#4132 Docs: v3 serve team mode, followers forward writes and the advertise-address and ca-cert serve flags (swamp-club#4120)

What changed

swamp-club#4120 (datastore rework Phase 5) changes v3 serve team mode: a follower node no longer refuses writes with serve_not_leader. It forwards each write to the leader with the caller's own credentials, and follows the leader's commit feed so its copy stays about 1 s fresh. Details: design/enablers/datastores.md, section "Team mode: forwarding and the commit feed", in swamp-club/swamp.

Pages to update

• how-to/swamp-serve/run-multi-instance-deployment.md
  • On v3, every node behind the load balancer takes writes; a follower forwards them to the leader.
  • Start each node with --advertise-address <its own https origin> (for example https://node-1.internal:9090), and with --ca-cert when nodes use a private CA.
  • Run every node with --trust-proxy behind a load balancer, or the leader rate-limits all callers behind a follower as that follower's single IP.
  • Keep the token-secrets key outside the datastore (token-secrets block in serve.yaml): with the co-located key, anyone who can read and write the datastore can sign a leader record and redirect forwarded credentials. Serve warns at start-up in that case.
  • Webhook endpoint config (routes, secrets) must match on every node: the leader verifies a delivery a follower forwards.
  • A request lost while the leader changes gets serve_not_leader with inFlight: true: it may already have run, so check before retrying.
• reference/swamp-serve/serve-flags.md: --advertise-address <url> (env SWAMP_SERVE_ADVERTISE_ADDRESS, serve.yaml advertise-address: an http(s) origin, no path, query, credentials or wildcard host); --ca-cert <path> (env SWAMP_CA_CERT, serve.yaml tls.ca-cert).
• reference/swamp-serve/webhooks.md: in team mode a follower forwards deliveries unverified to the leader, which verifies them; endpoint config must match across nodes.
• reference/tls-and-proxies.md: node-to-node TLS uses --ca-cert; X-Forwarded-For passes on from a follower only when it runs with --trust-proxy.
• reference/swamp-serve/rest-api.md (or the WebSocket protocol reference): commits.subscribe (from a cursor, filtered per caller as GET changes; ends with commits_compacted or commits_lagged) and commits.head.