diff --git a/agent-builder/.claude/context.md b/agent-builder/.claude/context.md
index f99fef9..a3b8365 100644
--- a/agent-builder/.claude/context.md
+++ b/agent-builder/.claude/context.md
@@ -202,6 +202,11 @@ Coolify service UUID: `ilus0cfdkheipodw1viurg1d`
 - 524 on destructive commands: Cloudflare kills long-poll at ~100s; approval must be tapped quickly; command still runs if approved before timeout, response just lost
 
 **NEXT SESSION — in order:**
+0. sudo-bridge-server01 — sync POST /allowlist endpoint
+   - POST /allowlist was added to sudo-bridge (primary) this session but server-01 bridge container was NOT redeployed — it's still running the old image without the endpoint
+   - Both bridges share gitea.local/backtalk6858/sudo-bridge:latest — code is already in the image, just need to redeploy server-01 bridge (Coolify UUID: o2kz1puml1mmneyiqd96mouj) via pull + restart
+   - Also: server-01 allowlist.json needs the 4 new entries added today (iptables-save, 99-local-routing.conf, sysctl -p, journalctl -u) — these are primary-only entries so only add if relevant to server-01 use cases
+   - Verify: curl POST /allowlist and GET /allowlist on sudo-bridge-server01.reverseproxyserver.net after redeploy
 1. id=51 Secrets Proxy — sandbox precondition scaffolding
    - Problem: sandbox dry-run is meaningless if the required state doesn't exist (e.g. file to delete isn't there, service isn't running)
    - Feature: before running command in proxy-sandbox-mirror, classify what the command needs to be present, check if it exists, and create/set it up if missing — so the sandbox test is a faithful replica of what would happen on the host