ADR 0143: a consumer verifies the grant it is given

A grant is four facts and a credential — the provision, the machine, the port, and
who the consumer is when it connects — and it is the whole mechanism by which
anything in the mesh reaches anything else. The mesh asserted it and never found
out whether it was true. Issue 145 is what that cost: eleven hours of 'every module
current with its source' while a module could not reach its database.

The consumer verifies it, from its own network position. Not the control plane,
which reaches the address by a path no consumer uses. Not the machine, whose own
packets carried a source address the filter admitted while every container's was
refused — so a host-side check would have passed throughout the outage it exists to
catch. That is inference from the rule that was loaded, stated as such.

A connection and nothing more; speaking each provision's protocol would be a second
implementation of every provision. One failure is not news, only consecutive ones,
and the count is reported rather than the last attempt. A consumer that is not
running reads unchecked, which is a different sentence from broken.

What it costs to be wrong is the constraint on all of it: a check that calls a
working provision broken trains a reader to ignore the report.

03-DESIGN/01-to-be/10-delivery.md

@@ -5,8 +5,9 @@ code:
   - mesh-controller internal/builder
   - mesh-controller cmd/mesh-controller (build, build --behind, push, status)
   - mesh-controller internal/inventory/builds.go
-updated: 2026-09-21
+updated: 2026-09-29
 decisions:
+  - 02-DECISIONS/0143-a-consumer-verifies-the-grant-it-is-given.md
   - 02-DECISIONS/0090-a-failure-that-repeats-is-said-to-be-stuck.md
   - 02-DECISIONS/0082-the-registry-is-reached-by-name-and-trusted-by-the-overlay.md
   - 02-DECISIONS/0010-delivery.md
@@ -226,3 +227,38 @@ when the current failure began and how many reports in a row have said it — th
 id, whatever the words; three make the machine stuck, and `status` says so beside the failure. The host keeps trying — stuck is what the mesh
 knows, not what the machine is told. *How it is checked:* an inventory test counts three identical
 reports, a different one, and a clean apply; the status test asserts the word appears.
+
+## A consumer verifies the grant it is given
+
+*2026-09-29, from an outage that ran eleven hours —
+[issue 145](../../04-ISSUES/145-a-machine-reads-healthy-while-its-modules-cannot-reach-each-other/00-report.md),
+settled by [ADR 0143](../../02-DECISIONS/0143-a-consumer-verifies-the-grant-it-is-given.md).*
+
+A grant is four facts and a credential: the provision, the machine, the port, and who the consumer is
+when it connects. It is the whole mechanism by which anything in the mesh reaches anything else, and the
+mesh asserted it without ever finding out whether it was true.
+
+What that cost: a machine was converged, the path from a container to a port on its own machine closed,
+and for eleven hours the mesh answered *all heard from, every module current with its source* while a
+module logged a connection timeout to its database six thousand times. Every check the mesh makes passed,
+because every one is about the relationship between the mesh and a machine — applied, current, running.
+None asks whether a consumer can reach what it requires.
+
+**So a consumer verifies its own grants, from its own network position.** Not the control plane, which
+reaches the address by a path no consumer uses; not the machine, whose own packets carried a source
+address the filter admitted while every container's was refused. The position is the point: a check
+somewhere else is testing something nobody asked about.
+
+It opens a connection and nothing more. Whether the credential is right or the schema current is the
+provider's to answer and the consumer's to discover; a check that spoke each provision's protocol would
+be a second implementation of every provision.
+
+One failure is not news — a provider restarting is ordinary — so a grant reads unreachable only after
+consecutive reconciles, and the machine reports the count rather than the last attempt, which is what
+separates "briefly away" from "never worked". A consumer that is not running has no position to dial
+from: that grant reads unchecked, which is a different sentence from broken and must not be written as
+one.
+
+*How it is checked* is stated with the decision, and the first of them is the outage itself: a bed drops
+the path from a consumer's position while leaving the machine's own open, and the grant must read
+unreachable — which fails both against reporting nothing and against a check run from the machine.