diff --git a/02-DECISIONS/0272-the-operator-reaches-the-controller-with-mesh-cli-on-every-node-and-a-node-is-the-terminal-only-where-no-agent-runs-as-its-operator.md b/02-DECISIONS/0272-the-operator-reaches-the-controller-with-mesh-cli-on-every-node-and-a-node-is-the-terminal-only-where-no-agent-runs-as-its-operator.md
index 51d555d6..403b8084 100644
--- a/02-DECISIONS/0272-the-operator-reaches-the-controller-with-mesh-cli-on-every-node-and-a-node-is-the-terminal-only-where-no-agent-runs-as-its-operator.md
+++ b/02-DECISIONS/0272-the-operator-reaches-the-controller-with-mesh-cli-on-every-node-and-a-node-is-the-terminal-only-where-no-agent-runs-as-its-operator.md
@@ -186,6 +186,30 @@ reach and no more. Once agents there run as `agent`, `agent` is refused. The cla
 fails if one changes alone: if the operator's account lost its passwordless `sudo` while agents still ran as it,
 `mesh-cli` would give those agents a terminal they no longer had (§ How it is checked).
 
+> **Progressive insight — 2026-10-09.** Three facts of the building, after the record was accepted; the decision
+> stands.
+>
+> 1. **How the terminal's line is told from every other.** ADR 0266 marks everything the serving controller starts
+>    as never the terminal (`MESH_SERVED_BY_THE_CONTROLLER`). A line mesh-cli runs as the terminal therefore runs
+>    without that mark and without `MESH_VERB`, and carries a mark of its own, `MESH_CLI_TERMINAL`, which the
+>    controller's check of where a command was started reads as the terminal. The controller says the terminal
+>    explicitly when it composes a line's environment (`commandEnvironment` in mesh-controller
+>    `cmd/mesh-controller/seatverbs.go`), and strips `MESH_CLI_TERMINAL` from every other line it runs — a verb's,
+>    an ordinary mesh-cli line — whatever its own environment holds. A test sets the mark in the serving
+>    environment and fails when that strip is taken out.
+> 2. **Only a login session is the terminal.** §4 said the control-node's operator account; the tool runner and
+>    the account's user units run as that account too, and are not a person at a terminal. The node-engine reads the
+>    asking process's cgroup and sends its login session's scope (`session-<id>.scope` under the account's own
+>    `user-<uid>.slice`, which logind's own record must say is this account's, of class `user`), read the moment
+>    the connection is accepted, or nothing; the controller makes a line from no login session an ordinary call.
+>    Built in mesh-host and mesh-controller on 2026-10-09, each with a test that fails without it. **What it does
+>    not do:** a login session includes every process started in it, agents started from the operator's shell
+>    among them, and any process of the account can reach one (a `tmux` server, a line in `~/.zshrc`). So the rule
+>    keeps services from being the terminal, not processes of the same account; on the control-node the agents'
+>    boundary is ADR 0266's account of their own.
+> 3. **An ordinary line is reads and settings.** §4 is exact as it stands: an ordinary line is the generic verb's
+>    reading forms, or a `settings` line composed as the settings verb composes it — nothing else runs.
+
 ### 5. What comes back
 
 **Every line is a call**, run, recorded and answered as a seat's verb is: the bus lets a request be answered for a