sync: a delta's signatures as a blob of their own

A sync message larger than the threshold for its peer (16 chunks, lower
on a slow link or after a message to it failed whole) goes as a delta:
the peer fetches its changes in chunks, from any node holding them. Its
signatures, each writer's latest with changes in it, went in the
envelope offering it: up to 65536 of them, 6 MiB, in one message, the
size the delta exists to avoid. Nor did an Automerge message count its
signatures (one per writer in a whole document pulled) towards the
threshold.

A delta's signatures are now a blob of their own: the offerer packs and
keeps them (Blobs::keep, the latest 64), and the spec names them by
BLAKE3 hash and size (DeltaSpec::signatures, None where no signature
vouches for its changes). They are served as content (BlobId::Content),
so their hash checks them. The receiver fetches them from the offerer
alone, as another node holding the changes holds signatures of its own,
before the changes, and offers them under the write lock just before
judging the changes, so they wait for them as before. The envelope of a
delta carries none. An Automerge message's signatures count towards its
size: past the threshold, it goes as a delta.

Wire version 49.

1 files changed, 4 insertions, 1 deletions

diff --git a/docs/api.md b/docs/api.md
index a4b76b0..2665306 100644
--- a/docs/api.md
+++ b/docs/api.md
@@ -292,7 +292,10 @@ vouched for as the first time; and a node checks one it receives once it holds t
 change (a signature costs about 30 µs to check, and one vouches for its node's changes
 before it). A message carrying no changes carries no signatures; one carrying more
 than 256 signed changes (a whole document pulled) carries each writer's latest among
-them instead, and a delta each writer's latest with changes in it. A writer is a node's
+them instead. Its signatures count towards a message's size, past which its changes are
+offered as a delta (fetched in chunks, from any node holding them); a delta's
+signatures, each writer's latest with changes in it, are a blob of their own, fetched
+from the node that offered it before the changes. A writer is a node's
 run: each start, rejoin or drop makes a fresh one. A node signs the latest change of
 each of its runs that nothing vouches for as it starts, before anything leaves, and
 whenever its document is swapped (a drop, a switch, a rejoin): changes it kept