The signed-in role picks the shell, not the width of the screen

Context

Clarity 2 has two users: the dentist, who works at a desk and is keyboard-first, and his attendant, who books the phone schedule and must never see money. The clinic has no front-desk computer. Both people reach the same address through the login gate.

Decision

Which shell you get is decided by the role the signed-in cookie carries, never by the width of the window. The cookie is HttpOnly on purpose, so the page cannot read it; the gate answers a new GET /_session with the role, and the app picks the shell from that answer. The desk and the phone are separate downloaded chunks, so the attendant's phone fetches only her shell and never the desk's screens.

Alternatives rejected

• One bundle for both shells. It would put the desk's screens in the file her phone downloads, so the promise that she cannot reach money would rest on a client-side check alone.
• Layout chosen by viewport width. There is no front-desk computer, and the same address is meant to render differently for the two people rather than reshape itself to a window.

Why

The money wall depends on the attendant never being able to reach a money screen. Choosing the shell from the role, and shipping it as its own chunk, keeps that promise at the level of what her browser downloads, not only what her browser displays. See the money wall.

Consequences

One address renders two experiences, and the gate now has to expose the role. Later work orders add screens to whichever shell owns them. The gate's list of desk-only addresses has to grow with them, which is recorded as a gap, not solved. See known gaps.

Status

Built on 2026-09-20 and verified against the live deployment, where each person's credentials opened their own shell. See work order 2, the login gate and the product overview.