docs(adr): ADR 0021, D31: once approved, the person signs in once more

The wait screen says the account is approved and leads to the usual
sign-in, which opens the keys and sets up the authenticator: a pass is
never worth a session. The pass deletes only a new account that was never
approved; a suspended one keeps its data, and deleting it takes its
owner's password and a code, as ADR 0017 has every deletion.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

docs/adr/0021-private-instance-and-assistant.md

@@ -183,9 +183,15 @@ On 25 Oct, how the first step is built (sign-ups and operators):
   session on every service is made in one place (`issueSession`), which refuses while
   the account waits and hands the device a waiting pass instead (a random secret, kept as
   its hash) with the matching code. The pass opens only the wait screen's calls: whether
-  the account still waits (and, once approved, its session, taking the pass), deleting
-  the account, and forgetting the pass. A member asks the register before it makes a
-  session, as it asks everything else about accounts (ADR 0016).
+  the account still waits, deleting the account, and forgetting the pass. Once approved,
+  the wait screen says so, the pass going with that answer, and the person signs in once
+  more as they did before (the developer's choice, recommended, over the pass handing
+  over a session): that sign-in opens the keys and, after a password's sign-up, sets up
+  the authenticator as every sign-in does, and a pass is never worth a session. The pass
+  deletes only a new account that was never approved: a suspended one keeps its data,
+  and deleting it takes its owner's password and a code, as ADR 0017 has every deletion.
+  A pass holds 30 days, at most five per account. A member asks the register before it
+  makes a session, as it asks everything else about accounts (ADR 0016).
 - **D32 The operator role is a scope**, `operator`, on the account and its sessions, as
   `identified` is (recommended, over a table of operators): every operator's call requires
   it (`requiredScopes`). The first operator, once signed up, is made by two statements on
@@ -228,8 +234,8 @@ On 25 Oct, how the first step is built (sign-ups and operators):
    named in the app (D21); an operator approves, refuses and suspends accounts (D22),
    grants assistants with their limits, and sees everyone's figures, never content.
 3. **Waiting accounts** (D1): after signing up (SimpleLogin, handle, keys: ADR 0020), an
-   account waits. Its sessions can only see that they wait, or delete the account;
-   nothing syncs and nothing uploads (D23). The operator sees who waits in the app (the
+   account waits. It gets no session, only a pass for its wait screen, which sees that it
+   waits or deletes the account (D31); nothing syncs and nothing uploads (D23). The operator sees who waits in the app (the
    handle, when they signed up, which is all the instance knows, and the matching code of
    D24) and approves or refuses; a refusal deletes the account. Unapproved after 14 days, it is deleted. At most 10
    waiting at once, and sign-ups per network limited as today's, so strangers can't flood