Multi-link failover
Three virtual links with an interactive impairment menu — inject latency, loss and jitter, kill and restore links, watch delivery-time failover and EWMA recovery in the real engine.
Live demos
Every claim you can click.
Twenty-four interactive simulations live where their subjects live — this page is the index. Every one carries the same label discipline: a Simulation reproduces the engine’s behaviour faithfully but is not the engine; anything marked Measured links to how it was measured.
How much to believe
Three rungs, and everything on this page sits on one of them.
Every frame on this site carries its own truth label, but a label at a time makes the whole picture hard to assemble. Here is the spectrum in one view: what each kind of demo costs us to produce, and — much more to the point — what it entitles you to conclude.
Rung 01 · simulated
It runs in your browser
A model of the mechanism, written to behave the way the engine does.
24interactive simulations
Proves
That we understand the mechanism and will describe it the same way twice. The shape of a decision — why a share moves, when a path is abandoned, what dedup is for.
Doesn’t prove
Anything at all about the shipping code. A simulation cannot be wrong about the software, because it never touches it.
Rung 02 · executed
It runs the real daemon
The shipping binary on one Linux box, with links impaired on purpose.
4scripted runs
Proves
That the code does this, reproducibly, on hardware you already own. Failover happens because a real socket stopped answering, not because a script said so.
Doesn’t prove
How any of it behaves against physics — real radios, real interference, real weather, real distance.
Rung 03 · fielded
It ran on real radios
Real hardware, real geography, real failures — the eight-node fleet and the HEMUS 2026 rig.
8field nodes · six bearer types on one
Proves
That it survives contact with the physical world: re-enumerating USB radios, a 64 kbps serial link beside a gigabit one, six dissimilar bearers bonded on one node.
Doesn’t prove
A guarantee about your environment. These are properties of the configurations stated on the evidence page, not promises about a different sky.
The rungs do not replace each other. A simulation you can break yourself in ten seconds teaches a mechanism faster than a log file ever will; a namespace run proves the code; only the field proves the physics. What matters is never mistaking one for another — which is the entire reason every frame on this site says which it is. What has actually been measured
Start from the failure
Twenty-four ways to break it, and where to watch each one.
The catalogue below is ordered by mechanism. This is the same set ordered by the thing that went wrong — which is usually how you arrive, because you already know what you are afraid of.
The link5
A link dies outright
Link-kill bondingcut any of five, watch the split reweight
A link rots instead of dying
Graceful degradationgradual reweighting against threshold failover
Nothing fails, but the geometry changes
Range & splitusable rate falls, the share follows
One radio of a bonded hop dies
Bonded hopsthe hop thins; the route does not move
A link degrades and the sessions stay pinned to it
Per-flow vs per-packetone pane holds flat then jumps; the other bleeds off
The node and the mesh6
A relay is destroyed mid-flight
The fleet as the fabricSPF threads the route through survivors
A whole band degrades at once
The fleet as the fabricspatial loss and spectral loss, counted separately
Config must reach every node, with no controller
Config pushsigned epochs gossiping outward, edges cut mid-push
One copy of a packet is not enough
N-path deliverytwo first hops, receiver keeps the first to land
Both ends are behind their own NAT
Hole punchingrelayed, then punched, then an ordinary link
A config change cuts your own path to the fleet
Commit-confirmed applyevery node reverts itself when its deadman expires
The traffic6
Video floods the command channel
Priority under flood20,000 pkt/s of video against a 2 kbps C2 lane
Frames arrive too late to be worth anything
Deadline deliverythe same feed through TCP, UDP and a deadline budget
There is no path at all, for minutes
Store-carry-forwarda blackout, a queue, and a reboot that loses nothing
Loss, with no return channel to ask again
Erasure recoveryparity shards rebuilding a block, no retransmit
Different traffic wants different links
Per-class bondingthree classes planning their own link sets
One fragment of a packet never arrives
Fragment and reassemblethe janitor reaps the half-filled buffer
The world outside5
The aircraft opens range on its best link
Predictive handoverprediction on: no drops. Off: the textbook gap
A ridge slides into the path, nobody moves
Terrain awarenessthe one case position and signal both miss
The better relay is about to become the worse one
Predictive relay selectionhand over on the trend, not on the break
Which bearers can even reach, from here
Bearer reachenvelopes crossed one at a time as you fly out
Hidden nodes collide on one shared channel
Shared-radio TDMACSMA collisions against a GPS-aligned slot grid
Interactive simulations
Twenty-four, sorted by what breaks.
Each link jumps straight to the demo, controls armed.
Link-kill bonding
Five dissimilar links, kill buttons, live reweighting — the signature demo, on the front page where it belongs.
Open on homeScheduler strategies
Five of the eight strategies over three dissimilar links — including latency-adaptive escalation with a delay injector.
Open on bondingGraceful degradation
A VSAT link rots and recovers; gradual reweighting against the binary-failover ghost line.
Open on bondingPriority under flood
20,000 packets per second of video against a 2 kbps command channel. The command channel wins. Every time.
Open on transportDeadline delivery
The same feed through TCP, plain UDP and Tempo during loss bursts — freeze vs tear vs bend.
Open on transportStore-carry-forward
Blackout, queueing bundles, a reboot that loses nothing, and the drain burst when a link returns.
Open on transportPer-class bonding
Three classes planning their own link sets — jam a link and watch each class re-plan independently.
Open on transportErasure recovery
K=8+2 Reed–Solomon shards, one per link; kill one mid-block and watch parity rebuild it in one trip. The simulation shows the shipping striped send path: shards stripe across links weighted by goodput, and the parity floor keeps one link’s death a recoverable erasure while its share stays at or below half the stripe.
Open on transportConfig push, no controller
Eight nodes, signed epochs over gossip, cut edges and push anyway.
Open on meshThe fleet as the fabric
Destroy relays, degrade bands — SPF threads the route through whatever survives.
Open on meshPredictive handover
Prediction on: zero drops. Prediction off: the textbook gap. Same flight.
Open on predictionTerrain awareness
A ridge drifts into the path while nobody moves relative to anyone. Only the elevation model sees it coming.
Open on predictionShared-radio TDMA
Hidden nodes colliding under CSMA, silenced by a GPS-aligned slot grid — the research direction, animated.
Open on roadmapHeterogeneous reach
Five bearers with different range envelopes; fly outward and the bond loses members one envelope at a time, without ever failing over.
Open on integrationsRange & split
Nothing fails — the aircraft simply flies further out, and each bearer’s usable rate falls at its own pace while the split follows.
Open on bondingBonded hops
Every hop of a multi-hop path is itself a bond. Kill a node and the route swings; kill one radio of a hop and nothing reroutes at all.
Open on meshN-path delivery
Two routes leaving on different first hops carry the same packet; the receiver keeps the first to land. Two copies, not five.
Open on architecturePredictive relay selection
Two relays moving, one opening range and one closing. Prediction hands over on the trend; without it the path holds until it breaks.
Open on predictionPer-flow vs per-packet
Two selection policies over the same three links and the same traffic. Degrade one link gradually and watch one pane hold flat then jump, while the other bleeds off continuously.
Open on compareHole punching
Two nodes behind their own NATs: relayed, then discovery and rendezvous, then a direct path that is simply an ordinary link with an endpoint. Plus the NAT that will not open.
Open on traversalCommit-confirmed apply
Push a change that cuts your own path to the fleet. No confirmation can arrive, and every node independently reverts itself when its deadman expires.
Open on operationsMake-before-break rekey
Two sessions overlapping across a key rotation, throughput stacked by which key decrypted it — the total never dips.
Open on securityThe anti-replay window
A 2048-entry sliding window: out-of-order accepted, duplicates and too-old rejected, and the check running after authentication.
Open on securityFragment and reassemble
One oversized packet split across three links, arriving out of order by construction — then a lost fragment and the janitor that reaps the half-filled buffer.
Open on architectureBroadcast redundancy
Broadcast over three links: kill one (zero loss), kill two (still alive), then force 30% loss on all three and measure ~2.7% end-to-end. Measured
Adaptive escalation under interference
Wi-Fi-class and serial-radio-class links under progressively injected impairment — watch the adaptive strategy step 1 → 2 → 3 paths and back down.
Ten-node layered mesh
Command, relay and edge layers: bonding, single- and multi-hop relay, gateway redundancy, failure scenarios — per-node stats, dashboards and logs included.
Beyond the demos, a set of end-to-end namespace test suites gates every change — what they prove is on evidence.
Companion viewers
Three ways to look at a mesh.
Separate tools, same telemetry — all three exist because a topology you can see is a topology you can reason about. The dashboard ships on every node; the two visualisers are what you reach for when the picture matters more than the numbers.
The mission simulator: every LSDB node placed at its real position over real elevation data, links coloured by terrain line-of-sight, predictive reroutes drawn as they happen — in demo, live (polling one node’s /api/stats at 1 Hz), or replay mode. The visual companion of the terrain engine.
The underlay viewer: live 802.11s radio topology from any node’s browser — signal, airtime metric, dying links fading out, discovery of hidden multi-hop nodes, and a 3D view. It shows the layer below Atlas, which is exactly why it exists.
Every node ships the best demo: its own live dashboard — the same numbers the CLI and the REST API serve, once a second, with no collector in the middle. Real screenshots are on operations.