screen: a signature vouches for its change and what it builds on

Review finding 5: vouching by (actor, seq) isn't bound to a hash. A
member can make a change under another member's actor at a seq that
member's signature covers. The change is then taken as vouched, and if
it breaks a rule, the honest member is refused as a whole and logged as
the one whose own change broke the rules.

A signature now vouches for its change and the changes of its actor it
builds on: in the document, as before; among received changes, those
it reaches through the batch's dependencies. A received change under an
actor at a seq whose change the document holds (a signature verified up
to it) is a fork: refused as forged, never as its actor's node's, not
told back in REFUSALS, and logged with the peer that brought it.

1 files changed, 4 insertions, 2 deletions

diff --git a/docs/access.md b/docs/access.md
index 43cd326..f7546aa 100644
--- a/docs/access.md
+++ b/docs/access.md
@@ -244,8 +244,10 @@ can't cut its node off.
 With `"signatures": "required"`, a change also needs a signature by the node it names
 ([`api.md`](api.md), Signed changes): every node then signs every change it makes, and
 one no signature vouches for yet waits, with whatever builds on it, until one does
-(they come with the changes, or within a second on their own). A member can then no
-longer write as another member; the user a change names is still its node's word.
+(they come with the changes, or within a second on their own). A signature vouches for
+its change and the node's changes it builds on, no others: a change made under another
+node's actor is forged, refused, and logged as its sender's (`A peer brought changes
+forged`). A member can then no longer write as another member; the user a change names is still its node's word.
 
 In a swarm without a registry, whatever a user would need, any member may. A refused
 change stays out, and so does whatever builds on it; the node logs it (`Refused a