Design 41 WP9: mesh-files runs as the operator account with sudo where needed, and replaces node-reads (ADR 0394)

03-DESIGN/01-to-be/41-the-shell-and-the-accounts-environment.md

@@ -382,19 +382,22 @@ project folders, downloads, logs, scratch.
   stat, read, search, write, copy, move, delete, make a folder, change mode, change owner, and the trash's list and
   restore. Each says what it replaces (ADR 0245): `ls`, `stat`, `cat`, `grep`, `cp`, `mv`, `rm`, `mkdir`, `chmod`,
   `chown`, and `ssh <node> cp` for a copy between nodes.
-- **It may touch every file.** It runs with full rights and keeps each file's owner and modes as well as it
-  can: a copy or a move keeps them, a new file takes its folder's owner. Which files to touch is the caller's
-  responsibility; this first version judges no permission.
+- **It may touch every file.** It declares no account of its own: the tool runner starts it as the node's
+  operator account, which has sudo without a password, and it uses `sudo -n` only where that account's own rights
+  do not reach. It keeps each file's owner and modes as well as it can: a copy or a move keeps them, a new file
+  takes its folder's owner. Which files to touch is the caller's responsibility; it judges no permission.
 - **Nothing is lost at once.** A file deleted or overwritten goes to the node's trash with who asked and why, is
   restorable for 7 days, and is emptied after.
 - **A path a module owns is refused**, naming the module and its tool, unless the call says `override` with a
   reason; an override is recorded and said to the operator.
+- **It replaces `node-reads`.** Its reads keep WP8's bounds, content rule and kernel reads; `node-reads` and
+  `mesh-reads` are removed in the delivery that brings it.
 - **No Approve is asked**; every act is recorded with its caller. Read and search never return the content
   of a known credential file or a secret place (the mesh never prints a token); copying or moving one is
   allowed.
 
 **Proof.** The module's tests: each verb against a temporary tree keeps owner and modes, a new file takes its
 folder's owner, a delete is restorable from the trash and gone after 7 days, an owned path is refused and an
-override recorded, a credential file's content is never returned. Live: the operator's `~/.claude` on shanks is listed, and a file copied from one node to another
+override recorded, a credential file's content is never returned. Live: the operator's `~/.claude` on a workstation is listed, a file in `/etc` is read through sudo, and a file copied from one node to another
 arrives with its owner and modes.