diff --git a/home_root/.claude/CLAUDE.md b/home_root/.claude/CLAUDE.md
index aaeabac..7f681dd 100644
--- a/home_root/.claude/CLAUDE.md
+++ b/home_root/.claude/CLAUDE.md
@@ -404,19 +404,35 @@ note says otherwise. On other boxes, check first.)
   served FP8 on ana-ml2 GPU 1, production-stable, 131k context (rebalanced
   2026-06-13). Treat it as a standing dependency you can reach for any time.
   Also behind the gateway: `qwen3.5-9b-fp8` (vision / multimodal — image +
-  text chat, GPU 1), `qwen3-embedding`, `qwen3-reranker`, and `glm-5.1` /
-  `glm-4.7` (via z.ai passthrough). The gateway 401s without a **virtual API
-  key**. **Shared all-agents key** — internal-only gateway, scoped to the *free
-  local* models only (granite + qwen-vision + embed/rerank, NOT the paid GLM):
-  `sk-eA_XOdcs6nIkyYXonohtEQ` (alias `all-agents-local`). Use it directly for
-  the always-available local endpoints — no per-project provisioning needed.
-  Example: `curl http://10.250.50.70:4000/v1/chat/completions -H "Authorization:
-  Bearer sk-eA_XOdcs6nIkyYXonohtEQ" -d '{"model":"granite-4.1-8b","messages":[…]}'`.
-  For the **paid** GLM passthroughs or broader scope, still request a
-  project-scoped key from infra-ops via althing (the shared key deliberately
-  can't spend z.ai cost). Rotatable via infra-ops if it leaks. Reach for
-  this before spending premium API tokens on tasks a small fast local model
-  handles fine (the LLM-last-resort floor still applies — deterministic first).
+  text chat, GPU 1), `qwen3-embedding`, `qwen3-reranker`, `glm-5.1` / `glm-4.7`
+  (via z.ai passthrough), and `kimi-k3` (Moonshot passthrough, added
+  2026-07-25 for Heid's 4th cross-frontier panel arm — 1M context, a
+  **reasoning** model: final answer in `content`, chain-of-thought in
+  `reasoning_content`, and it 400s on any `temperature` other than 1, so omit
+  the field entirely rather than sending 0. Sibling variants `kimi-k2.6` /
+  `kimi-k2.7-code` / `kimi-k2.7-code-highspeed` are provisioned on the same
+  key on request). The gateway 401s without a **virtual API key**. **Shared
+  all-agents key** — `sk-eA_XOdcs6nIkyYXonohtEQ` (alias `all-agents-local`):
+  reaches **every** model behind the gateway, paid passthroughs included
+  (corrected 2026-07-25 — this entry previously read "scoped to free local
+  models only... the shared key deliberately can't spend z.ai cost," which
+  infra-ops says was never actually true: the key already spent GLM/z.ai
+  credits before this correction, and now reaches kimi-k3 the same way).
+  **A paid-model call on this key spends real vendor credits, shared across
+  every session and project holding it** — there is no isolation between
+  what your session runs and what anyone else's does. Use it directly for
+  the always-available free local endpoints — no per-project provisioning
+  needed. Example: `curl http://10.250.50.70:4000/v1/chat/completions -H
+  "Authorization: Bearer sk-eA_XOdcs6nIkyYXonohtEQ" -d
+  '{"model":"granite-4.1-8b","messages":[…]}'`. For spend isolated from the
+  shared pool — auditable per-project cost, blast-radius containment — still
+  request a project-scoped key from infra-ops via althing; that remains the
+  right move for anything where "shows up on someone else's tab" matters, it's
+  just no longer a hard technical requirement for reaching a paid model.
+  Rotatable via infra-ops if it leaks. Reach for the free local endpoints
+  before spending premium API tokens on tasks a small fast local model
+  handles fine (the LLM-last-resort floor still applies — deterministic
+  first).
 
 - **The Booth** — ephemeral media board for surfacing **A/B renders, smoke
   results, screenshots, audio/video** to the operator (live at