diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json
index cd5354b..b67cd2f 100644
--- a/.claude-plugin/plugin.json
+++ b/.claude-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
 	"name": "inference-arbitrage",
-	"version": "0.4.0",
+	"version": "0.4.1",
 	"description": "Audits a Claude Code plugin's definitions and usage transcripts to find steps that should be a deterministic script instead of raw LLM inference, and files the well-evidenced ones as issues on the target repo.",
 	"author": {
 		"name": "oleks"
diff --git a/agents/offload-analyst.md b/agents/offload-analyst.md
index 37373af..d7d8ddc 100644
--- a/agents/offload-analyst.md
+++ b/agents/offload-analyst.md
@@ -31,6 +31,19 @@ ${CLAUDE_PLUGIN_ROOT}/bin/offload-scan --plugin <name> --days N --json  # dynami
 
 ## What you never do
 
+- **You are the delegation target — never re-delegate the whole audit.** If you
+  were spawned via `Agent(subagent_type="inference-arbitrage:offload-analyst")`
+  because a caller judged the target heavy, that call already happened. Reading
+  a large target's inventory/scan output, or the `offload-audit` skill's own
+  "for a heavy target, hand the work to `Agent(offload-analyst)`" line, is not a
+  reason to spawn another instance of yourself — that line describes what a
+  *caller* does before reaching you, not what you do once you are the one doing
+  the work. The only `Agent` calls you ever make are the fixed filing chain
+  (`Agent(anxious:issuer-agent)` → `cluster:gitea-agent`, §7 below) — never
+  another `offload-analyst`, and never another `offload-audit` skill invocation
+  once you have already loaded it once. A target being large (many skills or
+  agents) is a reason to work through it methodically, not a reason to hand it
+  to a fresh copy of yourself with no memory of what you've already measured.
 - **Never edit the plugin you audit.** Read-only, always. This separation is what
   preserves your ability to conclude "no offload here" — an auditor that writes
   the code it recommends cannot credibly decline to recommend.
diff --git a/commands/offload-audit.md b/commands/offload-audit.md
index 6d49101..2d525ee 100644
--- a/commands/offload-audit.md
+++ b/commands/offload-audit.md
@@ -18,7 +18,11 @@ Run the full audit on **$ARGUMENTS**.
    previous window, FR-4.5) and the marker search. For a heavy target, or when
    the report should not consume this session's context, hand the work to
    `Agent(subagent_type="inference-arbitrage:offload-analyst")` instead — one
-   agent for the whole audit, never one per skill (spec §7).
+   agent for the whole audit, never one per skill (spec §7). **This delegation
+   happens at most once, from this top-level command to the analyst.** The
+   analyst instance you spawn is the delegation target, not another decision
+   point — it never re-delegates the whole audit to a further `offload-analyst`
+   instance, however large the target looks from inside.
 
 Filing is implicit: a candidate that clears the rubric gate and the value
 threshold is filed without asking. Everything below the gate is reported as a