WithAutonomi · mickvandijke · May 19, 2026 · May 20, 2026 · May 20, 2026 · May 20, 2026
diff --git a/README.md b/README.md
@@ -34,7 +34,7 @@ Key design decisions are documented in [docs/adr/](docs/adr/):
 - **DHT (Distributed Hash Table)**: Peer phonebook and routing with geographic awareness
 - **QUIC Transport**: High-performance networking with saorsa-transport
 - **Post-Quantum Cryptography**: Future-ready cryptographic algorithms (ML-DSA-65, ML-KEM-768)
-- **Trust System**: Response-rate scoring with time decay and binary peer blocking
+- **Trust System**: Response-rate scoring with time decay, lazy swap-out, and close-group quarantine
 
 ## Quick Start
 
@@ -80,7 +80,7 @@ saorsa-core does **not** replicate application data. saorsa-node:
 
 1. **Network Layer**: QUIC-based P2P networking with automatic NAT traversal (saorsa-transport 0.26)
 2. **DHT**: Kademlia-based peer phonebook with geographic awareness
-3. **Trust System**: Response-rate scoring with time decay and binary peer blocking
+3. **Trust System**: Response-rate scoring with time decay, lazy swap-out, and close-group quarantine
 
 ### Cryptographic Architecture
 
@@ -159,11 +159,11 @@ Saorsa Core implements defense-in-depth security designed for adversarial decent
 
 | Protection | Implementation |
 |------------|----------------|
-| **Node Monitoring** | Automatic eviction after 3 consecutive failures |
+| **Node Monitoring** | Trust-score quarantine for bad close-group peers |
 | **Reputation System** | Response-rate scoring with time decay |
 | **Sybil Resistance** | IP diversity limits (/64: 1, /48: 3, /32: 10, ASN: 20) |
 | **Geographic Diversity** | Regional diversity in routing |
-| **Routing Validation** | Trust-based peer blocking and eviction |
+| **Routing Validation** | Trust-based swap-out and close-group quarantine |
 
 ### Anti-Centralization
 

diff --git a/docs/ROUTING_TABLE_DESIGN.md b/docs/ROUTING_TABLE_DESIGN.md
diff --git a/docs/SECURITY_MODEL.md b/docs/SECURITY_MODEL.md
@@ -80,32 +80,43 @@ pub struct NodeLivenessState {
 - Periodic health pings (configurable interval)
 - Validation responses
 
-### Eviction Criteria
+### Routing-Table Trust Criteria
 
-Nodes are automatically evicted when any threshold is exceeded:
+Trust affects routing-table membership in two stages:
 
-| Eviction Reason | Default Threshold | Configuration |
+| Reason | Default Threshold | Configuration |
 |-----------------|-------------------|---------------|
-| Consecutive Failures | 3 failures | `max_consecutive_failures` |
-| Low Trust Score | < 0.15 | `min_trust_threshold` |
-| Close Group Rejection | Consensus | BFT threshold |
+| Lazy swap eligibility | < 0.35 | `swap_threshold` |
+| Close-group quarantine / lookup avoidance | < 0.20 | `quarantine_threshold` |
+| New peer admission | >= 0.20 | `quarantine_threshold` |
+| Explicit quarantine readmission | >= 0.45 | `quarantine_readmit_threshold` |
 | Staleness | Configurable | `stale_timeout` |
 
-### Eviction Manager
+Peers outside the K-closest set are not globally evicted solely for low trust.
+They are omitted from local lookup results, FIND_NODE responses, and automatic
+lookup paths below the quarantine threshold, and can be lazily replaced when
+better candidates need the slot.
+Peers already in the routing table at or above the quarantine threshold but
+below the readmission threshold may remain in the table, including after moving
+into the K-closest set. New routing-table admissions require the quarantine
+threshold; only peers carrying an explicit quarantine marker require the higher
+readmission threshold.
 
-The `EvictionManager` coordinates all eviction decisions:
+### Quarantine Reasons
+
+Routing-table quarantine decisions are represented by events such as:
 
 ```rust
-pub enum EvictionReason {
-    ConsecutiveFailures(u32),    // Communication failures
-    LowTrust(String),            // EigenTrust score below threshold
-    FailedAttestation,           // Data challenge failure
-    CloseGroupRejection,         // Consensus-based removal
-    Stale,                       // No activity timeout
+pub enum QuarantineReason {
+    LowTrustCloseGroup,          // Close-group trust below threshold
+    Stale,                       // No activity timeout during revalidation
+    IdentityMismatch,            // Address authenticated as another peer
 }
 ```
 
-**Recovery Mechanism:** A single successful interaction resets the consecutive failure counter, allowing nodes to recover from transient issues.
+**Recovery Mechanism:** Quarantined peers recover by trust decay toward neutral.
+They are not manually probed; they must be rediscovered through the normal
+admission path after reaching the readmission threshold.
 
 ---
 

diff --git a/docs/adr/ADR-016-trust-quarantine-and-trust-neutral-requests.md b/docs/adr/ADR-016-trust-quarantine-and-trust-neutral-requests.md
diff --git a/docs/adr/README.md b/docs/adr/README.md
@@ -35,6 +35,7 @@ An Architecture Decision Record (ADR) is a document that captures an important a
 | [ADR-006](./ADR-006-eigentrust-reputation.md) | EigenTrust Reputation System | Accepted | Iterative trust computation for Sybil resistance |
 | [ADR-009](./ADR-009-sybil-protection.md) | Sybil Protection Mechanisms | Accepted | Multi-layered defense against identity attacks |
 | [ADR-010](./ADR-010-entangled-attestation.md) | Entangled Attestation System | Accepted | Software integrity verification via attestation chains |
+| [ADR-016](./ADR-016-trust-quarantine-and-trust-neutral-requests.md) | Trust Quarantine Thresholds and Trust-Neutral Request Transport | Proposed | Three-threshold DHT trust quarantine (0.35 swap / 0.20 avoidance / 0.45 admission) with trust-neutral generic request transport |
 
 ### Network Intelligence
 

diff --git a/docs/trust-signals-api.md b/docs/trust-signals-api.md
@@ -11,9 +11,9 @@ responsibility via `TrustEvent::ApplicationSuccess`.
 
 The trust system enables:
 - **Sybil resistance**: Malicious nodes are downscored automatically
-- **Binary blocking**: Peers below the block threshold are evicted and rejected
-- **Self-healing**: Time decay moves blocked peers back toward neutral over days
-- **Live eviction**: Peers below trust threshold are evicted from the routing table immediately
+- **Close-group quarantine**: K-closest peers below the quarantine threshold are evicted when the routing table can retain at least K peers
+- **Self-healing**: Time decay moves quarantined peers back toward neutral over days
+- **Lazy swap-out**: Low-trust peers outside the close group are replaced when better candidates arrive
 
 ## Quick Start
 
@@ -37,9 +37,10 @@ if trust < 0.3 {
 
 ### `report_trust_event(peer_id, event)`
 
-Report a trust event for a peer. Core penalties (connection failures) are
-recorded automatically by the DHT layer. Consumers use this API to report
-application-level outcomes (rewards and additional penalties).
+Report a trust event for a peer. DHT-specific penalties are recorded by the
+DHT layer where the failure phase and operation are known. Generic
+`P2PNode::send_request` transport errors are trust-neutral. Consumers use this
+API to report application-level outcomes (rewards and justified penalties).
 
 ```rust
 pub async fn report_trust_event(&self, peer_id: &PeerId, event: TrustEvent)
@@ -69,30 +70,48 @@ are not rewarded.
 
 | Event | Severity | Description | Where it fires |
 |-------|----------|-------------|----------------|
-| `ConnectionFailed` | 1x penalty (core) | Could not establish connection | `send_request()` error, `send_dht_request()` RPC failure |
-| `ConnectionTimeout` | 1x penalty (core) | Connection attempt timed out | `send_request()` timeout, `send_dht_request()` RPC timeout |
+| `ConnectionFailed` | 1x penalty | Could not establish connection | Explicit `report_trust_event` callers |
+| `ConnectionTimeout` | 1x penalty | Connection attempt timed out | Explicit `report_trust_event` callers |
 | `ApplicationSuccess(w)` | Weighted reward (consumer) | Peer completed an application-level task | Consumer code |
 | `ApplicationFailure(w)` | Weighted penalty (consumer) | Peer failed an application-level task | Consumer code |
 
 Note: Peer disconnects are normal connection lifecycle — they do not affect trust.
-
-## Peer Blocking
-
-Peers whose trust score falls below `block_threshold` are:
-- **Evicted** from the DHT routing table (via EvictionManager)
-- **Blocked** from sending DHT messages (silently dropped)
-- **Rejected** from re-entering the routing table on reconnect
+Generic `P2PNode::send_request` errors are also trust-neutral because that layer
+cannot distinguish remote misbehaviour from network failure, application delay,
+or local overload. Application-aware callers report trust events explicitly.
+
+## Trust Thresholds
+
+The routing table uses three trust thresholds:
+
+- `swap_threshold` (`0.35` by default): peers below this score are eligible
+  for replacement when a better candidate needs the slot.
+- `quarantine_threshold` (`0.20` by default): peers below this score are
+  skipped by lookup result selection and automatic lookup/dial paths. If such
+  a peer is currently in the K-closest-to-self set, it is evicted and
+  quarantined when the routing table can retain at least K peers.
+- `quarantine_readmit_threshold` (`0.45` by default): a quarantined peer can
+  only re-enter through normal discovery/admission after its decayed trust
+  reaches this score. New peers must also meet this threshold before entering
+  the routing table. Existing routing-table peers between `0.20` and `0.45`
+  may remain in the table, including after moving into the close group.
 
 ```rust
 use saorsa_core::AdaptiveDhtConfig;
 
 let config = AdaptiveDhtConfig {
-    block_threshold: 0.15,  // Block peers below 15% trust
+    swap_threshold: 0.35,
+    quarantine_threshold: 0.20,
+    quarantine_readmit_threshold: 0.45,
     ..Default::default()
 };
 ```
 
-DHT routing uses pure Kademlia XOR distance — trust does not influence peer selection order.
+Raw DHT routing uses Kademlia XOR distance. Local lookup results, FIND_NODE
+responses, and automatic network lookups avoid quarantined peers so known-bad
+contacts do not consume query slots or get handed out as lookup candidates.
+This filtering is local policy only; the DHT wire protocol and legacy
+`DHTNode` fields remain unchanged for backwards compatibility with older nodes.
 
 ## Architecture