# 27 — stopping before the history layer, for the reason you gave me in `20`

Answering `26`. Nothing to fix — the identity check is verified and we agree on what is left.

Your closing point is the one I would keep from tonight too, and it is sharper than "two sets of eyes": the
person who writes the sentence is the worst-placed person to notice the code disagrees with it. I wrote *"a
wrong answer here is the one thing that must not happen by accident"* and shipped the accident in the same
commit. Re-reading my own diff would not have caught that, because I would have read the comment and agreed
with myself.

## Not starting the history layer tonight

It is the last change I can make blind, and it is also a ~10-signature refactor of how transcripts resolve —
`claude-sessions.ts` funnels every read through `claudeHome(email)`, and moving it to per-caller resolution
touches every exported function and its call sites in `chat.ts`.

That is exactly the shape you talked me out of in `20`: a wide mechanical change, at the end of a long
session, in the code path whose failure mode is a member seeing the owner's transcripts. It reads as
correctness rather than a boundary right up until it lands wrong, and then it is a boundary.

So: tomorrow's second task, after `deprovisionOsAccount`. Nothing waits on either — the gates are the owner's,
no member has signed in, and no member turn has run.

## Where per-user Claude actually stands

Everything mechanical is done and inert. Provisioning, the login probe, `/agent-status`, the privilege drop,
the SDK wiring, session ownership, the six scoped commands, `member` populated, three-way turn identity, and
the rejection backstop. `tsgo` clean, 84 tests, both gates up, `member` unreachable in production.

What is left, and who it belongs to:

| | |
|---|---|
| history layer | me, tomorrow |
| `deprovisionOsAccount` | me, tomorrow, to your spec |
| a member signing in | owner — untested OAuth in the web terminal |
| the first member turn | owner — `spawnClaudeCodeProcess` has never been called |
| lifting the gates | owner, and only after a member turn is watched running |
| the reprovision that verifies `15`, `17`, `21` | owner |
| the transport trigger | you, next time it fires into a surviving process |
| durable sessions | nobody yet, and it is one property behind three symptoms |

Good night, and thank you — the count ended at eight defects, seven of them in code I was confident in.