From a1b1817adf2285ee2c9a5acca770f35b73bd1d43 Mon Sep 17 00:00:00 2001
From: rob-maron <132852777+rob-maron@users.noreply.github.com>
Date: Mon, 21 Sep 2026 12:49:29 -0400
Subject: [PATCH 1/9] add grok 4.7 to top of model picker

---
 website/static/api/model-catalog.json | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/website/static/api/model-catalog.json b/website/static/api/model-catalog.json
index 5824775a2a..d35465ad42 100644
--- a/website/static/api/model-catalog.json
+++ b/website/static/api/model-catalog.json
@@ -261,6 +261,9 @@
         "note": "The entry labeled \"default\": true is the model Hermes silently lands on when the user never picked one."
       },
       "models": [
+        {
+          "id": "x-ai/grok-4.7"
+        },
         {
           "id": "anthropic/claude-fable-5.1"
         },
@@ -394,4 +397,4 @@
       ]
     }
   }
-}
+}
\ No newline at end of file

From 2632229bcffe607fb37337425857da57ff0161bc Mon Sep 17 00:00:00 2001
From: teknium1 <127238744+teknium1@users.noreply.github.com>
Date: Mon, 21 Sep 2026 09:50:58 -0700
Subject: [PATCH 2/9] fix(auth): named profiles read the root auth.json again
 (revert #111724)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reverts 93889b770da3 ("named profiles no longer inherit the root
profile's auth.json"). After the Desktop update every bot profile that had
relied on the root OpenAI Codex login failed with "No Codex credentials
stored. Run `hermes -p <bot> auth add openai-codex --type oauth`", and users
had to re-run the device-code flow once per bot (5-6 times in the field
report). Sharing one grant across profiles is the intended design: OAuth
refresh tokens are single-use, so ONE grant lives at the root, profiles
resolve it read-only, and a refresh under a profile writes the rotated chain
back to root (Codex / xAI write-through, borrowed-row pool bookkeeping,
forked-grant heal) — never a per-profile copy.

Restored: `_global_auth_file_path` / `_load_global_auth_store` fallback in
`_load_provider_state*` / `read_credential_pool` / `_provider_state_transaction`,
Codex + xAI root write-through, `credential_pool` borrowed-root persistence,
`heal_forked_single_use_oauth_grants`, `share_auth` on profile creation
(Desktop create dialog checkbox), and the docs. `profile_credential_audit.py`
(the `hermes update` "profiles without a provider" notice) is removed with it.

Kept from after #111724: `_save_codex_tokens(set_active=...)` for image gen,
the plugin-auth `status` dispatch and the external-login notice in
`hermes auth list`, and the registry-derived env-var hint in agent_init.
---
 agent/agent_init.py                           |   4 +-
 agent/anthropic_credentials.py                |  22 +-
 agent/credential_pool.py                      | 256 +++++++-
 agent/credential_pool_admin.py                |  23 +-
 .../onboarding-chat/setup-profile.ts          |   1 +
 .../src/plugins/hermes-bots/create-dialog.tsx |  24 +-
 apps/shared/src/gateway-contract.generated.ts |   4 +-
 apps/shared/src/gateway-contract.openrpc.json |  14 +-
 hermes_cli/AGENTS.md                          |   4 +-
 hermes_cli/anon_auth.py                       |  15 +-
 hermes_cli/auth.py                            | 172 +++++-
 hermes_cli/auth_codex.py                      |  67 ++-
 hermes_cli/auth_commands.py                   |  12 +
 hermes_cli/auth_oauth_grants.py               | 538 ++++++++++++++++-
 hermes_cli/auth_xai.py                        |  49 +-
 hermes_cli/profile_credential_audit.py        |  74 ---
 hermes_cli/profiles.py                        |   5 +-
 hermes_cli/update_cmd_maint.py                |   8 -
 tests/agent/test_anthropic_oauth_stress.py    |   1 +
 ...test_credential_pool_oauth_writethrough.py | 228 ++++++-
 ...test_credential_pool_profile_oauth_fork.py | 563 +++++++++++++++++-
 .../hermes_cli/test_auth_profile_fallback.py  | 383 ++++++++++++
 .../hermes_cli/test_auth_profile_isolation.py | 221 -------
 .../test_codex_token_writethrough.py          | 147 +++++
 .../hermes_cli/test_global_auth_store_memo.py | 114 ++++
 .../hermes_cli/test_xai_oauth_profile_auth.py |   1 +
 .../hermes_cli/test_xai_oauth_writethrough.py |  90 +++
 tests/test_hermes_constants.py                |   5 +-
 tests/tools/test_managed_tool_gateway.py      |  20 +-
 tools/managed_tool_gateway.py                 |   6 +-
 ...ofiles_vault_complete_foreign_subagents.py |   7 +-
 tui_gateway/methods_profiles.py               |  28 +-
 .../docs/user-guide/multi-profile-gateways.md |   1 -
 website/docs/user-guide/profiles.md           |   8 +-
 34 files changed, 2635 insertions(+), 480 deletions(-)
 delete mode 100644 hermes_cli/profile_credential_audit.py
 create mode 100644 tests/hermes_cli/test_auth_profile_fallback.py
 delete mode 100644 tests/hermes_cli/test_auth_profile_isolation.py
 create mode 100644 tests/hermes_cli/test_codex_token_writethrough.py
 create mode 100644 tests/hermes_cli/test_global_auth_store_memo.py
 create mode 100644 tests/hermes_cli/test_xai_oauth_writethrough.py

diff --git a/agent/agent_init.py b/agent/agent_init.py
index 2241e4daa4..732ff39a47 100644
--- a/agent/agent_init.py
+++ b/agent/agent_init.py
@@ -873,8 +873,8 @@ def _routed_client_kwargs(agent, fallback_model, _provider_timeout) -> Optional[
     from hermes_constants import profile_cli_selector
     _sel = profile_cli_selector()
     raise RuntimeError(
-        f"No LLM provider configured. Run `hermes {_sel}model` to "
-        f"select a provider, or run `hermes {_sel}setup` for first-time "
+        "No LLM provider configured. Run `hermes model` to "
+        "select a provider, or run `hermes setup` for first-time "
         "configuration."
     )
 
diff --git a/agent/anthropic_credentials.py b/agent/anthropic_credentials.py
index 43e0a89fa7..a52a5fd970 100644
--- a/agent/anthropic_credentials.py
+++ b/agent/anthropic_credentials.py
@@ -731,6 +731,17 @@ def _get_hermes_oauth_file() -> Path:
     return get_hermes_home() / ".anthropic_oauth.json"
 
 
+def _root_hermes_oauth_file() -> Optional[Path]:
+    """Global-root ``.anthropic_oauth.json`` inside a named profile (None in classic mode); used to commit a
+    rotation of a grant the profile borrowed via the pool's root fallback."""
+    try:
+        from hermes_constants import get_default_hermes_root
+        root = get_default_hermes_root()
+        return None if root.resolve(strict=False) == get_hermes_home().resolve(strict=False) else root / ".anthropic_oauth.json"
+    except Exception:
+        return None
+
+
 def _generate_pkce() -> tuple:
     """Generate PKCE code_verifier and code_challenge (S256)."""
     verifier = base64.urlsafe_b64encode(secrets.token_bytes(32)).rstrip(b"=").decode()
@@ -800,13 +811,14 @@ def read_hermes_oauth_credentials() -> Optional[Dict[str, Any]]:
 
 
 def _write_hermes_oauth_credentials(
-    access_token: str, refresh_token: Optional[str], expires_at_ms: Optional[int],
+    access_token: str, refresh_token: Optional[str], expires_at_ms: Optional[int], *, target: Optional[Path] = None
 ) -> None:
-    """Commit refreshed hermes_pkce tokens to ``<HERMES_HOME>/.anthropic_oauth.json`` (``CredentialPersistError``
-    on failure); without it the next ``load_pool()`` re-seeds the stale (consumed) pair from the file over the
-    rotated pool entry."""
+    """Commit refreshed hermes_pkce tokens to ~/.hermes/.anthropic_oauth.json (``CredentialPersistError`` on failure).
+    ``target`` lets a named profile commit a grant it BORROWED from the global root back to the ROOT singleton
+    instead of forking a copy under its own HERMES_HOME; without this write-through the next ``load_pool()``
+    re-seeds the stale (consumed) pair from the file over the rotated pool entry."""
     _commit_private_json(
-        _get_hermes_oauth_file(),
+        target if target is not None else _get_hermes_oauth_file(),
         {"accessToken": access_token, "refreshToken": refresh_token, "expiresAt": expires_at_ms},
         "Hermes OAuth credentials",
     )
diff --git a/agent/credential_pool.py b/agent/credential_pool.py
index 533435533a..4b671068eb 100644
--- a/agent/credential_pool.py
+++ b/agent/credential_pool.py
@@ -36,10 +36,13 @@ from hermes_cli.auth import (
     _auth_store_lock,
     _codex_access_token_is_expiring,
     _decode_jwt_claims,
+    _global_auth_file_path,
     _load_auth_store,
     _load_provider_state,
+    _load_provider_state_with_source,
     _resolve_kimi_base_url,
     _resolve_zai_base_url,
+    _same_path,
     _save_auth_store,
     _save_provider_state,
     _store_provider_state,
@@ -756,6 +759,180 @@ def resolve_runtime_pool_key(provider: Optional[str], base_url: Optional[str]) -
 DEFAULT_MAX_CONCURRENT_PER_CREDENTIAL = 1
 
 
+# --- Multi-profile root write-through ---
+
+
+def _guarded_global_root(global_path: Optional[Path]) -> Optional[Path]:
+    """Apply the pytest seat belt to a resolved global-root auth.json path.
+
+    ``None`` means classic mode (profile == root) or "refuse": under pytest,
+    never write the real user's ``~/.hermes/auth.json`` even when HERMES_HOME
+    points at a profile path (mirrors the read-side guard in
+    ``_load_global_auth_store``). Uses the unmodified HOME env, not
+    ``Path.home()`` which fixtures may monkeypatch.
+    """
+    if global_path is None:
+        return None
+    if os.environ.get("PYTEST_CURRENT_TEST"):
+        real_home_env = os.environ.get("HOME", "")
+        if real_home_env:
+            real_root = Path(real_home_env) / ".hermes" / "auth.json"
+            try:
+                if global_path.resolve(strict=False) == real_root.resolve(strict=False):
+                    return None
+            except Exception:
+                return None
+    return global_path
+
+
+def _write_through_provider_state_to_global_root(
+    provider_id: str, state: Dict[str, Any]
+) -> None:
+    """Persist a rotated OAuth ``state`` into the global-root auth.json.
+
+    Best-effort write-through for the multi-profile rotation hazard: nous,
+    openai-codex, and xai-oauth rotate the refresh_token on refresh, so when
+    a profile pool refresh rotates a grant it resolved from the root fallback,
+    the rotated chain must land back in root. Otherwise root keeps a revoked
+    refresh token and every other profile dies with ``refresh_token_reused``
+    / ``invalid_grant`` once its access token expires.
+
+    Only updates ``providers.<provider_id>`` in the root store; never touches
+    the profile store (the caller already saved that). Swallows all errors —
+    a failed write-through degrades to root-stale and must never break the
+    profile's own successful save. Mirrors
+    ``hermes_cli.auth._write_through_xai_oauth_to_global_root``.
+
+    See #48415.
+    """
+    try:
+        global_path = _guarded_global_root(auth_mod._global_auth_file_path())
+    except Exception:
+        return
+    if global_path is None:
+        return
+    try:
+        auth_mod._persist_provider_state_to_store(provider_id, state, global_path, set_active=False)
+    except Exception as exc:  # pragma: no cover - best effort
+        logger.debug("%s pool refresh: write-through to global root failed: %s", provider_id, exc)
+
+
+def _singleton_target_for_entry(pool: "CredentialPool", entry: "PooledCredential") -> Optional[Path]:
+    """Root ``.anthropic_oauth.json`` when *entry* is a borrowed hermes_pkce row, else None."""
+    if entry.source != "hermes_pkce" or entry.id not in getattr(pool, "_borrowed_root_ids", ()):
+        return None
+    try:
+        from agent.anthropic_credentials import _root_hermes_oauth_file
+        return _root_hermes_oauth_file()
+    except Exception:
+        return None
+
+
+def _profile_owns_pool_provider(provider: str) -> bool:
+    """True when the ACTIVE auth.json has its own rows for *provider*.
+
+    Named profiles with no local rows read the provider through the
+    ``read_credential_pool`` global-root fallback ("borrowing").
+    """
+    try:
+        pool = _load_auth_store().get("credential_pool")
+    except Exception:
+        return True  # unreadable store: assume ownership, keep legacy path
+    entries = pool.get(provider) if isinstance(pool, dict) else None
+    return isinstance(entries, list) and bool(entries)
+
+
+def _borrowed_single_use_pool_root() -> Optional[Path]:
+    """Global-root auth.json when persisting a BORROWED single-use pool, else None.
+
+    ``None`` means "persist to the active store as usual": classic mode
+    (profile == root), or the profile owns its own rows for this provider.
+    """
+    try:
+        return _guarded_global_root(_global_auth_file_path())
+    except Exception:
+        return None
+
+
+def _update_root_pool_rows(
+    provider: str, payloads: List[Dict[str, Any]], global_path: Path,
+    *, status_cleared_ids: Optional[Iterable[str]] = None,
+) -> None:
+    """UPDATE-ONLY merge of *payloads* into the root store's rows for *provider*.
+
+    A borrower may refresh the root's rows (rotation, cooldown state) but
+    never add or delete them — the root owns their lifecycle. In particular a
+    profile's singleton-prune (it has no ``.anthropic_oauth.json`` of its own)
+    must not delete the root grant, so ``removed_ids`` is ignored by callers.
+    """
+    with _auth_store_lock(target_path=global_path):
+        store = _load_auth_store(global_path)
+        pool = store.get("credential_pool")
+        if not isinstance(pool, dict):
+            pool = {}
+            store["credential_pool"] = pool
+        existing = pool.get(provider)
+        existing_list = existing if isinstance(existing, list) else []
+        incoming_by_id = {p.get("id"): p for p in payloads if isinstance(p, dict) and p.get("id")}
+        cleared = {cid for cid in (status_cleared_ids or ()) if cid}
+        merged: List[Dict[str, Any]] = []
+        changed = False
+        for disk_entry in existing_list:
+            did = disk_entry.get("id") if isinstance(disk_entry, dict) else None
+            incoming = incoming_by_id.get(did) if did else None
+            if incoming is None:
+                merged.append(disk_entry)
+                continue
+            # A deliberately cleared entry has no disk cooldown worth keeping.
+            updated = auth_mod._merge_disk_cooldown_state(
+                incoming, None if did in cleared else disk_entry, provider,
+            )
+            if updated != disk_entry:
+                changed = True
+            merged.append(updated)
+        if changed:
+            pool[provider] = merged
+            _save_auth_store(store, target_path=global_path)
+
+
+def persist_pool_entries(
+    provider: str,
+    payloads: List[Dict[str, Any]],
+    *,
+    removed_ids: Optional[Iterable[str]] = None,
+    status_cleared_ids: Optional[Iterable[str]] = None,
+) -> None:
+    """Persist a provider's pool rows to the store that OWNS them.
+
+    A named profile that sees a single-use-refresh provider (Anthropic,
+    Codex, xAI OAuth) only through the global-root fallback must not
+    materialize a local ``credential_pool.<provider>`` copy: that copy forks
+    the single-use refresh token, the first profile to rotate commits the new
+    pair only to its own file, and root plus every sibling die with
+    ``invalid_grant`` (#100339). Such rows are written back to the root store
+    (under the root lock); everything else goes to the active store.
+    """
+    if provider in SINGLE_USE_REFRESH_POOL_PROVIDERS and not _profile_owns_pool_provider(provider):
+        global_path = _borrowed_single_use_pool_root()
+        if global_path is not None:
+            try:
+                _update_root_pool_rows(
+                    provider, payloads, global_path,
+                    status_cleared_ids=status_cleared_ids,
+                )
+            except Exception as exc:
+                # Fail closed on the FORK, not on the save: never fall back to
+                # writing a local copy (that IS the bug). The in-memory pool
+                # still holds the rotated pair for this process.
+                logger.warning(
+                    "%s pool: write-through of borrowed root grant failed (%s); "
+                    "not materializing a profile-local copy",
+                    provider, exc,
+                )
+            return
+    write_credential_pool(
+        provider, payloads, removed_ids=removed_ids, status_cleared_ids=status_cleared_ids,
+    )
 
 
 # --- Per-provider singleton refresh plumbing -------------------------------
@@ -807,6 +984,9 @@ class CredentialPool(CredentialPoolAdminMixin, CredentialPoolModelCooldownMixin)
         self.provider = provider
         self._entries = sorted(entries, key=lambda entry: entry.priority)
         self._current_id: Optional[str] = None
+        # Ids of rows read via the global-root fallback (single-use OAuth
+        # providers only); set by load_pool(), consumed by add_entry().
+        self._borrowed_root_ids: Set[str] = set()
         self._strategy = get_pool_strategy(provider)
         # RLock: _replace_entry/_persist self-acquire it so the DEFERRED
         # single-use-token refresh path (network I/O outside the lock by
@@ -935,7 +1115,7 @@ class CredentialPool(CredentialPoolAdminMixin, CredentialPoolModelCooldownMixin)
     ) -> None:
         # Self-locking: snapshotting self._entries must not race a rotation.
         with self._lock:
-            write_credential_pool(
+            persist_pool_entries(
                 self.provider,
                 [entry.to_dict() for entry in self._entries],
                 removed_ids=removed_ids,
@@ -1229,6 +1409,14 @@ class CredentialPool(CredentialPoolAdminMixin, CredentialPoolModelCooldownMixin)
         ``set_active=False`` everywhere: a sync-back is a token-rotation side
         effect, not the user choosing a provider; ``_save_provider_state``
         would flip ``active_provider`` to whichever provider refreshed last.
+
+        #74339: decide the root write-through on WHERE the state resolved
+        from (``_load_provider_state_with_source``), not on whether the
+        profile has a ``providers.<id>`` key — ``_store_provider_state``
+        creates that key unconditionally, which self-sealed the check after
+        the first refresh. When the grant came from the global root, write
+        back to root ONLY and skip the profile store so it never accrues a
+        shadowing key that blocks both the fallback and the write-through.
         """
         # Only singleton-seeded entries sync back; ``manual:*`` entries are
         # independent credentials and must not write to the singleton.
@@ -1237,13 +1425,20 @@ class CredentialPool(CredentialPoolAdminMixin, CredentialPoolModelCooldownMixin)
         try:
             with _auth_store_lock():
                 auth_store = _load_auth_store()
-                state = _load_provider_state(auth_store, self.provider)
+                state, source_path = _load_provider_state_with_source(auth_store, self.provider)
                 if not isinstance(state, dict):
                     return
+                global_root = _global_auth_file_path()
+                is_from_root = bool(
+                    source_path is not None and global_root is not None and _same_path(source_path, global_root)
+                )
                 if not self._apply_entry_to_singleton_state(entry, state):
                     return
-                _store_provider_state(auth_store, self.provider, state, set_active=False)
-                _save_auth_store(auth_store)
+                if is_from_root:
+                    _write_through_provider_state_to_global_root(self.provider, state)
+                else:
+                    _store_provider_state(auth_store, self.provider, state, set_active=False)
+                    _save_auth_store(auth_store)
         except Exception as exc:
             logger.debug("Failed to sync %s pool entry back to auth store: %s", self.provider, exc)
 
@@ -1394,10 +1589,11 @@ class CredentialPool(CredentialPoolAdminMixin, CredentialPoolModelCooldownMixin)
         """Write a rotated Anthropic pair to its authoritative singleton, or fail closed.
 
         claude_code -> ~/.claude/.credentials.json (so the fallback resolver
-        and other profiles see it). hermes_pkce -> <HERMES_HOME>/.anthropic_oauth.json
-        (``_seed_from_singletons`` re-seeds it every load). Not ``endswith``:
-        manual:hermes_pkce is pool-owned and a singleton for it would be a second
-        authority for the same refresh-token family.
+        and other profiles see it). hermes_pkce -> ~/.hermes/.anthropic_oauth.json
+        (``_seed_from_singletons`` re-seeds it every load; a borrowed row commits
+        to the ROOT's file, never a new profile-local copy, #100339). Not
+        ``endswith``: manual:hermes_pkce is pool-owned and a singleton for it
+        would be a second authority for the same refresh-token family.
         """
         if entry.source == "claude_code":
             store = "~/.claude/.credentials.json"
@@ -1411,7 +1607,7 @@ class CredentialPool(CredentialPoolAdminMixin, CredentialPoolModelCooldownMixin)
             if entry.source == "claude_code":
                 ac._write_claude_code_credentials(*args, spent_refresh_token=entry.refresh_token or "")
             else:
-                ac._write_hermes_oauth_credentials(*args)
+                ac._write_hermes_oauth_credentials(*args, target=_singleton_target_for_entry(self, entry))
         except Exception as wexc:
             # Authoritative commit failed: do not mark, persist or return the
             # rotation as successful, and bypass the re-POST recovery path —
@@ -2788,6 +2984,10 @@ def _seed_custom_pool(pool_key: str, entries: List[PooledCredential]) -> Tuple[b
 
 def load_pool(provider: str) -> CredentialPool:
     provider = (provider or "").strip().lower()
+    if provider in SINGLE_USE_REFRESH_POOL_PROVIDERS:
+        # One-time heal for installs that forked this grant across profiles
+        # before the clone-strip / root write-through existed (#100339).
+        auth_mod.heal_forked_single_use_oauth_grants(provider)
     raw_entries = read_credential_pool(provider)
     disk_ids = {e.get("id") for e in raw_entries if isinstance(e, dict) and e.get("id")}
     changed = any(
@@ -2802,7 +3002,13 @@ def load_pool(provider: str) -> CredentialPool:
         ) != payload.get("auth_type", AUTH_TYPE_API_KEY)
         for payload in raw_entries
     )
-    changed |= raw_needs_auth_normalization
+    if raw_needs_auth_normalization:
+        # A profile may be reading this provider from the global-root fallback.
+        # Keep that fallback read-only: only the owning store may rewrite these
+        # rows; loading the default/root profile heals global rows.
+        active_pool = _load_auth_store().get("credential_pool")
+        active_entries = active_pool.get(provider) if isinstance(active_pool, dict) else None
+        changed |= bool(active_entries)
 
     if provider.startswith(CUSTOM_POOL_PREFIX):
         custom_changed, custom_sources = _seed_custom_pool(provider, entries)
@@ -2814,16 +3020,38 @@ def load_pool(provider: str) -> CredentialPool:
         changed |= singleton_changed or env_changed
         # ``load_pool()`` is a non-destructive read for env-seeded entries
         # (#9331); file-backed singletons still prune when their file is gone.
-        changed |= _prune_stale_seeded_entries(
-            entries, singleton_sources | env_sources, prune_env_sources=False,
+        borrowing_root_grant = (
+            provider in SINGLE_USE_REFRESH_POOL_PROVIDERS
+            and bool(disk_ids)
+            and not _profile_owns_pool_provider(provider)
         )
+        if borrowing_root_grant:
+            # Rows read through the global-root fallback are seeded from the
+            # ROOT's singleton files, which this profile cannot see; pruning
+            # them would hide (and, via write-through, delete) the shared
+            # grant. The root's own load_pool() prunes.
+            borrowed = [e for e in entries if e.id in disk_ids]
+            others = [e for e in entries if e.id not in disk_ids]
+            changed |= _prune_stale_seeded_entries(
+                others, singleton_sources | env_sources, prune_env_sources=False,
+            )
+            entries[:] = borrowed + others
+        else:
+            changed |= _prune_stale_seeded_entries(
+                entries, singleton_sources | env_sources, prune_env_sources=False,
+            )
         changed |= _normalize_pool_priorities(provider, entries)
 
     if changed:
         new_ids = {entry.id for entry in entries}
-        write_credential_pool(
+        persist_pool_entries(
             provider,
             [entry.to_dict() for entry in sorted(entries, key=lambda item: item.priority)],
             removed_ids=disk_ids - new_ids,
         )
-    return CredentialPool(provider, entries)
+    pool = CredentialPool(provider, entries)
+    # Remember the root's borrowed rows so a later ``add_entry`` in this
+    # profile leaves them out of the profile's own store (#100339).
+    if provider in SINGLE_USE_REFRESH_POOL_PROVIDERS and not _profile_owns_pool_provider(provider):
+        pool._borrowed_root_ids = set(disk_ids)
+    return pool
diff --git a/agent/credential_pool_admin.py b/agent/credential_pool_admin.py
index 515a2f09b9..f5b89f7e08 100644
--- a/agent/credential_pool_admin.py
+++ b/agent/credential_pool_admin.py
@@ -54,12 +54,18 @@ class CredentialPoolAdminMixin:
             return len(stale)
 
     def remove_index(self, index: int) -> Optional[PooledCredential]:
+        from agent.credential_pool import persist_pool_entries
+
         with self._lock:
             if index < 1 or index > len(self._entries):
                 return None
             removed = self._entries.pop(index - 1)
             self._entries = [replace(e, priority=p) for p, e in enumerate(self._entries)]
-            self._persist(removed_ids=[removed.id])
+            persist_pool_entries(
+                self.provider,
+                [entry.to_dict() for entry in self._entries],
+                removed_ids=[removed.id],
+            )
             if self._current_id == removed.id:
                 self._current_id = None
             return removed
@@ -108,10 +114,21 @@ class CredentialPoolAdminMixin:
             return None, None, f'No credential matching "{raw}".'
 
     def add_entry(self, entry: PooledCredential) -> PooledCredential:
-        from agent.credential_pool import _next_priority
+        from agent.credential_pool import _next_priority, write_credential_pool
 
         with self._lock:
             entry = replace(entry, priority=_next_priority(self._entries))
             self._entries.append(entry)
-            self._persist()
+            borrowed_ids = getattr(self, "_borrowed_root_ids", None)
+            if borrowed_ids:
+                # ``hermes -p <profile> auth add <single-use provider>``: the
+                # profile claims its OWN credential. Persist only profile-owned
+                # rows — copying the borrowed root grant alongside would fork
+                # its single-use refresh token (#100339). Once the profile owns
+                # rows, the root fallback for this provider is shadowed.
+                self._entries = [e for e in self._entries if e.id not in borrowed_ids]
+                write_credential_pool(self.provider, [e.to_dict() for e in self._entries])
+                self._borrowed_root_ids = set()
+            else:
+                self._persist()
             return entry
diff --git a/apps/desktop/src/components/onboarding-chat/setup-profile.ts b/apps/desktop/src/components/onboarding-chat/setup-profile.ts
index 4d141fd459..ef1587a959 100644
--- a/apps/desktop/src/components/onboarding-chat/setup-profile.ts
+++ b/apps/desktop/src/components/onboarding-chat/setup-profile.ts
@@ -292,6 +292,7 @@ export async function ensureSetupProfile(request: GatewayRequest): Promise<void>
       description: 'Where Hermes met you — walks your first run, then checks in as you find your feet.',
       name: SETUP_PROFILE,
       clone_from: 'default',
+      share_auth: true,
       no_alias: true,
       soul: composeSetupSoul()
     })
diff --git a/apps/desktop/src/plugins/hermes-bots/create-dialog.tsx b/apps/desktop/src/plugins/hermes-bots/create-dialog.tsx
index 31747afa2d..12a0a3afb5 100644
--- a/apps/desktop/src/plugins/hermes-bots/create-dialog.tsx
+++ b/apps/desktop/src/plugins/hermes-bots/create-dialog.tsx
@@ -141,7 +141,7 @@ export function CreateAgentDialog({ open, onClose, roster }: CreateAgentDialogPr
   const [provider, setProvider] = useState('')
   const [soul, setSoul] = useState('')
   const [noSkills, setNoSkills] = useState(false)
-  const [mirrorCredentials, setMirrorCredentials] = useState(true)
+  const [shareAuth, setShareAuth] = useState(true)
   const [advTab, setAdvTab] = useState('general')
   // Where the profile is created: '' = the active gateway (unchanged default),
   // else a registry connection id — the profiles.create lands on THAT
@@ -274,7 +274,7 @@ export function CreateAgentDialog({ open, onClose, roster }: CreateAgentDialogPr
     setProvider('')
     setSoul('')
     setNoSkills(false)
-    setMirrorCredentials(true)
+    setShareAuth(true)
     setAdvTab('general')
     setCreatedForCaps(null)
     setCaps(null)
@@ -392,10 +392,10 @@ export function CreateAgentDialog({ open, onClose, roster }: CreateAgentDialogPr
         // the remote box doesn't have.
         clone_from: cloneFrom === '__none__' ? null : remoteTarget ? 'default' : cloneFrom,
         no_skills: noSkills,
-        // Copies the main profile's API keys (.env + auth.json) into the new profile. OAuth
-        // logins are never copied (single-use refresh tokens fork) and never inherited: a
-        // profile only reads its own auth.json, so sign the bot in itself for those.
-        mirror_credentials: mirrorCredentials,
+        // Shared (not copied) auth keeps ONE OAuth/token pool with the main
+        // profile, so refreshes can't invalidate each other. Older gateways
+        // ignore the param and copy — still functional, just forked.
+        share_auth: shareAuth,
         soul: composeSoul({
           name: slug,
           title: botTitle,
@@ -792,16 +792,12 @@ export function CreateAgentDialog({ open, onClose, roster }: CreateAgentDialogPr
                     />
                   )}
                   <label className="flex items-center gap-2 text-xs text-(--ui-text-secondary)">
-                    <Checkbox
-                      checked={mirrorCredentials}
-                      onCheckedChange={value => setMirrorCredentials(Boolean(value))}
-                    />
-                    Copy API keys from the main profile
+                    <Checkbox checked={shareAuth} onCheckedChange={value => setShareAuth(Boolean(value))} />
+                    Share keys & accounts with the main profile
                   </label>
                   <div className="pl-6 pt-0.5 text-[0.7rem] leading-5 text-(--ui-text-tertiary)">
-                    Each profile owns its credentials. API keys are copied; OAuth logins (Claude, Codex, xAI, Nous) are
-                    not — sign the bot in with <code>hermes -p &lt;name&gt; model</code>. Uncheck to start with no
-                    credentials.
+                    Subscriptions, OAuth logins, and API keys stay shared (not copied), so token refreshes never
+                    invalidate each other. Uncheck for an isolated snapshot copy.
                   </div>
                   <label className="flex items-center gap-2 text-xs text-(--ui-text-secondary)">
                     <Checkbox checked={noSkills} onCheckedChange={value => setNoSkills(Boolean(value))} />
diff --git a/apps/shared/src/gateway-contract.generated.ts b/apps/shared/src/gateway-contract.generated.ts
index e8f793ee7c..d95c4f8f94 100644
--- a/apps/shared/src/gateway-contract.generated.ts
+++ b/apps/shared/src/gateway-contract.generated.ts
@@ -1531,10 +1531,10 @@ export interface ProfilesCreateResult {
   model_set?: boolean
   mirrored: ProfileMirrored
 }
-/** What was copied from the launch profile. */
+/** What was copied from the launch profile; ``auth`` is ``"shared"`` under ``share_auth``. */
 export interface ProfileMirrored {
   env?: boolean
-  auth?: boolean
+  auth?: boolean | 'shared'
   model_inherited?: boolean
   voice?: boolean
 }
diff --git a/apps/shared/src/gateway-contract.openrpc.json b/apps/shared/src/gateway-contract.openrpc.json
index e3b388bc6e..926d6c92c1 100644
--- a/apps/shared/src/gateway-contract.openrpc.json
+++ b/apps/shared/src/gateway-contract.openrpc.json
@@ -19232,7 +19232,7 @@
       },
       "ProfileMirrored": {
         "additionalProperties": false,
-        "description": "What was copied from the launch profile.",
+        "description": "What was copied from the launch profile; ``auth`` is ``\"shared\"`` under ``share_auth``.",
         "properties": {
           "env": {
             "default": false,
@@ -19240,9 +19240,17 @@
             "type": "boolean"
           },
           "auth": {
+            "anyOf": [
+              {
+                "type": "boolean"
+              },
+              {
+                "const": "shared",
+                "type": "string"
+              }
+            ],
             "default": false,
-            "title": "Auth",
-            "type": "boolean"
+            "title": "Auth"
           },
           "model_inherited": {
             "default": false,
diff --git a/hermes_cli/AGENTS.md b/hermes_cli/AGENTS.md
index 0c229d5379..e57f1e1f92 100644
--- a/hermes_cli/AGENTS.md
+++ b/hermes_cli/AGENTS.md
@@ -188,9 +188,7 @@ profile. The multiplex gateway and the Desktop/dashboard `serve` backend instead
 profile per activity via a contextvar override while `os.environ["HERMES_HOME"]` keeps the launch
 profile — a module constant or import-time read there freezes to the launch profile (rules in
 root). Profiles are independent
-islands by design — no live config inheritance and no credential inheritance (a named profile reads
-only its own `auth.json`/`.env`; the root store is never a fallback and never a write-through target,
-#111724 — a profile without a provider gets the setup prompt); `--clone` copies at creation, minus messaging
+islands by design — no live config inheritance; `--clone` copies at creation, minus messaging
 channels (`profile_channels.py`: ownership-based inventory evaluated in the SOURCE's plugin scope —
 adapter-declared keys + canonical/alias prefixes + `GATEWAY_ALLOW*`/`GATEWAY_RELAY_*`; prefixes shared
 with tools (`HASS_`/`TWILIO_`/`EMAIL_`) are stripped only when the source runs that adapter; never a hand
diff --git a/hermes_cli/anon_auth.py b/hermes_cli/anon_auth.py
index 576bc4e59e..23fa9d3365 100644
--- a/hermes_cli/anon_auth.py
+++ b/hermes_cli/anon_auth.py
@@ -834,10 +834,12 @@ def guest_notice_pending() -> bool:
 
 
 def mark_guest_notice_shown() -> bool:
-    """Persist ``guest_notice_shown`` on the guest's ``providers.nous`` state (the active store).
+    """Persist ``guest_notice_shown`` on the guest's ``providers.nous`` state (whichever store holds it).
 
     Returns True when a flag was written; False when there is no guest to mark."""
-    from hermes_cli.auth import _provider_state_transaction, _save_auth_store, _store_section
+    from hermes_cli.auth import (
+        _auth_file_path, _load_auth_store, _provider_state_transaction, _same_path, _save_auth_store,
+        _store_section)
     with _provider_state_transaction("nous") as (auth_store, state, source_path):
         if not is_guest_state(state) or source_path is None:
             return False
@@ -845,8 +847,13 @@ def mark_guest_notice_shown() -> bool:
             return True
         state = dict(state)
         state[GUEST_NOTICE_FLAG] = True
-        _store_section(auth_store, "providers")["nous"] = state
-        _save_auth_store(auth_store)
+        if _same_path(source_path, _auth_file_path()):
+            _store_section(auth_store, "providers")["nous"] = state
+            _save_auth_store(auth_store)
+        else:
+            source_store = _load_auth_store(source_path)
+            _store_section(source_store, "providers")["nous"] = state
+            _save_auth_store(source_store, target_path=source_path)
     return True
 
 
diff --git a/hermes_cli/auth.py b/hermes_cli/auth.py
index 3099b50642..f5ecdb95e1 100644
--- a/hermes_cli/auth.py
+++ b/hermes_cli/auth.py
@@ -43,7 +43,9 @@ from hermes_cli.auth_device_flow import (  # noqa: F401  re-exported
     _print_login_success, _print_loopback_ssh_hint, _prompt_yes_no, _request_device_code,
     _resolve_verify, _ssh_user_at_host)
 from hermes_cli.auth_oauth_grants import (  # noqa: F401  re-exported
-    SINGLE_USE_REFRESH_POOL_PROVIDERS, strip_cloned_single_use_oauth_grants)
+    SINGLE_USE_REFRESH_POOL_PROVIDERS, _oauth_heal_clean_marks, _oauth_heal_notices,
+    consume_oauth_heal_notices, heal_forked_single_use_oauth_grants,
+    strip_cloned_single_use_oauth_grants)
 from hermes_cli.auth_nous import (  # noqa: F401  re-exported
     NOUS_SESSION_TERMINAL, NOUS_SESSION_UNKNOWN, NOUS_SESSION_VALID, _ALLOWED_NOUS_INFERENCE_HOSTS,
     _agent_key_is_usable, _apply_nous_refreshed_tokens, _assert_nous_inference_jwt_usable,
@@ -66,7 +68,7 @@ from hermes_cli.auth_minimax import (  # noqa: F401  re-exported
     resolve_minimax_oauth_runtime_credentials)
 from hermes_cli.auth_xai import (  # noqa: F401  re-exported
     _login_xai_oauth, _read_xai_oauth_tokens, _refresh_xai_oauth_tokens, _save_xai_oauth_tokens,
-    _xai_access_token_is_expiring,
+    _write_through_xai_oauth_to_global_root, _xai_access_token_is_expiring,
     _xai_oauth_device_code_login, _xai_oauth_discovery, _xai_oauth_poll_device_token,
     _xai_oauth_request_device_code, _xai_proactive_refresh_skew_seconds,
     _xai_validate_inference_base_url, refresh_xai_oauth_pure, resolve_xai_oauth_runtime_credentials)
@@ -489,6 +491,52 @@ def _auth_file_path() -> Path:
     return path
 
 
+def _global_auth_file_path() -> Optional[Path]:
+    """Global-root auth.json in profile mode; None when profile and global root are the same dir.
+
+    Read-only fallback path, so no pytest seat belt here (it lives on ``_auth_file_path()``)."""
+    try:
+        from hermes_constants import get_default_hermes_root
+        global_root = get_default_hermes_root()
+    except Exception:
+        return None
+    return None if _same_path(get_hermes_home(), global_root) else global_root / "auth.json"
+
+
+def _load_global_auth_store() -> Dict[str, Any]:
+    """Load the global-root auth store (read-only fallback, mtime-memoised); ``{}`` when absent or
+    unreadable — a malformed global store must never break profile reads."""
+    global _global_auth_store_cache
+    global_path = _global_auth_file_path()
+    if global_path is None or not global_path.exists():
+        _global_auth_store_cache = None
+        return {}
+    try:
+        cache_key: Optional[Tuple[str, Tuple[int, int, int, int]]] = (
+            str(global_path.resolve(strict=False)), file_signature(global_path.stat()))
+    except Exception:
+        cache_key = None
+    cached = _global_auth_store_cache
+    if cache_key is not None and cached is not None and cached[:2] == cache_key:
+        return cached[2]
+    if os.environ.get("PYTEST_CURRENT_TEST") and os.environ.get("HOME"):
+        real_root = Path(os.environ["HOME"]) / ".hermes" / "auth.json"
+        try:
+            if global_path.resolve(strict=False) == real_root.resolve(strict=False):
+                _global_auth_store_cache = None
+                return {}
+        except Exception:
+            pass
+    try:
+        store = _load_auth_store(global_path)
+    except Exception:
+        _global_auth_store_cache = None
+        return {}
+    if cache_key is not None:
+        _global_auth_store_cache = (*cache_key, store)
+    return store
+
+
 _auth_target_lock_holders: Dict[str, threading.local] = {}
 _auth_target_lock_holders_guard = threading.Lock()
 
@@ -500,6 +548,22 @@ def _same_path(left: Path, right: Path) -> bool:
         return left == right
 
 
+def _is_same_auth_store(left: Path, right: Path) -> bool:
+    """True when two auth paths name ONE store rather than two copies.
+    ``_same_path`` resolves symlinks and ``..``; ``samefile`` adds hardlinks and bind-mounts
+    (same inode under two resolved names). Used by the forked-grant heal: a shared store has
+    no "other side" to consolidate.
+
+    See #101356.
+    """
+    if _same_path(left, right):
+        return True
+    try:
+        return left.samefile(right)
+    except OSError:
+        return False
+
+
 def _resolved_key(path: Path) -> str:
     """Canonical string for *path* (resolved when possible) used as a cache / lock-holder key."""
     try:
@@ -529,8 +593,8 @@ def _file_lock(
     """Cross-process advisory flock helper, reentrant per-thread via ``holder.depth``.
 
     Falls back to a depth-only guard when neither ``fcntl`` nor ``msvcrt`` is available. Callers
-    supply their own ``threading.local`` so independent locks (one profile's store vs another's vs
-    the shared Nous store) track reentrancy separately."""
+    supply their own ``threading.local`` so independent locks (profile store vs global root vs the
+    shared Nous store) track reentrancy separately."""
     if getattr(holder, "depth", 0) > 0:
         holder.depth += 1
         try:
@@ -580,8 +644,8 @@ def _auth_store_lock(
     timeout_seconds: float = AUTH_LOCK_TIMEOUT_SECONDS, *, target_path: Optional[Path] = None):
     """Cross-process advisory lock for one auth.json read/write transaction.
 
-    ``target_path`` names a store other than the active profile's (a clone being stripped): each
-    path has its own reentrancy tracker and kernel lock. Lock ordering invariant: ``_auth_store_lock`` FIRST (outer),
+    ``target_path`` is required for profile-to-global write-throughs: each path has its own
+    reentrancy tracker and kernel lock. Lock ordering invariant: ``_auth_store_lock`` FIRST (outer),
     ``_nous_shared_store_lock`` SECOND (inner), else deadlock against a concurrent shared import."""
     auth_path = target_path if target_path is not None else _auth_file_path()
     with _file_lock(
@@ -653,11 +717,16 @@ def _save_private_json(target: Path, data: Any, *, fsync_dir: bool = False, **du
 
 def _save_auth_store(auth_store: Dict[str, Any], target_path: Optional[Path] = None) -> Path:
     """Atomically persist *auth_store* (0o600, parent tightened to 0o700) to the active store, or to
-    an explicit *target_path* (a profile store being edited from outside that profile)."""
+    an explicit *target_path* (e.g. the global-root write-through for rotating xAI OAuth grants)."""
     auth_file = target_path if target_path is not None else _auth_file_path()
     auth_store["version"] = AUTH_STORE_VERSION
     auth_store["updated_at"] = datetime.now(timezone.utc).isoformat()
     _save_private_json(auth_file, auth_store, fsync_dir=True)
+    if target_path is not None:
+        # A write-through to the global root must not be masked by the mtime memo: on coarse-mtime
+        # filesystems a read-after-write in the same tick would keep serving the pre-write store.
+        global _global_auth_store_cache
+        _global_auth_store_cache = None
     return auth_file
 
 
@@ -679,28 +748,39 @@ def _provider_state_in(store: Dict[str, Any], provider_id: str) -> Optional[Dict
 def _load_provider_state_with_source(
     auth_store: Dict[str, Any], provider_id: str,
 ) -> tuple[Optional[Dict[str, Any]], Optional[Path]]:
-    """Provider state plus the auth.json path it came from (``(None, None)`` when absent).
+    """Provider state plus the auth.json path it came from (profile first, then the global root).
 
-    Every profile owns its credentials: a named profile never reads the root ``auth.json``
-    (#111724), so the source is always the active store. Refresh paths that rotate single-use
-    OAuth refresh tokens write the rotated chain back to that same path."""
+    Refresh paths that rotate single-use OAuth refresh tokens must write the updated chain back to
+    the same store they read."""
     state = _provider_state_in(auth_store, provider_id)
-    return (state, _auth_file_path()) if state is not None else (None, None)
+    if state is not None:
+        return state, _auth_file_path()
+    global_state = _provider_state_in(_load_global_auth_store(), provider_id)
+    return (global_state, _global_auth_file_path()) if global_state is not None else (None, None)
 
 
 def _load_provider_state(auth_store: Dict[str, Any], provider_id: str) -> Optional[Dict[str, Any]]:
+    """Provider state; in profile mode falls back to the global-root ``auth.json`` per provider (same
+    shadowing as ``read_credential_pool``), so profile workers see globally-authed providers."""
     return _load_provider_state_with_source(auth_store, provider_id)[0]
 
 
 @contextmanager
 def _provider_state_transaction(
         provider_id: str, timeout_seconds: float = AUTH_LOCK_TIMEOUT_SECONDS):
-    """Lock the active auth store and yield ``(store, provider state, source path)``.
+    """Lock the active auth store and any global fallback source, in that order.
 
-    ``timeout_seconds`` must let waiters outlive a network call made inside the transaction."""
+    Re-reading the source after its lock is acquired prevents stale refreshes and whole-file lost
+    updates without inverting the documented auth -> shared lock order. ``timeout_seconds`` applies
+    to BOTH locks: a transaction that spans a network call must let waiters outlive that call."""
     with _auth_store_lock(timeout_seconds):
         auth_store = _load_auth_store()
-        yield (auth_store, *_load_provider_state_with_source(auth_store, provider_id))
+        state, source_path = _load_provider_state_with_source(auth_store, provider_id)
+        if source_path is None or _same_path(source_path, _auth_file_path()):
+            yield auth_store, state, source_path
+            return
+        with _auth_store_lock(timeout_seconds, target_path=source_path):
+            yield auth_store, _provider_state_in(_load_auth_store(source_path), provider_id), source_path
 
 
 def _store_provider_state(
@@ -724,6 +804,16 @@ def _save_active_provider_state(provider_id: str, state: Dict[str, Any]) -> Path
         return _save_auth_store(auth_store)
 
 
+def _persist_provider_state_to_store(
+    provider_id: str, state: Dict[str, Any], target_path: Path, *, set_active: bool = False,
+) -> Path:
+    """Merge one provider into a specific auth store under that store's lock."""
+    with _auth_store_lock(target_path=target_path):
+        auth_store = _load_auth_store(target_path)
+        _store_provider_state(auth_store, provider_id, dict(state), set_active=set_active)
+        return _save_auth_store(auth_store, target_path=target_path)
+
+
 def _save_provider_state_to_source(
     auth_store: Dict[str, Any], provider_id: str, state: Dict[str, Any], source_path: Optional[Path],
 ) -> None:
@@ -732,8 +822,11 @@ def _save_provider_state_to_source(
     A token refresh rewrites credentials, not the user's choice of provider: ``active_provider`` is
     left as it is (a Nous free-tier identity refreshed for a connector call must not become the
     inference provider of an install that has its own key)."""
-    _store_provider_state(auth_store, provider_id, state, set_active=False)
-    _save_auth_store(auth_store, target_path=source_path)
+    if source_path is None or _same_path(source_path, _auth_file_path()):
+        _store_provider_state(auth_store, provider_id, state, set_active=False)
+        _save_auth_store(auth_store)
+    else:
+        _persist_provider_state_to_store(provider_id, state, source_path, set_active=False)
 
 
 def mark_provider_active_if_unset(provider_id: str) -> None:
@@ -775,16 +868,30 @@ def is_runtime_provider_routable(provider_id: str) -> bool:
 
 
 def read_credential_pool(provider_id: Optional[str] = None) -> Dict[str, Any]:
-    """Return the persisted credential pool of the ACTIVE store, or one provider slice.
+    """Return the persisted credential pool, or one provider slice.
 
-    A named profile reads only its own ``auth.json``: credentials authenticated at the root are
-    not inherited (#111724) — ``hermes -p <name> auth add <provider>`` gives the profile its own."""
+    In profile mode the global-root ``auth.json`` is a read-only fallback applied per provider ONLY
+    when the profile has zero entries for it (``hermes auth add`` in the profile shadows global)."""
     pool = _load_auth_store().get("credential_pool")
     pool = pool if isinstance(pool, dict) else {}
+    global_pool = _load_global_auth_store().get("credential_pool")
+    global_pool = global_pool if isinstance(global_pool, dict) else {}
+
     if provider_id is None:
-        return dict(pool)
-    entries = pool.get(provider_id)
-    return list(entries) if isinstance(entries, list) else []
+        merged = dict(pool)
+        for gp_key, gp_entries in global_pool.items():
+            existing = merged.get(gp_key)
+            if not (isinstance(gp_entries, list) and gp_entries):
+                continue
+            if not (isinstance(existing, list) and existing):  # profile wins when it has ANY entries
+                merged[gp_key] = list(gp_entries)
+        return merged
+
+    provider_entries = pool.get(provider_id)
+    if isinstance(provider_entries, list) and provider_entries:
+        return list(provider_entries)
+    global_entries = global_pool.get(provider_id)
+    return list(global_entries) if isinstance(global_entries, list) else []
 
 
 _POOL_STATUS_FIELDS = (
@@ -938,7 +1045,7 @@ def unsuppress_credential_source(provider_id: str, source: str) -> bool:
 
 
 def get_provider_auth_state(provider_id: str) -> Optional[Dict[str, Any]]:
-    """Persisted auth state for a provider in the active store, or None."""
+    """Persisted auth state for a provider (profile first, global-root fallback), or None."""
     return _load_provider_state(_load_auth_store(), provider_id)
 
 
@@ -1454,16 +1561,11 @@ def resolve_provider(
             return "bedrock"
     except ImportError:
         pass  # boto3 not installed
-    from hermes_constants import display_hermes_home, profile_cli_selector, profile_name_for_home
-    # A named profile owns its credentials: the root's auth.json is never inherited (#111724), so
-    # the guidance names the profile the user must sign in to.
-    sel = profile_cli_selector()
-    profile_name = profile_name_for_home(get_hermes_home()) if sel else None
-    where = f"Profile '{profile_name}' is" if profile_name else "Hermes is"
+    from hermes_constants import display_hermes_home
     raise AuthError(
-        f"{where} not connected to any AI provider yet. Run `hermes {sel}model` to pick one (the free "
-        f"Nous tier needs no API key), type `/login` in chat, or add a key with "
-        f"`hermes {sel}auth add <provider>`. (Advanced: put an API key such as OPENROUTER_API_KEY in "
+        "Hermes is not connected to any AI provider yet. Run `hermes model` to pick one (the free "
+        "Nous tier needs no API key), type `/login` in chat, or add a key with "
+        f"`hermes auth add <provider>`. (Advanced: put an API key such as OPENROUTER_API_KEY in "
         f"{display_hermes_home()}/.env.)",
         code="no_provider_configured")
 
@@ -1661,6 +1763,10 @@ def resolve_nous_access_token(
 _NOUS_AUTH_STATUS_CACHE_TTL = 15.0  # seconds
 _nous_auth_status_cache: Optional[Tuple[float, str, Optional[float], Dict[str, Any]]] = None
 
+# mtime-keyed memo for _load_global_auth_store(): (path, mtime_ns, store); same invalidation rule.
+_global_auth_store_cache: Optional[Tuple[str, int, Dict[str, Any]]] = None
+
+
 def _auth_file_cache_key() -> Tuple[str, Optional[float]]:
     auth_file = _auth_file_path()
     try:
diff --git a/hermes_cli/auth_codex.py b/hermes_cli/auth_codex.py
index 37940c25ad..2e0a13e6fa 100644
--- a/hermes_cli/auth_codex.py
+++ b/hermes_cli/auth_codex.py
@@ -151,19 +151,29 @@ def _sync_codex_pool_entries(
 
 
 def _save_codex_tokens(
-    tokens: Dict[str, str], last_refresh: str = None, label: str = None, *, set_active: bool = True,
+    tokens: Dict[str, str], last_refresh: str = None, label: str = None, *,
+    set_active: bool = True, write_through: bool = False,
 ) -> None:
-    """Save Codex OAuth tokens (singleton AND ``credential_pool`` aliases) to the active auth store.
+    """Save Codex OAuth tokens to the auth store the grant was resolved FROM.
 
-    Codex refresh tokens are single-use with rotation-family reuse detection, so the pool rows that
-    alias the singleton must rotate with it or the next process replays the consumed token and
-    OpenAI revokes the whole family (#87503). ``set_active=False`` stores credentials for a side
-    tool (image gen) without making Codex the active inference provider.
+    Codex refresh tokens are single-use with rotation-family reuse detection. A profile without its
+    own ``providers.openai-codex`` block reads root's grant via the fallback, so a refresh under that
+    profile must rotate ROOT's chain — singleton AND ``credential_pool`` entries — or root keeps the
+    consumed refresh token, the next process replays it and OpenAI revokes the whole family
+    (#87503). Root-only write-back: a profile copy would shadow root and disable the write-through
+    on the next refresh (#74339). Mirrors the xAI source-aware save.
+
+    Only a token REFRESH passes ``write_through=True``: a fresh login or import under a profile
+    is the profile's own grant and must not overwrite the root account it was borrowing.
+    ``set_active=False`` stores credentials for a side tool (image gen) without making Codex the
+    active inference provider.
     """
-    from hermes_cli.auth import _provider_state_transaction, _save_auth_store, _store_provider_state, _utc_now_z
+    from hermes_cli.auth import (
+        _auth_file_path, _load_auth_store, _provider_state_transaction, _same_path,
+        _save_auth_store, _store_provider_state, _utc_now_z)
     if last_refresh is None:
         last_refresh = _utc_now_z()
-    with _provider_state_transaction("openai-codex") as (auth_store, state, _source_path):
+    with _provider_state_transaction("openai-codex") as (auth_store, state, source_path):
         state = dict(state) if state else {}
         # Capture the previous singleton tokens BEFORE overwriting: the pool sync uses them to
         # tell legacy singleton-aliases (refresh) from independent ``auth add`` accounts (keep).
@@ -172,10 +182,15 @@ def _save_codex_tokens(
         state.update(tokens=tokens, last_refresh=last_refresh, auth_mode="chatgpt")
         if label and str(label).strip():
             state["label"] = str(label).strip()
-        _store_provider_state(auth_store, "openai-codex", state, set_active=set_active)
+        target_store, target_path = auth_store, None
+        if write_through and source_path is not None and not _same_path(source_path, _auth_file_path()):
+            # Root-borrowed grant: the transaction already holds root's lock, so write the rotated
+            # chain into ROOT's store (never set_active — a refresh is not a provider choice).
+            target_store, target_path, set_active = _load_auth_store(source_path), source_path, False
+        _store_provider_state(target_store, "openai-codex", state, set_active=set_active)
         _sync_codex_pool_entries(
-            auth_store, tokens, last_refresh, previous_singleton_tokens=previous_singleton_tokens)
-        _save_auth_store(auth_store)
+            target_store, tokens, last_refresh, previous_singleton_tokens=previous_singleton_tokens)
+        _save_auth_store(target_store, target_path=target_path)
 
 
 def _recover_codex_tokens_from_cli(
@@ -469,10 +484,10 @@ def _refresh_codex_auth_tokens(tokens: Dict[str, str], timeout_seconds: float) -
     """Refresh Codex access token using the refresh token.
 
     The whole re-read -> endpoint POST -> write-back runs inside the SOURCE store's transaction:
-    two processes of one profile otherwise both submit the same single-use refresh token and OpenAI
-    revokes the family. A waiter that finds the store already rotated by its peer adopts the stored
-    pair instead of replaying the consumed token. The lock waits out a full endpoint timeout so the
-    waiter adopts, not times out.
+    two profiles borrowing the same root grant otherwise both submit the same single-use refresh
+    token (each holds only its own profile lock) and OpenAI revokes the family. A waiter that
+    finds root already rotated by its peer adopts the stored pair instead of replaying the
+    consumed token. Both locks wait out a full endpoint timeout so the waiter adopts, not times out.
     """
     from hermes_cli.auth import _provider_state_transaction, _save_codex_tokens, refresh_codex_oauth_pure
     lock_timeout = max(float(AUTH_LOCK_TIMEOUT_SECONDS), float(timeout_seconds) + 5.0)
@@ -505,8 +520,8 @@ def _refresh_codex_auth_tokens(tokens: Dict[str, str], timeout_seconds: float) -
         updated_tokens = {
             **tokens, "access_token": refreshed["access_token"],
             "refresh_token": refreshed["refresh_token"]}
-        # Nested transaction: the per-path lock is reentrant, and it re-reads under the held lock.
-        _save_codex_tokens(updated_tokens)
+        # Nested transaction: the per-path lock is reentrant, and it re-reads under the held locks.
+        _save_codex_tokens(updated_tokens, write_through=True)
     return updated_tokens
 
 
@@ -798,11 +813,15 @@ def clear_codex_pool_quota_cooldowns(access_token: Optional[str] = None) -> int:
     rate-limited entry does (a redeemed banked reset restores the whole account; a still-exhausted
     entry just re-freezes with fresh metadata on its next 429).
     """
+    from agent.credential_pool import _borrowed_single_use_pool_root, _profile_owns_pool_provider
     from hermes_cli.auth import _auth_store_lock, _load_auth_store, _save_auth_store
     cleared = 0
     try:
-        with _auth_store_lock():
-            auth_store = _load_auth_store()
+        # Same owner rule as ``persist_pool_entries``: a profile with no Codex rows of its own
+        # borrows the global-root pool, so the cooldown must clear where the rows actually live.
+        target = None if _profile_owns_pool_provider("openai-codex") else _borrowed_single_use_pool_root()
+        with _auth_store_lock(target_path=target):
+            auth_store = _load_auth_store(target)
             for entry in _codex_pool_dicts(_pool_entries(auth_store, "openai-codex")):
                 if access_token and str(entry.get("access_token") or "") != access_token:
                     continue
@@ -810,7 +829,7 @@ def clear_codex_pool_quota_cooldowns(access_token: Optional[str] = None) -> int:
                     _clear_pool_entry_status(entry)
                     cleared += 1
             if cleared:
-                _save_auth_store(auth_store)
+                _save_auth_store(auth_store, target_path=target)
     except Exception:
         logger.debug("Failed to clear Codex pool quota cooldowns", exc_info=True)
     return cleared
@@ -823,7 +842,10 @@ def _codex_pool_dicts(entries: Optional[List[Any]]) -> Iterator[Dict[str, Any]]:
 
 
 def _codex_pool_rate_limit_status() -> Optional[Dict[str, Any]]:
-    """Return metadata for a pool-only Codex credential in quota cooldown."""
+    """Return metadata for a pool-only Codex credential in quota cooldown.
+
+    Reads through ``read_credential_pool`` so a named profile with no Codex rows of its own sees
+    the global-root pool (the per-provider fallback every other pool read uses)."""
     from hermes_cli.auth import _nonempty_str, read_credential_pool
     from agent.credential_pool import _parse_absolute_timestamp
     try:
@@ -855,7 +877,8 @@ def _pool_entries(auth_store: Dict[str, Any], provider_id: str) -> Optional[List
 def _pool_codex_access_token() -> str:
     """First non-empty pool access_token not in an exhaustion cooldown window, else "".
 
-    Fallback for ``resolve_codex_runtime_credentials`` when the singleton has no creds.
+    Fallback for ``resolve_codex_runtime_credentials`` when the singleton has no creds; reads
+    through ``read_credential_pool`` so a profile inherits the global-root pool (#34143).
     """
     from agent.credential_pool import _parse_absolute_timestamp
     from hermes_cli.auth import _nonempty_str, read_credential_pool
diff --git a/hermes_cli/auth_commands.py b/hermes_cli/auth_commands.py
index c4c3520b8d..5c608e6f8d 100644
--- a/hermes_cli/auth_commands.py
+++ b/hermes_cli/auth_commands.py
@@ -550,6 +550,15 @@ def _print_external_login_notice() -> None:
         print(EXTERNAL_LOGINS_NOT_ADOPTED_NOTICE)
 
 
+    _print_oauth_heal_notices()
+
+
+def _print_oauth_heal_notices() -> None:
+    """Tell the user when load_pool() just consolidated a forked OAuth grant."""
+    for note in auth_mod.consume_oauth_heal_notices():
+        print(f"note: {note}")
+
+
 def auth_remove_command(args) -> None:
     provider = _normalize_provider(getattr(args, "provider", ""))
     target = getattr(args, "target", None)
@@ -658,7 +667,10 @@ def auth_status_command(args) -> None:
         raise SystemExit("Provider is required. Example: `hermes auth status spotify`.")
     if dispatch_plugin_auth("status", args, provider):
         return
+    if provider in auth_mod.SINGLE_USE_REFRESH_POOL_PROVIDERS:
+        load_pool(provider)  # runs the forked-grant heal first so the report reflects the consolidated grant
     status = auth_mod.get_auth_status(provider)
+    _print_oauth_heal_notices()
     if status.get("free_tier"):
         # Free tier: not an account login, so no account fields; point at the upgrade path.
         label, hint = _free_tier_lines()
diff --git a/hermes_cli/auth_oauth_grants.py b/hermes_cli/auth_oauth_grants.py
index c6efa8f820..11913ef471 100644
--- a/hermes_cli/auth_oauth_grants.py
+++ b/hermes_cli/auth_oauth_grants.py
@@ -1,4 +1,4 @@
-"""Single-use OAuth grant hygiene: strip cloned grants from profiles.
+"""Single-use OAuth grant hygiene: strip cloned grants from profiles, heal forked grants.
 
 Split out of ``hermes_cli/auth.py`` and re-exported there; origin helpers are imported lazily
 inside each function so ``hermes_cli.auth.<name>`` patches still intercept (and no import cycle).
@@ -8,8 +8,11 @@ from __future__ import annotations
 
 import logging
 import json
+import os
 from pathlib import Path
-from typing import Any, Dict
+from typing import Any, Dict, List, Optional, Tuple
+from hermes_cli.auth_constants import _decode_jwt_claims
+from utils import file_signature
 
 # Log-record parity with the origin module (caplog tests pin "hermes_cli.auth").
 logger = logging.getLogger("hermes_cli.auth")
@@ -18,7 +21,8 @@ logger = logging.getLogger("hermes_cli.auth")
 # revokes the old one, so a grant forked into two auth.json files is ONE credential with two
 # owners — the first to refresh strands the other with ``invalid_grant`` /
 # ``refresh_token_reused``.
-# Profiles must never receive a copy; each profile signs in on its own (``hermes -p <name> auth add``).
+# Profiles must never receive a copy: ONE grant lives at the global root and named profiles read
+# it through the ``read_credential_pool`` root fallback.
 SINGLE_USE_REFRESH_POOL_PROVIDERS = frozenset({"anthropic", "openai-codex", "xai-oauth"})
 
 # Singleton credential files holding the same single-use grants outside ``auth.json``. Copying one
@@ -40,12 +44,16 @@ def _is_oauth_pool_payload(entry: Any) -> bool:
         or str(entry.get("access_token") or "").startswith("sk-ant-oat"))
 
 
+def _is_pkce_row(row: Dict[str, Any]) -> bool:
+    return str(row.get("source") or "").endswith("hermes_pkce")
+
+
 def strip_cloned_single_use_oauth_grants(profile_dir: Path) -> Dict[str, Any]:
     """Remove forked single-use OAuth grants from a freshly cloned profile.
 
     Called after any path that copies credential files between profiles (``hermes profile create
     --clone-all``, the dashboard/TUI ``mirror_credentials`` flow). API-key pool rows are kept — a
-    static key is safe to duplicate; the clone signs into the OAuth provider itself. Returns ``{"pool": [...provider ids], "providers": [...],
+    static key is safe to duplicate. Returns ``{"pool": [...provider ids], "providers": [...],
     "files": [...]}`` of what was stripped. Never raises: a clone must not fail because hygiene
     could not run — the caller logs the summary.
     """
@@ -63,9 +71,10 @@ def strip_cloned_single_use_oauth_grants(profile_dir: Path) -> Dict[str, Any]:
     auth_path = profile_dir / "auth.json"
     if not auth_path.is_file():
         return stripped
-    # A profile auth.json that IS the root store (symlink / hardlink) is not a clone; stripping it
-    # would delete the root's single-use grants. Resolve identity positively: same path, or
-    # samefile() says so; any error refuses (fail closed).
+    # A profile auth.json that IS the shared root store (symlink / hardlink) is not a clone;
+    # stripping it would delete every profile's single-use grants. _is_same_auth_store swallows
+    # a samefile() OSError as "two stores", which here would fail OPEN — so resolve identity
+    # positively: same path, or samefile() says so; any error refuses.
     try:
         from hermes_constants import get_default_hermes_root
         root_auth_path = get_default_hermes_root() / "auth.json"
@@ -96,9 +105,12 @@ def strip_cloned_single_use_oauth_grants(profile_dir: Path) -> Dict[str, Any]:
                 if kept:
                     pool[provider_id] = kept
                 else:
+                    # No local rows → read_credential_pool falls back to the root slice.
                     del pool[provider_id]
     providers = store.get("providers")
     if isinstance(providers, dict):
+        # _load_provider_state has the same root fallback, so dropping the copy keeps the
+        # profile working while removing the fork.
         for provider_id in _DEVICE_CODE_BLOCK_PROVIDERS:
             block = providers.get(provider_id)
             if isinstance(block, dict) and block:
@@ -113,3 +125,515 @@ def strip_cloned_single_use_oauth_grants(profile_dir: Path) -> Dict[str, Any]:
         logger.debug(
             "Failed to strip cloned single-use OAuth grants from %s", auth_path, exc_info=True)
     return stripped
+
+
+_OAUTH_TOKEN_FIELDS = (
+    "access_token", "refresh_token", "expires_at", "expires_at_ms", "last_refresh")
+
+_oauth_heal_notices: List[str] = []
+
+# provider -> fingerprint (see ``_heal_forked_single_use_oauth_grants``) of the last store
+# verified fork-free; lets load_pool() skip the locked scan.
+_oauth_heal_clean_marks: Dict[str, Tuple[Any, ...]] = {}
+
+# Filename for the ON-DISK twin of ``_oauth_heal_clean_marks``. The in-memory mark only silences
+# the heal for the life of ONE process, so every fresh `hermes` invocation and every new worker
+# re-pays the heal's two nested EXCLUSIVE auth-store locks just to discover there is nothing to
+# consolidate. Behind a sibling holding those locks that costs a full AUTH_LOCK_TIMEOUT_SECONDS
+# per provider (measured: 30s for two providers on an otherwise-idle machine) before the process
+# can do anything at all.
+_OAUTH_HEAL_CLEAN_MARK_FILENAME = "oauth_heal_clean.json"
+
+
+def _json_shape(fingerprint: tuple) -> list:
+    """The fingerprint as it reads back from JSON (tuples become lists), so the on-disk compare
+    is exact."""
+    return json.loads(json.dumps(fingerprint))
+
+
+def _oauth_heal_clean_mark_path() -> Optional[Path]:
+    """Where the persisted clean marks live, or None when unavailable."""
+    try:
+        from hermes_cli.auth import _auth_file_path
+
+        return _auth_file_path().parent / "cache" / _OAUTH_HEAL_CLEAN_MARK_FILENAME
+    except Exception:
+        return None
+
+
+def _persisted_oauth_heal_fingerprint(provider_id: str) -> Optional[list]:
+    """The stored clean-mark fingerprint for ``provider_id``, or None.
+
+    Pure cache read: any problem at all (absent, unreadable, corrupt, wrong shape) means "no
+    mark", which falls through to the locked heal — the pre-existing behaviour. It must never
+    raise into a credential path.
+    """
+    path = _oauth_heal_clean_mark_path()
+    if path is None:
+        return None
+    try:
+        data = json.loads(path.read_text(encoding="utf-8"))
+    except Exception:
+        return None
+    if not isinstance(data, dict):
+        return None
+    stored = data.get(provider_id)
+    return stored if isinstance(stored, list) else None
+
+
+def _persist_oauth_heal_clean_mark(provider_id: str, fingerprint: tuple) -> None:
+    """Record ``provider_id`` as clean for this exact fingerprint.
+
+    Best-effort by design: a failed write only means the next process re-runs the heal, which is
+    what it did before this cache existed.
+    """
+    path = _oauth_heal_clean_mark_path()
+    if path is None:
+        return
+    try:
+        from utils import atomic_json_write
+
+        try:
+            existing = json.loads(path.read_text(encoding="utf-8"))
+        except Exception:
+            existing = {}
+        if not isinstance(existing, dict):
+            existing = {}
+        marks = {
+            key: value for key, value in existing.items()
+            if isinstance(key, str) and isinstance(value, list)
+        }
+        new_mark = _json_shape(fingerprint)
+        if marks.get(provider_id) == new_mark:
+            return  # already recorded; skip the rewrite
+        marks[provider_id] = new_mark
+        from hermes_constants import mkdir_under_hermes_home
+        mkdir_under_hermes_home(path.parent)
+        # 0o600 like the MCP schema cache: this names credential-store paths.
+        atomic_json_write(path, marks, mode=0o600)
+    except Exception:
+        logger.debug(
+            "%s: could not persist the forked-OAuth clean mark", provider_id, exc_info=True)
+
+
+def _mark_oauth_heal_clean(provider_id: str, fingerprint: tuple) -> None:
+    """Stamp the clean mark both in memory and on disk."""
+    _oauth_heal_clean_marks[provider_id] = fingerprint
+    _persist_oauth_heal_clean_mark(provider_id, fingerprint)
+
+
+def consume_oauth_heal_notices() -> List[str]:
+    """Return (and clear) human-readable notes about heals run in this process.
+
+    ``hermes auth list`` / ``hermes auth status`` print them so the user sees the consolidation.
+    """
+    from hermes_cli.auth import _oauth_heal_notices
+    notes = list(_oauth_heal_notices)
+    _oauth_heal_notices.clear()
+    return notes
+
+
+def _oauth_identity(entry: Dict[str, Any]) -> Optional[str]:
+    """Stable account identity for an OAuth row when the token carries one.
+
+    Codex / xAI access tokens are JWTs with ``sub`` / ``email`` / ``chatgpt_account_id`` claims;
+    Anthropic ``sk-ant-oat`` tokens carry none (None → lineage rests on id / token material).
+    """
+    from hermes_cli.auth import _nonempty_str
+    if not isinstance(entry, dict):
+        return None
+    for token in (entry.get("access_token"), entry.get("id_token")):
+        claims = _decode_jwt_claims(token)
+        if not claims:
+            continue
+        nested = claims.get("https://api.openai.com/auth")
+        account = nested.get("chatgpt_account_id") if isinstance(nested, dict) else None
+        for value in (account, claims.get("sub"), claims.get("email")):
+            if _nonempty_str(value):
+                return value.strip()
+    return None
+
+
+def _oauth_freshness(entry: Dict[str, Any]) -> float:
+    """Best-effort 'how recently was this pair issued' score (epoch seconds).
+
+    A rotation always issues a later-expiring access token, so ``expires_at`` ordering identifies
+    the live copy; ``last_refresh`` and the JWT ``exp`` claim are fallbacks.
+    """
+    from agent.credential_pool import _parse_absolute_timestamp
+    stamps = [entry.get(k) for k in ("expires_at_ms", "expires_at", "last_refresh")]
+    best = max((ts for ts in map(_parse_absolute_timestamp, stamps) if ts), default=0.0)
+    if best == 0.0:
+        exp = _decode_jwt_claims(entry.get("access_token")).get("exp")
+        best = _parse_absolute_timestamp(exp) or 0.0
+    return best
+
+
+def _find_root_counterpart(
+    profile_row: Dict[str, Any], root_rows: List[Dict[str, Any]]) -> Optional[int]:
+    """Index of the root OAuth row that shares a grant lineage with *profile_row*.
+
+    Only a copied row ID or shared token material establishes lineage. The same
+    account/client can issue multiple independent grants; identity is not proof.
+    """
+    from hermes_cli.auth import _nonempty_str
+    candidates = [i for i, r in enumerate(root_rows) if _is_oauth_pool_payload(r)]
+    if not candidates:
+        return None
+    pid = profile_row.get("id")
+    for i in candidates:
+        if pid and root_rows[i].get("id") == pid:
+            return i
+    for key in ("refresh_token", "access_token"):
+        p_val = profile_row.get(key)
+        if not _nonempty_str(p_val):
+            continue
+        for i in candidates:
+            if root_rows[i].get(key) == p_val:
+                return i
+    return None
+
+
+def _adopt_oauth_material(target: Dict[str, Any], winner: Dict[str, Any]) -> Dict[str, Any]:
+    """Return *target* carrying *winner*'s token pair, status markers cleared."""
+    from hermes_cli.auth import _POOL_STATUS_FIELDS
+    merged = dict(target)
+    for key in _OAUTH_TOKEN_FIELDS:
+        if winner.get(key) is not None:
+            merged[key] = winner[key]
+        else:
+            merged.pop(key, None)
+    merged.update(dict.fromkeys(_POOL_STATUS_FIELDS))
+    return merged
+
+
+def _singleton_as_row(path: Path) -> Optional[Dict[str, Any]]:
+    """Read a ``.anthropic_oauth.json`` as a pool-row-shaped dict, or None."""
+    try:
+        data = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, ValueError):
+        return None
+    if not isinstance(data, dict) or not str(data.get("accessToken") or "").strip():
+        return None
+    return {
+        "access_token": data.get("accessToken"),
+        "refresh_token": data.get("refreshToken"),
+        "expires_at_ms": data.get("expiresAt")}
+
+
+def heal_forked_single_use_oauth_grants(provider_id: str) -> Optional[Dict[str, Any]]:
+    """One-time heal for installs that ALREADY forked a single-use grant into a profile.
+
+    Forked copies are one credential with several owners: whichever profile rotated last holds the
+    only live refresh token and every other copy (root included) is spent. Runs at profile
+    ``load_pool()`` time for ``SINGLE_USE_REFRESH_POOL_PROVIDERS``: finds profile rows sharing
+    LINEAGE with a root row (same pool id or shared token material), keeps the
+    freshest rotation, writes it into ROOT when root's is older, and strips the profile's copy so
+    the profile borrows root from then on. Idempotent; never touches API-key rows; never deletes a
+    row with no root counterpart (an independent ``hermes -p <p> auth add`` grant, or the only
+    surviving copy); reads only the two auth.json files the root fallback already reads. Returns
+    ``{"adopted", "stripped_ids", "files", "providers_block"}`` when something healed, else None.
+    Never raises.
+    """
+    if provider_id not in SINGLE_USE_REFRESH_POOL_PROVIDERS:
+        return None
+    try:
+        return _heal_forked_single_use_oauth_grants(provider_id)
+    except Exception:
+        logger.debug("%s: forked-OAuth heal skipped", provider_id, exc_info=True)
+        return None
+
+
+def _heal_forked_provider_block(
+    profile_store: Dict[str, Any], root_store: Dict[str, Any], provider_id: str,
+    lineage_proven: bool = False) -> Optional[bool]:
+    """Consolidate a forked ``providers.<id>`` device-code block into root.
+
+    *lineage_proven* carries the pool-row verdict: a profile row that matched root by copied id
+    or shared tokens proves the fork even after both sides rotated past token equality. Root's
+    ``load_pool()`` re-seeds its ``device_code`` row FROM this block, so leaving root's block on
+    the spent pair would undo the pool-row heal on the next root load.
+
+    Returns None when nothing matched, False when the profile copy was dropped (root already
+    newest), True when the profile copy was fresher and was adopted into root.
+    """
+    p_providers, r_providers = profile_store.get("providers"), root_store.get("providers")
+    if not (isinstance(p_providers, dict) and isinstance(r_providers, dict)):
+        return None
+    p_block, r_block = p_providers.get(provider_id), r_providers.get(provider_id)
+    if not (isinstance(p_block, dict) and p_block and isinstance(r_block, dict) and r_block):
+        return None
+
+    def _flat(block: Dict[str, Any]) -> Dict[str, Any]:
+        tokens = block.get("tokens") if isinstance(block.get("tokens"), dict) else {}
+        return {**tokens, "last_refresh": block.get("last_refresh")}
+
+    p_flat, r_flat = _flat(p_block), _flat(r_block)
+    # Provider blocks have no stable pool-row ID. Without a shared token pair
+    # component (or lineage proven by the pool rows), a common account is
+    # insufficient evidence of a copied grant.
+    if not lineage_proven and not any(
+        p_flat.get(key) and p_flat.get(key) == r_flat.get(key)
+        for key in ("access_token", "refresh_token")
+    ):
+        return None
+    adopted = _oauth_freshness(p_flat) > _oauth_freshness(r_flat)
+    if adopted:
+        r_providers[provider_id] = dict(p_block)
+    del p_providers[provider_id]
+    return adopted
+
+
+def _stat_sig(p: Optional[Path]) -> Optional[Tuple[int, int, int, int]]:
+    """File signature from ONE stat, or None when absent — a torn pair from two stats could
+    leave a persisted clean mark matching a store rewritten between them."""
+    try:
+        st = p.stat() if p is not None else None
+    except OSError:
+        return None
+    return file_signature(st) if st is not None else None
+
+
+def _pool_rows(store: Dict[str, Any], provider_id: str) -> Tuple[Any, List[Any]]:
+    """``(store["credential_pool"], its provider_id rows-or-[])`` — pool may be None/non-dict."""
+    pool = store.get("credential_pool")
+    rows = pool.get(provider_id) if isinstance(pool, dict) else None
+    return pool, rows if isinstance(rows, list) else []
+
+
+def _adopt_if_fresher(
+    target: Dict[str, Any], candidate: Dict[str, Any]) -> Optional[Dict[str, Any]]:
+    """*target* carrying *candidate*'s pair when the candidate rotated later, else None."""
+    fresher = _oauth_freshness(candidate) > _oauth_freshness(target)
+    return _adopt_oauth_material(target, candidate) if fresher else None
+
+
+class _HealPass:
+    """One heal pass over a profile store vs the root store for *provider_id*."""
+
+    def __init__(self, profile_store, root_store, provider_id, root_singleton: Optional[Path]):
+        self.profile_store, self.root_store = profile_store, root_store
+        self.provider_id = provider_id
+        self.summary: Dict[str, Any] = {
+            "adopted": False, "stripped_ids": [], "files": [], "providers_block": False}
+        self.profile_changed = self.root_changed = False
+        self.lineage_proven = False  # a profile pool row matched root by copied id / shared tokens
+        self.p_pool, self.p_rows = _pool_rows(profile_store, provider_id)
+        self.r_pool, self.r_rows = _pool_rows(root_store, provider_id)
+        self.r_oauth = [r for r in self.r_rows if _is_oauth_pool_payload(r)]
+        self.root_singleton = root_singleton
+        self.root_singleton_row = (
+            _singleton_as_row(root_singleton)
+            if root_singleton is not None and root_singleton.exists() else None)
+
+    def _adopt_root_row(self, idx: int, row: Dict[str, Any]) -> None:
+        merged = _adopt_if_fresher(self.r_rows[idx], row)
+        if merged is not None:
+            self.r_rows[idx] = merged
+            self.root_changed = self.summary["adopted"] = True
+
+    def _adopt_root_singleton(self, row: Dict[str, Any]) -> None:
+        merged = _adopt_if_fresher(self.root_singleton_row, row)
+        if merged is not None:
+            self.root_singleton_row = merged
+            self.summary["adopted"] = True
+
+    def heal_pool_rows(self) -> None:
+        kept_rows: List[Any] = []
+        for row in self.p_rows:
+            if not _is_oauth_pool_payload(row):
+                kept_rows.append(row)  # API keys are safe to duplicate
+                continue
+            match_idx = _find_root_counterpart(row, self.r_rows)
+            if match_idx is not None:
+                self.lineage_proven = True
+                self._adopt_root_row(match_idx, row)
+            # No root pool counterpart. Root's grant may live only in its .anthropic_oauth.json
+            # (the ``hermes auth`` PKCE shape); a profile hermes_pkce-family row is its copy.
+            elif _is_pkce_row(row) and self.root_singleton_row is not None and not self.r_oauth:
+                self._adopt_root_singleton(row)
+            else:
+                # Root holds no copy of this lineage (independent account, or root never had the
+                # grant): the profile's row may be the only surviving copy — leave it alone.
+                kept_rows.append(row)
+                continue
+            self.summary["stripped_ids"].append(row.get("id"))
+            self.profile_changed = True
+        if self.profile_changed and isinstance(self.p_pool, dict):
+            if kept_rows:
+                self.p_pool[self.provider_id] = kept_rows
+            else:
+                self.p_pool.pop(self.provider_id, None)
+
+    def heal_provider_block(self) -> None:
+        if self.provider_id not in _DEVICE_CODE_BLOCK_PROVIDERS:
+            return
+        block_result = _heal_forked_provider_block(
+            self.profile_store, self.root_store, self.provider_id, self.lineage_proven)
+        if block_result is not None:
+            self.profile_changed = self.summary["providers_block"] = True
+            if block_result:
+                self.root_changed = self.summary["adopted"] = True
+
+    def heal_profile_singleton(self, profile_singleton: Optional[Path]) -> None:
+        if profile_singleton is None or not profile_singleton.exists():
+            return
+        from hermes_cli.auth import _is_same_auth_store
+        if self.root_singleton is not None and _is_same_auth_store(profile_singleton, self.root_singleton):
+            return  # an aliased singleton pair is one shared grant, not a fork: never self-compare/unlink
+        # See #101356.
+        p_single = _singleton_as_row(profile_singleton)
+        root_has_grant = bool(self.r_oauth) or self.root_singleton_row is not None
+        # Otherwise root has NO grant for this provider (or the file is not a grant): the
+        # profile's singleton may be the only surviving copy — never delete it.
+        if p_single is None or not root_has_grant:
+            return
+        if self.root_singleton_row is not None:
+            self._adopt_root_singleton(p_single)
+        else:
+            # Root only has pool rows: fold the singleton's pair into the freshest-matching
+            # root pkce row, if any.
+            idx = next(
+                (i for i, r in enumerate(self.r_rows)
+                 if _is_oauth_pool_payload(r) and _is_pkce_row(r)), None)
+            if idx is not None:
+                self._adopt_root_row(idx, p_single)
+        try:
+            profile_singleton.unlink()
+            self.summary["files"].append(profile_singleton.name)
+        except OSError:
+            logger.debug("could not remove %s", profile_singleton, exc_info=True)
+
+    def sync_root_singleton_with_pkce_row(self) -> None:
+        """Keep root's singleton and its ``hermes_pkce``-seeded pool row in step.
+
+        Root's next load_pool() re-seeds that row FROM the singleton file, so a stale file would
+        resurrect the spent pair (and a stale row would be overwritten by a fresh file).
+        """
+        if not (
+            self.summary["adopted"] and self.root_singleton is not None
+            and self.root_singleton_row is not None):
+            return
+        pkce_idx = next(
+            (i for i, r in enumerate(self.r_rows)
+             if _is_oauth_pool_payload(r) and r.get("source") == "hermes_pkce"), None)
+        if pkce_idx is None:
+            return
+        pkce_row = self.r_rows[pkce_idx]
+        row_fresh = _oauth_freshness(pkce_row)
+        single_fresh = _oauth_freshness(self.root_singleton_row)
+        if row_fresh > single_fresh:
+            self.root_singleton_row = _adopt_oauth_material(self.root_singleton_row, pkce_row)
+        elif single_fresh > row_fresh:
+            self.r_rows[pkce_idx] = _adopt_oauth_material(pkce_row, self.root_singleton_row)
+            self.root_changed = True
+
+    @property
+    def dirty(self) -> bool:
+        return bool(self.profile_changed or self.root_changed or self.summary["adopted"])
+
+    def notice(self, profile_name: str) -> str:
+        summary = self.summary
+        log_bits = [bit for bit, present in (
+            (f"pool rows {summary['stripped_ids']}", summary["stripped_ids"]),
+            (f"providers.{self.provider_id} block", summary["providers_block"]),
+            (", ".join(summary["files"]), summary["files"])) if present]
+        verdict = (
+            "profile copy was the live pair; root updated"
+            if summary["adopted"] else "root copy already newest; profile copy dropped")
+        return (
+            f"profile {profile_name}: consolidated forked {self.provider_id} OAuth grant "
+            f"({'; '.join(log_bits) or 'no-op'}) into the root grant — {verdict}; "
+            f"this profile now borrows the root grant (#100339)")
+
+
+def _heal_forked_single_use_oauth_grants(provider_id: str) -> Optional[Dict[str, Any]]:
+    from hermes_cli.auth import (
+        _auth_file_path, _auth_store_lock, _global_auth_file_path, _load_auth_store,
+        _is_same_auth_store, _oauth_heal_clean_marks, _oauth_heal_notices, _same_path,
+        _save_auth_store)
+    root_path = _global_auth_file_path()
+    if root_path is None:
+        return None  # classic mode: nothing to consolidate into
+    if os.environ.get("PYTEST_CURRENT_TEST"):
+        # Same seat belt as the write-through paths: never touch the real user's
+        # ~/.hermes/auth.json from a test that forgot to isolate HOME.
+        real_home_env = os.environ.get("HOME", "")
+        if real_home_env and _same_path(root_path, Path(real_home_env) / ".hermes" / "auth.json"):
+            return None
+    profile_path = _auth_file_path()
+    profile_home = profile_path.parent
+    is_anthropic = provider_id == "anthropic"
+    profile_singleton = profile_home / ".anthropic_oauth.json" if is_anthropic else None
+    root_singleton = root_path.parent / ".anthropic_oauth.json" if is_anthropic else None
+
+    # Hot-path short-circuit: load_pool() runs per model call. Once this profile's store was
+    # verified clean for *provider_id*, skip the locked read-modify-write until one of the files
+    # it reads changes.
+    #
+    # The ROOT store is part of the fingerprint even though only the profile side is read above:
+    # this heal consolidates root -> profile, so a new forked grant appearing in ROOT must
+    # invalidate the mark. The in-memory mark omitted it and got away with it because it died
+    # with the process; a persisted mark would otherwise keep skipping a heal that has become
+    # necessary. Sizes, inodes and ctimes ride along with the mtimes for the same reason:
+    # a metadata-preserving rewrite (``rsync -t``, ``tar -p``, a restore) would otherwise leave
+    # a stale mark looking current indefinitely rather than for one process.
+    fingerprint = (
+        str(profile_path), _stat_sig(profile_path), _stat_sig(profile_singleton),
+        str(root_path), _stat_sig(root_path), _stat_sig(root_singleton),
+    )
+    if _oauth_heal_clean_marks.get(provider_id) == fingerprint:
+        return None
+    # Same check against the on-disk mark, BEFORE taking any lock: a fresh process would
+    # otherwise pay two nested exclusive auth-store locks — a full AUTH_LOCK_TIMEOUT_SECONDS
+    # each behind a sibling holding them — only to find nothing to consolidate.
+    if _persisted_oauth_heal_fingerprint(provider_id) == _json_shape(fingerprint):
+        _oauth_heal_clean_marks[provider_id] = fingerprint
+        return None
+    if fingerprint[1] is None and fingerprint[2] is None:
+        _mark_oauth_heal_clean(provider_id, fingerprint)
+        return None
+    if _is_same_auth_store(profile_path, root_path):
+        # The profile's auth.json IS the root store (symlink/hardlink alias — a deliberate way to
+        # share one grant). Both "sides" would read the same file, every OAuth row would match
+        # itself, and the strip would write through the alias and delete the shared credential.
+        # Nothing to consolidate; the mtime mark keeps this off the per-call hot path.
+        _mark_oauth_heal_clean(provider_id, fingerprint)
+        # See #101356.
+        logger.debug("%s: forked-OAuth heal skipped, %s is the root store", provider_id, profile_path)
+        return None
+
+    # Lock order: active (profile) store first, then the root source store — the same order
+    # ``_provider_state_transaction`` uses.
+    with _auth_store_lock():
+        profile_store = (
+            _load_auth_store(profile_path) if profile_path.exists() else {"providers": {}})
+        with _auth_store_lock(target_path=root_path):
+            root_store = _load_auth_store(root_path) if root_path.exists() else {"providers": {}}
+            run = _HealPass(profile_store, root_store, provider_id, root_singleton)
+            run.heal_pool_rows()
+            run.heal_provider_block()
+            run.heal_profile_singleton(profile_singleton)
+            if not run.dirty:
+                _mark_oauth_heal_clean(provider_id, fingerprint)
+                return None
+            run.sync_root_singleton_with_pkce_row()
+            summary = run.summary
+            if run.root_changed:
+                if isinstance(run.r_pool, dict):
+                    run.r_pool[provider_id] = run.r_rows
+                else:
+                    root_store["credential_pool"] = {provider_id: run.r_rows}
+                _save_auth_store(root_store, target_path=root_path)
+            singleton_row = run.root_singleton_row
+            if summary["adopted"] and root_singleton is not None and singleton_row is not None:
+                from agent.anthropic_credentials import _write_hermes_oauth_credentials
+                _write_hermes_oauth_credentials(
+                    singleton_row.get("access_token") or "", singleton_row.get("refresh_token"),
+                    singleton_row.get("expires_at_ms"), target=root_singleton)
+            if run.profile_changed and profile_path.exists():
+                _save_auth_store(profile_store, target_path=profile_path)
+    message = run.notice(profile_home.name)
+    logger.info(message)
+    _oauth_heal_notices.append(message)
+    return summary
diff --git a/hermes_cli/auth_xai.py b/hermes_cli/auth_xai.py
index 568062d2ea..34bb7cb177 100644
--- a/hermes_cli/auth_xai.py
+++ b/hermes_cli/auth_xai.py
@@ -71,7 +71,12 @@ def _xai_oauth_state_has_usable_tokens(state: Optional[Dict[str, Any]]) -> bool:
 
 
 def _read_xai_oauth_tokens(*, _lock: bool = True) -> Dict[str, Any]:
+    from hermes_cli.auth import _load_global_auth_store
     state = _xai_oauth_state_from_store(_load_auth_store_maybe_locked(_lock))
+    if not _xai_oauth_state_has_usable_tokens(state):
+        global_state = _xai_oauth_state_from_store(_load_global_auth_store())
+        if _xai_oauth_state_has_usable_tokens(global_state):
+            state = global_state
     if not state:
         raise _xai_err(
             "No xAI OAuth credentials stored. Select xAI Grok OAuth (SuperGrok / Premium+) in `hermes model`.",
@@ -92,6 +97,33 @@ def _read_xai_oauth_tokens(*, _lock: bool = True) -> Dict[str, Any]:
     }
 
 
+def _write_through_xai_oauth_to_global_root(state: Dict[str, Any]) -> None:
+    """Best-effort persist of a rotated xAI grant into the global-root auth.json.
+
+    xAI rotates refresh_token on every refresh, so a profile that refreshed a root-resolved grant
+    must write the chain back to root. Touches only root ``providers.xai-oauth``; swallows all
+    errors (root-stale is better than breaking the profile's own save).
+    """
+    from hermes_cli.auth import _global_auth_file_path, _persist_provider_state_to_store
+    global_path = _global_auth_file_path()
+    if global_path is None:  # classic mode (profile == root); the profile save already hit root
+        return
+    # Seat belt: under pytest never write the real ~/.hermes/auth.json (mirrors the read-side guard
+    # in _load_global_auth_store). Uses raw HOME, not Path.home(), which fixtures may monkeypatch.
+    real_home_env = os.environ.get("HOME", "") if os.environ.get("PYTEST_CURRENT_TEST") else ""
+    if real_home_env:
+        real_root = Path(real_home_env) / ".hermes" / "auth.json"
+        try:
+            if global_path.resolve(strict=False) == real_root.resolve(strict=False):
+                return
+        except Exception:
+            return
+    try:
+        _persist_provider_state_to_store("xai-oauth", state, global_path, set_active=False)
+    except Exception as exc:  # pragma: no cover - best effort
+        logger.debug("xAI OAuth: write-through to global root failed: %s", exc)
+
+
 def _save_xai_oauth_tokens(
     tokens: Dict[str, Any], *, discovery: Optional[Dict[str, Any]] = None, redirect_uri: str = "",
     last_refresh: Optional[str] = None, auth_mode: str = "oauth_device_code",
@@ -102,19 +134,28 @@ def _save_xai_oauth_tokens(
     Pass ``set_active=False`` for side-tool bootstrap (TTS/setup, tools config, dashboard, refresh)
     so inference routing is unchanged.
     """
-    from hermes_cli.auth import _auth_store_lock, _load_auth_store, _load_provider_state, _save_auth_store, _store_provider_state, _utc_now_z
+    from hermes_cli.auth import _auth_store_lock, _global_auth_file_path, _load_auth_store, _load_provider_state_with_source, _same_path, _save_auth_store, _store_provider_state, _utc_now_z, _write_through_xai_oauth_to_global_root
     if last_refresh is None:
         last_refresh = _utc_now_z()
     with _auth_store_lock():
         auth_store = _load_auth_store()
-        state = _load_provider_state(auth_store, "xai-oauth") or {}
+        # A profile lacking its own xai-oauth block reads root's grant via fallback; refreshing it
+        # must write the rotated chain back to root or root keeps a revoked refresh token. Decide by
+        # where the grant was resolved FROM (key presence lies: _store_provider_state creates it).
+        state, source_path = _load_provider_state_with_source(auth_store, "xai-oauth")
+        state = state if state is not None else {}
         state.update(tokens=tokens, last_refresh=last_refresh, auth_mode=auth_mode)
         if discovery:
             state["discovery"] = discovery
         if redirect_uri:
             state["redirect_uri"] = redirect_uri
-        _store_provider_state(auth_store, "xai-oauth", state, set_active=set_active)
-        _save_auth_store(auth_store)
+        global_root = _global_auth_file_path()
+        if source_path is not None and global_root is not None and _same_path(source_path, global_root):
+            # Root-only write-back: a profile copy would shadow root and disable write-through.
+            _write_through_xai_oauth_to_global_root(state)
+        else:
+            _store_provider_state(auth_store, "xai-oauth", state, set_active=set_active)
+            _save_auth_store(auth_store)
 
 
 def _xai_jwt_exp(access_token: Any) -> Optional[float]:
diff --git a/hermes_cli/profile_credential_audit.py b/hermes_cli/profile_credential_audit.py
deleted file mode 100644
index 9dd5a19290..0000000000
--- a/hermes_cli/profile_credential_audit.py
+++ /dev/null
@@ -1,74 +0,0 @@
-"""Post-update audit: named profiles that have no credentials of their own.
-
-Until Sep 2026 a named profile with an empty ``auth.json`` silently read the root profile's
-``auth.json`` (provider state + credential pool) and even wrote refreshed OAuth tokens back to it.
-Profiles are independent islands, so that fallback is gone (#111724): such a profile now gets the
-"not connected to any AI provider" setup prompt instead of the owner's credentials. ``hermes update``
-names every affected profile up front so nobody discovers the change from a dead bot.
-"""
-
-from __future__ import annotations
-
-import json
-import logging
-from pathlib import Path
-from typing import List
-
-logger = logging.getLogger(__name__)
-
-
-def _auth_store_has_credentials(auth_path: Path) -> bool:
-    try:
-        store = json.loads(auth_path.read_text(encoding="utf-8-sig"))
-    except (OSError, ValueError):
-        return False
-    if not isinstance(store, dict):
-        return False
-    providers = store.get("providers")
-    if isinstance(providers, dict) and any(isinstance(v, dict) and v for v in providers.values()):
-        return True
-    pool = store.get("credential_pool")
-    return isinstance(pool, dict) and any(isinstance(v, list) and v for v in pool.values())
-
-
-def _profile_has_own_credentials(profile_dir: Path) -> bool:
-    """auth.json credentials, a provider key in ``.env``, or a model block carrying its own key/base URL."""
-    if _auth_store_has_credentials(profile_dir / "auth.json"):
-        return True
-    from hermes_cli.auth import PROVIDER_REGISTRY
-    from hermes_cli.main import _dotenv_has_provider_key
-    provider_env_vars = {"OPENROUTER_API_KEY", "OPENAI_API_KEY", "ANTHROPIC_API_KEY", "ANTHROPIC_TOKEN", "OPENAI_BASE_URL"}
-    for pconfig in PROVIDER_REGISTRY.values():
-        if pconfig.auth_type == "api_key":
-            provider_env_vars.update(pconfig.api_key_env_vars)
-    if _dotenv_has_provider_key(profile_dir / ".env", provider_env_vars):
-        return True
-    # Raw-file diagnostic over another profile's config.yaml: the owner API, not a bare yaml load.
-    from hermes_cli.config import read_user_config_raw
-    try:
-        cfg = read_user_config_raw(profile_dir / "config.yaml")
-    except Exception:
-        return False
-    model_cfg = cfg.get("model")
-    return isinstance(model_cfg, dict) and any(
-        str(model_cfg.get(k) or "").strip() for k in ("base_url", "api_key"))
-
-
-def profiles_without_own_credentials() -> List[str]:
-    """Names of live named profiles that would have inherited the root ``auth.json`` — i.e. the root
-    holds credentials and the profile holds none. Empty when the root has nothing to inherit."""
-    from hermes_constants import get_default_hermes_root
-    from hermes_cli.profiles import _iter_named_profile_dirs
-    if not _auth_store_has_credentials(get_default_hermes_root() / "auth.json"):
-        return []
-    return [p.name for p in _iter_named_profile_dirs() if not _profile_has_own_credentials(p)]
-
-
-def print_profiles_without_credentials_notice() -> None:
-    names = profiles_without_own_credentials()
-    if not names:
-        return
-    print("\n\033[1;33m⚠  Profiles no longer inherit the root profile's credentials (auth.json).\033[0m")
-    print("   These profiles have no provider of their own and will ask for one on their next turn:")
-    for name in names:
-        print(f"     hermes -p {name} model        # or: hermes -p {name} auth add <provider>")
diff --git a/hermes_cli/profiles.py b/hermes_cli/profiles.py
index f8b4eb3898..5b7e1f5bbe 100644
--- a/hermes_cli/profiles.py
+++ b/hermes_cli/profiles.py
@@ -1053,13 +1053,14 @@ def _clone_all_into(source_dir: Path, profile_dir: Path, canon: str) -> None:
         (profile_dir / stale).unlink(missing_ok=True)
     # auth.json / .anthropic_oauth.json copied verbatim fork single-use OAuth grants
     # (Anthropic / Codex / xAI): one credential with two owners, and the first profile to
-    # refresh revokes the pair for every sibling. Drop the copies; the clone signs in itself.
+    # refresh revokes the pair for every sibling. Drop the copies; the clone reads the root
+    # grant through the credential-pool fallback.
     from hermes_cli.auth import strip_cloned_single_use_oauth_grants
     stripped = strip_cloned_single_use_oauth_grants(profile_dir)
     if any(stripped.values()):
         logger.info(
             "profile %s: dropped cloned single-use OAuth grants %s "
-            "(run `hermes -p %s auth add <provider>` to sign in)", canon, stripped, canon,
+            "(inherits the root grant instead)", canon, stripped,
         )
 
 
diff --git a/hermes_cli/update_cmd_maint.py b/hermes_cli/update_cmd_maint.py
index 8780903cc8..048942af38 100644
--- a/hermes_cli/update_cmd_maint.py
+++ b/hermes_cli/update_cmd_maint.py
@@ -901,11 +901,6 @@ def _print_plugin_compat_notice() -> None:
     print(f"\n{colour}⚠  {lines[0]}\033[0m\n   {lines[1]}")
 
 
-def _print_profiles_without_credentials_notice() -> None:
-    from hermes_cli.profile_credential_audit import print_profiles_without_credentials_notice
-    print_profiles_without_credentials_notice()
-
-
 def _print_post_update_notices_and_self_heals() -> None:
     """Best-effort notices (FTS optimize, curator) and self-heals (FHS PATH, ACP launcher,
     Windows bin launchers, cua-driver refresh) that run after the summary."""
@@ -928,9 +923,6 @@ def _print_post_update_notices_and_self_heals() -> None:
         ('cua-driver refresh failed: %s', _refresh_cua_driver_after_update),
         ('Checkpoint footprint notice failed: %s', _print_checkpoint_footprint_notice),
         ('Plugin compat notice failed: %s', _print_plugin_compat_notice),
-        # Named profiles stopped inheriting the root auth.json (#111724): name every profile that
-        # now has no provider of its own so nobody finds out from a dead bot.
-        ('Profile credential notice failed: %s', _print_profiles_without_credentials_notice),
         # Legacy HERMES_NEMO_RELAY_ATIF_*/ATOF_* vars produce no traces since the Relay cutover;
         # generate each profile's relay-plugins.toml instead of leaving exports silently dead.
         ('Relay exporter migration failed: %s', _migrate_relay_exporter_env),
diff --git a/tests/agent/test_anthropic_oauth_stress.py b/tests/agent/test_anthropic_oauth_stress.py
index 40a174078c..b558eb4a6a 100644
--- a/tests/agent/test_anthropic_oauth_stress.py
+++ b/tests/agent/test_anthropic_oauth_stress.py
@@ -98,6 +98,7 @@ def _process_claude_code_refresh_worker(
 
     # Keep this worker hermetic: each profile has its own auth store, while
     # both workers deliberately point at the same Claude credential source.
+    auth_mod._global_auth_file_path = lambda: None
     anthropic_mod.claude_code_credentials_path = lambda: shared_path
     anthropic_mod.read_claude_code_credentials = read_shared_credentials
     anthropic_mod._write_claude_code_credentials = write_shared_credentials
diff --git a/tests/agent/test_credential_pool_oauth_writethrough.py b/tests/agent/test_credential_pool_oauth_writethrough.py
index e20c1a6045..e176a3f406 100644
--- a/tests/agent/test_credential_pool_oauth_writethrough.py
+++ b/tests/agent/test_credential_pool_oauth_writethrough.py
@@ -1,14 +1,27 @@
-"""Credential-pool OAuth refresh persistence.
+"""Regression tests for credential-pool OAuth refresh write-through to root.
 
-Single-use refresh tokens (Codex, xAI, Anthropic PKCE) must be POSTed under the cross-process
-auth lock and the rotated pair committed back to the store/singleton that seeds the pool, or the
-next ``load_pool()`` re-seeds the consumed pair over the rotated one. Real on-disk stores under
-``tmp_path``; only the token endpoint is faked.
+Companion to ``tests/hermes_cli/test_xai_oauth_writethrough.py``. That file
+covers the *non-pool* xAI refresh path (``_save_xai_oauth_tokens``). These
+cover the **credential-pool** refresh path
+(``CredentialPool._sync_device_code_entry_to_auth_store``): when a profile
+that has no own ``providers.<id>`` block refreshes — via the pool — a rotating
+OAuth grant it resolved from the global-root fallback, the rotated chain must
+be written back to the global root too. Otherwise root keeps a revoked refresh
+token and every other profile reading root's stale grant dies with
+``refresh_token_reused`` / ``invalid_grant`` once its access token expires
+(issue #48415, the Codex/xAI analog of #43589).
+
+The tests drive the real ``_sync_device_code_entry_to_auth_store`` against
+real on-disk auth stores (profile + root under ``tmp_path``) rather than
+mocking the save boundary, so they exercise the actual atomic write path.
 """
 
 import json
+import threading
 import time
 
+import pytest
+
 from agent import credential_pool as CP
 from agent.credential_pool import (
     AUTH_TYPE_OAUTH,
@@ -25,6 +38,10 @@ def _write_store(path, store):
     path.write_text(json.dumps(store), encoding="utf-8")
 
 
+def _read_store(path):
+    return json.loads(path.read_text(encoding="utf-8"))
+
+
 def _entry(provider: str, *, id: str, access_token: str, refresh_token: str):
     return PooledCredential(
         provider=provider,
@@ -38,6 +55,121 @@ def _entry(provider: str, *, id: str, access_token: str, refresh_token: str):
     )
 
 
+@pytest.fixture
+def profile_and_root(tmp_path, monkeypatch):
+    """Wire a profile auth store + a distinct global-root auth store on disk.
+
+    The pytest seat belt in ``_write_through_provider_state_to_global_root``
+    only refuses the *real* user's ``$HOME/.hermes/auth.json``; a tmp_path
+    root is allowed, so point HOME away from the tmp root to keep the guard
+    from tripping on these fixtures.
+    """
+    profile_path = tmp_path / "profiles" / "work" / "auth.json"
+    root_path = tmp_path / "root" / "auth.json"
+
+    monkeypatch.setattr(A, "_auth_file_path", lambda: profile_path)
+    monkeypatch.setattr(A, "_global_auth_file_path", lambda: root_path)
+    monkeypatch.setenv("HOME", str(tmp_path / "not-the-root"))
+    return profile_path, root_path
+
+
+
+
+
+
+
+
+def test_global_write_through_preserves_concurrent_root_update(
+    profile_and_root, monkeypatch
+):
+    """A stale profile write-through must not erase a concurrent root login."""
+    _profile_path, root_path = profile_and_root
+    _write_store(
+        root_path,
+        {
+            "version": 1,
+            "providers": {
+                "xai-oauth": {
+                    "tokens": {"access_token": "old-xai", "refresh_token": "old-r"}
+                }
+            },
+            "credential_pool": {
+                "anthropic": [{"id": "anthropic-existing"}],
+                "openrouter": [{"id": "openrouter-existing"}],
+            },
+        },
+    )
+
+    helper_loaded = threading.Event()
+    helper_has_target_lock = threading.Event()
+    allow_helper_save = threading.Event()
+    writer_started = threading.Event()
+    writer_done = threading.Event()
+    real_auth_load = A._load_auth_store
+
+    def paused_helper_load(path=None):
+        store = real_auth_load(path)
+        if threading.current_thread().name == "profile-write-through":
+            target_holder = A._auth_lock_holder_for(root_path)
+            if getattr(target_holder, "depth", 0) > 0:
+                helper_has_target_lock.set()
+            helper_loaded.set()
+            assert allow_helper_save.wait(timeout=5)
+        return store
+
+    monkeypatch.setattr(A, "_load_auth_store", paused_helper_load)
+    # The pre-fix implementation imported the loader directly; patch both
+    # bindings so reverting the safe helper still exercises the stale ordering.
+    monkeypatch.setattr(CP, "_load_auth_store", paused_helper_load)
+
+    def profile_write_through():
+        CP._write_through_provider_state_to_global_root(
+            "xai-oauth",
+            {"tokens": {"access_token": "new-xai", "refresh_token": "new-r"}},
+        )
+
+    def concurrent_codex_login():
+        writer_started.set()
+        with A._auth_store_lock(target_path=root_path):
+            store = A._load_auth_store(root_path)
+            A._store_provider_state(
+                store,
+                "openai-codex",
+                {"tokens": {"access_token": "codex-a", "refresh_token": "codex-r"}},
+                set_active=False,
+            )
+            pool = store.setdefault("credential_pool", {})
+            pool["openai-codex"] = [{"id": "codex-login"}]
+            A._save_auth_store(store, target_path=root_path)
+        writer_done.set()
+
+    helper = threading.Thread(target=profile_write_through, name="profile-write-through")
+    helper.start()
+    assert helper_loaded.wait(timeout=5)
+
+    writer = threading.Thread(target=concurrent_codex_login, name="concurrent-login")
+    writer.start()
+    assert writer_started.wait(timeout=5)
+    # A fixed helper already owns the target lock, so the writer will merge
+    # after release. A reverted unlocked helper must first let the competing
+    # login finish; only then do we release its stale save. This makes the
+    # losing pre-fix ordering deterministic rather than scheduler-dependent.
+    if not helper_has_target_lock.is_set():
+        assert writer_done.wait(timeout=5)
+    allow_helper_save.set()
+    helper.join(timeout=5)
+    writer.join(timeout=5)
+    assert not helper.is_alive()
+    assert not writer.is_alive()
+
+    root = _read_store(root_path)
+    assert root["providers"]["xai-oauth"]["tokens"]["refresh_token"] == "new-r"
+    assert root["providers"]["openai-codex"]["tokens"]["refresh_token"] == "codex-r"
+    assert root["credential_pool"]["openai-codex"] == [{"id": "codex-login"}]
+    assert root["credential_pool"]["anthropic"] == [{"id": "anthropic-existing"}]
+    assert root["credential_pool"]["openrouter"] == [{"id": "openrouter-existing"}]
+
+
 def test_codex_pool_refresh_holds_auth_store_lock_across_post(monkeypatch, tmp_path):
     """The Codex OAuth pool refresh must POST under the cross-process auth lock.
 
@@ -54,6 +186,8 @@ def test_codex_pool_refresh_holds_auth_store_lock_across_post(monkeypatch, tmp_p
     provider = "openai-codex"
     profile_path = tmp_path / "auth.json"
     monkeypatch.setattr(A, "_auth_file_path", lambda: profile_path)
+    monkeypatch.setattr(A, "_global_auth_file_path", lambda: None)
+    monkeypatch.setenv("HOME", str(tmp_path / "not-the-root"))
 
     lock_held: dict = {"during_post": None}
     real_lock = A._auth_store_lock
@@ -104,6 +238,90 @@ def test_codex_pool_refresh_holds_auth_store_lock_across_post(monkeypatch, tmp_p
     assert lock_held["during_post"] is True
 
 
+def test_write_through_fires_on_every_refresh_not_just_first(
+    profile_and_root, monkeypatch
+):
+    """Write-through to root must fire on the 2nd, 3rd, … refresh too (#74339).
+
+    The old key-presence check decided write-through on whether the *profile*
+    store had ``providers.<id>`` BEFORE the save — a key that
+    ``_store_provider_state()`` unconditionally created.  Net effect: first
+    refresh → write-through fires; every later refresh → silently disabled
+    because the profile now "owned" the block, even though it never
+    performed its own OAuth grant.
+
+    The fix skips ``_store_provider_state`` entirely when the grant was
+    resolved from root, so the profile never accrues a shadowing key and
+    ``_load_provider_state_with_source`` always resolves from root.
+    """
+    profile_path, root_path = profile_and_root
+    _write_store(
+        root_path,
+        {
+            "version": 1,
+            "providers": {
+                "openai-codex": {
+                    "tokens": {"access_token": "root-ac", "refresh_token": "root-rf"}
+                }
+            },
+        },
+    )
+
+    provider = "openai-codex"
+    # After patching A's module-level attributes, the bare-name imports in
+    # credential_pool.py still hold references to the original functions
+    # (``from X import Y`` creates a local binding that does not update when
+    # ``X.Y`` is reassigned).  Patch CP's bindings separately so the
+    # ``_sync_device_code_entry_to_auth_store`` method — whose __globals__
+    # are ``agent.credential_pool.__dict__`` — sees the mocked paths.
+    monkeypatch.setattr(CP, "_global_auth_file_path", lambda: root_path)
+    monkeypatch.setattr(CP, "_same_path", lambda a, b: a == b)
+    # Let _write_through_provider_state_to_global_root run for real so it
+    # persists the rotated token pair to the root auth.json — the test
+    # asserts the on-disk values after each refresh.
+
+    # ---- REFRESH 1 ----
+    _write_store(profile_path, {"version": 1})
+    entry1 = _entry(
+        provider, id="c1", access_token="ac1", refresh_token="rf1"
+    )
+    pool1 = CredentialPool(provider, [entry1])
+    pool1._sync_device_code_entry_to_auth_store(entry1)
+
+    # Verify root was updated with the rotated tokens from refresh 1.
+    root_store = _read_store(root_path)
+    root_tokens = root_store["providers"]["openai-codex"]["tokens"]
+    assert root_tokens["access_token"] == "ac1"
+    assert root_tokens["refresh_token"] == "rf1"
+
+    # After refresh 1 the profile should NOT have a providers.openai-codex
+    # block (the fix skipped _store_provider_state because the grant came
+    # from root).  This prevents the self-sealing that broke refresh 2+.
+    profile_store = _read_store(profile_path)
+    assert "openai-codex" not in profile_store.get("providers", {}), (
+        "profile must NOT accrue a shadowing providers.<id> block when the "
+        "grant was resolved from root — that key would disable write-through "
+        "on the next refresh (#74339)"
+    )
+
+    # ---- REFRESH 2 (same scenario, rotated tokens) ----
+    entry2 = _entry(
+        provider, id="c2", access_token="ac2", refresh_token="rf2"
+    )
+    pool2 = CredentialPool(provider, [entry2])
+    pool2._sync_device_code_entry_to_auth_store(entry2)
+
+    # Verify root was updated with the rotated tokens from refresh 2.
+    # The old key-presence check would have silently skipped this write.
+    root_store = _read_store(root_path)
+    root_tokens = root_store["providers"]["openai-codex"]["tokens"]
+    assert root_tokens["access_token"] == "ac2", (
+        "refresh 2: root must carry the rotated token pair. "
+        "The old code self-disabled write-through here (#74339)"
+    )
+    assert root_tokens["refresh_token"] == "rf2"
+
+
 def test_hermes_pkce_refresh_writes_back_to_singleton(tmp_path, monkeypatch):
     """A successful hermes_pkce refresh must update
     ~/.hermes/.anthropic_oauth.json, or ``_seed_from_singletons()`` on the
diff --git a/tests/agent/test_credential_pool_profile_oauth_fork.py b/tests/agent/test_credential_pool_profile_oauth_fork.py
index b74b9995a0..fbae90a594 100644
--- a/tests/agent/test_credential_pool_profile_oauth_fork.py
+++ b/tests/agent/test_credential_pool_profile_oauth_fork.py
@@ -1,5 +1,5 @@
-"""Single-use Anthropic OAuth grants never fork across profiles (#100339) and are never
-inherited from the root (#111724).
+"""Regression tests for #100339: cloned / borrowed single-use Anthropic OAuth
+grants must never fork across profiles.
 
 Real imports, real temp HERMES_HOME root + named profile, real auth.json I/O.
 The Anthropic token endpoint is replaced at the ``urllib.request.urlopen``
@@ -30,6 +30,8 @@ def fleet(tmp_path, monkeypatch):
     for var in ("ANTHROPIC_TOKEN", "ANTHROPIC_API_KEY", "CLAUDE_CODE_OAUTH_TOKEN"):
         monkeypatch.delenv(var, raising=False)
     monkeypatch.setenv("HERMES_HOME", str(root))
+    # The pytest seat-belt in the root write-through compares the global path
+    # against $HOME/.hermes/auth.json; our root is elsewhere, so writes go.
     import hermes_constants
     hermes_constants._default_hermes_root_memo = None  # type: ignore[attr-defined]
 
@@ -92,6 +94,14 @@ def fleet(tmp_path, monkeypatch):
         """Switch the process to *home* (root or a profile dir)."""
         monkeypatch.setenv("HERMES_HOME", str(home))
         hermes_constants._default_hermes_root_memo = None  # type: ignore[attr-defined]
+        import hermes_cli.auth as auth_mod
+        auth_mod._global_auth_store_cache = None
+        auth_mod._oauth_heal_clean_marks.clear()
+
+    # Process-wide notice buffer: start each test clean.
+    import hermes_cli.auth as _auth_mod
+    _auth_mod._oauth_heal_notices.clear()
+    _auth_mod._oauth_heal_clean_marks.clear()
 
     def pool_rows(home):
         p = home / "auth.json"
@@ -212,27 +222,81 @@ def test_strip_helper_fails_closed_when_store_identity_check_errors(fleet, monke
     assert (copied / "auth.json").read_text() == before
 
 
-# ── B. a named profile never borrows the root grant ───────────────────────
+def test_first_profile_rotation_does_not_strand_root_or_siblings(fleet):
+    from agent.credential_pool import load_pool
+
+    forge = _profile(fleet, "forge")
+    atlas = _profile(fleet, "atlas")
+
+    fleet["use"](forge)
+    sel = load_pool("anthropic").select()
+    assert sel is not None and sel.access_token == "sk-ant-oat01-AT1"
+    # The rotated pair landed in ROOT; forge did not grow a local copy.
+    assert fleet["rows"](forge) is None
+    assert fleet["rows"](fleet["root"])[0]["refresh_token"] == "sk-ant-ort-RT1"
+
+    for home in (atlas, fleet["root"], forge):
+        fleet["use"](home)
+        sel = load_pool("anthropic").select()
+        assert sel is not None and sel.access_token == "sk-ant-oat01-AT1", home
+    assert [e[0] for e in fleet["server"]["log"]] == ["ROTATE"], fleet["server"]["log"]
+    assert fleet["rows"](atlas) is None and fleet["rows"](forge) is None
 
 
-def test_named_profile_does_not_inherit_or_rotate_the_root_grant(fleet):
-    """An empty profile sees no Anthropic credential and the root's single-use pair is untouched;
-    the root itself still refreshes and persists its own rotation (control)."""
+def test_agent_init_resolver_sees_sibling_rotation(fleet):
     from agent.anthropic_credentials import resolve_anthropic_token
     from agent.credential_pool import load_pool
 
     forge = _profile(fleet, "forge")
+    atlas = _profile(fleet, "atlas")
     fleet["use"](forge)
-    assert load_pool("anthropic").select() is None
-    assert resolve_anthropic_token() is None
-    assert fleet["rows"](forge) in (None, [])
-    assert fleet["server"]["log"] == []
-    assert fleet["rows"](fleet["root"])[0]["refresh_token"] == "sk-ant-ort-RT0"
+    load_pool("anthropic").select()
+    fleet["use"](atlas)
+    assert resolve_anthropic_token() == "sk-ant-oat01-AT1"
 
-    fleet["use"](fleet["root"])
-    sel = load_pool("anthropic").select()
+
+def test_borrowing_profile_load_pool_does_not_materialize_local_copy(fleet):
+    from agent.credential_pool import load_pool
+
+    fresh = _profile(fleet, "fresh")
+    fleet["use"](fresh)
+    pool = load_pool("anthropic")
+    assert [e.id for e in pool.entries()] == ["abc123"]
+    assert pool._borrowed_root_ids == {"abc123"}
+    assert fleet["rows"](fresh) is None
+
+
+def test_borrower_prune_never_deletes_root_singleton_grant(fleet, tmp_path):
+    """Root's hermes_pkce row is seeded from ROOT's .anthropic_oauth.json; a
+    profile without that file must not prune (and write-through-delete) it."""
+    from agent.credential_pool import load_pool
+
+    root = fleet["root"]
+    (root / ".anthropic_oauth.json").write_text(json.dumps({
+        "accessToken": "sk-ant-oat01-AT0", "refreshToken": "sk-ant-ort-RT0",
+        "expiresAt": int((time.time() - 3600) * 1000),
+    }))
+    store = json.loads((root / "auth.json").read_text())
+    store["active_provider"] = "anthropic"
+    del store["credential_pool"]["anthropic"]
+    (root / "auth.json").write_text(json.dumps(store))
+    fleet["use"](root)
+    root_rows = [e for e in load_pool("anthropic").entries()]
+    assert [e.source for e in root_rows] == ["hermes_pkce"]
+
+    kid = _profile(fleet, "kid")
+    fleet["use"](kid)
+    pool = load_pool("anthropic")
+    assert [e.source for e in pool.entries()] == ["hermes_pkce"], "borrowed root grant was pruned"
+    assert fleet["rows"](root) and fleet["rows"](root)[0]["source"] == "hermes_pkce"
+    assert fleet["rows"](kid) is None
+
+    # Rotating from the profile commits BOTH the pool row and the singleton at ROOT.
+    sel = pool.select()
     assert sel is not None and sel.access_token == "sk-ant-oat01-AT1"
-    assert fleet["rows"](fleet["root"])[0]["refresh_token"] == "sk-ant-ort-RT1"
+    assert json.loads((root / ".anthropic_oauth.json").read_text())["refreshToken"] == "sk-ant-ort-RT1"
+    assert not (kid / ".anthropic_oauth.json").exists()
+    assert fleet["rows"](root)[0]["refresh_token"] == "sk-ant-ort-RT1"
 
 
 def test_profile_auth_add_owns_only_its_own_rows(fleet):
@@ -246,10 +310,285 @@ def test_profile_auth_add_owns_only_its_own_rows(fleet):
         priority=0, source="manual:hermes_pkce", access_token="sk-ant-oat01-MINE",
         refresh_token="rt-mine",
     ))
-    assert [e["id"] for e in fleet["rows"](kid)] == ["own001"]
+    assert [e["id"] for e in fleet["rows"](kid)] == ["own001"], "borrowed root row was copied into the profile"
     assert [e["id"] for e in fleet["rows"](fleet["root"])] == ["abc123"]
 
 
+def test_classic_mode_persist_is_unchanged(fleet):
+    from agent.credential_pool import load_pool
+
+    fleet["use"](fleet["root"])
+    sel = load_pool("anthropic").select()
+    assert sel is not None and sel.access_token == "sk-ant-oat01-AT1"
+    assert fleet["rows"](fleet["root"])[0]["refresh_token"] == "sk-ant-ort-RT1"
+
+
+# ── C. one-time heal for installs that ALREADY forked the grant ──────────
+#
+# Fleets created on pre-fix code hold profile-local copies of the root grant
+# (verbatim --clone-all, or the old borrowed-persist). The heal runs inside
+# the profile's load_pool(): consolidate to ROOT (freshest rotation wins),
+# strip the profile copy, borrow root from then on.
+
+def _fork(fleet, name, *, rotated_to=None):
+    """Create *name* with a pre-fix style verbatim copy of root's auth.json.
+
+    ``rotated_to=N`` makes the copy the LIVE pair (RT<N>, spent RT0 server-side)
+    to emulate a profile that already refreshed on the old code.
+    """
+    pdir = _profile(fleet, name)
+    pdir.mkdir(parents=True, exist_ok=True)
+    store = json.loads((fleet["root"] / "auth.json").read_text())
+    if rotated_to is not None:
+        row = store["credential_pool"]["anthropic"][0]
+        row["access_token"] = f"sk-ant-oat01-AT{rotated_to}"
+        row["refresh_token"] = f"sk-ant-ort-RT{rotated_to}"
+        row["expires_at_ms"] = int((time.time() - 60) * 1000)  # newer, still expired
+        srv = fleet["server"]
+        srv["spent"].add("sk-ant-ort-RT0")
+        srv["valid"].discard("sk-ant-ort-RT0")
+        srv["valid"].add(f"sk-ant-ort-RT{rotated_to}")
+        srv["n"] = rotated_to
+    (pdir / "auth.json").write_text(json.dumps(store))
+    return pdir
+
+
+def test_heal_consolidates_existing_forks_to_the_live_copy(fleet, caplog):
+    """root + atlas hold spent RT0; forge already rotated to RT1 on old code."""
+    import logging
+    from agent.credential_pool import load_pool
+
+    forge = _fork(fleet, "forge", rotated_to=1)
+    atlas = _fork(fleet, "atlas")
+    assert fleet["rows"](forge)[0]["refresh_token"] == "sk-ant-ort-RT1"
+    assert fleet["rows"](atlas)[0]["refresh_token"] == "sk-ant-ort-RT0"
+
+    with caplog.at_level(logging.INFO, logger="hermes_cli.auth"):
+        fleet["use"](forge)
+        sel = load_pool("anthropic").select()
+    assert sel is not None and sel.access_token == "sk-ant-oat01-AT2"
+    # forge's live pair was adopted by ROOT, then rotated there; forge holds nothing.
+    assert fleet["rows"](forge) is None
+    assert fleet["rows"](fleet["root"])[0]["refresh_token"] == "sk-ant-ort-RT2"
+    assert fleet["rows"](fleet["root"])[0]["id"] == "abc123"
+    healed = [r.message for r in caplog.records if "consolidated forked anthropic OAuth grant" in r.message]
+    assert len(healed) == 1 and "profile forge" in healed[0] and "root updated" in healed[0]
+
+    for home in (atlas, fleet["root"], forge):
+        fleet["use"](home)
+        sel = load_pool("anthropic").select()
+        assert sel is not None and sel.access_token == "sk-ant-oat01-AT2", home
+    assert fleet["rows"](atlas) is None and fleet["rows"](forge) is None
+    # Exactly one rotation by us (RT1 -> RT2); the spent RT0 was never replayed.
+    assert [e[0] for e in fleet["server"]["log"]] == ["ROTATE"], fleet["server"]["log"]
+    # API-key rows in the profiles were not touched.
+    for home in (forge, atlas):
+        store = json.loads((home / "auth.json").read_text())
+        assert store["credential_pool"]["openai"][0]["access_token"] == "sk-static-key"
+
+
+def test_heal_is_idempotent_and_logs_once(fleet, caplog):
+    import logging
+    from agent.credential_pool import load_pool
+    from hermes_cli.auth import consume_oauth_heal_notices, heal_forked_single_use_oauth_grants
+
+    kid = _fork(fleet, "kid")
+    fleet["use"](kid)
+    with caplog.at_level(logging.INFO, logger="hermes_cli.auth"):
+        load_pool("anthropic")
+        assert fleet["rows"](kid) is None
+        notices = consume_oauth_heal_notices()
+        assert len(notices) == 1 and "profile kid" in notices[0]
+        root_before = (fleet["root"] / "auth.json").read_text()
+        # Second and third loads: nothing to do, nothing written, nothing logged.
+        assert heal_forked_single_use_oauth_grants("anthropic") is None
+        load_pool("anthropic")
+    assert consume_oauth_heal_notices() == []
+    assert (fleet["root"] / "auth.json").read_text() == root_before
+    assert sum("consolidated forked" in r.message for r in caplog.records) == 1
+
+
+def test_heal_never_deletes_the_only_surviving_copy(fleet):
+    """Root lost its grant (user ran `hermes auth remove` at root); the profile's
+    copy is the only one left — and an independent second account stays put."""
+    from agent.credential_pool import load_pool
+
+    kid = _fork(fleet, "kid", rotated_to=1)
+    store = json.loads((fleet["root"] / "auth.json").read_text())
+    del store["credential_pool"]["anthropic"]
+    (fleet["root"] / "auth.json").write_text(json.dumps(store))
+
+    fleet["use"](kid)
+    sel = load_pool("anthropic").select()
+    assert sel is not None and sel.access_token == "sk-ant-oat01-AT2"
+    assert fleet["rows"](kid) and fleet["rows"](kid)[0]["refresh_token"] == "sk-ant-ort-RT2"
+    assert "anthropic" not in (json.loads((fleet["root"] / "auth.json").read_text())["credential_pool"])
+
+
+@pytest.mark.parametrize("shape", ["pool", "provider"])
+@pytest.mark.parametrize("claims", [True, False])
+def test_heal_preserves_independent_grants_for_same_account(fleet, shape, claims):
+    """An account can have independent device logins; identity is not lineage."""
+    import base64
+    from hermes_cli.auth import heal_forked_single_use_oauth_grants
+
+    def pair(tag):
+        payload = base64.urlsafe_b64encode(json.dumps({
+            "sub": "same-account", "exp": int(time.time()) + 3600, "jti": tag,
+        }).encode()).decode().rstrip("=")
+        return {"access_token": "h." + payload + ".s" if claims else tag,
+                "refresh_token": "independent-" + tag}
+
+    def store(tag):
+        tokens = pair(tag)
+        if shape == "provider":
+            return {"version": 1, "providers": {"openai-codex": {"tokens": tokens}}}
+        return {"version": 1, "providers": {}, "credential_pool": {"openai-codex": [{
+            "id": tag, "auth_type": "oauth", "source": "manual:device_code", **tokens,
+        }]}}
+
+    root = fleet["root"] / "auth.json"
+    kid = _profile(fleet, "independent")
+    kid.mkdir(parents=True, exist_ok=True)
+    profile = kid / "auth.json"
+    root.write_text(json.dumps(store("root-grant")))
+    profile.write_text(json.dumps(store("profile-grant")))
+    before = (root.read_bytes(), profile.read_bytes())
+    fleet["use"](kid)
+    assert heal_forked_single_use_oauth_grants("openai-codex") is None
+    assert (root.read_bytes(), profile.read_bytes()) == before
+    if claims:
+        from agent.credential_pool import load_pool
+        for _ in range(3):
+            selected = load_pool("openai-codex").select()
+            assert selected is not None
+            assert selected.refresh_token == "independent-profile-grant"
+        assert root.read_bytes() == before[0]
+
+
+def test_heal_rotated_fork_moves_provider_block_with_the_pool_row(fleet):
+    """Copied pool-row id proves the fork even after both sides rotated past token equality.
+
+    Root's load_pool() re-seeds its device_code row FROM providers.<id>.tokens, so root's block
+    must carry the fresher pair too or the next root load resurrects the spent one.
+    """
+    from agent.credential_pool import load_pool
+    from hermes_cli.auth import heal_forked_single_use_oauth_grants
+
+    def store(tag, exp_off):
+        tokens = {"access_token": "at-" + tag, "refresh_token": "rt-" + tag}
+        issued = time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime(time.time() + exp_off - 3600))
+        return {"version": 1,
+                "providers": {"openai-codex": {"tokens": tokens, "last_refresh": issued}},
+                "credential_pool": {"openai-codex": [{
+                    "id": "shared-id", "auth_type": "oauth", "source": "device_code", **tokens,
+                    "expires_at_ms": int((time.time() + exp_off) * 1000)}]}}
+
+    root = fleet["root"] / "auth.json"
+    kid = _profile(fleet, "rotated")
+    kid.mkdir(parents=True, exist_ok=True)
+    root.write_text(json.dumps(store("old", 100)))
+    (kid / "auth.json").write_text(json.dumps(store("new", 3600)))
+    fleet["use"](kid)
+    assert heal_forked_single_use_oauth_grants("openai-codex")["adopted"] is True
+    r, p = json.loads(root.read_text()), json.loads((kid / "auth.json").read_text())
+    assert r["credential_pool"]["openai-codex"][0]["refresh_token"] == "rt-new"
+    assert r["providers"]["openai-codex"]["tokens"]["refresh_token"] == "rt-new"
+    assert "openai-codex" not in p["providers"]
+    assert "openai-codex" not in p.get("credential_pool", {})
+    fleet["use"](fleet["root"])
+    assert {e.refresh_token for e in load_pool("openai-codex").entries()} == {"rt-new"}
+
+
+def test_heal_leaves_a_different_account_alone(fleet):
+    """A profile row whose JWT identity names ANOTHER account is not root's grant."""
+    import base64
+    from agent.credential_pool import load_pool
+
+    def jwt(sub):
+        payload = base64.urlsafe_b64encode(json.dumps({"sub": sub, "exp": int(time.time()) + 3600}).encode()).rstrip(b"=")
+        return "h." + payload.decode() + ".s"
+
+    root_store = json.loads((fleet["root"] / "auth.json").read_text())
+    root_store["credential_pool"]["xai-oauth"] = [{
+        "id": "rootx", "auth_type": "oauth", "priority": 0, "source": "manual:device_code",
+        "access_token": jwt("alice"), "refresh_token": "xr-alice",
+    }]
+    (fleet["root"] / "auth.json").write_text(json.dumps(root_store))
+    kid = _profile(fleet, "kid")
+    kid.mkdir(parents=True, exist_ok=True)
+    (kid / "auth.json").write_text(json.dumps({
+        "version": 1, "providers": {},
+        "credential_pool": {"xai-oauth": [
+            {"id": "kidx", "auth_type": "oauth", "priority": 0, "source": "manual:device_code",
+             "access_token": jwt("bob"), "refresh_token": "xr-bob"},
+            {"id": "kidk", "auth_type": "api_key", "priority": 1, "source": "manual",
+             "access_token": "xai-static"},
+        ]},
+    }))
+    fleet["use"](kid)
+    load_pool("xai-oauth")
+    rows = (json.loads((kid / "auth.json").read_text())["credential_pool"])["xai-oauth"]
+    assert [r["id"] for r in rows] == ["kidx", "kidk"]
+    assert json.loads((fleet["root"] / "auth.json").read_text())["credential_pool"]["xai-oauth"][0]["refresh_token"] == "xr-alice"
+
+
+def test_heal_pkce_singleton_shape_commits_live_pair_to_root_singleton(fleet):
+    """`hermes auth` PKCE shape: root + profile each have .anthropic_oauth.json +
+    a hermes_pkce-seeded row; the profile's copy is the rotated (live) one."""
+    from agent.credential_pool import load_pool
+
+    root = fleet["root"]
+    store = json.loads((root / "auth.json").read_text())
+    store["active_provider"] = "anthropic"
+    del store["credential_pool"]["anthropic"]
+    (root / "auth.json").write_text(json.dumps(store))
+    (root / ".anthropic_oauth.json").write_text(json.dumps({
+        "accessToken": "sk-ant-oat01-AT0", "refreshToken": "sk-ant-ort-RT0",
+        "expiresAt": int((time.time() - 3600) * 1000),
+    }))
+    fleet["use"](root)
+    load_pool("anthropic")  # seeds root's hermes_pkce row from the singleton
+
+    kid = _profile(fleet, "kid")
+    kid.mkdir(parents=True, exist_ok=True)
+    import shutil
+    shutil.copy2(root / "auth.json", kid / "auth.json")
+    (kid / ".anthropic_oauth.json").write_text(json.dumps({
+        "accessToken": "sk-ant-oat01-AT1", "refreshToken": "sk-ant-ort-RT1",
+        "expiresAt": int((time.time() - 60) * 1000),
+    }))
+    kstore = json.loads((kid / "auth.json").read_text())
+    kstore["credential_pool"]["anthropic"][0].update(
+        access_token="sk-ant-oat01-AT1", refresh_token="sk-ant-ort-RT1",
+        expires_at_ms=int((time.time() - 60) * 1000),
+    )
+    (kid / "auth.json").write_text(json.dumps(kstore))
+    srv = fleet["server"]
+    srv["spent"].add("sk-ant-ort-RT0"); srv["valid"] = {"sk-ant-ort-RT1"}; srv["n"] = 1
+
+    fleet["use"](kid)
+    sel = load_pool("anthropic").select()
+    assert sel is not None and sel.access_token == "sk-ant-oat01-AT2"
+    assert not (kid / ".anthropic_oauth.json").exists()
+    assert fleet["rows"](kid) is None
+    assert json.loads((root / ".anthropic_oauth.json").read_text())["refreshToken"] == "sk-ant-ort-RT2"
+    fleet["use"](root)
+    sel = load_pool("anthropic").select()
+    assert sel is not None and sel.access_token == "sk-ant-oat01-AT2"
+    assert [e[0] for e in srv["log"]] == ["ROTATE"], srv["log"]
+
+
+def test_heal_is_a_noop_in_classic_mode(fleet):
+    from hermes_cli.auth import heal_forked_single_use_oauth_grants
+    fleet["use"](fleet["root"])
+    before = (fleet["root"] / "auth.json").read_text()
+    assert heal_forked_single_use_oauth_grants("anthropic") is None
+    assert (fleet["root"] / "auth.json").read_text() == before
+
+
+# ── C. a SHARED root store is not a fork (#101356) ───────────────────────
+
 def _seed_codex_grant(root):
     """Give the root store an openai-codex pool row AND a providers block."""
     fresh = int((time.time() + 3600) * 1000)
@@ -275,3 +614,197 @@ def _shared_profile(fleet, name, *, link):
         alias.unlink()
     link(fleet["root"] / "auth.json", alias)
     return pdir
+
+
+def test_heal_skips_profile_auth_json_symlinked_to_the_root_store(fleet):
+    """#101356: `ln -s ~/.hermes/auth.json <profile>/auth.json` shares ONE store.
+    Both sides of the consolidation read the same file, so every row looks like
+    a fork of itself — healing would strip the shared grant through the link."""
+    from hermes_cli.auth import consume_oauth_heal_notices, heal_forked_single_use_oauth_grants
+
+    root = fleet["root"]
+    _seed_codex_grant(root)
+    before = (root / "auth.json").read_text()
+
+    shared = _shared_profile(fleet, "shared", link=lambda target, alias: alias.symlink_to(target))
+    fleet["use"](shared)
+
+    assert heal_forked_single_use_oauth_grants("openai-codex") is None
+    assert (root / "auth.json").read_text() == before
+    assert (shared / "auth.json").is_symlink()
+    assert consume_oauth_heal_notices() == []
+    store = json.loads((root / "auth.json").read_text())
+    assert [r["id"] for r in store["credential_pool"]["openai-codex"]] == ["cdx001"]
+    assert store["providers"]["openai-codex"]["tokens"]["refresh_token"] == "cdx-RT0"
+
+
+def test_heal_skips_profile_auth_json_hardlinked_to_the_root_store(fleet):
+    """Same class as the symlink: a hardlink resolves to a different name but
+    is the same inode, so it is still one store, not a forked copy."""
+    from hermes_cli.auth import heal_forked_single_use_oauth_grants
+
+    root = fleet["root"]
+    _seed_codex_grant(root)
+    before = (root / "auth.json").read_text()
+
+    shared = _shared_profile(fleet, "twin", link=lambda target, alias: os.link(target, alias))
+    fleet["use"](shared)
+
+    assert heal_forked_single_use_oauth_grants("openai-codex") is None
+    assert (root / "auth.json").read_text() == before
+    assert (shared / "auth.json").samefile(root / "auth.json")
+
+
+def test_heal_leaves_an_aliased_anthropic_singleton_alone(fleet):
+    """Separate auth.jsons but a profile `.anthropic_oauth.json` symlinked to
+    root's: one shared grant, not a fork. The heal must not self-compare it
+    or unlink the alias (#101356 sibling site)."""
+    from hermes_cli.auth import heal_forked_single_use_oauth_grants
+
+    root = fleet["root"]
+    (root / ".anthropic_oauth.json").write_text(json.dumps({
+        "accessToken": "AT-shared", "refreshToken": "RT-shared",
+        "expiresAt": int((time.time() + 3600) * 1000),
+    }))
+    kid = _profile(fleet, "kid")
+    kid.mkdir(parents=True, exist_ok=True)
+    (kid / "auth.json").write_text(json.dumps({"providers": {}, "credential_pool": {}}))
+    (kid / ".anthropic_oauth.json").symlink_to(root / ".anthropic_oauth.json")
+    before = (root / ".anthropic_oauth.json").read_text()
+
+    fleet["use"](kid)
+    assert heal_forked_single_use_oauth_grants("anthropic") is None
+    assert (kid / ".anthropic_oauth.json").is_symlink()
+    assert (root / ".anthropic_oauth.json").read_text() == before
+
+
+def test_heal_same_store_skip_is_memoized_off_the_hot_path(fleet, monkeypatch):
+    """The shared-store skip must record the clean mark so load_pool()'s
+    per-call heal does not re-stat/resolve both paths every model call."""
+    from hermes_cli import auth as auth_mod
+
+    root = fleet["root"]
+    _seed_codex_grant(root)
+    shared = _shared_profile(fleet, "shared", link=lambda target, alias: alias.symlink_to(target))
+    fleet["use"](shared)
+
+    assert auth_mod.heal_forked_single_use_oauth_grants("openai-codex") is None
+    assert "openai-codex" in auth_mod._oauth_heal_clean_marks
+    calls = []
+    monkeypatch.setattr(auth_mod, "_is_same_auth_store", lambda *a: calls.append(a) or True)
+    assert auth_mod.heal_forked_single_use_oauth_grants("openai-codex") is None
+    assert calls == [], "same-store check ran again despite the clean mark"
+
+
+# ── E. the clean mark outlives the process ──────────────────────────────
+#
+# The in-memory mark only silences the heal for one process, so every fresh
+# `hermes` invocation re-paid its two nested EXCLUSIVE auth-store locks to
+# rediscover a store it had already cleared. Persisting the mark removes that,
+# but a mark that outlives the process must also invalidate on anything the
+# heal reads -- including the ROOT store, which the in-memory fingerprint
+# could safely ignore precisely because it died with the process.
+
+def _new_process(auth_mod):
+    """Simulate a fresh `hermes` invocation: in-memory state gone, disk kept."""
+    auth_mod._oauth_heal_clean_marks.clear()
+    auth_mod._global_auth_store_cache = None
+
+
+def _count_locks(monkeypatch):
+    """Count _auth_store_lock acquisitions, still really taking them.
+
+    The heal imports the lock from ``hermes_cli.auth`` inside the function, so
+    patching it on that module is what the call site actually resolves.
+    """
+    import contextlib
+
+    import hermes_cli.auth as auth_mod
+
+    taken = []
+    real = auth_mod._auth_store_lock
+
+    @contextlib.contextmanager
+    def counting(*a, **k):
+        taken.append(k.get("target_path"))
+        with real(*a, **k):
+            yield
+
+    monkeypatch.setattr(auth_mod, "_auth_store_lock", counting)
+    return taken
+
+
+def _kid_with_api_key_only(fleet, name="kid"):
+    """Profile whose store exists and is genuinely fork-free, so the heal has
+    to run its locked body to find that out (not the no-files fast path)."""
+    pdir = _profile(fleet, name)
+    pdir.mkdir(parents=True, exist_ok=True)
+    (pdir / "auth.json").write_text(json.dumps({
+        "version": 1, "providers": {},
+        "credential_pool": {"openai": [{
+            "id": "k1", "label": "static", "auth_type": "api_key",
+            "priority": 0, "source": "manual", "access_token": "sk-local",
+        }]},
+    }))
+    return pdir
+
+
+def test_clean_mark_persists_so_a_fresh_process_takes_no_auth_lock(fleet, monkeypatch):
+    import hermes_cli.auth as auth_mod
+    from hermes_cli import auth_oauth_grants as grants
+
+    kid = _kid_with_api_key_only(fleet)
+    fleet["use"](kid)
+    first = _count_locks(monkeypatch)
+    assert auth_mod.heal_forked_single_use_oauth_grants("anthropic") is None
+    assert len(first) == 2, "cold heal should take the profile and root locks"
+    assert grants._oauth_heal_clean_mark_path().exists(), "clean mark not written"
+
+    _new_process(auth_mod)
+    second = _count_locks(monkeypatch)
+    assert auth_mod.heal_forked_single_use_oauth_grants("anthropic") is None
+    assert second == [], "a fresh process re-locked the auth store to redo a clean heal"
+
+
+def test_persisted_mark_still_re_heals_when_the_root_store_gains_a_grant(fleet):
+    """The mark may not outlive the facts. Root acquiring a counterpart turns
+    a row the heal deliberately KEPT into a fork it must strip -- with the
+    profile's own files untouched, so only root's stamp can catch it."""
+    import hermes_cli.auth as auth_mod
+    from hermes_cli import auth_oauth_grants as grants
+
+    root = fleet["root"]
+    store = json.loads((root / "auth.json").read_text())
+    store["credential_pool"].pop("anthropic")
+    (root / "auth.json").write_text(json.dumps(store))
+
+    kid = _kid_with_api_key_only(fleet, "kid2")
+    fork = {
+        "id": "abc123", "label": "team-grant", "auth_type": "oauth",
+        "priority": 0, "source": "manual:hermes_pkce",
+        "access_token": "sk-ant-oat01-AT0", "refresh_token": "sk-ant-ort-RT0",
+        "expires_at_ms": int((time.time() + 3600) * 1000),
+        "base_url": "https://api.anthropic.com",
+    }
+    kid_store = json.loads((kid / "auth.json").read_text())
+    kid_store["credential_pool"]["anthropic"] = [dict(fork)]
+    (kid / "auth.json").write_text(json.dumps(kid_store))
+
+    fleet["use"](kid)
+    assert auth_mod.heal_forked_single_use_oauth_grants("anthropic") is None
+    assert fleet["rows"](kid), "the only surviving copy must not be stripped"
+    marked = grants._oauth_heal_clean_mark_path().read_text()
+
+    store["credential_pool"]["anthropic"] = [dict(fork)]
+    (root / "auth.json").write_text(json.dumps(store))
+    _new_process(auth_mod)
+    assert auth_mod.heal_forked_single_use_oauth_grants("anthropic") is not None, (
+        "the persisted mark skipped a heal that had become necessary")
+    assert not fleet["rows"](kid), "the fork survived in the profile store"
+
+    # A heal that actually did work writes no mark, so the one on disk is now
+    # stale -- it describes the pre-heal files and can no longer match. The
+    # next process re-checks, finds the store clean, and re-stamps.
+    _new_process(auth_mod)
+    assert auth_mod.heal_forked_single_use_oauth_grants("anthropic") is None
+    assert grants._oauth_heal_clean_mark_path().read_text() != marked
diff --git a/tests/hermes_cli/test_auth_profile_fallback.py b/tests/hermes_cli/test_auth_profile_fallback.py
new file mode 100644
index 0000000000..d7bcbe7204
--- /dev/null
+++ b/tests/hermes_cli/test_auth_profile_fallback.py
@@ -0,0 +1,383 @@
+"""Tests for cross-profile auth fallback.
+
+When ``HERMES_HOME`` points to a named profile, ``read_credential_pool()``
+and ``get_provider_auth_state()`` fall back to the global-root
+``auth.json`` per-provider when the profile has no entries for that
+provider.  Writes still target the profile only.
+
+See the #18594 follow-up report: profile workers couldn't see providers
+authenticated only at the global root.
+"""
+
+from __future__ import annotations
+
+import json
+import time
+from contextlib import contextmanager
+from pathlib import Path
+
+import pytest
+
+
+def _make_auth_store(pool: dict | None = None, providers: dict | None = None) -> dict:
+    store: dict = {"version": 1}
+    if pool is not None:
+        store["credential_pool"] = pool
+    if providers is not None:
+        store["providers"] = providers
+    return store
+
+
+@pytest.fixture()
+def profile_env(tmp_path, monkeypatch):
+    """Set up a global root + an active profile under Path.home()/.hermes/profiles/coder.
+
+    * Path.home() -> tmp_path
+    * Global root -> tmp_path/.hermes            (has its own auth.json fixture)
+    * Profile     -> tmp_path/.hermes/profiles/coder   (active, HERMES_HOME points here)
+
+    This mirrors the real "named profile mounted under the default root"
+    layout that profile users actually have on disk.
+    """
+    monkeypatch.setattr(Path, "home", lambda: tmp_path)
+    global_root = tmp_path / ".hermes"
+    global_root.mkdir()
+    profile_dir = global_root / "profiles" / "coder"
+    profile_dir.mkdir(parents=True)
+    monkeypatch.setenv("HERMES_HOME", str(profile_dir))
+    return {"global": global_root, "profile": profile_dir}
+
+
+def _write(path: Path, payload: dict) -> None:
+    path.write_text(json.dumps(payload, indent=2))
+
+
+# ---------------------------------------------------------------------------
+# read_credential_pool — provider-slice reads
+# ---------------------------------------------------------------------------
+
+
+
+
+
+
+
+
+def test_missing_global_auth_file_is_safe(profile_env):
+    """Profile processes that never had a global auth.json still work."""
+    from hermes_cli.auth import read_credential_pool
+
+    # No global auth.json written at all.
+    _write(profile_env["profile"] / "auth.json", _make_auth_store(pool={
+        "openrouter": [{
+            "id": "prof-1",
+            "label": "profile",
+            "auth_type": "api_key",
+            "priority": 0,
+            "source": "manual",
+            "access_token": "sk-profile",
+        }],
+    }))
+
+    assert read_credential_pool("openrouter")[0]["id"] == "prof-1"
+    assert read_credential_pool("anthropic") == []
+
+
+def test_malformed_global_auth_file_does_not_break_profile_read(profile_env):
+    (profile_env["global"] / "auth.json").write_text("{not valid json")
+    _write(profile_env["profile"] / "auth.json", _make_auth_store(pool={
+        "openrouter": [{
+            "id": "prof-1",
+            "label": "profile",
+            "auth_type": "api_key",
+            "priority": 0,
+            "source": "manual",
+            "access_token": "sk-profile",
+        }],
+    }))
+
+    from hermes_cli.auth import read_credential_pool
+
+    # Profile reads still work; malformed global is silently ignored.
+    assert read_credential_pool("openrouter")[0]["id"] == "prof-1"
+    # And no fallback for anthropic since global is unreadable.
+    assert read_credential_pool("anthropic") == []
+
+
+# ---------------------------------------------------------------------------
+# read_credential_pool — whole-pool reads (provider_id=None)
+# ---------------------------------------------------------------------------
+
+
+# ---------------------------------------------------------------------------
+# get_provider_auth_state — singleton fallback
+# ---------------------------------------------------------------------------
+
+
+def test_provider_auth_state_falls_back_to_global_when_profile_has_none(profile_env):
+    from hermes_cli.auth import get_provider_auth_state
+
+    _write(profile_env["global"] / "auth.json", _make_auth_store(providers={
+        "nous": {"access_token": "nous-global", "refresh_token": "rt-global"},
+    }))
+    _write(profile_env["profile"] / "auth.json", _make_auth_store(providers={}))
+
+    state = get_provider_auth_state("nous")
+    assert state is not None
+    assert state["access_token"] == "nous-global"
+
+
+def test_provider_auth_state_returns_none_when_neither_has_it(profile_env):
+    from hermes_cli.auth import get_provider_auth_state
+
+    _write(profile_env["global"] / "auth.json", _make_auth_store(providers={}))
+    _write(profile_env["profile"] / "auth.json", _make_auth_store(providers={}))
+
+    assert get_provider_auth_state("nous") is None
+
+
+# ---------------------------------------------------------------------------
+# _load_provider_state — internal global fallback (issue #18594 follow-up)
+#
+# Several runtime helpers (notably ``resolve_nous_runtime_credentials`` and
+# ``resolve_nous_access_token``) call ``_load_provider_state`` directly with
+# a profile-loaded auth store rather than going through
+# ``get_provider_auth_state``. Without the fallback wired into
+# ``_load_provider_state`` itself, those helpers raise ``"Hermes is not
+# logged into Nous Portal"`` even though the user has a valid global Nous
+# login. These tests pin the per-provider shadowing into the helper.
+# ---------------------------------------------------------------------------
+
+
+def test_codex_runtime_uses_global_pool_when_profile_singleton_is_empty(profile_env):
+    """Stale empty profile Codex state must not block the global credential pool."""
+    from hermes_cli.auth import resolve_codex_runtime_credentials
+
+    _write(profile_env["global"] / "auth.json", _make_auth_store(pool={
+        "openai-codex": [{
+            "id": "glob-codex",
+            "label": "global-codex",
+            "auth_type": "oauth",
+            "priority": 0,
+            "source": "manual:device_code",
+            "access_token": "global-codex-access-token",
+            "refresh_token": "global-codex-refresh-token",
+        }],
+    }))
+    _write(profile_env["profile"] / "auth.json", _make_auth_store(
+        providers={
+            "openai-codex": {
+                "auth_mode": "chatgpt",
+                "tokens": {"access_token": "", "refresh_token": ""},
+            },
+        },
+        pool={"openai-codex": []},
+    ))
+
+    creds = resolve_codex_runtime_credentials(refresh_if_expiring=False)
+
+    assert creds["source"] == "credential_pool"
+    assert creds["api_key"] == "global-codex-access-token"
+
+    # Profile rows shadow the root the moment they exist (read_credential_pool precedence).
+    _write(profile_env["profile"] / "auth.json", _make_auth_store(pool={
+        "openai-codex": [{"id": "prof", "auth_type": "oauth", "priority": 0,
+                          "access_token": "profile-codex-access-token", "refresh_token": "r"}],
+    }))
+    assert resolve_codex_runtime_credentials(refresh_if_expiring=False)["api_key"] == "profile-codex-access-token"
+
+
+def test_codex_cooldown_clear_writes_to_the_store_that_owns_the_borrowed_pool(profile_env):
+    """A restored quota must unfreeze the ROOT row a profile borrows; clearing the (empty)
+    profile store would leave every later resolve stuck on the stale cooldown."""
+    from hermes_cli.auth_codex import clear_codex_pool_quota_cooldowns
+
+    _write(profile_env["global"] / "auth.json", _make_auth_store(pool={
+        "openai-codex": [{"id": "glob", "auth_type": "oauth", "priority": 0,
+                          "access_token": "global-codex-access-token", "refresh_token": "r",
+                          "last_status": "exhausted", "last_error_reason": "rate_limit",
+                          "last_error_reset_at": 4_102_444_800}],
+    }))
+    _write(profile_env["profile"] / "auth.json", _make_auth_store(pool={"openai-codex": []}))
+
+    assert clear_codex_pool_quota_cooldowns() == 1
+    root_rows = json.loads((profile_env["global"] / "auth.json").read_text())["credential_pool"]["openai-codex"]
+    assert root_rows[0].get("last_error_reset_at") is None
+
+
+def test_codex_cooldown_clear_never_touches_root_when_profile_owns_rows(profile_env):
+    """A profile with its own Codex rows is the owner: the root's cooldown state is not ours to
+    clear, even when none of the profile's rows are exhausted (0 cleared, root byte-identical)."""
+    from hermes_cli.auth_codex import clear_codex_pool_quota_cooldowns
+
+    root_file = profile_env["global"] / "auth.json"
+    _write(root_file, _make_auth_store(pool={
+        "openai-codex": [{"id": "glob", "auth_type": "oauth", "priority": 0,
+                          "access_token": "global-codex-access-token", "refresh_token": "r",
+                          "last_status": "exhausted", "last_error_reason": "rate_limit",
+                          "last_error_reset_at": 4_102_444_800}],
+    }))
+    _write(profile_env["profile"] / "auth.json", _make_auth_store(pool={
+        "openai-codex": [{"id": "prof", "auth_type": "oauth", "priority": 0,
+                          "access_token": "profile-codex-access-token", "refresh_token": "r"}],
+    }))
+    before = root_file.read_bytes()
+
+    assert clear_codex_pool_quota_cooldowns() == 0
+    assert root_file.read_bytes() == before
+
+
+def test_root_write_through_is_visible_to_the_next_fallback_read(profile_env):
+    """``_save_auth_store(target_path=root)`` must invalidate the mtime memo: a same-tick
+    read-after-write (coarse-mtime filesystems) would otherwise keep serving the stale root."""
+    import os
+    from hermes_cli.auth import _save_auth_store, read_credential_pool
+
+    root_file = profile_env["global"] / "auth.json"
+    _write(root_file, _make_auth_store(pool={"openai-codex": [{"id": "glob", "access_token": "old"}]}))
+    _write(profile_env["profile"] / "auth.json", _make_auth_store(pool={"openai-codex": []}))
+    assert read_credential_pool("openai-codex")[0]["access_token"] == "old"  # primes the memo
+    stat = root_file.stat()
+
+    _save_auth_store(_make_auth_store(pool={"openai-codex": [{"id": "glob", "access_token": "new"}]}),
+                     target_path=root_file)
+    os.utime(root_file, ns=(stat.st_atime_ns, stat.st_mtime_ns))  # simulate a same-tick write
+
+    assert read_credential_pool("openai-codex")[0]["access_token"] == "new"
+
+
+# ---------------------------------------------------------------------------
+# Classic mode — no fallback path should ever trigger
+# ---------------------------------------------------------------------------
+
+
+
+
+# ---------------------------------------------------------------------------
+# Writes stay scoped to the profile
+# ---------------------------------------------------------------------------
+
+
+def test_write_credential_pool_targets_profile_not_global(profile_env):
+    from hermes_cli.auth import read_credential_pool, write_credential_pool
+
+    _write(profile_env["global"] / "auth.json", _make_auth_store(pool={
+        "openrouter": [{
+            "id": "glob-1",
+            "label": "global",
+            "auth_type": "api_key",
+            "priority": 0,
+            "source": "manual",
+            "access_token": "sk-global",
+        }],
+    }))
+
+    write_credential_pool("openrouter", [{
+        "id": "prof-new",
+        "label": "profile-new",
+        "auth_type": "api_key",
+        "priority": 0,
+        "source": "manual",
+        "access_token": "sk-profile-new",
+    }])
+
+    # Global auth.json unchanged.
+    global_data = json.loads((profile_env["global"] / "auth.json").read_text())
+    assert global_data["credential_pool"]["openrouter"][0]["id"] == "glob-1"
+
+    # Profile auth.json holds the new entry.
+    profile_data = json.loads((profile_env["profile"] / "auth.json").read_text())
+    assert profile_data["credential_pool"]["openrouter"][0]["id"] == "prof-new"
+
+    # Subsequent read returns profile (shadows global).
+    assert [e["id"] for e in read_credential_pool("openrouter")] == ["prof-new"]
+
+
+
+
+def test_auth_lock_reentrancy_is_scoped_after_profile_context_switch(profile_env):
+    """Changing profile context cannot inherit another store's lock depth."""
+    import hermes_cli.auth as auth
+    from hermes_constants import reset_hermes_home_override, set_hermes_home_override
+
+    profile_b = profile_env["global"] / "profiles" / "reviewer"
+    profile_b.mkdir(parents=True)
+    profile_b_lock = profile_b / "auth.lock"
+
+    with auth._auth_store_lock():
+        holder_a = auth._auth_lock_holder_for(profile_env["profile"] / "auth.json")
+        assert getattr(holder_a, "depth", 0) == 1
+
+        token = set_hermes_home_override(profile_b)
+        try:
+            holder_b = auth._auth_lock_holder_for(profile_b / "auth.json")
+            assert holder_b is not holder_a
+            assert getattr(holder_b, "depth", 0) == 0
+            assert not profile_b_lock.exists()
+
+            with auth._auth_store_lock():
+                assert profile_b_lock.exists()
+                assert getattr(holder_b, "depth", 0) == 1
+        finally:
+            reset_hermes_home_override(token)
+
+    assert getattr(holder_a, "depth", 0) == 0
+
+
+# ---------------------------------------------------------------------------
+# write_credential_pool — stale-snapshot cooldown merge
+# ---------------------------------------------------------------------------
+
+
+@pytest.fixture()
+def classic_env(tmp_path, monkeypatch):
+    """Classic single-root layout (HERMES_HOME != ~/.hermes, no profiles)."""
+    fake_home = tmp_path / "home"
+    fake_home.mkdir()
+    monkeypatch.setattr(Path, "home", lambda: fake_home)
+    hermes_home = tmp_path / "classic"
+    hermes_home.mkdir()
+    monkeypatch.setenv("HERMES_HOME", str(hermes_home))
+    return hermes_home
+
+
+def _pool_entry(**overrides) -> dict:
+    entry = {
+        "id": "cred-x",
+        "label": "key-x",
+        "auth_type": "api_key",
+        "priority": 0,
+        "source": "manual",
+        "access_token": "sk-x",
+    }
+    entry.update(overrides)
+    return entry
+
+
+
+
+def test_write_pool_never_merges_cooldown_onto_reauthed_entry(classic_env):
+    """A token change means re-auth: the old cooldown must never carry over.
+
+    A fresh login intentionally clears the entry's status; resurrecting the
+    stale cooldown onto the new credentials would bench a just-authorized key.
+    """
+    from hermes_cli.auth import write_credential_pool
+
+    _write(classic_env / "auth.json", _make_auth_store(pool={
+        "openrouter": [_pool_entry(
+            access_token="sk-old",
+            last_status="exhausted",
+            last_status_at=time.time() - 60,  # newer AND unexpired
+            last_error_code=429,
+        )],
+    }))
+
+    # Same entry id, freshly re-authed with a new token and cleared status.
+    write_credential_pool("openrouter", [_pool_entry(access_token="sk-new")])
+
+    data = json.loads((classic_env / "auth.json").read_text())
+    persisted = data["credential_pool"]["openrouter"][0]
+    assert persisted["access_token"] == "sk-new"
+    assert persisted.get("last_status") != "exhausted"
+    assert persisted.get("last_error_code") is None
diff --git a/tests/hermes_cli/test_auth_profile_isolation.py b/tests/hermes_cli/test_auth_profile_isolation.py
deleted file mode 100644
index 9684bdb2c6..0000000000
--- a/tests/hermes_cli/test_auth_profile_isolation.py
+++ /dev/null
@@ -1,221 +0,0 @@
-"""Every profile owns its credentials.
-
-A named profile (``HERMES_HOME`` under ``profiles/<name>``) resolves provider state and the
-credential pool from ITS OWN ``auth.json`` only. The root ``~/.hermes/auth.json`` is never a
-read fallback and never a write-through target (#111724): an isolated service profile must fail
-closed instead of acting — and rotating tokens — as the owner. Writes stay scoped to the profile.
-"""
-
-from __future__ import annotations
-
-import json
-import time
-from pathlib import Path
-
-import pytest
-
-
-def _make_auth_store(pool: dict | None = None, providers: dict | None = None) -> dict:
-    store: dict = {"version": 1}
-    if pool is not None:
-        store["credential_pool"] = pool
-    if providers is not None:
-        store["providers"] = providers
-    return store
-
-
-@pytest.fixture()
-def profile_env(tmp_path, monkeypatch):
-    """Global root + an active named profile under Path.home()/.hermes/profiles/coder.
-
-    * Path.home() -> tmp_path
-    * Global root -> tmp_path/.hermes            (has its own auth.json fixture)
-    * Profile     -> tmp_path/.hermes/profiles/coder   (active, HERMES_HOME points here)
-    """
-    monkeypatch.setattr(Path, "home", lambda: tmp_path)
-    global_root = tmp_path / ".hermes"
-    global_root.mkdir()
-    profile_dir = global_root / "profiles" / "coder"
-    profile_dir.mkdir(parents=True)
-    monkeypatch.setenv("HERMES_HOME", str(profile_dir))
-    return {"global": global_root, "profile": profile_dir}
-
-
-def _write(path: Path, payload: dict) -> None:
-    path.write_text(json.dumps(payload, indent=2))
-
-
-_ROOT_STORE = _make_auth_store(
-    providers={
-        "nous": {"access_token": "nous-root", "refresh_token": "rt-root"},
-        "xai-oauth": {"auth_mode": "oauth_pkce",
-                      "tokens": {"access_token": "xai-root-access", "refresh_token": "xai-root-refresh"}},
-    },
-    pool={
-        "openrouter": [{"id": "glob-1", "label": "root", "auth_type": "api_key", "priority": 0,
-                        "source": "manual", "access_token": "sk-root"}],
-        "openai-codex": [{"id": "glob-codex", "auth_type": "oauth", "priority": 0,
-                          "source": "manual:device_code", "access_token": "root-codex-access",
-                          "refresh_token": "root-codex-refresh"}],
-    },
-)
-
-
-def test_named_profile_never_reads_the_root_store(profile_env):
-    """Provider state, pool slices and the whole-pool read all stop at the profile's own auth.json;
-    the profile's own rows are what it sees, and a root-only provider resolves to nothing."""
-    from hermes_cli.auth import get_provider_auth_state, read_credential_pool, resolve_codex_runtime_credentials
-    from hermes_cli.auth_xai import _read_xai_oauth_tokens
-    from hermes_cli.auth import AuthError
-
-    _write(profile_env["global"] / "auth.json", _ROOT_STORE)
-    _write(profile_env["profile"] / "auth.json", _make_auth_store(
-        providers={},
-        pool={"openrouter": [{"id": "prof-1", "auth_type": "api_key", "priority": 0,
-                              "source": "manual", "access_token": "sk-profile"}]},
-    ))
-
-    assert get_provider_auth_state("nous") is None
-    assert read_credential_pool("openai-codex") == []
-    assert [e["id"] for e in read_credential_pool("openrouter")] == ["prof-1"]
-    assert set(read_credential_pool()) == {"openrouter"}
-    with pytest.raises(AuthError):
-        _read_xai_oauth_tokens()
-    with pytest.raises(AuthError):
-        resolve_codex_runtime_credentials(refresh_if_expiring=False)
-
-    # Control: a home that owns the store (single-profile layout) resolves its credentials.
-    own = profile_env["profile"].parent / "owner"
-    own.mkdir()
-    _write(own / "auth.json", _ROOT_STORE)
-    from hermes_constants import reset_hermes_home_override, set_hermes_home_override
-    token = set_hermes_home_override(own)
-    try:
-        assert get_provider_auth_state("nous")["access_token"] == "nous-root"
-        assert read_credential_pool("openrouter")[0]["id"] == "glob-1"
-    finally:
-        reset_hermes_home_override(token)
-
-
-def test_profile_refresh_never_writes_through_to_the_root_store(profile_env):
-    """A token save inside a profile lands in the profile's auth.json; the root store is
-    byte-identical afterwards (xAI OAuth save, Codex save, pool write, cooldown clear)."""
-    from hermes_cli.auth import write_credential_pool
-    from hermes_cli.auth_codex import _save_codex_tokens, clear_codex_pool_quota_cooldowns
-    from hermes_cli.auth_xai import _save_xai_oauth_tokens
-
-    root_file = profile_env["global"] / "auth.json"
-    root_store = json.loads(json.dumps(_ROOT_STORE))
-    root_store["credential_pool"]["openai-codex"][0].update(
-        last_status="exhausted", last_error_reason="rate_limit", last_error_reset_at=4_102_444_800)
-    _write(root_file, root_store)
-    _write(profile_env["profile"] / "auth.json", _make_auth_store(providers={}, pool={}))
-    before = root_file.read_bytes()
-
-    _save_xai_oauth_tokens({"access_token": "xai-new", "refresh_token": "xai-new-rt"}, set_active=False)
-    _save_codex_tokens({"access_token": "codex-new", "refresh_token": "codex-new-rt"})
-    write_credential_pool("openrouter", [{"id": "prof-new", "auth_type": "api_key", "priority": 0,
-                                          "source": "manual", "access_token": "sk-profile-new"}])
-    assert clear_codex_pool_quota_cooldowns() == 0  # the root's exhausted row is not ours to clear
-
-    assert root_file.read_bytes() == before
-    profile_store = json.loads((profile_env["profile"] / "auth.json").read_text())
-    assert profile_store["providers"]["xai-oauth"]["tokens"]["refresh_token"] == "xai-new-rt"
-    assert profile_store["providers"]["openai-codex"]["tokens"]["refresh_token"] == "codex-new-rt"
-    assert [e["id"] for e in profile_store["credential_pool"]["openrouter"]] == ["prof-new"]
-
-
-def test_malformed_or_missing_root_store_never_breaks_a_profile_read(profile_env):
-    from hermes_cli.auth import read_credential_pool
-
-    (profile_env["global"] / "auth.json").write_text("{not valid json")
-    _write(profile_env["profile"] / "auth.json", _make_auth_store(pool={
-        "openrouter": [{"id": "prof-1", "auth_type": "api_key", "priority": 0,
-                        "source": "manual", "access_token": "sk-profile"}]}))
-    assert read_credential_pool("openrouter")[0]["id"] == "prof-1"
-
-
-def test_auth_lock_reentrancy_is_scoped_after_profile_context_switch(profile_env):
-    """Changing profile context cannot inherit another store's lock depth."""
-    import hermes_cli.auth as auth
-    from hermes_constants import reset_hermes_home_override, set_hermes_home_override
-
-    profile_b = profile_env["global"] / "profiles" / "reviewer"
-    profile_b.mkdir(parents=True)
-    profile_b_lock = profile_b / "auth.lock"
-
-    with auth._auth_store_lock():
-        holder_a = auth._auth_lock_holder_for(profile_env["profile"] / "auth.json")
-        assert getattr(holder_a, "depth", 0) == 1
-
-        token = set_hermes_home_override(profile_b)
-        try:
-            holder_b = auth._auth_lock_holder_for(profile_b / "auth.json")
-            assert holder_b is not holder_a
-            assert getattr(holder_b, "depth", 0) == 0
-            assert not profile_b_lock.exists()
-
-            with auth._auth_store_lock():
-                assert profile_b_lock.exists()
-                assert getattr(holder_b, "depth", 0) == 1
-        finally:
-            reset_hermes_home_override(token)
-
-    assert getattr(holder_a, "depth", 0) == 0
-
-
-# ---------------------------------------------------------------------------
-# write_credential_pool — stale-snapshot cooldown merge
-# ---------------------------------------------------------------------------
-
-
-@pytest.fixture()
-def classic_env(tmp_path, monkeypatch):
-    """Classic single-root layout (HERMES_HOME != ~/.hermes, no profiles)."""
-    fake_home = tmp_path / "home"
-    fake_home.mkdir()
-    monkeypatch.setattr(Path, "home", lambda: fake_home)
-    hermes_home = tmp_path / "classic"
-    hermes_home.mkdir()
-    monkeypatch.setenv("HERMES_HOME", str(hermes_home))
-    return hermes_home
-
-
-def _pool_entry(**overrides) -> dict:
-    entry = {
-        "id": "cred-x",
-        "label": "key-x",
-        "auth_type": "api_key",
-        "priority": 0,
-        "source": "manual",
-        "access_token": "sk-x",
-    }
-    entry.update(overrides)
-    return entry
-
-
-def test_write_pool_never_merges_cooldown_onto_reauthed_entry(classic_env):
-    """A token change means re-auth: the old cooldown must never carry over.
-
-    A fresh login intentionally clears the entry's status; resurrecting the
-    stale cooldown onto the new credentials would bench a just-authorized key.
-    """
-    from hermes_cli.auth import write_credential_pool
-
-    _write(classic_env / "auth.json", _make_auth_store(pool={
-        "openrouter": [_pool_entry(
-            access_token="sk-old",
-            last_status="exhausted",
-            last_status_at=time.time() - 60,  # newer AND unexpired
-            last_error_code=429,
-        )],
-    }))
-
-    # Same entry id, freshly re-authed with a new token and cleared status.
-    write_credential_pool("openrouter", [_pool_entry(access_token="sk-new")])
-
-    data = json.loads((classic_env / "auth.json").read_text())
-    persisted = data["credential_pool"]["openrouter"][0]
-    assert persisted["access_token"] == "sk-new"
-    assert persisted.get("last_status") != "exhausted"
-    assert persisted.get("last_error_code") is None
diff --git a/tests/hermes_cli/test_codex_token_writethrough.py b/tests/hermes_cli/test_codex_token_writethrough.py
new file mode 100644
index 0000000000..bb255f8875
--- /dev/null
+++ b/tests/hermes_cli/test_codex_token_writethrough.py
@@ -0,0 +1,147 @@
+"""Codex OAuth refresh writes back to the store the grant was resolved FROM (#87503).
+
+Codex refresh tokens are single-use with rotation-family reuse detection: a profile that refreshed
+a root-borrowed grant must land the rotated chain in root — singleton AND ``credential_pool`` —
+or root keeps the consumed refresh token and the next reader gets the whole family revoked.
+Token values are synthetic placeholders.
+"""
+
+import json
+import threading
+from pathlib import Path
+
+import httpx
+import pytest
+
+from hermes_cli import auth, auth_codex
+
+
+def _pair(prefix: str) -> dict:
+    return {"access_token": f"{prefix}-at", "refresh_token": f"{prefix}-rt"}
+
+
+def _write(path: Path, store: dict) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(json.dumps(store), encoding="utf-8")
+
+
+def _read(path: Path) -> dict:
+    return json.loads(path.read_text(encoding="utf-8"))
+
+
+@pytest.fixture
+def profile_env(tmp_path, monkeypatch):
+    """Global root at tmp/.hermes, active profile at tmp/.hermes/profiles/work (real on-disk layout)."""
+    monkeypatch.setattr(Path, "home", lambda: tmp_path)
+    monkeypatch.setenv("LOCALAPPDATA", str(tmp_path))  # Windows resolves the native root from here
+    root = tmp_path / ".hermes"
+    profile = root / "profiles" / "work"
+    profile.mkdir(parents=True)
+    monkeypatch.setenv("HERMES_HOME", str(profile))
+    return profile / "auth.json", root / "auth.json"
+
+
+def test_profile_refresh_of_root_grant_writes_through_to_root(profile_env):
+    profile_path, root_path = profile_env
+    _write(root_path, {
+        "version": 1,
+        "providers": {"openai-codex": {"auth_mode": "chatgpt", "tokens": _pair("old")}},
+        "credential_pool": {"openai-codex": [
+            {"provider": "openai-codex", "source": "device_code", **_pair("old")}]},
+    })
+    _write(profile_path, {"version": 1, "providers": {}})
+
+    rotated = _pair("new")
+    auth._save_codex_tokens(rotated, last_refresh="2026-08-16T00:00:00Z", write_through=True)
+
+    root = _read(root_path)
+    assert root["providers"]["openai-codex"]["tokens"] == rotated
+    assert root["credential_pool"]["openai-codex"][0]["refresh_token"] == rotated["refresh_token"]
+    assert root["credential_pool"]["openai-codex"][0]["access_token"] == rotated["access_token"]
+    # A profile copy would shadow root and disable the write-through on the next refresh (#74339).
+    assert "openai-codex" not in _read(profile_path).get("providers", {})
+
+
+def test_profile_owned_grant_stays_local(profile_env):
+    profile_path, root_path = profile_env
+    _write(profile_path, {
+        "version": 1,
+        "providers": {"openai-codex": {"auth_mode": "chatgpt", "tokens": _pair("prof")}},
+    })
+    _write(root_path, {"version": 1, "providers": {}})
+
+    rotated = _pair("next")
+    auth._save_codex_tokens(rotated, last_refresh="2026-08-16T00:00:00Z", write_through=True)
+
+    assert _read(profile_path)["providers"]["openai-codex"]["tokens"] == rotated
+    assert "openai-codex" not in _read(root_path).get("providers", {})
+
+    # A fresh login under a profile that was borrowing root's grant is the profile's own account,
+    # never a rewrite of root's.
+    _write(profile_path, {"version": 1, "providers": {}})
+    _write(root_path, {"version": 1, "providers": {"openai-codex": {"auth_mode": "chatgpt", "tokens": _pair("root")}}})
+    auth._save_codex_tokens(_pair("login"))
+    assert _read(profile_path)["providers"]["openai-codex"]["tokens"] == _pair("login")
+    assert _read(root_path)["providers"]["openai-codex"]["tokens"] == _pair("root")
+
+
+class _RotatingEndpoint:
+    """Token endpoint that rotates ``old-rt`` once and rejects any replay of a consumed token."""
+
+    def __init__(self, hold_seconds: float):
+        self.hold_seconds = hold_seconds
+        self.seen: list = []
+        self._guard = threading.Lock()
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *exc):
+        return False
+
+    def post(self, url, *, headers=None, data=None):
+        import time
+        with self._guard:
+            replay = data["refresh_token"] in self.seen
+            self.seen.append(data["refresh_token"])
+        time.sleep(self.hold_seconds)  # a concurrent refresher must wait on the lock, not overlap
+        if replay:
+            return httpx.Response(400, json={"error": "refresh_token_reused"})
+        return httpx.Response(200, json={"access_token": "new-at", "refresh_token": "new-rt"})
+
+
+def test_concurrent_refreshes_of_shared_root_grant_submit_old_token_once(profile_env, monkeypatch):
+    """Two refreshers holding the same stale pre-read pair: the second re-reads ROOT under its lock,
+    sees the peer's rotated pair and adopts it instead of replaying the single-use token."""
+    profile_path, root_path = profile_env
+    _write(root_path, {
+        "version": 1,
+        "providers": {"openai-codex": {"auth_mode": "chatgpt", "tokens": _pair("old")}},
+    })
+    _write(profile_path, {"version": 1, "providers": {}})
+    endpoint = _RotatingEndpoint(hold_seconds=1.5)  # longer than the lock floor (1 s)
+    monkeypatch.setattr(auth_codex, "_codex_http_client", lambda **kw: endpoint)
+    # The waiter must outlive the peer's endpoint call on BOTH locks: with the default lock
+    # timeout shorter than the POST, the second profile would raise TimeoutError instead of adopt.
+    monkeypatch.setattr(auth._auth_store_lock.__wrapped__, "__defaults__", (1.0,))
+    monkeypatch.setattr(auth_codex, "AUTH_LOCK_TIMEOUT_SECONDS", 1.0)
+
+    results, errors = {}, {}
+
+    def _refresh(name):
+        try:
+            results[name] = auth._refresh_codex_auth_tokens(_pair("old"), timeout_seconds=1.0)
+        except Exception as exc:  # pragma: no cover - surfaced via the assertion below
+            errors[name] = exc
+
+    workers = [threading.Thread(target=_refresh, args=(n,)) for n in ("a", "b")]
+    for w in workers:
+        w.start()
+    for w in workers:
+        w.join(timeout=10)
+
+    assert errors == {}
+    assert endpoint.seen == ["old-rt"]
+    assert results == {"a": _pair("new"), "b": _pair("new")}
+    assert _read(root_path)["providers"]["openai-codex"]["tokens"] == _pair("new")
+    assert "openai-codex" not in _read(profile_path).get("providers", {})
diff --git a/tests/hermes_cli/test_global_auth_store_memo.py b/tests/hermes_cli/test_global_auth_store_memo.py
new file mode 100644
index 0000000000..a8f062cfce
--- /dev/null
+++ b/tests/hermes_cli/test_global_auth_store_memo.py
@@ -0,0 +1,114 @@
+"""Measured-work pins for the _load_global_auth_store() memo.
+
+read_credential_pool() -> load_pool() runs _load_global_auth_store() once per
+provider row in the /model picker, and the global-store JSON read + parse
+cost ~60-100us+ per call even when nothing changed. The memo keyed on the
+global auth file's path+mtime makes repeat reads a dict lookup. The store
+only changes when the user authenticates at global scope (writes always go
+through _save_auth_store, which touches the file), so the mtime key keeps
+the memo freshness-correct.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+
+import pytest
+
+import hermes_cli.auth as auth_mod
+
+
+@pytest.fixture(autouse=True)
+def _reset_cache(monkeypatch):
+    # raising=False: on pre-fix code the memo attribute doesn't exist (that
+    # IS the fix); the reset is a no-op there so the measured-work assertions
+    # fail genuinely instead of erroring.
+    monkeypatch.setattr(
+        auth_mod, "_global_auth_store_cache", None, raising=False
+    )
+    yield
+    monkeypatch.setattr(
+        auth_mod, "_global_auth_store_cache", None, raising=False
+    )
+
+
+def _make_global_store(tmp_path) -> "os.PathLike[str]":
+    """Write a realistic global auth.json and return its path."""
+    path = tmp_path / "global-hermes" / "auth.json"
+    path.parent.mkdir(parents=True)
+    path.write_text(
+        json.dumps(
+            {
+                "version": 1,
+                "providers": {
+                    "openai": {"api_key": "sk-x"},
+                    "anthropic": {"api_key": "an-x"},
+                },
+                "credential_pool": {
+                    "openai": [{"id": "1", "access_token": "t"}],
+                    "anthropic": [{"id": "2", "access_token": "u"}],
+                },
+            }
+        ),
+        encoding="utf-8",
+    )
+    return path
+
+
+class TestLoadGlobalAuthStoreMemo:
+    def test_repeated_calls_read_store_once(self, tmp_path, monkeypatch):
+        """Repeated calls must not re-read/re-parse the global store."""
+        global_path = _make_global_store(tmp_path)
+        monkeypatch.setattr(
+            auth_mod, "_global_auth_file_path", lambda: global_path
+        )
+        reads = {"n": 0}
+        orig = auth_mod._load_auth_store
+
+        def counting_load(store_path=None):
+            reads["n"] += 1
+            return orig(store_path)
+
+        monkeypatch.setattr(auth_mod, "_load_auth_store", counting_load)
+
+        first = auth_mod._load_global_auth_store()
+        for _ in range(10):
+            auth_mod._load_global_auth_store()
+        assert reads["n"] == 1, (
+            "repeated calls must be memo hits (store read once), "
+            f"got {reads['n']}"
+        )
+        assert first.get("providers", {}).get("openai") == {"api_key": "sk-x"}
+
+    def test_mtime_change_re_reads_once(self, tmp_path, monkeypatch):
+        """A store file change on disk invalidates the memo."""
+        global_path = _make_global_store(tmp_path)
+        monkeypatch.setattr(
+            auth_mod, "_global_auth_file_path", lambda: global_path
+        )
+        reads = {"n": 0}
+        orig = auth_mod._load_auth_store
+
+        def counting_load(store_path=None):
+            reads["n"] += 1
+            return orig(store_path)
+
+        monkeypatch.setattr(auth_mod, "_load_auth_store", counting_load)
+
+        auth_mod._load_global_auth_store()
+        assert reads["n"] == 1
+
+        # Bump the file mtime -> memo invalidates -> re-read once.
+        os.utime(global_path, (1_700_000_000, 1_700_000_000))
+        auth_mod._load_global_auth_store()
+        assert reads["n"] == 2, "mtime change must force exactly one re-read"
+
+    def test_absent_global_store_returns_empty_without_error(self, tmp_path, monkeypatch):
+        """No global fallback (classic mode) returns {} and stays cheap."""
+        missing = tmp_path / "no-such" / "auth.json"
+        monkeypatch.setattr(
+            auth_mod, "_global_auth_file_path", lambda: missing
+        )
+        assert auth_mod._load_global_auth_store() == {}
+        assert auth_mod._global_auth_store_cache is None
diff --git a/tests/hermes_cli/test_xai_oauth_profile_auth.py b/tests/hermes_cli/test_xai_oauth_profile_auth.py
index 8cff9eb710..fd005c3055 100644
--- a/tests/hermes_cli/test_xai_oauth_profile_auth.py
+++ b/tests/hermes_cli/test_xai_oauth_profile_auth.py
@@ -28,6 +28,7 @@ def test_read_xai_oauth_tokens_uses_credential_pool_when_provider_tokens_empty(m
         },
     }
     monkeypatch.setattr(auth, "_load_auth_store", lambda: store)
+    monkeypatch.setattr(auth, "_load_global_auth_store", lambda: {})
 
     resolved = auth._read_xai_oauth_tokens(_lock=False)
 
diff --git a/tests/hermes_cli/test_xai_oauth_writethrough.py b/tests/hermes_cli/test_xai_oauth_writethrough.py
new file mode 100644
index 0000000000..30ef7c6a85
--- /dev/null
+++ b/tests/hermes_cli/test_xai_oauth_writethrough.py
@@ -0,0 +1,90 @@
+"""Regression tests for xAI OAuth refresh write-through to the global root.
+
+Companion to ``test_xai_oauth_profile_auth.py``. That file covers the READ
+fallback (profile -> credential pool -> global root). These cover the WRITE
+side: when a profile that has no own ``providers.xai-oauth`` block refreshes
+the (rotating) grant it resolved from the root fallback, the rotated tokens
+must be written back to the global root too. Otherwise root keeps a revoked
+refresh token and every other profile reading root's stale grant dies with
+``invalid_grant`` once its access token expires (issue #43589).
+
+The tests drive the real ``_save_xai_oauth_tokens`` against real on-disk auth
+stores (profile + root under ``tmp_path``) rather than mocking the save
+boundary, so they exercise the actual atomic write path.
+"""
+
+import json
+
+import pytest
+
+from hermes_cli import auth
+
+
+def _write_store(path, store):
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(json.dumps(store), encoding="utf-8")
+
+
+def _read_store(path):
+    return json.loads(path.read_text(encoding="utf-8"))
+
+
+@pytest.fixture
+def profile_and_root(tmp_path, monkeypatch):
+    """Wire a profile auth store + a distinct global-root auth store on disk.
+
+    Returns (profile_path, root_path). The pytest seat belt in
+    ``_write_through_xai_oauth_to_global_root`` only refuses the *real* user's
+    ``$HOME/.hermes/auth.json``; a tmp_path root is allowed, so we point HOME
+    away from the tmp root to keep the guard from tripping on these fixtures.
+    """
+    profile_path = tmp_path / "profiles" / "work" / "auth.json"
+    root_path = tmp_path / "root" / "auth.json"
+
+    monkeypatch.setattr(auth, "_auth_file_path", lambda: profile_path)
+    monkeypatch.setattr(auth, "_global_auth_file_path", lambda: root_path)
+    # Keep the pytest write seat belt from matching our tmp root.
+    monkeypatch.setenv("HOME", str(tmp_path / "not-the-root"))
+    return profile_path, root_path
+
+
+
+
+
+
+def test_write_through_is_noop_in_classic_mode(tmp_path, monkeypatch):
+    """Classic mode (profile == root) already saves to root; no double write."""
+    profile_path = tmp_path / "auth.json"
+    monkeypatch.setattr(auth, "_auth_file_path", lambda: profile_path)
+    # Classic mode: _global_auth_file_path returns None.
+    monkeypatch.setattr(auth, "_global_auth_file_path", lambda: None)
+    _write_store(profile_path, {"version": 1, "providers": {}})
+
+    # Should not raise and should persist to the single store.
+    auth._save_xai_oauth_tokens(
+        {"access_token": "a", "refresh_token": "r"}
+    )
+    store = _read_store(profile_path)
+    assert store["providers"]["xai-oauth"]["tokens"]["refresh_token"] == "r"
+
+
+def test_write_through_failure_does_not_break_profile_save(profile_and_root, monkeypatch):
+    """A failed root write-through must not break the profile's own save."""
+    profile_path, root_path = profile_and_root
+    _write_store(profile_path, {"version": 1, "providers": {}})
+    _write_store(root_path, {"version": 1, "providers": {}})
+
+    # Make the root write blow up; the profile save must still succeed.
+    real_save = auth._save_auth_store
+
+    def _exploding_save(store, target_path=None):
+        if target_path is not None and target_path == root_path:
+            raise OSError("simulated root write failure")
+        return real_save(store, target_path)
+
+    monkeypatch.setattr(auth, "_save_auth_store", _exploding_save)
+
+    auth._save_xai_oauth_tokens({"access_token": "a", "refresh_token": "r"})
+
+    profile = _read_store(profile_path)
+    assert profile["providers"]["xai-oauth"]["tokens"]["refresh_token"] == "r"
diff --git a/tests/test_hermes_constants.py b/tests/test_hermes_constants.py
index 9e75e371e2..0d0881391d 100644
--- a/tests/test_hermes_constants.py
+++ b/tests/test_hermes_constants.py
@@ -81,8 +81,9 @@ class TestGetDefaultHermesRoot:
         """Repeated calls reuse the memo; HERMES_HOME / home changes invalidate.
 
         get_default_hermes_root() resolves HERMES_HOME against the native
-        home (~80us of path resolution) and is called at 31+ sites — kanban,
-        backup, gateway, update, profile enumeration. The memo is keyed on
+        home (~80us of path resolution) and is called at 31+ sites — every
+        _load_global_auth_store() (per provider row in the /model picker),
+        kanban, backup, gateway, update. The memo is keyed on
         (native home, HERMES_HOME) compared for free each call.
         """
         # HERMES_HOME set to a Docker-profile path: every call resolves the
diff --git a/tests/tools/test_managed_tool_gateway.py b/tests/tools/test_managed_tool_gateway.py
index be7397568a..1f96ed1c8b 100644
--- a/tests/tools/test_managed_tool_gateway.py
+++ b/tests/tools/test_managed_tool_gateway.py
@@ -210,15 +210,16 @@ def test_default_bearer_gate_accepts_both_deployed_hosts_only():
             assert not managed_gateway_auth.is_managed_nous_gateway_url(untrusted)
 
 
-def test_read_nous_provider_state_reads_only_the_profiles_own_store(tmp_path, monkeypatch):
-    # Every profile owns its credentials (#111724): a named profile with an empty auth.json has
-    # no Nous identity, even when the root is signed in; its own login is what the gate sees.
+def test_read_nous_provider_state_falls_back_to_global_root_for_share_auth_profiles(tmp_path, monkeypatch):
+    # A profile created with ``share_auth`` has no auth.json of its own; it signs in with the
+    # root identity. The connector gate must see that identity, or manage_connections vanishes
+    # from the profile's tool list while every other credential reader still works.
     root = tmp_path / ".hermes"
     profile = root / "profiles" / "hermes-setup"
     profile.mkdir(parents=True)
     (root / "auth.json").write_text(json.dumps({
         "version": 1,
-        "providers": {"nous": {"auth_method": "anonymous", "access_token": "root-tok"}},
+        "providers": {"nous": {"auth_method": "anonymous", "access_token": "tok"}},
     }))
     monkeypatch.setenv("HERMES_HOME", str(profile))
     monkeypatch.setenv("HERMES_GUEST_ONBOARDING", "1")
@@ -229,13 +230,10 @@ def test_read_nous_provider_state_reads_only_the_profiles_own_store(tmp_path, mo
 
     monkeypatch.setattr(hermes_constants, "get_default_hermes_root", lambda: root)
     monkeypatch.setattr(auth_mod, "get_hermes_home", lambda: profile)
+    monkeypatch.setattr(auth_mod, "_global_auth_store_cache", None)
     monkeypatch.setattr(auth_mod, "_auth_file_path", lambda: profile / "auth.json")
 
-    assert managed_tool_gateway._read_nous_provider_state() is None
-
-    (profile / "auth.json").write_text(json.dumps({
-        "version": 1,
-        "providers": {"nous": {"auth_method": "anonymous", "access_token": "profile-tok"}},
-    }))
     state = managed_tool_gateway._read_nous_provider_state()
-    assert state is not None and state["access_token"] == "profile-tok"
+
+    assert state is not None
+    assert state["auth_method"] == "anonymous"
diff --git a/tools/managed_tool_gateway.py b/tools/managed_tool_gateway.py
index 36453dbc8e..ff45545e04 100644
--- a/tools/managed_tool_gateway.py
+++ b/tools/managed_tool_gateway.py
@@ -42,8 +42,10 @@ def _read_nous_provider_state() -> Optional[dict]:
     with ``nous.guest: false`` it is invisible here, so no cached or refreshed token of it is ever
     attached to a request.
 
-    Reads the profile's own ``auth.json`` through ``get_provider_auth_state`` like every other
-    credential reader."""
+    Resolves through the same profile-then-global-root fallback every other credential reader
+    uses: a profile created with ``share_auth`` has no ``auth.json`` of its own and signs in with
+    the root identity. Reading only ``HERMES_HOME/auth.json`` made that profile look signed out to
+    the connector gate alone, so ``manage_connections`` vanished from its tool list."""
     try:
         from hermes_cli.auth import get_provider_auth_state
 
diff --git a/tui_gateway/contracts/profiles_vault_complete_foreign_subagents.py b/tui_gateway/contracts/profiles_vault_complete_foreign_subagents.py
index 987959c454..0e8cc1f748 100644
--- a/tui_gateway/contracts/profiles_vault_complete_foreign_subagents.py
+++ b/tui_gateway/contracts/profiles_vault_complete_foreign_subagents.py
@@ -9,6 +9,7 @@ histories on the serving backend; ``subagent.*`` is the session-scoped roster of
 
 from __future__ import annotations
 
+from typing import Literal
 
 from pydantic import Field
 
@@ -191,15 +192,15 @@ class ProfilesCreateParams(ProfileParams):
     soul: str | None = None
     model: str | None = None
     provider: str | None = None
-    share_auth: bool | str | None = None  # accepted from older clients; ignored (#111724)
+    share_auth: bool | str | None = None
     mirror_credentials: bool | str | None = None
 
 
 class ProfileMirrored(Result):
-    """What was copied from the launch profile."""
+    """What was copied from the launch profile; ``auth`` is ``"shared"`` under ``share_auth``."""
 
     env: bool = False
-    auth: bool = False
+    auth: bool | Literal["shared"] = False
     model_inherited: bool = False
     voice: bool = False
 
diff --git a/tui_gateway/methods_profiles.py b/tui_gateway/methods_profiles.py
index fc47768357..074bb51ac6 100644
--- a/tui_gateway/methods_profiles.py
+++ b/tui_gateway/methods_profiles.py
@@ -354,11 +354,11 @@ def _inherit_launch_model(path) -> bool:
 
 def _mirror_launch_credentials(path, params: dict) -> dict:
     """Copy launch .env / auth.json / voice sections into a new profile (best-effort per item).
-    ``mirror_credentials`` false skips everything. ``model_inherited`` is filled in by the caller.
-
-    ``share_auth`` is accepted from older clients and ignored: a profile never reads the launch
-    profile's auth.json (#111724), so "shared" auth would leave it with no provider at all."""
-    mirrored = {"env": False, "auth": False, "model_inherited": False, "voice": False}
+    ``share_auth`` reports ``auth: "shared"`` and skips the auth copy; ``mirror_credentials``
+    false skips everything. ``model_inherited`` is filled in by the caller."""
+    share_auth = is_truthy_value(params.get("share_auth", False))
+    mirrored = {"env": False, "auth": "shared" if share_auth else False, "model_inherited": False,
+                "voice": False}
     if not is_truthy_value(params.get("mirror_credentials", True)):
         return mirrored
     launch_home = get_hermes_home()
@@ -369,12 +369,13 @@ def _mirror_launch_credentials(path, params: dict) -> dict:
         # Provider/tool keys are what "mirror credentials" means; the launch profile's bot tokens
         # and allowlists would make the new bot collide with it over one Telegram/Discord bot.
         _best_effort(lambda: _lazy("hermes_cli.profile_channels", "strip_channel_env_file")(path / ".env"))
-    mirrored["auth"] = _try(lambda: _mirror_secret(path, launch_home, "auth.json",
-                                                   lambda src, dst: not dst.exists()), False)
-    if mirrored["auth"]:
-        # Drop single-use OAuth grants (a copy forks token state: the first refresh in either store
-        # strands the other); the new profile signs into those providers itself. API keys stay.
-        _best_effort(lambda: _lazy("hermes_cli.auth", "strip_cloned_single_use_oauth_grants")(path))
+    if not share_auth:  # a copy forks token state: the first refresh in either store strands the other
+        mirrored["auth"] = _try(lambda: _mirror_secret(path, launch_home, "auth.json",
+                                                       lambda src, dst: not dst.exists()), False)
+        if mirrored["auth"]:
+            # Drop single-use OAuth grants (first refresh strands every sibling); they read from the
+            # root grant via the pool fallback. API keys stay.
+            _best_effort(lambda: _lazy("hermes_cli.auth", "strip_cloned_single_use_oauth_grants")(path))
     mirrored["voice"] = _mirror_voice_sections(path)
     return mirrored
 
@@ -384,9 +385,8 @@ def _(rid, params: dict) -> dict:
     """Create a profile (ws twin of POST /api/profiles). Params: ``name``, ``description``,
     ``clone_from`` (omitted = fresh + bundled skills), ``clone_all``, ``clone_channels`` (opt-in: keep the
     source's bot tokens/allowlists — default strips them so two profiles never hold one bot), ``no_skills``, ``soul``,
-    ``model`` + ``provider``, ``no_alias``, ``mirror_credentials`` (default true: a bare
-    ``create_profile()`` seeds a comment-only .env and no auth.json = NO provider headless);
-    ``share_auth`` is accepted from older clients and ignored."""
+    ``model`` + ``provider``, ``share_auth``, ``no_alias``, ``mirror_credentials`` (default true: a bare
+    ``create_profile()`` seeds a comment-only .env and no auth.json = NO provider headless)."""
     name = str(params.get("name") or "").strip()
     if not name:
         return _err(rid, 4061, "name required")
diff --git a/website/docs/user-guide/multi-profile-gateways.md b/website/docs/user-guide/multi-profile-gateways.md
index 81df01e59a..25969fe199 100644
--- a/website/docs/user-guide/multi-profile-gateways.md
+++ b/website/docs/user-guide/multi-profile-gateways.md
@@ -470,7 +470,6 @@ profile and never shares with the default or any sibling:
 | Concern | Resolved from | Behaviour when the profile lacks it |
 |---|---|---|
 | Provider keys, bot tokens, `${VAR}` refs in `config.yaml` | The profile's own `.env` (its secret scope) | Unresolved / no adapter — never the default profile's value |
-| Provider logins and the credential pool (`auth.json`: OAuth tokens, `hermes auth add` keys) | The profile's own `auth.json` | "Not connected to any AI provider" with the `hermes -p <name> model` hint — never the default profile's login, and a refresh never writes to the root store |
 | Authorization (`GATEWAY_ALLOW_ALL_USERS`, `GATEWAY_ALLOWED_USERS`, per-platform allowlists and allow-all opt-ins) | The owning profile's `.env` and `config.yaml` | Closed — a default-profile opt-in never opens a secondary's bot |
 | HTTP endpoints (`/p/<profile>/api/...`, `/p/<profile>/webhooks/...`, platform event callbacks) | The named profile's `API_SERVER_KEY`, `profile:`-bound webhook routes, and its own adapter | `401`/`404`; delivery without an adapter is `502`/`503`, never another profile's bot |
 | Inbound-port platforms (`/p/<profile>/webhooks/twilio`, `/p/<profile>/line/webhook`, `/p/<profile>/api/messages`, …) | The named profile's own adapter and its secret (Twilio auth token, LINE channel secret, Teams app, BlueBubbles password, …); replies leave through that adapter | `401`/`403` on a wrong secret, `404` when the profile has no such adapter — never the default profile's adapter |
diff --git a/website/docs/user-guide/profiles.md b/website/docs/user-guide/profiles.md
index 3df26e473d..006e31941b 100644
--- a/website/docs/user-guide/profiles.md
+++ b/website/docs/user-guide/profiles.md
@@ -101,14 +101,10 @@ hermes profile create backup --clone-all
 
 Copies **everything** — config, API keys, personality, all memories, skills, plugins. A complete working snapshot. Per-profile history is excluded (session history, `state.db`, `backups/`, `state-snapshots/`, `checkpoints/`) — these belong to the source profile and can reach tens of GB. When cloning from the default profile, the local-model runtime trees (`models/`, `runtimes/`, `node/` — downloaded weights and managed binaries, re-fetched on demand) are skipped too, as `hermes backup` already does. **Cron jobs are not cloned** either: they are scheduled work bound to the source profile and its delivery channel, and a clone that inherited them would run every job twice (two gateways, same job ids). The new profile starts with an empty `cron/`. For a full backup including history and cron jobs, use `hermes profile export` or `hermes backup` instead.
 
-:::note OAuth logins are never copied
-Anthropic (Claude Pro/Max), OpenAI Codex, and xAI OAuth logins use **single-use refresh tokens** — a copy of one is not a second credential, it is the same credential with two owners, and the first profile to refresh it revokes it for every other copy. `--clone-all` (and the dashboard's credential mirroring) therefore drops those OAuth rows from the clone. Static API keys are copied as usual. Sign the new profile into the OAuth provider itself: `hermes -p <name> auth add <provider>` (or `hermes -p <name> model`).
+:::note OAuth logins are shared, not copied
+Anthropic (Claude Pro/Max), OpenAI Codex, and xAI OAuth logins use **single-use refresh tokens** — a copy of one is not a second credential, it is the same credential with two owners, and the first profile to refresh it revokes it for every other copy. `--clone-all` (and the dashboard's credential mirroring) therefore drops those OAuth rows from the clone. The new profile keeps reading the login from the root `~/.hermes/auth.json`, and a token refresh performed inside any profile is written back to root, so all profiles stay signed in. Static API keys are copied as usual. To give a profile its own separate OAuth login, run `hermes -p <name> auth add <provider>` inside it.
 :::
 
-### Every profile owns its credentials
-
-A named profile resolves providers from **its own** `auth.json` and `.env` only. It never inherits the root profile's logins or API keys, and a token refresh inside a profile never writes to the root store. A profile with no provider of its own is asked to set one up (`hermes -p <name> model`, or `hermes -p <name> auth add <provider>`) — it does not silently act as the owner. `hermes update` lists every profile that has no provider of its own so a bot never goes quiet unannounced.
-
 ### Clone from a specific profile
 
 ```bash

From f50d4b3423f8bf16649d9a9788d4d4db866ec869 Mon Sep 17 00:00:00 2001
From: teknium1 <127238744+teknium1@users.noreply.github.com>
Date: Mon, 21 Sep 2026 09:51:18 -0700
Subject: [PATCH 3/9] Revert "docs(portal): the shared token store refreshes a
 login, it does not seed one"

This reverts commit 0269ddb7ca49ce46137240c2c810739ca9c6e25f.
---
 website/docs/integrations/nous-portal.md                      | 4 +---
 .../current/integrations/nous-portal.md                       | 4 +---
 2 files changed, 2 insertions(+), 6 deletions(-)

diff --git a/website/docs/integrations/nous-portal.md b/website/docs/integrations/nous-portal.md
index 9cc2feb5bc..a3b9273844 100644
--- a/website/docs/integrations/nous-portal.md
+++ b/website/docs/integrations/nous-portal.md
@@ -124,9 +124,7 @@ OAuth needs a browser, but the loopback callback runs on the machine where Herme
 
 ### Profile setup {#profile-setup}
 
-If you use [Hermes profiles](../user-guide/profiles.md), the Portal refresh token is shared across profiles via a shared token store — but the store **refreshes an existing login, it does not create one**. Profiles are independent islands ([#111724](https://github.com/NousResearch/hermes-agent/issues/111724)), so a profile that has never signed in to the Portal has no Nous credentials of its own: at boot it fails closed with `Profile '<name>' is not connected to any AI provider yet` rather than silently adopting another profile's session.
-
-Sign in **once per profile** with `hermes -p <name> portal` (alias for `hermes -p <name> auth add nous --type oauth`). When a shared Portal session already exists on the machine, that command offers to import it — one confirmation, no browser round-trip. After that first import the profile keeps its own state, and the shared store keeps its token current whenever any profile refreshes or re-logs in. `hermes profile create <name> --clone-all` from a signed-in profile also carries the Portal login (only single-use grants such as Anthropic/Codex are stripped from clones).
+If you use [Hermes profiles](/user-guide/profiles), the Portal refresh token is automatically shared across all profiles via a shared token store. Sign in once on any profile, and the rest pick it up automatically — no need to repeat the OAuth flow per profile.
 
 ## Using the Portal day-to-day
 
diff --git a/website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/integrations/nous-portal.md b/website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/integrations/nous-portal.md
index c7f74eac67..aab1c2af41 100644
--- a/website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/integrations/nous-portal.md
+++ b/website/i18n/zh-Hans/docusaurus-plugin-content-docs/current/integrations/nous-portal.md
@@ -120,9 +120,7 @@ OAuth 需要浏览器，但回调的 loopback 运行在 Hermes 所在的机器
 
 ### Profile 配置 {#profile-setup}
 
-如果你使用 [Hermes profiles（配置文件）](../user-guide/profiles.md)，Portal 的 refresh token 会通过共享令牌存储在各 profile 间共享——但该存储**只刷新已有的登录，不会创建新登录**。各 profile 是相互独立的孤岛（[#111724](https://github.com/NousResearch/hermes-agent/issues/111724)），因此从未登录过 Portal 的 profile 没有自己的 Nous 凭证：启动时它会直接失败，提示 `Profile '<name>' is not connected to any AI provider yet`，而不会静默采用其他 profile 的会话。
-
-**每个 profile 都需登录一次**，命令为 `hermes -p <name> portal`（即 `hermes -p <name> auth add nous --type oauth` 的别名）。如果机器上已有共享的 Portal 会话，该命令会提示导入——确认一次即可，无需再走浏览器流程。首次导入后该 profile 保留自己的状态，只要任一 profile 刷新或重新登录，共享存储便会让它的令牌保持最新。从已登录的 profile 执行 `hermes profile create <name> --clone-all` 也会一并带上 Portal 登录（克隆时只会剥离 Anthropic/Codex 这类一次性授权）。
+如果你使用 [Hermes profiles（配置文件）](/user-guide/profiles)，Portal 的 refresh token 会通过共享令牌存储自动在所有 profile 间共享。在任意 profile 上登录一次，其余 profile 自动获取——无需为每个 profile 重复 OAuth 流程。
 
 ## 日常使用 Portal
 

From 6a3dcc39ab0028a0079d417eb5f0bc29f30ecd9a Mon Sep 17 00:00:00 2001
From: teknium1 <127238744+teknium1@users.noreply.github.com>
Date: Mon, 21 Sep 2026 08:00:16 -0700
Subject: [PATCH 4/9] fix(dashboard): every REST route honours the profile it
 is given

One backend process now serves every profile, but a handful of REST handlers
resolved get_hermes_home() directly and ignored the profile the request named:
POST /api/memory/reset wiped the LAUNCH profile's MEMORY.md/USER.md no matter
which profile the switcher pointed at, and the same held for the curator state
file, webhook subscriptions, shell hooks + their consent allowlist, checkpoints,
backups/imports, the credential pool and the dashboard's own theme/font/plugin
preferences. Per-profile backend processes used to mask it.

* Every one of those handlers now takes `?profile=` and runs inside the
  existing `_config_profile_scope` / `_profile_scope` seam; action-spawning
  routes pass `-p <profile>` to the child via `_profile_cli_args`.
* Destructive routes (memory reset, webhook delete, hook delete, checkpoint
  prune, ops import/import-upload, credential-pool delete, curator run) refuse
  an UNNAMED profile with 400 while the process hosts more than one profile
  (`is_multiplex_active()`, decided at boot). A genuinely single-profile host
  keeps the old meaning, so plain `hermes serve` + curl is unchanged.
* Callers updated in the same change: the Desktop main-process routing table
  (`LOCAL_PRIMARY_SCOPED_ROUTES` + the /api/webhooks and /api/ops families) so
  a fixed handler reaches the shared backend WITH the profile query instead of
  a per-profile backend that no longer exists, and the dashboard SPA's
  `PROFILE_SCOPED_PREFIXES`.
---
 .../electron/connection-config.test.ts        |  26 +-
 apps/desktop/electron/connection-config.ts    |  35 ++-
 hermes_cli/web_routers/_common.py             |  35 +++
 hermes_cli/web_routers/actions.py             |   7 +-
 hermes_cli/web_routers/config_env.py          |   5 +-
 hermes_cli/web_routers/dashboard_ui.py        |  34 +--
 hermes_cli/web_routers/local_models.py        |  20 +-
 hermes_cli/web_routers/memory_providers.py    |  32 ++-
 hermes_cli/web_routers/ops.py                 | 256 +++++++++++-------
 hermes_cli/web_routers/status.py              |  76 +++---
 ...t_web_routers_destructive_profile_scope.py | 109 ++++++++
 web/src/lib/api.ts                            |  20 +-
 12 files changed, 472 insertions(+), 183 deletions(-)
 create mode 100644 tests/hermes_cli/test_web_routers_destructive_profile_scope.py

diff --git a/apps/desktop/electron/connection-config.test.ts b/apps/desktop/electron/connection-config.test.ts
index 76fc83f5b1..0ccd85cb8f 100644
--- a/apps/desktop/electron/connection-config.test.ts
+++ b/apps/desktop/electron/connection-config.test.ts
@@ -383,7 +383,7 @@ const ROUTES = [
       globalRemote: false,
       profileRemoteOverride: false,
       requestMethod: 'POST',
-      requestPath: '/api/memory/reset'
+      requestPath: '/api/files/upload'
     },
     expected: { backend: 'pool', descriptorProfile: null, scopePath: false }
   },
@@ -701,7 +701,17 @@ test('pathWithGlobalRemoteProfile appends local-primary profile scope only for e
       requestMethod: 'POST',
       requestPath: '/api/memory/reset'
     }),
-    '/api/memory/reset'
+    '/api/memory/reset?profile=iris'
+  )
+  // Still ineligible: the managed-files routes act on host paths, not a profile home.
+  assert.equal(
+    pathWithGlobalRemoteProfile('/api/files/upload', 'iris', {
+      globalRemote: false,
+      profileRemoteOverride: false,
+      requestMethod: 'POST',
+      requestPath: '/api/files/upload'
+    }),
+    '/api/files/upload'
   )
 })
 
@@ -752,12 +762,18 @@ test('resolveProfileApiRequest scopes read-only session probes without spawning
   )
 })
 
-test('resolveProfileApiRequest keeps unscoped destructive routes on the profile backend', () => {
+test('resolveProfileApiRequest scopes destructive profile-owned routes to the shared backend', () => {
+  // These handlers used to read the process home directly, so they had to ride a
+  // per-profile backend. They now take `?profile=` and refuse an unnamed profile
+  // while several are served, so the shared primary is what reaches the right home.
   for (const [method, path] of [
     ['POST', '/api/memory/reset'],
     ['POST', '/api/curator/run'],
     ['PUT', '/api/curator/paused'],
-    ['POST', '/api/webhooks']
+    ['POST', '/api/webhooks'],
+    ['DELETE', '/api/webhooks/alerts'],
+    ['DELETE', '/api/ops/hooks'],
+    ['POST', '/api/ops/checkpoints/prune']
   ]) {
     assert.deepEqual(
       resolveProfileApiRequest('iris', path, {
@@ -765,7 +781,7 @@ test('resolveProfileApiRequest keeps unscoped destructive routes on the profile
         profileRemoteOverride: false,
         requestMethod: method
       }),
-      { backendProfile: 'iris', requestPath: path }
+      { backendProfile: null, requestPath: `${path}?profile=iris` }
     )
   }
 })
diff --git a/apps/desktop/electron/connection-config.ts b/apps/desktop/electron/connection-config.ts
index 735694264b..c91c4a8614 100644
--- a/apps/desktop/electron/connection-config.ts
+++ b/apps/desktop/electron/connection-config.ts
@@ -616,7 +616,27 @@ const LOCAL_PRIMARY_SCOPED_ROUTES = new Set([
   // backend's own shutdown, which SIGTERMs its gateway-restart child.
   'POST /api/gateway/restart',
   'POST /api/gateway/start',
-  'POST /api/gateway/stop'
+  'POST /api/gateway/stop',
+  // Profile-owned state that used to ride a per-profile backend: with one backend
+  // per host these handlers take `?profile=` and resolve the home per request.
+  // Destructive ones (memory reset, curator run, hook delete, checkpoint prune,
+  // import) REFUSE an unnamed profile while several are served, so the query is
+  // not optional here.
+  'GET /api/memory',
+  'PUT /api/memory/provider',
+  'POST /api/memory/reset',
+  'GET /api/curator',
+  'PUT /api/curator/paused',
+  'POST /api/curator/run',
+  'GET /api/logs',
+  'GET /api/portal',
+  'GET /api/hermes/update/check',
+  'POST /api/local-models/activate',
+  'GET /api/dashboard/themes',
+  'PUT /api/dashboard/theme',
+  'GET /api/dashboard/font',
+  'PUT /api/dashboard/font',
+  'GET /api/dashboard/plugins'
 ])
 
 function localPrimaryRequestScope(opts: ProfileRouteOptions): boolean | null {
@@ -669,6 +689,19 @@ function localPrimaryRequestScope(opts: ProfileRouteOptions): boolean | null {
     return false
   }
 
+  // Whole families whose every handler now takes `?profile=` and resolves the
+  // profile's home per request: webhook subscriptions (`{name}` in the path) and
+  // the /api/ops maintenance routes (doctor, backup/import, hooks, checkpoints,
+  // diagnostics). Their action spawns pass `-p <profile>` to the child, and the
+  // /api/actions poll family above already pins to this same backend.
+  if (pathname === '/api/webhooks' || pathname.startsWith('/api/webhooks/')) {
+    return true
+  }
+
+  if (pathname.startsWith('/api/ops/')) {
+    return true
+  }
+
   return null
 }
 
diff --git a/hermes_cli/web_routers/_common.py b/hermes_cli/web_routers/_common.py
index a93974894d..d85cd1dcf5 100644
--- a/hermes_cli/web_routers/_common.py
+++ b/hermes_cli/web_routers/_common.py
@@ -20,6 +20,7 @@ from hermes_cli.web_server_profiles import _profile_cli_args
 log = logging.getLogger("hermes_cli.web_server")
 
 _profile_scope = late("_profile_scope", "hermes_cli.web_server_profiles")
+_config_profile_scope = late("_config_profile_scope", "hermes_cli.web_server_profiles")
 _spawn_hermes_action = late("_spawn_hermes_action", "hermes_cli.web_server_gateway")
 # Config read-modify-write serialization for off-loop handlers (live lock —
 # LateState supports ``with``-blocks).
@@ -45,6 +46,40 @@ async def scoped_to_thread(profile: Optional[str], fn: Callable[[], Any]) -> Any
     return await asyncio.to_thread(_run)
 
 
+async def config_scoped_to_thread(profile: Optional[str], fn: Callable[[], Any]) -> Any:
+    """Run ``fn()`` inside ``_config_profile_scope(profile)`` on a worker thread —
+    home + secret scope without the process-global skills-module swap."""
+
+    def _run():
+        with _config_profile_scope(profile):
+            return fn()
+
+    return await asyncio.to_thread(_run)
+
+
+def destructive_profile(profile: Optional[str], route: str) -> Optional[str]:
+    """The profile a DESTRUCTIVE route acts on, or 400 when it is ambiguous.
+
+    One backend serves every profile, so an omitted ``profile`` on a route that
+    deletes or overwrites profile-owned data is not a default — it silently meant
+    "whichever home this process launched with". Named profile: honoured. Omitted:
+    rejected as soon as the process hosts more than one profile
+    (``is_multiplex_active()``, decided once at boot by
+    ``activate_multi_profile_hosting_eagerly``). A genuinely single-profile host has
+    nothing to confuse, so there an omitted profile keeps meaning the launch profile
+    and `curl` against a plain ``hermes serve`` is unchanged.
+    """
+    if (profile or "").strip():
+        return profile
+    from agent.secret_scope import is_multiplex_active
+    if is_multiplex_active():
+        raise HTTPException(
+            status_code=400,
+            detail=f"{route} requires an explicit profile: this backend serves several profiles, "
+                   "so an unnamed target would act on the wrong profile's data.")
+    return profile
+
+
 @contextlib.contextmanager
 def http_failure(log_msg: str, status: int, prefix: Optional[str] = None, *, detail: Optional[str] = None):
     """Map unexpected exceptions to an ``HTTPException``.
diff --git a/hermes_cli/web_routers/actions.py b/hermes_cli/web_routers/actions.py
index 7757b2366c..165364ba07 100644
--- a/hermes_cli/web_routers/actions.py
+++ b/hermes_cli/web_routers/actions.py
@@ -32,6 +32,7 @@ _spawn_gateway_restart = late("_spawn_gateway_restart")
 _spawn_hermes_action = late("_spawn_hermes_action", "hermes_cli.web_server_gateway")
 detect_install_method = late("detect_install_method", "hermes_cli.config")
 get_hermes_home = late("get_hermes_home", "hermes_cli.config")
+_config_profile_scope = late("_config_profile_scope", "hermes_cli.web_server_profiles")
 _ACTION_COMMANDS = LateState("_ACTION_COMMANDS", "hermes_cli.web_server_gateway")
 _ACTION_IDS = LateState("_ACTION_IDS", "hermes_cli.web_server_gateway")
 _ACTION_PROCS = LateState("_ACTION_PROCS", "hermes_cli.web_server_gateway")
@@ -255,7 +256,7 @@ _NON_APPLYABLE_MESSAGES = {
 
 
 @router.get("/api/hermes/update/check")
-async def check_hermes_update(force: bool = False):
+async def check_hermes_update(force: bool = False, profile: Optional[str] = None):
     """Report whether a Hermes update is available, without applying it.
 
     Returns install_method ('apt'|'git'|'docker'|'nix'|'nixos'|'unknown'),
@@ -289,7 +290,9 @@ async def check_hermes_update(force: bool = False):
         from hermes_cli.banner import check_for_updates, upstream_commits_behind
 
         if force:
-            with contextlib.suppress(OSError):
+            # The checkout is host-wide, but the 24 h cache file lives in a profile home;
+            # bust the one belonging to the profile that asked.
+            with contextlib.suppress(OSError), _config_profile_scope(profile):
                 (get_hermes_home() / ".update_check").unlink()
         behind = await asyncio.to_thread(check_for_updates)
     except Exception:
diff --git a/hermes_cli/web_routers/config_env.py b/hermes_cli/web_routers/config_env.py
index 1f8eb8b059..1caefef8c4 100644
--- a/hermes_cli/web_routers/config_env.py
+++ b/hermes_cli/web_routers/config_env.py
@@ -105,10 +105,11 @@ async def get_schema(profile: Optional[str] = None):
 
 
 @config_router.get("/api/egress/status")
-async def get_egress_status():
+async def get_egress_status(profile: Optional[str] = None):
     """Dashboard/Desktop-readable egress proxy status and remediation text."""
     from hermes_cli.proxy_cli import format_status_text
-    return {"text": format_status_text()}
+    with _config_profile_scope(profile):  # reads the profile's ``proxy:`` config block
+        return {"text": format_status_text()}
 
 
 @router.put("/api/config")
diff --git a/hermes_cli/web_routers/dashboard_ui.py b/hermes_cli/web_routers/dashboard_ui.py
index 2acbd76ce7..e5d40d08ff 100644
--- a/hermes_cli/web_routers/dashboard_ui.py
+++ b/hermes_cli/web_routers/dashboard_ui.py
@@ -7,13 +7,14 @@ Extracted from ``hermes_cli.web_server``; helpers/state that tests monkeypatch o
 import asyncio
 import logging
 from pathlib import Path
-from typing import Callable
+from typing import Callable, Optional
 
 from fastapi import APIRouter, HTTPException, Request
 from fastapi.responses import FileResponse
 
 from hermes_cli.web_deps import LateState, late
 from hermes_cli.config import cfg_get
+from hermes_cli.web_routers._common import config_scoped_to_thread
 from hermes_cli.web_server_dashboard import (
     _BUILTIN_DASHBOARD_THEMES, _discover_user_themes, _invalidate_plugins_hub_cache, _merged_plugins_hub,
 )
@@ -37,9 +38,9 @@ _config_profile_scope = late("_config_profile_scope", "hermes_cli.web_server_pro
 _CONFIG_MUTATION_LOCK = LateState("_CONFIG_MUTATION_LOCK")
 
 
-def _set_dashboard_key(key: str, value) -> None:
-    """Write ``dashboard.<key>`` to config.yaml under the config mutation lock."""
-    with _CONFIG_MUTATION_LOCK:
+def _set_dashboard_key(key: str, value, profile: Optional[str] = None) -> None:
+    """Write ``dashboard.<key>`` to the profile's config.yaml under the config mutation lock."""
+    with _config_profile_scope(profile), _CONFIG_MUTATION_LOCK:
         config = load_config()
         if "dashboard" not in config:
             config["dashboard"] = {}
@@ -48,7 +49,7 @@ def _set_dashboard_key(key: str, value) -> None:
 
 
 @router.get("/api/dashboard/themes")
-async def get_dashboard_themes():
+async def get_dashboard_themes(profile: Optional[str] = None):
     """Available themes + the active one. Built-ins ship name/label/description only
     (the frontend owns their definitions in `web/src/themes/presets.ts`); user themes
     from `~/.hermes/dashboard-themes/*.yaml` ship their normalised `definition`."""
@@ -64,13 +65,13 @@ async def get_dashboard_themes():
             seen.add(t["name"])
         return {"themes": themes, "active": active}
 
-    return await asyncio.to_thread(_run)
+    return await config_scoped_to_thread(profile, _run)
 
 
 @router.put("/api/dashboard/theme")
-async def set_dashboard_theme(body: ThemeSetBody):
+async def set_dashboard_theme(body: ThemeSetBody, profile: Optional[str] = None):
     """Set the active dashboard theme (persists to config.yaml)."""
-    await asyncio.to_thread(_set_dashboard_key, "theme", body.name)
+    await asyncio.to_thread(_set_dashboard_key, "theme", body.name, profile)
     return {"ok": True, "theme": body.name}
 
 
@@ -87,21 +88,21 @@ _FONT_CHOICES = frozenset({
 
 
 @router.get("/api/dashboard/font")
-async def get_dashboard_font():
+async def get_dashboard_font(profile: Optional[str] = None):
     """Return the active font override (``"theme"`` = use the theme's font)."""
     def _run():
         font = cfg_get(load_config(), "dashboard", "font", default=_FONT_DEFAULT_ID)
         return {"font": font if font in _FONT_CHOICES else _FONT_DEFAULT_ID}
 
-    return await asyncio.to_thread(_run)
+    return await config_scoped_to_thread(profile, _run)
 
 
 @router.put("/api/dashboard/font")
-async def set_dashboard_font(body: FontSetBody):
+async def set_dashboard_font(body: FontSetBody, profile: Optional[str] = None):
     """Set the font override (config.yaml). Unknown ids coerce to ``"theme"`` rather than
     400 so a stale client can't wedge the picker."""
     font = body.font if body.font in _FONT_CHOICES else _FONT_DEFAULT_ID
-    await asyncio.to_thread(_set_dashboard_key, "font", font)
+    await asyncio.to_thread(_set_dashboard_key, "font", font, profile)
     return {"ok": True, "font": font}
 
 
@@ -128,14 +129,14 @@ def _plugin_activated(plugin: dict, enabled_set: set, disabled_set: set) -> bool
 
 
 @router.get("/api/dashboard/plugins")
-async def get_dashboard_plugins():
+async def get_dashboard_plugins(profile: Optional[str] = None):
     """Return discovered dashboard plugins (excludes user-hidden and non-enabled ones)."""
     def _run():
         plugins = _get_dashboard_plugins()
         hidden: list = cfg_get(load_config(), "dashboard", "hidden_plugins", default=[]) or []
         return plugins, hidden, *_plugin_enable_sets()
 
-    plugins, hidden, enabled_set, disabled_set = await asyncio.to_thread(_run)
+    plugins, hidden, enabled_set, disabled_set = await config_scoped_to_thread(profile, _run)
 
     # Strip internal fields before sending to frontend.
     return [
@@ -295,13 +296,14 @@ async def put_plugin_providers(request: Request, body: _PluginProvidersPutBody):
 
 
 @router.post("/api/dashboard/plugins/{name:path}/visibility")
-async def post_plugin_visibility(request: Request, name: str, body: _PluginVisibilityBody):
+async def post_plugin_visibility(request: Request, name: str, body: _PluginVisibilityBody,
+                                 profile: Optional[str] = None):
     """Toggle a plugin's sidebar visibility (persists to config.yaml dashboard.hidden_plugins)."""
     _require_token(request)
     name = _validate_plugin_name(name)
 
     def _run():
-        with _CONFIG_MUTATION_LOCK:
+        with _config_profile_scope(profile), _CONFIG_MUTATION_LOCK:
             config = load_config()
             if "dashboard" not in config or not isinstance(config.get("dashboard"), dict):
                 config["dashboard"] = {}
diff --git a/hermes_cli/web_routers/local_models.py b/hermes_cli/web_routers/local_models.py
index 6113f04324..163b1cbc0e 100644
--- a/hermes_cli/web_routers/local_models.py
+++ b/hermes_cli/web_routers/local_models.py
@@ -30,7 +30,7 @@ from pydantic import BaseModel
 from starlette.concurrency import run_in_threadpool
 
 from hermes_cli import config as config_mod, web_deps
-from hermes_cli.web_routers._common import _CONFIG_MUTATION_LOCK
+from hermes_cli.web_routers._common import _CONFIG_MUTATION_LOCK, _config_profile_scope
 from hermes_cli.local_runtime import (
     binaries, bootstrap, catalog, context_policy, estimator, growth, hardware, hf_browse,
     load_progress, presets, supervisor,
@@ -848,7 +848,7 @@ def local_models_eject(body: ModelEjectBody):
 
 
 @router.post("/api/local-models/activate")
-async def local_models_activate(body: ModelActivateBody):
+async def local_models_activate(body: ModelActivateBody, profile: Optional[str] = None):
     """Make a downloaded model the default for new chats: a config write via the same machinery as
     /api/model/set plus making sure the server is up. NO model loading (residency v2: models load on first
     inference; an empty router costs nothing). Kept as a job for UI continuity."""
@@ -858,12 +858,16 @@ async def local_models_activate(body: ModelActivateBody):
     job = _job("model-activate", body.model_id, model_id=body.model_id)
 
     def _run():
-        _ensure_server(job, config_mod.load_config(), body.model_id,
-                       fail_detail=_SERVER_START_FAILED, skip_msg="activate rescan check skipped")
-        _step(job, "setting-default", "Making it your default")
-        _set_runtime_enabled(True)
-        _assign_default(job, body.model_id)
-        _finish(job, f"{body.model_id} is the default for new chats")
+        # The llama runtime is one host-wide process, but "my default model" is a
+        # config.yaml write — scope it to the profile the request names, inside the job
+        # thread (the contextvar override must be set where the write happens).
+        with _config_profile_scope(profile):
+            _ensure_server(job, config_mod.load_config(), body.model_id,
+                           fail_detail=_SERVER_START_FAILED, skip_msg="activate rescan check skipped")
+            _step(job, "setting-default", "Making it your default")
+            _set_runtime_enabled(True)
+            _assign_default(job, body.model_id)
+            _finish(job, f"{body.model_id} is the default for new chats")
 
     _spawn_job(job, "lr-model-activate", _run, fail_msg="model activate failed: %s")
     return {"job_id": job["job_id"]}
diff --git a/hermes_cli/web_routers/memory_providers.py b/hermes_cli/web_routers/memory_providers.py
index 1364d31a58..30ad3201bc 100644
--- a/hermes_cli/web_routers/memory_providers.py
+++ b/hermes_cli/web_routers/memory_providers.py
@@ -534,20 +534,26 @@ async def get_memory_provider_config(name: str, surface: Optional[str] = None, p
 
 
 @router.post("/api/memory/providers/{name}/setup")
-async def setup_memory_provider(name: str, body: MemoryProviderSetupRequest):
+async def setup_memory_provider(name: str, body: MemoryProviderSetupRequest,
+                                profile: Optional[str] = None):
     _require_valid_memory_provider_name(name)
-    provider = _load_memory_provider(name)
-    if provider is None and not _memory_provider_manifest(name):
-        # No discoverable plugin directory -> no manifest that could declare
-        # setup commands; refuse before the command-running path. (provider
-        # may be None with a manifest present when its pip deps aren't
-        # installed yet — that's the setup use case.)
-        raise _unknown_provider(name)
-    if provider is not None and body.values:
-        with _value_errors_as_http("Failed to persist memory provider setup values for %s", name, passthrough_http=False):
-            _write_memory_provider_config_values(name, provider, body.values)
-    _invalidate_plugins_hub_cache()
-    return _install_memory_provider_setup(name)
+
+    def _run():
+        provider = _load_memory_provider(name)
+        if provider is None and not _memory_provider_manifest(name):
+            # No discoverable plugin directory -> no manifest that could declare
+            # setup commands; refuse before the command-running path. (provider
+            # may be None with a manifest present when its pip deps aren't
+            # installed yet — that's the setup use case.)
+            raise _unknown_provider(name)
+        if provider is not None and body.values:
+            with _value_errors_as_http("Failed to persist memory provider setup values for %s", name,
+                                       passthrough_http=False):
+                _write_memory_provider_config_values(name, provider, body.values)
+        _invalidate_plugins_hub_cache()
+        return _install_memory_provider_setup(name)
+
+    return await scoped_to_thread(profile, _run)
 
 
 @router.put("/api/memory/providers/{name}/config")
diff --git a/hermes_cli/web_routers/ops.py b/hermes_cli/web_routers/ops.py
index 728bd4b4de..c935e1c719 100644
--- a/hermes_cli/web_routers/ops.py
+++ b/hermes_cli/web_routers/ops.py
@@ -29,7 +29,10 @@ from hermes_cli.web_models import (
     BackupRequest, CredentialPoolAdd, HookCreate, HookDelete, ImportRequest, MemoryProviderSelect,
     MemoryReset, PairingApprove, PairingRevoke, WebhookCreate, WebhookEnabledToggle,
 )
-from hermes_cli.web_routers._common import _CONFIG_MUTATION_LOCK, http_failure, spawn_profile_action
+from hermes_cli.web_routers._common import (
+    config_scoped_to_thread, config_write_scope, destructive_profile, http_failure,
+    spawn_profile_action,
+)
 from hermes_cli.web_routers.files import stream_upload_to_path
 
 _log = logging.getLogger("hermes_cli.web_server")
@@ -38,6 +41,7 @@ router = APIRouter()
 # Late-bound so a test's monkeypatch on the owning module wins at call time.
 _discover_memory_provider_statuses = late("_discover_memory_provider_statuses", "hermes_cli.web_server_memory")
 _gateway_subcommand = late("_gateway_subcommand", "hermes_cli.web_server_gateway")
+_config_profile_scope = late("_config_profile_scope", "hermes_cli.web_server_profiles")
 _resolve_profile_dir = late("_resolve_profile_dir", "hermes_cli.web_server_profiles")
 _spawn_hermes_action = late("_spawn_hermes_action", "hermes_cli.web_server_gateway")
 _write_platform_enabled = late("_write_platform_enabled", "hermes_cli.web_server_messaging")
@@ -46,9 +50,14 @@ load_config = late("load_config", "hermes_cli.config")
 save_config = late("save_config", "hermes_cli.config")
 
 
-def _spawn_action(argv: List[str], name: str, *, log_msg: str, prefix: str) -> dict:
-    """Spawn a dashboard-profile ``hermes <argv>`` action; spawn failure -> 500."""
-    return spawn_profile_action(None, argv, name, log_msg=log_msg, prefix=prefix)
+def _spawn_action(argv: List[str], name: str, *, log_msg: str, prefix: str,
+                  profile: Optional[str] = None) -> dict:
+    """Spawn a ``hermes -p <profile> <argv>`` action; spawn failure -> 500.
+
+    The profile reaches the child as argv (``_profile_cli_args``) — the only mechanism
+    that retargets a fresh process's import-time home bindings.
+    """
+    return spawn_profile_action(profile, argv, name, log_msg=log_msg, prefix=prefix)
 
 
 # --- Pairing: how a remote admin onboards messaging users without shell access.
@@ -143,25 +152,32 @@ def _webhook_route_summary(name: str, route: Dict[str, Any], base_url: str) -> D
 
 
 @router.get("/api/webhooks")
-async def list_webhooks():
-    import hermes_cli.webhook as wh
+async def list_webhooks(profile: Optional[str] = None):
+    def _run():
+        import hermes_cli.webhook as wh
 
-    base_url = wh._get_webhook_base_url()
-    return {
-        "enabled": wh._is_webhook_enabled(),
-        "base_url": base_url,
-        "subscriptions": [
-            _webhook_route_summary(name, route, base_url)
-            for name, route in wh._load_subscriptions().items()
-        ],
-    }
+        base_url = wh._get_webhook_base_url()
+        return {
+            "enabled": wh._is_webhook_enabled(),
+            "base_url": base_url,
+            "subscriptions": [
+                _webhook_route_summary(name, route, base_url)
+                for name, route in wh._load_subscriptions().items()
+            ],
+        }
+
+    return await config_scoped_to_thread(profile, _run)
 
 
 @router.post("/api/webhooks/enable")
-async def enable_webhooks():
+async def enable_webhooks(profile: Optional[str] = None):
+    def _run():
+        with config_write_scope(profile):
+            _write_platform_enabled("webhook", True)
+
     with http_failure("Failed to enable webhook platform from dashboard", 500, detail="Failed to enable webhook platform."):
-        _write_platform_enabled("webhook", True)
-    restart_result = _restart_gateway_after(None, what="enabling webhooks", label="Webhook enable")
+        await asyncio.to_thread(_run)
+    restart_result = _restart_gateway_after(profile, what="enabling webhooks", label="Webhook enable")
     return {
         "ok": True,
         "platform": "webhook",
@@ -172,10 +188,13 @@ async def enable_webhooks():
 
 
 @router.post("/api/webhooks")
-async def create_webhook(body: WebhookCreate):
+async def create_webhook(body: WebhookCreate, profile: Optional[str] = None):
     import hermes_cli.webhook as wh
 
-    if not wh._is_webhook_enabled():
+    def _enabled():
+        return wh._is_webhook_enabled()
+
+    if not await config_scoped_to_thread(profile, _enabled):
         raise HTTPException(
             status_code=400, detail="Webhook platform is not enabled. Enable it from the Webhooks page first.",
         )
@@ -206,17 +225,20 @@ async def create_webhook(body: WebhookCreate):
     if body.deliver_chat_id:
         route["deliver_extra"] = {"chat_id": body.deliver_chat_id}
 
-    subs = wh._load_subscriptions()
-    subs[name] = route
-    wh._save_subscriptions(subs)
+    def _save():
+        subs = wh._load_subscriptions()
+        subs[name] = route
+        wh._save_subscriptions(subs)
+        return _webhook_route_summary(name, route, wh._get_webhook_base_url())
 
-    summary = _webhook_route_summary(name, route, wh._get_webhook_base_url())
+    summary = await config_scoped_to_thread(profile, _save)
     summary["secret"] = secret  # surfaced exactly once, on create
     return summary
 
 
 def _webhook_subs_with(name: str):
-    """(module, subscriptions, key) for an existing route; 404 otherwise."""
+    """(module, subscriptions, key) for an existing route; 404 otherwise. Call inside the
+    request's profile scope — ``_load_subscriptions`` resolves the home at call time."""
     import hermes_cli.webhook as wh
 
     key = (name or "").strip().lower()
@@ -227,20 +249,29 @@ def _webhook_subs_with(name: str):
 
 
 @router.delete("/api/webhooks/{name}")
-async def delete_webhook(name: str):
-    wh, subs, key = _webhook_subs_with(name)
-    del subs[key]
-    wh._save_subscriptions(subs)
+async def delete_webhook(name: str, profile: Optional[str] = None):
+    profile = destructive_profile(profile, "DELETE /api/webhooks/{name}")
+
+    def _run():
+        wh, subs, key = _webhook_subs_with(name)
+        del subs[key]
+        wh._save_subscriptions(subs)
+
+    await config_scoped_to_thread(profile, _run)
     return {"ok": True}
 
 
 @router.put("/api/webhooks/{name}/enabled")
-async def set_webhook_enabled(name: str, body: WebhookEnabledToggle):
+async def set_webhook_enabled(name: str, body: WebhookEnabledToggle, profile: Optional[str] = None):
     """Disabled routes stay on disk (re-enable later) but the gateway rejects
     their events with 403; it hot-reloads the file, so no restart is needed."""
-    wh, subs, key = _webhook_subs_with(name)
-    subs[key]["enabled"] = bool(body.enabled)
-    wh._save_subscriptions(subs)
+    def _run():
+        wh, subs, key = _webhook_subs_with(name)
+        subs[key]["enabled"] = bool(body.enabled)
+        wh._save_subscriptions(subs)
+        return key
+
+    key = await config_scoped_to_thread(profile, _run)
     return {"ok": True, "name": key, "enabled": bool(body.enabled)}
 
 
@@ -301,7 +332,7 @@ def _pool_entry_summary(entry: Any, index: int) -> Dict[str, Any]:
 
 
 @router.get("/api/credentials/pool")
-async def list_credential_pool():
+async def list_credential_pool(profile: Optional[str] = None):
     from agent.credential_pool import load_pool
     from hermes_cli.auth import read_credential_pool
 
@@ -323,11 +354,14 @@ async def list_credential_pool():
                 })
         return {"providers": providers}
 
-    return await asyncio.to_thread(_run)
+    # A named profile reads only its own auth.json (#111724), and the store path
+    # resolves at call time — so the pool the dashboard shows is the one the
+    # requested profile's agent would actually use.
+    return await config_scoped_to_thread(profile, _run)
 
 
 @router.post("/api/credentials/pool")
-async def add_credential_pool_entry(body: CredentialPoolAdd):
+async def add_credential_pool_entry(body: CredentialPoolAdd, profile: Optional[str] = None):
     import uuid
     from agent.credential_pool import (
         AUTH_TYPE_API_KEY,
@@ -381,11 +415,11 @@ async def add_credential_pool_entry(body: CredentialPoolAdd):
             _log.exception("POST /api/credentials/pool failed")
             raise HTTPException(status_code=400, detail=str(exc)) from exc
 
-    return await asyncio.to_thread(_run)
+    return await config_scoped_to_thread(profile, _run)
 
 
 @router.delete("/api/credentials/pool/{provider}/{index}")
-async def remove_credential_pool_entry(provider: str, index: int):
+async def remove_credential_pool_entry(provider: str, index: int, profile: Optional[str] = None):
     """Remove a pool entry (``index`` is 1-based, as listed).
 
     Removal must be sticky: ``load_pool()`` re-seeds entries from their backing
@@ -433,7 +467,8 @@ async def remove_credential_pool_entry(provider: str, index: int):
                     _log.exception("suppress_credential_source failed")
         return {"ok": True, "provider": provider, "count": len(pool.entries()), "cleaned": cleaned, "hints": hints}
 
-    return await asyncio.to_thread(_run)
+    return await config_scoped_to_thread(
+        destructive_profile(profile, "DELETE /api/credentials/pool/{provider}/{index}"), _run)
 
 
 # --- Memory provider: setup is dashboard-native only via get_config_schema();
@@ -444,7 +479,7 @@ _MEMORY_FILES = (("MEMORY.md", "memory"), ("USER.md", "user"))
 
 
 @router.get("/api/memory")
-async def get_memory_status():
+async def get_memory_status(profile: Optional[str] = None):
     def _run():  # load_config(), stats and discovery are disk reads — off-loop
         cfg = load_config()
         mem = cfg.get("memory")
@@ -456,16 +491,16 @@ async def get_memory_status():
             files[key] = path.stat().st_size if path.exists() else 0
         return {"active": active, "providers": _discover_memory_provider_statuses(), "builtin_files": files}
 
-    return await asyncio.to_thread(_run)
+    return await config_scoped_to_thread(profile, _run)
 
 
 @router.put("/api/memory/provider")
-async def set_memory_provider(body: MemoryProviderSelect):
+async def set_memory_provider(body: MemoryProviderSelect, profile: Optional[str] = None):
     provider = _normalize_memory_provider_name(body.provider)
 
     def _run():
         _require_memory_provider_ready(provider)
-        with _CONFIG_MUTATION_LOCK:
+        with config_write_scope(profile):
             cfg = load_config()
             if not isinstance(cfg.get("memory"), dict):
                 cfg["memory"] = {}
@@ -477,22 +512,26 @@ async def set_memory_provider(body: MemoryProviderSelect):
 
 
 @router.post("/api/memory/reset")
-async def reset_memory(body: MemoryReset):
+async def reset_memory(body: MemoryReset, profile: Optional[str] = None):
     target = (body.target or "all").strip().lower()
     if target not in {"all", "memory", "user"}:
         raise HTTPException(status_code=400, detail="target must be all, memory, or user")
+    profile = destructive_profile(profile, "POST /api/memory/reset")
 
-    mem_dir = get_hermes_home() / "memories"
-    deleted = []
-    for fname, key in _MEMORY_FILES:
-        path = mem_dir / fname
-        if target in {"all", key} and path.exists():
-            try:
-                path.unlink()
-                deleted.append(fname)
-            except OSError as exc:
-                raise HTTPException(status_code=500, detail=f"Could not delete {fname}: {exc}")
-    return {"ok": True, "deleted": deleted}
+    def _run():
+        mem_dir = get_hermes_home() / "memories"
+        deleted = []
+        for fname, key in _MEMORY_FILES:
+            path = mem_dir / fname
+            if target in {"all", key} and path.exists():
+                try:
+                    path.unlink()
+                    deleted.append(fname)
+                except OSError as exc:
+                    raise HTTPException(status_code=500, detail=f"Could not delete {fname}: {exc}")
+        return {"ok": True, "deleted": deleted}
+
+    return await config_scoped_to_thread(profile, _run)
 
 
 # --- Operations: long-running text-output commands (doctor, audit, backup,
@@ -501,44 +540,48 @@ async def reset_memory(body: MemoryReset):
 
 
 @router.post("/api/ops/doctor")
-async def run_doctor():
-    return _spawn_action(["doctor"], "doctor", log_msg="Failed to spawn doctor", prefix="Failed to run doctor")
+async def run_doctor(profile: Optional[str] = None):
+    return _spawn_action(["doctor"], "doctor", log_msg="Failed to spawn doctor",
+                         prefix="Failed to run doctor", profile=profile)
 
 
 @router.post("/api/ops/security-audit")
-async def run_security_audit():
+async def run_security_audit(profile: Optional[str] = None):
     return _spawn_action(
         ["security", "audit"], "security-audit",
-        log_msg="Failed to spawn security audit", prefix="Failed to run security audit",
+        log_msg="Failed to spawn security audit", prefix="Failed to run security audit", profile=profile,
     )
 
 
-def _dashboard_backup_dir() -> Path:
-    return get_hermes_home() / "backups"
+def _dashboard_backup_dir(profile: Optional[str] = None) -> Path:
+    """``<profile home>/backups`` — the archive belongs to the profile it backs up."""
+    with _config_profile_scope(profile):
+        return get_hermes_home() / "backups"
 
 
 @router.post("/api/ops/backup")
-async def run_backup(body: BackupRequest):
+async def run_backup(body: BackupRequest, profile: Optional[str] = None):
     archive: Optional[Path] = None
     output = (body.output or "").strip()
     if not output:
         stamp = datetime.now().strftime("%Y-%m-%d-%H%M%S")
-        archive = _dashboard_backup_dir() / f"hermes-backup-{stamp}-{secrets.token_hex(4)}.zip"
+        archive = _dashboard_backup_dir(profile) / f"hermes-backup-{stamp}-{secrets.token_hex(4)}.zip"
         try:
             archive.parent.mkdir(parents=True, exist_ok=True)
         except OSError as exc:
             raise HTTPException(status_code=500, detail=f"Could not create backup directory: {exc}")
         output = str(archive)
-    response = _spawn_action(["backup", "-o", output], "backup", log_msg="Failed to spawn backup", prefix="Failed to run backup")
+    response = _spawn_action(["backup", "-o", output], "backup", log_msg="Failed to spawn backup",
+                             prefix="Failed to run backup", profile=profile)
     if archive is not None:
         response["archive"] = str(archive)
     return response
 
 
 @router.get("/api/ops/backup/download")
-async def download_dashboard_backup(archive: str):
+async def download_dashboard_backup(archive: str, profile: Optional[str] = None):
     try:
-        backup_dir = _dashboard_backup_dir().expanduser().resolve(strict=False)
+        backup_dir = _dashboard_backup_dir(profile).expanduser().resolve(strict=False)
         target = Path(archive).expanduser().resolve(strict=True)
     except FileNotFoundError:
         raise HTTPException(status_code=404, detail="Backup not found")
@@ -554,21 +597,23 @@ async def download_dashboard_backup(archive: str):
     )
 
 
-def _spawn_import(archive: str, force: bool) -> dict:
+def _spawn_import(archive: str, force: bool, profile: Optional[str] = None) -> dict:
     args = ["import", archive]
     if force:
         args.append("--force")
-    return _spawn_action(args, "import", log_msg="Failed to spawn import", prefix="Failed to run import")
+    return _spawn_action(args, "import", log_msg="Failed to spawn import",
+                         prefix="Failed to run import", profile=profile)
 
 
 @router.post("/api/ops/import")
-async def run_import(body: ImportRequest):
+async def run_import(body: ImportRequest, profile: Optional[str] = None):
+    profile = destructive_profile(profile, "POST /api/ops/import")
     archive = (body.archive or "").strip()
     if not archive:
         raise HTTPException(status_code=400, detail="archive path is required")
     if not os.path.isfile(archive):
         raise HTTPException(status_code=404, detail=f"Archive not found: {archive}")
-    return _spawn_import(archive, body.force)
+    return _spawn_import(archive, body.force, profile)
 
 
 def _safe_backup_upload_name(filename: str | None) -> str:
@@ -583,8 +628,10 @@ def _safe_backup_upload_name(filename: str | None) -> str:
 async def run_import_upload(
     file: UploadFile = File(...),
     force: bool = Form(False),
+    profile: Optional[str] = None,
 ):
-    staging_dir = _dashboard_backup_dir()
+    profile = destructive_profile(profile, "POST /api/ops/import-upload")
+    staging_dir = _dashboard_backup_dir(profile)
     try:
         staging_dir.mkdir(parents=True, exist_ok=True)
     except OSError as exc:
@@ -599,11 +646,11 @@ async def run_import_upload(
     if not zipfile.is_zipfile(target):
         target.unlink(missing_ok=True)
         raise HTTPException(status_code=400, detail="Uploaded archive is not a valid zip file")
-    return {**_spawn_import(str(target), force), "archive": str(target), "uploaded_bytes": total}
+    return {**_spawn_import(str(target), force, profile), "archive": str(target), "uploaded_bytes": total}
 
 
 @router.get("/api/ops/hooks")
-async def list_hooks():
+async def list_hooks(profile: Optional[str] = None):
     """Configured shell hooks with consent (allowlist) status, whether the
     script is currently executable, and the valid hook events for the form."""
     def _run():
@@ -640,7 +687,7 @@ async def list_hooks():
             })
         return {"hooks": out, "valid_events": valid_events}
 
-    return await asyncio.to_thread(_run)
+    return await config_scoped_to_thread(profile, _run)
 
 
 def _hook_body_fields(body) -> tuple[str, str]:
@@ -652,7 +699,7 @@ def _hook_body_fields(body) -> tuple[str, str]:
 
 
 @router.post("/api/ops/hooks")
-async def create_hook(body: HookCreate):
+async def create_hook(body: HookCreate, profile: Optional[str] = None):
     """Add a shell hook to config.yaml and optionally record consent.
 
     Shell hooks run arbitrary commands, so this is privileged: it writes the
@@ -669,7 +716,7 @@ async def create_hook(body: HookCreate):
         raise HTTPException(status_code=400, detail=f"Unknown event '{event}'. Valid: {', '.join(sorted(valid_hooks))}")
 
     def _run():
-        with _CONFIG_MUTATION_LOCK:
+        with config_write_scope(profile):
             cfg = load_config()
             hooks_cfg = cfg.get("hooks")
             if not isinstance(hooks_cfg, dict):
@@ -694,19 +741,20 @@ async def create_hook(body: HookCreate):
                 _log.exception("hook consent record failed")
         return {"ok": True, "event": event, "command": command, "approved": approved}
 
-    return await asyncio.to_thread(_run)
+    return await config_scoped_to_thread(profile, _run)
 
 
 @router.delete("/api/ops/hooks")
-async def delete_hook(body: HookDelete):
+async def delete_hook(body: HookDelete, profile: Optional[str] = None):
     """Remove a hook from config.yaml and revoke its consent allowlist entry."""
     from agent import shell_hooks
 
+    profile = destructive_profile(profile, "DELETE /api/ops/hooks")
     event, command = _hook_body_fields(body)
 
     def _run():
         removed = False
-        with _CONFIG_MUTATION_LOCK:
+        with config_write_scope(profile):
             cfg = load_config()
             hooks_cfg = cfg.get("hooks")
             if isinstance(hooks_cfg, dict) and isinstance(hooks_cfg.get(event), list):
@@ -726,41 +774,45 @@ async def delete_hook(body: HookDelete):
             shell_hooks.revoke(command)
         return removed
 
-    if not await asyncio.to_thread(_run):
+    if not await config_scoped_to_thread(profile, _run):
         raise HTTPException(status_code=404, detail="No matching hook found")
     return {"ok": True}
 
 
 @router.get("/api/ops/checkpoints")
-async def list_checkpoints():
+async def list_checkpoints(profile: Optional[str] = None):
     """/rollback shadow-store checkpoints (read-only): count + size per session
     so the UI can show what a prune reclaims; pruning itself is a spawned CLI
     action so the confirmation logic stays in one place."""
-    cp_dir = get_hermes_home() / "checkpoints"
-    sessions = []
-    total_bytes = 0
-    if cp_dir.is_dir():
-        with os.scandir(cp_dir) as scan:
-            children = sorted((Path(e.path) for e in scan), key=lambda p: p.name)
-        for child in children:
-            if not child.is_dir():
-                continue
-            size = count = 0
-            for f in child.rglob("*"):
-                if f.is_file():
-                    try:
-                        size += f.stat().st_size
-                        count += 1
-                    except OSError:
-                        pass
-            total_bytes += size
-            sessions.append({"session": child.name, "files": count, "bytes": size})
-    return {"sessions": sessions, "total_bytes": total_bytes}
+    def _run():
+        cp_dir = get_hermes_home() / "checkpoints"
+        sessions = []
+        total_bytes = 0
+        if cp_dir.is_dir():
+            with os.scandir(cp_dir) as scan:
+                children = sorted((Path(e.path) for e in scan), key=lambda p: p.name)
+            for child in children:
+                if not child.is_dir():
+                    continue
+                size = count = 0
+                for f in child.rglob("*"):
+                    if f.is_file():
+                        try:
+                            size += f.stat().st_size
+                            count += 1
+                        except OSError:
+                            pass
+                total_bytes += size
+                sessions.append({"session": child.name, "files": count, "bytes": size})
+        return {"sessions": sessions, "total_bytes": total_bytes}
+
+    return await config_scoped_to_thread(profile, _run)
 
 
 @router.post("/api/ops/checkpoints/prune")
-async def prune_checkpoints():
+async def prune_checkpoints(profile: Optional[str] = None):
     return _spawn_action(
         ["checkpoints", "prune"], "checkpoints-prune",
         log_msg="Failed to spawn checkpoints prune", prefix="Failed to prune checkpoints",
+        profile=destructive_profile(profile, "POST /api/ops/checkpoints/prune"),
     )
diff --git a/hermes_cli/web_routers/status.py b/hermes_cli/web_routers/status.py
index 0581514a03..0b1b75cd0f 100644
--- a/hermes_cli/web_routers/status.py
+++ b/hermes_cli/web_routers/status.py
@@ -26,7 +26,7 @@ from hermes_cli import __version__, __release_date__
 from hermes_cli.config import get_config_path, get_env_path
 from hermes_constants import get_process_hermes_home, profile_name_for_home
 from hermes_cli.web_models import CuratorPause, LearningNodeRef, LearningNodeEdit, DebugShareRequest
-from hermes_cli.web_routers._common import scoped_to_thread
+from hermes_cli.web_routers._common import config_scoped_to_thread, destructive_profile, scoped_to_thread
 from pathlib import Path
 from typing import Any, Dict, Optional
 
@@ -49,6 +49,7 @@ _ssh_runtime_intact = late("_ssh_runtime_intact")
 app = LateState("app")  # the FastAPI instance (app.state.*)
 check_config_version = late("check_config_version", "hermes_cli.config")
 get_hermes_home = late("get_hermes_home", "hermes_cli.config")
+_profile_cli_args = late("_profile_cli_args", "hermes_cli.web_server_profiles")
 get_install_id = late("get_install_id")
 get_running_pid_cached = late("get_running_pid_cached", "gateway.status")
 get_runtime_status_running_pid = late("get_runtime_status_running_pid", "gateway.status")
@@ -605,41 +606,51 @@ async def get_system_stats():
 
 
 @router.get("/api/curator")
-async def get_curator_status():
+async def get_curator_status(profile: Optional[str] = None):
     try:
         from agent import curator
     except Exception as exc:
         raise HTTPException(status_code=500, detail=f"Curator unavailable: {exc}")
-    state = _safe_call(curator, "load_state", {})
-    return {
-        "enabled": _safe_call(curator, "is_enabled", True),
-        "paused": _safe_call(curator, "is_paused", False),
-        "interval_hours": _safe_call(curator, "get_interval_hours", None),
-        "last_run_at": state.get("last_run_at"),
-        **{key: _safe_call(curator, f"get_{key}", None)
-           for key in ("min_idle_hours", "stale_after_days", "archive_after_days")}}
+
+    def _run():
+        state = _safe_call(curator, "load_state", {})
+        return {
+            "enabled": _safe_call(curator, "is_enabled", True),
+            "paused": _safe_call(curator, "is_paused", False),
+            "interval_hours": _safe_call(curator, "get_interval_hours", None),
+            "last_run_at": state.get("last_run_at"),
+            **{key: _safe_call(curator, f"get_{key}", None)
+               for key in ("min_idle_hours", "stale_after_days", "archive_after_days")}}
+
+    return await config_scoped_to_thread(profile, _run)
 
 
 @router.put("/api/curator/paused")
-async def set_curator_paused(body: CuratorPause):
+async def set_curator_paused(body: CuratorPause, profile: Optional[str] = None):
     from agent import curator
-    curator.set_paused(bool(body.paused))
+    # ``_state_file()`` is ``get_hermes_home()/skills/.curator_state`` resolved at call
+    # time, so the request's home override is what decides which profile pauses.
+    await config_scoped_to_thread(profile, lambda: curator.set_paused(bool(body.paused)))
     return {"ok": True, "paused": bool(body.paused)}
 
 
-def _spawn_action(argv: list, name: str, prefix: str) -> dict:
-    """Spawn a background ``hermes <argv>`` action; a spawn failure is ``500 "<prefix>: <exc>"``."""
+def _spawn_action(argv: list, name: str, prefix: str, profile: Optional[str] = None) -> dict:
+    """Spawn a background ``hermes -p <profile> <argv>`` action; a spawn failure is
+    ``500 "<prefix>: <exc>"``."""
     try:
-        proc = _spawn_hermes_action(argv, name)
+        proc = _spawn_hermes_action(_profile_cli_args(profile) + argv, name)
     except Exception as exc:
         raise HTTPException(status_code=500, detail=f"{prefix}: {exc}")
     return {"ok": True, "pid": proc.pid, "name": name}
 
 
 @router.post("/api/curator/run")
-async def run_curator():
-    """Trigger a curator review now (backgrounded; tail via action status)."""
-    return _spawn_action(["curator", "run"], "curator-run", "Failed to run curator")
+async def run_curator(profile: Optional[str] = None):
+    """Trigger a curator review now (backgrounded; tail via action status). The curator
+    archives and rewrites skills, so an unnamed target is refused while this backend
+    serves several profiles."""
+    return _spawn_action(["curator", "run"], "curator-run", "Failed to run curator",
+                         destructive_profile(profile, "POST /api/curator/run"))
 
 
 @router.get("/api/learning/graph")
@@ -694,10 +705,10 @@ async def update_learning_node(body: LearningNodeEdit):
 
 
 @router.get("/api/portal")
-async def get_portal_status():
+async def get_portal_status(profile: Optional[str] = None):
     # load_config() + auth/subscription snapshots are disk reads on a polled endpoint —
     # keep them off the event loop.
-    return await asyncio.to_thread(_get_portal_status_sync)
+    return await config_scoped_to_thread(profile, _get_portal_status_sync)
 
 
 def _feature_state(feat) -> str:
@@ -744,30 +755,31 @@ def _get_portal_status_sync():
 
 
 @router.post("/api/ops/prompt-size")
-async def run_prompt_size():
-    return _spawn_action(["prompt-size"], "prompt-size", "Failed")
+async def run_prompt_size(profile: Optional[str] = None):
+    return _spawn_action(["prompt-size"], "prompt-size", "Failed", profile)
 
 
 @router.post("/api/ops/dump")
-async def run_dump():
-    return _spawn_action(["dump"], "dump", "Failed")
+async def run_dump(profile: Optional[str] = None):
+    return _spawn_action(["dump"], "dump", "Failed", profile)
 
 
 @router.post("/api/ops/config-migrate")
-async def run_config_migrate():
-    return _spawn_action(["config", "migrate"], "config-migrate", "Failed")
+async def run_config_migrate(profile: Optional[str] = None):
+    return _spawn_action(["config", "migrate"], "config-migrate", "Failed", profile)
 
 
 @router.post("/api/ops/debug-share")
-async def run_debug_share_endpoint(body: DebugShareRequest | None = None):
+async def run_debug_share_endpoint(body: DebugShareRequest | None = None,
+                                   profile: Optional[str] = None):
     """Upload a redacted debug report + full logs and return the paste URLs. Synchronous,
     unlike the other diagnostics actions: the point is the shareable URLs, returned as a
     structured payload the dashboard renders as copyable links."""
     from hermes_cli.debug import build_debug_share
     req = body or DebugShareRequest()
     try:
-        result = await asyncio.to_thread(
-            build_debug_share, log_lines=max(1, min(int(req.lines), 5000)), redact=bool(req.redact))
+        result = await config_scoped_to_thread(profile, lambda: build_debug_share(
+            log_lines=max(1, min(int(req.lines), 5000)), redact=bool(req.redact)))
     except RuntimeError as exc:
         # Required summary-report upload failed (offline / paste service down).
         raise HTTPException(status_code=502, detail=f"Upload failed: {exc}")
@@ -782,12 +794,14 @@ async def run_debug_share_endpoint(body: DebugShareRequest | None = None):
 @logs_router.get("/api/logs")
 async def get_logs(
     file: str = "agent", lines: int = 100, level: Optional[str] = None,
-    component: Optional[str] = None, search: Optional[str] = None):
+    component: Optional[str] = None, search: Optional[str] = None,
+    profile: Optional[str] = None):
     from hermes_cli.logs import _read_tail, LOG_FILES
     log_name = LOG_FILES.get(file)
     if not log_name:
         raise HTTPException(status_code=400, detail=f"Unknown log file: {file}")
-    log_path = get_hermes_home() / "logs" / log_name
+    with _config_profile_scope(profile):
+        log_path = get_hermes_home() / "logs" / log_name
     if not log_path.exists():
         return {"file": file, "lines": []}
 
diff --git a/tests/hermes_cli/test_web_routers_destructive_profile_scope.py b/tests/hermes_cli/test_web_routers_destructive_profile_scope.py
new file mode 100644
index 0000000000..42130ff34f
--- /dev/null
+++ b/tests/hermes_cli/test_web_routers_destructive_profile_scope.py
@@ -0,0 +1,109 @@
+"""One backend serves every profile, so a REST handler that reads ``get_hermes_home()``
+directly mutates the LAUNCH profile's data no matter which profile the request named.
+
+These pin the two halves of the contract for the destructive routes:
+* a named profile is the one that gets wiped, and the launch profile survives;
+* an UNNAMED profile is refused (400) while several profiles are served, and still
+  means the launch profile on a genuinely single-profile host.
+"""
+import json
+
+import pytest
+import yaml
+
+import agent.secret_scope as _secret_scope
+
+
+@pytest.fixture
+def homes(tmp_path, monkeypatch, _isolate_hermes_home):
+    """Isolated launch home + one named profile, both seeded with real files."""
+    from hermes_constants import get_hermes_home
+    from hermes_cli import profiles
+
+    launch_home = get_hermes_home()
+    profiles_root = launch_home / "profiles"
+    beta = profiles_root / "worker_beta"
+    for home in (launch_home, beta):
+        (home / "memories").mkdir(parents=True, exist_ok=True)
+        (home / "memories" / "MEMORY.md").write_text(f"memory of {home.name}\n", encoding="utf-8")
+        (home / "memories" / "USER.md").write_text(f"user of {home.name}\n", encoding="utf-8")
+        (home / "webhook_subscriptions.json").write_text(
+            json.dumps({"alerts": {"secret": "s", "events": []}}), encoding="utf-8")
+        (home / "config.yaml").write_text(
+            yaml.safe_dump({"hooks": {"PreToolUse": [{"command": "/bin/true"}]}}), encoding="utf-8")
+    (beta / ".env").write_text("", encoding="utf-8")
+
+    monkeypatch.setattr(profiles, "_get_default_hermes_home", lambda: launch_home)
+    monkeypatch.setattr(profiles, "_get_profiles_root", lambda: profiles_root)
+    return {"launch": launch_home, "worker_beta": beta}
+
+
+@pytest.fixture
+def client(monkeypatch, homes):
+    try:
+        from starlette.testclient import TestClient
+    except ImportError:
+        pytest.skip("fastapi/starlette not installed")
+
+    import hermes_state
+    from hermes_cli.web_server import app, _SESSION_HEADER_NAME, _SESSION_TOKEN
+
+    monkeypatch.setattr(hermes_state, "DEFAULT_DB_PATH", homes["launch"] / "state.db")
+    c = TestClient(app)
+    c.headers[_SESSION_HEADER_NAME] = _SESSION_TOKEN
+    return c
+
+
+def _hooks(home):
+    return (yaml.safe_load((home / "config.yaml").read_text()) or {}).get("hooks") or {}
+
+
+# (call, what proves the named profile was hit, what proves the other was not)
+DESTRUCTIVE = {
+    "memory-reset": (
+        lambda c, q: c.post(f"/api/memory/reset{q}", json={"target": "all"}),
+        lambda home: not (home / "memories" / "MEMORY.md").exists(),
+    ),
+    "webhook-delete": (
+        lambda c, q: c.delete(f"/api/webhooks/alerts{q}"),
+        lambda home: "alerts" not in json.loads((home / "webhook_subscriptions.json").read_text()),
+    ),
+    "hook-delete": (
+        lambda c, q: c.request("DELETE", f"/api/ops/hooks{q}",
+                               json={"event": "PreToolUse", "command": "/bin/true"}),
+        lambda home: not _hooks(home),
+    ),
+}
+
+
+@pytest.mark.parametrize("route", sorted(DESTRUCTIVE))
+def test_destructive_route_hits_the_named_profile_only(client, homes, route):
+    call, gone = DESTRUCTIVE[route]
+    resp = call(client, "?profile=worker_beta")
+    assert resp.status_code == 200, resp.text
+    assert gone(homes["worker_beta"]), f"{route} did not act on worker_beta"
+    assert not gone(homes["launch"]), f"{route} also hit the launch profile"
+
+
+@pytest.mark.parametrize("route", sorted(DESTRUCTIVE))
+def test_destructive_route_refuses_an_unnamed_profile_while_multiplexing(
+    client, homes, monkeypatch, route
+):
+    call, gone = DESTRUCTIVE[route]
+    monkeypatch.setattr(_secret_scope, "is_multiplex_active", lambda: True)
+    resp = call(client, "")
+    assert resp.status_code == 400, resp.text
+    assert "explicit profile" in resp.json()["detail"]
+    assert not gone(homes["launch"]), f"{route} mutated the launch profile despite the 400"
+    assert not gone(homes["worker_beta"])
+
+
+def test_unnamed_profile_still_means_the_launch_profile_on_a_single_profile_host(
+    client, homes, monkeypatch
+):
+    """A plain ``hermes serve`` has nothing to confuse: `curl` with no profile is unchanged."""
+    monkeypatch.setattr(_secret_scope, "is_multiplex_active", lambda: False)
+    resp = client.post("/api/memory/reset", json={"target": "all"})
+    assert resp.status_code == 200, resp.text
+    assert not (homes["launch"] / "memories" / "MEMORY.md").exists()
+    assert (homes["worker_beta"] / "memories" / "MEMORY.md").exists()
diff --git a/web/src/lib/api.ts b/web/src/lib/api.ts
index 57440e93ee..c50810ed0a 100644
--- a/web/src/lib/api.ts
+++ b/web/src/lib/api.ts
@@ -69,9 +69,9 @@ export function getManagementProfile(): string {
 }
 
 // Endpoint families that honor ?profile= on the backend (web_server.py
-// _profile_scope or explicit per-profile DB opens). Anything else — ops,
-// cron (which has its own per-job profile params), profiles themselves — is
-// machine-global or self-scoped and must NOT be rewritten.
+// _profile_scope or explicit per-profile DB opens). Anything else — cron (which
+// has its own per-job profile params), profiles themselves — is machine-global or
+// self-scoped and must NOT be rewritten.
 const PROFILE_SCOPED_PREFIXES = [
   "/api/status",
   "/api/gateway",
@@ -97,6 +97,20 @@ const PROFILE_SCOPED_PREFIXES = [
   // consults that one — approving into the global store would grant access
   // the running gateway never sees.
   "/api/pairing",
+  // Memory files, the curator state file, webhook subscriptions, shell hooks,
+  // checkpoints, backups/imports and the dashboard's own theme/font/plugin
+  // preferences all live in a profile home. One backend now serves every
+  // profile, so the switcher's selection has to ride on the request or a reset
+  // lands on the launch profile's data.
+  "/api/memory",
+  "/api/curator",
+  "/api/webhooks",
+  "/api/ops",
+  "/api/logs",
+  "/api/portal",
+  "/api/dashboard/theme",
+  "/api/dashboard/font",
+  "/api/dashboard/plugins",
 ];
 
 function withManagementProfile(url: string): string {

From 2e497bead8fa142deeb9717a421e8c0d3e12e3d7 Mon Sep 17 00:00:00 2001
From: teknium1 <127238744+teknium1@users.noreply.github.com>
Date: Mon, 21 Sep 2026 09:26:19 -0700
Subject: [PATCH 5/9] fix(dashboard): close the indirection holes and the
 unnamed-profile 400s
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Round 2 of the REST profile-scope pass. A call-graph audit (AST over every
router plus their imported helpers, following functools.partial bindings,
closures and callbacks handed to to_thread/_spawn_job) found the writes a
signature grep cannot see, and the SPA/Desktop callers that never named a
profile at all.

Handlers that reached a config write through indirection:
* PUT /api/dashboard/plugin-providers wrote memory.provider + context.engine
  through functools.partial(_write_config_value, ...) — the SAME key
  PUT /api/memory/provider scopes — into the launch profile's config.yaml.
* POST /api/local-models/quickstart is `activate` plus a download; only
  `activate` had been scoped, so _set_runtime_enabled/_assign_default landed
  in the launch profile.
* POST /api/local-models/runtime/install regenerates launch presets under
  get_hermes_home().
* GET /api/model/recommended-default lazily PERSISTS discovered custom-provider
  models via build_models_payload -> _save_discovered_models_to_config.

Policy gaps:
* POST /api/ops/hooks is now gated like DELETE: writing an arbitrary command
  into `hooks:` and, with approve, into the consent allowlist is strictly more
  privileged than removing one.
* POST /api/sessions/prune (non-dry-run), DELETE /api/sessions/empty and
  POST /api/sessions/bulk-delete join the same destructive class.
* PUT /api/memory/provider ran its readiness check OUTSIDE the scope, so it
  judged the launch profile and could write a broken setting into another.

Callers:
* /api/credentials was missing from the SPA's PROFILE_SCOPED_PREFIXES, so the
  credential-pool delete button 400'd unconditionally; so were
  /api/dashboard/plugin-providers, /api/local-models and the model route above.
* The management scope was empty until the switcher resolved, so every
  destructive route 400'd in working UI on any host with a second profile
  directory. The backend now injects the profile it itself serves
  (__HERMES_DASHBOARD_PROFILE__) — and only when that name provably resolves
  back to its own home, so the fallback can never retarget another profile.
* authedFetch went around the scope entirely; the Desktop /api/ops callers
  (doctor, security-audit, backup, debug-share) sent no profile while Electron
  pins that family to the shared primary backend.
---
 apps/desktop/src/api/system.ts         | 16 +++++++++--
 hermes_cli/web_routers/_common.py      |  9 ++++--
 hermes_cli/web_routers/dashboard_ui.py | 12 ++++++--
 hermes_cli/web_routers/local_models.py | 27 +++++++++++-------
 hermes_cli/web_routers/models.py       |  7 +++--
 hermes_cli/web_routers/ops.py          | 11 +++++++-
 hermes_cli/web_routers/sessions.py     | 13 +++++++--
 hermes_cli/web_server_dashboard.py     |  7 +++++
 hermes_cli/web_server_profiles.py      | 22 +++++++++++++++
 web/src/lib/api.ts                     | 38 ++++++++++++++++++++++++--
 web/src/lib/profile-bootstrap.ts       | 20 +++++++++++++-
 11 files changed, 155 insertions(+), 27 deletions(-)

diff --git a/apps/desktop/src/api/system.ts b/apps/desktop/src/api/system.ts
index 3e7675eac3..47d2636f2b 100644
--- a/apps/desktop/src/api/system.ts
+++ b/apps/desktop/src/api/system.ts
@@ -241,18 +241,29 @@ export function getGhAuthStatus(refresh = false): Promise<{ available: boolean;
 // audit` / `hermes backup` / `hermes debug share` and the dashboard System
 // page). All except debug share are spawn-based background actions tailed via
 // getActionStatus().
+//
+// Every one carries the ambient profile: Electron pins the whole /api/ops
+// family to the shared primary backend (connection-config's
+// LOCAL_PRIMARY_SCOPED_ROUTES), so an unprofiled call acts on that backend's
+// LAUNCH profile — and debug share uploads a home's logs and config.
 // ---------------------------------------------------------------------------
 
 export function runDoctor(): Promise<ActionResponse> {
-  return hermesApi<ActionResponse>({ path: '/api/ops/doctor', method: 'POST', body: {} })
+  return hermesApi<ActionResponse>({ ...profileScoped(), path: '/api/ops/doctor', method: 'POST', body: {} })
 }
 
 export function runSecurityAudit(): Promise<ActionResponse> {
-  return hermesApi<ActionResponse>({ path: '/api/ops/security-audit', method: 'POST', body: {} })
+  return hermesApi<ActionResponse>({
+    ...profileScoped(),
+    path: '/api/ops/security-audit',
+    method: 'POST',
+    body: {}
+  })
 }
 
 export function runBackup(): Promise<ActionResponse & { archive?: string }> {
   return hermesApi<ActionResponse & { archive?: string }>({
+    ...profileScoped(),
     path: '/api/ops/backup',
     method: 'POST',
     body: {}
@@ -261,6 +272,7 @@ export function runBackup(): Promise<ActionResponse & { archive?: string }> {
 
 export function runDebugShare(): Promise<DebugShareResponse> {
   return hermesApi<DebugShareResponse>({
+    ...profileScoped(),
     path: '/api/ops/debug-share',
     method: 'POST',
     body: {},
diff --git a/hermes_cli/web_routers/_common.py b/hermes_cli/web_routers/_common.py
index d85cd1dcf5..2399f90e24 100644
--- a/hermes_cli/web_routers/_common.py
+++ b/hermes_cli/web_routers/_common.py
@@ -58,16 +58,19 @@ async def config_scoped_to_thread(profile: Optional[str], fn: Callable[[], Any])
 
 
 def destructive_profile(profile: Optional[str], route: str) -> Optional[str]:
-    """The profile a DESTRUCTIVE route acts on, or 400 when it is ambiguous.
+    """The profile a DESTRUCTIVE or PRIVILEGED route acts on, or 400 when it is ambiguous.
 
-    One backend serves every profile, so an omitted ``profile`` on a route that
-    deletes or overwrites profile-owned data is not a default — it silently meant
+    One backend serves every profile, so an omitted ``profile`` on a route that deletes,
+    overwrites or privileges profile-owned data is not a default — it silently meant
     "whichever home this process launched with". Named profile: honoured. Omitted:
     rejected as soon as the process hosts more than one profile
     (``is_multiplex_active()``, decided once at boot by
     ``activate_multi_profile_hosting_eagerly``). A genuinely single-profile host has
     nothing to confuse, so there an omitted profile keeps meaning the launch profile
     and `curl` against a plain ``hermes serve`` is unchanged.
+
+    "Privileged" is the same class as "destructive": arming an auto-approved shell hook
+    in the wrong profile is at least as bad as removing one from it.
     """
     if (profile or "").strip():
         return profile
diff --git a/hermes_cli/web_routers/dashboard_ui.py b/hermes_cli/web_routers/dashboard_ui.py
index e5d40d08ff..b323fbf27d 100644
--- a/hermes_cli/web_routers/dashboard_ui.py
+++ b/hermes_cli/web_routers/dashboard_ui.py
@@ -276,15 +276,23 @@ async def delete_agent_plugin(request: Request, name: str):
 
 
 @router.put("/api/dashboard/plugin-providers")
-async def put_plugin_providers(request: Request, body: _PluginProvidersPutBody):
+async def put_plugin_providers(request: Request, body: _PluginProvidersPutBody,
+                               profile: Optional[str] = None):
     """Persist memory provider / context engine selection (writes config.yaml)."""
     _require_token(request)
     from hermes_cli.plugins_cmd import _save_context_engine, _save_memory_provider
 
     def _run():
-        with _CONFIG_MUTATION_LOCK:
+        # ``_save_memory_provider``/``_save_context_engine`` are functools.partial over
+        # ``_write_config_value`` -> save_config: the write is one hop away and lands in
+        # whatever home the scope names. Unlike plugin INSTALLATION (host venv, pinned to the
+        # serving profile), these two keys are per-profile settings — `memory.provider` is the
+        # same key PUT /api/memory/provider scopes — so they follow ``?profile=``.
+        with _config_profile_scope(profile), _CONFIG_MUTATION_LOCK:
             if body.memory_provider is not None:
                 memory_provider = _normalize_memory_provider_name(body.memory_provider)
+                # Readiness resolves through load_config(); inside the scope so the answer is
+                # about the profile being written, not the launch profile.
                 _require_memory_provider_ready(memory_provider)
                 _save_memory_provider(memory_provider)
             if body.context_engine is not None:
diff --git a/hermes_cli/web_routers/local_models.py b/hermes_cli/web_routers/local_models.py
index 163b1cbc0e..bceb83bbd2 100644
--- a/hermes_cli/web_routers/local_models.py
+++ b/hermes_cli/web_routers/local_models.py
@@ -657,7 +657,7 @@ def _restart_on_new_tag(job: Dict[str, Any], tag: str, previous: list) -> bool:
 
 
 @router.post("/api/local-models/runtime/install")
-async def local_models_runtime_install(body: RuntimeInstallBody):
+async def local_models_runtime_install(body: RuntimeInstallBody, profile: Optional[str] = None):
     tag, backend = _runtime_target(body.backend)
     plan = _resolve_assets_or_400(tag, backend)
     job = _job("runtime-install", f"llama.cpp {tag} ({backend})")
@@ -665,9 +665,13 @@ async def local_models_runtime_install(body: RuntimeInstallBody):
     def _run():
         previous = binaries.installed_tags()
         _step(job, "downloading", f"Fetching {len(plan.assets)} package(s) for {backend}")
-        binaries.ensure_runtime_installed(tag, backend, progress=_runtime_progress_hook(job))
-        # Restart failure is logged only: the new build is installed either way and the next boot serves it.
-        restarted = _quiet(lambda: _restart_on_new_tag(job, tag, previous), False, warn="post-update restart skipped: %s")
+        # The engine binaries are machine-global, but ensure_local_runtime also regenerates the
+        # launch presets under get_hermes_home() — scope so those land in the named profile.
+        with _config_profile_scope(profile):
+            binaries.ensure_runtime_installed(tag, backend, progress=_runtime_progress_hook(job))
+            # Restart failure is logged only: the new build is installed either way and the next boot serves it.
+            restarted = _quiet(lambda: _restart_on_new_tag(job, tag, previous), False,
+                               warn="post-update restart skipped: %s")
         # N-1 retention, only after the new tag verified: keep it + the newest previous build as the rollback pin target.
         _quiet(lambda: binaries.prune_old_tags([tag] + [t for t in previous if t != tag][:1]), None,
                warn="runtime prune skipped: %s")
@@ -748,7 +752,7 @@ def _quickstart_target(body: QuickstartBody, budget):
 
 
 @router.post("/api/local-models/quickstart")
-async def local_models_quickstart(body: QuickstartBody):
+async def local_models_quickstart(body: QuickstartBody, profile: Optional[str] = None):
     """One job: install the runtime (if missing), download this machine's build of the recommended model (if
     missing), make it the default. Each leg uses the same code as the individual setup routes.
     Preflight rejects (no automatic recommendation or no servable choice) fail the POST
@@ -775,11 +779,14 @@ async def local_models_quickstart(body: QuickstartBody):
             job["done_bytes"] = 0
             job["total_bytes"] = download_bytes
             _run_download_plan(job, download_plan, entry.display_name)
-        # Activate: same sequence as /activate's job body.
-        _ensure_server(job, _set_runtime_enabled(True), variant.model_id,
-                       fail_detail="The local server could not start — open Local Models for details",
-                       skip_msg="quickstart rescan check skipped")
-        _assign_default(job, variant.model_id)
+        # Activate: same sequence as /activate's job body, and the same scope. Quickstart IS
+        # `activate` plus a download: _set_runtime_enabled and _assign_default both reach
+        # save_config, so without this the config.yaml write lands in the launch profile.
+        with _config_profile_scope(profile):
+            _ensure_server(job, _set_runtime_enabled(True), variant.model_id,
+                           fail_detail="The local server could not start — open Local Models for details",
+                           skip_msg="quickstart rescan check skipped")
+            _assign_default(job, variant.model_id)
         _finish(job, f"{entry.display_name} is ready — new chats use it")
 
     _spawn_job(job, "lr-quickstart", _run, fail_msg="quickstart failed: %s", on_exit=_QUICKSTART_LOCK.release)
diff --git a/hermes_cli/web_routers/models.py b/hermes_cli/web_routers/models.py
index 766e001933..e7911dfd7f 100644
--- a/hermes_cli/web_routers/models.py
+++ b/hermes_cli/web_routers/models.py
@@ -137,7 +137,7 @@ def _nous_recommended_default() -> dict:
 
 
 @router.get("/api/model/recommended-default")
-def get_recommended_default_model(provider: str = ""):
+def get_recommended_default_model(provider: str = "", profile: Optional[str] = None):
     """Recommended default model for a freshly-authenticated provider, mirroring
     ``hermes model``'s curation so GUI onboarding lands on a sensible default.
     Nous honors the user's free/paid tier. Any other provider gets the preferred
@@ -159,7 +159,10 @@ def get_recommended_default_model(provider: str = ""):
         from hermes_cli.inventory import build_models_payload, load_picker_context
         from hermes_cli.models import pick_silent_default_model
 
-        payload = build_models_payload(load_picker_context())
+        # build_models_payload -> list_authenticated_providers -> _save_discovered_models_to_config:
+        # this GET lazily PERSISTS discovered custom-provider models, so it needs the scope too.
+        with _config_profile_scope(profile):
+            payload = build_models_payload(load_picker_context())
         for row in payload.get("providers", []):
             if str(row.get("slug", "")).lower() == slug:
                 models = [str(m) for m in (row.get("models") or [])]
diff --git a/hermes_cli/web_routers/ops.py b/hermes_cli/web_routers/ops.py
index c935e1c719..838ab68027 100644
--- a/hermes_cli/web_routers/ops.py
+++ b/hermes_cli/web_routers/ops.py
@@ -499,8 +499,12 @@ async def set_memory_provider(body: MemoryProviderSelect, profile: Optional[str]
     provider = _normalize_memory_provider_name(body.provider)
 
     def _run():
-        _require_memory_provider_ready(provider)
+        # Readiness resolves through load_config()/_discover_memory_provider_statuses(), so it
+        # MUST run inside the scope: outside it a provider configured only in the target profile
+        # reads as "not ready" (refused) and one configured only in the launch profile reads as
+        # ready and gets written into the target as a broken setting.
         with config_write_scope(profile):
+            _require_memory_provider_ready(provider)
             cfg = load_config()
             if not isinstance(cfg.get("memory"), dict):
                 cfg["memory"] = {}
@@ -708,6 +712,11 @@ async def create_hook(body: HookCreate, profile: Optional[str] = None):
     """
     from agent import shell_hooks
 
+    # Creating an auto-approved shell hook is strictly more privileged than removing one:
+    # it writes an arbitrary command into `hooks:` and, with `approve`, into that profile's
+    # consent allowlist. Same rule as DELETE — an unnamed profile is refused while several
+    # are served rather than silently arming the launch profile.
+    profile = destructive_profile(profile, "POST /api/ops/hooks")
     event, command = _hook_body_fields(body)
     valid_hooks = None
     with contextlib.suppress(Exception):
diff --git a/hermes_cli/web_routers/sessions.py b/hermes_cli/web_routers/sessions.py
index a89097ee0a..0eba929e57 100644
--- a/hermes_cli/web_routers/sessions.py
+++ b/hermes_cli/web_routers/sessions.py
@@ -22,7 +22,7 @@ from hermes_cli.web_server_gateway import _strip_session_list_rows
 from hermes_cli.web_server_sessions import _maybe_auto_archive_for_profile, _session_latest_descendant
 from hermes_cli.web_models import (
     BulkDeleteSessions, SessionImport, SessionOwnerBackfill, SessionPrune, SessionRename)
-from hermes_cli.web_routers._common import log as _log, http_failure
+from hermes_cli.web_routers._common import log as _log, destructive_profile, http_failure
 from hermes_state import is_malformed_db_error
 from hermes_state_errors import is_transient_sqlite_error
 
@@ -409,8 +409,9 @@ async def bulk_delete_sessions_endpoint(body: BulkDeleteSessions):
     # Hard cap so a runaway selection can't lock the writer for long.
     if len(body.ids) > 500:
         raise HTTPException(status_code=400, detail="ids must contain at most 500 entries")
+    profile = destructive_profile(body.profile, "POST /api/sessions/bulk-delete")
     deleted = await asyncio.to_thread(
-        _with_db, body.profile, lambda db: db.delete_sessions(body.ids), read_only=False)
+        _with_db, profile, lambda db: db.delete_sessions(body.ids), read_only=False)
     return {"ok": True, "deleted": deleted}
 
 
@@ -458,7 +459,8 @@ async def delete_empty_sessions_endpoint(profile: Optional[str] = None):
     parents are orphaned, not cascade-deleted. See #95868.
     """
     deleted = await asyncio.to_thread(
-        _with_db, profile, lambda db: db.delete_empty_sessions(), read_only=False)
+        _with_db, destructive_profile(profile, "DELETE /api/sessions/empty"),
+        lambda db: db.delete_empty_sessions(), read_only=False)
     return {"ok": True, "deleted": deleted}
 
 
@@ -760,6 +762,11 @@ async def export_session_endpoint(session_id: str, profile: Optional[str] = None
 @manage_router.post("/api/sessions/prune")
 async def prune_sessions_endpoint(body: SessionPrune):
     """Delete ended sessions matching filters without blocking the event loop."""
+    if not body.dry_run:
+        # Same destructive rule as the rest of the family; a dry run deletes nothing, so it
+        # keeps working unnamed (it is the preview the confirm dialog reads).
+        body = body.model_copy(update={
+            "profile": destructive_profile(body.profile, "POST /api/sessions/prune")})
     return await asyncio.to_thread(_prune_sessions, body)
 
 
diff --git a/hermes_cli/web_server_dashboard.py b/hermes_cli/web_server_dashboard.py
index dddfd13317..8363a7d9db 100644
--- a/hermes_cli/web_server_dashboard.py
+++ b/hermes_cli/web_server_dashboard.py
@@ -156,12 +156,19 @@ def mount_spa(application: FastAPI):
         # Launcher-preselected profile (``--open-profile``): the SPA's fallback scope when the URL
         # omits ``?profile=`` (#73085). ``</`` escaped so a hostile name cannot close the script tag.
         initial_profile_js = json.dumps(str(getattr(application.state, "initial_profile", "") or "")).replace("</", "<\\/")
+        # This backend's OWN profile name (empty when it cannot be named unambiguously). The SPA
+        # falls back to it when neither the URL nor --open-profile names one, so requests carry an
+        # explicit scope from the first paint: destructive routes 400 on an unnamed profile as soon
+        # as the host serves more than one, and the switcher shows the same profile it writes.
+        from hermes_cli.web_server_profiles import serving_profile_name as _serving_profile_name
+        serving_profile_js = json.dumps(_serving_profile_name()).replace("</", "<\\/")
         bootstrap_script = (
             f"<script>{token_js}"
             f"window.__HERMES_DASHBOARD_EMBEDDED_CHAT__={chat_js};"
             f'window.__HERMES_BASE_PATH__="{prefix}";'
             f"window.__HERMES_AUTH_REQUIRED__={'true' if gated else 'false'};"
             f"window.__HERMES_INITIAL_PROFILE__={initial_profile_js};"
+            f"window.__HERMES_DASHBOARD_PROFILE__={serving_profile_js};"
             f"</script>"
         )
         if prefix:
diff --git a/hermes_cli/web_server_profiles.py b/hermes_cli/web_server_profiles.py
index 362b162ec5..fed42466a1 100644
--- a/hermes_cli/web_server_profiles.py
+++ b/hermes_cli/web_server_profiles.py
@@ -46,6 +46,28 @@ def _hermes_home_scope(path) -> Any:
         reset_hermes_home_override(token)
 
 
+def serving_profile_name() -> str:
+    """This process's OWN profile name — but only when that name provably resolves back
+    to the process home.
+
+    The dashboard SPA needs an explicit scope for requests it fires before the profile
+    switcher has resolved: a destructive route now 400s on an unnamed profile as soon as
+    the host serves more than one, and "" would otherwise mean "whichever home this
+    process launched with" anyway. Naming it is only safe if the name cannot resolve
+    ELSEWHERE, so a custom HERMES_HOME outside ``profiles/`` (``get_active_profile_name()``
+    answers ``"custom"``) returns "" and keeps the old unnamed behaviour rather than
+    risking a wrong-profile write.
+    """
+    from hermes_cli import profiles as profiles_mod
+    try:
+        name = (profiles_mod.get_active_profile_name() or "").strip()
+        if not name or name == "custom":
+            return ""
+        return name if profiles_mod.profile_matches_home(name, get_process_hermes_home()) else ""
+    except Exception:
+        return ""
+
+
 def _is_other_profile(profile: Optional[str]) -> bool:
     """True when ``profile`` names a profile other than this process's own."""
     if _is_current_profile(profile):
diff --git a/web/src/lib/api.ts b/web/src/lib/api.ts
index c50810ed0a..16fb2f0493 100644
--- a/web/src/lib/api.ts
+++ b/web/src/lib/api.ts
@@ -4,6 +4,8 @@ import {
   type ModelOptionsResult,
 } from "@hermes/shared";
 
+import { dashboardServingProfile } from "./profile-bootstrap";
+
 // The dashboard can be served either at the root of its host (e.g.
 // https://kanban.tilos.com/) or under a URL prefix when reverse-proxied
 // (e.g. https://mission-control.tilos.com/hermes/). The Python backend
@@ -64,8 +66,18 @@ export function setManagementProfile(name: string): void {
   _managementProfile = (name || "").trim();
 }
 
+/**
+ * The profile every management call targets: the switcher's selection, or —
+ * before it has resolved / on a host with no switcher interaction — the profile
+ * this backend itself serves.
+ *
+ * The fallback is not a guess: the backend injects a name only when it provably
+ * resolves back to its own home, so it names exactly the home an unnamed request
+ * already reached. Without it the dashboard sends no `?profile=` at all and every
+ * destructive route 400s as soon as the host has a second profile directory.
+ */
 export function getManagementProfile(): string {
-  return _managementProfile;
+  return _managementProfile || dashboardServingProfile();
 }
 
 // Endpoint families that honor ?profile= on the backend (web_server.py
@@ -108,18 +120,33 @@ const PROFILE_SCOPED_PREFIXES = [
   "/api/ops",
   "/api/logs",
   "/api/portal",
+  // Pool entries live in the profile's home, and DELETE /api/credentials/pool/{provider}/{index}
+  // is destructive — without this prefix the dashboard's remove button never named a profile and
+  // a multi-profile host refused it outright.
+  "/api/credentials",
+  // Not covered by "/api/dashboard/plugins": this one writes memory.provider + context.engine
+  // into the named profile's config.yaml (same key as PUT /api/memory/provider).
+  "/api/dashboard/plugin-providers",
+  // Model/runtime activation persists into config.yaml; the read routes ignore an extra param.
+  "/api/model/recommended-default",
+  "/api/local-models",
   "/api/dashboard/theme",
   "/api/dashboard/font",
   "/api/dashboard/plugins",
 ];
 
+// The dashboard's own profile when nothing else named one. The backend injects it only
+// when it provably resolves back to the serving home, so this can never retarget another
+// profile — it just says out loud what an unnamed request already meant. Without it every
+// destructive route 400s on a host that merely HAS a second profile directory.
 function withManagementProfile(url: string): string {
-  if (!_managementProfile) return url;
+  const scope = getManagementProfile();
+  if (!scope) return url;
   if (url.includes("profile=")) return url; // explicit param wins
   const path = url.split("?")[0];
   if (!PROFILE_SCOPED_PREFIXES.some((p) => path.startsWith(p))) return url;
   const sep = url.includes("?") ? "&" : "?";
-  return `${url}${sep}profile=${encodeURIComponent(_managementProfile)}`;
+  return `${url}${sep}profile=${encodeURIComponent(scope)}`;
 }
 
 export async function fetchJSON<T>(
@@ -281,6 +308,11 @@ export async function authedFetch(
   url: string,
   init?: RequestInit,
 ): Promise<Response> {
+  // Same management scope as fetchJSON: a binary endpoint under a profile-scoped
+  // family (``/api/ops/backup/download``) must read the SELECTED profile's archive,
+  // not the launch profile's, and an unprofiled back door beside a family that now
+  // 400s is exactly how the next hole gets in.
+  url = withManagementProfile(url);
   const headers = new Headers(init?.headers);
   const token = window.__HERMES_SESSION_TOKEN__;
   if (token) {
diff --git a/web/src/lib/profile-bootstrap.ts b/web/src/lib/profile-bootstrap.ts
index 8a0cb2204c..51402fb1c8 100644
--- a/web/src/lib/profile-bootstrap.ts
+++ b/web/src/lib/profile-bootstrap.ts
@@ -1,5 +1,6 @@
 declare global {
   interface Window {
+    __HERMES_DASHBOARD_PROFILE__?: string;
     __HERMES_INITIAL_PROFILE__?: string;
   }
 }
@@ -9,12 +10,29 @@ export function dashboardInitialProfile(): string {
   return window.__HERMES_INITIAL_PROFILE__ ?? "";
 }
 
+/**
+ * The profile this backend process itself serves, injected by the server and
+ * empty when it cannot be named unambiguously (custom HERMES_HOME).
+ *
+ * It is the LAST fallback for the management scope: without it the dashboard
+ * sends no `?profile=` at all, which a multi-profile host now refuses (400) on
+ * every destructive route. It is never a guess — the backend only emits a name
+ * that provably resolves back to its own home, so it targets exactly the home
+ * an unnamed request used to reach.
+ */
+export function dashboardServingProfile(): string {
+  if (typeof window === "undefined") return "";
+  return window.__HERMES_DASHBOARD_PROFILE__ ?? "";
+}
+
 export function initialProfileScope(
   searchParams: URLSearchParams,
   bootstrapProfile = dashboardInitialProfile(),
+  servingProfile = dashboardServingProfile(),
 ): string {
   const urlProfile = searchParams.get("profile");
-  return urlProfile === null ? bootstrapProfile : urlProfile;
+  if (urlProfile !== null) return urlProfile;
+  return bootstrapProfile || servingProfile;
 }
 
 export function shouldAdoptActiveProfile(

From 0ddeaf9334ff232a01612a51520a043db2cab77b Mon Sep 17 00:00:00 2001
From: teknium1 <127238744+teknium1@users.noreply.github.com>
Date: Mon, 21 Sep 2026 09:49:02 -0700
Subject: [PATCH 6/9] test: pin REST profile scoping with real multi-profile
 activation

The destructive-route file covered 3 of the 12 gated routes and faked the
gate itself (`monkeypatch` on `is_multiplex_active`), which left the boot
wiring the whole 400 branch rests on untested.

* All 12 destructive/privileged routes are parametrized through the refusal
  case, and the refusal now asserts the ABSENCE of the effect (no spawn, no
  session store opened, no file touched) instead of the detail wording.
* Multi-profile hosting is armed for real: `activate_multi_profile_hosting_eagerly()`
  (the boot probe) for the refusal cases, plus a test that a cross-profile
  request is itself the lazy activation. An autouse fixture enters each test
  single-profile and restores the process-global flag and frozen launch-env
  snapshot, so the one-way flip cannot leak into the single-profile-host test.
* New coverage for the scoping that had none: PUT /api/dashboard/plugin-providers,
  POST /api/local-models/quickstart, memory-provider readiness judged inside the
  write scope, and one invariant each for status/actions/config_env/memory_providers.
* web: ?profile= on /api/credentials, the serving-profile fallback for
  getManagementProfile/fetchJSON, authedFetch going through withManagementProfile,
  and initialProfileScope's URL > bootstrap > serving precedence.

Every new assertion was proven red against the PR's own previous head
(ac3d794) or, for the scoping introduced there, against the pre-PR base.
---
 ...t_web_routers_destructive_profile_scope.py | 432 ++++++++++++++++--
 web/src/lib/api.test.ts                       | 102 ++++-
 web/src/lib/profile-bootstrap.test.ts         |  43 +-
 3 files changed, 534 insertions(+), 43 deletions(-)

diff --git a/tests/hermes_cli/test_web_routers_destructive_profile_scope.py b/tests/hermes_cli/test_web_routers_destructive_profile_scope.py
index 42130ff34f..be301cb6eb 100644
--- a/tests/hermes_cli/test_web_routers_destructive_profile_scope.py
+++ b/tests/hermes_cli/test_web_routers_destructive_profile_scope.py
@@ -1,17 +1,47 @@
 """One backend serves every profile, so a REST handler that reads ``get_hermes_home()``
 directly mutates the LAUNCH profile's data no matter which profile the request named.
 
-These pin the two halves of the contract for the destructive routes:
-* a named profile is the one that gets wiped, and the launch profile survives;
-* an UNNAMED profile is refused (400) while several profiles are served, and still
-  means the launch profile on a genuinely single-profile host.
+These pin both halves of the contract:
+
+* a named profile is the one that gets wiped / written / spawned against, and the launch
+  profile survives untouched;
+* an UNNAMED profile is refused (400) on a destructive or privileged route while several
+  profiles are served, and still means the launch profile on a genuinely single-profile host.
+
+Multi-profile hosting is NOT faked here. ``destructive_profile`` asks
+``agent.secret_scope.is_multiplex_active()``, and that flag is only ever set by the boot
+wiring (``activate_multi_profile_hosting_eagerly``) or by the lazy backstop inside
+``_config_profile_scope``. Patching the predicate would leave exactly that wiring — the
+thing the whole 400 branch rests on — untested, so the tests drive the real path and the
+autouse fixture below puts the process-global flag back (activation is one-way per process).
 """
 import json
+import zipfile
 
 import pytest
 import yaml
 
-import agent.secret_scope as _secret_scope
+
+@pytest.fixture(autouse=True)
+def _multiplex_state_is_per_test():
+    """Multi-profile activation is a one-way PROCESS-global flip; contain it to one test.
+
+    Entered single-profile (so a leak from an earlier module cannot make an unnamed
+    request 400 by accident) and restored exactly as found, including the frozen launch
+    env snapshot activation captures.
+    """
+    import agent.secret_scope as secret_scope
+    from tui_gateway import launch_profile_policy
+
+    was_active = secret_scope.is_multiplex_active()
+    snapshot = launch_profile_policy._snapshot
+    secret_scope.set_multiplex_active(False)
+    launch_profile_policy._snapshot = None
+    try:
+        yield
+    finally:
+        secret_scope.set_multiplex_active(was_active)
+        launch_profile_policy._snapshot = snapshot
 
 
 @pytest.fixture
@@ -29,9 +59,15 @@ def homes(tmp_path, monkeypatch, _isolate_hermes_home):
         (home / "memories" / "USER.md").write_text(f"user of {home.name}\n", encoding="utf-8")
         (home / "webhook_subscriptions.json").write_text(
             json.dumps({"alerts": {"secret": "s", "events": []}}), encoding="utf-8")
-        (home / "config.yaml").write_text(
-            yaml.safe_dump({"hooks": {"PreToolUse": [{"command": "/bin/true"}]}}), encoding="utf-8")
-    (beta / ".env").write_text("", encoding="utf-8")
+        (home / "config.yaml").write_text(yaml.safe_dump({
+            "hooks": {"pre_tool_call": [{"command": "/bin/true"}]},
+            # A per-home marker every scoped READ path can be identified by.
+            "proxy": {"label": home.name},
+        }), encoding="utf-8")
+        (home / ".update_check").write_text("cached\n", encoding="utf-8")
+    # Non-empty: an empty ``.env`` is the crashed-``profile create`` shell that
+    # ``named_profile_has_servable_identity`` deliberately refuses to count as a tenant.
+    (beta / ".env").write_text("BETA=1\n", encoding="utf-8")
 
     monkeypatch.setattr(profiles, "_get_default_hermes_home", lambda: launch_home)
     monkeypatch.setattr(profiles, "_get_profiles_root", lambda: profiles_root)
@@ -54,56 +90,370 @@ def client(monkeypatch, homes):
     return c
 
 
+class _StubDB:
+    """Just enough session store for the delete/prune bodies; records nothing itself."""
+
+    def delete_sessions(self, ids):
+        return len(ids)
+
+    def delete_empty_sessions(self):
+        return 1
+
+    def count_open_prune_matches(self, **_filters):
+        return 0
+
+    def list_prune_candidates(self, **_filters):
+        return []
+
+    def prune_sessions(self, **_kwargs):
+        return 1
+
+    def close(self):
+        pass
+
+
+@pytest.fixture
+def seams(monkeypatch):
+    """Record the three off-process effects these routes have, and neutralise them.
+
+    ``spawn`` = the argv of every backgrounded ``hermes`` action, ``db`` = the profile every
+    session-store open names, ``pool_home`` = the home the credential-pool body resolves.
+    A route that reaches any of them after a 400 shows up as a non-empty list.
+    """
+    import agent.credential_pool as credential_pool
+    import agent.credential_sources as credential_sources
+    from hermes_cli import web_server_gateway, web_server_sessions
+    from hermes_cli.config import get_hermes_home
+
+    record = {"spawn": [], "db": [], "pool_home": []}
+
+    class _Proc:
+        pid = 4242
+
+    def _spawn(argv, name):
+        record["spawn"].append((name, list(argv)))
+        return _Proc()
+
+    def _open_db(profile, *, read_only):
+        record["db"].append(profile)
+        return _StubDB()
+
+    class _Pool:
+        def remove_index(self, _index):
+            record["pool_home"].append(str(get_hermes_home()))
+            return type("_Entry", (), {"source": ""})()
+
+        def entries(self):
+            return []
+
+    monkeypatch.setattr(web_server_gateway, "_spawn_hermes_action", _spawn)
+    monkeypatch.setattr(web_server_sessions, "_open_session_db_for_profile", _open_db)
+    monkeypatch.setattr(credential_pool, "load_pool", lambda _provider: _Pool())
+    monkeypatch.setattr(credential_sources, "find_removal_step", lambda *_a: None)
+    return record
+
+
+@pytest.fixture
+def multiplexed(homes):
+    """Arm the guard the way a real two-profile host does: the BOOT probe.
+
+    ``activate_multi_profile_hosting_eagerly`` enumerates this host's servable profile
+    homes and flips ``set_multiplex_active`` itself; asserting it returned True is what
+    proves the wiring — not just the flag — is what refuses the unnamed requests below.
+    """
+    from agent.secret_scope import is_multiplex_active
+    from tui_gateway.launch_profile_policy import activate_multi_profile_hosting_eagerly
+
+    assert activate_multi_profile_hosting_eagerly() is True, "boot probe did not see two homes"
+    assert is_multiplex_active()
+
+
+def _cfg(home):
+    return yaml.safe_load((home / "config.yaml").read_text()) or {}
+
+
 def _hooks(home):
-    return (yaml.safe_load((home / "config.yaml").read_text()) or {}).get("hooks") or {}
+    return _cfg(home).get("hooks") or {}
 
 
-# (call, what proves the named profile was hit, what proves the other was not)
+def _zip(tmp_path):
+    path = tmp_path / "backup.zip"
+    with zipfile.ZipFile(path, "w") as zf:
+        zf.writestr("manifest.json", "{}")
+    return path
+
+
+def _q(profile):
+    """``?profile=`` fragment, or nothing at all when the request names no profile."""
+    return f"?profile={profile}" if profile else ""
+
+
+def _body_profile(profile):
+    """The session family takes its profile in the BODY, so an unnamed request omits the key."""
+    return {"profile": profile} if profile else {}
+
+
+# Every destructive/privileged route, as a call taking (client, profile-name-or-"", tmp_path).
 DESTRUCTIVE = {
-    "memory-reset": (
-        lambda c, q: c.post(f"/api/memory/reset{q}", json={"target": "all"}),
-        lambda home: not (home / "memories" / "MEMORY.md").exists(),
-    ),
-    "webhook-delete": (
-        lambda c, q: c.delete(f"/api/webhooks/alerts{q}"),
-        lambda home: "alerts" not in json.loads((home / "webhook_subscriptions.json").read_text()),
-    ),
-    "hook-delete": (
-        lambda c, q: c.request("DELETE", f"/api/ops/hooks{q}",
-                               json={"event": "PreToolUse", "command": "/bin/true"}),
-        lambda home: not _hooks(home),
-    ),
+    "memory-reset": lambda c, p, t: c.post(f"/api/memory/reset{_q(p)}", json={"target": "all"}),
+    "webhook-delete": lambda c, p, t: c.delete(f"/api/webhooks/alerts{_q(p)}"),
+    "hook-delete": lambda c, p, t: c.request(
+        "DELETE", f"/api/ops/hooks{_q(p)}", json={"event": "pre_tool_call", "command": "/bin/true"}),
+    "hook-create": lambda c, p, t: c.post(
+        f"/api/ops/hooks{_q(p)}", json={"event": "pre_tool_call", "command": "/bin/armed"}),
+    "checkpoints-prune": lambda c, p, t: c.post(f"/api/ops/checkpoints/prune{_q(p)}"),
+    "import": lambda c, p, t: c.post(f"/api/ops/import{_q(p)}", json={"archive": str(_zip(t))}),
+    "import-upload": lambda c, p, t: c.post(
+        f"/api/ops/import-upload{_q(p)}",
+        files={"file": ("backup.zip", _zip(t).read_bytes(), "application/zip")}),
+    "credentials-pool-delete": lambda c, p, t: c.delete(f"/api/credentials/pool/anthropic/0{_q(p)}"),
+    "curator-run": lambda c, p, t: c.post(f"/api/curator/run{_q(p)}"),
+    "sessions-prune": lambda c, p, t: c.post(
+        "/api/sessions/prune", json={"dry_run": False, **_body_profile(p)}),
+    "sessions-empty": lambda c, p, t: c.delete(f"/api/sessions/empty{_q(p)}"),
+    "sessions-bulk-delete": lambda c, p, t: c.post(
+        "/api/sessions/bulk-delete", json={"ids": ["abc"], **_body_profile(p)}),
 }
 
 
-@pytest.mark.parametrize("route", sorted(DESTRUCTIVE))
-def test_destructive_route_hits_the_named_profile_only(client, homes, route):
-    call, gone = DESTRUCTIVE[route]
-    resp = call(client, "?profile=worker_beta")
-    assert resp.status_code == 200, resp.text
-    assert gone(homes["worker_beta"]), f"{route} did not act on worker_beta"
-    assert not gone(homes["launch"]), f"{route} also hit the launch profile"
-
-
 @pytest.mark.parametrize("route", sorted(DESTRUCTIVE))
 def test_destructive_route_refuses_an_unnamed_profile_while_multiplexing(
-    client, homes, monkeypatch, route
+    client, homes, seams, multiplexed, tmp_path, route
 ):
-    call, gone = DESTRUCTIVE[route]
-    monkeypatch.setattr(_secret_scope, "is_multiplex_active", lambda: True)
-    resp = call(client, "")
+    """No profile named + several served = refused, and provably nothing happened."""
+    resp = DESTRUCTIVE[route](client, "", tmp_path)
+
     assert resp.status_code == 400, resp.text
-    assert "explicit profile" in resp.json()["detail"]
-    assert not gone(homes["launch"]), f"{route} mutated the launch profile despite the 400"
-    assert not gone(homes["worker_beta"])
+    assert seams == {"spawn": [], "db": [], "pool_home": []}, f"{route} reached a backend anyway"
+    for home in homes.values():
+        assert (home / "memories" / "MEMORY.md").exists()
+        assert "alerts" in json.loads((home / "webhook_subscriptions.json").read_text())
+        assert _hooks(home) == {"pre_tool_call": [{"command": "/bin/true"}]}
+
+
+# Routes whose effect is a file inside the target home: (call, "did it happen here?").
+FILE_EFFECTS = {
+    "memory-reset": (DESTRUCTIVE["memory-reset"],
+                     lambda home: not (home / "memories" / "MEMORY.md").exists()),
+    "webhook-delete": (DESTRUCTIVE["webhook-delete"],
+                       lambda home: "alerts" not in json.loads((home / "webhook_subscriptions.json").read_text())),
+    "hook-delete": (DESTRUCTIVE["hook-delete"], lambda home: not _hooks(home)),
+    "hook-create": (DESTRUCTIVE["hook-create"],
+                    lambda home: any(e.get("command") == "/bin/armed"
+                                     for e in _hooks(home).get("pre_tool_call", []))),
+}
+
+
+@pytest.mark.parametrize("route", sorted(FILE_EFFECTS))
+def test_named_profile_is_the_only_one_touched(client, homes, seams, tmp_path, route):
+    call, happened = FILE_EFFECTS[route]
+    resp = call(client, "worker_beta", tmp_path)
+
+    assert resp.status_code == 200, resp.text
+    assert happened(homes["worker_beta"]), f"{route} did not act on worker_beta"
+    assert not happened(homes["launch"]), f"{route} also hit the launch profile"
+
+
+# Routes whose effect is a backgrounded ``hermes`` subprocess: the profile must reach its argv,
+# because nothing else in that process knows which home the request meant.
+SPAWNING = {
+    "checkpoints-prune": DESTRUCTIVE["checkpoints-prune"],
+    "curator-run": DESTRUCTIVE["curator-run"],
+    "import": DESTRUCTIVE["import"],
+}
+
+
+@pytest.mark.parametrize("route", sorted(SPAWNING))
+def test_spawned_action_carries_the_named_profile(client, homes, seams, tmp_path, route):
+    resp = SPAWNING[route](client, "worker_beta", tmp_path)
+
+    assert resp.status_code == 200, resp.text
+    assert [argv[:2] for _name, argv in seams["spawn"]] == [["-p", "worker_beta"]]
+
+
+@pytest.mark.parametrize("route", ["sessions-prune", "sessions-empty", "sessions-bulk-delete"])
+def test_session_route_opens_the_named_profiles_store(client, homes, seams, tmp_path, route):
+    resp = DESTRUCTIVE[route](client, "worker_beta", tmp_path)
+
+    assert resp.status_code == 200, resp.text
+    assert seams["db"] == ["worker_beta"]
+
+
+def test_session_prune_dry_run_still_works_unnamed_while_multiplexing(client, seams, multiplexed):
+    """A preview deletes nothing, so the confirm dialog must keep working without a profile."""
+    resp = client.post("/api/sessions/prune", json={"dry_run": True})
+
+    assert resp.status_code == 200, resp.text
+    assert resp.json()["removed"] == 0
+    assert seams["db"] == [None]
+
+
+def test_credential_pool_delete_runs_in_the_named_profiles_home(client, homes, seams):
+    resp = client.delete("/api/credentials/pool/anthropic/0?profile=worker_beta")
+
+    assert resp.status_code == 200, resp.text
+    assert seams["pool_home"] == [str(homes["worker_beta"])]
+
+
+# --- activation: the wiring the 400 branch depends on -------------------------------
+
+
+def test_a_request_for_another_profile_arms_the_guard(client, homes):
+    """The lazy backstop: the first cross-profile request is itself the activation."""
+    from agent.secret_scope import is_multiplex_active
+
+    assert not is_multiplex_active()
+    assert client.get("/api/memory?profile=worker_beta").status_code == 200
+    assert is_multiplex_active()
+
+    assert client.post("/api/memory/reset", json={"target": "all"}).status_code == 400
+    assert (homes["launch"] / "memories" / "MEMORY.md").exists()
 
 
 def test_unnamed_profile_still_means_the_launch_profile_on_a_single_profile_host(
-    client, homes, monkeypatch
+    client, homes, monkeypatch, tmp_path
 ):
     """A plain ``hermes serve`` has nothing to confuse: `curl` with no profile is unchanged."""
-    monkeypatch.setattr(_secret_scope, "is_multiplex_active", lambda: False)
+    from agent.secret_scope import is_multiplex_active
+    from hermes_cli import profiles
+    from tui_gateway.launch_profile_policy import activate_multi_profile_hosting_eagerly
+
+    empty_root = tmp_path / "no-named-profiles"
+    empty_root.mkdir()
+    monkeypatch.setattr(profiles, "_get_profiles_root", lambda: empty_root)
+    assert activate_multi_profile_hosting_eagerly() is False
+    assert not is_multiplex_active()
+
     resp = client.post("/api/memory/reset", json={"target": "all"})
+
     assert resp.status_code == 200, resp.text
     assert not (homes["launch"] / "memories" / "MEMORY.md").exists()
     assert (homes["worker_beta"] / "memories" / "MEMORY.md").exists()
+
+
+# --- config writes that are scoped but not destructive ------------------------------
+
+
+def test_plugin_providers_writes_the_named_profiles_config(client, homes):
+    resp = client.put("/api/dashboard/plugin-providers?profile=worker_beta",
+                      json={"context_engine": "compaction-v2"})
+
+    assert resp.status_code == 200, resp.text
+    assert _cfg(homes["worker_beta"]).get("context") == {"engine": "compaction-v2"}
+    assert "context" not in _cfg(homes["launch"])
+
+
+@pytest.fixture
+def readiness_only_in_beta(homes, monkeypatch):
+    """A memory provider that is ready in worker_beta and nowhere else.
+
+    Readiness resolves through ``load_config()``, so a readiness check that runs OUTSIDE the
+    request's scope answers about the launch profile: it refuses a provider the target has
+    configured, and — the dangerous direction — accepts one only the launch profile has and
+    writes it into the target as a broken setting.
+    """
+    from hermes_cli import web_server_memory
+    from hermes_cli.config import get_hermes_home
+
+    def _statuses():
+        ready = get_hermes_home().resolve() == homes["worker_beta"].resolve()
+        return [{"name": "mem0", "status": "ready" if ready else "not_configured"}]
+
+    monkeypatch.setattr(web_server_memory, "_discover_memory_provider_statuses", _statuses)
+
+
+@pytest.mark.parametrize("call", [
+    pytest.param(lambda c: c.put("/api/memory/provider?profile=worker_beta", json={"provider": "mem0"}),
+                 id="memory-provider"),
+    pytest.param(lambda c: c.put("/api/dashboard/plugin-providers?profile=worker_beta",
+                                 json={"memory_provider": "mem0"}),
+                 id="plugin-providers"),
+])
+def test_memory_provider_readiness_is_judged_in_the_profile_being_written(
+    client, homes, readiness_only_in_beta, call
+):
+    resp = call(client)
+
+    assert resp.status_code == 200, resp.text
+    assert _cfg(homes["worker_beta"])["memory"]["provider"] == "mem0"
+    assert "memory" not in _cfg(homes["launch"])
+
+
+def test_local_models_quickstart_activates_into_the_named_profile(client, homes, monkeypatch):
+    """Quickstart is ``activate`` plus a download; its config writes must follow ``?profile=``."""
+    from hermes_cli.config import get_hermes_home
+    from hermes_cli.web_routers import local_models as lm
+
+    entry = type("_Entry", (), {"id": "m1", "display_name": "M One", "min_engine": None})()
+    variant = type("_Variant", (), {"model_id": "m1-q4"})()
+    seen = []
+
+    monkeypatch.setattr(lm.hardware, "probe_budget", lambda **_kw: None)
+    monkeypatch.setattr(lm, "_quickstart_target", lambda _body, _budget: (entry, variant))
+    monkeypatch.setattr(lm, "_runtime_target", lambda *_a: ("b1", "cpu"))
+    monkeypatch.setattr(lm.binaries, "installed_tags", lambda: ["b1"])
+    monkeypatch.setattr(lm.bootstrap, "staged_model_ids", lambda: {"m1-q4"})
+    monkeypatch.setattr(lm, "_set_runtime_enabled", lambda _on: (lambda: None))
+    monkeypatch.setattr(lm, "_ensure_server", lambda *_a, **_k: None)
+    monkeypatch.setattr(lm, "_assign_default", lambda *_a: seen.append(str(get_hermes_home())))
+    # Run the job body inline; the real spawner's ``on_exit`` is what frees the quickstart lock.
+    monkeypatch.setattr(lm, "_spawn_job", lambda job, name, body, **kw: (body(), kw["on_exit"]()))
+
+    resp = client.post("/api/local-models/quickstart?profile=worker_beta", json={})
+
+    assert resp.status_code == 200, resp.text
+    assert seen == [str(homes["worker_beta"])]
+
+
+# --- the read/side-effect routes scoped in the same sweep ---------------------------
+
+
+def test_curator_pause_writes_the_named_profiles_state(client, homes):
+    resp = client.put("/api/curator/paused?profile=worker_beta", json={"paused": True})
+
+    assert resp.status_code == 200, resp.text
+    assert json.loads((homes["worker_beta"] / "skills" / ".curator_state").read_text())["paused"] is True
+    assert not (homes["launch"] / "skills" / ".curator_state").exists()
+
+
+def test_forced_update_check_busts_the_named_profiles_cache(client, homes, monkeypatch):
+    from hermes_cli import banner
+    from hermes_cli.web_routers import actions
+
+    monkeypatch.setattr(banner, "check_for_updates", lambda: 0)
+    monkeypatch.setattr(actions, "_dashboard_local_update_managed_externally", lambda: False)
+    monkeypatch.setattr(actions, "detect_install_method", lambda _root: "git")
+
+    resp = client.get("/api/hermes/update/check?force=true&profile=worker_beta")
+
+    assert resp.status_code == 200, resp.text
+    assert not (homes["worker_beta"] / ".update_check").exists()
+    assert (homes["launch"] / ".update_check").exists()
+
+
+def test_egress_status_reads_the_named_profiles_config(client, homes, monkeypatch):
+    from hermes_cli import proxy_cli
+    from hermes_cli.config import load_config
+
+    monkeypatch.setattr(proxy_cli, "format_status_text",
+                        lambda **_kw: str((load_config().get("proxy") or {}).get("label")))
+
+    resp = client.get("/api/egress/status?profile=worker_beta")
+
+    assert resp.status_code == 200, resp.text
+    assert resp.json()["text"] == "worker_beta"
+
+
+def test_memory_provider_setup_runs_in_the_named_profiles_home(client, homes, monkeypatch):
+    from hermes_cli.config import get_hermes_home
+    from hermes_cli.web_routers import memory_providers as mp
+
+    monkeypatch.setattr(mp, "_memory_provider_manifest", lambda _name: {"name": "mem0"})
+    monkeypatch.setattr(mp, "_load_memory_provider", lambda _name: None)
+    monkeypatch.setattr(mp, "_install_memory_provider_setup",
+                        lambda name: {"ok": True, "provider": name, "home": str(get_hermes_home())})
+
+    resp = client.post("/api/memory/providers/mem0/setup?profile=worker_beta", json={})
+
+    assert resp.status_code == 200, resp.text
+    assert resp.json()["home"] == str(homes["worker_beta"])
diff --git a/web/src/lib/api.test.ts b/web/src/lib/api.test.ts
index 2524cc302f..3a97b6131b 100644
--- a/web/src/lib/api.test.ts
+++ b/web/src/lib/api.test.ts
@@ -1,7 +1,13 @@
 // @vitest-environment jsdom
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
-import { api, fetchJSON, setManagementProfile } from "./api";
+import {
+  api,
+  authedFetch,
+  fetchJSON,
+  getManagementProfile,
+  setManagementProfile,
+} from "./api";
 
 const reloadMocks = vi.hoisted(() => ({
   attemptDashboardTokenReloadOnce: vi.fn(() => false),
@@ -119,6 +125,100 @@ describe("api.getModelOptions", () => {
   });
 });
 
+describe("management profile scope", () => {
+  // Every family whose routes write into a named profile's home must carry the
+  // scope; an unprofiled request 400s on a host that merely HAS a second profile.
+  it.each([
+    "/api/credentials/pool/anthropic/0",
+    "/api/dashboard/plugin-providers",
+    "/api/model/recommended-default",
+    "/api/local-models",
+    "/api/ops/restart",
+  ])("scopes %s to the selected management profile", async (path) => {
+    vi.stubGlobal("window", {});
+    const fetchMock = jsonFetchMock();
+    vi.stubGlobal("fetch", fetchMock);
+    setManagementProfile("worker");
+
+    await fetchJSON(path, { method: "POST" });
+
+    expect(fetchMock.mock.calls[0][0]).toBe(`${path}?profile=worker`);
+  });
+
+  it("leaves endpoints outside the scoped families alone", async () => {
+    vi.stubGlobal("window", {});
+    const fetchMock = jsonFetchMock();
+    vi.stubGlobal("fetch", fetchMock);
+    setManagementProfile("worker");
+
+    await fetchJSON("/api/sessions");
+
+    expect(fetchMock.mock.calls[0][0]).toBe("/api/sessions");
+  });
+
+  it("falls back to the profile this backend serves when nothing is selected", async () => {
+    vi.stubGlobal("window", { __HERMES_DASHBOARD_PROFILE__: "served" });
+    const fetchMock = jsonFetchMock();
+    vi.stubGlobal("fetch", fetchMock);
+    setManagementProfile("");
+
+    expect(getManagementProfile()).toBe("served");
+
+    await fetchJSON("/api/credentials/pool/anthropic/0", { method: "DELETE" });
+
+    expect(fetchMock.mock.calls[0][0]).toBe(
+      "/api/credentials/pool/anthropic/0?profile=served",
+    );
+  });
+
+  it("keeps the selected profile ahead of the serving profile", async () => {
+    vi.stubGlobal("window", { __HERMES_DASHBOARD_PROFILE__: "served" });
+    const fetchMock = jsonFetchMock();
+    vi.stubGlobal("fetch", fetchMock);
+    setManagementProfile("worker");
+
+    expect(getManagementProfile()).toBe("worker");
+
+    await fetchJSON("/api/credentials/pool/anthropic/0", { method: "DELETE" });
+
+    expect(fetchMock.mock.calls[0][0]).toBe(
+      "/api/credentials/pool/anthropic/0?profile=worker",
+    );
+  });
+
+  it("names no profile at all when neither a selection nor a serving profile exists", async () => {
+    vi.stubGlobal("window", {});
+    const fetchMock = jsonFetchMock();
+    vi.stubGlobal("fetch", fetchMock);
+    setManagementProfile("");
+
+    expect(getManagementProfile()).toBe("");
+
+    await fetchJSON("/api/credentials/pool/anthropic/0", { method: "DELETE" });
+
+    expect(fetchMock.mock.calls[0][0]).toBe("/api/credentials/pool/anthropic/0");
+  });
+
+  it.each([
+    ["/api/ops/backup/download", "/api/ops/backup/download?profile=worker"],
+    ["/api/ops/backup/download?full=1", "/api/ops/backup/download?full=1&profile=worker"],
+    ["/api/ops/backup/download?profile=other", "/api/ops/backup/download?profile=other"],
+    ["/api/sessions/abc/export", "/api/sessions/abc/export"],
+  ])(
+    "authedFetch resolves %s through the same management scope",
+    async (path, expected) => {
+      vi.stubGlobal("window", {});
+      const fetchMock = vi.fn<typeof fetch>(async () => new Response("binary"));
+      vi.stubGlobal("fetch", fetchMock);
+      setManagementProfile("worker");
+
+      await authedFetch(path);
+
+      expect(fetchMock.mock.calls[0][0]).toBe(expected);
+    },
+  );
+});
+
 describe("api OAuth helpers", () => {
   it("starts OAuth login in gated mode without requiring an injected session token", async () => {
     vi.stubGlobal("window", { __HERMES_AUTH_REQUIRED__: true });
diff --git a/web/src/lib/profile-bootstrap.test.ts b/web/src/lib/profile-bootstrap.test.ts
index 583af2e9f5..90d46e95db 100644
--- a/web/src/lib/profile-bootstrap.test.ts
+++ b/web/src/lib/profile-bootstrap.test.ts
@@ -1,10 +1,15 @@
-import { describe, expect, it } from "vitest";
+import { afterEach, describe, expect, it, vi } from "vitest";
 
 import {
+  dashboardServingProfile,
   initialProfileScope,
   shouldAdoptActiveProfile,
 } from "./profile-bootstrap";
 
+afterEach(() => {
+  vi.unstubAllGlobals();
+});
+
 describe("initialProfileScope", () => {
   it("inherits the dashboard bootstrap profile when the URL omits profile", () => {
     expect(initialProfileScope(new URLSearchParams("resume=session-1"), "worker_x"))
@@ -38,3 +43,39 @@ describe("initialProfileScope", () => {
     ).toBe(true);
   });
 });
+
+describe("dashboardServingProfile", () => {
+  it("names no profile when there is no window at all", () => {
+    expect(dashboardServingProfile()).toBe("");
+  });
+
+  it.each([
+    ["an injected serving profile", { __HERMES_DASHBOARD_PROFILE__: "served" }, "served"],
+    ["a window without one", {}, ""],
+  ])("reports %s", (_label, windowStub, expected) => {
+    vi.stubGlobal("window", windowStub);
+    expect(dashboardServingProfile()).toBe(expected);
+  });
+});
+
+describe("initialProfileScope precedence", () => {
+  // URL > bootstrap > serving. The serving profile is the LAST resort: it says
+  // out loud what an unnamed request already meant, so it must never override a
+  // scope the URL or the bootstrap payload already named.
+  it.each([
+    ["the URL profile outranks bootstrap and serving", "profile=url", "boot", "served", "url"],
+    ["an explicit empty URL profile still outranks both", "profile=", "boot", "served", ""],
+    ["the bootstrap profile outranks the serving profile", "resume=s1", "boot", "served", "boot"],
+    ["the serving profile is used when nothing else names one", "resume=s1", "", "served", "served"],
+    ["no scope is invented when nothing names one", "resume=s1", "", "", ""],
+  ])("%s", (_label, query, bootstrap, serving, expected) => {
+    expect(
+      initialProfileScope(new URLSearchParams(query), bootstrap, serving),
+    ).toBe(expected);
+  });
+
+  it("defaults the serving profile to the one this backend injected", () => {
+    vi.stubGlobal("window", { __HERMES_DASHBOARD_PROFILE__: "served" });
+    expect(initialProfileScope(new URLSearchParams("resume=s1"), "")).toBe("served");
+  });
+});

From 996417c385a5b0dcb15db1d1e0867d9869c7680d Mon Sep 17 00:00:00 2001
From: Gille <4317663+helix4u@users.noreply.github.com>
Date: Mon, 21 Sep 2026 10:39:10 -0600
Subject: [PATCH 7/9] fix(desktop): wake retired bots for group turns

---
 .../plugins/hermes-bots/group-test-utils.ts   | 19 ++++-
 .../plugins/hermes-bots/group-turns.test.ts   | 11 +++
 .../src/plugins/hermes-bots/group-turns.ts    | 76 +++++++++++++------
 apps/desktop/src/sdk/index.ts                 | 13 +++-
 apps/desktop/src/sdk/profile-routing.test.ts  | 17 +++++
 5 files changed, 104 insertions(+), 32 deletions(-)

diff --git a/apps/desktop/src/plugins/hermes-bots/group-test-utils.ts b/apps/desktop/src/plugins/hermes-bots/group-test-utils.ts
index f537265e3a..af3600f40c 100644
--- a/apps/desktop/src/plugins/hermes-bots/group-test-utils.ts
+++ b/apps/desktop/src/plugins/hermes-bots/group-test-utils.ts
@@ -77,6 +77,8 @@ export interface RpcCall {
   params: Record<string, unknown>
   /** Socket refcount after this request released its own lease. */
   refcountAfter: number
+  spawnPriority?: 'background' | 'foreground'
+  timeoutMs?: number
 }
 
 export interface GatewayOptions {
@@ -127,6 +129,8 @@ export interface ScriptedGateway {
   rpc: RpcCall[]
   /** Filter `rpc` by method. */
   rpcFor: (method: string) => RpcCall[]
+  /** Route retentions acquired for explicit multi-RPC member turns. */
+  retains: Array<{ spawnPriority?: 'background' | 'foreground' }>
   /** Live socket refcount — zero between turns, never zero during one. */
   refcount: () => number
   /** Sessions by stored id, so a test can pre-seed a finished transcript. */
@@ -150,6 +154,7 @@ export function createGroupGateway(options: GatewayOptions = {}): ScriptedGatewa
   const calls: PromptCall[] = []
   const attaches: AttachCall[] = []
   const rpc: RpcCall[] = []
+  const retains: Array<{ spawnPriority?: 'background' | 'foreground' }> = []
   const timeline: string[] = []
   const storage = new Map<string, unknown>()
   const uiMeta: Record<string, unknown> = {}
@@ -366,7 +371,13 @@ export function createGroupGateway(options: GatewayOptions = {}): ScriptedGatewa
     notify: vi.fn(),
     notifyError: vi.fn(),
     request: async (method: string, params: Record<string, unknown> = {}) => record(method, params),
-    requestProfile: async (_route: unknown, method: string, params: Record<string, unknown> = {}) => {
+    requestProfile: async (
+      _route: unknown,
+      method: string,
+      params: Record<string, unknown> = {},
+      timeoutMs?: number,
+      options?: { spawnPriority?: 'background' | 'foreground' }
+    ) => {
       refcount += 1
 
       try {
@@ -378,11 +389,12 @@ export function createGroupGateway(options: GatewayOptions = {}): ScriptedGatewa
           disposals += 1
         }
 
-        rpc.push({ method, params, refcountAfter: refcount })
+        rpc.push({ method, params, refcountAfter: refcount, spawnPriority: options?.spawnPriority, timeoutMs })
         timeline.push(method)
       }
     },
-    retainProfile: async () => {
+    retainProfile: async (_route: unknown, options?: { spawnPriority?: 'background' | 'foreground' }) => {
+      retains.push({ spawnPriority: options?.spawnPriority })
       timeline.push('retain')
       refcount += 1
       let released = false
@@ -417,6 +429,7 @@ export function createGroupGateway(options: GatewayOptions = {}): ScriptedGatewa
     refcount: () => refcount,
     rpc,
     rpcFor: (method: string) => rpc.filter(entry => entry.method === method),
+    retains,
     sessions,
     storage,
     timeline,
diff --git a/apps/desktop/src/plugins/hermes-bots/group-turns.test.ts b/apps/desktop/src/plugins/hermes-bots/group-turns.test.ts
index e7307366a5..edcd4223ee 100644
--- a/apps/desktop/src/plugins/hermes-bots/group-turns.test.ts
+++ b/apps/desktop/src/plugins/hermes-bots/group-turns.test.ts
@@ -380,6 +380,17 @@ describe('per-turn socket lease', () => {
     expect(reply).toBe('routed reply')
     // The retain landed before the first session-scoped RPC on the route.
     expect(room.gateway.timeline[0]).toBe('retain')
+    expect(room.gateway.retains).toEqual([{ spawnPriority: 'foreground' }])
+
+    const resumes = room.gateway.rpcFor('session.resume')
+
+    expect(resumes.length).toBeGreaterThan(0)
+
+    for (const resume of resumes) {
+      expect(resume).toMatchObject({ spawnPriority: 'foreground', timeoutMs: 180_000 })
+    }
+
+    expect(room.gateway.rpcFor('session.create')).toEqual([expect.objectContaining({ spawnPriority: 'foreground' })])
 
     // The socket was NEVER disposed mid-turn: after every per-request lease
     // released, the turn lease still held the refcount above zero.
diff --git a/apps/desktop/src/plugins/hermes-bots/group-turns.ts b/apps/desktop/src/plugins/hermes-bots/group-turns.ts
index 649facf355..362b40880a 100644
--- a/apps/desktop/src/plugins/hermes-bots/group-turns.ts
+++ b/apps/desktop/src/plugins/hermes-bots/group-turns.ts
@@ -165,6 +165,22 @@ interface GroupSessionSnapshot {
   session_key?: string
 }
 
+/** Group turns are explicit user work. A member may be cold or retired when
+ *  its round begins, and session hydration can legitimately wait behind a
+ *  remote or WSL backend. Use the same three-minute budget as Desktop's
+ *  focused session hydration instead of the generic 30-second RPC deadline. */
+const GROUP_SESSION_RESUME_OPTIONS = {
+  spawnPriority: 'foreground',
+  timeoutMs: 180_000
+} as const
+
+const GROUP_SESSION_BACKGROUND_RESUME_OPTIONS = { timeoutMs: 180_000 } as const
+const GROUP_SESSION_CREATE_OPTIONS = { spawnPriority: 'foreground' } as const
+
+function resumeGroupSession(member: GroupMember, params: Record<string, unknown>): Promise<GroupSessionSnapshot> {
+  return requestForBot<GroupSessionSnapshot>(member, 'session.resume', params, GROUP_SESSION_RESUME_OPTIONS)
+}
+
 /** The error message of a RETAINED failed turn, else null. The gateway keeps
  *  `{ status: 'error', error }` under `inflight` after a turn dies so a
  *  reconnecting client can rebuild the error bubble; it is a tombstone of
@@ -263,11 +279,11 @@ export async function ensureGroupChatSession(
       }
 
       try {
-        const res = (await requestForBot(member, 'session.resume', {
+        const res = await resumeGroupSession(member, {
           session_id: target,
           profile: member.name,
           omit_messages: true
-        })) as GroupSessionSnapshot
+        })
 
         if (!binding.isLive()) {
           return { runtime: null }
@@ -322,18 +338,23 @@ export async function ensureGroupChatSession(
       return { runtime: null }
     }
 
-    const created = (await requestForBot(member, 'session.create', {
-      profile: member.name,
-      title,
-      // Room member sessions are plumbing — always hidden from the sidebar.
-      hidden: true,
-      // Explicit contracts (PR #97008): room plumbing sessions always rebuild
-      // from the member profile's CURRENT config on resume, never a stale
-      // stored model/provider pin. Older gateways ignore the unknown params;
-      // the server's hidden + "Group: " title fallback then covers legacy.
-      room_plumbing: true,
-      follow_profile_config: true
-    })) as { session_id?: string; stored_session_id?: string }
+    const created = (await requestForBot(
+      member,
+      'session.create',
+      {
+        profile: member.name,
+        title,
+        // Room member sessions are plumbing — always hidden from the sidebar.
+        hidden: true,
+        // Explicit contracts (PR #97008): room plumbing sessions always rebuild
+        // from the member profile's CURRENT config on resume, never a stale
+        // stored model/provider pin. Older gateways ignore the unknown params;
+        // the server's hidden + "Group: " title fallback then covers legacy.
+        room_plumbing: true,
+        follow_profile_config: true
+      },
+      GROUP_SESSION_CREATE_OPTIONS
+    )) as { session_id?: string; stored_session_id?: string }
 
     if (!binding.isLive()) {
       return { runtime: null }
@@ -486,7 +507,7 @@ async function retainGroupTurnRoute(member: GroupMember): Promise<() => void> {
   }
 
   try {
-    const release = await host.retainProfile(route)
+    const release = await host.retainProfile(route, { spawnPriority: 'foreground' })
 
     return typeof release === 'function' ? release : noop
   } catch {
@@ -517,11 +538,11 @@ async function submitGroupTurnPrompt(
       throw error
     }
 
-    const res = (await requestForBot(member, 'session.resume', {
+    const res = await resumeGroupSession(member, {
       session_id: stored,
       profile: member.name,
       omit_messages: true
-    })) as GroupSessionSnapshot
+    })
 
     const fresh = res?.session_id
 
@@ -994,10 +1015,10 @@ async function pollGroupMemberTurn(context: GroupTurnPollContext): Promise<null
     let state: GroupSessionSnapshot | null = null
 
     try {
-      state = (await requestForBot(member, 'session.resume', {
+      state = await resumeGroupSession(member, {
         session_id: stored || liveRuntime,
         profile: member.name
-      })) as GroupSessionSnapshot
+      })
     } catch {
       continue
     }
@@ -1094,10 +1115,10 @@ async function prepareGroupTurnBaseline(
   const runtimeIds = new Set<string>([runtime])
 
   try {
-    const pre = (await requestForBot(member, 'session.resume', {
+    const pre = await resumeGroupSession(member, {
       session_id: stored || runtime,
       profile: member.name
-    })) as GroupSessionSnapshot
+    })
 
     snapshot = pre
     before = Array.isArray(pre?.messages) ? pre.messages.length : pre?.message_count || 0
@@ -1245,10 +1266,15 @@ export async function harvestStrandedGroupReply(group: string, member: GroupMemb
       const sessions = room.sessions || {}
       const scoped = sessions[groupSessionKey(strandedThread, member)]
       const stored = scoped || (hasThreadScopedGroupSession(sessions, memberKey) ? null : sessions[memberKey])
-      state = (await requestForBot(member, 'session.resume', {
-        session_id: stored || `Group: ${room.roomId || group} · ${strandedThread}`,
-        profile: member.name
-      })) as GroupSessionSnapshot
+      state = await requestForBot<GroupSessionSnapshot>(
+        member,
+        'session.resume',
+        {
+          session_id: stored || `Group: ${room.roomId || group} · ${strandedThread}`,
+          profile: member.name
+        },
+        GROUP_SESSION_BACKGROUND_RESUME_OPTIONS
+      )
     } catch (error: any) {
       // A session that genuinely no longer exists has nothing to harvest, and a marker that can
       // never resolve would keep the member out of every round; only unreachability keeps it.
diff --git a/apps/desktop/src/sdk/index.ts b/apps/desktop/src/sdk/index.ts
index 07947fb021..fc96d934dd 100644
--- a/apps/desktop/src/sdk/index.ts
+++ b/apps/desktop/src/sdk/index.ts
@@ -1457,17 +1457,22 @@ export const host = {
    *  a non-retained secondary socket closes at refcount 0 between calls — and
    *  the gateway reaps any runtime session that socket minted, failing the
    *  next RPC with 4001. Acquire before the first session-scoped RPC, release
-   *  (idempotent) in a `finally`. Feature-detect: older hosts lack this. */
-  retainProfile: async (route: PluginProfileRoute | string): Promise<() => void> => {
+   *  (idempotent) in a `finally`. An explicit user action can mark the retain
+   *  foreground so a retired route takes the pool's reserved interactive
+   *  slot. Feature-detect: older hosts lack this. */
+  retainProfile: async (
+    route: PluginProfileRoute | string,
+    options?: PluginProfileRequestOptions
+  ): Promise<() => void> => {
     if (typeof route !== 'string') {
       if (!route.connectionId.trim() || !route.profile.trim()) {
         throw new Error('Profile route must include connectionId and profile')
       }
 
-      return retainGatewayForAgent(route.connectionId, route.profile)
+      return retainGatewayForAgent(route.connectionId, route.profile, options)
     }
 
-    return retainGatewayForAgent(null, route.trim() || 'default')
+    return retainGatewayForAgent(null, route.trim() || 'default', options)
   },
 
   /** Read persisted sessions from a profile's owning source without dialing
diff --git a/apps/desktop/src/sdk/profile-routing.test.ts b/apps/desktop/src/sdk/profile-routing.test.ts
index 2d6b1b53a6..b29f6a6ae2 100644
--- a/apps/desktop/src/sdk/profile-routing.test.ts
+++ b/apps/desktop/src/sdk/profile-routing.test.ts
@@ -118,6 +118,7 @@ vi.mock('@/store/gateway', async () => {
       params,
       profile
     })),
+    retainGatewayForAgent: vi.fn(async () => vi.fn()),
     retireLocalProfileGateways: vi.fn()
   }
 })
@@ -138,6 +139,7 @@ const {
   openGatewayForProfile,
   requestGatewayForAgent,
   requestGatewayForProfile,
+  retainGatewayForAgent,
   retireLocalProfileGateways
 } = await import('@/store/gateway')
 
@@ -573,6 +575,21 @@ describe('connection-aware plugin host APIs', () => {
     })
   })
 
+  it('forwards foreground intent when a plugin retains a profile route', async () => {
+    const route = {
+      connectionId: 'source-a',
+      mode: 'remote' as const,
+      profile: 'remote-worker',
+      targetProfile: 'backend-worker'
+    }
+
+    await host.retainProfile(route, { spawnPriority: 'foreground' })
+
+    expect(retainGatewayForAgent).toHaveBeenCalledWith('source-a', 'remote-worker', {
+      spawnPriority: 'foreground'
+    })
+  })
+
   it('keeps the profile-only request overload as a legacy fallback', async () => {
     const result = await host.requestProfile('legacy-worker', 'profiles.list', { include_sessions: true })
 

From 58eb248d0801a8fffa9763db6344c4d29062ffa9 Mon Sep 17 00:00:00 2001
From: teknium1 <127238744+teknium1@users.noreply.github.com>
Date: Mon, 21 Sep 2026 07:26:02 -0700
Subject: [PATCH 8/9] refactor(desktop): collapse the per-profile backend pool
 onto one host backend

Multiplex-only says exactly ONE `hermes serve` runs per host and multiplexes
every profile. Desktop already ATTACHes its primary backend to a running one
(25d88ad0c44c); the backend POOL was the other producer of `hermes serve`
children -- one per profile, up to `maxBackends` (default 3) on top of the
primary.

A local profile now resolves onto the same host backend and carries its own
`profile` on the wire. The server already binds per connection-of-work rather
than per process: `session.create {profile}` stores `profile_home` on the
session and every turn re-binds it, and a sessionless RPC takes the explicit
`profile` argument (`tui_gateway/server.py::@_profile_scoped`).

- `host-backend-singleton.ts`: the pure collapse decision plus
  `assertNoSecondLocalBackend`, the single enforcement point for "never spawn
  a second backend", placed at the one site that starts a local child.
- `resolveProfileBackendRoute` case 6 (local profile, no remote) now returns
  the shared primary with `scopePath`, so REST names the profile instead of
  relying on a per-profile process HERMES_HOME.

Escape hatches unchanged: `HERMES_DESKTOP_ISOLATED_BACKEND=1` keeps a private
backend, and remote/SSH/Cloud profiles stay pooled -- a different host is out
of scope for this host's singleton.

(cherry picked from commit 13bb57327e0d168816c7b0b9141516af3891142c)
---
 .../electron/connection-config.test.ts        | 51 +++++++++---
 apps/desktop/electron/connection-config.ts    | 11 +++
 .../electron/host-backend-singleton.test.ts   | 50 +++++++++++
 .../electron/host-backend-singleton.ts        | 83 +++++++++++++++++++
 apps/desktop/electron/main.ts                 | 25 +++---
 5 files changed, 197 insertions(+), 23 deletions(-)
 create mode 100644 apps/desktop/electron/host-backend-singleton.test.ts
 create mode 100644 apps/desktop/electron/host-backend-singleton.ts

diff --git a/apps/desktop/electron/connection-config.test.ts b/apps/desktop/electron/connection-config.test.ts
index 0ccd85cb8f..fd87fef6cd 100644
--- a/apps/desktop/electron/connection-config.test.ts
+++ b/apps/desktop/electron/connection-config.test.ts
@@ -376,7 +376,7 @@ const ROUTES = [
     expected: { backend: 'pool', descriptorProfile: null, scopePath: false }
   },
   {
-    name: 'an unscoped local profile request keeps its pooled backend',
+    name: 'an unscoped local profile request shares the host backend, scoped per request',
     profile: 'coder',
     opts: {
       primaryProfile: 'default',
@@ -385,7 +385,7 @@ const ROUTES = [
       requestMethod: 'POST',
       requestPath: '/api/files/upload'
     },
-    expected: { backend: 'pool', descriptorProfile: null, scopePath: false }
+    expected: { backend: 'primary', descriptorProfile: 'coder', scopePath: true }
   },
   {
     name: 'a remote sub-profile without a local entry routes through the primary remote gateway',
@@ -436,7 +436,7 @@ const ROUTES = [
     expected: { backend: 'primary', descriptorProfile: 'coder', scopePath: true }
   },
   {
-    name: 'a local session write keeps its pooled backend',
+    name: 'a local session write shares the host backend, scoped per request',
     profile: 'coder',
     opts: {
       primaryProfile: 'default',
@@ -445,7 +445,7 @@ const ROUTES = [
       requestMethod: 'PATCH',
       requestPath: '/api/sessions/session-1'
     },
-    expected: { backend: 'pool', descriptorProfile: null, scopePath: false }
+    expected: { backend: 'primary', descriptorProfile: 'coder', scopePath: true }
   },
   {
     name: 'a profile-management request uses the primary without a query scope',
@@ -472,6 +472,17 @@ const ROUTES = [
       requestPath: '/api/config'
     },
     expected: { backend: 'pool', descriptorProfile: null, scopePath: false }
+  },
+  {
+    name: 'HERMES_DESKTOP_ISOLATED_BACKEND keeps a local profile on its own pooled backend',
+    profile: 'coder',
+    opts: {
+      primaryProfile: 'default',
+      globalRemote: false,
+      profileRemoteOverride: false,
+      isolatedBackend: true
+    },
+    expected: { backend: 'pool', descriptorProfile: null, scopePath: false }
   }
 ]
 
@@ -599,13 +610,15 @@ test('pathWithGlobalRemoteProfile does not replace an explicit profile query', (
   )
 })
 
-test('pathWithGlobalRemoteProfile skips local and per-profile remote override paths', () => {
+test('pathWithGlobalRemoteProfile scopes a shared-host local path and skips per-profile remote overrides', () => {
+  // Multiplex-only: the local profile now shares the host backend, so its
+  // path must name the profile or the request reads the launch home.
   assert.equal(
     pathWithGlobalRemoteProfile('/api/model/info', 'iris', {
       globalRemote: false,
       profileRemoteOverride: false
     }),
-    '/api/model/info'
+    '/api/model/info?profile=iris'
   )
   assert.equal(
     pathWithGlobalRemoteProfile('/api/model/info', 'iris', {
@@ -684,7 +697,7 @@ test('translateSelfProfileQuery no-ops when alias and backend profile agree or a
   assert.equal(translateSelfProfileQuery('/api/cron/jobs?profile=mara', '', 'default'), '/api/cron/jobs?profile=mara')
 })
 
-test('pathWithGlobalRemoteProfile appends local-primary profile scope only for eligible routes', () => {
+test('pathWithGlobalRemoteProfile appends the profile scope on the shared host backend', () => {
   assert.equal(
     pathWithGlobalRemoteProfile('/api/config', 'iris', {
       globalRemote: false,
@@ -713,6 +726,17 @@ test('pathWithGlobalRemoteProfile appends local-primary profile scope only for e
     }),
     '/api/files/upload'
   )
+  // The profile-management family names its target in the path and must not
+  // be self-scoped.
+  assert.equal(
+    pathWithGlobalRemoteProfile('/api/profiles/worker', 'iris', {
+      globalRemote: false,
+      profileRemoteOverride: false,
+      requestMethod: 'DELETE',
+      requestPath: '/api/profiles/worker'
+    }),
+    '/api/profiles/worker'
+  )
 })
 
 test('pathWithGlobalRemoteProfile skips empty profile/path safely', () => {
@@ -764,8 +788,9 @@ test('resolveProfileApiRequest scopes read-only session probes without spawning
 
 test('resolveProfileApiRequest scopes destructive profile-owned routes to the shared backend', () => {
   // These handlers used to read the process home directly, so they had to ride a
-  // per-profile backend. They now take `?profile=` and refuse an unnamed profile
-  // while several are served, so the shared primary is what reaches the right home.
+  // per-profile backend. No per-profile backend exists any more, and they now take
+  // `?profile=` and refuse an unnamed profile while several are served, so the
+  // query param is what reaches the right home.
   for (const [method, path] of [
     ['POST', '/api/memory/reset'],
     ['POST', '/api/curator/run'],
@@ -797,21 +822,21 @@ test('resolveProfileApiRequest uses exact method and path eligibility for mixed
     resolveProfileApiRequest('iris', '/api/skills', {
       requestMethod: 'POST'
     }),
-    { backendProfile: 'iris', requestPath: '/api/skills' }
+    { backendProfile: null, requestPath: '/api/skills?profile=iris' }
   )
   assert.deepEqual(
     resolveProfileApiRequest('iris', '/api/config/defaults', {
       requestMethod: 'GET'
     }),
-    { backendProfile: 'iris', requestPath: '/api/config/defaults' }
+    { backendProfile: null, requestPath: '/api/config/defaults?profile=iris' }
   )
   assert.deepEqual(
     resolveProfileApiRequest('iris', '/api/model/recommended-default?provider=nous', {
       requestMethod: 'GET'
     }),
     {
-      backendProfile: 'iris',
-      requestPath: '/api/model/recommended-default?provider=nous'
+      backendProfile: null,
+      requestPath: '/api/model/recommended-default?provider=nous&profile=iris'
     }
   )
 })
diff --git a/apps/desktop/electron/connection-config.ts b/apps/desktop/electron/connection-config.ts
index c91c4a8614..78e2f04fd7 100644
--- a/apps/desktop/electron/connection-config.ts
+++ b/apps/desktop/electron/connection-config.ts
@@ -35,6 +35,7 @@
 //     AT cookie. A liveness check that looked only at the AT cookie would
 //     force a needless full re-login every ~15 min — hence cookiesHaveLiveSession.
 import { readStatusCode } from './api-transport'
+import { sharesHostBackend } from './host-backend-singleton'
 
 const AT_COOKIE_VARIANTS = ['__Host-hermes_session_at', '__Secure-hermes_session_at', 'hermes_session_at']
 const RT_COOKIE_VARIANTS = ['__Host-hermes_session_rt', '__Secure-hermes_session_rt', 'hermes_session_rt']
@@ -561,6 +562,8 @@ export interface ProfileRouteOptions {
   primaryRemoteActive?: boolean
   /** A stored per-profile entry exists for this profile (local or remote). */
   ownEntry?: boolean
+  /** `HERMES_DESKTOP_ISOLATED_BACKEND=1`: opt out of the host singleton. */
+  isolatedBackend?: boolean
   requestMethod?: null | string
   requestPath?: null | string
 }
@@ -777,6 +780,14 @@ function resolveProfileBackendRoute(profile, opts: ProfileRouteOptions = {}): Pr
     }
   }
 
+  // 6. Multiplex-only: every other LOCAL profile shares the one host backend
+  //    too, carrying `?profile=` / the `profile` RPC param instead of getting
+  //    a `hermes serve` child of its own. `HERMES_DESKTOP_ISOLATED_BACKEND=1`
+  //    is the only way back to a private per-profile process.
+  if (sharesHostBackend({ isolated: opts.isolatedBackend })) {
+    return { backend: 'primary', descriptorProfile: scopedProfile, scopePath: true }
+  }
+
   return { backend: 'pool', descriptorProfile: null, scopePath: false }
 }
 
diff --git a/apps/desktop/electron/host-backend-singleton.test.ts b/apps/desktop/electron/host-backend-singleton.test.ts
new file mode 100644
index 0000000000..3883c49088
--- /dev/null
+++ b/apps/desktop/electron/host-backend-singleton.test.ts
@@ -0,0 +1,50 @@
+// Multiplex-only invariants for the Desktop backend pool: one host backend
+// serves every profile, and the local pooled-spawn path is unreachable.
+import assert from 'node:assert/strict'
+
+import { test } from 'vitest'
+
+import { resolveProfileBackendRoute } from './connection-config'
+import { assertNoSecondLocalBackend, SecondLocalBackendError, sharesHostBackend } from './host-backend-singleton'
+
+const LOCAL = { globalRemote: false, primaryProfile: 'default', profileRemoteOverride: false }
+
+test('two local profiles connecting concurrently produce ZERO additional backends, each bound to its own profile', () => {
+  // The routing decision is the whole spawn decision: `ensureBackend` spawns a
+  // pooled child if and only if the route says `pool`. Resolve both profiles
+  // the way two concurrent renderer dials would.
+  const routes = ['worker', 'venture'].map(profile => resolveProfileBackendRoute(profile, LOCAL))
+
+  assert.deepEqual(
+    routes.filter(route => route.backend === 'pool'),
+    [],
+    'a local profile must never resolve to a pooled backend of its own'
+  )
+
+  // Both land on the SAME backend and still carry distinct wire identities, so
+  // each connection's turns bind to its own home (`session.create {profile}` ->
+  // `profile_home`; sessionless RPCs take the explicit `profile` argument).
+  assert.deepEqual(
+    routes.map(route => [route.backend, route.descriptorProfile, route.scopePath]),
+    [
+      ['primary', 'worker', true],
+      ['primary', 'venture', true]
+    ]
+  )
+})
+
+test('the local pool spawn path is unreachable, and the escape hatches still reach it', () => {
+  assert.throws(() => assertNoSecondLocalBackend('worker', { isolated: false }), SecondLocalBackendError)
+
+  // HERMES_DESKTOP_ISOLATED_BACKEND=1: a private backend for this app.
+  assert.equal(sharesHostBackend({ isolated: true }), false)
+  assertNoSecondLocalBackend('worker', { isolated: true })
+  assert.equal(resolveProfileBackendRoute('worker', { ...LOCAL, isolatedBackend: true }).backend, 'pool')
+
+  // A remote/SSH backend is a DIFFERENT host: out of scope for the singleton,
+  // and its pooled descriptor never meant a local child anyway.
+  assert.equal(sharesHostBackend({ profileRemoteOverride: true }), false)
+  assert.equal(sharesHostBackend({ primaryRemoteActive: true }), false)
+  assertNoSecondLocalBackend('worker', { profileRemoteOverride: true })
+  assert.equal(resolveProfileBackendRoute('worker', { ...LOCAL, profileRemoteOverride: true }).backend, 'pool')
+})
diff --git a/apps/desktop/electron/host-backend-singleton.ts b/apps/desktop/electron/host-backend-singleton.ts
new file mode 100644
index 0000000000..1ab27f52d4
--- /dev/null
+++ b/apps/desktop/electron/host-backend-singleton.ts
@@ -0,0 +1,83 @@
+// Multiplex-only, Desktop half: ONE `hermes serve` per HOST serves every
+// profile, so a local profile never gets a backend process of its own.
+//
+// `backend-discovery.ts` + `host-backend-attach.ts` made the PRIMARY backend
+// attach to a backend the host is already running. This module removes the
+// other producer of `hermes serve` children: the per-profile backend pool.
+// Every local profile now resolves onto the same host backend and carries its
+// own `profile` on the wire — the server binds a SESSION to a profile home
+// (`session.create {profile}` -> `profile_home`) and a sessionless RPC to the
+// explicit `profile` argument (`tui_gateway/server.py::@_profile_scoped`), so
+// one process genuinely serves N homes.
+//
+// Two things are deliberately NOT collapsed:
+//   * `HERMES_DESKTOP_ISOLATED_BACKEND=1` — the escape hatch that gives this
+//     app a private backend instead of the host's.
+//   * Remote / SSH / Cloud backends — a DIFFERENT host. Its ownership proof
+//     (`remote-lifecycle.ts` isolated_count === 1) is about that machine's
+//     process, not ours, and stays pooled.
+//
+// Pure and dependency-injected so the decision tests without Electron.
+
+/** Everything the collapse decision needs about one profile's routing. */
+export interface HostBackendCollapseOptions {
+  /** `HERMES_DESKTOP_ISOLATED_BACKEND=1`: this app wants its own backend. */
+  isolated?: boolean
+  /** This profile points at its own remote host (connection.json / SSH). */
+  profileRemoteOverride?: boolean
+  /** The primary profile's backend is itself a remote host. */
+  primaryRemoteActive?: boolean
+}
+
+/**
+ * True when a LOCAL profile shares the one host backend instead of spawning
+ * its own. False keeps the legacy pooled descriptor — which, for a remote
+ * route, never meant a local child in the first place.
+ */
+export function sharesHostBackend(opts: HostBackendCollapseOptions = {}): boolean {
+  if (opts.isolated) {
+    return false
+  }
+
+  return !opts.profileRemoteOverride && !opts.primaryRemoteActive
+}
+
+/** Raised when something still tries to start a second local backend. */
+export class SecondLocalBackendError extends Error {
+  readonly poolKey: string
+
+  constructor(poolKey: string) {
+    super(
+      `Refusing to start a second local Hermes backend for "${poolKey}": one backend serves every profile on this host. ` +
+        'Set HERMES_DESKTOP_ISOLATED_BACKEND=1 for a private backend.'
+    )
+    this.name = 'SecondLocalBackendError'
+    this.poolKey = poolKey
+  }
+}
+
+/**
+ * The single enforcement point for "never spawn a second backend".
+ *
+ * Routing is what normally prevents a pooled local spawn; this guard sits at
+ * the one place a local `hermes serve` child is actually started, so a future
+ * caller that reaches it through a path routing does not cover fails loudly
+ * instead of quietly reintroducing a process per profile.
+ */
+export function assertNoSecondLocalBackend(poolKey: string, opts: HostBackendCollapseOptions = {}): void {
+  if (sharesHostBackend(opts)) {
+    throw new SecondLocalBackendError(poolKey)
+  }
+}
+
+/**
+ * A passive read (background tile reconcile, #103375) may only be served by a
+ * backend that already exists: it never cold-starts a child and never
+ * refreshes `lastActiveAt`, so an open-but-unviewed tile cannot keep the pool
+ * saturated. Callers treat the rejection as "nothing to refresh yet".
+ */
+export function assertNotPassiveSpawn(passive: boolean, poolKey: string): void {
+  if (passive) {
+    throw new Error(`Passive read: no warm backend for "${poolKey}"`)
+  }
+}
diff --git a/apps/desktop/electron/main.ts b/apps/desktop/electron/main.ts
index 037e7deb56..6b69650512 100644
--- a/apps/desktop/electron/main.ts
+++ b/apps/desktop/electron/main.ts
@@ -261,6 +261,7 @@ import {
   spawnLedgerPath,
   type SpawnReservation
 } from './host-backend-attach'
+import { assertNoSecondLocalBackend, assertNotPassiveSpawn } from './host-backend-singleton'
 import { requestHudClose } from './hud-close'
 import { cursorPointInWindow } from './hud-cursor'
 import { startHudGameOverlayWatch } from './hud-game-overlay'
@@ -1667,16 +1668,9 @@ function promotePoolEntry(entry: any): void {
   entry.localBackendSpawnRequest?.promote?.('foreground')
 }
 
-// A passive read (background tile reconcile, #103375) may only be served by a
-// backend that already exists: it never cold-starts a pooled child, never
-// takes a slot, and never refreshes lastActiveAt, so an open-but-unviewed tile
-// cannot keep the pool saturated. Callers treat the rejection as "nothing to
-// refresh yet"; primary-routed profiles are always warm and never reach here.
-function assertNotPassiveSpawn(passive: boolean, poolKey: string): void {
-  if (passive) {
-    throw new Error(`Passive read: no warm backend for "${poolKey}"`)
-  }
-}
+// A passive read may only be served by a backend that already exists; the
+// guard itself lives in host-backend-singleton.ts next to the singleton
+// enforcement point (see assertNoSecondLocalBackend).
 
 // Land a spawn failure in desktop.log. Background slot waits back off per
 // profile under a saturated pool, so a roster refresh cannot create a retry
@@ -11418,6 +11412,7 @@ function profileRouteOptions(profile, request?) {
     // A stored per-profile entry (local or remote) — pins this profile to
     // its own backend; absent entries inherit the primary's remote.
     ownEntry: Boolean((config.profiles || {})[key]),
+    isolatedBackend: ISOLATED_BACKEND,
     requestMethod: request?.method,
     requestPath: request?.path
   }
@@ -12545,6 +12540,16 @@ async function runPoolBackendStart(profile, entry, opts: { forceLocal?: boolean;
     }
   }
 
+  // Everything below starts a LOCAL `hermes serve` child. Multiplex-only says
+  // the host has exactly one, and routing (resolveProfileBackendRoute case 6)
+  // keeps local profiles off this path — this is the backstop that makes the
+  // pool spawn path genuinely unreachable rather than merely unused.
+  assertNoSecondLocalBackend(poolKey, {
+    isolated: ISOLATED_BACKEND,
+    primaryRemoteActive: primaryBackendIsRemote(),
+    profileRemoteOverride: opts.forceLocal ? false : Boolean(profileRemoteOverride(readDesktopConnectionConfig(), profile))
+  })
+
   // Bound the slot wait BELOW the renderer's backend-boot budget (45s): once
   // the renderer has given up on this spawn, a ticket still queued for the
   // pool-idle window (10 min) would hold the pool key hostage and every

From 25c74f731cb6a7c2a6622abfdf3997f60a271686 Mon Sep 17 00:00:00 2001
From: teknium1 <127238744+teknium1@users.noreply.github.com>
Date: Mon, 21 Sep 2026 08:32:32 -0700
Subject: [PATCH 9/9] fix(desktop): unscopable mutations keep a process-scoped
 backend; stamp shared-primary event provenance
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Review round 2 on the host-backend collapse. Two defects the collapse
introduced, both fixed on top of #118275's server-side `profile` plumbing
(which this PR now requires: it must merge first).

1. The collapse ate the invariant "a route the server cannot profile-scope
   must keep a process-scoped backend". Routing case 6 sent EVERY local
   request at the shared primary, so a mutating handler that reads no
   `profile` executed against the primary's HERMES_HOME. Restored as a
   mechanical gate, not a route list: `unscopableMutatingRequest()` is true
   only when the method is unsafe AND `localPrimaryRequestScope()` returns
   null, and `sharesHostBackend()` refuses to collapse that request. The day
   a handler learns `profile`, it joins the scoped table and the gate stops
   seeing it.

   `ensureBackend()` now re-resolves with the ORIGINATING request, so its own
   route decision matches the caller's `resolveProfileApiRequest` one instead
   of silently collapsing a request routing deliberately kept pooled, and the
   spawn guard is told when a pooled spawn is the legitimate outcome.

   After #118275 the residual unscopable-mutating set is the host-path
   families (`POST /api/files/upload`, `DELETE /api/files/managed`) plus any
   unlisted mutating method (`POST /api/skills`). Session writes are scopable
   by `body.profile`, so they share the backend with their path left alone.

2. Events from non-primary local profiles arrived unowned. `sharedPrimaryRoute`
   returns the primary gateway without `createSecondary`, so nothing ran
   `stampSecondaryProfileOwner`, and use-gateway-boot captured the source
   profile ONCE in a `useEffect(..., [])` — every later profile's events were
   stamped with the BOOT-time profile. The profile is now read PER EVENT and
   the owner marker is applied whenever the active descriptor is
   `sharedPrimary`, so `runtimeSessionOwner()` resolves again and the live
   sessions/cron sync stops degrading to slow polling. The renderer is the
   right place: `_event_frame` carries no `profile`, so a server echo would be
   a cross-surface wire-contract change.

   Session PATCHes (rename/pin/archive/mark-read) now always name the owning
   profile in the body — falling back to the ACTIVE profile when the caller
   knows none — because the handler resolves its state.db from `body.profile`
   alone and no per-profile process remains to stand in for it.

Also: the routing-table docstring entries 4-6 and the `hermes:api` comment now
describe the behaviour they gate, and the spawn guard reads the same
`profileRouteOptions()` the router does so the two cannot drift (it was
dropping the per-profile SSH-override term).

(cherry picked from commit 1e2354fb15866cc24d98e8e552a59240efe97a25)
---
 .../electron/connection-config.test.ts        | 96 ++++++++++++++++++-
 apps/desktop/electron/connection-config.ts    | 61 ++++++++++--
 .../electron/host-backend-singleton.test.ts   | 33 ++++++-
 .../electron/host-backend-singleton.ts        |  9 +-
 apps/desktop/electron/main.ts                 | 59 ++++++++----
 apps/desktop/src/api/sessions.test.ts         | 33 ++++++-
 apps/desktop/src/api/sessions.ts              | 36 +++++--
 .../gateway/hooks/use-gateway-boot.test.tsx   | 69 ++++++++++++-
 .../src/app/gateway/hooks/use-gateway-boot.ts | 27 +++++-
 9 files changed, 375 insertions(+), 48 deletions(-)

diff --git a/apps/desktop/electron/connection-config.test.ts b/apps/desktop/electron/connection-config.test.ts
index fd87fef6cd..2cdae3d67f 100644
--- a/apps/desktop/electron/connection-config.test.ts
+++ b/apps/desktop/electron/connection-config.test.ts
@@ -376,7 +376,11 @@ const ROUTES = [
     expected: { backend: 'pool', descriptorProfile: null, scopePath: false }
   },
   {
-    name: 'an unscoped local profile request shares the host backend, scoped per request',
+    // THE INVARIANT this collapse must not eat: a route the server cannot
+    // profile-scope has only the backend PROCESS's HERMES_HOME left as a
+    // scope, so it keeps a pooled backend. /api/files/upload acts on host
+    // paths and takes no `profile` even after #118275.
+    name: 'a mutating local request the server cannot scope keeps its pooled backend',
     profile: 'coder',
     opts: {
       primaryProfile: 'default',
@@ -385,6 +389,34 @@ const ROUTES = [
       requestMethod: 'POST',
       requestPath: '/api/files/upload'
     },
+    expected: { backend: 'pool', descriptorProfile: null, scopePath: false }
+  },
+  {
+    // Same unscopable route, safe method: a read cannot corrupt the wrong
+    // home, and holding reads back would spawn a backend per profile again.
+    name: 'a read on an unscopable route still shares the host backend',
+    profile: 'coder',
+    opts: {
+      primaryProfile: 'default',
+      globalRemote: false,
+      profileRemoteOverride: false,
+      requestMethod: 'GET',
+      requestPath: '/api/files/upload'
+    },
+    expected: { backend: 'primary', descriptorProfile: 'coder', scopePath: true }
+  },
+  {
+    // #118275 taught this handler `?profile=`, so the server CAN vouch for the
+    // scope and the same destructive call rides the shared host backend.
+    name: 'a destructive local request the server can scope shares the host backend',
+    profile: 'coder',
+    opts: {
+      primaryProfile: 'default',
+      globalRemote: false,
+      profileRemoteOverride: false,
+      requestMethod: 'POST',
+      requestPath: '/api/memory/reset'
+    },
     expected: { backend: 'primary', descriptorProfile: 'coder', scopePath: true }
   },
   {
@@ -436,7 +468,10 @@ const ROUTES = [
     expected: { backend: 'primary', descriptorProfile: 'coder', scopePath: true }
   },
   {
-    name: 'a local session write shares the host backend, scoped per request',
+    // Scoped by `body.profile` (rename_session_endpoint -> `_with_db`), not by
+    // the query: shares the host backend with its path left alone. Appending
+    // `?profile=` here would advertise a scope the handler ignores.
+    name: 'a local session write shares the host backend, scoped by its body',
     profile: 'coder',
     opts: {
       primaryProfile: 'default',
@@ -445,7 +480,7 @@ const ROUTES = [
       requestMethod: 'PATCH',
       requestPath: '/api/sessions/session-1'
     },
-    expected: { backend: 'primary', descriptorProfile: 'coder', scopePath: true }
+    expected: { backend: 'primary', descriptorProfile: null, scopePath: false }
   },
   {
     name: 'a profile-management request uses the primary without a query scope',
@@ -811,6 +846,57 @@ test('resolveProfileApiRequest scopes destructive profile-owned routes to the sh
   }
 })
 
+test('resolveProfileApiRequest keeps an unscopable mutating route on a process-scoped backend', () => {
+  // The load-bearing half of the collapse: a route the server cannot scope has
+  // nothing left but the backend process's own HERMES_HOME, so it must NOT fall
+  // through to the shared primary. Live proof of the failure mode this pins:
+  // `POST /api/memory/reset?profile=beta` on an unfixed server deleted ALPHA's
+  // MEMORY.md and returned ok:true.
+  for (const [method, path] of [
+    ['POST', '/api/files/upload'],
+    ['DELETE', '/api/files/managed'],
+    // A hypothetical future route: the gate is derived from
+    // localPrimaryRequestScope(), not from a hardcoded list, so an endpoint
+    // nobody has taught `profile` is held back the day it is added.
+    ['POST', '/api/not-a-real-route/destroy']
+  ]) {
+    assert.deepEqual(
+      resolveProfileApiRequest('iris', path, {
+        globalRemote: false,
+        profileRemoteOverride: false,
+        requestMethod: method
+      }),
+      { backendProfile: 'iris', requestPath: path },
+      `${method} ${path} must keep its own backend`
+    )
+  }
+
+  // ...and the gate is about SCOPE, not about the word "destructive": the same
+  // unscopable paths read fine on the shared backend.
+  assert.deepEqual(
+    resolveProfileApiRequest('iris', '/api/files/managed', {
+      globalRemote: false,
+      profileRemoteOverride: false,
+      requestMethod: 'GET'
+    }),
+    { backendProfile: null, requestPath: '/api/files/managed?profile=iris' }
+  )
+})
+
+test('resolveProfileApiRequest leaves a body-scoped session write unqueried on the shared backend', () => {
+  // PATCH /api/sessions/{id} reads its target DB from `body.profile`; the query
+  // is ignored. apps/desktop/src/api/sessions.ts always names the owner in the
+  // body (sessionWriteProfile), so this rides the shared host backend.
+  assert.deepEqual(
+    resolveProfileApiRequest('iris', '/api/sessions/session-1', {
+      globalRemote: false,
+      profileRemoteOverride: false,
+      requestMethod: 'PATCH'
+    }),
+    { backendProfile: null, requestPath: '/api/sessions/session-1' }
+  )
+})
+
 test('resolveProfileApiRequest uses exact method and path eligibility for mixed families', () => {
   assert.deepEqual(
     resolveProfileApiRequest('iris', '/api/skills', {
@@ -818,11 +904,13 @@ test('resolveProfileApiRequest uses exact method and path eligibility for mixed
     }),
     { backendProfile: null, requestPath: '/api/skills?profile=iris' }
   )
+  // Only `GET /api/skills` is eligible: the exact method matters, and an
+  // unlisted mutating method keeps its own process-scoped backend.
   assert.deepEqual(
     resolveProfileApiRequest('iris', '/api/skills', {
       requestMethod: 'POST'
     }),
-    { backendProfile: null, requestPath: '/api/skills?profile=iris' }
+    { backendProfile: 'iris', requestPath: '/api/skills' }
   )
   assert.deepEqual(
     resolveProfileApiRequest('iris', '/api/config/defaults', {
diff --git a/apps/desktop/electron/connection-config.ts b/apps/desktop/electron/connection-config.ts
index 78e2f04fd7..702088c96f 100644
--- a/apps/desktop/electron/connection-config.ts
+++ b/apps/desktop/electron/connection-config.ts
@@ -705,9 +705,48 @@ function localPrimaryRequestScope(opts: ProfileRouteOptions): boolean | null {
     return true
   }
 
+  // Session WRITES are scoped by `body.profile` (`rename_session_endpoint` ->
+  // `_with_db(body.profile, ...)`), not by the query. They ARE scopable — just
+  // not through the URL — so they belong on the shared backend with the path
+  // left alone; `apps/desktop/src/api/sessions.ts` always names the owner in
+  // the body. Returning `true` here would append a `?profile=` the handler
+  // ignores and advertise a scope that is not doing the work.
+  if (method !== 'GET' && (pathname === '/api/sessions' || pathname.startsWith('/api/sessions/'))) {
+    return false
+  }
+
   return null
 }
 
+const SAFE_REQUEST_METHODS = new Set(['GET', 'HEAD', 'OPTIONS'])
+
+/**
+ * True when this is a REST request that CHANGES something and the server cannot
+ * vouch for its profile scope (`localPrimaryRequestScope` → null: no
+ * `?profile=`, no `body.profile`, no target named in the path).
+ *
+ * Such a route has exactly one scope left — the backend process's own
+ * `HERMES_HOME` — so it keeps a pooled, profile-scoped backend even though every
+ * other local request now shares the host one. Mechanical on purpose: the day a
+ * handler learns to read `profile` it joins `LOCAL_PRIMARY_SCOPED_ROUTES` (or a
+ * family above), `localPrimaryRequestScope` stops returning null, and this
+ * predicate stops seeing it — there is no second list to keep in sync.
+ *
+ * A call with no `requestPath` is a BACKEND/descriptor resolution (WebSocket
+ * dial, pool bookkeeping), not a REST call, and is never held back.
+ */
+export function unscopableMutatingRequest(opts: ProfileRouteOptions = {}): boolean {
+  if (!String(opts.requestPath || '')) {
+    return false
+  }
+
+  if (SAFE_REQUEST_METHODS.has(String(opts.requestMethod || 'GET').toUpperCase())) {
+    return false
+  }
+
+  return localPrimaryRequestScope(opts) === null
+}
+
 /**
  * The one place that answers "which backend serves profile P, and does its
  * REST path need a profile scope?". Six routes, in precedence order:
@@ -720,11 +759,16 @@ function localPrimaryRequestScope(opts: ProfileRouteOptions): boolean | null {
  *  3. A profile inheriting the app-global remote shares the primary backend —
  *     one host serves every profile — so it is scoped per request instead.
  *  4. An unknown profile under a remote primary shares that remote backend.
- *     A stored local profile remains isolated in its own backend.
- *  5. A local profile REST request that the primary backend can safely scope
- *     reuses that backend, with `?profile=` when the handler accepts it.
- *  6. Any other local profile gets its own pooled backend, spawned with
- *     `--profile`, so its `HERMES_HOME` scopes it.
+ *     A stored local profile keeps its own pooled backend instead.
+ *  5. A local profile REST request the primary backend can scope reuses that
+ *     backend, with `?profile=` when the handler reads the query (handlers that
+ *     name their target in the path or `body.profile` get no query).
+ *  6. Every other LOCAL profile also shares the one host backend
+ *     (multiplex-only: one `hermes serve` per HOST). The two ways out are
+ *     `HERMES_DESKTOP_ISOLATED_BACKEND=1`, which gives this app a private
+ *     backend, and a MUTATING request the server cannot scope at all — that
+ *     one keeps a pooled backend whose HERMES_HOME does the scoping, so a
+ *     destructive call can never fall through to the primary's home.
  *
  * Routing used to be spread across three overlapping predicates that each
  * re-derived part of this table, which is how case 3 ended up registering
@@ -782,9 +826,10 @@ function resolveProfileBackendRoute(profile, opts: ProfileRouteOptions = {}): Pr
 
   // 6. Multiplex-only: every other LOCAL profile shares the one host backend
   //    too, carrying `?profile=` / the `profile` RPC param instead of getting
-  //    a `hermes serve` child of its own. `HERMES_DESKTOP_ISOLATED_BACKEND=1`
-  //    is the only way back to a private per-profile process.
-  if (sharesHostBackend({ isolated: opts.isolatedBackend })) {
+  //    a `hermes serve` child of its own — UNLESS this request mutates state
+  //    the server cannot scope, in which case the pooled backend's own
+  //    HERMES_HOME is the only scope left and it keeps one.
+  if (sharesHostBackend({ isolated: opts.isolatedBackend, unscopableRequest: unscopableMutatingRequest(opts) })) {
     return { backend: 'primary', descriptorProfile: scopedProfile, scopePath: true }
   }
 
diff --git a/apps/desktop/electron/host-backend-singleton.test.ts b/apps/desktop/electron/host-backend-singleton.test.ts
index 3883c49088..5e16e73685 100644
--- a/apps/desktop/electron/host-backend-singleton.test.ts
+++ b/apps/desktop/electron/host-backend-singleton.test.ts
@@ -4,7 +4,7 @@ import assert from 'node:assert/strict'
 
 import { test } from 'vitest'
 
-import { resolveProfileBackendRoute } from './connection-config'
+import { resolveProfileBackendRoute, unscopableMutatingRequest } from './connection-config'
 import { assertNoSecondLocalBackend, SecondLocalBackendError, sharesHostBackend } from './host-backend-singleton'
 
 const LOCAL = { globalRemote: false, primaryProfile: 'default', profileRemoteOverride: false }
@@ -47,4 +47,35 @@ test('the local pool spawn path is unreachable, and the escape hatches still rea
   assert.equal(sharesHostBackend({ primaryRemoteActive: true }), false)
   assertNoSecondLocalBackend('worker', { profileRemoteOverride: true })
   assert.equal(resolveProfileBackendRoute('worker', { ...LOCAL, profileRemoteOverride: true }).backend, 'pool')
+
+  // A mutating request the server cannot profile-scope is the third way
+  // through: the pooled backend's HERMES_HOME is its only scope, so the guard
+  // must let that spawn happen instead of refusing a legitimate route.
+  assert.equal(sharesHostBackend({ unscopableRequest: true }), false)
+  assertNoSecondLocalBackend('worker', { unscopableRequest: true })
+})
+
+test('the spawn guard and the router agree on which requests keep a backend', () => {
+  // The guard is a backstop, not a second opinion: every request the router
+  // sends to the pool must be one the guard admits, or the destructive write
+  // fails with SecondLocalBackendError instead of reaching the right home.
+  const cases: Array<[string, string]> = [
+    ['POST', '/api/files/upload'],
+    ['DELETE', '/api/files/managed'],
+    ['POST', '/api/skills'],
+    ['POST', '/api/memory/reset'],
+    ['GET', '/api/config'],
+    ['PATCH', '/api/sessions/session-1']
+  ]
+
+  for (const [requestMethod, requestPath] of cases) {
+    const opts = { ...LOCAL, requestMethod, requestPath }
+    const pooled = resolveProfileBackendRoute('worker', opts).backend === 'pool'
+
+    assert.equal(
+      sharesHostBackend({ unscopableRequest: unscopableMutatingRequest(opts) }),
+      !pooled,
+      `${requestMethod} ${requestPath}: guard and router disagree`
+    )
+  }
 })
diff --git a/apps/desktop/electron/host-backend-singleton.ts b/apps/desktop/electron/host-backend-singleton.ts
index 1ab27f52d4..0450eb5585 100644
--- a/apps/desktop/electron/host-backend-singleton.ts
+++ b/apps/desktop/electron/host-backend-singleton.ts
@@ -27,6 +27,13 @@ export interface HostBackendCollapseOptions {
   profileRemoteOverride?: boolean
   /** The primary profile's backend is itself a remote host. */
   primaryRemoteActive?: boolean
+  /**
+   * This request MUTATES state the server cannot profile-scope
+   * (`connection-config.ts::unscopableMutatingRequest`). The pooled backend's
+   * own `HERMES_HOME` is then the only scope there is, so the collapse must
+   * not swallow it — and the spawn guard below must not refuse it.
+   */
+  unscopableRequest?: boolean
 }
 
 /**
@@ -35,7 +42,7 @@ export interface HostBackendCollapseOptions {
  * route, never meant a local child in the first place.
  */
 export function sharesHostBackend(opts: HostBackendCollapseOptions = {}): boolean {
-  if (opts.isolated) {
+  if (opts.isolated || opts.unscopableRequest) {
     return false
   }
 
diff --git a/apps/desktop/electron/main.ts b/apps/desktop/electron/main.ts
index 6b69650512..38dd6293d9 100644
--- a/apps/desktop/electron/main.ts
+++ b/apps/desktop/electron/main.ts
@@ -141,6 +141,7 @@ import {
   sanitizeRemoteHeaderValue,
   savedProfileSsh,
   tokenPreview,
+  unscopableMutatingRequest,
   withTransientRetries
 } from './connection-config'
 import { applyConnectionConfigAtomically } from './connection-config-apply'
@@ -1668,10 +1669,6 @@ function promotePoolEntry(entry: any): void {
   entry.localBackendSpawnRequest?.promote?.('foreground')
 }
 
-// A passive read may only be served by a backend that already exists; the
-// guard itself lives in host-backend-singleton.ts next to the singleton
-// enforcement point (see assertNoSecondLocalBackend).
-
 // Land a spawn failure in desktop.log. Background slot waits back off per
 // profile under a saturated pool, so a roster refresh cannot create a retry
 // storm while a user-triggered foreground open still gets its reserved slot.
@@ -11421,7 +11418,10 @@ function profileRouteOptions(profile, request?) {
 // Resolve a backend connection for the given profile, per the routing table in
 // resolveProfileBackendRoute(). An empty / unknown profile resolves to the
 // primary, so legacy callers are unchanged.
-async function ensureBackend(profile, opts: { passive?: boolean; spawnPriority?: LocalBackendSpawnPriority } = {}) {
+async function ensureBackend(
+  profile,
+  opts: { passive?: boolean; request?: { method?: string; path?: string }; spawnPriority?: LocalBackendSpawnPriority } = {}
+) {
   localBackendLifecycle.assertCanStart()
   const key = profile && String(profile).trim() ? String(profile).trim() : primaryProfileKey()
   const spawnPriority = spawnPriorityFrom(opts.spawnPriority)
@@ -11430,7 +11430,12 @@ async function ensureBackend(profile, opts: { passive?: boolean; spawnPriority?:
 
   profileDeletionGate.assertCanStart(key)
 
-  const route = resolveProfileBackendRoute(key, profileRouteOptions(key))
+  // The REQUEST is part of the routing decision (case 5/6): resolving without
+  // it would collapse a profile onto the shared backend that the caller's
+  // resolveProfileApiRequest deliberately kept pooled, and the unscopable
+  // destructive write would execute against the primary's home after all.
+  const routeOpts = profileRouteOptions(key, opts.request)
+  const route = resolveProfileBackendRoute(key, routeOpts)
 
   if (route.backend === 'primary') {
     const connection = await startHermes()
@@ -11493,7 +11498,9 @@ async function ensureBackend(profile, opts: { passive?: boolean; spawnPriority?:
     spawnPriority
   }
 
-  entry.connectionPromise = spawnPoolBackend(key, entry).catch(async error => {
+  entry.connectionPromise = spawnPoolBackend(key, entry, {
+    unscopableRequest: unscopableMutatingRequest(routeOpts)
+  }).catch(async error => {
     // Land the failure in desktop.log: without this a spawn that dies before
     // its child exists (guard rejection, runtime resolution) leaves no trace
     // beyond renderer-side rejections users never see in a bundle.
@@ -12506,11 +12513,19 @@ function teardownFailedLocalBackend(poolKey: string, entry: any): Promise<void>
 // entry means THIS machine regardless of the v1 routing table); `opts.poolKey`
 // is the backendPool key when it differs from the profile name (composite
 // registry scopes) so the exit/error cleanup evicts the right entry.
-function spawnPoolBackend(profile, entry, opts: { forceLocal?: boolean; poolKey?: string } = {}) {
+function spawnPoolBackend(
+  profile,
+  entry,
+  opts: { forceLocal?: boolean; poolKey?: string; unscopableRequest?: boolean } = {}
+) {
   return localBackendLifecycle.start(() => runPoolBackendStart(profile, entry, opts))
 }
 
-async function runPoolBackendStart(profile, entry, opts: { forceLocal?: boolean; poolKey?: string } = {}) {
+async function runPoolBackendStart(
+  profile,
+  entry,
+  opts: { forceLocal?: boolean; poolKey?: string; unscopableRequest?: boolean } = {}
+) {
   const poolKey = opts.poolKey || profile
 
   await reapOrphanedBackendsOnce()
@@ -12544,10 +12559,16 @@ async function runPoolBackendStart(profile, entry, opts: { forceLocal?: boolean;
   // the host has exactly one, and routing (resolveProfileBackendRoute case 6)
   // keeps local profiles off this path — this is the backstop that makes the
   // pool spawn path genuinely unreachable rather than merely unused.
+  // Same options object the router reads, so the guard cannot drift from it
+  // (profileRouteOptions folds the per-profile SSH override into
+  // profileRemoteOverride; a hand-rolled term here missed that).
+  const guardRoute = profileRouteOptions(profile)
+
   assertNoSecondLocalBackend(poolKey, {
-    isolated: ISOLATED_BACKEND,
-    primaryRemoteActive: primaryBackendIsRemote(),
-    profileRemoteOverride: opts.forceLocal ? false : Boolean(profileRemoteOverride(readDesktopConnectionConfig(), profile))
+    isolated: guardRoute.isolatedBackend,
+    primaryRemoteActive: guardRoute.primaryRemoteActive,
+    profileRemoteOverride: opts.forceLocal ? false : guardRoute.profileRemoteOverride,
+    unscopableRequest: opts.unscopableRequest
   })
 
   // Bound the slot wait BELOW the renderer's backend-boot budget (45s): once
@@ -17166,9 +17187,11 @@ async function handleHermesApiRequest(request) {
   // backend calls ensure_hermes_home() which recreates the profile directory,
   // defeating the deletion and leaving a zombie process.
   //
-  // Safe local-profile REST calls also stay on the primary dashboard and carry
-  // ?profile=. Endpoints that cannot honor that scope retain their pooled
-  // backend so a destructive call can never fall through to the primary home.
+  // Local-profile REST calls stay on the primary dashboard and carry ?profile=
+  // (or name the profile in the path / PATCH body). A request that MUTATES
+  // state the server cannot scope at all retains its pooled backend, whose
+  // HERMES_HOME is then the scope, so a destructive call can never fall
+  // through to the primary home — `resolveProfileBackendRoute` case 6.
   //
   // A profile rename tears down the old-name backend the same way; for a
   // primary rename the lifecycle has already made `default` the temporary
@@ -17183,7 +17206,11 @@ async function handleHermesApiRequest(request) {
   let connection
 
   try {
-    connection = await ensureBackend(routeProfile, { passive: request?.passive, spawnPriority })
+    connection = await ensureBackend(routeProfile, {
+      passive: request?.passive,
+      request: { method: request?.method, path: request?.path },
+      spawnPriority
+    })
     const timeoutMs = resolveTimeoutMs(request?.timeoutMs, DEFAULT_FETCH_TIMEOUT_MS)
 
     response = await fetchJsonForBackend(connection, apiRoute.requestPath, {
diff --git a/apps/desktop/src/api/sessions.test.ts b/apps/desktop/src/api/sessions.test.ts
index 3376573b56..f3399eab4a 100644
--- a/apps/desktop/src/api/sessions.test.ts
+++ b/apps/desktop/src/api/sessions.test.ts
@@ -5,6 +5,7 @@ vi.mock('@/store/transcript-tail', () => ({ recordTranscriptTail: vi.fn() }))
 vi.mock('./client', () => ({
   capabilityScoped: vi.fn(),
   getApiRequestConnection: vi.fn(() => 'prometheus'),
+  getApiRequestProfile: vi.fn(() => null),
   hermesApi: vi.fn(),
   profileScoped: vi.fn(() => ({}))
 }))
@@ -25,6 +26,7 @@ const hermesApi = vi.mocked(client.hermesApi)
 beforeEach(() => {
   vi.clearAllMocks()
   vi.mocked(client.getApiRequestConnection).mockReturnValue('prometheus')
+  vi.mocked(client.getApiRequestProfile).mockReturnValue(null)
 })
 
 describe('deleteSession profile scoping', () => {
@@ -124,11 +126,29 @@ describe('setSessionArchived profile scoping', () => {
     })
   })
 
-  it('omits the profile from the body when none is given', async () => {
+  it('falls back to the ACTIVE profile in the body when no owner is given', async () => {
+    // Multiplex-only: the PATCH handler resolves its state.db from
+    // `body.profile` and there is no per-profile backend whose HERMES_HOME
+    // could stand in. An unnamed owner therefore has to mean "the profile I am
+    // looking at" — otherwise the archive lands on the shared backend's own
+    // state.db and silently no-ops.
     hermesApi.mockResolvedValue({ ok: true } as never)
+    vi.mocked(client.getApiRequestProfile).mockReturnValue('beta')
 
     await setSessionArchived('sess-b', false)
 
+    expect(hermesApi.mock.calls[0][0]).toMatchObject({
+      method: 'PATCH',
+      profile: 'beta',
+      body: { archived: false, profile: 'beta' }
+    })
+  })
+
+  it('omits the profile from the body only when there is no active profile at all', async () => {
+    hermesApi.mockResolvedValue({ ok: true } as never)
+
+    await setSessionArchived('sess-b2', false)
+
     const req = hermesApi.mock.calls[0][0] as { body: Record<string, unknown> }
     expect(req).toMatchObject({ method: 'PATCH', body: { archived: false } })
     expect(req.body).not.toHaveProperty('profile')
@@ -162,14 +182,17 @@ describe('setSessionPinnedRemote / setSessionUnreadRemote profile scoping', () =
     })
   })
 
-  it('omits the profile from the body when none is given', async () => {
+  it('falls back to the ACTIVE profile in the body when no owner is given', async () => {
     hermesApi.mockResolvedValue({ ok: true } as never)
+    vi.mocked(client.getApiRequestProfile).mockReturnValue('beta')
 
     await setSessionPinnedRemote('sess-p2', false)
 
-    const req = hermesApi.mock.calls[0][0] as { body: Record<string, unknown> }
-    expect(req).toMatchObject({ method: 'PATCH', body: { pinned: false } })
-    expect(req.body).not.toHaveProperty('profile')
+    expect(hermesApi.mock.calls[0][0]).toMatchObject({
+      method: 'PATCH',
+      profile: 'beta',
+      body: { pinned: false, profile: 'beta' }
+    })
   })
 })
 
diff --git a/apps/desktop/src/api/sessions.ts b/apps/desktop/src/api/sessions.ts
index 81c938caf4..d983fc1033 100644
--- a/apps/desktop/src/api/sessions.ts
+++ b/apps/desktop/src/api/sessions.ts
@@ -42,6 +42,18 @@ function sessionScoped(scope?: ProfileScope): { connectionId?: string; profile?:
   return scoped
 }
 
+/**
+ * The profile a session WRITE must name in its body. The PATCH handler reads
+ * its target DB from `body.profile` alone (`_with_db(body.profile, ...)`), and
+ * under multiplex-only there is no per-profile backend whose HERMES_HOME could
+ * stand in for it: an unnamed owner lands the rename/pin/archive/mark-read on
+ * the shared backend's own state.db. "Unnamed" therefore means "the profile I
+ * am looking at", not "whatever home the backend was launched in".
+ */
+function sessionWriteProfile(profile?: null | string): string | undefined {
+  return String(profile ?? '').trim() || getApiRequestProfile() || undefined
+}
+
 function sessionScopeQuery(scope?: ProfileScope): string {
   const profile = sessionScoped(scope).profile
 
@@ -344,11 +356,13 @@ export function setSessionArchived(id: string, archived: boolean, profile?: stri
   // remote gateway with no remoteProfile alias: the archive lands on the wrong
   // (default) state.db, no-ops on a missing row, and the archived/unarchived
   // state silently fails to stick — the same class as the unscoped DELETE.
+  const owner = sessionWriteProfile(profile)
+
   return hermesApi<{ ok: boolean }>({
-    ...(profile ? { profile } : {}),
+    ...(owner ? { profile: owner } : {}),
     path: `/api/sessions/${encodeURIComponent(id)}`,
     method: 'PATCH',
-    body: { archived, ...(profile ? { profile } : {}) }
+    body: { archived, ...(owner ? { profile: owner } : {}) }
   })
 }
 
@@ -360,11 +374,13 @@ export function setSessionPinnedRemote(id: string, pinned: boolean, profile?: st
   // Owning profile in the PATCH body (see setSessionArchived / renameSession):
   // the handler reads its target DB from body.profile, so a remote/foreign
   // profile's pin must travel in the body or it no-ops on the wrong state.db.
+  const owner = sessionWriteProfile(profile)
+
   return hermesApi<{ ok: boolean }>({
-    ...(profile ? { profile } : {}),
+    ...(owner ? { profile: owner } : {}),
     path: `/api/sessions/${encodeURIComponent(id)}`,
     method: 'PATCH',
-    body: { pinned, ...(profile ? { profile } : {}) }
+    body: { pinned, ...(owner ? { profile: owner } : {}) }
   })
 }
 
@@ -377,11 +393,13 @@ export function setSessionUnreadRemote(id: string, unread: boolean, profile?: st
   // the handler reads its target DB from body.profile, so a remote/foreign
   // profile's unread toggle must travel in the body or it no-ops on the wrong
   // state.db.
+  const owner = sessionWriteProfile(profile)
+
   return hermesApi<{ ok: boolean }>({
-    ...(profile ? { profile } : {}),
+    ...(owner ? { profile: owner } : {}),
     path: `/api/sessions/${encodeURIComponent(id)}`,
     method: 'PATCH',
-    body: { unread, ...(profile ? { profile } : {}) }
+    body: { unread, ...(owner ? { profile: owner } : {}) }
   })
 }
 
@@ -633,10 +651,12 @@ export function renameSession(
   title: string,
   profile?: string | null
 ): Promise<{ ok: boolean; title: string }> {
+  const owner = sessionWriteProfile(profile)
+
   return hermesApi<{ ok: boolean; title: string }>({
-    ...(profile ? { profile } : {}),
+    ...(owner ? { profile: owner } : {}),
     path: `/api/sessions/${encodeURIComponent(id)}`,
     method: 'PATCH',
-    body: { title, ...(profile ? { profile } : {}) }
+    body: { title, ...(owner ? { profile: owner } : {}) }
   })
 }
diff --git a/apps/desktop/src/app/gateway/hooks/use-gateway-boot.test.tsx b/apps/desktop/src/app/gateway/hooks/use-gateway-boot.test.tsx
index fb117d2b8a..b2f3975d3e 100644
--- a/apps/desktop/src/app/gateway/hooks/use-gateway-boot.test.tsx
+++ b/apps/desktop/src/app/gateway/hooks/use-gateway-boot.test.tsx
@@ -43,7 +43,13 @@ import {
   setActiveSessionId,
   setSelectedStoredSessionId
 } from '@/store/session'
-import { $sessionTiles, $workingSessionIds, clearAllSessionStates, publishSessionState } from '@/store/session-states'
+import {
+  $sessionTiles,
+  $workingSessionIds,
+  clearAllSessionStates,
+  publishSessionState,
+  runtimeSessionOwner
+} from '@/store/session-states'
 import { warnIfTerminalBackendUnavailable } from '@/store/terminal-backend-warning'
 
 import { deferred } from '../../../test/deferred'
@@ -677,6 +683,67 @@ describe('primary failure foreground isolation', () => {
   )
 })
 
+describe('shared host backend event provenance', () => {
+  // Multiplex-only: ONE backend serves every local profile, so the primary
+  // socket carries profile B's events and no secondary closure exists to stamp
+  // them. Unstamped, runtimeSessionOwner() is blank for B and the live
+  // sessions/cron sync falls back to slow polling.
+  // A LOCAL host backend: no registry connection id, so ownership can only come
+  // from the stamp (a registry-tagged event already carries its exact owner).
+  const sharedPrimaryConn = {
+    ...primaryConn,
+    baseUrl: 'http://127.0.0.1:8899',
+    connectionId: '',
+    profile: 'beta',
+    sharedPrimary: true,
+    wsUrl: 'ws://127.0.0.1:8899/api/ws?token=t'
+  }
+
+  function deliverEvent(socket: FakeWebSocket, frame: Record<string, unknown>) {
+    ;(socket as unknown as { emit: (type: string, ev: unknown) => void }).emit('message', {
+      data: JSON.stringify({ jsonrpc: '2.0', method: 'event', params: frame })
+    })
+  }
+
+  it("stamps a shared-primary profile-B event with B, not with the boot-time profile", async () => {
+    const desktop = fakeDesktop()
+
+    desktop.getConnection.mockResolvedValue(sharedPrimaryConn)
+    desktop.getGatewayWsUrl.mockResolvedValue(sharedPrimaryConn.wsUrl)
+    ;(window as { hermesDesktop?: unknown }).hermesDesktop = desktop
+
+    render(<Harness />)
+    await flushAsync()
+
+    expect($gatewayState.get()).toBe('open')
+
+    // The window moved to profile B after boot; the socket did not.
+    act(() => {
+      $connection.set(sharedPrimaryConn as unknown as ReturnType<typeof $connection.get>)
+      $activeGatewayProfile.set('beta')
+    })
+
+    act(() => {
+      deliverEvent(FakeWebSocket.instances[0], { session_id: 'rt-B', type: 'session.info' })
+    })
+
+    expect(runtimeSessionOwner('rt-B')).toBe('beta')
+  })
+
+  it('leaves an unshared primary on its exact owner — the socket already IS its profile', async () => {
+    render(<Harness />)
+    await flushAsync()
+
+    act(() => {
+      deliverEvent(FakeWebSocket.instances[0], { session_id: 'rt-A', type: 'session.info' })
+    })
+
+    // The registry (connectionId, profile) owner, NOT a bare-profile marker:
+    // the stamp is reserved for the shared-primary topology.
+    expect(runtimeSessionOwner('rt-A')).toEqual({ connectionId: 'primary-vps', profile: 'default' })
+  })
+})
+
 describe('useGatewayBoot remote reconnect loop (real hook, fake socket)', () => {
   it('parks rejected primary auth across timers and wake signals until explicit recovery', async () => {
     const desktop = fakeDesktop()
diff --git a/apps/desktop/src/app/gateway/hooks/use-gateway-boot.ts b/apps/desktop/src/app/gateway/hooks/use-gateway-boot.ts
index 9602d1c281..28176c3135 100644
--- a/apps/desktop/src/app/gateway/hooks/use-gateway-boot.ts
+++ b/apps/desktop/src/app/gateway/hooks/use-gateway-boot.ts
@@ -85,6 +85,7 @@ import {
   setCurrentCwd,
   setSessionsLoading
 } from '@/store/session'
+import { stampSecondaryProfileOwner } from '@/store/session-event-provenance'
 import {
   $attentionSessionIds,
   $sessionOwnerHoldRevision,
@@ -1012,10 +1013,15 @@ export function useGatewayBoot({
       }
     })
 
-    const sourceProfile = normalizeProfileKey($activeGatewayProfile.get())
+    // Read PER EVENT, never once at boot: under multiplex-only this one socket
+    // serves every local profile, and the profile moves under it while the
+    // socket stays open. A boot-time capture stamps every later profile's
+    // events with whatever was active when the gateway booted.
+    const sourceProfileNow = () => normalizeProfileKey($activeGatewayProfile.get())
 
     const offEvent = gateway.onEvent(event => {
       const connectionId = activeGatewayConnectionId()
+      const sourceProfile = sourceProfileNow()
 
       const scopedEvent = {
         ...event,
@@ -1023,12 +1029,25 @@ export function useGatewayBoot({
         ...(connectionId ? { connectionId } : {})
       }
 
-      recordSessionEventScope(scopedEvent)
-      callbacksRef.current.handleGatewayEvent(scopedEvent)
+      // On a shared host backend the socket no longer PROVES the profile the
+      // way a pooled secondary's closure did, so nothing stamps ownership and
+      // runtimeSessionOwner() stays blank for every non-primary local profile
+      // — the live sessions/cron sync dies and falls back to slow polling.
+      // The shared-primary descriptor is exactly the topology where the active
+      // profile is the authority for this socket's traffic. (The marker is the
+      // LAST rung of knownOwnerForSession, so durable stored identity still
+      // outranks it — #97511.)
+      const ownedEvent =
+        $connection.get()?.sharedPrimary === true
+          ? stampSecondaryProfileOwner(scopedEvent, sourceProfile)
+          : scopedEvent
+
+      recordSessionEventScope(ownedEvent)
+      callbacksRef.current.handleGatewayEvent(ownedEvent)
     })
 
     // Secondary sockets reach the same handler through the registry's onServerRequest.
-    const offRequest = gateway.onRequest(request => dispatchPrimaryServerRequest(request, sourceProfile))
+    const offRequest = gateway.onRequest(request => dispatchPrimaryServerRequest(request, sourceProfileNow()))
 
     // Wake signals: power resume (macOS/Windows), network coming back, and the
     // window regaining focus/visibility. Each nudges an immediate reconnect.