Demand revoke_and_ack before more updates

Fixes #526

02-peer-protocol.md

@@ -953,6 +953,9 @@ fee changes).
   to BIP69 lexicographic ordering of the commitment transaction.
   - if it has not recently received a message from the remote node:
       - SHOULD use `ping` and await the reply `pong` before sending `commitment_signed`.
+  - after sending a `commitment_signed` message:
+      - MUST NOT process any `update` message from the other party before receiving the
+        `revoke_and_ack` that corresponds to the `commitment_signed` sent.
 
 A receiving node:
   - once all pending updates are applied:
@@ -978,6 +981,9 @@ offline until after sending `commitment_signed`.  Once
 those HTLCs, and cannot fail the related incoming HTLCs until the
 output HTLCs are fully resolved.
 
+Allowing a node to make more updates before receiving `revoke_and_ack` leaves the old
+state unrevoked.
+
 ### Completing the Transition to the Updated State: `revoke_and_ack`
 
 Once the recipient of `commitment_signed` checks the signature and knows