document file: a clean stop marked, and `--keep-actor` writes on as the same actor

A node writes as a fresh Automerge actor at each start, so no change number of an actor
comes twice: one sent before a crash but not yet appended to the document file would
otherwise be made again, differently. An epoch thus gathers a writer per start, and
every transfer of its history carries a signature per writer.

The document file now says when it holds everything the node wrote:

* at a clean stop, after the last append, an empty `Closed` record, only where the
  file is up to the document's heads (ready, not rejoining);
* as a node starts on the file, before anything is written, an empty `Opened` record,
  so a crash from then on leaves a file without the mark;
* the header names the actor the node writes with (`current`).

With `--keep-actor` (off by default; needs `--document-file`), a node starting on a
file that ends with `Closed` writes on as that actor. A crash, a drop, a switch or a
rejoin still starts a fresh one, so an epoch's writers come to one per node plus one
per such event. lifecycle.md says so.

1 files changed, 6 insertions, 1 deletions

diff --git a/docs/lifecycle.md b/docs/lifecycle.md
index 829e425..e09ef01 100644
--- a/docs/lifecycle.md
+++ b/docs/lifecycle.md
@@ -91,7 +91,12 @@ document file holding a document is an error with no override.
   rewritten after an epoch change, a restart, or when the appended part outgrew the
   full save (at most every `--document-rewrite`, default 1h); a record cut short
   by a crash is dropped when reading. A node starting from it is ready at once; sync
-  merges what it missed, or it rejoins a newer epoch.
+  merges what it missed, or it rejoins a newer epoch. A node writes as a fresh actor
+  each start, unless `--keep-actor` and it stopped cleanly (the file marks a clean
+  stop, and the mark is undone as the node starts on it): then it writes on as the actor
+  of before, as nothing it wrote is missing. Fewer actors mean fewer signatures in every
+  transfer of the epoch's history (a writer each); a crash, a drop, or a switch or a
+  rejoin still starts a fresh one.
 * **A backup** (`GET /admin/document`) is the whole document with its history, naming
   its swarm and epoch. `--recover-from` starts a node on it; `--genesis --remake
   import:FILE` starts a *new* swarm with its content; an `import` remake brings its