Module spawn_audit 

The “every task carries its account” check, run by this crate’s suite and by every crate that spawns per-account work against vector-core. The policy check behind crate::db::spawn_bound, shared by every crate that spawns per-account work.

A bare tokio::spawn leaves its task resolving whoever is logged in when it finally asks, which is how account A’s work lands in account B’s storage. That mistake is invisible in review, so it is caught mechanically instead: walk a source tree and fail on an unbound spawn.

A task that genuinely owns no account state — a process-lifetime listener, a socket drain, CPU work on bytes already in hand — is exempted per site with a // spawn-detached: <why> marker on the line or just above it. Per site, not per file: files hold both kinds, and exempting one wholesale hides the other.

Functions

account_access_off_task

Account access from a thread that does not carry the account.

assert_all_spawns_bound

The assertion both crates run. pending is a shrink-only worklist of files not yet converted; it is a ratchet, not an exemption, so a file that no longer spawns unbound must be deleted from it.

has_unbound_spawn

Whether one file’s shipping code still spawns unbound. Used by the ratchet.

unbound_spawns

Every unbound tokio::spawn under src_root, as path:line relative to crate_root. Empty means the tree is clean.