# Diagnosis — 2026-09-21

1. The three open questions, answered. It is `secret accept` growing a provider end, not a new
   verb: the verb already means a value a person supplied, sealed on the way in. An accepted pair
   refuses `rotate` — the mesh cannot make the replacement — and accepting a new value is the
   rotation. The origin becomes a fact of every pair credential, `made` or `accepted`, so the
   vault's ledger can say which a person supplied.
2. One consequence the report did not name: a pair credential is remade whenever either end's
   sealing key changes, and an accepted one cannot be — the mesh does not hold the value. The
   read is refused aloud with the remedy rather than quietly replaced by a minted one.

**Located in:** the controller's pair-credential store and the `secret accept` command. Decided
in [ADR 0092](../../02-DECISIONS/0092-an-operator-delivers-a-pair-credential.md).