roots: a joiner takes a root once its seeds named it

Review 3, R2: the root pin was set by the first HELLO_REPLY, and the
first sync, a round trip later, took that root; a peer naming another
afterwards was refused as another history. So the seed that answered
first decided, not "none while they disagree", and a malicious seed
makes itself fastest.

A node joining with an empty document of the first epoch now takes no
root (RootPin::Awaiting, roots left for later) until each of its seeds
named one, or ROOT_WAIT (10 s) passed since the first did; then the
one they name, none while they differ, as before. With --genesis-root
it takes that one alone, at once. access.md, the option's help and
example.toml say so; switching roots later, while the joiner holds
nothing of its own, is postponed.

1 files changed, 4 insertions, 2 deletions

diff --git a/docs/access.md b/docs/access.md
index 2f36ecd..46758b0 100644
--- a/docs/access.md
+++ b/docs/access.md
@@ -329,8 +329,10 @@ node whose document starts from another root of the same epoch refuses the hands
 (another history under the swarm's ID: a forged root, or a genesis started again).
 A node joining with an empty document takes as its root only the one it was given
 (`--genesis-root`), or else the one its peers name, and none while they name different
-ones. So one peer hands a joiner another root only if it is all the joiner hears, or
-never, with `--genesis-root`.
+ones; and none before each of its seeds named one, or ten seconds passed since the
+first did. So without `--genesis-root`, the root is the one the seeds that answer within
+that wait agree on: one peer hands a joiner another root only if it is all the joiner
+hears by then; with `--genesis-root`, never.
 
 What it doesn't do yet: