office: refuse to run as root, and write the wrapper with the real home path so sudo cannot hide it

.pi/memory-vault/packs/paperclip-harness/20-context/home.md

@@ -1544,3 +1544,122 @@ Nothing touched `~/SECURITY` or `~/TEST-BETA`.
 - session: [[packs/paperclip-harness/80-sessions/rich-discovery-now-2026-11-12-20-21-44|Rich discovery: now 2026-11-12 20:21:44]]
 - context: [[packs/paperclip-harness/20-context/home|now]]
 - observation: [[packs/paperclip-harness/60-observations/tmp-repository-structure-and-configuration-patterns|now repository structure and configuration patterns]]
+
+
+---
+
+## Update (2026-11-12 22:47:55)
+
+## Rich discovery update (2026-11-12 22:47:55)
+
+Both fixed. `l` is yours again.
+
+## `g` for git, `l` goes back to navigation
+
+You are right, and I had the wrong model: TUIOS keeps `h j k l` only in *window* mode. Inside a pane the program gets them, so `l` was already doing real work and I took it away.
+
+| key | does | on |
+|---|---|---|
+| `t` | the tool chooser — lazygit, yazi, nvim, hunk, fzf, ocr, shell | `Board>board`, `Project>project` |
+| `g` | lazygit, straight away, in the project folder | `Board>board`, `Project>project` |
+| `l` / `h` | next / previous tab, as before | `Project>project` |
+| `l` | next tab in the needs panel, as before | `Board>board` |
+
+`g` was free on both panes. The footers and the `?` help now say `g lazygit`, `t tools`.
+
+## The `.27` error: my advice caused it
+
+`exec zsh` printed:
+
+```
+/home/sam/.config/environment.d/10-secrets.conf:70: command not found: ietf
+```
+
+and the cause is the second option I offered you for getting keys into shells — `source` the secrets file from zsh. It is now in `~/.config/zsh/local.zsh`:
+
+```sh
+if [ -f "$HOME/.config/environment.d/10-secrets.conf" ]; then
+  set -a
+  source "$HOME/.config/environment.d/10-secrets.conf"
+  set +a
+fi
+```
+
+That cannot work in general. **`environment.d` is not shell.** It is a data file: values may contain spaces, quotes and `#`, and systemd reads them as plain text. A shell does not. Line 70 holds a value with a space in it, so zsh assigned the first word and tried to run the second one as a command — `ietf`. It is harmless noise, and the rest of the file still loads, but it will appear on every shell start and could get worse on the next value with a `$` or a backtick in it (those would be *expanded*).
+
+Also worth knowing: `~/.config/zsh/local.zsh` is not editable on `.27` — it is a store copy of `/etc/nixos/home/sam/config/zsh/local.zsh`, which is why my first attempt failed with a read-only filesystem. It goes out with a rebuild.
+
+The replacement, now in your config:
+
+```sh
+# environment.d is NOT shell: a value may contain a space, a quote or a #, and
+# systemd reads the file as data. Sourcing it makes zsh run the second word of
+# such a value as a command, which is where "command not found: ietf" came from.
+# Read it as data instead and export the pairs.
+if [ -f "$HOME/.config/environment.d/10-secrets.conf" ]; then
+  while IFS="=" read -r key value; do
+    value=${value%$'\r'}
+    case "$key" in
+      ""|\#*) continue ;;
+      [A-Za-z_]*) ;;
+      *) continue ;;
+    esac
+    export "$key=$value"
+  done < "$HOME/.config/environment.d/10-secrets.conf"
+fi
+```
+
+Everything is taken after the first `=`, so spaces are just part of the value; comments and junk keys are skipped; nothing is expanded or executed.
+
+Verified on `.27`:
+
+```
+the deployed old file:   /home/sam/.config/environment.d/10-secrets.conf:70: command not found: ietf
+the new block alone:     started clean
+                         PAPERCLIP_BOARD_KEY is set
+                         secrets exported: 78
+```
+
+## Rebuild `.27` to get it
+
+```sh
+sudo nixos-rebuild switch --flake /etc/nixos#sam-4screen-desktop
+```
+
+Seven derivations, already built. Nothing network-related changes, so it is safe to `switch`.
+
+Then check with `exec zsh` — it should start silently. Verified after that with `echo ${PAPERCLIP_BOARD_KEY:+set}` if you want to see the key arriving.
+
+**`.51` I could not reach** (`No route to host`, so it is off or off the network). If it has the same block in `/etc/nixos/home/sam/config/zsh/local.zsh`, it has the same noise and the same fix; I will do it when the machine is back.
+
+## Committed
+
+- `paperclip-harness` → `32fb356`, pushed, commands and binary synced to `.27`
+- `nixos-4screen` (`/etc/nixos` on `.27`) → `587db3f`, pushed
+- backup of the old zsh fragment at `/tmp/local.zsh.bak-harness` on `.27`
+
+And for the record: the `office` commands no longer need any of this. They read `~/.config/environment.d/*.conf` themselves, as data, the same way. The zsh change is only so *your* shells have the variables for other tools.
+
+## Source paths observed
+
+- `home/sam/.config/zsh/local.zsh`
+- `nix/store/v2z0s2nw8xmjq5b4icj21wjm0jv2xpwx-hm_local.zsh`
+- `home/sam/.config/zsh`
+- `./config/zsh/local.zsh`
+- `HOME/.config/zsh/local.zsh`
+- `HOME/.config/environment.d/10-secrets.conf`
+- `etc/nixos/home/sam/config/zsh/local.zsh`
+- `etc/nixos/home/sam/config/zsh`
+- `home/sam/.config/environment.d/10-secrets.conf`
+- `.config/zsh/local.zsh`
+
+## Evidence
+
+- Confidence: 84%
+- Reason: Update component/repository context with detailed discovered structure and configuration
+
+## Related learned memories <!-- same-turn-2026-11-12 22:47:55 -->
+
+- session: [[packs/paperclip-harness/80-sessions/rich-discovery-home-2026-11-12-22-47-55|Rich discovery: home 2026-11-12 22:47:55]]
+- context: [[packs/paperclip-harness/20-context/home|home]]
+- observation: [[packs/paperclip-harness/60-observations/tmp-repository-structure-and-configuration-patterns|home repository structure and configuration patterns]]

.pi/memory-vault/packs/paperclip-harness/20-context/paperclip-harness.md

@@ -1084,3 +1084,94 @@ Workspace paths seen: `/home/sam/paseo/projects/paperclip-harness` (bin/ha), rep
 - session: [[packs/paperclip-harness/80-sessions/rich-discovery-with-2026-11-12-09-39-17|Rich discovery: with 2026-11-12 09:39:17]]
 - context: [[packs/paperclip-harness/20-context/with|with]]
 - observation: [[packs/paperclip-harness/60-observations/tmp-repository-structure-and-configuration-patterns|with repository structure and configuration patterns]]
+
+
+---
+
+## Update (2026-11-12 23:03:35)
+
+## Rich discovery update (2026-11-12 23:03:35)
+
+`.51` is done. Two things were needed, and only one of them urgently.
+
+## `.51`: the commands were stale, now current
+
+The copy at `~/.local/share/paperclip-harness/bin/` predated today's changes, so `office` there had the old prompt and the old `l`-for-lazygit binding. Synced:
+
+```
+office — open a folder as a project, and say what else can be run
+PUT INTO .gitignore EVERY FILE ... ✓
+```
+
+`.51` was already in good shape otherwise: `~/.local/bin` is on `PATH`, `office` resolves by name, and Pi is 1.5.0.
+
+## `.51` has the same zsh block, but it is silent — for now
+
+Same deployed file, same `set -a; source` block, sourced by `~/.zshrc`. It prints nothing today, and I measured why:
+
+```
+old block against .51's secrets file:   no "command not found"
+.27's secrets file:                     line 70 has a value with a space → the error
+```
+
+So on `.51` the fault is present but **nothing in that secrets file contains a space yet**. It would start printing the day any value gets one — exactly what happened on `.27`. I patched it anyway, because the next value with a space, a `$` or a backtick would not just be noise: those get expanded by a shell.
+
+Verified on `.51`:
+
+```
+syntax ok
+clean start
+PAPERCLIP_BOARD_KEY is set
+```
+
+So **`.51` does not need a rebuild for anything to work.** When convenient:
+
+```sh
+sudo nixos-rebuild switch --flake /etc/nixos#sam-thinkpad
+```
+
+Seven derivations, already built, nothing network-related. Or leave it until the next time you rebuild for another reason — nothing is broken meanwhile.
+
+## Where the three machines stand
+
+| machine | Pi | Go | `office` on PATH | commands current |
+|---|---|---|---|---|
+| `.13` nixos-desktop | 1.5.0 | 1.26.5 | yes | **this is the source** |
+| `.27` sam-4screen-desktop | 1.5.0 | 1.26.2 | yes | yes |
+| `.51` sam-thinkpad | 1.5.0 | 1.26.7 | yes | yes |
+
+One Pi store path on all three, `office --help`, `--host` and the git gate available everywhere.
+
+The `0` against `.13` is not a problem: `.13` runs the repository's own `bin/office` through `~/.local/bin/office`, so it is the thing the others copy from.
+
+## Outstanding, if you want them
+
+- **`.27` rebuild** for the zsh fix (`587db3f`) — that one removes a message you are seeing every shell start.
+- **`.51` rebuild** for the same fix (`17ab884`) — cosmetic; the message has not appeared yet.
+- `~/SECURITY` is a `local_path` project with no worktrees, and `~/TEST-BETA` is untouched and not a repository. Both are yours to run through the gate when you choose.
+
+All committed and pushed: `paperclip-harness` `32fb356`, `nixos-4screen` `587db3f`, `nixos-thinkpad` `17ab884`. Backups of the old zsh fragment are at `/tmp/local.zsh.bak-harness` on both machines.
+
+## Source paths observed
+
+- `etc/nixos/home/sam/config/zsh/local.zsh`
+- `HOME/.config/environment.d/10-secrets.conf`
+- `home/sam/.local/bin/office`
+- `home/sam/.local/share/paperclip-harness/bin/office`
+- `home/sam/.config/zsh/local.zsh`
+- `nix/store/42dhgv507vmfr6bap0mn5b2fzxih0pj5-home-manager-files/.config/zsh/local.zsh`
+- `HOME/.config/zsh/local.zsh`
+- `./config/zsh/local.zsh`
+- `.local/share/paperclip-harness/bin`
+- `.local/bin/office`
+
+## Evidence
+
+- Confidence: 84%
+- Reason: Update component/repository context with detailed discovered structure and configuration
+
+## Related learned memories <!-- same-turn-2026-11-12 23:03:35 -->
+
+- session: [[packs/paperclip-harness/80-sessions/rich-discovery-local-2026-11-12-23-03-35|Rich discovery: .local 2026-11-12 23:03:35]]
+- context: [[packs/paperclip-harness/20-context/paperclip-harness|.local]]
+- observation: [[packs/paperclip-harness/60-observations/tmp-repository-structure-and-configuration-patterns|.local repository structure and configuration patterns]]

.pi/memory-vault/packs/paperclip-harness/60-observations/tmp-repository-structure-and-configuration-patterns.md

@@ -6802,3 +6802,213 @@ Nothing touched `~/SECURITY` or `~/TEST-BETA`.
 - session: [[packs/paperclip-harness/80-sessions/rich-discovery-now-2026-11-12-20-21-44|Rich discovery: now 2026-11-12 20:21:44]]
 - context: [[packs/paperclip-harness/20-context/home|now]]
 - observation: [[packs/paperclip-harness/60-observations/tmp-repository-structure-and-configuration-patterns|now repository structure and configuration patterns]]
+
+
+---
+
+## Update (2026-11-12 22:47:55)
+
+## Structural/configuration observations (2026-11-12 22:47:55)
+
+Both fixed. `l` is yours again.
+
+## `g` for git, `l` goes back to navigation
+
+You are right, and I had the wrong model: TUIOS keeps `h j k l` only in *window* mode. Inside a pane the program gets them, so `l` was already doing real work and I took it away.
+
+| key | does | on |
+|---|---|---|
+| `t` | the tool chooser — lazygit, yazi, nvim, hunk, fzf, ocr, shell | `Board>board`, `Project>project` |
+| `g` | lazygit, straight away, in the project folder | `Board>board`, `Project>project` |
+| `l` / `h` | next / previous tab, as before | `Project>project` |
+| `l` | next tab in the needs panel, as before | `Board>board` |
+
+`g` was free on both panes. The footers and the `?` help now say `g lazygit`, `t tools`.
+
+## The `.27` error: my advice caused it
+
+`exec zsh` printed:
+
+```
+/home/sam/.config/environment.d/10-secrets.conf:70: command not found: ietf
+```
+
+and the cause is the second option I offered you for getting keys into shells — `source` the secrets file from zsh. It is now in `~/.config/zsh/local.zsh`:
+
+```sh
+if [ -f "$HOME/.config/environment.d/10-secrets.conf" ]; then
+  set -a
+  source "$HOME/.config/environment.d/10-secrets.conf"
+  set +a
+fi
+```
+
+That cannot work in general. **`environment.d` is not shell.** It is a data file: values may contain spaces, quotes and `#`, and systemd reads them as plain text. A shell does not. Line 70 holds a value with a space in it, so zsh assigned the first word and tried to run the second one as a command — `ietf`. It is harmless noise, and the rest of the file still loads, but it will appear on every shell start and could get worse on the next value with a `$` or a backtick in it (those would be *expanded*).
+
+Also worth knowing: `~/.config/zsh/local.zsh` is not editable on `.27` — it is a store copy of `/etc/nixos/home/sam/config/zsh/local.zsh`, which is why my first attempt failed with a read-only filesystem. It goes out with a rebuild.
+
+The replacement, now in your config:
+
+```sh
+# environment.d is NOT shell: a value may contain a space, a quote or a #, and
+# systemd reads the file as data. Sourcing it makes zsh run the second word of
+# such a value as a command, which is where "command not found: ietf" came from.
+# Read it as data instead and export the pairs.
+if [ -f "$HOME/.config/environment.d/10-secrets.conf" ]; then
+  while IFS="=" read -r key value; do
+    value=${value%$'\r'}
+    case "$key" in
+      ""|\#*) continue ;;
+      [A-Za-z_]*) ;;
+      *) continue ;;
+    esac
+    export "$key=$value"
+  done < "$HOME/.config/environment.d/10-secrets.conf"
+fi
+```
+
+Everything is taken after the first `=`, so spaces are just part of the value; comments and junk keys are skipped; nothing is expanded or executed.
+
+Verified on `.27`:
+
+```
+the deployed old file:   /home/sam/.config/environment.d/10-secrets.conf:70: command not found: ietf
+the new block alone:     started clean
+                         PAPERCLIP_BOARD_KEY is set
+                         secrets exported: 78
+```
+
+## Rebuild `.27` to get it
+
+```sh
+sudo nixos-rebuild switch --flake /etc/nixos#sam-4screen-desktop
+```
+
+Seven derivations, already built. Nothing network-related changes, so it is safe to `switch`.
+
+Then check with `exec zsh` — it should start silently. Verified after that with `echo ${PAPERCLIP_BOARD_KEY:+set}` if you want to see the key arriving.
+
+**`.51` I could not reach** (`No route to host`, so it is off or off the network). If it has the same block in `/etc/nixos/home/sam/config/zsh/local.zsh`, it has the same noise and the same fix; I will do it when the machine is back.
+
+## Committed
+
+- `paperclip-harness` → `32fb356`, pushed, commands and binary synced to `.27`
+- `nixos-4screen` (`/etc/nixos` on `.27`) → `587db3f`, pushed
+- backup of the old zsh fragment at `/tmp/local.zsh.bak-harness` on `.27`
+
+And for the record: the `office` commands no longer need any of this. They read `~/.config/environment.d/*.conf` themselves, as data, the same way. The zsh change is only so *your* shells have the variables for other tools.
+
+## Source paths observed
+
+- `home/sam/.config/zsh/local.zsh`
+- `nix/store/v2z0s2nw8xmjq5b4icj21wjm0jv2xpwx-hm_local.zsh`
+- `home/sam/.config/zsh`
+- `./config/zsh/local.zsh`
+- `HOME/.config/zsh/local.zsh`
+- `HOME/.config/environment.d/10-secrets.conf`
+- `etc/nixos/home/sam/config/zsh/local.zsh`
+- `etc/nixos/home/sam/config/zsh`
+- `home/sam/.config/environment.d/10-secrets.conf`
+- `.config/zsh/local.zsh`
+
+## Evidence
+
+- Confidence: 82%
+- Reason: Captured factual repo structure/configuration patterns from rich discovery
+
+## Related learned memories <!-- same-turn-2026-11-12 22:47:55 -->
+
+- session: [[packs/paperclip-harness/80-sessions/rich-discovery-home-2026-11-12-22-47-55|Rich discovery: home 2026-11-12 22:47:55]]
+- context: [[packs/paperclip-harness/20-context/home|home]]
+- observation: [[packs/paperclip-harness/60-observations/tmp-repository-structure-and-configuration-patterns|home repository structure and configuration patterns]]
+
+
+---
+
+## Update (2026-11-12 23:03:35)
+
+## Structural/configuration observations (2026-11-12 23:03:35)
+
+`.51` is done. Two things were needed, and only one of them urgently.
+
+## `.51`: the commands were stale, now current
+
+The copy at `~/.local/share/paperclip-harness/bin/` predated today's changes, so `office` there had the old prompt and the old `l`-for-lazygit binding. Synced:
+
+```
+office — open a folder as a project, and say what else can be run
+PUT INTO .gitignore EVERY FILE ... ✓
+```
+
+`.51` was already in good shape otherwise: `~/.local/bin` is on `PATH`, `office` resolves by name, and Pi is 1.5.0.
+
+## `.51` has the same zsh block, but it is silent — for now
+
+Same deployed file, same `set -a; source` block, sourced by `~/.zshrc`. It prints nothing today, and I measured why:
+
+```
+old block against .51's secrets file:   no "command not found"
+.27's secrets file:                     line 70 has a value with a space → the error
+```
+
+So on `.51` the fault is present but **nothing in that secrets file contains a space yet**. It would start printing the day any value gets one — exactly what happened on `.27`. I patched it anyway, because the next value with a space, a `$` or a backtick would not just be noise: those get expanded by a shell.
+
+Verified on `.51`:
+
+```
+syntax ok
+clean start
+PAPERCLIP_BOARD_KEY is set
+```
+
+So **`.51` does not need a rebuild for anything to work.** When convenient:
+
+```sh
+sudo nixos-rebuild switch --flake /etc/nixos#sam-thinkpad
+```
+
+Seven derivations, already built, nothing network-related. Or leave it until the next time you rebuild for another reason — nothing is broken meanwhile.
+
+## Where the three machines stand
+
+| machine | Pi | Go | `office` on PATH | commands current |
+|---|---|---|---|---|
+| `.13` nixos-desktop | 1.5.0 | 1.26.5 | yes | **this is the source** |
+| `.27` sam-4screen-desktop | 1.5.0 | 1.26.2 | yes | yes |
+| `.51` sam-thinkpad | 1.5.0 | 1.26.7 | yes | yes |
+
+One Pi store path on all three, `office --help`, `--host` and the git gate available everywhere.
+
+The `0` against `.13` is not a problem: `.13` runs the repository's own `bin/office` through `~/.local/bin/office`, so it is the thing the others copy from.
+
+## Outstanding, if you want them
+
+- **`.27` rebuild** for the zsh fix (`587db3f`) — that one removes a message you are seeing every shell start.
+- **`.51` rebuild** for the same fix (`17ab884`) — cosmetic; the message has not appeared yet.
+- `~/SECURITY` is a `local_path` project with no worktrees, and `~/TEST-BETA` is untouched and not a repository. Both are yours to run through the gate when you choose.
+
+All committed and pushed: `paperclip-harness` `32fb356`, `nixos-4screen` `587db3f`, `nixos-thinkpad` `17ab884`. Backups of the old zsh fragment are at `/tmp/local.zsh.bak-harness` on both machines.
+
+## Source paths observed
+
+- `etc/nixos/home/sam/config/zsh/local.zsh`
+- `HOME/.config/environment.d/10-secrets.conf`
+- `home/sam/.local/bin/office`
+- `home/sam/.local/share/paperclip-harness/bin/office`
+- `home/sam/.config/zsh/local.zsh`
+- `nix/store/42dhgv507vmfr6bap0mn5b2fzxih0pj5-home-manager-files/.config/zsh/local.zsh`
+- `HOME/.config/zsh/local.zsh`
+- `./config/zsh/local.zsh`
+- `.local/share/paperclip-harness/bin`
+- `.local/bin/office`
+
+## Evidence
+
+- Confidence: 82%
+- Reason: Captured factual repo structure/configuration patterns from rich discovery
+
+## Related learned memories <!-- same-turn-2026-11-12 23:03:35 -->
+
+- session: [[packs/paperclip-harness/80-sessions/rich-discovery-local-2026-11-12-23-03-35|Rich discovery: .local 2026-11-12 23:03:35]]
+- context: [[packs/paperclip-harness/20-context/paperclip-harness|.local]]
+- observation: [[packs/paperclip-harness/60-observations/tmp-repository-structure-and-configuration-patterns|.local repository structure and configuration patterns]]

.pi/memory-vault/packs/paperclip-harness/80-sessions/rich-discovery-home-2026-11-12-22-47-55.md

@@ -0,0 +1,138 @@
+---
+type: session
+id: session.paperclip-harness.rich-discovery-home-2026-11-12-22-47-55
+title: Rich discovery: home 2026-11-12 22:47:55
+status: active
+source_of_truth: false
+freshness: current
+last_reviewed: 2026-11-12
+tags:
+  - pack/paperclip-harness
+  - agent-memory/session
+  - autolearn
+  - rich-discovery
+  - repo/home
+---
+
+# Rich discovery: home 2026-11-12 22:47:55
+
+Sanitized rich discovery snapshot captured automatically from the completed turn.
+
+
+## Source paths observed
+
+- `home/sam/.config/zsh/local.zsh`
+- `nix/store/v2z0s2nw8xmjq5b4icj21wjm0jv2xpwx-hm_local.zsh`
+- `home/sam/.config/zsh`
+- `./config/zsh/local.zsh`
+- `HOME/.config/zsh/local.zsh`
+- `HOME/.config/environment.d/10-secrets.conf`
+- `etc/nixos/home/sam/config/zsh/local.zsh`
+- `etc/nixos/home/sam/config/zsh`
+- `home/sam/.config/environment.d/10-secrets.conf`
+- `.config/zsh/local.zsh`
+
+## Final answer snapshot
+
+Both fixed. `l` is yours again.
+
+## `g` for git, `l` goes back to navigation
+
+You are right, and I had the wrong model: TUIOS keeps `h j k l` only in *window* mode. Inside a pane the program gets them, so `l` was already doing real work and I took it away.
+
+| key | does | on |
+|---|---|---|
+| `t` | the tool chooser — lazygit, yazi, nvim, hunk, fzf, ocr, shell | `Board>board`, `Project>project` |
+| `g` | lazygit, straight away, in the project folder | `Board>board`, `Project>project` |
+| `l` / `h` | next / previous tab, as before | `Project>project` |
+| `l` | next tab in the needs panel, as before | `Board>board` |
+
+`g` was free on both panes. The footers and the `?` help now say `g lazygit`, `t tools`.
+
+## The `.27` error: my advice caused it
+
+`exec zsh` printed:
+
+```
+/home/sam/.config/environment.d/10-secrets.conf:70: command not found: ietf
+```
+
+and the cause is the second option I offered you for getting keys into shells — `source` the secrets file from zsh. It is now in `~/.config/zsh/local.zsh`:
+
+```sh
+if [ -f "$HOME/.config/environment.d/10-secrets.conf" ]; then
+  set -a
+  source "$HOME/.config/environment.d/10-secrets.conf"
+  set +a
+fi
+```
+
+That cannot work in general. **`environment.d` is not shell.** It is a data file: values may contain spaces, quotes and `#`, and systemd reads them as plain text. A shell does not. Line 70 holds a value with a space in it, so zsh assigned the first word and tried to run the second one as a command — `ietf`. It is harmless noise, and the rest of the file still loads, but it will appear on every shell start and could get worse on the next value with a `$` or a backtick in it (those would be *expanded*).
+
+Also worth knowing: `~/.config/zsh/local.zsh` is not editable on `.27` — it is a store copy of `/etc/nixos/home/sam/config/zsh/local.zsh`, which is why my first attempt failed with a read-only filesystem. It goes out with a rebuild.
+
+The replacement, now in your config:
+
+```sh
+# environment.d is NOT shell: a value may contain a space, a quote or a #, and
+# systemd reads the file as data. Sourcing it makes zsh run the second word of
+# such a value as a command, which is where "command not found: ietf" came from.
+# Read it as data instead and export the pairs.
+if [ -f "$HOME/.config/environment.d/10-secrets.conf" ]; then
+  while IFS="=" read -r key value; do
+    value=${value%$'\r'}
+    case "$key" in
+      ""|\#*) continue ;;
+      [A-Za-z_]*) ;;
+      *) continue ;;
+    esac
+    export "$key=$value"
+  done < "$HOME/.config/environment.d/10-secrets.conf"
+fi
+```
+
+Everything is taken after the first `=`, so spaces are just part of the value; comments and junk keys are skipped; nothing is expanded or executed.
+
+Verified on `.27`:
+
+```
+the deployed old file:   /home/sam/.config/environment.d/10-secrets.conf:70: command not found: ietf
+the new block alone:     started clean
+                         PAPERCLIP_BOARD_KEY is set
+                         secrets exported: 78
+```
+
+## Rebuild `.27` to get it
+
+```sh
+sudo nixos-rebuild switch --flake /etc/nixos#sam-4screen-desktop
+```
+
+Seven derivations, already built. Nothing network-related changes, so it is safe to `switch`.
+
+Then check with `exec zsh` — it should start silently. Verified after that with `echo ${PAPERCLIP_BOARD_KEY:+set}` if you want to see the key arriving.
+
+**`.51` I could not reach** (`No route to host`, so it is off or off the network). If it has the same block in `/etc/nixos/home/sam/config/zsh/local.zsh`, it has the same noise and the same fix; I will do it when the machine is back.
+
+## Committed
+
+- `paperclip-harness` → `32fb356`, pushed, commands and binary synced to `.27`
+- `nixos-4screen` (`/etc/nixos` on `.27`) → `587db3f`, pushed
+- backup of the old zsh fragment at `/tmp/local.zsh.bak-harness` on `.27`
+
+And for the record: the `office` commands no longer need any of this. They read `~/.config/environment.d/*.conf` themselves, as data, the same way. The zsh change is only so *your* shells have the variables for other tools.
+
+## Evidence
+
+- Confidence: 86%
+- Reason: Preserve full sanitized discovery detail from a rich investigation turn
+
+## Related
+
+- [[packs/paperclip-harness/00-system/pi-agent/memory-manifest|Memory Manifest]]
+
+## Related learned memories <!-- same-turn-2026-11-12 22:47:55 -->
+
+- session: [[packs/paperclip-harness/80-sessions/rich-discovery-home-2026-11-12-22-47-55|Rich discovery: home 2026-11-12 22:47:55]]
+- context: [[packs/paperclip-harness/20-context/home|home]]
+- observation: [[packs/paperclip-harness/60-observations/tmp-repository-structure-and-configuration-patterns|home repository structure and configuration patterns]]

.pi/memory-vault/packs/paperclip-harness/80-sessions/rich-discovery-local-2026-11-12-23-03-35.md

@@ -0,0 +1,110 @@
+---
+type: session
+id: session.paperclip-harness.rich-discovery-local-2026-11-12-23-03-35
+title: Rich discovery: .local 2026-11-12 23:03:35
+status: active
+source_of_truth: false
+freshness: current
+last_reviewed: 2026-11-12
+tags:
+  - pack/paperclip-harness
+  - agent-memory/session
+  - autolearn
+  - rich-discovery
+  - repo/local
+---
+
+# Rich discovery: .local 2026-11-12 23:03:35
+
+Sanitized rich discovery snapshot captured automatically from the completed turn.
+
+
+## Source paths observed
+
+- `etc/nixos/home/sam/config/zsh/local.zsh`
+- `HOME/.config/environment.d/10-secrets.conf`
+- `home/sam/.local/bin/office`
+- `home/sam/.local/share/paperclip-harness/bin/office`
+- `home/sam/.config/zsh/local.zsh`
+- `nix/store/42dhgv507vmfr6bap0mn5b2fzxih0pj5-home-manager-files/.config/zsh/local.zsh`
+- `HOME/.config/zsh/local.zsh`
+- `./config/zsh/local.zsh`
+- `.local/share/paperclip-harness/bin`
+- `.local/bin/office`
+
+## Final answer snapshot
+
+`.51` is done. Two things were needed, and only one of them urgently.
+
+## `.51`: the commands were stale, now current
+
+The copy at `~/.local/share/paperclip-harness/bin/` predated today's changes, so `office` there had the old prompt and the old `l`-for-lazygit binding. Synced:
+
+```
+office — open a folder as a project, and say what else can be run
+PUT INTO .gitignore EVERY FILE ... ✓
+```
+
+`.51` was already in good shape otherwise: `~/.local/bin` is on `PATH`, `office` resolves by name, and Pi is 1.5.0.
+
+## `.51` has the same zsh block, but it is silent — for now
+
+Same deployed file, same `set -a; source` block, sourced by `~/.zshrc`. It prints nothing today, and I measured why:
+
+```
+old block against .51's secrets file:   no "command not found"
+.27's secrets file:                     line 70 has a value with a space → the error
+```
+
+So on `.51` the fault is present but **nothing in that secrets file contains a space yet**. It would start printing the day any value gets one — exactly what happened on `.27`. I patched it anyway, because the next value with a space, a `$` or a backtick would not just be noise: those get expanded by a shell.
+
+Verified on `.51`:
+
+```
+syntax ok
+clean start
+PAPERCLIP_BOARD_KEY is set
+```
+
+So **`.51` does not need a rebuild for anything to work.** When convenient:
+
+```sh
+sudo nixos-rebuild switch --flake /etc/nixos#sam-thinkpad
+```
+
+Seven derivations, already built, nothing network-related. Or leave it until the next time you rebuild for another reason — nothing is broken meanwhile.
+
+## Where the three machines stand
+
+| machine | Pi | Go | `office` on PATH | commands current |
+|---|---|---|---|---|
+| `.13` nixos-desktop | 1.5.0 | 1.26.5 | yes | **this is the source** |
+| `.27` sam-4screen-desktop | 1.5.0 | 1.26.2 | yes | yes |
+| `.51` sam-thinkpad | 1.5.0 | 1.26.7 | yes | yes |
+
+One Pi store path on all three, `office --help`, `--host` and the git gate available everywhere.
+
+The `0` against `.13` is not a problem: `.13` runs the repository's own `bin/office` through `~/.local/bin/office`, so it is the thing the others copy from.
+
+## Outstanding, if you want them
+
+- **`.27` rebuild** for the zsh fix (`587db3f`) — that one removes a message you are seeing every shell start.
+- **`.51` rebuild** for the same fix (`17ab884`) — cosmetic; the message has not appeared yet.
+- `~/SECURITY` is a `local_path` project with no worktrees, and `~/TEST-BETA` is untouched and not a repository. Both are yours to run through the gate when you choose.
+
+All committed and pushed: `paperclip-harness` `32fb356`, `nixos-4screen` `587db3f`, `nixos-thinkpad` `17ab884`. Backups of the old zsh fragment are at `/tmp/local.zsh.bak-harness` on both machines.
+
+## Evidence
+
+- Confidence: 86%
+- Reason: Preserve full sanitized discovery detail from a rich investigation turn
+
+## Related
+
+- [[packs/paperclip-harness/00-system/pi-agent/memory-manifest|Memory Manifest]]
+
+## Related learned memories <!-- same-turn-2026-11-12 23:03:35 -->
+
+- session: [[packs/paperclip-harness/80-sessions/rich-discovery-local-2026-11-12-23-03-35|Rich discovery: .local 2026-11-12 23:03:35]]
+- context: [[packs/paperclip-harness/20-context/paperclip-harness|.local]]
+- observation: [[packs/paperclip-harness/60-observations/tmp-repository-structure-and-configuration-patterns|.local repository structure and configuration patterns]]

bin/office

@@ -228,10 +228,25 @@ def is_this_machine(name):
 
 
 def install_wrapper(addr, remote_bin):
-    """Leave a short `office` on the other machine's PATH, pointing at the copy."""
+    """Leave a short `office` on the other machine's PATH, pointing at the copy.
+
+    The path is written out in full rather than using $HOME, because $HOME is
+    /root under sudo and the wrapper then looks for a copy that is not there.
+    """
+    home = subprocess.run(["ssh", "-o", "BatchMode=yes", addr, 'printf %s "$HOME"'],
+                          capture_output=True, text=True, timeout=60).stdout.strip()
+    if not home:
+        return
     script = ("#!/bin/sh\n"
               "# Written by office on another machine. Runs the copy it keeps here.\n"
-              'exec "$HOME/.local/share/paperclip-harness/bin/office" "$@"\n')
+              "#\n"
+              "# Run this as your own user, never with sudo: it talks to your TUIOS\n"
+              "# daemon and to your Paperclip key, and neither exists for root.\n"
+              'if [ "$(id -u)" = "0" ]; then\n'
+              '  echo "office: run this as your own user, not with sudo." >&2\n'
+              '  exit 2\n'
+              'fi\n'
+              'exec "%s/office" "$@"\n' % (home + "/.local/share/paperclip-harness/bin"))
     subprocess.run(["ssh", "-o", "BatchMode=yes", addr,
                     "mkdir -p \"$HOME/.local/bin\" && cat > \"$HOME/.local/bin/office\" && chmod +x \"$HOME/.local/bin/office\""],
                    input=script, text=True, capture_output=True, timeout=60)
@@ -575,6 +590,11 @@ def note_ignore(folder, opts):
 
 
 def main():
+    if os.geteuid() == 0:
+        h.say("office: run this as your own user, not with sudo.")
+        h.say("  it reads your Paperclip key and asks your TUIOS daemon to make panes;")
+        h.say("  neither of those exists for root, and files it wrote would belong to root.")
+        return 2
     argv = sys.argv[1:]
     if not argv or "-h" in argv or "--help" in argv:
         h.say(USAGE.strip())