It's not entirely true right now. We don't drop updates entirely, but relayer can mark any update as rejected. Its logic is not fully deterministic because we still have a circuit breaker. (We plan to remove it.)

let's describe the policy that is implemented here -- "no price dropping outside of circuit breakers"

I was trying not to mention circuit breakers at all as we are planning to remove it.

this is where deterministic behaviour is important, all the aggregators produce the exact same aggregate solely relying on the consistent stream of price updates.

here if you are not mentioning Douro running the service and think about the future that this part gets more decentralized, the publishers signature should be checked too (otherwise Douro can forge them). You can add that the aggregator validates the signatures of publisher update transactions.

p.s: we don't do it now, but will do in the future.

So should we mention that right now?