From 2a4316f4a256012120337064df150944880b6453 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 9 Nov 2026 22:25:53 +0000
Subject: document file: undo the clean stop's mark before deciding the actor

At start, a node on a document file appends an Opened record before it
writes anything, so that a Closed record before it no longer says the
file holds every change of the actor it names. It does so now before
deciding which actor to write as, and DocumentFile::open says whether it
could: where the append fails (the disk full, permissions), the file
still ends with Closed, and later appends likely fail too. A crash, or a
clean stop whose last append failed (close then sees the file behind and
writes no mark), would leave that Closed standing for a run the file
never got. So with --keep-actor, the node writes on as the actor of
before only where the file was marked as opened; else it writes as a
fresh actor and warns.
---
 src/main.rs | 32 ++++++++++++++++++--------------
 1 file changed, 18 insertions(+), 14 deletions(-)

(limited to 'src/main.rs')

diff --git a/src/main.rs b/src/main.rs
index 7c819e5..d8704a0 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -184,13 +184,30 @@ async fn main() -> Result<()> {
         None => (Document::new(), None, None, Vec::new(), Vec::new(), None),
     };
     let mut initial_doc = initial_doc;
+    let document_file = args.document_file.clone().map(|path| {
+        Arc::new(document::file::DocumentFile::new(
+            path,
+            Arc::clone(&files),
+            args.document_append,
+            args.document_rewrite,
+        ))
+    });
+    // A clean stop's mark undone before anything is written, and before deciding the
+    // actor: a crash from here on leaves a file that doesn't say so. A file that still
+    // says so (the mark not undone) gets a fresh actor.
+    let opened = document_file.as_ref().is_none_or(|file| file.open());
     // Writing on as the actor of before, where this node stopped cleanly: everything it
     // wrote as that one is in the document, so no change of it comes twice.
-    match resumable.filter(|_| args.keep_actor) {
+    match resumable.filter(|_| args.keep_actor && opened) {
         Some(actor) => {
             info!(actor = %actor, "Writing on as the actor of before (--keep-actor)");
             initial_doc.set_actor(actor);
         }
+        None if args.keep_actor && !opened => {
+            warn!(
+                "Writing as a fresh actor: the document file couldn't be marked as opened (--keep-actor)"
+            );
+        }
         None if args.keep_actor && starting_epoch.is_some() => {
             info!("Writing as a fresh actor: this node didn't stop cleanly (--keep-actor)");
         }
@@ -239,19 +256,6 @@ async fn main() -> Result<()> {
     let mut transports = transports.into_iter();
     let (scheme, transport) = transports.next().context("No transports")?;
 
-    let document_file = args.document_file.clone().map(|path| {
-        Arc::new(document::file::DocumentFile::new(
-            path,
-            Arc::clone(&files),
-            args.document_append,
-            args.document_rewrite,
-        ))
-    });
-    // A clean stop's mark undone before anything is written: a crash from here on
-    // leaves a file that doesn't say so.
-    if let Some(file) = &document_file {
-        file.open();
-    }
     let node = node::Node::new(node::NodeConfig {
         transport,
         identity: Some(transport::identity::IdentityConfig {
-- 
cgit v1.3.1