README and docs: experimental, not an alpha

README.md

@@ -1,5 +1,14 @@
 # OpenClapper
 
-OpenClapper is in early alpha and still under development. You can already try to self-host it if you want ([self-hosting](docs/self-hosting.md)), but for now I can't guarantee that anything works properly or that the docs are up to date.
+An open-source way to organise film productions, built together with the people who do the job.
+The project, its plan and the two forms that start it are on [openclapper.org](https://openclapper.org).
+
+**What is in this repository is experimental.** It is the maintainer's own tooling for his hobby
+shoots, shaped by one person's projects; it is not a release, and it is not what the industry needs.
+The proper alpha gets defined with the community first (the plan on the page), and is built from that.
+
+The [docs](docs/README.md) describe what the code does today. [Self-hosting](docs/self-hosting.md)
+explains how to run it on your own Cloudflare account, for the curious, without any promise that things
+work or stay compatible: during the experimental phase anything may change or break.
 
 Open source under the [Apache License 2.0](LICENSE).

docs/features/accounts.md

@@ -4,7 +4,7 @@ Epic [#107](https://github.com/OpenClapper-dev/core/issues/107). OpenClapper has
 
 ## Accounts
 
-- **Sign-in** is email + password (`apps/worker/src/authn/`). There is no sign-up during the alpha: `#/register` says so. Accounts are made by an administrator: the admin board (#116), or `node scripts/user.mjs --email … [--remote]` ([development](../development.md)).
+- **Sign-in** is email + password (`apps/worker/src/authn/`). There is no sign-up for now: `#/register` says so. Accounts are made by an administrator: the admin board (#116), or `node scripts/user.mjs --email … [--remote]` ([development](../development.md)).
 - **Sessions** are opaque tokens, stored hashed. The Studio keeps its session in an HttpOnly cookie for 30 days; the phone keeps a bearer token for 180 days. Both slide while in use. A session that ends (it expires, or the account is blocked or signed out elsewhere) shows the sign-in page at the next request.
 - The message for an unknown email and for a wrong password is the same, and both cost the same time. There is **no brute-force limit** (#224): the account lockout was dropped (anyone could lock an account out with it, and its 429 told a guesser the email exists). Rate limiting by IP and email comes with the sign-in revamp before the app opens up to users; `users.failed_logins` and `locked_until` stay in the schema, unused.
 - **Changing one's password** (#148): Settings › Account in the Studio, Setup › Account › Change password on the phone. The current password, then the new one twice (at least 10 characters, the same rule as everywhere). A wrong current password is refused (403). Every other session of the account ends; the one that changed it stays signed in. Only an administrator can change an account's email or name (admin board › Edit).

docs/releasing.md

@@ -5,7 +5,7 @@
 OpenClapper has **one version for the whole product**: the Worker and the Studio deploy together, the admin plane reads the same database, and the phone talks to that API. Nothing is published as a separate library. The workspace packages (`apps/*`, `packages/*`) are private and stay at `0.0.0`.
 
 - **Source**: the `version` of the root `package.json`, and nothing else.
-- **SemVer, `0.x` during the alpha**:
+- **SemVer, `0.x` while experimental and through the alpha**:
   - a minor bump (`0.2.0`) for new features and anything that changes behaviour or data in a way a deployment or a phone has to follow;
   - a patch (`0.1.1`) for fixes only.
   - `1.0.0` will mean "stable".

docs/self-hosting.md

@@ -1,6 +1,6 @@
 # Self-hosting
 
-OpenClapper runs entirely on your own Cloudflare account: one Worker serves the API and the Studio, a second one the admin plane, D1 holds the data, R2 the photos. Nothing calls home, and nothing is shared between instances. You pay Cloudflare for what you use (the free plan goes a long way for a crew, see [the free plan](#the-free-plan)).
+OpenClapper runs entirely on your own Cloudflare account: one Worker serves the API and the Studio, a second one the admin plane, D1 holds the data, R2 the photos. Nothing calls home, and nothing is shared between instances. You pay Cloudflare for what you use: storage for the photos is what costs, compute stays small (one setting matters on the free plan, see [the free plan](#the-free-plan)).
 
 OpenClapper is open source under the [Apache License 2.0](../LICENSE): you may run instances for yourself, your crew, your company or anyone else, and offer them as a service. Keep the licence and the [NOTICE](../NOTICE) with your copy. If you offer an instance to others, give it a name of your own: the licence does not cover the project's name.
 
@@ -143,7 +143,7 @@ Google Play delivers the app instead of sideloading, starting with the **interna
 
 ## The free plan
 
-The Workers free plan allows 10 ms of CPU per request. Checking a password with 100 000 PBKDF2 iterations takes about 16 ms, so a sign-in may fail there. Set `PBKDF2_ITERATIONS` lower, e.g. `50000`; stored passwords are rehashed to the new count on their next sign-in. Everything else stays well within the free limits for a small crew.
+The Workers free plan allows 10 ms of CPU per request. Checking a password with 100 000 PBKDF2 iterations takes about 16 ms, so a sign-in may fail there. Set `PBKDF2_ITERATIONS` lower, e.g. `50000`; stored passwords are rehashed to the new count on their next sign-in. How far the free plan reaches beyond that depends on your photos: storage is the one cost that grows.
 
 ## Your own sign-in