The fleet-sync.mdx page reflected an earlier shape of the feature.
Refreshed to cover everything the receiver and sender now do:
- Both scan policies AND CVE suppressions replicate over the same
channel today (was previously framed as "future" for suppressions).
- Control anchor: replicas bind to the first control fingerprint and
reject pushes from a different control until an admin reanchors.
Documented the reanchor curl call.
- Push ordering: monotonic pushedAt rejects strictly-older pushes
with 409 STALE_SYNC_PUSH; legacy controls without timestamps still
accepted for back-compat.
- Automatic retry: the control retries failed pushes every 5 minutes
for 24h and emits one warning notification per hour-long failure
window for previously-working remotes.
- Demote to control: documented the admin-only button and what it
wipes. Replaced the "remove the node from the control" workaround
with the proper flow.
- Pilot-agent nodes: explicitly documented as out of fleet-sync scope.
- Tiebreaker: documented lowest-id wins for ties.
- Replica policy filtering: identity-scoped policies for other
replicas no longer surface in this replica's UI.
- Troubleshooting expanded with 409 codes (STALE_SYNC_PUSH,
CONTROL_IDENTITY_MISMATCH).
Cross-link added from vulnerability-scanning.mdx (Scan policies
section) so anyone reading about policies finds the replication
docs.
Scan policies now propagate from the control Sencho instance to every
registered remote. The control is the source of truth; replicas render
rules read-only with a managed-by-control banner. Pushes fire on every
policy write, record per-node success and failure on a new
fleet_sync_status table, and use node_proxy Bearer tokens exclusively
so only sibling Senchos can apply incoming sync payloads. Policy scope
now travels as a string identity (api_url or a local sentinel) so
node-scoped rules evaluate correctly on each target.
Anso