Binding is built except for the secret

Which turned out to be the useful way to cut it. A provider says what a
consumer needs in order to use it; a consumer says where it wants to be
told; the mesh adds which machine and what that machine is called on the
private network. So an app on one node reaches its database on another,
by a name the mesh also created.

The file says it carries no credential and why, because a missing field
looks like a bug and a stated absence looks like a boundary.

What remains is the secret itself, and the shape it will arrive in now
exists.

Also: two machines wired together across no private network is refused,
and that only became checkable when the network stopped being something a
machine has by virtue of holding an address.

02-DECISIONS/0009-modules-and-the-graph.md

@@ -162,10 +162,29 @@ software *on* the mesh rather than *of* it. It also costs the host nothing: a re
 file, which was checked by putting the control plane's output through the host's own parser rather
 than by asserting it.
 
-**Binding is not built**, and it is the larger half. It needs a secret to exist, be stored, be
-delivered to one node and not the others, and be rotated with every holder informed — which is
+**Binding is built except for the secret**, and that turned out to be the useful way to cut it.
+
+A provider says what a consumer needs in order to use it — a port, a driver, a realm — and a
+consumer says where it wants to be told. The mesh adds the half only it has: **which machine, and
+what that machine is called on the private network.** So an application on one node is handed the
+address of its database on another, as a file, and reaches it by a name the mesh also created.
+
+**The file states that it carries no credential, and why.** A missing field looks like a bug; a
+stated absence looks like a boundary, and somebody wiring this up should not spend an afternoon
+looking for a password that was never going to be there.
+
+**What remains is the secret itself**, and it is the larger half: it must exist, be stored, reach
+one node and not the others, and rotate with every holder informed — which is
 [the invariant set](0001-mesh-brokers-nodes-host-agents-think.md) that was found violated three
-ways at once, and the reason it is not something to add in passing.
+ways at once, and the reason it is not something to add in passing. What is built is the shape it
+will arrive in.
+
+**One check that only became possible now.** Two machines wired together across no private network
+is a mesh that reports itself configured and does not work, and the failure surfaces as a
+connection timing out — the slowest place to find anything. It is refused, and it is only
+*checkable* because the network became [something a machine is
+given](#what-a-domain-module-turns-out-to-be-and-why-it-is-not-the-one-refused-above) rather than
+something it has by virtue of holding an address.
 
 **What the absence cost, measured.** Exactly two modules opened a direct connection to the control
 plane's database — the proxy and the VPN — and they are the reason every node permanently holds a