molluskandClaude Opus 4.8
a0a5922389
Fixes the field-observed dead-end where a network outage longer than the 45s anti-flap grace evicted the peer with no path back (required manual Leave + re-ticket). On grace expiry the peer is now torn down cleanly and a bounded per-session recovery coordinator re-bootstraps the gossip overlay via GossipSender::join_peers on retained authenticated addresses, with immediate-then-1/2/4/8/15/30/60s capped backoff. Readmission still requires a fresh authenticated signed Announce, preserving the S8/S11 membership boundary; a transport link alone cannot readmit a grace-expired peer. Field-verified 2026-06-20 on a 2-machine Linux-host <-> Windows-VM call through a 93s link outage on the libvirt NAT path: both UIs auto-recovered to "2 in room" with no manual Leave/Join, exactly one Reconnected chime, host showed "reconnecting" during the outage, and the VM log captured the full sequence (grace expiry -> rebootstrap 1->2->4 backoff -> NeighborUp -> authenticated Announce -> readmit -> audio link up). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>