A rendered route carries its tier's ingress class #578

Parent

Rewrite the spec and the compiler in place, release 1.0.0, and hand over every Project

What to build

A tier declares the ingress class its Traefik admits, and every route rendered for that tier carries it. Today the traefik adapter renders no class, while both live Traefiks only admit routes of their class (traefik-public, traefik-lan) and external-dns filters on the same annotation, so a rendered route would be admitted by no proxy and get no record. Found while planning the edge handover (operator decisions of 2026-10-23 on #373).

Acceptance criteria

• A tier declares its ingress class; a tier without one is refused once any exposure uses it.
• Every route rendered for a tier carries that tier's class, and a route rendered for the public tier is admitted by a Traefik filtering on traefik-public.
• The chapter states the rule and its refusals, with short rationale only, and CONTEXT.md carries each new term in the same pull request.
• A worked example shows it; its resolved artifact and its rendered tree are updated and reviewed by hand, never regenerated in CI.
• Each refusal has a refusal example with its diagnostics file.
• The JSON Schemas and their corpus admit the new shape and refuse a malformed one.
• The behaviour-ledger row lands with its test, and npm run verify passes.

Blocked by

• Split the compiler's mixed modules by concept, with no change of behaviour