refusals: a drop taking much waits for a second member, and shows

A node told (REFUSALS) that it holds a change the swarm's rules refuse,
and whose own rules refuse it too, dropped it and everything built on
it on one peer's word, however much that was; its own writes among them
went to the quarantine, the others' nowhere.

* A drop taking more than 100 changes, or more than ten and a tenth of
  the document, now
  waits until a second member names the same change: the node's rules
  and one peer's word could both be off. Logged as an error, counted in
  /admin/stats (sync.dropsHeld).
* The others' changes dropped are listed with the refused (GET
  /admin/refused, "taken unjudged, dropped"), for operators to see.

The cheap half of asking the others (future-work.md, Telling a
malicious change from a wrong policy).

1 files changed, 3 insertions, 2 deletions

diff --git a/src/swarm/refusals.rs b/src/swarm/refusals.rs
index c1949eb..af4252c 100644
--- a/src/swarm/refusals.rs
+++ b/src/swarm/refusals.rs
@@ -10,7 +10,8 @@
 //! anything): it judges each it holds itself, as its rules have them now
 //! (`received`). If its rules refuse one too, it took it unjudged, and drops it with
 //! everything built on it: its document as it would be without them, its own writes
-//! among them quarantined (`AppState::drop_taken`). If its rules take it, the two
+//! among them quarantined, the others' listed as refused (`AppState::drop_taken`); one
+//! taking much, once a second member says so too. If its rules take it, the two
 //! policies disagree, which it logs; finding out which is right is left
 //! (`future-work.md`, Write protection by checking changes).
 
@@ -85,7 +86,7 @@ pub(crate) async fn received(state: &AppState, peer: &str, message: RefusalsMess
     };
     if let Some((hash, why)) = refused {
         warn!(peer = %peer, change = %hash, why = %why, "We hold a change the swarm's rules refuse, taken unjudged: dropping it and what builds on it (our writes among them go to the quarantine)");
-        state.drop_taken(hash).await;
+        state.drop_taken(hash, peer, &why).await;
     } else if !taken.is_empty() {
         warn!(peer = %peer, changes = ?taken, "A peer refuses changes our rules take: its policy or ours is off");
     }