1@README.md
2
3- **Every `unsafe` block carries a `// SAFETY:` naming the Postgres
4  invariant it relies on.**
5- **Sockets must `executor::deregister` before closing:** a closed fd
6  reaching `AddWaitEventToSet` is an ERROR.
7- **Task slots are Vacant/Running/Waiting.** A spawn during a poll must
8  never take the running task's slot; that bug once silently dropped
9  hyper's h2 driver.
10- **Never hold a RefCell borrow across an `.await`;** an ERROR can unwind
11  from any wait.
12- **In the scan, evaluate expressions only through `ScanTuple::eval`.**
13  They are compiled for the node's virtual scan slot, which is never
14  deformed; pointing `ecxt_scantuple` at another slot segfaulted in
15  `to_json` over a Sort.
16- **Tasks that belong to a scan are spawned in its `executor::Scope`.** The
17  (sub)transaction abort callback drops them before the flush, because the
18  scan state itself is freed only later, with the query's memory.
19- **No tokio, no threads, no signal handlers** in anything this crate pulls
20  in (root `CLAUDE.md` §2, "Traps"). A dependency that brings a runtime or
21  `spawn_blocking` (reqwest, hyper-util's default resolver, hickory's
22  `tokio` feature) is a regression even if every test passes.