The Review Checklist

The course in one printable page. Work top to bottom. Each line is about a 30-second check.

Signatures first

• Parameter ownership honest? &str to read, String to keep, &mut rare and deliberate.
• Fallibility honest? Result where failure exists; a -> T that can panic does so only on documented invariant violations, never on input; Option only where absence is normal.
• Receivers meaningful? self by value for transitions, &self for observation, interior mutability justified.
• Any <'a> in a pub signature: who decided it, and where is the decision written down? A boundary-crossing lifetime with no named exception (view type with owned twin, iterator, guard, measured zero-copy) is a red flag.

Types second

• Closed sets modeled as enums, not strings or flag sets. Count the bools and Options; check whether they are one state machine.
• Validated values as newtypes with fallible constructors. Parse at the boundary; the type carries the proof.
• Quantities carry units. IDs aren’t bare primitives.
• Costly wrong-state calls prevented by construction (typestate) where the state graph is small and stable.
• Paired manual calls (begin/end, acquire/release) replaced by guards with Drop.

Errors third

• One convention per crate: libraries enumerate their errors in dedicated enums, applications aggregate into one opaque error with context. A mix of conventions is a finding on its own.
• Context attached at boundaries; the chain reads causally.
• unwrap/expect only on invariants, each with a message saying why it’s unreachable. Never where input arrives.

Smells last (grep pass)

• clone: each survivor has a comment justifying two owners.
• Arc<Mutex: each survivor names the invariant it protects and why the state is shared and mutable.
• dyn , single-implementation traits: survivors are test seams or documented extension points.
• Tests: count the ladder (example / property / statistical). A green suite that can’t detect the regressions you care about isn’t evidence.

Always

• A finding without a prompt is incomplete.
• A recurring prompt is a skeleton defect. Promote it.