FIX: failure-code and additional are literal field names, be cons…

…istent.

Also, put HMAC fail before keyparse fail, since that's the first check.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

04-onion-routing.md

@@ -468,20 +468,20 @@ The association between forward and return packet is handled outside of the prot
 
 ### Failure Codes
 
-The following failure codes are supported.  A node MUST select one of
-these failure codes when creating an error message, and MUST include the
+The following `failure-code` values are supported.  A node MUST select one of
+these codes when creating an error message, and MUST include the
 appropriate `additional` data.
 
 In the case of more than one error, a node SHOULD select the first one
 listed.
 
-The top byte of the failure code can be read as a set of flags:
+The top byte of `failure-code` can be read as a set of flags:
 * 0x80000000 (BADONION): unparsable onion, encrypted by previous node.
 * 0x40000000 (PERM): permanent failure (otherwise transient)
 * 0x20000000 (NODE): node failure (otherwise channel)
 * 0x10000000 (UPDATE): new channel update enclosed
 
-Any node may return one of the following errors:
+Any node MAY return one of the following errors:
 
 If the realm byte is unknown:
 
@@ -511,15 +511,15 @@ If the onion version byte is unknown:
 2. data:
    * [32:sha256-of-onion]
 
-If the ephemeral key in the onion is unparsable:
+If the onion HMAC is incorrect:
 
-1. type: BADONION|PERM|5 (`invalid_onion_key`)
+1. type: BADONION|PERM|5 (`invalid_onion_hmac`)
 2. data:
    * [32:sha256-of-onion]
 
-If the onion HMAC is incorrect:
+If the ephemeral key in the onion is unparsable:
 
-1. type: BADONION|PERM|6 (`invalid_onion_hmac`)
+1. type: BADONION|PERM|6 (`invalid_onion_key`)
 2. data:
    * [32:sha256-of-onion]