diff --git a/packages/core/src/claustrum.ts b/packages/core/src/claustrum.ts
index c17a7dbb..fe9a3c28 100644
--- a/packages/core/src/claustrum.ts
+++ b/packages/core/src/claustrum.ts
@@ -273,10 +273,48 @@ export function custodyCredentialId(label: string): string {
   return `${CUSTODY_CREDENTIAL_PREFIX}${label}`
 }
 
+// A resolved MANIFEST binding carries the credential id verbatim (the parser
+// stores it as-written and the resolver returns it; round 2 dropped the
+// parse-time derivation check). Anything else — legacy source, unresolved,
+// or a manifest entry whose id happens to be undefined — derives from the
+// label, the only id the caller can construct without a binding in hand.
+// Callers building completion records (local-exit, reachability probe)
+// pass this single rule instead of inlining it.
+export function custodyCredentialIdFromResolution(
+  resolution: CustodyHandleResolution,
+  label: string,
+): string {
+  if (resolution.status === 'resolved' && resolution.source === 'manifest') {
+    return resolution.credentialId ?? custodyCredentialId(label)
+  }
+  return custodyCredentialId(label)
+}
+
 function isValidCustodyCredentialId(value: unknown): value is string {
   return typeof value === 'string' && value.length > 0
 }
 
+// The manifest is a co-tenant file: a sibling plugin (`provider: 'openai'`,
+// `serve: 'openai-auth'`) writes its own block in the same file. Provider
+// scoping is what stops us from binding its handles — the parser has to
+// enforce it because the sibling plugin never talks to us.
+//
+// Scope on the SECOND colon-separated segment (the provider segment). The
+// first segment is a "kind" prefix the vault owner extends (`oauth:`,
+// `chatgpt:`, `antigravity:`, `apikey:`, …) and the rule deliberately does
+// NOT enumerate or constrain it: enumerating the kinds would reject live
+// credentials the moment a new one ships. The third-and-later segments are
+// the label, which is never consulted here — the label is the lookup key
+// elsewhere, not an authorization check.
+function isScopedCustodyCredentialId(
+  value: unknown,
+  provider: string,
+): value is string {
+  if (typeof value !== 'string' || value.length === 0) return false
+  const segments = value.split(':')
+  return segments[1] === provider
+}
+
 function legacyOrUnresolved(
   account: OAuthAccount,
   reason: Extract<CustodyHandleResolution, { status: 'unresolved' }>['reason'],
@@ -321,10 +359,10 @@ export function resolveCustodyHandle(input: {
     return { status: 'unresolved', reason: 'corrupt-binding' }
   }
 
+  // The manifest carries the credential id verbatim; the runtime fence in
+  // custody-mode.ts is the one that compares it against vault ground truth.
   const entry = manifest.accounts.find(
-    (candidate) =>
-      candidate.label === account.label &&
-      candidate.credentialId === custodyCredentialId(account.label),
+    (candidate) => candidate.label === account.label,
   )
   if (!entry) return legacyOrUnresolved(account, 'missing-entry')
   if (manifest.superseded.has(entry.handle)) {
@@ -372,6 +410,27 @@ export function readCustodyHandles(
   if (!Object.hasOwn(source, 'accounts') || !Array.isArray(source.accounts)) {
     throw new Error('invalid manifest accounts')
   }
+  // The label is the sole lookup key; two entries with the same label cannot
+  // tell the resolver which one to bind, so every such entry is marked corrupt
+  // rather than silently picking a winner.
+  const labelCounts = new Map<string, number>()
+  for (const candidate of source.accounts) {
+    if (
+      !isRecord(candidate) ||
+      !Object.hasOwn(candidate, 'label') ||
+      typeof candidate.label !== 'string' ||
+      !isValidCustodyLabel(candidate.label)
+    )
+      continue
+    labelCounts.set(
+      candidate.label,
+      (labelCounts.get(candidate.label) ?? 0) + 1,
+    )
+  }
+  const duplicateLabels = new Set(
+    [...labelCounts].filter(([, count]) => count > 1).map(([label]) => label),
+  )
+
   const superseded = new Set<string>()
   const corruptLabels = new Set<string>()
   const accounts: CustodyHandleAccount[] = []
@@ -388,13 +447,15 @@ export function readCustodyHandles(
       !Object.hasOwn(entry, 'credential_id') ||
       typeof entry.handle !== 'string' ||
       !isValidCustodyHandle(entry.handle) ||
-      !isValidCustodyCredentialId(entry.credential_id) ||
-      (provider === 'anthropic' &&
-        entry.credential_id !== custodyCredentialId(entry.label))
+      !isScopedCustodyCredentialId(entry.credential_id, provider)
     ) {
       corruptLabels.add(entry.label)
       continue
     }
+    if (duplicateLabels.has(entry.label)) {
+      corruptLabels.add(entry.label)
+      continue
+    }
     if (Object.hasOwn(entry, 'superseded')) {
       if (!Array.isArray(entry.superseded)) {
         corruptLabels.add(entry.label)
@@ -958,8 +1019,7 @@ export async function writeCustodyHandleManifestEntry(
   if (
     !isValidCustodyLabel(input.entry.label) ||
     !isValidCustodyHandle(input.entry.handle) ||
-    !isValidCustodyCredentialId(input.entry.credentialId) ||
-    input.entry.credentialId !== custodyCredentialId(input.entry.label)
+    !isValidCustodyCredentialId(input.entry.credentialId)
   ) {
     return refusal('invalid entry')
   }
@@ -987,8 +1047,7 @@ export async function removeCustodyHandleManifestEntry(
   if (
     !isValidCustodyLabel(input.entry.label) ||
     !isValidCustodyHandle(input.entry.handle) ||
-    !isValidCustodyCredentialId(input.entry.credentialId) ||
-    input.entry.credentialId !== custodyCredentialId(input.entry.label)
+    !isValidCustodyCredentialId(input.entry.credentialId)
   ) {
     return { status: 'refused' }
   }
@@ -1514,6 +1573,7 @@ export type ClaustrumCredential = {
   recordVersion: number
   projectId?: string
   accountId?: string
+  credentialId?: string
 }
 
 export type ClaustrumServedCredential = Pick<
@@ -1552,6 +1612,7 @@ type CredentialGetResult = {
   recordVersion: number
   projectId?: string
   accountId?: string
+  credentialId?: string
 }
 
 function credentialErrorAction(
@@ -1688,6 +1749,9 @@ function decodeCredentialGetResponse(response: unknown): CredentialGetResult {
     ...(typeof result?.account_id === 'string' && {
       accountId: result.account_id,
     }),
+    ...(typeof result?.credential_id === 'string' && {
+      credentialId: result.credential_id,
+    }),
   }
 }
 
@@ -1897,6 +1961,9 @@ export class ClaustrumCredentialCache {
       recordVersion: result.recordVersion,
       ...(result.projectId !== undefined && { projectId: result.projectId }),
       ...(result.accountId !== undefined && { accountId: result.accountId }),
+      ...(result.credentialId !== undefined && {
+        credentialId: result.credentialId,
+      }),
     }
     if (
       credential.expiresAtMs !== null &&
diff --git a/packages/core/src/tests/claustrum.test.ts b/packages/core/src/tests/claustrum.test.ts
index 6fd85914..d648c0f8 100644
--- a/packages/core/src/tests/claustrum.test.ts
+++ b/packages/core/src/tests/claustrum.test.ts
@@ -1,7 +1,14 @@
 import { describe, expect, test } from 'bun:test'
 import { basename, win32 } from 'node:path'
 
-import { __deriveCustodyManifestStaleLockPrefix } from '../claustrum.ts'
+import {
+  __deriveCustodyManifestStaleLockPrefix,
+  type CustodyHandleManifest,
+  type CustodyHandleResolution,
+  custodyCredentialIdFromResolution,
+  readCustodyHandles,
+  resolveCustodyHandle,
+} from '../claustrum.ts'
 
 describe('custody manifest stale-lock prefix', () => {
   test('derives prefixes from POSIX and Windows path basenames', () => {
@@ -19,3 +26,284 @@ describe('custody manifest stale-lock prefix', () => {
     ).toBe('handles.json.lock.stale-')
   })
 })
+
+describe('custodyCredentialIdFromResolution', () => {
+  test("returns a resolved manifest binding's credential id verbatim, not the derived form", () => {
+    // The provider-default main case: the manifest carries `oauth:anthropic`,
+    // not `oauth:anthropic:main`. This is the assertion round 2's e2e test
+    // could not make — it had to feed the id in by hand because the helper
+    // was inline.
+    const resolution: CustodyHandleResolution = {
+      status: 'resolved',
+      source: 'manifest',
+      handle: 'ckh_a'.padEnd(47, '_'),
+      credentialId: 'oauth:anthropic',
+    }
+    expect(custodyCredentialIdFromResolution(resolution, 'main')).toBe(
+      'oauth:anthropic',
+    )
+  })
+
+  test('derives from the label when the resolved source is legacy', () => {
+    const resolution: CustodyHandleResolution = {
+      status: 'resolved',
+      source: 'legacy',
+      handle: 'ckh_b'.padEnd(47, '_'),
+    }
+    expect(custodyCredentialIdFromResolution(resolution, 'work-alt')).toBe(
+      'oauth:anthropic:work-alt',
+    )
+  })
+
+  test('derives from the label when the resolution is unresolved', () => {
+    const resolution: CustodyHandleResolution = {
+      status: 'unresolved',
+      reason: 'missing-entry',
+    }
+    expect(custodyCredentialIdFromResolution(resolution, 'main')).toBe(
+      'oauth:anthropic:main',
+    )
+  })
+
+  test("derives from the label when the manifest binding's credential id is undefined", () => {
+    const resolution = {
+      status: 'resolved' as const,
+      source: 'manifest' as const,
+      handle: 'ckh_c'.padEnd(47, '_'),
+      credentialId: undefined,
+    }
+    expect(custodyCredentialIdFromResolution(resolution, 'main')).toBe(
+      'oauth:anthropic:main',
+    )
+  })
+})
+
+// The manifest is a co-tenant file: a sibling plugin (`provider: 'openai'`,
+// `serve: 'openai-auth'`) writes its own block in the same file, and the
+// `serve`/`provider` split is what stops the two plugins from binding each
+// other's handles. Provider scoping has to live in the parser because the
+// sibling plugin never talks to us — it only writes the file.
+describe('readCustodyHandles provider scope', () => {
+  const anthropicHandle = `ckh_${'A'.repeat(43)}`
+  const openaiHandle = `ckh_${'O'.repeat(43)}`
+  const googleHandle = `ckh_${'G'.repeat(43)}`
+
+  function makeManifest(provider: string, serve: string) {
+    return {
+      version: 1,
+      providers: [
+        {
+          provider,
+          serve,
+          accounts: [],
+        },
+      ],
+    } as const
+  }
+
+  function manifestFromParsed(
+    parsed: ReturnType<typeof readCustodyHandles>,
+  ): CustodyHandleManifest {
+    return {
+      version: 1,
+      provider: parsed.provider as 'anthropic',
+      serve: parsed.serve as 'anthropic-auth',
+      accounts: parsed.accounts,
+      superseded: parsed.superseded,
+      corruptLabels: parsed.corruptLabels,
+    }
+  }
+
+  function oauthAccount(label: string) {
+    return { id: `uuid-${label}`, type: 'oauth' as const, refresh: 'r', label }
+  }
+
+  // (a) A real foreign id inside the anthropic block — the case the parse-time
+  //     derivation check used to catch. The kind prefix (`chatgpt:`) is one
+  //     the vault serves today; the rule is that `chatgpt:openai` belongs in
+  //     an `openai` block, not in ours.
+  test('rejects an entry whose credential id names a different provider', () => {
+    const doc = makeManifest('anthropic', 'anthropic-auth')
+    doc.providers[0]!.accounts.push({
+      label: 'main',
+      handle: anthropicHandle,
+      credential_id: 'chatgpt:openai',
+    })
+
+    const parsed = readCustodyHandles(doc, 'anthropic', 'anthropic-auth')
+    expect(parsed.corruptLabels).toEqual(new Set(['main']))
+    expect(parsed.accounts).toEqual([])
+
+    const result = resolveCustodyHandle({
+      account: oauthAccount('main'),
+      manifest: manifestFromParsed(parsed),
+    })
+    expect(result).toEqual({ status: 'unresolved', reason: 'corrupt-binding' })
+  })
+
+  // (b) The main case this branch exists for: the unlabelled provider-default
+  //     credential id. Must still resolve — the runtime fence in
+  //     custody-mode.ts is the only thing that ever proves it against the
+  //     vault, but the parser must accept it verbatim.
+  test("resolves the unlabelled provider-default credential id (main's id is `oauth:anthropic`)", () => {
+    const doc = makeManifest('anthropic', 'anthropic-auth')
+    doc.providers[0]!.accounts.push({
+      label: 'main',
+      handle: anthropicHandle,
+      credential_id: 'oauth:anthropic',
+    })
+
+    const parsed = readCustodyHandles(doc, 'anthropic', 'anthropic-auth')
+    expect(parsed.corruptLabels).toEqual(new Set())
+    expect(parsed.accounts).toHaveLength(1)
+    expect(parsed.accounts[0]?.credentialId).toBe('oauth:anthropic')
+
+    const result = resolveCustodyHandle({
+      account: oauthAccount('main'),
+      manifest: manifestFromParsed(parsed),
+    })
+    expect(result).toEqual({
+      status: 'resolved',
+      source: 'manifest',
+      handle: anthropicHandle,
+      credentialId: 'oauth:anthropic',
+    })
+  })
+
+  // (c) The labelled form: credential id `oauth:<provider>:<label>`.
+  test('resolves a labelled credential id whose label matches the entry', () => {
+    const doc = makeManifest('anthropic', 'anthropic-auth')
+    doc.providers[0]!.accounts.push({
+      label: 'work-alt',
+      handle: anthropicHandle,
+      credential_id: 'oauth:anthropic:work-alt',
+    })
+
+    const parsed = readCustodyHandles(doc, 'anthropic', 'anthropic-auth')
+    expect(parsed.corruptLabels).toEqual(new Set())
+    expect(parsed.accounts).toHaveLength(1)
+
+    const result = resolveCustodyHandle({
+      account: oauthAccount('work-alt'),
+      manifest: manifestFromParsed(parsed),
+    })
+    expect(result).toEqual({
+      status: 'resolved',
+      source: 'manifest',
+      handle: anthropicHandle,
+      credentialId: 'oauth:anthropic:work-alt',
+    })
+  })
+
+  // (d) The discriminating test. A label/id mismatch that is still in-provider
+  //     MUST resolve: scoping by provider must not silently reintroduce the
+  //     parse-time label derivation that the previous commit removed. If this
+  //     goes red the parser has rebuilt the bug this branch fixed.
+  test('still resolves an in-provider entry whose credential id does not derive from its label', () => {
+    const doc = makeManifest('anthropic', 'anthropic-auth')
+    doc.providers[0]!.accounts.push({
+      label: 'work-alt',
+      handle: anthropicHandle,
+      credential_id: 'oauth:anthropic:something-else',
+    })
+
+    const parsed = readCustodyHandles(doc, 'anthropic', 'anthropic-auth')
+    expect(parsed.corruptLabels).toEqual(new Set())
+    expect(parsed.accounts).toHaveLength(1)
+
+    const result = resolveCustodyHandle({
+      account: oauthAccount('work-alt'),
+      manifest: manifestFromParsed(parsed),
+    })
+    expect(result).toEqual({
+      status: 'resolved',
+      source: 'manifest',
+      handle: anthropicHandle,
+      credentialId: 'oauth:anthropic:something-else',
+    })
+  })
+
+  // (e) The co-tenant shape: a sibling plugin's openai block in the same file
+  //     must not perturb our resolution. Sanity-checks the existing
+  //     `provider`/`serve` filter still works after the scope check is added.
+  test('resolves ours in a co-tenant file with an openai block beside ours', () => {
+    const doc = {
+      version: 1,
+      providers: [
+        {
+          provider: 'openai',
+          serve: 'openai-auth',
+          accounts: [
+            {
+              label: 'openai-main',
+              handle: openaiHandle,
+              credential_id: 'chatgpt:openai',
+            },
+          ],
+        },
+        {
+          provider: 'anthropic',
+          serve: 'anthropic-auth',
+          accounts: [
+            {
+              label: 'main',
+              handle: anthropicHandle,
+              credential_id: 'oauth:anthropic',
+            },
+          ],
+        },
+      ],
+    } as const
+
+    const parsed = readCustodyHandles(doc, 'anthropic', 'anthropic-auth')
+    expect(parsed.corruptLabels).toEqual(new Set())
+    expect(parsed.accounts.map((a) => a.label)).toEqual(['main'])
+
+    const result = resolveCustodyHandle({
+      account: oauthAccount('main'),
+      manifest: manifestFromParsed(parsed),
+    })
+    expect(result).toEqual({
+      status: 'resolved',
+      source: 'manifest',
+      handle: anthropicHandle,
+      credentialId: 'oauth:anthropic',
+    })
+  })
+
+  // (f) The sibling plugin's real credential id. Red under the original
+  //     `oauth:<provider>:<label>` rule (which would have rejected it because
+  //     the kind prefix is `chatgpt:`, not `oauth:`); green under the
+  //     provider-segment rule. Parser-level because the rule is shared.
+  test("resolves the sibling plugin's `chatgpt:openai` id inside an openai block", () => {
+    const doc = makeManifest('openai', 'openai-auth')
+    doc.providers[0]!.accounts.push({
+      label: 'main',
+      handle: openaiHandle,
+      credential_id: 'chatgpt:openai',
+    })
+
+    const parsed = readCustodyHandles(doc, 'openai', 'openai-auth')
+    expect(parsed.corruptLabels).toEqual(new Set())
+    expect(parsed.accounts).toHaveLength(1)
+    expect(parsed.accounts[0]?.credentialId).toBe('chatgpt:openai')
+    expect(parsed.accounts[0]?.label).toBe('main')
+  })
+
+  // (g) Another real kind prefix, another provider. Same shape as (f):
+  //     `antigravity:google` belongs in a google block.
+  test('resolves a `antigravity:google` id inside a google block', () => {
+    const doc = makeManifest('google', 'google-auth')
+    doc.providers[0]!.accounts.push({
+      label: 'main',
+      handle: googleHandle,
+      credential_id: 'antigravity:google',
+    })
+
+    const parsed = readCustodyHandles(doc, 'google', 'google-auth')
+    expect(parsed.corruptLabels).toEqual(new Set())
+    expect(parsed.accounts).toHaveLength(1)
+    expect(parsed.accounts[0]?.credentialId).toBe('antigravity:google')
+    expect(parsed.accounts[0]?.label).toBe('main')
+  })
+})
diff --git a/packages/opencode/src/cli.ts b/packages/opencode/src/cli.ts
index 559afef8..1b6b9cb1 100644
--- a/packages/opencode/src/cli.ts
+++ b/packages/opencode/src/cli.ts
@@ -346,6 +346,12 @@ export async function login(labelArg?: string, deps: LoginDeps = {}) {
     lastUsed: now,
     lastRefreshedAt: now,
   } as const
+  // Safe to derive here: this is the legacy handle migration path and every
+  // legacy handle file on disk today names a labelled credential whose real
+  // vault id matches `oauth:anthropic:<label>` (the only one is
+  // `.claustrum-handle-work-alt` -> `oauth:anthropic:work-alt`). If a legacy
+  // file naming an unlabelled credential ever appears, the derived id will
+  // resolve to nothing and the two-factor local-exit will fail closed.
   const credentialId = custodyCredentialId(account.label ?? account.id)
   await addAccountPersistent(account)
   await acknowledgeLocalOAuthLoginFromStorage(
diff --git a/packages/opencode/src/custody-live.ts b/packages/opencode/src/custody-live.ts
index 52fca36d..da4afdc8 100644
--- a/packages/opencode/src/custody-live.ts
+++ b/packages/opencode/src/custody-live.ts
@@ -217,15 +217,21 @@ export function createLiveCustodyDeps(input: {
   ): Promise<CustodyCacheCredential> => {
     const credential = await input.cache.get(handle, minTtlMs)
     if ('state' in credential) return credential
-    const vaultCredentialId = (credential as { credentialId?: unknown })
-      .credentialId
+    // Wire-format credentials (`core.ClaustrumCredential`) name the id in
+    // snake_case (`credential_id`); internal callers carry it as
+    // `credentialId`. Accept both so the runtime fence can compare.
+    const rawCredentialId =
+      (credential as { credentialId?: unknown; credential_id?: unknown })
+        .credentialId ??
+      (credential as { credential_id?: unknown }).credential_id
+    const vaultCredentialId =
+      typeof rawCredentialId === 'string' ? rawCredentialId : undefined
     let payload: { access_token?: unknown; refresh_token?: unknown } = {}
     try {
       payload = JSON.parse(credential.payload)
     } catch {}
     return {
-      credentialId:
-        typeof vaultCredentialId === 'string' ? vaultCredentialId : undefined,
+      credentialId: vaultCredentialId,
       recordVersion: credential.recordVersion,
       access:
         typeof payload.access_token === 'string' ? payload.access_token : '',
diff --git a/packages/opencode/src/custody-mode.ts b/packages/opencode/src/custody-mode.ts
index ce2e859e..70f2d434 100644
--- a/packages/opencode/src/custody-mode.ts
+++ b/packages/opencode/src/custody-mode.ts
@@ -1,5 +1,4 @@
 import {
-  getRefreshBeforeExpiryMs,
   isCustodyTombstoneOAuth,
   setClaustrumModePersistent,
 } from '@cortexkit/anthropic-auth-core'
@@ -18,6 +17,12 @@ type Lock = { release: () => Promise<void> }
 
 export const OPENCODE_MAIN_OAUTH_REFRESH_LOCK = 'opencode-main-oauth-refresh'
 
+// `cache.get` interprets `min_ttl_ms` as a staleness floor — a value below it
+// forces an upstream refresh. The preflight is a readiness check, so the floor
+// is intentionally tiny: just enough to ensure the credential can serve the
+// takeover without forcing the cache to rotate it during the check.
+export const CUSTODY_PREFLIGHT_MIN_TTL_MS = 5 * 60_000
+
 export type CustodyCacheCredential = {
   credentialId?: string
   recordVersion: number
@@ -246,8 +251,11 @@ export async function preflightClaustrumTakeover(
   const mainAuth = await input.hostAuth.get()
   const mainIsTombstoned = isCustodyTombstoneOAuth(mainAuth, 'anthropic')
 
-  const minTtlMs =
-    getRefreshBeforeExpiryMs(input.storage as never) + 30 * 60_000
+  // `cache.get` treats `min_ttl_ms` as a staleness floor: a value below it
+  // forces an upstream refresh. A preflight must not rotate the credential it
+  // is about to use, so the floor is reduced to a small serving margin — the
+  // vault owns rotation and only needs "fresh enough to serve the takeover".
+  const minTtlMs = CUSTODY_PREFLIGHT_MIN_TTL_MS
   const accounts: ClaustrumTakeoverPlan['accounts'] = []
   const refusals: CollectedPreflightRefusal[] = []
   const refuse = (
@@ -262,7 +270,7 @@ export async function preflightClaustrumTakeover(
       reason === 'TAKEOVER_INCOMPLETE_MAIN_REAL'
         ? {
             guidance:
-              "Onboard the main account into the Claustrum vault with Claustrum's tooling (see its runbook) before retrying.",
+              'Mint a handle with `ck auth mint-handle`; this plugin then writes the manifest entry.',
           }
         : {}),
     })
@@ -303,12 +311,15 @@ export async function preflightClaustrumTakeover(
       refuse(route, 'credential_unusable')
       continue
     }
-    // Without a vault id, a same-account wrong-record response remains possible; the vault `account_id` vs persisted `anthropicAccountUuid` fence is the live protection.
-    if (credential.credentialId === undefined)
-      input.debug?.(
-        'custody identity check skipped: vault supplied no credential id',
-      )
-    else if (credential.credentialId !== binding.credentialId) {
+    // Refuse when the vault omits an id: skipping would make the manifest's
+    // `credential_id` decorative, since there is then nothing to compare it
+    // against. The current vault daemon always supplies the id on a successful
+    // get, so this branch is unreachable in production today.
+    if (credential.credentialId === undefined) {
+      refuse(route, 'credential_identity_mismatch')
+      continue
+    }
+    if (credential.credentialId !== binding.credentialId) {
       refuse(route, 'credential_identity_mismatch')
       continue
     }
diff --git a/packages/opencode/src/index.ts b/packages/opencode/src/index.ts
index dfc7a6c5..d8bd4833 100644
--- a/packages/opencode/src/index.ts
+++ b/packages/opencode/src/index.ts
@@ -50,6 +50,7 @@ import {
   createEmptyStorage,
   createStickyNoRouteResponse,
   custodyCredentialId,
+  custodyCredentialIdFromResolution,
   type DumpHandle,
   decideStickyQuotaFailure,
   detectClaustrumConnection,
@@ -625,6 +626,7 @@ async function sendIgnoredMessage(
     noReply?: boolean
     beforeActiveAssistant?: boolean
     canSend?: () => boolean
+    onMessageId?: (messageId: string) => void
   } = {},
 ): Promise<boolean> {
   const session = ctx.client.session as PluginSessionClient | undefined
@@ -653,6 +655,7 @@ async function sendIgnoredMessage(
   // A new user prompt can start while that request is in flight, so re-check the
   // caller's delivery lease immediately before inserting the ignored message.
   if (options.canSend && !options.canSend()) return false
+  if (request.body.messageID) options.onMessageId?.(request.body.messageID)
 
   if (typeof session?.promptAsync === 'function') {
     await session.promptAsync(request)
@@ -1087,6 +1090,8 @@ const anthropicAuthPlugin = async (
   const desktopNoticeSafeSessions = new Set<string>()
   const desktopNoticeLatestUserMessages = new Map<string, string>()
   const desktopNoticeIdleUserMessages = new Map<string, string>()
+  const desktopNoticeMessageIds = new Map<string, Set<string>>()
+  const desktopNoticeUserRevisions = new Map<string, number>()
   const desktopNoticeProbes = new Map<string, number>()
   const stickySessionRouter = new StickySessionRouter({
     path:
@@ -1973,7 +1978,10 @@ const anthropicAuthPlugin = async (
   ): Promise<void> {
     const completion = completedLocalLogin
     if (!completion) return
-    const storage = await loadAccounts(accountStoragePath)
+    // Best-effort metadata read — same shape as the OAuth callback path
+    // (~8775). A corrupt store must not reject the post-login ack; fall
+    // through to the missing-entry branch the ternary below already handles.
+    const storage = await loadAccounts(accountStoragePath).catch(() => null)
     if (getClaustrumMode(storage) !== 'local') return
     const account = mainCustodyAccount(await getAuth().catch(() => ({})))
     const resolution = storage
@@ -1992,7 +2000,7 @@ const anthropicAuthPlugin = async (
         entry: {
           label: 'main',
           handle: resolution.handle,
-          credentialId: resolution.credentialId ?? custodyCredentialId('main'),
+          credentialId: custodyCredentialIdFromResolution(resolution, 'main'),
         },
         beforeRemove: async () => {
           await persistCustodyDivergenceState(
@@ -2052,7 +2060,7 @@ const anthropicAuthPlugin = async (
               code: 'TAKEOVER_INCOMPLETE_MAIN_REAL',
               retryable: false,
               message:
-                "Claustrum main binding is not active while local main material remains; onboard main into the vault with Claustrum's tooling first.",
+                'Claustrum main binding is not active while local main material remains; mint a handle with `ck auth mint-handle` so this plugin can write the manifest entry.',
             }
           : state === 'identity-mismatch'
             ? {
@@ -2608,6 +2616,13 @@ const anthropicAuthPlugin = async (
                   // Refuse malformed labels before taking the cross-tenant lock.
                   isValidCustodyLabel(account.label)
                 ) {
+                  // Safe to derive here: this migrates a LEGACY handle into
+                  // our manifest block, and every legacy handle file on disk
+                  // today names a labelled credential whose real vault id
+                  // matches `oauth:anthropic:<label>` (the only one is
+                  // `.claustrum-handle-work-alt` -> `oauth:anthropic:work-alt`).
+                  // A legacy file naming an unlabelled credential would derive
+                  // to nothing and the removal branch would fail closed.
                   const write = await writeCustodyHandleManifestEntry({
                     path: custodyHandleManifestPath,
                     entry: {
@@ -4044,6 +4059,11 @@ const anthropicAuthPlugin = async (
 
   function queueDesktopNotice(sessionId: string, text: string) {
     if (isTuiConnected(sessionId)) return
+    logger.debug('fable-fallback', 'Desktop notification queued', {
+      session: sessionId,
+      safe: desktopNoticeSafeSessions.has(sessionId),
+      text,
+    })
     // OpenCode's prompt endpoints run revert cleanup before honoring noReply.
     // OpenCode awaits event handlers before it evaluates the loop exit condition.
     // Escape the post-idle session update, then probe outside that critical section.
@@ -4063,6 +4083,36 @@ const anthropicAuthPlugin = async (
     }
   }
 
+  function rememberDesktopNoticeMessageId(
+    sessionId: string,
+    messageId: string,
+  ) {
+    const messageIds =
+      desktopNoticeMessageIds.get(sessionId) ?? new Set<string>()
+    messageIds.add(messageId)
+    while (messageIds.size > 8) {
+      const oldest = messageIds.values().next().value
+      if (oldest) messageIds.delete(oldest)
+      else break
+    }
+    desktopNoticeMessageIds.delete(sessionId)
+    desktopNoticeMessageIds.set(sessionId, messageIds)
+    while (desktopNoticeMessageIds.size > 128) {
+      const oldest = desktopNoticeMessageIds.keys().next().value
+      if (oldest) desktopNoticeMessageIds.delete(oldest)
+      else break
+    }
+  }
+
+  function grantDesktopNoticeLease(sessionId: string) {
+    desktopNoticeSafeSessions.add(sessionId)
+    while (desktopNoticeSafeSessions.size > 128) {
+      const oldest = desktopNoticeSafeSessions.values().next().value
+      if (oldest) desktopNoticeSafeSessions.delete(oldest)
+      else break
+    }
+  }
+
   function scheduleDesktopNoticeProbe(sessionId: string, attempt = 0) {
     if (
       !pendingDesktopNotices.has(sessionId) ||
@@ -4090,6 +4140,12 @@ const anthropicAuthPlugin = async (
   }
 
   async function flushDesktopNoticesIfIdle(sessionId: string, attempt: number) {
+    logger.debug('fable-fallback', 'Desktop notification flush considered', {
+      session: sessionId,
+      attempt,
+      safe: desktopNoticeSafeSessions.has(sessionId),
+      pending: pendingDesktopNotices.has(sessionId),
+    })
     if (
       !desktopNoticeSafeSessions.has(sessionId) ||
       !pendingDesktopNotices.has(sessionId)
@@ -4150,13 +4206,28 @@ const anthropicAuthPlugin = async (
           return
         }
         try {
+          const userRevision = desktopNoticeUserRevisions.get(sessionId) ?? 0
           const sent = await sendIgnoredMessage(ctx, sessionId, text, {
             noReply: true,
             beforeActiveAssistant: true,
             canSend: () => desktopNoticeSafeSessions.has(sessionId),
+            onMessageId: (messageId) =>
+              rememberDesktopNoticeMessageId(sessionId, messageId),
           })
           if (!sent) return
           queue.shift()
+          if (
+            !desktopNoticeSafeSessions.has(sessionId) &&
+            pendingDesktopNotices.get(sessionId)?.[0] &&
+            (desktopNoticeUserRevisions.get(sessionId) ?? 0) === userRevision
+          ) {
+            // OpenCode marks its own noReply insertion busy without publishing a
+            // new idle event. Re-enter only through the same live-status probe;
+            // a genuine user message changes the revision and blocks this path.
+            grantDesktopNoticeLease(sessionId)
+            scheduleDesktopNoticeProbe(sessionId)
+            return
+          }
         } catch (error) {
           logger.warn('fable-fallback', 'Desktop notification failed', {
             session: sessionId,
@@ -4633,7 +4704,10 @@ const anthropicAuthPlugin = async (
         await acknowledgeLocalOAuthLoginFromStorage(
           {
             accountId: account.id,
-            credentialId: custodyCredentialId(account.label ?? account.id),
+            credentialId: custodyCredentialIdFromResolution(
+              fallbackBinding,
+              account.label ?? account.id,
+            ),
             authFingerprint: localAuthFingerprint(
               result.access,
               result.refresh,
@@ -5237,21 +5311,32 @@ const anthropicAuthPlugin = async (
       if (!sessionId) return
 
       if (value.type === 'message.updated' && info?.role === 'user') {
-        if (typeof info.id === 'string') {
-          desktopNoticeLatestUserMessages.set(sessionId, info.id)
-          if (
-            desktopNoticeSafeSessions.has(sessionId) &&
-            desktopNoticeIdleUserMessages.get(sessionId) !== info.id
-          ) {
-            // A new user message can precede OpenCode's busy status event. Revoke
-            // the idle-delivery lease immediately so an ignored notice cannot
-            // become the active request parent and duplicate a provider turn.
-            // Repeated updates for the user message that produced the current
-            // idle event are harmless and must not suppress delivery forever.
+        // promptAsync publishes ignored notices as user-message updates. They do
+        // not start a provider turn, so only genuine user messages revoke the lease.
+        const isDesktopNotice =
+          typeof info.id === 'string' &&
+          desktopNoticeMessageIds.get(sessionId)?.has(info.id)
+        if (!isDesktopNotice) {
+          desktopNoticeUserRevisions.set(
+            sessionId,
+            (desktopNoticeUserRevisions.get(sessionId) ?? 0) + 1,
+          )
+          if (typeof info.id === 'string') {
+            desktopNoticeLatestUserMessages.set(sessionId, info.id)
+            if (
+              desktopNoticeSafeSessions.has(sessionId) &&
+              desktopNoticeIdleUserMessages.get(sessionId) !== info.id
+            ) {
+              // A new user message can precede OpenCode's busy status event. Revoke
+              // the idle-delivery lease immediately so an ignored notice cannot
+              // become the active request parent and duplicate a provider turn.
+              // Repeated updates for the user message that produced the current
+              // idle event are harmless and must not suppress delivery forever.
+              desktopNoticeSafeSessions.delete(sessionId)
+            }
+          } else {
             desktopNoticeSafeSessions.delete(sessionId)
           }
-        } else {
-          desktopNoticeSafeSessions.delete(sessionId)
         }
       }
 
@@ -5274,12 +5359,7 @@ const anthropicAuthPlugin = async (
         // live status map is still idle. OpenCode 1.18 no longer guarantees a
         // session.updated event after session.idle, so that event cannot be used
         // as the release signal.
-        desktopNoticeSafeSessions.add(sessionId)
-        while (desktopNoticeSafeSessions.size > 128) {
-          const oldest = desktopNoticeSafeSessions.values().next().value
-          if (oldest) desktopNoticeSafeSessions.delete(oldest)
-          else break
-        }
+        grantDesktopNoticeLease(sessionId)
         scheduleDesktopNoticeProbe(sessionId)
       }
 
@@ -5297,6 +5377,8 @@ const anthropicAuthPlugin = async (
         desktopNoticeSafeSessions.delete(sessionId)
         desktopNoticeLatestUserMessages.delete(sessionId)
         desktopNoticeIdleUserMessages.delete(sessionId)
+        desktopNoticeMessageIds.delete(sessionId)
+        desktopNoticeUserRevisions.delete(sessionId)
         for (const recoveryKey of pendingRecoveryDesktopNotices.keys()) {
           if (recoveryKey.startsWith(`${sessionId}\0`)) {
             pendingRecoveryDesktopNotices.delete(recoveryKey)
@@ -8758,9 +8840,35 @@ const anthropicAuthPlugin = async (
                   result.state,
                 )
                 if (exchanged.type === 'success') {
+                  // Mirror `acknowledgeMainLocalLogin` (~1995): prefer the
+                  // manifest-resolved credential id so divergence state and
+                  // removal match the actual vault id, not the derived form.
+                  // This lookup only supplies the credential id; a corrupt or
+                  // partially-written store must NOT reject the OAuth callback
+                  // and discard the just-exchanged credentials — exactly the
+                  // case a re-logging-in user is trying to recover from.
+                  const reentryStorage = await loadAccounts(
+                    accountStoragePath,
+                  ).catch(() => null)
+                  const reentryResolution = reentryStorage
+                    ? resolveAccountCustodyHandle(
+                        mainCustodyAccount({
+                          access: exchanged.access,
+                          refresh: exchanged.refresh,
+                        }),
+                        reentryStorage,
+                      )
+                    : ({
+                        status: 'unresolved',
+                        reason: 'missing-entry',
+                      } as const)
+                  const reentryCredentialId = custodyCredentialIdFromResolution(
+                    reentryResolution,
+                    'main',
+                  )
                   completedLocalLogin = {
                     accountId: 'main',
-                    credentialId: custodyCredentialId('main'),
+                    credentialId: reentryCredentialId,
                     authFingerprint: localAuthFingerprint(
                       exchanged.access,
                       exchanged.refresh,
diff --git a/packages/opencode/src/tests/account-command.test.ts b/packages/opencode/src/tests/account-command.test.ts
index 4a57cad9..90697099 100644
--- a/packages/opencode/src/tests/account-command.test.ts
+++ b/packages/opencode/src/tests/account-command.test.ts
@@ -905,7 +905,7 @@ describe('account command INFO logs (via plugin)', () => {
       expect(text).toBe(
         [
           'Custody takeover refused:',
-          "main: TAKEOVER_INCOMPLETE_MAIN_REAL — Onboard the main account into the Claustrum vault with Claustrum's tooling (see its runbook) before retrying.",
+          'main: TAKEOVER_INCOMPLETE_MAIN_REAL — Mint a handle with `ck auth mint-handle`; this plugin then writes the manifest entry.',
           'Work account: binding_missing',
           'Personal account: binding_missing',
         ].join('\n'),
diff --git a/packages/opencode/src/tests/custody-handle-manifest.test.ts b/packages/opencode/src/tests/custody-handle-manifest.test.ts
index 38eb88d1..e16b3cbb 100644
--- a/packages/opencode/src/tests/custody-handle-manifest.test.ts
+++ b/packages/opencode/src/tests/custody-handle-manifest.test.ts
@@ -446,7 +446,7 @@ describe('writeCustodyHandleManifestEntry', () => {
     })
   })
 
-  test('refuses a valid-shaped credential id that is not canonical for its label', async () => {
+  test('accepts a non-canonical credential id via the writer', async () => {
     await withTempDirectory(async (directory) => {
       const parent = join(directory, 'manifest')
       const path = join(parent, 'handles.json')
@@ -456,10 +456,19 @@ describe('writeCustodyHandleManifestEntry', () => {
       await expect(
         writeCustodyHandleManifestEntry({
           path,
-          entry: { ...writerEntry, credentialId: 'oauth:anthropic:other' },
+          entry: { ...writerEntry, credentialId: 'oauth:anthropic' },
         }),
-      ).resolves.toEqual({ status: 'refused', reason: 'invalid entry' })
-      await expect(fs.lstat(path)).rejects.toMatchObject({ code: 'ENOENT' })
+      ).resolves.toEqual({ status: 'written' })
+      const output = JSON.parse(await fs.readFile(path, 'utf8')) as {
+        providers: Array<{ accounts: Array<Record<string, unknown>> }>
+      }
+      expect(output.providers[0]?.accounts).toEqual([
+        {
+          label: writerEntry.label,
+          handle: writerEntry.handle,
+          credential_id: 'oauth:anthropic',
+        },
+      ])
     })
   })
 
@@ -1655,27 +1664,30 @@ describe('withCustodyManifestLock', () => {
   test.serial('reports a held lock as lock_busy', async () => {
     await withTempDirectory(async (directory) => {
       const path = join(directory, 'handles.json')
-      const firstEntered = Promise.withResolvers<void>()
-      const releaseFirst = Promise.withResolvers<void>()
+      const lockPath = `${path}.lock`
+      const times = [0, 29, 30]
+      let timeIndex = 0
+      await fs.mkdir(lockPath, { mode: 0o700 })
+      await fs.writeFile(
+        join(lockPath, 'owner'),
+        `${JSON.stringify({
+          tenant: 'anthropic-auth',
+          pid: process.pid,
+          claimed_at_ms: 0,
+          nonce: 'held-test',
+        })}\n`,
+      )
       __setCustodyManifestLockTestOptions({
         ttlMs: 30,
         retryMinMs: 1,
         retryMaxMs: 1,
-        renewalIntervalMs: 5,
+        now: () => times[Math.min(timeIndex++, times.length - 1)]!,
       })
-      const first = withCustodyManifestLock(path, async () => {
-        firstEntered.resolve()
-        await releaseFirst.promise
-      })
-      try {
-        await firstEntered.promise
-        await expect(
-          withCustodyManifestLock(path, async () => 'acquired'),
-        ).rejects.toMatchObject({ code: 'lock_busy' })
-      } finally {
-        releaseFirst.resolve()
-        await first
-      }
+
+      await expect(
+        withCustodyManifestLock(path, async () => 'acquired'),
+      ).rejects.toMatchObject({ code: 'lock_busy' })
+      await expect(fs.lstat(lockPath)).resolves.toBeDefined()
     })
   })
 
@@ -1998,7 +2010,8 @@ describe('resolveCustodyHandle', () => {
       | 'duplicate-label'
       | 'missing-entry'
       | 'foreign-serve'
-      | 'superseded',
+      | 'superseded'
+      | 'corrupt-binding',
   ) {
     expect(result.status).toBe('unresolved')
     if (result.status !== 'unresolved')
@@ -2098,21 +2111,67 @@ describe('resolveCustodyHandle', () => {
     )
   })
 
-  test('requires the canonical OAuth credential ID rather than the UUID', () => {
+  test("returns the entry's own credential id verbatim", () => {
     const result = resolveCustodyHandle({
-      account: account({ id: 'uuid-not-a-label', label: 'alice' }),
+      account: account({ id: 'uuid-not-a-label', label: 'main' }),
       manifest: manifest({
         accounts: [
           {
-            label: 'alice',
+            label: 'main',
             handle: activeHandle,
-            credential_id: 'uuid-not-a-label',
+            credential_id: 'oauth:anthropic',
           },
         ],
       }),
     })
 
-    expectUnresolvedReason(result, 'missing-entry')
+    expect(result.status).toBe('resolved')
+    if (result.status !== 'resolved')
+      throw new Error('expected resolved handle')
+    expect(result.source).toBe('manifest')
+    if (result.source !== 'manifest')
+      throw new Error('expected manifest source')
+    expect(result.credentialId).toBe('oauth:anthropic')
+  })
+
+  test('marks every duplicate-label entry as corrupt-binding and refuses to resolve', () => {
+    const parsed = readCustodyHandles(
+      {
+        version: 1,
+        providers: [
+          {
+            provider: 'anthropic',
+            serve: 'anthropic-auth',
+            accounts: [
+              {
+                label: 'alice',
+                handle: activeHandle,
+                credential_id: 'oauth:anthropic:alice',
+              },
+              {
+                label: 'alice',
+                handle: otherHandle,
+                credential_id: 'oauth:anthropic:alice',
+              },
+            ],
+          },
+        ],
+      },
+      'anthropic',
+      'anthropic-auth',
+    )
+    expect(parsed.corruptLabels).toEqual(new Set(['alice']))
+    expect(parsed.accounts).toEqual([])
+
+    const result = resolveCustodyHandle({
+      account: account({ label: 'alice' }),
+      manifest: {
+        ...manifest(),
+        accounts: parsed.accounts,
+        corruptLabels: parsed.corruptLabels,
+      },
+    })
+    expectUnresolvedReason(result, 'corrupt-binding')
   })
 
   test('never falls back to legacy for a foreign serve', () => {
diff --git a/packages/opencode/src/tests/custody-mode-first-run.test.ts b/packages/opencode/src/tests/custody-mode-first-run.test.ts
index 34054dee..2d46d10f 100644
--- a/packages/opencode/src/tests/custody-mode-first-run.test.ts
+++ b/packages/opencode/src/tests/custody-mode-first-run.test.ts
@@ -3,6 +3,7 @@ import { access, mkdtemp, readFile, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { dirname, join } from 'node:path'
 import {
+  custodyCredentialId,
   custodyTombstoneOAuth,
   getAccountStatePath,
   loadAccounts,
@@ -771,6 +772,8 @@ describe('exit and terminating re-login', () => {
               main ? 'vault-main-access' : 'vault-fallback-access',
               main ? 3 : fallbackRecordVersion,
               20_000_000,
+              undefined,
+              main ? custodyCredentialId('main') : custodyCredentialId(label),
             )
           }),
         onFetch: (input) => {
diff --git a/packages/opencode/src/tests/custody-mode.test.ts b/packages/opencode/src/tests/custody-mode.test.ts
index cf6f33a5..0c634f37 100644
--- a/packages/opencode/src/tests/custody-mode.test.ts
+++ b/packages/opencode/src/tests/custody-mode.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, test } from 'bun:test'
-import { mkdtemp, readFile, rm } from 'node:fs/promises'
+import { mkdir, mkdtemp, readFile, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import * as core from '@cortexkit/anthropic-auth-core'
@@ -9,6 +9,7 @@ import {
 } from '../custody-live.ts'
 import {
   acquireCustodyTransitionLocks,
+  CUSTODY_PREFLIGHT_MIN_TTL_MS,
   CustodyLockBusyError,
   CustodyPreflightRefusedError,
   CustodyStateMismatchError,
@@ -167,7 +168,7 @@ describe('custody mode', () => {
       expect(cacheCalls).toEqual([
         {
           handle: manifestHandle,
-          minTtlMs: core.getRefreshBeforeExpiryMs(storage) + 30 * 60_000,
+          minTtlMs: CUSTODY_PREFLIGHT_MIN_TTL_MS,
         },
       ])
     } finally {
@@ -187,7 +188,6 @@ describe('custody mode', () => {
     const directory = await mkdtemp(join(tmpdir(), 'custody-live-adapter-'))
     const storagePath = join(directory, 'storage.json')
     const manifestPath = join(directory, 'handles.json')
-    const debugMessages: string[] = []
     try {
       await expect(
         core.writeCustodyHandleManifestEntry({
@@ -210,18 +210,16 @@ describe('custody mode', () => {
         storagePath,
         cache: {
           get: async (_handle, minTtlMs) => ({
-            payload: JSON.stringify({
-              access_token: 'vault-access',
-              refresh_token: 'vault-refresh',
-            }),
-            expiresAtMs: null,
+            credentialId: 'oauth:anthropic:x',
             recordVersion: 1,
-            accountId: 'vault-account',
+            access: 'vault-access',
+            refresh: 'vault-refresh',
+            expiresAt: null,
+            state: 'usable',
           }),
         },
         latestGetAuth: get,
         now,
-        debug: (message: string) => debugMessages.push(message),
       })
 
       const input = await deps.preflightInput(
@@ -231,14 +229,31 @@ describe('custody mode', () => {
       input.bindings[0]!.credentialId = 'oauth:anthropic:x'
       const plan = await preflightClaustrumTakeover(input)
       expect(plan).toMatchObject({ accounts: [{ id: 'main' }] })
-      expect(debugMessages).toEqual([
-        'custody identity check skipped: vault supplied no credential id',
-      ])
     } finally {
       await rm(directory, { recursive: true, force: true })
     }
   })
 
+  test('custody: preflight refuses when the vault omits a credential id', async () => {
+    const input = preflightInput({
+      cache: {
+        get: async (_handle: string, _minTtlMs: number) => ({
+          handle: 'handle-main',
+          recordVersion: 4,
+          access: 'vault-access',
+          refresh: 'vault-refresh',
+          expiresAt: Number.MAX_SAFE_INTEGER,
+          state: 'usable' as const,
+        }),
+      },
+    })
+
+    await expect(preflightClaustrumTakeover(input)).rejects.toMatchObject({
+      code: 'custody_preflight_refused',
+      reason: 'credential_identity_mismatch',
+    })
+  })
+
   test('custody: preflight verifies every account before any write', async () => {
     const cases = [
       {
@@ -395,11 +410,69 @@ describe('custody mode', () => {
       },
     })
 
-    await expect(preflightClaustrumTakeover(input)).rejects.toMatchObject({
-      code: 'custody_preflight_refused',
+    const error = await preflightClaustrumTakeover(input).catch(
+      (error: unknown) => error,
+    )
+    expect(error).toBeInstanceOf(CustodyPreflightRefusedError)
+    const serialized = (error as CustodyPreflightRefusedError).toJSON() as {
+      ok: boolean
+      accountId: string
+      reason: string
+      refusals: Array<{ label: string; reason: string; guidance?: unknown }>
+    }
+    expect(serialized).toMatchObject({
+      ok: false,
       accountId: 'main',
       reason: 'TAKEOVER_INCOMPLETE_MAIN_REAL',
     })
+    const guidance = serialized.refusals[0]?.guidance
+    expect(typeof guidance).toBe('string')
+    expect(guidance as string).toContain('ck auth mint-handle')
+    expect(guidance as string).not.toContain('migrate-plugin')
+  })
+
+  test('custody: preflight hands a small serving margin to cache.get even when expiry is far below the refresh floor', async () => {
+    const cacheCalls: Array<{ handle: string; minTtlMs: number }> = []
+    // Credential expires well beyond the small margin (5 min) but far below
+    // the previous 4.5 h refresh floor — the readiness check must accept it
+    // and ask the cache for a tiny min-t-tl, not rotate it.
+    const expiresAt = now + 60 * 60_000
+    const oldRefreshFloorMs =
+      core.getRefreshBeforeExpiryMs({
+        version: 1,
+        accounts: [],
+        refresh: { refreshBeforeExpiryMinutes: 240 },
+      }) +
+      30 * 60_000
+    const input = preflightInput({
+      storage: { refresh: { refreshBeforeExpiryMinutes: 240 } },
+      cache: {
+        get: async (handle: string, { minTtlMs }: { minTtlMs: number }) => {
+          cacheCalls.push({ handle, minTtlMs })
+          return {
+            credentialId:
+              handle === 'handle-main'
+                ? 'oauth:anthropic:main'
+                : 'oauth:anthropic:work',
+            recordVersion: 4,
+            access: `vault-secret-${handle}`,
+            refresh: `vault-refresh-${handle}`,
+            expiresAt,
+            state: 'usable' as const,
+          }
+        },
+      },
+    })
+
+    await expect(preflightClaustrumTakeover(input)).resolves.toMatchObject({
+      accounts: [{ id: 'main' }, { id: 'work' }],
+    })
+    for (const call of cacheCalls)
+      expect(call.minTtlMs).toBe(CUSTODY_PREFLIGHT_MIN_TTL_MS)
+    expect(cacheCalls).toHaveLength(2)
+    expect(cacheCalls.every((call) => call.minTtlMs < oldRefreshFloorMs)).toBe(
+      true,
+    )
   })
 
   test('custody: preflight refuses a tombstoned main without its manifest binding', async () => {
@@ -1273,3 +1346,132 @@ describe('custody mode', () => {
     expect(calls).toEqual(['local'])
   })
 })
+
+describe('custody end-to-end binding', () => {
+  test('writes, resolves, preflights, removes, and local-exits a non-derived credential id for main', async () => {
+    const directory = await mkdtemp(join(tmpdir(), 'custody-e2e-'))
+    const parent = join(directory, 'manifest')
+    const manifestPath = join(parent, 'handles.json')
+    const storagePath = join(directory, 'storage.json')
+    await mkdir(parent, { mode: 0o700 })
+    const handle = `ckh_${'M'.repeat(43)}`
+    const access = 'local-access'
+    const refresh = 'local-refresh'
+    try {
+      // 1) Real writer accepts a non-derived id and stores it verbatim.
+      const writeResult = await core.writeCustodyHandleManifestEntry({
+        path: manifestPath,
+        entry: {
+          label: 'main',
+          handle,
+          credentialId: 'oauth:anthropic',
+        },
+      })
+      expect(writeResult).toEqual({ status: 'written' })
+
+      // 2) Real reader + resolver carry the id back, no derivation.
+      const reader = new core.CustodyHandleManifestReader({
+        path: manifestPath,
+        provider: 'anthropic',
+        serve: 'anthropic-auth',
+      })
+      const manifestResult = await reader.read()
+      expect(manifestResult.status).toBe('ready')
+      if (manifestResult.status !== 'ready') throw new Error('not ready')
+      const resolution = core.resolveCustodyHandle({
+        account: {
+          id: 'main',
+          label: 'main',
+          type: 'oauth',
+          refresh: '',
+        },
+        manifest: manifestResult.manifest,
+      })
+      expect(resolution.status).toBe('resolved')
+      if (resolution.status !== 'resolved') throw new Error('not resolved')
+      expect(resolution.source).toBe('manifest')
+      if (resolution.source !== 'manifest') throw new Error('not manifest')
+      expect(resolution.credentialId).toBe('oauth:anthropic')
+
+      // 3) Real binding construction (mirrors `readBindings` and the index.ts
+      // ~8763/4636 sites): use the resolved id verbatim, derive only as a
+      // legacy-source fallback.
+      const bindingCredentialId =
+        resolution.source === 'manifest'
+          ? (resolution.credentialId ?? core.custodyCredentialId('main'))
+          : core.custodyCredentialId('main')
+
+      // 4) Real preflight, cache stub returning the same id.
+      const plan = await preflightClaustrumTakeover({
+        now,
+        storage: { refresh: { refreshBeforeExpiryMinutes: 5 } },
+        main: { id: 'main', label: 'main', enabled: true },
+        fallbacks: [],
+        hostAuth: { get: () => core.custodyTombstoneOAuth('anthropic') },
+        bindings: [
+          {
+            accountId: 'main',
+            label: 'main',
+            handle: resolution.handle,
+            credentialId: bindingCredentialId,
+            source: resolution.source,
+          },
+        ],
+        cache: {
+          get: async (_h, _opts) => ({
+            credentialId: 'oauth:anthropic',
+            recordVersion: 4,
+            access: 'vault-access',
+            refresh: 'vault-refresh',
+            expiresAt: now + 60 * 60_000,
+            state: 'usable' as const,
+          }),
+        },
+      })
+      expect(plan.accounts).toHaveLength(1)
+      expect(plan.accounts[0]?.credentialId).toBe('oauth:anthropic')
+      expect(plan.accounts[0]?.handle).toBe(handle)
+
+      // 5) Real local-exit path: persist a labelled main account, drive
+      // acknowledgeLocalOAuthLoginFromStorage with a completion credentialId
+      // keyed off the manifest resolution, and assert the binding is cleared.
+      await core.saveAccounts(
+        {
+          version: 1,
+          accounts: [
+            {
+              id: 'main',
+              label: 'main',
+              type: 'oauth',
+              access,
+              refresh,
+              enabled: true,
+            },
+          ],
+        },
+        storagePath,
+      )
+      const { acknowledgeLocalOAuthLoginFromStorage, localAuthFingerprint } =
+        await import('../local-login.ts')
+      const exitResult = await acknowledgeLocalOAuthLoginFromStorage(
+        {
+          accountId: 'main',
+          credentialId: bindingCredentialId,
+          authFingerprint: localAuthFingerprint(access, refresh),
+          completedAt: now,
+        },
+        {
+          accountStoragePath: storagePath,
+          manifestPath,
+        },
+      )
+      expect(exitResult).toBe('cleared')
+      const reloaded = await reader.read()
+      expect(reloaded.status).toBe('ready')
+      if (reloaded.status !== 'ready') throw new Error('not ready')
+      expect(reloaded.manifest.accounts).toEqual([])
+    } finally {
+      await rm(directory, { recursive: true, force: true })
+    }
+  })
+})
diff --git a/packages/opencode/src/tests/custody-ruled-row.fixture.ts b/packages/opencode/src/tests/custody-ruled-row.fixture.ts
index 4340e9af..d97f2dfd 100644
--- a/packages/opencode/src/tests/custody-ruled-row.fixture.ts
+++ b/packages/opencode/src/tests/custody-ruled-row.fixture.ts
@@ -68,6 +68,7 @@ export function credentialResponse(
   recordVersion: number,
   expiresAtMs = Date.now() + 60_000,
   accountId?: string,
+  credentialId?: string,
 ) {
   return {
     result: {
@@ -77,6 +78,7 @@ export function credentialResponse(
       expires_at_ms: expiresAtMs,
       record_version: recordVersion,
       ...(accountId && { account_id: accountId }),
+      ...(credentialId && { credential_id: credentialId }),
     },
   }
 }
@@ -123,6 +125,14 @@ export async function writeManifest(
         {
           provider: 'anthropic',
           serve,
+          // Label-derived ids are a fixture convenience, not main's real shape.
+          // The vault holds exactly two anthropic credentials: the UNLABELLED
+          // `oauth:anthropic` (main) and `oauth:anthropic:work-alt`. Nothing about a
+          // production binding derives from the label — the manifest carries whatever
+          // id the handle was minted against, and the runtime fence compares it with
+          // what `credential.get` returns. Provider scoping only requires the second
+          // segment to be `anthropic`, so a labelled id is valid here and would still
+          // mismatch the vault in production. Read this before inferring a shape.
           accounts: entries.map(({ label, handle }) => ({
             label,
             handle,
diff --git a/packages/opencode/src/tests/custody-source-deps.test.ts b/packages/opencode/src/tests/custody-source-deps.test.ts
index 4477edf5..62d363a3 100644
--- a/packages/opencode/src/tests/custody-source-deps.test.ts
+++ b/packages/opencode/src/tests/custody-source-deps.test.ts
@@ -12,9 +12,9 @@ const productionFiles = [
 ]
 
 const allowedGuidance = [
-  "Onboard the main account into the Claustrum vault with Claustrum's tooling (see its runbook) before retrying.",
+  'Mint a handle with `ck auth mint-handle`; this plugin then writes the manifest entry.',
   'Claustrum main credential requires re-import; run ck auth import --replace.',
-  "Claustrum main binding is not active while local main material remains; onboard main into the vault with Claustrum's tooling first.",
+  'Claustrum main binding is not active while local main material remains; mint a handle with `ck auth mint-handle` so this plugin can write the manifest entry.',
   'Claustrum main credential identity differs from the persisted main identity; run ck auth set-identity.',
 ]
 const forbidden = [
diff --git a/packages/opencode/src/tests/custody-tombstone.test.ts b/packages/opencode/src/tests/custody-tombstone.test.ts
index 59677e1a..b11079e3 100644
--- a/packages/opencode/src/tests/custody-tombstone.test.ts
+++ b/packages/opencode/src/tests/custody-tombstone.test.ts
@@ -392,9 +392,11 @@ describe('Claustrum custody tombstones', () => {
     if (!anthropic) throw new Error('missing anthropic fixture')
     const account = anthropic.accounts[0]
     if (!account) throw new Error('missing anthropic account fixture')
-    const missingHandle = { ...account }
+    const missingHandle: Record<string, unknown> = { ...account }
+    missingHandle.label = 'missing-handle'
     delete missingHandle.handle
-    const missingCredentialId = { ...account }
+    const missingCredentialId: Record<string, unknown> = { ...account }
+    missingCredentialId.label = 'missing-credential-id'
     delete missingCredentialId.credential_id
     anthropic.accounts = [
       missingHandle,
@@ -407,11 +409,13 @@ describe('Claustrum custody tombstones', () => {
       oauthFixture.provider,
       'anthropic-auth',
     )
-    expect(parsed.corruptLabels).toEqual(new Set([String(account.label)]))
+    expect(parsed.corruptLabels).toEqual(
+      new Set(['missing-handle', 'missing-credential-id']),
+    )
     expect(parsed.accounts).toHaveLength(1)
   })
 
-  test('marks non-canonical credential IDs as corrupt bindings', () => {
+  test('accepts a non-canonical credential ID and carries it verbatim', () => {
     const fixture = structuredClone(handlesFixture) as {
       providers: Array<{
         provider: string
@@ -424,7 +428,35 @@ describe('Claustrum custody tombstones', () => {
     if (!anthropic) throw new Error('missing anthropic fixture')
     const account = anthropic.accounts[0]
     if (!account) throw new Error('missing anthropic account fixture')
-    anthropic.accounts = [{ ...account, credential_id: 'wrong' }]
+    anthropic.accounts = [{ ...account, credential_id: 'oauth:anthropic' }]
+
+    const parsed = readCustodyHandles(
+      fixture,
+      oauthFixture.provider,
+      'anthropic-auth',
+    )
+    expect(parsed.corruptLabels).toEqual(new Set())
+    expect(parsed.accounts).toHaveLength(1)
+    expect(parsed.accounts[0]?.credentialId).toBe('oauth:anthropic')
+  })
+
+  test('marks every duplicate-label entry as corrupt', () => {
+    const fixture = structuredClone(handlesFixture) as {
+      providers: Array<{
+        provider: string
+        accounts: Array<Record<string, unknown>>
+      }>
+    }
+    const anthropic = fixture.providers.find(
+      (provider) => provider.provider === oauthFixture.provider,
+    )
+    if (!anthropic) throw new Error('missing anthropic fixture')
+    const account = anthropic.accounts[0]
+    if (!account) throw new Error('missing anthropic account fixture')
+    anthropic.accounts = [
+      { ...account, credential_id: 'oauth:anthropic:a' },
+      { ...account, credential_id: 'oauth:anthropic:b' },
+    ]
 
     const parsed = readCustodyHandles(
       fixture,
@@ -432,6 +464,7 @@ describe('Claustrum custody tombstones', () => {
       'anthropic-auth',
     )
     expect(parsed.corruptLabels).toEqual(new Set([String(account.label)]))
+    expect(parsed.accounts).toEqual([])
   })
 
   test('throws when the requested provider is absent', () => {
diff --git a/packages/opencode/src/tests/index.test.ts b/packages/opencode/src/tests/index.test.ts
index 16b6db32..40b58a76 100644
--- a/packages/opencode/src/tests/index.test.ts
+++ b/packages/opencode/src/tests/index.test.ts
@@ -734,6 +734,26 @@ async function getPlugin(
   return plugin
 }
 
+async function withoutClaustrumWarmupDeadline<T>(
+  fn: () => Promise<T>,
+): Promise<T> {
+  const originalSetTimeout = globalThis.setTimeout
+  const setTimeoutImpl = ((
+    ...arguments_: Parameters<typeof globalThis.setTimeout>
+  ) =>
+    arguments_[1] === 100
+      ? ({ unref() {} } as ReturnType<typeof globalThis.setTimeout>)
+      : originalSetTimeout(...arguments_)) as typeof globalThis.setTimeout
+  const setTimeoutSpy = spyOn(globalThis, 'setTimeout').mockImplementation(
+    setTimeoutImpl,
+  )
+  try {
+    return await fn()
+  } finally {
+    setTimeoutSpy.mockRestore()
+  }
+}
+
 function installRelayResponseStart(
   status: number,
   errorEvent?: { status?: number; message?: string },
@@ -2442,12 +2462,14 @@ describe('fallback Claustrum credential resolution', () => {
         },
       )
       try {
-        const plugin = await getPlugin(undefined, undefined, {
-          claustrumConnector: manifestConnector(
-            [],
-            new Map([[legacyHandle, 'migration-order-access']]),
-          ),
-        })
+        const plugin = await withoutClaustrumWarmupDeadline(() =>
+          getPlugin(undefined, undefined, {
+            claustrumConnector: manifestConnector(
+              [],
+              new Map([[legacyHandle, 'migration-order-access']]),
+            ),
+          }),
+        )
         expect(stateAtManifestWrite).toContain(legacyHandle)
         expect(await readFile(accountStatePath, 'utf8')).not.toContain(
           legacyHandle,
@@ -2588,11 +2610,16 @@ describe('fallback Claustrum credential resolution', () => {
     },
   )
 
-  async function withShortManifestLockTiming<T>(fn: () => Promise<T>) {
+  async function withFixedManifestLockClock<T>(
+    fn: () => Promise<T>,
+    now?: () => number,
+  ) {
+    const fixedNow = Date.now()
     __setCustodyManifestLockTestOptions({
       ttlMs: 150,
       retryMinMs: 5,
       retryMaxMs: 5,
+      now: now ?? (() => fixedNow),
     })
     try {
       return await fn()
@@ -2621,14 +2648,16 @@ describe('fallback Claustrum credential resolution', () => {
     const manifestPath = await writeManifest([])
     const restore = await configureClaustrumConnection()
     const calls: CredentialCall[] = []
-    const plugin = await getPlugin(undefined, undefined, {
-      claustrumConnector:
-        input.connector?.(calls) ??
-        manifestConnector(
-          calls,
-          new Map([[input.handle, `${input.label}-access`]]),
-        ),
-    })
+    const plugin = await withoutClaustrumWarmupDeadline(() =>
+      getPlugin(undefined, undefined, {
+        claustrumConnector:
+          input.connector?.(calls) ??
+          manifestConnector(
+            calls,
+            new Map([[input.handle, `${input.label}-access`]]),
+          ),
+      }),
+    )
     return { calls, manifestPath, plugin, restore }
   }
 
@@ -2671,12 +2700,14 @@ describe('fallback Claustrum credential resolution', () => {
       const manifestPath = await writeManifest([])
       const restore = await configureClaustrumConnection()
       const calls: CredentialCall[] = []
-      const plugin = await getPlugin(undefined, undefined, {
-        claustrumConnector: manifestConnector(
-          calls,
-          new Map([[legacyHandle, 'retry-migration-access']]),
-        ),
-      })
+      const plugin = await withoutClaustrumWarmupDeadline(() =>
+        getPlugin(undefined, undefined, {
+          claustrumConnector: manifestConnector(
+            calls,
+            new Map([[legacyHandle, 'retry-migration-access']]),
+          ),
+        }),
+      )
       try {
         await plugin.__fallbackRefreshReady
         expect(
@@ -2820,72 +2851,59 @@ describe('fallback Claustrum credential resolution', () => {
   test.serial(
     'reports a corrupt manifest lock after its bounded wait and keeps the legacy handle',
     async () => {
-      await withShortManifestLockTiming(async () => {
-        await useTempAccountFile(
-          manifestStorage({ label: 'fresh-lock', legacy: legacyHandle }),
-        )
-        const manifestPath = await writeManifest([])
-        const restore = await configureClaustrumConnection()
-        const lockPath = `${manifestPath}.lock`
-        await mkdir(lockPath, { mode: 0o700 })
-        await writeFile(
-          join(lockPath, 'owner'),
-          `${JSON.stringify({ claimed_at_ms: Date.now(), tenant: 'test' })}\n`,
-        )
-        const logs: LogTestRecord[] = []
-        __setLogTestSink((record) => logs.push(record))
-        const startedAt = Date.now()
-        let plugin: Awaited<ReturnType<typeof getPlugin>> | undefined
-        try {
-          plugin = await Promise.race([
-            getPlugin(undefined, undefined, {
-              claustrumConnector: manifestConnector(
-                [],
-                new Map([[legacyHandle, 'fresh-lock-access']]),
-              ),
-            }),
-            Bun.sleep(1_000).then(() => {
-              throw new Error('manifest lock busy did not respect its deadline')
-            }),
-          ])
-          for (let attempt = 0; attempt < 100; attempt++) {
-            if (
+      const times = [0, 150]
+      let timeIndex = 0
+      await withFixedManifestLockClock(
+        async () => {
+          await useTempAccountFile(
+            manifestStorage({ label: 'fresh-lock', legacy: legacyHandle }),
+          )
+          const manifestPath = await writeManifest([])
+          const restore = await configureClaustrumConnection()
+          const lockPath = `${manifestPath}.lock`
+          await mkdir(lockPath, { mode: 0o700 })
+          await writeFile(
+            join(lockPath, 'owner'),
+            `${JSON.stringify({ claimed_at_ms: 0, tenant: 'test' })}\n`,
+          )
+          const logs: LogTestRecord[] = []
+          __setLogTestSink((record) => logs.push(record))
+          let plugin: Awaited<ReturnType<typeof getPlugin>> | undefined
+          try {
+            plugin = await withoutClaustrumWarmupDeadline(() =>
+              getPlugin(undefined, undefined, {
+                claustrumConnector: manifestConnector(
+                  [],
+                  new Map([[legacyHandle, 'fresh-lock-access']]),
+                ),
+              }),
+            )
+            expect(
               logs.some(
                 (record) =>
                   record.message === 'manifest write failed' &&
                   record.payload?.reason === 'manifest lock owner invalid',
-              )
-            )
-              break
-            await Bun.sleep(10)
+              ),
+            ).toBe(true)
+            expect(
+              await readFile(
+                getAccountStatePath(process.env.OPENCODE_ANTHROPIC_AUTH_FILE!),
+                'utf8',
+              ),
+            ).toContain(legacyHandle)
+          } finally {
+            __setLogTestSink(null)
+            await plugin?.dispose?.()
+            restore()
           }
-          const elapsedMs = Date.now() - startedAt
-          expect(elapsedMs).toBeGreaterThanOrEqual(120)
-          expect(elapsedMs).toBeLessThan(1_000)
-          expect(
-            logs.some(
-              (record) =>
-                record.message === 'manifest write failed' &&
-                record.payload?.reason === 'manifest lock owner invalid',
-            ),
-          ).toBe(true)
-          expect(
-            await readFile(
-              getAccountStatePath(process.env.OPENCODE_ANTHROPIC_AUTH_FILE!),
-              'utf8',
-            ),
-          ).toContain(legacyHandle)
-        } finally {
-          __setLogTestSink(null)
-          await plugin?.dispose?.()
-          restore()
-        }
-      })
+        },
+        () => times[Math.min(timeIndex++, times.length - 1)]!,
+      )
     },
   )
 
   test.serial('renames a stale manifest lock before writing', async () => {
-    await withShortManifestLockTiming(async () => {
+    await withFixedManifestLockClock(async () => {
       await useTempAccountFile(
         manifestStorage({ label: 'stale-lock', legacy: legacyHandle }),
       )
@@ -2945,12 +2963,14 @@ describe('fallback Claustrum credential resolution', () => {
         },
       )
       try {
-        const plugin = await getPlugin(undefined, undefined, {
-          claustrumConnector: manifestConnector(
-            [],
-            new Map([[legacyHandle, 'lock-owner-access']]),
-          ),
-        })
+        const plugin = await withoutClaustrumWarmupDeadline(() =>
+          getPlugin(undefined, undefined, {
+            claustrumConnector: manifestConnector(
+              [],
+              new Map([[legacyHandle, 'lock-owner-access']]),
+            ),
+          }),
+        )
         expect(owner).toMatchObject({ tenant: 'anthropic-auth' })
         expect(typeof owner?.claimed_at_ms).toBe('number')
         await expect(fs.stat(lockPath)).rejects.toThrow()
@@ -2966,7 +2986,7 @@ describe('fallback Claustrum credential resolution', () => {
   test.serial(
     'preserves two concurrent legacy migrations in one manifest',
     async () => {
-      await withShortManifestLockTiming(async () => {
+      await withFixedManifestLockClock(async () => {
         const storageA = fallbackWithClaustrum({
           id: 'fallback-a',
           label: 'migration-a',
@@ -2976,8 +2996,10 @@ describe('fallback Claustrum credential resolution', () => {
         })
         await useTempAccountFile(storageA)
         const accountPathA = process.env.OPENCODE_ANTHROPIC_AUTH_FILE!
+        const accountPathB = join(tempConfigDir!, 'anthropic-auth-b.json')
         const manifestPath = await writeManifest([])
         const restore = await configureClaustrumConnection()
+        const firstEntered = deferred()
         const entered = deferred()
         const release = deferred()
         let credentialGets = 0
@@ -2988,6 +3010,7 @@ describe('fallback Claustrum credential resolution', () => {
             if (method !== 'credential.get')
               throw new Error(`unexpected method: ${method}`)
             credentialGets += 1
+            if (credentialGets === 1) firstEntered.resolve()
             if (credentialGets === 2) entered.resolve()
             await release.promise
             return credentialResponse(
@@ -2996,27 +3019,8 @@ describe('fallback Claustrum credential resolution', () => {
             )
           },
         )
-        const pluginA = await getPlugin(undefined, undefined, {
-          claustrumConnector: concurrentConnector,
-        })
-
-        const accountPathB = join(tempConfigDir!, 'anthropic-auth-b.json')
-        const storageB = fallbackWithClaustrum({
-          id: 'fallback-b',
-          label: 'migration-b',
-          enabled: true,
-          claustrumHandle: `ckh_${'B'.repeat(43)}`,
-          claustrum: { mode: 'claustrum' },
-        })
-        await saveAccounts(storageB, accountPathB)
-        process.env.OPENCODE_ANTHROPIC_AUTH_FILE = accountPathB
-        process.env.OPENCODE_ANTHROPIC_AUTH_SIDEBAR_STATE_FILE = join(
-          tempConfigDir!,
-          'sidebar-state-b.json',
-        )
-        const pluginB = await getPlugin(undefined, undefined, {
-          claustrumConnector: concurrentConnector,
-        })
+        let pluginA: Awaited<ReturnType<typeof getPlugin>> | undefined
+        let pluginB: Awaited<ReturnType<typeof getPlugin>> | undefined
         const originalRename = fs.rename
         const secondManifestRename = deferred()
         let manifestRenames = 0
@@ -3032,21 +3036,36 @@ describe('fallback Claustrum credential resolution', () => {
           },
         )
         try {
-          await Promise.race([
-            entered.promise,
-            Bun.sleep(1_000).then(() => {
-              throw new Error(
-                `concurrent credential calls did not both start (${credentialGets})`,
-              )
-            }),
-          ])
-          release.resolve()
-          await Promise.race([
-            secondManifestRename.promise,
-            Bun.sleep(1_000).then(() => {
-              throw new Error('concurrent migrations did not finish')
-            }),
-          ])
+          await withoutClaustrumWarmupDeadline(async () => {
+            const pluginAPromise = getPlugin(undefined, undefined, {
+              claustrumConnector: concurrentConnector,
+            })
+            await firstEntered.promise
+
+            const storageB = fallbackWithClaustrum({
+              id: 'fallback-b',
+              label: 'migration-b',
+              enabled: true,
+              claustrumHandle: `ckh_${'B'.repeat(43)}`,
+              claustrum: { mode: 'claustrum' },
+            })
+            await saveAccounts(storageB, accountPathB)
+            process.env.OPENCODE_ANTHROPIC_AUTH_FILE = accountPathB
+            process.env.OPENCODE_ANTHROPIC_AUTH_SIDEBAR_STATE_FILE = join(
+              tempConfigDir!,
+              'sidebar-state-b.json',
+            )
+            const pluginBPromise = getPlugin(undefined, undefined, {
+              claustrumConnector: concurrentConnector,
+            })
+            await entered.promise
+            release.resolve()
+            ;[pluginA, pluginB] = await Promise.all([
+              pluginAPromise,
+              pluginBPromise,
+            ])
+          })
+          await secondManifestRename.promise
           const manifest = JSON.parse(await readFile(manifestPath, 'utf8')) as {
             providers: Array<{
               provider: string
@@ -3065,8 +3084,8 @@ describe('fallback Claustrum credential resolution', () => {
           ])
         } finally {
           rename.mockRestore()
-          await pluginA.dispose?.()
-          await pluginB.dispose?.()
+          await pluginA?.dispose?.()
+          await pluginB?.dispose?.()
           restore()
         }
       })
@@ -19021,6 +19040,13 @@ describe('auth.loader', () => {
         return {}
       },
     )
+    const switchNoticeCompletion = deferred()
+    let holdSwitchNotice = true
+    mockClient.session.promptAsync = mock(async () => {
+      if (!holdSwitchNotice) return
+      holdSwitchNotice = false
+      await switchNoticeCompletion.promise
+    })
     const plugin = await getPlugin(mockClient)
     const result = await plugin.auth.loader(
       () =>
@@ -19353,6 +19379,38 @@ describe('auth.loader', () => {
     await restored.text()
     expect(normalModels.at(-1)).toBe('claude-fable-5')
 
+    await waitForSidebarState((state) =>
+      Boolean(
+        state.fableRecoveries?.some(
+          (recovery) =>
+            recovery.sessionId === 'ses_fable_filter' &&
+            recovery.mode === 'fable',
+        ),
+      ),
+    )
+    await plugin.event?.({
+      event: {
+        type: 'message.updated',
+        properties: {
+          info: {
+            id: switchNotificationMessageId,
+            sessionID: 'ses_fable_filter',
+            role: 'user',
+          },
+        },
+      },
+    })
+    await plugin.event?.({
+      event: {
+        type: 'session.status',
+        properties: {
+          sessionID: 'ses_fable_filter',
+          status: { type: 'busy' },
+        },
+      },
+    })
+    switchNoticeCompletion.resolve()
+
     await waitForMockCall({
       mock: {
         get calls() {
diff --git a/packages/opencode/src/tests/oauth-callback-corrupt-store.test.ts b/packages/opencode/src/tests/oauth-callback-corrupt-store.test.ts
new file mode 100644
index 00000000..00bfc9ca
--- /dev/null
+++ b/packages/opencode/src/tests/oauth-callback-corrupt-store.test.ts
@@ -0,0 +1,116 @@
+import { afterEach, beforeEach, describe, expect, mock, test } from 'bun:test'
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+import { AnthropicAuthPlugin } from '../index'
+import { extractUrl, TOKEN_URL } from './test-fetch'
+
+// House pattern: stub `globalThis.fetch` to answer `TOKEN_URL` with the
+// exchange result the callback under test consumes. A previous revision of
+// this test replaced the core module wholesale; Bun's runtime cannot undo
+// that replacement from `afterAll`, so the stub leaked into later files in
+// the same process and answered another suite's exchange. The repo records
+// the same lesson at `accounts.test.ts:6396` (Bun's `mock.restore()` does
+// not undo a module-level replacement registered with the runtime's module
+// mocking API). Stubbing `fetch` avoids the leak entirely — the real
+// `exchange()` reads its result from the global fetch.
+//
+// Captured at module load (after `setup.ts` has installed the guarded fetch);
+// restored after every test so the global `afterEach` in `setup.ts` never sees
+// a leaked fetch mock and throws.
+const originalFetch = globalThis.fetch
+
+describe('OAuth exchange callback — corrupt account store between authorize() and callback()', () => {
+  let tempDir: string
+  let accountPath: string
+  const previousEnv: Record<string, string | undefined> = {}
+
+  beforeEach(async () => {
+    tempDir = await mkdtemp(join(tmpdir(), 'oauth-callback-corrupt-'))
+    accountPath = join(tempDir, 'anthropic-auth.json')
+    previousEnv.OPENCODE_ANTHROPIC_AUTH_FILE =
+      process.env.OPENCODE_ANTHROPIC_AUTH_FILE
+    process.env.OPENCODE_ANTHROPIC_AUTH_FILE = accountPath
+  })
+
+  afterEach(async () => {
+    await rm(tempDir, { recursive: true, force: true })
+    if (previousEnv.OPENCODE_ANTHROPIC_AUTH_FILE === undefined) {
+      delete process.env.OPENCODE_ANTHROPIC_AUTH_FILE
+    } else {
+      process.env.OPENCODE_ANTHROPIC_AUTH_FILE =
+        previousEnv.OPENCODE_ANTHROPIC_AUTH_FILE
+    }
+    globalThis.fetch = originalFetch
+  })
+
+  test('returns the exchanged credentials even when the account file is unreadable/malformed at callback time', async () => {
+    // No file present yet — plugin init must succeed and authorize() must
+    // pass its own loadAccounts-based claustrum-mode check (line ~8751).
+    globalThis.fetch = mock((input: unknown) => {
+      const url = extractUrl(input as string | URL | Request)
+      if (url === TOKEN_URL) {
+        return Promise.resolve(
+          Response.json({
+            access_token: 'exchanged-access',
+            refresh_token: 'exchanged-refresh',
+            expires_in: 3600,
+          }),
+        )
+      }
+      return Promise.resolve(new Response('{}', { status: 200 }))
+    }) as unknown as typeof fetch
+
+    const plugin = (await (
+      AnthropicAuthPlugin as unknown as (
+        context: unknown,
+        runtime: unknown,
+      ) => Promise<any>
+    )(
+      {
+        client: {
+          auth: { set: mock(() => Promise.resolve()) },
+          session: { promptAsync: mock(() => Promise.resolve()) },
+        },
+      },
+      {
+        authorize: async () => ({
+          url: 'https://example.com/oauth/authorize',
+          verifier: 'test-verifier',
+          redirectUri: 'https://example.com/callback',
+          state: 'test-state',
+        }),
+        setInterval: mock(
+          () => ({ unref() {} }) as unknown as ReturnType<typeof setInterval>,
+        ) as unknown as typeof setInterval,
+        clearInterval: mock(() => {}) as unknown as typeof clearInterval,
+      },
+    )) as any
+
+    const method = plugin.auth.methods.find(
+      (m: { label?: string }) => m.label === 'Claude Pro/Max',
+    )
+    expect(method).toBeDefined()
+    const flow = await method.authorize()
+    expect(flow.callback).toBeDefined()
+
+    // Corrupt the account store AFTER authorize() returned its flow, but
+    // BEFORE the user pastes their code. This is the re-login recovery
+    // scenario the original bug describes: a partially-written or corrupt
+    // file at the moment the callback reads it.
+    await writeFile(accountPath, '{not valid json', 'utf8')
+
+    // Discriminate the failure mode: the bug rejects the callback with the
+    // loadAccounts error, which loses the exchanged credentials. The fix
+    // must return the exchange result to the caller.
+    const result = await flow.callback('code=user-code&state=test-state')
+
+    expect(result).toBeDefined()
+    expect(result.type).toBe('success')
+    if (result.type === 'success') {
+      expect(result.access).toBe('exchanged-access')
+      expect(result.refresh).toBe('exchanged-refresh')
+    }
+  })
+})