Known-pattern routing only. No guessed diagnosis.
Sudo: no arbitrary sudo assumptions. Only source-marked privileged READ commands can be rendered with sudo; state-changing commands are never auto-converted.