received

Merge an inbound update into the local state.

For each replica whose entry advances (higher clock, or present beating a same-clock null), the local receive time is re-stamped to clock(). Stale deliveries and same-clock equal-value duplicates do not update the receive time — they leave the existing TTL timer intact.

Evict-on-read past TTL. An existing slot whose local receive time has aged past ttlMs reads as absent here — exactly as it already does in live. So when an inbound entry arrives for an expired slot, it is accepted as fresh: the receive time is re-stamped and the stale slot is dropped before the join, so the merge takes the inbound entry even when its clock counter is lower than the dead one's. This is what makes a restarted replica (whose process-local clock restarts from zero) visible again within one TTL of its first heartbeat, rather than being pinned behind the dead incarnation's higher clock forever — honouring EphemeralMap's restart-recovery contract.

Identical re-delivery is inert. An inbound entry equal to the one already held (same value, same clock) carries no evidence that its author is alive — it is this observer's own copy coming back, via a merged-state echo or an anti-entropy round. Such an entry never re-stamps the receive time, expired slot or not, so a crashed peer stays evicted however many times its last frame is re-delivered. A genuine restart's heartbeat differs (a new incarnation-epoch clock, or simply a different counter) and is still accepted. The one cost: a restart whose very first heartbeat reproduces the dead entry exactly is deferred to its next heartbeat.

Eviction never installs an older entry. Evicting a slot drops causal information, so it is confined to the one case that needs it: a presence entry re-opening an expired presence slot. It is never applied when the standing entry is a departure tombstone — EphemeralMap.leave is a permanent statement, and an inbound entry the tombstone already dominates is provably not news, whoever relayed it, so admitting it would invert the lattice's own ordering (#1675). Nor is it applied to an inbound departure that the standing presence entry dominates, which would re-open the slot for a later relay of that same presence entry to win. Everything else is left to the join, which keeps the dominating entry. A replica that departed gracefully therefore returns only by out-clocking its own tombstone — see the restart-recovery contract on EphemeralMap.