diff --git a/04-ISSUES/078-a-delivered-secret-is-accepted-under-any-name/00-report.md b/04-ISSUES/078-a-delivered-secret-is-accepted-under-any-name/00-report.md
index 840a1d1..b5d1340 100644
--- a/04-ISSUES/078-a-delivered-secret-is-accepted-under-any-name/00-report.md
+++ b/04-ISSUES/078-a-delivered-secret-is-accepted-under-any-name/00-report.md
@@ -2,7 +2,7 @@
 status: resolved
 opened: 2026-09-21
 located-in: [mesh-controller internal/inventory (secrets)]
-fixed-by: mesh-controller multiple-fixes (a delivery is refused for a name the module does not declare as an own secret, a requirement it has not got, or a local it does not keep; the refusal names what it does declare); found one stale delivery in the whole-mesh bed on the spot
+fixed-by: mesh-controller multiple-fixes (a delivery is refused for a name the module does not declare as an own secret, a requirement it has not got, or a local it does not keep; the refusal names what it does declare); module issue refuses a module with no broker secret before making the account; found one stale delivery in the whole-mesh bed and one orphan account the mesh itself made
 ---
 
 # 078 — A delivered secret is accepted under any name
diff --git a/04-ISSUES/078-a-delivered-secret-is-accepted-under-any-name/01-diagnosis.md b/04-ISSUES/078-a-delivered-secret-is-accepted-under-any-name/01-diagnosis.md
index b049a0e..b54e41a 100644
--- a/04-ISSUES/078-a-delivered-secret-is-accepted-under-any-name/01-diagnosis.md
+++ b/04-ISSUES/078-a-delivered-secret-is-accepted-under-any-name/01-diagnosis.md
@@ -15,3 +15,10 @@ authority on what a module holds. Proven by unit tests against the store: a deli
 undeclared name is refused naming the declared ones; under a declared name it is kept; to an
 unknown module it is refused with the remedy; a pair delivery for a requirement the module has not
 got, or with no local where several are kept, or under a local it does not keep, is refused.
+
+*Later the same day.* The refusal caught the mesh itself: `module issue` made a broker account
+for any module and delivered it as the own secret named `broker`, whether or not the module
+declared one — a bed issuing the certificate authority, which speaks on no bus, left an account
+on the broker that nothing would ever read. `module issue` now refuses a module with no `broker`
+own secret before the account is made. An own secret the mesh mints (the authority's password)
+never needed an issue: it is minted when the node is resolved.