Every node floods what it knows, computes routes over the shared picture, and relays for its peers. When a node joins, moves or dies, the topology refloods and every surviving node recomputes independently, within whatever detection costs — ≈1.25 s at default probe settings.
Each advertisement carries the originator, a sequence number, per-neighbor links (cost = best alive RTT, aliveness, per-link RSSI), served prefixes, a human node_name — and optionally WGS-84 position with velocity, which is what the prediction layer consumes.
Entries age out at 100 s, refresh every 30 s (re-stamping position), and departed nodes leave tombstones (~300 s) so a stale advertisement can’t resurrect them. Full-database exchange on session establish; event-driven, debounced re-floods on link changes.
Static config, live GPS fixes over the telemetry socket, or an operator typing coordinates into the dashboard’s topology tab — park a relay van, enter its position, and every peer’s map updates within an advertisement tick.
The roster travels in pages, and a page fits a single UDP datagram by construction: node ids ride as base64 (not 32-number JSON arrays), the public key left the wire entirely (identity is the key), the deprecated config block rides only on full-sync rounds, and the sealed envelope carries a 48-byte binary prefix instead of base64-in-JSON. [mesh] max_gossip_bytes defaults to 1330 — sealed, that stays under a 1500-MTU path — so losing a datagram costs one page, never the roster; the members that did not fit lead the next document to the same target. Measured to fit a 250 kbit tactical bearer.
Dijkstra over the LSDB — measured-cost or hop-count mode — with dynamic peer learning behind relays and a TTL’d relay header capping paths at 8 hops. When the direct edge dies, traffic threads through whoever survives.
Each leg is protected by its own Noise session: a relay decrypts the fragment from the previous hop, reassembles, makes the forwarding decision, and re-encrypts toward the next hop. That is per-hop protection by trusted nodes — not end-to-end blindness — and it is different from hosted traversal relays, which forward opaque envelopes they cannot open. the three trust boundaries ↗
routing.path_redundancy = K computes the top-K next hops and fans every fragment across all of them — at the origin and at each transit hop — with receive-side dedup. Because candidates are separated by first hop, not by full node-disjointness, two paths can still meet further downstream; what you are guaranteed is that they leave on different neighbours. Nothing switches over, so there is no failover gap to lose packets in. Off by default (K = 1); K = 2 doubles the backbone bill. The 2× figure comes from a scripted demo scenario, not the measurement estate. Simulation
Named hop lists with stable path IDs and auto-failover deliberately disabled — a static FIB for rehearsed operations where predictability beats adaptivity.
Membership is a CRDT with authenticated join and liveness heartbeats; configuration travels as Ed25519-signed epochs over encrypted gossip. Any node can author; every node verifies, applies through the commit-confirmed lifecycle, and gossips its status back.
The mesh needs no orchestrator because its three jobs are already distributed:
A conflict-free replicated registry with Lamport clocks, authenticated join via a shared mesh secret, heartbeats and expiry. Anti-entropy syncs with a genuinely random peer every few seconds, so no member can be starved of updates.
Since gossip v2, every mesh body crosses the wire as ChaCha20-Poly1305 ciphertext under a key derived from the mesh secret, with per-opcode domain separation and replay damping — an eavesdropper on any underlay no longer gets a free map of the fleet. (A compatibility flag exists for mixed fleets mid-upgrade.)
Knowing the mesh secret means you may see the mesh; only an Ed25519 author key means you may change it — and even an author cannot rewrite a node’s identity or peer set remotely. Partition-tolerant by construction: both sides keep operating and reconcile on reconnection.
Give every airframe a node and the formation becomes its own transport fabric: spatial diversity (routes thread around losses) and spectral diversity (edges on different bands fail differently) — with reconvergence on the event rather than on a timer, doing the flying-formation bookkeeping.
A radio segment that self-forms at Layer 2 is a perfectly good Atlas underlay — the standing fleet bonds one alongside five other link types. Atlas treats the whole mesh segment as one measured path.
Two routing layers fighting over the same RF is the one bad configuration: HWMP path changes race Atlas’s dead-detection, the L2 mesh advertises capacity it can’t deliver over N hops, RSSI is first-hop-only, and broadcast amplifies. Rule: if Atlas is doing the relaying, the radio layer underneath must not — and vice versa.
A proposed forwarding = "bonding-only" link attribute would keep a mesh-underlay link fully in the bond between its endpoints while making it structurally impossible to use as a transit hop — the recommended tactical layout, enforced by the config instead of by discipline. roadmap ↗
Bonding and meshing compose: the mesh decides which nodes carry the traffic, and between each pair of them the bond decides over what. That gives a path two independent ways to survive — and two failure modes that look identical on a topology map until you draw the hops honestly.
Every node a relay, every relay measured, every route recomputed the moment the topology moves — with nothing in the middle to capture or lose.
