OperServ: add SET READONLY lockdown

src/engine/db/mod.rs

@@ -680,11 +680,15 @@ pub struct EventLog {
     versions: HashMap<String, u64>, // per-origin highest seq applied (version vector)
     entries: Vec<LogEntry>,         // full log, kept so peers can pull what they lack
     outbound: Option<broadcast::Sender<LogEntry>>, // push newly committed entries to peers
+    // Operator lockdown (OperServ SET READONLY): while set, locally-authored
+    // writes are refused. Ephemeral — it resets on restart and never persists,
+    // and gossip ingestion is unaffected so a read-only node stays in sync.
+    readonly: bool,
 }
 
 impl EventLog {
     fn open(path: PathBuf, origin: String) -> (Self, Vec<Event>) {
-        let mut log = Self { path, origin, lamport: 0, versions: HashMap::new(), entries: Vec::new(), outbound: None };
+        let mut log = Self { path, origin, lamport: 0, versions: HashMap::new(), entries: Vec::new(), outbound: None, readonly: false };
         if let Ok(data) = std::fs::read_to_string(&log.path) {
             for line in data.lines().filter(|l| !l.trim().is_empty()) {
                 match serde_json::from_str::<LogEntry>(line) {
@@ -719,6 +723,10 @@ impl EventLog {
     // Lamport clock and are pushed to peers; local (channel) events are written
     // for restart but never gossiped and carry no version-vector identity.
     fn append(&mut self, event: Event) -> std::io::Result<()> {
+        // Operator lockdown refuses every locally-authored write at this one seam.
+        if self.readonly {
+            return Err(std::io::Error::new(std::io::ErrorKind::PermissionDenied, "services are read-only"));
+        }
         let global = event.scope() == Scope::Global;
         let entry = if global {
             self.lamport += 1;

src/engine/db/network.rs

@@ -197,6 +197,17 @@ impl Db {
         self.defcon = level.clamp(1, 5);
     }
 
+    /// Whether the services are in operator read-only lockdown.
+    pub fn readonly(&self) -> bool {
+        self.log.readonly
+    }
+
+    /// Enter or leave read-only lockdown: while on, locally-authored writes are
+    /// refused. Ephemeral (never persisted); gossip ingestion is unaffected.
+    pub fn set_readonly(&mut self, on: bool) {
+        self.log.readonly = on;
+    }
+
     /// Whether new nick/account registrations are frozen (defcon 3 or lower).
     pub fn registrations_frozen(&self) -> bool {
         self.defcon <= 3

src/engine/db/store.rs

@@ -228,6 +228,12 @@ impl Store for Db {
     fn set_defcon(&mut self, level: u8) {
         Db::set_defcon(self, level)
     }
+    fn readonly(&self) -> bool {
+        Db::readonly(self)
+    }
+    fn set_readonly(&mut self, on: bool) {
+        Db::set_readonly(self, on)
+    }
     fn registrations_frozen(&self) -> bool {
         Db::registrations_frozen(self)
     }

src/engine/register.rs

@@ -200,7 +200,7 @@ impl Engine {
         if self.db.external_accounts() {
             return Some(reg_reply(reply, RegOutcome::External, account));
         }
-        if self.db.registrations_frozen() {
+        if self.db.registrations_frozen() || self.db.readonly() {
             return Some(reg_reply(reply, RegOutcome::Frozen, account));
         }
         if self.db.exists(account) {

src/engine/tests.rs

@@ -1155,6 +1155,48 @@
         assert!(notice(&e.handle(NetEvent::Privmsg { from: "000AAAAAD".into(), to: "42SAAAAAH".into(), text: "FORBID ADD NICK x y".into() }), "Access denied"), "non-oper refused");
     }
 
+    // OperServ SET READONLY locks out writes: while on, a channel can't be
+    // registered; turning it off restores normal service.
+    #[test]
+    fn operserv_set_readonly_blocks_writes() {
+        use echo_chanserv::ChanServ;
+        use echo_nickserv::NickServ;
+        use echo_operserv::OperServ;
+        let path = std::env::temp_dir().join("echo-osreadonly.jsonl");
+        let _ = std::fs::remove_file(&path);
+        let mut db = Db::open(&path, "42S");
+        db.scram_iterations = 4096;
+        db.register("boss", "pw", None).unwrap();
+        let mut e = Engine::new(
+            vec![
+                Box::new(NickServ { uid: "42SAAAAAA".into(), guest_nick: "Guest".into(), guest_seq: 0 }),
+                Box::new(ChanServ { uid: "42SAAAAAB".into() }),
+                Box::new(OperServ { uid: "42SAAAAAH".into() }),
+            ],
+            db,
+        );
+        let mut opers = std::collections::HashMap::new();
+        opers.insert("boss".to_string(), Privs::default().with(echo_api::Priv::Admin));
+        e.set_opers(opers);
+        e.handle(NetEvent::UserConnect { uid: "000AAAAAB".into(), nick: "boss".into(), host: "h".into(), ip: "0.0.0.0".into() });
+        e.handle(NetEvent::Privmsg { from: "000AAAAAB".into(), to: "42SAAAAAA".into(), text: "IDENTIFY pw".into() });
+        e.handle(NetEvent::Join { uid: "000AAAAAB".into(), channel: "#c".into(), op: true });
+        let os = |e: &mut Engine, t: &str| e.handle(NetEvent::Privmsg { from: "000AAAAAB".into(), to: "42SAAAAAH".into(), text: t.into() });
+        let cs = |e: &mut Engine, t: &str| e.handle(NetEvent::Privmsg { from: "000AAAAAB".into(), to: "42SAAAAAB".into(), text: t.into() });
+        let notice = |out: &[NetAction], n: &str| out.iter().any(|a| matches!(a, NetAction::Notice { text, .. } if text.contains(n)));
+
+        assert!(notice(&os(&mut e, "SET READONLY ON"), "read-only"), "readonly enabled");
+        assert!(e.db.readonly(), "flag set");
+        let out = cs(&mut e, "REGISTER #c");
+        assert!(!notice(&out, "now registered"), "register blocked while read-only: {out:?}");
+        assert!(e.db.channel("#c").is_none(), "no channel written");
+
+        assert!(notice(&os(&mut e, "SET READONLY OFF"), "no longer"), "readonly cleared");
+        assert!(!e.db.readonly(), "flag cleared");
+        assert!(notice(&cs(&mut e, "REGISTER #c"), "now registered"), "register works again");
+        assert!(e.db.channel("#c").is_some(), "channel written");
+    }
+
     // OperServ SHUTDOWN/RESTART (admin) emit a Shutdown action (which the link
     // layer turns into a process exit) and are refused to non-operators.
     #[test]