refusals: a drop taking much waits for a second member, and shows

A node told (REFUSALS) that it holds a change the swarm's rules refuse,
and whose own rules refuse it too, dropped it and everything built on
it on one peer's word, however much that was; its own writes among them
went to the quarantine, the others' nowhere.

* A drop taking more than 100 changes, or more than ten and a tenth of
  the document, now
  waits until a second member names the same change: the node's rules
  and one peer's word could both be off. Logged as an error, counted in
  /admin/stats (sync.dropsHeld).
* The others' changes dropped are listed with the refused (GET
  /admin/refused, "taken unjudged, dropped"), for operators to see.

The cheap half of asking the others (future-work.md, Telling a
malicious change from a wrong policy).

1 files changed, 5 insertions, 1 deletions

diff --git a/docs/access.md b/docs/access.md
index 5983c7c..a8dfed4 100644
--- a/docs/access.md
+++ b/docs/access.md
@@ -296,7 +296,11 @@ every 30 seconds). The peer doesn't take the word for it: it judges each it hold
 itself, by its rules as they are now. If they refuse one too, it drops it with
 everything built on it, its document becoming what it would be without them, and puts
 its own writes among them in the quarantine (`GET /admin/quarantine`), to be replayed
-or discarded; what it writes from then on goes everywhere. If its rules take the
+or discarded, and the others' among the refused (`GET /admin/refused`, "taken
+unjudged, dropped"); what it writes from then on goes everywhere. A drop taking more
+than 100 changes, or more than ten and a tenth of the document, waits until a second member says so too:
+its own rules and one peer's word could both be off (logged as an error, counted in
+`/admin/stats` as `sync.dropsHeld`). If its rules take the
 change, the two policies disagree, which it logs. A change whose
 dependencies haven't come yet waits for them.