From 61cb117a9b230371d7be36a15a055972ec7de56e Mon Sep 17 00:00:00 2001 From: tv Date: Mon, 9 Nov 2026 22:32:01 +0000 Subject: screen: write as a fresh actor when another node writes as this one With --keep-actor, a node on a document file that ends with a clean stop writes on as the actor the file names. Two nodes started on copies of one file (a copied data directory, a restored disk image while the original runs) both do, and both make that actor's next change number: peers holding one refuse the other as forged, and everything built on it. screen::apply_bytes, the way every received change comes in, now looks for a change of the actor the node writes as that the node doesn't hold: only another node can have made it. The node then writes on as a fresh actor at once, logs a warning, and its callers add the actor to the node's own (RemakeState::add_own_actor), which the document file's header follows. The change is judged as any other. lifecycle.md says not to start a copy of a node's data directory with --keep-actor, and what the switch leaves: what both wrote before stays refused where the other's came first. --- docs/lifecycle.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) (limited to 'docs/lifecycle.md') diff --git a/docs/lifecycle.md b/docs/lifecycle.md index d703fe3..900349d 100644 --- a/docs/lifecycle.md +++ b/docs/lifecycle.md @@ -95,7 +95,13 @@ document file holding a document is an error with no override. each start, unless `--keep-actor` and it stopped cleanly (the file marks a clean stop, and the mark is undone as the node starts on it, before it decides its actor): then it writes on as the actor of before, as nothing it wrote is missing. Where the - mark can't be undone (the disk full, say), it writes as a fresh one. Fewer actors mean fewer signatures in every + mark can't be undone (the disk full, say), it writes as a fresh one. Two nodes + started on copies of one file would both write on as that actor, and each one's + changes would be refused as forged by peers holding the other's: don't start a copy + of a node's data directory while the node runs, or after it, with `--keep-actor`. A + node receiving a change of its own actor that it didn't make writes on as a fresh + actor at once, and logs a warning; what both wrote before stays refused where the + other's came first. Fewer actors mean fewer signatures in every transfer of the epoch's history (a writer each); a crash, a drop, or a switch or a rejoin still starts a fresh one. * **A backup** (`GET /admin/document`) is the whole document with its history, naming -- cgit v1.3.1