Merge pull request 'ADR 0266: the control node's agent account is named nox' (#264) from decisions/0266-the-agent-account-is-named-nox into main

02-DECISIONS/0266-on-the-control-node-agents-run-under-an-account-of-their-own-that-cannot-become-root-without-a-person.md

@@ -120,10 +120,15 @@ The controller resolves three machine facts from it:
 
 The tool runner is given `MESH_AGENT_ACCOUNT` and `MESH_AGENT_HOME` beside the operator's.
 
-**On the control node the agent account is `agent`.** The other nodes keep their agents as the operator for
+**On the control node the agent account is `nox`.** The other nodes keep their agents as the operator for
 now. The operator's machines do so because the agent works in the operator's desktop and files there, under
 the risk ADR 0234 accepts. A server may follow: it is moved by stating the fact.
 
+> **Progressive insight — 2026-10-10.** This sentence named the control node's agent account `agent`. The
+> operator chose `nox` instead. The name is the account argument of `mesh-controller node agent-account`,
+> a node fact stated at the controller's terminal, so no code and no other part of this record changes:
+> the control node still names an agent account of its own, which cannot become root without a person.
+
 ### 2. The account is declared and has no way to root
 
 The `claude-code` module declares the account as a `user` resource named `${machine:agent-account}`, with
@@ -379,6 +384,10 @@ works on branches and pull requests; what it may merge is said under *What still
   runs as it can still become root: the tool runner and the operator's own shells. No agent runs as it.
 - **Not judged, said plainly:** the ways §3 lists under *not judged*. Each is a way to root this record does not
   see. None is known on the control node, and each is left for a later record.
+
+  > **Progressive insight — 2026-10-10.** That later record had no issue tracking it. The ways §3 lists under
+  > *not judged* are tracked by [issue 344](../04-ISSUES/344-known-gaps-in-the-agents-boundary-accepted-for-now/00-report.md)
+  > (gap 14), beside the other gaps in the agent's boundary accepted for now.
 - The tool runner's credential still carries every co-hosted module's grants. The agent cannot read it.
 - ADR 0181 decided one account per node. This record adds a second, of a different kind: not a person's
   login, but the one agents run as.

04-ISSUES/344-known-gaps-in-the-agents-boundary-accepted-for-now/00-report.md

@@ -100,6 +100,14 @@ note. Each gap says what is open, why it matters, and what would close it.
    *Closed* on 2026-10-09 by mesh-controller #177: the build-source check judges the first matching rule, as the
    forge does.
 
+14. **Ways to root the node-engine's judge does not see.** ADR 0266 §3 lists them under *not judged, so not seen*:
+   among them a root-run unit or script the agent account can write, a directory on root's `PATH` it can write,
+   root's ssh keys readable by it, and a setuid program on a filesystem the search does not walk. None is known
+   on the control-node, but a healthy verdict says nothing about them. The record left them "for a later record"
+   with nothing tracking it; added here on 2026-10-10.
+   *Closes with:* each way judged by the node-engine beside the others, or a record that decides against judging
+   it and says why.
+
 ## Why it is an issue
 
 Each gap is a known way around a rule the mesh states. A gap that is written down can be weighed and closed. A