diff --git a/agent-builder/.claude/context.md b/agent-builder/.claude/context.md
index 605a922..868d16b 100644
--- a/agent-builder/.claude/context.md
+++ b/agent-builder/.claude/context.md
@@ -154,25 +154,29 @@ All sandbox prereqs done. Sandbox mirrors production.
 - n8n_agent_worker postgres role — api_business DB, scoped to automation_ideas + agent_test_results
 - Credential in production Vault: secret/postgres/n8n-agent-worker
 
-### id=51 — MIGRATING TO PRIMARY (June 22 session 2)
-**Decision: move proxy from server-01 → primary server.** Reasons: security infrastructure (not a test workload), Claude Code runs on primary, all deps (Vault, bridge, N8N, ntfy) already local. Cloudflare route stays `http://coolify-proxy:80`.
+### id=51 — DEPLOYED ON PRIMARY ✅ (June 22 session 3)
+Container running healthy at `https://secrets-proxy.reverseproxyserver.net` on primary.
+Coolify service UUID: `ilus0cfdkheipodw1viurg1d`
 
-**June 22 session 2 facts:**
-- gitea.local pulls from server-01 now work: iptables DNAT rule applied on primary (192.168.1.88:80 → 127.0.0.1:80 via enp1s0 route_localnet=1) — NOT persisted across reboot yet (needs iptables-persistent or systemd unit)
-- Cloudflare route `secrets-proxy.reverseproxyserver.net` already exists but pointed to primary's coolify-proxy which doesn't know about server-01 container — confirms proxy should be on primary
-- Coolify API: secrets-proxy is a SERVICE type (not application) — use /api/v1/services endpoint
-- Server-01 service UUID: lv3xeu2manuimle458wbm9u9 (to be stopped/deleted after migration)
-- Image at gitea.local/backtalk6858/secrets-proxy:latest (digest sha256:5bf92d2e...) — bridge_health_check fix included
-- Caller keys: claude-code: 0ce8c396...591e9, agent-builder-agent: 473d9e1f...3573, n8n-builder-agent: 233e6aa9...cb
+**June 22 session 3 facts:**
+- Coolify API allowed_ips was `172.16.16.1/32` — cleared to allow API access (set to empty string in instance_settings)
+- Server-01 service (lv3xeu2manuimle458wbm9u9) stopped and deleted ✅
+- Sandbox Vault and bridge now LAN-exposed on server-01: vault=192.168.1.90:8201, bridge=192.168.1.90:8083 (port bindings added to Coolify DB + sandbox compose file)
+- secrets-proxy Vault AppRole created in prod (role: 3bf7b8a6-9e99-ca78-8e69-517881e26ea5) — creds at secret/proxy/vault-approle
+- secrets-proxy Vault AppRole created in sandbox (role: f21416b3-2f3a-0461-fa38-d453a4e32865) — creds at secret/proxy/vault-approle-sandbox
+- secrets_proxy DB user created in api_business (INSERT on proxy_executions only) — creds at secret/postgres/secrets-proxy
+- NTFY secrets-proxy-bot created (topic: secrets-proxy-notifications, token at secret/ntfy/secrets-proxy-bot)
+- Coolify bug: env vars for custom-image services can only be set via PATCH /api/v1/services/{uuid}/envs with key+value (not POST)
+- Coolify DB YAML serializer mangles CMD-SHELL healthcheck single quotes (`'` → `''`) — fixed by using CMD array form in healthcheck
+- psql heredoc via `docker exec ... << 'SQL'` doesn't work — use `docker cp` + `psql -f` instead
+- pull_policy: never removed from docker-compose.yml (was server-01 workaround, no longer needed on primary)
+- docker_compose_raw in Coolify DB must be updated via `docker cp` + `psql -f` for reliability
 
 **NEXT SESSION — in order:**
-1. Stop/delete secrets-proxy service on server-01 (Coolify UUID lv3xeu2manuimle458wbm9u9)
-2. Deploy secrets-proxy on primary via Coolify (same docker-compose.yml, Traefik labels, coolify network)
-3. Cloudflare route already correct (http://coolify-proxy:80) — no change needed
-4. Full E2E test: bridge_health_check, bitwarden_item_exists, n8n_workflow_list, vault_secret_write
-5. Persist iptables DNAT rule on primary (iptables-persistent or systemd unit) — so server-01 can always pull from gitea.local
-6. Add sudo-bridge allowlist management endpoint (POST /allowlist) — gap discovered this session
-7. id=24 Agent Builder Agent + id=67 N8N Builder Agent
+1. E2E tests: bridge_health_check, n8n_workflow_list, vault_secret_exists, vault_secret_write (all via `https://secrets-proxy.reverseproxyserver.net/exec`)
+2. Persist iptables DNAT rule on primary (iptables-persistent or systemd unit)
+3. Add POST /allowlist endpoint to sudo bridge
+4. id=24 Agent Builder Agent + id=67 N8N Builder Agent
 
 - Bitwarden bridge LAN-exposed: 192.168.1.88:8083 ✅