Confirm Suspect → Dead after indirect probes fail past suspectTimeoutMs. Bumps epoch because the live set shrinks. Errors if peer unknown or is Self.

Project the current view to a wire-ready digest list (strips local bookkeeping fields).

True when live count ≥ requiredQuorum.

Fresh view containing only Self as Alive at Incarnation 0, Epoch 0.

Add or refresh a peer from an inbound digest / seed list. If the peer is new, emits PeerJoined and bumps epoch; if it is known, applies SWIM merge semantics on that single entry.

Mark a peer as having left cleanly (received a Leaving envelope). Removes from the view and bumps epoch. Errors if peer unknown or is Self.

Live members (Alive only; input for HRW and quorum counting).

Fold a set of remote digests into our view — SWIM merge with incarnation precedence (higher wins); on equal incarnations, state precedence is Dead > Suspect > Alive, except Self is always Alive in its own view. Bumps epoch once if the live set actually changes.

Heard from a peer directly — bounces Suspect back to Alive if we had suspected it, and updates LastHeardMs in any case. No-op if unknown.

We received a digest claiming *we* are Suspect or Dead. Bump our own incarnation so our next gossip refutes it. Emits PeerRefuted.

Promote Alive → Suspect when local pings time out. No epoch bump. Errors if peer unknown or is Self.

Time-based sweep: promote Alive peers whose LastHeardMs is older than heartbeatMs * K to Suspect; confirm Dead those Suspect for more than suspectTimeoutMs. Returns all resulting state transitions as events and bumps epoch at most once if the live set changed.