An edge has two directions, and only one of them is built

0009 already said a consumer supplies a target and receives a name. What
it did not say is that those are two separate mechanisms.

Contribution — publish me at this name, on this port — now exists.
Binding — and hand me back a credential — does not, and is the larger
half: a secret has to exist, be stored, reach one node and not the
others, and rotate with every holder informed. That is the invariant set
found violated three ways at once, so it is not something to add in
passing.

The absence had a measured cost. Exactly two modules opened a direct
connection to the control plane's database, and they are the reason every
node permanently holds a credential to it. Both were doing by hand what
this edge is for. Neither needed a new kind of thing.

03-DESIGN/01-to-be/08-connectivity.md

@@ -99,6 +99,18 @@ back in by the names, which needed addresses only WireGuard hands out — and no
 Running two VPNs is not always wrong; being *the* one the mesh runs over is singular. So it is a
 claim, and the collision is refused by name.
 
+**And the proxy's half, which was the other module reaching into the database.** A web application
+requiring a reverse proxy has to say *which name, which port*, and there was nowhere to put it —
+`requires` says a thing must exist and never said what to do with it. A module now contributes to
+a requirement, the control plane collects every contribution on a node, and the provider is given
+them as a file at a path it named. It reloads when that file changes, by the same `restart-on` the
+private network needed when a peer list changed under a running interface.
+
+**The proxy's configuration is not written by the mesh.** It is given the facts and turns them
+into whatever it runs, which is why swapping Traefik for something else touches nothing that
+publishes through it. See [ADR 0009](../../02-DECISIONS/0009-modules-and-the-graph.md) for the
+other direction — handing a credential *back* — which is the larger half and is not built.
+
 **What is still not a module, and why that is correct.** The host needs none of this. It has an
 address and a route before the mesh exists — that is the machine's own networking — and the
 broker's address is carried in the token rather than resolved