docs: a strict swarm's registry against a minority of members, not a majority

Review 4, R3 partly: nodes refuse a strict remake of a strict swarm by its kind, a label
the proposal and the snapshot's metadata carry. A majority of members labelling one
`compact`, its snapshot holding the registry it wants, gets it followed: nodes whose own
build differs take the quorum's snapshot. access.md says outright that a strict swarm's
registry, policy and bans change by its users' signatures against a minority of members;
comparing a downloaded snapshot with the node's own build at the signed places, and
refusing the switch where they differ, goes to future-work.md.

1 files changed, 7 insertions, 1 deletions

diff --git a/docs/access.md b/docs/access.md
index 94ca195..7bacd91 100644
--- a/docs/access.md
+++ b/docs/access.md
@@ -463,7 +463,13 @@ holds, plain values too.
 A running swarm turns strict through a remake of its own kind, `strict`, once (a swarm
 strict already takes none: its registry, policy and bans change by their users'
 signatures, not by a majority of members; its nodes neither vote for one nor follow one
-a majority commits anyway, switching or rejoining): compaction
+a majority commits anyway, switching or rejoining). Nodes tell such a remake by its
+kind, which its proposal and its snapshot's metadata say: a majority of members
+labelling it otherwise (`compact`, its snapshot holding the registry it wants) gets it
+followed, as nodes whose own build differs take the quorum's snapshot. So a strict
+swarm's registry, policy and bans change by its users' signatures against a minority of
+members, not against a majority ([`trust.md`](trust.md); comparing a downloaded snapshot
+with the node's own build is in [`future-work.md`](future-work.md)). Compaction
 that keeps, at the places values are signed (the registry, `_continuum/access`, the
 bans, the paths listed in `userSigned`), only the values an operator looked over and
 signed, and sets the strict policy. What was written after its base reaches the new