diff --git a/agent-builder/.claude/context.md b/agent-builder/.claude/context.md
index e90c1e6..2476c4b 100644
--- a/agent-builder/.claude/context.md
+++ b/agent-builder/.claude/context.md
@@ -357,6 +357,27 @@ Build, test, and push both builder agents to production. Work as long as it take
 **Next session first task:** id=147 Phase 2 — Coolify retirement
 1. Migrate N8N env var rotation workflows from Coolify API → Vault
 2. Create Gitea repo for Traefik config (boilerplates entry + repo)
+
+### 2026-06-24 Sprint Day 7 facts
+- id=147 Phase 2 IN PROGRESS — N8N workflows migrated, Coolify stopped on primary
+- N8N rotation workflow changes (committed e28a3fe in docker-compose repo):
+  - DB_Password_Rotation: removed Read Vault Coolify Key + 10 Coolify PATCH/Deploy nodes; rewired ALTER → Vault Write directly
+  - Admin_UI_Password_Rotation: removed Read Vault Coolify node only (coolify_key was loaded but never called Coolify API)
+  - App_Token_Rotation: removed Read Vault Coolify + 19 Coolify PATCH/Deploy nodes; rewired DELETE JF Old Key → NTFY directly
+  - All 3 imported to sandbox N8N (192.168.1.90:5679): IDs o8zxdYbY4Y6JRTEy, 1mM1rC9n2HjHPpJf, lDVXyar70e0w3fs9
+  - Status: NOT YET TESTED in sandbox — services pick up rotated values on next Jenkins redeploy
+- Coolify containers stopped on primary: coolify, coolify-realtime, coolify-redis, coolify-db, coolify-sentinel
+- All 21 routes verified live post-shutdown
+- New behavior rule: feedback_n8n_json_first.md — always edit workflow JSONs in git repo, import to sandbox for testing; never edit in N8N UI
+- N8N playbook updated: JSON-first rule added, workflow status reset to NOT YET TESTED, secret/data/coolify removed from Vault paths
+- sudo-bridge /exec endpoint confirmed (was using wrong /execute, /run); POST /exec is correct
+- Vault paths no longer needed by N8N: secret/data/coolify (rotation workflows no longer call Coolify API)
+
+**Next session first task:** id=147 Phase 2 — remaining steps
+1. Remove coolify.yaml from /data/coolify/proxy/dynamic/ (via sudo-bridge POST /exec — needs Vault auth for bridge key)
+2. Check server-01 Coolify containers (expected: just coolify-proxy which is already replaced by standalone Traefik)
+3. Create Gitea repo for Traefik config + boilerplates entry
+4. Verify 90-day rotation workflow dry run in sandbox with Coolify nodes removed
 3. Shut down Coolify stack on primary (coolify, coolify-realtime, coolify-redis, coolify-db)
 4. Shut down Coolify stack on server-01
 5. Verify all routes still live after Coolify gone