Clarify the consensus rule preventing double-spends.

Signed-off-by: Daira Hopwood <daira@jacaranda.org>

protocol/protocol.tex

@@ -280,6 +280,7 @@ electronic commerce and payment, financial privacy, proof of work, zero knowledg
 \newcommand{\treestates}{\term{treestates}}
 \newcommand{\nullifier}{\term{nullifier}}
 \newcommand{\nullifiers}{\term{nullifiers}}
+\newcommand{\xNullifiers}{\term{Nullifiers}}
 \newcommand{\Nullifier}{\titleterm{Nullifier}}
 \newcommand{\Nullifiers}{\titleterm{Nullifiers}}
 \newcommand{\nullifierSet}{\term{nullifier set}}
@@ -1268,9 +1269,13 @@ Each \fullnode maintains a \nullifierSet logically associated with each \treesta
 As valid \transactions containing \joinSplitTransfers are processed, the \nullifiers
 revealed in \joinSplitDescriptions are inserted into this \nullifierSet.
 
-If a \joinSplitDescription reveals a \nullifier that already exists in the
-\blockchain at the associated \treestate, the containing \transaction will be
-rejected, since it would otherwise result in a double-spend.
+\xNullifiers are enforced to be unique within a valid \blockchain, in order to
+prevent double-spends.
+
+\consensusrule{
+A \nullifier{} \MUSTNOT repeat either within a \transaction, or across
+\transactions in a valid \blockchain.
+}
 
 
 \nsubsection{Block Subsidy and Founders' Reward} \label{subsidyconcepts}
@@ -4118,6 +4123,13 @@ The errors in the proof of Ledger Indistinguishability mentioned in
 \introlist
 \nsection{Change history}
 
+\subparagraph{2017.0-beta-2.5}
+
+\begin{itemize}
+    \item Clarify the consensus rule preventing double-spends.
+\end{itemize}
+
+\introlist
 \subparagraph{2017.0-beta-2.4}
 
 \begin{itemize}