SPEC: false statements fixed, repeats removed, dropped requirements restored

The bounds sentence, the blocklist URL sentence, the deny list sentence,
the limit action's scope and the observe mode sentence now say what the
code does. Each of the twenty-one requirements the fourth review found
twice is stated once, with a link from the other place. The request id
header, redirect_uri's case, change 4's reason and the live archive's
InRelease files are back. The biased thresholds are defined where they
are introduced. The docs files apply the fifth README review's findings
and stay identical to the README branch.

Model: fable-5-1

docs/settings.md

@@ -2,8 +2,7 @@
 
 Every setting, its default and the values it takes, in the groups of "Settings"
 in [`SPEC.md`](../SPEC.md). That section gives the conventions, the settings
-that take `off`, the `_FILE` form, and what each group does and why. A setting
-set to a value its entry does not allow stops the start.
+that take `off`, the `_FILE` form, and what each group does and why.
 
 ## Forms of values
 
@@ -27,8 +26,9 @@ set to a value its entry does not allow stops the start.
 
 - `SWWAF_UPSTREAM_URL` (default `http://127.0.0.1:8081`): the app. An `http` or
   `https` URL with a host and an optional port, and nothing more.
-- `SWWAF_LISTEN_ADDR` (default `:8080`): where `smallwebwaf` listens, an
-  optional host and a port. The host stays empty.
+- `SWWAF_LISTEN_ADDR` (default `:8080`): where `smallwebwaf` listens: `:` and a
+  port, such as `:9000`. Leave the host out (see "Ports" in
+  [`SPEC.md`](../SPEC.md)).
 - `SWWAF_INSTANCE_NAME` (default: the container's host name): the `instance`
   name in every log line, alert and metric, such as `fsn1app1/gitea`. Valid
   UTF-8. No control character while `SWWAF_ALERT_NTFY_URL` is set. 1 to 48
@@ -42,8 +42,8 @@ set to a value its entry does not allow stops the start.
   client's group, from 32 to 128.
 - `SWWAF_MAX_TRACKED_CLIENTS` (default `20000`): the most clients kept, a whole
   number above zero.
-- `SWWAF_MAX_BANS` (default `5000`): the most bans `smallwebwaf` made that are
-  kept, a whole number above zero.
+- `SWWAF_MAX_BANS` (default `5000`): how many of its own bans `smallwebwaf`
+  keeps, a whole number above zero.
 
 ## Tokens
 
@@ -90,8 +90,9 @@ set to a value its entry does not allow stops the start.
 
 ## Static lists
 
-- `SWWAF_ALLOW_NETS` (default empty): netblocks whose clients are refused only
-  for a size or time limit or a missing or wrong token, such as your monitoring.
+- `SWWAF_ALLOW_NETS` (default empty): netblocks you trust, such as your
+  monitoring. Their clients are refused only for a size or time limit or a
+  missing or wrong token.
 - `SWWAF_RATE_LIMIT_EXEMPT_NETS` (default empty): netblocks whose clients are
   exempt from rate limiting and the byte limits.
 - `SWWAF_DENY_NETS` (default empty): netblocks whose clients are always refused.
@@ -150,7 +151,7 @@ set to a value its entry does not allow stops the start.
   such as `cn,ru,kp`.
 - `SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES` (default empty): when set, the only
   countries whose clients get through, such as `us,de`. A country on both lists
-  is refused.
+  stops the start.
 
 ## Biased thresholds
 
@@ -164,8 +165,8 @@ set to a value its entry does not allow stops the start.
 - `SWWAF_UNKNOWN_LIMIT_PERCENT` (default `100`): the percentage for a client the
   lookup cannot place.
 - `SWWAF_ASN_LIMIT_PERCENT_URL` (default unset): the `http` or `https` URL of a
-  text file of `AS<number>:<percent>` lines, one to a line. A URL that is also
-  in `SWWAF_BLOCKLIST_URLS` is refused.
+  text file with one AS number and percentage on each line, such as
+  `AS64496:50`. A URL that is also in `SWWAF_BLOCKLIST_URLS` is refused.
 
 ## Attack detection
 
@@ -260,8 +261,8 @@ set to a value its entry does not allow stops the start.
   `ban,permanent_ban,waf_block,anomaly,reputation_hit,source_failure,file_error`):
   the event types alerts are sent for, from those in [`alerts.md`](alerts.md)
   but `summary`. Any other name is refused.
-- `SWWAF_ALERT_COOLDOWN` (default `15m`): how long a repeat of an alert is held
-  back. A duration or `off`.
+- `SWWAF_ALERT_COOLDOWN` (default `15m`): how long after an alert is sent its
+  repeats are held back. A duration or `off`.
 - `SWWAF_ALERT_MAX_PER_HOUR` (default `60`): the most alerts sent in an hour. A
   whole number above zero, or `off`.
 
@@ -294,10 +295,8 @@ as `REQUESTS_PER_MINUTE`:
 
 ## Settings given as files
 
-Add `_FILE` to a setting's name to read its value from a file:
-`SWWAF_METRICS_TOKEN_FILE` names the file that holds `SWWAF_METRICS_TOKEN`. To
-keep a token from the app, make the file on the host, owned by uid 65532 with
-mode `0400`:
+To give a token as a file, as "Tokens" under "Deployment" in
+[`SPEC.md`](../SPEC.md) describes, make the file on the host:
 
 ```sh
 mkdir -p /srv/app/tokens
@@ -306,7 +305,7 @@ chown 65532:65532 /srv/app/tokens/metrics
 chmod 0400 /srv/app/tokens/metrics
 ```
 
-Mount its directory into the container read-only, and name the file:
+Then mount its directory into the container read-only, and name the file:
 
 ```sh
 docker run \