# Diagnosis — 2026-09-18

The mechanism was already understood when the issue was opened: a provision secret is minted as a
side-effect of composing the consumer's node, and the provider's grant list is a pure read of
secrets already issued — so a provider composed before the consumer existed, and never again, is
blind to it. The open question was the remedy: cascade the push, or report the obligation.

Decided as [ADR 0083](../../02-DECISIONS/0083-one-push-leaves-the-mesh-consistent.md): a push
finishes what it starts. The controller captures the digest of what every machine should be
before composing the named node, recomputes after, and delivers to exactly the machines whose
declaration changed because of this push — named in the output, bounded rounds, converging.
Machines behind for unrelated reasons stay the business of `push --behind`.

**Located in:** mesh-controller (the push command). Checked by the built-store-cross-node bed,
which now pushes only the consumer's node and asserts the provider minted the vhost — the
workaround push is removed, so a regression fails the bed.