diff --git a/agent-builder/.claude/context.md b/agent-builder/.claude/context.md
index 868d16b..8df526f 100644
--- a/agent-builder/.claude/context.md
+++ b/agent-builder/.claude/context.md
@@ -172,11 +172,26 @@ Coolify service UUID: `ilus0cfdkheipodw1viurg1d`
 - pull_policy: never removed from docker-compose.yml (was server-01 workaround, no longer needed on primary)
 - docker_compose_raw in Coolify DB must be updated via `docker cp` + `psql -f` for reliability
 
+**June 22 session 4 facts:**
+- E2E tests all passed: bridge_health_check (sandbox+prod), n8n_workflow_list (12 workflows), vault_secret_exists, vault_secret_write ✅
+- proxy path format: callers pass RELATIVE path (e.g. `n8n`, `e2e-test`) — proxy prepends `secret/data/` automatically
+- params go inside a `params: {}` object in the POST body (not at top level)
+- iptables DNAT rule persisted: /etc/iptables/rules.v4 saved, /etc/sysctl.d/99-local-routing.conf written ✅
+  - iptables-persistent + netfilter-persistent already installed
+  - Used sudo-bridge (port 8082 on 192.168.1.88) with new bash -c allowlist entries
+- POST /allowlist + GET /allowlist endpoints added to sudo-bridge ✅
+  - Validates tier (1/2), rejects danger-pattern matches, 409 on duplicate
+  - Writes to allowlist.json on disk (daemon reloads per-request — no restart needed)
+  - Audits to JSONL + Postgres, sends NTFY notification
+  - New image built, pushed to gitea.local, Coolify start called via proxy shell + env_secret injection
+- sudo-bridge port: 8082 on 192.168.1.88 (LAN), container name: sudo-bridge-drbjegv07256ki2lpfyr00n8
+- Coolify API from within Docker network: http://172.16.16.30:8080/api/v1/ (not 172.16.16.35)
+- Coolify token: vault://coolify#api_key (field name is api_key)
+- To call Coolify API from proxy: use /shell with env_secrets: {"TOKEN": "vault://coolify#api_key"}
+- sudo-bridge image rebuild pattern: build → push to gitea.local → stop container → POST /api/v1/services/{uuid}/start
+
 **NEXT SESSION — in order:**
-1. E2E tests: bridge_health_check, n8n_workflow_list, vault_secret_exists, vault_secret_write (all via `https://secrets-proxy.reverseproxyserver.net/exec`)
-2. Persist iptables DNAT rule on primary (iptables-persistent or systemd unit)
-3. Add POST /allowlist endpoint to sudo bridge
-4. id=24 Agent Builder Agent + id=67 N8N Builder Agent
+1. id=24 Agent Builder Agent + id=67 N8N Builder Agent
 
 - Bitwarden bridge LAN-exposed: 192.168.1.88:8083 ✅