diff --git a/CHANGELOG.md b/CHANGELOG.md
index 95039fd9..23b4bcae 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,15 @@ new version heading in the same commit.
 
 ## [Unreleased]
 
+## [0.446.1] - 2026-09-17
+### Fixed
+- **`session-pause-test` no longer depends on the deploy box's own Claude login.** Its HTTP section resumes a
+  paused session and then awaits, so the deferred launch — and its credential pre-flight against the real
+  `~/.claude` — had run by the time the row was checked. On the Linux deploy boxes (no refresh token in the
+  box default) the resume was correctly refused and the row read `crashed`, failing the make-live gate on
+  every remote target while passing on the Mac. The harness now stubs the pre-flight, as it already stubs
+  the session backend.
+
 ## [0.446.0] - 2026-09-17
 ### Added
 - **Pause a session.** A new session status, `paused`, that is neither live nor finished: pausing kills the
diff --git a/package-lock.json b/package-lock.json
index b5a21f7a..fecf137a 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "agent-os",
-  "version": "0.446.0",
+  "version": "0.446.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "agent-os",
-      "version": "0.446.0",
+      "version": "0.446.1",
       "license": "MIT",
       "bin": {
         "agent-os": "bin/agent-os"
diff --git a/package.json b/package.json
index 270b5902..62379607 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "agent-os",
-  "version": "0.446.0",
+  "version": "0.446.1",
   "description": "A generic, governed operating system for running autonomous agents safely across brands. Ships with a local web console.",
   "license": "MIT",
   "type": "commonjs",
diff --git a/scripts/session-pause-test.cjs b/scripts/session-pause-test.cjs
index 1a037a95..76e41659 100644
--- a/scripts/session-pause-test.cjs
+++ b/scripts/session-pause-test.cjs
@@ -233,6 +233,11 @@ console.log('\n\x1b[1m10) end to end over real HTTP — the routes, the gate and
   htm.backend.spawn = (_s, o) => { live.add(o.tmuxName); };
   htm.backend.capturePane = () => '';
   htm.backend.hasClient = () => false;
+  // The launch credential pre-flight reads the BOX's real login (~/.claude). This harness resumes over HTTP
+  // and then awaits, so the deferred launch has run by the time we look — on a box whose default login has
+  // no refresh token (every Linux deploy box) the resume is refused and the row reads `crashed`. That's the
+  // pre-flight working, not pause; keep the test about pause.
+  htm.assertCredentialsUsable = () => true;
 
   const post = (u, cookie) => fetch(base + u, { method: 'POST', headers: { 'content-type': 'application/json', ...(cookie ? { cookie } : {}) }, body: '{}' });