docs(auth): the short reading of the fixes (ADR 0017)

ADR 0017 gets "The short reading": its findings, the developer's four
decisions of 21 Oct, and what changed. "The rules as they stand" says a
reset takes effect 14 days after it was asked at the latest, that a member
keeps the session a reset signed in and deletes nobody while the register
is out of reach, and no longer claims every secret is kept out of every
capture: Android holds them back, Windows from 10 2004, macOS from
screenshots but not ScreenCaptureKit on macOS 15 and later, iOS covers
the app switcher's picture alone, Linux nothing. The module's and
halkyon_app's READMEs and Learn's AGENTS.md follow.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_server/README.md

@@ -104,8 +104,12 @@ the same ID. Sessions stay each service's own: every app signs in itself.
   under the account's ID the first time). Linking a way in makes the person identified on
   the register and then on the member; a switch token signs in as the account the
   address is already. Every refusal is the register's, as on the register itself.
-- **Deleting:** an identified person's deletion on a member goes to the register first
-  (refused while it can't be reached, deleting nothing), which deletes the account and
+- **Deleting:** a deletion on a member asks the register first whose account it is
+  (`knownAccounts`), and is refused while it can't be reached, deleting nothing, a
+  person still anonymous on the member too: the register may have linked them while
+  their becoming identified there failed (the app then gives an anonymous account up
+  all the same, leaving it to the pruning). An account of the register's goes there,
+  which deletes the account and
   keeps a notice for each member in the same transaction (`account_deletion_notice`),
   told at once and again hourly (`deliverDeletionNotices`, tried least first) until each
   confirms; notices to a member no longer named are dropped. An anonymous person goes
@@ -293,11 +297,14 @@ Built on the three parts above, on the register (members forward every step thro
   password, the keys staying. A lost password without it: a mailed code asks, 72 hours
   pass (a mail at the start, a sign-in calls it off), a new code carries it out: new
   password, new keys, no authenticators. A reset takes effect once the owner had 72 hours
-  outside hold-outs (codes waiting, the address's ceiling of proofs filled): each
+  outside hold-outs (codes waiting, the address's ceiling of proofs filled), and 14
+  days after it was asked at the latest, held out or not (`resetWaitsAtMost`): each
   hold-out that begins before it takes effect moves it on by the time it holds the owner
-  out and no hold-out counted before did (`pushOutResets`, `account_resets.dart`, the
-  row's `heldOutUntil`); a reset that took effect and wasn't carried out lapses a week
-  later (`resetLapsesAfter`), and every reset not carried out 30 days after it was asked
+  out and no hold-out counted before did, never past that (`pushOutResets`,
+  `account_resets.dart`, the row's `heldOutUntil`; a refusal at the address's ceiling
+  pushes after it has answered, on a session of its own, so its time tells nothing); a
+  reset that took effect and wasn't carried out lapses a week later
+  (`resetLapsesAfter`), and none outlives 30 days after it was asked
   (`resetLivesAtMost`), both pruned by `forgetLapsedResets`; `SignInWays` tells
   signed-in devices when each waiting reset takes effect, and `password.callOffResets`
   calls them off for the owner's proof.
@@ -325,7 +332,9 @@ Built on the three parts above, on the register (members forward every step thro
   taken by its own clock (the notice carries the register's, `sentAt`, so the clocks'
   offset drops out); a member signing someone in after a reset ends every session of the
   account it holds made before the register's moment or before now, whichever is later,
-  then makes the new one (`issueSessionAfter`), waiting for nothing. The owner's warning of a session ended for its proofs is
+  then makes the new one (`issueSessionAfter`), waiting for nothing, and keeps it when
+  the register's notice of that moment comes, however late (remembered in memory for a
+  day). The owner's warning of a session ended for its proofs is
   dismissed only by a session made since (`signedInBefore`). A refusal for a reset not due says when it takes effect
   (`takesEffectAt`).
 - **Older ways:** an account that signs in with a password (it had a confirmed
@@ -336,8 +345,8 @@ Built on the three parts above, on the register (members forward every step thro
   then) and, 30 days later (`gitHubAccountsKeptAfterEnd`, so a date set wrong can be put
   right first), `forgetGitHubAccounts` deletes every GitHub ID on the register, first
   deleting the accounts that sign in with GitHub alone (no address, never a password),
-  each on its own (one failing is tried again the next day), the members told once
-  after all of them. `password.set` adds an
+  each on its own (one failing is tried again the next day; one deleted whose host step
+  after failed counts as deleted), the members told once after all of them. `password.set` adds an
   address without GitHub only for someone anonymous where the session lives
   (`anonymousHere`, which a member tells the register).