Separate immutable data (identified by hash via Content Addressing) from mutable pointers (signed by Identity keys):

Data is permanent and verifiable; anyone can cache or mirror it without trust.

Pointers (IPNS records, signed heads, DNS links) are the only mutable surface—and they're authenticated.

This separation enables aggressive caching, CDN-like distribution, and offline verification.

IPFS, Hypercore, and SSB all follow this pattern.

Decouple discovery (finding who has what) from transfer (moving bytes). This separation allows each concern to evolve independently:

Trackers in BitTorrent: centralized servers that maintain peer lists. Simple, fast, but a single point of failure.

Provider records in IPFS DHT: decentralized discovery without any single tracker.

Rendezvous servers in libp2p: lightweight discovery points where peers register and find each other by topic.

Relay servers in Nostr: simple WebSocket servers that are both discovery and relay. Users choose their relays.

The pattern works because transfer protocols can be simple (Bitswap, uTP) while discovery can range from centralized to fully decentralized based on the threat model.

Elevate capable nodes to provide services while keeping the network open to all:

Superpeers/ultrapeers: nodes with good bandwidth, uptime, and public reachability handle indexing, relay, or caching for lighter peers.

libp2p DHT server vs client mode: only publicly reachable nodes serve DHT routing requests.

SSB pub servers: always-online nodes that store and forward feeds for offline users.

Risk: superpeers can become points of centralization. Mitigate with rotation, redundancy, and ensuring any node can be promoted.

Design for intermittent connectivity—assume the network is unreliable and peers go offline frequently:

Local-first: all reads and writes happen locally against a local replica; sync happens opportunistically when connectivity is available.

CRDTs enable conflict-free merging after reconnection, making local-first practical.

Delay-tolerant networking (DTN): store-and-forward across intermittent links. Applicable to mesh networks, rural connectivity, and even space communication.

Hypercore (Keet), SSB (Manyverse), and Syncthing are built around this pattern.

Successful P2P stacks are modular, with clean boundaries between concerns:

Transport (connectivity): connection establishment, encryption, multiplexing.

Overlay (DHTs): routing, peer discovery, topology maintenance.

Data (content addressing, storage): block exchange, replication, caching.

Application (sync, messaging): domain logic, UI.

libp2p is the most explicit implementation of this pattern, with swappable modules at each layer.

Layer security at every level rather than relying on a single defense:

Transport encryption (Noise/TLS) + content addressing verification + PubSub scoring + identity-based authorization.

Design patterns are cross-cutting. Each pattern references specific concept documents above. Testing and Operations covers how to validate these patterns in practice (modular stacks are easier to test). Compliance addresses governance implications of decentralized patterns. Privacy benefits from the offline-first pattern (less metadata exposure when not always connected).