screen: signatures required as the policy a change came under says

Review 3, R1: what a node received was vouched for only while its own
document's policy required signatures. A joiner's first sync, and
every node's message bringing `required`, went in by the rules alone:
a malicious first peer could plant changes under other members' actors
at their next seqs, their real ones then failing as duplicates for
good.

The signatures a message carries are always offered now, and the
screen always has them: a change waits for one where the policy at the
heads it is judged at requires it (rules::Reads::required, read once
per heads), whatever the receiving document holds. Changes written
under a policy not requiring signatures wait for none, as on every
other node; the check for forged changes runs always. Changes waiting
for a signature are judged again whenever signatures come.

The test of signatures required now takes the history into an empty
document; a new one takes changes written under a policy not requiring
them without any.

1 files changed, 2 insertions, 1 deletions

diff --git a/docs/access.md b/docs/access.md
index 9d38bd5..2f36ecd 100644
--- a/docs/access.md
+++ b/docs/access.md
@@ -317,7 +317,8 @@ dependencies haven't come yet waits for them.
 
 A node judges what it receives whether its document has a policy yet or not, each
 change by the policy it was written under: a joining node judges its first sync, the
-policy's own change and everything after it, as every other node does. While neither
+policy's own change and everything after it, as every other node does, and waits for
+the signatures of what was written under a policy requiring them. While neither
 its document nor what it receives holds a policy, it judges only that a root is the
 epoch's, and nothing costs more than applying the changes.