signatures: a node signs at start what it kept unsigned when it stopped

A node commits a change, keeps it in its document file, and may stop
before any signature vouches for it. It starts again under a new
actor and only ever signed its current actor's latest change: the old
one stays unsigned for good. Peers pulling it then wait for a
signature under a policy requiring them, and so does everything the
node writes after, building on it. Signing every change at commit hid
this under such a policy; signing what is sent, next, won't.

At start, before anything leaves, a node signs each of its own
changes at the document's heads that no signature vouches for:
nothing it made since builds on them, so they are heads.

1 files changed, 11 insertions, 0 deletions

diff --git a/src/node.rs b/src/node.rs
index 91a9c62..314433c 100644
--- a/src/node.rs
+++ b/src/node.rs
@@ -126,6 +126,17 @@ impl Node {
             &replica.doc,
             config.initial_signatures,
         );
+        // What this node kept unsigned when it stopped: signed before anything leaves.
+        if let Some(key) = &config.node_key {
+            let replica = &mut replica;
+            let signed = replica.signatures.sign_own_heads(&replica.doc, key);
+            if signed > 0 {
+                tracing::info!(
+                    signed,
+                    "Signed changes this node kept unsigned when it stopped"
+                );
+            }
+        }
         let stamp = replica.stamps();
         let state = AppState {
             doc: Arc::new(crate::document::lock::DocumentLock::new(replica)),