Begin an epoch only from the answer to this offer, not an earlier one

A sender that took its epoch for lost offers epoch 1 again with a new
key. The receiver accepts it in the turn, after the answers; until then
its answers still carried the ACCEPT of the earlier offer, which named
the same epoch. The sender began its epoch from that one, the two sides
held different secrets, and 2 s later it took the epoch for lost again:
a turn of that each time the order fell so. Now an ACCEPT carries the
first four bytes of the key it answers, and a sender begins its epoch
only from one that answers its own.

test-link cuts the path for 3 s the moment the sender begins an epoch,
three times; a sender's counts say how many epochs it took for lost,
and it must be three. Before, it was four.

1 files changed, 8 insertions, 5 deletions

diff --git a/link/link-protocol.h b/link/link-protocol.h
index f54514b..a8dd826 100644
--- a/link/link-protocol.h
+++ b/link/link-protocol.h
@@ -95,7 +95,9 @@
  *                epoch's secret, until it is accepted
  *   0x0a ACCEPT  u32 epoch, a public key: the receiver's half, until a
  *                packet of that epoch opens (the same offer again gets the
- *                same; one a second for a run)
+ *                same; one a second for a sender), then the first four
+ *                bytes of the key offered it answers (a sender that took
+ *                its epoch for lost offers epoch 1 again with another)
  *   0x00 PADDING to the end of the packet: a full packet sent in a burst is
  *                a whole datagram
  * Losses are detected as RFC 9002 says, with RACK's patience for packets
@@ -114,12 +116,13 @@ enum { PURE_LINK_DATAGRAM = 1200, PURE_LINK_DATAGRAM_MOST = 1452, PURE_LINK_NAME
  * packets lost and acknowledged, packets received, deliveries handed over,
  * the last number stored; packets called lost that came late, and
  * congestion events undone for it; runs keyed (keys made from a secret),
- * secrets made (X25519 of the nodes' keys), epochs begun; a receiver's senders woken (their active
- * state made), of them with a secret remembered (no X25519), let go when
- * idle, and active now. */
+ * secrets made (X25519), epochs begun, and a sender's epochs taken for lost
+ * (begun again from the nodes' keys); a receiver's senders woken (their
+ * active state made), of them with a secret remembered (no X25519), let go
+ * when idle, and active now. */
 typedef struct {
     uint64_t packets, records, resent, lost, acknowledged, received, deliveries, stored, late, undone, keyed, secrets,
-        epochs, woken, remembered, swept, active;
+        epochs, fallbacks, woken, remembered, swept, active;
 } PureLinkCounts;
 
 /* ---- The sending side: one output's saved sends to a receiver's input, as