Goal
Three correctness fixes at the foundation that everything later builds on. First, the sync peer
selector hashes the local node id, so every node computes a different holder set for the same
document. Second, placement candidates are not filtered by node kind, which would let laptops
become document holders once user nodes exist. Third, conflict resolution is last writer wins
on wall clock time and nothing guards against clock skew, so a single node with a fast clock
would win every conflict forever. See the federation plan and
the hardening plan item PH-1.
Workplan
- Remove the local node id from the selector score so all nodes compute the same selection
- Filter user kind nodes out of the sync candidate set. The kind is known locally from the
realm config
- Add an apply time skew guard. Inbound events with a timestamp too far in the future get
rejected, counted and logged. The threshold is configurable with a default of 300 seconds.
Document that operators must run NTP
Definition of Done
Test Concept
- Unit tests for selector determinism across simulated node identities
- Boundary tests for the skew guard
Risks / Blockers
- Removing the bias changes existing placements on dev realms. That is fine, dev state gets
recreated
Goal
Three correctness fixes at the foundation that everything later builds on. First, the sync peer
selector hashes the local node id, so every node computes a different holder set for the same
document. Second, placement candidates are not filtered by node kind, which would let laptops
become document holders once user nodes exist. Third, conflict resolution is last writer wins
on wall clock time and nothing guards against clock skew, so a single node with a fast clock
would win every conflict forever. See the federation plan and
the hardening plan item PH-1.
Workplan
realm config
rejected, counted and logged. The threshold is configurable with a default of 300 seconds.
Document that operators must run NTP
Definition of Done
Test Concept
Risks / Blockers
recreated