The secret is delivered without ever being held

Written after looking at how the existing mesh does it, so this is a
reaction to a measurement rather than a preference.

There, credentials sit in a column encrypted at rest. Its own tooling
records what that bought: the tool for finding a secret matches by value
rather than by name, because the same password is in three tables, in
each node's environment file in plain text, and inside every connection
string composed from it — copies its documentation calls the ones usually
in use. And a query against the encrypted column returns zero rows and
proves nothing, so auditing moved to the decrypted copies.

Encryption at rest addresses neither fault. The control plane can read
what it stores, so a copy of its database is a copy of everything. And
composition is what mints the untracked copies.

So the value is sealed to the node that will use it before it is stored,
with a key that node generated. Nothing central is composed. What it
costs is auditing by value, which was never real anyway; what stays
answerable is which node holds what, which is what rotation asks.

What remains is a provisioner. The mesh generates the secret and tells
both ends; nothing yet acts on the telling.

02-DECISIONS/0009-modules-and-the-graph.md

@@ -173,11 +173,55 @@ address of its database on another, as a file, and reaches it by a name the mesh
 stated absence looks like a boundary, and somebody wiring this up should not spend an afternoon
 looking for a password that was never going to be there.
 
-**What remains is the secret itself**, and it is the larger half: it must exist, be stored, reach
-one node and not the others, and rotate with every holder informed — which is
-[the invariant set](0001-mesh-brokers-nodes-host-agents-think.md) that was found violated three
-ways at once, and the reason it is not something to add in passing. What is built is the shape it
-will arrive in.
+### And the secret, which is delivered without ever being held
+
+*Written 2026-08-30, after looking at how the existing mesh does it. The design here is a reaction
+to a measurement, not a preference.*
+
+**The obvious arrangement is a credentials column, encrypted at rest.** It exists, and its own
+tooling records what it bought:
+
+| | |
+|---|---|
+| the tool for finding a secret matches **by value**, not by name | because one password is in the provisions table, the environment table, each node's environment file in plain text, and **inside every connection string composed from it** — copies its documentation calls *"often the only copies actually in use"* |
+| a query against the encrypted column **returns zero rows and proves nothing** | so auditing moved to the decrypted copies on the machines |
+
+**Two faults, and encryption at rest addresses neither.** The control plane can read what it
+stores, so a copy of its database is a copy of every credential in the mesh. And one secret has
+many homes with nothing tracking them — **composition is what mints the untracked ones**, because
+building a connection string centrally creates a new secret-bearing value no rotation path knows
+about.
+
+**So the value is sealed to the node that will use it before it is stored.** With a key that node
+generated and whose private half the mesh has never seen — a third key beside the identity and the
+overlay, for the same reason those are two rather than one. What is stored is unusable by whoever
+holds it, the mesh included, and the broker relays a blob it cannot read. This is what makes
+[ADR 0004](0004-a-node-and-how-it-joins.md)'s *compromise of a node is compromise of that node*
+true of secrets rather than true of identity and quietly false of everything that matters.
+
+**And nothing is composed centrally.** A connection string is assembled on the machine that needs
+one, if at all. The mesh delivers parts.
+
+**What it costs, stated because it is real:** the mesh cannot audit by value. That is the right
+trade rather than an oversight — a query over an encrypted column could not either, so the audit
+was never real. What *is* answerable is which node holds what, which is the question rotation
+actually asks.
+
+**A consequence that shapes the mechanism.** The mesh discarded the plaintext, so it cannot
+compose a file containing it. The credential is therefore **its own file**, holding the value and
+nothing else, beside the readable one. That is better than the alternative it was forced into:
+the readable half stays readable in the declaration, and the secret half changes only when the
+secret does, so a service reloading on it reloads for a real reason.
+
+**Rotation is generating a new one**, because reading the old one back is not possible. Both ends
+are re-sealed and reach their machines in the same push — which removes the window where half the
+mesh holds a dead credential, the failure
+[recorded in ADR 0001](0001-mesh-brokers-nodes-host-agents-think.md) as consumers on three nodes
+holding one for two days.
+
+**What remains is a provisioner** — something that creates the database user the credential is
+for. The mesh now generates the secret, tells the provider to create it and the consumer to use
+it; nothing yet acts on the telling.
 
 **One check that only became possible now.** Two machines wired together across no private network
 is a mesh that reports itself configured and does not work, and the failure surfaces as a