Copilot instructions

1---
2description: "Review guidance for Rust changes"
3applyTo: "**/*.rs"
4excludeAgent: "coding-agent"
5---
6 
7# Rust Review Rules
8 
9This workspace uses **Rust edition 2024** on nightly, with `clippy` (warnings denied) and `rustfmt` in CI. All merged and pushed code compiles. These are Rust semantics that past reviews have repeatedly gotten wrong — do not flag any of the following as errors:
10 
11## Language semantics reviewers commonly get wrong
12 
13- **Edition 2024 prelude**: `Future` and `IntoFuture` are in the prelude. Do not claim they (or other prelude items) are missing imports.
14- Functional record update (`Self { ..*self }` through `&self`) does NOT require the struct to be `Copy`. It moves/copies field-by-field; it compiles whenever every remaining field is `Copy`.
15- `==` desugars to `PartialEq::eq(&a, &b)` — comparing fields through a reference moves nothing. Likewise, matching on a non-`Copy` field by value is fine when the patterns only bind `Copy` data or wildcards.
16- Partially moving one field while borrowing a different field of the same local is accepted — the borrow checker tracks fields independently.
17- A trait impl may return a longer lifetime than the trait declares (e.g. `&'static str` for `fn as_str(&self) -> &str`) — impl signatures are checked with subtyping.
18- Adapters that take `self` by value (e.g. `Rng::sample_iter`) work on immutable bindings. Check whether a method takes `self`, `&self`, or `&mut self` before claiming a binding must be `mut`.
19- The standard library implements arithmetic between integers and `NonZero` types (e.g. `usize / NonZero<usize>`).
20- Block expressions in statement position (`unsafe { ... }`, `if`, `match`, `loop`) do NOT need a trailing semicolon.
21- `str::strip_prefix`, `trim_matches`, and friends accept any `Pattern`, which includes `char` arrays/slices like `['n', 'N']`.
22 
23If a comment of yours depends on the borrow checker, trait resolution, or the prelude rejecting code that is sitting in the diff with green CI, the comment is wrong — discard it.
24 
25## Project conventions
26 
27- Error handling uses `error-stack` (`Report`, `ReportSink`, `.change_context()`); suggest alternatives only within that framework.
28- Doc comments use intra-doc links; only flag a doc link if it points at a genuinely different item than the one being documented, not a re-export or moved path.
29- Prefer suggesting `cargo` tooling the repo uses: `cargo nextest run --package <name>`, `cargo clippy --all-features --package <name>`.
30 
31## What is worth flagging in Rust code here
32 
33- SQL built in Rust: missing `WHERE` conditions (e.g. draft/permission filters), missing `ORDER BY` when order feeds a deterministic contract, mispaired `unnest` arrays.
34- Serialization boundaries: values that serialize successfully in tests but fail on real data (e.g. `serde_json` rejects `NaN`/infinite floats), error types whose serialized form leaks internal or user data to clients.
35- Authorization: code paths that could return or leak data the actor cannot view.
36- Unbounded allocation or CPU driven by user-controlled request parameters.
37- Panics reachable from request handlers (`unwrap`, `expect`, indexing) on untrusted input.
38