sync: a write between signing and making a message signed too

Review 4, F10: a sync message signed the node's latest change under the document's
write lock (`sign_sent`), then was made under its read lock: a write committed in
between went in the message unsigned, and under a policy requiring signatures waited at
the peer until the next signed change came with it, or a resend.

Now the message is made under a read lock taken after signing, and if a write came in
between (`AppState::sign_due` again under that lock), signed again: a few times at
most, past them it goes as before, its signature with the next message.

1 files changed, 13 insertions, 3 deletions

diff --git a/src/swarm/sync.rs b/src/swarm/sync.rs
index dd3d804..e3f6055 100644
--- a/src/swarm/sync.rs
+++ b/src/swarm/sync.rs
@@ -171,12 +171,22 @@ async fn deliver_sync_to_peer(state: &AppState, peer: &str) -> Result<()> {
         // The session the message comes from, for its send's outcome.
         let (session, generated) = tokio::task::spawn_blocking(
             move || -> (u64, Result<Option<transport::EncodedMessage>>) {
-                // This node's latest change, if this message may take it, leaves signed.
-                signer.sign_sent(&doc);
                 // Label the message with the epoch of the document it was generated
                 // from, read under the same lock.
                 let (session, epoch, epoch_seq, body, writer, delivered, signatures) = {
-                    let replica = doc.blocking_read();
+                    // This node's latest change, if this message may take it, leaves
+                    // signed: signed, then looked at again under the lock the message is
+                    // made under, signed again if a write came in between (a few times
+                    // at most; past them it goes as it is, its signature with the next).
+                    let mut tries = 0;
+                    let replica = loop {
+                        signer.sign_sent(&doc);
+                        let replica = doc.blocking_read();
+                        tries += 1;
+                        if tries >= 3 || !signer.sign_due(&replica) {
+                            break replica;
+                        }
+                    };
                     let mut peer_state = psm.blocking_lock();
                     let (epoch, epoch_seq) = (replica.epoch, replica.epoch_seq);
                     // Whose change it passes on, if any: this message carries it.