Every node floods what it knows, computes routes over the shared picture, and relays for its peers. When a node joins, moves or dies, the topology refloods and every surviving node recomputes independently, within whatever detection costs — ≈1.25 s at default probe settings.
Each advertisement carries the originator, a sequence number, per-neighbor links (cost = best alive RTT, aliveness, per-link RSSI), served prefixes, a human node_name — and optionally WGS-84 position with velocity, which is what the prediction layer consumes. That node_name is also the mesh’s namespace — served as DNS by every node, from this same flood. mesh DNS ↗
Entries age out at 100 s, refresh every 30 s (re-stamping position), and departed nodes leave tombstones (~300 s) so a stale advertisement can’t resurrect them. Full-database exchange on session establish; event-driven, debounced re-floods on link changes.
Static config, live GPS fixes over the telemetry socket, or an operator typing coordinates into the dashboard’s topology tab — park a relay van, enter its position, and every peer’s map updates within an advertisement tick.
The roster travels in pages, and a page fits a single UDP datagram by construction: node ids ride as base64 (not 32-number JSON arrays), the public key left the wire entirely (identity is the key), the deprecated config block rides only on full-sync rounds, and the sealed envelope carries a 48-byte binary prefix instead of base64-in-JSON. [mesh] max_gossip_bytes defaults to 1330 — sealed, that stays under a 1500-MTU path — so losing a datagram costs one page, never the roster; the members that did not fit lead the next document to the same target. Measured to fit a 250 kbit tactical bearer.
Dijkstra over the LSDB — measured-cost or hop-count mode — with dynamic peer learning behind relays and a TTL’d relay header capping paths at 8 hops. When the direct edge dies, traffic threads through whoever survives.
Each leg is protected by its own Noise session: a relay decrypts the fragment from the previous hop, reassembles, makes the forwarding decision, and re-encrypts toward the next hop. That is per-hop protection by trusted nodes — not end-to-end blindness — and it is different from hosted traversal relays, which forward opaque envelopes they cannot open. the three trust boundaries ↗
routing.path_redundancy = K computes the top-K next hops and fans every fragment across all of them — at the origin and at each transit hop — with receive-side dedup. Because candidates are separated by first hop, not by full node-disjointness, two paths can still meet further downstream; what you are guaranteed is that they leave on different neighbours. Nothing switches over, so there is no failover gap to lose packets in. Off by default (K = 1); K = 2 doubles the backbone bill. The 2× figure comes from a scripted demo scenario, not the measurement estate. Simulation
Named hop lists with stable path IDs and auto-failover deliberately disabled — a static FIB for rehearsed operations where predictability beats adaptivity.
Membership is a CRDT with authenticated join and liveness heartbeats; configuration travels as Ed25519-signed epochs over encrypted gossip. Any node can author; every node verifies, applies through the commit-confirmed lifecycle, and gossips its status back.
The mesh needs no orchestrator because its three jobs are already distributed:
A conflict-free replicated registry with Lamport clocks, authenticated join via a shared mesh secret, heartbeats and expiry. Anti-entropy syncs with a genuinely random peer every few seconds, so no member can be starved of updates.
Since gossip v2, every mesh body crosses the wire as ChaCha20-Poly1305 ciphertext under a key derived from the mesh secret, with per-opcode domain separation and replay damping — an eavesdropper on any underlay no longer gets a free map of the fleet. (A compatibility flag exists for mixed fleets mid-upgrade.)
Knowing the mesh secret means you may see the mesh; only an Ed25519 author key means you may change it — and even an author cannot rewrite a node’s identity or peer set remotely. Partition-tolerant by construction: both sides keep operating and reconcile on reconnection.
Give every airframe a node and the formation becomes its own transport fabric: spatial diversity (routes thread around losses) and spectral diversity (edges on different bands fail differently) — with reconvergence on the event rather than on a timer, doing the flying-formation bookkeeping.
A radio segment that self-forms at Layer 2 is a perfectly good Atlas underlay — the standing fleet bonds one alongside five other link types. Atlas treats the whole mesh segment as one measured path.
Two routing layers fighting over the same RF is the one bad configuration: HWMP path changes race Atlas’s dead-detection, the L2 mesh advertises capacity it can’t deliver over N hops, RSSI is first-hop-only, and broadcast amplifies. Rule: if Atlas is doing the relaying, the radio layer underneath must not — and vice versa.
A proposed forwarding = "bonding-only" link attribute would keep a mesh-underlay link fully in the bond between its endpoints while making it structurally impossible to use as a transit hop — the recommended tactical layout, enforced by the config instead of by discipline. roadmap ↗
Bonding and meshing compose: the mesh decides which nodes carry the traffic, and between each pair of them the bond decides over what. That gives a path two independent ways to survive — and two failure modes that look identical on a topology map until you draw the hops honestly.
Ten operators watching one drone feed used to cost the trunk ten copies — and inner multicast was worse: for flat-mesh correctness a packet to 224.0.0.0/4 replicates at the source, once per peer. [multicast] changes the shape: groups on its list are carried as source-rooted distribution trees — every shared segment carries the stream once, and copies are made only where subscriber paths diverge.
Subscriptions ride the LSA flood as an additive field, so every node holds the same picture; each derives its (source, group) role — reverse-path parent, subscriber-pruned children — straight from the SPF graph, cached and re-derived whenever the topology or the subscriptions change. No IGMP, no PIM, no rendezvous point: the classically hard parts of multicast were already solved by the LSDB.
Tree traffic rides the existing relay envelope with the group as its final destination and a hop limit bounding any transient loop. A relay accepts the stream only from its tree parent, delivers to its own TUN when subscribed, and forks one re-encrypted copy per child branch. A branch with no subscribers below it carries nothing — and a group nobody subscribes to costs zero packets on the air.
On the eight-container verification rig — ISR → relay drones → forward drones → three subscribed ground stations — five minutes of Full-HD-rate video (6.00 Mbit/s: 187,500 packets, ≈225 MB) crossed the mesh with 187,466 / 187,454 / 187,466 of the 187,500 packets delivered at the three stations — and the structural counters were exact: the scarce trunk carried 187,500 copies — one per packet — where per-viewer unicast would have put 562,500, the fork layer emitted exactly 562,500 at the divergence, and reverse-path drops were zero. (A 2 Mbit/s run on the same rig delivers loss-free.) The invariant is the real result — the trunk count equals the packet count, at any rate, any duration, any number of watchers; add seven more ground stations and the trunk cost does not move. Stopping the carrying forward drone mid-stream re-rooted the branches through the survivor with the delivery counters still climbing; the five-daemon netns suite pins the same properties in CI, including that a subscriber-less group sends nothing.
Delivery is unreliable-with-FEC: no ACK trees, no retransmit fan-in — reliable one-to-many stays store-carry-forward’s job. Applications stay unmodified: the sender writes UDP to a group, receivers join it on the atlas interface, and the kernel’s own multicast filtering applies exactly as on a LAN. Groups outside the configured list keep the flat fan-out; disabled, the data path is byte-identical. Mixed fleets: enable only once every node carries the build, with identical group lists.
The same two lines fleet-wide; subscribers add one more. Behind the measured numbers above sits the eight-container verification rig — the full ISR-to-ground-station chain, every copy on every segment counted.
[multicast]
enabled = true
groups = ["239.31.0.1"] # tree-distributed groups (fleet-wide list)
subscribe = ["239.31.0.1"] # this node wants the feed on its TUNEvery node a relay, every relay measured, every route recomputed the moment the topology moves — with nothing in the middle to capture or lose.