diff --git a/apps/hub/src/index.ts b/apps/hub/src/index.ts
index 90597f7c3..9b8c89387 100644
--- a/apps/hub/src/index.ts
+++ b/apps/hub/src/index.ts
@@ -257,6 +257,7 @@ import {
   createArtifactRoutes,
   createTemplateLibraryDbStore,
   createTemplateLibraryRoutes,
+  createTemplateLibrarySeeder,
   createUnavailableArtifactRoutes,
   createUnavailableTemplateLibraryRoutes,
   createUnavailableWorkflowArtifactRoutes,
@@ -333,7 +334,6 @@ import {
 } from "./config";
 import type { SidecarProvisioner } from "@intx/hub-sessions";
 import { scheduleEnvProviderCredentialPlant } from "./env-credential-plant";
-import { scheduleTemplateLibrarySeed } from "./template-library-seed";
 import { createHubRoutineLauncher } from "./routine-launcher";
 import { withTurnPartWriteDefaults } from "./turn-part-content-default";
 import { createHubRunSummaryResolver } from "./routine-run-summary";
@@ -3307,15 +3307,23 @@ export async function createHub(config: HubConfig) {
 
     // The bench library's template shelf (CL-6344): what the
     // new-workbench picker instantiates from — seeded rows, never a
-    // hardcoded import.
+    // hardcoded import. Reading the shelf is what seeds it (CL-6458), so
+    // a bench created at any point after boot carries the shipped
+    // manifests the first time its picker opens.
     app.route(
       `${TENANT_PREFIX}/library/templates`,
       createTemplateLibraryRoutes({
         store: createTemplateLibraryDbStore(artifactsHandle.db),
+        seeder: createTemplateLibrarySeeder({
+          db: artifactsHandle.db,
+          entries: workbenchTemplateLibraryEntries(),
+          log: (line) => log.info`${line}`,
+        }),
         requireGrant: createRequireGrant({
           grantStore: chatGrantStore,
           conditionRegistry: chatConditionRegistry,
         }),
+        log: (line) => log.error`${line}`,
       }),
     );
 
@@ -3456,23 +3464,6 @@ export async function createHub(config: HubConfig) {
     fetch: (request) => Promise.resolve(guardedApp.fetch(request)),
   });
 
-  // Bench-library template seed (CL-6344): the hub, as system, plants
-  // the shipped workbench template manifests and their tool tarballs
-  // into the operator bench's library at boot — idempotently, so a
-  // second boot leaves exactly one entry per template. Skipped in
-  // degraded (no-artifacts) mode: with no library to seed into there is
-  // nothing honest to do. See ./template-library-seed.ts.
-  const templateLibrarySeed =
-    artifactsHandle !== undefined
-      ? scheduleTemplateLibrarySeed({
-          baseUrl: config.baseUrl,
-          admin: config.envCredentialPlantAdmin,
-          fetch: (request) => Promise.resolve(guardedApp.fetch(request)),
-          artifactsDb: artifactsHandle.db,
-          entries: workbenchTemplateLibraryEntries(),
-        })
-      : { stop: (): void => {} };
-
   return {
     app: guardedApp,
     db,
@@ -3482,7 +3473,6 @@ export async function createHub(config: HubConfig) {
         clearTimeout(sidecarAllocationReconciliationTimer);
       }
       envCredentialPlant.stop();
-      templateLibrarySeed.stop();
       chatOrchestrator.dispose();
       taskOrchestrator.dispose();
       taskLifecycle.stop();
diff --git a/apps/hub/src/template-library-seed.ts b/apps/hub/src/template-library-seed.ts
deleted file mode 100644
index 3fa0100b9..000000000
--- a/apps/hub/src/template-library-seed.ts
+++ /dev/null
@@ -1,212 +0,0 @@
-// CL-6344: schedules the bench-library template seed at hub boot. The
-// hub, as the operator's admin principal, plants the shipped workbench
-// template manifests into the bench's library (see
-// `@corbits/artifacts-hub`'s `seedTemplateLibrary` — idempotent, so a
-// second boot changes nothing) and publishes the `@corbits/*` tool
-// tarballs those templates' workflows pin (reusing
-// `@corbits/tool-registry-publish`, which already skips
-// already-published filenames), so instantiating a template never
-// resolves against a registry the bench doesn't have yet.
-//
-// Target resolution, retry cadence, and the sign-in-only rule all
-// mirror `./env-credential-plant.ts`: sign in as the configured admin
-// (never sign up), find the bench named ORG_SLUG among that account's
-// memberships, retry with backoff while it doesn't exist yet, and
-// never block or fail hub boot.
-
-import { getLogger } from "@intx/log";
-import { paginatedSchema, PrincipalSummary } from "@intx/types";
-import type { ArtifactDb } from "@corbits/artifacts";
-import {
-  seedTemplateLibrary,
-  type TemplateLibraryEntry,
-} from "@corbits/artifacts-hub";
-import {
-  publishCorbitsToolsRegistry,
-  type PublishCorbitsToolsRegistryArgs,
-} from "@corbits/tool-registry-publish";
-import {
-  signIn,
-  createHubAPI,
-  parseAs,
-  type ApiCall,
-  type Session,
-} from "@workbench/hub-client";
-import type { HubConfig } from "./config";
-
-const DEFAULT_RETRY_INTERVAL_MS = 10_000;
-const DEFAULT_MAX_RETRY_INTERVAL_MS = 5 * 60_000;
-const DEFAULT_GIVE_UP_AFTER_MS = 24 * 60 * 60_000;
-
-const log = getLogger(["hub", "template-library-seed"]);
-
-export type TemplateLibrarySeedDeps = {
-  baseUrl: string;
-  admin: HubConfig["envCredentialPlantAdmin"];
-  /** The fully composed, guarded app's own request entry point. */
-  fetch: (request: Request) => Promise<Response>;
-  artifactsDb: ArtifactDb;
-  entries: readonly TemplateLibraryEntry[];
-  retryIntervalMs?: number;
-  maxRetryIntervalMs?: number;
-  giveUpAfterMs?: number;
-  /** Test seams, replacing the real library seed and tarball publish. */
-  seed?: typeof seedTemplateLibrary;
-  publishTools?: (args: PublishCorbitsToolsRegistryArgs) => Promise<unknown>;
-};
-
-function localFetchImpl(
-  entry: (request: Request) => Promise<Response>,
-): typeof fetch {
-  return ((input, init) =>
-    entry(new Request(input as string, init as RequestInit))) as typeof fetch;
-}
-
-type BenchTarget = { tenantId: string; principalId: string };
-
-async function lookUpBench(
-  api: ApiCall,
-  cookies: string[],
-  orgSlug: string,
-): Promise<BenchTarget | "unauthorized" | "not-found"> {
-  const response = await api("GET", "/api/me/principals", undefined, cookies);
-  if (response.status === 401) return "unauthorized";
-  if (response.status !== 200) return "not-found";
-  const summary = parseAs(
-    paginatedSchema(PrincipalSummary),
-    response.data,
-    "principals response",
-  );
-  const membership = summary.data.find((p) => p.tenantSlug === orgSlug);
-  return membership !== undefined
-    ? { tenantId: membership.tenantId, principalId: membership.principalId }
-    : "not-found";
-}
-
-type ResolveResult =
-  | { status: "resolved"; target: BenchTarget; session: Session }
-  | { status: "unresolved"; session: Session };
-
-async function resolveWithSession(
-  api: ApiCall,
-  deps: TemplateLibrarySeedDeps,
-  cachedSession: Session | undefined,
-): Promise<ResolveResult> {
-  const session = cachedSession ?? (await signIn(api, deps.admin));
-  const lookup = await lookUpBench(api, session.cookies, deps.admin.orgSlug);
-  if (lookup !== "unauthorized") {
-    return lookup === "not-found"
-      ? { status: "unresolved", session }
-      : { status: "resolved", target: lookup, session };
-  }
-  // Stale cookie — re-authenticate once rather than waiting a full tick.
-  const freshSession = await signIn(api, deps.admin);
-  const retried = await lookUpBench(
-    api,
-    freshSession.cookies,
-    deps.admin.orgSlug,
-  );
-  return retried === "unauthorized" || retried === "not-found"
-    ? { status: "unresolved", session: freshSession }
-    : { status: "resolved", target: retried, session: freshSession };
-}
-
-/**
- * Fires the first seed attempt immediately (never blocking the caller)
- * and keeps retrying with exponential backoff until the operator bench
- * resolves and one full seed pass (library entries + tool tarballs)
- * completes. Both halves are idempotent, so a retry after a partial
- * failure redoes only what's missing.
- */
-export function scheduleTemplateLibrarySeed(deps: TemplateLibrarySeedDeps): {
-  stop: () => void;
-} {
-  if (deps.entries.length === 0) {
-    return { stop: () => {} };
-  }
-
-  const intervalMs = deps.retryIntervalMs ?? DEFAULT_RETRY_INTERVAL_MS;
-  const maxIntervalMs =
-    deps.maxRetryIntervalMs ?? DEFAULT_MAX_RETRY_INTERVAL_MS;
-  const giveUpAfterMs = deps.giveUpAfterMs ?? DEFAULT_GIVE_UP_AFTER_MS;
-  const seed = deps.seed ?? seedTemplateLibrary;
-  const publishTools = deps.publishTools ?? publishCorbitsToolsRegistry;
-
-  let stopped = false;
-  let timer: ReturnType<typeof setTimeout> | undefined;
-  let currentIntervalMs = intervalMs;
-  let lastLoggedReason: string | undefined;
-  let session: Session | undefined;
-  const startedAt = Date.now();
-
-  function scheduleRetry(): void {
-    if (stopped) return;
-    if (Date.now() - startedAt >= giveUpAfterMs) {
-      log.error`template library seed: giving up after ${Math.round(giveUpAfterMs / 3_600_000)}h with the operator bench still unresolved (last reason: ${lastLoggedReason ?? "unknown"})`;
-      session = undefined;
-      return;
-    }
-    timer = setTimeout(() => void attempt(), currentIntervalMs);
-    if (typeof timer.unref === "function") timer.unref();
-    currentIntervalMs = Math.min(currentIntervalMs * 2, maxIntervalMs);
-  }
-
-  function logUnresolved(reason: string): void {
-    if (reason === lastLoggedReason) return;
-    const level = lastLoggedReason === undefined ? "info" : "error";
-    const message = `template library seed: not ready yet (${reason}); will keep retrying with backoff up to ${Math.round(maxIntervalMs / 1000)}s`;
-    if (level === "error") log.error`${message}`;
-    else log.info`${message}`;
-    lastLoggedReason = reason;
-  }
-
-  async function attempt(): Promise<void> {
-    if (stopped) return;
-    const api = createHubAPI(deps.baseUrl, localFetchImpl(deps.fetch));
-    try {
-      const resolved = await resolveWithSession(api, deps, session);
-      if (resolved.status === "unresolved") {
-        session = resolved.session;
-        logUnresolved(
-          `operator bench "${deps.admin.orgSlug}" does not exist yet (or ${deps.admin.email} is not a member of it)`,
-        );
-        scheduleRetry();
-        return;
-      }
-      const outcomes = await seed({
-        db: deps.artifactsDb,
-        scope: {
-          tenantId: resolved.target.tenantId,
-          principalId: resolved.target.principalId,
-        },
-        entries: deps.entries,
-      });
-      for (const outcome of outcomes) {
-        log.info`template library seed: "${outcome.id}" ${outcome.outcome}`;
-      }
-      await publishTools({
-        api,
-        cookies: resolved.session.cookies,
-        hubUrl: deps.baseUrl,
-        tenantId: resolved.target.tenantId,
-        fetchImpl: localFetchImpl(deps.fetch),
-        log: (line) => log.info`${line}`,
-      });
-      session = undefined;
-    } catch (cause) {
-      session = undefined;
-      logUnresolved(cause instanceof Error ? cause.message : String(cause));
-      scheduleRetry();
-    }
-  }
-
-  void attempt();
-
-  return {
-    stop(): void {
-      stopped = true;
-      session = undefined;
-      if (timer !== undefined) clearTimeout(timer);
-    },
-  };
-}
diff --git a/apps/web/src/instant-agent-create.ts b/apps/web/src/instant-agent-create.ts
index 85a5660ea..da8be86f2 100644
--- a/apps/web/src/instant-agent-create.ts
+++ b/apps/web/src/instant-agent-create.ts
@@ -106,11 +106,13 @@ export async function createWorkbenchFromTemplate(
   if (setupTemplate === undefined) {
     throw new Error("No default setup agent found for this workbench.");
   }
-  // The manifest comes from the bench library the hub seeded at boot
-  // (CL-6344), never from a hardcoded catalog import. `blank` is the one
-  // id with no manifest by design; any other id resolving to nothing
-  // means this bench's boot seed hasn't run — fail loud rather than
-  // mint a workbench missing its agents.
+  // The manifest comes from the bench library (CL-6344), never from a
+  // hardcoded catalog import; reading it is what seeds the shelf
+  // (CL-6458). `blank` is the one id with no manifest by design; any
+  // other id resolving to nothing means this build ships no such
+  // template — fail loud rather than mint a workbench missing its
+  // agents. The picker only offers ids the library listed, so this is
+  // the race-loser's message, not the everyday path.
   const manifest =
     templateId === "blank"
       ? undefined
@@ -118,7 +120,7 @@ export async function createWorkbenchFromTemplate(
         undefined);
   if (templateId !== "blank" && manifest === undefined) {
     throw new Error(
-      `The "${templateId}" template isn't in this bench's library yet — its boot seed hasn't run.`,
+      `This bench can't set up a ${templateId} workbench yet — it isn't in the library.`,
     );
   }
   const requiresGithub =
diff --git a/apps/web/src/pages/new-workbench-picker.tsx b/apps/web/src/pages/new-workbench-picker.tsx
index 48129341e..76f45e898 100644
--- a/apps/web/src/pages/new-workbench-picker.tsx
+++ b/apps/web/src/pages/new-workbench-picker.tsx
@@ -15,6 +15,8 @@ import { useState } from "react";
 
 import type { ConnectGithubRepo } from "@corbits/chat-ui";
 
+import { useAPIQuery } from "../api";
+import { TemplateLibraryPage } from "../workbench-templates-api";
 import { useBench } from "../bench-context";
 import {
   createWorkbenchFromTemplate,
@@ -45,15 +47,40 @@ function ctaLabel(selected: boolean): string {
   return selected ? "Selected" : "Choose";
 }
 
+/** The one kind that needs no manifest: an empty room is always
+ * something this bench can set up. */
+const BLANK_TEMPLATE_ID: WorkbenchTemplateId = "blank";
+
 export function NewWorkbenchPickerRoute() {
   const navigate = useNavigate();
   const { selectedTenantId } = useBench();
-  const [selectedId, setSelectedId] = useState<WorkbenchTemplateId>(
-    WORKBENCH_TEMPLATES[0]?.id ?? "blank",
+  const library = useAPIQuery(
+    selectedTenantId === null
+      ? ""
+      : `/api/tenants/${selectedTenantId}/library/templates`,
+    TemplateLibraryPage,
   );
+  const [picked, setPicked] = useState<WorkbenchTemplateId | null>(null);
   const [creating, setCreating] = useState(false);
   const [repoPicker, setRepoPicker] = useState<RepoPickerState | null>(null);
 
+  // What this bench's library can actually serve (CL-6458). A kind whose
+  // manifest the library doesn't hold is shown as not set up rather than
+  // offered and then dead-ended on a 404 at create time.
+  const servedTemplateIds =
+    library.kind === "ready"
+      ? new Set(library.data.data.map((entry) => entry.id))
+      : new Set<string>();
+  const offeredTemplates = WORKBENCH_TEMPLATES.filter(
+    (template) =>
+      template.id === BLANK_TEMPLATE_ID || servedTemplateIds.has(template.id),
+  );
+  const unavailableTemplates = WORKBENCH_TEMPLATES.filter(
+    (template) => !offeredTemplates.includes(template),
+  );
+  const selectedId =
+    picked ?? offeredTemplates[0]?.id ?? WORKBENCH_TEMPLATES[0]?.id ?? "blank";
+
   const pickGithubRepos: PickGithubRepos = ({
     orgName,
     repos,
@@ -97,6 +124,8 @@ export function NewWorkbenchPickerRoute() {
       <div className="new-workbench-picker">
         {creating ? (
           <WorkbenchLoadingState title="Setting up your workbench…" />
+        ) : library.kind === "loading" ? (
+          <WorkbenchLoadingState title="Seeing what this bench can set up…" />
         ) : (
           <>
             <h3>What should this workbench do?</h3>
@@ -104,12 +133,27 @@ export function NewWorkbenchPickerRoute() {
               Pick one. You can change your mind later — nothing is locked in.
             </p>
 
+            {library.kind === "error" ? (
+              <p className="new-workbench-picker-sub" role="status">
+                Couldn't load what this bench can set up, so only a plain room
+                is on offer right now.{" "}
+                <Button
+                  type="button"
+                  variant="ghost"
+                  size="sm"
+                  onClick={() => library.retry()}
+                >
+                  Try again
+                </Button>
+              </p>
+            ) : null}
+
             <div
               className="new-workbench-pick-list"
               role="radiogroup"
               aria-label="Workbench kind"
             >
-              {WORKBENCH_TEMPLATES.map((template) => {
+              {offeredTemplates.map((template) => {
                 const Icon = ROW_ICON[template.id];
                 const selected = template.id === selectedId;
                 return (
@@ -120,7 +164,7 @@ export function NewWorkbenchPickerRoute() {
                     aria-checked={selected}
                     data-selected={selected ? "true" : undefined}
                     className="new-workbench-pick-row"
-                    onClick={() => setSelectedId(template.id)}
+                    onClick={() => setPicked(template.id)}
                   >
                     <span
                       className="new-workbench-pick-glyph"
@@ -143,6 +187,33 @@ export function NewWorkbenchPickerRoute() {
                 );
               })}
 
+              {unavailableTemplates.map((template) => {
+                const Icon = ROW_ICON[template.id];
+                return (
+                  <span
+                    key={template.id}
+                    className="new-workbench-pick-row"
+                    aria-disabled="true"
+                  >
+                    <span
+                      className="new-workbench-pick-glyph"
+                      aria-hidden="true"
+                    >
+                      <Icon size={16} strokeWidth={1.8} />
+                    </span>
+                    <span className="new-workbench-pick-text">
+                      <span className="new-workbench-pick-title">
+                        {template.title}
+                      </span>
+                      <span className="new-workbench-pick-promise">
+                        Not set up on this bench yet.
+                      </span>
+                    </span>
+                    <span className="new-workbench-pick-cta">Unavailable</span>
+                  </span>
+                );
+              })}
+
               <span className="new-workbench-pick-row" aria-disabled="true">
                 <span className="new-workbench-pick-glyph" aria-hidden="true">
                   <Plus size={16} strokeWidth={1.8} />
diff --git a/apps/web/src/workbench-templates-api.ts b/apps/web/src/workbench-templates-api.ts
index 664938799..f383f7dd5 100644
--- a/apps/web/src/workbench-templates-api.ts
+++ b/apps/web/src/workbench-templates-api.ts
@@ -1,9 +1,10 @@
-// Reads a workbench template's manifest from the bench library the hub
-// seeded at boot (CL-6344) — `instant-agent-create.ts` instantiates
-// from this seeded row, never from a hardcoded `@corbits/workflow-catalog`
-// import. The wire shape is the library's `{id, content}` entry; the
-// content string re-enters through the catalog's own manifest schema,
-// so a corrupt or stale library row fails loud here rather than
+// Reads a workbench template's manifest from the bench library (CL-6344)
+// — `instant-agent-create.ts` instantiates from this seeded row, never
+// from a hardcoded `@corbits/workflow-catalog` import. The read itself
+// is what converges the shelf (CL-6458), so these routes answer for a
+// bench of any age. The wire shape is the library's `{id, content}`
+// entry; the content string re-enters through the catalog's own manifest
+// schema, so a corrupt or stale library row fails loud here rather than
 // half-instantiating a workbench.
 
 import { type } from "arktype";
@@ -15,6 +16,11 @@ import { ApiQueryError } from "@corbits/api-query";
 
 const TemplateLibraryEntry = type({ id: "string > 0", content: "string > 0" });
 
+/** What the picker offers rows from: the ids this bench's library can
+ * actually serve, so a kind is never offered and then dead-ended on a
+ * missing manifest at create time. */
+export const TemplateLibraryPage = type({ data: TemplateLibraryEntry.array() });
+
 const TemplateBlockDeployResponse = type({
   id: "string > 0",
   created: "boolean",
diff --git a/apps/web/test/new-workbench-picker.test.tsx b/apps/web/test/new-workbench-picker.test.tsx
index 38a5b28a8..06a5d2545 100644
--- a/apps/web/test/new-workbench-picker.test.tsx
+++ b/apps/web/test/new-workbench-picker.test.tsx
@@ -58,8 +58,21 @@ function stubFetch(
     if (path.includes("/api/me/principals")) {
       return Promise.resolve(json(MEMBERSHIP));
     }
-    // The bench library the hub seeded at boot (CL-6344) — what the
-    // create flow instantiates from instead of a hardcoded import.
+    // The bench library the first read converges (CL-6458) — what the
+    // picker offers rows from and the create flow instantiates from,
+    // never a hardcoded import.
+    if (path.endsWith("/library/templates")) {
+      return Promise.resolve(
+        json({
+          data: [
+            {
+              id: "code-review",
+              content: serializeWorkbenchTemplateManifest(CODE_REVIEW_TEMPLATE),
+            },
+          ],
+        }),
+      );
+    }
     if (path.endsWith("/library/templates/code-review")) {
       return Promise.resolve(
         json({
@@ -131,6 +144,54 @@ describe("NewWorkbenchPickerRoute", () => {
     expect(container?.textContent).toContain("More kinds soon");
   });
 
+  // CL-6458: the picker offers what the bench's library can actually
+  // serve. A row the library has no manifest for is shown as not set up
+  // — never offered and then dead-ended on a 404 at create time.
+  test("a kind this bench's library cannot serve is not offered", async () => {
+    globalThis.fetch = ((input: RequestInfo | URL) => {
+      const path = typeof input === "string" ? input : String(input);
+      if (path.includes("/api/me/principals")) {
+        return Promise.resolve(json(MEMBERSHIP));
+      }
+      if (path.endsWith("/library/templates")) {
+        return Promise.resolve(json({ data: [] }));
+      }
+      throw new Error(`unexpected fetch: ${path}`);
+    }) as typeof fetch;
+    await renderPicker();
+
+    const radios = Array.from(
+      container?.querySelectorAll('[role="radio"]') ?? [],
+    );
+    expect(radios.length).toBe(1);
+    expect(radios[0]?.textContent).toContain("Just start talking");
+    expect(container?.textContent).toContain("Code review");
+    expect(container?.textContent).toContain("Not set up on this bench yet");
+  });
+
+  test("when the library can't be read, the row list says so instead of offering a dead end", async () => {
+    globalThis.fetch = ((input: RequestInfo | URL) => {
+      const path = typeof input === "string" ? input : String(input);
+      if (path.includes("/api/me/principals")) {
+        return Promise.resolve(json(MEMBERSHIP));
+      }
+      if (path.endsWith("/library/templates")) {
+        return Promise.resolve(json({ error: "boom" }, 503));
+      }
+      throw new Error(`unexpected fetch: ${path}`);
+    }) as typeof fetch;
+    await renderPicker();
+
+    expect(container?.textContent).toContain(
+      "Couldn't load what this bench can set up",
+    );
+    const radios = Array.from(
+      container?.querySelectorAll('[role="radio"]') ?? [],
+    );
+    expect(radios.length).toBe(1);
+    expect(radios[0]?.textContent).toContain("Just start talking");
+  });
+
   test("Code review is selected on entry, so Create workbench starts enabled", async () => {
     stubFetch(() => undefined);
     await renderPicker();
diff --git a/docs/seed-reconciliation.md b/docs/seed-reconciliation.md
index 20bec1ba3..b8ca03c31 100644
--- a/docs/seed-reconciliation.md
+++ b/docs/seed-reconciliation.md
@@ -16,14 +16,24 @@ onboarding run, a `workbench seed` — must satisfy four properties:
 Ambiguity always resolves toward property 3: when a pass cannot prove a
 row is still seed-owned, it leaves the row alone.
 
-## Template library (hub boot)
+## Template library (first library read)
 
-`apps/hub/src/template-library-seed.ts` schedules
-`seedTemplateLibrary` (`packages/artifacts-hub/src/template-library.ts`)
-against the operator bench. Each shipped template manifest becomes one
-versioned artifact row (`kind: workbench-template`, title = template
-id), and the seed records the SHA-256 of the content it last wrote in
-the artifact's `source.seededContentHash`.
+`createTemplateLibrarySeeder`
+(`packages/artifacts-hub/src/template-library.ts`) runs
+`seedTemplateLibrary` for the tenant whose shelf is being read, on the
+`GET /api/tenants/:id/library/templates` routes themselves. Each shipped
+template manifest becomes one versioned artifact row (`kind:
+workbench-template`, title = template id), and the seed records the
+SHA-256 of the content it last wrote in the artifact's
+`source.seededContentHash`.
+
+The trigger is the read, not a boot window, because template rows are
+tenant-scoped: every bench owns its own shelf, so a bench created long
+after the hub booted converges the first time its picker opens, in any
+boot order. One pass per tenant per process, shared by concurrent first
+reads; a failed pass is not remembered, so the next read retries rather
+than the shelf staying empty until a restart. A read whose pass failed
+answers 503 — never a 404, which would read as "no such template".
 
 - The marker distinguishes "the shipped manifest moved" (head content
   still equals the marker: write a new version) from "a member edited
diff --git a/packages/artifacts-hub/src/index.ts b/packages/artifacts-hub/src/index.ts
index 61b65f4c7..c905bee18 100644
--- a/packages/artifacts-hub/src/index.ts
+++ b/packages/artifacts-hub/src/index.ts
@@ -13,12 +13,15 @@ export {
   WORKBENCH_TEMPLATE_ARTIFACT_KIND,
   createTemplateLibraryDbStore,
   createTemplateLibraryRoutes,
+  createTemplateLibrarySeeder,
   createUnavailableTemplateLibraryRoutes,
   seedTemplateLibrary,
   type CreateTemplateLibraryRoutesDeps,
+  type CreateTemplateLibrarySeederArgs,
   type SeedTemplateLibraryArgs,
   type TemplateLibraryEngine,
   type TemplateLibraryEntry,
+  type TemplateLibrarySeeder,
   type TemplateLibraryStore,
   type TemplateSeedOutcome,
 } from "./template-library";
diff --git a/packages/artifacts-hub/src/template-library.test.ts b/packages/artifacts-hub/src/template-library.test.ts
index ed82d5cdf..6656f4153 100644
--- a/packages/artifacts-hub/src/template-library.test.ts
+++ b/packages/artifacts-hub/src/template-library.test.ts
@@ -4,10 +4,13 @@ import { Hono } from "hono";
 
 import {
   WORKBENCH_TEMPLATE_ARTIFACT_KIND,
+  createTemplateLibraryDbStore,
   createTemplateLibraryRoutes,
+  createTemplateLibrarySeeder,
   createUnavailableTemplateLibraryRoutes,
   seedTemplateLibrary,
   type TemplateLibraryEngine,
+  type TemplateLibrarySeeder,
   type TemplateLibraryStore,
 } from "./template-library";
 
@@ -441,11 +444,92 @@ describe("seedTemplateLibrary", () => {
   });
 });
 
+const OTHER_TENANT = { id: "tenant_b" };
+
+describe("createTemplateLibrarySeeder", () => {
+  test("seeds a tenant the first time it is asked, and not again after", async () => {
+    let passes = 0;
+    const seeder = createTemplateLibrarySeeder({
+      db: fakeDb,
+      entries: ENTRIES,
+      seed: async (args) => {
+        passes += 1;
+        return seedTemplateLibrary(args);
+      },
+      engine: memoryEngine().engine,
+    });
+
+    await seeder.ensureSeeded(SCOPE);
+    await seeder.ensureSeeded(SCOPE);
+    expect(passes).toBe(1);
+  });
+
+  test("concurrent first reads share one seed pass", async () => {
+    let passes = 0;
+    const seeder = createTemplateLibrarySeeder({
+      db: fakeDb,
+      entries: ENTRIES,
+      seed: async (args) => {
+        passes += 1;
+        await new Promise((resolve) => setTimeout(resolve, 5));
+        return seedTemplateLibrary(args);
+      },
+      engine: memoryEngine().engine,
+    });
+
+    await Promise.all([seeder.ensureSeeded(SCOPE), seeder.ensureSeeded(SCOPE)]);
+    expect(passes).toBe(1);
+  });
+
+  test("a failed pass never latches: the next read retries instead of giving up", async () => {
+    let passes = 0;
+    const seeder = createTemplateLibrarySeeder({
+      db: fakeDb,
+      entries: ENTRIES,
+      seed: async (args) => {
+        passes += 1;
+        if (passes === 1) throw new Error("database is booting");
+        return seedTemplateLibrary(args);
+      },
+      engine: memoryEngine().engine,
+    });
+
+    await expect(seeder.ensureSeeded(SCOPE)).rejects.toThrow(
+      "database is booting",
+    );
+    await seeder.ensureSeeded(SCOPE);
+    expect(passes).toBe(2);
+  });
+
+  test("each tenant converges on its own first read — no operator bench involved", async () => {
+    const seededTenants: string[] = [];
+    const seeder = createTemplateLibrarySeeder({
+      db: fakeDb,
+      entries: ENTRIES,
+      seed: async (args) => {
+        seededTenants.push(args.scope.tenantId);
+        return seedTemplateLibrary(args);
+      },
+      engine: memoryEngine().engine,
+    });
+
+    await seeder.ensureSeeded(SCOPE);
+    await seeder.ensureSeeded({
+      tenantId: OTHER_TENANT.id,
+      principalId: "prin_b",
+    });
+    expect(seededTenants).toEqual([TENANT.id, OTHER_TENANT.id]);
+  });
+});
+
 type TestEnv = {
   Variables: { tenant: { id: string }; principal: { id: string } };
 };
 
-function mountRoutes(store: TemplateLibraryStore): Hono<TestEnv> {
+function mountRoutes(
+  store: TemplateLibraryStore,
+  seeder: TemplateLibrarySeeder,
+): Hono<TestEnv> {
   const app = new Hono<TestEnv>();
   app.use("*", async (c, next) => {
     c.set("tenant", TENANT);
@@ -454,11 +538,18 @@ function mountRoutes(store: TemplateLibraryStore): Hono<TestEnv> {
   });
   app.route(
     "/library/templates",
-    createTemplateLibraryRoutes({ store, requireGrant: allowAll }),
+    createTemplateLibraryRoutes({
+      store,
+      seeder,
+      requireGrant: allowAll,
+      log: () => {},
+    }),
   );
   return app;
 }
 
+const noopSeeder: TemplateLibrarySeeder = { ensureSeeded: async () => {} };
+
 const fakeStore: TemplateLibraryStore = {
   async list(tenantId) {
     return tenantId === TENANT.id ? ENTRIES : [];
@@ -469,15 +560,29 @@ const fakeStore: TemplateLibraryStore = {
   },
 };
 
+/** The bench the owner actually hit: a tenant nothing ever seeded, on a
+ * hub that never resolved an operator bench. Reads go through the real
+ * store over the same memory engine the seeder writes into, so a served
+ * template proves the read itself converged the shelf. */
+function mountUnseededTenant(): Hono<TestEnv> {
+  const { engine } = memoryEngine();
+  return mountRoutes(
+    createTemplateLibraryDbStore(fakeDb, engine),
+    createTemplateLibrarySeeder({ db: fakeDb, entries: ENTRIES, engine }),
+  );
+}
+
 describe("template library routes", () => {
   test("lists the seeded entries", async () => {
-    const res = await mountRoutes(fakeStore).request("/library/templates");
+    const res = await mountRoutes(fakeStore, noopSeeder).request(
+      "/library/templates",
+    );
     expect(res.status).toBe(200);
     expect(await res.json()).toEqual({ data: ENTRIES });
   });
 
   test("fetches one template by id", async () => {
-    const res = await mountRoutes(fakeStore).request(
+    const res = await mountRoutes(fakeStore, noopSeeder).request(
       "/library/templates/code-review",
     );
     expect(res.status).toBe(200);
@@ -485,11 +590,41 @@ describe("template library routes", () => {
   });
 
   test("404s an id the library does not hold", async () => {
-    const res = await mountRoutes(fakeStore).request(
+    const res = await mountRoutes(fakeStore, noopSeeder).request(
       "/library/templates/standup",
     );
     expect(res.status).toBe(404);
   });
+
+  test("a never-seeded tenant's first list read seeds the shelf and serves it", async () => {
+    const res = await mountUnseededTenant().request("/library/templates");
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({ data: ENTRIES });
+  });
+
+  test("a never-seeded tenant's first template read serves the template instead of 404ing", async () => {
+    const res = await mountUnseededTenant().request(
+      "/library/templates/code-review",
+    );
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual(CODE_REVIEW_ENTRY);
+  });
+
+  test("a seed the read could not run answers 503, never a 404 that reads as 'no such template'", async () => {
+    const failing: TemplateLibrarySeeder = {
+      ensureSeeded: async () => {
+        throw new Error("artifacts database unreachable");
+      },
+    };
+    const app = mountRoutes(fakeStore, failing);
+
+    const list = await app.request("/library/templates");
+    expect(list.status).toBe(503);
+    const one = await app.request("/library/templates/code-review");
+    expect(one.status).toBe(503);
+    const body = (await one.json()) as { error: { code: string } };
+    expect(body.error.code).toBe("unavailable");
+  });
 });
 
 describe("createUnavailableTemplateLibraryRoutes", () => {
diff --git a/packages/artifacts-hub/src/template-library.ts b/packages/artifacts-hub/src/template-library.ts
index 183366462..fadca2bd0 100644
--- a/packages/artifacts-hub/src/template-library.ts
+++ b/packages/artifacts-hub/src/template-library.ts
@@ -3,6 +3,12 @@
  * shipped template manifests in as versioned artifact rows, and the
  * tenant-scoped read routes a create flow instantiates from.
  *
+ * What triggers a seed (CL-6458): the read itself. Every bench that can
+ * read the shelf owns one — the rows are tenant-scoped artifacts, so
+ * "the tenant being read" is the only honest owner, and a bench created
+ * long after the hub booted converges the first time its picker opens.
+ * There is no window to miss and no bench to wait for.
+ *
  * Reconciliation semantics (CL-6400): every boot converges the shelf
  * to the shipped manifests without ever fighting a member. The seed
  * records the hash of the content it last wrote in the artifact's
@@ -337,27 +343,130 @@ export function createTemplateLibraryDbStore(
   };
 }
 
+/**
+ * What makes a tenant's shelf match the shipped manifests before it is
+ * read (CL-6458). Seeding is triggered by the read itself rather than by
+ * a boot-time window: a bench created after the hub booted converges the
+ * first time anyone opens the picker, in any boot order, with no
+ * operator bench in the picture.
+ */
+export type TemplateLibrarySeeder = {
+  ensureSeeded(scope: { tenantId: string; principalId: string }): Promise<void>;
+};
+
+export type CreateTemplateLibrarySeederArgs = {
+  db: ArtifactDb;
+  entries: readonly TemplateLibraryEntry[];
+  engine?: TemplateLibraryEngine;
+  seed?: typeof seedTemplateLibrary;
+  log?: (line: string) => void;
+};
+
+/**
+ * One reconciliation pass per tenant per process: concurrent first reads
+ * share a pass, a converged tenant costs nothing on later reads, and a
+ * failed pass is not remembered, so the next read retries it. Nothing
+ * here is a cache of the shelf's contents — `seedTemplateLibrary` is
+ * itself convergent (CL-6400), so a redeploy carrying changed manifests
+ * reconciles on the new process's first read.
+ */
+export function createTemplateLibrarySeeder(
+  args: CreateTemplateLibrarySeederArgs,
+): TemplateLibrarySeeder {
+  const seed = args.seed ?? seedTemplateLibrary;
+  const log = args.log ?? ((): void => undefined);
+  const converged = new Set<string>();
+  const inFlight = new Map<string, Promise<void>>();
+
+  async function runPass(scope: {
+    tenantId: string;
+    principalId: string;
+  }): Promise<void> {
+    const outcomes =
+      args.engine === undefined
+        ? await seed({ db: args.db, scope, entries: args.entries })
+        : await seed({
+            db: args.db,
+            scope,
+            entries: args.entries,
+            engine: args.engine,
+          });
+    for (const outcome of outcomes) {
+      log(
+        `template library ${scope.tenantId}: "${outcome.id}" ${outcome.outcome}`,
+      );
+    }
+    converged.add(scope.tenantId);
+  }
+
+  return {
+    async ensureSeeded(scope) {
+      if (args.entries.length === 0 || converged.has(scope.tenantId)) return;
+      const running = inFlight.get(scope.tenantId);
+      if (running !== undefined) return running;
+      const pass = runPass(scope).finally(() => {
+        inFlight.delete(scope.tenantId);
+      });
+      inFlight.set(scope.tenantId, pass);
+      return pass;
+    },
+  };
+}
+
 export type CreateTemplateLibraryRoutesDeps = {
   store: TemplateLibraryStore;
+  seeder: TemplateLibrarySeeder;
   requireGrant: RequireGrant;
+  /** Where a failed reconciliation's real cause goes; the client sees
+   * one honest "unavailable", never a 404 that reads as "no such
+   * template". */
+  log: (line: string) => void;
 };
 
 /** `GET /` lists every seeded template entry; `GET /:templateId` fetches
- * one. Content travels as the seeded string — the client parses it with
+ * one. Both converge the tenant's shelf before reading it. Content
+ * travels as the seeded string — the client parses it with
  * `@corbits/workflow-catalog`'s manifest schema at its own boundary. */
 export function createTemplateLibraryRoutes(
   deps: CreateTemplateLibraryRoutesDeps,
 ): Hono<TenantEnv> {
   const app = new Hono<TenantEnv>();
 
+  async function converge(
+    tenantId: string,
+    principalId: string,
+  ): Promise<Response | null> {
+    try {
+      await deps.seeder.ensureSeeded({ tenantId, principalId });
+      return null;
+    } catch (cause) {
+      deps.log(
+        `template library seed failed for ${tenantId}: ${cause instanceof Error ? cause.message : String(cause)}`,
+      );
+      return Response.json(
+        {
+          error: {
+            code: "unavailable",
+            message: "The template library isn't ready yet",
+          },
+        },
+        { status: 503 },
+      );
+    }
+  }
+
   app.get("/", deps.requireGrant("asset:*", "read"), async (c) => {
     const tenant = c.get("tenant");
+    const failed = await converge(tenant.id, c.get("principal").id);
+    if (failed !== null) return failed;
     const entries = await deps.store.list(tenant.id);
     return c.json({ data: entries });
   });
 
   app.get("/:templateId", deps.requireGrant("asset:*", "read"), async (c) => {
     const tenant = c.get("tenant");
+    const failed = await converge(tenant.id, c.get("principal").id);
+    if (failed !== null) return failed;
     const entry = await deps.store.get(tenant.id, c.req.param("templateId"));
     if (entry === null) {
       return c.json(
diff --git a/packages/evals/src/targets/real-target.ts b/packages/evals/src/targets/real-target.ts
index 05a290969..cbe23c242 100644
--- a/packages/evals/src/targets/real-target.ts
+++ b/packages/evals/src/targets/real-target.ts
@@ -139,16 +139,6 @@ export interface MyraTargetInfra {
     hubDataDir: string;
     fakeReceipts: () => readonly FakeReceipt[];
   }) => Promise<WorldSnapshot>;
-  /** Seeds the bench-library template shelf for the freshly provisioned
-   * scratch tenant — the SAME `seedTemplateLibrary` path hub boot runs
-   * (`@corbits/artifacts-hub`), with the scratch tenant's own admin
-   * standing in for the operator bench the env-credential-plant admin
-   * resolves in production. Without it the eval tenant has no seeded
-   * manifests and `installTemplate` fails loudly on the library read. */
-  seedTemplateLibrary?: (scope: {
-    tenantId: string;
-    principalId: string;
-  }) => Promise<void>;
 }
 
 /** Never sent anywhere for real in plumbing mode — see the module
@@ -421,37 +411,6 @@ export async function bootMyraTarget(
       },
     );
 
-    // Bench-library template seed: same path, scratch admin (see
-    // `MyraTargetInfra.seedTemplateLibrary`). Runs before any install
-    // step so `installTemplate`'s library read finds the manifests.
-    if (infra.seedTemplateLibrary !== undefined) {
-      const principalsRes = await api(
-        hub.baseUrl,
-        "GET",
-        "/api/me/principals",
-        undefined,
-        cookies,
-      );
-      expectStatus("list principals for the library seed", principalsRes, 200);
-      const memberships = arrayField(
-        principalsRes.data,
-        "data",
-        "list principals for the library seed",
-      ) as { tenantId: string; principalId: string }[];
-      const membership = memberships.find(
-        (row) => row.tenantId === seeded.tenantId,
-      );
-      if (membership === undefined) {
-        throw new Error(
-          `library seed: no principal membership for tenant ${seeded.tenantId}`,
-        );
-      }
-      await infra.seedTemplateLibrary({
-        tenantId: seeded.tenantId,
-        principalId: membership.principalId,
-      });
-    }
-
     // Connect every started fake through the exact same route Plugins
     // uses for a real MCP server — no eval-only connect mechanism.
     for (const [index, fake] of startedFakes.entries()) {
@@ -723,6 +682,8 @@ export async function bootMyraTarget(
     // `createWorkbenchFromTemplate` drives — seeded-library manifest
     // read, workbench mint, `instantiateWorkbenchTemplate` over
     // HTTP-bound ports — never an eval-only instantiation mechanism.
+    // The library read is also what seeds this scratch tenant's shelf
+    // (CL-6458), so a passing install proves convergence on first read.
     async function installTemplate(templateId: string): Promise<Turn> {
       const entryRes = await api(
         hub.baseUrl,
diff --git a/scripts/evals-run.ts b/scripts/evals-run.ts
index 67990f584..a3e9ac0c5 100644
--- a/scripts/evals-run.ts
+++ b/scripts/evals-run.ts
@@ -36,9 +36,6 @@ import {
   type MyraTargetMcpFake,
   type RunConfig,
 } from "@corbits/evals";
-import { createArtifactDb } from "@corbits/artifacts";
-import { seedTemplateLibrary } from "@corbits/artifacts-hub";
-import { workbenchTemplateLibraryEntries } from "@corbits/workflow-catalog";
 import { createDB } from "@intx/db";
 import { createBootAssetWiring } from "../apps/hub/src/asset-service-factory.ts";
 import { resetSchema, setupDatabase } from "./db-setup.ts";
@@ -103,22 +100,6 @@ const infra: MyraTargetInfra = {
       await close();
     }
   },
-  // The same `seedTemplateLibrary` path hub boot runs
-  // (template-library-seed.ts), with the scratch tenant's own admin in
-  // place of the operator bench — same entries, same idempotent seed.
-  seedTemplateLibrary: async (scope) => {
-    const url = requireE2eDatabaseUrl("seedTemplateLibrary");
-    const { db, close } = createArtifactDb(url);
-    try {
-      await seedTemplateLibrary({
-        db,
-        scope,
-        entries: workbenchTemplateLibraryEntries(),
-      });
-    } finally {
-      await close();
-    }
-  },
 };
 
 function databaseUrl(): string | undefined {