From 7323e8ed8598cda9784493aa3334d947120b53d8 Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 7 Nov 2026 22:35:22 +0100 Subject: swarm: changes taken unjudged, dropped (REFUSALS) A node refusing changes a peer brought tells it which broke a rule; the peer judges them itself, and if its rules refuse them too, drops them with all built on them (its document forked without them, a fresh actor), quarantining its own writes among them. Wire version 42. Auth plan M6 (rejoin on taint). --- docs/access.md | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) (limited to 'docs/access.md') diff --git a/docs/access.md b/docs/access.md index 31efe4e..44c89f3 100644 --- a/docs/access.md +++ b/docs/access.md @@ -246,7 +246,18 @@ from then on builds on what was refused, and logs it once. It shows in `GET /pee (`refused`, with the change and why), in `/admin/stats` (`sync.refusedPeers`) and on the dashboard. A node that only passed a refused change on isn't: the committer is, whoever brought it. It lasts until a change of the member's is taken again (it rejoined and -writes anew), or the epoch changes; forgetting or banning it is the operators'. A change whose +writes anew), or the epoch changes; forgetting or banning it is the operators'. + +A node takes a change the others refuse only if it didn't judge it as they do: under a +policy it didn't know yet (it receives without judging then), or before the policy +came. Everything it writes from then on builds on that change, and is refused too. So +a node refusing changes a peer brought tells it which broke a rule (REFUSALS, at most +every 30 seconds). The peer doesn't take the word for it: it judges each it holds +itself, by its rules as they are now. If they refuse one too, it drops it with +everything built on it, its document becoming what it would be without them, and puts +its own writes among them in the quarantine (`GET /admin/quarantine`), to be replayed +or discarded; what it writes from then on goes everywhere. If its rules take the +change, the two policies disagree, which it logs. A change whose dependencies haven't come yet waits for them. What it doesn't do yet: -- cgit v1.3.1