docs: what the review found that stays

Review findings 10 and 12, and 3.1/3.3: what stays as it is, said.

* Any member can log any user out: the user a logout names is its
  node's word, and a logout is no deciding path, even under strict.
* Used challenges are remembered in memory: after a restart, one
  captured within its five minutes could be taken once more.
* A registry turns strict as it is: whatever it holds then counts,
  plain values and envelopes, checked or not. Look it over first.
* A value that isn't an envelope starts its chain anew (prev empty).
* A strict registry whose only manager lost its keys changes no more:
  keep two managers, or two keys.
* The handed-over token stays in the address bar and history where the
  other dashboard never loads, for its five minutes.

1 files changed, 18 insertions, 4 deletions

diff --git a/docs/access.md b/docs/access.md
index e8108e2..909d915 100644
--- a/docs/access.md
+++ b/docs/access.md
@@ -107,7 +107,9 @@ curl -H "Authorization: Bearer ct1.…" http://other-node:3000/store
   by the user (`POST /auth/logout`) or by one who may manage users (`DELETE
   /admin/users/{name}/tokens`), which sets `_continuum/logouts/<name>`: tokens issued
   before aren't taken any more. A token of a node banned or forgotten by the swarm isn't
-  taken either. In a swarm without a registry, a token is taken until it expires.
+  taken either. In a swarm without a registry, a token is taken until it expires. The
+  user a logout names is its node's word, and a logout no deciding path, even under a
+  strict policy: any member could log any user out. It ends sessions, nothing more.
 * **What it means to trust**: any member could sign a token for any user, as it could
   write anything as anyone ([`trust.md`](trust.md)). A token is a bearer's: whoever holds it is
   the user until it ends, so it goes over TLS only, as passwords do.
@@ -123,7 +125,9 @@ jq -n --arg c "$c" --rawfile s sig '{user: "alice", challenge: $c, signature: $s
   curl -s -X POST localhost:3000/auth/login/key -H 'Content-Type: application/json' -d @-
 ```
 
-A challenge is the node's, signed by it, valid for five minutes, and taken once;
+A challenge is the node's, signed by it, valid for five minutes, and taken once (the
+node remembers which in memory: after a restart, one captured in its five minutes
+could be taken once more; it goes over TLS, as passwords do);
 the signature must be by one of the user's keys, as the registry the node holds then
 says, and the user enabled (`401` if not, saying why). A swarm without a registry has
 no keys (`409`).
@@ -361,8 +365,18 @@ A node takes one only from that user, for that path, replacing what is there, by
 of the user's keys, and if the user may write there ([`api.md`](api.md), Signed values);
 it writes nothing else there, nor within or above such a value (`409`), and the users
 API changes nothing (`409`). Values there before the policy stay as they are until
-replaced: a registry whose entries hold the users' keys turns strict as it is. Without
-the policy, signed values may be written all the same, and plain ones too.
+replaced: a registry whose entries hold the users' keys turns strict as it is. As it is
+means trusted as it is: whatever entries, policy and bans it holds then count, plain
+values and envelopes alike, checked or not, whoever wrote them before (under a policy
+that isn't strict, a member may write as any user). Look them over before turning
+strict (`continuum-signed verify` on each entry). A value there that isn't an envelope
+starts its chain anew: any envelope its user once signed for that path replacing
+nothing (`prev` empty) can be put there again. Without the policy, signed values may
+be written all the same, and plain ones too.
+
+Keep two users who may manage users, or two keys each: under a strict policy, a
+registry whose only manager lost its keys changes no more (the protocol writers do
+everything there again only while nobody may manage users).
 
 Every node judges the changes it receives alike (Changes judged on every node, above),
 as their writer saw the registry: at such a place, only a string that is an envelope