Parsed cluster config, derived from `FsShelter.Conf` at startup so the Cluster modules never reach back into the Conf map at runtime.

External capabilities the cluster supervisor depends on. `Supervisor.runCluster` wires these to their production defaults; tests (and alternate hosts) can supply `runClusterWith` directly.

Result of an election round. `None` master means insufficient information (empty live set); the Supervisor stays in Standby.

Monotonic epoch attached to every `MemberView`. Incremented on any add/remove; used in HRW hash to make mastership sticky across non-fatal membership changes.

SWIM per-member "incarnation": a peer bumps its own incarnation when it sees itself as Suspect elsewhere, overriding stale gossip.

A single member row in the local view. Extends MemberDigest with local bookkeeping (last-heard timestamps) that never crosses the wire.

Gossip payload: one row per member the sender knows about. Wire-format data contract shared between the Membership domain and the Transport.

Errors returned by MemberView operations that take a caller-supplied PeerId.

Events emitted by state transitions. Consumed by the Supervisor to drive election recompute and topology activation. Only EpochBumped fires when the live set actually changes; Suspect flaps never bump epoch.

Per-member SWIM state.

The local view of the cluster at one peer. Pure value; all mutations are functional updates. Self is never Dead in our own view.

Network address a peer listens on.

Stable per-process identity. Persisted to `peer-id.dat` on first boot and reused across restarts so HRW rank survives IP/host changes.

Effectful transport surface. One instance per process.

Effects the orchestrator must apply after `step` returns.

External inputs the orchestrator feeds into the pure step function.

Lifecycle phase of the local peer with respect to the topology.

Wire-level control-plane envelope. Closed DU, custom binary codec.