Apply endpoint health in peer cache

agents/rap-node-agent/internal/mesh/peer_cache.go

@@ -9,16 +9,17 @@ import (
 const DefaultWarmPeerLimit = 8
 
 type PeerCacheConfig struct {
-	Local                  PeerIdentity
-	PeerEndpoints          map[string]string
-	PeerEndpointCandidates map[string][]PeerEndpointCandidate
-	PeerDirectory          []PeerDirectoryEntry
-	RecoverySeeds          []PeerRecoverySeed
-	RendezvousLeases       []PeerRendezvousLease
-	Routes                 []SyntheticRoute
-	WarmPeerLimit          int
-	PreferredRegion        string
-	Now                    time.Time
+	Local                    PeerIdentity
+	PeerEndpoints            map[string]string
+	PeerEndpointCandidates   map[string][]PeerEndpointCandidate
+	PeerEndpointObservations map[string]EndpointCandidateHealthObservation
+	PeerDirectory            []PeerDirectoryEntry
+	RecoverySeeds            []PeerRecoverySeed
+	RendezvousLeases         []PeerRendezvousLease
+	Routes                   []SyntheticRoute
+	WarmPeerLimit            int
+	PreferredRegion          string
+	Now                      time.Time
 }
 
 type PeerCache struct {
@@ -116,6 +117,8 @@ func NewPeerCache(cfg PeerCacheConfig) *PeerCache {
 			PreferredRegion:    cfg.PreferredRegion,
 			Now:                now,
 			MaxVerificationAge: time.Hour,
+			Observations:       cfg.PeerEndpointObservations,
+			MaxObservationAge:  time.Hour,
 		})
 		if len(scored) > 0 {
 			entry.EndpointCandidates = make([]PeerEndpointCandidate, 0, len(scored))

agents/rap-node-agent/internal/mesh/peer_cache_test.go

@@ -100,6 +100,59 @@ func TestPeerCacheUsesBestEndpointCandidate(t *testing.T) {
 	}
 }
 
+func TestPeerCacheAppliesEndpointHealthObservations(t *testing.T) {
+	local := PeerIdentity{ClusterID: "cluster-1", NodeID: "node-a"}
+	now := time.Date(2026, 5, 16, 12, 0, 0, 0, time.UTC)
+	cache := NewPeerCache(PeerCacheConfig{
+		Local: local,
+		PeerEndpointCandidates: map[string][]PeerEndpointCandidate{
+			"node-b": {
+				{
+					EndpointID:       "node-b-quic",
+					NodeID:           "node-b",
+					Transport:        "direct_quic",
+					Address:          "quic://node-b.example.test:19443",
+					Reachability:     "public",
+					NATType:          "none",
+					ConnectivityMode: "direct",
+					Priority:         1,
+					LastVerifiedAt:   &now,
+				},
+				{
+					EndpointID:       "node-b-wss",
+					NodeID:           "node-b",
+					Transport:        "wss",
+					Address:          "https://node-b.example.test:443",
+					Reachability:     "public",
+					NATType:          "none",
+					ConnectivityMode: "direct",
+					Priority:         1,
+					LastVerifiedAt:   &now,
+				},
+			},
+		},
+		PeerEndpointObservations: map[string]EndpointCandidateHealthObservation{
+			"node-b-quic": {
+				EndpointID:        "node-b-quic",
+				FailureCount:      2,
+				LastFailureReason: "session_open_failed",
+				ReliabilityScore:  35,
+				ObservedAt:        now,
+			},
+		},
+		WarmPeerLimit: 1,
+		Now:           now,
+	})
+
+	entry, ok := peerCacheEntryByID(cache.Snapshot(), "node-b")
+	if !ok {
+		t.Fatal("node-b missing from cache")
+	}
+	if entry.BestCandidateID != "node-b-wss" || entry.Endpoint != "https://node-b.example.test:443" {
+		t.Fatalf("peer cache did not apply endpoint observations: %+v", entry)
+	}
+}
+
 func TestPeerCacheUsesPreferredCorporateEndpointAddress(t *testing.T) {
 	local := PeerIdentity{ClusterID: "cluster-1", NodeID: "node-a"}
 	cache := NewPeerCache(PeerCacheConfig{