◈Durable hub-to-hub sync — A persisted per-peer mirror (peer_journal) that survives restarts, per-peer due times after success and failure, bounded concurrent drains, exponential backoff isolation, and an atomic status snapshot after every cycle. One slow peer cannot serially block every healthy peer.
◈Fail-closed journal integrity — The daemon holds one kernel-backed writer lock, validates a complete page before I/O, fsyncs the active journal before replacing its owner-only cursor, rotates bounded immutable checksum-chained segments, and refuses startup unless the strict segmented tail equals that cursor. A failed poll never advances the cursor.
◈Live trust reload — Changed mTLS and Ed25519 trust material is validated as one immutable generation before any socket opens.
◈Per-peer operations — Strict versioned configuration, separate credentials and cadence, protocol negotiation, status snapshots, and a read-only doctor pass.
◈Offline licence admission — Named-license documents are verified locally before credentials are read or network connections begin. No account lookup or telemetry.
◈Lease-correct forwarding — Remote claims route only through the configured owner; denials and malformed or expired verdicts are never cached.
◈Signed audit equality — Independently signed commitments let operators verify equal Core log state offline across deployment boundaries.
Operator doctor pass
$ synapse-fleet doctor READ ONLY
hub-a → hub-b caught_up
mirror integrity verified
trust generation current
remote claims observed only