Farewell

Sent by the host to every remaining member when a member departs cleanly (the host received that member's Goodbye).

The host is the membership authority — it admits via Welcome; this is the eviction counterpart. On receipt each member removes the departed peer promptly with us.tractat.kuilt.session.LeaveReason.Normal, instead of waiting out its own heartbeat window and mislabelling the clean leave as us.tractat.kuilt.session.LeaveReason.PartitionExpired.

Host-authoritative, not peer-trust: receivers act on a Farewell only when it comes from their identified host — never on another joiner's raw Goodbye (a spoof surface, and hub/relay topologies may lack direct joiner↔joiner edges).

peerId — the departed member's us.tractat.kuilt.core.PeerId value.

expired — false (the default) for a clean Goodbye-driven departure, evicted with us.tractat.kuilt.session.LeaveReason.Normal; true when the host is propagating a reconnect-window expiry, evicted with us.tractat.kuilt.session.LeaveReason.PartitionExpired. Expiry needs the same authoritative fan-out as a clean leave — on a star topology a joiner has no heartbeat against another joiner, so without it an expired seat is never evicted from a peer joiner's roster (#1557). Defaulted so it is wire-safe: a frame from an older build that never sends the field decodes as a clean leave, which is what that build meant.

Wire-compatible: an older build that doesn't know this message drops it as malformed and degrades to its own heartbeat-window eviction (the prior behavior).