Registration is a lease, not a permanent row.
An instance that crashes cannot reliably run a cleanup callback. That is why OpenMesh registrations expire unless the owner renews them. A healthy service heartbeats its lease; graceful shutdown removes the lease before request draining so new callers stop selecting the instance while in-flight work can finish.
This model makes liveness an explicit property of the registry rather than an assumption hidden inside a deployment script.
Discovery returns snapshots with monotonic revisions.
Membership can change while a caller is reading it. OpenMesh associates each service membership snapshot with a monotonic revision. Pagination can restart when the revision changes instead of returning a mixed view assembled from two different topologies.
{
"service": "users",
"revision": 18,
"instances": [
{ "id": "users-a", "url": "http://10.0.0.12:3000" },
{ "id": "users-b", "url": "http://10.0.0.13:3000" }
]
}The revision is also useful to downstream routing logic: it can tell whether an update is newer without diffing arbitrary arrays.
Steady-state topology updates are push-first.
OpenMesh uses authenticated Server-Sent Events for service and configuration watches. A watcher receives an initial full snapshot and later snapshots when state changes. Heartbeat comments keep idle streams alive.
SSE events carry IDs. On reconnect the client sends Last-Event-ID; if state has not advanced, the control plane can avoid a duplicate snapshot. If state did advance, the client receives the complete current snapshot rather than depending on a potentially lossy delta history.
For service membership, a complete versioned state is often easier to recover and validate than an unbounded log of add/remove deltas.
The protocol is separate from the storage adapter.
The bundled in-memory registry is useful for local clusters and tests. Production systems that need shared durable state can use the Redis adapters or implement the public registry/config contracts against another store.
That separation matters for portability: the application-facing discovery semantics stay the same while durability, replication and infrastructure ownership can change underneath.
A broken update should not erase the last good topology.
Discovery, configuration and traffic policy updates are validated before they replace runtime state. Invalid or unavailable updates preserve the last accepted snapshot. The service relationship therefore degrades from known-good state rather than immediately adopting malformed control-plane data.
Discovery is only one part of safe distributed calls. The resulting peer set feeds traffic targeting, peer selection, admission, deadlines, retries and circuits. Continue with the peer routing guide, or read the control-plane protocol documentation.