[Hyper-AI-Lab]

What

A Shared machines section at the end of docs/guide/setup.md, and a line in the 3.1.0 changelog (3.1.0 is not tagged yet, so it ships in that release).

Why

Teams often run their agents on one development server that everyone reaches over SSH. PAACM itself works there unchanged, but the agent acts with the operating-system account it runs in, so a few setup choices decide whether that is safe:

• One account per person: the Claude Code login and user settings, the git author, the gh login and cloud credentials all belong to the account. A shared account gives every commit and pull request one identity and makes "someone else approves" meaningless.
• One clone or worktree per person: task state lives in the working tree, and paacm task start refuses while another task is active there.
• No long-lived cloud keys where agents run: shell deny rules are not a security boundary; keep deployment credentials in CI.
• Not as root: root reads every account's files and credentials.

Docs only. No code, configuration or plugin content changes.

Verification

• node bin/paacm.mjs validate: exit 0
• node bin/paacm.mjs build --check: exit 0
• npm test: 86 of 86 pass
• markdownlint-cli2@0.23.3 "**/*.md": 0 issues in 71 files
• claude plugin validate plugins/paacm --strict and claude plugin validate .: passed