access: a change judged by the policy it was written under, locally too

Review 2, N10: the judgement before a change leaves (1140) and a
replay's (1141) skipped changes when the document *with* the change had
no policy it enforces. A write removing the policy, or setting one the
node doesn't know, then left unjudged, while receivers judge it at its
dependencies, where the policy was enforced. Both now read the policy
at the heads before the change, as receivers do.

1 files changed, 5 insertions, 1 deletions

diff --git a/src/state/mod.rs b/src/state/mod.rs
index ed93fda..441cdaf 100644
--- a/src/state/mod.rs
+++ b/src/state/mod.rs
@@ -250,7 +250,11 @@ fn judged_here(
     replica: &crate::document::replica::Replica,
     before: &[crate::document::ChangeHash],
 ) -> Result<(), String> {
-    if !crate::access::policy::of(&replica.doc).enforced() {
+    // By the policy it was written under, as receivers judge it: one removing or
+    // changing the policy is judged too.
+    let enforced = crate::document::at::At::new(&replica.doc, before)
+        .is_some_and(|at| crate::access::policy::of(&at).enforced());
+    if !enforced {
         return Ok(());
     }
     let after = replica.doc.get_heads();