access: a change judged by the policy it was written under, locally too

Review 2, N10: the judgement before a change leaves (1140) and a
replay's (1141) skipped changes when the document *with* the change had
no policy it enforces. A write removing the policy, or setting one the
node doesn't know, then left unjudged, while receivers judge it at its
dependencies, where the policy was enforced. Both now read the policy
at the heads before the change, as receivers do.

1 files changed, 4 insertions, 1 deletions

diff --git a/src/remake/delta.rs b/src/remake/delta.rs
index dd5df4f..a152861 100644
--- a/src/remake/delta.rs
+++ b/src/remake/delta.rs
@@ -203,7 +203,10 @@ fn judged(
     epoch: crate::document::replica::Epoch,
     before: &[ChangeHash],
 ) -> Result<(), String> {
-    if !crate::access::policy::of(doc).enforced() {
+    // By the policy it was written under, as receivers judge it.
+    let enforced = crate::document::at::At::new(doc, before)
+        .is_some_and(|at| crate::access::policy::of(&at).enforced());
+    if !enforced {
         return Ok(());
     }
     match doc.get_heads()[..] {