From d74538f77cb68c1836f6245b0a36f7f9d683c237 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 8 Nov 2026 19:10:03 +0000 Subject: screen: what a node receives judged, policy or not Review 2, N7: a node screened received changes only while its own document had a policy it enforces. A joiner's empty document has none, so its first sync, as much history as the node it joins through chose, was applied unjudged, and under signatures required unvouched; the same for any node while the policy's own change arrived with later ones. Sync messages, deltas and downloaded changes are now always screened, each change judged by the policy at its dependencies (1135), so the verdicts are the swarm's. While neither the document nor the changes hold a policy (none touches a "policy" key: inspect::touch_key), only an epoch's root is judged and nothing is placed: bench_screening, after 1188, measured placing everything at about as much again as applying (564 ms + 543 ms for 100 000 changes), judging by the rules at about five times (+2.5 s), which a document with a policy pays anyway. access.md no longer lists the joiner's first sync, nor nodes agreeing only as the policy reaches them (judged at the dependencies, they agree), as left to do; changes::load_delta is for tests now. --- src/swarm/sync.rs | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) (limited to 'src/swarm') diff --git a/src/swarm/sync.rs b/src/swarm/sync.rs index ffdbf07..75c20f1 100644 --- a/src/swarm/sync.rs +++ b/src/swarm/sync.rs @@ -641,10 +641,11 @@ pub(crate) async fn handle_sync( replica .logged_signed(|doc, known, log| { let result = (|| { - // Judged first, as the policy has it (`access::screen`); with - // signatures required, by those it sent too. + // Judged first, each as the policy it was written under has it + // (`access::screen`), whether this document has one yet or not; + // with signatures required, by those it sent too. let policy = crate::access::policy::of(&*doc); - if policy.enforced() { + { let bytes = message.take_changes(); let required = policy.required(); if required { @@ -955,8 +956,9 @@ async fn download_and_apply_delta( } let heads_before = replica.heads().to_vec(); let policy = crate::access::policy::of(&replica.doc); - if policy.enforced() { - // Judged first (`access::screen`). + { + // Judged first (`access::screen`), whether this document has a policy yet or + // not. let epoch_seq = replica.epoch_seq; let replica = &mut *replica; crate::access::screen::apply_bytes( @@ -968,8 +970,6 @@ async fn download_and_apply_delta( policy.required().then_some(&mut replica.signatures), &mut crate::document::PatchLog::inactive(), )?; - } else { - crate::document::changes::load_delta(&mut replica.doc, &bytes)?; } replica.refresh_heads(); // Signatures waiting for what it brought (`Signatures::offer`). -- cgit v1.3.1