State what the client trusts a storage provider for

docs/protocol/moderation.md

@@ -60,6 +60,8 @@ The owner of a contract-backed channel can appoint moderators. They manage the a
 
 Only the owner can write to the admin stream, so a moderator's actions travel as **signed deltas** on the message stream, and clients render the owner's snapshot with the unabsorbed deltas applied on top. Moderation keeps working while the owner is away, and the owner has the last word on return: **Confirm Moderator Actions** absorbs the deltas into the owner's snapshot, and dismissing a moderator dissolves whatever they left pending. What was already absorbed stays.
 
+Publishing a snapshot only broadcasts it, and a session that has just opened may have no peer to hand it to yet. The owner's client therefore reads the snapshot back from storage after publishing and republishes it when it did not land, a few times before saying so; a change made on another of the owner's devices in the meantime wins and is adopted instead.
+
 ## Discovery and curation
 
 Explore lists the channels that opted in. **Listed** is a choice at creation, channels are unlisted by default, and closed channels are never listed.

docs/protocol/storage-and-sync.md

@@ -42,7 +42,7 @@ What providers hold is what the network carried: ciphertext for protected channe
 
 Signing a read keeps everyone else out of a private channel's history. It also gives the provider a verified record of which private channels you open and when, instead of an inference from your IP. Choosing a provider is choosing who holds that record.
 
-**A receipt timestamp.** The node stamps each message with the time it received it. That stamp is the node's, not the publisher's, which is what lets a client tell a message that genuinely arrived last year from one that merely claims to.
+**A receipt timestamp.** The node stamps each message with the time it received it. That stamp is the node's, not the publisher's, which is what lets a client tell a message that genuinely arrived last year from one that merely claims to. The client takes the stamp on trust: a provider that misstates it can make a genuine message look forward-dated and have the client drop it. What else a provider is trusted for is in the [Threat model](../security/threat-model.md).
 
 **Erasure.** The channel owner, a moderator, or a message's own author while they still hold its signing key can delete specific messages from the node before retention ends. Who can erase what is in [Moderation](moderation.md).
 

docs/security/threat-model.md

@@ -30,7 +30,7 @@ Pombo has no backend, and every piece of infrastructure it touches can be swappe
 | **The push relay**, one in production today | Tag buckets and timing. If it is down, push stops and messaging is unaffected |
 | **Public RPCs and ENS infrastructure** | Polygon RPCs serve chain queries, Ethereum RPCs resolve ENS with decoys, a public gateway serves ENS avatars. All see the requests and your IP. You can configure your own |
 | **The Graph** | Channel-type and membership queries. A shared default API key ships with the app; you can supply your own |
-| **The storage provider you read from** | Holds ciphertext, or plaintext for open channels. Private reads are signed, so it does not infer who is reading: it knows which addresses open which channels and when. This applies to the Pombo project's cluster like any other provider |
+| **The storage provider you read from** | Holds ciphertext, or plaintext for open channels. Private reads are signed, so it does not infer who is reading: it knows which addresses open which channels and when. It is also trusted for completeness and for the receipt time. The client checks every message's signature and its publisher's permission, so a provider cannot forge or alter what it serves, but it can withhold messages, serve an older moderation state to a device that never saw the newer one, or misstate when a message arrived, and the client detects none of that. Nothing today compares one provider's answer with another's. This applies to the Pombo project's cluster like any other provider |
 | **The gate contracts** | Decide who participates in every contract-backed channel and route subscription payments, which go straight to the owner. Open source, not upgradeable, **not audited**. A flaw there is a flaw in access control and payment, not in the confidentiality of other channel types |
 | **app.pombo.cc itself** | A hosted interface. Its operator controls what *this interface* shows, such as Explore curation, but not the protocol |