row 245: row 195 follow-up, F9 runs node as root only at the pinned root-only path, the header and TOOLS.md list what root runs, F6 refuses .. after claude-<pin>/ (Duckworth N1-N3, #1693)

Darkwing's ef8b4439e (darkwing/row245), Duckworth round 1 APPROVE (rev 2849, comment 30043),
manifest 69bc05f4f706, 5 paths. Slot run sage-1961 (darkwing-0107): singles 23/0, mutants 16/16
killed, N1 and N3 among them. DESIGN.md:336-338 stays unedited, superseded by gosalyn-0087.
Sage gate on 856c1826b plus these 5 paths (12:24-12:35Z): case1-accept.test.mjs alone 23/0,
cli 681/0, every scripts/test-*.sh 429/0.

docs/TOOLS.md

@@ -905,9 +905,13 @@ args file (`/etc/mosaic-stack/dev.args` on .53), which must pass
 `stack-upgrade.sh`'s rules, say `--profile factory` and name `--business`.
 Every command that runs the stack's code runs as
 `sudo -u USER -H env PATH=<node dir>:/usr/local/bin:/usr/bin:/bin` from `/`.
-Root only reads systemd, `ss`, `/proc`, the account database and file
-metadata. The one write is F3's message and its reply, and it never opens
-`claude-session.env`.
+Root itself reads `ss`, `/proc`, the account database and file metadata. It
+runs `systemctl show` and `is-enabled`, `curl` on the Console's loopback
+`/healthz`, `sudo -l`, `sudo -u jarvis bwrap --version`, `hostcheck.sh
+--check`, and node to parse `managed-settings.json` for F9. F9 runs node only
+when `--node` is the `--node-pin` path, and the file and every directory above
+it are root's with no group or other write. The one write is F3's message and
+its reply, and it never opens `claude-session.env`.
 
 It prints one line per check, `<id> <path> <mark> <evidence>`, then
 `count <mark> N` for each mark and a result line. The functional checks