Failure, split and recovery.

A member’s announcement and session-owned mappings leave with its session. Clean close and silent loss have different detection times. The five-second keepalive configuration uses idle 2 seconds and three one-second probes, with TCP_USER_TIMEOUT where supported. In the recorded C++/Kotlin comparison, silent member loss was about 3.9 seconds and silent region loss about 4.0 seconds.

At 10–20% random packet loss the same experiment found more false deaths than the earlier twenty-second settings. Neither a single good run nor the nominal setting establishes an SLA.

The graph derives candidate paths from the current member facts. Hub routes depend on handshake health. Positive failure withdraws routes immediately when observed; rows that merely vanish have a 60-second hold-down in the graph path. Session membership is not a claim that every bearer is currently usable.

The region loop removes the region’s routes, names and tunnels when the session world is lost. It does not reconstruct a working world from another unrelated source. Members reconnect and reannounce under the deployed manager/mapping arrangement. A direct fixed-server setup has a different recovery contract from the named mapping setup.

Eligible members reselect the application memory host from published capabilities. The selection path must not query the store on the host that just died. The switchover simulator checks that property and unanimous selection under membership and capability changes.

The new host is new RAM. Applications reassert their owned state and rediscover dependencies. Old contents are not a durable failover guarantee. A split creates separate worlds; a merge changes the world participants must interpret.

A dead fdf-tun ends the bridge’s sessions and tears down its TUN and reach state. Aliases are quarantined. A replacement session replans from the present. A configuration with overlapping alias routes is refused as a whole.

If several ponds answer for the requested identity, resolution refuses rather than choosing an arbitrary one. IP header translation does not fix protocols that embed addresses in their payloads.