From c9c7807bf0f068474ce5c853244bcb392bdfcce3 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sun, 8 Nov 2026 19:16:10 +0000
Subject: roots: an epoch's root pinned, and named in every handshake

Review 2, N7, the care it raised: a joining node's empty document took
as the first epoch's root whatever dependency-less change came first,
from whichever peer it joined through; the first epoch's ID is all
zeros, so nothing pinned it. A remake's epoch has its ID, the snapshot
change's hash, which the rules hold its root to.

* Every node names its epoch's root in HELLO and HELLO_REPLY (the
  epoch's ID for a remake's, its genesis change for the first; wire
  version 45). A node whose document starts from another root of the
  same epoch refuses the handshake, logging it: another history under
  the swarm's ID, a forged root or a genesis started again.
* A joining node with an empty document takes as its root only the one
  it was given (--genesis-root, new), else the one its peers name, and
  none while they name different ones (access::screen::RootPin, kept
  in Screening across documents): one peer hands it another root only
  if it is all the joiner hears, or never, with --genesis-root. A root
  refused is listed with the refused, what builds on it with it.
* The genesis node logs the root (`The swarm's root`); GET
  /admin/epochs shows it (`root`).

A genesis started again under a remembered swarm ID used to merge with
the nodes of it still running; they now refuse it (another root), and
the docs say to join them with seeds instead.

The epoch's identity stays as it is (generation 0 all zeros): records
and epoch metadata name it so, and every comparison of epochs with
them.
---
 src/transport/mod.rs | 9 +++++++++
 1 file changed, 9 insertions(+)

(limited to 'src/transport/mod.rs')

diff --git a/src/transport/mod.rs b/src/transport/mod.rs
index e0359b0..640754a 100644
--- a/src/transport/mod.rs
+++ b/src/transport/mod.rs
@@ -576,6 +576,10 @@ pub(crate) struct HelloRequest {
     /// with all peers, from 1. A retry carries the same number, so the recipient resets
     /// its sync session only for a new handshake, not for every resend or late copy.
     pub(crate) handshake: u32,
+    /// The hash of its epoch's root, where its document holds it (`swarm::roots`): what
+    /// a joining node takes as the root, where those it hears agree.
+    #[serde(with = "serde_bytes")]
+    pub(crate) root: Option<Vec<u8>>,
 }
 
 /// A peer a HELLO_REPLY lists: who it is, and where the sender reaches it.
@@ -661,6 +665,9 @@ pub(crate) struct HelloReply {
     /// The sender's own run (as its HELLOs carry it): a new one means it restarted.
     #[serde(with = "crate::transport::wire::codec::run_id")]
     pub(crate) sender_run_id: RunId,
+    /// As `HelloRequest::root`.
+    #[serde(with = "serde_bytes")]
+    pub(crate) root: Option<Vec<u8>>,
 }
 
 /// Bytes shown as lowercase hex, e.g. run IDs in logs.
@@ -694,6 +701,7 @@ impl std::fmt::Debug for HelloRequest {
             .field("ready", &self.ready)
             .field("run_id", &Hex(&self.run_id))
             .field("handshake", &self.handshake)
+            .field("root", &self.root.as_deref().map(Hex))
             .finish()
     }
 }
@@ -710,6 +718,7 @@ impl std::fmt::Debug for HelloReply {
             .field("run_id", &Hex(&self.run_id))
             .field("away_ms", &self.away_ms)
             .field("sender_run_id", &Hex(&self.sender_run_id))
+            .field("root", &self.root.as_deref().map(Hex))
             .finish()
     }
 }
-- 
cgit v1.3.1