no rotation needed: nobody else has ever used this install

the owner confirmed the additional accounts are test rows - none has ever
signed in, no member has opened a shell or a chat. so the proxy secret was
readable by accounts that do not exist in practice, and there is nothing to
rotate.

the mode fix stands: it is about the install that gets used, not this one.
dropping the TODO and recording the reasoning instead, because a rotation item
left sitting there reads as outstanding work forever, and the next person to
find a world-readable secret should ask who uses the box before reaching for
the alarm.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/per-user-linux-accounts.md

@@ -117,10 +117,20 @@ above. The line is who created the file: `.env` is the installer's and Officer m
 this is Officer's own output at the machine's umask — a wrong mode there is Officer's bug, and bricking the
 platform over it would punish the user for our mistake.
 
-**A chmod does not undo exposure.** Any account that read the secret while it was open still holds it, and
-it does not expire. Rotating it means clearing `proxySecret` and restarting `officer-anthropic-proxy` —
-and then `officer-claude-code`, which caches the value in `process.env.ANTHROPIC_API_KEY` and will 401 on
-every turn until it re-reads. Restart both or neither.
+**No rotation was needed, and that is a fact about this install rather than about the bug.** A chmod closes
+the door without changing the lock — anyone who read the secret while it was open still holds it, and it
+does not expire. But the owner confirmed on 2026-08-17 that nothing here has ever been used by anyone else:
+the additional accounts were created for testing, none has ever signed in, and no member has ever opened a
+shell or a chat. So the window existed and nobody was standing in it.
+
+Worth writing down because the code cannot tell you this, and the next person to find a world-readable
+secret here will reach for the alarm before asking. **Ask who actually uses the install before deciding
+how bad an exposure is.**
+
+Should this ever need rotating on an install that IS used: clear `proxySecret`, then restart
+`officer-anthropic-proxy` **and** `officer-claude-code` together — the agent sidecar caches the value in
+`process.env.ANTHROPIC_API_KEY` and `ensureAnthropicEnv` returns early once it is set, so rotating the
+proxy alone 401s every turn until the agent is restarted too.
 
 ## The mechanism, and the trap in it