diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 7a486960..2ae82245 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -121,8 +121,14 @@ jobs:
   update-workspaces:
     runs-on: ubuntu-latest
     needs: [build-and-push]
-    # Only run on main branch pushes, not releases or manual runs
-    if: success() && github.event_name == 'push' && github.ref == 'refs/heads/main'
+    # Only run on main branch pushes when build-and-push succeeded
+    # Note: Can't use success() here because it checks the entire dependency chain,
+    # including build-base which is often skipped. Use explicit result check instead.
+    if: |
+      always() &&
+      needs.build-and-push.result == 'success' &&
+      github.event_name == 'push' &&
+      github.ref == 'refs/heads/main'
     steps:
       - name: Update workspace images
         env:
@@ -139,7 +145,7 @@ jobs:
           response=$(curl -s -w "\n%{http_code}" -X POST "${CLOUD_API_URL}/api/admin/workspaces/update-image" \
             -H "x-admin-secret: ${ADMIN_API_SECRET}" \
             -H "Content-Type: application/json" \
-            -d '{"image": "ghcr.io/agentworkforce/relay-workspace:latest", "skipRestart": true}')
+            -d '{"image": "ghcr.io/agentworkforce/relay-workspace:latest", "skipRestart": false}')
 
           http_code=$(echo "$response" | tail -n1)
           body=$(echo "$response" | sed '$d')
diff --git a/.trajectories/completed/2026-01/traj_oszg9flv74pk.json b/.trajectories/completed/2026-01/traj_oszg9flv74pk.json
new file mode 100644
index 00000000..99aa3c85
--- /dev/null
+++ b/.trajectories/completed/2026-01/traj_oszg9flv74pk.json
@@ -0,0 +1,73 @@
+{
+  "id": "traj_oszg9flv74pk",
+  "version": 1,
+  "task": {
+    "title": "Fix cloud link authentication flow"
+  },
+  "status": "completed",
+  "startedAt": "2026-01-08T09:01:35.826Z",
+  "agents": [
+    {
+      "name": "khaliqgant",
+      "role": "lead",
+      "joinedAt": "2026-01-08T09:01:35.827Z"
+    }
+  ],
+  "chapters": [
+    {
+      "id": "chap_fnyyswrra94t",
+      "title": "Work",
+      "agentName": "default",
+      "startedAt": "2026-01-08T09:01:42.677Z",
+      "events": [
+        {
+          "ts": 1767862902677,
+          "type": "decision",
+          "content": "Fixed cloud link page auth check: Fixed cloud link page auth check",
+          "raw": {
+            "question": "Fixed cloud link page auth check",
+            "chosen": "Fixed cloud link page auth check",
+            "alternatives": [],
+            "reasoning": "checkAuth() was looking for data.userId but /api/auth/session returns { authenticated: true, user: { id } }. Changed to check data.authenticated && data.user?.id"
+          },
+          "significance": "high"
+        },
+        {
+          "ts": 1767862908073,
+          "type": "decision",
+          "content": "Added return URL support to login page: Added return URL support to login page",
+          "raw": {
+            "question": "Added return URL support to login page",
+            "chosen": "Added return URL support to login page",
+            "alternatives": [],
+            "reasoning": "Login page ignored ?return= query param, always redirecting to /app after auth. Added useSearchParams to read return URL and redirect back (e.g., to cloud link page)"
+          },
+          "significance": "high"
+        },
+        {
+          "ts": 1767862912381,
+          "type": "decision",
+          "content": "Wrapped login page in Suspense boundary: Wrapped login page in Suspense boundary",
+          "raw": {
+            "question": "Wrapped login page in Suspense boundary",
+            "chosen": "Wrapped login page in Suspense boundary",
+            "alternatives": [],
+            "reasoning": "useSearchParams requires Suspense for Next.js static generation. Created LoginContent component wrapped in Suspense with LoginLoading fallback"
+          },
+          "significance": "high"
+        }
+      ],
+      "endedAt": "2026-01-08T09:01:57.389Z"
+    }
+  ],
+  "commits": [],
+  "filesChanged": [],
+  "projectId": "/Users/khaliqgant/Projects/agent-workforce/relay",
+  "tags": [],
+  "completedAt": "2026-01-08T09:01:57.389Z",
+  "retrospective": {
+    "summary": "Fixed two bugs in cloud link flow: 1) Auth check used wrong response shape 2) Login page ignored return URL param. Also added Suspense boundary for Next.js static gen.",
+    "approach": "Standard approach",
+    "confidence": 0.9
+  }
+}
\ No newline at end of file
diff --git a/.trajectories/completed/2026-01/traj_oszg9flv74pk.md b/.trajectories/completed/2026-01/traj_oszg9flv74pk.md
new file mode 100644
index 00000000..c095ed06
--- /dev/null
+++ b/.trajectories/completed/2026-01/traj_oszg9flv74pk.md
@@ -0,0 +1,41 @@
+# Trajectory: Fix cloud link authentication flow
+
+> **Status:** ✅ Completed
+> **Confidence:** 90%
+> **Started:** January 8, 2026 at 10:01 AM
+> **Completed:** January 8, 2026 at 10:01 AM
+
+---
+
+## Summary
+
+Fixed two bugs in cloud link flow: 1) Auth check used wrong response shape 2) Login page ignored return URL param. Also added Suspense boundary for Next.js static gen.
+
+**Approach:** Standard approach
+
+---
+
+## Key Decisions
+
+### Fixed cloud link page auth check
+- **Chose:** Fixed cloud link page auth check
+- **Reasoning:** checkAuth() was looking for data.userId but /api/auth/session returns { authenticated: true, user: { id } }. Changed to check data.authenticated && data.user?.id
+
+### Added return URL support to login page
+- **Chose:** Added return URL support to login page
+- **Reasoning:** Login page ignored ?return= query param, always redirecting to /app after auth. Added useSearchParams to read return URL and redirect back (e.g., to cloud link page)
+
+### Wrapped login page in Suspense boundary
+- **Chose:** Wrapped login page in Suspense boundary
+- **Reasoning:** useSearchParams requires Suspense for Next.js static generation. Created LoginContent component wrapped in Suspense with LoginLoading fallback
+
+---
+
+## Chapters
+
+### 1. Work
+*Agent: default*
+
+- Fixed cloud link page auth check: Fixed cloud link page auth check
+- Added return URL support to login page: Added return URL support to login page
+- Wrapped login page in Suspense boundary: Wrapped login page in Suspense boundary
diff --git a/.trajectories/active/traj_rsavt0jipi3c.json b/.trajectories/completed/2026-01/traj_rsavt0jipi3c.json
similarity index 64%
rename from .trajectories/active/traj_rsavt0jipi3c.json
rename to .trajectories/completed/2026-01/traj_rsavt0jipi3c.json
index ed4bda56..c9dd8abd 100644
--- a/.trajectories/active/traj_rsavt0jipi3c.json
+++ b/.trajectories/completed/2026-01/traj_rsavt0jipi3c.json
@@ -4,7 +4,7 @@
   "task": {
     "title": "Power agent session - ready for tasks"
   },
-  "status": "active",
+  "status": "completed",
   "startedAt": "2026-01-08T07:54:35.678Z",
   "agents": [
     {
@@ -67,12 +67,43 @@
             "reasoning": "Prevents future build failures - useSearchParams requires Suspense boundary for Next.js static generation"
           },
           "significance": "high"
+        },
+        {
+          "ts": 1767861773992,
+          "type": "decision",
+          "content": "Changed update-workspaces condition to use explicit result check: Changed update-workspaces condition to use explicit result check",
+          "raw": {
+            "question": "Changed update-workspaces condition to use explicit result check",
+            "chosen": "Changed update-workspaces condition to use explicit result check",
+            "alternatives": [],
+            "reasoning": "success() checks entire dependency chain including skipped build-base. Using always() + needs.build-and-push.result == 'success' checks only direct dependency"
+          },
+          "significance": "high"
+        },
+        {
+          "ts": 1767862760607,
+          "type": "decision",
+          "content": "Changed skipRestart to false in update-workspaces: Changed skipRestart to false in update-workspaces",
+          "raw": {
+            "question": "Changed skipRestart to false in update-workspaces",
+            "chosen": "Changed skipRestart to false in update-workspaces",
+            "alternatives": [],
+            "reasoning": "If no active agents, workspace should restart immediately to apply new image since there's no work to disrupt"
+          },
+          "significance": "high"
         }
-      ]
+      ],
+      "endedAt": "2026-01-08T09:01:29.981Z"
     }
   ],
   "commits": [],
   "filesChanged": [],
   "projectId": "/Users/khaliqgant/Projects/agent-workforce/relay",
-  "tags": []
+  "tags": [],
+  "completedAt": "2026-01-08T09:01:29.981Z",
+  "retrospective": {
+    "summary": "General session - mixed work on cloud link auth, docker workflow, and React rules",
+    "approach": "Standard approach",
+    "confidence": 0.7
+  }
 }
\ No newline at end of file
diff --git a/.trajectories/completed/2026-01/traj_rsavt0jipi3c.md b/.trajectories/completed/2026-01/traj_rsavt0jipi3c.md
new file mode 100644
index 00000000..37ca1c9d
--- /dev/null
+++ b/.trajectories/completed/2026-01/traj_rsavt0jipi3c.md
@@ -0,0 +1,56 @@
+# Trajectory: Power agent session - ready for tasks
+
+> **Status:** ✅ Completed
+> **Confidence:** 70%
+> **Started:** January 8, 2026 at 08:54 AM
+> **Completed:** January 8, 2026 at 10:01 AM
+
+---
+
+## Summary
+
+General session - mixed work on cloud link auth, docker workflow, and React rules
+
+**Approach:** Standard approach
+
+---
+
+## Key Decisions
+
+### Fixed cloud link auth flow - two bugs
+- **Chose:** Fixed cloud link auth flow - two bugs
+- **Reasoning:** 1) Cloud link page checked for data.userId but API returns data.authenticated + data.user.id. 2) Login page ignored return URL param, so after login it went to /app instead of back to cloud link page
+
+### Fixed login page return URL support
+- **Chose:** Fixed login page return URL support
+- **Reasoning:** Added useSearchParams to read return query param and redirect back after login instead of always going to /app
+
+### Added Suspense boundary to login page
+- **Chose:** Added Suspense boundary to login page
+- **Reasoning:** useSearchParams requires Suspense for Next.js static generation - wrapped LoginContent in Suspense with LoginLoading fallback
+
+### Added useSearchParams/Suspense rule to react-dashboard.md
+- **Chose:** Added useSearchParams/Suspense rule to react-dashboard.md
+- **Reasoning:** Prevents future build failures - useSearchParams requires Suspense boundary for Next.js static generation
+
+### Changed update-workspaces condition to use explicit result check
+- **Chose:** Changed update-workspaces condition to use explicit result check
+- **Reasoning:** success() checks entire dependency chain including skipped build-base. Using always() + needs.build-and-push.result == 'success' checks only direct dependency
+
+### Changed skipRestart to false in update-workspaces
+- **Chose:** Changed skipRestart to false in update-workspaces
+- **Reasoning:** If no active agents, workspace should restart immediately to apply new image since there's no work to disrupt
+
+---
+
+## Chapters
+
+### 1. Work
+*Agent: default*
+
+- Fixed cloud link auth flow - two bugs: Fixed cloud link auth flow - two bugs
+- Fixed login page return URL support: Fixed login page return URL support
+- Added Suspense boundary to login page: Added Suspense boundary to login page
+- Added useSearchParams/Suspense rule to react-dashboard.md: Added useSearchParams/Suspense rule to react-dashboard.md
+- Changed update-workspaces condition to use explicit result check: Changed update-workspaces condition to use explicit result check
+- Changed skipRestart to false in update-workspaces: Changed skipRestart to false in update-workspaces
diff --git a/.trajectories/completed/2026-01/traj_xjqvmep5ed3h.json b/.trajectories/completed/2026-01/traj_xjqvmep5ed3h.json
new file mode 100644
index 00000000..9822cd78
--- /dev/null
+++ b/.trajectories/completed/2026-01/traj_xjqvmep5ed3h.json
@@ -0,0 +1,61 @@
+{
+  "id": "traj_xjqvmep5ed3h",
+  "version": 1,
+  "task": {
+    "title": "Fix update-workspaces GitHub Action job"
+  },
+  "status": "completed",
+  "startedAt": "2026-01-08T09:02:08.758Z",
+  "agents": [
+    {
+      "name": "khaliqgant",
+      "role": "lead",
+      "joinedAt": "2026-01-08T09:02:08.759Z"
+    }
+  ],
+  "chapters": [
+    {
+      "id": "chap_idiabu3o77zd",
+      "title": "Work",
+      "agentName": "default",
+      "startedAt": "2026-01-08T09:02:14.052Z",
+      "events": [
+        {
+          "ts": 1767862934052,
+          "type": "decision",
+          "content": "Changed job condition from success() to explicit needs check: Changed job condition from success() to explicit needs check",
+          "raw": {
+            "question": "Changed job condition from success() to explicit needs check",
+            "chosen": "Changed job condition from success() to explicit needs check",
+            "alternatives": [],
+            "reasoning": "success() checks entire dependency chain including build-base which is often skipped. Changed to always() + needs.build-and-push.result == 'success' to only check direct dependency"
+          },
+          "significance": "high"
+        },
+        {
+          "ts": 1767862939841,
+          "type": "decision",
+          "content": "Changed skipRestart from true to false: Changed skipRestart from true to false",
+          "raw": {
+            "question": "Changed skipRestart from true to false",
+            "chosen": "Changed skipRestart from true to false",
+            "alternatives": [],
+            "reasoning": "With skipRestart:true, running workspaces without active agents would only update config but not restart. Since no agents = no work to disrupt, should restart immediately to apply new image"
+          },
+          "significance": "high"
+        }
+      ],
+      "endedAt": "2026-01-08T09:02:24.262Z"
+    }
+  ],
+  "commits": [],
+  "filesChanged": [],
+  "projectId": "/Users/khaliqgant/Projects/agent-workforce/relay",
+  "tags": [],
+  "completedAt": "2026-01-08T09:02:24.262Z",
+  "retrospective": {
+    "summary": "Fixed update-workspaces job: 1) Changed condition to check direct dependency result instead of success() which fails on skipped upstream jobs 2) Set skipRestart:false so idle workspaces restart immediately",
+    "approach": "Standard approach",
+    "confidence": 0.85
+  }
+}
\ No newline at end of file
diff --git a/.trajectories/completed/2026-01/traj_xjqvmep5ed3h.md b/.trajectories/completed/2026-01/traj_xjqvmep5ed3h.md
new file mode 100644
index 00000000..85da74e0
--- /dev/null
+++ b/.trajectories/completed/2026-01/traj_xjqvmep5ed3h.md
@@ -0,0 +1,36 @@
+# Trajectory: Fix update-workspaces GitHub Action job
+
+> **Status:** ✅ Completed
+> **Confidence:** 85%
+> **Started:** January 8, 2026 at 10:02 AM
+> **Completed:** January 8, 2026 at 10:02 AM
+
+---
+
+## Summary
+
+Fixed update-workspaces job: 1) Changed condition to check direct dependency result instead of success() which fails on skipped upstream jobs 2) Set skipRestart:false so idle workspaces restart immediately
+
+**Approach:** Standard approach
+
+---
+
+## Key Decisions
+
+### Changed job condition from success() to explicit needs check
+- **Chose:** Changed job condition from success() to explicit needs check
+- **Reasoning:** success() checks entire dependency chain including build-base which is often skipped. Changed to always() + needs.build-and-push.result == 'success' to only check direct dependency
+
+### Changed skipRestart from true to false
+- **Chose:** Changed skipRestart from true to false
+- **Reasoning:** With skipRestart:true, running workspaces without active agents would only update config but not restart. Since no agents = no work to disrupt, should restart immediately to apply new image
+
+---
+
+## Chapters
+
+### 1. Work
+*Agent: default*
+
+- Changed job condition from success() to explicit needs check: Changed job condition from success() to explicit needs check
+- Changed skipRestart from true to false: Changed skipRestart from true to false
diff --git a/.trajectories/completed/2026-01/traj_y7n6hfbf7dmg.json b/.trajectories/completed/2026-01/traj_y7n6hfbf7dmg.json
new file mode 100644
index 00000000..de512e6e
--- /dev/null
+++ b/.trajectories/completed/2026-01/traj_y7n6hfbf7dmg.json
@@ -0,0 +1,49 @@
+{
+  "id": "traj_y7n6hfbf7dmg",
+  "version": 1,
+  "task": {
+    "title": "Add useSearchParams/Suspense rule to react-dashboard"
+  },
+  "status": "completed",
+  "startedAt": "2026-01-08T09:02:29.285Z",
+  "agents": [
+    {
+      "name": "khaliqgant",
+      "role": "lead",
+      "joinedAt": "2026-01-08T09:02:29.285Z"
+    }
+  ],
+  "chapters": [
+    {
+      "id": "chap_4f8h46e935ub",
+      "title": "Work",
+      "agentName": "default",
+      "startedAt": "2026-01-08T09:02:34.375Z",
+      "events": [
+        {
+          "ts": 1767862954376,
+          "type": "decision",
+          "content": "Added Next.js App Router section to react-dashboard.md rule: Added Next.js App Router section to react-dashboard.md rule",
+          "raw": {
+            "question": "Added Next.js App Router section to react-dashboard.md rule",
+            "chosen": "Added Next.js App Router section to react-dashboard.md rule",
+            "alternatives": [],
+            "reasoning": "Prevents future build failures - documents that useSearchParams requires Suspense boundary with code example and references to existing files (cloud/link/page.tsx, login/page.tsx)"
+          },
+          "significance": "high"
+        }
+      ],
+      "endedAt": "2026-01-08T09:02:38.286Z"
+    }
+  ],
+  "commits": [],
+  "filesChanged": [],
+  "projectId": "/Users/khaliqgant/Projects/agent-workforce/relay",
+  "tags": [],
+  "completedAt": "2026-01-08T09:02:38.286Z",
+  "retrospective": {
+    "summary": "Added Next.js App Router section to .claude/rules/react-dashboard.md documenting the useSearchParams + Suspense requirement with code pattern and file references",
+    "approach": "Standard approach",
+    "confidence": 0.95
+  }
+}
\ No newline at end of file
diff --git a/.trajectories/completed/2026-01/traj_y7n6hfbf7dmg.md b/.trajectories/completed/2026-01/traj_y7n6hfbf7dmg.md
new file mode 100644
index 00000000..019d4937
--- /dev/null
+++ b/.trajectories/completed/2026-01/traj_y7n6hfbf7dmg.md
@@ -0,0 +1,31 @@
+# Trajectory: Add useSearchParams/Suspense rule to react-dashboard
+
+> **Status:** ✅ Completed
+> **Confidence:** 95%
+> **Started:** January 8, 2026 at 10:02 AM
+> **Completed:** January 8, 2026 at 10:02 AM
+
+---
+
+## Summary
+
+Added Next.js App Router section to .claude/rules/react-dashboard.md documenting the useSearchParams + Suspense requirement with code pattern and file references
+
+**Approach:** Standard approach
+
+---
+
+## Key Decisions
+
+### Added Next.js App Router section to react-dashboard.md rule
+- **Chose:** Added Next.js App Router section to react-dashboard.md rule
+- **Reasoning:** Prevents future build failures - documents that useSearchParams requires Suspense boundary with code example and references to existing files (cloud/link/page.tsx, login/page.tsx)
+
+---
+
+## Chapters
+
+### 1. Work
+*Agent: default*
+
+- Added Next.js App Router section to react-dashboard.md rule: Added Next.js App Router section to react-dashboard.md rule
diff --git a/.trajectories/index.json b/.trajectories/index.json
index bac1bd5d..fc0b0776 100644
--- a/.trajectories/index.json
+++ b/.trajectories/index.json
@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "lastUpdated": "2026-01-08T08:21:39.291Z",
+  "lastUpdated": "2026-01-08T09:02:38.297Z",
   "trajectories": {
     "traj_ozd98si6a7ns": {
       "title": "Fix thinking indicator showing on all messages",
@@ -501,9 +501,31 @@
     },
     "traj_rsavt0jipi3c": {
       "title": "Power agent session - ready for tasks",
-      "status": "active",
+      "status": "completed",
       "startedAt": "2026-01-08T07:54:35.678Z",
-      "path": "/Users/khaliqgant/Projects/agent-workforce/relay/.trajectories/active/traj_rsavt0jipi3c.json"
+      "completedAt": "2026-01-08T09:01:29.981Z",
+      "path": "/Users/khaliqgant/Projects/agent-workforce/relay/.trajectories/completed/2026-01/traj_rsavt0jipi3c.json"
+    },
+    "traj_oszg9flv74pk": {
+      "title": "Fix cloud link authentication flow",
+      "status": "completed",
+      "startedAt": "2026-01-08T09:01:35.826Z",
+      "completedAt": "2026-01-08T09:01:57.389Z",
+      "path": "/Users/khaliqgant/Projects/agent-workforce/relay/.trajectories/completed/2026-01/traj_oszg9flv74pk.json"
+    },
+    "traj_xjqvmep5ed3h": {
+      "title": "Fix update-workspaces GitHub Action job",
+      "status": "completed",
+      "startedAt": "2026-01-08T09:02:08.758Z",
+      "completedAt": "2026-01-08T09:02:24.262Z",
+      "path": "/Users/khaliqgant/Projects/agent-workforce/relay/.trajectories/completed/2026-01/traj_xjqvmep5ed3h.json"
+    },
+    "traj_y7n6hfbf7dmg": {
+      "title": "Add useSearchParams/Suspense rule to react-dashboard",
+      "status": "completed",
+      "startedAt": "2026-01-08T09:02:29.285Z",
+      "completedAt": "2026-01-08T09:02:38.286Z",
+      "path": "/Users/khaliqgant/Projects/agent-workforce/relay/.trajectories/completed/2026-01/traj_y7n6hfbf7dmg.json"
     }
   }
 }
\ No newline at end of file