rules: an expired remake aborted by any member

Under a policy, a remake's decision was taken from its coordinator only.
A node aborting an expired remake whose coordinator is gone
(DELETE /admin/remakes, after abortableAt) was refused by its own
judgement (403), so such a remake could never be decided.

The decision is now also taken from a user who may write it (the
protocol writers), and an abort from any member once the remake expired
a grace period ago (abortableAt, by the coordinator's grace period in
the proposal). The rules have no clock of their own, so that is judged
by the time the change says it was made: the writer's word, so a member
could abort a remake early, as it could ask its coordinator to, but
never commit one. Before then, an abort stays a request the coordinator
applies.

1 files changed, 3 insertions, 0 deletions

diff --git a/docs/remakes.md b/docs/remakes.md
index b70835e..b8e0fa6 100644
--- a/docs/remakes.md
+++ b/docs/remakes.md
@@ -252,6 +252,9 @@ aborts it itself, under three conditions that keep it from crossing a late commi
   Clocks): whether the remake expired is judged by it, and a node ahead would abort a
   remake its coordinator may still commit. Otherwise `409`, unless `?force=clock`.
 
+With a policy ([`access.md`](access.md)), the other nodes take that abort by the time
+it says it was written: a grace period after the expiry at least.
+
 A member that saw a remake expire before it voted for it says so in its log, once
 (`Didn't vote for a remake`, warn if its clock is off: it then misses remakes others
 still vote on).