The control plane uses whichever mirror answers

mirror.peers names the mirrors kept in step with mirror.api. The
mirror's management calls go to the first that can be reached, and
each mirror is asked every fifteen seconds whether it answers: a shard
is sent its model's and adapters' address on one that does while the
mirror the catalog names is down.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs/reference.md

@@ -180,6 +180,7 @@ rather than repeated.
 | `parallel` | `int` | [LlamaCppConfig](#llamacppconfig) |
 | `threads` | `int` | [LlamaCppConfig](#llamacppconfig) |
 | `api` | `string` | [Mirror](#mirror) |
+| `peers` | `[]string` | [Mirror](#mirror) |
 | `tls` | `tlsconf.Config` | [Mirror](#mirror) |
 | `registry` | `string` | [Mirror](#mirror) |
 | `timeout` | `time.Duration` | [Mirror](#mirror) |
@@ -1722,6 +1723,14 @@ The management port, not the one nodes fetch bytes from. Those are two
 listeners on the mirror precisely so this one can be locked down without
 re-certifying every agent's fetcher.
 
+### `peers`
+
+`[]string`
+
+Peers are the management addresses of mirrors kept in step with this
+one (llmgw mirror serve --peer): asked when it cannot be reached, and
+a node given the same file on one of them while it is down.
+
 ### `tls`
 
 `tlsconf.Config`