docs(auth): the owner's warning when ten wrong proofs end a session (ADR 0017)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

docs/adr/0017-password-totp-and-keys.md

@@ -416,8 +416,18 @@ authenticator. What was done (`18ab2ee`, `f3c8706`, `403b88c`):
    proofs are.
 3. **Lows**: a proof whose call to the register failed (`RegisterUnavailableException`)
    stays counted, as the register may have checked it; the sign-up mail's subject says it
-   also gives an account its password. A notice for the owner when ten wrong proofs end a
-   session is still to come (NEXT.md).
+   also gives an account its password.
+4. **The owner is warned when ten wrong proofs end a session** (`b096cb0`, `a177a8f`):
+   someone with a session of theirs tried their password or codes. The register keeps
+   the moment with the account's password (`account_password.sessionEndedForProofsAt`,
+   a nullable column), set where the session ends (a member tells the register; one out
+   of reach leaves the owner unwarned, the session ended all the same). The account's
+   sign-in ways and its next password sign-in carry it: the app shows it before the
+   sign-in is put in place (dismissed, or kept for later) and in the account section
+   above the change of password. It names when, nothing of the session or its device.
+   Dismissing takes the session alone (`password.dismissSessionEndedWarning`): it hides
+   a warning and secures nothing. A new password clears it, as does deleting the person.
+   An owner who stays signed in sees it only in the account section.
 
 ### The rules as they stand (21 Oct 2026)
 
@@ -442,7 +452,8 @@ sign-ins' codes per account (waits from ten wrong in a row, the owner mailed).
 | Delete the account | — | password + code; where no second factor works, password + mailed code (`deletion`) |
 
 Every reset carried out, and every new password, ends the account's sessions in every
-service (a change keeps the session asking).
+service (a change keeps the session asking). A session ended for ten wrong proofs leaves
+its owner a warning; dismissing it takes the session alone, and a new password clears it.
 
 ## Consequences
 

packages/halkyon_base_server/README.md

@@ -244,7 +244,13 @@ Built on the three parts above, on the register (members forward every step thro
   checked; the tenth wrong in a row ends the session (`sessionEnded`), only a proof
   accepted clears the count, and a try that checked none is taken back. Never toward the
   account's waits, nor waiting for them: whoever knows the password holds no signed-in
-  owner out of changing it, and a new password forgets those waits.
+  owner out of changing it, and a new password forgets those waits. A session ended so
+  warns its owner: the register keeps the moment (`account_password`'s
+  `sessionEndedForProofsAt`; a member's ended session tells it through
+  `noteSessionEndedForProofs`, a register out of reach leaving the owner unwarned), which
+  `account.signInWays` and the next `passwordSignIn.complete` carry until the owner
+  dismisses it (`password.dismissSessionEndedWarning`, the session alone: it hides a
+  warning) or sets a new password.
 - **Authenticators:** a secret made on the register, shown once as an `otpauth://` URI
   (issuer: the account domain); confirmed by a code from it and the owner's proof, so a
   session alone adds no second factor: while the account has a confirmed one, the