remake: replays judged before they go in

A switching or rejoining node replays late writes as fresh changes
naming each write's user, and nothing judged them before they left: a
replay every node would refuse (a revoked capability, a second
envelope at a signed path, readers changed) was refused everywhere,
and with it everything the node wrote after it.

Under a policy, replay_newest now judges each group it commits as
every node will (rules::judge_held, in the new epoch); one they would
refuse is taken back (forked at the heads before it, same actor) and
its paths quarantined with the reason. replay_newest takes the epoch.

Review finding 3 (remake replays).

1 files changed, 4 insertions, 0 deletions

diff --git a/docs/remakes.md b/docs/remakes.md
index 8e585c6..b70835e 100644
--- a/docs/remakes.md
+++ b/docs/remakes.md
@@ -311,6 +311,10 @@ The swarm stays writable throughout.
   replayed: newer ones touched their paths`), or with `--superseded-writes quarantine`
   kept in the quarantine. Clocks that disagree (beyond `--clock-skew-warn`) can make
   the older write win.
+* **Under a policy** ([`access.md`](access.md)), a carried-over write is judged as every
+  node will judge it, in the new epoch: one they would refuse (its user may no longer
+  write there, say) goes to the quarantine instead, so it can't cut the carrying node
+  off.
 * **Granularity**: map entries are carried over per key. Lists and text are carried
   over whole, so concurrent edits of the same list on two nodes around a remake end as
   last-writer-wins.