diff --git a/README.md b/README.md
index 23a0953..f6391ca 100644
--- a/README.md
+++ b/README.md
@@ -6,14 +6,16 @@
 
 nova-cache implements the Nix binary cache protocol in Haskell: nix-base32,
 NAR serialization (whole-tree and streaming), narinfo parsing, store paths,
-Ed25519 signing and upload validation, and an optional WAI cache server.
+Ed25519 signing and upload validation, a WAI application for a cache server,
+and an optional server executable.
 Bounded xz, zstd and bzip2 codecs are the public `nova-cache:xz`,
 `nova-cache:zstandard` and `nova-cache:bzip2` sublibraries, and the zstd codec
 also compresses for uploads.
 
-Parsing, formatting, hashing, signing and validation are pure. Reading and
-writing trees, hashing files, the codecs, the store and the server run in
-`IO`. nova-cache is the protocol layer under
+Parsing, formatting, hashing, signing, validation, one-shot xz decompression
+and zstd compression are pure. Reading and writing trees, hashing files, the
+streaming codecs, zstd and bzip2 decompression, the store and the server run
+in `IO`. nova-cache is the protocol layer under
 [nova-nix](https://github.com/Novavero-AI/nova-nix).
 
 ## Installation
@@ -50,7 +52,8 @@ import NovaCache.Signing (parseSecretKey, sign)
 -- Parse a narinfo and sign it
 case (parseNarInfo raw, parseSecretKey "mykey:base64...") of
   (Right ni, Right sk) -> print (sign sk ni)  -- Right "mykey:<base64 sig>"
-  _                    -> error "parse failed"
+  (Left err, _)        -> putStrLn err
+  (_, Left err)        -> putStrLn err
 ```
 
 ```haskell
@@ -83,9 +86,12 @@ narHash <- withNarSource defaultCaseHack path $ \pull ->
 ## Server
 
 ```bash
-cabal run --flag server nova-cache-server -- --port 5000 --store ./nix-cache
+CACHE_API_KEY=change-me cabal run --flag server nova-cache-server -- --port 5000 --store ./nix-cache
 ```
 
+Without `CACHE_API_KEY` the server refuses to start. `--allow-open-writes` runs
+it with unauthenticated writes, for local testing only.
+
 The protocol lives in the `NovaCache.Server` library module as a WAI
 `Application`, so the cache can be embedded in another server with its own
 root page. The bundled executable is one such embedding.
@@ -164,7 +170,7 @@ Tested with GHC 9.14.1. CI uses the latest cabal-install release.
 ```bash
 cabal update
 cabal build all -f server --enable-tests --ghc-options="-Werror"
-cabal test -f server --ghc-options="-Werror"
+cabal test -f server --enable-tests --ghc-options="-Werror"
 ```
 
 ## License
diff --git a/changelog.d/readme-current.md b/changelog.d/readme-current.md
new file mode 100644
index 0000000..eb776ce
--- /dev/null
+++ b/changelog.d/readme-current.md
@@ -0,0 +1 @@
+- **The README in the package describes 0.12: its version bounds, the server's required `CACHE_API_KEY`, and which codecs are pure.** The README in the 0.12.0.0 tarball, the one Hackage shows, gave bounds that exclude 0.12 itself and a server command that exits at once, since the server refuses to start without `CACHE_API_KEY` unless given `--allow-open-writes`. It also called the WAI server optional, where `NovaCache.Server` is always part of the library and only the executable sits behind `-f server`, and counted one-shot xz decompression and zstd compression among the `IO` operations, where both are pure. The test command now passes `--enable-tests`, as CI's does.
diff --git a/nova-cache.cabal b/nova-cache.cabal
index 370fd16..2110409 100644
--- a/nova-cache.cabal
+++ b/nova-cache.cabal
@@ -84,13 +84,11 @@ library
     -Wincomplete-record-updates
     -Wincomplete-uni-patterns
 
--- The bounded xz decoder as a solver-visible opt-in: a consumer that
--- substitutes foreign caches writes build-depends: nova-cache:xz and
--- gets the module; everyone else never builds the xz package's
--- bundled liblzma.  This replaces the manual xz flag - a dependency's flag
--- cannot be set from a consumer's .cabal file, which forced mirror
--- flags and matching constraints downstream (nova-nix#27) - while
--- keeping the 0.5.0.0 lesson: xz stays out of the default install.
+-- The bounded xz decoder as a public sublibrary: a consumer that
+-- substitutes from xz caches depends on nova-cache:xz, and nobody else
+-- builds the xz package's bundled liblzma.  A sublibrary rather than a
+-- flag, because a dependency's flag cannot be set from a consumer's
+-- .cabal file.
 library xz
   visibility:       public
   exposed-modules:  NovaCache.Xz