Update the public pages to 0.2.3

docs/CONTRACT.md

@@ -1,6 +1,6 @@
 # The surface Nolimit News exposes
 
-<!-- nlnws:version 0.2.2 -->
+<!-- nlnws:version 0.2.3 -->
 
 Everything another plugin, a theme or a site owner can bind to, store against,
 or break by changing. For developers; a site owner never needs to read it.
@@ -114,6 +114,12 @@ The signup form (`admin-post.php?action=nlnws_signup`) answers the same
 whether the address is new, already subscribed, suppressed or throttled, so it
 cannot be used to learn who is on a list. It accepts only lists marked public,
 whatever the request names, and mails one confirmation per address per hour.
+The whole site mails at most 100 confirmations in one clock hour (define
+`NLNWS_CONFIRMATIONS_PER_HOUR` in `wp-config.php` to change it); past that the
+form answers "try again in an hour" for every address and stores nothing, and
+a Nolimit Forms signup is skipped. The confirmation mail greets nobody by name:
+the person filling in the form chooses both the name and the address, so a name
+there would be their text mailed to a stranger from this site.
 
 ### Shortcode
 
@@ -183,6 +189,7 @@ row of this table is gone.
 | `nlnws_auto_update_seeded` | option | That the one-time auto-update offer was made. |
 | `nlnws_release_feed` | transient | The cached release feed. |
 | `nlnws_t_<32 hex>` | transient, one hour | "This address was just mailed a confirmation". The name is a keyed hash of the address, so the address is not written to the options table. |
+| `nlnws_t_hour_<YYYYMMDDHH>` | transient, two hours | How many confirmation mails the site sent in that clock hour (UTC). A count and nothing else. |
 | `nlnws_purge_pending` | WP-Cron event, daily | Deletes a pending membership older than 30 days, and the person too when nothing else is left and they are not suppressed. |
 
 The admin screens store nothing of their own: they read and write the tables
@@ -313,6 +320,7 @@ included. It leaves an ordinary post alone.
 | --- | --- |
 | `NLNWS_VERSION` | The version, equal to the header's. |
 | `NLNWS_COLOUR` | The card colour, `#4a4fc4`, measured 6.55:1 against white. It exists three times, here, as `--nlnws-accent` in `assets/css/admin.css` and as the tile fill in `assets/icon.svg`; the release checks assert all three agree. |
+| `NLNWS_CONFIRMATIONS_PER_HOUR` | Not defined by the plugin. A site may define it in `wp-config.php` to change how many confirmation mails it sends per hour (default 100). |
 | `NLNWS_PLUGIN_FILE`, `NLNWS_PLUGIN_DIR`, `NLNWS_PLUGIN_URL`, `NLNWS_PLUGIN_BASENAME` | Paths, for this plugin's own use. |
 
 ## What a consumer must not do