docs: what the review found that stays

Review findings 10 and 12, and 3.1/3.3: what stays as it is, said.

* Any member can log any user out: the user a logout names is its
  node's word, and a logout is no deciding path, even under strict.
* Used challenges are remembered in memory: after a restart, one
  captured within its five minutes could be taken once more.
* A registry turns strict as it is: whatever it holds then counts,
  plain values and envelopes, checked or not. Look it over first.
* A value that isn't an envelope starts its chain anew (prev empty).
* A strict registry whose only manager lost its keys changes no more:
  keep two managers, or two keys.
* The handed-over token stays in the address bar and history where the
  other dashboard never loads, for its five minutes.

0 files changed, 0 insertions, 0 deletions