From 4ecb4ee5c0a49fc6d78ae06e21f6bb1571e290cb Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sun, 8 Nov 2026 09:41:05 +0000
Subject: remake: replay from the quarantine where the user may write

POST /admin/quarantine/{id}/replay needs write on _continuum, which
never covers user data, and replayed every path of the entry as the
user who asked: every node refused the user data in it. It now
replays only the paths the user may write and keeps the rest in the
entry (left), for one who may; 403 if the user may write none.

Review finding 3 (quarantine replays).
---
 docs/openapi.yaml | 16 +++++++++++++---
 docs/remakes.md   |  4 +++-
 2 files changed, 16 insertions(+), 4 deletions(-)

(limited to 'docs')

diff --git a/docs/openapi.yaml b/docs/openapi.yaml
index d3715b1..960ab14 100644
--- a/docs/openapi.yaml
+++ b/docs/openapi.yaml
@@ -1705,8 +1705,9 @@ paths:
       summary: Replay quarantined writes
       description: |
         Writes them into the current epoch at their old paths, as fresh writes (they
-        win over what is there), and removes the entry. If none can be written, the
-        entry stays.
+        win over what is there), and removes the entry. Only paths the user may write
+        (every node judges the change by them): the rest stay in the entry (`left`), for
+        one who may. If none can be written, the entry stays.
       responses:
         '200':
           description: Replayed.
@@ -1714,14 +1715,23 @@ paths:
             application/json:
               schema:
                 type: object
-                required: [replayed, failed]
+                required: [replayed, failed, left]
                 properties:
                   replayed:
                     type: integer
                   failed:
                     type: integer
+                  left:
+                    type: integer
+                    description: Paths the user may not write, left in the entry.
         '401':
           $ref: '#/components/responses/Unauthorized'
+        '403':
+          description: The user may write none of its paths.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
         '404':
           $ref: '#/components/responses/Error'
         '409':
diff --git a/docs/remakes.md b/docs/remakes.md
index cad429f..8e585c6 100644
--- a/docs/remakes.md
+++ b/docs/remakes.md
@@ -339,7 +339,9 @@ curl -X DELETE localhost:3000/admin/quarantine/<id>       # discard
 ```
 
 Replaying writes the values at their old paths as fresh writes (they win over what is
-there now), in the name of the user who asked. Quarantine doesn't survive a restart of that node, so look at it soon; the
+there now), in the name of the user who asked: only at the paths it may write, as every
+node judges the change by them ([`access.md`](access.md)); the rest stay (`left`), for
+one who may. Quarantine doesn't survive a restart of that node, so look at it soon; the
 remake report's `local.quarantine` on that node names the entry.
 
 ## Troubleshooting
-- 
cgit v1.3.1