From 23f0b629e5d80f880e5a0809f2e47b2d836ee2f9 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 8 Nov 2026 09:47:11 +0000 Subject: remake: replays judged before they go in A switching or rejoining node replays late writes as fresh changes naming each write's user, and nothing judged them before they left: a replay every node would refuse (a revoked capability, a second envelope at a signed path, readers changed) was refused everywhere, and with it everything the node wrote after it. Under a policy, replay_newest now judges each group it commits as every node will (rules::judge_held, in the new epoch); one they would refuse is taken back (forked at the heads before it, same actor) and its paths quarantined with the reason. replay_newest takes the epoch. Review finding 3 (remake replays). --- docs/remakes.md | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'docs/remakes.md') diff --git a/docs/remakes.md b/docs/remakes.md index 8e585c6..b70835e 100644 --- a/docs/remakes.md +++ b/docs/remakes.md @@ -311,6 +311,10 @@ The swarm stays writable throughout. replayed: newer ones touched their paths`), or with `--superseded-writes quarantine` kept in the quarantine. Clocks that disagree (beyond `--clock-skew-warn`) can make the older write win. +* **Under a policy** ([`access.md`](access.md)), a carried-over write is judged as every + node will judge it, in the new epoch: one they would refuse (its user may no longer + write there, say) goes to the quarantine instead, so it can't cut the carrying node + off. * **Granularity**: map entries are carried over per key. Lists and text are carried over whole, so concurrent edits of the same list on two nodes around a remake end as last-writer-wins. -- cgit v1.3.1