ADR 0272: the agent account's judgement comes from the engine's statement, never from the request

02-DECISIONS/0272-the-operator-reaches-the-controller-with-mesh-cli-on-every-node-and-a-node-is-the-terminal-only-where-no-agent-runs-as-its-operator.md

@@ -121,11 +121,13 @@ The node-engine serves a socket every local account may connect to. For each con
    core NATS. Only that node's engine may publish under `mesh.control.<node>.`: its bus account is granted that
    prefix and nothing of any other node's, so **the node is a fact the bus server enforces and the account is a
    fact the kernel gives**. The CONTROL stream names its own subjects, so the request is never persisted;
-3. says with it whether the node's declaration names an agent account, and the engine's latest judgement of it
-   (ADR 0266 §3);
-4. answers the program with what the controller answered, or says that the controller did not answer within its
+3. answers the program with what the controller answered, or says that the controller did not answer within its
    call bound.
 
+Whether the node's agents run under an account of their own is not in the request. The node-engine already
+says it: its judgement of the agent account is in its health statement (ADR 0266 §3, §4), and the controller reads
+its own record of that statement, so a request cannot claim a judgement.
+
 The node-engine is trusted for its own node. Root on a node could claim any account there; root on a node that is
 the terminal is already the operator's, and §4 makes no other node the terminal.