Design 58 and 36: cite ADR 0266's ways to root, and make acceptance tests 7 and 9 and the nox glossary entry agree with ADR 0411, 0412 and 0414 (review round 1)

00-META/glossary.md

@@ -626,8 +626,8 @@ asking, never the act. **Decided by** ADR 0152, 0175, 0234, 0259, 0272, 0383, 03
   line as the **controller's terminal** or as an ordinary call
   (ADR 0272).
 - **nox** — `mesh-cli`'s alias, in interactive zsh only. A script, `sudo` and a document meant to work everywhere
-  say `mesh-cli`. The operator also calls the mesh itself *nox mesh*; on this page and in the records *nox* is the
-  alias alone. It is the one command the operator types: every line the mesh addresses to the operator — a
+  say `mesh-cli`. The operator also calls the mesh itself *nox mesh*. *nox* is also the agent (ADR 0414 §7): see
+  [Homonyms](#homonyms), and say which is meant. It is the one command the operator types: every line the mesh addresses to the operator — a
   condition's words, a verb's answer, a README, a design — names a `nox` line, never a daemon's (the controller's
   or the node-engine's binary followed by a command), which `words.py` and the catalogue's check refuse
   (ADR 0272,

03-DESIGN/01-to-be/36-the-operators-agent-on-a-machine.md

@@ -326,7 +326,7 @@ is empty, so nothing changes there, though a login `nox` exists for the modules
 **What the module declares.**
 
 - No login. The mesh makes the agent's machine account (home, own group, no password) from the identity, and the
-  node-engine judges on every look that it cannot become root without a person, by the ways ADR 0266 §3 lists.
+  node-engine judges on every look that it cannot become root without a person, by the ways ADR 0266 §12 to §17 list.
   It detects those ways and no others; it prevents nothing. The `user` resource named by `agent-account`,
   which this module declared until ADR 0411, goes.
 - `~/.claude` under that account's home, owned by it.

03-DESIGN/01-to-be/58-agent-work-as-the-meshs-own.md

@@ -127,7 +127,7 @@ An identity's login on one machine is its **machine account**. The controller co
 identity present on a machine into that machine's declaration, and the node-engine applies it with its `user`
 resource. A login that exists is adopted under its name, uid and home; the mesh never renames or deletes one. An
 agent's machine account has its own home and group, no password, no root group and no sudo rule, and the node-engine
-judges on every look that it cannot become root without a person (ADR 0266 §3). No module declares a login for a
+judges on every look that it cannot become root without a person, by the ways ADR 0266 §12 to §17 list. No module declares a login for a
 person or an agent: claude-code's `agent-account` resource goes, and the catalogue's check refuses a manifest that
 declares one. The node record's operator account and agent account are read from the identities, no longer stated
 at the controller's terminal or in the mesh-config snapshot; the machine facts `account`, `agent-account` and their
@@ -256,12 +256,13 @@ From research 057 (ADR 0411 to ADR 0414):
 6. The identity seat lists `jochen` and `nox` with their machines, kept logins and novox's agent account mark; a
    create or a presence change by any caller but the operator's Approve is refused.
 7. On ace, g14 and shanks a login `nox` exists; on novox the login `nox` is adopted with its uid and home unchanged;
-   on all four the node-engine judges `nox` unable to become root, and the self-check raises `agent-can-become-root`
-   for it on a machine that marks no agent account too; the operator's logins `ace`, `jochen` and `jochens` are
+   on all four the node-engine judges `nox` unable to become root; a login `nox` given a sudo rule in a test is left
+   unaltered and the self-check raises `agent-can-become-root` for it, on a machine that marks no agent account too;
+   the operator's logins `ace`, `jochen` and `jochens` are
    unchanged.
 8. No manifest in the catalogue declares a login for a person or an agent; the catalogue's check refuses one.
-9. For every machine, the declaration before and after differs only in the machine accounts' `user` resources (now
-   the controller's, and `nox` added on ace, g14 and shanks); claude-code on novox, run for `nox`, places the same
+9. For every machine, the declaration before and after differs, for the modules not set to run for an identity, only
+   in the machine accounts' `user` resources (now the controller's, and `nox` added on ace, g14 and shanks); claude-code on novox, run for `nox`, places the same
    files in the same home; on ace, g14 and shanks the guard stays off and the operator's sessions keep the mesh's tools.
 10. A session started for `nox` on novox gets the agent's home configuration and one started for `jochen` the
     operator's, with no tool call through; a session as `nox` that starts claude-code for `jochen` is refused; with