diff --git a/.project/concepts/app-contract/contract_polyfill-surface.md b/.project/concepts/app-contract/contract_polyfill-surface.md
index 6168935..372306a 100644
--- a/.project/concepts/app-contract/contract_polyfill-surface.md
+++ b/.project/concepts/app-contract/contract_polyfill-surface.md
@@ -31,7 +31,6 @@ export interface EventuallyConfig {
   getSession?: () => Promise<RegistrySession>;   // resolve the session (a thunk)
   normalizeId?: (id: string) => string;
   sharedWallet?: SharedWalletConfig;             // { fileUrl, password, importUrl? }
-  currentUser?: PrincipalId;
   debugAccessLog?: boolean;
   init?: (...args: any[]) => any;
   initNg?: (...args: any[]) => any;
diff --git a/docs/api-contract.md b/docs/api-contract.md
index c25a13c..e4c8c15 100644
--- a/docs/api-contract.md
+++ b/docs/api-contract.md
@@ -30,7 +30,6 @@ export interface EventuallyConfig {
   normalizeId?: (id: string) => string;
   pointerGuard?: { attempts?: number; baseMs?: number; maxStepMs?: number };
   sharedWallet?: SharedWalletConfig;             // the gate's, § 2bis
-  currentUser?: PrincipalId;
   debugAccessLog?: boolean;
   init?: (...args: any[]) => any;
   initNg?: (...args: any[]) => any;
diff --git a/packages/polyfill/src/shared-wallet/bootstrap.ts b/packages/polyfill/src/shared-wallet/bootstrap.ts
index f24fd03..dfd4a3c 100644
--- a/packages/polyfill/src/shared-wallet/bootstrap.ts
+++ b/packages/polyfill/src/shared-wallet/bootstrap.ts
@@ -85,8 +85,6 @@ export interface EventuallyConfig {
    * itself. Disappears with the gate: upstream a user opens their own wallet.
    */
   sharedWallet?: SharedWalletConfig;
-  /** Initial current user; may also be set later via {@link setCurrentUser}. */
-  currentUser?: PrincipalId;
   /**
    * Turn on the OFF-by-default document access log (see {@link ./access-log}):
    * every real read/write is printed, prefixed by the active identity, to
@@ -135,7 +133,10 @@ let caps = new CapRegistry(capsHolder);
 
 export function configure(c: EventuallyConfig): void {
   cfg = c;
-  currentUser = c.currentUser ?? null;
+  // Not taken from the config: an application never supplies its own identity — upstream
+  // it comes FROM the wallet a person opened. Accepting one here would also let a caller
+  // skip the barrier on a top-level page, which is the one thing it exists to prevent.
+  currentUser = null;
   setAccessLog(c.debugAccessLog ?? false);
   // The session wiring is part of the same act — see {@link EventuallyConfig}. Omitted
   // only by unit suites that never touch the registry; those get the same