diff --git a/AGENTS.md b/AGENTS.md
index 82dc1bb..86072e4 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -17,6 +17,23 @@ This file provides guidance for AI coding agents operating in this repository.
 
 ---
 
+## Lane Partition (ratified 2026-07-03)
+
+Multiple autonomous agents (Claude, Codex) work phoenixvc repos concurrently. Seven documented collisions through 2026-07-03 led to this org-wide partition:
+
+| Lane                       | Owner  | Scope                                                                                 |
+| -------------------------- | ------ | ------------------------------------------------------------------------------------- |
+| Release / prod             | Codex  | promotion PRs, version bumps and tags, prod deploy dispatch and verification           |
+| Backend / security / infra | Claude | gateway/backend code, security fixes, Terraform/IaC (`infra/`), governance docs        |
+
+Rules:
+
+1. Either agent may **open** a PR anywhere; **merge authority follows the lane owner**. Do not enable auto-merge on a PR in the other agent's lane.
+2. Cross-lane requests and handoffs go via **PR comments** — both agents act on those. Baton remains the coordination record for Claude and humans.
+3. Humans (Jurie, Ben) override lanes at will; a direct human instruction beats this table.
+
+---
+
 ## Build / Lint / Test Commands
 
 ### Dashboard (Node.js/pnpm)
@@ -250,10 +267,16 @@ PR #93 (see `docs/architecture/09-claude-code-via-sluice.md`).
 Auth is a Bearer token (the consumer's virtual key). Sluice strips it,
 attributes spend, and forwards upstream with the master provider key.
 
+The canonical gateway host is **`https://sluice.phoenixvc.tech`** (custom
+domain, bound 2026-07-03 and managed in `infra/` since PR #129). The raw
+`pvc-prod-sluice-ca.<region>.azurecontainerapps.io` FQDN still works but
+changes if the Container Apps environment is ever rebuilt — new consumers
+should use the custom domain.
+
 ### OpenAI SDK consumers
 
 ```bash
-export OPENAI_BASE_URL="https://pvc-prod-sluice-ca.<region>.azurecontainerapps.io/v1"
+export OPENAI_BASE_URL="https://sluice.phoenixvc.tech/v1"
 export OPENAI_API_KEY="$(az keyvault secret show \
   --vault-name pvc-prod-sluice-kv \
   --name vkey-<consumer-alias> \
@@ -266,7 +289,7 @@ The Anthropic Python/TypeScript SDKs read `ANTHROPIC_API_KEY` by default.
 Override the base URL and use the consumer's virtual key as the API key:
 
 ```bash
-export ANTHROPIC_BASE_URL="https://pvc-prod-sluice-ca.<region>.azurecontainerapps.io"
+export ANTHROPIC_BASE_URL="https://sluice.phoenixvc.tech"
 export ANTHROPIC_API_KEY="$(az keyvault secret show \
   --vault-name pvc-prod-sluice-kv \
   --name vkey-<consumer-alias> \
@@ -278,7 +301,7 @@ export ANTHROPIC_API_KEY="$(az keyvault secret show \
 The Claude Code CLI reads `ANTHROPIC_AUTH_TOKEN` (not `ANTHROPIC_API_KEY`):
 
 ```bash
-export ANTHROPIC_BASE_URL="https://pvc-prod-sluice-ca.<region>.azurecontainerapps.io"
+export ANTHROPIC_BASE_URL="https://sluice.phoenixvc.tech"
 export ANTHROPIC_AUTH_TOKEN="$(az keyvault secret show \
   --vault-name pvc-prod-sluice-kv \
   --name vkey-<consumer-alias> \