Register R164: a credential only a person can give was made anyway (hq issue 164)

The replay lives in mesh-controller (TestReplay164) and is proved against the main its fix branched
from until the fix merges: go run ./cmd/prove R164 says it fails before and passes on the fix.

replays/register.go

@@ -549,6 +549,21 @@ var Register = []Replay{
 		Package: "./cmd/mesh-controller", Test: "TestReplay348AFaultFromBeforeTheSendFailsNoGate",
 		Files: []string{"cmd/mesh-controller/replay348_test.go"},
 		Home:  "mesh-controller", HomeRef: "6eea92c323f4862d4162f9d977c8783d8a62efc3"},
+	// A credential only a person can give was made anyway (found provisioning the media machine, re-checked
+	// 2026-10-08): a Servarr app's API key, an indexer's key and a downloader's password are held by the provider's
+	// software, and for each consumer of them the send made a random pair credential, sealed it to both ends and
+	// placed it; the provider refused it, and a consumer retrying it could be banned (ADR 0337: such a credential is
+	// never made). A test of its own in the controller, written with only what it had before the fix — register,
+	// assign, planFor, declarationFor, AcceptSecretForPair, SecretsOf — laid over the commit before. Needs a store:
+	// MESH_TEST_POSTGRES. The fix is still on its branch (mesh-controller fix/164-an-accepted-credential-is-never-minted),
+	// so it is proved against the main it branched from (Before); set Fix to its merge and Before to "" once merged.
+	{ID: "R164", Issue: 164, Kind: InRepository, Repository: "mesh-controller", Fix: "cfe63a4738ae57b0fe82518c50eeb541f990c157",
+		Before: "1826b68a22b5a1a5a1db38fb6e4bfdf923e953cb",
+		What: "the send made a random pair credential for a provision whose credential only a person can give, and " +
+			"placed it: the provider refused it",
+		Asserts: "for a provision whose offer says its credential is issued outside the mesh, the send makes no value " +
+			"and places none, the consumer's machine still composes, and a value a person gave for the pair is placed",
+		Package: "./cmd/mesh-controller", Test: "TestReplay164", Files: []string{"cmd/mesh-controller/replay164_test.go"}},
 	// A README-only merge made a new digest of an unchanged Go program (2026-10-13): a module built from its
 	// repository's root is compiled with the clone's .git in view, and Go stamped the commit into the binary — the
 	// node-engine on the laptop carried vcs.revision=7a41e120… — so a rebuild of an unchanged build source was a new