refusals: a drop taking much waits for a second member, and shows

A node told (REFUSALS) that it holds a change the swarm's rules refuse,
and whose own rules refuse it too, dropped it and everything built on
it on one peer's word, however much that was; its own writes among them
went to the quarantine, the others' nowhere.

* A drop taking more than 100 changes, or more than ten and a tenth of
  the document, now
  waits until a second member names the same change: the node's rules
  and one peer's word could both be off. Logged as an error, counted in
  /admin/stats (sync.dropsHeld).
* The others' changes dropped are listed with the refused (GET
  /admin/refused, "taken unjudged, dropped"), for operators to see.

The cheap half of asking the others (future-work.md, Telling a
malicious change from a wrong policy).

1 files changed, 6 insertions, 0 deletions

diff --git a/src/api/stats/prometheus.rs b/src/api/stats/prometheus.rs
index 41d224a..dd49751 100644
--- a/src/api/stats/prometheus.rs
+++ b/src/api/stats/prometheus.rs
@@ -640,6 +640,12 @@ pub(super) fn render(stats: &StatsResponse, list: &PeerListResponse) -> String {
         "Peers refused as a whole, their own changes having broken the swarm's rules.",
         stats.sync.refused_peers as f64,
     );
+    out.single(
+        "drops_held",
+        "gauge",
+        "Changes peers say the swarm's rules refuse, ours too, whose drop takes much: held for a second member to say so.",
+        stats.sync.drops_held as f64,
+    );
     let relay = &stats.relay;
     out.single(
         "announce_rounds_total",