For agents, on top of README.md, which they read first.

• No I/O, no runtime, no Postgres: forbid(unsafe_code) and pure functions only. Time and randomness are passed in.
• The request bytes are the cache key's input: test exact bytes for any serialization change.
• Choice options never pass through a map type that sorts.