Record what four more pieces of the mesh became

Rotation and the provisioner contract; model access as a provision answered by
a record, with ADR 0024's other two gaps left as gaps; exposure, which closes
the open question about revoking a route; and the delivery loop, which closes
the gap ADR 0010 left when it replaced a pipeline with a comparison.

03-DESIGN/01-to-be/08-connectivity.md

@@ -3,6 +3,7 @@ layer: to-be
 status: designed
 code:
   - mesh-control internal/catalogue/filtering.go
+  - mesh-control examples/route-proxy
   - mesh-control internal/identity/authority.go
   - mesh-host internal/identity/serving.go
   - mesh-host internal/apply (the service that reflects a rule set)
@@ -263,6 +264,38 @@ name rather than supplying nothing and receiving credentials.
 **A workload on an unreachable node is proxied by a reachable one, across the overlay.** Which is
 the case is a mesh-level fact, which is the fourth reason exposure is control-plane work.
 
+### What was built
+
+*2026-08-31.* Nothing new in the vocabulary, which was the claim and is now the fact: a route is a
+provision, a proxy provides it, and a module that must be reachable requires it. The consumer
+contributes the name it wants and the port it listens on; the proxy receives every consumer that
+asked; the consumer is told what the provider serves, which is how it knows its own name.
+
+**One field was missing, and it is the one anything reaching back needs.** A contribution now
+carries **where the mesh says that machine is**. A database is reached *by* its consumer, so the
+mesh never had to tell a provider where anybody was; a proxy is the other direction — it is told
+to send traffic to a consumer and has to open a connection. Without it every provider implementing
+a provision would have to know how the mesh names machines, which is a convention leaking into
+every module.
+
+**Exposure and filtering are different questions and a module answers both.** A workload says what
+it listens on and who may reach it; separately, it says it wants a route. A module that asked for a
+route and not for the port is unreachable by the proxy it just asked for — which the lab
+demonstrates, because the machine is already filtering by the time this runs.
+
+**Withdrawal, which was open above.** The file the proxy is given is the whole truth about who has
+a route, so a proxy replaces its table rather than merging. Merging would keep serving a name whose
+module was unassigned — and *a stale public name pointing at nothing fails more visibly than a
+stale grant* is the reason it must not survive, not a reason to tolerate it.
+
+**A name a proxy does not serve is refused by saying which it does.** A route that was withdrawn
+and a name that never existed are different things, and a bare 404 makes an operator go and read
+the mesh to tell them apart.
+
+*Checked in the lab by a request to the name reaching the workload across the private network and
+returning the workload's own answer, then by unassigning the module and requiring the same request
+to stop working.*
+
 ## 4 — Filtering
 
 **Derived from what is assigned here, and from the overlay's shape** — a node's open ports are a
@@ -428,8 +461,9 @@ The list is worth having in one place, because it is most of the argument:
 - **Renumbering the overlay.** Made *possible* by declaring the hub rather than inferring it from
   an address, but no procedure exists, and a graph delivered node by node has an ordering problem
   while it is half-applied.
-- **Revoking a route** when a module is unassigned ([ADR 0007](../../02-DECISIONS/0007-connectivity.md)).
-  A stale public name pointing at nothing fails more visibly than a stale grant.
+- ~~**Revoking a route** when a module is unassigned.~~ **Resolved** 2026-08-31 — see §3. The file
+  a proxy is given is the whole truth about who has a route, so a route does not outlive the module
+  that asked for it.
 - **IPv6.** [ADR 0007](../../02-DECISIONS/0007-connectivity.md) makes
   it expressible; nothing here says the overlay or the resolver handle it.
 - **Reporting declared-versus-observed.** ADR 0007 makes the disagreement detectable and does not