diff --git a/02-DECISIONS/0009-modules-and-the-graph.md b/02-DECISIONS/0009-modules-and-the-graph.md
index c5f0753..24615df 100644
--- a/02-DECISIONS/0009-modules-and-the-graph.md
+++ b/02-DECISIONS/0009-modules-and-the-graph.md
@@ -162,10 +162,29 @@ software *on* the mesh rather than *of* it. It also costs the host nothing: a re
 file, which was checked by putting the control plane's output through the host's own parser rather
 than by asserting it.
 
-**Binding is not built**, and it is the larger half. It needs a secret to exist, be stored, be
-delivered to one node and not the others, and be rotated with every holder informed — which is
+**Binding is built except for the secret**, and that turned out to be the useful way to cut it.
+
+A provider says what a consumer needs in order to use it — a port, a driver, a realm — and a
+consumer says where it wants to be told. The mesh adds the half only it has: **which machine, and
+what that machine is called on the private network.** So an application on one node is handed the
+address of its database on another, as a file, and reaches it by a name the mesh also created.
+
+**The file states that it carries no credential, and why.** A missing field looks like a bug; a
+stated absence looks like a boundary, and somebody wiring this up should not spend an afternoon
+looking for a password that was never going to be there.
+
+**What remains is the secret itself**, and it is the larger half: it must exist, be stored, reach
+one node and not the others, and rotate with every holder informed — which is
 [the invariant set](0001-mesh-brokers-nodes-host-agents-think.md) that was found violated three
-ways at once, and the reason it is not something to add in passing.
+ways at once, and the reason it is not something to add in passing. What is built is the shape it
+will arrive in.
+
+**One check that only became possible now.** Two machines wired together across no private network
+is a mesh that reports itself configured and does not work, and the failure surfaces as a
+connection timing out — the slowest place to find anything. It is refused, and it is only
+*checkable* because the network became [something a machine is
+given](#what-a-domain-module-turns-out-to-be-and-why-it-is-not-the-one-refused-above) rather than
+something it has by virtue of holding an address.
 
 **What the absence cost, measured.** Exactly two modules opened a direct connection to the control
 plane's database — the proxy and the VPN — and they are the reason every node permanently holds a