ADR 0143: a consumer verifies the grant it is given

A grant is four facts and a credential — the provision, the machine, the port, and
who the consumer is when it connects — and it is the whole mechanism by which
anything in the mesh reaches anything else. The mesh asserted it and never found
out whether it was true. Issue 145 is what that cost: eleven hours of 'every module
current with its source' while a module could not reach its database.

The consumer verifies it, from its own network position. Not the control plane,
which reaches the address by a path no consumer uses. Not the machine, whose own
packets carried a source address the filter admitted while every container's was
refused — so a host-side check would have passed throughout the outage it exists to
catch. That is inference from the rule that was loaded, stated as such.

A connection and nothing more; speaking each provision's protocol would be a second
implementation of every provision. One failure is not news, only consecutive ones,
and the count is reported rather than the last attempt. A consumer that is not
running reads unchecked, which is a different sentence from broken.

What it costs to be wrong is the constraint on all of it: a check that calls a
working provision broken trains a reader to ignore the report.

04-ISSUES/145-a-machine-reads-healthy-while-its-modules-cannot-reach-each-other/00-report.md

@@ -5,7 +5,7 @@ located-in:
   - mesh-controller internal/catalogue/filtering.go (fixed for this instance)
   - mesh-controller (what status reports, and what it does not ask)
 fixed-by:
-amended-design:
+amended-design: 03-DESIGN/01-to-be/10-delivery.md
 ---
 
 # 145 — A machine reads healthy while its modules cannot reach each other
@@ -72,6 +72,18 @@ distance between a declaration and the machine, and in both cases the report was
 **And the eleven hours are the measurement, not the bug.** The filter fault was one line and is fixed.
 What is not fixed is that nothing in the mesh would have told anybody.
 
+## What was decided
+
+*2026-09-29, the same day.* The first open question below — should a grant be checked, and from where —
+is answered by [ADR 0143](../../02-DECISIONS/0143-a-consumer-verifies-the-grant-it-is-given.md): the
+consumer verifies it, from its own network position, because that is the only position that answers what
+a grant claims. A check run by the control plane or by the machine would have passed throughout this
+outage, since the rule in force admitted the machines' own addresses and it was the containers that were
+refused.
+
+The remaining questions below stand, and the record answers two of them: one failure is not news, only
+consecutive ones, and a grant that cannot be checked is reported unchecked rather than assumed good.
+
 ## Open questions
 
 - Should a grant be checked? The mesh knows the consumer, the provider, the address and the port, so a