diff --git a/scripts/setup/machine-setup/zshrc b/scripts/setup/machine-setup/zshrc
new file mode 100644
index 00000000..a999d199
--- /dev/null
+++ b/scripts/setup/machine-setup/zshrc
@@ -0,0 +1,34 @@
+# Officer — the owner's shell configuration.
+#
+# EMPTY ON PURPOSE, for now. Created 2026-08-13 so there is somewhere to put the
+# things the owner actually wants, and it is not wired into the Shell section yet.
+#
+# ── What this replaces, and the decision still to make ──
+#
+# The Shell section does not install a .zshrc today. It APPENDS four
+# marker-wrapped blocks to whatever is already there — `starship`, `agent`,
+# `aliases` and `editor` — via `append_once`, which recognises its own work so a
+# second run does not duplicate it. That was the right call for a machine whose
+# .zshrc already belongs to somebody.
+#
+# Installing a whole file is a different promise, and the two do not compose: a
+# template that gets installed AND appended to ends up with the same lines twice,
+# once from the file and once from a block. So when this is wired in, the four
+# append_once blocks either move INTO this file or stay out of it — not both.
+#
+# `install_config` already handles the careful half: it writes only when the
+# destination is missing or still byte-for-byte the template, and offers a diff
+# otherwise, so an owner's own edits are never overwritten.
+#
+# ── Naming ──
+#
+# `zshrc`, no leading dot. It is a template in a repository, not a dotfile in a
+# home directory — the same reason tmux.conf lost its dot beside it. The member
+# equivalent, src/servers/shell-skel/zshrc, has been spelled that way all along.
+#
+# ── The one thing worth keeping when this is filled in ──
+#
+# shell-skel/zshrc depends on nothing but zsh: starship, eza, nvim and bun are
+# each used only if present, so the same file works on a minimal VPS and on a
+# fully equipped workstation. Worth holding to here, since this file will be read
+# on machines that have had none of the optional sections run.