signatures: up to 4096 in a message, each actor's latest past them

Review 4, F5: a delta, and a message whose changes held more than 256 signatures (a
whole document pulled, of any real history), carried each actor's latest signature,
the 256 that became latest last. An actor is a node's run, so past 256 runs writing in
an epoch, some actors' changes arrived unvouched at the puller under a policy requiring
signatures, waited, and every resend carried the same 256: a joiner never finished.

A message now carries up to 4096 signatures (`MAX_PER_MESSAGE`, as many as wait for
their changes, `MAX_PENDING`: 384 KiB at most), all of its changes' up to there, each
actor's latest past it and for a delta, and a receiver takes as many (wire version
47). An epoch with more than 4096 runs writing would still leave some unvouched in
such a transfer, which the constant says; sending each actor of the transfer its own
latest would need the actors of a delta's changes, which only rebuilding their
metadata gives.

1 files changed, 5 insertions, 2 deletions

diff --git a/src/document/signatures.rs b/src/document/signatures.rs
index a8b4713..da2df03 100644
--- a/src/document/signatures.rs
+++ b/src/document/signatures.rs
@@ -147,8 +147,11 @@ impl<'de> serde::Deserialize<'de> for SignEvery {
     }
 }
 
-/// Signatures a sync message carries at most (`for_changes`, `latest_each`).
-pub(crate) const MAX_PER_MESSAGE: usize = 256;
+/// Signatures a sync message carries at most (`for_changes`, `latest_each`), as many
+/// as wait for their changes (`MAX_PENDING`): 384 KiB of them. A whole document pulled,
+/// or a delta, carries each actor's latest, and an actor is a node's run: an epoch with
+/// more runs writing than this leaves some unvouched for in such a transfer.
+pub(crate) const MAX_PER_MESSAGE: usize = MAX_PENDING;
 /// A signature as messages and the document file carry it (`pack`): the change's
 /// hash (32 bytes), then the signature (64).
 pub(crate) const PACKED: usize = 32 + 64;