Serve route-proxy's routes through its own contract: decode each plan entry's opaque contribution with it, say each name served, withdrawn or refused on the bus, and take who is inside from the seat mesh-placement, since the membership went with the assignments stream (issue 774, research 072 rows 33 and 34)

modules/route-proxy/cmd/route-provider/main.go

@@ -14,7 +14,7 @@ import (
 	stdio "git.novox.be/novox/mesh-sdk/go"
 	"git.novox.be/novox/mesh-sdk/go/provider"
 
-	"route-proxy/internal/routestate"
+	"git.novox.be/novox/mesh-controller/modules/route-proxy/contract"
 )
 
 func say(format string, args ...any) {
@@ -36,7 +36,7 @@ func main() {
 			}
 		}()
 	}
-	tools := front{routes: stdio.State(routestate.RoutesState), unrouted: stdio.State(routestate.UnroutedState),
+	tools := front{routes: stdio.State(contract.RoutesState), unrouted: stdio.State(contract.UnroutedState),
 		now: time.Now}.tools()
 	if err := stdio.Serve("", tools); err != nil {
 		say("%v", err)

modules/route-proxy/cmd/route-provider/provider.go

@@ -13,13 +13,13 @@ package main
 import (
 	"git.novox.be/novox/mesh-sdk/go/provider"
 
-	"route-proxy/internal/routestate"
+	"git.novox.be/novox/mesh-controller/modules/route-proxy/contract"
 )
 
 // ProvisionName is what route-proxy provides, as its manifest says, and ModuleName this module.
 const (
-	ProvisionName = routestate.Provision
-	ModuleName    = routestate.Module
+	ProvisionName = contract.Provision
+	ModuleName    = contract.Module
 )
 
 // newProvider is route-proxy answering its consumers over bus on node: the route, served as the manifest serves it

modules/route-proxy/cmd/route-provider/tools.go

@@ -14,14 +14,14 @@ import (
 
 	stdio "git.novox.be/novox/mesh-sdk/go"
 
-	"route-proxy/internal/routestate"
+	"git.novox.be/novox/mesh-controller/modules/route-proxy/contract"
 )
 
 // The tools' names, as the manifest declares them.
 const (
-	RoutesTool   = "route_proxy_routes"
-	RouteTool    = "route_proxy_route"
-	UnroutedTool = "route_proxy_unrouted"
+	RoutesTool   = contract.ToolRoutes
+	RouteTool    = contract.ToolRoute
+	UnroutedTool = contract.ToolUnrouted
 )
 
 // reader is one of the module's states, as stdio.KeptState reads it.
@@ -46,9 +46,9 @@ type RouteLine struct {
 	// unknown before any request.
 	Reachable string `json:"reachable"`
 	// Certificate is its outcome, issuer and expiry in words; ExpiresInDays is the whole days until not-after.
-	Certificate   string             `json:"certificate"`
-	ExpiresInDays *int               `json:"expires_in_days,omitempty"`
-	LastAnswer    *routestate.Answer `json:"last_answer,omitempty"`
+	Certificate   string           `json:"certificate"`
+	ExpiresInDays *int             `json:"expires_in_days,omitempty"`
+	LastAnswer    *contract.Answer `json:"last_answer,omitempty"`
 }
 
 func (f front) tools() []stdio.Tool {
@@ -99,7 +99,7 @@ func read[T any](state reader, node string) ([]T, error) {
 	}
 	var out []T
 	for _, key := range keys {
-		at, _ := routestate.Split(key)
+		at, _ := contract.Split(key)
 		if node != "" && at != node {
 			continue
 		}
@@ -120,7 +120,7 @@ func read[T any](state reader, node string) ([]T, error) {
 }
 
 func (f front) list(node string) (map[string]any, error) {
-	routes, err := read[routestate.Route](f.routes, node)
+	routes, err := read[contract.Route](f.routes, node)
 	if err != nil {
 		return nil, err
 	}
@@ -131,7 +131,7 @@ func (f front) list(node string) (map[string]any, error) {
 		if line.Reachable == "no" {
 			unreachable++
 		}
-		if line.ExpiresInDays != nil && *line.ExpiresInDays < 14 || r.Certificate.Outcome == routestate.Failed {
+		if line.ExpiresInDays != nil && *line.ExpiresInDays < 14 || r.Certificate.Outcome == contract.Failed {
 			expiring++
 		}
 		lines = append(lines, line)
@@ -146,7 +146,7 @@ func (f front) list(node string) (map[string]any, error) {
 		"certificates_failing_or_within_14_days": expiring}, nil
 }
 
-func (f front) line(r routestate.Route) RouteLine {
+func (f front) line(r contract.Route) RouteLine {
 	line := RouteLine{Name: r.Name, Proxy: r.Proxy, Reach: r.Reach, LastAnswer: r.LastAnswer, Reachable: "unknown",
 		Targets: []string{}}
 	for _, t := range r.Targets {
@@ -182,7 +182,7 @@ func (f front) line(r routestate.Route) RouteLine {
 }
 
 // describe is one rule in a few words: path → module@node at target, or what it answers with.
-func describe(t routestate.Target) string {
+func describe(t contract.Target) string {
 	path := t.Path
 	if path == "" {
 		path = "/"
@@ -209,11 +209,11 @@ func (f front) one(name, node string) (map[string]any, error) {
 	if name == "" {
 		return nil, fmt.Errorf("name is the site to read, such as app.example.org")
 	}
-	routes, err := read[routestate.Route](f.routes, node)
+	routes, err := read[contract.Route](f.routes, node)
 	if err != nil {
 		return nil, err
 	}
-	var found []routestate.Route
+	var found []contract.Route
 	for _, r := range routes {
 		if r.Name == name {
 			found = append(found, r)
@@ -248,32 +248,32 @@ func (f front) refusals(node string) (map[string]any, error) {
 	}
 	sort.Slice(asked, func(i, j int) bool { return asked[i].AskedAt.After(asked[j].AskedAt) })
 	if asked == nil {
-		asked = []routestate.Unrouted{}
+		asked = []contract.Unrouted{}
 	}
 	return map[string]any{"unrouted": asked, "names": len(asked), "other_refusals": others}, nil
 }
 
 // asked is the names refused and kept by name, and each proxy's count of the refusals not kept by name.
-func (f front) asked(node string) ([]routestate.Unrouted, []routestate.Other, error) {
+func (f front) asked(node string) ([]contract.Unrouted, []contract.Other, error) {
 	keys, err := f.unrouted.Keys()
 	if err != nil {
 		return nil, nil, err
 	}
 	names, others := keySet{}, keySet{}
 	for _, key := range keys {
-		if _, name := routestate.Split(key); name == routestate.OtherName {
+		if _, name := contract.Split(key); name == contract.OtherName {
 			others[key] = true
 		} else {
 			names[key] = true
 		}
 	}
-	asked, err := read[routestate.Unrouted](only{f.unrouted, names}, node)
+	asked, err := read[contract.Unrouted](only{f.unrouted, names}, node)
 	if err != nil {
 		return nil, nil, err
 	}
-	counted, err := read[routestate.Other](only{f.unrouted, others}, node)
+	counted, err := read[contract.Other](only{f.unrouted, others}, node)
 	if counted == nil {
-		counted = []routestate.Other{}
+		counted = []contract.Other{}
 	}
 	return asked, counted, err
 }

modules/route-proxy/cmd/route-provider/tools_test.go

@@ -9,7 +9,7 @@ import (
 
 	stdio "git.novox.be/novox/mesh-sdk/go"
 
-	"route-proxy/internal/routestate"
+	"git.novox.be/novox/mesh-controller/modules/route-proxy/contract"
 )
 
 // held is a state as the bus holds it, read-only.
@@ -40,19 +40,19 @@ func TestTheWebFrontsToolsAnswerFromTheBus(t *testing.T) {
 	now := time.Date(2026, 10, 30, 21, 0, 0, 0, time.UTC)
 	expires := now.Add(30 * 24 * time.Hour)
 	routes := held{
-		"anchor.grafana.example": routestate.Route{Name: "grafana.example", Proxy: "anchor", Reach: routestate.ReachPublic,
-			Targets:     []routestate.Target{{Module: "grafana", Node: "home-server", Target: "http://10.0.0.2:3000"}},
-			Certificate: routestate.Certificate{Authority: routestate.ReachPublic, Issuer: "Let's Encrypt R11", NotAfter: &expires, Outcome: routestate.Issued},
-			LastAnswer:  &routestate.Answer{Status: 502, At: now, Error: "dial tcp 10.0.0.2:3000: connect: connection refused"}},
-		"anchor.drive.example": routestate.Route{Name: "drive.example", Proxy: "anchor", Reach: routestate.ReachPublic,
-			Targets:     []routestate.Target{{Module: "nextcloud", Node: "home-server", Target: "http://10.0.0.2:8080"}},
-			Certificate: routestate.Certificate{Authority: routestate.ReachPublic},
-			LastAnswer:  &routestate.Answer{Status: 200, At: now}},
+		"anchor.grafana.example": contract.Route{Name: "grafana.example", Proxy: "anchor", Reach: contract.ReachPublic,
+			Targets:     []contract.Target{{Module: "grafana", Node: "home-server", Target: "http://10.0.0.2:3000"}},
+			Certificate: contract.Certificate{Authority: contract.ReachPublic, Issuer: "Let's Encrypt R11", NotAfter: &expires, Outcome: contract.Issued},
+			LastAnswer:  &contract.Answer{Status: 502, At: now, Error: "dial tcp 10.0.0.2:3000: connect: connection refused"}},
+		"anchor.drive.example": contract.Route{Name: "drive.example", Proxy: "anchor", Reach: contract.ReachPublic,
+			Targets:     []contract.Target{{Module: "nextcloud", Node: "home-server", Target: "http://10.0.0.2:8080"}},
+			Certificate: contract.Certificate{Authority: contract.ReachPublic},
+			LastAnswer:  &contract.Answer{Status: 200, At: now}},
 	}
 	unrouted := held{
-		"anchor.old.example":  routestate.Unrouted{Name: "old.example", Proxy: "anchor", AskedAt: now.Add(-time.Hour), Times: 3},
-		"anchor.wiki.example": routestate.Unrouted{Name: "wiki.example", Proxy: "anchor", AskedAt: now, Times: 1},
-		"anchor._other":       routestate.Other{Proxy: "anchor", Minute: now, LastMinute: 40, SinceStart: 900},
+		"anchor.old.example":  contract.Unrouted{Name: "old.example", Proxy: "anchor", AskedAt: now.Add(-time.Hour), Times: 3},
+		"anchor.wiki.example": contract.Unrouted{Name: "wiki.example", Proxy: "anchor", AskedAt: now, Times: 1},
+		"anchor._other":       contract.Other{Proxy: "anchor", Minute: now, LastMinute: 40, SinceStart: 900},
 	}
 	tools := map[string]stdio.Tool{}
 	for _, tool := range (front{routes: routes, unrouted: unrouted, now: func() time.Time { return now }}).tools() {

modules/route-proxy/cmd/route-proxy/bus.go

@@ -3,6 +3,7 @@ package main
 import (
 	"fmt"
 	"log"
+	"sort"
 	"strings"
 	"sync/atomic"
 	"time"
@@ -11,20 +12,21 @@ import (
 
 	stdio "git.novox.be/novox/mesh-sdk/go"
 	"git.novox.be/novox/mesh-sdk/go/announce"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
 	"git.novox.be/novox/mesh-sdk/go/membership"
 	"git.novox.be/novox/mesh-sdk/go/process"
 	"git.novox.be/novox/mesh-sdk/go/provisions"
 
-	"route-proxy/internal/routestate"
+	"git.novox.be/novox/mesh-controller/modules/route-proxy/contract"
 )
 
 // keptStates is every state route-proxy keeps, as both its halves write them: the routes and the refusals this
 // proxy writes, readable by others, and the bound entries the provider helper writes.
 func keptStates() []announce.State {
 	return []announce.State{
-		{Name: routestate.BoundState},
-		{Name: routestate.RoutesState, Readable: true},
-		{Name: routestate.UnroutedState, Readable: true},
+		{Name: contract.BoundState},
+		{Name: contract.RoutesState, Readable: true},
+		{Name: contract.UnroutedState, Readable: true},
 	}
 }
 
@@ -32,12 +34,13 @@ func keptStates() []announce.State {
 //
 // **The routes are the seat mesh-provisioner's plans, alone** (issue 774, research 072 row 34): every plan's entry
 // naming this proxy as a route's provider, followed, so a route added or withdrawn reaches a running proxy without a
-// restart. **Who is inside** is this proxy's membership (novox/hq ADR 0160, ADR 0167): every machine's address on the
-// private network, which is who may be served an internal name; until it is read, an internal name is served to this
-// machine alone.
+// restart, and said on the bus as it changes (contract.EventServed, EventWithdrawn, EventRefused). **Who is inside**
+// is every node's address on the private network as the seat mesh-placement decides it (mesh-sdk
+// delivery.InsideAddresses), which is who may be served an internal name; until it is read, an internal name is
+// served to this machine alone.
 
-// follow connects with the credential in path, follows the plans and the membership, and retries the connection for as
-// long as it takes: until the bus answers, the proxy routes nothing, and says so.
+// follow connects with the credential in path, follows the plans and the placement, and retries the connection for
+// as long as it takes: until the bus answers, the proxy routes nothing, and says so.
 func follow(path string, held *table) {
 	for {
 		err := followOnce(path, held)
@@ -64,39 +67,40 @@ func followOnce(path string, held *table) error {
 	if err := conn.Keeps(keptStates()...); err != nil {
 		log.Printf("cannot say on the bus what this proxy keeps, so it keeps nothing there: %v", err)
 	} else {
-		held.ledger.attach(account.Node, conn.State(routestate.RoutesState), conn.State(routestate.UnroutedState))
+		held.ledger.attach(account.Node, conn.State(contract.RoutesState), conn.State(contract.UnroutedState))
 	}
-	if err := followPlans(conn.Read(provisions.PlansRead), newPlanned(account.Node), held); err != nil {
+	say := func(eventType string, e contract.Event) {
+		if err := conn.Emit(eventType, e); err != nil {
+			log.Printf("cannot say %s of %q on the bus: %v", eventType, e.Name, err)
+		}
+	}
+	// Who is inside first, so the first table is served to the machines it is meant for.
+	if err := followInside(conn.Read(delivery.PlacementRead), held); err != nil {
+		log.Printf("cannot follow %s, so an internal name is served to this machine alone: %v", delivery.PlacementRead, err)
+	}
+	if err := followPlans(conn.Read(provisions.PlansRead), newPlanned(account.Node, say), held, say); err != nil {
 		conn.Close()
 		return err
 	}
-	subject := membership.Subject(account.Node, account.Module)
-	err = conn.FollowMembership(func(issued membership.Membership) {
-		applyMembership(issued, held)
-	}, func(err error) { log.Print(err) })
-	if err != nil {
-		log.Printf("cannot follow this proxy's membership on %s, so an internal name is served to this machine "+
-			"alone: %v", subject, err)
-	}
 	return nil
 }
 
-// planWatch is the seat's plans as this proxy watches them: every current key, then every change.
+// planWatch is a state this proxy watches: every current key, then every change.
 type planWatch interface {
 	Watch(key string, handle func(stdio.StateChange) error) error
 }
 
 // followPlans serves what the plans give this proxy: the whole table once every current plan is read, then again on
 // every change that alters it. A table built from part of the plans would withdraw every route not yet read.
-func followPlans(plans planWatch, given *planned, held *table) error {
+func followPlans(plans planWatch, given *planned, held *table, say func(string, contract.Event)) error {
 	var read atomic.Bool // every current plan is read: from here, each change is served as it comes
 	err := plans.Watch("", func(c stdio.StateChange) error {
 		var value []byte
-		if c.Op != "delete" {
+		if c.Op != "delete" && c.Op != "purge" {
 			value = c.Value
 		}
 		if changed := given.take(c.Key, value); changed && read.Load() {
-			serve(given, held)
+			serve(given, held, say)
 		}
 		return nil
 	})
@@ -104,25 +108,87 @@ func followPlans(plans planWatch, given *planned, held *table) error {
 		return fmt.Errorf("watching %s: %w", provisions.PlansRead, err)
 	}
 	read.Store(true)
-	serve(given, held)
+	serve(given, held, say)
 	return nil
 }
 
-// serve replaces what the proxy serves with what the plans give it.
-func serve(given *planned, held *table) {
+// serve replaces what the proxy serves with what the plans give it, and says each name it now serves or serves no
+// more.
+func serve(given *planned, held *table, say func(string, contract.Event)) {
+	before := held.served()
 	routes, public := routesOf(given.contributions())
 	held.set(routes, public)
+	after := held.served()
+	for _, e := range servedChanges(given.node, before, after) {
+		say(e.kind, e.Event)
+	}
 	log.Printf("serving %d route(s) from the seat's plans: %s", len(routes), strings.Join(held.names(), ", "))
 }
 
-// applyMembership takes who is inside the mesh from a membership, and says whether it could read it.
-func applyMembership(issued membership.Membership, held *table) bool {
-	inside, err := sourcesOf(issued.Mesh)
+// change is one event serve says.
+type change struct {
+	kind string
+	contract.Event
+}
+
+// servedChanges is what changed between two tables' names, each name once, in order: a name now served, or now
+// served at another reach or by another module, is served; a name no longer served is withdrawn.
+func servedChanges(proxy string, before, after map[string]contract.Event) []change {
+	var out []change
+	for _, name := range sortedNames(after) {
+		if was, ok := before[name]; !ok || was != after[name] {
+			e := after[name]
+			e.Proxy = proxy
+			out = append(out, change{contract.EventServed, e})
+		}
+	}
+	for _, name := range sortedNames(before) {
+		if _, ok := after[name]; !ok {
+			out = append(out, change{contract.EventWithdrawn, contract.Event{Proxy: proxy, Name: name}})
+		}
+	}
+	return out
+}
+
+func sortedNames(m map[string]contract.Event) []string {
+	out := make([]string, 0, len(m))
+	for k := range m {
+		out = append(out, k)
+	}
+	sort.Strings(out)
+	return out
+}
+
+// followInside follows the seat mesh-placement's state and serves an internal name to every node's address on the
+// private network it decides, each time it changes (mesh-sdk delivery.InsideAddresses; research 072 rows 33 and 34:
+// the membership that carried them went with the assignments stream). A key that does not read keeps who is inside
+// as it was.
+func followInside(placement planWatch, held *table) error {
+	keys := delivery.NewPlacementKeys()
+	var read atomic.Bool
+	apply := func() {
+		inside, err := sourcesOf(delivery.InsideAddresses(keys.All()))
+		if err != nil {
+			log.Printf("the placement says an address that is not one, so who is inside stays as it was: %v", err)
+			return
+		}
+		held.setInside(inside)
+		log.Printf("internal names are served to %d machine(s)", len(inside))
+	}
+	err := placement.Watch("", func(c stdio.StateChange) error {
+		if _, err := keys.Put(c.Key, c.Value, c.Revision, c.Op == "delete" || c.Op == "purge"); err != nil {
+			log.Printf("the placement's key %s does not read, so who is inside stays as it was: %v", c.Key, err)
+			return nil
+		}
+		if read.Load() {
+			apply()
+		}
+		return nil
+	})
 	if err != nil {
-		log.Printf("the mesh in this proxy's membership is unreadable, keeping who is inside as it was: %v", err)
-		return false
+		return err
 	}
-	held.setInside(inside)
-	log.Printf("internal names are served to %d machine(s)", len(inside))
-	return true
+	read.Store(true)
+	apply()
+	return nil
 }

modules/route-proxy/cmd/route-proxy/ledger.go

@@ -17,7 +17,7 @@ import (
 
 	stdio "git.novox.be/novox/mesh-sdk/go"
 
-	"route-proxy/internal/routestate"
+	"git.novox.be/novox/mesh-controller/modules/route-proxy/contract"
 )
 
 // What this proxy says on the bus about the names it serves and the names it refuses (issue 774).
@@ -55,9 +55,9 @@ type ledger struct {
 	node             string
 	routes, unrouted kvStore
 
-	served   map[string]*routestate.Route
-	previous map[string]routestate.Route // what the bus held for this machine when it was reached
-	asked    map[string]*routestate.Unrouted
+	served   map[string]*contract.Route
+	previous map[string]contract.Route // what the bus held for this machine when it was reached
+	asked    map[string]*contract.Unrouted
 
 	answerWritten map[string]time.Time
 	askedWritten  map[string]time.Time
@@ -69,7 +69,7 @@ type ledger struct {
 	domains                  map[string]bool
 	newMinute                time.Time
 	newInMinute              int
-	other                    routestate.Other
+	other                    contract.Other
 	otherMinute              time.Time
 	otherInMinute            int
 	otherDirty               bool
@@ -81,9 +81,9 @@ type ledger struct {
 func newLedger() *ledger {
 	return &ledger{
 		now:           time.Now,
-		served:        map[string]*routestate.Route{},
-		previous:      map[string]routestate.Route{},
-		asked:         map[string]*routestate.Unrouted{},
+		served:        map[string]*contract.Route{},
+		previous:      map[string]contract.Route{},
+		asked:         map[string]*contract.Unrouted{},
 		answerWritten: map[string]time.Time{},
 		askedWritten:  map[string]time.Time{},
 		dirtyRoutes:   map[string]bool{},
@@ -113,12 +113,12 @@ func (l *ledger) attach(node string, routes, unrouted kvStore) {
 	if l == nil {
 		return
 	}
-	before := map[string]routestate.Route{}
+	before := map[string]contract.Route{}
 	if keys, err := routes.Keys(); err != nil {
 		log.Printf("cannot read back what this proxy said it serves: %v", err)
 	} else {
 		for _, key := range keys {
-			at, name := routestate.Split(key)
+			at, name := contract.Split(key)
 			if at != node {
 				continue
 			}
@@ -126,7 +126,7 @@ func (l *ledger) attach(node string, routes, unrouted kvStore) {
 			if err != nil || entry == nil {
 				continue
 			}
-			var r routestate.Route
+			var r contract.Route
 			if json.Unmarshal(entry.Value, &r) == nil {
 				before[name] = r
 			}
@@ -152,7 +152,7 @@ func (l *ledger) attach(node string, routes, unrouted kvStore) {
 }
 
 // keepWhatWasKnown carries a certificate and a last answer read back from the bus onto a route that knows none yet.
-func keepWhatWasKnown(r *routestate.Route, before routestate.Route) {
+func keepWhatWasKnown(r *contract.Route, before contract.Route) {
 	if r.Certificate.Outcome == "" && r.Certificate.NotAfter == nil && before.Certificate.Authority == r.Certificate.Authority {
 		r.Certificate = before.Certificate
 	}
@@ -170,14 +170,14 @@ func (l *ledger) serving(routes map[string][]rule, public map[string]bool) {
 	l.mu.Lock()
 	defer l.mu.Unlock()
 	for name, rules := range routes {
-		reach := routestate.ReachInternal
+		reach := contract.ReachInternal
 		if public[name] {
-			reach = routestate.ReachPublic
+			reach = contract.ReachPublic
 		}
 		targets := targetsOf(rules)
 		r := l.served[name]
 		if r == nil {
-			r = &routestate.Route{Name: name}
+			r = &contract.Route{Name: name}
 			if before, ok := l.previous[name]; ok {
 				r.Certificate.Authority = reach
 				keepWhatWasKnown(r, before)
@@ -190,7 +190,7 @@ func (l *ledger) serving(routes map[string][]rule, public map[string]bool) {
 			l.dirtyRoutes[name] = true
 		}
 		if r.Certificate.Authority != reach {
-			r.Certificate = routestate.Certificate{Authority: reach}
+			r.Certificate = contract.Certificate{Authority: reach}
 			l.dirtyRoutes[name] = true
 		}
 		if _, was := l.asked[name]; was {
@@ -200,7 +200,7 @@ func (l *ledger) serving(routes map[string][]rule, public map[string]bool) {
 	}
 	l.domains = map[string]bool{}
 	for name := range routes {
-		if d := routestate.Registrable(name); d != "" {
+		if d := contract.Registrable(name); d != "" {
 			l.domains[d] = true
 		}
 	}
@@ -214,10 +214,10 @@ func (l *ledger) serving(routes map[string][]rule, public map[string]bool) {
 	l.wake()
 }
 
-func targetsOf(rules []rule) []routestate.Target {
-	out := make([]routestate.Target, 0, len(rules))
+func targetsOf(rules []rule) []contract.Target {
+	out := make([]contract.Target, 0, len(rules))
 	for _, r := range rules {
-		out = append(out, routestate.Target{Path: r.path, Module: r.from, Node: r.node, Target: r.target,
+		out = append(out, contract.Target{Path: r.path, Module: r.from, Node: r.node, Target: r.target,
 			Deny: r.policy.deny, Redirect: r.policy.redirectTo, Auth: len(r.policy.users) > 0 || r.policy.sealed != "",
 			Sealed: r.policy.sealed})
 	}
@@ -241,7 +241,7 @@ func (l *ledger) answered(name, path string, status int, failed error) {
 		why = failed.Error()
 	}
 	before := r.LastAnswer
-	r.LastAnswer = &routestate.Answer{Status: status, At: now, Error: why, Path: path}
+	r.LastAnswer = &contract.Answer{Status: status, At: now, Error: why, Path: path}
 	if before != nil && before.Status == status && before.Error == why && now.Sub(l.answerWritten[name]) < refreshAfter {
 		return
 	}
@@ -268,11 +268,11 @@ func (l *ledger) refused(name string, internalOnly, handshake bool) {
 	now := l.now()
 	a := l.asked[name]
 	if a == nil {
-		if !routestate.Keyable(name) || !l.domains[routestate.Registrable(name)] || !l.mayAddName(now) {
+		if !contract.Keyable(name) || !l.domains[contract.Registrable(name)] || !l.mayAddName(now) {
 			l.countOther(now)
 			return
 		}
-		a = &routestate.Unrouted{Name: name}
+		a = &contract.Unrouted{Name: name}
 		l.asked[name] = a
 	}
 	a.AskedAt, a.InternalOnly, a.Handshake = now, internalOnly, handshake
@@ -345,7 +345,7 @@ func (l *ledger) certified(name string, leaf *x509.Certificate) {
 	notAfter := leaf.NotAfter.UTC()
 	r.Certificate.Issuer, r.Certificate.NotAfter = issuerOf(leaf), &notAfter
 	r.Certificate.RenewedAt, r.Certificate.At = &now, &now
-	r.Certificate.Outcome, r.Certificate.Error = routestate.Issued, ""
+	r.Certificate.Outcome, r.Certificate.Error = contract.Issued, ""
 	l.dirtyRoutes[name] = true
 	l.wake()
 }
@@ -362,13 +362,13 @@ func (l *ledger) handedOut(name string, leaf *x509.Certificate) {
 		return
 	}
 	notAfter := leaf.NotAfter.UTC()
-	if r.Certificate.NotAfter != nil && r.Certificate.NotAfter.Equal(notAfter) && r.Certificate.Outcome != routestate.Failed {
+	if r.Certificate.NotAfter != nil && r.Certificate.NotAfter.Equal(notAfter) && r.Certificate.Outcome != contract.Failed {
 		return
 	}
 	now := l.now()
 	r.Certificate.Issuer, r.Certificate.NotAfter, r.Certificate.At = issuerOf(leaf), &notAfter, &now
-	if r.Certificate.Outcome != routestate.Issued || r.Certificate.Error != "" {
-		r.Certificate.Outcome, r.Certificate.Error = routestate.Cached, ""
+	if r.Certificate.Outcome != contract.Issued || r.Certificate.Error != "" {
+		r.Certificate.Outcome, r.Certificate.Error = contract.Cached, ""
 	}
 	l.dirtyRoutes[name] = true
 	l.wake()
@@ -386,11 +386,11 @@ func (l *ledger) certificateFailed(name string, failed error) {
 		return
 	}
 	now := l.now()
-	same := r.Certificate.Outcome == routestate.Failed && r.Certificate.Error == failed.Error()
+	same := r.Certificate.Outcome == contract.Failed && r.Certificate.Error == failed.Error()
 	if same && r.Certificate.At != nil && now.Sub(*r.Certificate.At) < refreshAfter {
 		return
 	}
-	r.Certificate.Outcome, r.Certificate.Error, r.Certificate.At = routestate.Failed, failed.Error(), &now
+	r.Certificate.Outcome, r.Certificate.Error, r.Certificate.At = contract.Failed, failed.Error(), &now
 	l.dirtyRoutes[name] = true
 	l.wake()
 }
@@ -423,7 +423,7 @@ func (l *ledger) flush() {
 	l.forgetOldestAsked()
 	var puts []put
 	for name := range l.dirtyRoutes {
-		p := put{store: l.routes, key: routestate.Key(l.node, name), route: true}
+		p := put{store: l.routes, key: contract.Key(l.node, name), route: true}
 		if r := l.served[name]; r != nil {
 			c := *r
 			c.Proxy = l.node
@@ -432,7 +432,7 @@ func (l *ledger) flush() {
 		puts = append(puts, p)
 	}
 	for name := range l.dirtyAsked {
-		p := put{store: l.unrouted, key: routestate.Key(l.node, name)}
+		p := put{store: l.unrouted, key: contract.Key(l.node, name)}
 		if a := l.asked[name]; a != nil {
 			c := *a
 			c.Proxy = l.node
@@ -443,7 +443,7 @@ func (l *ledger) flush() {
 	if l.otherDirty {
 		o := l.other
 		o.Proxy = l.node
-		puts = append(puts, put{store: l.unrouted, key: routestate.Key(l.node, routestate.OtherName), value: o})
+		puts = append(puts, put{store: l.unrouted, key: contract.Key(l.node, contract.OtherName), value: o})
 	}
 	l.dirtyRoutes, l.dirtyAsked, l.otherDirty = map[string]bool{}, map[string]bool{}, false
 	l.mu.Unlock()
@@ -466,7 +466,7 @@ func (l *ledger) flush() {
 				log.Printf("cannot write %s to the bus, kept for the next change: %v", p.key, err)
 			}
 			l.routesFailing = true
-			_, name := routestate.Split(p.key)
+			_, name := contract.Split(p.key)
 			l.dirtyRoutes[name] = true
 		default:
 			if !l.askFailed {

modules/route-proxy/cmd/route-proxy/ledger_test.go

@@ -25,7 +25,7 @@ import (
 
 	stdio "git.novox.be/novox/mesh-sdk/go"
 
-	"route-proxy/internal/routestate"
+	"git.novox.be/novox/mesh-controller/modules/route-proxy/contract"
 )
 
 // fakeState is a state on the bus, in memory, counting what was written to it.
@@ -68,13 +68,13 @@ func (f *fakeState) Get(key string) (*stdio.StateEntry, error) {
 	return &stdio.StateEntry{Key: key, Value: v}, nil
 }
 
-func (f *fakeState) route(t *testing.T, key string) *routestate.Route {
+func (f *fakeState) route(t *testing.T, key string) *contract.Route {
 	t.Helper()
 	raw, ok := f.values[key]
 	if !ok {
 		return nil
 	}
-	var r routestate.Route
+	var r contract.Route
 	if err := json.Unmarshal(raw, &r); err != nil {
 		t.Fatal(err)
 	}
@@ -117,8 +117,8 @@ func TestTheBusIsToldWhatIsServedAndRefused(t *testing.T) {
 	}()
 	_, port, _ := net.SplitHostPort(gone)
 	contributions := []contribution{
-		{From: "grafana", Node: "anchor", At: "127.0.0.1", Values: map[string]any{"name": "grafana.example", "port": mustFloat(t, port)}},
-		{From: "drive", Node: "home-server", At: "10.0.0.2", Values: map[string]any{"internal-name": "drive.internal", "port": 8080.0}},
+		{From: "grafana", Node: "anchor", At: "127.0.0.1", Route: contract.Request{Name: "grafana.example", Port: int(mustFloat(t, port))}},
+		{From: "drive", Node: "home-server", At: "10.0.0.2", Route: contract.Request{InternalName: "drive.internal", Port: 8080}},
 	}
 
 	for _, row := range []struct {
@@ -130,12 +130,12 @@ func TestTheBusIsToldWhatIsServedAndRefused(t *testing.T) {
 			func(t *testing.T, held *table) {},
 			func(t *testing.T, routes, _ *fakeState) {
 				r := routes.route(t, "anchor.grafana.example")
-				if r == nil || r.Proxy != "anchor" || r.Reach != routestate.ReachPublic || len(r.Targets) != 1 ||
+				if r == nil || r.Proxy != "anchor" || r.Reach != contract.ReachPublic || len(r.Targets) != 1 ||
 					r.Targets[0].Module != "grafana" || r.Targets[0].Node != "anchor" || r.Targets[0].Target != "http://127.0.0.1:"+port {
 					t.Fatalf("grafana's route is not on the bus as served: %+v", r)
 				}
-				if d := routes.route(t, "anchor.drive.internal"); d == nil || d.Reach != routestate.ReachInternal ||
-					d.Certificate.Authority != routestate.ReachInternal {
+				if d := routes.route(t, "anchor.drive.internal"); d == nil || d.Reach != contract.ReachInternal ||
+					d.Certificate.Authority != contract.ReachInternal {
 					t.Fatalf("an internal-only name is not on the bus as internal: %+v", d)
 				}
 			}},
@@ -172,7 +172,7 @@ func TestTheBusIsToldWhatIsServedAndRefused(t *testing.T) {
 				req.RemoteAddr = "192.0.2.7:51000"
 				handler(held).ServeHTTP(httptest.NewRecorder(), req)
 				held.ledger.flush()
-				var a routestate.Unrouted
+				var a contract.Unrouted
 				raw := held.ledger.unrouted.(*fakeState).values["anchor.wiki.grafana.example"]
 				if err := json.Unmarshal(raw, &a); err != nil || a.Times != 1 || a.AskedAt.IsZero() {
 					t.Fatalf("the refused name is not on the bus as asked: %s", raw)
@@ -181,7 +181,7 @@ func TestTheBusIsToldWhatIsServedAndRefused(t *testing.T) {
 					t.Fatalf("who asked is on the bus: %s", raw)
 				}
 				routes, public := routesOf(append(contributions, contribution{From: "grafana", Node: "anchor",
-					Values: map[string]any{"name": "wiki.grafana.example", "port": 3000.0}}))
+					Route: contract.Request{Name: "wiki.grafana.example", Port: 3000}}))
 				held.set(routes, public)
 			},
 			func(t *testing.T, _, unrouted *fakeState) {
@@ -197,7 +197,7 @@ func TestTheBusIsToldWhatIsServedAndRefused(t *testing.T) {
 				_, _ = pick(&tls.ClientHelloInfo{ServerName: "forgotten.grafana.example"})
 			},
 			func(t *testing.T, _, unrouted *fakeState) {
-				var a routestate.Unrouted
+				var a contract.Unrouted
 				if err := json.Unmarshal(unrouted.values["anchor.forgotten.grafana.example"], &a); err != nil || !a.Handshake {
 					t.Fatalf("a handshake refused for its name is not on the bus: %v", unrouted.values)
 				}
@@ -232,7 +232,7 @@ func TestTheBusIsToldWhatIsServedAndRefused(t *testing.T) {
 				held.ledger.refused("w.scan.test", false, false)
 			},
 			func(t *testing.T, _, unrouted *fakeState) {
-				var o routestate.Other
+				var o contract.Other
 				if err := json.Unmarshal(unrouted.values["anchor._other"], &o); err != nil || o.LastMinute != 2 || o.SinceStart != 78 {
 					t.Fatalf("the refusals not kept by name are not counted on the bus: %s", unrouted.values["anchor._other"])
 				}
@@ -247,7 +247,7 @@ func TestTheBusIsToldWhatIsServedAndRefused(t *testing.T) {
 			},
 			func(t *testing.T, routes, _ *fakeState) {
 				c := routes.route(t, "anchor.grafana.example").Certificate
-				if c.Outcome != routestate.Issued || c.Issuer != "Let's Encrypt R11" || c.NotAfter == nil ||
+				if c.Outcome != contract.Issued || c.Issuer != "Let's Encrypt R11" || c.NotAfter == nil ||
 					!c.NotAfter.Equal(notAfter) || c.RenewedAt == nil {
 					t.Fatalf("the issued certificate is not on the bus: %+v", c)
 				}
@@ -261,7 +261,7 @@ func TestTheBusIsToldWhatIsServedAndRefused(t *testing.T) {
 			},
 			func(t *testing.T, routes, _ *fakeState) {
 				c := routes.route(t, "anchor.grafana.example").Certificate
-				if c.Outcome != routestate.Failed || c.Error != "acme: urn:ietf:params:acme:error:rateLimited" {
+				if c.Outcome != contract.Failed || c.Error != "acme: urn:ietf:params:acme:error:rateLimited" {
 					t.Fatalf("the failed certificate is not on the bus: %+v", c)
 				}
 			}},

modules/route-proxy/cmd/route-proxy/main.go

@@ -64,6 +64,8 @@ import (
 	"golang.org/x/crypto/acme"
 	"golang.org/x/crypto/acme/autocert"
 	"golang.org/x/crypto/bcrypt"
+
+	"git.novox.be/novox/mesh-controller/modules/route-proxy/contract"
 )
 
 // Where public certificates come from when nothing says otherwise.
@@ -116,15 +118,16 @@ func onlyInternalNamesTheMeshSaid(held *table) autocert.HostPolicy {
 	}
 }
 
-// contribution is one route a consumer asked for: the module, its machine, where that machine is, and what it
-// contributes, composed by the mesh (its plan's entry for the route, plans.go).
+// contribution is one route a consumer asked for: the module, its machine, where that machine is, the local name of
+// its contribution, and the route, composed by the mesh and read with route-proxy's contract (plans.go).
 type contribution struct {
 	From string `json:"from"`
 	Node string `json:"node"`
 	// At is where that machine is on the private network. The mesh knows it; a proxy that had to
 	// build it from the node name would be a naming convention copied into every provider.
-	At     string         `json:"at"`
-	Values map[string]any `json:"values"`
+	At    string           `json:"at"`
+	Local string           `json:"local,omitempty"`
+	Route contract.Request `json:"route"`
 }
 
 // policy is what a rule does with a request that matched it.
@@ -407,6 +410,24 @@ func (t *table) namesSeenFrom(remote string) []string {
 	return out
 }
 
+// served is every name served, as an event says it: how far it reaches and the module whose rule serves it first.
+func (t *table) served() map[string]contract.Event {
+	t.mu.RLock()
+	defer t.mu.RUnlock()
+	out := make(map[string]contract.Event, len(t.to))
+	for name, rules := range t.to {
+		e := contract.Event{Name: name, Reach: contract.ReachInternal}
+		if t.public[name] {
+			e.Reach = contract.ReachPublic
+		}
+		if len(rules) > 0 {
+			e.Module, e.Node = rules[0].from, rules[0].node
+		}
+		out[name] = e
+	}
+	return out
+}
+
 func (t *table) names() []string {
 	t.mu.RLock()
 	defer t.mu.RUnlock()
@@ -857,38 +878,15 @@ func routesOf(contributions []contribution) (map[string][]rule, map[string]bool)
 	out := map[string][]rule{}
 	public := map[string]bool{}
 	for _, c := range contributions {
-		name, _ := c.Values["name"].(string)
-		name = strings.TrimSpace(name)
-		internal, _ := c.Values["internal-name"].(string)
-		internal = strings.TrimSpace(internal)
-		if name == "" && internal == "" {
-			log.Printf("%s on %s asked for a route and named nothing; skipped", c.From, c.Node)
-			continue
-		}
-		// What the route is called in a log line: its public name when it has one.
-		called := name
-		if called == "" {
-			called = internal
-		}
-
-		made := rule{path: asPath(c.Values["path"])}
-		if p, ok := asWhole(c.Values["priority"]); ok {
-			made.priority = p
-		}
-		made.policy.deny, _ = c.Values["deny"].(bool)
-		made.policy.redirectTo, _ = c.Values["redirect"].(string)
-
-		if named, carried := c.Values["auth"].(string); carried && strings.TrimSpace(named) != "" {
-			// **A declaration names a secret; it never holds one** (ADR 0108). Refused rather than
-			// tolerated, and the whole rule is dropped rather than served unprotected — the
-			// rejected option cannot come back by accident, which is the failure this check exists
-			// to make impossible.
-			if looksLikeACredential(named) {
-				log.Printf("%s on %s declared route %q with a credential in the declaration rather "+
-					"than the name of a secret; the whole route is refused (novox/hq ADR 0108)",
-					c.From, c.Node, called)
-				continue
-			}
+		// The contract admitted the route whole (contract.Request.Validate): it names a host, a rule that forwards
+		// gives a port, its scheme is http or https, its body limit is whole and positive, and its auth names a
+		// secret's file rather than holding a credential (novox/hq ADR 0108).
+		r := c.Route
+		name := strings.TrimSpace(r.Name)
+		internal := strings.TrimSpace(r.InternalName)
+		made := rule{path: r.Prefix(), priority: r.Priority}
+		made.policy.deny, made.policy.redirectTo = r.Deny, r.Redirect
+		if named := strings.TrimSpace(r.Auth); named != "" {
 			users, err := usersFrom(named)
 			if err != nil {
 				// Fail closed: the rule is kept so the name stays routed and answers, and it
@@ -900,13 +898,7 @@ func routesOf(contributions []contribution) (map[string][]rule, map[string]bool)
 		}
 
 		// Only a rule that actually proxies needs somewhere to send the request.
-		if !made.policy.deny && made.policy.redirectTo == "" {
-			port, ok := asPort(c.Values["port"])
-			if !ok {
-				log.Printf("%s on %s asked for route %q and gave no usable port; skipped",
-					c.From, c.Node, called)
-				continue
-			}
+		if r.Forwards() {
 			// Where the mesh says that machine is. Empty means it is this one — a workload beside
 			// the proxy is ordinary, and reaching it over loopback is both correct and the only
 			// thing that works when there is no private network.
@@ -916,32 +908,12 @@ func routesOf(contributions []contribution) (map[string][]rule, map[string]bool)
 			}
 			// http unless the contribution says otherwise. A backend that terminates its own TLS
 			// with a certificate this proxy has no reason to trust — Mailu's webmail front is the
-			// first of these — is the reason `insecure` exists, and it stays the exception: every
-			// other target the mesh hands this proxy is a plain workload on the private network.
-			scheme, _ := c.Values["scheme"].(string)
-			scheme = strings.ToLower(strings.TrimSpace(scheme))
-			if scheme == "" {
-				scheme = "http"
+			// first of these — is the reason `insecure` exists, and it stays the exception.
+			made.insecure = r.Insecure
+			if r.MaxRequestBody != nil {
+				made.maxRequestBody = *r.MaxRequestBody
 			}
-			if scheme != "http" && scheme != "https" {
-				log.Printf("%s on %s asked for route %q with scheme %q, which is neither http "+
-					"nor https; skipped", c.From, c.Node, called, scheme)
-				continue
-			}
-			made.insecure, _ = c.Values["insecure"].(bool)
-			// A limit this proxy cannot read is a route it does not serve, named like a port that
-			// is not a port. Serving it without the limit would carry exactly what the module said
-			// not to carry, and report success doing it.
-			if asked, said := c.Values["max-request-body"]; said {
-				bytes, whole := asWhole(asked)
-				if !whole || bytes <= 0 {
-					log.Printf("%s on %s asked for route %q with a max-request-body of %v, which is "+
-						"not a whole positive number of bytes; skipped", c.From, c.Node, called, asked)
-					continue
-				}
-				made.maxRequestBody = int64(bytes)
-			}
-			made.target = fmt.Sprintf("%s://%s:%d", scheme, at, port)
+			made.target = fmt.Sprintf("%s://%s:%d", r.SchemeOrDefault(), at, r.Port)
 		}
 		made.from, made.node = c.From, c.Node
 
@@ -955,9 +927,8 @@ func routesOf(contributions []contribution) (map[string][]rule, map[string]bool)
 		// answered both for one route, as a convenience (reaching a service over the VPN without a
 		// public TLS round trip), not as an access boundary; composing it here restores exactly
 		// that, nothing more. Absent whenever the node composed no internal name (novox/hq ADR
-		// 0056's internalDomain half) — the same "nothing to join a label to" case the public name
-		// already has. And the only name, when the endpoint reaches no further than the private
-		// network.
+		// 0056's internalDomain half). And the only name, when the endpoint reaches no further than
+		// the private network.
 		if internal != "" {
 			out[strings.ToLower(internal)] = append(out[strings.ToLower(internal)], made)
 		}
@@ -965,50 +936,6 @@ func routesOf(contributions []contribution) (map[string][]rule, map[string]bool)
 	return out, public
 }
 
-// asWhole is any whole number the mesh wrote, whatever its magnitude.
-//
-// **Not asPort.** Priority was read with the port reader first, which caps at 65535 — so a rule
-// declared at a priority above that silently became priority 0 and stopped shadowing the route it
-// exists to shadow. The one real rule this has to reproduce is declared at 100000, so the bug was
-// exactly load-bearing. A priority is an ordering, not a port: it has no range.
-func asWhole(v any) (int, bool) {
-	switch n := v.(type) {
-	case float64:
-		// JSON makes a float of every number, so a non-integral one was not meant as a priority.
-		if n != float64(int(n)) {
-			return 0, false
-		}
-		return int(n), true
-	case int:
-		return n, true
-	}
-	return 0, false
-}
-
-// asPath is the path prefix a rule is scoped to, or "" for every path.
-func asPath(v any) string {
-	p, _ := v.(string)
-	p = strings.TrimSpace(p)
-	if p == "" {
-		return ""
-	}
-	if !strings.HasPrefix(p, "/") {
-		p = "/" + p
-	}
-	return p
-}
-
-// looksLikeACredential is the check that keeps a secret out of a declaration.
-//
-// It errs towards refusing: a value holding a `:` (the htpasswd separator) or opening with a bcrypt
-// identifier is a credential, not a path, and no filesystem path the mesh writes needs either. A
-// false refusal is a loud log and a route that does not serve; a false accept is a credential
-// committed to a declaration, which is the thing being prevented.
-func looksLikeACredential(v string) bool {
-	v = strings.TrimSpace(v)
-	return strings.Contains(v, ":") || strings.HasPrefix(v, "$2")
-}
-
 // usersFrom reads the credentials the mesh mounted, in the one format every htpasswd already is.
 func usersFrom(path string) (map[string]string, error) {
 	raw, err := os.ReadFile(path)
@@ -1033,23 +960,6 @@ func usersFrom(path string) (map[string]string, error) {
 	return users, nil
 }
 
-// asPort accepts what JSON makes of a number, which is a float even when it was written 8080.
-func asPort(v any) (int, bool) {
-	switch n := v.(type) {
-	case float64:
-		if n < 1 || n > 65535 {
-			return 0, false
-		}
-		return int(n), true
-	case int:
-		if n < 1 || n > 65535 {
-			return 0, false
-		}
-		return n, true
-	}
-	return 0, false
-}
-
 // towards proxies to one backend and tells it what the client asked: **X-Forwarded-Proto, -Host and
 // -For**, set from the request this proxy received. A backend that builds its own addresses — a forge
 // writing its clone URL into a page, a login redirect — otherwise sees the plain HTTP hop from this

modules/route-proxy/cmd/route-proxy/plans.go

@@ -3,12 +3,13 @@ package main
 // The routes this proxy serves, read from the seat mesh-provisioner's plans and nothing else (issue 774; research 072
 // row 34, the operator on 2026-10-31: "there is only 1 path, the other is simply deprecated/invalid").
 //
-// **A route is a provision.** A module that must be reachable requires `route`; the controller composes its plan on
-// its node, and the plan's entry for the route names this proxy as its provider and carries what the module
-// contributes, composed as the received file used to carry it (its names joined to the node's domains, its endpoint's
-// port, its policy), and where the module's machine is on the private network. The proxy follows the plans on the bus
+// **A route is a provision, in route-proxy's own contract.** A module that must be reachable requires `route`; the
+// controller composes its plan on its node, and the plan's entry for the route names this proxy as its provider and
+// carries what the module contributes, composed (its names joined to the node's domains, its endpoint's port), and
+// where the module's machine is on the private network, as one opaque payload the seat never reads (mesh-sdk
+// catalogue.PlanProvision.Contributed). The proxy decodes each contribution with its contract (contract.DecodeRequest)
 // and serves every entry naming it. There is no file and no second source: a route the plans do not name is not
-// served.
+// served, and a route the contract refuses is said refused (contract.EventRefused), never served half.
 
 import (
 	"fmt"
@@ -19,23 +20,28 @@ import (
 	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/provisions"
 
-	"route-proxy/internal/routestate"
+	"git.novox.be/novox/mesh-controller/modules/route-proxy/contract"
 )
 
 // planned is the routes the seat's plans give this proxy on its node, by plan key, kept so a plan that cannot be read
 // leaves what it gave served (a bind missed would read as a route withdrawn).
 type planned struct {
 	node string
+	// said is where a refusal is told: the bus's events, nothing in a test that does not ask.
+	said func(eventType string, e contract.Event)
 	mu   sync.Mutex
 	by   map[string][]contribution
 }
 
-func newPlanned(node string) *planned {
-	return &planned{node: node, by: map[string][]contribution{}}
+func newPlanned(node string, said func(string, contract.Event)) *planned {
+	if said == nil {
+		said = func(string, contract.Event) {}
+	}
+	return &planned{node: node, said: said, by: map[string][]contribution{}}
 }
 
 // take is one change of a plan's key: its value, or nil when the key was deleted. It answers whether what is served
-// changed, and says on the log what it could not serve.
+// changed, and says on the log and the bus what it could not serve.
 func (p *planned) take(key string, value []byte) bool {
 	p.mu.Lock()
 	defer p.mu.Unlock()
@@ -44,13 +50,14 @@ func (p *planned) take(key string, value []byte) bool {
 		delete(p.by, key)
 		return had
 	}
-	gave, problems, err := routesOfPlan(p.node, key, value)
+	gave, refused, err := routesOfPlan(p.node, key, value)
 	if err != nil {
 		log.Printf("the plan %s is not readable, so what it routes is kept as it was: %v", key, err)
 		return false
 	}
-	for _, problem := range problems {
-		log.Print(problem)
+	for _, r := range refused {
+		log.Printf("the plan %s gives %s on %s a route this proxy does not serve: %s", key, r.Module, r.Node, r.Why)
+		p.said(contract.EventRefused, r)
 	}
 	if len(gave) == 0 {
 		_, had := p.by[key]
@@ -77,12 +84,12 @@ func (p *planned) contributions() []contribution {
 	return out
 }
 
-// routesOfPlan is the routes one plan gives the proxy on node: each contribution of each entry naming this proxy on
-// node as the route's provider, reached on its own machine over loopback and on another at the address the plan says.
-// A plan of another module, or one routing elsewhere, gives none. Problems are what the plan names and the proxy
-// cannot serve, said rather than skipped silently: an entry carrying nothing to serve (a controller before the plans
-// carried it), or a consumer elsewhere with no address on the private network.
-func routesOfPlan(node, key string, value []byte) ([]contribution, []string, error) {
+// routesOfPlan is the routes one plan gives the proxy on node: each contribution the plan's entries naming this proxy
+// on node as the route's provider carry, decoded with the contract, reached on its own machine over loopback and on
+// another at the address the plan says. A plan of another module, or one routing elsewhere, gives none. Refused is
+// what the plan names and the proxy does not serve, each with why: an entry carrying nothing to serve, a payload or a
+// route the contract does not read, or a consumer elsewhere with no address on the private network.
+func routesOfPlan(node, key string, value []byte) ([]contribution, []contract.Event, error) {
 	plan, err := provisions.DecodePlan(value)
 	if err != nil {
 		return nil, nil, err
@@ -91,33 +98,50 @@ func routesOfPlan(node, key string, value []byte) ([]contribution, []string, err
 		return nil, nil, fmt.Errorf("it is the plan of %s.%s, under the key %s", plan.Node, plan.Module, key)
 	}
 	var out []contribution
-	var problems []string
+	var refused []contract.Event
+	refuse := func(local, why string) {
+		refused = append(refused, contract.Event{Proxy: node, Module: plan.Module, Node: plan.Node, Local: local, Why: why})
+	}
+	named, carried := false, false
 	for _, e := range plan.Plan.Provisions {
 		if !routesHere(node, e) {
 			continue
 		}
-		if len(e.Given) == 0 {
-			problems = append(problems, fmt.Sprintf("the plan %s names this proxy for its route and gives nothing "+
-				"to serve; it is not served", key))
+		named = true
+		// What the module contributes is on the requirement's first entry alone, however many local names it has.
+		if len(e.Contributed) == 0 {
+			continue
+		}
+		carried = true
+		given, err := catalogue.DecodeContributed(e.Contributed)
+		if err != nil {
+			refuse("", err.Error())
 			continue
 		}
 		at := ""
 		if plan.Node != node {
-			if e.ConsumerAt == "" {
-				problems = append(problems, fmt.Sprintf("the plan %s routes %s on %s here and says no address on "+
-					"the private network for it; it is not served", key, plan.Module, plan.Node))
+			if given.At == "" {
+				refuse("", fmt.Sprintf("it runs on %s and its plan says no address on the private network for it", plan.Node))
 				continue
 			}
-			at = e.ConsumerAt
+			at = given.At
 		}
-		for _, g := range e.Given {
-			out = append(out, contribution{From: plan.Module, Node: plan.Node, At: at, Values: g.Values})
+		for _, one := range given.Each {
+			route, err := contract.DecodeRequest(one.Values)
+			if err != nil {
+				refuse(one.Local, err.Error())
+				continue
+			}
+			out = append(out, contribution{From: plan.Module, Node: plan.Node, At: at, Local: one.Local, Route: route})
 		}
 	}
-	return out, problems, nil
+	if named && !carried {
+		refuse("", "its plan names this proxy for its route and carries nothing to serve")
+	}
+	return out, refused, nil
 }
 
 // routesHere is whether a plan's entry is a route this proxy on node provides.
 func routesHere(node string, e catalogue.PlanProvision) bool {
-	return e.Provision == routestate.Provision && e.Provider == node && e.ProviderModule == routestate.Module
+	return e.Provision == contract.Provision && e.Provider == node && e.ProviderModule == contract.Module
 }

modules/route-proxy/cmd/route-proxy/reach_test.go

@@ -10,11 +10,15 @@ import (
 	"net/http/httptest"
 	"net/url"
 	"reflect"
+	"slices"
+	"sort"
 	"strings"
 	"testing"
 
 	stdio "git.novox.be/novox/mesh-sdk/go"
-	"git.novox.be/novox/mesh-sdk/go/membership"
+	"git.novox.be/novox/mesh-sdk/go/delivery"
+
+	"git.novox.be/novox/mesh-controller/modules/route-proxy/contract"
 )
 
 // behind is a workload the proxy can send to, and a table routing one public name and one
@@ -189,28 +193,42 @@ func plan(node, module, entries string) string {
 		`"provisions":[%s]}}`, node, module, entries)
 }
 
+// contributed is a plan entry's opaque payload: the consumer's machine at at, and each contribution by local name.
+func contributed(at string, each ...string) string {
+	var parts []string
+	for i := 0; i+1 < len(each); i += 2 {
+		parts = append(parts, fmt.Sprintf(`{"local":%q,"values":%s}`, each[i], each[i+1]))
+	}
+	return fmt.Sprintf(`"contributed":{"v":1,"at":%q,"each":[%s]}`, at, strings.Join(parts, ","))
+}
+
 // What the plans give is what is served, and nothing else (issue 774, research 072 row 34): each entry naming this
-// proxy on its node as the route's provider, every contribution of it, reached over loopback on this machine and at
-// the plan's address on another; an entry routing elsewhere, giving nothing or naming no address is not served. A
-// change is served as it comes, a plan that cannot be read keeps what it gave, and a deleted one withdraws it. The
-// membership says only who is inside: an internal-only name is served to the machines it names.
-func TestThePlansAreServedAndTheMembershipSaysWhoIsInside(t *testing.T) {
-	const gitea = `{"provision":"route","provider":"anchor","provider-module":"route-proxy","consumer-at":"10.10.0.7",` +
-		`"given":[{"local":"web","values":{"name":"git.example","internal-name":"git.anchor.internal","port":3000}},` +
-		`{"local":"api","values":{"internal-name":"git-api.anchor.internal","port":3001}}]}`
+// proxy on its node as the route's provider, every contribution of it read with route-proxy's contract, reached over
+// loopback on this machine and at the plan's address on another; an entry routing elsewhere, carrying nothing, naming
+// no address or a route the contract refuses is not served, and is said refused. A change is served as it comes and
+// said served or withdrawn, a plan that cannot be read keeps what it gave, and a deleted one withdraws it. The
+// placement says only who is inside: an internal-only name is served to the machines it decides addresses for.
+func TestThePlansAreServedAndThePlacementSaysWhoIsInside(t *testing.T) {
+	const route = `{"provision":"route","provider":"anchor","provider-module":"route-proxy",`
+	gitea := route + contributed("10.10.0.7",
+		"web", `{"name":"git.example","internal-name":"git.anchor.internal","port":3000}`,
+		"api", `{"internal-name":"git-api.anchor.internal","port":3001}`,
+		"refused", `{"name":"bad.example","port":3002,"host":"x"}`) + `}`
 	plans := &fakePlans{current: map[string]string{
 		"laptop.gitea": plan("laptop", "gitea", gitea+`,{"provision":"postgres-database","provider":"anchor",`+
-			`"provider-module":"postgres","given":[{"values":{"name":"gitea"}}]}`),
-		"anchor.blog": plan("anchor", "blog", `{"provision":"route","provider":"anchor","provider-module":"route-proxy",`+
-			`"consumer-at":"10.10.0.1","given":[{"values":{"name":"blog.example","port":2368}}]}`),
+			`"provider-module":"postgres",`+contributed("10.10.0.7", "", `{"name":"gitea"}`)+`}`),
+		"anchor.blog": plan("anchor", "blog", route+contributed("10.10.0.1", "", `{"name":"blog.example","port":2368}`)+`}`),
 		"anchor.other": plan("anchor", "other", `{"provision":"route","provider":"edge","provider-module":"route-proxy",`+
-			`"given":[{"values":{"name":"other.example","port":80}}]}`),
-		"anchor.older": plan("anchor", "older", `{"provision":"route","provider":"anchor","provider-module":"route-proxy"}`),
-		"laptop.lost": plan("laptop", "lost", `{"provision":"route","provider":"anchor","provider-module":"route-proxy",`+
-			`"given":[{"values":{"name":"lost.example","port":80}}]}`),
+			contributed("", "", `{"name":"other.example","port":80}`)+`}`),
+		"anchor.older": plan("anchor", "older", route+`"local":""}`),
+		"laptop.lost":  plan("laptop", "lost", route+contributed("", "", `{"name":"lost.example","port":80}`)+`}`),
 	}}
 	held := newTable()
-	if err := followPlans(plans, newPlanned("anchor"), held); err != nil {
+	var said []string
+	say := func(kind string, e contract.Event) {
+		said = append(said, kind+" "+e.Proxy+" "+e.Name+" "+e.Module+" "+e.Local+" "+e.Why)
+	}
+	if err := followPlans(plans, newPlanned("anchor", say), held, say); err != nil {
 		t.Fatal(err)
 	}
 	served := func() map[string]string {
@@ -230,17 +248,36 @@ func TestThePlansAreServedAndTheMembershipSaysWhoIsInside(t *testing.T) {
 	if !held.eligibleForACME("git.example") || held.eligibleForACME("git-api.anchor.internal") {
 		t.Error("a public name is not certified publicly, or an internal-only one is")
 	}
+	// Each refusal said with why, and each name served said once.
+	sort.Strings(said)
+	for _, w := range []string{
+		"route.refused anchor  gitea refused not a route this contract reads: json: unknown field \"host\"",
+		"route.refused anchor  lost  it runs on laptop and its plan says no address on the private network for it",
+		"route.refused anchor  older  its plan names this proxy for its route and carries nothing to serve",
+		"route.served anchor blog.example blog  ",
+		"route.served anchor git-api.anchor.internal gitea  ",
+	} {
+		if !slices.Contains(said, w) {
+			t.Errorf("not said %q, said:\n%s", w, strings.Join(said, "\n"))
+		}
+	}
+	if len(said) != 7 {
+		t.Errorf("said %d events, want 3 refusals and 4 names served:\n%s", len(said), strings.Join(said, "\n"))
+	}
 	for _, row := range []struct {
 		name, key, value string
 		served           []string
 		withdrawn        []string
+		say              []string
 	}{
-		{"a route arrives", "anchor.new", plan("anchor", "new", `{"provision":"route","provider":"anchor",`+
-			`"provider-module":"route-proxy","given":[{"values":{"name":"new.example","port":81}}]}`),
-			[]string{"new.example"}, nil},
-		{"an unreadable plan keeps what it gave", "laptop.gitea", `{"v":1,`, []string{"git.example"}, nil},
-		{"a deleted plan withdraws its routes", "laptop.gitea", "", nil, []string{"git.example", "git-api.anchor.internal"}},
+		{"a route arrives", "anchor.new", plan("anchor", "new", route+contributed("", "", `{"name":"new.example","port":81}`)+`}`),
+			[]string{"new.example"}, nil, []string{"route.served anchor new.example new  "}},
+		{"an unreadable plan keeps what it gave", "laptop.gitea", `{"v":1,`, []string{"git.example"}, nil, nil},
+		{"a deleted plan withdraws its routes", "laptop.gitea", "", nil, []string{"git.example", "git-api.anchor.internal"},
+			[]string{"route.withdrawn anchor git-api.anchor.internal   ", "route.withdrawn anchor git.anchor.internal   ",
+				"route.withdrawn anchor git.example   "}},
 	} {
+		said = nil
 		change := stdio.StateChange{Key: row.key, Op: "put", Value: json.RawMessage(row.value)}
 		if row.value == "" {
 			change = stdio.StateChange{Key: row.key, Op: "delete"}
@@ -259,22 +296,36 @@ func TestThePlansAreServedAndTheMembershipSaysWhoIsInside(t *testing.T) {
 				t.Errorf("%s: %s is still served", row.name, host)
 			}
 		}
+		if !slices.Equal(said, row.say) {
+			t.Errorf("%s: said %q, want %q", row.name, said, row.say)
+		}
 	}
 
 	held = behind(t)
 	if code, _ := askFrom(held, "admin.anchor.internal", "10.10.0.7:1"); code != http.StatusNotFound {
-		t.Errorf("before a membership, a machine of the mesh was served an internal-only name: %d", code)
+		t.Errorf("before the placement is read, a machine of the mesh was served an internal-only name: %d", code)
 	}
-	if !applyMembership(membership.Membership{Mesh: []string{"10.10.0.7"}}, held) {
-		t.Fatal("a membership naming the mesh was not applied")
+	laptop, err := delivery.PlacementValues(delivery.Placement{Node: "laptop", Decided: delivery.NodeDecided{Address: "10.10.0.7"}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	placement := &fakePlans{current: map[string]string{}}
+	for k, v := range laptop {
+		placement.current[k] = string(v)
+	}
+	if err := followInside(placement, held); err != nil {
+		t.Fatal(err)
 	}
 	if code, _ := askFrom(held, "admin.anchor.internal", "10.10.0.7:1"); code == http.StatusNotFound {
-		t.Error("a machine the membership names was refused the internal-only route")
+		t.Error("a machine the placement decides an address for was refused the internal-only route")
 	}
-	if applyMembership(membership.Membership{Mesh: []string{"not-an-address"}}, held) {
-		t.Error("a membership whose mesh cannot be read was applied")
+	if code, _ := askFrom(held, "admin.anchor.internal", "10.10.0.8:1"); code != http.StatusNotFound {
+		t.Error("a machine the placement does not name was served the internal-only route")
+	}
+	if err := placement.handle(stdio.StateChange{Key: "laptop.node", Op: "put", Value: json.RawMessage(`{`)}); err != nil {
+		t.Fatal(err)
 	}
 	if code, _ := askFrom(held, "admin.anchor.internal", "10.10.0.7:1"); code == http.StatusNotFound {
-		t.Error("an unreadable membership changed who is inside")
+		t.Error("an unreadable placement key changed who is inside")
 	}
 }

modules/route-proxy/cmd/route-proxy/routes_test.go

@@ -9,18 +9,32 @@ import (
 	"net/http/httptest"
 	"strings"
 	"testing"
+
+	"git.novox.be/novox/mesh-controller/modules/route-proxy/contract"
 )
 
-// routesFrom is the table a test's routes make, written as `{"given":[<contribution>…]}`: the contributions the plans
-// give the proxy (plans.go), each as routesOfPlan makes it.
+// routesFrom is the table a test's routes make, written as `{"given":[{"from","node","at","values"}…]}`: the
+// contributions the plans give the proxy, each read with route-proxy's contract as routesOfPlan reads it, and one the
+// contract refuses left out, as routesOfPlan leaves it out.
 func routesFrom(body string) (map[string][]rule, map[string]bool, error) {
 	var said struct {
-		Given []contribution `json:"given"`
+		Given []struct {
+			From, Node, At string
+			Values         json.RawMessage
+		} `json:"given"`
 	}
 	if err := json.Unmarshal([]byte(body), &said); err != nil {
 		return nil, nil, err
 	}
-	routes, public := routesOf(said.Given)
+	var given []contribution
+	for _, g := range said.Given {
+		route, err := contract.DecodeRequest(g.Values)
+		if err != nil {
+			continue
+		}
+		given = append(given, contribution{From: g.From, Node: g.Node, At: g.At, Route: route})
+	}
+	routes, public := routesOf(given)
 	return routes, public, nil
 }