diff --git a/hypaware-core/plugins-workspace/central/src/identity_client.js b/hypaware-core/plugins-workspace/central/src/identity_client.js
index 0e8c84c4..254a6e53 100644
--- a/hypaware-core/plugins-workspace/central/src/identity_client.js
+++ b/hypaware-core/plugins-workspace/central/src/identity_client.js
@@ -100,8 +100,13 @@ export class IdentityClient {
       // operator must re-run `hyp join` against the new server.
       // @ref LLP 0031#physical-layout [implements]: a re-point with no token cannot safely reuse the old identity, so loading is refused
       if (persisted.central_url !== undefined && persisted.central_url !== this.centralUrl) {
+        // A login-seeded identity re-enrolls with a fresh login, not a join
+        // token (LLP 0061 D3): point the operator at the seam that minted it.
+        const remedy = persisted.origin === 'login'
+          ? 'Re-run `hyp remote login` against the new server to enroll this host'
+          : `Run \`hyp join ${this.centralUrl} <token>\` to enroll this host with the new server`
         throw new Error(
-          `identity central URL mismatch: persisted identity was minted by ${persisted.central_url} but the configured central server is ${this.centralUrl}. Run \`hyp join ${this.centralUrl} <token>\` to enroll this host with the new server`
+          `identity central URL mismatch: persisted identity was minted by ${persisted.central_url} but the configured central server is ${this.centralUrl}. ${remedy}`
         )
       }
       this.identity = persisted
@@ -201,6 +206,7 @@ export class IdentityClient {
     // persisted identity rather than recomputing.
     identity.central_url = this.identity.central_url
     identity.bootstrap_token_fp = this.identity.bootstrap_token_fp
+    if (this.identity.origin !== undefined) identity.origin = this.identity.origin
     this.identity = identity
     writePersistedFile(this.persistedPath, identity)
   }
@@ -249,7 +255,7 @@ function readPersistedFile(filePath) {
   if (!isPlainObject(parsed)) {
     throw new Error(`persisted identity ${filePath} must be an object`)
   }
-  const { jwt, expires_at, gateway_id, central_url, bootstrap_token_fp } =
+  const { jwt, expires_at, gateway_id, central_url, bootstrap_token_fp, origin } =
     /** @type {Record<string, unknown>} */ (parsed)
   if (typeof jwt !== 'string' || jwt.length === 0) {
     throw new Error(`persisted identity ${filePath}: missing or invalid jwt`)
@@ -264,6 +270,7 @@ function readPersistedFile(filePath) {
   const identity = { jwt, expires_at, gateway_id }
   if (typeof central_url === 'string') identity.central_url = central_url
   if (typeof bootstrap_token_fp === 'string') identity.bootstrap_token_fp = bootstrap_token_fp
+  if (origin === 'login') identity.origin = origin
   return identity
 }
 
@@ -283,6 +290,14 @@ function mintChanged(persisted, centralUrl, bootstrapToken) {
   if (persisted.central_url !== undefined && persisted.central_url !== centralUrl) {
     return true
   }
+  // A login-seeded identity was minted by a human login, not by any bootstrap
+  // token, so its missing token fingerprint is not a mint mismatch. With the
+  // URL matching (above), a configured bootstrap token coexists with the login
+  // seed rather than re-bootstrapping over it on every daemon start.
+  // @ref LLP 0061#d3 [implements]: the origin marker keeps the re-enrollment guard from reading a login seed as a swapped bootstrap token
+  if (persisted.origin === 'login') {
+    return false
+  }
   return persisted.bootstrap_token_fp !== fingerprintToken(bootstrapToken)
 }
 
diff --git a/hypaware-core/plugins-workspace/central/src/types.d.ts b/hypaware-core/plugins-workspace/central/src/types.d.ts
index 0eee5825..d39e47d0 100644
--- a/hypaware-core/plugins-workspace/central/src/types.d.ts
+++ b/hypaware-core/plugins-workspace/central/src/types.d.ts
@@ -34,6 +34,15 @@ export interface PersistedIdentity {
    * gateway identity against a new tenant/server.
    */
   bootstrap_token_fp?: string
+  /**
+   * Present when this identity was seeded by `hyp remote login` (a
+   * login-minted gateway, LLP 0061 D3) rather than a bootstrap-token
+   * mint. No bootstrap token was involved, so the re-enrollment guard
+   * must not read the missing `bootstrap_token_fp` as a mint mismatch;
+   * only a `central_url` change counts. Absent on bootstrap-minted
+   * identities.
+   */
+  origin?: 'login'
 }
 
 /** Request body for `POST /v1/identity/bootstrap`. */
diff --git a/hypaware-core/smoke/flows/remote_oidc_login.js b/hypaware-core/smoke/flows/remote_oidc_login.js
index 78f257a4..f99aa647 100644
--- a/hypaware-core/smoke/flows/remote_oidc_login.js
+++ b/hypaware-core/smoke/flows/remote_oidc_login.js
@@ -1,14 +1,18 @@
 // @ts-check
 
+import fsp from 'node:fs/promises'
 import http from 'node:http'
+import path from 'node:path'
 import process from 'node:process'
 
+import { IdentityClient } from '../../plugins-workspace/central/src/identity_client.js'
 import { installObservability } from '../../../src/core/observability/index.js'
 import { loginWithBrowser } from '../../../src/core/remote/oidc_login.js'
 import {
   readCredentials,
   writeSession,
 } from '../../../src/core/remote/credentials.js'
+import { seedLoginGateway } from '../../../src/core/remote/gateway_seed.js'
 import { querySqlVerb } from '../../../src/core/query/verb.js'
 import { verbToCommand } from '../../../src/core/cli/verb_command.js'
 
@@ -32,6 +36,10 @@ import { verbToCommand } from '../../../src/core/cli/verb_command.js'
  *   silent refresh + persist -> a revoked refresh row drives the re-login
  *   message.
  *
+ * The same login also mints a gateway credential (LLP 0061): the flow seeds
+ * it into a configured central sink and proves the sink's own IdentityClient
+ * loads it with no bootstrap token.
+ *
  * Asserts both the user-visible result and the `smoke_step` telemetry the
  * remote-oidc modules emit (Log-Driven Development).
  *
@@ -59,7 +67,7 @@ export async function run({ harness, expect }) {
       fetch(url).catch(() => {})
       return true
     }
-    const session = await loginWithBrowser({ identityBase, org: 'acme', openBrowser })
+    const session = await loginWithBrowser({ identityBase, org: 'acme', host: 'smoke-host', openBrowser })
     await writeSession(stateDir, 'prod', session)
 
     const afterLogin = await readCredentials(stateDir)
@@ -67,6 +75,30 @@ export async function run({ harness, expect }) {
     expect.that('login: resolved org is acme', session.org, (v) => v === 'acme')
     expect.that('login: a refresh token was issued', session.refreshToken, (v) => typeof v === 'string' && v.length > 0)
 
+    // ----- smoke_step: gateway_seed -----
+    // The same login minted a gateway credential (LLP 0061 D1); seed it into a
+    // configured central sink and prove the sink's own IdentityClient loads it
+    // with no bootstrap token (D2/D3). The query record must not carry it (D1).
+    // @ref LLP 0061#d2 [tests]: login seed is loaded by the sink's unchanged acquire() path, end to end
+    expect.that('gateway: credential captured on login', session.gateway?.gatewayId, (v) => v === 'gw-smoke')
+    expect.that('gateway: host label sent with the exchange', server.state.lastHost, (v) => v === 'smoke-host')
+    expect.that('gateway: jwt kept out of the query record', JSON.stringify(afterLogin.prod), (s) => !s.includes('gw-jwt-smoke'))
+    const smokeConfigPath = path.join(String(process.env.HYP_HOME), 'smoke-config.json')
+    await fsp.writeFile(smokeConfigPath, JSON.stringify({
+      version: 2,
+      sinks: { fwd: { plugin: '@hypaware/central', config: { url: origin, identity: {} } } },
+    }))
+    const seeded = await seedLoginGateway({
+      stateDir,
+      configPath: smokeConfigPath,
+      targetUrl: mcpUrl,
+      gateway: /** @type {any} */ (session.gateway),
+    })
+    expect.that('gateway: the origin-matched sink was seeded', seeded.map((s) => s.sink).join(','), (v) => v === 'fwd')
+    const sinkIdentity = new IdentityClient({ centralUrl: origin, persistedPath: seeded[0].persistedPath })
+    expect.that('gateway: sink loads the seed without a bootstrap token', await sinkIdentity.acquire(), (v) => v === 'loaded')
+    expect.that('gateway: sink presents the login-minted jwt', await sinkIdentity.getCurrentJwt(), (v) => v === 'gw-jwt-smoke')
+
     // ----- smoke_step: attach_query -----
     const cmd = verbToCommand(querySqlVerb)
     const first = runQuery(mcpUrl)
@@ -159,7 +191,7 @@ async function forceExpiry(stateDir, target) {
  * @returns {Promise<{ port: number, state: any, close: (cb: () => void) => void, closeAllConnections: () => void }>}
  */
 function startStubServer() {
-  const state = { jwtSeq: 0, validJwt: '', refreshToken: 'rt-smoke', refreshRevoked: false, refreshCalls: 0 }
+  const state = { jwtSeq: 0, validJwt: '', refreshToken: 'rt-smoke', refreshRevoked: false, refreshCalls: 0, lastHost: '' }
   const mint = () => {
     state.jwtSeq += 1
     state.validJwt = `jwt-${state.jwtSeq}`
@@ -191,7 +223,13 @@ function startStubServer() {
       readBody(req).then((body) => {
         const grant = body.grant_type
         if (grant === 'authorization_code') {
-          return json({ session_id: 'sess-1', refresh_token: state.refreshToken, access_jwt: mint(), expires_at: FUTURE, org: 'acme' })
+          state.lastHost = typeof body.host === 'string' ? body.host : ''
+          // A login-configured server also mints a gateway credential on the
+          // same response (LLP 0061); the refresh grant never carries it.
+          return json({
+            session_id: 'sess-1', refresh_token: state.refreshToken, access_jwt: mint(), expires_at: FUTURE, org: 'acme',
+            gateway_jwt: 'gw-jwt-smoke', gateway_expires_at: FUTURE, gateway_id: 'gw-smoke',
+          })
         }
         if (grant === 'refresh_token') {
           state.refreshCalls += 1
diff --git a/llp/0061-login-minted-gateway-client.decision.md b/llp/0061-login-minted-gateway-client.decision.md
new file mode 100644
index 00000000..b30981ec
--- /dev/null
+++ b/llp/0061-login-minted-gateway-client.decision.md
@@ -0,0 +1,217 @@
+# LLP 0061: Login-minted gateway credential on the client
+
+**Type:** Decision
+**Status:** Implemented
+**Systems:** CLI, Onboarding, Sinks, Gateway
+**Author:** Kenny / Claude
+**Date:** 2026-07-01
+**Related:** LLP 0033, LLP 0049, LLP 0058, LLP 0031
+
+> The server side of login-minted gateway enrollment already shipped:
+> hypaware-server now provisions a gateway on a successful human login and returns
+> its credential (`gateway_jwt` / `gateway_expires_at` / `gateway_id`) on the same
+> `POST /v1/identity/token` response. This is the client half: teaching `hyp remote
+> login` to capture that credential and seed it where the `central` forward sink's
+> identity client reads it, so a logged-in user can forward logs with no
+> out-of-band bootstrap-token distribution. These are the client-local forks; the
+> architecture is decided in the server repo.
+
+## Summary
+
+This is the **client half of chunk 4** (login-minted gateway enrollment). The
+architecture was decided server-side and lives in the hypaware-server repo:
+`../hypaware-server/llp/0020-login-minted-gateway.decision.md` (the decision),
+`0021-...design.md`, and `0022-...plan.md` (the shipped server plan). That work
+added `enrollLoginGateway`, minted a gateway JWT in the `authorization_code`
+grant, and stamped the gateway registry with `origin: 'login'`.
+
+This document does **not** re-decide that architecture. It records only the
+**client-local** choices. Everything cross-cutting (why the server owns `org`, why
+a login mints an ordinary registry row so the ingest path needs no new code, why
+the host label is advisory) defers up to server LLP 0020. Server LLP 0020 D7 names
+the client obligation; this doc resolves how the client meets it.
+
+## Context: what exists today
+
+The client already has the two credential stores this chunk bridges; it extends
+them rather than inventing a third.
+
+- **Query-scoped store** (`src/core/remote/credentials.js`): the `0600`
+  `remote-credentials.json`, per-target, discriminated by `kind` (LLP 0058 D4). A
+  browser login writes an `oidc` record `{ refreshToken, accessJwt, expiresAt, org }`
+  via `writeSession` / `commitSession`. This is the **human query** credential.
+- **Forward-scoped identity** (`hypaware-core/plugins-workspace/central/src/identity_client.js`):
+  the `central` sink's `IdentityClient` holds a gateway JWT and manages its full
+  lifecycle. `acquire()` loads a persisted `identity.json` (`{ jwt, expires_at,
+  gateway_id, central_url, bootstrap_token_fp? }`) or, if none exists, `bootstrap()`s
+  with a configured `bootstrap_token`. `doRefresh()` re-mints via `POST
+  /v1/identity/refresh` (bearer = the gateway JWT), and `sink.js` `postNdjson()`
+  drives the 401 → refresh → retry loop. This is the **forwarder** credential.
+- **The login flow** (`src/core/cli/remote_commands.js` → `oidc_login.js` →
+  `identity_client.js` `exchangeCode()`): today `exchangeCode()` reads only
+  `refresh_token` / `access_jwt` / `expires_at` / `org` from the token response and
+  returns an `OidcSession`. The new `gateway_*` fields land unread.
+- **Net-new for this chunk:** nothing on the client captures the gateway credential,
+  and nothing bridges a login into the forward-scoped identity store.
+
+## Decisions
+
+### D1: One login mints two credentials with two scopes and two stores
+
+<a id="d1"></a>
+A single `hyp remote login <target>` yields two independent credentials: the
+**human session** (refresh token + access JWT → the query path) and the
+**login-minted gateway** (`gateway_jwt` / `gateway_expires_at` / `gateway_id` → the
+forward path). They differ in scope and lifetime and must not be conflated.
+
+`exchangeCode()` captures the three `gateway_*` fields and carries them on
+`OidcSession`, but they are **not** written into the query `oidc` record. The
+query record stays exactly `{ kind, refreshToken, accessJwt, expiresAt, org }` (LLP
+0058 D4); the gateway fields route to the forward store (D2). Keeping them out of
+the query record preserves the LLP 0033 stakes argument: what lands in
+`remote-credentials.json` is query-scoped only. The refresh grant
+(`grant_type=refresh_token`) never carries `gateway_*` (the server mints a gateway
+only on `authorization_code`), so `refreshSession()` is unchanged.
+
+### D2: The gateway credential seeds the central sink's persisted identity; the forward path is unchanged
+
+<a id="d2"></a>
+The `central` sink already loads and refreshes a persisted gateway identity. A
+login-seeded credential is simply that `identity.json` pre-populated: `{ jwt:
+gateway_jwt, expires_at: gateway_expires_at, gateway_id, central_url, origin:
+'login' }`. With the file present, `acquire()` finds a persisted identity, skips
+`bootstrap()`, and the existing `doRefresh()` / 401-retry path carries it unchanged
+- because a login-minted gateway is an ordinary registry row that refreshes through
+the same `POST /v1/identity/refresh` a bootstrap-minted gateway uses (server LLP
+0020 D2).
+
+**No new forward code, no gateway-specific refresh grant.** The single change on the
+forward side is teaching the seed-writer to produce this file; `IdentityClient` and
+`sink.js` are untouched except for widening the persisted shape.
+
+### D3: A login seed takes precedence over bootstrap; the bootstrap seam stays for zero-touch
+
+<a id="d3"></a>
+`acquire()` bootstraps only when no persisted identity exists. Seeding the file at
+login means the sink never needs a `bootstrap_token` configured: the logged-in user
+is the enrollment. The `bootstrap_token` path (LLP 0033 / server LLP 0008) is
+**retained unchanged** for the unattended / MDM / device-cert case that has no human
+to trigger a login (server LLP 0020 D7). Login-seeded and bootstrap-seeded
+identities coexist and are indistinguishable to `doRefresh()`; an `origin` marker on
+the persisted record distinguishes them for the re-enrollment guard (D4) and for
+diagnostics.
+
+### D4: The seed carries `central_url` provenance so the existing re-point guards apply
+
+<a id="d4"></a>
+`acquire()`'s re-enrollment and cross-tenant guards (LLP 0031) key on `central_url`
+and `bootstrap_token_fp`. A login seed **must** stamp `central_url` so that
+re-pointing the sink at a different server is refused exactly as it is for a
+bootstrap-minted identity: reusing the old gateway JWT against a new server would
+file this server's data under the other server's `gateway_id`. A login re-seed
+against the **same** central URL overwrites the persisted file; the server dedups to
+the same `gateway_id` (server LLP 0020 D6), so re-login is idempotent on identity and
+only advances the expiry. A login seed must not silently clobber a bootstrap identity
+minted by a different token or URL - it goes through the same mint-changed path, not
+around it.
+
+### D5: `hyp remote login` writes the seed to the sink's persisted path, resolved from the target
+
+<a id="d5"></a>
+The login command and the sink run under the same `HYP_HOME`, so the login command
+resolves the target's forward-identity path (the sink's `persistedPath`) and writes
+the seed there directly, under the same atomic-write discipline the sink uses. This
+keeps the credential where `acquire()` already reads it (server LLP 0020 D7: "writes
+the returned gateway JWT where the central forward sink's identity client reads it")
+rather than inventing a handoff. The exact path derivation is a design-level detail
+(see open questions).
+
+### D6: The host label defaults to the machine hostname, overridable
+
+<a id="d6"></a>
+Resolving the server's open question (server LLP 0020): `hyp remote login` sends
+`host: os.hostname()` in the token exchange by default, overridable with an explicit
+`--host <label>` flag. The host is advisory only - it rides the server-side dedup key and admin
+attribution (server LLP 0020 D6); identity stays server-assigned, so a forged or
+duplicated host never grants scope, at worst it splits or merges a user's forwarder
+rows.
+
+## Consequences
+
+- **Log forwarding after login needs no bootstrap token.** A user who runs `hyp
+  remote login` against a login-configured server can forward immediately; the
+  operator no longer distributes bootstrap tokens for the attended case.
+- **The forward path is unchanged.** Only the persisted-identity shape widens
+  (`origin?: 'login'`) and a new seed-writer is added; `IdentityClient` refresh,
+  the 401 loop, and the re-point guards are reused verbatim.
+- **Backward compatible.** A server without login-gateway support omits the
+  `gateway_*` fields; `exchangeCode()` captures nothing and login still completes.
+  A sink with a bootstrap token and no login seed behaves exactly as before.
+- **Two failure surfaces stay separate.** Revoking the gateway stops forwarding
+  while the human's query session still works (server LLP 0020 D5); the client
+  keeps them in separate stores, so neither revocation touches the other.
+
+## Implementation surface (sketch; a plan can follow)
+
+Mirrors server LLP 0022 Milestone 2 (T4/T5/T6). Named here for orientation, not as a
+committed task breakdown.
+
+- **Capture** (`src/core/remote/identity_client.js` `exchangeCode()`, `types.d.ts`
+  `OidcSession`): read `gateway_jwt` / `gateway_expires_at` / `gateway_id`; send
+  `host`.
+- **Seed** (`src/core/cli/remote_commands.js` `runBrowserLogin`, plus the resolver
+  and writer in `src/core/remote/gateway_seed.js`): resolve the sink's `persistedPath`
+  for the target and write the login-origin `identity.json` seed (D2, D4, D5).
+- **Consume** (`central/src/identity_client.js`, `types.d.ts` `PersistedIdentity`):
+  widen the persisted shape with `origin?: 'login'`; `acquire()` already loads and
+  refreshes it. Verify the re-point guard treats a login seed correctly (D4).
+- **Smoke** (client end-to-end, stub IdP + stub ingest): log in, confirm the seed is
+  written, forward a log line, assert the org-tagged accept; revoke and assert the
+  forward 401s while the query path still works.
+
+## Out of scope (later chunks / follow-ups)
+
+- Our own OIDC provider (server chunk 3) and self-serve DNS-TXT domain claiming
+  (server chunk 5). The client change is provider-agnostic.
+- MDM zero-touch device-cert enrollment (server LLP 0017 Q9); D3 keeps the bootstrap
+  seam open for it.
+- A distinct login-gateway TTL policy; the client consumes whatever expiry the server
+  returns.
+
+## Open questions
+
+- **Persisted-path derivation (D5).** *Resolved (implementation):* config-driven,
+  the same derivation the sink itself uses. The login command resolves the
+  effective local+central layered config (what the daemon runs) and, for each
+  `@hypaware/central` sink block, takes `identity.persisted_path` when set,
+  defaulting to the per-plugin state path
+  `<stateRoot>/plugins/@hypaware/central/identity.json` (LLP 0004
+  state-directories, mirroring the sink's `sinkCtx.paths.stateDir` default). The
+  resolver and the seed writer both live in `src/core/remote/gateway_seed.js`: the
+  login command is the seed's producer and the sink (`hypaware-core`) only reads and
+  refreshes the file, so the writer sits on the `src` side of the package boundary
+  rather than importing a sink value across it (the published declaration build
+  compiles `src` alone, `rootDir: src`, so a `src` value import into `hypaware-core`
+  would not resolve). The file format is the contract between the two halves; the
+  sink validates it on read.
+- **Multiple central targets.** *Resolved (implementation):* the mapping is by URL
+  **origin**, the same derivation that maps a target to its identity endpoints
+  (LLP 0058 D6). `hyp remote login <target>` seeds every `central` sink whose
+  configured `url` shares the target URL's origin (persisted paths deduped) and
+  never touches a sink pointed at another origin. No explicit sink naming needed;
+  a login against server A cannot disturb the forwarder for server B.
+- **Systems vocabulary.** This doc tags `Sinks` + `Gateway` for the forward half;
+  LLP 0058 already flagged that login/credentials may deserve its own subsystem tag.
+
+## References
+
+- Server: [LLP 0020](../../hypaware-server/llp/0020-login-minted-gateway.decision.md)
+  (D2 ordinary-row, D3 mint, D4 org, D5 revocation asymmetry, D6 dedup/host, D7
+  client obligation), LLP 0021 (design), LLP 0022 (plan, Milestone 2)
+- [LLP 0058](./0058-oidc-login-client.decision.md) (browser login, the `oidc`
+  credential record, D4 kind-discrimination, D6 identity-base derivation)
+- [LLP 0033](./0033-remote-query-attach.spec.md) (query-scoped credential store,
+  credential stakes)
+- [LLP 0049](./0049-remote-credentials-lock.decision.md) (single-flight write lock)
+- [LLP 0031](./0031-layered-config.decision.md) (`#physical-layout`: persisted
+  identity.json, re-join re-bootstrap / cross-tenant re-point guards)
diff --git a/src/core/cli/remote_commands.js b/src/core/cli/remote_commands.js
index 46caa183..172ab1a0 100644
--- a/src/core/cli/remote_commands.js
+++ b/src/core/cli/remote_commands.js
@@ -1,6 +1,7 @@
 // @ts-check
 
 import fs from 'node:fs/promises'
+import os from 'node:os'
 import path from 'node:path'
 import process from 'node:process'
 
@@ -14,6 +15,7 @@ import {
   writeSession,
   writeToken,
 } from '../remote/credentials.js'
+import { seedLoginGateway } from '../remote/gateway_seed.js'
 import { loginWithBrowser } from '../remote/oidc_login.js'
 
 /**
@@ -39,7 +41,8 @@ export async function runRemoteHelp(argv, ctx) {
     ctx.stdout.write('usage: hyp remote <subcommand> [args...]\n')
     ctx.stdout.write('  subcommands: add, login, list, remove\n')
     ctx.stdout.write('  login: browser sign-in by default; --token-file/stdin for a static token,\n')
-    ctx.stdout.write('         --org <name> to select an org, --no-browser to print the URL\n')
+    ctx.stdout.write('         --org <name> to select an org, --no-browser to print the URL,\n')
+    ctx.stdout.write('         --host <label> to override the forwarding host label (default: hostname)\n')
     return 0
   }
   ctx.stderr.write(`hyp remote: unknown subcommand '${argv[0]}'\n`)
@@ -89,11 +92,12 @@ export async function runRemoteAdd(argv, ctx) {
  * D8). Otherwise an interactive **browser** authorization-code flow runs
  * against the target's identity endpoint and stores an OIDC session. `--org`
  * selects an org; `--browser` forces the flow even with stdin piped;
- * `--no-browser` prints the URL instead of opening it.
+ * `--no-browser` prints the URL instead of opening it; `--host` overrides
+ * the advisory machine label sent with the token exchange (LLP 0061 D6).
  *
  * @param {string[]} argv
  * @param {CommandRunContext} ctx
- * @param {{ login?: typeof loginWithBrowser }} [deps] test seam for the browser flow
+ * @param {{ login?: typeof loginWithBrowser, seed?: typeof seedLoginGateway }} [deps] test seam for the browser flow + gateway seeding
  * @ref LLP 0058#d1 [implements]: browser mode of `hyp remote login`; one command, one store, one more way to populate it
  */
 export async function runRemoteLogin(argv, ctx, deps = {}) {
@@ -109,12 +113,18 @@ export async function runRemoteLogin(argv, ctx, deps = {}) {
     ctx.stderr.write('hyp remote login: --org expects an org name\n')
     return 2
   }
+  const hostArg = valueFlag(argv, '--host')
+  const host = hostArg.value
+  if (hostArg.present && !host) {
+    ctx.stderr.write('hyp remote login: --host expects a host label\n')
+    return 2
+  }
   // The target name is the first positional. Skip the VALUE slot of a
   // value-taking flag so e.g. `login --org acme` (name omitted) is not misread
   // as the target 'acme'.
-  const name = positionals(argv, new Set(['--token-file', '--org']))[0]
+  const name = positionals(argv, new Set(['--token-file', '--org', '--host']))[0]
   if (!name) {
-    ctx.stderr.write('usage: hyp remote login <name> [--token-file <path>] [--org <name>] [--no-browser]\n')
+    ctx.stderr.write('usage: hyp remote login <name> [--token-file <path>] [--org <name>] [--host <label>] [--no-browser]\n')
     return 2
   }
   const forceBrowser = argv.includes('--browser')
@@ -127,10 +137,13 @@ export async function runRemoteLogin(argv, ctx, deps = {}) {
   const useStatic = !!tokenFile || (stdinPiped && !forceBrowser && !noBrowser)
 
   if (useStatic) {
-    // --org only applies to the browser flow; say so rather than silently drop it.
+    // --org/--host only apply to the browser flow; say so rather than silently drop them.
     if (org) {
       ctx.stderr.write('note: --org is ignored with a static token (it applies to the browser login flow)\n')
     }
+    if (host) {
+      ctx.stderr.write('note: --host is ignored with a static token (it applies to the browser login flow)\n')
+    }
     return runStaticLogin(name, tokenFile, stdin, ctx)
   }
 
@@ -139,7 +152,10 @@ export async function runRemoteLogin(argv, ctx, deps = {}) {
   // as a static token. A piped token *without* a browser-mode flag already took
   // the static path above (`useStatic`), so nothing is swallowed silently there;
   // only an explicit `--no-browser` ignores a pipe, by design.
-  return runBrowserLogin(name, { org, noBrowser }, ctx, deps.login ?? loginWithBrowser)
+  return runBrowserLogin(name, { org, host, noBrowser }, ctx, {
+    login: deps.login ?? loginWithBrowser,
+    seed: deps.seed ?? seedLoginGateway,
+  })
 }
 
 /**
@@ -262,15 +278,17 @@ async function persistStaticToken(name, token, ctx) {
 /**
  * The browser authorization-code path (LLP 0058 D1/D6/D7). Derives the
  * identity base from the configured target URL's origin, runs the loopback
- * flow, and stores the resulting OIDC session.
+ * flow, and stores the resulting OIDC session. When the server also mints a
+ * login gateway (LLP 0061), the returned credential is seeded into the
+ * matching `central` forward sinks' persisted identity.
  *
  * @param {string} name
- * @param {{ org?: string, noBrowser: boolean }} opts
+ * @param {{ org?: string, host?: string, noBrowser: boolean }} opts
  * @param {CommandRunContext} ctx
- * @param {typeof loginWithBrowser} login
+ * @param {{ login: typeof loginWithBrowser, seed: typeof seedLoginGateway }} deps
  * @returns {Promise<number>}
  */
-async function runBrowserLogin(name, { org, noBrowser }, ctx, login) {
+async function runBrowserLogin(name, { org, host, noBrowser }, ctx, { login, seed }) {
   const remotes = await readConfiguredRemotes(ctx)
   const entry = remotes[name]
   if (!entry) {
@@ -291,6 +309,9 @@ async function runBrowserLogin(name, { org, noBrowser }, ctx, login) {
     session = await login({
       identityBase,
       org,
+      // The host label is advisory (server-side dedup + admin attribution,
+      // LLP 0061 D6): the machine hostname unless overridden with --host.
+      host: host ?? os.hostname(),
       noBrowser,
       print: (line) => ctx.stderr.write(`${line}\n`),
     })
@@ -318,6 +339,43 @@ async function runBrowserLogin(name, { org, noBrowser }, ctx, login) {
     return 1
   }
   ctx.stdout.write(`logged in to '${name}' as org '${session.org}' (session stored, mode 0600)\n`)
+
+  // One login, two credentials (LLP 0061 D1): the gateway credential, when the
+  // server minted one, seeds the matching central forward sinks so the user can
+  // forward without a bootstrap token. The query session above is already
+  // stored, so a seed failure is reported as exactly that - not a login failure.
+  // @ref LLP 0061#d1 [implements]: gateway credential routes to the forward store; the query record is untouched by it
+  if (session.gateway) {
+    /** @type {Awaited<ReturnType<typeof seedLoginGateway>>} */
+    let seeded
+    try {
+      seeded = await seed({
+        stateDir,
+        configPath: localConfigPath(ctx),
+        targetUrl: entry.url,
+        gateway: session.gateway,
+      })
+    } catch (err) {
+      ctx.stderr.write(`hyp remote login: signed in, but could not seed the forwarding credential: ${err instanceof Error ? err.message : String(err)}\n`)
+      return 1
+    }
+    if (seeded.length === 0) {
+      ctx.stderr.write(`note: the server issued a forwarding credential, but no '@hypaware/central' sink targets this server - configure one to forward logs\n`)
+    }
+    for (const s of seeded) {
+      ctx.stdout.write(`seeded forwarding identity for sink '${s.sink}' (gateway ${session.gateway.gatewayId})\n`)
+      // Never silent about a displaced identity (LLP 0061 D4). A re-login over a
+      // prior login seed for the same server is idempotent (the server dedups to
+      // the same gateway), so only a different provenance is worth a note.
+      if (s.replaced && !(s.replaced.origin === 'login' && s.replaced.central_url === s.centralUrl)) {
+        const provenance = s.replaced.origin === 'login' ? 'login-minted' : 'bootstrap-minted'
+        const from = s.replaced.central_url && s.replaced.central_url !== s.centralUrl
+          ? ` for ${s.replaced.central_url}`
+          : ''
+        ctx.stderr.write(`note: this replaced a ${provenance} gateway identity${from} (was gateway ${s.replaced.gateway_id})\n`)
+      }
+    }
+  }
   return 0
 }
 
diff --git a/src/core/remote/gateway_seed.js b/src/core/remote/gateway_seed.js
new file mode 100644
index 00000000..c7d1897f
--- /dev/null
+++ b/src/core/remote/gateway_seed.js
@@ -0,0 +1,204 @@
+// @ts-check
+
+import fs from 'node:fs'
+import path from 'node:path'
+import process from 'node:process'
+
+import { Attr, getLogger } from '../observability/index.js'
+import { resolveLayeredConfigFromDisk } from '../runtime/boot.js'
+
+/**
+ * Bridge from a login-minted gateway credential to the `central` forward
+ * sink's persisted identity (LLP 0061 D5). The login command and the sink
+ * run under the same `HYP_HOME`, so the seed is written directly where the
+ * sink's `IdentityClient.acquire()` reads it - no handoff protocol.
+ *
+ * The sink's forward-identity path is resolved config-driven, the same way
+ * the sink itself resolves it: each `@hypaware/central` sink block's
+ * `identity.persisted_path`, defaulting to the per-plugin state path
+ * `<stateDir>/plugins/@hypaware/central/identity.json` (LLP 0004). The
+ * effective config is the layered local+central merge the daemon runs, so
+ * a server-pushed sink block seeds the same file a locally-configured one
+ * does.
+ *
+ * @import { LoginGatewayCredential, SeededGateway } from '../../../src/core/remote/types.js'
+ * @import { PersistedIdentity } from '../../../hypaware-core/plugins-workspace/central/src/types.js'
+ */
+
+const CENTRAL_PLUGIN = '@hypaware/central'
+
+/**
+ * Seed every configured `central` forward sink that targets the logged-in
+ * server. A login `<target>` maps to forward sinks by URL **origin** - the
+ * same derivation that maps the target to its identity endpoints (LLP 0058
+ * D6) - so one login seeds exactly the sinks that forward to the server
+ * that minted the credential, and a second central target's sink is never
+ * touched. Paths are deduped: several instances sharing one persisted path
+ * (the per-plugin default) get one write.
+ *
+ * Returns the seeded sinks (empty when no central sink targets the origin);
+ * throws when a matched sink's seed cannot be written.
+ *
+ * @param {{
+ *   stateDir: string,
+ *   configPath: string | null,
+ *   targetUrl: string,
+ *   gateway: LoginGatewayCredential,
+ * }} args
+ * @returns {Promise<SeededGateway[]>}
+ * @ref LLP 0061#d5 [implements]: login resolves the sink's persistedPath from the target's central sink block and writes the seed where acquire() reads it
+ */
+export async function seedLoginGateway({ stateDir, configPath, targetUrl, gateway }) {
+  const log = getLogger('remote')
+  const origin = originOf(targetUrl)
+  if (!origin) return []
+  const { effective } = await resolveLayeredConfigFromDisk({ stateRoot: stateDir, configPath })
+  const sinks = effective?.sinks ?? {}
+
+  /** @type {SeededGateway[]} */
+  const seeded = []
+  const seenPaths = new Set()
+  for (const [name, entry] of Object.entries(sinks)) {
+    if (!entry || /** @type {any} */ (entry).plugin !== CENTRAL_PLUGIN) continue
+    const config = /** @type {Record<string, any>} */ (/** @type {any} */ (entry).config ?? {})
+    const centralUrl = typeof config.url === 'string' ? config.url : ''
+    if (originOf(centralUrl) !== origin) continue
+    const persistedPath = typeof config.identity?.persisted_path === 'string'
+      ? config.identity.persisted_path
+      : path.join(stateDir, 'plugins', CENTRAL_PLUGIN, 'identity.json')
+    if (seenPaths.has(persistedPath)) continue
+    seenPaths.add(persistedPath)
+    const { replaced } = writeLoginSeed({
+      persistedPath,
+      centralUrl,
+      jwt: gateway.jwt,
+      expiresAt: gateway.expiresAt,
+      gatewayId: gateway.gatewayId,
+    })
+    log.info('remote.gateway_seeded', {
+      [Attr.COMPONENT]: 'remote-oidc',
+      [Attr.OPERATION]: 'remote.gateway_seed',
+      [Attr.STATUS]: 'ok',
+      hyp_sink_instance: name,
+      gateway_id: gateway.gatewayId,
+      replaced_origin: replaced ? replaced.origin ?? 'bootstrap' : 'none',
+    })
+    seeded.push({ sink: name, persistedPath, centralUrl, ...(replaced ? { replaced } : {}) })
+  }
+  return seeded
+}
+
+/**
+ * Seed the sink's persisted identity from a login-minted gateway credential
+ * (LLP 0061 D2): the file `acquire()` already loads, pre-populated, so the
+ * sink skips `bootstrap()` and the unchanged refresh / 401-retry path carries
+ * the credential from there. Written with the same atomic 0600 discipline the
+ * sink uses for its own persistence, but from the login (producer) side of the
+ * package boundary - the sink (`hypaware-core`) only ever reads and refreshes
+ * this file, so `src` never imports a sink value to write it. Stamps
+ * `central_url` so the re-point guards apply to a login seed exactly as to a
+ * bootstrap mint (LLP 0061 D4), and `origin: 'login'` for the re-enrollment
+ * guard and diagnostics.
+ *
+ * The write always lands (the login is a fresh mint for this server, the same
+ * authority a re-bootstrap has), but never silently: the replaced identity is
+ * returned so the caller can report what the seed displaced - a prior login
+ * seed (idempotent: the server dedups to the same gateway), a bootstrap-minted
+ * identity, or a stale identity from another server.
+ *
+ * @param {{ persistedPath: string, centralUrl: string, jwt: string, expiresAt: number, gatewayId: string }} args
+ * @returns {{ replaced: PersistedIdentity | undefined }}
+ * @ref LLP 0061#d2 [implements]: a login seed is the persisted identity pre-populated; only the writer is new, the forward path is untouched
+ */
+export function writeLoginSeed({ persistedPath, centralUrl, jwt, expiresAt, gatewayId }) {
+  if (typeof jwt !== 'string' || jwt.length === 0) {
+    throw new Error('writeLoginSeed: jwt is required')
+  }
+  if (typeof expiresAt !== 'number' || !Number.isInteger(expiresAt) || expiresAt <= 0) {
+    throw new Error('writeLoginSeed: expiresAt must be a Unix epoch second')
+  }
+  if (typeof gatewayId !== 'string' || gatewayId.length === 0) {
+    throw new Error('writeLoginSeed: gatewayId is required')
+  }
+  if (typeof centralUrl !== 'string' || centralUrl.length === 0) {
+    throw new Error('writeLoginSeed: centralUrl is required')
+  }
+  // Read the current identity for the caller's report; a missing or corrupt
+  // file is simply no prior identity (the fresh mint supersedes it).
+  const replaced = readPersistedIdentity(persistedPath)
+  /** @type {PersistedIdentity} */
+  const identity = {
+    jwt,
+    expires_at: expiresAt,
+    gateway_id: gatewayId,
+    central_url: centralUrl,
+    origin: 'login',
+  }
+  writePersistedIdentity(persistedPath, identity)
+  return { replaced }
+}
+
+/**
+ * Read the persisted identity for the seed's replacement report. Mirrors the
+ * sink's read validation (LLP 0031 physical-layout), but leniently: a missing
+ * or malformed file counts as no prior identity rather than throwing, because
+ * this is only diagnostics for what the seed displaced.
+ *
+ * @param {string} filePath
+ * @returns {PersistedIdentity | undefined}
+ */
+function readPersistedIdentity(filePath) {
+  let parsed
+  try {
+    parsed = JSON.parse(fs.readFileSync(filePath, 'utf8'))
+  } catch {
+    return undefined
+  }
+  if (!parsed || typeof parsed !== 'object') return undefined
+  const { jwt, expires_at, gateway_id, central_url, bootstrap_token_fp, origin } = parsed
+  if (typeof jwt !== 'string' || jwt.length === 0) return undefined
+  if (typeof gateway_id !== 'string' || gateway_id.length === 0) return undefined
+  if (typeof expires_at !== 'number' || !Number.isInteger(expires_at)) return undefined
+  /** @type {PersistedIdentity} */
+  const identity = { jwt, expires_at, gateway_id }
+  if (typeof central_url === 'string') identity.central_url = central_url
+  if (typeof bootstrap_token_fp === 'string') identity.bootstrap_token_fp = bootstrap_token_fp
+  if (origin === 'login') identity.origin = origin
+  return identity
+}
+
+/**
+ * Atomic tmp+rename write at mode 0600, matching the sink's own persistence.
+ * The JWT is the gateway's only credential against the central server, so a
+ * crash mid-write must never leave a half-finished file in place.
+ *
+ * @param {string} filePath
+ * @param {PersistedIdentity} identity
+ */
+function writePersistedIdentity(filePath, identity) {
+  const dir = path.dirname(filePath)
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 })
+  const tmp = `${filePath}.tmp.${process.pid}.${Date.now()}`
+  fs.writeFileSync(tmp, JSON.stringify(identity, null, 2), { mode: 0o600 })
+  fs.renameSync(tmp, filePath)
+  try {
+    fs.chmodSync(filePath, 0o600)
+  } catch {
+    // best effort: rename already replaced the file
+  }
+}
+
+/**
+ * The URL's origin, or `null` when unparseable (an unparseable sink URL
+ * simply never matches; the sink's own validation reports it).
+ *
+ * @param {string} url
+ * @returns {string | null}
+ */
+function originOf(url) {
+  try {
+    return new URL(url).origin
+  } catch {
+    return null
+  }
+}
diff --git a/src/core/remote/identity_client.js b/src/core/remote/identity_client.js
index a3933595..b86b3e4e 100644
--- a/src/core/remote/identity_client.js
+++ b/src/core/remote/identity_client.js
@@ -15,7 +15,7 @@ import { Attr, getLogger } from '../observability/index.js'
  * ISO-based. The JWT is hypaware-server's own credential, so there is no
  * external JWKS trust on the client.
  *
- * @import { OidcSession, RefreshedAccess } from '../../../src/core/remote/types.js'
+ * @import { LoginGatewayCredential, OidcSession, RefreshedAccess } from '../../../src/core/remote/types.js'
  */
 
 /**
@@ -80,20 +80,50 @@ export function describeRefreshError(err, target) {
 
 /**
  * Exchange an authorization code for a session (the `authorization_code`
- * grant). Presents the held PKCE verifier.
+ * grant). Presents the held PKCE verifier. `host` is the advisory machine
+ * label the server folds into its login-gateway dedup key (LLP 0061 D6);
+ * it is omitted from the body when empty.
  *
- * @param {{ identityBase: string, code: string, codeVerifier: string, fetchImpl?: typeof fetch }} args
+ * @param {{ identityBase: string, code: string, codeVerifier: string, host?: string, fetchImpl?: typeof fetch }} args
  * @returns {Promise<OidcSession>}
  */
-export async function exchangeCode({ identityBase, code, codeVerifier, fetchImpl }) {
-  const body = { grant_type: 'authorization_code', code, code_verifier: codeVerifier }
+export async function exchangeCode({ identityBase, code, codeVerifier, host, fetchImpl }) {
+  const body = { grant_type: 'authorization_code', code, code_verifier: codeVerifier, ...(host ? { host } : {}) }
   const json = await postToken({ identityBase, body, fetchImpl, operation: 'remote.exchange_code' })
-  return {
+  /** @type {OidcSession} */
+  const session = {
     refreshToken: str(json.refresh_token, 'refresh_token'),
     accessJwt: str(json.access_jwt, 'access_jwt'),
     expiresAt: expiryTimestamp(json.expires_at, 'expires_at'),
     org: str(json.org, 'org'),
   }
+  const gateway = gatewayCredential(json)
+  if (gateway) session.gateway = gateway
+  return session
+}
+
+/**
+ * Read the login-minted gateway credential off a token response (LLP 0061
+ * D1). A server without login-gateway support omits all three `gateway_*`
+ * fields and the session simply carries no gateway; a *partial* set is a
+ * server contract violation and fails loudly, because silently dropping it
+ * would break forwarding with no visible cause. The fields stay out of the
+ * query-scoped record entirely; the login command routes them to the
+ * central sink's forward store.
+ *
+ * @param {Record<string, any>} json
+ * @returns {LoginGatewayCredential | undefined}
+ * @ref LLP 0061#d1 [implements]: capture the gateway_* triple off the authorization_code response; absent fields mean no gateway, partial fields fail loudly
+ */
+function gatewayCredential(json) {
+  if (json.gateway_jwt === undefined && json.gateway_expires_at === undefined && json.gateway_id === undefined) {
+    return undefined
+  }
+  return {
+    jwt: str(json.gateway_jwt, 'gateway_jwt'),
+    expiresAt: epochSecond(json.gateway_expires_at, 'gateway_expires_at'),
+    gatewayId: str(json.gateway_id, 'gateway_id'),
+  }
 }
 
 /**
@@ -253,6 +283,29 @@ function expiryTimestamp(v, field) {
   return s
 }
 
+/**
+ * Normalize an expiry to a Unix epoch second. The inverse framing of
+ * {@link expiryTimestamp}: the gateway credential seeds the central sink's
+ * persisted `identity.json`, whose `expires_at` is an integer epoch second,
+ * so here the epoch is the stored form and an ISO string (an older mock) is
+ * converted down to it.
+ *
+ * @param {unknown} v @param {string} field @returns {number}
+ */
+function epochSecond(v, field) {
+  if (typeof v === 'number') {
+    if (!Number.isFinite(v) || v <= 0) {
+      throw new Error(`identity response field '${field}' is not a valid timestamp`)
+    }
+    return Math.floor(v)
+  }
+  const ms = Date.parse(str(v, field))
+  if (Number.isNaN(ms)) {
+    throw new Error(`identity response field '${field}' is not a valid timestamp`)
+  }
+  return Math.floor(ms / 1000)
+}
+
 /**
  * Strip trailing slashes from an identity base so `${base}/token` never
  * double-slashes. Shared with the login orchestrator's start-URL builder.
diff --git a/src/core/remote/oidc_login.js b/src/core/remote/oidc_login.js
index dd37fb93..a66972e6 100644
--- a/src/core/remote/oidc_login.js
+++ b/src/core/remote/oidc_login.js
@@ -22,6 +22,7 @@ import { createPkcePair } from './pkce.js'
  * @param {{
  *   identityBase: string,
  *   org?: string,
+ *   host?: string,
  *   noBrowser?: boolean,
  *   openBrowser?: typeof defaultOpenBrowser,
  *   fetchImpl?: typeof fetch,
@@ -35,6 +36,7 @@ import { createPkcePair } from './pkce.js'
 export async function loginWithBrowser({
   identityBase,
   org,
+  host,
   noBrowser = false,
   openBrowser = defaultOpenBrowser,
   fetchImpl,
@@ -77,7 +79,7 @@ export async function loginWithBrowser({
     })
 
     const { code } = await receiver.waitForCode()
-    const session = await exchangeCode({ identityBase, code, codeVerifier: verifier, fetchImpl })
+    const session = await exchangeCode({ identityBase, code, codeVerifier: verifier, host, fetchImpl })
     log.info('remote.login_complete', {
       [Attr.COMPONENT]: 'remote-oidc',
       [Attr.OPERATION]: 'remote.login',
diff --git a/src/core/remote/types.d.ts b/src/core/remote/types.d.ts
index f2ccdc7c..f2fc1fec 100644
--- a/src/core/remote/types.d.ts
+++ b/src/core/remote/types.d.ts
@@ -4,6 +4,41 @@
  * specifier so the published declaration build resolves them identically.
  */
 
+import type { PersistedIdentity } from '../../../hypaware-core/plugins-workspace/central/src/types.js'
+
+/**
+ * One central forward sink seeded from a login-minted gateway credential
+ * (LLP 0061 D5). `replaced` is the persisted identity the seed displaced,
+ * when there was one, so the login command can report the replacement
+ * rather than clobbering silently (LLP 0061 D4).
+ */
+export interface SeededGateway {
+  /** Sink instance name in the effective config. */
+  sink: string
+  /** The persisted identity file the seed was written to. */
+  persistedPath: string
+  /** The sink's configured central URL, stamped into the seed. */
+  centralUrl: string
+  replaced?: PersistedIdentity
+}
+
+/**
+ * The login-minted gateway credential (LLP 0061 D1): a server that
+ * provisions a gateway on login returns it alongside the human session on
+ * the same `authorization_code` response. It is forward-scoped (the
+ * `central` sink's identity), never part of the query credential record.
+ */
+export interface LoginGatewayCredential {
+  jwt: string
+  /**
+   * Unix epoch second when the gateway JWT expires. Kept as an epoch (not
+   * ISO like `OidcSession.expiresAt`) because it seeds the central sink's
+   * persisted `identity.json`, whose `expires_at` is an epoch second.
+   */
+  expiresAt: number
+  gatewayId: string
+}
+
 /**
  * A full OIDC session, the result of the `authorization_code` grant. The
  * refresh token is long-lived and revocable; the access JWT is short-lived
@@ -16,6 +51,13 @@ export interface OidcSession {
   expiresAt: string
   /** The org hypaware-server resolved for this session. */
   org: string
+  /**
+   * The login-minted gateway credential, when the server provisions one
+   * (LLP 0061 D1). Absent against a server without login-gateway support.
+   * Routed to the forward store by the login command; never written into
+   * the query-scoped `oidc` record.
+   */
+  gateway?: LoginGatewayCredential
 }
 
 /** The result of the `refresh_token` grant: a fresh access JWT only. */
diff --git a/test/core/remote-identity-client.test.js b/test/core/remote-identity-client.test.js
index f0b2e2ac..cf8ba49b 100644
--- a/test/core/remote-identity-client.test.js
+++ b/test/core/remote-identity-client.test.js
@@ -44,6 +44,74 @@ test('exchangeCode posts the authorization_code grant and maps the response', as
   assert.deepEqual(JSON.parse(calls[0].init.body), { grant_type: 'authorization_code', code: 'auth-code', code_verifier: 'verifier-1' })
 })
 
+test('exchangeCode sends the host label with the authorization_code grant when given', async () => {
+  const { fetchImpl, calls } = stubFetch({
+    body: { refresh_token: 'rt-1', access_jwt: 'jwt-1', expires_at: '2026-06-29T12:00:00Z', org: 'acme' },
+  })
+  await exchangeCode({
+    identityBase: 'https://hyp.internal/v1/identity',
+    code: 'auth-code',
+    codeVerifier: 'verifier-1',
+    host: 'dev-laptop',
+    fetchImpl,
+  })
+  assert.equal(JSON.parse(calls[0].init.body).host, 'dev-laptop')
+})
+
+test('exchangeCode omits host from the body when none is given', async () => {
+  const { fetchImpl, calls } = stubFetch({
+    body: { refresh_token: 'rt-1', access_jwt: 'jwt-1', expires_at: '2026-06-29T12:00:00Z', org: 'acme' },
+  })
+  await exchangeCode({ identityBase: 'https://hyp.internal/v1/identity', code: 'c', codeVerifier: 'v', fetchImpl })
+  assert.ok(!('host' in JSON.parse(calls[0].init.body)))
+})
+
+test('exchangeCode captures the login-minted gateway credential (LLP 0061 D1)', async () => {
+  const gatewayExp = 1_820_000_000
+  const { fetchImpl } = stubFetch({
+    body: {
+      refresh_token: 'rt-1', access_jwt: 'jwt-1', expires_at: '2026-06-29T12:00:00Z', org: 'acme',
+      gateway_jwt: 'gw-jwt', gateway_expires_at: gatewayExp, gateway_id: 'gw-42',
+    },
+  })
+  const session = await exchangeCode({ identityBase: 'https://hyp.internal/v1/identity', code: 'c', codeVerifier: 'v', fetchImpl })
+  assert.deepEqual(session.gateway, { jwt: 'gw-jwt', expiresAt: gatewayExp, gatewayId: 'gw-42' })
+})
+
+test('exchangeCode against a server without login-gateway support carries no gateway', async () => {
+  const { fetchImpl } = stubFetch({
+    body: { refresh_token: 'rt-1', access_jwt: 'jwt-1', expires_at: '2026-06-29T12:00:00Z', org: 'acme' },
+  })
+  const session = await exchangeCode({ identityBase: 'https://hyp.internal/v1/identity', code: 'c', codeVerifier: 'v', fetchImpl })
+  assert.equal(session.gateway, undefined)
+})
+
+test('a partial gateway_* set is a contract violation, not a silent drop', async () => {
+  // Silently dropping a half-present gateway credential would break forwarding
+  // with no visible cause; a server that sends any of the triple must send all.
+  const { fetchImpl } = stubFetch({
+    body: {
+      refresh_token: 'rt-1', access_jwt: 'jwt-1', expires_at: '2026-06-29T12:00:00Z', org: 'acme',
+      gateway_jwt: 'gw-jwt', gateway_expires_at: 1_820_000_000,
+    },
+  })
+  await assert.rejects(
+    () => exchangeCode({ identityBase: 'https://hyp.internal/v1/identity', code: 'c', codeVerifier: 'v', fetchImpl }),
+    /missing 'gateway_id'/,
+  )
+})
+
+test('an ISO gateway_expires_at converts down to an epoch second (identity.json stores epochs)', async () => {
+  const { fetchImpl } = stubFetch({
+    body: {
+      refresh_token: 'rt-1', access_jwt: 'jwt-1', expires_at: '2026-06-29T12:00:00Z', org: 'acme',
+      gateway_jwt: 'gw-jwt', gateway_expires_at: '2027-07-01T00:00:30Z', gateway_id: 'gw-42',
+    },
+  })
+  const session = await exchangeCode({ identityBase: 'https://hyp.internal/v1/identity', code: 'c', codeVerifier: 'v', fetchImpl })
+  assert.equal(session.gateway?.expiresAt, Math.floor(Date.parse('2027-07-01T00:00:30Z') / 1000))
+})
+
 test('exchangeCode accepts the server epoch-second expires_at and normalizes it to ISO', async () => {
   // The server sends `expires_at` as a Unix epoch-second (the JWT `exp`); the
   // client stores an ISO string, so it must convert rather than reject.
diff --git a/test/core/remote-login-command.test.js b/test/core/remote-login-command.test.js
index f6c8dfb4..f5cd1a07 100644
--- a/test/core/remote-login-command.test.js
+++ b/test/core/remote-login-command.test.js
@@ -17,18 +17,21 @@ async function tmpHome() {
  * Build a ctx with a stub stdin (TTY by default so the browser path is the
  * default), captured streams, and a configured `prod` target written to a
  * real config file (the command resolves targets from the config file).
+ * `sinks` lands in the same config file, so gateway seeding resolves it the
+ * way the daemon would.
  *
- * @param {{ hypHome: string, stdin?: any, remotes?: any }} opts
+ * @param {{ hypHome: string, stdin?: any, remotes?: any, sinks?: any }} opts
  */
-async function makeCtx({ hypHome, stdin, remotes }) {
+async function makeCtx({ hypHome, stdin, remotes, sinks }) {
   /** @type {string[]} */ const out = []
   /** @type {string[]} */ const err = []
   const configPath = path.join(hypHome, 'config.json')
   const resolvedRemotes = remotes ?? { prod: { url: 'https://hyp.internal/mcp' } }
-  await fs.writeFile(configPath, JSON.stringify({ version: 2, query: { remotes: resolvedRemotes } }))
+  const config = { version: 2, query: { remotes: resolvedRemotes }, ...(sinks ? { sinks } : {}) }
+  await fs.writeFile(configPath, JSON.stringify(config))
   const ctx = /** @type {any} */ ({
     env: { HYP_HOME: hypHome, HYP_CONFIG: configPath },
-    config: { version: 2, query: { remotes: resolvedRemotes } },
+    config,
     stdin: stdin ?? { isTTY: true },
     stdout: { write: (/** @type {string} */ s) => out.push(s) },
     stderr: { write: (/** @type {string} */ s) => err.push(s) },
@@ -36,6 +39,14 @@ async function makeCtx({ hypHome, stdin, remotes }) {
   return { ctx, out, err }
 }
 
+/** An OidcSession carrying a login-minted gateway credential (LLP 0061). */
+function gatewaySession() {
+  return {
+    refreshToken: 'rt', accessJwt: 'jwt', expiresAt: '2999-01-01T00:00:00Z', org: 'acme',
+    gateway: { jwt: 'gw-jwt', expiresAt: 1_920_000_000, gatewayId: 'gw-1' },
+  }
+}
+
 test('deriveIdentityBase yields <origin>/v1/identity', () => {
   assert.equal(deriveIdentityBase('https://hyp.internal/mcp'), 'https://hyp.internal/v1/identity')
   assert.equal(deriveIdentityBase('https://hyp.internal:8443/a/b/mcp'), 'https://hyp.internal:8443/v1/identity')
@@ -111,6 +122,142 @@ test('--no-browser still uses browser mode when stdin is non-TTY', async () => {
   assert.equal(seen.noBrowser, true)
 })
 
+test('a login-minted gateway credential seeds the matching central sink (LLP 0061 D2/D5)', async () => {
+  const hypHome = await tmpHome()
+  const { ctx, out, err } = await makeCtx({
+    hypHome,
+    sinks: { fwd: { plugin: '@hypaware/central', config: { url: 'https://hyp.internal', identity: {} } } },
+  })
+  const login = /** @type {any} */ (async () => gatewaySession())
+
+  const code = await runRemoteLogin(['prod'], ctx, { login })
+  assert.equal(code, 0)
+  assert.match(out.join(''), /seeded forwarding identity for sink 'fwd' \(gateway gw-1\)/)
+  assert.doesNotMatch(err.join(''), /replaced/)
+
+  // The seed is the sink's persisted identity, at the per-plugin default path.
+  const persistedPath = path.join(hypHome, 'hypaware', 'plugins', '@hypaware/central', 'identity.json')
+  const persisted = JSON.parse(await fs.readFile(persistedPath, 'utf8'))
+  assert.deepEqual(persisted, {
+    jwt: 'gw-jwt',
+    expires_at: 1_920_000_000,
+    gateway_id: 'gw-1',
+    central_url: 'https://hyp.internal',
+    origin: 'login',
+  })
+
+  // Two scopes, two stores (D1): the query record carries no gateway fields.
+  const raw = await fs.readFile(path.join(hypHome, 'hypaware', 'remote-credentials.json'), 'utf8')
+  assert.ok(!raw.includes('gw-jwt'))
+  assert.ok(!raw.includes('gateway'))
+})
+
+test('a configured persisted_path is honored and non-matching central sinks are not seeded', async () => {
+  const hypHome = await tmpHome()
+  const seedPath = path.join(hypHome, 'custom-identity.json')
+  const otherPath = path.join(hypHome, 'other-identity.json')
+  const { ctx } = await makeCtx({
+    hypHome,
+    sinks: {
+      fwd: { plugin: '@hypaware/central', config: { url: 'https://hyp.internal', identity: { persisted_path: seedPath } } },
+      other: { plugin: '@hypaware/central', config: { url: 'https://elsewhere.example', identity: { persisted_path: otherPath } } },
+    },
+  })
+  const login = /** @type {any} */ (async () => gatewaySession())
+
+  const code = await runRemoteLogin(['prod'], ctx, { login })
+  assert.equal(code, 0)
+  const persisted = JSON.parse(await fs.readFile(seedPath, 'utf8'))
+  assert.equal(persisted.central_url, 'https://hyp.internal')
+  // The second central target's sink is never touched by this login.
+  await assert.rejects(fs.access(otherPath))
+})
+
+test('a gateway credential with no matching central sink notes the skip and still succeeds', async () => {
+  const hypHome = await tmpHome()
+  const { ctx, err } = await makeCtx({ hypHome })
+  const login = /** @type {any} */ (async () => gatewaySession())
+
+  const code = await runRemoteLogin(['prod'], ctx, { login })
+  assert.equal(code, 0)
+  assert.match(err.join(''), /no '@hypaware\/central' sink targets this server/)
+})
+
+test('a session without a gateway credential seeds nothing and prints no forwarding output', async () => {
+  const hypHome = await tmpHome()
+  const { ctx, out, err } = await makeCtx({
+    hypHome,
+    sinks: { fwd: { plugin: '@hypaware/central', config: { url: 'https://hyp.internal', identity: {} } } },
+  })
+  const login = /** @type {any} */ (async () => ({
+    refreshToken: 'rt', accessJwt: 'jwt', expiresAt: '2999-01-01T00:00:00Z', org: 'acme',
+  }))
+
+  const code = await runRemoteLogin(['prod'], ctx, { login })
+  assert.equal(code, 0)
+  assert.doesNotMatch(out.join(''), /forwarding/)
+  assert.doesNotMatch(err.join(''), /forwarding/)
+  const persistedPath = path.join(hypHome, 'hypaware', 'plugins', '@hypaware/central', 'identity.json')
+  await assert.rejects(fs.access(persistedPath))
+})
+
+test('replacing a bootstrap-minted identity is reported, never silent (LLP 0061 D4)', async () => {
+  const hypHome = await tmpHome()
+  const persistedPath = path.join(hypHome, 'identity.json')
+  await fs.writeFile(persistedPath, JSON.stringify({
+    jwt: 'old-jwt', expires_at: 1_910_000_000, gateway_id: 'gw-boot',
+    central_url: 'https://hyp.internal', bootstrap_token_fp: 'fp',
+  }))
+  const { ctx, err } = await makeCtx({
+    hypHome,
+    sinks: { fwd: { plugin: '@hypaware/central', config: { url: 'https://hyp.internal', identity: { persisted_path: persistedPath } } } },
+  })
+  const login = /** @type {any} */ (async () => gatewaySession())
+
+  const code = await runRemoteLogin(['prod'], ctx, { login })
+  assert.equal(code, 0)
+  assert.match(err.join(''), /replaced a bootstrap-minted gateway identity \(was gateway gw-boot\)/)
+})
+
+test('a seed write failure reports signed-in-but-not-seeded, not a login failure', async () => {
+  const hypHome = await tmpHome()
+  const { ctx, out, err } = await makeCtx({
+    hypHome,
+    sinks: { fwd: { plugin: '@hypaware/central', config: { url: 'https://hyp.internal', identity: {} } } },
+  })
+  const login = /** @type {any} */ (async () => gatewaySession())
+  const seed = /** @type {any} */ (async () => { throw new Error('disk is sad') })
+
+  const code = await runRemoteLogin(['prod'], ctx, { login, seed })
+  assert.equal(code, 1)
+  assert.match(out.join(''), /logged in to 'prod'/)
+  assert.match(err.join(''), /signed in, but could not seed the forwarding credential: disk is sad/)
+})
+
+test('the host label defaults to the machine hostname and --host overrides it (LLP 0061 D6)', async () => {
+  const hypHome = await tmpHome()
+  const { ctx } = await makeCtx({ hypHome })
+  /** @type {any} */ let seen
+  const login = /** @type {any} */ (async (/** @type {any} */ args) => {
+    seen = args
+    return { refreshToken: 'rt', accessJwt: 'jwt', expiresAt: '2999-01-01T00:00:00Z', org: 'acme' }
+  })
+
+  await runRemoteLogin(['prod'], ctx, { login })
+  assert.equal(seen.host, os.hostname())
+
+  await runRemoteLogin(['prod', '--host', 'lab-box'], ctx, { login })
+  assert.equal(seen.host, 'lab-box')
+})
+
+test('--host as the last arg with no value is a usage error', async () => {
+  const hypHome = await tmpHome()
+  const { ctx, err } = await makeCtx({ hypHome })
+  const code = await runRemoteLogin(['prod', '--host'], ctx, {})
+  assert.equal(code, 2)
+  assert.match(err.join(''), /--host expects a host label/)
+})
+
 test('a callback error maps to a clear org-selection message', async () => {
   const hypHome = await tmpHome()
   const { ctx, err } = await makeCtx({ hypHome })
diff --git a/test/plugins/central-identity-login-seed.test.js b/test/plugins/central-identity-login-seed.test.js
new file mode 100644
index 00000000..81e67cc2
--- /dev/null
+++ b/test/plugins/central-identity-login-seed.test.js
@@ -0,0 +1,155 @@
+// @ts-check
+
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+
+import { IdentityClient } from '../../hypaware-core/plugins-workspace/central/src/identity_client.js'
+import { writeLoginSeed } from '../../src/core/remote/gateway_seed.js'
+
+const DAY = 24 * 60 * 60
+
+/** Fixed wall clock so JWT lifetime math is deterministic. */
+const NOW_SEC = 1_900_000_000
+const now = () => NOW_SEC * 1000
+
+/**
+ * Minimal unsigned JWT carrying a `sub` claim, matching what the client
+ * decodes (never verifies) to recover the gateway id.
+ * @param {string} sub
+ */
+function fakeJwt(sub) {
+  const b64 = (/** @type {object} */ obj) =>
+    Buffer.from(JSON.stringify(obj)).toString('base64url')
+  return `${b64({ alg: 'none' })}.${b64({ sub })}.sig`
+}
+
+/** Fake central server counting bootstrap/refresh hits. */
+function makeFetch() {
+  const calls = { bootstrap: 0, refresh: 0 }
+  /** @type {typeof fetch} */
+  const fetchFn = async (url) => {
+    const u = String(url)
+    if (u.endsWith('/v1/identity/bootstrap')) {
+      calls.bootstrap += 1
+      return new Response(
+        JSON.stringify({ jwt: fakeJwt(`gw-boot-${calls.bootstrap}`), expires_at: NOW_SEC + 30 * DAY }),
+        { status: 200, headers: { 'content-type': 'application/json' } }
+      )
+    }
+    if (u.endsWith('/v1/identity/refresh')) {
+      calls.refresh += 1
+      return new Response(
+        JSON.stringify({ jwt: fakeJwt(`gw-refresh-${calls.refresh}`), expires_at: NOW_SEC + 60 * DAY }),
+        { status: 200, headers: { 'content-type': 'application/json' } }
+      )
+    }
+    return new Response('{"error":"not_found"}', { status: 404 })
+  }
+  return { fetchFn, calls }
+}
+
+function tmpIdentityPath() {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'hyp-login-seed-'))
+  return path.join(dir, 'identity.json')
+}
+
+/** @param {string} persistedPath */
+function seedArgs(persistedPath) {
+  return {
+    persistedPath,
+    centralUrl: 'https://central-a.example',
+    jwt: fakeJwt('gw-login'),
+    expiresAt: NOW_SEC + 30 * DAY,
+    gatewayId: 'gw-login',
+  }
+}
+
+test('writeLoginSeed writes a 0600 login-origin identity stamped with the central URL', () => {
+  const persistedPath = tmpIdentityPath()
+  const { replaced } = writeLoginSeed(seedArgs(persistedPath))
+  assert.equal(replaced, undefined)
+  const persisted = JSON.parse(fs.readFileSync(persistedPath, 'utf8'))
+  assert.equal(persisted.origin, 'login')
+  assert.equal(persisted.central_url, 'https://central-a.example')
+  assert.equal(persisted.gateway_id, 'gw-login')
+  assert.equal(persisted.expires_at, NOW_SEC + 30 * DAY)
+  assert.equal(persisted.bootstrap_token_fp, undefined)
+  assert.equal(fs.statSync(persistedPath).mode & 0o777, 0o600)
+})
+
+test('writeLoginSeed returns the identity it displaced', () => {
+  const persistedPath = tmpIdentityPath()
+  writeLoginSeed(seedArgs(persistedPath))
+  const again = writeLoginSeed({ ...seedArgs(persistedPath), gatewayId: 'gw-login-2', jwt: fakeJwt('gw-login-2') })
+  assert.equal(again.replaced?.gateway_id, 'gw-login')
+  assert.equal(again.replaced?.origin, 'login')
+})
+
+test('acquire() loads a login seed with no bootstrap token configured (LLP 0061 D2/D3)', async () => {
+  const persistedPath = tmpIdentityPath()
+  writeLoginSeed(seedArgs(persistedPath))
+  const { fetchFn, calls } = makeFetch()
+  const client = new IdentityClient({
+    centralUrl: 'https://central-a.example', persistedPath, fetchFn, now,
+  })
+  const source = await client.acquire()
+  assert.equal(source, 'loaded')
+  assert.equal(calls.bootstrap, 0)
+  assert.equal(await client.getCurrentJwt(), seedArgs(persistedPath).jwt)
+})
+
+test('a configured bootstrap token does not re-bootstrap over a same-URL login seed (LLP 0061 D3)', async () => {
+  // The login seed has no bootstrap_token_fp; without the origin exemption the
+  // mint-changed guard would read that as a swapped token and clobber the seed
+  // on every daemon start.
+  const persistedPath = tmpIdentityPath()
+  writeLoginSeed(seedArgs(persistedPath))
+  const { fetchFn, calls } = makeFetch()
+  const source = await new IdentityClient({
+    centralUrl: 'https://central-a.example', bootstrapToken: 'token-a', persistedPath, fetchFn, now,
+  }).acquire()
+  assert.equal(source, 'loaded')
+  assert.equal(calls.bootstrap, 0)
+})
+
+test('a login seed for a different URL still re-bootstraps when a token is configured (LLP 0061 D4)', async () => {
+  const persistedPath = tmpIdentityPath()
+  writeLoginSeed(seedArgs(persistedPath))
+  const { fetchFn, calls } = makeFetch()
+  const source = await new IdentityClient({
+    centralUrl: 'https://central-b.example', bootstrapToken: 'token-b', persistedPath, fetchFn, now,
+  }).acquire()
+  assert.equal(source, 'bootstrapped')
+  assert.equal(calls.bootstrap, 1)
+})
+
+test('a re-point with no token refuses a login seed and points at re-login, not hyp join', async () => {
+  const persistedPath = tmpIdentityPath()
+  writeLoginSeed(seedArgs(persistedPath))
+  const { fetchFn, calls } = makeFetch()
+  await assert.rejects(
+    new IdentityClient({ centralUrl: 'https://central-b.example', persistedPath, fetchFn, now }).acquire(),
+    /central URL mismatch.*hyp remote login/s
+  )
+  assert.equal(calls.bootstrap, 0)
+  assert.equal(calls.refresh, 0)
+})
+
+test('refresh preserves the login origin and central_url on the persisted identity', async () => {
+  const persistedPath = tmpIdentityPath()
+  // Expires inside the 24h refresh window, so acquire() refreshes immediately.
+  writeLoginSeed({ ...seedArgs(persistedPath), expiresAt: NOW_SEC + 60 * 60 })
+  const { fetchFn, calls } = makeFetch()
+  const source = await new IdentityClient({
+    centralUrl: 'https://central-a.example', persistedPath, fetchFn, now,
+  }).acquire()
+  assert.equal(source, 'refreshed')
+  assert.equal(calls.refresh, 1)
+  const persisted = JSON.parse(fs.readFileSync(persistedPath, 'utf8'))
+  assert.equal(persisted.origin, 'login')
+  assert.equal(persisted.central_url, 'https://central-a.example')
+  assert.equal(persisted.gateway_id, 'gw-refresh-1')
+})