document file: say which versions read a file, and the Opened record

The document file's format names itself in its first line
(continuum-document/2) and each record's kind in its first byte. A
record of a kind the reading version doesn't know makes the file
unusable: the node doesn't start on it unless told to move it aside
(--force badDocumentFile). lifecycle.md says so: a file one version
wrote is read only by versions knowing every kind of record in it. The
format's comment names the Opened record a node appends as it starts on
the file, which undoes the clean stop's mark.

2 files changed, 8 insertions, 5 deletions

diff --git a/docs/lifecycle.md b/docs/lifecycle.md
index 900349d..3843646 100644
--- a/docs/lifecycle.md
+++ b/docs/lifecycle.md
@@ -90,7 +90,9 @@ document file holding a document is an error with no override.
   own writes. It is appended to every `--document-append` (default 5s) and
   rewritten after an epoch change, a restart, or when the appended part outgrew the
   full save (at most every `--document-rewrite`, default 1h); a record cut short
-  by a crash is dropped when reading. A node starting from it is ready at once; sync
+  by a crash is dropped when reading. A file is read only by a version that knows
+  every kind of record in it: one a later version wrote is unusable to an earlier one,
+  which doesn't start on it unless told to move it aside (`--force badDocumentFile`). A node starting from it is ready at once; sync
   merges what it missed, or it rejoins a newer epoch. A node writes as a fresh actor
   each start, unless `--keep-actor` and it stopped cleanly (the file marks a clean
   stop, and the mark is undone as the node starts on it, before it decides its actor):
diff --git a/src/document/file.rs b/src/document/file.rs
index 1a33918..54ab9af 100644
--- a/src/document/file.rs
+++ b/src/document/file.rs
@@ -7,10 +7,11 @@
 //! many bytes, the first of them its kind (`Record`): first a full save of the document,
 //! then increments (the changes after the heads written before), and the signatures of
 //! its changes (`document::signatures`), those the file holds none of yet, as
-//! `signatures::pack` packs them; last, at a clean stop, an empty `Closed` record: the
-//! file holds everything the node wrote, so it may resume as `current`
-//! (`--keep-actor`). A record cut short by a crash is dropped when
-//! reading. A file of `continuum-document/1` has records of the document alone,
+//! `signatures::pack` packs them; at a clean stop, an empty `Closed` record: the file
+//! holds everything the node wrote, so it may resume as `current` (`--keep-actor`); and
+//! as a node starts on the file, before it writes anything, an empty `Opened` record,
+//! which undoes that mark. A record cut short by a crash is dropped when reading; one of
+//! a kind this version doesn't know (a later version's) makes the file unusable. A file of `continuum-document/1` has records of the document alone,
 //! without their kind: a full save, then increments.
 //!
 //! Written by a worker (`swarm::document_file`), only while the node is ready and not