signatures: the latest unsigned change of each own actor signed, at start and after a swap

Review 4, F2 (the honest case) and claim 2: a node signed at start its own changes at
the heads that nothing vouched for (1216), and after a swap only its current actor's
latest. An own change left unsigned can sit below the heads: a drop (`drop_taken`)
takes away a signed change and keeps an earlier unsigned one, and the node writes on
under a fresh actor, building on it; or a node's change is built on by another's
concurrently with the signed one the drop took. Nothing signed it again, and under a
policy requiring signatures every node pulling it (a joiner) waited for good, and for
everything built on it.

Now the latest change of each of the node's actors (`RemakeState::own_actors`, the
current one among them) that no signature vouches for is signed
(`Signatures::sign_own_actors`), at start and whenever the document is swapped (a drop,
a switch, a rejoin), the old `sign_own_heads` and `sign_own_latest` going. One
signature per actor vouches for all its changes before it. The case of a member whose
signed change the rules refuse, vouching once for its earlier ones, is
postponed (future-work.md, next).

1 files changed, 4 insertions, 1 deletions

diff --git a/src/node.rs b/src/node.rs
index 6f08e69..0744206 100644
--- a/src/node.rs
+++ b/src/node.rs
@@ -129,7 +129,10 @@ impl Node {
         // What this node kept unsigned when it stopped: signed before anything leaves.
         if let Some(key) = &config.node_key {
             let replica = &mut replica;
-            let signed = replica.signatures.sign_own_heads(&replica.doc, key);
+            let signed =
+                replica
+                    .signatures
+                    .sign_own_actors(&mut replica.doc, key, &config.earlier_actors);
             if signed > 0 {
                 tracing::info!(
                     signed,