Module endpoint 

Endpoint — a single way a recipient can reach a sender’s data plane.

Endpoints carry an optional EndpointHealth block populated by the control plane’s background re-validator (ADR-0014 + ADR-0021). The health machine is asymmetric: three consecutive failed probes flip an endpoint to Unhealthy, but two consecutive successes are required to flip it back to Healthy. Freshly admitted endpoints start Healthy because the admission flow in aex-control-plane already proved them reachable once.

Introduced in Sprint 2 for transport plurality (v1.3.0-beta.1). A transfer carries a list of endpoints (reachable_at[]); the recipient SDK tries them in the sender’s declared priority order per ADR-0012 (sender-ranked, serial, sticky) and stops at the first that works.

    reachable_at[] (JSONB on transfers, JSON on the wire)
        │
        ├── { kind: "cloudflare_quick", url: "https://x.trycloudflare.com", priority: 0 }
        ├── { kind: "iroh",              url: "iroh:NodeID@relay:443",        priority: 1 }
        └── { kind: "frp",               url: "https://frp.example.com/x",    priority: 2 }
             │
             └── recipient tries in priority order, sticks with first success

Forward compatibility

kind is a String, not an enum, so unknown kinds from a newer peer are preserved losslessly. Recipients MUST skip endpoints whose kind is not in Endpoint::KNOWN_KINDS rather than erroring. This mirrors the capability-bit philosophy in ADR-0018 — new transports land additively without requiring a wire bump.

Structs

Endpoint

A single way to reach a sender’s data plane.

EndpointHealth

Persisted health state for a single Endpoint. Kept inline in the reachable_at JSONB so a control-plane restart doesn’t reset the debounce counters; this means a flapping endpoint that was about to flip Unhealthy keeps its accrued failure count across deploys.

Enums

HealthStatus

Current health classification of an endpoint.