For agents, on top of README.md, which they read first.

• Policy only: no I/O, no runtime, forbid(unsafe_code).
• New retry or error behaviour gets a virtual-time test in src/client/tests.rs first; they are exact and instant.
• nothing_billed is what a spend guard trusts to release a hold. Widen it only for a failure that provably reached no server.