diff --git a/CLAUDE.md b/CLAUDE.md
index 73323ea1..6d4de067 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -23,8 +23,15 @@ One Bun process (`src/server.tsx`) serves everything:
 
 Long-running and privileged work lives in **sidecars**: separate processes that dial back in over
 `/api/sidecar/register` and are tracked in `src/servers/sidecar-registry.ts`. PM2 runs them
-(`ecosystem.config.cjs`): `officer` (the server), `officer-claude`, `officer-opencode`,
-`officer-email`, `officer-pty`, `officer-vnc`.
+(`ecosystem.config.cjs`): `officer` (the server), `officer-anthropic-proxy`, `officer-agent`,
+`officer-opencode`, `officer-email`, `officer-pty`, `officer-vnc`, `officer-music`, `officer-vault`,
+`officer-slskd`.
+
+**`officer-anthropic-proxy` and `officer-agent` are not the same thing.** The proxy holds the Anthropic
+credential and forwards API traffic; the agent is the process that spawns `claude`. They were one entry
+named `officer-claude` until the sidecar-isolation work — which is exactly how the false claim that
+"restarting officer doesn't disturb the agent" survived so long. Every sidecar is a PM2 peer of
+`officer`, so **no sidecar is a child of the server and restarting the server does not kill one.**
 
 Agents run **unsandboxed as the server owner**, with `--dangerously-skip-permissions`. This is
 deliberate — it is the owner's own machine. Do not add a jail without being asked.
diff --git a/docs/working-on-officer.md b/docs/working-on-officer.md
index c510355a..82b45452 100644
--- a/docs/working-on-officer.md
+++ b/docs/working-on-officer.md
@@ -57,8 +57,13 @@ Commit messages: simple lowercase, no prefixes, explaining *why*.
 
 ## Running and checking your work
 
-The server runs under pm2 as `officer`, plus sidecars (`officer-claude`, `officer-opencode`,
-`officer-email`, `officer-pty`, `officer-vnc`). `pm2 list` shows them; `pm2 logs officer` follows.
+The server runs under pm2 as `officer`, plus sidecars (`officer-anthropic-proxy`, `officer-agent`,
+`officer-opencode`, `officer-email`, `officer-pty`, `officer-vnc`, `officer-music`, `officer-vault`,
+`officer-slskd`). `pm2 list` shows them; `pm2 logs officer` follows.
+
+Two of those names are worth knowing apart: **`officer-anthropic-proxy` holds the Anthropic credential
+and proxies API traffic; `officer-agent` is the process that actually runs `claude`.** They used to be
+one confusingly-named entry (`officer-claude`) that was only the proxy.
 
 **Don't restart the owner's server to test.** Boot your own on a spare port instead — the running
 instance holds `PORT` from `.env` (9010):
diff --git a/ecosystem.config.cjs b/ecosystem.config.cjs
index 15c25a28..c12f1527 100644
--- a/ecosystem.config.cjs
+++ b/ecosystem.config.cjs
@@ -6,8 +6,11 @@ module.exports = {
       args: 'start',
       watch: false,
     },
+    // The Anthropic credential proxy. Despite the old name (`officer-claude`) this process does NOT
+    // run agents — it holds the proxy secret and forwards to api.anthropic.com. The process that runs
+    // agents is `officer-agent` below.
     {
-      name: 'officer-claude',
+      name: 'officer-anthropic-proxy',
       script: 'bun',
       args: 'run src/servers/sidecar/claude/index.ts',
       watch: false,