diff --git a/cmd/mesh-controller/replay401_test.go b/cmd/mesh-controller/replay401_test.go
new file mode 100644
index 00000000..0c4fd94b
--- /dev/null
+++ b/cmd/mesh-controller/replay401_test.go
@@ -0,0 +1,83 @@
+package main
+
+import (
+	"testing"
+
+	"github.com/novox/mesh-controller/internal/catalogue"
+)
+
+// TestReplay401 replays novox/hq issue 401 (2026-10-10): the mounts module's smb-credentials, an own secret
+// only an outside party issues, was given by nobody, and the send made a random value for it and placed it on
+// the machine; the module read it as a credential given and wrong. The outcome asserted (ADR 0228): the send
+// makes no value for an own secret issued outside the mesh that nobody gave and places none, and a value the
+// mesh made for it before is not placed either; once a person gives one, that value is placed. Written with
+// only what the controller had before its fix (mesh-controller #262) — register, assign, planFor,
+// declarationFor and the inventory's secret reads — so it is laid over the commit before. Needs the store
+// (MESH_TEST_POSTGRES), and is named in testdata/store-tests.
+func TestReplay401(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	const made, outside = "/var/lib/mesh/mounts/password", "/var/lib/mesh/mounts/smb-credentials"
+	register(t, open, catalogue.Manifest{Module: "mounts", Version: "1",
+		OwnSecrets: catalogue.OwnSecrets{
+			"password":        {Path: made, Taken: catalogue.TakenAtStart},
+			"smb-credentials": {Path: outside, Taken: catalogue.TakenAtStart, IssuedBy: catalogue.IssuedOutside},
+		},
+		Resources: []map[string]any{
+			{"id": "state", "type": "directory", "path": "/var/lib/mesh/mounts", "mode": "0700"},
+		}})
+	if _, err := assign(ctx, open, "laptop", "mounts"); err != nil {
+		t.Fatal(err)
+	}
+	sent := func() []map[string]any {
+		t.Helper()
+		plan, settings, err := planFor(ctx, open, "laptop")
+		if err != nil {
+			t.Fatal(err)
+		}
+		declared, err := declarationFor(ctx, open, "laptop", plan, settings)
+		if err != nil {
+			t.Fatalf("the send to laptop did not compose: %v", err)
+		}
+		return declared.Resources
+	}
+	placed := func(resources []map[string]any, path string) map[string]any {
+		for _, r := range resources {
+			if r["path"] == path && r["sealed"] != nil {
+				return r
+			}
+		}
+		return nil
+	}
+
+	first := sent()
+	if placed(first, made) == nil {
+		t.Fatal("the secret the mesh makes was not placed")
+	}
+	if got := placed(first, outside); got != nil {
+		t.Errorf("the send placed a value for smb-credentials, which nobody gave: %v", got)
+	}
+	if _, held, err := open.inventory.ModuleSecretIfIssued(ctx, "laptop", "mounts", "smb-credentials"); err != nil || held {
+		t.Fatalf("the send made a value for a secret issued outside the mesh (held %v, %v)", held, err)
+	}
+
+	// A value the mesh made for it before the rule is not one a person gave: it is not placed.
+	if _, err := open.inventory.SecretForModule(ctx, "laptop", "mounts", "smb-credentials"); err != nil {
+		t.Fatal(err)
+	}
+	if got := placed(sent(), outside); got != nil {
+		t.Fatalf("a value the mesh made for a secret issued outside was placed: %v", got)
+	}
+
+	// Given by a person, it is placed, as given.
+	if err := open.inventory.AcceptSecretForModule(ctx, "laptop", "mounts", "smb-credentials", "the share's credentials"); err != nil {
+		t.Fatal(err)
+	}
+	given, held, err := open.inventory.ModuleSecretIfIssued(ctx, "laptop", "mounts", "smb-credentials")
+	if err != nil || !held {
+		t.Fatalf("the value given is not held (%v)", err)
+	}
+	if got := placed(sent(), outside); got == nil || got["sealed"] != given {
+		t.Fatalf("the value given is placed as %v", got)
+	}
+}
diff --git a/testdata/store-tests b/testdata/store-tests
index 0d195b8c..124e9a9a 100644
--- a/testdata/store-tests
+++ b/testdata/store-tests
@@ -31,3 +31,4 @@
 ./cmd/mesh-controller TestADirectoryOwnersKeyIsRefusedThroughAVerb
 ./cmd/mesh-controller TestTheSendMakesNoValueForAnOutsideSecretNobodyGave
 ./cmd/mesh-controller TestAQuestionComposesWithoutAnOutsideSecretNobodyGave
+./cmd/mesh-controller TestReplay401