diff --git a/04-ISSUES/361-the-control-nodes-agent-account-is-never-judged/01-diagnosis.md b/04-ISSUES/361-the-control-nodes-agent-account-is-never-judged/01-diagnosis.md
index 3ff4e930..c55a296f 100644
--- a/04-ISSUES/361-the-control-nodes-agent-account-is-never-judged/01-diagnosis.md
+++ b/04-ISSUES/361-the-control-nodes-agent-account-is-never-judged/01-diagnosis.md
@@ -136,11 +136,14 @@ engine agree. What it found, and what was done:
   once complete. But every ask throws a walk away. Asked again and again, it would keep the machine unjudged
   for good and its disks busy, and whoever may call a verb includes agents. The operator needs the line only
   after a change made by hand.
-- **Considered, not built: judge only what the agent account can reach.** A setuid program under another
-  account's home with mode 0700 cannot be executed by the agent account, because it cannot traverse the
-  directory. Counting only files whose every parent directory the agent account may traverse would stop the
-  operator's own copies blocking `root-free`. It is not built, for three reasons. Root or the operator can make
-  a directory traversable later without any apply, so the verdict would rest on modes that change unseen. ACLs
-  and group membership have to be read for every parent. A program the agent cannot reach today is still one
-  no package owns. Deciding it is a change to ADR 0266 §3 item 10, made through playbook 02 if wanted.
-
+- **A find counts only where the agent account can execute it.** The operator asked how the agent account could
+  reach the two finds at all. It cannot: they sit in the operator's home, which is mode 0700. A setuid- or
+  setgid-root program no package owns now counts against an account only when that account can execute it.
+  Every directory from the root down must be searchable for it and the file executable for it, judged by its
+  uid and all its groups (owner, group or other bits as the kernel picks them). The judge errs towards a way:
+  a link on the path, a POSIX ACL on any component, or a mode it could not read counts as reachable.
+  The search still keeps every find. Reachability is read again at every judgement (one `lstat` per path
+  component), because the operator's account can open its own home without root and no search would see it.
+  A find in a home is said by count ("in an account's home"), never by path. Its path stays in the engine's
+  journal line that ends each search. On resolution, ADR 0266 §3 item 10 gains this as a progressive insight
+  beside the values above.