v0.26.5 minor doc update and code cleanup

doc/README.md

@@ -30,8 +30,7 @@ streams, or downstream LogWisp nodes.
 - [CLI](cli.md): flags, signals, exit codes, `lw auth`; also the `lw(1)`
   manual, [`lw.1`](lw.1)
 - [Operations](operations.md): running, monitoring, tuning, troubleshooting
-- [To Do](todo.md): planned work in priority order: packaging, smaller
-  follow-ups
+- [To Do](todo.md): planned work: packaging
 
 A fully annotated configuration covering every option lives at
 [`config/logwisp.toml`](../config/logwisp.toml).

doc/security.md

@@ -446,7 +446,10 @@ A listener needs no certificate files. With `self_signed = true`, or with
 `issuer_cert_file` and `issuer_key_file`, it makes an ECDSA P-256 key once per
 process and, at startup and every reload, a certificate for it valid 397 days
 (never past the issuer), for `hosts`, its `host` (unless a wildcard),
-`os.Hostname()`, `localhost`, `127.0.0.1` and `::1`.
+`os.Hostname()`, `localhost`, `127.0.0.1` and `::1`. Every such listener of
+one process shares that key, self-signed or issued, so one pin matches them
+all; a dialer that must tell two apart verifies by name with `ca_file`, or
+the listeners use `cert_file`.
 
 - **Self-signed.** No CA can vouch for it, so dialers pin its key:
   `pin_sha256`, which the listener logs at WARN on every start. A reload
@@ -461,8 +464,9 @@ process and, at startup and every reload, a certificate for it valid 397 days
 - **Pins.** A pin is the SHA-256 of the server's public key, not of its
   certificate, so it survives reissue. `pin_sha256` accepts several, `;`
   between them, for a rotation. It replaces chain, name and validity checks:
-  whoever holds the key is the server. `scram` dialers still bind every login
-  to that certificate.
+  whoever holds the key is the server. A pinned dialer never resumes a TLS
+  session, so every connection checks the pins, and a pin a reload drops
+  holds at once. `scram` dialers still bind every login to that certificate.
 
 ```bash
 lw tls ca --dir /etc/logwisp/pki                       # ca.crt, ca.key (0600)

doc/todo.md

@@ -60,14 +60,3 @@ identity, and both skeletons download the tagged source.
 5. Shell completion for bash, zsh and fish, installed by `make install`.
 6. A packaging CI job: build the AUR package in an Arch container and the port
    in a FreeBSD VM, run `lw --version` and `make image-check`.
-
-## 2. Follow-ups
-
-Smaller items found along the way, each independent of the others.
-
-1. TLS: the generated-certificate key is one per process, so a pin taken from a
-   `self_signed` listener also matches an `issuer` listener of the same
-   process; document it or key per listener. Pins are checked in
-   `VerifyPeerCertificate`, which Go skips on resumption: guard it if a dialer
-   ever keeps a `ClientSessionCache`.
-2. `core.ShutdownTimeout` is unused.