Add Federation page

Federation.md

@@ -0,0 +1,24 @@
+# Federation
+
+Several Echo nodes on different servers share one account and channel database with no central store. They do it by replicating the event log.
+
+## Gossip
+
+Each log entry carries an origin, a per-origin sequence number, and a Lamport clock. Peers connect, exchange version vectors, and send each other the entries the other is missing. A freshly committed entry is also pushed immediately, so a registration propagates in milliseconds. Ingest is idempotent, so re-delivery and reconnection after a network split both converge. The peer link can run over mutually-authenticated TLS.
+
+## Global and local scope
+
+Not everything replicates. Every event has a scope, and the match on it is exhaustive, so a new event has to pick a side.
+
+- **Global**: account identity. Registration, certificates, password, grouped nicks, and the network-wide operator lists. Gossiped to every node.
+- **Local**: channel state. It stays on the node that owns the channel and never leaves.
+
+The reason is authority. Account identity is meant to be one thing across the whole network. Channel authority is live and local: a node must not be handed ownership of a channel registered on a network it was never part of. A node refuses to ingest any non-global entry a peer sends it, which is the guarantee behind that rule.
+
+## Conflict resolution
+
+If two nodes register the same account name before gossip converges, the log still folds to the same owner on every node. Each account records the node that first registered it; the earliest registration wins, with ties broken deterministically. The merge is commutative and idempotent, so delivery order does not matter. When a peer's registration wins a name a local session was using, that node logs the session out and tells the user, and releases any channels the losing account founded, since they cannot transfer to the name's new owner.
+
+## Compaction
+
+The log is compacted to one entry per account as it grows, so it does not grow without bound. Local channel state is kept for the owning node's own replay and excluded from what peers pull.