feat: documents and session tokens

spec/08-fidelity.md

@@ -91,7 +91,7 @@ It is valid when its signature verifies and its signer is the revoked receipt's
 
 The roster, `scienting-roster/1`, lists the keys that may sign: each with an `id`, a `person`, a `scheme`, its `public` key (Base64 for Ed25519), its `purposes` (`sign`, `spot-check`, `export`), `registered_at` and `revoked_at`.
 A package MAY carry the roster its receipts need as `roster.json`, so its receipts verify without the store.
-The roster is meant to match the one Lode already verifies; aligning the two is recorded in [DECISIONS.md](../DECISIONS.md).
+The roster is meant to be the same one Lode verifies; see the [rationale](../docs/rationale.md#limits-worth-knowing).
 
 ## 8.8 Spot-checks
 
@@ -109,7 +109,7 @@ Anyone can recompute the sample; `spotcheck.jsonl` does.
 
 ## 8.9 Reviewer error bounds
 
-One sample proves little; what a buyer wants is a bound on each reviewer's error rate across all their samples.
+One sample proves little; what someone relying on the work needs is a bound on each reviewer's error rate across all their samples.
 With *k* errors in *n* sampled nodes, the bound is the one-sided Clopper–Pearson upper confidence bound at confidence *c*, by default 0.95: the rate *p* at which the probability of at most *k* errors in *n* is 1 − *c*, or 1 when *k* = *n*.
 It is reported to six decimal places, rounded up.
 With no errors the bound is about 3/*n*, so zero errors in 300 sampled nodes bounds a rate below 1%; `bounds.jsonl` gives cases.