roots: a joiner takes a root once its seeds named it

Review 3, R2: the root pin was set by the first HELLO_REPLY, and the
first sync, a round trip later, took that root; a peer naming another
afterwards was refused as another history. So the seed that answered
first decided, not "none while they disagree", and a malicious seed
makes itself fastest.

A node joining with an empty document of the first epoch now takes no
root (RootPin::Awaiting, roots left for later) until each of its seeds
named one, or ROOT_WAIT (10 s) passed since the first did; then the
one they name, none while they differ, as before. With --genesis-root
it takes that one alone, at once. access.md, the option's help and
example.toml say so; switching roots later, while the joiner holds
nothing of its own, is postponed.

1 files changed, 2 insertions, 2 deletions

diff --git a/docs/example.toml b/docs/example.toml
index c152b8b..010968a 100644
--- a/docs/example.toml
+++ b/docs/example.toml
@@ -112,8 +112,8 @@ htpasswd = "/etc/continuum/htpasswd"
 
 # The hash of the swarm's genesis change (hex, as its genesis node logs it and GET
 # /admin/epochs shows it): joining with an empty document, the only root this node
-# takes. Without, the one its peers name, none while they name different ones
-# (docs/access.md).
+# takes. Without, the one its peers name once each seed named one or ten seconds
+# passed since the first did, none while they name different ones (docs/access.md).
 # genesis-root = "…"
 
 # SSH keys, as authorized_keys lines (ssh-ed25519 <base64> [comment]), whose signature