Graduate issues 067 and 068 to decisions and to-be designs

ADR 0084 (extends 0027) — a provision is served by a node-scoped provider the
consumer selects, defaulting to co-location; a module may instead carry a private
embedded instance that is not a provision. Design: 01-to-be/23-choosing-a-provider.

ADR 0085 (extends 0031) — a secret is a provision and the vault is the module that
provides it; a module's own local secret becomes an ordinary pair credential that
rotates through the existing machinery, while the controller's provisioning-credential
mint (0048) is unchanged. Design: 01-to-be/24-the-secrets-vault; doc 13 amended to
cross-link the non-pair secret.

Issues 067/068 marked resolved with amended-design set. ADR index regenerated;
records and index checks pass.

Claude-Session: https://claude.ai/code/session_01D6qtiYU3P9jk3pnAXyAFyx

03-DESIGN/01-to-be/13-credentials-and-their-rotation.md

@@ -5,10 +5,11 @@ code:
   - mesh-controller internal/inventory/secrets.go
   - mesh-controller cmd/mesh-controller/rotate.go
   - mesh-controller examples/postgres-provisioner
-updated: 2026-09-01
+updated: 2026-09-20
 decisions:
   - 02-DECISIONS/0001-mesh-brokers-nodes-host-agents-think.md
   - 02-DECISIONS/0009-modules-and-the-graph.md
+  - 02-DECISIONS/0085-a-secret-is-a-provision.md
 ---
 
 # 13 — Credentials, and moving them
@@ -105,3 +106,19 @@ a provider that added a password and removed nothing.
 
 **Not over loopback.** `pg_hba` trusts anything there, so every password looks correct — a
 deliberately wrong one returned a row for an afternoon before that was noticed.
+
+
+## The secret that is not a pair
+
+Everything on this page is about the credential *between a consumer and a provider* — the login
+one module uses against another. A mesh also holds secrets that are not that: a value a single
+module needs for **its own** use, and a value only an operator can supply. Those had no owner, and
+so no rotation — the gap this page's machinery could not reach because there was no pair to rotate.
+
+[ADR 0085](../../02-DECISIONS/0085-a-secret-is-a-provision.md) gives them one. Such a secret is
+provided by a **vault** module ([24](24-the-secrets-vault.md)): a module requires a `secret`
+provision, and the credential of that consumer↔vault pair is an ordinary pair credential — so it
+rotates, and is queried for who holds it, through exactly the machinery described above, unchanged.
+The rotation a module's own secret lacks is not a second mechanism; it is this one, pointed at a
+secret the vault provides. What this page proves for a database password holds, by construction,
+for a secret from the vault.