Community limits on index and docs come from tiers.js

[Apolloccrypt]

The free Community plan was sold on three pages with a number that belongs to a different, retired thing.

10 uploads per hour is ANON_RATE_PER_HOUR, the per-IP ceiling on POST /v2/anon-inbound (relay/relay.js:4300-4312). That endpoint was deprecated on 2026-05-28 and carries Sunset: Wed, 31 Dec 2026. It has never been the limit of a logged-in Community account.

The source of truth

relay/lib/tiers.js, the community row:

dimension	value	enforced at
transfers_month	10	relay/relay.js:4594-4602, 402 monthly_transfer_quota_reached
file_mb	5	relay/relay.js:4550, 413 Max 5MB
signs_month	2	already stated correctly on index.html and sign.html
view_ttl_ms	1 h	already stated as "1 hour link expiry"
max_views	1	already stated as "burn on first read"

Per page

frontend/index.html (ParaSend tier list)

• old: Community · 1 hour link expiry, burn on first read, 10 uploads per hour
• new: Community · 10 transfers a month, 5 MB per file, 1 hour link expiry, burn on first read

frontend/docs.html (FAQ, "How do I get a pgp_ API key?")

• old: Community plan: 10 uploads/hour per IP, 1-hour TTL, burn-on-first-read.
• new: Community plan: 10 transfers a month, 5 MB per file, 1-hour TTL, burn-on-first-read.

frontend/docs/api.md (Authentication)

• old: - `pgp_` prefix — end user key (10 uploads/day free, no account needed)
• new: - `pgp_` prefix, end user key. Community plan: 10 transfers a month, 5 MB per file.

10 uploads/day matched nothing in the code at all, and "no account needed" was wrong too: a pgp_ key comes from /signup.

The pin

tests/site-claims.test.mjs, test 11. It reads transfers_month and file_mb straight out of the community block in tiers.js, asserts the three pages state those numbers, and asserts the relay still enforces them (monthly_transfer_quota_reached, the Max ${...}MB check), so the pages are pinned to a constant that is actually load-bearing. It then scans every public page for any N uploads per hour/day phrasing and fails on it.

Sabotage check, 10 to 20 in index.html:

not ok 11 - the Community plan limits on the site are the ones tiers.js declares
      index: must state "10 transfers a month"

And with the old sentence restored on both pages:

      docs: claims "10 uploads/hour", which is the retired /v2/anon-inbound rate, not a tier limit
      index: claims "10 uploads per hour", which is the retired /v2/anon-inbound rate, not a tier limit

Per-minute claims are deliberately out of scope: frontend/help/iot-integration.html (60/min, API) and frontend/docs/self-hosting.md (10/min, nginx) have their own sources.

pricing.html:249 still says 10 uploads per hour per IP and is excluded from the scan by name, with a comment saying to drop the exclusion once #336 and #339 land. parasign.html and parasend.html were left alone as asked; neither carries the phrase today.

Not touched

pricing.html, parasign.html, parasend.html, the nav generator, every head element.

Tests

links, seo-contract, ui-truthfulness, site-claims (11/11), frontend-loading-contract, csp-inline, cache-bust, eslint, static-sanity (10 green) all pass.