1@README.md
2
3- **The crate's invariants are two folders up**, in
4  `crates/postjevsql-pg/CLAUDE.md`; the wrapper's traps (pg_guard on every
5  callback, no Rust pointer in `custom_private`, `EndCustomScan` not called
6  on error, `rescan` required) are the root `CLAUDE.md`'s *Implementation*
7  §1.
8- **Never let a call reach the per-row function body.** A new place a call
9  can appear needs a hook that wraps it, or `guard.rs` must refuse it; a
10  plan that evaluates a call outside a jev scan would have spent money
11  before the body refuses.
12- **The child plan is built with the jev quals removed** (`take_calls`). A
13  child that kept them would judge rows one at a time, outside any request,
14  in both modes, `ForeignScan` included.
15- **Reach may only widen, never narrow.** A condition that cannot be
16  evaluated twice with the same result (it reads a call's answer, a
17  volatile function, a SubPlan, a `CASE x WHEN` placeholder) is dropped, so
18  the call is judged as before. Keeping such a condition could skip a call
19  Postgres does read.
20- **An EvalPlanQual recheck never sends.** A row version the statement did
21  not judge is refused with 40001 (`Statement::rechecking`); do not give a
22  recheck a client.