maka-agent 0.2.0-dev.8.20260830 → 0.2.1-dev.80.20261012

package/node_modules/@maka/runtime-host/dist/peer-mesh/node.js

@@ -16,23 +16,22 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { setTimeout as delay } from 'node:timers/promises';
-import { canonicalPeerMeshRoster, canonicalPeerMeshRouteRecord, createPeerMeshInvitationSecret, validatePeerMeshInvitation, decodeSignedPeerMeshRoster, decodeSignedPeerMeshRouteRecord, generatePeerMeshAuthorityKeyPair, matchesPeerMeshInvitationSecret, PEER_MESH_MAX_MEMBERS, PEER_MESH_MAX_MESHES, PEER_MESH_MAX_INVITATION_RECORDS, PEER_MESH_MAX_PENDING_INVITATIONS, PEER_MESH_MAX_TRANSIT_ADDRESSES_PER_RELAY, PEER_MESH_MAX_TRANSIT_RELAY_ADDRESSES, peerMeshRouteRecordSigningBytes, peerMeshId, peerMeshInvitationSecretDigest, signPeerMeshRoster, } from './model.js';
+import { createHash } from 'node:crypto';
+import { performance } from 'node:perf_hooks';
+import { canonicalPeerMeshMemberAdvertisement, canonicalPeerMeshRoster, createPeerMeshInvitationSecret, validatePeerMeshInvitation, decodeSignedPeerMeshMemberAdvertisement, decodeSignedPeerMeshRoster, generatePeerMeshAuthorityKeyPair, matchesPeerMeshInvitationSecret, PEER_MESH_MAX_MEMBERS, PEER_MESH_MAX_MESHES, PEER_MESH_MAX_INVITATION_RECORDS, PEER_MESH_MAX_PENDING_INVITATIONS, PEER_MESH_MAX_TRANSIT_ADDRESSES_PER_RELAY, PEER_MESH_MAX_TRANSIT_RELAY_ADDRESSES, peerMeshMemberAdvertisementSigningBytes, peerMeshId, peerMeshInvitationSecretDigest, signPeerMeshRoster, } from './model.js';
 import { canonicalPeerMeshDisplayName } from './display-name.js';
-import { authorityKeys, openPeerMeshStateStore, } from './store.js';
-const CONTROL_FRAME_MAX_BYTES = 64 * 1024;
+import { authenticateSignedPeerReachabilityLease, decodeSignedPeerReachabilityLease, isPeerReachabilityLeaseCurrent, PEER_REACHABILITY_MAX_CLOCK_SKEW_MS, peerReachabilityLeaseSigningBytes, peerReachabilityLeaseReceipt, PEER_REACHABILITY_RECOVERY_HORIZON_MS, verifySignedPeerReachabilityLease, } from '../peer-reachability/index.js';
+import { authorityKeys, isActivePeerMeshMembership as isActiveMembership, isRetiredPeerMeshState as isRetired, openPeerMeshStateStore, } from './store.js';
+const CONTROL_FRAME_MAX_BYTES = 128 * 1024;
 const DEFAULT_INVITATION_TTL_MS = 15 * 60 * 1_000;
 const CONNECT_DEADLINE_MS = 30_000;
 const CONTROL_REQUEST_DEADLINE_MS = 10_000;
 const MAX_ACTIVE_CONTROL_STREAMS = 32;
 const MAX_ACTIVE_CONTROL_STREAMS_PER_PEER = 2;
-const ROUTE_TTL_MS = 5 * 60 * 1_000;
-const ROUTE_REFRESH_LEAD_MS = 60 * 1_000;
-const ROUTE_MAX_FUTURE_MS = 10 * 60 * 1_000;
-const ROUTE_PAGE_SIZE = 8;
+const EVIDENCE_PAGE_SIZE = 2;
 const RECONCILE_CONCURRENCY = 4;
 const RECONCILE_DEADLINE_MS = 60 * 1_000;
-const RECONCILE_INTERVAL_MS = 30 * 1_000;
+const RECONCILE_INTERVAL_MS = 5 * 60 * 1_000;
 export async function openPeerMeshNode(input) {
     const store = await openPeerMeshStateStore(input.dataRoot, input.peer.identity().peerId);
     const node = new PeerMeshNodeImpl({ ...input, store });
@@ -48,26 +47,66 @@ export async function openPeerMeshNode(input) {
 class PeerMeshNodeImpl {
     #store;
     #peer;
+    #reachability;
     #endpointKind;
     #now;
+    #monotonicNow;
+    #onBackgroundReconcileError;
     #activeControlStreams = new Set();
     #lifetime = new AbortController();
     #admissionTail = Promise.resolve();
     #reconcileTail = Promise.resolve();
+    #transitTail = Promise.resolve();
     #reconcileCursor = 0;
     #gossipCursor = 0;
-    #routeRefreshTask;
+    #evidenceRefreshTask;
+    #unsubscribeReachability;
+    #reconcileGeneration = 0;
+    #reconcileWaiters = new Set();
+    #reachabilityReceipts = new Map();
+    #completedRecoverySweeps = new Set();
+    #routeResolutionListeners = new Map();
     #serveTask;
     #closeTask;
     constructor(input) {
         this.#store = input.store;
         this.#peer = input.peer;
+        this.#reachability = input.reachability;
         this.#endpointKind = input.endpointKind;
         this.#now = input.now ?? Date.now;
+        this.#monotonicNow = input.monotonicNow ?? (input.now ? input.now : () => performance.now());
+        this.#onBackgroundReconcileError = input.onBackgroundReconcileError;
     }
     async initialize() {
-        for (const route of this.#store.read().routes)
-            this.#assertRouteSignature(route);
+        const stored = this.#store.read();
+        const now = this.#now();
+        for (const lease of stored.reachability) {
+            const signed = authenticateSignedPeerReachabilityLease({
+                value: lease,
+                expectedPeerId: lease.lease.peerId,
+                verifyIdentity: this.#peer.verifyIdentity.bind(this.#peer),
+            });
+            if (usableHistoricalReachability(signed, now) &&
+                signed.lease.issuedAt <= now + PEER_REACHABILITY_MAX_CLOCK_SKEW_MS) {
+                this.#recordReachabilityReceipt(signed);
+            }
+        }
+        for (const advertisement of stored.advertisements) {
+            this.#assertAdvertisementSignature(advertisement);
+        }
+        if (stored.reachability.some((signed) => !usableHistoricalReachability(signed, now))) {
+            await this.#store.mutate((current) => ({
+                state: {
+                    ...current,
+                    reachability: current.reachability.filter((signed) => usableHistoricalReachability(signed, now)),
+                },
+                result: undefined,
+            }));
+        }
+        await this.#refreshLocalEvidence();
+        this.#unsubscribeReachability = this.#reachability.subscribe(() => {
+            this.#triggerReconciliation();
+        });
         await this.#reconcileTransit();
     }
     localPeerId() {
@@ -84,27 +123,23 @@ class PeerMeshNodeImpl {
             await this.#store.mutate(async (current) => {
                 if (current.displayName === canonical)
                     return { state: current, result: undefined };
-                const state = { ...current, displayName: canonical };
-                const localPeerId = this.#peer.identity().peerId;
-                if (!state.meshes.some((mesh) => isActiveMembership(mesh, localPeerId))) {
-                    return { state, result: undefined };
-                }
-                const route = await this.#signLocalRoute(state);
+                const next = { ...current, displayName: canonical };
+                const advertisements = await this.#localAdvertisementsFor(next);
                 return {
                     state: {
-                        ...state,
-                        routes: mergeRoutes(state.routes, [route], this.#now()),
+                        ...next,
+                        advertisements: mergeAdvertisements(current.advertisements, advertisements),
                     },
                     result: undefined,
                 };
             });
-            void this.reconcile().catch(() => undefined);
+            this.#triggerReconciliation();
         });
     }
     setMeshDisplayName(meshId, displayName) {
         return this.#admitMesh(async () => {
             const canonical = displayName === null ? undefined : canonicalPeerMeshDisplayName(displayName);
-            await this.#store.mutate((current) => {
+            const announcement = await this.#store.mutate((current) => {
                 const state = requireAuthority(current.meshes, meshId);
                 if (state.roster.roster.closed)
                     throw new Error('Peer Mesh is closed');
@@ -117,12 +152,20 @@ class PeerMeshNodeImpl {
                     ...(canonical ? { displayName: canonical } : {}),
                 }), authorityKeys(state));
                 return {
-                    state: { ...current, meshes: replaceMesh(current.meshes, { ...state, roster }) },
-                    result: undefined,
+                    state: {
+                        ...current,
+                        meshes: replaceMesh(current.meshes, { ...state, roster }),
+                    },
+                    result: {
+                        roster,
+                        targets: rosterAnnouncementTargets(state.roster.roster.members, current.reachability, this.#peer.identity().peerId, this.#now()),
+                    },
                 };
             });
+            if (announcement)
+                this.#scheduleRosterAnnouncement(announcement.roster, announcement.targets);
             const stored = this.#store.read();
-            return peerMeshStatus(requireAuthority(stored.meshes, meshId), this.#peer.identity(), this.#endpointKind, stored.routes, this.#now());
+            return peerMeshStatus(requireAuthority(stored.meshes, meshId), this.#peer.identity(), this.#endpointKind, stored.reachability, stored.advertisements, this.#now(), (peerId) => this.#peer.isConnected(peerId), (peerId) => this.resolveRoutes(peerId), (signed) => this.#isReachabilityCurrent(signed));
         });
     }
     status() {
@@ -130,8 +173,8 @@ class PeerMeshNodeImpl {
         const identity = this.#peer.identity();
         const stored = this.#store.read();
         return Object.freeze(stored.meshes
-            .filter((state) => isActiveMembership(state, identity.peerId))
-            .map((state) => peerMeshStatus(state, identity, this.#endpointKind, stored.routes, this.#now())));
+            .filter((state) => state.roster.roster.closed || isActiveMembership(state, identity.peerId))
+            .map((state) => peerMeshStatus(state, identity, this.#endpointKind, stored.reachability, stored.advertisements, this.#now(), (peerId) => this.#peer.isConnected(peerId), (peerId) => this.resolveRoutes(peerId), (signed) => this.#isReachabilityCurrent(signed))));
     }
     create() {
         return this.#admitMesh(async () => {
@@ -140,6 +183,7 @@ class PeerMeshNodeImpl {
             const roster = signPeerMeshRoster(canonicalPeerMeshRoster({
                 version: 1,
                 meshId: peerMeshId(keys.publicKey),
+                authorityPeerId: identity.peerId,
                 revision: 1,
                 members: [identity.peerId],
                 closed: false,
@@ -150,38 +194,34 @@ class PeerMeshNodeImpl {
                 authorityPrivateKey: keys.privateKey,
                 invitations: [],
             };
-            const signedRoute = await this.#signLocalRoute();
+            const reachability = await this.#reachability.refresh();
             const now = this.#now();
             await this.#store.mutate((current) => {
-                assertMeshCapacity(current.meshes, identity.peerId);
-                const currentLocalRoute = current.routes
-                    .filter(({ route }) => route.peerId === identity.peerId)
-                    .sort((left, right) => right.route.sequence - left.route.sequence)[0];
-                const localRoute = currentLocalRoute && currentLocalRoute.route.sequence >= signedRoute.route.sequence
-                    ? currentLocalRoute
-                    : signedRoute;
+                assertMeshCapacity(current.meshes, identity.peerId, current.pendingJoins.length);
                 return {
                     state: {
                         ...current,
                         meshes: appendMesh(current.meshes, state, identity.peerId),
-                        routes: mergeRoutes(current.routes, [localRoute], now),
+                        reachability: mergeReachability(current.reachability, [reachability], now),
                     },
                     result: undefined,
                 };
             });
+            await this.#refreshLocalEvidence();
             const stored = this.#store.read();
-            return peerMeshStatus(findMesh(stored.meshes, state.roster.roster.meshId), identity, this.#endpointKind, stored.routes, now);
+            return peerMeshStatus(findMesh(stored.meshes, state.roster.roster.meshId), identity, this.#endpointKind, stored.reachability, stored.advertisements, now, (peerId) => this.#peer.isConnected(peerId), (peerId) => this.resolveRoutes(peerId), (signed) => this.#isReachabilityCurrent(signed));
         });
     }
-    invite(meshId, input = {}) {
+    async invite(meshId, input = {}) {
         if (this.#lifetime.signal.aborted)
-            return Promise.reject(new Error('Peer Mesh node is closed'));
+            throw new Error('Peer Mesh node is closed');
         const now = this.#now();
         const identity = this.#peer.identity();
         const ttlMs = input.ttlMs ?? DEFAULT_INVITATION_TTL_MS;
         if (!Number.isSafeInteger(ttlMs) || ttlMs < 1_000 || ttlMs > 24 * 60 * 60 * 1_000) {
-            return Promise.reject(new Error('Peer Mesh invitation TTL must be between 1 second and 1 day'));
+            throw new Error('Peer Mesh invitation TTL must be between 1 second and 1 day');
         }
+        const reachability = await this.#reachability.refresh();
         return this.#store.mutate((current) => {
             const state = requireAuthority(current.meshes, meshId);
             if (state.roster.roster.closed)
@@ -194,14 +234,13 @@ class PeerMeshNodeImpl {
                 throw new Error('Peer Mesh has too many recent invitations');
             const secret = createPeerMeshInvitationSecret();
             const expiresAt = now + ttlMs;
-            const target = authorityTarget(identity);
             const invitation = {
                 version: 1,
                 meshId: state.roster.roster.meshId,
                 authorityPublicKey: state.roster.authorityPublicKey,
                 secret,
                 expiresAt,
-                ...target,
+                reachability,
             };
             return {
                 state: {
@@ -225,89 +264,237 @@ class PeerMeshNodeImpl {
     join(invitationValue, signal) {
         return this.#admitMesh(async () => {
             const invitation = validatePeerMeshInvitation(invitationValue);
-            if (invitation.expiresAt <= this.#now()) {
-                throw new Error('Peer Mesh invitation has expired');
-            }
+            const authorityReachability = this.#authenticateReachability(invitation.reachability, invitation.reachability.lease.peerId, true);
             const current = this.#store.read();
             const existing = findMesh(current.meshes, invitation.meshId);
+            const pending = current.pendingJoins.find(({ invitation: candidate }) => candidate.meshId === invitation.meshId);
+            if (!pending && invitation.expiresAt <= this.#now()) {
+                throw new Error('Peer Mesh invitation has expired');
+            }
             const localPeerId = this.#peer.identity().peerId;
+            if (existing?.roster.roster.closed) {
+                throw new Error('Peer Mesh is closed');
+            }
             if (existing?.role === 'authority') {
                 throw new Error('This peer already belongs to that Peer Mesh');
             }
-            if (!existing)
-                assertMeshCapacity(current.meshes, localPeerId);
+            if (existing?.role === 'replica' &&
+                authorityReachability.lease.peerId !== existing.roster.roster.authorityPeerId) {
+                throw new Error('Peer Mesh repair invitation has the wrong authority identity');
+            }
+            assertRejoinSettled(existing, localPeerId);
+            if (pending && pending.invitation.secret !== invitation.secret) {
+                throw new Error('This Peer Mesh already has an unresolved join attempt');
+            }
+            if (pending?.phase === 'leave_pending') {
+                throw new Error('This Peer Mesh join is still being cancelled');
+            }
+            if (!existing && !pending) {
+                assertMeshCapacity(current.meshes, localPeerId, current.pendingJoins.length);
+            }
             const operationSignal = signal
                 ? AbortSignal.any([signal, this.#lifetime.signal])
                 : this.#lifetime.signal;
-            const stream = await this.#peer.connectMeshControl({
-                peerId: invitation.peerId,
-                routeHints: invitation.routeHints,
-                coordinationRelays: invitation.coordinationRelays,
-                directDeadlineMs: CONNECT_DEADLINE_MS,
-            }, operationSignal);
+            let stream;
+            let joinIntentAdmitted = pending !== undefined;
             try {
-                const localRoute = (await this.#refreshLocalRoute()) ?? (await this.#signLocalRoute());
-                const request = {
-                    kind: 'redeem-invitation',
-                    meshId: invitation.meshId,
-                    secret: invitation.secret,
-                    route: localRoute,
-                };
-                const response = await exchangeControl(stream, request, decodeRedeemResponse, operationSignal);
-                if (response.kind === 'invitation-rejected') {
-                    throw new Error(`Peer Mesh invitation was rejected: ${response.reason}`);
-                }
-                const roster = decodeSignedPeerMeshRoster(response.roster);
-                const identity = this.#peer.identity();
-                if (roster.roster.meshId !== invitation.meshId ||
-                    roster.authorityPublicKey !== invitation.authorityPublicKey ||
-                    !roster.roster.members.includes(identity.peerId)) {
-                    throw new Error('Peer Mesh authority returned an unrelated roster');
+                stream = await this.#peer.connectMeshControl({
+                    ...dialTarget(authorityReachability),
+                    directDeadlineMs: CONNECT_DEADLINE_MS,
+                }, operationSignal);
+                if (stream.peerId !== authorityReachability.lease.peerId) {
+                    throw new Error('Peer Mesh control stream has the wrong peer identity');
                 }
-                const routes = await this.#validateRoutes(response.routes, roster, this.#now());
-                operationSignal.throwIfAborted();
+                const localReachability = await this.#reachability.refresh();
+                const localAdvertisement = await this.#signLocalAdvertisement(invitation.meshId);
                 await this.#store.mutate((current) => {
                     const existing = findMesh(current.meshes, invitation.meshId);
                     if (existing?.role === 'authority') {
                         throw new Error('This peer already belongs to that Peer Mesh');
                     }
-                    const selectedRoster = existing ? selectRoster(existing.roster, roster) : roster;
-                    if (!selectedRoster.roster.members.includes(identity.peerId)) {
-                        throw new Error('Peer Mesh invitation did not establish an active membership');
+                    assertRejoinSettled(existing, localPeerId);
+                    const pending = current.pendingJoins.find(({ invitation: candidate }) => candidate.meshId === invitation.meshId);
+                    if (pending && pending.invitation.secret !== invitation.secret) {
+                        throw new Error('This Peer Mesh already has an unresolved join attempt');
                     }
-                    const state = {
-                        role: 'replica',
-                        authority: {
-                            peerId: invitation.peerId,
-                            routeHints: invitation.routeHints,
-                            coordinationRelays: invitation.coordinationRelays,
-                        },
-                        roster: selectedRoster,
-                    };
-                    if (!existing)
-                        assertMeshCapacity(current.meshes, identity.peerId);
-                    const meshes = existing
-                        ? replaceMesh(current.meshes, state)
-                        : appendMesh(current.meshes, state, identity.peerId);
+                    if (pending?.phase === 'leave_pending') {
+                        throw new Error('This Peer Mesh join is still being cancelled');
+                    }
+                    if (!existing && !pending) {
+                        assertMeshCapacity(current.meshes, localPeerId, current.pendingJoins.length);
+                    }
+                    const next = pending
+                        ? { ...pending, invitation }
+                        : { invitation, phase: 'prepared' };
                     return {
                         state: {
                             ...current,
-                            meshes,
-                            routes: mergeRoutes(current.routes, [...routes, localRoute], this.#now()),
+                            pendingJoins: pending
+                                ? current.pendingJoins.map((candidate) => candidate === pending ? next : candidate)
+                                : [...current.pendingJoins, next],
                         },
                         result: undefined,
                     };
                 });
-                await this.#refreshLocalRoute();
-                await this.#reconcileTransit();
-                const stored = this.#store.read();
-                return peerMeshStatus(findMesh(stored.meshes, invitation.meshId), identity, this.#endpointKind, stored.routes);
+                joinIntentAdmitted = true;
+                return await this.#redeemPendingJoin(invitation, localReachability, localAdvertisement, stream, operationSignal);
+            }
+            catch (error) {
+                if (signal?.aborted && joinIntentAdmitted) {
+                    await this.#cancelPendingJoin(invitation.meshId);
+                    await this.#reconcileTransit();
+                }
+                void this.reconcile().catch(() => undefined);
+                throw error;
             }
             finally {
-                await stream.close().catch(() => undefined);
+                await stream?.close().catch(() => undefined);
             }
         });
     }
+    async #redeemPendingJoin(invitation, localReachability, localAdvertisement, stream, signal) {
+        signal.throwIfAborted();
+        const authorityReachability = this.#authenticateReachability(invitation.reachability, invitation.reachability.lease.peerId, true);
+        const dispatch = await this.#store.mutate((current) => {
+            const pending = current.pendingJoins.find(({ invitation: candidate }) => candidate.meshId === invitation.meshId && candidate.secret === invitation.secret);
+            if (!pending) {
+                return { state: current, result: false };
+            }
+            if (pending.phase !== 'prepared') {
+                return { state: current, result: true };
+            }
+            return {
+                state: {
+                    ...current,
+                    pendingJoins: current.pendingJoins.map((candidate) => candidate === pending ? { ...candidate, phase: 'outcome_unknown' } : candidate),
+                },
+                result: true,
+            };
+        });
+        if (!dispatch)
+            throw new Error('Peer Mesh join is no longer pending');
+        signal.throwIfAborted();
+        const response = await exchangeControl(stream, {
+            kind: 'redeem-invitation',
+            meshId: invitation.meshId,
+            secret: invitation.secret,
+            reachability: localReachability,
+            advertisement: localAdvertisement,
+        }, decodeRedeemResponse, signal);
+        if (response.kind === 'invitation-rejected') {
+            await this.#discardPendingJoin(invitation);
+            throw new Error(`Peer Mesh invitation was rejected: ${response.reason}`);
+        }
+        const roster = decodeSignedPeerMeshRoster(response.roster);
+        const identity = this.#peer.identity();
+        if (roster.roster.meshId !== invitation.meshId ||
+            roster.authorityPublicKey !== invitation.authorityPublicKey ||
+            roster.roster.authorityPeerId !== stream.peerId ||
+            invitation.reachability.lease.peerId !== stream.peerId ||
+            !roster.roster.members.includes(identity.peerId)) {
+            await this.#discardPendingJoin(invitation);
+            throw new Error('Peer Mesh authority returned an unrelated roster');
+        }
+        const reachability = this.#validateReachabilityPage(response.reachability, roster, true);
+        const advertisements = this.#validateAdvertisementPage(response.advertisements, roster);
+        signal.throwIfAborted();
+        await this.#store.mutate((current) => {
+            const pending = current.pendingJoins.find(({ invitation: candidate }) => candidate.meshId === invitation.meshId && candidate.secret === invitation.secret);
+            const existing = findMesh(current.meshes, invitation.meshId);
+            if (!pending) {
+                if (!existing || existing.role === 'authority') {
+                    throw new Error('Peer Mesh join is no longer pending');
+                }
+                return { state: current, result: undefined };
+            }
+            const selectedRoster = existing ? selectRoster(existing.roster, roster) : roster;
+            if (!selectedRoster.roster.members.includes(identity.peerId)) {
+                throw new Error('Peer Mesh invitation did not establish an active membership');
+            }
+            const state = {
+                role: 'replica',
+                roster: selectedRoster,
+                desiredMembership: pending.phase === 'leave_pending' ? 'left' : 'active',
+            };
+            return {
+                state: {
+                    ...current,
+                    meshes: existing
+                        ? replaceMesh(current.meshes, state)
+                        : appendMesh(current.meshes, state, identity.peerId),
+                    pendingJoins: current.pendingJoins.filter((candidate) => candidate !== pending),
+                    reachability: mergeReachability(current.reachability, [...reachability, authorityReachability, localReachability], this.#now()),
+                    advertisements: mergeAdvertisements(current.advertisements, [
+                        ...advertisements,
+                        localAdvertisement,
+                    ]),
+                },
+                result: undefined,
+            };
+        });
+        this.#recordReachabilityReceipts([...reachability, authorityReachability, localReachability]);
+        signal.throwIfAborted();
+        await this.#refreshLocalEvidence();
+        signal.throwIfAborted();
+        await this.#reconcileTransit();
+        signal.throwIfAborted();
+        const stored = this.#store.read();
+        const state = findMesh(stored.meshes, invitation.meshId);
+        if (!state)
+            throw new Error('Peer Mesh join was not retained');
+        return peerMeshStatus(state, identity, this.#endpointKind, stored.reachability, stored.advertisements, this.#now(), (peerId) => this.#peer.isConnected(peerId), (peerId) => this.resolveRoutes(peerId), (signed) => this.#isReachabilityCurrent(signed));
+    }
+    #discardPendingJoin(invitation) {
+        return this.#store.mutate((current) => ({
+            state: {
+                ...current,
+                pendingJoins: current.pendingJoins.filter(({ invitation: candidate }) => candidate.meshId !== invitation.meshId || candidate.secret !== invitation.secret),
+            },
+            result: undefined,
+        }));
+    }
+    #cancelPendingJoin(meshId) {
+        return this.#store.mutate((current) => {
+            const existing = findMesh(current.meshes, meshId);
+            return {
+                state: {
+                    ...current,
+                    meshes: existing?.role === 'replica'
+                        ? replaceMesh(current.meshes, {
+                            ...existing,
+                            desiredMembership: 'left',
+                        })
+                        : current.meshes,
+                    pendingJoins: current.pendingJoins.flatMap((pending) => {
+                        if (pending.invitation.meshId !== meshId)
+                            return [pending];
+                        return pending.phase === 'prepared' ? [] : [{ ...pending, phase: 'leave_pending' }];
+                    }),
+                },
+                result: undefined,
+            };
+        });
+    }
+    async #resumePendingJoin(pending, signal) {
+        const authorityReachability = this.#authenticateReachability(pending.invitation.reachability, pending.invitation.reachability.lease.peerId, true);
+        const existing = findMesh(this.#store.read().meshes, pending.invitation.meshId);
+        if (existing?.role === 'replica' &&
+            authorityReachability.lease.peerId !== existing.roster.roster.authorityPeerId) {
+            throw new Error('Peer Mesh repair invitation has the wrong authority identity');
+        }
+        const stream = await this.#peer.connectMeshControl({
+            ...dialTarget(authorityReachability),
+            directDeadlineMs: CONNECT_DEADLINE_MS,
+        }, signal);
+        try {
+            const localReachability = await this.#reachability.refresh();
+            const localAdvertisement = await this.#signLocalAdvertisement(pending.invitation.meshId);
+            await this.#redeemPendingJoin(pending.invitation, localReachability, localAdvertisement, stream, signal);
+        }
+        finally {
+            await stream.close().catch(() => undefined);
+        }
+    }
     remove(meshId, peerId) {
         if (this.#lifetime.signal.aborted)
             return Promise.reject(new Error('Peer Mesh node is closed'));
@@ -324,31 +511,32 @@ class PeerMeshNodeImpl {
     }
     leave(meshId, signal) {
         return this.#admitMesh(async () => {
-            const stored = this.#store.read();
-            const state = findMesh(stored.meshes, meshId);
+            signal?.throwIfAborted();
             const localPeerId = this.#peer.identity().peerId;
-            if (!state || !isActiveMembership(state, localPeerId)) {
-                throw new Error('This peer does not belong to that Peer Mesh');
-            }
-            if (state.role === 'authority') {
-                throw new Error('Close a Peer Mesh instead of leaving its authority');
-            }
-            const operationSignal = signal
-                ? AbortSignal.any([signal, this.#lifetime.signal])
-                : this.#lifetime.signal;
-            const stream = await this.#peer.connectMeshControl({
-                ...currentAuthorityTarget(state, stored.routes),
-                directDeadlineMs: CONNECT_DEADLINE_MS,
-            }, operationSignal);
-            try {
-                const response = await exchangeControl(stream, { kind: 'leave', meshId }, decodeLeaveResponse, operationSignal);
-                if (response.kind === 'leave-rejected') {
-                    throw new Error('Peer Mesh authority rejected the leave request');
+            await this.#store.mutate((current) => {
+                const state = findMesh(current.meshes, meshId);
+                if (!state || !isActiveMembership(state, localPeerId)) {
+                    throw new Error('This peer does not belong to that Peer Mesh');
+                }
+                if (state.role === 'authority') {
+                    throw new Error('Close a Peer Mesh instead of leaving its authority');
                 }
-                await this.#applySync(meshId, response.roster, []);
+                return {
+                    state: {
+                        ...current,
+                        meshes: replaceMesh(current.meshes, {
+                            ...state,
+                            desiredMembership: 'left',
+                        }),
+                    },
+                    result: undefined,
+                };
+            });
+            try {
+                await this.#reconcileTransit();
             }
             finally {
-                await stream.close().catch(() => undefined);
+                void this.reconcile().catch(() => undefined);
             }
         });
     }
@@ -363,22 +551,28 @@ class PeerMeshNodeImpl {
     setTransitMesh(meshId) {
         return this.#admitMesh(async () => {
             const localPeerId = this.#peer.identity().peerId;
-            await this.#store.mutate((current) => {
+            await this.#store.mutate(async (current) => {
                 if (meshId !== null &&
                     !current.meshes.some((mesh) => mesh.roster.roster.meshId === meshId && isActiveMembership(mesh, localPeerId))) {
                     throw new Error('Transit requires an active Peer Mesh membership');
                 }
+                if (current.transitMeshId === meshId)
+                    return { state: current, result: undefined };
+                const next = { ...current, transitMeshId: meshId };
+                const advertisements = await this.#localAdvertisementsFor(next);
                 return {
-                    state: { ...current, transitMeshId: meshId },
+                    state: {
+                        ...next,
+                        advertisements: mergeAdvertisements(current.advertisements, advertisements),
+                    },
                     result: undefined,
                 };
             });
             try {
                 await this.#reconcileTransit();
-                await this.#refreshLocalRoute();
             }
-            catch {
-                void this.reconcile().catch(() => undefined);
+            finally {
+                this.#triggerReconciliation();
             }
         });
     }
@@ -394,47 +588,126 @@ class PeerMeshNodeImpl {
         this.#assertOpen();
         const now = this.#now();
         const stored = this.#store.read();
+        const localPeerId = this.#peer.identity().peerId;
+        this.#pruneCompletedRecoverySweeps(stored, localPeerId);
         const sharedMeshIds = stored.meshes
-            .filter((state) => isActiveMembership(state, this.#peer.identity().peerId) &&
-            state.roster.roster.members.includes(peerId))
+            .filter((state) => isActiveMembership(state, localPeerId) && state.roster.roster.members.includes(peerId))
             .map(({ roster }) => roster.roster.meshId);
         const visible = sharedMeshIds.length > 0;
         if (!visible)
-            return undefined;
-        const route = stored.routes
-            .filter(({ route }) => route.peerId === peerId && route.expiresAt > now)
-            .sort((left, right) => right.route.sequence - left.route.sequence)[0]?.route;
-        const localPeerId = this.#peer.identity().peerId;
-        const transitRelayPeerIds = transitRelayCandidates(stored.routes
-            .filter(({ route: candidate }) => candidate.peerId !== localPeerId &&
-            candidate.peerId !== peerId &&
-            candidate.expiresAt > now &&
-            candidate.transitMeshId !== undefined &&
-            sharedMeshIds.includes(candidate.transitMeshId) &&
-            isActiveMeshMember(stored.meshes, candidate.transitMeshId, localPeerId, candidate.peerId))
-            .sort((left, right) => left.route.peerId.localeCompare(right.route.peerId))).map(({ peerId: relayPeerId }) => relayPeerId);
-        if (!route && transitRelayPeerIds.length === 0)
-            return undefined;
+            return emptyRouteResolution('exhausted');
+        const reachability = latestReachability(stored.reachability, peerId, now, true)?.lease;
+        const transitRelayPeerIds = transitRelayCandidates(eligibleTransitEvidence(stored, localPeerId, now, (signed) => this.#isReachabilityCurrent(signed)).filter(({ meshId, lease }) => lease.lease.peerId !== peerId && sharedMeshIds.includes(meshId))).map(({ peerId: relayPeerId }) => relayPeerId);
+        const routeHints = reachability?.directRoutes ?? [];
+        const coordinationRelays = reachability?.coordinationRoutes ?? [];
+        const hasCandidates = routeHints.length + coordinationRelays.length + transitRelayPeerIds.length > 0;
+        const state = hasCandidates
+            ? 'available'
+            : hasPeerRecoverySource(stored, sharedMeshIds, peerId, localPeerId, now)
+                ? 'recovering'
+                : this.#completedRecoverySweeps.has(peerId)
+                    ? 'exhausted'
+                    : 'recovering';
         return Object.freeze({
-            routeHints: route?.routeHints ?? [],
-            coordinationRelays: route?.coordinationRelays ?? [],
+            state,
+            routeHints,
+            coordinationRelays,
             transitRelayPeerIds: Object.freeze(transitRelayPeerIds),
         });
     }
+    peerConnected(peerId) {
+        if (this.#lifetime.signal.aborted)
+            return;
+        const localPeerId = this.#peer.identity().peerId;
+        if (peerId !== localPeerId &&
+            this.#store
+                .read()
+                .meshes.some((state) => isActiveMembership(state, localPeerId) && state.roster.roster.members.includes(peerId)))
+            this.#triggerReconciliation();
+    }
     async prepareRoutes(peerId, signal) {
         this.#assertOpen();
         signal.throwIfAborted();
+        this.#setRecoverySweepCompleted(peerId, false);
         const localPeerId = this.#peer.identity().peerId;
         const stored = this.#store.read();
-        const visible = stored.meshes.some((mesh) => isActiveMembership(mesh, localPeerId) && mesh.roster.roster.members.includes(peerId));
+        const visible = this.#pruneCompletedRecoverySweeps(stored, localPeerId).has(peerId);
         if (!visible)
             return;
-        if (stored.routes.some(({ route }) => route.peerId === peerId && route.expiresAt > this.#now())) {
-            return;
+        // A signed route can remain within its TTL after a peer restarted or
+        // rotated Relay reservations. Every connection establishment therefore
+        // asks the Mesh control plane for its newest record. Callers with a
+        // self-contained invitation run this reconciliation in parallel with the
+        // first dial; callers without usable routes wait for it.
+        try {
+            await this.#queueReconcile(signal, peerId);
+        }
+        finally {
+            if (!signal.aborted && !this.#lifetime.signal.aborted) {
+                this.#setRecoverySweepCompleted(peerId, true);
+            }
+        }
+    }
+    #pruneCompletedRecoverySweeps(stored = this.#store.read(), localPeerId = this.#peer.identity().peerId) {
+        const visiblePeerIds = new Set();
+        for (const state of stored.meshes) {
+            if (!isActiveMembership(state, localPeerId))
+                continue;
+            for (const memberPeerId of state.roster.roster.members) {
+                if (memberPeerId !== localPeerId)
+                    visiblePeerIds.add(memberPeerId);
+            }
         }
-        await this.reconcile(signal);
+        for (const peerId of this.#completedRecoverySweeps) {
+            if (!visiblePeerIds.has(peerId))
+                this.#completedRecoverySweeps.delete(peerId);
+        }
+        return visiblePeerIds;
+    }
+    subscribeRoutes(peerId, listener) {
+        this.#assertOpen();
+        let current = this.resolveRoutes(peerId);
+        const observe = () => {
+            const next = this.resolveRoutes(peerId);
+            if (sameResolvedRoutes(current, next))
+                return;
+            current = next;
+            try {
+                listener();
+            }
+            catch {
+                // Route observers cannot control Mesh reconciliation.
+            }
+        };
+        const listeners = this.#routeResolutionListeners.get(peerId) ?? new Set();
+        listeners.add(observe);
+        this.#routeResolutionListeners.set(peerId, listeners);
+        const unsubscribeStore = this.#store.subscribe(observe);
+        return () => {
+            unsubscribeStore();
+            listeners.delete(observe);
+            if (listeners.size === 0)
+                this.#routeResolutionListeners.delete(peerId);
+        };
+    }
+    #setRecoverySweepCompleted(peerId, completed) {
+        const retain = completed && this.#pruneCompletedRecoverySweeps().has(peerId);
+        const changed = retain
+            ? !this.#completedRecoverySweeps.has(peerId)
+            : this.#completedRecoverySweeps.has(peerId);
+        if (!changed)
+            return;
+        if (retain)
+            this.#completedRecoverySweeps.add(peerId);
+        else
+            this.#completedRecoverySweeps.delete(peerId);
+        for (const listener of this.#routeResolutionListeners.get(peerId) ?? [])
+            listener();
     }
     reconcile(signal) {
+        return this.#queueReconcile(signal);
+    }
+    #queueReconcile(signal, excludedPeerId) {
         if (this.#lifetime.signal.aborted)
             return Promise.reject(new Error('Peer Mesh node is closed'));
         const previous = this.#reconcileTail;
@@ -444,7 +717,7 @@ class PeerMeshNodeImpl {
         });
         this.#reconcileTail = previous.then(() => turn);
         return waitForTurn(previous, signal)
-            .then(() => this.#reconcile(signal))
+            .then(() => this.#reconcile(signal, excludedPeerId))
             .finally(release);
     }
     async serve() {
@@ -483,49 +756,126 @@ class PeerMeshNodeImpl {
     }
     async #close() {
         this.#lifetime.abort();
+        this.#unsubscribeReachability?.();
+        this.#unsubscribeReachability = undefined;
+        for (const wake of this.#reconcileWaiters)
+            wake();
+        this.#reconcileWaiters.clear();
         await this.#serveTask?.catch(() => undefined);
         for (const stream of this.#activeControlStreams)
             stream.abort();
         this.#activeControlStreams.clear();
-        await Promise.all([this.#admissionTail, this.#reconcileTail]);
+        this.#routeResolutionListeners.clear();
+        await Promise.all([this.#admissionTail, this.#reconcileTail, this.#transitTail]);
         return this.#store.close();
     }
     async #runReconciliation(signal) {
+        let failureReported = false;
         while (!signal.aborted) {
-            await this.reconcile(signal).catch(() => undefined);
-            await delay(RECONCILE_INTERVAL_MS, undefined, { signal }).catch(() => undefined);
+            const observedGeneration = this.#reconcileGeneration;
+            try {
+                await this.reconcile(signal);
+                failureReported = false;
+            }
+            catch (error) {
+                if (!signal.aborted && !failureReported) {
+                    failureReported = true;
+                    try {
+                        this.#onBackgroundReconcileError?.(error);
+                    }
+                    catch {
+                        // Diagnostics cannot control Peer Mesh reconciliation.
+                    }
+                }
+            }
+            await this.#waitForReconciliationTrigger(observedGeneration, signal).catch(() => undefined);
         }
     }
-    async #reconcile(signal) {
+    async #waitForReconciliationTrigger(observedGeneration, signal) {
+        if (this.#reconcileGeneration !== observedGeneration || signal.aborted)
+            return;
+        let wake;
+        const triggered = new Promise((resolve) => {
+            wake = resolve;
+            this.#reconcileWaiters.add(wake);
+        });
+        const timeout = setTimeout(wake, RECONCILE_INTERVAL_MS);
+        signal.addEventListener('abort', wake, { once: true });
+        if (this.#reconcileGeneration !== observedGeneration || signal.aborted)
+            wake();
+        try {
+            await triggered;
+        }
+        finally {
+            clearTimeout(timeout);
+            signal.removeEventListener('abort', wake);
+            this.#reconcileWaiters.delete(wake);
+        }
+    }
+    #triggerReconciliation() {
+        this.#reconcileGeneration += 1;
+        for (const wake of this.#reconcileWaiters)
+            wake();
+        this.#reconcileWaiters.clear();
+    }
+    async #reconcile(signal, excludedPeerId) {
         const lifetimeSignal = signal
             ? AbortSignal.any([signal, this.#lifetime.signal])
             : this.#lifetime.signal;
         lifetimeSignal.throwIfAborted();
         await this.#reconcileTransit();
-        await this.#refreshLocalRoute();
+        await this.#refreshLocalEvidence();
         const identity = this.#peer.identity();
         const stored = this.#store.read();
-        const memberships = stored.meshes.filter((state) => state.role === 'replica' && isActiveMembership(state, identity.peerId));
-        const pending = [];
+        const memberships = stored.meshes.filter((state) => !state.roster.roster.closed && state.roster.roster.members.includes(identity.peerId));
+        const pending = stored.pendingJoins
+            .filter(({ invitation }) => invitation.reachability.lease.peerId !== excludedPeerId)
+            .map((join) => ({ kind: 'join', join }));
         const gossipCursor = this.#gossipCursor;
         this.#gossipCursor = (this.#gossipCursor + 1) % PEER_MESH_MAX_MEMBERS;
         const now = this.#now();
+        const targetFor = (peerId) => {
+            const signed = latestReachability(stored.reachability, peerId, now, true);
+            if (signed)
+                return dialTarget(signed);
+            // A fresh Session Share can reconnect an existing member after all of
+            // its stored routes expired. Reuse that authenticated connection to
+            // exchange signed evidence; the connection itself grants no membership.
+            return this.#peer.isConnected(peerId)
+                ? { peerId, routeHints: [], coordinationRelays: [] }
+                : undefined;
+        };
         for (const [index, state] of memberships.entries()) {
-            const authorityRoute = stored.routes.find(({ route }) => route.peerId === state.authority.peerId);
-            const targets = [currentAuthorityTarget(state, stored.routes)];
-            const gossipRoutes = state.roster.roster.members
-                .filter((peerId) => peerId !== identity.peerId && peerId !== state.authority.peerId)
+            const meshId = state.roster.roster.meshId;
+            const desiredMembership = state.role === 'replica' ? state.desiredMembership : 'active';
+            const authority = state.role === 'replica' ? targetFor(state.roster.roster.authorityPeerId) : undefined;
+            if (authority && authority.peerId !== excludedPeerId) {
+                pending.push({
+                    kind: 'membership',
+                    meshId,
+                    target: authority,
+                    desiredMembership,
+                    roster: state.roster,
+                });
+            }
+            if (desiredMembership === 'left')
+                continue;
+            const rotatingTargets = state.roster.roster.members
+                .filter((peerId) => peerId !== identity.peerId &&
+                peerId !== excludedPeerId &&
+                (state.role === 'authority' || peerId !== state.roster.roster.authorityPeerId))
                 .flatMap((peerId) => {
-                const route = stored.routes.find((candidate) => candidate.route.peerId === peerId)?.route;
-                return route ? [route] : [];
+                const target = targetFor(peerId);
+                return target ? [target] : [];
             });
-            if (gossipRoutes.length > 0) {
-                targets.push(gossipRoutes[(gossipCursor + index) % gossipRoutes.length]);
-            }
+            if (rotatingTargets.length === 0)
+                continue;
             pending.push({
-                meshId: state.roster.roster.meshId,
-                targets,
-                authorityRouteExpired: authorityRoute !== undefined && authorityRoute.route.expiresAt <= now,
+                kind: 'membership',
+                meshId,
+                target: rotatingTargets[(gossipCursor + index) % rotatingTargets.length],
+                desiredMembership,
+                roster: state.roster,
             });
         }
         if (pending.length === 0)
@@ -541,14 +891,24 @@ class PeerMeshNodeImpl {
                 next += 1;
                 if (offset >= pending.length)
                     return;
-                const { meshId, targets, authorityRouteExpired } = pending[(start + offset) % pending.length];
+                const operation = pending[(start + offset) % pending.length];
                 try {
-                    await this.#syncTargets(meshId, targets, authorityRouteExpired, operationSignal);
+                    if (operation.kind === 'join') {
+                        await this.#resumePendingJoin(operation.join, operationSignal);
+                    }
+                    else if (operation.desiredMembership === 'left') {
+                        await this.#notifyLeave(operation.meshId, operation.target, operation.roster, operationSignal);
+                    }
+                    else {
+                        await this.#syncPeer(operation.meshId, operation.target, operationSignal);
+                    }
                 }
                 catch (error) {
                     if (lifetimeSignal.aborted)
                         lifetimeSignal.throwIfAborted();
-                    failures.push(error);
+                    if (operation.kind === 'join' || operation.desiredMembership === 'left') {
+                        failures.push(error);
+                    }
                     if (deadline.aborted)
                         return;
                 }
@@ -559,77 +919,63 @@ class PeerMeshNodeImpl {
         await this.#reconcileTransit();
         lifetimeSignal.throwIfAborted();
         if (failures.length > 0) {
-            throw new AggregateError(failures, 'Peer Mesh synchronization did not reach every membership');
+            throw new AggregateError(failures, 'Peer Mesh reconciliation did not reach every pending intent');
         }
     }
-    async #syncTargets(meshId, targets, authorityRouteExpired, signal) {
-        if (!authorityRouteExpired || targets.length === 1) {
-            try {
-                await this.#syncPeer(meshId, targets[0], signal);
-            }
-            catch (authorityFailure) {
-                const fallbackTargets = targets.slice(1);
-                if (fallbackTargets.length === 0)
-                    throw authorityFailure;
-                await Promise.any(fallbackTargets.map((target) => this.#syncPeer(meshId, target, signal)));
-            }
-            return;
-        }
-        const controllers = targets.map(() => new AbortController());
-        const authorityPeerId = targets[0].peerId;
-        const attempts = targets.map(async (target, index) => {
-            await this.#syncPeer(meshId, target, AbortSignal.any([signal, controllers[index].signal]));
-            if (index > 0 && !this.#hasFreshRoute(meshId, authorityPeerId)) {
-                throw new Error('Peer Mesh gossip did not recover the authority route');
-            }
-        });
+    async #notifyLeave(meshId, target, roster, signal) {
+        const stream = await this.#peer.connectMeshControl({
+            ...target,
+            directDeadlineMs: CONNECT_DEADLINE_MS,
+        }, signal);
         try {
-            await Promise.any(attempts);
+            const response = await exchangeControl(stream, { kind: 'leave', meshId, roster }, decodeLeaveResponse, signal);
+            if (response.kind === 'leave-rejected') {
+                throw new Error('Peer Mesh authority rejected the leave request');
+            }
+            await this.#applySync(meshId, response.roster, [], []);
         }
         finally {
-            for (const controller of controllers)
-                controller.abort();
-            await Promise.allSettled(attempts);
+            await stream.close().catch(() => undefined);
         }
     }
-    #hasFreshRoute(meshId, peerId) {
-        const stored = this.#store.read();
-        const mesh = findMesh(stored.meshes, meshId);
-        return Boolean(mesh &&
-            isActiveMembership(mesh, this.#peer.identity().peerId) &&
-            stored.routes.some(({ route }) => route.peerId === peerId && route.expiresAt > this.#now()));
-    }
     async #syncPeer(meshId, target, signal) {
-        for (let page = 0; page <= Math.ceil(PEER_MESH_MAX_MEMBERS / ROUTE_PAGE_SIZE); page += 1) {
-            await this.#refreshLocalRoute();
-            const stored = this.#store.read();
-            const state = findMesh(stored.meshes, meshId);
-            const localPeerId = this.#peer.identity().peerId;
-            if (!state || !isActiveMembership(state, localPeerId))
+        const localPeerId = this.#peer.identity().peerId;
+        const targetPeerId = target.peerId;
+        for (let page = 0; page <= PEER_MESH_MAX_MEMBERS; page += 1) {
+            if (!isActiveMeshMember(this.#store.read().meshes, meshId, localPeerId, targetPeerId))
                 return;
-            const route = stored.routes.find((candidate) => candidate.route.peerId === localPeerId);
-            if (!route)
-                throw new Error('Peer Mesh local route is unavailable');
-            const discovered = this.resolveRoutes(target.peerId);
+            const discovered = this.resolveRoutes(targetPeerId);
             const stream = await this.#peer.connectMeshControl({
-                peerId: target.peerId,
+                peerId: targetPeerId,
                 routeHints: mergeAddresses(discovered?.routeHints ?? [], target.routeHints),
                 coordinationRelays: mergeAddresses(discovered?.coordinationRelays ?? [], target.coordinationRelays),
                 transitRelayPeerIds: discovered?.transitRelayPeerIds,
                 directDeadlineMs: CONNECT_DEADLINE_MS,
             }, signal);
             try {
+                await this.#refreshLocalEvidence();
+                const stored = this.#store.read();
+                if (!isActiveMeshMember(stored.meshes, meshId, localPeerId, targetPeerId))
+                    return;
+                const state = findMesh(stored.meshes, meshId);
+                const reachability = latestReachability(stored.reachability, localPeerId, this.#now(), true);
+                const advertisement = findAdvertisement(stored.advertisements, meshId, localPeerId);
+                if (!reachability || !advertisement) {
+                    throw new Error('Peer Mesh local evidence is unavailable');
+                }
                 const response = await exchangeControl(stream, {
                     kind: 'sync',
                     meshId,
                     roster: state.roster,
-                    route,
-                    knownRoutes: routeSequences(stored.routes, state.roster, this.#now()),
+                    reachability,
+                    advertisement,
+                    knownReachability: reachabilitySummaries(stored.reachability, state.roster, this.#now()),
+                    knownAdvertisements: advertisementSummaries(stored.advertisements, state.roster),
                 }, decodeSyncResponse, signal);
                 if (response.kind === 'sync-rejected') {
                     throw new Error(`Peer Mesh synchronization was rejected: ${response.reason}`);
                 }
-                await this.#applySync(meshId, response.roster, response.routes);
+                await this.#applySync(meshId, response.roster, response.reachability, response.advertisements);
                 if (!response.more)
                     return;
             }
@@ -639,104 +985,191 @@ class PeerMeshNodeImpl {
         }
         throw new Error('Peer Mesh synchronization exceeded its page bound');
     }
-    #refreshLocalRoute() {
-        this.#routeRefreshTask ??= this.#refreshLocalRouteOnce().finally(() => {
-            this.#routeRefreshTask = undefined;
+    #refreshLocalEvidence() {
+        this.#evidenceRefreshTask ??= this.#refreshLocalEvidenceOnce().finally(() => {
+            this.#evidenceRefreshTask = undefined;
         });
-        return this.#routeRefreshTask;
+        return this.#evidenceRefreshTask;
     }
-    async #refreshLocalRouteOnce() {
+    async #refreshLocalEvidenceOnce() {
+        const reachability = await this.#reachability.refresh();
         const identity = this.#peer.identity();
         const now = this.#now();
         return this.#store.mutate(async (current) => {
-            if (!current.meshes.some((state) => isActiveMembership(state, identity.peerId))) {
+            const active = current.meshes.filter((state) => isActiveMembership(state, identity.peerId));
+            if (active.length === 0) {
                 return { state: current, result: undefined };
             }
-            const existing = current.routes
-                .filter(({ route }) => route.peerId === identity.peerId)
-                .sort((left, right) => right.route.sequence - left.route.sequence)[0];
-            if (existing &&
-                existing.route.expiresAt > now + ROUTE_REFRESH_LEAD_MS &&
-                sameAddresses(existing.route.routeHints, identity.listenAddresses) &&
-                sameAddresses(existing.route.coordinationRelays, identity.coordinationRelays) &&
-                existing.route.endpointKind === this.#endpointKind &&
-                existing.route.displayName === (current.displayName ?? undefined) &&
-                existing.route.transitMeshId === current.transitMeshId) {
-                return { state: current, result: existing };
-            }
-            const route = await this.#signLocalRoute(current);
+            const advertisements = await this.#localAdvertisementsFor(current);
             return {
-                state: { ...current, routes: mergeRoutes(current.routes, [route], now) },
-                result: route,
+                state: {
+                    ...current,
+                    reachability: mergeReachability(current.reachability, [reachability], now),
+                    advertisements: mergeAdvertisements(current.advertisements, advertisements),
+                },
+                result: Object.freeze({
+                    reachability,
+                    advertisements: Object.freeze(advertisements),
+                }),
             };
         });
     }
-    async #signLocalRoute(stored = this.#store.read()) {
+    async #localAdvertisementsFor(stored) {
         const identity = this.#peer.identity();
-        const maxSequence = stored.routes
-            .filter(({ route }) => route.peerId === identity.peerId)
-            .reduce((maximum, { route }) => Math.max(maximum, route.sequence), 0);
-        const route = canonicalPeerMeshRouteRecord({
+        const advertisements = [];
+        for (const state of stored.meshes) {
+            if (!isActiveMembership(state, identity.peerId))
+                continue;
+            const meshId = state.roster.roster.meshId;
+            const existing = findAdvertisement(stored.advertisements, meshId, identity.peerId);
+            advertisements.push(isCurrentLocalAdvertisement(existing, meshId, identity.peerId, stored, this.#endpointKind)
+                ? existing
+                : await this.#signLocalAdvertisement(meshId, stored));
+        }
+        return Object.freeze(advertisements);
+    }
+    async #signLocalAdvertisement(meshId, stored = this.#store.read()) {
+        const identity = this.#peer.identity();
+        const maxRevision = stored.advertisements
+            .filter(({ advertisement }) => advertisement.meshId === meshId && advertisement.peerId === identity.peerId)
+            .reduce((maximum, { advertisement }) => Math.max(maximum, advertisement.revision), 0);
+        const advertisement = canonicalPeerMeshMemberAdvertisement({
             version: 1,
+            meshId,
             peerId: identity.peerId,
-            sequence: maxSequence + 1,
-            expiresAt: this.#now() + ROUTE_TTL_MS,
-            routeHints: identity.listenAddresses,
-            coordinationRelays: identity.coordinationRelays,
+            revision: maxRevision + 1,
             ...(this.#endpointKind ? { endpointKind: this.#endpointKind } : {}),
             ...(stored.displayName ? { displayName: stored.displayName } : {}),
-            ...(stored.transitMeshId ? { transitMeshId: stored.transitMeshId } : {}),
+            offersTransit: stored.transitMeshId === meshId,
         });
-        const proof = await this.#peer.signIdentity(peerMeshRouteRecordSigningBytes(route));
-        const signed = decodeSignedPeerMeshRouteRecord({
-            route,
+        const proof = await this.#peer.signIdentity(peerMeshMemberAdvertisementSigningBytes(advertisement));
+        const signed = decodeSignedPeerMeshMemberAdvertisement({
+            advertisement,
             publicKey: proof.publicKey.toString('base64url'),
             signature: proof.signature.toString('base64url'),
         });
-        this.#assertRouteSignature(signed);
+        this.#assertAdvertisementSignature(signed);
+        return signed;
+    }
+    #validateReachabilityPage(values, roster, allowExpired) {
+        if (values.length > EVIDENCE_PAGE_SIZE) {
+            throw new Error('Too many Peer Mesh reachability leases');
+        }
+        const reachability = values.map((value) => {
+            const signed = decodeSignedPeerReachabilityLease(value);
+            if (!roster.roster.members.includes(signed.lease.peerId)) {
+                throw new Error('Peer Mesh reachability is outside the active roster');
+            }
+            return this.#authenticateReachability(signed, signed.lease.peerId, allowExpired);
+        });
+        if (new Set(reachability.map(({ lease }) => lease.peerId)).size !== reachability.length) {
+            throw new Error('Duplicate Peer Mesh reachability leases');
+        }
+        return Object.freeze(reachability);
+    }
+    #authenticateReachability(value, expectedPeerId, allowExpired = false) {
+        const signed = verifySignedPeerReachabilityLease({
+            value,
+            expectedPeerId,
+            now: this.#now(),
+            verifyIdentity: this.#peer.verifyIdentity.bind(this.#peer),
+            ...(allowExpired ? { allowExpired: true } : {}),
+        });
+        if (allowExpired &&
+            signed.lease.expiresAt <= this.#now() - PEER_REACHABILITY_RECOVERY_HORIZON_MS) {
+            throw new Error('Peer Mesh reachability is outside the recovery horizon');
+        }
         return signed;
     }
-    #validateRoutes(values, roster, now) {
-        if (values.length > PEER_MESH_MAX_MEMBERS)
-            throw new Error('Too many Peer Mesh routes');
-        const routes = values.map(decodeSignedPeerMeshRouteRecord);
-        if (new Set(routes.map(({ route }) => route.peerId)).size !== routes.length) {
-            throw new Error('Duplicate Peer Mesh routes');
+    #validateAdvertisementPage(values, roster) {
+        if (values.length > EVIDENCE_PAGE_SIZE) {
+            throw new Error('Too many Peer Mesh member advertisements');
         }
-        for (const signed of routes) {
-            if (!roster.roster.members.includes(signed.route.peerId)) {
-                throw new Error('Peer Mesh route is outside the active roster or lifetime');
+        const advertisements = values.map((value) => {
+            const signed = decodeSignedPeerMeshMemberAdvertisement(value);
+            if (signed.advertisement.meshId !== roster.roster.meshId ||
+                !roster.roster.members.includes(signed.advertisement.peerId)) {
+                throw new Error('Peer Mesh member advertisement is outside the active roster');
             }
-            this.#validateRemoteRoute(signed, signed.route.peerId, now);
+            this.#assertAdvertisementSignature(signed);
+            return signed;
+        });
+        const keys = advertisements.map(({ advertisement }) => advertisement.peerId);
+        if (new Set(keys).size !== keys.length) {
+            throw new Error('Duplicate Peer Mesh member advertisements');
         }
-        return Object.freeze(routes);
-    }
-    #validateRemoteRoute(value, expectedPeerId, now = this.#now()) {
-        const signed = decodeSignedPeerMeshRouteRecord(value);
-        if (signed.route.peerId !== expectedPeerId ||
-            signed.route.expiresAt <= now ||
-            signed.route.expiresAt > now + ROUTE_MAX_FUTURE_MS) {
-            throw new Error('Peer Mesh route is outside the authenticated peer or lifetime');
+        return Object.freeze(advertisements);
+    }
+    #validateAdvertisementForPeer(value, meshId, peerId) {
+        const signed = decodeSignedPeerMeshMemberAdvertisement(value);
+        if (signed.advertisement.meshId !== meshId || signed.advertisement.peerId !== peerId) {
+            throw new Error('Peer Mesh member advertisement belongs to a different member');
         }
-        this.#assertRouteSignature(signed);
+        this.#assertAdvertisementSignature(signed);
         return signed;
     }
-    #assertRouteSignature(signedValue) {
-        const signed = decodeSignedPeerMeshRouteRecord(signedValue);
-        const valid = this.#peer.verifyIdentity(signed.route.peerId, peerMeshRouteRecordSigningBytes(signed.route), {
+    #assertAdvertisementSignature(signedValue) {
+        const signed = decodeSignedPeerMeshMemberAdvertisement(signedValue);
+        const valid = this.#peer.verifyIdentity(signed.advertisement.peerId, peerMeshMemberAdvertisementSigningBytes(signed.advertisement), {
             publicKey: Buffer.from(signed.publicKey, 'base64url'),
             signature: Buffer.from(signed.signature, 'base64url'),
         });
         if (!valid)
-            throw new Error('Peer Mesh route signature is invalid');
+            throw new Error('Peer Mesh member advertisement signature is invalid');
+    }
+    #recordReachabilityReceipt(signed) {
+        this.#recordReachabilityReceipts([signed]);
     }
-    async #applySync(meshId, rosterValue, routeValues) {
+    #recordReachabilityReceipts(values) {
+        const retained = this.#retainedReachabilityReceiptPeerIds();
+        for (const peerId of this.#reachabilityReceipts.keys()) {
+            if (!retained.has(peerId))
+                this.#reachabilityReceipts.delete(peerId);
+        }
+        for (const signed of values) {
+            if (!retained.has(signed.lease.peerId))
+                continue;
+            const previous = this.#reachabilityReceipts.get(signed.lease.peerId);
+            if (previous && previous.revision > signed.lease.revision)
+                continue;
+            if (previous &&
+                previous.revision === signed.lease.revision &&
+                previous.signature !== signed.signature) {
+                continue;
+            }
+            this.#reachabilityReceipts.set(signed.lease.peerId, peerReachabilityLeaseReceipt({
+                signed,
+                wallNow: this.#now(),
+                monotonicNow: this.#monotonicNow(),
+                ...(previous ? { previous } : {}),
+            }));
+        }
+    }
+    #retainedReachabilityReceiptPeerIds() {
+        const stored = this.#store.read();
+        const localPeerId = this.#peer.identity().peerId;
+        const retained = new Set();
+        for (const state of stored.meshes) {
+            if (!isActiveMembership(state, localPeerId))
+                continue;
+            for (const peerId of state.roster.roster.members) {
+                if (peerId !== localPeerId)
+                    retained.add(peerId);
+            }
+        }
+        return retained;
+    }
+    #isReachabilityCurrent(signed) {
+        return isPeerReachabilityLeaseCurrent(signed, this.#reachabilityReceipts.get(signed.lease.peerId), this.#monotonicNow());
+    }
+    async #applySync(meshId, rosterValue, reachabilityValues, advertisementValues) {
         const roster = decodeSignedPeerMeshRoster(rosterValue);
         if (roster.roster.meshId !== meshId)
             throw new Error('Peer Mesh synchronization changed Mesh');
-        const routes = this.#validateRoutes(routeValues, roster, this.#now());
+        const reachability = this.#validateReachabilityPage(reachabilityValues, roster, true);
+        const advertisements = this.#validateAdvertisementPage(advertisementValues, roster);
         const localPeerId = this.#peer.identity().peerId;
-        await this.#store.mutate((current) => {
+        const accepted = await this.#store.mutate((current) => {
             const state = findMesh(current.meshes, meshId);
             if (!state || state.roster.authorityPublicKey !== roster.authorityPublicKey) {
                 throw new Error('Peer Mesh synchronization has the wrong authority');
@@ -750,14 +1183,19 @@ class PeerMeshNodeImpl {
                 state: {
                     ...current,
                     meshes: replaceMesh(current.meshes, next),
-                    routes: nextRoster.roster.closed || !nextRoster.roster.members.includes(localPeerId)
-                        ? current.routes
-                        : mergeRoutes(current.routes, routes, this.#now()),
+                    reachability: !isActiveMembership(next, localPeerId)
+                        ? current.reachability
+                        : mergeReachability(current.reachability, reachability, this.#now()),
+                    advertisements: !isActiveMembership(next, localPeerId)
+                        ? current.advertisements
+                        : mergeAdvertisements(current.advertisements, advertisements),
                 },
-                result: undefined,
+                result: isActiveMembership(next, localPeerId),
             };
         });
-        await this.#refreshLocalRoute();
+        if (accepted)
+            this.#recordReachabilityReceipts(reachability);
+        await this.#refreshLocalEvidence();
         await this.#reconcileTransit();
     }
     #assertOpen() {
@@ -765,7 +1203,7 @@ class PeerMeshNodeImpl {
             throw new Error('Peer Mesh node is closed');
     }
     async #updateAuthorityRoster(meshId, closedIsSuccess, update) {
-        await this.#store.mutate((current) => {
+        const announcement = await this.#store.mutate((current) => {
             const state = requireAuthority(current.meshes, meshId);
             if (state.roster.roster.closed) {
                 if (closedIsSuccess) {
@@ -780,6 +1218,7 @@ class PeerMeshNodeImpl {
             const roster = signPeerMeshRoster({
                 version: 1,
                 meshId: state.roster.roster.meshId,
+                authorityPeerId: state.roster.roster.authorityPeerId,
                 revision: state.roster.roster.revision + 1,
                 members: next.members,
                 closed: next.closed,
@@ -796,13 +1235,52 @@ class PeerMeshNodeImpl {
             };
             return {
                 state: { ...current, meshes: replaceMesh(current.meshes, updated) },
-                result: undefined,
+                result: {
+                    roster,
+                    targets: rosterAnnouncementTargets(state.roster.roster.members, current.reachability, this.#peer.identity().peerId, this.#now()),
+                },
             };
         });
-        await this.#refreshLocalRoute();
-        await this.#reconcileTransit();
+        try {
+            await this.#reconcileTransit();
+        }
+        finally {
+            if (announcement) {
+                this.#scheduleRosterAnnouncement(announcement.roster, announcement.targets);
+            }
+            this.#scheduleMaintenance();
+        }
         const stored = this.#store.read();
-        return peerMeshStatus(findMesh(stored.meshes, meshId), this.#peer.identity(), this.#endpointKind, stored.routes);
+        return peerMeshStatus(findMesh(stored.meshes, meshId), this.#peer.identity(), this.#endpointKind, stored.reachability, stored.advertisements, this.#now(), (peerId) => this.#peer.isConnected(peerId), (peerId) => this.resolveRoutes(peerId), (signed) => this.#isReachabilityCurrent(signed));
+    }
+    #scheduleRosterAnnouncement(roster, targets) {
+        if (targets.length === 0 || this.#lifetime.signal.aborted)
+            return;
+        const signal = this.#lifetime.signal;
+        void Promise.allSettled(targets.map(async (target) => {
+            const stream = await this.#peer.connectMeshControl({
+                ...dialTarget(target),
+                directDeadlineMs: CONNECT_DEADLINE_MS,
+            }, signal);
+            try {
+                const response = await exchangeControl(stream, {
+                    kind: 'announce-roster',
+                    meshId: roster.roster.meshId,
+                    roster,
+                }, decodeAnnounceRosterResponse, signal);
+                if (response.kind === 'roster-rejected') {
+                    throw new Error('Peer Mesh roster announcement was rejected');
+                }
+            }
+            finally {
+                await stream.close().catch(() => undefined);
+            }
+        }));
+    }
+    #scheduleMaintenance() {
+        this.#triggerReconciliation();
+        void this.#refreshLocalEvidence().catch(() => undefined);
+        void this.#reconcileTransit().catch(() => undefined);
     }
     #acceptIncoming(stream) {
         let peerStreams = 0;
@@ -838,19 +1316,21 @@ class PeerMeshNodeImpl {
             const request = decodeControlRequest(await readFrame(stream));
             let response;
             if (request.kind === 'redeem-invitation') {
-                await this.#refreshLocalRoute();
-                response = await this.#redeem(request, stream.peerId, this.#validateRemoteRoute(request.route, stream.peerId));
+                await this.#refreshLocalEvidence();
+                response = await this.#redeem(request, stream.peerId, this.#authenticateReachability(request.reachability, stream.peerId), this.#validateAdvertisementForPeer(request.advertisement, request.meshId, stream.peerId));
             }
             else if (request.kind === 'sync') {
                 response = await this.#sync(request, stream.peerId);
             }
+            else if (request.kind === 'leave') {
+                response = await this.#leave(request, stream.peerId);
+            }
             else {
-                response = await this.#leave(request.meshId, stream.peerId);
+                response = await this.#observeRoster(request);
             }
-            await this.#refreshLocalRoute();
-            await this.#reconcileTransit();
             await writeFrame(stream, response);
             await stream.close();
+            this.#scheduleMaintenance();
         }
         catch {
             stream.abort();
@@ -859,9 +1339,31 @@ class PeerMeshNodeImpl {
             clearTimeout(deadline);
         }
     }
-    #redeem(request, remotePeerId, remoteRoute) {
+    async #observeRoster(request) {
+        const response = await this.#store.mutate((current) => {
+            const state = findMesh(current.meshes, request.meshId);
+            if (!state || state.roster.authorityPublicKey !== request.roster.authorityPublicKey) {
+                return {
+                    state: current,
+                    result: { kind: 'roster-rejected', reason: 'unknown' },
+                };
+            }
+            const roster = selectRoster(state.roster, request.roster);
+            return {
+                state: {
+                    ...current,
+                    meshes: replaceMesh(current.meshes, { ...state, roster }),
+                },
+                result: { kind: 'roster-observed' },
+            };
+        });
+        if (response.kind === 'roster-observed')
+            await this.#reconcileTransit();
+        return response;
+    }
+    async #redeem(request, remotePeerId, remoteReachability, remoteAdvertisement) {
         const now = this.#now();
-        return this.#store.mutate((current) => {
+        const response = await this.#store.mutate((current) => {
             const state = findMesh(current.meshes, request.meshId);
             if (!state || state.role !== 'authority')
                 return { state: current, result: rejected('invalid') };
@@ -874,16 +1376,15 @@ class PeerMeshNodeImpl {
                     !state.roster.roster.members.includes(remotePeerId)) {
                     return { state: current, result: rejected('invalid') };
                 }
-                const updated = {
-                    ...state,
-                };
-                const routes = mergeAuthenticatedRoute(current.routes, remoteRoute, now);
+                const reachability = mergeReachability(current.reachability, [remoteReachability], now);
+                const advertisements = mergeAdvertisements(current.advertisements, [remoteAdvertisement]);
+                const evidence = initialEvidence(state, reachability, advertisements, this.#peer.identity().peerId, now);
                 return {
-                    state: { ...current, meshes: replaceMesh(current.meshes, updated), routes },
+                    state: { ...current, reachability, advertisements },
                     result: {
                         kind: 'invitation-redeemed',
-                        roster: updated.roster,
-                        routes: responseRoutes(updated, routes, [{ peerId: remotePeerId, sequence: Number.MAX_SAFE_INTEGER }], now).routes,
+                        roster: state.roster,
+                        ...evidence,
                     },
                 };
             }
@@ -925,30 +1426,14 @@ class PeerMeshNodeImpl {
                     result: rejected('full'),
                 };
             }
-            if (state.roster.roster.members.includes(remotePeerId)) {
-                const updated = {
-                    ...state,
-                    invitations: [
-                        ...remaining.filter((record) => record.status === 'pending' || record.peerId !== remotePeerId),
-                        redeemedInvitation(invitation, remotePeerId),
-                    ],
-                };
-                const routes = mergeAuthenticatedRoute(current.routes, remoteRoute, now);
-                return {
-                    state: { ...current, meshes: replaceMesh(current.meshes, updated), routes },
-                    result: {
-                        kind: 'invitation-redeemed',
-                        roster: state.roster,
-                        routes: responseRoutes(updated, routes, [{ peerId: remotePeerId, sequence: Number.MAX_SAFE_INTEGER }], now).routes,
-                    },
-                };
-            }
-            const members = [...state.roster.roster.members, remotePeerId].sort();
-            const roster = signPeerMeshRoster({
-                ...state.roster.roster,
-                revision: state.roster.roster.revision + 1,
-                members,
-            }, authorityKeys(state));
+            const existingMember = state.roster.roster.members.includes(remotePeerId);
+            const roster = existingMember
+                ? state.roster
+                : signPeerMeshRoster({
+                    ...state.roster.roster,
+                    revision: state.roster.roster.revision + 1,
+                    members: [...state.roster.roster.members, remotePeerId].sort(),
+                }, authorityKeys(state));
             const updated = {
                 ...state,
                 roster,
@@ -957,31 +1442,48 @@ class PeerMeshNodeImpl {
                     redeemedInvitation(invitation, remotePeerId),
                 ],
             };
-            const routes = mergeRoutes(current.routes, [remoteRoute], now);
+            const reachability = mergeReachability(current.reachability, [remoteReachability], now);
+            const advertisements = mergeAdvertisements(current.advertisements, [remoteAdvertisement]);
+            const evidence = initialEvidence(updated, reachability, advertisements, this.#peer.identity().peerId, now);
             return {
-                state: { ...current, meshes: replaceMesh(current.meshes, updated), routes },
+                state: {
+                    ...current,
+                    meshes: replaceMesh(current.meshes, updated),
+                    reachability,
+                    advertisements,
+                },
                 result: {
                     kind: 'invitation-redeemed',
                     roster,
-                    routes: responseRoutes(updated, routes, [{ peerId: remotePeerId, sequence: Number.MAX_SAFE_INTEGER }], now).routes,
+                    ...evidence,
                 },
             };
         });
+        if (response.kind === 'invitation-redeemed') {
+            this.#recordReachabilityReceipt(remoteReachability);
+            const stored = this.#store.read();
+            const state = findMesh(stored.meshes, request.meshId);
+            if (state) {
+                this.#scheduleRosterAnnouncement(state.roster, rosterAnnouncementTargets(state.roster.roster.members, stored.reachability, this.#peer.identity().peerId, this.#now()).filter(({ lease }) => lease.peerId !== remotePeerId));
+            }
+        }
+        return response;
     }
-    #leave(meshId, remotePeerId) {
-        return this.#store.mutate((current) => {
-            const state = findMesh(current.meshes, meshId);
+    async #leave(request, remotePeerId) {
+        const response = await this.#store.mutate((current) => {
+            const state = findMesh(current.meshes, request.meshId);
             if (!state ||
                 state.role !== 'authority' ||
-                state.roster.roster.closed ||
-                (!state.roster.roster.members.includes(remotePeerId) &&
-                    !state.invitations.some((invitation) => invitation.status === 'redeemed' && invitation.peerId === remotePeerId))) {
+                request.roster.roster.meshId !== request.meshId ||
+                request.roster.authorityPublicKey !== state.roster.authorityPublicKey ||
+                request.roster.roster.revision > state.roster.roster.revision ||
+                !request.roster.roster.members.includes(remotePeerId)) {
                 return {
                     state: current,
                     result: { kind: 'leave-rejected', reason: 'unknown' },
                 };
             }
-            if (!state.roster.roster.members.includes(remotePeerId)) {
+            if (state.roster.roster.closed || !state.roster.roster.members.includes(remotePeerId)) {
                 return {
                     state: current,
                     result: { kind: 'left', roster: state.roster },
@@ -1001,12 +1503,22 @@ class PeerMeshNodeImpl {
                 result: { kind: 'left', roster },
             };
         });
+        if (response.kind === 'left') {
+            await this.#reconcileTransit();
+            const stored = this.#store.read();
+            const state = findMesh(stored.meshes, request.meshId);
+            if (state) {
+                this.#scheduleRosterAnnouncement(state.roster, rosterAnnouncementTargets(state.roster.roster.members, stored.reachability, this.#peer.identity().peerId, this.#now()));
+            }
+        }
+        return response;
     }
     async #sync(request, remotePeerId) {
-        const remoteRoute = this.#validateRemoteRoute(request.route, remotePeerId);
-        await this.#refreshLocalRoute();
+        const remoteReachability = this.#authenticateReachability(request.reachability, remotePeerId);
+        const remoteAdvertisement = this.#validateAdvertisementForPeer(request.advertisement, request.meshId, remotePeerId);
+        await this.#refreshLocalEvidence();
         const incomingRoster = decodeSignedPeerMeshRoster(request.roster);
-        return this.#store.mutate((current) => {
+        const response = await this.#store.mutate((current) => {
             const state = findMesh(current.meshes, request.meshId);
             if (!state || state.roster.authorityPublicKey !== incomingRoster.authorityPublicKey) {
                 return {
@@ -1016,77 +1528,132 @@ class PeerMeshNodeImpl {
             }
             const roster = selectRoster(state.roster, incomingRoster);
             const localPeerId = this.#peer.identity().peerId;
-            const localMember = !roster.roster.closed && roster.roster.members.includes(localPeerId);
-            const remoteMember = !roster.roster.closed && roster.roster.members.includes(remotePeerId);
             const updated = {
                 ...state,
                 roster,
             };
-            const routes = localMember && remoteMember
-                ? mergeRoutes(current.routes, [remoteRoute], this.#now())
-                : current.routes;
+            const localMember = isActiveMembership(updated, localPeerId);
+            const remoteMember = !roster.roster.closed && roster.roster.members.includes(remotePeerId);
+            const reachability = localMember && remoteMember
+                ? mergeReachability(current.reachability, [remoteReachability], this.#now())
+                : current.reachability;
+            const advertisements = localMember && remoteMember
+                ? mergeAdvertisements(current.advertisements, [remoteAdvertisement])
+                : current.advertisements;
             if (!localMember || !remoteMember) {
                 return {
-                    state: { ...current, meshes: replaceMesh(current.meshes, updated), routes },
+                    state: {
+                        ...current,
+                        meshes: replaceMesh(current.meshes, updated),
+                        reachability,
+                        advertisements,
+                    },
                     result: {
                         kind: 'sync-result',
                         roster,
-                        routes: [],
+                        reachability: [],
+                        advertisements: [],
                         more: false,
                     },
                 };
             }
-            const page = responseRoutes(updated, routes, request.knownRoutes, this.#now());
+            const page = responseEvidence(updated, reachability, advertisements, request.knownReachability, request.knownAdvertisements, this.#now());
             return {
-                state: { ...current, meshes: replaceMesh(current.meshes, updated), routes },
+                state: {
+                    ...current,
+                    meshes: replaceMesh(current.meshes, updated),
+                    reachability,
+                    advertisements,
+                },
                 result: {
                     kind: 'sync-result',
                     roster,
-                    routes: page.routes,
-                    more: page.more,
+                    ...page,
                 },
             };
         });
+        if (response.kind === 'sync-result') {
+            const localPeerId = this.#peer.identity().peerId;
+            if (!response.roster.roster.closed &&
+                response.roster.roster.members.includes(localPeerId) &&
+                response.roster.roster.members.includes(remotePeerId)) {
+                this.#recordReachabilityReceipt(remoteReachability);
+            }
+            await this.#reconcileTransit();
+        }
+        return response;
+    }
+    #reconcileTransit() {
+        const task = this.#transitTail.then(() => this.#applyTransitSnapshot());
+        this.#transitTail = task.then(() => undefined, () => undefined);
+        return task;
     }
-    async #reconcileTransit() {
+    async #applyTransitSnapshot() {
         const stored = this.#store.read();
         const localPeerId = this.#peer.identity().peerId;
         const now = this.#now();
         const selected = stored.meshes.find((mesh) => mesh.roster.roster.meshId === stored.transitMeshId && isActiveMembership(mesh, localPeerId));
-        const eligibleRelays = stored.routes
-            .filter(({ route }) => {
-            if (route.peerId === localPeerId ||
-                route.expiresAt <= now ||
-                route.transitMeshId === undefined ||
-                route.routeHints.length + route.coordinationRelays.length === 0) {
-                return false;
-            }
-            return isActiveMeshMember(stored.meshes, route.transitMeshId, localPeerId, route.peerId);
-        })
-            .sort((left, right) => left.route.peerId.localeCompare(right.route.peerId));
+        const eligibleRelays = eligibleTransitEvidence(stored, localPeerId, now, (signed) => this.#isReachabilityCurrent(signed));
         const relayCandidates = transitRelayCandidates(eligibleRelays);
+        const approvedRelayPeerIds = [
+            ...new Set(stored.meshes
+                .filter((mesh) => isActiveMembership(mesh, localPeerId))
+                .flatMap((mesh) => mesh.roster.roster.members)
+                .filter((peerId) => peerId !== localPeerId)),
+        ].sort();
         await this.#peer.configureTransit({
             allowedPeerIds: selected
                 ? selected.roster.roster.members.filter((peerId) => peerId !== localPeerId)
                 : [],
+            approvedRelayPeerIds,
             relayCandidates,
         });
     }
 }
-function transitRelayCandidates(routes) {
+function sameResolvedRoutes(left, right) {
+    return (left.state === right.state &&
+        sameStringValues(left.routeHints, right.routeHints) &&
+        sameStringValues(left.coordinationRelays, right.coordinationRelays) &&
+        sameStringValues(left.transitRelayPeerIds, right.transitRelayPeerIds));
+}
+function sameStringValues(left, right) {
+    return left.length === right.length && left.every((value, index) => value === right[index]);
+}
+function eligibleTransitEvidence(stored, localPeerId, now, isCurrent) {
+    const evidence = new Map();
+    for (const { advertisement } of stored.advertisements) {
+        if (advertisement.peerId === localPeerId ||
+            !advertisement.offersTransit ||
+            !isActiveMeshMember(stored.meshes, advertisement.meshId, localPeerId, advertisement.peerId)) {
+            continue;
+        }
+        const lease = latestReachability(stored.reachability, advertisement.peerId, now, true);
+        if (!lease ||
+            !isCurrent(lease) ||
+            lease.lease.directRoutes.length + lease.lease.coordinationRoutes.length === 0) {
+            continue;
+        }
+        evidence.set(advertisement.peerId, {
+            meshId: advertisement.meshId,
+            lease,
+        });
+    }
+    return Object.freeze([...evidence.values()].sort((left, right) => left.lease.lease.peerId.localeCompare(right.lease.lease.peerId)));
+}
+function transitRelayCandidates(evidence) {
     let remaining = PEER_MESH_MAX_TRANSIT_RELAY_ADDRESSES;
     const candidates = [];
-    for (const { route } of routes) {
+    for (const { lease: { lease }, } of evidence) {
         if (remaining === 0)
             break;
         const routeHints = [
-            ...new Set(route.routeHints.filter((address) => isBaseRelayFor(address, route.peerId))),
+            ...new Set(lease.directRoutes.filter((address) => isBaseRelayFor(address, lease.peerId))),
         ].slice(0, Math.min(PEER_MESH_MAX_TRANSIT_ADDRESSES_PER_RELAY, remaining));
-        const coordinationRelays = [...new Set(route.coordinationRelays)].slice(0, Math.min(PEER_MESH_MAX_TRANSIT_ADDRESSES_PER_RELAY - routeHints.length, remaining - routeHints.length));
+        const coordinationRelays = [...new Set(lease.coordinationRoutes)].slice(0, Math.min(PEER_MESH_MAX_TRANSIT_ADDRESSES_PER_RELAY - routeHints.length, remaining - routeHints.length));
         if (routeHints.length + coordinationRelays.length === 0)
             continue;
         candidates.push(Object.freeze({
-            peerId: route.peerId,
+            peerId: lease.peerId,
             addresses: Object.freeze(routeHints),
             coordinationRelays: Object.freeze(coordinationRelays),
         }));
@@ -1107,12 +1674,12 @@ function isActiveMeshMember(meshes, meshId, localPeerId, peerId) {
         isActiveMembership(mesh, localPeerId) &&
         mesh.roster.roster.members.includes(peerId));
 }
-function peerMeshStatus(state, identity, endpointKind, routes = [], now = Date.now()) {
-    const localDisplayName = routes.find(({ route }) => route.peerId === identity.peerId)?.route
-        .displayName;
+function peerMeshStatus(state, identity, endpointKind, reachability, advertisements, now, isConnected, resolveRoutes, isCurrent) {
+    const meshId = state.roster.roster.meshId;
+    const localAdvertisement = findAdvertisement(advertisements, meshId, identity.peerId);
     return Object.freeze({
         role: state.role === 'authority' ? 'authority' : 'member',
-        authority: state.role === 'authority' ? authorityTarget(identity) : state.authority,
+        authorityPeerId: state.roster.roster.authorityPeerId,
         roster: state.roster,
         pendingInvitationCount: state.role === 'authority'
             ? state.invitations.filter((invitation) => invitation.status === 'pending' && invitation.expiresAt > now).length
@@ -1122,37 +1689,43 @@ function peerMeshStatus(state, identity, endpointKind, routes = [], now = Date.n
                 return Object.freeze({
                     peerId,
                     ...(endpointKind ? { endpointKind } : {}),
-                    ...(localDisplayName ? { displayName: localDisplayName } : {}),
+                    ...(localAdvertisement?.advertisement.displayName
+                        ? { displayName: localAdvertisement.advertisement.displayName }
+                        : {}),
                     state: 'local',
                 });
             }
-            const route = routes.find((candidate) => candidate.route.peerId === peerId)?.route;
-            if (!route)
-                return Object.freeze({ peerId, state: 'unknown' });
-            if (route.expiresAt <= now) {
-                return Object.freeze({
-                    peerId,
-                    ...(route.endpointKind ? { endpointKind: route.endpointKind } : {}),
-                    ...(route.displayName ? { displayName: route.displayName } : {}),
-                    state: 'stale',
-                    expiresAt: route.expiresAt,
-                });
-            }
+            const advertisement = findAdvertisement(advertisements, meshId, peerId)?.advertisement;
+            const signed = latestReachability(reachability, peerId, now, true);
+            const lease = signed?.lease;
+            const resolution = resolveRoutes(peerId);
+            const current = Boolean(signed && isCurrent(signed));
+            const memberState = isConnected(peerId)
+                ? 'reachable'
+                : resolution.state === 'exhausted'
+                    ? 'needs_repair'
+                    : resolution.state === 'recovering'
+                        ? signed
+                            ? 'reconnecting'
+                            : 'connecting'
+                        : current
+                            ? 'connecting'
+                            : 'reconnecting';
             return Object.freeze({
                 peerId,
-                ...(route.endpointKind ? { endpointKind: route.endpointKind } : {}),
-                ...(route.displayName ? { displayName: route.displayName } : {}),
-                state: route.routeHints.length > 0
-                    ? 'route_available'
-                    : 'coordination_only',
-                expiresAt: route.expiresAt,
+                ...(advertisement?.endpointKind ? { endpointKind: advertisement.endpointKind } : {}),
+                ...(advertisement?.displayName ? { displayName: advertisement.displayName } : {}),
+                state: memberState,
+                ...(lease ? { expiresAt: lease.expiresAt } : {}),
             });
         })),
     });
 }
-function currentAuthorityTarget(state, routes) {
-    const learned = routes.find(({ route }) => route.peerId === state.authority.peerId)?.route;
-    return learned ? mergeTargets(learned, state.authority) : state.authority;
+function rosterAnnouncementTargets(memberPeerIds, reachability, localPeerId, now) {
+    const members = new Set(memberPeerIds);
+    return Object.freeze(reachability.filter((signed) => signed.lease.peerId !== localPeerId &&
+        members.has(signed.lease.peerId) &&
+        usableHistoricalReachability(signed, now)));
 }
 function requireAuthority(states, meshId) {
     const state = findMesh(states, meshId);
@@ -1176,32 +1749,31 @@ function redeemedInvitation(invitation, peerId) {
         peerId,
     };
 }
-function authorityTarget(identity) {
-    return Object.freeze({
-        peerId: identity.peerId,
-        routeHints: identity.listenAddresses,
-        coordinationRelays: identity.coordinationRelays,
-    });
-}
-function assertMeshCapacity(states, localPeerId) {
-    if (states.filter((state) => isActiveMembership(state, localPeerId)).length >= PEER_MESH_MAX_MESHES) {
+function assertMeshCapacity(states, localPeerId, pendingJoinCount = 0) {
+    if (states.filter((state) => !isRetired(state, localPeerId)).length + pendingJoinCount >=
+        PEER_MESH_MAX_MESHES) {
         throw new Error('This peer belongs to too many Peer Meshes');
     }
 }
 function appendMesh(states, state, localPeerId) {
     if (states.length < PEER_MESH_MAX_MESHES)
         return [...states, state];
-    const retired = states.findIndex((candidate) => !isActiveMembership(candidate, localPeerId));
+    const retired = states.findIndex((candidate) => isRetired(candidate, localPeerId));
     if (retired < 0)
         throw new Error('This peer belongs to too many Peer Meshes');
     return [...states.slice(0, retired), ...states.slice(retired + 1), state];
 }
-function isActiveMembership(state, localPeerId) {
-    return !state.roster.roster.closed && state.roster.roster.members.includes(localPeerId);
+function assertRejoinSettled(state, localPeerId) {
+    if (state?.role === 'replica' &&
+        state.desiredMembership === 'left' &&
+        state.roster.roster.members.includes(localPeerId)) {
+        throw new Error('This Peer Mesh leave is still being reconciled');
+    }
 }
 function selectRoster(current, candidate) {
     if (current.roster.meshId !== candidate.roster.meshId ||
-        current.authorityPublicKey !== candidate.authorityPublicKey) {
+        current.authorityPublicKey !== candidate.authorityPublicKey ||
+        current.roster.authorityPeerId !== candidate.roster.authorityPeerId) {
         throw new Error('Peer Mesh roster has the wrong authority');
     }
     if (candidate.roster.revision < current.roster.revision)
@@ -1214,52 +1786,187 @@ function selectRoster(current, candidate) {
     }
     return candidate;
 }
-function mergeRoutes(current, candidates, now) {
-    const routes = new Map(current.map((route) => [route.route.peerId, route]));
+function mergeReachability(current, candidates, now) {
+    const leases = new Map(current
+        .filter((signed) => usableHistoricalReachability(signed, now))
+        .map((signed) => [signed.lease.peerId, signed]));
     for (const candidate of candidates) {
-        if (candidate.route.expiresAt <= now)
+        if (!usableHistoricalReachability(candidate, now))
             continue;
-        const existing = routes.get(candidate.route.peerId);
-        if (!existing ||
-            existing.route.expiresAt <= now ||
-            candidate.route.sequence > existing.route.sequence) {
-            routes.set(candidate.route.peerId, candidate);
+        const existing = leases.get(candidate.lease.peerId);
+        if (!existing || candidate.lease.revision > existing.lease.revision) {
+            leases.set(candidate.lease.peerId, candidate);
             continue;
         }
-        if (candidate.route.sequence === existing.route.sequence &&
-            JSON.stringify(candidate) !== JSON.stringify(existing)) {
-            throw new Error('Peer Mesh route sequence identifies conflicting facts');
+        if (candidate.lease.revision === existing.lease.revision &&
+            reachabilityFactDigest(candidate) !== reachabilityFactDigest(existing)) {
+            throw new Error('Peer reachability revision identifies conflicting facts');
         }
     }
-    return Object.freeze([...routes.values()].sort((left, right) => left.route.peerId.localeCompare(right.route.peerId)));
+    return Object.freeze([...leases.values()].sort((left, right) => left.lease.peerId.localeCompare(right.lease.peerId)));
 }
-function mergeAuthenticatedRoute(current, candidate, now) {
-    const existing = current.find(({ route }) => route.peerId === candidate.route.peerId);
-    if (existing &&
-        existing.route.expiresAt > now &&
-        existing.route.sequence > candidate.route.sequence) {
-        return current;
+function mergeAdvertisements(current, candidates) {
+    const advertisements = new Map(current.map((signed) => [advertisementKey(signed.advertisement), signed]));
+    for (const candidate of candidates) {
+        const key = advertisementKey(candidate.advertisement);
+        const existing = advertisements.get(key);
+        if (!existing || candidate.advertisement.revision > existing.advertisement.revision) {
+            advertisements.set(key, candidate);
+            continue;
+        }
+        if (candidate.advertisement.revision === existing.advertisement.revision &&
+            advertisementFactDigest(candidate) !== advertisementFactDigest(existing)) {
+            throw new Error('Peer Mesh advertisement revision identifies conflicting facts');
+        }
     }
-    return mergeRoutes(current.filter(({ route }) => route.peerId !== candidate.route.peerId), [candidate], now);
+    return Object.freeze([...advertisements.values()].sort((left, right) => advertisementKey(left.advertisement).localeCompare(advertisementKey(right.advertisement))));
+}
+function reachabilitySummaries(reachability, roster, now) {
+    return Object.freeze(reachability
+        .filter((signed) => usableHistoricalReachability(signed, now) &&
+        roster.roster.members.includes(signed.lease.peerId))
+        .map((signed) => Object.freeze({
+        peerId: signed.lease.peerId,
+        revision: signed.lease.revision,
+        digest: reachabilityFactDigest(signed),
+    }))
+        .sort((left, right) => left.peerId.localeCompare(right.peerId)));
 }
-function routeSequences(routes, roster, now) {
-    return Object.freeze(routes
-        .filter(({ route }) => route.expiresAt > now && roster.roster.members.includes(route.peerId))
-        .map(({ route }) => Object.freeze({ peerId: route.peerId, sequence: route.sequence }))
+function advertisementSummaries(advertisements, roster) {
+    return Object.freeze(advertisements
+        .filter(({ advertisement }) => advertisement.meshId === roster.roster.meshId &&
+        roster.roster.members.includes(advertisement.peerId))
+        .map((signed) => Object.freeze({
+        peerId: signed.advertisement.peerId,
+        revision: signed.advertisement.revision,
+        digest: advertisementFactDigest(signed),
+    }))
         .sort((left, right) => left.peerId.localeCompare(right.peerId)));
 }
-function responseRoutes(state, routes, knownRoutes, now) {
-    const known = new Map(knownRoutes.map(({ peerId, sequence }) => [peerId, sequence]));
-    const missing = routes.filter(({ route }) => route.expiresAt > now &&
-        state.roster.roster.members.includes(route.peerId) &&
-        route.sequence > (known.get(route.peerId) ?? 0));
+function responseEvidence(state, reachability, advertisements, knownReachability, knownAdvertisements, now) {
+    const knownLeases = new Map(knownReachability.map((summary) => [summary.peerId, summary]));
+    const knownAds = new Map(knownAdvertisements.map((summary) => [summary.peerId, summary]));
+    const missing = [
+        ...reachability
+            .filter((signed) => usableHistoricalReachability(signed, now) &&
+            state.roster.roster.members.includes(signed.lease.peerId) &&
+            evidenceRequiresTransfer({
+                peerId: signed.lease.peerId,
+                revision: signed.lease.revision,
+                digest: reachabilityFactDigest(signed),
+            }, knownLeases.get(signed.lease.peerId), 'Peer reachability'))
+            .map((value) => ({
+            kind: 'reachability',
+            peerId: value.lease.peerId,
+            value,
+        })),
+        ...advertisements
+            .filter((signed) => signed.advertisement.meshId === state.roster.roster.meshId &&
+            state.roster.roster.members.includes(signed.advertisement.peerId) &&
+            evidenceRequiresTransfer({
+                peerId: signed.advertisement.peerId,
+                revision: signed.advertisement.revision,
+                digest: advertisementFactDigest(signed),
+            }, knownAds.get(signed.advertisement.peerId), 'Peer Mesh advertisement'))
+            .map((value) => ({
+            kind: 'advertisement',
+            peerId: value.advertisement.peerId,
+            value,
+        })),
+    ].sort((left, right) => left.peerId === right.peerId
+        ? left.kind.localeCompare(right.kind)
+        : left.peerId.localeCompare(right.peerId));
+    const page = missing.slice(0, EVIDENCE_PAGE_SIZE);
+    return Object.freeze({
+        reachability: Object.freeze(page.flatMap((entry) => (entry.kind === 'reachability' ? [entry.value] : []))),
+        advertisements: Object.freeze(page.flatMap((entry) => (entry.kind === 'advertisement' ? [entry.value] : []))),
+        more: missing.length > EVIDENCE_PAGE_SIZE,
+    });
+}
+function evidenceRequiresTransfer(local, remote, label) {
+    if (!remote || local.revision > remote.revision)
+        return true;
+    if (local.revision < remote.revision)
+        return false;
+    if (local.digest !== remote.digest) {
+        throw new Error(`${label} revision identifies conflicting facts`);
+    }
+    return false;
+}
+function reachabilityFactDigest(signed) {
+    return evidenceDigest(peerReachabilityLeaseSigningBytes(signed.lease));
+}
+function advertisementFactDigest(signed) {
+    return evidenceDigest(peerMeshMemberAdvertisementSigningBytes(signed.advertisement));
+}
+function evidenceDigest(bytes) {
+    return createHash('sha256').update(bytes).digest('hex');
+}
+function initialEvidence(state, reachability, advertisements, localPeerId, now) {
+    const lease = latestReachability(reachability, localPeerId, now, true);
+    const advertisement = findAdvertisement(advertisements, state.roster.roster.meshId, localPeerId);
+    if (!lease || !advertisement)
+        throw new Error('Peer Mesh authority evidence is unavailable');
+    return Object.freeze({
+        reachability: Object.freeze([lease]),
+        advertisements: Object.freeze([advertisement]),
+    });
+}
+function isCurrentLocalAdvertisement(existing, meshId, peerId, current, endpointKind) {
+    return Boolean(existing &&
+        existing.advertisement.meshId === meshId &&
+        existing.advertisement.peerId === peerId &&
+        existing.advertisement.endpointKind === endpointKind &&
+        existing.advertisement.displayName === (current.displayName ?? undefined) &&
+        existing.advertisement.offersTransit === (current.transitMeshId === meshId));
+}
+function latestReachability(reachability, peerId, now, includeHistorical) {
+    const signed = reachability.find(({ lease }) => lease.peerId === peerId);
+    if (!signed)
+        return undefined;
+    if (signed.lease.expiresAt > now)
+        return signed;
+    return includeHistorical && usableHistoricalReachability(signed, now) ? signed : undefined;
+}
+function emptyRouteResolution(state) {
+    return Object.freeze({
+        state,
+        routeHints: Object.freeze([]),
+        coordinationRelays: Object.freeze([]),
+        transitRelayPeerIds: Object.freeze([]),
+    });
+}
+function hasPeerRecoverySource(stored, sharedMeshIds, targetPeerId, localPeerId, now) {
+    const shared = new Set(sharedMeshIds);
+    const sourcePeerIds = new Set(stored.meshes
+        .filter(({ roster }) => shared.has(roster.roster.meshId))
+        .flatMap(({ roster }) => roster.roster.members)
+        .filter((peerId) => peerId !== localPeerId && peerId !== targetPeerId));
+    for (const sourcePeerId of sourcePeerIds) {
+        const signed = latestReachability(stored.reachability, sourcePeerId, now, true);
+        if (signed && hasReachabilityRoutes(signed))
+            return true;
+    }
+    return false;
+}
+function hasReachabilityRoutes(signed) {
+    return signed.lease.directRoutes.length + signed.lease.coordinationRoutes.length > 0;
+}
+function usableHistoricalReachability(signed, now) {
+    return signed.lease.expiresAt > now - PEER_REACHABILITY_RECOVERY_HORIZON_MS;
+}
+function dialTarget(reachability) {
     return Object.freeze({
-        routes: Object.freeze(missing.slice(0, ROUTE_PAGE_SIZE)),
-        more: missing.length > ROUTE_PAGE_SIZE,
+        peerId: reachability.lease.peerId,
+        routeHints: reachability.lease.directRoutes,
+        coordinationRelays: reachability.lease.coordinationRoutes,
     });
 }
-function sameAddresses(left, right) {
-    return left.length === right.length && left.every((address, index) => address === right[index]);
+function findAdvertisement(advertisements, meshId, peerId) {
+    return advertisements.find(({ advertisement }) => advertisement.meshId === meshId && advertisement.peerId === peerId);
+}
+function advertisementKey(advertisement) {
+    return `${advertisement.meshId}\n${advertisement.peerId}`;
 }
 function mergeAddresses(primary, fallback) {
     return Object.freeze([...new Set([...primary, ...fallback])].slice(0, 32));
@@ -1278,15 +1985,6 @@ function waitForTurn(previous, signal) {
         });
     });
 }
-function mergeTargets(primary, fallback) {
-    return Object.freeze({
-        peerId: primary.peerId,
-        routeHints: Object.freeze([...new Set([...primary.routeHints, ...fallback.routeHints])]),
-        coordinationRelays: Object.freeze([
-            ...new Set([...primary.coordinationRelays, ...fallback.coordinationRelays]),
-        ]),
-    });
-}
 async function exchangeControl(stream, request, decode, signal) {
     const timeout = AbortSignal.timeout(CONTROL_REQUEST_DEADLINE_MS);
     const operationSignal = signal ? AbortSignal.any([signal, timeout]) : timeout;
@@ -1312,36 +2010,63 @@ async function exchangeControl(stream, request, decode, signal) {
 function decodeControlRequest(value) {
     const record = recordValue(value);
     if (record.kind === 'redeem-invitation' &&
-        hasExactKeys(record, ['kind', 'meshId', 'secret', 'route'])) {
+        hasExactKeys(record, ['kind', 'meshId', 'secret', 'reachability', 'advertisement'])) {
         return {
             kind: 'redeem-invitation',
             meshId: requiredString(record.meshId, 128),
             secret: requiredString(record.secret, 64),
-            route: decodeSignedPeerMeshRouteRecord(record.route),
+            reachability: decodeSignedPeerReachabilityLease(record.reachability),
+            advertisement: decodeSignedPeerMeshMemberAdvertisement(record.advertisement),
         };
     }
     if (record.kind === 'sync' &&
-        hasExactKeys(record, ['kind', 'meshId', 'roster', 'route', 'knownRoutes'])) {
+        hasExactKeys(record, [
+            'kind',
+            'meshId',
+            'roster',
+            'reachability',
+            'advertisement',
+            'knownReachability',
+            'knownAdvertisements',
+        ])) {
         return {
             kind: 'sync',
             meshId: requiredString(record.meshId, 128),
             roster: decodeSignedPeerMeshRoster(record.roster),
-            route: decodeSignedPeerMeshRouteRecord(record.route),
-            knownRoutes: decodeRouteSequences(record.knownRoutes),
+            reachability: decodeSignedPeerReachabilityLease(record.reachability),
+            advertisement: decodeSignedPeerMeshMemberAdvertisement(record.advertisement),
+            knownReachability: decodeEvidenceSummaries(record.knownReachability),
+            knownAdvertisements: decodeEvidenceSummaries(record.knownAdvertisements),
+        };
+    }
+    if (record.kind === 'leave' && hasExactKeys(record, ['kind', 'meshId', 'roster'])) {
+        return {
+            kind: 'leave',
+            meshId: requiredString(record.meshId, 128),
+            roster: decodeSignedPeerMeshRoster(record.roster),
         };
     }
-    if (record.kind === 'leave' && hasExactKeys(record, ['kind', 'meshId'])) {
-        return { kind: 'leave', meshId: requiredString(record.meshId, 128) };
+    if (record.kind === 'announce-roster' && hasExactKeys(record, ['kind', 'meshId', 'roster'])) {
+        return {
+            kind: 'announce-roster',
+            meshId: requiredString(record.meshId, 128),
+            roster: decodeSignedPeerMeshRoster(record.roster),
+        };
     }
     throw new Error('Unsupported Peer Mesh control request');
 }
 function decodeRedeemResponse(value) {
     const record = recordValue(value);
-    if (record.kind === 'invitation-redeemed' && hasExactKeys(record, ['kind', 'roster', 'routes'])) {
+    if (record.kind === 'invitation-redeemed' &&
+        hasExactKeys(record, ['kind', 'roster', 'reachability', 'advertisements'])) {
+        const reachability = decodeReachabilityPage(record.reachability);
+        const advertisements = decodeAdvertisementPage(record.advertisements);
+        assertEvidencePageSize(reachability, advertisements);
         return {
             kind: 'invitation-redeemed',
             roster: decodeSignedPeerMeshRoster(record.roster),
-            routes: decodeRoutePage(record.routes),
+            reachability,
+            advertisements,
         };
     }
     if (record.kind === 'invitation-rejected' &&
@@ -1357,12 +2082,16 @@ function decodeRedeemResponse(value) {
 function decodeSyncResponse(value) {
     const record = recordValue(value);
     if (record.kind === 'sync-result' &&
-        hasExactKeys(record, ['kind', 'roster', 'routes', 'more']) &&
+        hasExactKeys(record, ['kind', 'roster', 'reachability', 'advertisements', 'more']) &&
         typeof record.more === 'boolean') {
+        const reachability = decodeReachabilityPage(record.reachability);
+        const advertisements = decodeAdvertisementPage(record.advertisements);
+        assertEvidencePageSize(reachability, advertisements);
         return {
             kind: 'sync-result',
             roster: decodeSignedPeerMeshRoster(record.roster),
-            routes: decodeRoutePage(record.routes),
+            reachability,
+            advertisements,
             more: record.more,
         };
     }
@@ -1385,34 +2114,61 @@ function decodeLeaveResponse(value) {
     }
     throw new Error('Invalid Peer Mesh leave response');
 }
-function decodeRoutePage(value) {
-    if (!Array.isArray(value) || value.length > ROUTE_PAGE_SIZE) {
-        throw new Error('Invalid Peer Mesh route page');
+function decodeAnnounceRosterResponse(value) {
+    const record = recordValue(value);
+    if (record.kind === 'roster-observed' && hasExactKeys(record, ['kind'])) {
+        return { kind: 'roster-observed' };
+    }
+    if (record.kind === 'roster-rejected' &&
+        hasExactKeys(record, ['kind', 'reason']) &&
+        record.reason === 'unknown') {
+        return { kind: 'roster-rejected', reason: 'unknown' };
+    }
+    throw new Error('Invalid Peer Mesh roster announcement response');
+}
+function decodeReachabilityPage(value) {
+    if (!Array.isArray(value) || value.length > EVIDENCE_PAGE_SIZE) {
+        throw new Error('Invalid Peer Mesh reachability page');
+    }
+    return Object.freeze(value.map(decodeSignedPeerReachabilityLease));
+}
+function decodeAdvertisementPage(value) {
+    if (!Array.isArray(value) || value.length > EVIDENCE_PAGE_SIZE) {
+        throw new Error('Invalid Peer Mesh advertisement page');
     }
-    return Object.freeze(value.map(decodeSignedPeerMeshRouteRecord));
+    return Object.freeze(value.map(decodeSignedPeerMeshMemberAdvertisement));
 }
-function decodeRouteSequences(value) {
+function assertEvidencePageSize(reachability, advertisements) {
+    if (reachability.length + advertisements.length > EVIDENCE_PAGE_SIZE) {
+        throw new Error('Peer Mesh evidence page exceeds its bound');
+    }
+}
+function decodeEvidenceSummaries(value) {
     if (!Array.isArray(value) || value.length > PEER_MESH_MAX_MEMBERS) {
-        throw new Error('Invalid Peer Mesh route sequences');
+        throw new Error('Invalid Peer Mesh evidence revisions');
     }
-    const sequences = value.map((entry) => {
+    const revisions = value.map((entry) => {
         const record = recordValue(entry);
-        if (!hasExactKeys(record, ['peerId', 'sequence'])) {
-            throw new Error('Invalid Peer Mesh route sequence');
+        if (!hasExactKeys(record, ['peerId', 'revision', 'digest'])) {
+            throw new Error('Invalid Peer Mesh evidence revision');
+        }
+        const revision = record.revision;
+        if (!Number.isSafeInteger(revision) || revision < 1) {
+            throw new Error('Invalid Peer Mesh evidence revision');
         }
-        const sequence = record.sequence;
-        if (!Number.isSafeInteger(sequence) || sequence < 1) {
-            throw new Error('Invalid Peer Mesh route sequence');
+        if (typeof record.digest !== 'string' || !/^[0-9a-f]{64}$/u.test(record.digest)) {
+            throw new Error('Invalid Peer Mesh evidence digest');
         }
         return Object.freeze({
             peerId: requiredString(record.peerId, 256),
-            sequence: sequence,
+            revision: revision,
+            digest: record.digest,
         });
     });
-    if (new Set(sequences.map(({ peerId }) => peerId)).size !== sequences.length) {
-        throw new Error('Duplicate Peer Mesh route sequence');
+    if (new Set(revisions.map(({ peerId }) => peerId)).size !== revisions.length) {
+        throw new Error('Duplicate Peer Mesh evidence revision');
     }
-    return Object.freeze(sequences);
+    return Object.freeze(revisions);
 }
 async function writeFrame(stream, value) {
     const bytes = Buffer.from(`${JSON.stringify(value)}\n`);