Security model: the key-holder gap is closed
Echo: the engine returns an FRR peer's v6 echo; not-self narrowed
Finals within a budget, packets no faster than the peer may send RFC conformance names the Poll budget as deviation 4 and the spacing as a note; Monitoring lists too-fast and changes-lost; the security model adds the churning-timer flood; Limitations has the engine at 2% for 1024.
Security model: floods at 1024 sessions, and the two new budgets The eight flood arms against the 1024-session mesh, and the moved-address and echo budgets they led to; Monitoring lists the two new counters.
RFC conformance: the fast path demuxes on Your Discriminator and keeps one source port Deviation 4 is gone: a packet naming one of our discriminators reaches userspace when the address pair misses. The fallback socket is bound within 49152-65535, and both planes send from the port the session bound.
Rewrite the wiki as pages a reader can use The first pass moved the old README sections across as they were, which gave a Deployment page that was six caveats in a bullet list and nothing telling anyone how to deploy anything. Written properly this time, for someone arriving without the project in their head: install it, wire it to FRR in an order that works, then check the fast path is really carrying the traffic rather than trusting show bfd peer, which looks identical either way. Two new pages carry most of the value. Troubleshooting is symptom first and covers what actually goes wrong: a peer configured on one side only, the 64 session ceiling, sessions stranded by an engine restart, the three separate reasons an authenticated session never comes up, a snapshot file left behind by a previous engine, and the observer quietly stealing the XDP attach. Monitoring explains the snapshot and all eighteen counters, since a number nobody can interpret is not monitoring. Limitations is prose with the reasoning and the upstream links rather than a list of bullets.