For agents, on top of README.md, which they read first.

Notes for agents

Every widening has a name and none is a string. A policy cannot be written with * or a whole scheme; allow_origin returns an error. Do not add a method that takes raw policy text.

'unsafe-eval' is Datastar's, not the site's. It is the one concession the framework makes for itself (for_datastar). Whether a build of Datastar exists that needs none is an open item in the brain's Aldebaran crate map.

The headers are lower-case names and plain strings so each adapter converts them once (http::HeaderName::from_static, Worker headers).