at/cli.mjs only loaded a .env from its own folder, which this machine never had, so the x MCP's bluesky_post (which shells out to it) failed with 'Set BSKY_IDENTIFIER and BSKY_APP_PASSWORD' while the credentials sat in vault/at/.env the whole time. It now falls back to the vault copy; the shell environment still wins over both.