strict: no strict remake of a swarm strict already

Review 2, N2: nothing checked that a strict remake's base wasn't strict
already. In a strict swarm the registry, the policy and the bans change
only as a user who may change them signs; a strict remake committed by
a majority of members, each with keys of its own, could drop any of
them (unban, remove managers, empty userSigned and the sealed
declarations), and the honest minority would follow.

A node now takes a strict remake (proposing or voting) only in a swarm
not strict yet: turning strict is done once, by a remake; after it, by
signatures.

1 files changed, 3 insertions, 1 deletions

diff --git a/docs/access.md b/docs/access.md
index 03b70b8..d1f69e1 100644
--- a/docs/access.md
+++ b/docs/access.md
@@ -407,7 +407,9 @@ registry, the policy and the bans change only as a user who may change them sign
 
 ### Turning a swarm strict
 
-A running swarm turns strict through a remake of its own kind, `strict`: compaction
+A running swarm turns strict through a remake of its own kind, `strict`, once (a swarm
+strict already takes none: its registry, policy and bans change by their users'
+signatures, not by a majority of members): compaction
 that keeps, at the places values are signed (the registry, `_continuum/access`, the
 bans, the paths listed in `userSigned`), only the values an operator looked over and
 signed, and sets the strict policy. What was written after its base reaches the new