access: members refused as a whole

With signatures required, a member whose own change broke a rule is
refused as a whole: sent nothing, shown in /peers (refused), in stats
(sync.refusedPeers) and on the dashboard, until a change of its is
taken again or the epoch changes.

Auth plan M6 (diverged standing).

1 files changed, 9 insertions, 1 deletions

diff --git a/docs/access.md b/docs/access.md
index 567cebd..31efe4e 100644
--- a/docs/access.md
+++ b/docs/access.md
@@ -238,7 +238,15 @@ change stays out, and so does whatever builds on it; the node logs it (`Refused
 change`) and lists the last thousand (`GET /admin/refused`). Offered again, as its
 writer's node keeps offering what is never taken, it is refused by its hash, not judged
 or logged again, and a peer offering nothing else is answered later each time, up to a
-minute apart. A change whose
+minute apart.
+
+With signatures required, a member whose own change broke a rule (its signature proves
+it its own) is refused as a whole: every node sends it nothing more, as all it commits
+from then on builds on what was refused, and logs it once. It shows in `GET /peers`
+(`refused`, with the change and why), in `/admin/stats` (`sync.refusedPeers`) and on the
+dashboard. A node that only passed a refused change on isn't: the committer is, whoever
+brought it. It lasts until a change of the member's is taken again (it rejoined and
+writes anew), or the epoch changes; forgetting or banning it is the operators'. A change whose
 dependencies haven't come yet waits for them.
 
 What it doesn't do yet: