document: reject writes during rejoin

1 files changed, 7 insertions, 0 deletions

diff --git a/src/document/replica.rs b/src/document/replica.rs
index 27c81ad..61f2b3b 100644
--- a/src/document/replica.rs
+++ b/src/document/replica.rs
@@ -113,6 +113,12 @@ pub(crate) struct Replica {
     /// run: messages carry it, so a late one can't flip a peer's view of our epoch back.
     pub(crate) epoch_seq: u32,
     pub(crate) doc: Document,
+    /// Whether writes go in (`AppState::mutate_doc`). False while a rejoin syncs a fresh
+    /// document: a write would land in a document the epoch's snapshot hasn't reached
+    /// yet, or be thrown away with it if the rejoin is abandoned. Cleared and set again
+    /// in the same lock as the swap (`Host::switch_epoch`), so no write checked
+    /// before a swap lands after it.
+    pub(crate) writable: bool,
     heads: Vec<ChangeHash>,
     stamp: watch::Sender<Stamp>,
 }
@@ -138,6 +144,7 @@ impl Replica {
             epoch,
             epoch_seq: 0,
             doc,
+            writable: true,
             heads: Vec::new(),
             stamp,
         };