Serve route-proxy's routes through its own contract: decode each plan entry's opaque contribution with it, say each name served, withdrawn or refused on the bus, and take who is inside from the seat mesh-placement, since the membership went with the assignments stream (issue 774, research 072 rows 33 and 34)

modules/route-proxy/README.md

@@ -9,10 +9,27 @@ The shipping form of the reference reverse proxy (novox/hq ADR 0007, novox/hq 08
 is simply deprecated/invalid"). A module that must be reachable declares `requires: ["route"]` and contributes the
 name it wants and the port it listens on; this module provides `route`. The controller composes each consumer's plan,
 and the seat `mesh-provisioner` keeps it in its state `plans`: the plan's entry for the route names this proxy as
-its provider and carries what the consumer contributes, composed (`given`: its names joined to the node's domains, its
-endpoint's port, its policy), and where the consumer's machine is on the private network (`consumer-at`). The proxy
-follows the plans on the bus and forwards by the `Host` header of each request to `http://<consumer-at>:<port>`, or
-over loopback for a consumer on its own machine.
+its provider and carries what the consumer contributes, composed (its names joined to the node's domains, its
+endpoint's port, its policy), and where the consumer's machine is on the private network, as one opaque payload
+(`contributed`) the seat never reads. The proxy follows the plans on the bus, reads each contribution with its own
+contract (below), and forwards by the `Host` header of each request to `http://<at>:<port>`, or over loopback for a
+consumer on its own machine.
+
+## Its contract: a package of its own
+
+**route-proxy defines its own contract, and other modules use it** (the operator, 2026-10-31). It is the Go module
+`git.novox.be/novox/mesh-controller/modules/route-proxy/contract`, in `contract/` here with its own `go.mod`, standard
+library only, released by tags `modules/route-proxy/contract/vX.Y.Z`, the way mesh-sdk is released (`go/vX.Y.Z`); this
+module depends on it by its version like any other. It holds:
+
+- **the route a consumer asks** (`Request`, read strictly by `DecodeRequest`: no field it does not name, a name of
+  either kind, a port where the rule forwards, http or https, a positive body limit, a secret's file never a
+  credential) and its JSON schema (`route.schema.json`, `Schema`), the form of a manifest's `contributes.route`;
+- **the events this proxy says** on `mesh.mod.route-proxy.event.<type>`: `route.served` and `route.withdrawn` as the
+  names it serves change, `route.refused` with why for a route a plan gives it and it does not serve (`Event`);
+- **what it keeps on the bus**, its states `routes` and `unrouted`, their keys and records (`Route`, `Unrouted`,
+  `Other`, `Key`, `Split`);
+- **its tools' names and arguments** (`ToolRoutes`, `ToolRoute`, `ToolUnrouted`, `RoutesArgs`, `RouteArgs`).
 
 The controller does not write the proxy's configuration. It composes the facts into the plans and the proxy turns them
 into whatever it runs. That boundary is why swapping this proxy for another costs nothing to the modules that publish
@@ -24,12 +41,14 @@ migration scaffolding still listed there.
 |---|---|---|
 | `provides` | `route` (scope `mesh`, answered by the helper) | a module on any node may require it |
 | `serves.route` | `{}` | a route hands back a name, not a credential — the consumer already knows the name it asked for |
-| `reads` | `mesh-provisioner.plans`, `mesh-provisioner.provisions` | the plans are where the routes are; the helper reads both |
+| `reads` | `mesh-provisioner.plans`, `mesh-provisioner.provisions`, `mesh-delivery-assigner.placement` | the plans are where the routes are; the helper reads both; the placement says who is inside |
+| `emits` | `route.served`, `route.withdrawn`, `route.refused` | what it serves, said as it changes (the contract's `Event`) |
 | `listens` | `80` and `443`, both `from: anywhere` | the one machine with a public opening; the firewall opens these for free (ADR 0045) |
 
 Until the bus answers, the proxy routes nothing and says so on its log; it refuses to start without its broker
 credential (`MESH_BROKER_FILE`). Who is inside the private network, and so may be served an internal-only name, is
-still read from its membership (novox/hq ADR 0167).
+every node's address on it as the seat mesh-placement decides it (mesh-sdk `delivery.InsideAddresses`); until that
+is read, an internal-only name is served to this machine alone.
 
 ## Which issuer: Let's Encrypt, stated here (novox/hq ADR 0226)