diff --git a/02-DECISIONS/0259-an-ask-is-a-message-on-the-bus-any-channel-answers-it-and-the-asker-acts-on-a-warrant.md b/02-DECISIONS/0259-an-ask-is-a-message-on-the-bus-any-channel-answers-it-and-the-asker-acts-on-a-warrant.md
index 5d610695..e4ac4cc4 100644
--- a/02-DECISIONS/0259-an-ask-is-a-message-on-the-bus-any-channel-answers-it-and-the-asker-acts-on-a-warrant.md
+++ b/02-DECISIONS/0259-an-ask-is-a-message-on-the-bus-any-channel-answers-it-and-the-asker-acts-on-a-warrant.md
@@ -273,7 +273,7 @@ met, and when. It carries no secret.
 
 ### 8. Who may say what on the bus: the trusted parties' own accounts
 
-*Revised after the security review of 2026-10-08, and not yet accepted by the operator.* The first version of
+*Revised after the security review of 2026-10-08; the revision accepted by the operator the same day.* The first version of
 this section rested on the tool runner running as root with a credential only root reads. **On the control
 node it runs as the operator's account, its bus credential belongs to that account, and that account may
 become root without a password.** Every agent runs as that account. So an agent there could read the runner's
@@ -312,10 +312,17 @@ router issues no approve warrant, and the condition says what to change.
 **3. What remains, said plainly.**
 
 - **Root on the router's or the channel's machine defeats all of this.** The self-check raises an urgent
-  condition while an agent's account can become root there without a person; on the control node today it
-  can (the operator's account has passwordless sudo, measured on 2026-10-08). The operator chooses one of:
-  a password for sudo on that machine; agents there under an account of their own without sudo; or the
-  router and the channels placed on a machine where neither holds.
+  condition while an agent can become root there without a person; on the control node today it can (the
+  operator's account has passwordless sudo, measured on 2026-10-08). **The operator chose, on 2026-10-08,
+  that agents on the control node run under an account of their own without sudo.**
+- **An agent reaches root through the mesh's own tools too.** Any machine's tool runner may call any tool
+  on any machine, and the login shell seat's `execute` runs a command as the account the runner runs as —
+  on the control node, the operator's account, with passwordless sudo, which the mesh's acting tools rely
+  on (measured on 2026-10-08). So an agent on any machine can run a root command on the control node
+  without touching its own account. The self-check therefore counts both ways in: an account an agent
+  runs as that can become root without a person, **and** a tool an agent may call that runs a command
+  given to it as an account that can. It fails until both are closed; the second is decided separately
+  (the login shell's reach, and what an agent's calls are granted).
 - **The controller holds the whole JetStream API** today. Narrowing it to the streams and buckets it owns is
   planned work of its own; until then the controller is trusted with every record.
 - **On the X11 desk an agent can read a code as it is shown or typed** (ADR 0234's accepted risk). The hour