Never crash: deny the panicking lints in the already-clean crates and apps

aac, bitstream, cfb, color, format, frame, geom, isobmff, media, scopes, speech, the desktop
app and the web app have no production unwrap/expect/panic/unreachable (the web app's two
`expect`s — frame-cache eviction and chunked file reads — become `let … else`); each now
carries `#![deny(clippy::unwrap_used, …)]` outside tests so it stays that way.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/filmcraft-web/src/fs.rs

@@ -289,20 +289,25 @@ impl ByteReader for BlobReader {
             }
             return Err(filmcraft_media::pending::would_block());
         }
-        FS.with(|fs| {
+        let complete = FS.with(|fs| {
             let mut fs = fs.borrow_mut();
             fs.clock += 1;
             let t = fs.clock;
             let mut pos = 0usize;
             for c in c0..=c1 {
-                let (d, used) = fs.chunks.get_mut(&(self.id, c)).expect("checked above");
+                // Present (checked above); evicted in between would be a bug, reported as an error.
+                let Some((d, used)) = fs.chunks.get_mut(&(self.id, c)) else { return false };
                 *used = t;
                 let a = if c == c0 { (offset - c * CHUNK) as usize } else { 0 };
                 let n = (d.len() - a).min(buf.len() - pos);
                 buf[pos..pos + n].copy_from_slice(&d[a..a + n]);
                 pos += n;
             }
+            true
         });
+        if !complete {
+            return Err(filmcraft_media::pending::would_block());
+        }
         // read-ahead for sequential access
         for c in c1 + 1..=(c1 + READ_AHEAD).min(last) {
             request(self.id, c);

apps/filmcraft-web/src/lib.rs

@@ -16,6 +16,7 @@
 //!
 //! Everything here is `wasm32`-only; on other targets the crate is empty.
 #![cfg(target_arch = "wasm32")]
+#![cfg_attr(not(test), deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable))]
 
 pub mod api;
 pub mod audio;

apps/filmcraft-web/src/webcodecs.rs

@@ -463,7 +463,7 @@ impl WcSource {
             c.frames.insert(pts, Arc::new(f));
         }
         while c.frames.len() > CACHE_FRAMES {
-            let far = c.frames.keys().copied().max_by_key(|p| (p - want).abs()).expect("non-empty");
+            let Some(far) = c.frames.keys().copied().max_by_key(|p| (p - want).abs()) else { break };
             c.frames.remove(&far);
         }
         // the session's own frame came out: other requests may restart it now

apps/filmcraft/src/main.rs

@@ -15,6 +15,8 @@
 //! asking, `--no-recover` starts without asking (the changes stay available via File ▸ Recover
 //! Unsaved Changes…).
 
+#![cfg_attr(not(test), deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable))]
+
 mod app_nap;
 mod audio;
 mod audio_in;

crates/aac/src/lib.rs

@@ -31,6 +31,8 @@
 //! # Ok::<(), filmcraft_aac::Error>(())
 //! ```
 
+#![cfg_attr(not(test), deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable))]
+
 mod config;
 mod decoder;
 mod encoder;

crates/bitstream/src/lib.rs

@@ -5,6 +5,8 @@
 //! - [`unescape_rbsp`] / [`escape_rbsp`]: remove/insert H.264/HEVC emulation-prevention bytes.
 //! - [`annexb_nals`] / [`length_prefixed_nals`]: split Annex-B byte streams and AVCC/HVCC samples into NAL units.
 
+#![cfg_attr(not(test), deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable))]
+
 use std::fmt;
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]

crates/cfb/src/lib.rs

@@ -15,6 +15,8 @@
 //!
 //! Layer L0: no dependencies beyond `std`, no `unsafe`, builds for `wasm32-unknown-unknown`.
 
+#![cfg_attr(not(test), deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable))]
+
 mod read;
 mod write;
 

crates/color/src/lib.rs

@@ -5,6 +5,8 @@
 //! The compositor works in **linear-light, premultiplied RGBA f32** in the sequence working space
 //! (Rec.709 primaries by default). Decoded frames carry [`ColorInfo`] so conversions are explicit.
 
+#![cfg_attr(not(test), deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable))]
+
 use serde::{Deserialize, Serialize};
 use std::sync::OnceLock;
 

crates/format/src/lib.rs

@@ -34,6 +34,8 @@
 //!   per-character text styles (`TrackItem::graphic`, `EffectInstance::layer`) and source graphics
 //!   (`Project::source_graphics`). No-op step; older builds would drop these fields when saving.
 
+#![cfg_attr(not(test), deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable))]
+
 pub mod atomic;
 pub mod autosave;
 

crates/frame/src/lib.rs

@@ -5,6 +5,8 @@
 //!   compositor. Pixel data is `Arc`-shared so caches, monitors and export share frames for free.
 //! - [`AudioBuffer`]: planar f32 samples.
 
+#![cfg_attr(not(test), deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable))]
+
 use std::sync::Arc;
 
 use filmcraft_color::{ColorInfo, DecodeTable, Matrix, Range, linear_to_srgb_u8, normalize_c, normalize_y, srgb_u8_to_linear_table, to_linear, ycbcr_to_rgb};

crates/geom/src/lib.rs

@@ -1,5 +1,7 @@
 //! 2D geometry for FilmCraft: vectors, rectangles and affine transforms (Motion effect math).
 
+#![cfg_attr(not(test), deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable))]
+
 use serde::{Deserialize, Serialize};
 use std::ops::{Add, Mul, Sub};
 

crates/isobmff/src/lib.rs

@@ -8,6 +8,8 @@
 //!
 //! See the crate README for supported boxes and limitations.
 
+#![cfg_attr(not(test), deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable))]
+
 mod bytes;
 mod codec;
 mod demux;

crates/media/src/lib.rs

@@ -7,6 +7,8 @@
 //!
 //! Time passed to a source is **media time** (0 = first frame of the media), in ticks.
 
+#![cfg_attr(not(test), deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable))]
+
 pub mod cache;
 pub mod cancel;
 pub mod digits;

crates/scopes/src/lib.rs

@@ -20,6 +20,8 @@
 //! `[-0.1, 1.1]` without (values outside are dropped). With 256 rows over `[0, 1]`, an 8-bit code
 //! value `c` lands exactly on row `c`.
 
+#![cfg_attr(not(test), deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable))]
+
 pub mod paint;
 pub mod summary;
 #[cfg(test)]

crates/speech/src/lib.rs

@@ -14,6 +14,8 @@
 //!
 //! See `docs/transcripts.md` for the user-facing behaviour and accuracy numbers.
 
+#![cfg_attr(not(test), deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable))]
+
 pub mod diarize;
 pub mod mel;
 pub mod models;