screen: what a node receives judged, policy or not

Review 2, N7: a node screened received changes only while its own
document had a policy it enforces. A joiner's empty document has none,
so its first sync, as much history as the node it joins through chose,
was applied unjudged, and under signatures required unvouched; the same
for any node while the policy's own change arrived with later ones.

Sync messages, deltas and downloaded changes are now always screened,
each change judged by the policy at its dependencies (1135), so the
verdicts are the swarm's. While neither the document nor the changes
hold a policy (none touches a "policy" key: inspect::touch_key), only
an epoch's root is judged and nothing is placed: bench_screening, after
1188, measured placing everything at about as much again as applying
(564 ms + 543 ms for 100 000 changes), judging by the rules at about
five times (+2.5 s), which a document with a policy pays anyway.

access.md no longer lists the joiner's first sync, nor nodes agreeing
only as the policy reaches them (judged at the dependencies, they
agree), as left to do; changes::load_delta is for tests now.

1 files changed, 6 insertions, 5 deletions

diff --git a/docs/access.md b/docs/access.md
index b853b5a..c5365b7 100644
--- a/docs/access.md
+++ b/docs/access.md
@@ -312,15 +312,16 @@ saying the same; and never makes a node drop what its own rules take. If its rul
 take the change, the two policies disagree, which it logs. A change whose
 dependencies haven't come yet waits for them.
 
+A node judges what it receives whether its document has a policy yet or not, each
+change by the policy it was written under: a joining node judges its first sync, the
+policy's own change and everything after it, as every other node does. While neither
+its document nor what it receives holds a policy, it judges only that a root is the
+epoch's, and nothing costs more than applying the changes.
+
 What it doesn't do yet:
 
 * **Prove the user.** A change is its node's (with signatures required, proven) and its
   claimed user's: a member could claim a user its operator doesn't have.
-* **Judge a joining node's first sync.** An empty document has no policy: what it gets
-  from the node it joins through is taken as it is, as that node judged it.
-* **Agree at once.** The policy applies as each node gets it: a change received between
-  the policy's arrival on one node and on another may be refused by one and kept by
-  the other.
 
 A node that doesn't know the policy (another version, or a setting it lacks) takes no
 writes through the API (`409`) and receives without judging, until it is upgraded.