screen: that a policy was held kept across a swap of the document

Review 4, F12: `Screening::of` started screening over when the document was swapped (a
drop, a switch, a rejoin), the root pin alone carried on, so whether the document had
held a policy (`policed`, 1211) was forgotten there too, not only across a restart as
documented: after a drop with the policy removed meanwhile, late changes written under
it went in unjudged again.

It is carried on now, as the root pin is; what belongs to the old document (changes
waiting, refusals, drops held) still starts over. access.md says so.

1 files changed, 6 insertions, 2 deletions

diff --git a/src/access/screen.rs b/src/access/screen.rs
index b1318ea..3ea03e0 100644
--- a/src/access/screen.rs
+++ b/src/access/screen.rs
@@ -147,8 +147,9 @@ impl Screening {
     /// Whether `doc` holds a policy, known or not, or did since this node took it up:
     /// then what it receives is judged (`apply`), each change by the policy at its
     /// dependencies, though the policy is gone or unknown now; changes written under it
-    /// may still come. Not across a restart: a node that starts with no policy in its
-    /// document judges as one that never had one.
+    /// may still come. Kept across a swap of the document (a drop, a switch, a rejoin,
+    /// `of`); not across a restart: a node that starts with no policy in its document
+    /// judges as one that never had one.
     pub(crate) fn policed(&mut self, doc: &Document) -> bool {
         self.policed |= !matches!(super::policy::of(doc), super::policy::Policy::Open);
         self.policed
@@ -156,9 +157,12 @@ impl Screening {
 
     pub(crate) fn of(&mut self, epoch_seq: u32) -> &mut Self {
         if self.epoch_seq != epoch_seq {
+            // The root pin and whether a policy was held go on; what belongs to the old
+            // document (changes waiting, refusals, drops held) doesn't.
             *self = Screening {
                 epoch_seq,
                 root_pin: std::mem::take(&mut self.root_pin),
+                policed: self.policed,
                 ..Screening::default()
             };
         }