1@README.md
2
3## Notes for agents
4
5- Handlers hold no state and read no request header. Do not read `cf-connecting-ip` or any
6  client-identifying header, and do not add a cookie.
7- `public/` is generated working state and carries no docs (documentation rule, carve-out 1).
8- A new route needs a `log::Route` entry, and nothing the visitor typed may reach a log line.
9- The `/tick` interval and signals are described in `src/view.rs`'s page; the server decides the
10  choreography (`site::demo`). Do not move that logic into JavaScript.
11- Every response carries the CSP (`font-src 'self'` is for `jev-ui`'s fonts); a new kind of load needs its own directive and a test.
12- Do not run `wrangler deploy`, `wrangler login` or `wrangler secret`.
13- `/preview/loop.mp4` must stay in `run_worker_first` and the `[assets]` block must keep `binding = "ASSETS"`
14  (`src/media.rs` reads the file through it); without them a player's `Range` request gets a whole
15  `200` again. Range parsing is `site::range::select`, pure and tested; do not hand-parse `Range` in the Worker.
16- The canonical address is `SITE_ORIGIN` (the deploy passes it; `config::SITE_ORIGIN` is the default). A request to any other
17  host that is not local is sent there with a `308` (GET/HEAD) or told `405` (`site::host`, called first in `fetch`). A
18  request a page made for itself (`Sec-Fetch-Mode` not `navigate`: Datastar's POSTs, the scripts, styles, fonts) is
19  answered where it arrives, so a page open on an old address finishes. The old address is not named in any tracked file:
20  "elsewhere" is derived. `/preview/*` runs the Worker first so the PNG can be sent on too; on the canonical host
21  `image` in `lib.rs` hands it to the assets.
22- Local check of a host: `wrangler dev --local --host <host> --port N --var SITE_ORIGIN:https://whiskers.lmjtfy.fun`, one
23  server per host (a `Host` header on a request is overwritten by the dev server, as in `~/lmjtfy/tools/check-hosts`).