1@README.md
2
3## Notes for agents
4
5**When `pnpm-lock.yaml` changes** (for example after rebasing onto newer Strudel), the pnpm `hash` goes stale: set it to `lib.fakeHash`, build `.#site`, and paste the hash it reports.
6
7**Keep the devshell free of the built site.** Anything in `devShells.default` that depends on `site` makes every `nix develop` (and direnv reload) rebuild the whole website first; the old Python server did, until 2026-09-24.
8
9**`worker` is copied from pnpm's layout, not produced by `pnpm deploy`.** In pnpm 10, `pnpm deploy` needs `injectWorkspacePackages` (which would change how every workspace package links in dev) or `--legacy`, which re-resolves every workspace package's dependencies from the registry and fails offline in the sandbox (tried 2026-09-25: `ERR_PNPM_NO_OFFLINE_META` for `@tonaljs/tonal`, a dependency of a package the Worker does not use). `worker-closure.mjs` follows the relative symlinks from `worker/node_modules` instead and copies those `.pnpm` entries only (25 for `@simplewebauthn/server`).