read-only confinement cannot write /tmp, so the per-terminal history path did nothing there; read-only shells now get an empty HISTFILE, which also keeps them from loading the person's history. workspace-write shells keep their per-terminal history file, and the controller now deletes it through the same execution environment after the shell ends, including a failed allocation; a failed deletion is logged.