Do i need write access to the files directory to migrate d7_file?
Ok, i figured this one out.  The magic lines are in /core/modules/migrate/src/Plugin/migrate/process/FileCopy.php
First, make sure source_base_path is correct in your config: Check drush mmsg d7_file after migrate-upgrade d7_node --limit=1 to see whether it is correctly finding the files.  Use drush config:export and config:import to modify it til that works.  Alter settings.php to put config/sync somewhere other than /sites/default/files
Second, mount the live site's public files dir read-only at /sites/default/files.
Third, modify /core/modules/migrate/src/Plugin/migrate/process/FileCopy.php around line 149 to comment out the action.  Make it look like this:
    if (!is_dir($dir) || !is_writable($dir)) {
      if (!$this-&gt;fileSystem-&gt;prepareDirectory($dir, FileSystemInterface::CREATE_DIRECTORY | FileSystemInterface::MODIFY_PERMISSIONS)) {
        throw new MigrateException(&quot;Could not create or write to directory '$dir'&quot;);
      }
    }

    $final_destination = $this-&gt;writeFile($source, $destination, $this-&gt;configuration['file_exists']);
    if ($final_destination) {
      return $final_destination;
    }
*/
      return $destination;```


Last, run drush migrate-upgrade d7_file

Enjoy.