screen: write as a fresh actor when another node writes as this one

With --keep-actor, a node on a document file that ends with a clean stop
writes on as the actor the file names. Two nodes started on copies of
one file (a copied data directory, a restored disk image while the
original runs) both do, and both make that actor's next change number:
peers holding one refuse the other as forged, and everything built on
it.

screen::apply_bytes, the way every received change comes in, now looks
for a change of the actor the node writes as that the node doesn't hold:
only another node can have made it. The node then writes on as a fresh
actor at once, logs a warning, and its callers add the actor to the
node's own (RemakeState::add_own_actor), which the document file's
header follows. The change is judged as any other. lifecycle.md says not
to start a copy of a node's data directory with --keep-actor, and what
the switch leaves: what both wrote before stays refused where the
other's came first.

1 files changed, 7 insertions, 1 deletions

diff --git a/docs/lifecycle.md b/docs/lifecycle.md
index d703fe3..900349d 100644
--- a/docs/lifecycle.md
+++ b/docs/lifecycle.md
@@ -95,7 +95,13 @@ document file holding a document is an error with no override.
   each start, unless `--keep-actor` and it stopped cleanly (the file marks a clean
   stop, and the mark is undone as the node starts on it, before it decides its actor):
   then it writes on as the actor of before, as nothing it wrote is missing. Where the
-  mark can't be undone (the disk full, say), it writes as a fresh one. Fewer actors mean fewer signatures in every
+  mark can't be undone (the disk full, say), it writes as a fresh one. Two nodes
+  started on copies of one file would both write on as that actor, and each one's
+  changes would be refused as forged by peers holding the other's: don't start a copy
+  of a node's data directory while the node runs, or after it, with `--keep-actor`. A
+  node receiving a change of its own actor that it didn't make writes on as a fresh
+  actor at once, and logs a warning; what both wrote before stays refused where the
+  other's came first. Fewer actors mean fewer signatures in every
   transfer of the epoch's history (a writer each); a crash, a drop, or a switch or a
   rejoin still starts a fresh one.
 * **A backup** (`GET /admin/document`) is the whole document with its history, naming