diff --git a/.github/workflows/ubuntu-builder.yml b/.github/workflows/ubuntu-builder.yml
index 58796eaf8..1df720a2c 100644
--- a/.github/workflows/ubuntu-builder.yml
+++ b/.github/workflows/ubuntu-builder.yml
@@ -11,9 +11,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - builder-image: "ghcr.io/${{ github.repository_owner }}/psibase-builder-ubuntu-2004:b2a46a609b12f645aaeb03245afd0e3d2bf75340"
+          - builder-image: "ghcr.io/${{ github.repository_owner }}/psibase-builder-ubuntu-2004:efa3d81568eb2d4cdc3b3d8a343dd26de0fcba6c"
             ubuntu-version: "2004"
-          - builder-image: "ghcr.io/${{ github.repository_owner }}/psibase-builder-ubuntu-2204:7e3c6e5739df95ba33943789d2cdf5472f91111a"
+          - builder-image: "ghcr.io/${{ github.repository_owner }}/psibase-builder-ubuntu-2204:efa3d81568eb2d4cdc3b3d8a343dd26de0fcba6c"
             ubuntu-version: "2204"
     steps:
       - name: Timestamp
diff --git a/.gitignore b/.gitignore
index 711ae4d51..be1f9e1a9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -24,3 +24,4 @@ vite.config.ts.timestamp-*.mjs
 psibase.127.0.0.1.sslip.io*.pem
 psinode_db
 psinode_db_secure
+__pycache__
diff --git a/doc/psidk/src/consensus.md b/doc/psidk/src/consensus.md
index 05d82bf1e..b6c6c250e 100644
--- a/doc/psidk/src/consensus.md
+++ b/doc/psidk/src/consensus.md
@@ -3,6 +3,18 @@
 - [CFT](#cft)
 - [BFT](#bft)
 - [Joint Consensus](#joint-consensus)
+- [Special Cases](#special-cases)
+
+## Overview
+
+The blockchain forms a replicated state machine. Each block contains a cryptographic hash identifying the previous block and a bundle of transactions that can be applied to the chain state to create a new state. Block execution is strictly deterministic. Applying the same sequence of blocks to the same initial state will always result in the same final state. The process of consensus ensures that nodes agree on the sequence of blocks to apply, and thus agree on the state of the chain.
+
+New blocks are created by block producers designated in the chain state. After a block producer creates a block, the block is distributed to all other block producers which then agree to make the block irreversible. If there are conflicts, then the consensus algorithm will resolve them. Each consensus algorithm has its own constraints on the behavior of block producers. As long as these constraints are met, the consensus algorithm guarantees safety:
+- Only one fork can ever become irreversible
+- If two blocks are irreversible, one must be a descendant of the other
+- An irreversible block cannot be forked out
+
+All of these formulations are equivalent.
 
 ## CFT
 
@@ -57,24 +69,53 @@ BFT consensus has the following properties:
 
 ### Block Production
 
-Blocks are produced by the leader. Leader selection is round-robin. The producer should build off a chain that includes the best block that has been prepared by 2f+1 producers.
+Blocks are produced by the leader. Leader selection is round-robin.
 
 ### Irreversibility
 
 - Blocks are ordered first by term, then by block height.
 - Blocks go through two rounds of confirmation, prepare and commit. Each producer broadcasts its confirmations to all other producer nodes.
-- A producer can only commit a block that has been prepared by 2f+1 producers.
-- If a producer commits a block A, it can only prepare a conflicting block B that is better than A if at least 2f+1 nodes have already prepared an ancestor of B that is better than A.
 - A block is considered irreversible if it has been committed by 2f+1 nodes.
 
+Block producers must obey these restrictions:
+1. A producer shall only commit a block that has been prepared by 2f+1 producers.
+2. A producer shall not prepare or commit conflicting blocks in the same term
+3. A view change for view N names a block from any prior view that has been prepared by 2f+1 producers. This block must not be worse than any block that the producer has committed in any view before N.
+4. The first block of a term must be a descendant of a block which is the best block referenced by 2f+1 view changes from different producers, and is referenced by the leader's best view change. The leader MAY issue more than one view change and MUST issue a second view change if its original view change refers to a block that is too old.
+
 ### View Change
 
 Each producer maintains a view change timer to detect failure in the leader. The view change timer is restarted whenever irreversibility advances. When the view change timer expires, a producer broadcasts a `view_change_message` to all other producers and increments the current term, moving to the next leader.
 
-- After initiating a view change, a producer will not restart the view change timer until it sees 2f+1 view change messages.
-- Consecutive view changes during which the chain does not make progress, cause the view change timeout to increase by a flat amount for each view change after the first.
+- After initiating a view change, a producer will not restart the view change timer until it sees 2f+1 block producers are in the same term or later.
+- Consecutive view changes during which the chain does not make progress, cause the view change timeout to increase.
 - A view change will trigger immediately if the leader of the current term or at least f+1 other producers are in a later term. This view change is independent of the view change timer and may skip terms.
 
+View change messages are broadcast network-wide. Every node retains the best view change from each active producer and broadcasts it to its peers whenever it receives a better one. When a node changes its view of active producers, it requests the current list of view change messages from all its peers.
+
+The ordering of view change messages from a single node is defined as follows:
+- A higher term is always better than a lower term
+- The ordering of view changes with the same term depends on whether the node that issued the view change is the leader.
+  - If the source is not the leader, a view change is better if it refers to an older block
+  - If the source is the leader, a view change is better if it refers to a newer block
+
+Note: Since the condition for activating a view requires the leader's view change to refer to a block which not older than other nodes' view changes, this ordering guarantees that as long as a valid set of view changes exist, all connected, honest nodes will converge to the same valid set.
+
+### Safety
+
+Let block X and block Y be two conflicting blocks which are both irreversible
+- Without loss of generality, let X be better than Y
+- Y has been committed by 2f+1 producers, because that is the requirement for it to be considered irreversible
+- let Z be the earliest block that is an ancestor of X (inclusive of X), conflicts with Y, is better than Y, and is prepared by 2f+1 producers. Such a block is guaranteed to exist because X itself must be prepared by 2f+1 producers in order to be committed by any honest producer.
+
+The existence of Z implies that at least f+1 producers have violated the protocol
+- If Z and Y have the same term then at least f+1 producers have violated rule 2
+- Y does not have a higher term than Z because Z is better than Y
+- If Z is in a higher term than Y, then there is a valid view change set for the term of Z
+  - Let W be the block named by the leader's view change
+  - If W is worse than Y, then at least f+1 producers have violated rule 3
+  - Otherwise, W is in a lower term than Z and is prepared by 2f+1 producers (by the definition of a view change) and conflicts with Y and is better than Y (otherwise X would be a descendant of Y), which contradicts the definition of Z.
+
 ### Messages
 
 `BlockMessage`
@@ -92,7 +133,7 @@ The leader is selected from any of the old or new producers. Leader elections an
 
 ### CFT → BFT
 
-The leader is selected by election from the old producers. Irreversibility requires a majority of the old producers and a quorum of the new producers. Leader election requires a majority of the old producers and a quorum of the new producers.
+The leader is selected by election from the old producers. Irreversibility requires a majority of the old producers and a quorum of the new producers. Leader election requires a majority of the old producers and a quorum of the new producers. The new producers cannot advance the current term.
 
 ### BFT → CFT
 
@@ -100,4 +141,9 @@ The leader is selected from the old producers. The new producers commit, but do
 
 ### BFT → BFT
 
-The leader is selected from the old producers. Committing a block and advancing irreversibility require quorums of both the old and the new producers. Switching forks after a commit is permitted if a quorum of either the old or the new producers have prepared the new fork.
+The leader is selected from the old producers. Activating a view, committing a block, and advancing irreversibility all require quorums of both the old and the new producers. View change auto triggers if f+1 of the old producers are ahead of the current term.
+
+## Special Cases
+
+- Blocks with a single producer are immediately irreversible. This is a degenerate case for both algorithms and they behave identically.
+- The genesis block is immediately irreversible. There is nothing to preserve pre-genesis.
diff --git a/libraries/net/include/psibase/bft.hpp b/libraries/net/include/psibase/bft.hpp
index c439d9611..49e438ac9 100644
--- a/libraries/net/include/psibase/bft.hpp
+++ b/libraries/net/include/psibase/bft.hpp
@@ -62,6 +62,14 @@ namespace psibase::net
    // assuming that the signature remains valid.
    PSIO_REFLECT(CommitMessage, definitionWillNotChange(), block_id, producer, signer)
 
+   struct ProducerConfirm
+   {
+      AccountNumber     producer;
+      std::vector<char> signature;
+      friend bool       operator==(const ProducerConfirm&, const ProducerConfirm&) = default;
+   };
+   PSIO_REFLECT(ProducerConfirm, producer, signature)
+
    struct ViewChangeMessage
    {
       static constexpr unsigned type = 40;
@@ -69,13 +77,36 @@ namespace psibase::net
       AccountNumber             producer;
       Claim                     signer;
 
+      // This is the best block which is prepared in a previous term. This
+      // is sufficient to guarantee the properties that we require
+      // - The block must be prepared
+      // - We must not commit a better block in a previous term
+      Checksum256                                 best_prepared;
+      TermNum                                     best_prepared_term;
+      std::vector<ProducerConfirm>                prepares;
+      std::optional<std::vector<ProducerConfirm>> nextPrepares;
+
+      auto by_best_prepared() const { return std::tie(best_prepared_term, best_prepared); }
+
       friend bool operator==(const ViewChangeMessage&, const ViewChangeMessage&) = default;
       std::string to_string() const
       {
-         return "view change: term=" + std::to_string(term) + " producer=" + producer.str();
+         return "view change: term=" + std::to_string(term) + " producer=" + producer.str() +
+                " prepared=" + loggers::to_string(best_prepared);
       }
    };
-   PSIO_REFLECT(ViewChangeMessage, term, producer, signer)
+   PSIO_REFLECT(ViewChangeMessage,
+                term,
+                producer,
+                signer,
+                best_prepared,
+                best_prepared_term,
+                prepares,
+                nextPrepares)
+   inline auto by_best_prepared(psio::view<const ViewChangeMessage> message)
+   {
+      return std::tuple(message.best_prepared_term().unpack(), message.best_prepared().unpack());
+   }
 
    struct RequestViewMessage
    {
@@ -85,13 +116,6 @@ namespace psibase::net
    };
    PSIO_REFLECT(RequestViewMessage);
 
-   struct ProducerConfirm
-   {
-      AccountNumber     producer;
-      std::vector<char> signature;
-   };
-   PSIO_REFLECT(ProducerConfirm, producer, signature)
-
    // TODO: consider using a multiparty signature scheme to save space
    struct BlockConfirm
    {
@@ -116,6 +140,7 @@ namespace psibase::net
       using Base::self;
       using Base::start_leader;
       using Base::stop_leader;
+      using Base::validate_message;
       using Base::validate_producer;
       using typename Base::producer_state;
       enum class confirm_type
@@ -124,21 +149,23 @@ namespace psibase::net
          commit
       };
 
+      template <typename M>
       void verifyMsig(const auto&        revision,
                       const Checksum256& id,
-                      const auto&        commits,
+                      const auto&        confirms,
                       const ProducerSet& prods)
       {
          AccountNumber prevAccount{};
-         check(commits.size() >= prods.threshold(), "Not enough commits");
-         for (const auto& [prod, sig] : commits)
+         check(confirms.size() >= prods.threshold(), "Not enough confirmations");
+         for (const ProducerConfirm& confirm : confirms)
          {
+            const auto& [prod, sig] = confirm;
             // mostly to guarantee that the producers are unique
-            check(prevAccount < prod, "Commits must be ordered by producer");
+            check(prevAccount < prod, "Confirmations must be ordered by producer");
             auto claim = prods.getClaim(prod);
-            check(!!claim, "Not a valid producer");
-            CommitMessage originalCommit{id, prod, *claim};
-            auto          msg = network().serialize_unsigned_message(originalCommit);
+            check(!!claim, "Not a valid producer: " + prod.str());
+            M    originalMsg{id, prod, *claim};
+            auto msg = network().serialize_unsigned_message(originalMsg);
             chain().verify(revision, {msg.data(), msg.size()}, *claim, sig);
          }
       }
@@ -147,11 +174,12 @@ namespace psibase::net
                                        const BlockConfirm&     commits,
                                        const BlockHeaderState* state)
       {
-         verifyMsig(revision, state->blockId(), commits.commits, *state->producers);
+         verifyMsig<CommitMessage>(revision, state->blockId(), commits.commits, *state->producers);
          if (state->nextProducers)
          {
             check(!!commits.nextCommits, "nextCommits required during joint consensus");
-            verifyMsig(revision, state->blockId(), *commits.nextCommits, *state->nextProducers);
+            verifyMsig<CommitMessage>(revision, state->blockId(), *commits.nextCommits,
+                                      *state->nextProducers);
          }
          else
          {
@@ -278,14 +306,18 @@ namespace psibase::net
 
       std::map<Checksum256, block_info> confirmations;
       std::vector<view_info>            producer_views[2];
+      // Blocks that are referenced by view change messages
+      // When such a block is received, it requires the subtree
+      // to be re-evaluated
+      std::vector<Checksum256> pendingBlocks;
 
       using BlockOrder = decltype(std::declval<BlockHeaderState>().order());
 
       BlockOrder best_prepared = {};
-      BlockOrder best_prepare  = {};
-      BlockOrder alt_prepare   = {};
+      BlockOrder best_confirm  = {};
 
       Timer                     _new_term_timer;
+      TermNum                   _ready_term    = -1;
       std::chrono::milliseconds _timeout       = std::chrono::seconds(10);
       std::chrono::milliseconds _timeout_delta = std::chrono::seconds(5);
 
@@ -297,25 +329,6 @@ namespace psibase::net
       std::tuple<const std::shared_ptr<ProducerSet>&, const std::shared_ptr<ProducerSet>&>
       get_producers(const BlockHeaderState* state)
       {
-#if 0
-         std::cout << "producers for block: " << loggers::to_string(state->blockId());
-         std::cout << " {";
-         for(const auto& [name,key] : state->producers->activeProducers)
-         {
-            std::cout << name.str() << ',';
-         }
-         std::cout << '}';
-         if(state->nextProducers)
-         {
-            std::cout << " {";
-            for(const auto& [name,key] : state->nextProducers->activeProducers)
-            {
-               std::cout << name.str() << ',';
-            }
-            std::cout << '}';
-         }
-         std::cout << std::endl;
-#endif
          return {state->producers, state->nextProducers};
       }
 
@@ -424,19 +437,36 @@ namespace psibase::net
                _state = producer_state::follower;
             }
          }
-         bool new_producers = !active_producers[0] || *active_producers[0] != *prods.first;
+         bool new_producers  = !active_producers[0] || *active_producers[0] != *prods.first;
+         bool need_view_sync = false;
          if (start_bft || new_producers)
          {
-            // TODO: start tracking views of joint producers early. Not necessary for safety,
-            // but will help reduce unnecessary delays on a producer change.
             producer_views[0].clear();
             producer_views[0].resize(prods.first->size());
-            network().multicast(RequestViewMessage{});
+            need_view_sync = true;
+         }
+         if ((!active_producers[1] && prods.second) ||
+             (prods.second && *active_producers[1] == *prods.second))
+         {
+            producer_views[1].clear();
+            producer_views[1].resize(prods.second->size());
+            need_view_sync = true;
          }
-         if (new_producers)
+         else if (!prods.second)
          {
-            PSIBASE_LOG(logger, info) << "New producers: " << prods.first->size() << ", "
-                                      << (prods.second ? prods.second->size() : 0);
+            producer_views[1].clear();
+         }
+         if (new_producers || active_producers[1] != prods.second)
+         {
+            PSIBASE_LOG(logger, info) << "Active producers: " << *prods.first
+                                      << print_function(
+                                             [&](std::ostream& os)
+                                             {
+                                                if (prods.second)
+                                                {
+                                                   os << ", " << *prods.second;
+                                                }
+                                             });
          }
          active_producers[0] = std::move(prods.first);
          active_producers[1] = std::move(prods.second);
@@ -446,15 +476,15 @@ namespace psibase::net
             {
                PSIBASE_LOG(logger, info) << "Node is active producer";
                _state = producer_state::follower;
-               start_timer();
+               maybe_start_timer();
+               // If we became a producer due to renaming ourselves, instead of
+               // because the producer set changed, this might not have been set
+               // previously.
+               need_view_sync = true;
             }
             else if (start_bft)
             {
-               start_timer();
-            }
-            if (start_bft || new_producers)
-            {
-               sync_current_term();
+               maybe_start_timer();
             }
          }
          else
@@ -470,7 +500,13 @@ namespace psibase::net
                _state = producer_state::nonvoting;
             }
          }
+         if (need_view_sync)
+         {
+            sync_current_term();
+            network().multicast(RequestViewMessage{});
+         }
          assert(producer_views[0].size() == active_producers[0]->size());
+         assert(!active_producers[1] || producer_views[1].size() == active_producers[1]->size());
       }
 
       void start_timer()
@@ -484,36 +520,372 @@ namespace psibase::net
                    if (!ec && old_term == current_term)
                    {
                       auto committed = chain().get_block_by_num(chain().commit_index());
-                      if (committed && committed->block().header().term() < current_term)
+                      if (!committed || committed->block().header().term() < current_term)
                       {
                          // If we have not committed a block in the current term, increase the block timer
-                         _timeout += _timeout_delta;
+                         //_timeout += _timeout_delta;
+                         _timeout = _timeout * 3 / 2;
+                         PSIBASE_LOG(logger, info)
+                             << "Increased consensus timeout to " << _timeout.count() << " ms";
                       }
                       increase_view();
-                      start_timer();
                    }
                 });
          }
       }
 
       // returns true if a quorum of producers are believed to be in the current term.
-      bool is_term_ready() const
+      bool is_term_ready() { return get_subtree_from_leader() != nullptr; }
+
+      // If the leader has provided a view change that is viable
+      // as the root of the current view, return it. Otherwise,
+      // return nullptr.
+      BlockHeaderState* get_subtree_from_leader()
       {
-         auto threshold = producer_views[0].size() * 2 / 3 + 1;
-         return std::count_if(producer_views[0].begin(), producer_views[0].end(),
-                              [current_term = current_term](const auto& v)
-                              { return v.term == current_term; }) >= threshold;
+         auto& leader_view = producer_views[0][get_leader_index(current_term)];
+         if (leader_view.term != current_term)
+         {
+            PSIBASE_LOG(logger, debug)
+                << "Leader "
+                << (active_producers[0]->activeProducers.begin() + get_leader_index(current_term))
+                       ->first.str()
+                << " not in current term " << current_term << ": "
+                << print_function([&](std::ostream& os) { print_views(os, 0); });
+            return nullptr;
+         }
+         if (!leader_view.best_message)
+         {
+            PSIBASE_LOG(logger, debug) << "View change missing message";
+            return nullptr;
+         }
+         Checksum256       id    = leader_view.best_message->data->best_prepared();
+         BlockHeaderState* state = chain().get_state(id);
+         if (id == Checksum256{})
+         {
+            state = chain().get_state(chain().get_block_id(chain().commit_index()));
+         }
+         else if (state)
+         {
+            // check prepares
+            if (!validate_view_change(state, leader_view))
+            {
+               PSIBASE_LOG(logger, debug) << "View change validation failed";
+               return nullptr;
+            }
+         }
+         if (!state)
+         {
+            if (chain().get_block_id(getBlockNum(id)) == id)
+            {
+               state = chain().get_state(chain().get_block_id(chain().commit_index()));
+            }
+            else
+            {
+               PSIBASE_LOG(logger, debug) << "leader view change refers to unknown state";
+               return nullptr;
+            }
+         }
+
+         auto n = std::count_if(
+             producer_views[0].begin(), producer_views[0].end(),
+             [current_term = current_term,
+              limit        = by_best_prepared(*leader_view.best_message->data)](const auto& v)
+             {
+                return v.term == current_term && v.best_message &&
+                       by_best_prepared(*v.best_message->data) <= limit;
+             });
+         if (!is_term_ready(0, *leader_view.best_message))
+         {
+            PSIBASE_LOG(logger, debug)
+                << "Not enough producers in the current term " << current_term << ": "
+                << print_function([&](std::ostream& os)
+                                  { print_views(os, 0, *leader_view.best_message); });
+            return nullptr;
+         }
+         if (active_producers[1] && !is_term_ready(1, *leader_view.best_message))
+         {
+            PSIBASE_LOG(logger, debug)
+                << "Not enough joint producers in the current term " << current_term << ": "
+                << print_function([&](std::ostream& os)
+                                  { print_views(os, 1, *leader_view.best_message); });
+            return nullptr;
+         }
+         PSIBASE_LOG(logger, debug) << "Term " << current_term << " ready";
+         return state;
+      }
+
+      void print_views(std::ostream&                           os,
+                       int                                     group,
+                       const SignedMessage<ViewChangeMessage>& leader_msg)
+      {
+         os << '[';
+         bool first = true;
+         for (std::size_t i = 0; i < producer_views[group].size(); ++i)
+         {
+            const auto& view = producer_views[group][i];
+            const auto& prod = (active_producers[group]->activeProducers.begin() + i)->first;
+            if (first)
+            {
+               first = false;
+            }
+            else
+            {
+               os << ' ';
+            }
+            os << prod.str() << '=' << view.term;
+            if (view.term == current_term &&
+                !(view.best_message &&
+                  by_best_prepared(*view.best_message->data) <= by_best_prepared(*leader_msg.data)))
+            {
+               os << '!';
+            }
+         }
+         os << ']';
+      }
+
+      void print_views(std::ostream& os, int group)
+      {
+         os << '[';
+         bool first = true;
+         for (std::size_t i = 0; i < producer_views[group].size(); ++i)
+         {
+            const auto& view = producer_views[group][i];
+            const auto& prod = (active_producers[group]->activeProducers.begin() + i)->first;
+            if (first)
+            {
+               first = false;
+            }
+            else
+            {
+               os << ' ';
+            }
+            os << prod.str() << '=' << view.term;
+         }
+         os << ']';
       }
 
+      bool is_term_ready(int group, const SignedMessage<ViewChangeMessage>& leader_msg)
+      {
+         auto n = std::ranges::count_if(producer_views[group],
+                                        [current_term = current_term,
+                                         limit = by_best_prepared(*leader_msg.data)](const auto& v)
+                                        {
+                                           return v.term == current_term && v.best_message &&
+                                                  by_best_prepared(*v.best_message->data) <= limit;
+                                        });
+         return n >= active_producers[group]->threshold();
+      }
+
+      BlockHeaderState* get_subtree_from_view_change(view_info& info)
+      {
+         if (!info.best_message)
+         {
+            return nullptr;
+         }
+         if (info.best_message->data->best_prepared().unpack() == Checksum256{})
+         {
+            return chain().get_state(chain().get_block_id(chain().commit_index()));
+         }
+         BlockHeaderState* state = chain().get_state(info.best_message->data->best_prepared());
+         if (!state)
+         {
+            if (getBlockNum(info.best_message->data->best_prepared()) > chain().commit_index())
+            {
+               pendingBlocks.push_back(info.best_message->data->best_prepared());
+            }
+            return nullptr;
+         }
+         if (!validate_view_change(state, info))
+         {
+            return nullptr;
+         }
+         return state;
+      }
+
+      bool validate_view_change(BlockHeaderState* state, view_info& info)
+      {
+         if (info.best_message->data->best_prepared_term() != state->info.header.term)
+         {
+            PSIBASE_LOG(logger, warning) << "invalid view change: wrong term";
+            return false;
+         }
+         auto verifyState = chain().get_state(state->info.header.previous);
+         if (!verifyState)
+         {
+            // TODO: This implies that state is LIB. The need for this check
+            // is yet another symptom of the problems with the way we're handling
+            // the services for signature verification
+            return true;
+         }
+         try
+         {
+            verifyMsig<PrepareMessage>(verifyState->authState->revision, state->blockId(),
+                                       info.best_message->data->prepares(), *state->producers);
+            if (state->nextProducers && state->nextProducers->algorithm == ConsensusAlgorithm::bft)
+            {
+               if (auto nextPrepares = info.best_message->data->nextPrepares())
+               {
+                  verifyMsig<PrepareMessage>(verifyState->authState->revision, state->blockId(),
+                                             *nextPrepares, *state->nextProducers);
+               }
+               else
+               {
+                  PSIBASE_LOG(logger, warning) << "invalid view change: missing nextPrepares";
+                  return false;
+               }
+            }
+            else if (info.best_message->data->nextPrepares())
+            {
+               PSIBASE_LOG(logger, warning) << "invalid view change: unexpected nextPrepares";
+               return false;
+            }
+         }
+         catch (std::runtime_error& e)
+         {
+            PSIBASE_LOG(logger, warning) << "invalid view change: " << e.what();
+            return false;
+         }
+         return true;
+      }
+
+      void load_prepares(const BlockHeaderState*                        state,
+                         const ProducerSet&                             prods,
+                         psio::view<const std::vector<ProducerConfirm>> prepares)
+      {
+         for (const ProducerConfirm& confirm : prepares)
+         {
+            const auto& [prod, sig] = confirm;
+            auto claim              = prods.getClaim(prod);
+            check(!!claim, "Not a valid producer");
+            PrepareMessage originalPrepare{state->blockId(), prod, *claim};
+            on_prepare(state, prod, SignedMessage<PrepareMessage>{originalPrepare, sig});
+         }
+      }
+
+      // \pre the msg has been validated, including all prepare signatures
+      void load_prepares(BlockHeaderState* state, const SignedMessage<ViewChangeMessage>& msg)
+      {
+         load_prepares(state, *state->producers, msg.data->prepares());
+         if (auto nextPrepares = msg.data->nextPrepares())
+         {
+            load_prepares(state, *state->nextProducers, *nextPrepares);
+         }
+      }
+
+      void set_root()
+      {
+         // If the current producer's ViewChange for the current term is viable, use it
+         // Otherwise, use the best ViewChange for the current term
+         BlockHeaderState* state = get_subtree_from_leader();
+         if (!state)
+         {
+            pendingBlocks.clear();
+            view_info* best_view_change = nullptr;
+            for (int i = 0; i < 2; ++i)
+            {
+               for (auto& view_change : producer_views[i])
+               {
+                  if (view_change.term == current_term)
+                  {
+                     BlockHeaderState* check_state = get_subtree_from_view_change(view_change);
+                     if (check_state)
+                     {
+                        if (!best_view_change ||
+                            by_best_prepared(*best_view_change->best_message->data) <
+                                by_best_prepared(*view_change.best_message->data))
+                        {
+                           best_view_change = &view_change;
+                           state            = check_state;
+                        }
+                     }
+                  }
+               }
+            }
+            std::ranges::sort(pendingBlocks);
+            auto [b, e] = std::ranges::unique(pendingBlocks);
+            pendingBlocks.erase(b, e);
+            if (state && is_leader())
+            {
+               // TODO: We should not assume that state corresponds to best_message
+               load_prepares(state, *best_view_change->best_message);
+               sync_current_term();
+            }
+         }
+         // Because we accept view changes even if we don't have the referenced block,
+         // it's possible to trigger a view change without being able to set the subtree.
+         if (!state)
+         {
+            state = chain().get_state(chain().get_block_id(chain().commit_index()));
+         }
+         chain().set_subtree(state, "view change from current leader");
+      }
+
+      ViewChangeMessage make_view_change(BlockHeaderState* state)
+      {
+         ViewChangeMessage result{.term = current_term, .producer = self};
+         result.best_prepared      = state->blockId();
+         result.best_prepared_term = state->info.header.term;
+         auto pos                  = confirmations.find(state->blockId());
+         assert(pos != confirmations.end());
+         if (state->nextProducers && state->nextProducers->algorithm == ConsensusAlgorithm::bft)
+         {
+            result.nextPrepares.emplace();
+         }
+         for (const auto& msg : pos->second.prepares)
+         {
+            if (auto expected = state->producers->getClaim(msg.data->producer());
+                expected && expected == msg.data->signer())
+            {
+               result.prepares.push_back({msg.data->producer(), msg.signature});
+            }
+            if (result.nextPrepares)
+            {
+               if (auto expected = state->nextProducers->getClaim(msg.data->producer());
+                   expected && expected == msg.data->signer())
+               {
+                  result.nextPrepares->push_back({msg.data->producer(), msg.signature});
+               }
+            }
+         }
+         auto compareProducer = [](const auto& lhs, const auto& rhs)
+         { return lhs.producer < rhs.producer; };
+         std::ranges::sort(result.prepares, compareProducer);
+         if (result.nextPrepares)
+         {
+            std::ranges::sort(*result.nextPrepares, compareProducer);
+         }
+         return result;
+      }
+      ViewChangeMessage make_view_change()
+      {
+         auto id = orderToXid(best_prepared);
+         if (auto* state = chain().get_state(id.id()); state && state->blockId() != Checksum256{})
+         {
+            return make_view_change(state);
+         }
+         else
+         {
+            // The absence of a state implies that a better block has been committed (The
+            // fact that this block has been prepared prevents it from being forked out
+            // by a worse block)
+            // Therefore at least 2f+1 producers have seen a better prepared block
+            // Therefore this view change will not be chosen
+            // Therefore the list of prepares is not needed
+            return ViewChangeMessage{
+                .term = current_term, .producer = self, .best_prepared = id.id()};
+         }
+      }
       void sync_current_term()
       {
+         auto view_change = make_view_change();
+
          for_each_key(
              [&](const auto& k)
              {
-                auto msg = network().sign_message(
-                    ViewChangeMessage{.term = current_term, .producer = self, .signer = k});
+                view_change.signer = k;
+                auto msg           = network().sign_message(view_change);
                 set_producer_view(msg);
-                network().multicast_producers(msg);
+                network().multicast(msg);
              });
       }
 
@@ -555,6 +927,25 @@ namespace psibase::net
          }
       }
 
+      bool compare_view_change(const ProducerSet&                  producers,
+                               psio::view<const ViewChangeMessage> lhs,
+                               psio::view<const ViewChangeMessage> rhs)
+      {
+         assert(lhs.producer() == rhs.producer());
+         if (lhs.term() < rhs.term())
+            return true;
+         if (lhs.term() > rhs.term())
+            return false;
+         if (is_leader(producers, lhs.term(), lhs.producer()))
+         {
+            return by_best_prepared(lhs) < by_best_prepared(rhs);
+         }
+         else
+         {
+            return by_best_prepared(lhs) > by_best_prepared(rhs);
+         }
+      }
+
       const SignedMessage<ViewChangeMessage>* get_newer_view(
           const SignedMessage<ViewChangeMessage>& msg)
       {
@@ -574,7 +965,8 @@ namespace psibase::net
          if (auto idx = active_producers[group]->getIndex(msg.data->producer(), msg.data->signer()))
          {
             auto& view = producer_views[group][*idx];
-            if (view.best_message && view.best_message->data->term() > msg.data->term())
+            if (view.best_message &&
+                compare_view_change(*active_producers[group], *msg.data, *view.best_message->data))
             {
                return &*view.best_message;
             }
@@ -619,7 +1011,9 @@ namespace psibase::net
                view.term = term;
                result    = true;
             }
-            if (msg && (!view.best_message || view.best_message->data->term() < msg->data->term()))
+            if (msg &&
+                (!view.best_message || compare_view_change(*active_producers[group],
+                                                           *view.best_message->data, *msg->data)))
             {
                view.best_message = *msg;
                result            = true;
@@ -644,6 +1038,7 @@ namespace psibase::net
                   Base::switch_fork();
                }
             }
+            maybe_start_timer();
          }
          return result;
       }
@@ -656,6 +1051,21 @@ namespace psibase::net
          }
       }
 
+      void maybe_start_timer()
+      {
+         if (_ready_term != current_term)
+         {
+            auto n = std::ranges::count_if(producer_views[0], [current_term = current_term](auto& v)
+                                           { return v.term >= current_term; });
+            if (n >= active_producers[0]->threshold())
+            {
+               _ready_term = current_term;
+               PSIBASE_LOG(logger, debug) << "Starting consensus timer for term " << current_term;
+               start_timer();
+            }
+         }
+      }
+
       void check_view_change_threshold()
       {
          std::vector<TermNum> view_copy;
@@ -671,10 +1081,26 @@ namespace psibase::net
          if (new_term > current_term)
          {
             set_view(new_term);
-            start_timer();
+            maybe_start_timer();
          }
       }
 
+      bool is_forbidden_fork(const BlockHeaderState* state)
+      {
+         // If we have not confirmed anything, there are no restrictions
+         if (orderToXid(best_confirm).id() == Checksum256{})
+         {
+            return false;
+         }
+         // If the block does not fork, then we can confirm it
+         if (chain().in_best_chain(state->xid()) && chain().in_best_chain(orderToXid(best_confirm)))
+         {
+            return false;
+         }
+         // Forks are allowed on a new term
+         return orderToTerm(best_confirm) >= state->info.header.term;
+      }
+
       // track best committed, best prepared, best prepared on different fork
       bool can_prepare(const BlockHeaderState* state)
       {
@@ -686,9 +1112,20 @@ namespace psibase::net
          {
             return false;
          }
+         if (state->info.header.term != current_term ||
+             active_producers[0]->algorithm != ConsensusAlgorithm::bft || !is_term_ready())
+         {
+            return false;
+         }
+         // CFT joint producers should not prepare
          if (state->nextProducers && state->nextProducers->algorithm != ConsensusAlgorithm::bft)
          {
-            return state->producers->isProducer(self);
+            if (!state->producers->isProducer(self))
+               return false;
+         }
+         if (is_forbidden_fork(state))
+         {
+            return false;
          }
          return true;
       }
@@ -702,16 +1139,12 @@ namespace psibase::net
          {
             return false;
          }
-         // have threshold prepares AND have not prepared a better conflicting block
-         if (chain().in_best_chain(state->xid()) && chain().in_best_chain(orderToXid(best_prepare)))
+         if (state->info.header.term != current_term ||
+             active_producers[0]->algorithm != ConsensusAlgorithm::bft || !is_term_ready())
          {
-            return state->order() > alt_prepare;
-         }
-         else
-         {
-            return state->order() > best_prepare;
+            return false;
          }
-         return false;
+         return !is_forbidden_fork(state);
       }
       void on_prepare(const BlockHeaderState* state, AccountNumber producer, const auto& msg)
       {
@@ -722,7 +1155,7 @@ namespace psibase::net
             {
                best_prepared = state->order();
                set_view(state->info.header.term);
-               chain().set_subtree(state, "prepared by a quorum of producers");
+               //chain().set_subtree(state, "prepared by a quorum of producers");
                // Fork switch handled by caller. It cannot be handled
                // here because we might already by in the process of
                // switching forks
@@ -737,13 +1170,9 @@ namespace psibase::net
       {
          const auto& id = state->blockId();
          assert(chain().in_best_chain(state->xid()));
-         if (state->order() > best_prepare)
+         if (state->order() > best_confirm)
          {
-            if (!chain().in_best_chain(orderToXid(best_prepare)))
-            {
-               alt_prepare = best_prepare;
-            }
-            best_prepare = state->order();
+            best_confirm = state->order();
          }
          for_each_key(state,
                       [&](const auto& key)
@@ -751,7 +1180,7 @@ namespace psibase::net
                          auto message = network().sign_message(
                              PrepareMessage{.block_id = id, .producer = self, .signer = key});
                          on_prepare(state, self, message);
-                         network().multicast_producers(message);
+                         network().multicast_producers(id, message);
                       });
       }
       void save_commit_data(const BlockHeaderState* state)
@@ -788,17 +1217,16 @@ namespace psibase::net
          }
          chain().setBlockData(state->blockId(), psio::convert_to_frac(result));
       }
-      //
       void verify_commit(const BlockHeaderState* state)
       {
-         if (state->order() < best_prepared)
+         if (state->order() < best_prepared &&
+             !chain().is_ancestor(state->xid(), orderToXid(best_prepared)))
          {
             PSIBASE_LOG(logger, critical)
                 << "Consensus failure: committing a block that that is not in the best "
                    "chain. This means that either there is a severe bug in the software, or "
                    "the maximum number of byzantine faults was exceeded.";
-            // TODO: Now what?  Trigger shutdown? Halt block production, but
-            // leave the server running at the last valid state?
+            throw consensus_failure{};
          }
       }
       void on_commit(const BlockHeaderState*             state,
@@ -829,13 +1257,17 @@ namespace psibase::net
       void do_commit(const BlockHeaderState* state, AccountNumber producer)
       {
          const auto& id = state->blockId();
+         if (state->order() > best_confirm)
+         {
+            best_confirm = state->order();
+         }
          for_each_key(state,
                       [&](const auto& key)
                       {
                          auto message = network().sign_message(
                              CommitMessage{.block_id = id, .producer = self, .signer = key});
                          on_commit(state, self, message);
-                         network().multicast_producers(message);
+                         network().multicast_producers(id, message);
                       });
       }
       std::optional<std::vector<char>> makeBlockData(const BlockHeaderState* state)
@@ -899,13 +1331,63 @@ namespace psibase::net
          {
             for (const auto& msg : iter->second.prepares)
             {
-               network().async_send_block(peer, msg, [](const std::error_code&) {});
+               network().async_send(peer, msg, [](const std::error_code&) {});
             }
             for (const auto& msg : iter->second.commits)
             {
-               network().async_send_block(peer, msg, [](const std::error_code&) {});
+               network().async_send(peer, msg, [](const std::error_code&) {});
+            }
+         }
+         Base::post_send_block(peer, id);
+      }
+
+      void validate_aux_consensus_data(const BlockHeaderState*             state,
+                                       psio::view<const std::vector<char>> aux)
+      {
+         auto        data   = psio::from_frac<BlockConfirm>(aux);
+         const auto& header = state->info.header;
+         check(data.blockNum >= header.commitNum && data.blockNum <= header.blockNum,
+               "blockNum out of range");
+         auto committed = state;
+         while (committed->blockNum() > data.blockNum)
+         {
+            committed = chain().get_state(committed->info.header.previous);
+            if (!committed)
+            {
+               // TODO: We can't verify the signatures, but that's okay because
+               // they're proving somthing that we already know. We just
+               // need to remove or replace them for outgoing blocks.
+               return;
             }
          }
+         auto verifyState = chain().get_state(state->info.header.previous);
+         assert(verifyState && "accept_block_header requires the previous block to be known");
+         verifyIrreversibleSignature(verifyState->authState->revision, data, committed);
+         if (committed->producers->algorithm == ConsensusAlgorithm::bft)
+         {
+            chain().setBlockData(committed->blockId(), aux);
+         }
+         // Ensure that the committed block is a candidate for the best block
+         set_view(committed->info.header.term);
+         if (!chain().in_best_chain(committed->xid()))
+         {
+            verify_commit(committed);
+            //chain().set_subtree(committed, "made irreversible by a subsequent block");
+            // fork switch will be handled by the caller
+            auto [iter, _] = confirmations.try_emplace(committed->blockId(), state->producers,
+                                                       state->nextProducers);
+            // Signal to on_accept_block that it should commit this block
+            // as soon as it is applied.
+            iter->second.committedByBlock = true;
+         }
+         else if (chain().commit(data.blockNum))
+         {
+            start_timer();
+         }
+         if (committed->order() > best_prepared)
+         {
+            best_prepared = committed->order();
+         }
       }
 
       void on_accept_block_header(const BlockHeaderState* state)
@@ -918,50 +1400,7 @@ namespace psibase::net
             auto block = chain().get(state->blockId());
             if (auto aux = block->auxConsensusData())
             {
-               auto data   = psio::from_frac<BlockConfirm>(*aux);
-               auto header = block->block().header();
-               check(data.blockNum >= header.commitNum() && data.blockNum <= header.blockNum(),
-                     "blockNum out of range");
-               auto committed = state;
-               while (committed->blockNum() > data.blockNum)
-               {
-                  committed = chain().get_state(committed->info.header.previous);
-                  if (!committed)
-                  {
-                     // TODO: We can't verify the signatures, but that's okay because
-                     // they're proving somthing that we already know. We just
-                     // need to remove or replace them for outgoing blocks.
-                     return;
-                  }
-               }
-               auto verifyState = chain().get_state(state->info.header.previous);
-               assert(verifyState && "accept_block_header requires the previous block to be known");
-               verifyIrreversibleSignature(verifyState->authState->revision, data, committed);
-               if (committed->producers->algorithm == ConsensusAlgorithm::bft)
-               {
-                  chain().setBlockData(committed->blockId(), *aux);
-               }
-               // Ensure that the committed block is a candidate for the best block
-               set_view(committed->info.header.term);
-               if (!chain().in_best_chain(committed->xid()))
-               {
-                  verify_commit(committed);
-                  chain().set_subtree(committed, "made irreversible by a subsequent block");
-                  // fork switch will be handled by the caller
-                  auto [iter, _] = confirmations.try_emplace(committed->blockId(), state->producers,
-                                                             state->nextProducers);
-                  // Signal to on_accept_block that it should commit this block
-                  // as soon as it is applied.
-                  iter->second.committedByBlock = true;
-               }
-               else if (chain().commit(data.blockNum))
-               {
-                  start_timer();
-               }
-               if (committed->order() > best_prepared)
-               {
-                  best_prepared = committed->order();
-               }
+               validate_aux_consensus_data(state, *aux);
             }
             else
             {
@@ -970,6 +1409,10 @@ namespace psibase::net
                check(state->singleProducer() || !state->needsIrreversibleSignature(),
                      "Missing irreversibility proof");
             }
+            if (std::ranges::binary_search(pendingBlocks, state->blockId()))
+            {
+               set_root();
+            }
          }
          return Base::on_accept_block_header(state);
       }
@@ -977,16 +1420,7 @@ namespace psibase::net
       void connect(peer_id peer)
       {
          Base::connect(peer);
-         if (active_producers[0]->algorithm == ConsensusAlgorithm::bft)
-         {
-            for (const auto& [term, msg] : producer_views[0])
-            {
-               if (msg)
-               {
-                  network().async_send_block(peer, *msg, [](const std::error_code&) {});
-               }
-            }
-         }
+         send_all_view_changes(peer);
       }
 
       void recv(peer_id peer, const SignedMessage<PrepareMessage>& msg)
@@ -1003,7 +1437,7 @@ namespace psibase::net
          validate_producer(state, msg.data->producer(), msg.data->signer());
          do_view_change(msg.data->producer(), msg.data->signer(), state->info.header.term);
          on_prepare(state, msg.data->producer(), msg);
-         Base::switch_fork();
+         //Base::switch_fork();
       }
       void recv(peer_id peer, const SignedMessage<CommitMessage>& msg)
       {
@@ -1028,23 +1462,32 @@ namespace psibase::net
          if (set_producer_view(msg))
          {
             check_view_change_threshold();
+            set_root();
+            Base::switch_fork();
             // If this is a new view, notify our peers
             network().multicast(msg);
          }
-         if (const auto* response = get_newer_view(msg))
-         {
-            assert(response->data->producer().unpack() == msg.data->producer().unpack());
-            assert(response->data->term() > msg.data->term());
-            // If we have a newer view than the sender, reply with our view
-            network().async_send_block(peer, *response, [](const std::error_code&) {});
-         }
          if (current_term != saved_term)
          {
             Base::switch_fork();
          }
       }
 
-      void recv(peer_id peer, const RequestViewMessage&)
+      std::optional<Checksum256> validate_message(const PrepareMessage& msg)
+      {
+         // TODO: actual validation
+         return msg.block_id;
+      }
+
+      std::optional<Checksum256> validate_message(const CommitMessage& msg)
+      {
+         // TODO: actual validation
+         return msg.block_id;
+      }
+
+      void recv(peer_id peer, const RequestViewMessage&) { send_all_view_changes(peer); }
+
+      void send_all_view_changes(peer_id peer)
       {
          if (active_producers[0]->algorithm == ConsensusAlgorithm::bft)
          {
@@ -1052,7 +1495,17 @@ namespace psibase::net
             {
                if (msg)
                {
-                  network().async_send_block(peer, *msg, [](const std::error_code&) {});
+                  network().async_send(peer, *msg, [](const std::error_code&) {});
+               }
+            }
+            if (active_producers[1])
+            {
+               for (const auto& [term, msg] : producer_views[1])
+               {
+                  if (msg)
+                  {
+                     network().async_send(peer, *msg, [](const std::error_code&) {});
+                  }
                }
             }
          }
diff --git a/libraries/net/include/psibase/blocknet.hpp b/libraries/net/include/psibase/blocknet.hpp
index 4fbc54bf2..593854448 100644
--- a/libraries/net/include/psibase/blocknet.hpp
+++ b/libraries/net/include/psibase/blocknet.hpp
@@ -28,6 +28,17 @@ namespace psibase::net
       return tp - rem;
    }
 
+   template <typename F>
+   struct print_function
+   {
+      F                    f;
+      friend std::ostream& operator<<(std::ostream& os, const print_function& f)
+      {
+         f.f(os);
+         return os;
+      }
+   };
+
    struct HelloRequest
    {
       static constexpr unsigned type = 32;
@@ -163,6 +174,12 @@ namespace psibase::net
          connection.hello_sent       = false;
          connection.hello.xid        = chain().get_head_state()->xid();
          async_send_hello(connection);
+         if (connection.hello.xid.id() == Checksum256{})
+         {
+            connection.last_received = {Checksum256{}, 1};
+            connection.last_sent     = connection.last_received;
+            connection.ready         = true;
+         }
       }
       void async_send_hello(peer_connection& connection)
       {
@@ -188,25 +205,25 @@ namespace psibase::net
             }
          }
          connection.hello_sent = true;
-         network().async_send_block(connection.id, connection.hello,
-                                    [this, &connection](const std::error_code& ec)
-                                    {
-                                       if (connection.closed)
-                                       {
-                                          connection.peer_ready = true;
-                                          disconnect(connection.id);
-                                          return;
-                                       }
-                                       else if (ec)
-                                       {
-                                          connection.peer_ready = true;
-                                       }
-                                       if (!connection.peer_ready)
-                                       {
-                                          // TODO: rate limit hellos, delay second hello until we have received the first peer hello
-                                          async_send_hello(connection);
-                                       }
-                                    });
+         network().async_send(connection.id, connection.hello,
+                              [this, &connection](const std::error_code& ec)
+                              {
+                                 if (connection.closed)
+                                 {
+                                    connection.peer_ready = true;
+                                    disconnect(connection.id);
+                                    return;
+                                 }
+                                 else if (ec)
+                                 {
+                                    connection.peer_ready = true;
+                                 }
+                                 if (!connection.peer_ready)
+                                 {
+                                    // TODO: rate limit hellos, delay second hello until we have received the first peer hello
+                                    async_send_hello(connection);
+                                 }
+                              });
       }
       void recv(peer_id origin, const HelloRequest& request)
       {
@@ -228,6 +245,8 @@ namespace psibase::net
             // sync from genesis
             connection.last_received = {Checksum256{}, 1};
             connection.last_sent     = connection.last_received;
+            // With no common block, we don't expect to get a HelloResponse
+            connection.peer_ready = true;
          }
          else
          {
@@ -255,9 +274,9 @@ namespace psibase::net
          //std::cout << "ready: received=" << to_string(connection.last_received.id())
          //          << " common=" << to_string(connection.last_sent.id()) << std::endl;
          // FIXME: blocks and hellos need to be sequenced correctly
-         network().async_send_block(connection.id, HelloResponse{},
-                                    [this, &connection](const std::error_code&)
-                                    { async_send_fork(connection); });
+         network().async_send(connection.id, HelloResponse{},
+                              [this, &connection](const std::error_code&)
+                              { async_send_fork(connection); });
       }
       void recv(peer_id origin, const HelloResponse&)
       {
@@ -272,9 +291,17 @@ namespace psibase::net
       }
       bool is_sole_producer() const
       {
-         return ((active_producers[0]->size() == 0 && self != AccountNumber()) ||
-                 (active_producers[0]->size() == 1 && active_producers[0]->isProducer(self))) &&
-                !active_producers[1];
+         if (self == AccountNumber())
+         {
+            return false;
+         }
+         if (active_producers[1])
+         {
+            if (active_producers[1]->size() != 1 || !active_producers[1]->isProducer(self))
+               return false;
+         }
+         return active_producers[0]->size() == 0 ||
+                (active_producers[0]->size() == 1 && active_producers[0]->isProducer(self));
       }
       bool is_producer() const
       {
@@ -285,6 +312,13 @@ namespace psibase::net
                 active_producers[0]->isProducer(self) ||
                 (active_producers[1] && active_producers[1]->isProducer(self));
       }
+      bool is_producer(AccountNumber account) const
+      {
+         return (active_producers[0]->size() == 0 && account != AccountNumber() &&
+                 !active_producers[1]) ||
+                active_producers[0]->isProducer(account) ||
+                (active_producers[1] && active_producers[1]->isProducer(account));
+      }
       producer_id producer_name() const { return self; }
 
       void set_producer_id(producer_id prod)
@@ -301,6 +335,7 @@ namespace psibase::net
                // I believe that this is safe because the fact that it's
                // still the same node guarantees that the hand-off is atomic.
                consensus().set_producers({active_producers[0], active_producers[1]});
+               network().on_producer_change();
                // set_producers may abort the current block,
                // if we are no longer an active producer
                switch_fork();
@@ -406,12 +441,29 @@ namespace psibase::net
                       // to rely on the invariant that there is an active block
                       // iff _state == leader.
                       start_leader();
+                      bool updatedProducers = false;
+                      // If a new consensus was set while building this block,
+                      // our current producers might be out-dated
+                      if (b->info.header.newConsensus)
+                      {
+                         consensus().set_producers({b->producers, b->nextProducers});
+                         updatedProducers = true;
+                      }
                       // on_produce_block and on_fork_switch should both run
                       // before set_producers, because they should see the
                       // producers of this of this block.
                       consensus().on_produce_block(b);
                       consensus().on_fork_switch(&b->info.header);
-                      consensus().set_producers(chain().getProducers());
+                      // Set tentative producers for the next block
+                      if (b->endsJointConsensus())
+                      {
+                         consensus().set_producers({b->nextProducers, nullptr});
+                         updatedProducers = true;
+                      }
+                      if (updatedProducers)
+                      {
+                         network().on_producer_change();
+                      }
                       // do_gc needs to run after on_fork_switch, because
                       // on_fork_switch is responsible for cleaning up any
                       // pointers that will become dangling.
@@ -469,9 +521,9 @@ namespace psibase::net
             peer.last_sent  = {next_block_id, peer.last_sent.num() + 1};
             auto next_block = chain().get(next_block_id);
 
-            network().async_send_block(peer.id, BlockMessage{next_block},
-                                       [this, &peer](const std::error_code& e)
-                                       { async_send_fork(peer); });
+            network().async_send(peer.id, BlockMessage{next_block},
+                                 [this, &peer](const std::error_code& e)
+                                 { async_send_fork(peer); });
             consensus().post_send_block(peer.id, peer.last_sent.id());
          }
          else
@@ -519,6 +571,10 @@ namespace psibase::net
                   async_send_fork(*peer);
                }
             }
+            else
+            {
+               PSIBASE_LOG(logger, debug) << "Peer " << peer->id << " not ready";
+            }
             // ------------------------------------------------------------------
          }
       }
@@ -530,11 +586,12 @@ namespace psibase::net
          {
             peer.last_sent = xid;
          }
+         consensus().post_send_block(peer.id, xid.id());
       }
 
       void recv(peer_id origin, const BlockMessage& request)
       {
-         if (auto state = chain().insert(request.block))
+         if (auto [state, inserted] = chain().insert(request.block); inserted)
          {
             try
             {
@@ -545,12 +602,15 @@ namespace psibase::net
                chain().erase(state);
                throw;
             }
-            // TODO: update_last_received should run even if the block
-            // is already known.
             auto& connection = get_connection(origin);
             update_last_received(connection, state->xid());
             switch_fork();
          }
+         else if (state)
+         {
+            auto& connection = get_connection(origin);
+            update_last_received(connection, state->xid());
+         }
       }
 
       // This should be called after any operation that might change the head block.
@@ -564,7 +624,13 @@ namespace psibase::net
                    PSIBASE_LOG(logger, debug) << "New head block";
                 }
                 // TODO: only run set_producers when the producers actually changed
-                consensus().set_producers(chain().getProducers());
+                auto producers = chain().getProducers();
+                if (producers.first != active_producers[0] ||
+                    producers.second != active_producers[1])
+                {
+                   consensus().set_producers(std::move(producers));
+                   network().on_producer_change();
+                }
                 if (_state == producer_state::leader &&
                     chain().getBlockContext()->current.header.previous != head.blockId)
                 {
@@ -582,16 +648,36 @@ namespace psibase::net
          chain().gc([this](const auto& b) { consensus().on_erase_block(b); });
       }
 
+      bool peer_has_block(peer_id peer, const Checksum256& id)
+      {
+         // If peer_has_block returns true, then the peer's receipt of the block
+         // happens before its receipt of any message sent after peer_has_block returns.
+         //
+         // If peer_has_block returns false, then one of the following will eventually happen:
+         // - The block is not in the best chain
+         // - post_send_block(peer, id)
+
+         auto& connection = get_connection(peer);
+         if (chain().in_best_chain(id) && getBlockNum(id) <= connection.last_sent.num())
+         {
+            return true;
+         }
+         return chain().is_ancestor(id, connection.last_received);
+      }
+
       // Default implementations
       std::optional<std::vector<char>> makeBlockData(const BlockHeaderState*) { return {}; }
       void                             on_accept_block_header(const BlockHeaderState*) {}
       void                             on_produce_block(const BlockHeaderState*) {}
       void                             on_accept_block(const BlockHeaderState*) {}
-      void                             post_send_block(peer_id, const Checksum256&) {}
-      void                             on_erase_block(const Checksum256&) {}
-      void                             set_producers(auto prods)
+      void                             post_send_block(peer_id peer, const Checksum256& id)
+      {
+         network().on_peer_block(peer, id);
+      }
+      void on_erase_block(const Checksum256&) {}
+      void set_producers(auto prods)
       {
-         if (prods.first->size() != 0 || prods.second)
+         if (prods.first->size() != 0)
             throw std::runtime_error("Consensus algorithm not available");
          active_producers[0] = std::move(prods.first);
          active_producers[1] = std::move(prods.second);
@@ -605,5 +691,6 @@ namespace psibase::net
          }
       }
       void cancel() {}
+      void validate_message() {}
    };
 }  // namespace psibase::net
diff --git a/libraries/net/include/psibase/cft.hpp b/libraries/net/include/psibase/cft.hpp
index b47854353..114622581 100644
--- a/libraries/net/include/psibase/cft.hpp
+++ b/libraries/net/include/psibase/cft.hpp
@@ -87,6 +87,7 @@ namespace psibase::net
       using Base::self;
       using Base::start_leader;
       using Base::stop_leader;
+      using Base::validate_message;
       using Base::validate_producer;
       using typename Base::producer_state;
 
@@ -172,6 +173,18 @@ namespace psibase::net
                _state = producer_state::unknown;
             }
          }
+         if (active_producers[0] != prods.first || active_producers[1] != prods.second)
+         {
+            PSIBASE_LOG(logger, info) << "Active producers: " << *prods.first
+                                      << print_function(
+                                             [&](std::ostream& os)
+                                             {
+                                                if (prods.second)
+                                                {
+                                                   os << ", " << *prods.second;
+                                                }
+                                             });
+         }
          active_producers[0] = std::move(prods.first);
          active_producers[1] = std::move(prods.second);
          if (is_producer())
@@ -360,7 +373,7 @@ namespace psibase::net
       void randomize_timer()
       {
          // Don't bother waiting if we're the only producer
-         if (active_producers[0]->size() <= 1 && !active_producers[1])
+         if (this->is_sole_producer())
          {
             if (_state == producer_state::follower)
             {
@@ -504,6 +517,21 @@ namespace psibase::net
             check_votes();
          }
       }
+      bool validate_message(const ConfirmMessage&)
+      {
+         // TODO:
+         return true;
+      }
+      bool validate_message(const RequestVoteRequest&)
+      {
+         // TODO:
+         return true;
+      }
+      bool validate_message(const RequestVoteResponse&)
+      {
+         // TODO:
+         return true;
+      }
    };
 
 }  // namespace psibase::net
diff --git a/libraries/net/include/psibase/direct_routing.hpp b/libraries/net/include/psibase/direct_routing.hpp
index 68bd0f2ca..f14ee2b4f 100644
--- a/libraries/net/include/psibase/direct_routing.hpp
+++ b/libraries/net/include/psibase/direct_routing.hpp
@@ -9,26 +9,15 @@
 #include <memory>
 #include <psibase/SignedMessage.hpp>
 #include <psibase/log.hpp>
-#include <psibase/message_serializer.hpp>
 #include <psibase/net_base.hpp>
+#include <psibase/routing_base.hpp>
 #include <psio/fracpack.hpp>
 #include <queue>
+#include <random>
 #include <vector>
 
 namespace psibase::net
 {
-   // message type 0 is reserved to ensure that message signatures
-   // are disjoint from block signatures.
-   // message types 1-31 are used for routing messages
-   // message types 32-63 are used for consensus messages
-   struct InitMessage
-   {
-      static constexpr unsigned type = 1;
-      std::uint32_t             version;
-      NodeId                    id;
-      std::string to_string() const { return "init: version=" + std::to_string(version); }
-   };
-   PSIO_REFLECT(InitMessage, version, id);
    struct ProducerMessage
    {
       static constexpr unsigned type = 2;
@@ -37,33 +26,24 @@ namespace psibase::net
    };
    PSIO_REFLECT(ProducerMessage, producer)
 
-   template <typename T>
-   concept has_block_id = requires(T& t) { t.block_id; };
-
    // This requires all producers to be peers
    template <typename Derived>
-   struct direct_routing : message_serializer<Derived>
+   struct direct_routing : routing_base<Derived>
    {
-      auto& peers() { return static_cast<Derived*>(this)->peers(); }
-      auto& chain() { return static_cast<Derived*>(this)->chain(); }
-      explicit direct_routing(boost::asio::io_context& ctx)
-      {
-         std::random_device rng;
-         nodeId = std::uniform_int_distribution<NodeId>()(rng);
-      }
-      static const std::uint32_t protocol_version = 0;
-      auto                       get_message_impl()
-      {
-         return boost::mp11::mp_push_back<
-             typename std::remove_cvref_t<
-                 decltype(static_cast<Derived*>(this)->consensus())>::message_type,
-             InitMessage, ProducerMessage>{};
-      }
+      using base_type = routing_base<Derived>;
+      using base_type::async_send;
+      using base_type::base_type;
+      using base_type::chain;
+      using base_type::consensus;
+      using base_type::peers;
+      using base_type::recv;
+
+      using message_type = std::variant<ProducerMessage>;
+
       template <typename Msg, typename F>
       void async_send_block(peer_id id, const Msg& msg, F&& f)
       {
-         PSIBASE_LOG(peers().logger(id), debug) << "Sending message: " << msg.to_string();
-         peers().async_send(id, this->serialize_message(msg), std::forward<F>(f));
+         async_send(id, msg, f);
       }
       // Sends a message to each peer in a list
       // each peer will receive the message only once even if it is duplicated in the input list.
@@ -108,18 +88,17 @@ namespace psibase::net
       struct connection;
       void connect(peer_id id)
       {
-         async_send_block(id, InitMessage{.version = protocol_version, .id = nodeId},
-                          [](const std::error_code&) {});
+         base_type::connect(id);
          if (auto producer = static_cast<Derived*>(this)->consensus().producer_name();
              producer != AccountNumber())
          {
             async_send_block(id, ProducerMessage{producer}, [](const std::error_code&) {});
          }
-         static_cast<Derived*>(this)->consensus().connect(id);
+         consensus().connect(id);
       }
       void disconnect(peer_id id)
       {
-         static_cast<Derived*>(this)->consensus().disconnect(id);
+         consensus().disconnect(id);
          for (auto iter = producers.begin(), end = producers.end(); iter != end;)
          {
             if (iter->second == id)
@@ -132,105 +111,12 @@ namespace psibase::net
             }
          }
       }
-      template <template <typename...> class L, typename... T>
-      static constexpr bool check_message_uniqueness(L<T...>*)
-      {
-         std::uint8_t ids[] = {T::type...};
-         for (std::size_t i = 0; i < sizeof(ids) - 1; ++i)
-         {
-            for (std::size_t j = i + 1; j < sizeof(ids); ++j)
-            {
-               if (ids[i] == ids[j])
-               {
-                  return false;
-               }
-            }
-         }
-         return true;
-      }
-      template <typename T>
-      void try_recv_impl(peer_id peer, psio::input_stream& s)
-      {
-         try
-         {
-            using message_type = std::conditional_t<NeedsSignature<T>, SignedMessage<T>, T>;
-            return recv(peer, psio::from_frac<message_type>({s.pos, s.end}));
-         }
-         catch (std::exception& e)
-         {
-            PSIBASE_LOG(peers().logger(peer), warning) << e.what();
-            peers().disconnect(peer);
-         }
-      }
-      template <template <typename...> class L, typename... T>
-      void recv_impl(peer_id peer, int key, std::vector<char>&& msg, L<T...>*)
-      {
-         psio::input_stream s(msg.data() + 1, msg.size() - 1);
-         ((key == T::type ? try_recv_impl<T>(peer, s) : (void)0), ...);
-      }
-      void recv(peer_id peer, std::vector<char>&& msg)
-      {
-         using message_type = decltype(get_message_impl());
-         static_assert(check_message_uniqueness((message_type*)nullptr));
-         if (msg.empty())
-         {
-            PSIBASE_LOG(peers().logger(peer), warning) << "Invalid message";
-            peers().disconnect(peer);
-            return;
-         }
-         recv_impl(peer, msg[0], std::move(msg), (message_type*)0);
-      }
-      void recv(peer_id peer, const InitMessage& msg)
-      {
-         PSIBASE_LOG(peers().logger(peer), debug) << "Received message: " << msg.to_string();
-         if (msg.version != protocol_version)
-         {
-            peers().disconnect(peer);
-            return;
-         }
-         if (msg.id)
-         {
-            peers().set_node_id(peer, msg.id);
-         }
-      }
       void recv(peer_id peer, const ProducerMessage& msg)
       {
          PSIBASE_LOG(peers().logger(peer), debug) << "Received message: " << msg.to_string();
          producers.insert({msg.producer, peer});
       }
-      template <typename T>
-      void recv(peer_id peer, const SignedMessage<T>& msg)
-      {
-         std::vector<char> raw;
-         raw.reserve(msg.data.size() + 1);
-         raw.push_back(T::type);
-         raw.insert(raw.end(), msg.data.data(), msg.data.data() + msg.data.size());
-         Claim claim = msg.data->signer();
-         PSIBASE_LOG(peers().logger(peer), debug) << "Received message: " << msg.to_string();
-         if constexpr (has_block_id<T>)
-         {
-            chain().verify(msg.data->block_id(), {raw.data(), raw.size()}, claim, msg.signature);
-         }
-         else
-         {
-            chain().verify({raw.data(), raw.size()}, claim, msg.signature);
-         }
-         if constexpr (has_recv<SignedMessage<T>, Derived>)
-         {
-            static_cast<Derived*>(this)->consensus().recv(peer, msg);
-         }
-         else
-         {
-            static_cast<Derived*>(this)->consensus().recv(peer, msg.data.unpack());
-         }
-      }
-      void recv(peer_id peer, const auto& msg)
-      {
-         PSIBASE_LOG(peers().logger(peer), debug) << "Received message: " << msg.to_string();
-         static_cast<Derived*>(this)->consensus().recv(peer, msg);
-      }
       std::multimap<producer_id, peer_id> producers;
-      NodeId                              nodeId = 0;
    };
 
 }  // namespace psibase::net
diff --git a/libraries/net/include/psibase/message_serializer.hpp b/libraries/net/include/psibase/message_serializer.hpp
index c70f247f7..c36c6a7cf 100644
--- a/libraries/net/include/psibase/message_serializer.hpp
+++ b/libraries/net/include/psibase/message_serializer.hpp
@@ -50,5 +50,6 @@ namespace psibase::net
       {
          return serialize_signed_message(msg);
       }
+      auto serialize_message(const std::vector<char>& msg) { return msg; }
    };
 }  // namespace psibase::net
diff --git a/libraries/net/include/psibase/mock_routing.hpp b/libraries/net/include/psibase/mock_routing.hpp
index 3f56cf4e4..5ce52b1d2 100644
--- a/libraries/net/include/psibase/mock_routing.hpp
+++ b/libraries/net/include/psibase/mock_routing.hpp
@@ -19,6 +19,7 @@ namespace psibase::net
    template <typename Derived>
    struct mock_routing : message_serializer<Derived>
    {
+      using DeferredMessageKey = std::tuple<peer_id, Checksum256>;
       struct peer_info
       {
          mock_routing*              ptr;
@@ -29,6 +30,7 @@ namespace psibase::net
       {
          logger.add_attribute("Channel", boost::log::attributes::constant(std::string("p2p")));
       }
+      void on_producer_change() {}
       void post_recv(peer_id origin, const auto& msg)
       {
          ctx.post(
@@ -69,8 +71,8 @@ namespace psibase::net
                              { ptr->post_recv(origin, message); });
          }
       }
-      template <typename Msg, typename F>
-      void async_send_block(peer_id id, const Msg& msg, F&& f)
+      template <typename Msg>
+      void async_send(peer_id id, const Msg& msg)
       {
          auto peer = _peers.find(id);
          if (peer == _peers.end())
@@ -78,6 +80,11 @@ namespace psibase::net
             throw std::runtime_error("unknown peer");
          }
          send(peer->second, msg);
+      }
+      template <typename Msg, typename F>
+      void async_send(peer_id id, const Msg& msg, F&& f)
+      {
+         async_send(id, msg);
          ctx.post([f]() { f(std::error_code()); });
       }
       template <typename Msg>
@@ -86,6 +93,14 @@ namespace psibase::net
          multicast(msg);
       }
       template <typename Msg>
+      void multicast_producers(const Checksum256& blockid, const Msg& msg)
+      {
+         for (const auto& [id, peer] : _peers)
+         {
+            send_after_block(id, blockid, msg);
+         }
+      }
+      template <typename Msg>
       void multicast(const Msg& msg)
       {
          for (const auto& [id, peer] : _peers)
@@ -94,6 +109,28 @@ namespace psibase::net
          }
       }
       template <typename Msg>
+      void send_after_block(peer_id peer, const Checksum256& blockid, const Msg& msg)
+      {
+         if (static_cast<Derived*>(this)->consensus().peer_has_block(peer, blockid))
+         {
+            async_send(peer, msg);
+         }
+         else
+         {
+            deferredMessages.try_emplace({peer, blockid},
+                                         [this, peer, msg] { async_send(peer, msg); });
+         }
+      }
+      void on_peer_block(peer_id peer, const Checksum256& blockid)
+      {
+         auto r = deferredMessages.equal_range({peer, blockid});
+         for (const auto& [k, f] : std::ranges::subrange(r.first, r.second))
+         {
+            f();
+         }
+         deferredMessages.erase(r.first, r.second);
+      }
+      template <typename Msg>
       void sendto(producer_id producer, const Msg& msg)
       {
          for (const auto& [id, peer] : _peers)
@@ -149,6 +186,9 @@ namespace psibase::net
       peer_id                      next_peer_id = 0;
       std::map<peer_id, peer_info> _peers;
       loggers::common_logger       logger;
+      // Stores messages that should be sent to a peer after the
+      // peer is known to have a particular block.
+      std::map<DeferredMessageKey, std::function<void()>> deferredMessages;
    };
 
 }  // namespace psibase::net
diff --git a/libraries/net/include/psibase/mock_timer.hpp b/libraries/net/include/psibase/mock_timer.hpp
index c4987d9e0..6a8d842b3 100644
--- a/libraries/net/include/psibase/mock_timer.hpp
+++ b/libraries/net/include/psibase/mock_timer.hpp
@@ -29,7 +29,7 @@ namespace psibase::test
       static void           reset();
       static void           reset(time_point);
       static void           advance(duration);
-      static void           advance();
+      static bool           advance();
    };
 
    std::ostream& operator<<(std::ostream&, mock_clock::time_point);
@@ -58,6 +58,7 @@ namespace psibase::test
          std::vector<callback_type>                         callbacks;
          std::function<callback_type(const callback_type&)> bind;
          time_point                                         deadline;
+         std::uint64_t                                      sequence;
       };
       std::shared_ptr<impl> _impl;
       void                  cancel();
diff --git a/libraries/net/include/psibase/peer_manager.hpp b/libraries/net/include/psibase/peer_manager.hpp
index 71e9e3c72..838fc0049 100644
--- a/libraries/net/include/psibase/peer_manager.hpp
+++ b/libraries/net/include/psibase/peer_manager.hpp
@@ -1,9 +1,11 @@
 #pragma once
 
 #include <psibase/log.hpp>
+#include <psibase/net_base.hpp>
 
 #include <boost/asio/dispatch.hpp>
 #include <boost/asio/io_context.hpp>
+#include <boost/asio/steady_timer.hpp>
 #include <boost/log/attributes/constant.hpp>
 #include <functional>
 #include <map>
diff --git a/libraries/net/include/psibase/routing_base.hpp b/libraries/net/include/psibase/routing_base.hpp
new file mode 100644
index 000000000..2fe099876
--- /dev/null
+++ b/libraries/net/include/psibase/routing_base.hpp
@@ -0,0 +1,229 @@
+#pragma once
+
+#include <boost/mp11/algorithm.hpp>
+#include <cstdint>
+#include <psibase/SignedMessage.hpp>
+#include <psibase/log.hpp>
+#include <psibase/message_serializer.hpp>
+#include <psibase/net_base.hpp>
+#include <psio/fracpack.hpp>
+#include <psio/reflect.hpp>
+#include <random>
+#include <string>
+#include <type_traits>
+#include <variant>
+#include <vector>
+
+namespace psibase::net
+{
+   // message type 0 is reserved to ensure that message signatures
+   // are disjoint from block signatures.
+   // message types 1-31 are used for routing messages
+   // message types 32-63 are used for consensus messages
+   struct InitMessage
+   {
+      static constexpr unsigned type = 1;
+      std::uint32_t             version;
+      NodeId                    id;
+      std::string to_string() const { return "init: version=" + std::to_string(version); }
+   };
+   PSIO_REFLECT(InitMessage, version, id);
+
+   template <typename T>
+   concept has_block_id = requires(T& t) { t.block_id; };
+
+   template <typename Derived>
+   struct routing_base : message_serializer<Derived>
+   {
+      auto& peers() { return static_cast<Derived*>(this)->peers(); }
+      auto& consensus() { return static_cast<Derived*>(this)->consensus(); }
+      auto& chain() { return static_cast<Derived*>(this)->chain(); }
+      auto& derived() { return static_cast<Derived*>(this)->network(); }
+      explicit routing_base(boost::asio::io_context& ctx)
+      {
+         std::random_device rng;
+         nodeId = std::uniform_int_distribution<NodeId>()(rng);
+      }
+      static const std::uint32_t protocol_version = 0;
+      // This is used solely for type deduction
+      auto get_message_impl()
+      {
+         return boost::mp11::mp_append<
+             typename std::remove_cvref_t<
+                 decltype(static_cast<Derived*>(this)->consensus())>::message_type,
+             typename std::remove_cvref_t<
+                 decltype(static_cast<Derived*>(this)->network())>::message_type,
+             std::variant<InitMessage>>{};
+      }
+      std::string message_to_string(const auto& msg)
+      {
+         if constexpr (requires { msg.to_string(); })
+         {
+            return msg.to_string();
+         }
+         else if constexpr (requires { msg.to_string(this); })
+         {
+            return msg.to_string(this);
+         }
+         else
+         {
+            return "unknown message";
+         }
+      }
+      template <typename Msg, typename F>
+      void async_send(peer_id id, const Msg& msg, F&& f)
+      {
+         PSIBASE_LOG(peers().logger(id), debug) << "Sending message: " << message_to_string(msg);
+         peers().async_send(id, this->serialize_message(msg), std::forward<F>(f));
+      }
+      template <typename Msg>
+      void async_send(peer_id id, const Msg& msg)
+      {
+         return async_send(id, msg, [](const std::error_code&) {});
+      }
+      struct connection;
+      void connect(peer_id id)
+      {
+         async_send(id, InitMessage{.version = protocol_version, .id = nodeId});
+      }
+      void disconnect(peer_id id) {}
+      template <template <typename...> class L, typename... T>
+      static constexpr bool check_message_uniqueness(L<T...>*)
+      {
+         std::uint8_t ids[] = {T::type...};
+         for (std::size_t i = 0; i < sizeof(ids) - 1; ++i)
+         {
+            for (std::size_t j = i + 1; j < sizeof(ids); ++j)
+            {
+               if (ids[i] == ids[j])
+               {
+                  return false;
+               }
+            }
+         }
+         return true;
+      }
+      template <typename T>
+      void try_recv_impl(peer_id peer, psio::input_stream& s)
+      {
+         try
+         {
+            using message_type = std::conditional_t<NeedsSignature<T>, SignedMessage<T>, T>;
+            return derived().recv(peer, psio::from_frac<message_type>({s.pos, s.end}));
+         }
+         catch (std::exception& e)
+         {
+            PSIBASE_LOG(peers().logger(peer), warning) << e.what();
+            peers().disconnect(peer);
+         }
+      }
+      template <template <typename...> class L, typename... T>
+      void recv_impl(peer_id peer, int key, std::vector<char>&& msg, L<T...>*)
+      {
+         psio::input_stream s(msg.data() + 1, msg.size() - 1);
+         ((key == T::type ? try_recv_impl<T>(peer, s) : (void)0), ...);
+      }
+      void recv(peer_id peer, std::vector<char>&& msg)
+      {
+         using message_type = decltype(get_message_impl());
+         static_assert(check_message_uniqueness((message_type*)nullptr));
+         if (msg.empty())
+         {
+            PSIBASE_LOG(peers().logger(peer), warning) << "Invalid message";
+            peers().disconnect(peer);
+            return;
+         }
+         recv_impl(peer, msg[0], std::move(msg), (message_type*)0);
+      }
+      std::string message_to_string(const std::vector<char>& msg)
+      {
+         std::string result;
+         handle_message(msg, [&](const auto& m) { result = message_to_string(m); });
+         return result;
+      }
+      template <typename T, typename F>
+      void handle_message_impl(psio::input_stream& s, F&& f)
+      {
+         using message_type = std::conditional_t<NeedsSignature<T>, SignedMessage<T>, T>;
+         f(psio::from_frac<message_type>({s.pos, s.end}));
+      }
+      template <typename F, template <typename...> class L, typename... T>
+      void handle_message_impl(int key, const std::vector<char>& msg, F&& f, L<T...>*)
+      {
+         psio::input_stream s(msg.data() + 1, msg.size() - 1);
+         ((key == T::type ? handle_message_impl<T>(s, f) : (void)0), ...);
+      }
+      template <typename F>
+      void handle_message(const std::vector<char>& msg, F&& f)
+      {
+         using message_type = decltype(get_message_impl());
+         if (!msg.empty())
+         {
+            handle_message_impl(msg[0], msg, f, (message_type*)0);
+         }
+      }
+      void recv(peer_id peer, const InitMessage& msg)
+      {
+         PSIBASE_LOG(peers().logger(peer), debug) << "Received message: " << msg.to_string();
+         if (msg.version != protocol_version)
+         {
+            peers().disconnect(peer);
+            return;
+         }
+         if (msg.id)
+         {
+            peers().set_node_id(peer, msg.id);
+         }
+      }
+      template <typename T>
+      void verify_signature(const SignedMessage<T>& msg)
+      {
+         std::vector<char> raw;
+         raw.reserve(msg.data.size() + 1);
+         raw.push_back(T::type);
+         raw.insert(raw.end(), msg.data.data(), msg.data.data() + msg.data.size());
+         Claim claim = msg.data->signer();
+         if constexpr (has_block_id<T>)
+         {
+            chain().verify(msg.data->block_id(), {raw.data(), raw.size()}, claim, msg.signature);
+         }
+         else
+         {
+            chain().verify({raw.data(), raw.size()}, claim, msg.signature);
+         }
+      }
+      template <typename T>
+      void recv(peer_id peer, const SignedMessage<T>& msg)
+      {
+         PSIBASE_LOG(peers().logger(peer), debug) << "Received message: " << msg.to_string();
+         try
+         {
+            verify_signature(msg);
+         }
+         catch (std::runtime_error& e)
+         {
+            // We might fail to validate the signature due to being ahead or
+            // behind the origin of the message. This is not an error, so just
+            // drop the message. TODO: When verifying a signature with an
+            // associated block, we can strictly enforce the signature as long
+            // as we have the correct block header state.
+            PSIBASE_LOG(peers().logger(peer), debug) << "Message dropped: " << e.what();
+            return;
+         }
+         if constexpr (has_recv<SignedMessage<T>, Derived>)
+         {
+            consensus().recv(peer, msg);
+         }
+         else
+         {
+            consensus().recv(peer, msg.data.unpack());
+         }
+      }
+      void recv(peer_id peer, const auto& msg)
+      {
+         PSIBASE_LOG(peers().logger(peer), debug) << "Received message: " << msg.to_string();
+         consensus().recv(peer, msg);
+      }
+      NodeId nodeId = 0;
+   };
+}  // namespace psibase::net
diff --git a/libraries/net/include/psibase/shortest_path_routing.hpp b/libraries/net/include/psibase/shortest_path_routing.hpp
new file mode 100644
index 000000000..902279162
--- /dev/null
+++ b/libraries/net/include/psibase/shortest_path_routing.hpp
@@ -0,0 +1,676 @@
+#pragma once
+
+// Implements a Bellman-Ford based routing algorithm using the feasibility
+// condition from babel (RFC8966) to prevent routing loops
+//
+// Note that this protocol allows routing to producers only.
+// Other nodes act purely as routers from the standpoint of this protocol.
+
+#include <psibase/log.hpp>
+#include <psibase/net_base.hpp>
+#include <psibase/routing_base.hpp>
+
+#include <boost/asio/steady_timer.hpp>
+#include <chrono>
+#include <cstdint>
+#include <map>
+#include <random>
+
+namespace psibase::net
+{
+   struct SequenceNumber
+   {
+      std::uint16_t value;
+      // Not even a partial ordering, because it is cyclic
+      friend bool operator<(const SequenceNumber& lhs, const SequenceNumber& rhs)
+      {
+         return lhs.value != rhs.value && ((rhs.value - lhs.value) & 0x8000) == 0;
+      }
+      friend bool operator>=(const SequenceNumber& lhs, const SequenceNumber& rhs)
+      {
+         return !(lhs < rhs);
+      }
+      friend bool    operator==(const SequenceNumber& lhs, const SequenceNumber& rhs) = default;
+      SequenceNumber operator+(std::uint16_t i) const
+      {
+         return SequenceNumber{static_cast<std::uint16_t>(value + i)};
+      }
+   };
+   PSIO_REFLECT(SequenceNumber, definitionWillNotChange(), value)
+
+   struct RouteMetric
+   {
+      static const RouteMetric infinite;
+      std::uint16_t            value;
+      friend RouteMetric       operator+(const RouteMetric& lhs, const RouteMetric& rhs)
+      {
+         auto result =
+             static_cast<std::uint32_t>(lhs.value) + static_cast<std::uint32_t>(rhs.value);
+         if (result > infinite.value)
+         {
+            return infinite;
+         }
+         else
+         {
+            return {static_cast<std::uint16_t>(result)};
+         }
+      }
+      friend auto operator<=>(const RouteMetric&, const RouteMetric&) = default;
+   };
+   PSIO_REFLECT(RouteMetric, definitionWillNotChange(), value)
+
+   inline const RouteMetric RouteMetric::infinite = {0xffffu};
+
+   struct Feasibility
+   {
+      SequenceNumber seqno;
+      RouteMetric    metric;
+      friend bool    operator<(const Feasibility& lhs, const Feasibility& rhs)
+      {
+         return rhs.seqno < lhs.seqno || (lhs.seqno == rhs.seqno && lhs.metric < rhs.metric);
+      }
+   };
+
+   template <typename Derived, typename Msg>
+   concept has_validate_message =
+       requires(Derived& d, const Msg& msg) { d.consensus().validate_message(msg); };
+
+   struct RouteUpdateMessage
+   {
+      static constexpr unsigned type = 4;
+      producer_id               producer;
+      SequenceNumber            seqno;
+      RouteMetric               metric;
+      std::string               to_string() const
+      {
+         return "route update: " + producer.str() + " seqno=" + std::to_string(seqno.value) +
+                " metric=" + std::to_string(metric.value);
+      }
+   };
+   PSIO_REFLECT(RouteUpdateMessage, producer, seqno, metric)
+
+   struct RouteSeqnoRequest
+   {
+      static constexpr unsigned type = 5;
+      producer_id               producer;
+      SequenceNumber            seqno;
+      std::uint16_t             ttl = 64;
+      std::string               to_string() const
+      {
+         return "seqno request: " + producer.str() + " seqno=" + std::to_string(seqno.value) +
+                " ttl=" + std::to_string(ttl);
+      }
+   };
+   PSIO_REFLECT(RouteSeqnoRequest, producer, seqno, ttl)
+
+   struct RequestRoutesMessage
+   {
+      static constexpr unsigned type = 6;
+      std::string               to_string() const { return "request routes"; }
+   };
+   PSIO_REFLECT(RequestRoutesMessage)
+
+   struct RoutingEnvelope
+   {
+      static constexpr unsigned type = 3;
+      producer_id               destination;
+      std::vector<char>         data;
+      std::string               to_string(auto* serializer) const
+      {
+         return "to " + destination.str() + ": " + serializer->message_to_string(data);
+      }
+   };
+   PSIO_REFLECT(RoutingEnvelope, destination, data)
+
+   template <typename Derived>
+   struct shortest_path_routing : routing_base<Derived>
+   {
+      using base_type = routing_base<Derived>;
+      using base_type::async_send;
+      using base_type::chain;
+      using base_type::consensus;
+      using base_type::peers;
+      using base_type::recv;
+
+      static constexpr peer_id min_peer               = std::numeric_limits<peer_id>::min();
+      static constexpr auto    minSeqnoUpdateInterval = std::chrono::seconds(1);
+      static constexpr auto    seqnoCacheMaxAge       = std::chrono::seconds(30);
+      struct RouteKey
+      {
+         producer_id producer;
+         peer_id     peer;
+         friend auto operator<=>(const RouteKey& lhs, const RouteKey& rhs) = default;
+         friend auto operator<=>(const RouteKey& lhs, const producer_id& rhs)
+         {
+            return lhs.producer <=> rhs;
+         }
+      };
+      struct RouteData
+      {
+         SequenceNumber seqno;
+         RouteMetric    metric;
+         auto           feasibility() const { return Feasibility(seqno, metric); }
+      };
+      struct NeighborData
+      {
+         RouteMetric transmissionCost = 1;
+      };
+      struct CachedSeqnoRequest
+      {
+         SequenceNumber                        seqno;
+         std::chrono::steady_clock::time_point time;
+      };
+
+      struct DeferredMessage
+      {
+         using MessageKey = std::tuple<peer_id, Checksum256>;
+         peer_id           peer;
+         Checksum256       blockid;
+         std::vector<char> message;
+         friend auto       operator<=>(const DeferredMessage&, const DeferredMessage&) = default;
+         friend auto       operator<=>(const DeferredMessage& lhs, const peer_id& rhs)
+         {
+            return lhs.peer <=> rhs;
+         }
+         friend auto operator<=>(const DeferredMessage& lhs, const MessageKey& rhs)
+         {
+            return MessageKey{lhs.peer, lhs.blockid} <=> rhs;
+         }
+      };
+
+      explicit shortest_path_routing(boost::asio::io_context& ctx) : base_type(ctx), seqnoTimer(ctx)
+      {
+         logger.add_attribute("Channel", boost::log::attributes::constant(std::string("p2p")));
+      }
+
+      template <typename Msg>
+      void multicast(const Msg& msg)
+      {
+         for (const auto& [peer, _] : neighborTable)
+         {
+            async_send(peer, msg);
+         }
+      }
+      template <typename Msg>
+      void multicast_producers(const Checksum256& id, const Msg& msg)
+      {
+         for (const auto& [producer, peer] : selectedRoutes)
+         {
+            send_after_block(peer, id, RoutingEnvelope{producer, this->serialize_message(msg)});
+         }
+      }
+      template <typename Msg>
+      void multicast_producers(const Msg& msg)
+      {
+         for (const auto& [producer, peer] : selectedRoutes)
+         {
+            sendto(producer, msg);
+         }
+      }
+      template <typename Msg>
+      void sendto(producer_id producer, const Checksum256& id, const Msg& msg)
+      {
+         auto selected = selectedRoutes.find(producer);
+         if (selected != selectedRoutes.end())
+         {
+            send_after_block(selected->second, id,
+                             RoutingEnvelope{producer, this->serialize_message(msg)});
+         }
+         else
+         {
+            PSIBASE_LOG(logger, debug)
+                << "Message discarded for lack of a route to " << msg.destination.str();
+         }
+      }
+      template <typename Msg>
+      void sendto(producer_id producer, const Msg& msg)
+      {
+         trySend(producer, RoutingEnvelope{producer, this->serialize_message(msg)});
+      }
+      template <typename Msg>
+      void send_after_block(peer_id peer, const Checksum256& blockid, const Msg& msg)
+      {
+         if (consensus().peer_has_block(peer, blockid))
+         {
+            async_send(peer, msg);
+         }
+         else
+         {
+            deferredMessages.insert({peer, blockid, this->serialize_message(msg)});
+         }
+      }
+      void on_peer_block(peer_id peer, const Checksum256& blockid)
+      {
+         auto r = deferredMessages.equal_range(std::tuple{peer, blockid});
+         for (const auto& value : std::ranges::subrange(r.first, r.second))
+         {
+            async_send(peer, value.message);
+         }
+         deferredMessages.erase(r.first, r.second);
+      }
+      void connect(peer_id peer)
+      {
+         base_type::connect(peer);
+         neighborTable.try_emplace(peer, NeighborData{RouteMetric{1}});
+         send_routes(peer);
+         consensus().connect(peer);
+      }
+      void disconnect(peer_id peer)
+      {
+         consensus().disconnect(peer);
+         auto iter = routeTable.begin();
+         auto end  = routeTable.end();
+         while (iter != end)
+         {
+            if (iter->first.peer == peer)
+            {
+               iter = routeTable.erase(iter);
+            }
+            else
+            {
+               ++iter;
+            }
+         }
+         neighborTable.erase(peer);
+         for (auto iter = selectedRoutes.begin(), end = selectedRoutes.end(); iter != end;)
+         {
+            auto next = iter;
+            ++next;
+            if (iter->second == peer)
+            {
+               selectRoute(iter->first, iter->second);
+            }
+            iter = next;
+         }
+      }
+      void send_routes(peer_id peer)
+      {
+         for (const auto& [producer, nextPeer] : selectedRoutes)
+         {
+            auto route = routeTable.find(RouteKey{producer, nextPeer});
+            if (route != routeTable.end())
+            {
+               async_send(peer,
+                          RouteUpdateMessage{producer, route->second.seqno, getMetric(*route)});
+            }
+         }
+         if (auto self = consensus().producer_name(); consensus().is_producer(self))
+         {
+            async_send(peer, RouteUpdateMessage{self, seqno, RouteMetric{0}});
+         }
+      }
+      void on_producer_change()
+      {
+         // purge out-dated routes
+         auto self = consensus().producer_name();
+         for (auto iter = selectedRoutes.begin(), end = selectedRoutes.end(); iter != end;)
+         {
+            if (consensus().is_producer(iter->first) && iter->first != self)
+            {
+               ++iter;
+            }
+            else
+            {
+               PSIBASE_LOG(logger, info) << "Removed route to " << iter->first.str();
+               iter = selectedRoutes.erase(iter);
+            }
+         }
+         for (auto iter = routeTable.begin(), end = routeTable.end(); iter != end;)
+         {
+            auto next = routeTable.upper_bound(iter->first.producer);
+            if (!consensus().is_producer(iter->first.producer) || iter->first.producer == self)
+            {
+               routeTable.erase(iter, next);
+            }
+            iter = next;
+         }
+         for (auto iter = sourceTable.begin(), end = sourceTable.end(); iter != end;)
+         {
+            if (consensus().is_producer(iter->first) && iter->first != self)
+            {
+               ++iter;
+            }
+            else
+            {
+               iter = sourceTable.erase(iter);
+            }
+         }
+         // If we became a producer, we need to establish a new route
+         if (consensus().is_producer(self))
+         {
+            multicast(RouteUpdateMessage{self, seqno, RouteMetric{0}});
+         }
+         // Sync our routing table with all peers
+         multicast(RequestRoutesMessage{});
+      }
+      bool isFeasible(std::pair<const RouteKey, RouteData>& route)
+      {
+         if (route.second.metric == RouteMetric::infinite)
+         {
+            return true;
+         }
+         auto pos = sourceTable.find(route.first.producer);
+         if (pos == sourceTable.end())
+         {
+            return true;
+         }
+         return route.second.feasibility() < pos->second;
+      }
+      void updateRoute(std::pair<const RouteKey, RouteData>& route, const RouteUpdateMessage& msg)
+      {
+         if (route.second.metric != msg.metric || route.second.seqno != msg.seqno)
+         {
+            route.second.metric = msg.metric;
+            route.second.seqno  = msg.seqno;
+            selectRoute(route.first.producer, route.first.peer);
+         }
+      }
+      bool isSelected(const RouteKey& key)
+      {
+         auto iter = selectedRoutes.find(key.producer);
+         return iter != selectedRoutes.end() && iter->second == key.peer;
+      }
+      RouteMetric getMetric(const std::pair<const RouteKey, RouteData>& route) const
+      {
+         auto iter = neighborTable.find(route.first.peer);
+         if (iter == neighborTable.end())
+         {
+            return RouteMetric::infinite;
+         }
+         return route.second.metric + iter->second.transmissionCost;
+      }
+      void selectRoute(std::pair<const RouteKey, RouteData>& route, peer_id updatedRoute)
+      {
+         auto [iter, updated] = selectedRoutes.try_emplace(route.first.producer, route.first.peer);
+         if (!updated)
+         {
+            if (iter->second != route.first.peer)
+            {
+               updated      = true;
+               iter->second = route.first.peer;
+            }
+         }
+         if (updated || route.first.peer == updatedRoute)
+         {
+            auto metric = getMetric(route);
+            PSIBASE_LOG(peers().logger(route.first.peer), info)
+                << (updated ? "New" : "Updated") << " route for " << route.first.producer.str()
+                << " seqno=" << route.second.seqno.value << " metric=" << metric.value;
+            auto feasibility     = Feasibility{route.second.seqno, metric};
+            auto [pos, inserted] = sourceTable.try_emplace(route.first.producer, feasibility);
+            if (!inserted && feasibility < pos->second)
+            {
+               pos->second = feasibility;
+            }
+            multicast(RouteUpdateMessage{route.first.producer, route.second.seqno, metric});
+         }
+      }
+      void selectRoute(producer_id producer, peer_id updated)
+      {
+         auto iter        = routeTable.lower_bound(RouteKey{producer, min_peer});
+         auto end         = routeTable.end();
+         auto best_metric = RouteMetric::infinite;
+         auto best_iter   = end;
+         while (iter != end && iter->first.producer == producer)
+         {
+            if (isFeasible(*iter))
+            {
+               auto metric = getMetric(*iter);
+               if (metric < best_metric)
+               {
+                  best_metric = metric;
+                  best_iter   = iter;
+               }
+            }
+            ++iter;
+         }
+         if (best_iter != end)
+         {
+            selectRoute(*best_iter, updated);
+         }
+         else if (selectedRoutes.erase(producer) != 0)
+         {
+            PSIBASE_LOG(logger, info) << "No feasible route to " << producer.str();
+            multicast(RouteUpdateMessage{producer, {}, RouteMetric::infinite});
+            sendSeqnoRequest(producer);
+         }
+      }
+      void sendSeqnoRequest(producer_id producer)
+      {
+         auto iter = sourceTable.find(producer);
+         if (iter != sourceTable.end())
+         {
+            multicast(RouteSeqnoRequest{producer, iter->second.seqno + 1});
+         }
+      }
+      void recv(peer_id peer, const RouteUpdateMessage& msg)
+      {
+         PSIBASE_LOG(peers().logger(peer), debug) << "Received message: " << msg.to_string();
+         if (msg.producer == consensus().producer_name())
+         {
+            return;
+         }
+         if (!consensus().is_producer(msg.producer))
+         {
+            PSIBASE_LOG(peers().logger(peer), debug)
+                << "Ignoring route because " << msg.producer.str() << " is not an active producer";
+            return;
+         }
+         auto iter = routeTable.find(RouteKey{msg.producer, peer});
+         if (iter == routeTable.end())
+         {
+            if (msg.metric != RouteMetric::infinite)
+            {
+               routeTable.try_emplace(RouteKey{msg.producer, peer}, msg.seqno, msg.metric);
+               selectRoute(msg.producer, peer);
+            }
+         }
+         else
+         {
+            updateRoute(*iter, msg);
+         }
+      }
+      void recv(peer_id peer, const RequestRoutesMessage& msg)
+      {
+         PSIBASE_LOG(peers().logger(peer), debug) << "Received message: " << msg.to_string();
+         send_routes(peer);
+      }
+      RouteUpdateMessage makeUpdate(producer_id producer)
+      {
+         auto selected = selectedRoutes.find(producer);
+         if (selected != selectedRoutes.end())
+         {
+            auto route = routeTable.find(RouteKey{producer, selected->second});
+            if (route != routeTable.end())
+            {
+               return {producer, route->second.seqno, getMetric(*route)};
+            }
+         }
+         return {producer, {}, RouteMetric::infinite};
+      }
+      template <typename T>
+      bool trySend(producer_id prod, const T& msg)
+      {
+         auto selected = selectedRoutes.find(prod);
+         if (selected != selectedRoutes.end())
+         {
+            async_send(selected->second, msg);
+            return true;
+         }
+         else
+         {
+            return false;
+         }
+      }
+
+      using message_type = std::
+          variant<RouteUpdateMessage, RouteSeqnoRequest, RequestRoutesMessage, RoutingEnvelope>;
+
+      void recv(peer_id peer, const RouteSeqnoRequest& msg)
+      {
+         PSIBASE_LOG(peers().logger(peer), debug) << "Received message: " << msg.to_string();
+         if (auto response = makeUpdate(msg.producer);
+             response.metric != RouteMetric::infinite && response.seqno >= msg.seqno)
+         {
+            async_send(peer, response);
+         }
+         else if (msg.producer == consensus().producer_name())
+         {
+            incrementSeqno();
+         }
+         else if (msg.ttl >= 2)
+         {
+            forwardSeqnoRequest(msg);
+         }
+      }
+      template <typename T>
+         requires has_validate_message<Derived, T>
+      auto validate_message(const SignedMessage<T>& msg)
+      {
+         try
+         {
+            this->verify_signature(msg);
+         }
+         catch (std::runtime_error&)
+         {
+            return decltype(consensus().validate_message(*msg.data)){};
+         }
+         return consensus().validate_message(*msg.data);
+      }
+      template <typename T>
+         requires has_validate_message<Derived, T>
+      auto validate_message(const T& msg)
+      {
+         return consensus().validate_message(msg);
+      }
+      void recv(peer_id peer, RoutingEnvelope&& msg)
+      {
+         PSIBASE_LOG(peers().logger(peer), debug)
+             << "Received message: to " << msg.destination.str() << ": "
+             << this->message_to_string(msg.data);
+         if (msg.destination == consensus().producer_name())
+         {
+            recv(peer, std::move(msg.data));
+         }
+         else
+         {
+            this->handle_message(msg.data,
+                                 [&, this](const auto& deserialized)
+                                 {
+                                    if constexpr (requires { validate_message(deserialized); })
+                                    {
+                                       if (auto id = validate_message(deserialized))
+                                       {
+                                          auto selected = selectedRoutes.find(msg.destination);
+                                          if (selected != selectedRoutes.end())
+                                          {
+                                             if constexpr (std::is_same_v<decltype(id), bool>)
+                                             {
+                                                this->async_send(selected->second, msg);
+                                             }
+                                             else
+                                             {
+                                                send_after_block(selected->second, *id, msg);
+                                             }
+                                          }
+                                          else
+                                          {
+                                             PSIBASE_LOG(logger, debug)
+                                                 << "Message discarded for lack of a route to "
+                                                 << msg.destination.str();
+                                          }
+                                       }
+                                    }
+                                    else
+                                    {
+                                       PSIBASE_LOG(this->peers().logger(peer), warning)
+                                           << "Wrong message type";
+                                    }
+                                 });
+         }
+      }
+      void incrementSeqno()
+      {
+         auto now = std::chrono::steady_clock::now();
+         if (now - lastSeqnoUpdate > minSeqnoUpdateInterval)
+         {
+            seqno = seqno + 1;
+            multicast(RouteUpdateMessage{consensus().producer_name(), seqno, 0});
+            lastSeqnoUpdate = now;
+         }
+         else
+         {
+            seqnoTimer.expires_at(lastSeqnoUpdate + minSeqnoUpdateInterval);
+            seqnoTimer.async_wait(
+                [this](const std::error_code& e)
+                {
+                   if (!e)
+                   {
+                      incrementSeqno();
+                   }
+                });
+         }
+      }
+      bool cacheSeqnoRequest(const RouteSeqnoRequest& msg)
+      {
+         auto now              = std::chrono::steady_clock::now();
+         auto [iter, inserted] = recentSeqnoRequests.try_emplace(msg.producer, msg.seqno, now);
+         if (inserted)
+         {
+            return true;
+         }
+         if (now - iter->second.time <= seqnoCacheMaxAge && iter->second.seqno == msg.seqno)
+         {
+            return false;
+         }
+         else
+         {
+            iter->second.seqno = msg.seqno;
+            iter->second.time  = now;
+            return true;
+         }
+      }
+      void forwardSeqnoRequest(RouteSeqnoRequest msg)
+      {
+         --msg.ttl;
+         if (!cacheSeqnoRequest(msg))
+            return;
+         if (!trySend(msg.producer, msg))
+         {
+            auto    bestMetric = RouteMetric::infinite;
+            peer_id bestRoute;
+            for (const auto& route : getRoutes(msg.producer))
+            {
+               auto metric = getMetric(route);
+               if (metric < bestMetric)
+               {
+                  bestMetric = metric;
+                  bestRoute  = route.first.peer;
+               }
+            }
+            if (bestMetric != RouteMetric::infinite)
+            {
+               async_send(bestRoute, msg);
+            }
+         }
+      }
+      auto getRoutes(producer_id producer)
+      {
+         auto [begin, end] = routeTable.equal_range(producer);
+         return std::ranges::subrange(begin, end);
+      }
+      SequenceNumber                             seqno = {};
+      std::chrono::steady_clock::time_point      lastSeqnoUpdate;
+      std::map<peer_id, NeighborData>            neighborTable;
+      std::map<RouteKey, RouteData, std::less<>> routeTable;
+      std::map<producer_id, Feasibility>         sourceTable;
+      std::map<producer_id, peer_id>             selectedRoutes;
+
+      std::map<producer_id, CachedSeqnoRequest> recentSeqnoRequests;
+      boost::asio::steady_timer                 seqnoTimer;
+
+      std::set<DeferredMessage, std::less<>> deferredMessages;
+
+      loggers::common_logger logger;
+   };
+}  // namespace psibase::net
diff --git a/libraries/net/include/psibase/websocket.hpp b/libraries/net/include/psibase/websocket.hpp
index f71d51938..688e5d464 100644
--- a/libraries/net/include/psibase/websocket.hpp
+++ b/libraries/net/include/psibase/websocket.hpp
@@ -195,7 +195,7 @@ namespace psibase::net
       auto& ssl = conn->stream.next_layer();
       ssl.async_handshake(boost::asio::ssl::stream_base::client,
                           [conn = std::move(conn), f = std::forward<F>(f)](
-                              const std::error_code& ec) { f(ec, std::move(conn)); });
+                              const std::error_code& ec) mutable { f(ec, std::move(conn)); });
    }
 #endif
 
@@ -231,7 +231,7 @@ namespace psibase::net
                        {
                           maybe_async_ssl_handshake(
                               std::move(conn),
-                              [f = std::move(f)](const std::error_code& ec, auto&& conn)
+                              [f = std::move(f)](const std::error_code& ec, auto&& conn) mutable
                               {
                                  if (ec)
                                  {
@@ -269,4 +269,43 @@ namespace psibase::net
              }
           });
    }
+
+   template <typename Stream, typename F>
+   void async_connect(std::shared_ptr<websocket_connection<Stream>>&& conn,
+                      std::string_view                                path,
+                      F&&                                             f)
+   {
+      conn->host = path;
+      conn->logger.add_attribute("RemoteEndpoint", boost::log::attributes::constant(conn->host));
+      auto& sock = get_lowest_layer(conn->stream);
+      sock.async_connect(
+          std::string(path),
+          [conn = std::move(conn), f = std::forward<F>(f)](const std::error_code& ec) mutable
+          {
+             if (ec)
+             {
+                PSIBASE_LOG(conn->logger, warning) << ec.message();
+                f(ec, std::move(conn));
+             }
+             else
+             {
+                auto* p = conn.get();
+                p->stream.async_handshake(
+                    "localhost", "/native/p2p",
+                    [conn = std::move(conn), f = std::move(f)](const std::error_code& ec) mutable
+                    {
+                       if (ec)
+                       {
+                          PSIBASE_LOG(conn->logger, warning) << ec.message();
+                          f(ec, std::move(conn));
+                       }
+                       else
+                       {
+                          conn->need_close_msg = true;
+                          f(ec, std::move(conn));
+                       }
+                    });
+             }
+          });
+   }
 }  // namespace psibase::net
diff --git a/libraries/net/test/CMakeLists.txt b/libraries/net/test/CMakeLists.txt
index 79617c25f..78c9e52b9 100644
--- a/libraries/net/test/CMakeLists.txt
+++ b/libraries/net/test/CMakeLists.txt
@@ -13,6 +13,11 @@ target_link_libraries(test_mock_timer PUBLIC catch2 Threads::Threads Boost::head
 
 add_test(NAME test_mock_timer COMMAND test_mock_timer)
 
+add_executable(test_shortest_path_routing test_shortest_path_routing.cpp connection_pair.cpp)
+target_include_directories(test_shortest_path_routing PUBLIC ../include)
+target_link_libraries(test_shortest_path_routing PUBLIC catch2 psibase Threads::Threads Boost::headers)
+add_test(NAME test_shortest_path_routing COMMAND test_shortest_path_routing --log-filter "Severity >= debug")
+
 add_executable(test_consensus test_consensus.cpp test_cft_consensus.cpp test_bft_consensus.cpp test_signatures.cpp mock_timer.cpp test_util.cpp main.cpp)
 target_include_directories(test_consensus PUBLIC ../include)
 target_link_libraries(test_consensus PUBLIC catch2 psibase services_system)
diff --git a/libraries/net/test/connection_pair.cpp b/libraries/net/test/connection_pair.cpp
new file mode 100644
index 000000000..a5fc37081
--- /dev/null
+++ b/libraries/net/test/connection_pair.cpp
@@ -0,0 +1,99 @@
+#include "connection_pair.hpp"
+
+#include <boost/asio/post.hpp>
+#include <deque>
+
+namespace
+{
+   using psibase::net::connection_base;
+   struct connection : connection_base
+   {
+      explicit connection(boost::asio::io_context& ctx) : ctx(ctx) {}
+      virtual void async_write(std::vector<char>&& data, write_handler handler)
+      {
+         if (!is_open())
+         {
+            boost::asio::post(ctx, [handler = std::move(handler)]
+                              { handler(make_error_code(boost::asio::error::eof)); });
+            return;
+         }
+         if (peer->pending_read)
+         {
+            boost::asio::post(
+                ctx, [handler = std::move(*peer->pending_read), data = std::move(data)]() mutable
+                { handler(std::error_code(), std::move(data)); });
+            peer->pending_read.reset();
+         }
+         else
+         {
+            peer->queue.push_back(std::move(data));
+         }
+         boost::asio::post(ctx, [handler = std::move(handler)] { handler(std::error_code()); });
+      }
+      virtual void async_read(read_handler handler)
+      {
+         if (!queue.empty())
+         {
+            auto data = std::move(queue.front());
+            queue.pop_front();
+            boost::asio::post(ctx, [handler = std::move(handler), data = std::move(data)]() mutable
+                              { handler(std::error_code(), std::move(data)); });
+         }
+         else
+         {
+            if (!is_open())
+            {
+               boost::asio::post(ctx, [handler = std::move(handler)]
+                                 { handler(make_error_code(boost::asio::error::eof), {}); });
+               return;
+            }
+            pending_read = std::move(handler);
+         }
+      }
+      virtual bool is_open() const { return peer != nullptr; }
+      virtual void close(close_code)
+      {
+         if (peer)
+         {
+            peer->close_impl();
+            close_impl();
+         }
+      }
+      void close_impl()
+      {
+         if (pending_read)
+         {
+            boost::asio::post(ctx, [handler = std::move(*pending_read)]
+                              { handler(make_error_code(boost::asio::error::eof), {}); });
+            pending_read.reset();
+         }
+         peer = nullptr;
+      }
+      boost::asio::io_context&      ctx;
+      connection*                   peer;
+      std::optional<read_handler>   pending_read;
+      std::deque<std::vector<char>> queue;
+   };
+   struct connection_pair
+   {
+      explicit connection_pair(boost::asio::io_context& ctx)
+          : conns{connection{ctx}, connection{ctx}}
+      {
+         conns[0].peer = &conns[1];
+         conns[1].peer = &conns[0];
+      }
+      connection conns[2];
+   };
+}  // namespace
+
+namespace psibase::net
+{
+   std::pair<std::shared_ptr<connection_base>, std::shared_ptr<connection_base>>
+   make_connection_pair(boost::asio::io_context& ctx)
+   {
+      auto                             result = std::make_shared<connection_pair>(ctx);
+      std::shared_ptr<connection_base> res0{result, &result->conns[0]};
+      std::shared_ptr<connection_base> res1{std::move(result), &result->conns[1]};
+      return {std::move(res0), std::move(res1)};
+   }
+}  // namespace psibase::net
diff --git a/libraries/net/test/connection_pair.hpp b/libraries/net/test/connection_pair.hpp
new file mode 100644
index 000000000..120d68d0a
--- /dev/null
+++ b/libraries/net/test/connection_pair.hpp
@@ -0,0 +1,12 @@
+#pragma once
+
+#include <boost/asio/io_context.hpp>
+#include <memory>
+#include <psibase/peer_manager.hpp>
+#include <utility>
+
+namespace psibase::net
+{
+   std::pair<std::shared_ptr<connection_base>, std::shared_ptr<connection_base>>
+   make_connection_pair(boost::asio::io_context&);
+}
diff --git a/libraries/net/test/fuzz.cpp b/libraries/net/test/fuzz.cpp
index c0ede0992..6393a2247 100644
--- a/libraries/net/test/fuzz.cpp
+++ b/libraries/net/test/fuzz.cpp
@@ -37,7 +37,7 @@ namespace psibase::test
       return mock_current_time;
    }
 
-   void mock_clock::advance()
+   bool mock_clock::advance()
    {
       assert(!"not implemented");
    }
diff --git a/libraries/net/test/fuzz.hpp b/libraries/net/test/fuzz.hpp
index 5d7f688f7..e0fca8760 100644
--- a/libraries/net/test/fuzz.hpp
+++ b/libraries/net/test/fuzz.hpp
@@ -9,13 +9,15 @@ struct basic_fuzz_routing : psibase::net::message_serializer<Derived>
    {
       logger.add_attribute("Channel", boost::log::attributes::constant(std::string("p2p")));
    }
+   void on_producer_change() {}
+   void on_peer_block(psibase::net::peer_id /*peer*/, const psibase::Checksum256& /*blockid*/) {}
    void send(const auto& message)
    {
       PSIBASE_LOG(logger, debug) << "Send message: " << message.to_string() << std::endl;
       _network->recv(message);
    }
    template <typename Msg, typename F>
-   void async_send_block(psibase::net::peer_id id, const Msg& msg, F&& f)
+   void async_send(psibase::net::peer_id id, const Msg& msg, F&& f)
    {
       if (peer != id)
       {
@@ -25,6 +27,11 @@ struct basic_fuzz_routing : psibase::net::message_serializer<Derived>
       ctx.post([f]() { f(std::error_code()); });
    }
    template <typename Msg>
+   void multicast_producers(const psibase::Checksum256&, const Msg& msg)
+   {
+      send(msg);
+   }
+   template <typename Msg>
    void multicast_producers(const Msg& msg)
    {
       send(msg);
diff --git a/libraries/net/test/mock_timer.cpp b/libraries/net/test/mock_timer.cpp
index cf2f9c8cc..5d9545fef 100644
--- a/libraries/net/test/mock_timer.cpp
+++ b/libraries/net/test/mock_timer.cpp
@@ -11,10 +11,11 @@ namespace psibase::test
    namespace
    {
       static constexpr auto timer_queue_compare = [](const auto& lhs, const auto& rhs)
-      { return lhs->deadline > rhs->deadline; };
+      { return std::tie(lhs->deadline, lhs->sequence) > std::tie(rhs->deadline, rhs->sequence); };
       mock_clock::time_point                         mock_current_time;
       std::vector<std::shared_ptr<mock_timer::impl>> timer_queue;
       std::mutex                                     queue_mutex;
+      std::atomic<std::uint64_t>                     timer_sequence;
       void                                           process_queue(mock_clock::time_point new_now)
       {
          while (!timer_queue.empty() && timer_queue.front()->deadline <= new_now)
@@ -68,13 +69,18 @@ namespace psibase::test
       mock_current_time += diff;
       process_queue(mock_current_time);
    }
-   void mock_clock::advance()
+   bool mock_clock::advance()
    {
       std::lock_guard l{queue_mutex};
       if (!timer_queue.empty())
       {
          mock_current_time = timer_queue.front()->deadline;
          process_queue(mock_current_time);
+         return true;
+      }
+      else
+      {
+         return false;
       }
    }
    std::ostream& operator<<(std::ostream& os, mock_clock::time_point tp)
@@ -92,12 +98,14 @@ namespace psibase::test
       std::lock_guard l{queue_mutex};
       cancel_timer(_impl);
       _impl->deadline = expiration;
+      _impl->sequence = timer_sequence.fetch_add(1);
    }
    void mock_timer::expires_after(duration d)
    {
       std::lock_guard l{queue_mutex};
       cancel_timer(_impl);
       _impl->deadline = mock_current_time + d;
+      _impl->sequence = timer_sequence.fetch_add(1);
    }
    void mock_timer::async_wait(std::function<void(const std::error_code&)> callback)
    {
diff --git a/libraries/net/test/test_bft_consensus.cpp b/libraries/net/test/test_bft_consensus.cpp
index a12ed3a5d..79ca488f2 100644
--- a/libraries/net/test/test_bft_consensus.cpp
+++ b/libraries/net/test/test_bft_consensus.cpp
@@ -113,9 +113,9 @@ TEST_CASE("bft partition", "[bft]")
    loop(timer, 15s, [&]() { nodes.partition(NetworkPartition::split(rng)); });
    // This may advance the chain, but should not be expected to
    runFor(ctx, 10min);
-   ctx.poll();
    timer.cancel();
    ctx.poll();
+   ctx.restart();
 
    PSIBASE_LOG(logger, info) << "Final sync";
    // Make all nodes active
@@ -136,7 +136,13 @@ TEST_CASE("bft latency", "[bft]")
 {
    TEST_START(logger);
 
-   auto latency = GENERATE(150ms, 450ms, 900ms, 1050ms, 2100ms, 3450ms, 7650ms, 10350ms, 15450ms);
+   static const std::vector latencies{150ms,  450ms,  900ms,   1050ms, 2100ms,
+                                      3450ms, 7650ms, 10350ms, 15450ms};
+   auto                     dataIndex = GENERATE_INDEX(latencies);
+   INFO("data-index: " << dataIndex);
+   auto latency = latencies.at(dataIndex);
+
+   INFO("latency: " << latency.count() << " ms");
 
    boost::asio::io_context ctx;
    NodeSet<node_type>      nodes(ctx);
@@ -236,7 +242,7 @@ TEST_CASE("fork before invalid 1", "[bft]")
    node.send(block2);
    node.send(invalid);
    node.send(makeViewChange("b", 6));
-   node.send(makeViewChange("c", 6));
+   node.send(makeViewChange("d", 6));
    CHECK(node.head().blockId == BlockInfo{block2.block->block()}.blockId);
 }
 
@@ -257,7 +263,7 @@ TEST_CASE("fork before invalid 2", "[bft]")
    node.send(block1);
    node.send(block2);
    node.send(makeViewChange("b", 6));
-   node.send(makeViewChange("c", 6));
+   node.send(makeViewChange("d", 6));
    CHECK(node.head().blockId == BlockInfo{block1.block->block()}.blockId);
 }
 
@@ -274,13 +280,15 @@ TEST_CASE("truncated fork switch", "[bft]")
    auto root    = node.head();
    auto block1a = makeBlock(root, "b", 4);
    auto block1b = makeBlock(block1a, "b", 4);
-   auto block2  = makeBlock(root, "c", 5, setProducers(bft("a", "b", "c")));
+   auto block1c = makeBlock(block1b, "b", 4);
+   auto block2  = makeBlock(root, "c", 5, setProducers(bft("a", "b", "c", "e")));
    auto invalid = makeBlock(block2, "c", 5, Transaction{.actions = {Action{}}});
    node.addClient();
    node.send(block1a);
    node.send(makeViewChange("b", 4));
    node.send(makeViewChange("c", 4));
    node.send0(block1b);
+   node.send0(block1c);
    node.send0(block2);
    node.send0(invalid);
    node.send0(makeViewChange("b", 5));
@@ -329,13 +337,14 @@ TEST_CASE("producer fork 1", "[bft]")
    node.send(fork1);
    node.send(invalid);
    // Force switch to fork 1
-   node.send(makePrepare(fork1, "b"));
-   node.send(makePrepare(fork1, "c"));
-   node.send(makePrepare(fork1, "d"));
-   CHECK(node.head().blockId == BlockInfo{fork1.block->block()}.blockId);
+   BlockInfo fork1info{fork1.block->block()};
+   node.send(makeViewChange("b", 11, fork1info, {"b", "c", "d"}));
+   node.send(makeViewChange("c", 11, fork1info, {"b", "c", "d"}));
+   node.send(makeViewChange("d", 11, fork1info, {"b", "c", "d"}));
+   CHECK(node.head().blockId == fork1info.blockId);
    runFor(node.ctx, 1s);
    // The block should be built off fork1
-   CHECK(node.head().header.previous == BlockInfo{fork1.block->block()}.blockId);
+   CHECK(node.head().header.previous == fork1info.blockId);
    CHECK(node.head().header.producer.str() == "a");
 }
 
@@ -406,19 +415,19 @@ TEST_CASE("return to previous fork", "[bft]")
    CHECK(node.head().blockId == BlockInfo{fork2.block->block()}.blockId);
    // return to the worse fork
    node.send(fork1b);
-   node.send(makePrepare(fork1, "b"));
-   node.send(makePrepare(fork1, "c"));
+   node.send(makeViewChange("b", 6, BlockInfo{fork1.block->block()}, {"b", "c", "d"}));
+   node.send(makeViewChange("c", 6, BlockInfo{fork1.block->block()}, {"b", "c", "d"}));
    node.send(makePrepare(fork1b, "b"));
    node.send(makePrepare(fork1b, "c"));
    CHECK(node.head().blockId == BlockInfo{fork1b.block->block()}.blockId);
    // Must not generate commit for fork1b because this conflicts
-   // with the prepare for fork2.  Note that c's commit also violates
+   // with the view change.  Note that c's commit also violates
    // the protocol, so we have to consider it to be the one adversary node..
    node.send(makeCommit(fork1b, "c"));
    node.send(makeCommit(fork1b, "d"));
 
-   node.send(makePrepare(fork2, "b"));
-   node.send(makePrepare(fork2, "c"));
+   node.send(makeViewChange("b", 7, BlockInfo{fork2.block->block()}, {"b", "c", "d"}));
+   node.send(makeViewChange("c", 7, BlockInfo{fork2.block->block()}, {"b", "c", "d"}));
 
    // should switch to fork 2
    CHECK(node.head().blockId == BlockInfo{fork2.block->block()}.blockId);
@@ -485,7 +494,13 @@ TEST_CASE("invalid prepared block 1", "[bft]")
    node.send(makeViewChange("c", 4));
    node.send(makePrepare(invalid, "b"));
    node.send(makePrepare(invalid, "c"));
-   CHECK_THROWS_AS(node.send(makePrepare(invalid, "d")), consensus_failure);
+   try
+   {
+      node.send(makePrepare(invalid, "d"));
+   }
+   catch (consensus_failure&)
+   {
+   }
 }
 
 // The invalid block is executed at the fork switch
@@ -503,7 +518,13 @@ TEST_CASE("invalid prepared block 2", "[bft]")
    node.send(invalid);
    node.send(makePrepare(invalid, "b"));
    node.send(makePrepare(invalid, "c"));
-   CHECK_THROWS_AS(node.send(makePrepare(invalid, "d")), consensus_failure);
+   try
+   {
+      node.send(makePrepare(invalid, "d"));
+   }
+   catch (consensus_failure&)
+   {
+   }
 }
 
 TEST_CASE("invalid committed block", "[bft]")
diff --git a/libraries/net/test/test_consensus.cpp b/libraries/net/test/test_consensus.cpp
index ef0c0be1b..746c71b06 100644
--- a/libraries/net/test/test_consensus.cpp
+++ b/libraries/net/test/test_consensus.cpp
@@ -50,27 +50,6 @@ namespace psibase
       std::visit([&os](const auto& obj) { os << obj; }, consensus);
       return os;
    }
-
-   std::ostream& operator<<(std::ostream& os, const ProducerSet& producers)
-   {
-      if (producers.algorithm == ConsensusAlgorithm::cft)
-      {
-         os << "CFT:";
-      }
-      else if (producers.algorithm == ConsensusAlgorithm::bft)
-      {
-         os << "BFT:";
-      }
-      else
-      {
-         os << "?FT:";
-      }
-      for (const auto& [name, auth] : producers.activeProducers)
-      {
-         os << " " << name.str();
-      }
-      return os;
-   }
 }  // namespace psibase
 
 std::vector<std::pair<Consensus, Consensus>> transitions = {
@@ -220,6 +199,7 @@ TEST_CASE("joint consensus crash", "[combined]")
    runFor(ctx, 2min);
    timer.cancel();
    ctx.poll();
+   ctx.reset();
 
    nodes.connect_all();
    runFor(ctx, 30s);
@@ -254,6 +234,7 @@ TEST_CASE("fork at commit consensus change", "[combined]")
    {
       nodes[1].sendto(AccountNumber{"a"}, message);
       ctx.poll();
+      ctx.reset();
    };
    auto boot_block = nodes[0].chain().get_head_state()->info;
 
diff --git a/libraries/net/test/test_shortest_path_routing.cpp b/libraries/net/test/test_shortest_path_routing.cpp
new file mode 100644
index 000000000..e2a064de3
--- /dev/null
+++ b/libraries/net/test/test_shortest_path_routing.cpp
@@ -0,0 +1,242 @@
+#include <psibase/shortest_path_routing.hpp>
+
+#include <psibase/node.hpp>
+#include <psibase/peer_manager.hpp>
+#include "connection_pair.hpp"
+
+#define CATCH_CONFIG_RUNNER
+#include <catch2/catch.hpp>
+
+using namespace psibase;
+using namespace psibase::net;
+
+TEST_CASE("seqno")
+{
+   CHECK(SequenceNumber{0} < SequenceNumber{1});
+   CHECK(SequenceNumber{0} < SequenceNumber{32767});
+   CHECK(!(SequenceNumber{0} < SequenceNumber{32768}));
+   CHECK(!(SequenceNumber{32768} < SequenceNumber{0}));
+}
+
+TEST_CASE("feasibility")
+{
+   CHECK((Feasibility{SequenceNumber{0}, RouteMetric{2}} <
+          Feasibility{SequenceNumber{0}, RouteMetric{3}}));
+   CHECK((Feasibility{SequenceNumber{1}, RouteMetric{2}} <
+          Feasibility{SequenceNumber{0}, RouteMetric{1}}));
+}
+
+struct message1
+{
+   static constexpr unsigned type = 96;
+   std::int32_t              value;
+   std::string               to_string() const { return std::to_string(value); }
+   friend auto               operator<=>(const message1&, const message1&) = default;
+};
+PSIO_REFLECT(message1, value)
+
+std::ostream& operator<<(std::ostream& os, const message1& msg)
+{
+   return os << msg.value;
+}
+
+template <typename Derived>
+struct mock_consensus
+{
+   explicit mock_consensus(boost::asio::io_context&) {}
+   using message_type = std::variant<message1>;
+   AccountNumber producer_name() const { return producer; }
+   void          set_producer_id(AccountNumber account)
+   {
+      producer = account;
+      if (active_producers)
+      {
+         static_cast<Derived*>(this)->network().on_producer_change();
+      }
+   }
+   void set_producers(std::set<AccountNumber> prods)
+   {
+      active_producers = std::move(prods);
+      static_cast<Derived*>(this)->network().on_producer_change();
+   }
+   bool is_producer(AccountNumber account) const
+   {
+      return !active_producers || active_producers->count(account) != 0;
+   }
+
+   bool validate_message(const message1&) { return true; }
+
+   void connect(peer_id id) {}
+   void disconnect(peer_id id) {}
+   void recv(peer_id id, message1 msg) { _recv_queue.push_back(msg); }
+   void expect(std::vector<message1> messages)
+   {
+      CHECK(_recv_queue == messages);
+      _recv_queue.clear();
+   }
+   std::vector<message1> consume()
+   {
+      auto result = std::move(_recv_queue);
+      _recv_queue.clear();
+      return result;
+   }
+   std::vector<message1> _recv_queue;
+   AccountNumber         producer;
+   std::string           name = "<anonymous node>";
+   //
+   std::optional<std::set<AccountNumber>> active_producers;
+};
+
+using node_type = node<peer_manager, shortest_path_routing, mock_consensus, int>;
+
+void connect(boost::asio::io_context& ctx, node_type& node1, node_type& node2)
+{
+   auto [p1, p2] = make_connection_pair(ctx);
+   p1->logger.add_attribute("Host", boost::log::attributes::constant(node1.name));
+   p2->logger.add_attribute("Host", boost::log::attributes::constant(node2.name));
+   p1->logger.add_attribute("RemoteEndpoint", boost::log::attributes::constant(node2.name));
+   p2->logger.add_attribute("RemoteEndpoint", boost::log::attributes::constant(node1.name));
+   p1->url = node2.name;
+   p2->url = node1.name;
+
+   node1.peers().connect(node2.name,
+                         [&node1, p1 = std::move(p1)](const std::string&, auto&& next) mutable
+                         {
+                            node1.peers().add_connection(std::move(p1));
+                            next(std::error_code());
+                         });
+   node2.peers().connect(node1.name,
+                         [&node2, p2 = std::move(p2)](const std::string&, auto&& next) mutable
+                         {
+                            node2.peers().add_connection(std::move(p2));
+                            next(std::error_code());
+                         });
+}
+
+struct TestNode : node_type
+{
+   TestNode(boost::asio::io_context& ctx, const std::string& name) : node_type(ctx), ctx(ctx)
+   {
+      this->name = name;
+      this->network().logger.add_attribute("Host", boost::log::attributes::constant(name));
+   }
+   ~TestNode() { disconnect_all(false); }
+   boost::asio::io_context& ctx;
+};
+
+void connect(TestNode& node1, TestNode& node2)
+{
+   connect(node1.ctx, node1, node2);
+}
+
+void disconnect(TestNode& node1, TestNode& node2)
+{
+   for (const auto& [id, ptr] : node1.connections())
+   {
+      if (ptr->url && *ptr->url == node2.name)
+      {
+         node1.peers().disconnect(id);
+         break;
+      }
+   }
+}
+
+TEST_CASE("basic routing")
+{
+   boost::asio::io_context ctx;
+   TestNode                node1(ctx, "a"), node2(ctx, "b"), node3(ctx, "c");
+   node3.set_producer_id(AccountNumber{"c"});
+   connect(node1, node2);
+   connect(node2, node3);
+   ctx.run();
+   ctx.restart();
+   // a message sent by node1 to node3 will reach node3
+   node1.network().sendto(AccountNumber{"c"}, message1{42});
+   ctx.run();
+   node3.consensus().expect({message1{42}});
+}
+
+TEST_CASE("cycle")
+{
+   boost::asio::io_context ctx;
+   TestNode                node1(ctx, "a"), node2(ctx, "b"), node3(ctx, "c");
+   node3.set_producer_id(AccountNumber{"c"});
+   connect(node1, node2);
+   connect(node2, node3);
+   connect(node1, node3);
+   ctx.run();
+   ctx.restart();
+   // a message sent by node1 to node3 will reach node3
+   node1.network().sendto(AccountNumber{"c"}, message1{42});
+   ctx.run();
+   ctx.restart();
+   CHECK(node3.consume() == std::vector{message1{42}});
+
+   disconnect(node1, node3);
+   ctx.run();
+   ctx.restart();
+
+   node1.network().sendto(AccountNumber{"c"}, message1{7});
+   ctx.run();
+   ctx.restart();
+   CHECK(node3.consume() == std::vector{message1{7}});
+}
+
+TEST_CASE("producers only")
+{
+   boost::asio::io_context ctx;
+   TestNode                node1(ctx, "a"), node2(ctx, "b"), node3(ctx, "c");
+   node3.set_producer_id(AccountNumber{"c"});
+   connect(node1, node2);
+   connect(node2, node3);
+   node2.set_producers({});
+   ctx.run();
+   ctx.restart();
+
+   // node2 should not route message to c
+   node1.network().sendto(AccountNumber{"c"}, message1{42});
+   ctx.run();
+   ctx.restart();
+   CHECK(node3.consume() == std::vector<message1>{});
+
+   // making node2 recognize c as a producer allows routing
+   node2.set_producers({AccountNumber{"c"}});
+   ctx.run();
+   ctx.restart();
+   node1.network().sendto(AccountNumber{"c"}, message1{42});
+   ctx.run();
+   ctx.restart();
+   CHECK(node3.consume() == std::vector{message1{42}});
+}
+
+struct ConsoleLog
+{
+   std::string type   = "console";
+   std::string filter = "Severity > critical";
+   std::string format = "[{Severity}] [{Host}]{?:-[{RemoteEndpoint}]}: {Message}";
+};
+PSIO_REFLECT(ConsoleLog, type, filter, format);
+
+struct Loggers
+{
+   ConsoleLog stderr;
+};
+PSIO_REFLECT(Loggers, stderr);
+
+int main(int argc, const char* const* argv)
+{
+   Loggers logConfig;
+
+   Catch::Session session;
+
+   using Catch::clara::Opt;
+   auto cli = session.cli() | Opt(logConfig.stderr.filter,
+                                  "filter")["--log-filter"]("The filter to apply to node loggers");
+   session.cli(cli);
+
+   if (int res = session.applyCommandLine(argc, argv))
+      return res;
+
+   loggers::configure(psio::convert_from_json<loggers::Config>(psio::convert_to_json(logConfig)));
+   return session.run();
+}
diff --git a/libraries/net/test/test_util.cpp b/libraries/net/test/test_util.cpp
index 1be0c7c90..944b9595c 100644
--- a/libraries/net/test/test_util.cpp
+++ b/libraries/net/test/test_util.cpp
@@ -310,13 +310,33 @@ ViewChangeMessage makeViewChange(std::string_view producer, TermNum view)
    return ViewChangeMessage{view, AccountNumber{producer}};
 }
 
+ViewChangeMessage makeViewChange(std::string_view                        producer,
+                                 TermNum                                 view,
+                                 const BlockInfo&                        prepared,
+                                 std::initializer_list<std::string_view> preparers)
+{
+   ViewChangeMessage result{
+       view, AccountNumber{producer}, {}, prepared.blockId, prepared.header.term};
+   for (auto p : preparers)
+   {
+      result.prepares.push_back({AccountNumber{p}, {}});
+   }
+   return result;
+}
+
 void runFor(boost::asio::io_context& ctx, mock_clock::duration total_time)
 {
-   for (auto end = mock_clock::now() + total_time; mock_clock::now() < end; mock_clock::advance())
+   for (auto end = mock_clock::now() + total_time; mock_clock::now() < end;)
    {
       ctx.poll();
+      ctx.restart();
+      if (!mock_clock::advance())
+      {
+         return;
+      }
    }
    ctx.poll();
+   ctx.restart();
 }
 
 void printAccounts(std::ostream& os, const std::vector<AccountNumber>& producers)
diff --git a/libraries/net/test/test_util.hpp b/libraries/net/test/test_util.hpp
index 69a916e25..1ceb817d3 100644
--- a/libraries/net/test/test_util.hpp
+++ b/libraries/net/test/test_util.hpp
@@ -406,6 +406,10 @@ psibase::net::BlockConfirm makeBlockConfirm(const BlockArg&
 SignedMessage<PrepareMessage> makePrepare(const BlockMessage& block, std::string_view producer);
 SignedMessage<CommitMessage>  makeCommit(const BlockMessage& block, std::string_view producer);
 ViewChangeMessage             makeViewChange(std::string_view producer, psibase::TermNum view);
+ViewChangeMessage             makeViewChange(std::string_view                        producer,
+                                             psibase::TermNum                        view,
+                                             const psibase::BlockInfo&               prepared,
+                                             std::initializer_list<std::string_view> preparers);
 
 void runFor(boost::asio::io_context& ctx, psibase::test::mock_clock::duration total_time);
 
diff --git a/libraries/psibase/common/include/psibase/AccountNumber.hpp b/libraries/psibase/common/include/psibase/AccountNumber.hpp
index e8433c1de..d2de6ebb4 100644
--- a/libraries/psibase/common/include/psibase/AccountNumber.hpp
+++ b/libraries/psibase/common/include/psibase/AccountNumber.hpp
@@ -48,7 +48,7 @@ namespace psibase
       ///
       /// Compares by 64-bit `value`. This does not sort by the
       /// string (name) form.
-      auto operator<=>(const AccountNumber&) const = default;
+      friend auto operator<=>(const AccountNumber&, const AccountNumber&) = default;
    };
    PSIO_REFLECT(AccountNumber, definitionWillNotChange(), value)
 
diff --git a/libraries/psibase/native/include/psibase/ForkDb.hpp b/libraries/psibase/native/include/psibase/ForkDb.hpp
index f3ade4b17..0fd19fed8 100644
--- a/libraries/psibase/native/include/psibase/ForkDb.hpp
+++ b/libraries/psibase/native/include/psibase/ForkDb.hpp
@@ -128,6 +128,34 @@ namespace psibase
       }
    };
 
+   inline std::ostream& operator<<(std::ostream& os, const ProducerSet& prods)
+   {
+      if (prods.algorithm == ConsensusAlgorithm::cft)
+      {
+         os << "CFT:";
+      }
+      else if (prods.algorithm == ConsensusAlgorithm::bft)
+      {
+         os << "BFT:";
+      }
+      os << '[';
+      bool first = true;
+      for (const auto& [name, auth] : prods.activeProducers)
+      {
+         if (first)
+         {
+            first = false;
+         }
+         else
+         {
+            os << ',';
+         }
+         os << name.str();
+      }
+      os << ']';
+      return os;
+   }
+
    struct BlockAuthState
    {
       ConstRevisionPtr                    revision;
@@ -221,8 +249,9 @@ namespace psibase
             std::ranges::set_difference(prevKeys, nextKeys, std::back_inserter(removed));
             std::ranges::set_difference(nextKeys, prevKeys, std::back_inserter(added));
             auto code = makeCodeIndex(&header);
-            check(std::ranges::includes(nextKeys, code | std::views::transform([
-                                                  ](auto& arg) -> auto& { return arg.first; })),
+            check(std::ranges::includes(
+                      nextKeys,
+                      code | std::views::transform([](auto& arg) -> auto& { return arg.first; })),
                   "Wrong code");
             Database db{systemContext->sharedDatabase, prev.revision};
             auto     session = db.startWrite(writer);
@@ -311,9 +340,7 @@ namespace psibase
             nextProducersBlockNum(prev.nextProducersBlockNum)
       {
          // Handling of the producer schedule must match BlockContext::writeRevision
-         // Note: technically we could use this block's commitNum instead of the
-         // previous block's commitNum, but that complicates the producer hand-off.
-         if (nextProducers && prev.info.header.commitNum >= nextProducersBlockNum)
+         if (prev.endsJointConsensus())
          {
             producers = std::move(nextProducers);
          }
@@ -351,6 +378,10 @@ namespace psibase
          auto     session = db.startRead();
          authState        = std::make_shared<BlockAuthState>(systemContext, writer, db, info);
       }
+      bool endsJointConsensus() const
+      {
+         return nextProducers && info.header.commitNum >= nextProducersBlockNum;
+      }
       // Returns the claim for an immediate successor of this block
       std::optional<Claim> getNextProducerClaim(AccountNumber producer)
       {
@@ -415,27 +446,32 @@ namespace psibase
       return ExtendedBlockId{std::get<2>(order), std::get<1>(order)};
    }
 
+   TermNum orderToTerm(const auto& order)
+   {
+      return std::get<0>(order);
+   }
+
    class ForkDb
    {
      public:
       using id_type = Checksum256;
-      // \return a pointer to the header state for the block or null if the block
-      // was not inserted for any reason.
+      // \return a pointer to the header state for the block and a bool indicating
+      // whether a new block was inserted.
       // \post if the block was successfully inserted, a fork switch is required.
-      const BlockHeaderState* insert(const psio::shared_view_ptr<SignedBlock>& b)
+      std::pair<const BlockHeaderState*, bool> insert(const psio::shared_view_ptr<SignedBlock>& b)
       {
          BlockInfo info(b->block());
          PSIBASE_LOG_CONTEXT_BLOCK(blockLogger, info.header, info.blockId);
          if (info.header.blockNum <= commitIndex)
          {
             PSIBASE_LOG(blockLogger, debug) << "Block ignored because it is before commitIndex";
-            return nullptr;
+            return {nullptr, false};
          }
          auto [iter, inserted] = blocks.try_emplace(info.blockId, b);
          if (!inserted)
          {
             PSIBASE_LOG(blockLogger, debug) << "Block skipped because it is already known";
-            return nullptr;
+            return {get_state(info.blockId), false};
          }
          if (auto* prev = get_state(info.header.previous))
          {
@@ -464,14 +500,14 @@ namespace psibase
             {
                PSIBASE_LOG(blockLogger, debug) << "Block is outside current tree";
             }
-            return &pos->second;
+            return {&pos->second, true};
          }
          else
          {
             blocks.erase(iter);
             PSIBASE_LOG(blockLogger, debug) << "Block dropped because its parent is missing";
          }
-         return nullptr;
+         return {nullptr, false};
       }
       // \pre The block must not be in the current chain and
       // must not have any children. Practially speaking, this
@@ -840,7 +876,7 @@ namespace psibase
       bool is_complete_chain(const id_type& id) { return get_state(id) != nullptr; }
       std::pair<std::shared_ptr<ProducerSet>, std::shared_ptr<ProducerSet>> getProducers()
       {
-         if (head->nextProducers && head->info.header.commitNum >= head->nextProducersBlockNum)
+         if (head->endsJointConsensus())
          {
             return {head->nextProducers, nullptr};
          }
@@ -935,8 +971,10 @@ namespace psibase
       {
          return T{get_prev_id(t.id()), t.num() - 1};
       }
-      auto    commit_index() const { return commitIndex; }
-      id_type get_ancestor(id_type id, auto n)
+      auto            commit_index() const { return commitIndex; }
+      ExtendedBlockId xid(const ExtendedBlockId& id) { return id; }
+      ExtendedBlockId xid(const Checksum256& id) { return {id, getBlockNum(id)}; }
+      id_type         get_ancestor(id_type id, auto n)
       {
          for (; n > 0; --n)
          {
@@ -985,6 +1023,30 @@ namespace psibase
             }
          }
       }
+      bool is_ancestor(const ExtendedBlockId& ancestor, const ExtendedBlockId& descendant)
+      {
+         Checksum256 tmp = descendant.id();
+         for (auto idx = descendant.num(); idx >= ancestor.num(); --idx)
+         {
+            if (tmp == ancestor.id())
+            {
+               return true;
+            }
+            if (auto current_block = get(tmp))
+            {
+               tmp = current_block->block().header().previous();
+            }
+            else
+            {
+               return false;
+            }
+         }
+         return false;
+      }
+      bool is_ancestor(const Checksum256& ancestor, const ExtendedBlockId& descendant)
+      {
+         return is_ancestor(xid(ancestor), descendant);
+      }
       bool in_best_chain(const ExtendedBlockId& t)
       {
          auto iter = byBlocknumIndex.find(t.num());
diff --git a/libraries/psibase_http/http.cpp b/libraries/psibase_http/http.cpp
index ab733a426..7705ad942 100644
--- a/libraries/psibase_http/http.cpp
+++ b/libraries/psibase_http/http.cpp
@@ -303,15 +303,10 @@ namespace psibase::http
 
    bool is_admin(const http_config& cfg, beast::string_view host)
    {
+      host = deport(host);
       return std::visit([&](const auto& admin) { return is_admin(admin, cfg, host); }, cfg.admin);
    }
 
-   template <class Body, class Allocator>
-   bool is_admin(const http_config& cfg, bhttp::request<Body, bhttp::basic_fields<Allocator>>& req)
-   {
-      return is_admin(cfg, deport(req.at(bhttp::field::host)));
-   }
-
    // Returns the access mode and an indication of whether the request contains
    // an explicit authorization. The result access mode will not be greater than
    // the argument.
@@ -424,6 +419,45 @@ namespace psibase::http
       return result;
    }
 
+   std::pair<beast::string_view, beast::string_view> parse_uri(beast::string_view uri)
+   {
+      if (uri.starts_with("http://"))
+      {
+         uri = uri.substr(7);
+      }
+      else if (uri.starts_with("https://"))
+      {
+         uri = uri.substr(8);
+      }
+      else
+      {
+         return {};
+      }
+      auto pos         = uri.find('/');
+      auto authority   = uri.substr(0, pos);
+      auto path        = pos == std::string::npos ? "/" : uri.substr(pos);
+      auto enduserinfo = authority.find('@');
+      auto host = enduserinfo == std::string::npos ? authority : authority.substr(enduserinfo + 1);
+      return {host, path};
+   }
+
+   // Returns the host and path for the request. See RFC 9112 § 3.2 and 3.3
+   template <typename Body, typename Allocator>
+   std::pair<beast::string_view, beast::string_view> parse_request_target(
+       const bhttp::request<Body, bhttp::basic_fields<Allocator>>& request)
+   {
+      auto target = request.target();
+      if (target.starts_with('/') || target == "*")
+      {
+         return {request[bhttp::field::host], target};
+      }
+      else
+      {
+         // We are not a proxy, so we don't need to support authority-form
+         return parse_uri(target);
+      }
+   }
+
    // This function produces an HTTP response for the given
    // request. The type of the response object depends on the
    // contents of the request, so the interface requires the
@@ -433,9 +467,10 @@ namespace psibase::http
                        bhttp::request<Body, bhttp::basic_fields<Allocator>>&& req,
                        Send&&                                                 send)
    {
-      unsigned req_version    = req.version();
-      bool     req_keep_alive = req.keep_alive();
-      bool     req_allow_cors = !req.target().starts_with("/native/");
+      auto [req_host, req_target] = parse_request_target(req);
+      unsigned req_version        = req.version();
+      bool     req_keep_alive     = req.keep_alive();
+      bool     req_allow_cors     = !req_target.starts_with("/native/");
 
       const auto set_cors = [&server, req_allow_cors](auto& res)
       {
@@ -594,13 +629,12 @@ namespace psibase::http
       };
 
       // Used for requests that are not subject to CORS such as websockets
-      auto forbid_cross_origin = [&req, &send, &error]()
+      auto forbid_cross_origin = [&req, &req_host, &send, &error]()
       {
          if (auto iter = req.find(bhttp::field::origin); iter != req.end())
          {
-            const auto& host   = req[bhttp::field::host];
             const auto& origin = iter->value();
-            if (origin == "null" || remove_scheme(origin) != host)
+            if (origin == "null" || remove_scheme(origin) != req_host)
             {
                send(error(bhttp::status::bad_request, "Cross origin request refused"));
                return true;
@@ -640,14 +674,18 @@ namespace psibase::http
       try
       {
          std::shared_lock l{server.http_config->mutex};
-         if (!req.target().starts_with("/native"))
+         if (req_target == "")
+         {
+            return send(bad_request("Invalid request target"));
+         }
+         else if (!req_target.starts_with("/native"))
          {
-            auto host = deport(req.at(bhttp::field::host));
+            auto host = deport(req_host);
 
             if (auto iter = server.http_config->services.find(host);
                 iter != server.http_config->services.end())
             {
-               auto file = iter->second.find(req.target());
+               auto file = iter->second.find(req_target);
                if (file != iter->second.end())
                {
                   if (req.method() == bhttp::verb::options)
@@ -694,7 +732,7 @@ namespace psibase::http
                    method_not_allowed(req.target(), req.method_string(), "GET, POST, OPTIONS"));
             data.host        = {host.begin(), host.size()};
             data.rootHost    = server.http_config->host;
-            data.target      = std::string(req.target());
+            data.target      = std::string(req_target);
             data.contentType = (std::string)req[bhttp::field::content_type];
             data.body        = std::move(req.body());
 
@@ -748,7 +786,7 @@ namespace psibase::http
                          "The resource '" + std::string(req.target()) + "' was not found.\n"));
             return send(ok(std::move(result->body), result->contentType.c_str(), &result->headers));
          }  // !native
-         else if (req.target() == "/native/push_boot" && server.http_config->push_boot_async)
+         else if (req_target == "/native/push_boot" && server.http_config->push_boot_async)
          {
             if (!server.http_config->enable_transactions)
                return send(not_found(req.target()));
@@ -800,7 +838,7 @@ namespace psibase::http
             send.pause_read = true;
             return;
          }  // push_boot
-         else if (req.target() == "/native/push_transaction" &&
+         else if (req_target == "/native/push_transaction" &&
                   server.http_config->push_transaction_async)
          {
             if (!server.http_config->enable_transactions)
@@ -863,7 +901,7 @@ namespace psibase::http
             send.pause_read = true;
             return;
          }  // push_transaction
-         else if (req.target() == "/native/p2p" && websocket::is_upgrade(req) &&
+         else if (req_target == "/native/p2p" && websocket::is_upgrade(req) &&
                   !boost::type_erasure::is_empty(server.http_config->accept_p2p_websocket) &&
                   server.http_config->enable_p2p)
          {
@@ -874,9 +912,9 @@ namespace psibase::http
             send(websocket_upgrade{}, std::move(req), server.http_config->accept_p2p_websocket);
             return;
          }
-         else if (req.target() == "/native/admin/status")
+         else if (req_target == "/native/admin/status")
          {
-            if (!is_admin(*server.http_config, req))
+            if (!is_admin(*server.http_config, req_host))
             {
                return send(not_found(req.target()));
             }
@@ -898,9 +936,9 @@ namespace psibase::http
                send(method_not_allowed(req.target(), req.method_string(), "GET"));
             }
          }
-         else if (req.target() == "/native/admin/shutdown")
+         else if (req_target == "/native/admin/shutdown")
          {
-            if (!is_admin(*server.http_config, req))
+            if (!is_admin(*server.http_config, req_host))
             {
                return send(not_found(req.target()));
             }
@@ -920,9 +958,9 @@ namespace psibase::http
             server.http_config->shutdown(std::move(req.body()));
             return send(accepted());
          }
-         else if (req.target() == "/native/admin/perf" && server.http_config->get_perf)
+         else if (req_target == "/native/admin/perf" && server.http_config->get_perf)
          {
-            if (!is_admin(*server.http_config, req))
+            if (!is_admin(*server.http_config, req_host))
             {
                return send(not_found(req.target()));
             }
@@ -939,9 +977,9 @@ namespace psibase::http
                 [ok, session = send.self.derived_session().shared_from_this()](auto&& make_result)
                 { session->queue_(ok(make_result(), "application/json")); });
          }
-         else if (req.target() == "/native/admin/metrics" && server.http_config->get_metrics)
+         else if (req_target == "/native/admin/metrics" && server.http_config->get_metrics)
          {
-            if (!is_admin(*server.http_config, req))
+            if (!is_admin(*server.http_config, req_host))
             {
                return send(not_found(req.target()));
             }
@@ -962,9 +1000,9 @@ namespace psibase::http
                           "application/openmetrics-text; version=1.0.0; charset=utf-8"));
                 });
          }
-         else if (req.target() == "/native/admin/peers" && server.http_config->get_peers)
+         else if (req_target == "/native/admin/peers" && server.http_config->get_peers)
          {
-            if (!is_admin(*server.http_config, req))
+            if (!is_admin(*server.http_config, req_host))
             {
                return send(not_found(req.target()));
             }
@@ -997,9 +1035,9 @@ namespace psibase::http
                 });
             return;
          }
-         else if (req.target() == "/native/admin/connect" && server.http_config->connect)
+         else if (req_target == "/native/admin/connect" && server.http_config->connect)
          {
-            if (!is_admin(*server.http_config, req))
+            if (!is_admin(*server.http_config, req_host))
             {
                return send(not_found(req.target()));
             }
@@ -1045,9 +1083,9 @@ namespace psibase::http
                 });
             return;
          }
-         else if (req.target() == "/native/admin/disconnect" && server.http_config->disconnect)
+         else if (req_target == "/native/admin/disconnect" && server.http_config->disconnect)
          {
-            if (!is_admin(*server.http_config, req))
+            if (!is_admin(*server.http_config, req_host))
             {
                return send(not_found(req.target()));
             }
@@ -1093,9 +1131,9 @@ namespace psibase::http
                 });
             return;
          }
-         else if (req.target() == "/native/admin/log" && websocket::is_upgrade(req))
+         else if (req_target == "/native/admin/log" && websocket::is_upgrade(req))
          {
-            if (!is_admin(*server.http_config, req))
+            if (!is_admin(*server.http_config, req_host))
                return send(not_found(req.target()));
             if (forbid_cross_origin())
                return;
@@ -1114,9 +1152,9 @@ namespace psibase::http
                     websocket_log_session<stream_type>::run(std::move(session));
                  });
          }
-         else if (req.target() == "/native/admin/config")
+         else if (req_target == "/native/admin/config")
          {
-            if (!is_admin(*server.http_config, req))
+            if (!is_admin(*server.http_config, req_host))
             {
                return send(not_found(req.target()));
             }
@@ -1163,7 +1201,7 @@ namespace psibase::http
             }
             return;
          }
-         else if (req.target() == "/native/admin/keys")
+         else if (req_target == "/native/admin/keys")
          {
             if (req.method() == bhttp::verb::get)
             {
@@ -1209,9 +1247,9 @@ namespace psibase::http
             }
             return;
          }
-         else if (req.target() == "/native/admin/login")
+         else if (req_target == "/native/admin/login")
          {
-            if (!is_admin(*server.http_config, req))
+            if (!is_admin(*server.http_config, req_host))
             {
                return send(not_found(req.target()));
             }
@@ -1519,8 +1557,17 @@ namespace psibase::http
                 }
                 else
                 {
-                   PSIBASE_LOG(logger, info) << "Idle connection closed";
-                   return do_close();
+                   beast::error_code ec;
+                   derived_session().close_impl(ec);
+                   if (ec)
+                   {
+                      PSIBASE_LOG(logger, warning) << "close: " << ec.message();
+                   }
+                   else
+                   {
+                      PSIBASE_LOG(logger, info) << "Idle connection closed";
+                   }
+                   _closed = true;
                 }
              });
       }
@@ -1553,7 +1600,7 @@ namespace psibase::http
          if (ec)
          {
             fail(logger, ec, "read");
-            return do_close();
+            return close_on_error();
          }
 
          {
@@ -1586,7 +1633,7 @@ namespace psibase::http
          if (ec)
          {
             fail(logger, ec, "write");
-            return do_close();
+            return close_on_error();
          }
 
          if (close)
@@ -1610,17 +1657,43 @@ namespace psibase::http
          // Send a TCP shutdown
          if (!_closed)
          {
-            derived_session().do_shutdown();
+            derived_session().shutdown_impl();
             _timer->cancel();  // cancel connection timer.
             _closed = true;
          }
          // At this point the connection is closed gracefully
       }
-      void do_shutdown()
+      void close_on_error()
+      {
+         if (!_closed)
+         {
+            _timer->cancel();
+            beast::error_code ec;
+            derived_session().close_impl(ec);
+            if (ec)
+            {
+               PSIBASE_LOG(logger, warning) << "close: " << ec.message();
+            }
+            _closed = true;
+         }
+      }
+
+     protected:
+      void shutdown_impl()
       {
          beast::error_code ec;
-         derived_session().stream.socket().shutdown(tcp::socket::shutdown_send, ec);
+         derived_session().stream.socket().shutdown(tcp::socket::shutdown_both, ec);
+         if (ec)
+         {
+            PSIBASE_LOG(logger, warning) << "shutdown: " << ec.message();
+         }
+         derived_session().stream.socket().close(ec);
+         if (ec)
+         {
+            PSIBASE_LOG(logger, warning) << "close: " << ec.message();
+         }
       }
+      void close_impl(beast::error_code& ec) { derived_session().stream.socket().close(ec); }
    };  // http_session
 
    struct tcp_http_session : public http_session<tcp_http_session>,
@@ -1673,11 +1746,13 @@ namespace psibase::http
          return stream.next_layer().socket().remote_endpoint().address() == addr.address;
       }
 
-      void do_shutdown()
+      void shutdown_impl()
       {
          stream.async_shutdown([self = shared_from_this()](const std::error_code& ec) {});
       }
 
+      void close_impl(beast::error_code& ec) { stream.next_layer().socket().close(ec); }
+
       void run()
       {
          stream.async_handshake(boost::asio::ssl::stream_base::server,
@@ -1780,6 +1855,7 @@ namespace psibase::http
       {
          server.register_connection(this->shared_from_this());
          do_accept<Session>();
+         PSIBASE_LOG(logger, info) << "Listening on " << acceptor.local_endpoint();
          return true;
       }
 
diff --git a/programs/psinode/CMakeLists.txt b/programs/psinode/CMakeLists.txt
index 08b607158..a192671b6 100644
--- a/programs/psinode/CMakeLists.txt
+++ b/programs/psinode/CMakeLists.txt
@@ -28,6 +28,20 @@ target_include_directories(psinode PUBLIC
     ../../services/psibase_tests)
 set_target_properties(psinode PROPERTIES RUNTIME_OUTPUT_DIRECTORY ${ROOT_BINARY_DIR})
 
+find_package(Python COMPONENTS Interpreter)
+if(Python_Interpreter_FOUND)
+    add_test(
+        NAME psinode_test_routing
+        COMMAND ${Python_EXECUTABLE} test_routing.py --psinode=$<TARGET_FILE:psinode>
+        WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}/tests)
+    set_tests_properties(psinode_test_routing PROPERTIES PROCESSORS 7)
+    add_test(
+        NAME psinode_test_crash
+        COMMAND ${Python_EXECUTABLE} test_crash.py --psinode=$<TARGET_FILE:psinode>
+        WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}/tests)
+    set_tests_properties(psinode_test_crash PROPERTIES PROCESSORS 4)
+endif()
+
 include(GNUInstallDirs)
 install(FILES config.in DESTINATION ${CMAKE_INSTALL_DATADIR}/psibase COMPONENT ServerData)
 install(TARGETS psinode RUNTIME COMPONENT ServerBin)
diff --git a/programs/psinode/main.cpp b/programs/psinode/main.cpp
index a06d2b743..d8fada331 100644
--- a/programs/psinode/main.cpp
+++ b/programs/psinode/main.cpp
@@ -3,12 +3,12 @@
 #include <psibase/TransactionContext.hpp>
 #include <psibase/bft.hpp>
 #include <psibase/cft.hpp>
-#include <psibase/direct_routing.hpp>
 #include <psibase/http.hpp>
 #include <psibase/log.hpp>
 #include <psibase/node.hpp>
 #include <psibase/peer_manager.hpp>
 #include <psibase/serviceEntry.hpp>
+#include <psibase/shortest_path_routing.hpp>
 #include <psibase/version.hpp>
 #include <psibase/websocket.hpp>
 #include <psio/finally.hpp>
@@ -663,40 +663,59 @@ bool pushTransaction(psibase::SharedState&                  sharedState,
    return false;
 }  // pushTransaction
 
-std::tuple<bool, std::string_view, std::string_view> parse_endpoint(std::string_view peer)
+enum class socket_type
 {
-   // TODO: handle ipv6 addresses [addr]:port
-   bool secure = false;
+   unknown,
+   tcp,
+   tls,
+   local
+};
+
+std::tuple<socket_type, std::string_view, std::string_view> parse_endpoint(std::string_view peer)
+{
+   auto type = socket_type::unknown;
    if (peer.starts_with("ws://"))
    {
+      type = socket_type::tcp;
       peer = peer.substr(5);
    }
    else if (peer.starts_with("http://"))
    {
+      type = socket_type::tcp;
       peer = peer.substr(7);
    }
    else if (peer.starts_with("wss://"))
    {
-      secure = true;
-      peer   = peer.substr(6);
+      type = socket_type::tls;
+      peer = peer.substr(6);
    }
    else if (peer.starts_with("https://"))
    {
-      secure = true;
-      peer   = peer.substr(8);
+      type = socket_type::tls;
+      peer = peer.substr(8);
    }
-   if (peer.ends_with('/'))
+   if (type == socket_type::unknown)
    {
-      peer = peer.substr(0, peer.size() - 1);
+      if (peer.find('/') != std::string::npos)
+      {
+         return {socket_type::local, peer, ""};
+      }
+   }
+   else
+   {
+      if (peer.ends_with('/'))
+      {
+         peer = peer.substr(0, peer.size() - 1);
+      }
    }
    auto pos = peer.find(':');
    if (pos == std::string_view::npos)
    {
-      return {secure, peer, secure ? "443" : "80"};
+      return {type, peer, type == socket_type::tls ? "443" : "80"};
    }
    else
    {
-      return {secure, peer.substr(0, pos), peer.substr(pos + 1)};
+      return {type, peer.substr(0, pos), peer.substr(pos + 1)};
    }
 }
 
@@ -704,8 +723,7 @@ std::vector<std::string> translate_endpoints(std::vector<std::string> urls)
 {
    for (auto& url : urls)
    {
-      if (!url.starts_with("http:") && !url.starts_with("ws:") && !url.starts_with("https") &&
-          !url.starts_with("wss:"))
+      if (url.find('/') == std::string::npos)
       {
          url = "http://" + url + "/";
       }
@@ -1458,7 +1476,7 @@ void run(const std::string&              db_path,
    }
 #endif
 
-   using node_type = node<peer_manager, direct_routing, consensus, ForkDb>;
+   using node_type = node<peer_manager, shortest_path_routing, consensus, ForkDb>;
    node_type node(chainContext, system.get(), prover);
    node.set_producer_id(producer);
    node.load_producers();
@@ -1469,30 +1487,37 @@ void run(const std::string&              db_path,
    auto connect_one = [&resolver, &node, &chainContext, &http_config, &runResult](
                           const std::string& peer, auto&& f)
    {
-      auto [secure, host, service] = parse_endpoint(peer);
-      auto do_connect              = [&](auto&& conn)
+      auto [proto, host, service] = parse_endpoint(peer);
+      auto on_connect = [&node, &http_config, &runResult, f = static_cast<decltype(f)>(f)](
+                            const std::error_code& ec, auto&& conn) mutable
+      {
+         if (!ec)
+         {
+            if (http_config->status.load().shutdown)
+            {
+               conn->close(runResult.shouldRestart ? connection_base::close_code::restart
+                                                   : connection_base::close_code::shutdown);
+               f(make_error_code(boost::asio::error::operation_aborted));
+               return;
+            }
+            node.add_connection(std::move(conn));
+         }
+         f(ec);
+      };
+      auto do_connect = [&](auto&& conn)
       {
          conn->url = peer;
-         async_connect(std::move(conn), resolver, host, service,
-                       [&node, &http_config, &runResult, f = static_cast<decltype(f)>(f)](
-                           const std::error_code& ec, auto&& conn)
-                       {
-                          if (!ec)
-                          {
-                             if (http_config->status.load().shutdown)
-                             {
-                                conn->close(runResult.shouldRestart
-                                                ? connection_base::close_code::restart
-                                                : connection_base::close_code::shutdown);
-                                f(make_error_code(boost::asio::error::operation_aborted));
-                                return;
-                             }
-                             node.add_connection(std::move(conn));
-                          }
-                          f(ec);
-                       });
+         async_connect(std::move(conn), resolver, host, service, std::move(on_connect));
       };
-      if (secure)
+      if (proto == socket_type::local)
+      {
+         auto conn = std::make_shared<
+             websocket_connection<boost::beast::basic_stream<boost::asio::local::stream_protocol>>>(
+             chainContext);
+         conn->url = peer;
+         async_connect(std::move(conn), host, std::move(on_connect));
+      }
+      else if (proto == socket_type::tls)
       {
 #if PSIBASE_ENABLE_SSL
          auto conn = std::make_shared<
diff --git a/programs/psinode/tests/predicates.py b/programs/psinode/tests/predicates.py
new file mode 100644
index 000000000..e833fa345
--- /dev/null
+++ b/programs/psinode/tests/predicates.py
@@ -0,0 +1,36 @@
+import calendar
+import time
+
+def _get_producer_name(prod):
+    if isinstance(prod, str):
+        return prod
+    else:
+        return prod.producer
+
+def producers_are(expected):
+    expected = [_get_producer_name(p) for p in expected]
+    print("waiting for producers: %s" % expected)
+    expected.sort()
+    def result(node):
+        (prods, nextProds) = node.get_producers()
+        print("producers: %s, next producers %s" % (prods, nextProds))
+        prods.sort()
+        return len(nextProds) == 0 and prods == expected
+    return result
+
+def new_block():
+    now = time.time_ns() // 1000000000
+    print("waiting for block produced after %s" % time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime(now)))
+    def result(node):
+        timestamp = node.get_block_header()['time']
+        print(timestamp)
+        return calendar.timegm(time.strptime(timestamp, "%Y-%m-%dT%H:%M:%S.000Z")) > now
+    return result
+
+def irreversible(num):
+    print("waiting for block %s to be committed" % num)
+    def result(node):
+        commitNum = node.get_block_header()['commitNum']
+        print("commitNum: %d" % commitNum)
+        return commitNum >= num
+    return result
diff --git a/programs/psinode/tests/psinode.py b/programs/psinode/tests/psinode.py
new file mode 100644
index 000000000..e4f9fa755
--- /dev/null
+++ b/programs/psinode/tests/psinode.py
@@ -0,0 +1,477 @@
+import socket
+import urllib3
+import requests
+import subprocess
+import os
+import tempfile
+import time
+import calendar
+from collections import namedtuple
+
+class _LocalConnection(urllib3.connection.HTTPConnection):
+    def __init__(self, *args, **kwargs):
+        self.socketpath = kwargs.pop('socketpath', None)
+        super().__init__(*args, **kwargs)
+    def connect(self):
+        self.sock = socket.socket(family=socket.AF_UNIX)
+        self.sock.connect(self.socketpath)
+
+class _LocalConnectionPool(urllib3.HTTPConnectionPool):
+    ConnectionCls = _LocalConnection
+
+def _key_normalizer(request_context):
+    context = request_context.copy()
+    del context['socketpath']
+    return urllib3.poolmanager.key_fn_by_scheme['http'](context)
+        
+class _LocalPoolManager(urllib3.PoolManager):
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.pool_classes_by_scheme = {'http':_LocalConnectionPool}
+        self.key_fn_by_scheme = {'http': _key_normalizer}
+
+class _LocalAdapter(requests.adapters.HTTPAdapter):
+    def __init__(self, socketpath):
+        self.socketpath = socketpath
+        super().__init__()
+    def init_poolmanager(self, connections, maxsize, block=False, **pool_kwargs):
+        self.poolmanager = _LocalPoolManager(num_pools=connections, maxsize=maxsize, block=block, socketpath=self.socketpath)
+
+class Cluster(object):
+    '''Manages a cluster of psinode servers.'''
+    def __init__(self, dir=None, **node_kw):
+        '''
+        Creates a new Cluster.
+
+        If dir is None, the cluster will use a temporary directory.
+        Addition keyword arguments will be used to construct every node.
+        '''
+        if dir is None:
+            self.tempdir = tempfile.TemporaryDirectory()
+            self.dir = self.tempdir.name
+        else:
+            self.dir = dir
+        self.next_id = 0
+        self.node_kw = node_kw
+        self.nodes = {}
+    def make_node(self, name=None, **kw):
+        '''
+        Creates a new Node in this cluster.
+
+        If a name is not provided, the node will be a non-producing node.
+        '''
+        if name is None:
+            self.next_id = self.next_id + 1
+            hostname = str(self.next_id)
+        else:
+            hostname = name
+        for (k,v) in self.node_kw.items():
+            kw.setdefault(k, v)
+        result = Node(dir=os.path.join(self.dir, hostname), hostname=hostname, producer=name, **kw)
+        self.nodes[hostname] = result
+        return result
+    def star(self, *names, **kw):
+        '''Create a star graph with the first node in the center'''
+        nodes = [self.make_node(name, **kw) for name in names]
+        center = nodes[0]
+        for node in nodes[1:]:
+            node.connect(center)
+        return tuple(nodes)
+    def ring(self, *names, **kw):
+        '''Creates nodes connected in a ring'''
+        nodes = [self.make_node(name, **kw) for name in names]
+        prev = nodes[-1]
+        for node in nodes:
+            prev.connect(node)
+            prev = node
+        return tuple(nodes)
+    def complete(self, *names, **kw):
+        '''Creates a fully connected group of nodes'''
+        nodes = [self.make_node(name, **kw) for name in names]
+        for a in nodes:
+            for b in nodes:
+                a.connect(b)
+        return tuple(nodes)
+    def line(self, *names, **kw):
+        '''Creates nodes connected in a line'''
+        nodes = [self.make_node(name, **kw) for name in names]
+        prev = nodes[0]
+        for node in nodes[1:]:
+            prev.connect(node)
+            prev = node
+        return tuple(nodes)
+    def __enter__(self):
+        if hasattr(self, 'tempdir'):
+            self.tempdir.__enter__()
+        return self
+    def __exit__(self, exc_type, exc_value, traceback):
+        for child in self.nodes.values():
+            child.close()
+        if hasattr(self, 'tempdir'):
+            self.tempdir.__exit__(exc_type, exc_value, traceback)
+
+def _get_producer_claim(producer):
+    if isinstance(producer, str):
+        return {'name': producer}
+    elif isinstance(producer, Node):
+        return {'name': producer.producer}
+    else:
+        return producer
+
+Action = namedtuple('Action', ['sender', 'service', 'method', 'data'])
+Transaction = namedtuple('Transaction', ['tapos', 'actions', 'claims'], defaults=[[]])
+
+class TransactionError(Exception):
+    def __init__(self, trace):
+        super().__init__(trace['error'])
+        self.trace = trace
+
+class GraphQLError(Exception):
+    def __init__(self, json):
+        super().__init__(json['errors']['message'])
+        self.json = json
+
+class API:
+    '''Provides an interface to the HTTP API of a psinode server based on requests'''
+    def __init__(self, url, session=None):
+        '''
+        Initializes a new API object for url. If session is provided, it should
+        be a requests Session object that will be used to handle all requests
+        '''
+        self.url = url
+        if session is None:
+            session = requests
+        self.session = session
+
+    # HTTP requests
+    def _make_url(self, path, service=None):
+        url = urllib3.util.parse_url(self.url)
+        if service is not None:
+            host = service + '.' + url.host
+        else:
+            host = url.host
+        return urllib3.util.Url(url.scheme, url.auth, host, url.port, path).url
+    def request(self, method, path, service=None, **kw):
+        '''Makes an HTTP request and returns a Response. Other named parameters are passed through to requests.request.'''
+        return self.session.request(method, self._make_url(path, service), **kw)
+    def head(self, path, service=None, **kw):
+        '''HTTP HEAD request'''
+        return self.request('HEAD', path, service, **kw)
+    def get(self, path, service=None, **kw):
+        '''HTTP GET request'''
+        return self.request('GET', path, service, **kw)
+    def post(self, path, service=None, **kw):
+        '''HTTP POST request'''
+        return self.request('POST', path, service, **kw)
+    def put(self, path, service=None, **kw):
+        '''HTTP PUT request'''
+        return self.request('PUT', path, service, **kw)
+    def patch(self, path, service=None, **kw):
+        '''HTTP PATCH request'''
+        return self.request('PATCH', path, service, **kw)
+    def delete(self, path, service=None, **kw):
+        '''HTTP DELETE request'''
+        return self.request('DELETE', path, service, **kw)
+
+    # Transaction processing
+    def pack_action(self, act):
+        '''Pack an action and return a json object suitable for use in pack_transaction'''
+        with self.post('/pack_action/%s' % act.method, service=act.service, json=act.data) as result:
+            result.raise_for_status()
+            return {'sender':act.sender, 'service':act.service, 'method': act.method, 'rawData': result.content.hex()}
+    def pack_transaction(self, trx):
+        '''Pack a transaction and return the result as bytes'''
+        with self.post('/common/pack/Transaction', json={'tapos':trx.tapos, 'actions':[self.pack_action(act) for act in trx.actions], 'claims': trx.claims}) as result:
+            result.raise_for_status()
+            return result.content
+    def pack_signed_transaction(self, trx, signatures=[]):
+        '''Pack a signed transactions and return the result as bytes'''
+        if isinstance(trx, bytes):
+            trx = trx.hex()
+        elif isinstance(trx, Transaction):
+            trx = self.pack_transaction(trx).hex()
+        with self.post('/common/pack/SignedTransaction', json={'transaction': trx, 'proofs':signatures}) as result:
+            result.raise_for_status()
+            return result.content
+    def push_transaction(self, trx):
+        '''
+        Push a transaction to the chain and return the transaction trace
+
+        Raise TransactionError if the transaction fails
+        '''
+        packed = self.pack_signed_transaction(trx)
+        with self.post('/native/push_transaction', headers={'Content-Type': 'application/octet-stream'}, data=packed) as result:
+            result.raise_for_status()
+            trace = result.json()
+            if trace['error'] is not None:
+                raise TransactionError(trace)
+            return trace
+    def push_action(self, sender, service, method, data):
+        '''
+        Push a transaction consisting of a single action to the chain and return the transaction trace
+
+        Raise TransactionError if the transaction fails
+        '''
+        tapos = tapos=self.get_tapos()
+        tapos['expiration'] = time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime(time.time_ns() // 1000000000 + 10))
+        tapos['flags'] = 0
+        return self.push_transaction(Transaction(tapos, actions=[Action(sender, service, method, data)]))
+
+    # Transactions for key system services
+    def set_producers(self, prods, algorithm=None):
+        '''
+        Pushes a transaction to set the block producers.
+        prods should be a list whose elements are any of
+        - The name of a producer
+        - A Node object
+        - A json dict of the form {"name":<name>, "auth":{"service":<verify service>,"rawData":<hex string>}}
+        algorithm should be either "cft" or "bft". If algorithm is None, the current consensus algorithm will be used.
+        '''
+        producers = [_get_producer_claim(p) for p in prods]
+        if algorithm is None:
+            return self.push_action('producer-sys', 'producer-sys', 'setProducers', {'producers': producers})
+        elif algorithm == 'cft':
+            mode = 'CftConsensus'
+        elif algorithm == 'bft':
+            mode = 'BftConsensus'
+        return self.push_action('producer-sys', 'producer-sys', 'setConsensus', {'consensus':[mode, {'producers': producers}]})
+
+    # Queries
+    def graphql(self, service, query):
+        '''
+        Sends a GraphQL query to a service and returns the result as json
+
+        Raise GraphQLError if the query fails
+        '''
+        with self.post('/graphql', service=service, json={'query': query}) as result:
+            result.raise_for_status()
+            json = result.json()
+            if 'errors' in json:
+                raise GraphQLError(json)
+            return json['data']
+
+    def get_tapos(self):
+        '''Returns TaPoS for the current head block'''
+        with  self.get('/common/tapos/head') as result:
+            result.raise_for_status()
+            return result.json()
+
+    def get_producers(self):
+        '''Returns a tuple of (current producers, next producers). The next producers are empty except when the chain is in the process of changing block producers.'''
+        def flatten(producers):
+            return [p['name'] for p in producers]
+        result = self.graphql('producer-sys', 'query { producers { name } nextProducers { name } }')
+        return (flatten(result['producers']), flatten(result['nextProducers']))
+
+    def get_block_header(self, num=-1):
+        '''Returns the header for a given blocknum. A negative num will return blocks from the end of the chain. -1 is the head block.'''
+        if num == -1:
+            args = 'last:1'
+        else:
+            if num < 0:
+                num += self.get_block_header()['blockNum'] + 1
+                if num < 0:
+                    return None
+            args = 'first:1 ge:%d' % num
+        result = self.graphql('explore-sys', '''
+            query {
+                blocks(%s) {
+                    edges {
+                        node {
+                            header {
+                                blockNum
+                                previous
+                                time
+                                producer
+                                term
+                                commitNum
+                            }
+                        }
+                    }
+                }
+            }
+        ''' % args)
+        edges = result['blocks']['edges']
+        if len(edges) == 0:
+            return None
+        else:
+            return edges[0]['node']['header']
+
+_default_config = '''# psinode config
+service  = localhost:$PSIBASE_DATADIR/services/admin-sys
+service  = 127.0.0.1:$PSIBASE_DATADIR/services/admin-sys
+service  = [::1]:$PSIBASE_DATADIR/services/admin-sys
+service  = admin-sys.:$PSIBASE_DATADIR/services/admin-sys
+admin    = static:*
+
+admin-authz = r:any
+admin-authz = rw:loopback
+
+[logger.stderr]
+type   = console
+filter = %s
+format = %s
+'''
+_default_log_filter = 'Severity >= info'
+_default_log_format = '[{TimeStamp}] [{Severity}]{?: [{RemoteEndpoint}]}: {Message}{?: {TransactionId}}{?: {BlockId}}{?RequestMethod:: {RequestMethod} {RequestHost}{RequestTarget}{?: {ResponseStatus}{?: {ResponseBytes}}}}{?: {ResponseTime} µs}'
+
+def _write_config(dir, log_filter, log_format):
+    logfile = os.path.join(dir, 'config')
+    if not os.path.exists(logfile):
+        if log_filter is None:
+            log_filter = _default_log_filter
+        if log_format is None:
+            log_format = _default_log_format
+        with open(logfile, 'x') as f:
+            f.write(_default_config % (log_filter, log_format))
+
+class Node(API):
+    def __init__(self, executable='psinode', dir=None, hostname=None, producer=None, p2p=True, listen=[], log_filter=None, log_format=None, database_cache_size=None):
+        '''
+        Create a new psinode server
+        If dir is not specified, the server will reside in a temporary directory
+        '''
+        if dir is None:
+            self.tempdir = tempfile.TemporaryDirectory()
+            self.dir = self.tempdir.name
+        else:
+            self.dir = dir
+        self.executable = executable
+        self.hostname = hostname
+        self.producer = producer
+        self.socketpath = os.path.join(self.dir, 'socket')
+        self.logpath = os.path.join(self.dir, 'psinode.log')
+        session = requests.Session()
+        session.mount('http://', _LocalAdapter(self.socketpath))
+        super().__init__('http://%s/' % hostname, session)
+        os.makedirs(self.dir, exist_ok=True)
+        _write_config(self.dir, log_filter, log_format)
+        if isinstance(listen, str):
+            listen = [listen]
+        self.listen = listen
+        self.p2p = p2p
+        self.start(database_cache_size=database_cache_size)
+    def start(self, database_cache_size=None):
+        args = [self.executable, "-l", self.socketpath]
+        for interface in self.listen:
+            args.extend(['-l', interface])
+        if self.producer is not None:
+            args.extend(['-p', self.producer])
+        if self.hostname is not None:
+            args.extend(['--host', self.hostname])
+        if self.p2p:
+            args.append('--p2p')
+        if database_cache_size is not None:
+            args.extend(['--database-cache-size', str(database_cache_size)])
+        args.append(self.dir)
+        with open(self.logpath, 'a') as logfile:
+            self.child = subprocess.Popen(args, stderr=logfile)
+        self._wait_for_startup()
+
+    def __enter__(self):
+        return self
+    def __exit__(self, exc_type, exc_value, traceback):
+        self.close()
+    def __del__(self):
+        self.close()
+    def close(self):
+        '''
+        Stops the server and cleans up all associated resources.
+
+        If a temporary directory was created for the node, it will be deleted.
+        '''
+        if hasattr(self, 'child'):
+            self.child.terminate()
+            try:
+                self.child.wait(timeout=10)
+            except TimeoutExpired:
+                self.child.kill()
+                self.child.wait()
+
+        if hasattr(self, 'tempdir'):
+            self.tempdir.cleanup()
+    def shutdown(self):
+        '''Stop the server and wait for the server process to exit'''
+        with self.post('/native/admin/shutdown', service='admin-sys', json={}):
+            pass
+        self.session.close()
+        self.child.wait()
+    def wait(self, cond, timeout=10):
+        '''
+        Wait until cond(self) is true.
+
+        Raise TimeoutError if the timeout expires first
+        '''
+        for i in range(timeout):
+            if cond(self):
+                return
+            time.sleep(1)
+        raise TimeoutError()
+    def connect(self, other):
+        '''Connect to a peer. other can be a URL or a Node object'''
+        if isinstance(other, Node):
+            url = other.socketpath
+        else:
+            url = other
+        with self.post('/native/admin/connect', service='admin-sys', json={'url':url}):
+            pass
+    def disconnect(self, other):
+        '''Disconnects a peer. other can be a peer id, a URL, or a Node object.'''
+        if isinstance(other, int):
+            result = self.post('/native/admin/disconnect', service='admin-sys', json={'id': other})
+            result.raise_for_status()
+            return True
+        elif isinstance(other, str):
+            with self.get('/native/admin/peers', service='admin-sys') as peers:
+                peers.raise_for_status()
+                for peer in peers.json():
+                    if peer['url'] == other:
+                        return self.disconnect(int(peer['id']))
+            return False
+        else:
+            return self.disconnect(other.socketpath) or other.disconnect(self.socketpath)
+
+    def boot(self, producer=None, doc=False):
+        '''boots the chain. If a producer is not specified, uses the name of this node'''
+        self._find_psibase()
+        if producer is None:
+            producer = self.producer
+        if producer is None:
+            raise RuntimeError("Producer required for boot")
+        args = ['-p', producer]
+        if not doc:
+            args.append('--no-doc')
+        subprocess.run([self.psibase, '-a', self.url, '--proxy', 'unix:' + self.socketpath, 'boot'] + args)
+        now = time.time_ns() // 1000000000
+        def isbooted(node):
+            timestamp = node.get_block_header()['time']
+            if calendar.timegm(time.strptime(timestamp, "%Y-%m-%dT%H:%M:%S.000Z")) <= now:
+                return False
+            return node.get_producers() == ([producer],[])
+        self.wait(isbooted)
+    def log(self):
+        return open(self.logpath, 'r')
+    def print_log(self):
+        with self.log() as f:
+            for line in f.readlines():
+                print(line, end='')
+    def _find_psibase(self):
+        if not hasattr(self, 'psibase'):
+            dirname = os.path.dirname(self.executable)
+            if dirname == '':
+                self.psibase = 'psibase'
+            elif os.path.exists(os.path.join(dirname, 'psibase')):
+                self.psibase = os.path.join(dirname, 'psibase')
+            elif os.path.exists(os.path.join(dirname, 'rust', 'release', 'psibase')):
+                self.psibase = os.path.join(dirname, 'rust', 'release', 'psibase')
+            else:
+                self.psibase = 'psibase'
+    def _wait_for_startup(self):
+        while not self._is_ready():
+            time.sleep(0.1)
+    def _is_ready(self):
+        try:
+            with self.get('/native/admin/status', service='admin-sys') as result:
+                return result.status_code == requests.codes.ok and 'startup' not in result.json()
+        except requests.exceptions.ConnectionError as e:
+            return False
diff --git a/programs/psinode/tests/test_crash.py b/programs/psinode/tests/test_crash.py
new file mode 100755
index 000000000..71ee7937a
--- /dev/null
+++ b/programs/psinode/tests/test_crash.py
@@ -0,0 +1,117 @@
+#!/usr/bin/python
+
+from psinode import Cluster
+from predicates import *
+import testutil
+import time
+import unittest
+
+class TestCrash(unittest.TestCase):
+    @testutil.psinode_test
+    def test_crash_cft(self, cluster):
+        prods = cluster.complete(*testutil.generate_names(3))
+        a = testutil.boot_with_producers(prods)
+        b = cluster.nodes['b']
+
+        a.wait(new_block())
+        a.wait(irreversible(a.get_block_header()['blockNum']))
+
+        # We expect irreversible to be behind by 2
+        print('checking blocks')
+        err = testutil.SuppressErrors(1)
+        for i in range(5):
+            header = a.get_block_header()
+            print(header)
+            with err:
+                self.assertEqual(header['commitNum'] + 2, header['blockNum'])
+            time.sleep(1)
+
+        a.shutdown()
+        b.wait(new_block())
+        b.wait(irreversible(b.get_block_header()['blockNum']))
+
+        print('checking blocks')
+        err = testutil.SuppressErrors(1)
+        for i in range(5):
+            header = b.get_block_header()
+            print(header)
+            with err:
+                self.assertEqual(header['commitNum'] + 2, header['blockNum'])
+            time.sleep(1)
+
+    @testutil.psinode_test
+    def test_shutdown_all_cft(self, cluster):
+        prods = cluster.complete(*testutil.generate_names(3))
+        a = testutil.boot_with_producers(prods)
+        b = prods[1]
+        c = prods[2]
+
+        a.wait(new_block())
+        a.wait(irreversible(a.get_block_header()['blockNum']))
+
+        a.shutdown()
+        b.shutdown()
+        c.shutdown()
+
+        a.start()
+        b.start()
+        c.start()
+
+        a.connect(b)
+        a.connect(c)
+        b.connect(c)
+
+        a.wait(new_block())
+        a.wait(irreversible(a.get_block_header()['blockNum']))
+
+        print('checking blocks')
+        err = testutil.SuppressErrors(1)
+        for i in range(5):
+            header = b.get_block_header()
+            print(header)
+            with err:
+                self.assertEqual(header['commitNum'] + 2, header['blockNum'])
+            time.sleep(1)
+
+    @testutil.psinode_test
+    def test_shutdown_all_bft(self, cluster):
+        prods = cluster.complete(*testutil.generate_names(4))
+        a = testutil.boot_with_producers(prods, 'bft')
+        b = prods[1]
+        c = prods[2]
+        d = prods[3]
+
+        a.wait(new_block())
+        a.wait(irreversible(a.get_block_header()['blockNum']))
+
+        a.shutdown()
+        b.shutdown()
+        c.shutdown()
+        d.shutdown()
+
+        a.start()
+        b.start()
+        c.start()
+        d.start()
+
+        a.connect(b)
+        a.connect(c)
+        a.connect(d)
+        b.connect(c)
+        b.connect(d)
+        c.connect(d)
+
+        a.wait(new_block())
+        a.wait(irreversible(a.get_block_header()['blockNum']))
+
+        print('checking blocks')
+        err = testutil.SuppressErrors(1)
+        for i in range(5):
+            header = b.get_block_header()
+            print(header)
+            with err:
+                self.assertEqual(header['commitNum'] + 2, header['blockNum'])
+            time.sleep(1)
+
+if __name__ == '__main__':
+    testutil.main()
diff --git a/programs/psinode/tests/test_routing.py b/programs/psinode/tests/test_routing.py
new file mode 100755
index 000000000..a5bde382e
--- /dev/null
+++ b/programs/psinode/tests/test_routing.py
@@ -0,0 +1,147 @@
+#!/usr/bin/python
+
+from psinode import Cluster
+from predicates import *
+import testutil
+import time
+import unittest
+
+class TestRouting(unittest.TestCase):
+    @testutil.psinode_test
+    def test_routing(self, cluster):
+        # Each node is adjacent to two others. With 7 nodes, consensus
+        # requires 4 nodes, so this test will time out if messages are not routed
+        prods = cluster.ring(*testutil.generate_names(7))
+        a = testutil.boot_with_producers(prods)
+
+        # wait for irreversibility to advance
+        a.wait(new_block())
+        a.wait(irreversible(a.get_block_header()['blockNum']))
+
+        # We expect irreversible to be behind by 2
+        print('checking blocks')
+        err = testutil.SuppressErrors(1)
+        for i in range(5):
+            header = a.get_block_header()
+            print(header)
+            with err:
+                self.assertEqual(header['commitNum'] + 2, header['blockNum'])
+            time.sleep(1)
+
+    @testutil.psinode_test
+    def test_change_route(self, cluster):
+        # Each node is a adjacent to two others. With 7 nodes, consensus
+        # requires 4 nodes, so this test will time out if messages are not routed
+        (a, b, c, d, e, f, g) = cluster.ring('a', 'b', 'c', 'd', 'e', 'f', 'g')
+        testutil.boot_with_producers([a, b, c, d, e, f, g])
+
+        # wait for irreversibility to advance
+        a.wait(new_block())
+        a.wait(irreversible(a.get_block_header()['blockNum']))
+
+        a.disconnect(b)
+
+        # Switch between two different configurations
+        print('checking blocks')
+        err = testutil.SuppressErrors(1)
+        for i in range(10):
+            header = a.get_block_header()
+            print(header)
+            with err:
+                self.assertEqual(header['commitNum'] + 2, header['blockNum'])
+            time.sleep(1)
+            if i % 2 == 0:
+                a.connect(b)
+                a.disconnect(g)
+            else:
+                a.connect(g)
+                a.disconnect(b)
+
+    @testutil.psinode_test
+    def test_min_nodes(self, cluster):
+        # Each node is a adjacent to two others. With 7 nodes, consensus
+        # requires 4 nodes, so this test will time out if messages are not routed
+        (a, b, c, d, e, f, g) = cluster.ring('a', 'b', 'c', 'd', 'e', 'f', 'g')
+        testutil.boot_with_producers([a, b, c, d, e, f, g, 'h', 'i', 'j', 'k', 'l', 'm'])
+
+        # wait for irreversibility to advance
+        a.wait(new_block())
+        a.wait(irreversible(a.get_block_header()['blockNum']))
+
+        a.disconnect(b)
+
+        # Switch between two different configurations
+        print('checking blocks')
+        err = testutil.SuppressErrors(1)
+        testutil.sleep(0.0, 0.5)
+        for i in range(10):
+            header = a.get_block_header()
+            print(header)
+            with err:
+                self.assertEqual(header['commitNum'] + 2, header['blockNum'])
+            testutil.sleep(0.5, 0.5)
+            if i % 2 == 0:
+                a.connect(b)
+                a.disconnect(g)
+            else:
+                a.connect(g)
+                a.disconnect(b)
+
+    @testutil.psinode_test
+    def test_bft(self, cluster):
+        (a, b, c, d, e, f, g) = cluster.ring('a', 'b', 'c', 'd', 'e', 'f', 'g')
+        testutil.boot_with_producers([a, b, c, d, e, f, g], 'bft')
+
+        # wait for irreversibility to advance
+        a.wait(new_block())
+        a.wait(irreversible(a.get_block_header()['blockNum']))
+
+        a.disconnect(g)
+
+        # Switch between two different configurations
+        print('checking blocks')
+        err = testutil.SuppressErrors(1)
+        testutil.sleep(0.0, 0.5)
+        for i in range(10):
+            header = a.get_block_header()
+            print(header)
+            with err:
+                self.assertEqual(header['commitNum'] + 2, header['blockNum'])
+            testutil.sleep(0.5, 0.5)
+            if i % 2 == 0:
+                a.connect(g)
+                a.disconnect(b)
+            else:
+                a.connect(b)
+                a.disconnect(g)
+
+    @testutil.psinode_test
+    def test_bft_min_nodes(self, cluster):
+        (a, b, c, d, e, f, g) = cluster.ring('a', 'b', 'c', 'd', 'e', 'f', 'g')
+        testutil.boot_with_producers([a, b, c, d, e, f, g, 'h', 'i', 'j'], 'bft')
+
+        # wait for irreversibility to advance
+        a.wait(new_block())
+        a.wait(irreversible(a.get_block_header()['blockNum']))
+
+        a.disconnect(g)
+
+        # Switch between two different configurations
+        print('checking blocks')
+        err = testutil.SuppressErrors(1)
+        testutil.sleep(0.0, 0.5)
+        for i in range(10):
+            header = a.get_block_header()
+            print(header)
+            with err:
+                self.assertEqual(header['commitNum'] + 2, header['blockNum'])
+            testutil.sleep(0.5, 0.5)
+            if i % 2 == 0:
+                a.connect(g)
+                a.disconnect(b)
+            else:
+                a.connect(b)
+                a.disconnect(g)
+
+if __name__ == '__main__':
+    testutil.main()
diff --git a/programs/psinode/tests/testutil.py b/programs/psinode/tests/testutil.py
new file mode 100644
index 000000000..1ca033197
--- /dev/null
+++ b/programs/psinode/tests/testutil.py
@@ -0,0 +1,68 @@
+from psinode import Cluster
+import predicates
+import argparse
+import unittest
+import sys
+import time
+import math
+
+def psinode_test(f):
+    def result(self):
+        with Cluster(executable=args.psinode, log_filter=args.log_filter, log_format=args.log_format, database_cache_size=256*1024*1024) as cluster:
+            try:
+                f(self, cluster)
+            except:
+                for node in cluster.nodes.values():
+                    node.print_log()
+                raise
+            else:
+                if args.print_logs is not None:
+                    for (hostname, node) in cluster.nodes.items():
+                        if hostname in args.print_logs or 'all' in args.print_logs:
+                            node.print_log()
+    return result
+
+def generate_names(n):
+    letters = 'abcdefghijklmnopqrstuvwxyz'
+    return list(letters[0:n])
+
+def boot_with_producers(nodes, algorithm=None, timeout=10):
+    p = nodes[0]
+    print("booting chain")
+    p.boot()
+    print("setting producers")
+    p.set_producers(nodes, algorithm)
+    p.wait(predicates.producers_are(nodes), timeout=timeout)
+    return p
+
+def sleep(secs, end_at):
+    '''Like time.sleep, but waits additional time until the fractional seconds are equal to end_at'''
+    ticks_per_sec = 1000000000
+    current = (time.time_ns() % ticks_per_sec) / ticks_per_sec
+    extra = end_at - (current + math.modf(secs)[0])
+    if extra < 0:
+        extra += 1
+
+    time.sleep(secs + extra)
+
+class SuppressErrors:
+    '''A Context Manager used to handle repeated checks that we expect to pass most of the time'''
+    def __init__(self, n):
+        self.n = n
+    def __enter__(self):
+        return self
+    def __exit__(self, exc_type, exc_value, traceback):
+        if exc_type is not None:
+            self.n -= 1
+            if self.n >= 0:
+                return True
+
+def main(argv=sys.argv):
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--psinode", default="psinode", help="The path to the psinode executable")
+    parser.add_argument('--log-filter', metavar='FILTER', help="Filter for log messages")
+    parser.add_argument('--log-format', metavar='FORMAT', help="Format for log messages")
+    parser.add_argument('--print-logs', metavar='NODE', action='append', help="Nodes whose logs should be printed")
+    global args
+    (args, remaining) = parser.parse_known_args(argv)
+    unittest.main(argv=remaining)
diff --git a/rust/psibase/src/lib.rs b/rust/psibase/src/lib.rs
index 7b5129467..58e43df4e 100644
--- a/rust/psibase/src/lib.rs
+++ b/rust/psibase/src/lib.rs
@@ -9,6 +9,7 @@ mod graph_ql;
 mod hex;
 mod http;
 mod internal_macros;
+mod local_socket;
 mod method_number;
 pub mod native;
 pub mod native_raw;
@@ -39,6 +40,7 @@ pub use from_bin::*;
 pub use graph_ql::*;
 pub use hex::*;
 pub use http::*;
+pub use local_socket::*;
 pub use method_number::*;
 pub use native::*;
 pub use native_tables::*;
diff --git a/rust/psibase/src/local_socket.rs b/rust/psibase/src/local_socket.rs
new file mode 100644
index 000000000..3d1492a5b
--- /dev/null
+++ b/rust/psibase/src/local_socket.rs
@@ -0,0 +1,52 @@
+use tokio::net::TcpListener;
+use tokio::net::UnixStream;
+//use core::net::SocketAddr;
+use reqwest::Url;
+
+pub struct AutoAbort {
+    handle: tokio::task::JoinHandle<()>,
+}
+
+impl Drop for AutoAbort {
+    fn drop(&mut self) {
+        self.handle.abort()
+    }
+}
+
+async fn make_tcp_proxy(
+    path: &str,
+) -> Result<(tokio::task::JoinHandle<()>, String), anyhow::Error> {
+    let listener = TcpListener::bind("127.0.0.1:0").await?;
+    let endpoint = listener.local_addr()?;
+    let pathcpy: String = path.into();
+    let task = tokio::task::spawn(async move {
+        while let Ok((mut client, _)) = listener.accept().await {
+            let pathcpy2 = pathcpy.clone();
+            tokio::task::spawn(async move {
+                if let Ok(mut upstream) = UnixStream::connect(pathcpy2).await {
+                    let _ = tokio::io::copy_bidirectional(&mut client, &mut upstream).await;
+                }
+            });
+        }
+    });
+
+    Ok((task, format!("http://{}", endpoint)))
+}
+
+pub async fn apply_proxy(
+    builder: reqwest::ClientBuilder,
+    proxy: &Option<Url>,
+) -> Result<(reqwest::ClientBuilder, Option<AutoAbort>), anyhow::Error> {
+    if let Some(url) = proxy {
+        if url.scheme() == "unix" {
+            let (task, endpoint) = make_tcp_proxy(url.path()).await?;
+            return Ok((
+                builder.proxy(reqwest::Proxy::http(endpoint)?),
+                Some(AutoAbort { handle: task }),
+            ));
+        } else {
+            return Ok((builder.proxy(reqwest::Proxy::http(url.as_str())?), None));
+        }
+    }
+    return Ok((builder, None));
+}
diff --git a/rust/psibase/src/main.rs b/rust/psibase/src/main.rs
index 9d8f604dd..c20d96277 100644
--- a/rust/psibase/src/main.rs
+++ b/rust/psibase/src/main.rs
@@ -8,9 +8,9 @@ use indicatif::{ProgressBar, ProgressStyle};
 use jwt::SignWithKey;
 use psibase::services::{account_sys, auth_ec_sys, proxy_sys, psispace_sys, setcode_sys};
 use psibase::{
-    account, create_boot_transactions, get_tapos_for_head, push_transaction, sign_transaction,
-    AccountNumber, Action, ExactAccountNumber, PrivateKey, PublicKey, SignedTransaction, Tapos,
-    TaposRefBlock, TimePointSec, Transaction,
+    account, apply_proxy, create_boot_transactions, get_tapos_for_head, push_transaction,
+    sign_transaction, AccountNumber, Action, AutoAbort, ExactAccountNumber, PrivateKey, PublicKey,
+    SignedTransaction, Tapos, TaposRefBlock, TimePointSec, Transaction,
 };
 use reqwest::Url;
 use serde::{Deserialize, Serialize};
@@ -32,6 +32,10 @@ struct Args {
     )]
     api: Url,
 
+    /// HTTP proxy
+    #[clap(long, value_name = "URL")]
+    proxy: Option<Url>,
+
     /// Sign with this key (repeatable)
     #[clap(short = 's', long, value_name = "KEY")]
     sign: Vec<PrivateKey>,
@@ -649,10 +653,15 @@ fn create_token(expires_after: Duration, mode: &str) -> Result<(), anyhow::Error
     Ok(())
 }
 
+async fn build_client(args: &Args) -> Result<(reqwest::Client, Option<AutoAbort>), anyhow::Error> {
+    let (builder, result) = apply_proxy(reqwest::Client::builder(), &args.proxy).await?;
+    Ok((builder.build()?, result))
+}
+
 #[tokio::main]
 async fn main() -> Result<(), anyhow::Error> {
     let args = Args::parse();
-    let client = reqwest::Client::new();
+    let (client, _proxy) = build_client(&args).await?;
     match &args.command {
         Command::Boot { key, producer, doc } => boot(&args, client, key, *producer, *doc).await?,
         Command::Create {
diff --git a/services/system/ProducerSys/src/RProducerSys.cpp b/services/system/ProducerSys/src/RProducerSys.cpp
index 901e00e06..3cda5b244 100644
--- a/services/system/ProducerSys/src/RProducerSys.cpp
+++ b/services/system/ProducerSys/src/RProducerSys.cpp
@@ -18,14 +18,43 @@ using Tables = psibase::ServiceTables<psibase::WebContentTable>;
 struct ProducerQuery
 {
    std::vector<Producer> producers() const
+   {
+      return std::visit([](const auto& c) { return c.producers; }, consensus());
+   }
+   std::vector<Producer> nextProducers() const
+   {
+      if (auto c = nextConsensus())
+         return std::visit([](const auto& c) { return c.producers; }, *c);
+      return {};
+   }
+   Consensus consensus() const
    {
       auto status = psibase::kvGet<psibase::StatusRow>(StatusRow::db, StatusRow::key());
       if (!status)
          return {};
-      return std::visit([](const auto& c) { return c.producers; }, status->consensus);
+      return std::move(status->consensus);
+   }
+   std::optional<Consensus> nextConsensus() const
+   {
+      auto status = psibase::kvGet<psibase::StatusRow>(StatusRow::db, StatusRow::key());
+      if (!status || !status->nextConsensus)
+         return {};
+      return std::move(std::get<0>(*status->nextConsensus));
+   }
+   std::optional<BlockNum> jointStart() const
+   {
+      auto status = psibase::kvGet<psibase::StatusRow>(StatusRow::db, StatusRow::key());
+      if (!status || !status->nextConsensus)
+         return {};
+      return std::get<1>(*status->nextConsensus);
    }
 };
-PSIO_REFLECT(ProducerQuery, method(producers))
+PSIO_REFLECT(ProducerQuery,
+             method(producers),
+             method(nextProducers),
+             method(consensus),
+             method(nextConsensus),
+             method(jointStart))
 
 std::optional<HttpReply> RProducerSys::serveSys(HttpRequest request)
 {