This is the last object to change, but the semantics here are more
complex. Since the ACL doesn't have a parent, and the init signature
is complex, we can't detect "same-reinit", we allow arbitrary-reinit,
but this makes existing live entries be undefined; they might point to
a different entry in the new ACL, or not be valid, etc.
It could be possible to prevent re-init, but doing so requires
trickery which might be broken by serialisation, so let's just leave
it there and document it as such.