Steps to reproduce:

1. Create a model and add "has_paper_trail" to it
2. Create an instance of the model (w = Widget.create!)
3. Destroy the instance (w.destroy)
4. Call w.version_at(Time.now)

Expected behavior:
Returns nil (symmetric with calling version_at with a timestamp before the instance was created)

Actual behavior:
Returns the instance of the model (w)

Note that in this case, you could at least call w.destroyed? to see if it was destroyed. But if you use the solution mentioned in #204, which reifies the latest non-destroyed version of the object and then calls version_at, your call to destroyed? will return false.

I'm assuming this isn't intended behavior, but maybe I'm missing something?

It looks like the issue is here, where version_at sees that it can't find an entry in the versions table with a late enough timestamp. It then assumes that the object is live and further assumes that self is the live version of the object.

I overrode version_at in my model with the following, which calls find_by on the model class if there's no entry in the versions table to reify. That should return the live instance if one exists or nil if it's been destroyed. (I avoided find since that would raise an exception if the object has been destroyed.) I'm not sure if this causes other issues or if it'd need to be adjusted to deal with primary keys that are not called "id".

  # Returns the object (not a Version) as it was at the given timestamp.
  def version_at(timestamp, reify_options={})
    # Because a version stores how its object looked *before* the change,
    # we need to look for the first version created *after* the timestamp.
    v = send(self.class.versions_association_name).subsequent(timestamp).first
    v ? v.reify(reify_options) : self.class.find_by(id: id)
  end