Meet everybody, not just the one you were told about

A device pointed at one member talked to that member and nobody else. The
only candidates an agent had were the ones on its command line and
whatever the cache remembered, so the network was a star around whichever
peer happened to be typed — while the signed state sitting in front of it
listed every other member by name.

Two sources fix that, and both produce candidates rather than facts.

Every author of a signed record is somebody to try. Those records reach us
through anybody, so a member is known to exist, and by id, long before it
is ever spoken to; an id with no address is still dialable where the
endpoint's own discovery can resolve one.

And members tell each other where they have seen the others. A
`ControlMessage::Peers` carries each member with the addresses the sender
observes for it — including the sender's own, which is the one thing
nobody else can pass on — in the same `ip:`/`relay:` spelling the cache
already uses, so one decoder serves both and neither can drift. An agent
that only ever accepts has no candidates of its own and is exactly the one
everybody was pointed at, so the addresses come from the live sessions as
well as the candidate list.

None of it authenticates anything. An introduction is not a vouching: the
handshake decides membership as before, and a candidate from a member is
tried exactly like one from a bootstrap entry or the cache. It is also
deliberately the shape a distributed hash table lookup would return, so
that becomes another source beside these rather than a redesign.

With the mesh pairwise, the relay is what it was meant to be: the way to
the one peer that cannot be reached directly, not the way the network is
held together.

Covered by three agents where two are told only about the first: each ends
up with both of the others, and the one nobody mentioned arrives as an
introduction.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

README.md

@@ -95,12 +95,25 @@ and join the same network with the secret that was printed:
 ./target/release/tsunagi join --network lab --secret tsn1...
 ```
 
-**`--peer` is how the first meeting happens.** Two agents that have never
-met have nothing to go on: this project publishes nothing about who is in
-which network, by design. One of them has to be told the other's endpoint
-id — after that each remembers the other and finds it again by itself, so
-it is needed once. An agent with nobody to contact says so in `status`
-rather than sitting there looking patient.
+**`--peer` is how the first meeting happens, and only the first.** Two
+agents that have never met have nothing to go on: this project publishes
+nothing about who is in which network, by design. One of them has to be
+told the other's endpoint id — after that each remembers the other and
+finds it again by itself. Give several for redundancy; any one of them
+getting through is enough.
+
+**One introduction is enough for the whole network.** Members tell each
+other about the members they know, and every author of a signed record is
+somebody to try, so a device pointed at one member ends up talking to all
+of them rather than to the one that happened to be on its command line.
+What travels is a candidate — an address somebody has seen — and it is
+authenticated by the handshake like any other; being introduced grants
+nothing. It is deliberately the same shape a lookup in a distributed hash
+table would return, so that is a source to add beside this one rather than
+a redesign.
+
+An agent with nobody to contact says so in `status` rather than sitting
+there looking patient.
 
 Within a few seconds both print something like:
 
@@ -538,7 +551,9 @@ explicitly.
 
 ### Through somebody in the middle
 
-Two members can both reach a third and not each other: a blocked path, a
+Everybody tries everybody first: the mesh is pairwise, and a relay is only
+for the pair that cannot manage it. Two members can both reach a third and
+not each other: a blocked path, a
 relay that is unavailable, a network only reachable from inside somebody
 else's building. When that happens the pair is routed through a member that
 has both.