For agents, on top of README.md, which they read first.

• Majors are listed once, in PG_MAJORS in build/defs.bzl. The constraint values, the platforms, the test twins, the Cargo features and the nix package sets all derive from it; never write a major here.
• The remote cache stays opt-in. remote_cache is false unless the machine's own buckconfig sets [buildbuddy] cache = true; the repository must build with no cache and no credentials anywhere else.
• execution.bzl is kept identical across the estate's buck2 repos on purpose; change it everywhere or nowhere.