a member's turn ran as the owner after any idle gap

This is the cause. Everything before it was symptom.

`handleChat` had two spawn call sites. The first, for a new session, passed `member`.
The second — "session already live" — was a separate object literal that did not.

That branch is taken whenever OFFICER still holds the session, and officer holds it
long after the SIDECAR has let go: the sidecar reaps a session after 30 minutes idle,
`_claudeKill` stays set here regardless. So a gap sent a turn with no identity to a
sidecar with nothing to push it onto, and it created a fresh session from those
params. No member means the owner.

    [claude:spawn:…] resume=49527b33… cwd=…/data/jg@pertento.ai/home as=owner

green is a Developer with their own Linux account, their own `claude` and their own
login. Every turn after a break ran as the OWNER: owner's HOME, owner's Anthropic
credential, owner's MCP config — which carries a JWT that signs as the owner. The
entire per-member boundary, undone by an omitted line in the branch nobody reads.

It surfaced as breakage rather than as silent escalation only by luck. The owner's
`claude` was handed the member's cwd — a 700 home it cannot enter — and the member's
transcript id, so it exited 1 instead of quietly working. Reported as "he went for a
walk and it stopped working", which is the idle timeout to the minute.

── The fix, and what it then found ──

Both paths now build from one `turnParams`, so they cannot drift again.

Then `member` was made REQUIRED-though-possibly-undefined in the protocol, and the
compiler immediately found three more sites that had left it out:

  - `agent-handoff/deliver.ts` — the same bug, worse. No member AND a cwd from
    `getOwnerHomeDir`, which ignores the email it is given. A member's agent panel ran
    as the owner in the owner's home. Now resolves identity like chat does.
  - `agents/agent-runner.ts`, `tasks/pipeline-executor.ts` — correct as they were:
    both are `kind: 'execution'`, owner-only and never grantable. They now say
    `member: undefined` explicitly, because a field you must fill in is a decision and
    a field you may omit is an accident.

`resolveTurnIdentity` is exported so "whose turn is this" has one implementation
rather than three.

── What I got wrong on the way ──

Three wrong answers first — the credential, the working directory, then a recovery
whose condition could never fire — each from reading code and reasoning instead of
making the system say what it was doing. The log line that found this took five
minutes to write and should have been the first thing I did, not the fourth.

Also: `--resume` by hand appeared to work twice, which is what sent me down the wrong
paths. It proved nothing. The id I tested was not the id the platform passed.

tsgo clean, 950 pass / 7 fail unchanged.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/servers/api/chat/websocket.ts

@@ -52,7 +52,7 @@ type TurnIdentity =
   | { kind: 'member'; run: { osUser: string; home: string } }
   | { kind: 'refuse'; reason: string };
 
-async function resolveTurnIdentity(userId: number): Promise<TurnIdentity> {
+export async function resolveTurnIdentity(userId: number): Promise<TurnIdentity> {
   const resolved = await resolveHomeDir(userId);
   if (!resolved.ok) return { kind: 'refuse', reason: resolved.reason };
   if (resolved.isOwner) return { kind: 'owner' };
@@ -534,41 +534,54 @@ async function handleClaudeCodeChat(
 
   const onMessage = createMessageHandler(sessionId, model);
 
+  /**
+   * One description of the turn, used by both paths below.
+   *
+   * They were two object literals, and they had drifted: the first carried `member`, the second did not.
+   * The second is taken whenever officer already holds a session — which it does long after the SIDECAR has
+   * let go, because the sidecar tears a session down after 30 minutes idle while `_claudeKill` stays set
+   * here. So an idle gap sent a turn with no identity to a sidecar that no longer had a session to push it
+   * onto, and it created a new one. With no member, that means the OWNER.
+   *
+   * What that cost, on a real account: a `Developer` with their own Linux user, their own `claude` and their
+   * own login had every turn after a break run as the owner — in the owner's HOME, with the owner's Anthropic
+   * credential and the owner's MCP config, which carries a JWT that signs as the owner. The whole point of
+   * per-member accounts, undone by an omitted line in the branch nobody looks at.
+   *
+   * It surfaced as breakage rather than as a silent escalation only by luck: the owner's `claude` was handed
+   * the member's cwd — a 700 home it cannot enter — and their transcript id, so it exited 1 instead of
+   * quietly working. Reported as "the chat stopped after he went for a walk", which is the idle timeout.
+   *
+   * Built once now, so the two paths cannot disagree again.
+   */
+  const turnParams = {
+    userId,
+    email,
+    username,
+    prompt: effectivePrompt,
+    images: msg.images,
+    sessionKey: sessionId,
+    cwd,
+    model,
+    // Never from the client: whose account a turn runs as is resolved here and nowhere else.
+    member: identity.kind === 'member' ? identity.run : undefined,
+    resumeSessionId: msg.resumeSessionId,
+  };
+
   try {
     if (!session._claudeKill) {
       // First turn of this session: open the persistent session + a SESSION-scoped event subscription
       // (survives turn-end so background task:notifications keep flowing). `kill` tears both down for an
       // explicit disconnect; `detach` drops only the listener, which is what the idle GC uses so an
       // absent browser stops taking a live agent with it.
-      const handle = await sendClaudeCodeStreaming({
-        userId,
-        email,
-        username,
-        prompt: effectivePrompt,
-        images: msg.images,
-        sessionKey: sessionId,
-        cwd,
-        model,
-        member: identity.kind === 'member' ? identity.run : undefined,
-        resumeSessionId: msg.resumeSessionId,
-        onMessage,
-      });
+      const handle = await sendClaudeCodeStreaming({ ...turnParams, onMessage });
       session.piProcess = sessionId as any;
       session._claudeKill = handle.kill;
       session._sidecarUnsub = handle.detach;
     } else {
-      // Session already live: push this turn onto the existing persistent session (no new subscription).
-      await sidecar.spawnClaudeStreaming({
-        userId,
-        email,
-        username,
-        prompt: effectivePrompt,
-        images: msg.images,
-        sessionKey: sessionId,
-        cwd,
-        model,
-        resumeSessionId: msg.resumeSessionId,
-      });
+      // Session already live HERE — which does not mean it is live in the sidecar. If it is not, the sidecar
+      // creates one from these params, so they must be complete.
+      await sidecar.spawnClaudeStreaming(turnParams);
     }
   } catch (err) {
     logger.error('Failed to start Claude Code streaming', { sessionId, error: String(err) });