screen: a signature vouches for its change and what it builds on

Review finding 5: vouching by (actor, seq) isn't bound to a hash. A
member can make a change under another member's actor at a seq that
member's signature covers. The change is then taken as vouched, and if
it breaks a rule, the honest member is refused as a whole and logged as
the one whose own change broke the rules.

A signature now vouches for its change and the changes of its actor it
builds on: in the document, as before; among received changes, those
it reaches through the batch's dependencies. A received change under an
actor at a seq whose change the document holds (a signature verified up
to it) is a fork: refused as forged, never as its actor's node's, not
told back in REFUSALS, and logged with the peer that brought it.

2 files changed, 8 insertions, 4 deletions

diff --git a/docs/access.md b/docs/access.md
index 43cd326..f7546aa 100644
--- a/docs/access.md
+++ b/docs/access.md
@@ -244,8 +244,10 @@ can't cut its node off.
 With `"signatures": "required"`, a change also needs a signature by the node it names
 ([`api.md`](api.md), Signed changes): every node then signs every change it makes, and
 one no signature vouches for yet waits, with whatever builds on it, until one does
-(they come with the changes, or within a second on their own). A member can then no
-longer write as another member; the user a change names is still its node's word.
+(they come with the changes, or within a second on their own). A signature vouches for
+its change and the node's changes it builds on, no others: a change made under another
+node's actor is forged, refused, and logged as its sender's (`A peer brought changes
+forged`). A member can then no longer write as another member; the user a change names is still its node's word.
 
 In a swarm without a registry, whatever a user would need, any member may. A refused
 change stays out, and so does whatever builds on it; the node logs it (`Refused a
diff --git a/docs/api.md b/docs/api.md
index 7d7a563..019f9cf 100644
--- a/docs/api.md
+++ b/docs/api.md
@@ -248,8 +248,10 @@ who wrote what, until a remake drops the history ([`remakes.md`](remakes.md)).
 Every node signs changes it commits with its node key: an Ed25519 signature over the
 change's hash, kept beside the document. One signature vouches for more than its
 change: a node's change builds on its previous one, and a change's hash covers what it
-builds on, so a signed change vouches for all the node's changes before it. So not
-every change is signed, only those that
+builds on, so a signed change vouches for all the node's changes before it, those it
+builds on. No others: anyone can make a change under a node's actor, and one in the
+place of a change of the node's the document holds is forged, refused as its sender's,
+not the node's. So not every change is signed, only those that
 
 * touch protocol data (`_continuum`),
 * touch a path listed in `_continuum/access/signed` (within it, or above it), a list