Object.hasOwn(entry, 'credential_id') ||
       typeof entry.handle !== 'string' ||
       !isValidCustodyHandle(entry.handle) ||
-      !isValidCustodyCredentialId(entry.credential_id) ||
-      (provider === 'anthropic' &&
-        entry.credential_id !== custodyCredentialId(entry.label))
+      !isScopedCustodyCredentialId(entry.credential_id, provider)
     ) {
       corruptLabels.add(entry.label)
       continue
     }
+    if (duplicateLabels.has(entry.label)) {
+      corruptLabels.add(entry.label)
+      continue
+    }
     if (Object.hasOwn(entry, 'superseded')) {
       if (!Array.isArray(entry.superseded)) {
         corruptLabels.add(entry.label)
@@ -958,8 +1019,7 @@ export async function writeCustodyHandleManifestEntry(
   if (
     !isValidCustodyLabel(input.entry.label) ||
     !isValidCustodyHandle(input.entry.handle) ||
-    !isValidCustodyCredentialId(input.entry.credentialId) ||
-    input.entry.credentialId !== custodyCredentialId(input.entry.label)
+    !isValidCustodyCredentialId(input.entry.credentialId)
   ) {
     return refusal('invalid entry')
   }
@@ -987,8 +1047,7 @@ export async function removeCustodyHandleManifestEntry(
   if (
     !isValidCustodyLabel(input.entry.label) ||
     !isValidCustodyHandle(input.entry.handle) ||
-    !isValidCustodyCredentialId(input.entry.credentialId) ||
-    input.entry.credentialId !== custodyCredentialId(input.entry.label)
+    !isValidCustodyCredentialId(input.entry.credentialId)
   ) {
     return { status: 'refused' }
   }
@@ -1514,6 +1573,7 @@ export type ClaustrumCredential = {
   recordVersion: number
   projectId?: string
   accountId?: string
+  credentialId?: string
 }
 
 export type ClaustrumServedCredential = Pick<
@@ -1552,6 +1612,7 @@ type CredentialGetResult = {
   recordVersion: number
   projectId?: string
   accountId?: string
+  credentialId?: string
 }
 
 function credentialErrorAction(
@@ -1688,6 +1749,9 @@ function decodeCredentialGetResponse(response: unknown): CredentialGetResult {
     ...(typeof result?.account_id === 'string' && {
       accountId: result.account_id,
     }),
+    ...(typeof result?.credential_id === 'string' && {
+      credentialId: result.credential_id,
+    }),
   }
 }
 
@@ -1897,6 +1961,9 @@ export class ClaustrumCredentialCache {
       recordVersion: result.recordVersion,
       ...(result.projectId !== undefined && { projectId: result.projectId }),
       ...(result.accountId !== undefined && { accountId: result.accountId }),
+      ...(result.credentialId !== undefined && {
+        credentialId: result.credentialId,
+      }),
     }
     if (
       credential.expiresAtMs !== null &&
diff --git a/packages/core/src/tests/claustrum.test.ts b/packages/core/src/tests/claustrum.test.ts
index 6fd85914..d648c0f8 100644
--- a/packages/core/src/tests/claustrum.test.ts
+++ b/packages/core/src/tests/claustrum.test.ts
@@ -1,7 +1,14 @@
 import { describe, expect, test } from 'bun:test'
 import { basename, win32 } from 'node:path'
 
-import { __deriveCustodyManifestStaleLockPrefix } from '../claustrum.ts'
+import {
+  __deriveCustodyManifestStaleLockPrefix,
+  type CustodyHandleManifest,
+  type CustodyHandleResolution,
+  custodyCredentialIdFromResolution,
+  readCustodyHandles,
+  resolveCustodyHandle,
+} from '../claustrum.ts'
 
 describe('custody manifest stale-lock prefix', () => {
   test('derives prefixes from POSIX and Windows path basenames', () => {
@@ -19,3 +26,284 @@ describe('custody manifest stale-lock prefix', () => {
     ).toBe('handles.json.lock.stale-')
   })
 })
+
+describe('custodyCredentialIdFromResolution', () => {
+  test("returns a resolved manifest binding's credential id verbatim, not the derived form", () => {
+    // The provider-default main case: the manifest carries `oauth:anthropic`,
+    // not `oauth:anthropic:main`. This is the assertion round 2's e2e test
+    // could not make — it had to feed the id in by hand because the helper
+    // was inline.
+    const resolution: CustodyHandleResolution = {
+      status: 'resolved',
+      source: 'manifest',
+      handle: 'ckh_a'.padEnd(47, '_'),
+      credentialId: 'oauth:anthropic',
+    }
+    expect(custodyCredentialIdFromResolution(resolution, 'main')).toBe(
+      'oauth:anthropic',
+    )
+  })
+
+  test('derives from the label when the resolved source is legacy', () => {
+    const resolution: CustodyHandleResolution = {
+      status: 'resolved',
+      source: 'legacy',
+      handle: 'ckh_b'.padEnd(47, '_'),
+    }
+    expect(custodyCredentialIdFromResolution(resolution, 'work-alt')).toBe(
+      'oauth:anthropic:work-alt',
+    )
+  })
+
+  test('derives from the label when the resolution is unresolved', () => {
+    const resolution: CustodyHandleResolution = {
+      status: 'unresolved',
+      reason: 'missing-entry',
+    }
+    expect(custodyCredentialIdFromResolution(resolution, 'main')).toBe(
+      'oauth:anthropic:main',
+    )
+  })
+
+  test("derives from the label when the manifest binding's credential id is undefined", () => {
+    const resolution = {
+      status: 'resolved' as const,
+      source: 'manifest' as const,
+      handle: 'ckh_c'.padEnd(47, '_'),
+      credentialId: undefined,
+    }
+    expect(custodyCredentialIdFromResolution(resolution, 'main')).toBe(
+      'oauth:anthropic:main',
+    )
+  })
+})
+
+// The manifest is a co-tenant file: a sibling plugin (`provider: 'openai'`,
+// `serve: 'openai-auth'`) writes its own block in the same file, and the
+// `serve`/`provider` split is what stops the two plugins from binding each
+// other's handles. Provider scoping has to live in the parser because the
+// sibling plugin never talks to us — it only writes the file.
+describe('readCustodyHandles provider scope', () => {
+  const anthropicHandle = `ckh_${'A'.repeat(43)}`
+  const openaiHandle = `ckh_${'O'.repeat(43)}`
+  const googleHandle = `ckh_${'G'.repeat(43)}`
+
+  function makeManifest(provider: string, serve: string) {
+    return {
+      version: 1,
+      providers: [
+        {
+          provider,
+          serve,
+          accounts: [],
+        },
+      ],
+    } as const
+  }
+
+  function manifestFromParsed(
+    parsed: ReturnType<typeof readCustodyHandles>,
+  ): CustodyHandleManifest {
+    return {
+      version: 1,
+      provider: parsed.provider as 'anthropic',
+      serve: parsed.serve as 'anthropic-auth',
+      accounts: parsed.accounts,
+      superseded: parsed.superseded,
+      corruptLabels: parsed.corruptLabels,
+    }
+  }
+
+  function oauthAccount(label: string) {
+    return { id: `uuid-${label}`, type: 'oauth' as const, refresh: 'r', label }
+  }
+
+  // (a) A real foreign id inside the anthropic block — the case the parse-time
+  //     derivation check used to catch. The kind prefix (`chatgpt:`) is one
+  //     the vault serves today; the rule is that `chatgpt:openai` belongs in
+  //     an `openai` block, not in ours.
+  test('rejects an entry whose credential id names a different provider', () => {
+    const doc = makeManifest('anthropic', 'anthropic-auth')
+    doc.providers[0]!.accounts.push({
+      label: 'main',
+      handle: anthropicHandle,
+      credential_id: 'chatgpt:openai',
+    })
+
+    const parsed = readCustodyHandles(doc, 'anthropic', 'anthropic-auth')
+    expect(parsed.corruptLabels).toEqual(new Set(['main']))
+    expect(parsed.accounts).toEqual([])
+
+    const result = resolveCustodyHandle({
+      account: oauthAccount('main'),
+      manifest: manifestFromParsed(parsed),
+    })
+    expect(result).toEqual({ status: 'unresolved', reason: 'corrupt-binding' })
+  })
+
+  // (b) The main case this branch exists for: the unlabelled provider-default
+  //     credential id. Must still resolve — the runtime fence in
+  //     custody-mode.ts is the only thing that ever proves it against the
+  //     vault, but the parser must accept it verbatim.
+  test("resolves the unlabelled provider-default credential id (main's id is `oauth:anthropic`)", () => {
+    const doc = makeManifest('anthropic', 'anthropic-auth')
+    doc.providers[0]!.accounts.push({
+      label: 'main',
+      handle: anthropicHandle,
+      credential_id: 'oauth:anthropic',
+    })
+
+    const parsed = readCustodyHandles(doc, 'anthropic', 'anthropic-auth')
+    expect(parsed.corruptLabels).toEqual(new Set())
+    expect(parsed.accounts).toHaveLength(1)
+    expect(parsed.accounts[0]?.credentialId).toBe('oauth:anthropic')
+
+    const result = resolveCustodyHandle({
+      account: oauthAccount('main'),
+      manifest: manifestFromParsed(parsed),
+    })
+    expect(result).toEqual({
+      status: 'resolved',
+      source: 'manifest',
+      handle: anthropicHandle,
+      credentialId: 'oauth:anthropic',
+    })
+  })
+
+  // (c) The labelled form: credential id `oauth:<provider>:<label>`.
+  test('resolves a labelled credential id whose label matches the entry', () => {
+    const doc = makeManifest('anthropic', 'anthropic-auth')
+    doc.providers[0]!.accounts.push({
+      label: 'work-alt',
+      handle: anthropicHandle,
+      credential_id: 'oauth:anthropic:work-alt',
+    })
+
+    const parsed = readCustodyHandles(doc, 'anthropic', 'anthropic-auth')
+    expect(parsed.corruptLabels).toEqual(new Set())
+    expect(parsed.accounts).toHaveLength(1)
+
+    const result = resolveCustodyHandle({
+      account: oauthAccount('work-alt'),
+      manifest: manifestFromParsed(parsed),
+    })
+    expect(result).toEqual({
+      status: 'resolved',
+      source: 'manifest',
+      handle: anthropicHandle,
+      credentialId: 'oauth:anthropic:work-alt',
+    })
+  })
+
+  // (d) The discriminating test. A label/id mismatch that is still in-provider
+  //     MUST resolve: scoping by provider must not silently reintroduce the
+  //     parse-time label derivation that the previous commit removed. If this
+  //     goes red the parser has rebuilt the bug this branch fixed.
+  test('still resolves an in-provider entry whose credential id does not derive from its label', () => {
+    const doc = makeManifest('anthropic', 'anthropic-auth')
+    doc.providers[0]!.accounts.push({
+      label: 'work-alt',
+      handle: anthropicHandle,
+      credential_id: 'oauth:anthropic:something-else',
+    })
+
+    const parsed = readCustodyHandles(doc, 'anthropic', 'anthropic-auth')
+    expect(parsed.corruptLabels).toEqual(new Set())
+    expect(parsed.accounts).toHaveLength(1)
+
+    const result = resolveCustodyHandle({
+      account: oauthAccount('work-alt'),
+      manifest: manifestFromParsed(parsed),
+    })
+    expect(result).toEqual({
+      status: 'resolved',
+      source: 'manifest',
+      handle: anthropicHandle,
+      credentialId: 'oauth:anthropic:something-else',
+    })
+  })
+
+  // (e) The co-tenant shape: a sibling plugin's openai block in the same file
+  //     must not perturb our resolution. Sanity-checks the existing
+  //     `provider`/`serve` filter still works after the scope check is added.
+  test('resolves ours in a co-tenant file with an openai block beside ours', () => {
+    const doc = {
+      version: 1,
+      providers: [
+        {
+          provider: 'openai',
+          serve: 'openai-auth',
+          accounts: [
+            {
+              label: 'openai-main',
+              handle: openaiHandle,
+              credential_id: 'chatgpt:openai',
+            },
+          ],
+        },
+        {
+          provider: 'anthropic',
+          serve: 'anthropic-auth',
+          accounts: [
+            {
+              label: 'main',
+              handle: anthropicHandle,
+              credential_id: 'oauth:anthropic',
+            },
+          ],
+        },
+      ],
+    } as const
+
+    const parsed = readCustodyHandles(doc, 'anthropic', 'anthropic-auth')
+    expect(parsed.corruptLabels).toEqual(new Set())
+    expect(parsed.accounts.map((a) => a.label)).toEqual(['main'])
+
+    const result = resolveCustodyHandle({
+      account: oauthAccount('main'),
+      manifest: manifestFromParsed(parsed),
+    })
+    expect(result).toEqual({
+      status: 'resolved',
+      source: 'manifest',
+      handle: anthropicHandle,
+      credentialId: 'oauth:anthropic',
+    })
+  })
+
+  // (f) The sibling plugin's real credential id. Red under the original
+  //     `oauth:<provider>:<label>` rule (which would have rejected it because
+  //     the kind prefix is `chatgpt:`, not `oauth:`); green under the
+  //     provider-segment rule. Parser-level because the rule is shared.
+  test("resolves the sibling plugin's `chatgpt:openai` id inside an openai block", () => {
+    const doc = makeManifest('openai', 'openai-auth')
+    doc.providers[0]!.accounts.push({
+      label: 'main',
+      handle: openaiHandle,
+      credential_id: 'chatgpt:openai',
+    })
+
+    const parsed = readCustodyHandles(doc, 'openai', 'openai-auth')
+    expect(parsed.corruptLabels).toEqual(new Set())
+    expect(parsed.accounts).toHaveLength(1)
+    expect(parsed.accounts[0]?.credentialId).toBe('chatgpt:openai')
+    expect(parsed.accounts[0]?.label).toBe('main')
+  })
+
+  // (g) Another real kind prefix, another provider. Same shape as (f):
+  //     `antigravity:google` belongs in a google block.
+  test('resolves a `antigravity:google` id inside a google block', () => {
+    const doc = makeManifest('google', 'google-auth')
+    doc.providers[0]!.accounts.push({
+      label: 'main',
+      handle: googleHandle,
+      credential_id: 'antigravity:google',
+    })
+
+    const parsed = readCustodyHandles(doc, 'google', 'google-auth')
+    expect(parsed.corruptLabels).toEqual(new Set())
+    expect(parsed.accounts).toHaveLength(1)
+    expect(parsed.accounts[0]?.credentialId).toBe('antigravity:google')
+    expect(parsed.accounts[0]?.label).toBe('main')
+  })
+})
diff --git a/packages/opencode/src/cli.ts b/packages/opencode/src/cli.ts
index 559afef8..1b6b9cb1 100644
--- a/packages/opencode/src/cli.ts
+++ b/packages/opencode/src/cli.ts
@@ -346,6 +346,12 @@ export async function login(labelArg?: string, deps: LoginDeps = {}) {
     lastUsed: now,
     lastRefreshedAt: now,
   } as const
+  // Safe to derive here: this is the legacy handle migration path and every
+  // legacy handle file on disk today names a labelled credential whose real
+  // vault id matches `oauth:anthropic:<label>` (the only one is
+  // `.claustrum-handle-work-alt` -> `oauth:anthropic:work-alt`). If a legacy
+  // file naming an unlabelled credential ever appears, the derived id will
+  // resolve to nothing and the two-factor local-exit will fail closed.
   const credentialId = custodyCredentialId(account.label ?? account.id)
   await addAccountPersistent(account)
   await acknowledgeLocalOAuthLoginFromStorage(
diff --git a/packages/opencode/src/custody-live.ts b/packages/opencode/src/custody-live.ts
index 52fca36d..da4afdc8 100644
--- a/packages/opencode/src/custody-live.ts
+++ b/packages/opencode/src/custody-live.ts
@@ -217,15 +217,21 @@ export function createLiveCustodyDeps(input: {
   ): Promise<CustodyCacheCredential> => {
     const credential = await input.cache.get(handle, minTtlMs)
     if ('state' in credential) return credential
-    const vaultCredentialId = (credential as { credentialId?: unknown })
-      .credentialId
+    // Wire-format credentials (`core.ClaustrumCredential`) name the id in
+    // snake_case (`credential_id`); internal callers carry it as
+    // `credentialId`. Accept both so the runtime fence can compare.
+    const rawCredentialId =
+      (credential as { credentialId?: unknown; credential_id?: unknown })
+        .credentialId ??
+      (credential as { credential_id?: unknown }).credential_id
+    const vaultCredentialId =
+      typeof rawCredentialId === 'string' ? rawCredentialId : undefined
     let payload: { access_token?: unknown; refresh_token?: unknown } = {}
     try {
       payload = JSON.parse(credential.payload)
     } catch {}
     return {
-      credentialId:
-        typeof vaultCredentialId === 'string' ? vaultCredentialId : undefined,
+      credentialId: vaultCredentialId,
       recordVersion: credential.recordVersion,
       access:
         typeof payload.access_token === 'string' ? payload.access_token : '',
diff --git a/packages/opencode/src/custody-mode.ts b/packages/opencode/src/custody-mode.ts
index ce2e859e..70f2d434 100644
--- a/packages/opencode/src/custody-mode.ts
+++ b/packages/opencode/src/custody-mode.ts
@@ -1,5 +1,4 @@
 import {
-  getRefreshBeforeExpiryMs,
   isCustodyTombstoneOAuth,
   setClaustrumModePersistent,
 } from '@cortexkit/anthropic-auth-core'
@@ -18,6 +17,12 @@ type Lock = { release: () => Promise<void> }
 
 export const OPENCODE_MAIN_OAUTH_REFRESH_LOCK = 'opencode-main-oauth-refresh'
 
+// `cache.get` interprets `min_ttl_ms` as a staleness floor — a value below it
+// forces an upstream refresh. The preflight is a readiness check, so the floor
+// is intentionally tiny: just enough to ensure the credential can serve the
+// takeover without forcing the cache to rotate it during the check.
+export const CUSTODY_PREFLIGHT_MIN_TTL_MS = 5 * 60_000
+
 export type CustodyCacheCredential = {
   credentialId?: string
   recordVersion: number
@@ -246,8 +251,11 @@ export async function preflightClaustrumTakeover(
   const mainAuth = await input.hostAuth.get()
   const mainIsTombstoned = isCustodyTombstoneOAuth(mainAuth, 'anthropic')
 
-  const minTtlMs =
-    getRefreshBeforeExpiryMs(input.storage as never) + 30 * 60_000
+  // `cache.get` treats `min_ttl_ms` as a staleness floor: a value below it
+  // forces an upstream refresh. A preflight must not rotate the credential it
+  // is about to use, so the floor is reduced to a small serving margin — the
+  // vault owns rotation and only needs "fresh enough to serve the takeover".
+  const minTtlMs = CUSTODY_PREFLIGHT_MIN_TTL_MS
   const accounts: ClaustrumTakeoverPlan['accounts'] = []
   const refusals: CollectedPreflightRefusal[] = []
   const refuse = (
@@ -262,7 +270,7 @@ export async function preflightClaustrumTakeover(
       reason === 'TAKEOVER_INCOMPLETE_MAIN_REAL'
         ? {
             guidance:
-              "Onboard the main account into the Claustrum vault with Claustrum's tooling (see its runbook) before retrying.",
+              'Mint a handle with `ck auth mint-handle`; this plugin then writes the manifest entry.',
           }
         : {}),
     })
@@ -303,12 +311,15 @@ export async function preflightClaustrumTakeover(
       refuse(route, 'credential_unusable')
       continue
     }
-    // Without a vault id, a same-account wrong-record response remains possible; the vault `account_id` vs persisted `anthropicAccountUuid` fence is the live protection.
-    if (credential.credentialId === undefined)
-      input.debug?.(
-        'custody identity check skipped: vault supplied no credential id',
-      )
-    else if (credential.credentialId !== binding.credentialId) {
+    // Refuse when the vault omits an id: skipping would make the manifest's
+    // `credential_id` decorative, since there is then nothing to compare it
+    // against. The current vault daemon always supplies the id on a successful
+    // get, so this branch is unreachable in production today.
+    if (credential.credentialId === undefined) {
+      refuse(route, 'credential_identity_mismatch')
+      continue
+    }
+    if (credential.credentialId !== binding.credentialId) {
       refuse(route, 'credential_identity_mismatch')
       continue
     }
diff --git a/packages/opencode/src/index.ts b/packages/opencode/src/index.ts
index 5d0b4d55..d8bd4833 100644
--- a/packages/opencode/src/index.ts
+++ b/packages/opencode/src/index.ts
@@ -50,6 +50,7 @@ import {
   createEmptyStorage,
   createStickyNoRouteResponse,
   custodyCredentialId,
+  custodyCredentialIdFromResolution,
   type DumpHandle,
   decideStickyQuotaFailure,
   detectClaustrumConnection,
@@ -1977,7 +1978,10 @@ const anthropicAuthPlugin = async (
   ): Promise<void> {
     const completion = completedLocalLogin
     if (!completion) return
-    const storage = await loadAccounts(accountStoragePath)
+    // Best-effort metadata read — same shape as the OAuth callback path
+    // (~8775). A corrupt store must not reject the post-login ack; fall
+    // through to the missing-entry branch the ternary below already handles.
+    const storage = await loadAccounts(accountStoragePath).catch(() => null)
     if (getClaustrumMode(storage) !== 'local') return
     const account = mainCustodyAccount(await getAuth().catch(() => ({})))
     const resolution = storage
@@ -1996,7 +2000,7 @@ const anthropicAuthPlugin = async (
         entry: {
           label: 'main',
           handle: resolution.handle,
-          credentialId: resolution.credentialId ?? custodyCredentialId('main'),
+          credentialId: custodyCredentialIdFromResolution(resolution, 'main'),
         },
         beforeRemove: async () => {
           await persistCustodyDivergenceState(
@@ -2056,7 +2060,7 @@ const anthropicAuthPlugin = async (
               code: 'TAKEOVER_INCOMPLETE_MAIN_REAL',
               retryable: false,
               message:
-                "Claustrum main binding is not active while local main material remains; onboard main into the vault with Claustrum's tooling first.",
+                'Claustrum main binding is not active while local main material remains; mint a handle with `ck auth mint-handle` so this plugin can write the manifest entry.',
             }
           : state === 'identity-mismatch'
             ? {
@@ -2612,6 +2616,13 @@ const anthropicAuthPlugin = async (
                   // Refuse malformed labels before taking the cross-tenant lock.
                   isValidCustodyLabel(account.label)
                 ) {
+                  // Safe to derive here: this migrates a LEGACY handle into
+                  // our manifest block, and every legacy handle file on disk
+                  // today names a labelled credential whose real vault id
+                  // matches `oauth:anthropic:<label>` (the only one is
+                  // `.claustrum-handle-work-alt` -> `oauth:anthropic:work-alt`).
+                  // A legacy file naming an unlabelled credential would derive
+                  // to nothing and the removal branch would fail closed.
                   const write = await writeCustodyHandleManifestEntry({
                     path: custodyHandleManifestPath,
                     entry: {
@@ -4693,7 +4704,10 @@ const anthropicAuthPlugin = async (
         await acknowledgeLocalOAuthLoginFromStorage(
           {
             accountId: account.id,
-            credentialId: custodyCredentialId(account.label ?? account.id),
+            credentialId: custodyCredentialIdFromResolution(
+              fallbackBinding,
+              account.label ?? account.id,
+            ),
             authFingerprint: localAuthFingerprint(
               result.access,
               result.refresh,
@@ -8826,9 +8840,35 @@ const anthropicAuthPlugin = async (
                   result.state,
                 )
                 if (exchanged.type === 'success') {
+                  // Mirror `acknowledgeMainLocalLogin` (~1995): prefer the
+                  // manifest-resolved credential id so divergence state and
+                  // removal match the actual vault id, not the derived form.
+                  // This lookup only supplies the credential id; a corrupt or
+                  // partially-written store must NOT reject the OAuth callback
+                  // and discard the just-exchanged credentials — exactly the
+                  // case a re-logging-in user is trying to recover from.
+                  const reentryStorage = await loadAccounts(
+                    accountStoragePath,
+                  ).catch(() => null)
+                  const reentryResolution = reentryStorage
+                    ? resolveAccountCustodyHandle(
+                        mainCustodyAccount({
+                          access: exchanged.access,
+                          refresh: exchanged.refresh,
+                        }),
+                        reentryStorage,
+                      )
+                    : ({
+                        status: 'unresolved',
+                        reason: 'missing-entry',
+                      } as const)
+                  const reentryCredentialId = custodyCredentialIdFromResolution(
+                    reentryResolution,
+                    'main',
+                  )
                   completedLocalLogin = {
                     accountId: 'main',
-                    credentialId: custodyCredentialId('main'),
+                    credentialId: reentryCredentialId,
                     authFingerprint: localAuthFingerprint(
                       exchanged.access,
                       exchanged.refresh,
diff --git a/packages/opencode/src/tests/account-command.test.ts b/packages/opencode/src/tests/account-command.test.ts
index 4a57cad9..90697099 100644
--- a/packages/opencode/src/tests/account-command.test.ts
+++ b/packages/opencode/src/tests/account-command.test.ts
@@ -905,7 +905,7 @@ describe('account command INFO logs (via plugin)', () => {
       expect(text).toBe(
         [
           'Custody takeover refused:',
-          "main: TAKEOVER_INCOMPLETE_MAIN_REAL — Onboard the main account into the Claustrum vault with Claustrum's tooling (see its runbook) before retrying.",
+          'main: TAKEOVER_INCOMPLETE_MAIN_REAL — Mint a handle with `ck auth mint-handle`; this plugin then writes the manifest entry.',
           'Work account: binding_missing',
           'Personal account: binding_missing',
         ].join('\n'),
diff --git a/packages/opencode/src/tests/custody-handle-manifest.test.ts b/packages/opencode/src/tests/custody-handle-manifest.test.ts
index e81dca50..e16b3cbb 100644
--- a/packages/opencode/src/tests/custody-handle-manifest.test.ts
+++ b/packages/opencode/src/tests/custody-handle-manifest.test.ts
@@ -446,7 +446,7 @@ describe('writeCustodyHandleManifestEntry', () => {
     })
   })
 
-  test('refuses a valid-shaped credential id that is not canonical for its label', async () => {
+  test('accepts a non-canonical credential id via the writer', async () => {
     await withTempDirectory(async (directory) => {
       const parent = join(directory, 'manifest')
       const path = join(parent, 'handles.json')
@@ -456,10 +456,19 @@ describe('writeCustodyHandleManifestEntry', () => {
       await expect(
         writeCustodyHandleManifestEntry({
           path,
-          entry: { ...writerEntry, credentialId: 'oauth:anthropic:other' },
+          entry: { ...writerEntry, credentialId: 'oauth:anthropic' },
         }),
-      ).resolves.toEqual({ status: 'refused', reason: 'invalid entry' })
-      await expect(fs.lstat(path)).rejects.toMatchObject({ code: 'ENOENT' })
+      ).resolves.toEqual({ status: 'written' })
+      const output = JSON.parse(await fs.readFile(path, 'utf8')) as {
+        providers: Array<{ accounts: Array<Record<string, unknown>> }>
+      }
+      expect(output.providers[0]?.accounts).toEqual([
+        {
+          label: writerEntry.label,
+          handle: writerEntry.handle,
+          credential_id: 'oauth:anthropic',
+        },
+      ])
     })
   })
 
@@ -2001,7 +2010,8 @@ describe('resolveCustodyHandle', () => {
       | 'duplicate-label'
       | 'missing-entry'
       | 'foreign-serve'
-      | 'superseded',
+      | 'superseded'
+      | 'corrupt-binding',
   ) {
     expect(result.status).toBe('unresolved')
     if (result.status !== 'unresolved')
@@ -2101,21 +2111,67 @@ describe('resolveCustodyHandle', () => {
     )
   })
 
-  test('requires the canonical OAuth credential ID rather than the UUID', () => {
+  test("returns the entry's own credential id verbatim", () => {
     const result = resolveCustodyHandle({
-      account: account({ id: 'uuid-not-a-label', label: 'alice' }),
+      account: account({ id: 'uuid-not-a-label', label: 'main' }),
       manifest: manifest({
         accounts: [
           {
-            label: 'alice',
+            label: 'main',
             handle: activeHandle,
-            credential_id: 'uuid-not-a-label',
+            credential_id: 'oauth:anthropic',
           },
         ],
       }),
     })
 
-    expectUnresolvedReason(result, 'missing-entry')
+    expect(result.status).toBe('resolved')
+    if (result.status !== 'resolved')
+      throw new Error('expected resolved handle')
+    expect(result.source).toBe('manifest')
+    if (result.source !== 'manifest')
+      throw new Error('expected manifest source')
+    expect(result.credentialId).toBe('oauth:anthropic')
+  })
+
+  test('marks every duplicate-label entry as corrupt-binding and refuses to resolve', () => {
+    const parsed = readCustodyHandles(
+      {
+        version: 1,
+        providers: [
+          {
+            provider: 'anthropic',
+            serve: 'anthropic-auth',
+            accounts: [
+              {
+                label: 'alice',
+                handle: activeHandle,
+                credential_id: 'oauth:anthropic:alice',
+              },
+              {
+                label: 'alice',
+                handle: otherHandle,
+                credential_id: 'oauth:anthropic:alice',
+              },
+            ],
+          },
+        ],
+      },
+      'anthropic',
+      'anthropic-auth',
+    )
+    expect(parsed.corruptLabels).toEqual(new Set(['alice']))
+    expect(parsed.accounts).toEqual([])
+
+    const result = resolveCustodyHandle({
+      account: account({ label: 'alice' }),
+      manifest: {
+        ...manifest(),
+        accounts: parsed.accounts,
+        corruptLabels: parsed.corruptLabels,
+      },
+    })
+    expectUnresolvedReason(result, 'corrupt-binding')
   })
 
   test('never falls back to legacy for a foreign serve', () => {
diff --git a/packages/opencode/src/tests/custody-mode-first-run.test.ts b/packages/opencode/src/tests/custody-mode-first-run.test.ts
index 34054dee..2d46d10f 100644
--- a/packages/opencode/src/tests/custody-mode-first-run.test.ts
+++ b/packages/opencode/src/tests/custody-mode-first-run.test.ts
@@ -3,6 +3,7 @@ import { access, mkdtemp, readFile, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { dirname, join } from 'node:path'
 import {
+  custodyCredentialId,
   custodyTombstoneOAuth,
   getAccountStatePath,
   loadAccounts,
@@ -771,6 +772,8 @@ describe('exit and terminating re-login', () => {
               main ? 'vault-main-access' : 'vault-fallback-access',
               main ? 3 : fallbackRecordVersion,
               20_000_000,
+              undefined,
+              main ? custodyCredentialId('main') : custodyCredentialId(label),
             )
           }),
         onFetch: (input) => {
diff --git a/packages/opencode/src/tests/custody-mode.test.ts b/packages/opencode/src/tests/custody-mode.test.ts
index cf6f33a5..0c634f37 100644
--- a/packages/opencode/src/tests/custody-mode.test.ts
+++ b/packages/opencode/src/tests/custody-mode.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, test } from 'bun:test'
-import { mkdtemp, readFile, rm } from 'node:fs/promises'
+import { mkdir, mkdtemp, readFile, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import * as core from '@cortexkit/anthropic-auth-core'
@@ -9,6 +9,7 @@ import {
 } from '../custody-live.ts'
 import {
   acquireCustodyTransitionLocks,
+  CUSTODY_PREFLIGHT_MIN_TTL_MS,
   CustodyLockBusyError,
   CustodyPreflightRefusedError,
   CustodyStateMismatchError,
@@ -167,7 +168,7 @@ describe('custody mode', () => {
       expect(cacheCalls).toEqual([
         {
           handle: manifestHandle,
-          minTtlMs: core.getRefreshBeforeExpiryMs(storage) + 30 * 60_000,
+          minTtlMs: CUSTODY_PREFLIGHT_MIN_TTL_MS,
         },
       ])
     } finally {
@@ -187,7 +188,6 @@ describe('custody mode', () => {
     const directory = await mkdtemp(join(tmpdir(), 'custody-live-adapter-'))
     const storagePath = join(directory, 'storage.json')
     const manifestPath = join(directory, 'handles.json')
-    const debugMessages: string[] = []
     try {
       await expect(
         core.writeCustodyHandleManifestEntry({
@@ -210,18 +210,16 @@ describe('custody mode', () => {
         storagePath,
         cache: {
           get: async (_handle, minTtlMs) => ({
-            payload: JSON.stringify({
-              access_token: 'vault-access',
-              refresh_token: 'vault-refresh',
-            }),
-            expiresAtMs: null,
+            credentialId: 'oauth:anthropic:x',
             recordVersion: 1,
-            accountId: 'vault-account',
+            access: 'vault-access',
+            refresh: 'vault-refresh',
+            expiresAt: null,
+            state: 'usable',
           }),
         },
         latestGetAuth: get,
         now,
-        debug: (message: string) => debugMessages.push(message),
       })
 
       const input = await deps.preflightInput(
@@ -231,14 +229,31 @@ describe('custody mode', () => {
       input.bindings[0]!.credentialId = 'oauth:anthropic:x'
       const plan = await preflightClaustrumTakeover(input)
       expect(plan).toMatchObject({ accounts: [{ id: 'main' }] })
-      expect(debugMessages).toEqual([
-        'custody identity check skipped: vault supplied no credential id',
-      ])
     } finally {
       await rm(directory, { recursive: true, force: true })
     }
   })
 
+  test('custody: preflight refuses when the vault omits a credential id', async () => {
+    const input = preflightInput({
+      cache: {
+        get: async (_handle: string, _minTtlMs: number) => ({
+          handle: 'handle-main',
+          recordVersion: 4,
+          access: 'vault-access',
+          refresh: 'vault-refresh',
+          expiresAt: Number.MAX_SAFE_INTEGER,
+          state: 'usable' as const,
+        }),
+      },
+    })
+
+    await expect(preflightClaustrumTakeover(input)).rejects.toMatchObject({
+      code: 'custody_preflight_refused',
+      reason: 'credential_identity_mismatch',
+    })
+  })
+
   test('custody: preflight verifies every account before any write', async () => {
     const cases = [
       {
@@ -395,11 +410,69 @@ describe('custody mode', () => {
       },
     })
 
-    await expect(preflightClaustrumTakeover(input)).rejects.toMatchObject({
-      code: 'custody_preflight_refused',
+    const error = await preflightClaustrumTakeover(input).catch(
+      (error: unknown) => error,
+    )
+    expect(error).toBeInstanceOf(CustodyPreflightRefusedError)
+    const serialized = (error as CustodyPreflightRefusedError).toJSON() as {
+      ok: boolean
+      accountId: string
+      reason: string
+      refusals: Array<{ label: string; reason: string; guidance?: unknown }>
+    }
+    expect(serialized).toMatchObject({
+      ok: false,
       accountId: 'main',
       reason: 'TAKEOVER_INCOMPLETE_MAIN_REAL',
     })
+    const guidance = serialized.refusals[0]?.guidance
+    expect(typeof guidance).toBe('string')
+    expect(guidance as string).toContain('ck auth mint-handle')
+    expect(guidance as string).not.toContain('migrate-plugin')
+  })
+
+  test('custody: preflight hands a small serving margin to cache.get even when expiry is far below the refresh floor', async () => {
+    const cacheCalls: Array<{ handle: string; minTtlMs: number }> = []
+    // Credential expires well beyond the small margin (5 min) but far below
+    // the previous 4.5 h refresh floor — the readiness check must accept it
+    // and ask the cache for a tiny min-t-tl, not rotate it.
+    const expiresAt = now + 60 * 60_000
+    const oldRefreshFloorMs =
+      core.getRefreshBeforeExpiryMs({
+        version: 1,
+        accounts: [],
+        refresh: { refreshBeforeExpiryMinutes: 240 },
+      }) +
+      30 * 60_000
+    const input = preflightInput({
+      storage: { refresh: { refreshBeforeExpiryMinutes: 240 } },
+      cache: {
+        get: async (handle: string, { minTtlMs }: { minTtlMs: number }) => {
+          cacheCalls.push({ handle, minTtlMs })
+          return {
+            credentialId:
+              handle === 'handle-main'
+                ? 'oauth:anthropic:main'
+                : 'oauth:anthropic:work',
+            recordVersion: 4,
+            access: `vault-secret-${handle}`,
+            refresh: `vault-refresh-${handle}`,
+            expiresAt,
+            state: 'usable' as const,
+          }
+        },
+      },
+    })
+
+    await expect(preflightClaustrumTakeover(input)).resolves.toMatchObject({
+      accounts: [{ id: 'main' }, { id: 'work' }],
+    })
+    for (const call of cacheCalls)
+      expect(call.minTtlMs).toBe(CUSTODY_PREFLIGHT_MIN_TTL_MS)
+    expect(cacheCalls).toHaveLength(2)
+    expect(cacheCalls.every((call) => call.minTtlMs < oldRefreshFloorMs)).toBe(
+      true,
+    )
   })
 
   test('custody: preflight refuses a tombstoned main without its manifest binding', async () => {
@@ -1273,3 +1346,132 @@ describe('custody mode', () => {
     expect(calls).toEqual(['local'])
   })
 })
+
+describe('custody end-to-end binding', () => {
+  test('writes, resolves, preflights, removes, and local-exits a non-derived credential id for main', async () => {
+    const directory = await mkdtemp(join(tmpdir(), 'custody-e2e-'))
+    const parent = join(directory, 'manifest')
+    const manifestPath = join(parent, 'handles.json')
+    const storagePath = join(directory, 'storage.json')
+    await mkdir(parent, { mode: 0o700 })
+    const handle = `ckh_${'M'.repeat(43)}`
+    const access = 'local-access'
+    const refresh = 'local-refresh'
+    try {
+      // 1) Real writer accepts a non-derived id and stores it verbatim.
+      const writeResult = await core.writeCustodyHandleManifestEntry({
+        path: manifestPath,
+        entry: {
+          label: 'main',
+          handle,
+          credentialId: 'oauth:anthropic',
+        },
+      })
+      expect(writeResult).toEqual({ status: 'written' })
+
+      // 2) Real reader + resolver carry the id back, no derivation.
+      const reader = new core.CustodyHandleManifestReader({
+        path: manifestPath,
+        provider: 'anthropic',
+        serve: 'anthropic-auth',
+      })
+      const manifestResult = await reader.read()
+      expect(manifestResult.status).toBe('ready')
+      if (manifestResult.status !== 'ready') throw new Error('not ready')
+      const resolution = core.resolveCustodyHandle({
+        account: {
+          id: 'main',
+          label: 'main',
+          type: 'oauth',
+          refresh: '',
+        },
+        manifest: manifestResult.manifest,
+      })
+      expect(resolution.status).toBe('resolved')
+      if (resolution.status !== 'resolved') throw new Error('not resolved')
+      expect(resolution.source).toBe('manifest')
+      if (resolution.source !== 'manifest') throw new Error('not manifest')
+      expect(resolution.credentialId).toBe('oauth:anthropic')
+
+      // 3) Real binding construction (mirrors `readBindings` and the index.ts
+      // ~8763/4636 sites): use the resolved id verbatim, derive only as a
+      // legacy-source fallback.
+      const bindingCredentialId =
+        resolution.source === 'manifest'
+          ? (resolution.credentialId ?? core.custodyCredentialId('main'))
+          : core.custodyCredentialId('main')
+
+      // 4) Real preflight, cache stub returning the same id.
+      const plan = await preflightClaustrumTakeover({
+        now,
+        storage: { refresh: { refreshBeforeExpiryMinutes: 5 } },
+        main: { id: 'main', label: 'main', enabled: true },
+        fallbacks: [],
+        hostAuth: { get: () => core.custodyTombstoneOAuth('anthropic') },
+        bindings: [
+          {
+            accountId: 'main',
+            label: 'main',
+            handle: resolution.handle,
+            credentialId: bindingCredentialId,
+            source: resolution.source,
+          },
+        ],
+        cache: {
+          get: async (_h, _opts) => ({
+            credentialId: 'oauth:anthropic',
+            recordVersion: 4,
+            access: 'vault-access',
+            refresh: 'vault-refresh',
+            expiresAt: now + 60 * 60_000,
+            state: 'usable' as const,
+          }),
+        },
+      })
+      expect(plan.accounts).toHaveLength(1)
+      expect(plan.accounts[0]?.credentialId).toBe('oauth:anthropic')
+      expect(plan.accounts[0]?.handle).toBe(handle)
+
+      // 5) Real local-exit path: persist a labelled main account, drive
+      // acknowledgeLocalOAuthLoginFromStorage with a completion credentialId
+      // keyed off the manifest resolution, and assert the binding is cleared.
+      await core.saveAccounts(
+        {
+          version: 1,
+          accounts: [
+            {
+              id: 'main',
+              label: 'main',
+              type: 'oauth',
+              access,
+              refresh,
+              enabled: true,
+            },
+          ],
+        },
+        storagePath,
+      )
+      const { acknowledgeLocalOAuthLoginFromStorage, localAuthFingerprint } =
+        await import('../local-login.ts')
+      const exitResult = await acknowledgeLocalOAuthLoginFromStorage(
+        {
+          accountId: 'main',
+          credentialId: bindingCredentialId,
+          authFingerprint: localAuthFingerprint(access, refresh),
+          completedAt: now,
+        },
+        {
+          accountStoragePath: storagePath,
+          manifestPath,
+        },
+      )
+      expect(exitResult).toBe('cleared')
+      const reloaded = await reader.read()
+      expect(reloaded.status).toBe('ready')
+      if (reloaded.status !== 'ready') throw new Error('not ready')
+      expect(reloaded.manifest.accounts).toEqual([])
+    } finally {
+      await rm(directory, { recursive: true, force: true })
+    }
+  })
+})
diff --git a/packages/opencode/src/tests/custody-ruled-row.fixture.ts b/packages/opencode/src/tests/custody-ruled-row.fixture.ts
index 4340e9af..d97f2dfd 100644
--- a/packages/opencode/src/tests/custody-ruled-row.fixture.ts
+++ b/packages/opencode/src/tests/custody-ruled-row.fixture.ts
@@ -68,6 +68,7 @@ export function credentialResponse(
   recordVersion: number,
   expiresAtMs = Date.now() + 60_000,
   accountId?: string,
+  credentialId?: string,
 ) {
   return {
     result: {
@@ -77,6 +78,7 @@ export function credentialResponse(
       expires_at_ms: expiresAtMs,
       record_version: recordVersion,
       ...(accountId && { account_id: accountId }),
+      ...(credentialId && { credential_id: credentialId }),
     },
   }
 }
@@ -123,6 +125,14 @@ export async function writeManifest(
         {
           provider: 'anthropic',
           serve,
+          // Label-derived ids are a fixture convenience, not main's real shape.
+          // The vault holds exactly two anthropic credentials: the UNLABELLED
+          // `oauth:anthropic` (main) and `oauth:anthropic:work-alt`. Nothing about a
+          // production binding derives from the label — the manifest carries whatever
+          // id the handle was minted against, and the runtime fence compares it with
+          // what `credential.get` returns. Provider scoping only requires the second
+          // segment to be `anthropic`, so a labelled id is valid here and would still
+          // mismatch the vault in production. Read this before inferring a shape.
           accounts: entries.map(({ label, handle }) => ({
             label,
             handle,
diff --git a/packages/opencode/src/tests/custody-source-deps.test.ts b/packages/opencode/src/tests/custody-source-deps.test.ts
index 4477edf5..62d363a3 100644
--- a/packages/opencode/src/tests/custody-source-deps.test.ts
+++ b/packages/opencode/src/tests/custody-source-deps.test.ts
@@ -12,9 +12,9 @@ const productionFiles = [
 ]
 
 const allowedGuidance = [
-  "Onboard the main account into the Claustrum vault with Claustrum's tooling (see its runbook) before retrying.",
+  'Mint a handle with `ck auth mint-handle`; this plugin then writes the manifest entry.',
   'Claustrum main credential requires re-import; run ck auth import --replace.',
-  "Claustrum main binding is not active while local main material remains; onboard main into the vault with Claustrum's tooling first.",
+  'Claustrum main binding is not active while local main material remains; mint a handle with `ck auth mint-handle` so this plugin can write the manifest entry.',
   'Claustrum main credential identity differs from the persisted main identity; run ck auth set-identity.',
 ]
 const forbidden = [
diff --git a/packages/opencode/src/tests/custody-tombstone.test.ts b/packages/opencode/src/tests/custody-tombstone.test.ts
index 59677e1a..b11079e3 100644
--- a/packages/opencode/src/tests/custody-tombstone.test.ts
+++ b/packages/opencode/src/tests/custody-tombstone.test.ts
@@ -392,9 +392,11 @@ describe('Claustrum custody tombstones', () => {
     if (!anthropic) throw new Error('missing anthropic fixture')
     const account = anthropic.accounts[0]
     if (!account) throw new Error('missing anthropic account fixture')
-    const missingHandle = { ...account }
+    const missingHandle: Record<string, unknown> = { ...account }
+    missingHandle.label = 'missing-handle'
     delete missingHandle.handle
-    const missingCredentialId = { ...account }
+    const missingCredentialId: Record<string, unknown> = { ...account }
+    missingCredentialId.label = 'missing-credential-id'
     delete missingCredentialId.credential_id
     anthropic.accounts = [
       missingHandle,
@@ -407,11 +409,13 @@ describe('Claustrum custody tombstones', () => {
       oauthFixture.provider,
       'anthropic-auth',
     )
-    expect(parsed.corruptLabels).toEqual(new Set([String(account.label)]))
+    expect(parsed.corruptLabels).toEqual(
+      new Set(['missing-handle', 'missing-credential-id']),
+    )
     expect(parsed.accounts).toHaveLength(1)
   })
 
-  test('marks non-canonical credential IDs as corrupt bindings', () => {
+  test('accepts a non-canonical credential ID and carries it verbatim', () => {
     const fixture = structuredClone(handlesFixture) as {
       providers: Array<{
         provider: string
@@ -424,7 +428,35 @@ describe('Claustrum custody tombstones', () => {
     if (!anthropic) throw new Error('missing anthropic fixture')
     const account = anthropic.accounts[0]
     if (!account) throw new Error('missing anthropic account fixture')
-    anthropic.accounts = [{ ...account, credential_id: 'wrong' }]
+    anthropic.accounts = [{ ...account, credential_id: 'oauth:anthropic' }]
+
+    const parsed = readCustodyHandles(
+      fixture,
+      oauthFixture.provider,
+      'anthropic-auth',
+    )
+    expect(parsed.corruptLabels).toEqual(new Set())
+    expect(parsed.accounts).toHaveLength(1)
+    expect(parsed.accounts[0]?.credentialId).toBe('oauth:anthropic')
+  })
+
+  test('marks every duplicate-label entry as corrupt', () => {
+    const fixture = structuredClone(handlesFixture) as {
+      providers: Array<{
+        provider: string
+        accounts: Array<Record<string, unknown>>
+      }>
+    }
+    const anthropic = fixture.providers.find(
+      (provider) => provider.provider === oauthFixture.provider,
+    )
+    if (!anthropic) throw new Error('missing anthropic fixture')
+    const account = anthropic.accounts[0]
+    if (!account) throw new Error('missing anthropic account fixture')
+    anthropic.accounts = [
+      { ...account, credential_id: 'oauth:anthropic:a' },
+      { ...account, credential_id: 'oauth:anthropic:b' },
+    ]
 
     const parsed = readCustodyHandles(
       fixture,
@@ -432,6 +464,7 @@ describe('Claustrum custody tombstones', () => {
       'anthropic-auth',
     )
     expect(parsed.corruptLabels).toEqual(new Set([String(account.label)]))
+    expect(parsed.accounts).toEqual([])
   })
 
   test('throws when the requested provider is absent', () => {
diff --git a/packages/opencode/src/tests/oauth-callback-corrupt-store.test.ts b/packages/opencode/src/tests/oauth-callback-corrupt-store.test.ts
new file mode 100644
index 00000000..00bfc9ca
--- /dev/null
+++ b/packages/opencode/src/tests/oauth-callback-corrupt-store.test.ts
@@ -0,0 +1,116 @@
+import { afterEach, beforeEach, describe, expect, mock, test } from 'bun:test'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+import { AnthropicAuthPlugin } from '../index'
+import { extractUrl, TOKEN_URL } from './test-fetch'
+
+// House pattern: stub `globalThis.fetch` to answer `TOKEN_URL` with the
+// exchange result the callback under test consumes. A previous revision of
+// this test replaced the core module wholesale; Bun's runtime cannot undo
+// that replacement from `afterAll`, so the stub leaked into later files in
+// the same process and answered another suite's exchange. The repo records
+// the same lesson at `accounts.test.ts:6396` (Bun's `mock.restore()` does
+// not undo a module-level replacement registered with the runtime's module
+// mocking API). Stubbing `fetch` avoids the leak entirely — the real
+// `exchange()` reads its result from the global fetch.
+//
+// Captured at module load (after `setup.ts` has installed the guarded fetch);
+// restored after every test so the global `afterEach` in `setup.ts` never sees
+// a leaked fetch mock and throws.
+const originalFetch = globalThis.fetch
+
+describe('OAuth exchange callback — corrupt account store between authorize() and callback()', () => {
+  let tempDir: string
+  let accountPath: string
+  const previousEnv: Record<string, string | undefined> = {}
+
+  beforeEach(async () => {
+    tempDir = await mkdtemp(join(tmpdir(), 'oauth-callback-corrupt-'))
+    accountPath = join(tempDir, 'anthropic-auth.json')
+    previousEnv.OPENCODE_ANTHROPIC_AUTH_FILE =
+      process.env.OPENCODE_ANTHROPIC_AUTH_FILE
+    process.env.OPENCODE_ANTHROPIC_AUTH_FILE = accountPath
+  })
+
+  afterEach(async () => {
+    await rm(tempDir, { recursive: true, force: true })
+    if (previousEnv.OPENCODE_ANTHROPIC_AUTH_FILE === undefined) {
+      delete process.env.OPENCODE_ANTHROPIC_AUTH_FILE
+    } else {
+      process.env.OPENCODE_ANTHROPIC_AUTH_FILE =
+        previousEnv.OPENCODE_ANTHROPIC_AUTH_FILE
+    }
+    globalThis.fetch = originalFetch
+  })
+
+  test('returns the exchanged credentials even when the account file is unreadable/malformed at callback time', async () => {
+    // No file present yet — plugin init must succeed and authorize() must
+    // pass its own loadAccounts-based claustrum-mode check (line ~8751).
+    globalThis.fetch = mock((input: unknown) => {
+      const url = extractUrl(input as string | URL | Request)
+      if (url === TOKEN_URL) {
+        return Promise.resolve(
+          Response.json({
+            access_token: 'exchanged-access',
+            refresh_token: 'exchanged-refresh',
+            expires_in: 3600,
+          }),
+        )
+      }
+      return Promise.resolve(new Response('{}', { status: 200 }))
+    }) as unknown as typeof fetch
+
+    const plugin = (await (
+      AnthropicAuthPlugin as unknown as (
+        context: unknown,
+        runtime: unknown,
+      ) => Promise<any>
+    )(
+      {
+        client: {
+          auth: { set: mock(() => Promise.resolve()) },
+          session: { promptAsync: mock(() => Promise.resolve()) },
+        },
+      },
+      {
+        authorize: async () => ({
+          url: 'https://example.com/oauth/authorize',
+          verifier: 'test-verifier',
+          redirectUri: 'https://example.com/callback',
+          state: 'test-state',
+        }),
+        setInterval: mock(
+          () => ({ unref() {} }) as unknown as ReturnType<typeof setInterval>,
+        ) as unknown as typeof setInterval,
+        clearInterval: mock(() => {}) as unknown as typeof clearInterval,
+      },
+    )) as any
+
+    const method = plugin.auth.methods.find(
+      (m: { label?: string }) => m.label === 'Claude Pro/Max',
+    )
+    expect(method).toBeDefined()
+    const flow = await method.authorize()
+    expect(flow.callback).toBeDefined()
+
+    // Corrupt the account store AFTER authorize() returned its flow, but
+    // BEFORE the user pastes their code. This is the re-login recovery
+    // scenario the original bug describes: a partially-written or corrupt
+    // file at the moment the callback reads it.
+    await writeFile(accountPath, '{not valid json', 'utf8')
+
+    // Discriminate the failure mode: the bug rejects the callback with the
+    // loadAccounts error, which loses the exchanged credentials. The fix
+    // must return the exchange result to the caller.
+    const result = await flow.callback('code=user-code&state=test-state')
+
+    expect(result).toBeDefined()
+    expect(result.type).toBe('success')
+    if (result.type === 'success') {
+      expect(result.access).toBe('exchanged-access')
+      expect(result.refresh).toBe('exchanged-refresh')
+    }
+  })
+})