tell the operator they are still root, once

Neither script ever becomes the user it sets the machine up for — a process cannot
change its own uid, so both run as root and drop privileges per command instead.
Everything Officer owns ends up belonging to that user and every pm2 process runs
as them, but the session you are left holding is root's.

Two things that fixes are invisible until they bite: group membership is fixed at
LOGIN, so the `docker` group just granted is not in the current session, and the
shell configuration was written into their home and is not loaded in root's. Both
present as "the machine is broken" rather than "log in again".

Printed by whichever half runs LAST. The first attempt put it at the end of both,
which says it twice on a full install — and the first time it is wrong, because
officer-setup is about to run and still needs the root session it tells you to
leave. install.sh is the only thing that knows whether anything follows, so it
sets OFFICER_SETUP_FOLLOWS and machine-setup stays quiet.

Also drops "Pre-flight complete. The remaining sections are not built yet." from
the end of officer-setup. All 11 sections exist; that line last made sense when 6
did.

Verified: bash -n on all three, the set -e behaviour of `$RUN_OFFICER && export`
under --machine-only, and the suppression across all five ways in.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/setup/officer-setup.sh

@@ -838,8 +838,35 @@ if ! skip; then
 fi
 
 
-echo ""
-echo -e "${BOLD}  Pre-flight complete.${NC} The remaining sections are not built yet."
+# ── Who you are when this exits ──
+#
+# Root, and that surprises people — reasonably, because everything this script just
+# installed belongs to somebody else. The platform runs as ${USERNAME}: the checkout,
+# node_modules, .env, the secret store and all six pm2 processes are theirs. Root was
+# the installer's privilege, never the platform's.
+#
+# Saying so matters for two things that are invisible until they bite:
+#
+#   - group membership is fixed at login. ${USERNAME} was added to `docker` during
+#     machine setup, and a session that started before that does not have it — so
+#     `docker ps` fails for a reason that has nothing to do with docker.
+#   - the shell config was written into THEIR home. Staying as root means none of it
+#     is loaded, and the machine looks unconfigured.
+if [[ "$EUID" -eq 0 ]]; then
+  echo ""
+  echo -e "${BOLD}  One more thing — you are still root.${NC}"
+  echo ""
+  echo "    Officer runs as ${USERNAME}, and everything it installed is theirs."
+  echo "    Nothing here needs root any more. To carry on as them:"
+  echo ""
+  echo -e "      ${BOLD}su - ${USERNAME}${NC}                     from this session"
+  echo -e "      ${BOLD}ssh ${USERNAME}@<this machine>${NC}       or log in fresh"
+  echo ""
+  echo "    Either gives a new session, which is what makes their docker group"
+  echo "    membership and their shell configuration take effect. Staying as root"
+  echo "    means neither does, and the machine will look half-configured."
+fi
+
 echo ""
 
 report_mark_complete