rules: protocol maps judged by what is done to them

Review finding 7, first part: the protocol-map rules looked at paths,
not actions. Any member could delete _continuum/members, /votes or
/remakes whole, or rewrite another remake's proposal (its coordinator)
and then write its decision.

What holds the members' entries, votes and remake records, and a
remake's record itself, are now made by a member only where there is
none; a proposal is written only where there is none. Replacing or
removing any of them is left to a user who may write there (the
protocol writers). An abort asked for stays any member's.

1 files changed, 7 insertions, 2 deletions

diff --git a/docs/access.md b/docs/access.md
index f7546aa..eb9efc9 100644
--- a/docs/access.md
+++ b/docs/access.md
@@ -224,8 +224,13 @@ stays as it is, wherever it comes from later (a joining node catching up, say).
   member in the same change (`DELETE /peers/{pk}`, with `_continuum/forgotten`).
 * Epochs and the swarm ID (`_continuum/epochs`, `_continuum/swarm`) by an epoch's first
   change only (the genesis change, a remake's snapshot).
-* A remake's decision by the coordinator its proposal names; the rest of a record by
-  any member.
+* A remake's record and its proposal by whichever member proposes, where there are
+  none; its decision by the coordinator its proposal names; an abort asked for by any
+  member. Replacing or removing a record or its proposal, by a user who may write
+  there.
+* What holds the members' entries, votes and remake records (`_continuum/members`,
+  `_continuum/votes`, `_continuum/remakes`) made by whichever member first writes in
+  it, where there is none; replaced or removed by a user who may write there only.
 * A user's tokens revoked by that user too (logging out), and by one who manages users.
 * A member's forget record cancelled by that member too (forgotten while alive).
 * Everything else, protocol data or not, by a user the registry lets write there.