The store's mirror of the assignments may not write while they are switching or moved, asked before every write (issue 1093)

Review round 2. The writer's leave to write is the lease's and AssignmentsMirrorMayWrite, a flag set before the settle of the assignments' switch, kept after the commit and cleared only if the switch fails, so a pass that read its source before the switch lays and purges nothing after it.

internal/inventory/chain.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"sync"
+	"sync/atomic"
 
 	"github.com/jackc/pgx/v5"
 	"github.com/jackc/pgx/v5/pgconn"
@@ -41,6 +42,18 @@ type movedKinds struct {
 	// is not saved yet.
 	view    *rolloutView
 	pending map[string]pendingMerge
+	// switching is set when the assignments begin to be switched to the bus and kept once they are: the store's mirror of
+	// them writes nothing from then on (AssignmentsMirrorMayWrite). Cleared only if the switch fails.
+	switching atomic.Bool
+}
+
+// AssignmentsMirrorMayWrite says the store's mirror of the assignments may still write the bucket: the assignments are
+// neither being switched to the bus nor on it. Asked before every write of the mirror's writer, not once a pass.
+func (i *Inventory) AssignmentsMirrorMayWrite() bool {
+	i.moved.mu.Lock()
+	moved := i.moved.kind[KindAssignments]
+	i.moved.mu.Unlock()
+	return !moved && !i.moved.switching.Load()
 }
 
 // ChainOpener opens the chain on the bus when a process first needs it: a command that reads and never moved anything has
@@ -124,3 +137,13 @@ func (i *Inventory) ChainMoved(ctx context.Context) (map[string]int, error) {
 	}
 	return counts, err
 }
+
+// NewForTest is an inventory with no store, for a test of what needs none.
+func NewForTest() *Inventory { return &Inventory{moved: &movedKinds{}} }
+
+// BeginSwitchForTest sets the flag a kind's switch sets, as a switch under way does.
+func (i *Inventory) BeginSwitchForTest(kind string) {
+	if kind == KindAssignments {
+		i.moved.switching.Store(true)
+	}
+}