Issue 1409. readTools no longer appends the refusal sentence to list. A row in TestSecretPlacesAreRefusedByNameBeforeAnyRead holds a link's target in a secret place to the content rule. S2's match on sudo's English message is left as it is: the root path sets no locale, and sudo's environment handling decides whether LC_ALL reaches stat. Builds: design 39 parts D3 (§15), bullets 2 and 4