2 files changed, 12 insertions, 3 deletions

diff --git a/docs/access.md b/docs/access.md
index 50c0265..988d619 100644
--- a/docs/access.md
+++ b/docs/access.md
@@ -124,7 +124,11 @@ curl -H "Authorization: Bearer ct1.…" http://other-node:3000/store
 * **Revoking**: a user disabled or removed is refused at once; all of a user's tokens,
   by the user (`POST /auth/logout`) or by one who may manage users (`DELETE
   /admin/users/{name}/tokens`), which sets `_continuum/logouts/<name>`: tokens issued
-  before aren't taken any more. A token of a node banned or forgotten by the swarm isn't
+  before aren't taken any more. One session's (`DELETE /auth/session`, the dashboard's
+  "log out"): `_continuum/sessions/<name>/<session>`, until when the session would have
+  lasted, written by the user or one who manages users; a remake's snapshot leaves it
+  out once that has passed. Without a registry, the node ending it refuses the
+  session's tokens itself, until it restarts; others take them until they expire. A token of a node banned or forgotten by the swarm isn't
   taken either. In a swarm without a registry, a token is taken until it expires. The
   user a logout names is its node's word, and a logout no deciding path, even under a
   strict policy: any member could log any user out. It ends sessions; and a value there
diff --git a/docs/openapi.yaml b/docs/openapi.yaml
index 03afa2f..adee4a6 100644
--- a/docs/openapi.yaml
+++ b/docs/openapi.yaml
@@ -923,8 +923,13 @@ paths:
         '503': { description: Not ready yet. }
     delete:
       tags: [Auth]
-      summary: Forget the browser's session
-      description: The session cookie cleared. The token stays valid until it expires (`POST /auth/logout` ends them all).
+      summary: End the session
+      description: |
+        The session of the token it comes with (the cookie, or `Authorization: Bearer`)
+        ended: recorded as `_continuum/sessions/<user>/<session>` where the swarm has a
+        registry, so no node takes its tokens any more once the change reaches it; else on
+        this node only, others taking them until they expire. And the session cookie
+        cleared. (`POST /auth/logout` ends all of a user's sessions.)
       responses:
         '204': { description: Forgotten. }
         '401':