clarify the single-ciphertext principle and that delivery buffers should be capped
tweak some wording: invariant definitions and resend logic of explicit-acks' children