0050 — ccswitch runs on the mini only; the MacBook uses its own login

• Status: Accepted. Decided 2026-10-05, written down 2026-10-12, when the code began to depend on it (dotclaude #230).
• Date: 2026-10-05
• Deciders: Gera.
• Systems: ccswitch, dotclaude shell/aliases.sh (_pf_run, the pf launcher), dotclaude statusline.sh, dotclaude skills/tmux/open-top.py (Reopen Tabs).

The problem

Gera, 2026-10-05: "we don't want the CC switch on Mac book, only on the mini."

ccswitch never worked on the MacBook. Claude Code keeps Mac logins in the Keychain (/login), and a ccswitch swap does not reach the Keychain. That night ccswitch tried to move one Mac session about 50 times. So a session turned it off on the Mac:

• ~/.claude/ccswitch/config.json, which is Mac-only and not in git, disables every action: auto_switch, auto_walled_heal, auto_wedge_heal, auto_rotate_bearer and register_sessions.
• Its two background jobs (co.propflow.ccswitch-snapshot, co.propflow.ccswitch-pull) were moved to ~/Library/LaunchAgents/disabled-ccswitch/.

No ADR was written, and one place kept calling ccswitch: pf still started every Mac session through ccswitch exec. With its snapshot six days stale, that gate fell back to name order. On 2026-10-11 it spent its four probes on gera@ (5h at 99%) and three capped accounts, then exited 3, even though agentsmith@ was usable in sixth place. tmux closed the pane on that exit, so all Gera saw was ✦ creating NEW tmux … [exited]. In the same state, the status bar told every Mac session ⛔ UNMANAGED — stop this session.

Options considered

• A. Turn the Mac snapshot job back on, so the gate ranks accounts correctly. Ruled out. It reverses the decision, and a gated Mac session still binds a fleet bearer over the login Gera just made.
• B. Raise EXEC_MAX_PROBES or reorder the candidates. Ruled out for the same reason. It fixes the ranking, but the gate is still deciding Mac accounts.
• C (this decision). On the Mac, nothing from ccswitch runs at launch or in the status bar.

The decision

1. ccswitch is the mini's. On the MacBook it neither spawns, moves, heals, rotates nor registers sessions.
2. pf on the Mac starts plain claude on the Keychain login. On the mini, pf and mpf still start through ccswitch exec, because swap-in-place and subagent safety depend on that (ADR-0024). The check is hostname -s matching MiniClaws*, the same test _pf_run already used to arm a Driver.
3. The status bar's ccswitch labels are mini-only. On the Mac it shows neither UNMANAGED nor any verdict read from a ccswitch store or snapshot. The lease twin check (NOT THIS COPY) does not belong to ccswitch and still runs on both machines.

Consequences

• A Mac session's account is whatever /login says. When it runs out, Gera runs /login again. Nothing moves it automatically, and that is the intended trade.
• Mac sessions spend from the same accounts the fleet uses, and nothing on the mini sees them. The ccswitch entry in SYSTEMS.md already says an interactive Mac claude "never rotates at all". This makes that the rule, not an accident.
• Reopen Tabs reads ~/.claude/ccswitch/session-cfg/<tmux>/history.jsonl on the mini to recover a conversation ID that a tab record is missing. That is a read of ccswitch's per-session files, not a ccswitch action, and it only works for sessions born through the gate. Mac tabs need their ID on the tab record.
• Reversing this decision on the Mac means re-enabling config.json, the two LaunchAgents, and both host checks in dotclaude, in that order.