state: refused writes limited for the node too

Review 3, R5: --refused-writes-per-minute bounds each user, but the
cost it guards, a document copy under the write lock, is the node's:
ten users, or ten accounts of one, are ten times the budget.

The node now takes six times a user's limit within a minute in all
(refused::NODE_FACTOR); past it, every user with a write refused
within the minute is answered 429 untried, until the oldest leave it.
A user none of whose writes was refused writes on, so honest writers
aren't held up by others' refusals.

1 files changed, 3 insertions, 1 deletions

diff --git a/docs/access.md b/docs/access.md
index 2ef94d3..034b9fa 100644
--- a/docs/access.md
+++ b/docs/access.md
@@ -269,7 +269,9 @@ those through the API alike: one every node would refuse is rolled back, never
 written, and the request refused (`403`, saying why). A rollback costs a copy of the
 document, so a user with more than ten such writes within a minute
 (`--refused-writes-per-minute`) has its writes answered `429`, untried, until the
-oldest leave the minute. So a write the API's checks let
+oldest leave the minute; and past six times as many on the node in all, so does every
+user with one refused within the minute (users none of whose writes were refused write
+on). So a write the API's checks let
 through (they look at the path asked for, the rules at everything the change does)
 can't cut its node off.