Merge remote-tracking branch 'origin/main' into decision/0272-mesh-cli-the-operators-command

00-META/glossary.md

@@ -214,6 +214,10 @@ and Health and repair. **Decided by** ADR 0100, 0126, 0176, 0181, 0207, 0221, 02
   against this account's home and owned by it
   ([ADR 0181](../02-DECISIONS/0181-the-operator-account-is-a-node-fact-and-a-home-is-a-placement-root.md)).
   Not a name a manifest carries.
+- **agent account** — the login every coding agent on a node runs as, when the node names one of its own;
+  stated on the node record at the controller's terminal, never by a verb or a setting. Empty means agents
+  run as the operator account. It cannot become root without a person, and the node-engine judges that on
+  every look ([ADR 0266](../02-DECISIONS/0266-on-the-control-node-agents-run-under-an-account-of-their-own-that-cannot-become-root-without-a-person.md)).
 - **account group** — a group of the machine's group database that a module puts an account in, by
   declaring the account with that group and nothing else of it. Several modules may each add one to the
   same account; the mesh takes back only an account group it added