A route is a grant, and a provider is told where its consumer is

novox/hq 08-connectivity §3, built. The mirror of a database grant: there the
consumer supplies a name and receives credentials; here it supplies a target
and receives a name. Nothing new in the vocabulary — a route is a provision
like any other.

One field was missing and it is the one that matters for anything reaching
back: a contribution now carries where the mesh says that machine is. A reverse
proxy is told to send traffic to a consumer and has to open a connection, so
without it every provider implementing a provision would have to know how the
mesh names machines — a convention leaking into every module.

The proxy itself is an example, not part of the control plane: the contract is
the file, not this program. It replaces its table whole rather than merging,
because the file is the whole truth about who has a route and merging would
keep serving a name whose module was unassigned — the stale-route fault
08-connectivity lists as open, reintroduced one level down. A name it does not
serve is refused by saying which it does: a route withdrawn and a name that
never existed are different things.

internal/catalogue/declaration.go

@@ -38,6 +38,12 @@ type Grant struct {
 	// Values are what that module contributed — the name it wants, and anything else the
 	// provision's own vocabulary defines.
 	Values map[string]any
+	// At is where the consuming machine is on the private network, empty if it is not on one.
+	//
+	// Passed in with the grant because it is a fact about another machine, and resolution answers
+	// questions about one. A provider that must reach back to its consumer — a reverse proxy is
+	// the whole reason this exists — otherwise has to know how the mesh names machines.
+	At string
 	// Sealed is the credential, closed to the providing node.
 	Sealed string
 }
@@ -284,6 +290,14 @@ type Contribution struct {
 	// cannot do anything with it. Contributions were node-local until this, which meant the one
 	// case that most needed them was the one they did not reach.
 	Node string `json:"node,omitempty"`
+	// At is where that machine is on the private network, empty when it is not on one or when it
+	// is this machine.
+	//
+	// The mesh knows it and a provider should not have to derive it. A reverse proxy is told
+	// *send traffic to this consumer* and has to open a connection — so without this every
+	// provider that reaches back to a consumer would have to know how the mesh names machines,
+	// which is a convention leaking into every module that implements a provision.
+	At string `json:"at,omitempty"`
 	// Secret is the file on this machine holding that consumer's credential, sealed to it.
 	//
 	// Named rather than carried, for the same reason the private network's key is: the mesh
@@ -331,7 +345,7 @@ func (r Resolution) contributions(settings SettingsBy, grants []Grant,
 			continue
 		}
 		out[g.Provision] = append(out[g.Provision], Contribution{
-			From: g.From, Node: g.Consumer, Values: g.Values,
+			From: g.From, Node: g.Consumer, At: g.At, Values: g.Values,
 			Secret: grantPath(directories[g.Provision], g.Consumer),
 		})
 	}