remake: a strict remake of a strict swarm isn't followed

Review 3, R3: 1186 kept honest nodes from proposing or voting for a
strict remake of a swarm strict already, but a majority of members,
each with keys of its own, could still commit one, and switch and
catchup followed it without asking what kind of remake made the
epoch: the registry, policy and bans of a strict swarm changing by a
member majority, the honest minority following.

A node now refuses to switch to such an epoch (its document's policy
strict, the remake's kind strict), and catchup refuses to rejoin one
whose chain of epochs holds a strict remake after the swarm was strict
(as the old document is, or once a remake since made it so). access.md
says so.

3 files changed, 30 insertions, 1 deletions

diff --git a/docs/access.md b/docs/access.md
index 46758b0..be91185 100644
--- a/docs/access.md
+++ b/docs/access.md
@@ -428,7 +428,8 @@ registry, the policy and the bans change only as a user who may change them sign
 
 A running swarm turns strict through a remake of its own kind, `strict`, once (a swarm
 strict already takes none: its registry, policy and bans change by their users'
-signatures, not by a majority of members): compaction
+signatures, not by a majority of members; its nodes neither vote for one nor follow one
+a majority commits anyway, switching or rejoining): compaction
 that keeps, at the places values are signed (the registry, `_continuum/access`, the
 bans, the paths listed in `userSigned`), only the values an operator looked over and
 signed, and sets the strict policy. What was written after its base reaches the new
diff --git a/src/remake/catchup.rs b/src/remake/catchup.rs
index 4df5c90..6ef8121 100644
--- a/src/remake/catchup.rs
+++ b/src/remake/catchup.rs
@@ -528,6 +528,22 @@ fn prepare(
         .filter(|next| next.previous == previous);
     let gap = target.generation - previous.generation;
 
+    // A strict remake of a swarm strict already isn't followed: there its registry,
+    // policy and bans change by its users' signatures, not by a majority of members
+    // (`vote::strict_taken`). Strict as our document is, or once a remake since made it so.
+    let mut strict = crate::access::policy::of(old).strict();
+    for generation in previous.generation + 1..=target.generation {
+        if let Ok(epoch) = snapshot::read_epoch_metadata(copy, generation)
+            && epoch.kind == "strict"
+        {
+            if strict {
+                return Prepared::Failed(format!(
+                    "epoch generation {generation} was made by a strict remake of a swarm strict already: not followed"
+                ));
+            }
+            strict = true;
+        }
+    }
     // Writes made in our epoch go through every remake since, in order.
     let translator = (previous.generation + 1..=target.generation).try_fold(
         Translator::default(),
diff --git a/src/remake/switch.rs b/src/remake/switch.rs
index bd40d72..df3fcc8 100644
--- a/src/remake/switch.rs
+++ b/src/remake/switch.rs
@@ -192,6 +192,18 @@ async fn switch<H: Host>(
     let translator = request
         .translator()
         .ok_or_else(|| format!("unknown remake kind {:?}", request.kind))?;
+    // A strict remake of a swarm strict already, committed by a majority of members
+    // anyway: not followed (`vote::strict_taken`, `catchup`).
+    if request.kind == "strict"
+        && host
+            .read_doc(|doc| crate::access::policy::of(doc).strict())
+            .await
+    {
+        return Err(
+            "a strict remake of a swarm strict already: its registry changes by its users' signatures; not followed"
+                .to_owned(),
+        );
+    }
     let late_translator = translator.clone();
     let superseded = host.superseded();
     let previous = request.previous;