The received grants file names each pair secret by its HOST path. A sidecar that mounts the placed grants directory at another path inside its container sees mesh.json and not the secrets beside it — mosquitto's provisioner reported ENOENT for a file that was there, and nodered's mqtt step failed against a login that was never created. Mounted at its own path now, as postgres does.