Errors, Broken Code, and Lifecycle

Broken source is data

Parsing produces a syntax tree plus errors, never “no tree.” AST accessors return Option even where the grammar says a child should exist. IDE features can therefore operate on the incomplete file currently being typed.

Read failures are contained

Read-only handlers run inside catch_unwind. Ordinary errors become JSON-RPC errors; Salsa revision cancellation becomes retry/content-modified; unexpected panics are logged and isolated because the worker held only a snapshot. Mutable main-thread handlers are intentionally not recoverable in the same way.

External tools degrade independently

Cargo metadata, flycheck, rustfmt, and proc macros have dedicated messages and status. Workspace reload does not make the server wholly unavailable. Syntax highlighting can fall back while proc macros load; a broken build still permits local editing features.

Shutdown is a protocol state

The shutdown request marks shutdown_requested, drops proc-macro clients, cancels flycheck, and clears discovery handles. Later requests are rejected. The main loop exits only on the LSP exit notification; client disappearance without that sequence is reported as an error. Dropping pools closes their job channels before joining workers, an ordering documented in the field layout.