roots: a joiner takes a root once its seeds named it

Review 3, R2: the root pin was set by the first HELLO_REPLY, and the
first sync, a round trip later, took that root; a peer naming another
afterwards was refused as another history. So the seed that answered
first decided, not "none while they disagree", and a malicious seed
makes itself fastest.

A node joining with an empty document of the first epoch now takes no
root (RootPin::Awaiting, roots left for later) until each of its seeds
named one, or ROOT_WAIT (10 s) passed since the first did; then the
one they name, none while they differ, as before. With --genesis-root
it takes that one alone, at once. access.md, the option's help and
example.toml say so; switching roots later, while the joiner holds
nothing of its own, is postponed.

2 files changed, 6 insertions, 4 deletions

diff --git a/docs/access.md b/docs/access.md
index 2f36ecd..46758b0 100644
--- a/docs/access.md
+++ b/docs/access.md
@@ -329,8 +329,10 @@ node whose document starts from another root of the same epoch refuses the hands
 (another history under the swarm's ID: a forged root, or a genesis started again).
 A node joining with an empty document takes as its root only the one it was given
 (`--genesis-root`), or else the one its peers name, and none while they name different
-ones. So one peer hands a joiner another root only if it is all the joiner hears, or
-never, with `--genesis-root`.
+ones; and none before each of its seeds named one, or ten seconds passed since the
+first did. So without `--genesis-root`, the root is the one the seeds that answer within
+that wait agree on: one peer hands a joiner another root only if it is all the joiner
+hears by then; with `--genesis-root`, never.
 
 What it doesn't do yet:
 
diff --git a/docs/example.toml b/docs/example.toml
index c152b8b..010968a 100644
--- a/docs/example.toml
+++ b/docs/example.toml
@@ -112,8 +112,8 @@ htpasswd = "/etc/continuum/htpasswd"
 
 # The hash of the swarm's genesis change (hex, as its genesis node logs it and GET
 # /admin/epochs shows it): joining with an empty document, the only root this node
-# takes. Without, the one its peers name, none while they name different ones
-# (docs/access.md).
+# takes. Without, the one its peers name once each seed named one or ten seconds
+# passed since the first did, none while they name different ones (docs/access.md).
 # genesis-root = "…"
 
 # SSH keys, as authorized_keys lines (ssh-ed25519 <base64> [comment]), whose signature