For agents, on top of README.md, which they read first.

• No I/O, no runtime, no Postgres: forbid(unsafe_code) and pure functions only. Time and randomness are passed in.
• The request bytes are the cache key's input: test exact bytes for any serialization change.
• Choice options never pass through a map type that sorts.
• ApiErrorKind::OutOfCredit is inferred (a 402, or a 403 whose message speaks of credit, balance, insufficient funds or quota exceeded); the vendor documents no out-of-credit response. If a real one is ever seen with another shape, fix ApiError::from_response in src/error.rs and correct jevsnes research/jev-api-digest.md §10 in the same commit.