signatures: sign what is sent

A node signed its changes no rule signs a while after them (--sign-every
1s): the change left at once, unsigned, and its signature followed on
its own a second later, to every neighbour, over every link. A few
writes made a cascade of SIGNATURES. Under a policy requiring
signatures it signed every change as it was made instead.

A node now signs its latest change, if no signature vouches for it, as
a sync message takes it (--sign-every sent, the default): the
signature leaves in the same message, and goes where the change goes.
One signature per message, however many changes it carries, each
vouching for those before it: a slow writer's every change is signed,
a fast writer's batches are, at no threshold to pick. A policy
requiring signatures signs what is sent too, even with `none`. `all`
still signs every change as it is made; changes to protocol data,
listed paths and ?signed=true writes are signed as they are made, as
before. The interval, and the task signing on it, go.

1 files changed, 3 insertions, 4 deletions

diff --git a/src/simtest/signatures.rs b/src/simtest/signatures.rs
index 2425a16..c6232e7 100644
--- a/src/simtest/signatures.rs
+++ b/src/simtest/signatures.rs
@@ -44,11 +44,10 @@ async fn verified(node: &AppState, actor: &ActorId, seq: u64) -> bool {
     node.doc.read().await.signatures.verified(actor, seq)
 }
 
-/// A write no rule signs is signed a while after it (`--sign-every`, 1 s by default),
-/// and the signature reaches every node on its own (SIGNATURES): the change went before
-/// it was signed.
+/// A write no rule signs is signed as a sync message takes it (`--sign-every sent`, the
+/// default), and the signature reaches every node with it.
 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
-async fn unsigned_writes_are_verified_within_the_interval() {
+async fn writes_leave_signed() {
     let sim = Sim::with_identity(61);
     let a = sim.start("a", &[], Start::Genesis);
     let b = sim.start("b", &["a"], Start::Join);