open sync only from one side

If both sides open, the openings cross, and an empty node's answer to
the other opening (empty heads) makes the other side send the whole
document a second time.

Now after a sync reset, only the side with the smaller public key opens
the sync; the other answers it, or opens itself if nothing arrives.

1 files changed, 24 insertions, 0 deletions

diff --git a/src/state.rs b/src/state.rs
index 9c3b569..3fa01c2 100644
--- a/src/state.rs
+++ b/src/state.rs
@@ -110,6 +110,9 @@ pub(crate) struct PeerState {
     pub(crate) sync_reply: Option<SyncReplyWait>,
     /// How long to wait for it; doubles while answers stay out.
     pub(crate) sync_reply_timeout: Duration,
+
+    /// When sync with this peer last started from scratch.
+    pub(crate) sync_reset_at: Instant,
 }
 
 /// Sync messages we sent and expect an answer to. Automerge assumes reliable delivery:
@@ -128,6 +131,10 @@ const SYNC_REPLY_TIMEOUT: Duration = Duration::from_secs(10);
 /// Upper bound (Mycelium gives up on a message after five minutes).
 const SYNC_REPLY_TIMEOUT_MAX: Duration = Duration::from_secs(300);
 
+/// How long the side that doesn't open a fresh sync waits for the other's opening
+/// before opening itself (the other one may not have reset, or its message got lost).
+const SYNC_OPENING_GRACE: Duration = Duration::from_secs(3);
+
 impl Default for PeerState {
     fn default() -> Self {
         Self {
@@ -148,6 +155,7 @@ impl Default for PeerState {
             authenticated: false,
             sync_reply: None,
             sync_reply_timeout: SYNC_REPLY_TIMEOUT,
+            sync_reset_at: Instant::now(),
             epoch: None,
         }
     }
@@ -162,6 +170,22 @@ impl PeerState {
         self.needs_generate = false;
         self.sync_reply = None;
         self.sync_reply_timeout = SYNC_REPLY_TIMEOUT;
+        self.sync_reset_at = Instant::now();
+    }
+
+    /// After a reset, usually both sides do it and both open the sync at once. The
+    /// openings cross, and each side answers the other's: harmless between peers that
+    /// share history, but an empty peer answers with empty heads, which Automerge takes
+    /// for "lost everything", so the whole document goes out a second time. Only the
+    /// side with the smaller key opens; the other waits for its opening, up to
+    /// `SYNC_OPENING_GRACE`. Returns how much longer to wait, if at all.
+    pub(crate) fn opening_wait(&self, we_open: bool, now: Instant) -> Option<Duration> {
+        if we_open || self.sync_state.their_heads.is_some() {
+            return None;
+        }
+        SYNC_OPENING_GRACE
+            .checked_sub(now.saturating_duration_since(self.sync_reset_at))
+            .filter(|wait| !wait.is_zero())
     }
 
     /// A sync message went out; `sent` are the changes it carried for the first time.