Plan 00088: fix claude_state_dir resolving to /root/.claude, not the user's

play-claude-code.yml computed claude_state_dir from ansible_facts['env']['HOME'],
which ansible.cfg's gathering=smart + persistent fact_caching=jsonfile lets an
EARLIER play's privilege context poison: play-AA-preflight-sanity.yml (play #1
in playbook-main.yml) runs become: true at the play level, elevating its own
fact-gathering, so HOME is cached as /root for the rest of the run regardless
of this play's own become: false. Every other user-home lookup in this same
file already avoids ansible_facts['env']['HOME'] for exactly this reason
(/home/{{ user_login }}/... at five other call sites) — bring this one in line.

Found live, downstream, by lts-infra Plan 00045's proof of
RUN_BASH_GITHUB_ACCOUNTS=none: the first run in that harness able to actually
exercise Plan 00086's kernel-modules fix got past it cleanly and then hit this,
a sixth and unrelated defect in the same proof chain.

Author: LTSCommerce

CLAUDE/Plan/00088-claude-code-state-dir-stale-home-fact/JOURNAL/00088-Journal-26-08-24.md

@@ -0,0 +1,64 @@
+# Plan 00088 — Journal 26-08-24
+
+> **Append-only activity log** for plan 00088. One file per day
+> (`00088-Journal-YY-MM-DD.md`). `PLAN.md` tracks the plan (what/why,
+> current state, tasks); this journal tracks what actually *happened* —
+> findings, decisions, dead-ends, hand-off state — the linear lifecycle a plan
+> document structurally cannot carry.
+>
+> **Entry grammar** — append new entries at the BOTTOM; NEVER edit earlier
+> entries (corrections are new entries):
+>
+> ```
+> ## HH:MM · category · REF   — optional short title
+> ```
+>
+> - `HH:MM` local 24h (the date is in the filename); times increase down the file.
+> - `category` ∈ `action` | `finding` | `decision` | `thought` | `blocker` | `handoff`
+> - `REF` = optional task/phase ref (`T1.2`, `P1`) or `—`.
+> - Bodies may embed fenced logs/diffs/snippets — no size limit — with a
+>   one-line takeaway above the fence.
+> - End a working session with a `handoff` entry so the next agent's entry
+>   point is the last entry of the newest day-file.
+
+## 17:24 · action · — — plan scaffolded
+
+Plan 00088 created via `mkplan.bash`; `JOURNAL/` initialised. Next:
+fill in `PLAN.md`, then log progress here as it happens.
+
+## 17:26 · finding · T1.1 — root cause confirmed by reading source, not the log alone
+
+lts-infra's Plan 00045 live-proof run (the first genuinely able to exercise Plan
+00086's kernel-modules fix) got past kernel-modules cleanly (`half_installed_kernels`
+correctly resolved to `[]`) and then hard-failed much later, deep into
+`playbook-main.yml`, at `play-claude-code.yml:143` ("Check Whether the Claude
+Code State Directory Exists"): `Permission denied: [Errno 13] Permission denied:
+b'/root/.claude'`.
+
+Traced to source rather than assumed from the log:
+
+1. `play-claude-code.yml` line 18: `claude_state_dir: "{{ ansible_facts['env']
+   ['HOME'] }}/.claude"`. The play itself runs `become: false`.
+2. `ansible.cfg`: `gathering = smart` + `fact_caching=jsonfile` — facts are
+   gathered once per host per run (or persisted across runs) and reused by
+   every subsequent play targeting that host, regardless of that later play's
+   own `become` setting.
+3. `playbooks/playbook-main.yml` import order: `play-AA-preflight-sanity.yml`
+   is play #1, and runs with `become: true` at the PLAY level — which elevates
+   its own implicit `setup` fact-gathering task too, so `ansible_facts['env']
+   ['HOME']` is captured as `/root` (via `ansible.cfg`'s `sudo_flags=-HE`) at
+   the very start of the run.
+4. `play-claude-code.yml` runs tens of plays later in the same run and, under
+   `gathering=smart`, inherits that same stale-for-its-own-context cached fact
+   instead of re-gathering fresh as the connecting (non-root) user.
+
+This is deterministic — it would reproduce on any fresh guest, not just this
+one — and confirmed unrelated to anything already fixed in this proof chain
+(PR #33/#34/#35/#36/#37).
+
+The fix is obvious once traced: the REST of `play-claude-code.yml` already
+knows not to trust `ansible_facts['env']['HOME']` for exactly this reason — five
+other places in the same file (lines 50, 61, 82, 99, 230, 259) build the real
+user's home explicitly as `/home/{{ user_login }}` rather than reading it from
+gathered facts. `claude_state_dir` is the one place that never got the same
+treatment. Fixing it to match the file's own established pattern.

CLAUDE/Plan/00088-claude-code-state-dir-stale-home-fact/PLAN.md

@@ -0,0 +1,90 @@
+# Plan 00088: claude code state dir stale home fact
+
+**Status**: Not Started
+**Created**: 2026-08-24
+**Owner**: joseph
+**Priority**: Medium
+
+## Overview
+
+A downstream deployment repo's live proof of `playbook-main.yml` on a real guest
+(the first run in that harness able to actually exercise Plan 00086's
+kernel-modules fix — see that plan) got past every prior defect in this proof
+chain and then failed deep in `play-claude-code.yml`: "Check Whether the Claude
+Code State Directory Exists" hard-failed with `Permission denied: [Errno 13] Permission denied: b'/root/.claude'`.
+
+Root cause, confirmed by reading the actual source rather than guessed from the
+log: `play-claude-code.yml` computes `claude_state_dir: "{{ ansible_facts['env']['HOME'] }}/.claude"` (line 18) as a play-level var. This
+play runs with `become: false` — its own tasks should run as the real login user
+— but `ansible.cfg` sets `gathering = smart` with a **persistent** on-disk fact
+cache (`fact_caching=jsonfile`). The very FIRST play in `playbook-main.yml`,
+`play-AA-preflight-sanity.yml`, runs with `become: true` at the PLAY level, which
+elevates its implicit `setup` fact-gathering task too — so `ansible_facts['env'] ['HOME']` is captured as `/root` (root's home, via `sudo_flags=-HE`'s `-H`) at
+the very start of the run. Every later play targeting the same host — including
+`play-claude-code.yml`, run tens of plays later — inherits that SAME cached,
+stale-for-its-own-context fact under `gathering=smart`, rather than re-gathering
+fresh as the connecting user. This is deterministic and would reproduce on any
+fresh host, not an artefact of this guest's history: confirmed by reading
+`ansible.cfg` (`gathering = smart`, `fact_caching=jsonfile`) and
+`playbook-main.yml`'s import order (preflight-sanity is play #1, `become: true`).
+
+The rest of `play-claude-code.yml` already knows not to trust
+`ansible_facts['env']['HOME']` for this exact reason: five other places in the
+SAME file (lines 50, 61, 82, 99, 230, 259) build the real user's home explicitly
+as `/home/{{ user_login }}` rather than reading it from gathered facts.
+`claude_state_dir` is the one place in the file that never got the same
+treatment.
+
+This is a sixth, unrelated defect surfaced downstream while proving PR #33
+(`RUN_BASH_GITHUB_ACCOUNTS=none`) end-to-end — none of the mechanisms proven so
+far (PR #33/#34/#35/#36/#37) are implicated.
+
+## Goals
+
+- Make `claude_state_dir` resolve to the real target user's home reliably,
+  independent of which play in `playbook-main.yml` happened to gather facts
+  first and under what privilege context.
+- Bring `claude_state_dir` in line with the rest of `play-claude-code.yml`'s
+  own established convention (`/home/{{ user_login }}/...`), not invent a new
+  pattern.
+
+## Non-Goals
+
+- Not changing `ansible.cfg`'s `gathering`/`fact_caching` settings, and not
+  changing `play-AA-preflight-sanity.yml`'s `become: true` — both are
+  legitimate on their own terms; the fix is to stop this one play depending on
+  a fact that another play's privilege context can poison.
+- Not auditing every other play for the same `ansible_facts['env']['HOME']`
+  pattern — out of scope for this plan; flagged as a possible follow-up in the
+  journal, not actioned here.
+
+## Tasks
+
+### Phase 1: fix
+
+- [ ] ⬜ **Task 1.1**: change `claude_state_dir` in `play-claude-code.yml` from
+  `"{{ ansible_facts['env']['HOME'] }}/.claude"` to
+  `"/home/{{ user_login }}/.claude"`, matching the file's own established
+  pattern for resolving the real target user's home.
+- [ ] ⬜ **Task 1.2**: `ansible-playbook --syntax-check` clean;
+  `./scripts/qa-all.bash` passes.
+- [ ] ⬜ **Task 1.3**: commit, push on a branch, open PR against `F44`.
+- [ ] ⬜ **Task 1.4**: independent review (peer review agent).
+- [ ] ⬜ **Task 1.5**: merge once PASS/PASS WITH NITS.
+- [ ] ⬜ **Task 1.6**: re-pin lts-infra's live-proof harness at this merged
+  commit and re-run it — see lts-infra Plan 00045.
+
+## Success Criteria
+
+- [ ] A downstream live proof re-run gets past "Check Whether the Claude Code
+  State Directory Exists" without a hard failure, and `claude_state_dir`
+  resolves to the real login user's home (`/home/{{ user_login }}/.claude` on
+  the proof guest), not `/root/.claude`. **Not yet run** — pending Task 1.6.
+
+## Delivery & Milestones
+
+<!-- Curated milestones + delivery commit hashes only (git is the SSoT for
+     "when" — do not add dates). The blow-by-blow activity log lives in
+     JOURNAL/00088-Journal-YY-MM-DD.md — see CLAUDE/PlanJournalling.md. -->
+
+- Recovery cron: 28837729 (shared session-wide failsafe, already running).

CLAUDE/Plan/README.md

@@ -134,6 +134,8 @@ Use these Unicode icons in plan documents:
 
 - [00086-kernel-modules-absent-enumeration](00086-kernel-modules-absent-enumeration/) - A downstream live proof of `play-AB-dnf-upgrade.yml` on a guest lacking the `kernel-modules` package (present only `kernel-core`/`kernel-modules-core`) found the half-installed-kernel enumeration hard-failed instead of treating "not installed" as zero versions. Fixed with a probe-then-fail `assert`, not a blanket `failed_when: false`.
 
+- [00088-claude-code-state-dir-stale-home-fact](00088-claude-code-state-dir-stale-home-fact/) - The same downstream live proof, past PR #36, hard-failed in `play-claude-code.yml` on `Permission denied: /root/.claude`: `claude_state_dir` trusted `ansible_facts['env']['HOME']`, which `gathering=smart` + a play-level `become: true` on the FIRST play in `playbook-main.yml` poisons to `/root` for every later play. Fixed to match the file's own `/home/{{ user_login }}` convention used everywhere else in it.
+
 ## Completed Plans
 
 - [00085-headless-path-local-bin](Completed/00085-headless-path-local-bin/) - A downstream live proof of the composed PR #33/#34 headless mechanisms found a third, unrelated blocker: `ansible-galaxy: command not found` under a non-interactive `sudo -u` invocation, since pipx's `~/.local/bin` shims are never put on PATH there. Exports PATH right after the pipx install block. Merged (`dac4f7c`).

playbooks/imports/play-claude-code.yml

@@ -15,7 +15,17 @@
     claude_code_version: "latest"
     # Desktop Claude Code's plaintext session store. Container (ccy) sessions
     # keep their state per-project instead, so ccy's launcher repairs those.
-    claude_state_dir: "{{ ansible_facts['env']['HOME'] }}/.claude"
+    #
+    # NOT ansible_facts['env']['HOME']: this play runs become: false, but
+    # ansible.cfg's `gathering = smart` + persistent `fact_caching=jsonfile`
+    # mean facts gathered by an EARLIER play in playbook-main.yml are reused
+    # here rather than re-gathered. play-AA-preflight-sanity.yml (play #1)
+    # runs become: true at the PLAY level, which elevates its own fact-
+    # gathering too, so ansible_facts['env']['HOME'] is '/root' for the whole
+    # run — see CLAUDE/Plan/00088-claude-code-state-dir-stale-home-fact. The
+    # rest of this file already avoids this trap (lines below use
+    # /home/{{ user_login }}/... directly); do the same here.
+    claude_state_dir: "/home/{{ user_login }}/.claude"
   tasks:
     # cc wrapper sources ccy's lib at runtime. play-claude-yolo MUST run
     # first (see playbook-main.yml import order). Fail at deploy time