diff --git a/ecomm/0027/SESSION-0027.0-TRANSCRIPT-2026-06-11T01-00--INPROGRESS.md b/ecomm/0027/SESSION-0027.0-TRANSCRIPT-2026-06-11T01-00--INPROGRESS.md
new file mode 100644
index 0000000..3a93947
--- /dev/null
+++ b/ecomm/0027/SESSION-0027.0-TRANSCRIPT-2026-06-11T01-00--INPROGRESS.md
@@ -0,0 +1,24 @@
+# Session 0027.0 — Transcript
+
+> App: ecomm
+> Start: 2026-06-11T01-00 (PST)
+> Type: planning-and-executing
+> Claude-Session: 5f629a7b-f3cf-42e3-a0ca-66f16d7a2f50
+> Status: **PLACEHOLDER — claimed at session start; finalized at session end.**
+>
+> This file reserves session ID 0027 for ecomm. The driver replaces this
+> body with the full transcript and renames the file to its final
+> SESSION-0027.0-TRANSCRIPT-2026-06-11T01-00--<end>.md form at session end.
+
+## Launch prompt
+
+```
+Operator hit the sign-in resend-cooldown lockout: after sending a code to a mistyped email, the email-step Send button stayed disabled ("Resend in 31s") even after correcting the address, blocking them for the rest of the 60s window. Backend cooldown is correctly per-address (SD-0001 INV-3/PUC-2c); the lockout is a frontend state bug (SignIn.tsx cooldown not keyed to the address it was set for). Session goal: file Gitea issues (bug: frontend cooldown lockout; story: layered rate-limit hardening — per-address daily cap, per-IP limit), then fix the frontend bug in this session.
+
+```
+
+## Deferred decisions
+
+_Autonomous-mode low-confidence calls the driver made and would have
+liked operator input on. Appended as the session runs; surfaced at
+finalize. Empty if none._
diff --git a/ecomm/sessions.json b/ecomm/sessions.json
index a792c61..9645ab5 100644
--- a/ecomm/sessions.json
+++ b/ecomm/sessions.json
@@ -76,5 +76,8 @@
   },
   "0026": {
     "title": ""
+  },
+  "0027": {
+    "title": ""
   }
 }