Design 41: node-reads goes in the delivery after node-files is held on every node (ADR 0394 §9)

03-DESIGN/01-to-be/41-the-shell-and-the-accounts-environment.md

@@ -344,7 +344,8 @@ out, the control-node's value is set to `withhold` and zsh is pushed to it. Then
 *`mesh-sdk`, `mesh-catalog`, `mesh-controller`. ADR 0310, extending ADR 0268; tracked by issue 418.*
 
 **Replaced by WP9.** ADR 0394 supersedes ADR 0310: `node-files` takes over every read below, with the same
-bounds, content rule and refusal of secret places, and `node-reads` is removed in the delivery that brings it.
+bounds, content rule and refusal of secret places; once `node-files` is held on every node, the next delivery
+removes `node-reads` and `mesh-reads`.
 
 ADR 0268 §5 has narrow read tools take the common reads over from `execute`, so that an approval is asked for an
 act and not for a read, and ADR 0286 §44 sets the approval mark on `execute` only once those reads have a tool on
@@ -393,8 +394,9 @@ project folders, downloads, logs, scratch.
   restorable for 7 days, and is emptied after.
 - **A path a module owns is refused**, naming the module and its tool, unless the call says `override` with a
   reason; an override is recorded and said to the operator.
-- **It replaces `node-reads`.** Its reads keep WP8's bounds, content rule and kernel reads; `node-reads` and
-  `mesh-reads` are removed in the delivery that brings it.
+- **It replaces `node-reads`.** Its reads keep WP8's bounds, content rule and kernel reads. Every node is
+  assigned `mesh-reads`, so `node-reads` and `mesh-reads` are removed by the next delivery, once `mesh-files`
+  holds `node-files` on every node.
 - **No Approve is asked**; every act is recorded with its caller. Read and search never return the content
   of a known credential file or a secret place (the mesh never prints a token); copying or moving one is
   allowed.