document file: undo the clean stop's mark before deciding the actor

At start, a node on a document file appends an Opened record before it
writes anything, so that a Closed record before it no longer says the
file holds every change of the actor it names. It does so now before
deciding which actor to write as, and DocumentFile::open says whether it
could: where the append fails (the disk full, permissions), the file
still ends with Closed, and later appends likely fail too. A crash, or a
clean stop whose last append failed (close then sees the file behind and
writes no mark), would leave that Closed standing for a run the file
never got. So with --keep-actor, the node writes on as the actor of
before only where the file was marked as opened; else it writes as a
fresh actor and warns.

1 files changed, 3 insertions, 2 deletions

diff --git a/docs/lifecycle.md b/docs/lifecycle.md
index e09ef01..d703fe3 100644
--- a/docs/lifecycle.md
+++ b/docs/lifecycle.md
@@ -93,8 +93,9 @@ document file holding a document is an error with no override.
   by a crash is dropped when reading. A node starting from it is ready at once; sync
   merges what it missed, or it rejoins a newer epoch. A node writes as a fresh actor
   each start, unless `--keep-actor` and it stopped cleanly (the file marks a clean
-  stop, and the mark is undone as the node starts on it): then it writes on as the actor
-  of before, as nothing it wrote is missing. Fewer actors mean fewer signatures in every
+  stop, and the mark is undone as the node starts on it, before it decides its actor):
+  then it writes on as the actor of before, as nothing it wrote is missing. Where the
+  mark can't be undone (the disk full, say), it writes as a fresh one. Fewer actors mean fewer signatures in every
   transfer of the epoch's history (a writer each); a crash, a drop, or a switch or a
   rejoin still starts a fresh one.
 * **A backup** (`GET /admin/document`) is the whole document with its history, naming