rust

Use typed errors derived with thiserror where callers need to inspect or recover from failures, and anyhow with context at I/O boundaries in executables. Never use unwrap or expect for recoverable conditions in request paths, and convert infrastructure errors before they cross transport boundaries.

A common starter stack is Axum with Tower for HTTP, Tokio as the single async runtime, SQLx for SQL-first database access, serde for DTOs, and tracing for structured logging. Prefer the repository's existing choices like Actix, Diesel, or SeaORM when they are already in use.

Treat cancellation as possible at every .await point and give long-lived tasks an explicit owner and lifecycle policy. Dropping a JoinHandle detaches rather than cancels the task, so retain handles, propagate shutdown signals, and verify that dropping a future in select! or timeout is safe.

Use unsafe only with a concrete payoff, minimize and encapsulate it, and document public unsafe APIs with a # Safety contract plus a local // SAFETY: comment per block. A safe API must check preconditions in every build since debug_assert cannot uphold memory-safety contracts.

Commit Cargo.lock for applications and shipped workspace artifacts; reusable libraries may commit it for CI reproducibility or omit it since downstream consumers ignore it. Use --locked where a committed lockfile defines the build.

Format touched files with the repository's cargo fmt setup, run affected tests and CI-equivalent Clippy checks, and run doctests when documented behavior changes. For public API or MSRV changes, derive the full matrix from CI including feature combinations, targets, and the declared rust-version.