From 64c3c47d9bbc8ca2e6352bdcf79a91b1d1669289 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 8 Nov 2026 21:55:00 +0000 Subject: screen: judged after the policy is gone, too Review 3, R4: whether a batch was judged followed the receiving document's policy now (and whether the batch writes one). After the policy was removed, or replaced by a version the node doesn't know, changes written under it and received late went in unjudged, while nodes that had them earlier judged them; REFUSALS gave up likewise. Screening now remembers that the document held a policy, known or not (Screening::policed), and judges what it receives while it does, each change by the policy at its dependencies; REFUSALS judges then too (not under a policy the node doesn't know, as before). Not across a restart, which access.md says. --- docs/access.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'docs') diff --git a/docs/access.md b/docs/access.md index fdcf23c..2ef94d3 100644 --- a/docs/access.md +++ b/docs/access.md @@ -320,7 +320,10 @@ change by the policy it was written under: a joining node judges its first sync, policy's own change and everything after it, as every other node does, and waits for the signatures of what was written under a policy requiring them. While neither its document nor what it receives holds a policy, it judges only that a root is the -epoch's, and nothing costs more than applying the changes. +epoch's, and nothing costs more than applying the changes. A policy removed, or +replaced by one the node doesn't know, still judges what was written under it and +comes late, as long as the node runs (after a restart, a document without a policy +is judged as one that never had one). An epoch's root is pinned. A remake's is its epoch's ID, the hash of its snapshot. The first epoch's is its genesis change, which its genesis node logs (`The swarm's root`) -- cgit v1.3.1