# Documenter — F-005 Identity: register, login, sessions

done -> work/artifacts/F-005/documenter.md

## Docs updated
- `project/README.md`:
  - Configuration: `COOKIE_SECURE` documented (default true).
  - HTTP contract: auth error codes (`INVALID_CREDENTIALS` 401,
    `EMAIL_ALREADY_REGISTERED` 409, `TOO_MANY_ATTEMPTS` 429 + Retry-After).
  - New "Authentication (identity module)" section: endpoints table, argon2id,
    opaque-token sessions (DB stores only SHA-256 hash), cookie flags,
    anti-enumeration + rate-limit behavior, pool-gated wiring.
  - Layout: modules list now shows health/flags/identity; infrastructure mentions
    db pool + config + logging; shared mentions input parsing.
- `spec/tech.md`: argon2 + @fastify/cookie justified (F-005 row).
- `project/.env.example`: `COOKIE_SECURE=false` with local-dev comment.

## Specs (source of truth for this ticket)
- specs/F-005-identity/SPEC.md, DESIGN.md, TASKS.md, TESTS.md

## Evidence trail
- work/artifacts/F-005/: architect.md, implementer.md, reviewer.json, security.json, qa.json