Seems like a permission issue & not related to MSM. Did you attempt to restore a version of the any child page ?
Yes, it looks like a permission issue, but since I'm doing the rollout as admin, which has full permissions to all pages in both source and target languages, it shouldn't be an issue, so I think MSM is doing something wrong here. It doesn't help if I remove all Deny-nodes under the rep:policy node, it still won't work. Only if I remove the rep:policy node itself the rollout will work. But this means that we can't set any detailed permissions at all in the target languages content trees (because that creates rep:policy nodes which breaks the rollout).
Maybe MSM missed the following sentence in the jackrabbit documentation (http://wiki.apache.org/jackrabbit/AccessControl):
"Resource-based ACLs are stored per resource/node in a special child node rep:policy... Note that you can read/browse these nodes using the JCR API, but cannot modify them. This must always happen through the JCR access control API."
Problem solved. We got a hotfix from Adobe called crx-hotfixpack-126.96.36.199 containg (amoung other things) this fix:
CRX-4220 - Reordering policy node fails with AccessDeniedException