diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json
index e0adbbe..2b01083 100644
--- a/.claude-plugin/marketplace.json
+++ b/.claude-plugin/marketplace.json
@@ -18,7 +18,7 @@
       "name": "work-system",
       "source": "./plugins/work-system",
       "description": "Generic task and worktree workflow system for Claude Code. Manage tasks as markdown files, work in isolated git worktrees, and track progress through the full lifecycle.",
-      "version": "1.8.0"
+      "version": "1.8.1"
     },
     {
       "name": "pr-flow",
diff --git a/.claude/knowledge/_index.md b/.claude/knowledge/_index.md
index e4e9e89..9b63ae1 100644
--- a/.claude/knowledge/_index.md
+++ b/.claude/knowledge/_index.md
@@ -12,7 +12,7 @@
 - `features/statusline-integration.md` — Status-line segments: plugins can't own `statusLine.command`; marker-block injection; the `[ks …]` + `[ws …]` two-segment coexistence and ws's never-block-on-network PR cache
 - `features/herdr-kickoff-automation.md` — herdr `herdr-launch.sh`: `launch` (`/kickoff`) + `resume` (`/continue <task>` reopens an `/exit`-closed tab)
 - `features/herdr-close-automation.md` — `/close` in herdr: cwd-tab teardown, plugin SessionEnd hook, the one TUI-exit primitive, detached self-exit onto idle
-- `features/herdr-tab-glyphs.md` — Task-state glyphs (`○ ● ◇ ◆ ✓`) on herdr tab names: `states` mode inside the self-contained renderer (no sibling), sync-vs-`--cached` PR refresh per caller, exact-cwd rename rules, soft pr-flow shim
+- `features/herdr-tab-glyphs.md` — Task-state glyphs (`○ ● ◇ ◆ ✓`) + main-root `◉` on herdr tab labels: `states` mode in the self-contained renderer, sync-vs-`--cached` PR refresh per caller, exact-cwd rename rules, soft pr-flow shim
 - `features/task-archiving-on-close.md` — `/close` archives (not deletes) the task file; adaptive commit + ff-push to main
 - `features/swarm-backend-adapter.md` — Verified codex/grok CLI facts (schema-enforced JSON, effort mapping, stdin hang, model-aware grok readiness) behind `swarm`'s adapter script
 - `features/swarm-review-pipeline.md` — `/swarm:review` P2 pipeline (skill↔Workflow wiring, family-consensus, minimal security) + P5 `--fix`/`--loop` (in-session orchestration between workflow runs; deterministic termination + close-out box in `loop-closeout.py`) + `--pr` (review a PR diff, post via `gh` under the user's identity so pr-flow's `claude`-author poll ignores it; publish path is deterministic `pr-post.py`: per-cell sanitizer + stale-head gate + post)
diff --git a/.claude/knowledge/features/herdr-tab-glyphs.md b/.claude/knowledge/features/herdr-tab-glyphs.md
index e399ef2..047f587 100644
--- a/.claude/knowledge/features/herdr-tab-glyphs.md
+++ b/.claude/knowledge/features/herdr-tab-glyphs.md
@@ -8,10 +8,13 @@ prime: false
 
 # herdr Tab State Glyphs
 
-work-system prefixes each task tab's herdr agent name with the task's state
+work-system prefixes each task tab's herdr **tab label** with the task's state
 glyph (`○` not-started · `●` active · `◇` in review · `◆` approved · `✓`
 merged), so the sidebar mirrors the `[ws …]` statusline (e.g. `● close-herdr`,
-`◇ ks-label`, `◆ ready-pr`). `◆` (open PR whose `reviewDecision == APPROVED`,
+`◇ ks-label`, `◆ ready-pr`). A tab at the **main repo root** gets `◉` — the
+Manager hub among the task satellites (`○` was rejected: it already means
+not-started). `◉` is stateless and non-exclusive: it marks the *location*, so
+every tab at the main root carries it. `◆` (open PR whose `reviewDecision == APPROVED`,
 ready to `/merge`) is the one state needing a second `gh` field beyond
 `state`: the PR cache carries `headRef\tstate\treviewDecision`, and an old
 two-column cache row degrades safely to `◇` (empty field 3 is never `APPROVED`).
@@ -25,7 +28,7 @@ surfaces source — is **blocked by the renderer's self-containment contract**:
 in the same file*: `ws-statusline.sh states <dir>` prints
 `<task>\t<state>\t<glyph>` per backlog task from the very `task_state()` /
 `glyph_of()` functions the render path aggregates. One file — the surfaces
-cannot drift. `herdr-tab-glyph.sh` only *applies* the result to agent names.
+cannot drift. `herdr-tab-glyph.sh` only *applies* the result to the tab label.
 
 ## Sync vs cache-only PR refresh
 
@@ -55,20 +58,55 @@ was shipped and caught in review.
 
 ## Renamer rules (herdr-tab-glyph.sh)
 
-- **Trigger points:** stamped at launch (`herdr-launch.sh prefix`, both modes —
-  the Claude *session name* stays plain; glyphs would clutter `/resume`);
-  re-stamped by `refresh` on `/status`, `/list`, `/close` (remaining tabs, main-repo
-  path — `$PWD` may be the just-removed worktree) and pr-flow's `/open`,
-  `/merge`, `/cycle`, `/check`.
-- **Matching:** exact realpath equality `agent.cwd == <main>/.claude/worktrees/<task>`
-  (same philosophy as `herdr-teardown.sh`): an unrelated agent cd'd into a
-  worktree subdir is never renamed; agents outside task worktrees are never
-  touched. Rename targets the `pane_id`; `herdr agent list` exposes `cwd`,
-  `name`, `pane_id` per agent (verified live 2026-07-16).
+- **The glyph lives in the TAB LABEL — one namespace, and it is not the obvious
+  one.** herdr has two independent names per tab: `tab rename <tab_id> <label>`
+  and `agent rename <pane_id> <name>` (the agent registry's own field, which
+  other tooling owns elsewhere). **The sidebar renders the label.** 1.8.0 shipped
+  `refresh` writing the *agent name* — invisible, so every re-stamp silently did
+  nothing and only the launch-time label survived (a task tab sat at `●` while
+  its PR was long in review). Fixed in 1.8.1: `refresh` writes the label, and
+  `herdr-launch.sh` passes the glyph *only* to `--label`, keeping the agent and
+  `claude -n` session names plain — those are stable identities, and nothing
+  refreshes them, so a glyph there would freeze at its launch value.
+- **Trigger points:** stamped at launch (`herdr-launch.sh` → `prefix`, both
+  modes); re-stamped by `refresh` on `/status`, `/list`, `/close` (remaining tabs,
+  main-repo path — `$PWD` may be the just-removed worktree) and pr-flow's
+  `/open`, `/merge`, `/cycle`, `/check`.
+- **Matching:** exact realpath equality against `<main>/.claude/worktrees/<task>`
+  (→ state glyph) or the main repo root itself (→ `◉`) — same philosophy as
+  `herdr-teardown.sh`: an agent cd'd into a *subdir* of either is never renamed,
+  and anything outside the repo never is. `◉` needs no new trigger — the same
+  `refresh` sweep stamps both. The match needs **both** herdr lists joined on
+  `tab_id`: only agents carry `cwd` (the match key), only tabs carry `label`
+  (what we stamp). One tab is stamped once (first matching agent wins — a
+  mixed-cwd multi-pane tab would otherwise flip-flop each refresh). The join is
+  the tab list passed **by file path** (not an argv element): the JSON can be
+  hundreds of KB and would blow ARG_MAX/E2BIG, a failure `|| true` would mask as
+  `checked=0`. **Caveat (accepted):** only *agent-backed* tabs are reachable —
+  `cwd` has no other source than `herdr agent list`, so a main-root tab that is a
+  bare shell (no agent) can't be matched and won't get `◉`. In practice a Manager
+  tab is a Claude session, so it is agent-backed; a plain terminal at the root is
+  not a Manager session.
+- **`◉` is stateless — never gated on the backlog.** The main-root mark is a
+  location mark, so `refresh` does NOT early-return on an empty `states` (no
+  tasks): it stamps `◉` on main-root tabs regardless, and only the per-task
+  `glyph_lookup` finds nothing to do. Coupling `◉` to a non-empty backlog was a
+  latent bug (the early-return predated `◉` and it inherited the gate) that also
+  contradicted the README/CHANGELOG "every main-root tab carries it" promise.
 - **Idempotency:** leading glyphs are stripped before re-prefixing via
   byte-exact `case "○ "*` patterns — a bracket expression (`[○●◇✓]`) would
-  match per *byte* for multibyte chars under C locale. Renames are only issued
-  when the name actually changes. Everything is best-effort exit-0.
+  match per *byte* for multibyte chars under C locale. The strip set includes
+  `◉`, so a tab moving between the hub and a worktree swaps glyphs cleanly.
+  Renames are only issued when the name actually changes. Everything is
+  best-effort exit-0.
+- **The extractor's TSV must never have an empty middle field.** The consumer
+  reads it with `IFS=$'\t' read -r …`, and tab is IFS *whitespace* — bash
+  collapses a run of tabs into ONE delimiter, so an empty field silently
+  shifts every later field left. Adding the `kind` column bit exactly here: a
+  main-root row emitted an empty `task`, and the agent's *name* slid into it
+  (`◉ Manager` → `◉ claude-plugins`). Hence the `key` column carries the task
+  name **or** the repo dir name — never nothing. A non-whitespace delimiter
+  (`\x1f`) would also work; non-empty fields were the smaller change.
 
 ## pr-flow coupling stays soft
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 41d9140..6947efe 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -52,6 +52,11 @@ entries are grouped per plugin, newest first.
 
 ## work-system
 
+### 1.8.1 — 2026-07-17
+- Mark the main-repo session in the herdr sidebar: a tab sitting exactly at the main repo root is now prefixed with `◉` — the Manager hub among the `○ ● ◇ ◆ ✓` task satellites. Stateless and non-exclusive (it marks the location, so every tab at the root gets it), stamped by the existing `refresh` sweep — no new trigger. The chosen tab label is preserved (prefix only) and `◉` joins the idempotency strip, so hub↔task moves swap glyphs cleanly.
+- Fix: state-glyph refreshes never reached the sidebar. herdr keeps two names per tab — the tab label (what the sidebar renders) and the agent registry's own name — and 1.8.0's `refresh` rewrote the latter, so a tab kept its launch-time glyph forever (a task sat at `●` while its PR was in review). `refresh` now rewrites the tab label, joining `herdr agent list` (carries `cwd`) with `herdr tab list` (carries `label`).
+- The glyph now lives in the tab label only: `/kickoff` passes the plain label to `herdr agent start` and `claude -n`, so the agent and session names stay stable identities instead of freezing a launch-time glyph. Existing tabs correct themselves on the next refresh; agent names stamped by 1.8.0 are left as-is (rename them yourself if the leftover glyph bothers you).
+
 ### 1.8.0 — 2026-07-16
 - Mirror task states onto herdr tab names as a leading state glyph (`○ ● ◇ ◆ ✓`: not-started / active / in-review / approved / merged), matching the `[ws …]` statusline. The mapping + precedence stay in `ws-statusline.sh` (new `states` mode, single source of truth); the new `herdr-tab-glyph.sh` stamps the glyph at launch (`/kickoff`, `/continue`) and re-stamps it idempotently on `/status`, `/list`, and `/close` (and via pr-flow's PR-lifecycle skills). `◆` approved is derived from the PR's `reviewDecision`. Survey surfaces (`/status`, `/list`, `/check`, `/close`) read the PR cache without blocking; state-changing skills (`/open`, `/merge`, `/cycle`) do a bounded synchronous refresh.
 
diff --git a/plugins/work-system/.claude-plugin/plugin.json b/plugins/work-system/.claude-plugin/plugin.json
index aee3d11..ec2eb64 100644
--- a/plugins/work-system/.claude-plugin/plugin.json
+++ b/plugins/work-system/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "name": "work-system",
   "description": "Generic task and worktree workflow system for Claude Code. Manage tasks as markdown files, work in isolated git worktrees, and track progress through the full lifecycle: create, start, continue, check, close.",
-  "version": "1.8.0",
+  "version": "1.8.1",
   "author": {
     "name": "gering"
   },
diff --git a/plugins/work-system/README.md b/plugins/work-system/README.md
index 450f003..de0e617 100644
--- a/plugins/work-system/README.md
+++ b/plugins/work-system/README.md
@@ -221,9 +221,14 @@ both surfaces speak one visual language (e.g. `● close-herdr`, `◇ ks-label`,
 - `○` not-started · `●` active (worktree) · `◇` in review (PR open) ·
   `◆` approved (PR review APPROVED — ready to `/merge`) · `✓` merged.
 
+A session sitting in the **main repo root** — the hub you kick tasks off from —
+gets `◉` instead (e.g. `◉ Manager`), so the sidebar reads as one hub plus its
+task satellites. `◉` marks the *location*, not an identity: every tab at the
+main root carries it. It is stateless — the state glyphs belong to tasks.
+
 The mapping and its precedence live in `scripts/ws-statusline.sh` (a `states`
 mode next to the render mode — one file, so sidebar and statusline can never
-disagree); `scripts/herdr-tab-glyph.sh` applies it to herdr agent names.
+disagree); `scripts/herdr-tab-glyph.sh` applies it to the herdr tab label.
 
 The glyph is stamped when `/kickoff` or `/continue` opens the tab, and
 re-stamped — idempotently, only when it changed — whenever you survey or move
@@ -233,8 +238,13 @@ same refresh, so `●` flips to `◇` when the PR opens, to `◆` when it is app
 and to `✓` when it merges. Survey surfaces (`/status`, `/list`, `/check`,
 `/close`) read the PR cache and never block; the state-changing skills (`/open`,
 `/merge`, `/cycle`) do a bounded synchronous `gh` refresh so the new state shows
-at once. Agents outside task worktrees are never renamed; outside herdr
-everything is a silent no-op.
+at once. The same refreshes stamp `◉` on the main-root tabs — no separate
+trigger. Only tabs sitting *exactly* at a task worktree or the main root are
+renamed (one cd into a subdir and yours is left alone); a tab is renamed only
+when its label actually changes, your chosen label is kept and merely prefixed,
+and outside herdr everything is a silent no-op. The glyph lives in the **tab
+label** and nowhere else — the herdr agent name and the `claude -n` session name
+keep the plain label, since those are stable identities.
 
 ## Adopting Existing Branches
 
diff --git a/plugins/work-system/scripts/herdr-launch.sh b/plugins/work-system/scripts/herdr-launch.sh
index b9309dd..798c73d 100755
--- a/plugins/work-system/scripts/herdr-launch.sh
+++ b/plugins/work-system/scripts/herdr-launch.sh
@@ -27,7 +27,9 @@
 #   herdr-launch.sh resume <label> <worktree-abs-path> <workspace-id>
 #     label         short, sidebar-friendly agent/tab name (e.g. close-herdr).
 #                   Pass it PLAIN — this helper prefixes the task's state glyph
-#                   (○ ● ◇ ✓, via herdr-tab-glyph.sh) itself, best-effort.
+#                   (○ ● ◇ ◆ ✓, via herdr-tab-glyph.sh) itself, best-effort,
+#                   onto the TAB LABEL only; the agent and session names keep
+#                   the plain label (see the stamping block below).
 #     worktree      absolute path to the worktree (becomes the new pane's cwd)
 #     workspace-id  herdr workspace to open the tab in (e.g. $HERDR_WORKSPACE_ID)
 #     session-name  (launch only) `claude -n` name; defaults to <label>
@@ -86,15 +88,21 @@ command -v python3 >/dev/null 2>&1 || { echo "python3 not on PATH" >&2; exit 1;
 }
 [ -d "$worktree" ] || { echo "worktree dir not found: $worktree" >&2; exit 1; }
 
-# Stamp the task's CURRENT state glyph onto the sidebar label (○ ● ◇ ✓ — the
+# Stamp the task's CURRENT state glyph onto the sidebar label (○ ● ◇ ◆ ✓ — the
 # same mapping the [ws …] statusline renders; ws-statusline.sh is the single
 # source, applied via herdr-tab-glyph.sh). Best-effort: any failure keeps the
-# plain label. The Claude session name (launch mode) was already defaulted from
-# the PLAIN label above — glyphs would clutter /resume.
+# plain label.
+#
+# ONLY the TAB LABEL carries a glyph — `$label` stays plain for everything else.
+# The tab label is what the sidebar renders and what `herdr-tab-glyph.sh refresh`
+# keeps current as the task's state moves. The herdr *agent* name (`agent start
+# <name>`) and the Claude session name are stable identities: a glyph there would
+# freeze at its launch-time value (nothing refreshes them) and clutter /resume.
+tab_label="$label"
 glyph_helper="${0%/*}/herdr-tab-glyph.sh"
 if [ -f "$glyph_helper" ]; then
   stamped="$(bash "$glyph_helper" prefix "$label" "$worktree" 2>/dev/null || true)"
-  [ -n "$stamped" ] && label="$stamped"
+  [ -n "$stamped" ] && tab_label="$stamped"
 fi
 
 # JSON extractors. null / missing / malformed all yield empty, and a stray
@@ -138,7 +146,7 @@ case "$mode" in
     # Relocate the agent into its own background tab (agent start splits the
     # caller's tab). If the move fails, Claude is still running — report it in
     # place rather than claiming a tab that does not exist.
-    if move_json="$(herdr pane move "$pane" --new-tab --label "$label" --no-focus 2>/dev/null)"; then
+    if move_json="$(herdr pane move "$pane" --new-tab --label "$tab_label" --no-focus 2>/dev/null)"; then
       tab="$(printf '%s' "$move_json" | python3 -c "$extract_moved_tab" 2>/dev/null || true)"
       printf 'pane=%s\ntab=%s\nmoved=yes\n' "$pane" "$tab"
     else
@@ -197,7 +205,7 @@ case "$mode" in
     # empty pane id (with a present tab id) stays empty and trips the guard below,
     # rather than the tab id being mis-read as the pane id.
     create_json="$(herdr tab create --workspace "$workspace" \
-      --cwd "$worktree" --label "$label" 2>/dev/null || true)"
+      --cwd "$worktree" --label "$tab_label" 2>/dev/null || true)"
     pane_tab="$(printf '%s' "$create_json" | python3 -c "$extract_root_pane_tab" 2>/dev/null || true)"
     pane="${pane_tab%%|*}"
     tab="${pane_tab#*|}"
diff --git a/plugins/work-system/scripts/herdr-tab-glyph.sh b/plugins/work-system/scripts/herdr-tab-glyph.sh
index 77aa76b..55d4a62 100755
--- a/plugins/work-system/scripts/herdr-tab-glyph.sh
+++ b/plugins/work-system/scripts/herdr-tab-glyph.sh
@@ -1,16 +1,21 @@
 #!/usr/bin/env bash
-# herdr-tab-glyph.sh — mirror work-system task states onto herdr tab/agent
-# names as a leading state glyph (○ not-started · ● active · ◇ in review ·
+# herdr-tab-glyph.sh — mirror work-system task states onto herdr tab labels
+# as a leading state glyph (○ not-started · ● active · ◇ in review ·
 # ◆ approved · ✓ merged), so the herdr sidebar speaks the same visual language
-# as the [ws …] status-line segment.
+# as the [ws …] status-line segment. A session sitting in the MAIN repo root
+# instead gets ◉ — the "Manager" hub among the task satellites. ◉ marks the
+# location, not an identity: if several tabs sit at the main root, they ALL
+# carry it.
 #
 # The state→glyph mapping and its precedence live in ws-statusline.sh
 # (`states` mode) — the ONE source both surfaces read; this script only
-# applies the result to herdr agent names. Everything is best-effort: prefix
-# and refresh exit 0 and degrade silently when they cannot act (outside a
-# herdr session, no herdr/python3, herdr unreachable, not a git repo, no
-# backlog) — callers are launch paths and skill triggers that must never fail
-# on cosmetics.
+# applies the result to herdr tab labels (never the agent name — see ONE
+# NAMESPACE below). Everything is best-effort: prefix and refresh exit 0 and
+# degrade silently when they cannot act (outside a herdr session, no
+# herdr/python3, herdr unreachable, not a git repo) — callers are launch paths
+# and skill triggers that must never fail on cosmetics. An empty backlog is NOT
+# a degrade condition for refresh: the main-root ◉ is stateless, so it stamps
+# even with zero tasks (only the per-task glyphs have nothing to do).
 #
 # Subcommands:
 #   prefix <label> <worktree-abs-path>
@@ -20,17 +25,27 @@
 #       (idempotent, re-runs never stack) and prints the plain label when the
 #       state cannot be resolved. Always exits 0.
 #   refresh [--cached] [<dir>]
-#       Re-stamp the glyph on every herdr agent whose cwd IS a task worktree
-#       of the repo containing <dir> (default: $PWD) — exact realpath match on
-#       <main>/.claude/worktrees/<task>, across ALL workspaces of this herdr
-#       server, so one refresh fixes every open task tab of the repo. Agents
-#       outside task worktrees are never touched; a rename is only issued when
-#       the name actually changes. Prints `checked=N updated=M` when herdr was
-#       reachable; silent no-op otherwise. Always exits 0.
+#       Re-stamp the glyph on the LABEL of every herdr tab whose agent cwd IS a
+#       task worktree of the repo containing <dir> (default: $PWD) — exact
+#       realpath match on <main>/.claude/worktrees/<task> — or IS the main repo
+#       root itself (→ ◉), across ALL workspaces of this herdr server, so one
+#       refresh fixes every open tab of the repo. Both matches are exact: an
+#       agent merely cd'd into a subdir of either is never touched, nor is
+#       anything outside the repo. A rename is only issued when the label
+#       actually changes. Prints `checked=N updated=M` when herdr was reachable;
+#       silent no-op otherwise. A repo with an empty backlog still stamps ◉ on
+#       its main-root tabs (the mark is stateless); only the per-task glyphs have
+#       nothing to do. Always exits 0.
 #       --cached forwards to `ws-statusline.sh states --cached` (read the PR
 #       cache + non-blocking background refresh, never a synchronous gh call) —
 #       for pure-survey callers (/status, /list, /check, /close). Without it the
 #       state is refreshed synchronously, for callers reacting to a PR change.
+#
+# ONE NAMESPACE: the sidebar renders a tab's LABEL, so both the launch-time
+# stamp (herdr-launch.sh, via `prefix`) and this refresh write the label and
+# nothing else. A herdr *agent* also has a `name` — a different field, in
+# herdr's agent registry, which other tooling owns. Never write it: 1.8.0's
+# refresh did, which is why it silently never showed up in the sidebar.
 set -u
 
 SCRIPT_DIR="${0%/*}"
@@ -42,7 +57,7 @@ strip_glyph() {
   local l="$1"
   while :; do
     case "$l" in
-      "○ "*|"● "*|"◇ "*|"◆ "*|"✓ "*) l="${l#* }" ;;
+      "○ "*|"● "*|"◇ "*|"◆ "*|"✓ "*|"◉ "*) l="${l#* }" ;;
       *) break ;;
     esac
   done
@@ -64,40 +79,76 @@ task_glyph() {
   bash "$ws" states "$2" 2>/dev/null | glyph_lookup "$1"
 }
 
-# Emit "pane_id\ttask\tcurrent_name" for every agent whose realpath(cwd) is
-# EXACTLY <main>/.claude/worktrees/<task> (argv[1] = main repo path). Exact
-# match mirrors herdr-teardown.sh's cwd philosophy: an unrelated agent merely
-# cd'd into a worktree subdir is never renamed. Malformed JSON emits nothing.
-# The agent fields are UNTRUSTED (any tool in the session can set a name): a
-# tab/newline embedded in a field would forge extra TSV records and aim a
-# rename at an arbitrary pane — so the pane id must match herdr shape, a task
-# name that would break the framing is skipped, and the free-form name is
-# scrubbed (it is display data; a space is a faithful stand-in). The pane
-# pattern forbids a LEADING dash (first char excludes `-`) so a value like
-# `-x`/`--foo` can never reach `herdr agent rename` as an option flag; herdr
-# ids are `wN:pM` and never start with a dash, so nothing legitimate is lost.
-extract_task_agents='import sys, json, os, re
+# Emit "tab_id\tkind\tkey\tcurrent_label" for every TAB whose agent cwd is
+# EXACTLY <main>/.claude/worktrees/<task> (kind=task, key=<task>) or EXACTLY the
+# main repo root (kind=main, key=the repo dir name). argv[1] = main repo path,
+# argv[2] = `herdr tab list` JSON; stdin = `herdr agent list` JSON. Exact match
+# mirrors herdr-teardown.sh's cwd philosophy: an agent merely cd'd into a subdir
+# of either is never renamed. `key` doubles as the label fallback for an
+# unlabelled tab. Malformed JSON emits nothing.
+#
+# THE SIDEBAR RENDERS THE TAB LABEL, NOT THE AGENT NAME — the two are separate
+# herdr namespaces (`tab rename <tab_id>` vs `agent rename <pane_id>`). We join
+# the two lists because only agents carry `cwd` (the match) while only tabs
+# carry `label` (what we prefix and diff against). Renaming agents instead is
+# invisible; that was the 1.8.0 bug.
+#
+# A tab is emitted ONCE (first matching agent wins). A tab whose panes sit in
+# *different* matching dirs would otherwise flip-flop each refresh; first-wins
+# is stable given herdr's stable agent order — an accepted residual for that
+# rare mixed-pane tab.
+#
+# The agent/tab fields are UNTRUSTED (any tool in the session can set them): a
+# tab/newline embedded in a field would forge extra TSV records and aim a rename
+# at an arbitrary tab — so the tab id must match herdr shape, a task name that
+# would break the framing is skipped, and the free-form label is scrubbed (it is
+# display data; a space is a faithful stand-in). The id pattern forbids a LEADING
+# dash (first char excludes `-`) so a value like `-x`/`--foo` can never reach
+# `herdr tab rename` as an option flag; herdr ids are `wN:tM` and never start
+# with a dash, so nothing legitimate is lost.
+extract_glyph_tabs='import sys, json, os, re
 main = sys.argv[1] if len(sys.argv) > 1 else ""
 if not main.strip():
     sys.exit(0)
-wtdir = os.path.join(os.path.realpath(main), ".claude", "worktrees")
+root = os.path.realpath(main)
+# realpath the whole worktrees path, not just root: cwd is resolved below, so a
+# symlinked .claude/worktrees would otherwise never match (dirname of the resolved
+# cwd follows the symlink, an unresolved wtdir does not) and task tabs would freeze.
+wtdir = os.path.realpath(os.path.join(root, ".claude", "worktrees"))
 try:
     agents = json.load(sys.stdin)["result"]["agents"]
 except Exception:
     sys.exit(0)
+# argv[2] is a FILE PATH, not the JSON itself: `herdr tab list` can be hundreds
+# of KB on a big server, and passing it as an argv element would blow ARG_MAX
+# (E2BIG) — the exec would fail, the caller `|| true` would mask it, and refresh
+# would misreport `checked=0` while herdr is up. A short path never triggers that.
+try:
+    with open(sys.argv[2]) as fh:
+        tabs = json.load(fh)["result"]["tabs"]
+except Exception:
+    sys.exit(0)
+labels = {t.get("tab_id"): (t.get("label") or "") for t in tabs}
+seen = set()
 for a in agents:
     cwd = (a.get("cwd") or "").rstrip("/")
-    pane = a.get("pane_id") or ""
-    if not cwd or not re.fullmatch(r"[A-Za-z0-9:_.][A-Za-z0-9:_.-]*", pane):
+    tab = a.get("tab_id") or ""
+    if not cwd or tab in seen:
+        continue
+    if not re.fullmatch(r"[A-Za-z0-9:_.][A-Za-z0-9:_.-]*", tab) or tab not in labels:
         continue
     cwd = os.path.realpath(cwd)
-    if os.path.dirname(cwd) != wtdir:
+    if cwd == root:
+        kind, key = "main", os.path.basename(root)
+    elif os.path.dirname(cwd) == wtdir:
+        kind, key = "task", os.path.basename(cwd)
+    else:
         continue
-    task = os.path.basename(cwd)
-    if re.search(r"[\t\r\n]", task):
+    if not key or re.search(r"[\t\r\n]", key):
         continue
-    name = re.sub(r"[\t\r\n]", " ", a.get("name") or "")
-    print("\t".join([pane, task, name]))'
+    seen.add(tab)
+    label = re.sub(r"[\t\r\n]", " ", labels[tab])
+    print("\t".join([tab, kind, key, label]))'
 
 cmd_prefix() {
   local label="${1:-}" worktree="${2:-}" base name glyph
@@ -131,41 +182,69 @@ cmd_refresh() {
   command -v python3 >/dev/null 2>&1 || return 0
   git -C "$dir" rev-parse --git-dir >/dev/null 2>&1 || return 0
   # Main worktree (first porcelain entry) — the backlog + worktrees live there.
-  local main states list agents
+  local main states list tablist tabs
   main="$(git -C "$dir" worktree list --porcelain 2>/dev/null | head -1)"
   main="${main#worktree }"
   [ -n "$main" ] || return 0
   # $cached is unquoted so an empty value expands to no argument (not "").
+  # An empty $states (no backlog) is NOT an early exit: ◉ is a stateless location
+  # mark, so a main-root Manager tab must still be stamped even with zero tasks.
+  # Empty states just means the per-task glyph_lookup below finds nothing, so task
+  # tabs are left alone while main-root tabs still get ◉.
   states="$(bash "$SCRIPT_DIR/ws-statusline.sh" states $cached "$dir" 2>/dev/null || true)"
-  [ -n "$states" ] || return 0     # no backlog → nothing to stamp
   # Empty list output = herdr unreachable (binary present, server down) →
   # silent no-op, NOT `checked=0` — that line means "reachable, nothing to do".
+  # Agents carry the cwd we match on; tabs carry the label we stamp. Both.
   list="$(herdr agent list 2>/dev/null || true)"
   [ -n "$list" ] || return 0
-  agents="$(printf '%s' "$list" \
-    | python3 -c "$extract_task_agents" "$main" 2>/dev/null || true)"
-  if [ -z "$agents" ]; then
+  tablist="$(herdr tab list 2>/dev/null || true)"
+  [ -n "$tablist" ] || return 0
+  # Pass the tab-list JSON by FILE, not as a python argv element: on a big server
+  # it is hundreds of KB and would blow ARG_MAX (E2BIG), a failure the `|| true`
+  # below would silently mask as `checked=0`. The agent list stays on stdin (a
+  # pipe has no ARG_MAX limit). mktemp failure → skip this refresh, best-effort.
+  # tabfile is intentionally NOT `local`: the EXIT trap below fires in the global
+  # scope (after cmd_refresh has returned), where a function-local would be gone —
+  # under `set -u` that reads as an unbound-variable error and leaks the file.
+  tabfile="$(mktemp "${TMPDIR:-/tmp}/ws-tablist.XXXXXX")" || return 0
+  # EXIT trap, not just a trailing rm: a Ctrl-C / SIGTERM between mktemp and the
+  # cleanup (refresh runs on every /status, /list, /open, …) would otherwise orphan
+  # the tab-list temp file. The trap fires on any exit path, signals included; the
+  # `${tabfile:-}` guard keeps it safe under `set -u` even if it never got assigned.
+  trap 'rm -f "${tabfile:-}"' EXIT
+  printf '%s' "$tablist" > "$tabfile"
+  # PYTHONUTF8=1 forces UTF-8 for stdin, the tab-list file, AND stdout regardless
+  # of locale: under LC_ALL=C, Python would otherwise decode the glyph bytes (◉ ●
+  # …) in labels as ASCII and raise UnicodeDecodeError — or fail to *encode* them
+  # on the print — and the bare except / `|| true` would mask it as `checked=0`.
+  tabs="$(printf '%s' "$list" \
+    | PYTHONUTF8=1 python3 -c "$extract_glyph_tabs" "$main" "$tabfile" 2>/dev/null || true)"
+  if [ -z "$tabs" ]; then
     echo "checked=0 updated=0"
     return 0
   fi
-  local checked=0 updated=0 pane task name glyph base new
-  while IFS=$'\t' read -r pane task name; do
-    [ -n "$pane" ] && [ -n "$task" ] || continue
-    glyph="$(printf '%s\n' "$states" | glyph_lookup "$task")"
-    [ -n "$glyph" ] || continue    # worktree without a backlog task — leave alone
+  local checked=0 updated=0 tab kind key label glyph base new
+  while IFS=$'\t' read -r tab kind key label; do
+    [ -n "$tab" ] && [ -n "$key" ] || continue
+    if [ "$kind" = "main" ]; then
+      glyph="◉"                    # the Manager hub — no state, just the place
+    else
+      glyph="$(printf '%s\n' "$states" | glyph_lookup "$key")"
+      [ -n "$glyph" ] || continue  # worktree without a backlog task — leave alone
+    fi
     checked=$((checked + 1))
-    base="$(strip_glyph "$name")"
-    [ -n "$base" ] || base="$task" # unnamed agent → fall back to the task name
+    base="$(strip_glyph "$label")"
+    [ -n "$base" ] || base="$key"  # unlabelled tab → task name / repo dir name
     new="$glyph $base"
-    [ "$new" = "$name" ] && continue   # already correct — no rename churn
-    # No `--` guard here: `herdr agent rename` treats `--` as the target itself
-    # (verified), so it can't end option parsing. The no-leading-dash pane regex
-    # in extract_task_agents is the sole (and sufficient) injection guard — pane
+    [ "$new" = "$label" ] && continue   # already correct — no rename churn
+    # No `--` guard here: `herdr tab rename` treats `--` as the target itself
+    # (verified), so it can't end option parsing. The no-leading-dash id regex
+    # in extract_glyph_tabs is the sole (and sufficient) injection guard — tab
     # can never be a `-`-prefixed value that rename would read as a flag.
-    if herdr agent rename "$pane" "$new" >/dev/null 2>&1; then
+    if herdr tab rename "$tab" "$new" >/dev/null 2>&1; then
       updated=$((updated + 1))
     fi
-  done <<<"$agents"
+  done <<<"$tabs"
   echo "checked=$checked updated=$updated"
 }
 
diff --git a/plugins/work-system/skills/close/SKILL.md b/plugins/work-system/skills/close/SKILL.md
index 5a46eb8..5efbf29 100644
--- a/plugins/work-system/skills/close/SKILL.md
+++ b/plugins/work-system/skills/close/SKILL.md
@@ -315,9 +315,9 @@ Rules:
       (the main-repo path from step 4 — after step 7 the worktree, and possibly
       `$PWD`, no longer exists).
     - The closed task's own tab is gone; this re-stamps the state glyphs
-      (`○ ● ◇ ◆ ✓`) on the repo's *remaining* task tabs — whose state `/close`
-      didn't change, so `--cached` reads the PR cache instead of a blocking `gh`
-      call. Outside herdr it is a silent no-op. Ignore its output — never block
+      (`○ ● ◇ ◆ ✓`, plus the main-repo tab's `◉` hub mark) on the repo's
+      *remaining* tabs — whose state `/close` didn't change, so `--cached` reads
+      the PR cache instead of a blocking `gh` call. Outside herdr it is a silent no-op. Ignore its output — never block
       or report on it.
 
 ## Safety
diff --git a/plugins/work-system/skills/continue/SKILL.md b/plugins/work-system/skills/continue/SKILL.md
index e5512c5..aa888b8 100644
--- a/plugins/work-system/skills/continue/SKILL.md
+++ b/plugins/work-system/skills/continue/SKILL.md
@@ -72,7 +72,8 @@ the prefix-stripped task name) — comparing the raw argument instead misroutes.
    **a) Inside herdr — reopen the tab and resume via the shared helper:**
    ```sh
    LABEL="<short sidebar label from the task name, e.g. close-herdr>"   # same convention as
-   # /kickoff — pass it PLAIN; the helper prefixes the task's state glyph (○ ● ◇ ✓) itself.
+   # /kickoff — pass it PLAIN; the helper prefixes the task's state glyph (○ ● ◇ ◆ ✓)
+   # onto the tab LABEL itself (agent + session names stay plain).
    bash "${CLAUDE_PLUGIN_ROOT}/scripts/herdr-launch.sh" resume "$LABEL" "$WORKTREE" "$HERDR_WORKSPACE_ID"
    ```
    The helper reuses an already-open tab at the worktree (focuses it), or (if none)
diff --git a/plugins/work-system/skills/kickoff/SKILL.md b/plugins/work-system/skills/kickoff/SKILL.md
index 60bd472..7137e86 100644
--- a/plugins/work-system/skills/kickoff/SKILL.md
+++ b/plugins/work-system/skills/kickoff/SKILL.md
@@ -102,9 +102,11 @@ The same rule applies to any project-specific setup the user's `CLAUDE.md` may a
     Derive a short, sidebar-friendly label from the task name — drop filler words
     (`automate`, `in`, …) so it reads punchy (e.g. `automate-close-in-herdr` →
     `close-herdr`), hard-cap ~32 chars. Pass it PLAIN — the launch helper
-    prefixes the task's state glyph (`○ ● ◇ ✓`, e.g. `● close-herdr`) itself,
-    mirroring the `[ws …]` statusline. This `LABEL` names the herdr agent, the
-    tab, and the Claude session; the `task/<task-name>` branch is unchanged, so
+    prefixes the task's state glyph (`○ ● ◇ ◆ ✓`, e.g. `● close-herdr`) onto the
+    **tab label** itself, mirroring the `[ws …]` statusline. This `LABEL` names
+    the herdr agent, the tab, and the Claude session — but the glyph rides only
+    on the tab label (what the sidebar renders); the agent and session names
+    stay plain. The `task/<task-name>` branch is unchanged, so
     `/continue` still resolves the task inside the worktree. The worktree path is
     absolute (`<main-repo>/.claude/worktrees/<task-name>`, with `<main-repo>` from
     step 1). Then call the shared launch helper:
diff --git a/plugins/work-system/skills/list/SKILL.md b/plugins/work-system/skills/list/SKILL.md
index aff371d..ebcf09a 100644
--- a/plugins/work-system/skills/list/SKILL.md
+++ b/plugins/work-system/skills/list/SKILL.md
@@ -87,8 +87,10 @@ user_invocable: true
 7. **Sync herdr tab glyphs** (best-effort, silent):
    - Run: `bash "${CLAUDE_PLUGIN_ROOT}/scripts/herdr-tab-glyph.sh" refresh --cached "$PWD"`
    - Inside herdr this re-stamps every open task tab's state glyph
-     (`○ ● ◇ ◆ ✓`) to match the surveyed states; outside herdr (or without a
-     backlog) it is a silent no-op. `--cached`: this is a read-only survey, so
+     (`○ ● ◇ ◆ ✓`, plus the main-repo tab's `◉` hub mark) to match the surveyed
+     states; outside herdr it is a silent no-op (the main-repo `◉` is stateless,
+     so an empty backlog still stamps it — only per-task glyphs have nothing to
+     do). `--cached`: this is a read-only survey, so
      read the PR cache instead of a blocking `gh` call (a background refresh
      keeps it current). Ignore its output — never block or report on it.
 
diff --git a/plugins/work-system/skills/status/SKILL.md b/plugins/work-system/skills/status/SKILL.md
index 668eb9a..be3d235 100644
--- a/plugins/work-system/skills/status/SKILL.md
+++ b/plugins/work-system/skills/status/SKILL.md
@@ -99,7 +99,9 @@ user_invocable: true
 5. **Sync herdr tab glyphs** (best-effort, silent):
    - Run: `bash "${CLAUDE_PLUGIN_ROOT}/scripts/herdr-tab-glyph.sh" refresh --cached "$PWD"`
    - Inside herdr this re-stamps every open task tab's state glyph
-     (`○ ● ◇ ◆ ✓`) to match the surveyed state; outside herdr (or without a
-     backlog) it is a silent no-op. `--cached`: this is a read-only survey, so
+     (`○ ● ◇ ◆ ✓`, plus the main-repo tab's `◉` hub mark) to match the surveyed
+     state; outside herdr it is a silent no-op (the main-repo `◉` is stateless,
+     so an empty backlog still stamps it — only per-task glyphs have nothing to
+     do). `--cached`: this is a read-only survey, so
      read the PR cache instead of a blocking `gh` call (a background refresh
      keeps it current). Ignore its output — never block or report on it.