diff --git a/ecomm/0027/SESSION-0027.0-TRANSCRIPT-2026-06-11T01-00--INPROGRESS.md b/ecomm/0027/SESSION-0027.0-TRANSCRIPT-2026-06-11T01-00--INPROGRESS.md
index 3a93947..72efbfc 100644
--- a/ecomm/0027/SESSION-0027.0-TRANSCRIPT-2026-06-11T01-00--INPROGRESS.md
+++ b/ecomm/0027/SESSION-0027.0-TRANSCRIPT-2026-06-11T01-00--INPROGRESS.md
@@ -17,8 +17,39 @@ Operator hit the sign-in resend-cooldown lockout: after sending a code to a mist
 
 ```
 
+## Plan
+
+> Anchor: #20 (wiggleverse/wiggleverse-ecomm, type/bug, P1 — sign-in resend cooldown
+> locks out a corrected email address). ELIGIBLE per R2b (leaf bug).
+> Sibling capture: #21 (type/story, P2 — OTP send rate-limit hardening; backlog only,
+> not worked this session).
+
+1. Capture: file bug #20 + story #21 on the ecomm tracker — **done** (#20 P1, #21 P2).
+2. Fix #20 — **done**: new `frontend/src/cooldown.ts` (`cooldownAppliesTo`, normalization
+   mirrors backend `normalize_email`/INV-2); `SignIn.tsx` tracks `cooldownFor` and gates
+   the email-step button through it. Code-step resend unchanged.
+3. Tests first — **done** (TDD, red→green): `frontend/src/cooldown.test.ts`, 5 cases incl.
+   the lockout regression. (No RTL in repo — pure-logic module per repo convention.)
+4. Verify — **done**: vitest 8/8, tsc clean, backend 68/68 untouched-green; live UI walk
+   on the localhost stack (wrong address → "Wrong address?" → same address stays
+   disabled w/ countdown; corrected address sends at once). PR #22 merged to main
+   @ 6b405a0; issue #20 auto-closed. #21 remains open backlog.
+
 ## Deferred decisions
 
 _Autonomous-mode low-confidence calls the driver made and would have
 liked operator input on. Appended as the session runs; surfaced at
 finalize. Empty if none._
+
+- **Priorities**: filed #20 as P1 (live UX lockout on the signup door) and #21 as P2
+  (hardening, no active abuse). Operator may want to re-rank #21.
+- **§9 pipeline**: localhost stage green (unit + typecheck + live-UI walk). **PPE deploy
+  deferred** — PPE exists (PUC-11 rehearsal green 2026-06-11) but the deploy is a
+  flotilla gesture with a version-pin bump and the E2E suite/pipeline automation is
+  still being built (§10.6); no prod exists yet, so `ppe-before-prod` is not bypassed.
+  The merged fix should ride the next PPE deploy.
+- **E2E browser test**: not added as a Playwright artifact (suite not yet stood up,
+  consistent with SLICE-3/4 deferral per §6.8); covered by a pure-logic vitest
+  regression + a manual live-UI walk this session.
+- **Scope**: left `.claude/launch.json` (preview launch config) untracked — local
+  tooling, not repo surface.