Agents reaching nodes is the capability, not a hole in it

Correcting what I wrote an hour ago. I had recorded node-to-node SSH as "not a
mesh function" and "a second control path through the back door", reasoning
from ADR 0004's rule that the host has no inbound control surface. That
conflated two different things and got the product backwards.

There is no node-to-node SSH to forbid. The actor is always an agent; a node is
only where it happens to be running -- ADR 0001 already says a node is a place
where an agent can run and that is the entire relationship. An agent hired onto
one node reaching another to do work is the capability the whole arrangement
exists to provide.

The credential is the agent's, in its own credential directory, which ADR 0001
already established. So a node's authorized_keys lists agents and never nodes,
and three things follow: no node holds a key reaching another node, so 0004's
"a node holds its own identity and nothing else" stays literally true; a
compromised node costs the credentials of the agents that were on it rather
than a way into everything; and who may reach what stays a mesh-wide fact,
which is why it is identity's.

The rule I misapplied is about how a node's declared state changes -- over the
broker, never by being dialled. An agent with a shell is not the mesh
reconfiguring a machine, it is what a person with a terminal has always been,
and this design already depends on that working: the overlay is the way back in
when a declaration breaks something. What such a session leaves behind is
drift, and drift is what reconciliation is for.

0001 also stops underselling the fourth layer. It read as "the layer the other
three exist to carry", which is true and flat. The value is that an agent can
work across a set of machines as though they were one -- centrally configurable
machines are ordinary; that is not.

02-DECISIONS/0001-mesh-brokers-nodes-host-agents-think.md

@@ -83,6 +83,16 @@ Four layers. Naming them honestly is worth more than the word on the tin:
 | **modules are how anything is built and delivered** | this *is* the CI/CD, not something beside it ([ADR 0010](0010-delivery.md)) |
 | **agents are hired onto nodes and do the work** | the layer the other three exist to carry |
 
+**The fourth row is where the value is, and the first three are what make it possible.** An agent
+hired onto one node can reach any other — a shell, a service, a file — because the private network
+makes every node reachable and `identity` decides which agents may reach which. **That is the
+capability being built**: not machines that can be configured centrally, which is ordinary, but a
+set of machines an agent can work across as though they were one.
+
+The credential belongs to the **agent**, never to the node it is sitting on
+([ADR 0006](0006-the-substrate-and-the-control-plane.md)), which is the same rule as *nodes and
+agents are decoupled* below, applied to access.
+
 **This is not a mesh in the peer-to-peer sense and will not become one.** The word describes what
 machines can reach, not how they are governed:
 

02-DECISIONS/0006-the-substrate-and-the-control-plane.md

@@ -49,7 +49,32 @@ It is three questions wearing one name, and only two of them are the mesh's:
 |---|---|
 | **humans** | their key, on the nodes they are allowed on |
 | **agents** | the same, with a lifetime — and revocation that has to actually work |
-| **node to node** | **not a mesh function.** The host has no inbound control surface by decision ([ADR 0004](0004-a-node-and-how-it-joins.md)); nodes SSHing to each other would be a second control path arriving through the back door |
+| **an agent reaching another node** | **this is the point of the mesh, not an exception to it** — see below |
+
+**There is no such thing as node-to-node SSH here, and that is a clarification rather than a
+restriction.** The actor is always an **agent**; a node is only where it happens to be running —
+[ADR 0001](0001-mesh-brokers-nodes-host-agents-think.md): *a node is a place where an agent can
+run, that is the entire relationship.* An agent hired onto one node reaching another to do work is
+the capability the whole arrangement exists to provide.
+
+**The credential is the agent's, never the node's.** It lives in the agent's own credential
+directory ([ADR 0001](0001-mesh-brokers-nodes-host-agents-think.md)), so a node's
+`authorized_keys` lists **agents** and never nodes. Three things follow, and they are why this
+shape is better rather than merely allowed:
+
+- [ADR 0004](0004-a-node-and-how-it-joins.md)'s *a node holds its own identity and nothing else*
+  stays true — no node holds a key that reaches another node;
+- a compromised node costs the credentials of the agents that were on it, not a way into
+  everything;
+- **who may reach what is a mesh-wide fact**, which is exactly why it is `identity`'s and not
+  something arranged locally.
+
+**And it does not conflict with the host having no inbound control surface.** That rule is about
+how a node's *declared state* changes: over the broker, never by being dialled. An agent with a
+shell is not the mesh reconfiguring a machine — it is what a person with a terminal has always
+been, and this design already depends on it working
+([ADR 0007](0007-connectivity.md): the overlay is *the way back in*). What such a session can leave
+behind is drift, and drift is what reconciliation is for.
 
 **Where the record lives is deliberately open.** Contexts integrate through it, which makes it
 load-bearing, and putting it in the substrate risks recreating the circularity the tiers just