Module content_deny 

The node’s live ORIGIN deny-set (ADR 011 §Local Denylist, §On Blacklist Event) — which operator addresses this node refuses to accept payment from.

Neither hash half of the denylist lives here — local and governance alike are held by CacheEngine beside the eviction set, because “will this node serve/announce/acquire this hash” has five consumers (serve, probe hold, DHT republish, populate, and the per-MB in-flight re-check) and ADR 011 requires one answer for all of them. See CacheEngine::refuses. Addresses have two — the open-time delivery gate and that same in-flight re-check — and the cache knows nothing about them, so they stay here.

Two sources feed it and they are deliberately kept in separate slots:

• Local, from [content] denied_origins. Operator-set, local-only, and applied on the next reload without a restart. ADR 011 §One-hour removal orders makes this the only mechanism sized to a sub-day statutory deadline, because it is the only one entirely within the order recipient’s control.
• On-chain, from ContentBlacklist’s OriginBlacklistUpdated AND OperatorBlacklisted — two separate on-chain mappings the node unions. Watching only the first would leave the primary governance path (addOperator, which also ejects from CapacityBond) unenforced at the delivery gate.

Separate slots because their lifecycles are independent — a config reload must not clobber what the chain watcher learned, and vice versa — but ContentDenylist::is_origin_denied unions them, and the wire refusal that results does not say which matched. That is a requirement, not an omission: ADR 011 §StreamRequest Response specifies the response must not distinguish governance from local sources. A client able to tell them apart could map an operator’s private legal exposure by probing.

Reads land on the request hot path, so each slot is an ArcSwap — the same shape CacheEngine uses for its pinned set. A lookup is one atomic load and a hash-set probe; a swap never blocks a reader.

Structs

ContentDenylist

The union of the operator’s local denylist and the on-chain origin blacklist, as consulted by the delivery path.