Containers: never crash — mpegts, ogg, mxf, matroska without expect/unreachable

- mpegts: a PES unit is built before it is stored (no `as_mut().expect`); stream maps are
  drained with `let … else` instead of `remove().expect`.
- ogg: completing a packet and reading the page granule no longer expect.
- mxf writer: the picture descriptor uses `let … else` on the picture configuration.
- matroska: the `Lacing::None` arm returns the single frame instead of `unreachable!`.
- Each crate denies unwrap/expect/panic/unimplemented/todo/unreachable outside tests.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

crates/matroska/src/ebml.rs

@@ -267,7 +267,7 @@ pub fn parse_lacing(lacing: Lacing, data: &[u8]) -> Result<Vec<(usize, usize)>>
     let mut pos = 1usize;
     let mut sizes = Vec::with_capacity(count);
     match lacing {
-        Lacing::None => unreachable!(),
+        Lacing::None => return Ok(vec![(0, data.len())]),
         Lacing::Xiph => {
             for _ in 0..count - 1 {
                 let mut s = 0usize;

crates/matroska/src/lib.rs

@@ -10,6 +10,8 @@
 //!
 //! Layer L0: no dependencies beyond `std`, no `unsafe`, builds for `wasm32-unknown-unknown`.
 
+#![cfg_attr(not(test), deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable))]
+
 mod codec;
 mod demux;
 pub mod ebml;

crates/mpegts/src/es.rs

@@ -317,15 +317,15 @@ impl Splitter {
         let at = self.es_pos;
         self.close(at);
         // the chunk of this position arrives with the next feed: resolved there
-        self.open = Some(Open { start: at, pos: u64::MAX, offset: 0, pts: None, dts: None, key: false, disposable: false, vcl: false, picture: None });
+        let mut o = Open { start: at, pos: u64::MAX, offset: 0, pts: None, dts: None, key: false, disposable: false, vcl: false, picture: None };
         if let Some((pts, dts)) = self.timestamps_at(at) {
-            let o = self.open.as_mut().expect("open");
             o.pts = pts;
             o.dts = dts;
         }
         if self.mode == Mode::Pes {
-            self.open.as_mut().expect("open").key = true;
+            o.key = true;
         }
+        self.open = Some(o);
     }
 
     /// The unused timestamps of the PES packet holding `at` (consumed).

crates/mpegts/src/lib.rs

@@ -18,6 +18,8 @@
 //!
 //! The crate does no decoding; `filmcraft-codecs` pairs the streams with decoders.
 
+#![cfg_attr(not(test), deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable))]
+
 mod es;
 pub use es::{FrameInfo, frame_info};
 mod pes;

crates/mpegts/src/ps.rs

@@ -218,7 +218,7 @@ pub(crate) fn scan<S: ByteSource + ?Sized>(src: &S, mpeg1: bool) -> Result<File>
     }
     let mut out = Vec::new();
     for key in order {
-        let mut e = streams.remove(&key).expect("stream");
+        let Some(mut e) = streams.remove(&key) else { continue };
         e.split.finish();
         e.stream.units = std::mem::take(&mut e.split.units);
         e.stream.skipped_bytes = e.split.skipped;

crates/mpegts/src/ts.rs

@@ -380,7 +380,7 @@ pub(crate) fn scan<S: ByteSource + ?Sized>(src: &S, packet_size: usize, sync_off
     }
     let mut streams = Vec::new();
     for pid in order {
-        let mut e = es.remove(&pid).expect("stream");
+        let Some(mut e) = es.remove(&pid) else { continue };
         e.split.finish();
         e.stream.units = std::mem::take(&mut e.split.units);
         e.stream.skipped_bytes = e.split.skipped;

crates/mxf/src/lib.rs

@@ -17,6 +17,8 @@
 //!
 //! Layer L0: no dependencies beyond `std`, no `unsafe`, builds for `wasm32-unknown-unknown`.
 
+#![cfg_attr(not(test), deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable))]
+
 mod essence;
 mod file;
 mod index;

crates/mxf/src/write/mod.rs

@@ -864,7 +864,8 @@ impl<W: Write + Seek> MxfWriter<W> {
             desc_uids.push(uid);
             match t.kind {
                 TrackKind::Picture => {
-                    let p = cfg.picture.as_ref().expect("picture track");
+                    // Picture tracks exist only with a picture configuration.
+                    let Some(p) = cfg.picture.as_ref() else { continue };
                     let mut s = Set::new(0x28, uid);
                     if multiple {
                         s.u32(0x3006, t.id);

crates/ogg/src/lib.rs

@@ -14,6 +14,8 @@
 //!
 //! Layer L0: no dependencies beyond `std`, no `unsafe`, builds for `wasm32-unknown-unknown`.
 
+#![cfg_attr(not(test), deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable))]
+
 use std::collections::HashMap;
 use std::fmt;
 use std::io;
@@ -289,8 +291,9 @@ pub fn open(src: &(impl ByteSource + ?Sized)) -> Result<OggFile> {
                     let need = 2usize.saturating_sub(p.prefix.len()).min(n as usize);
                     p.prefix.extend_from_slice(&page[s..s + need]);
                 }
-                if l < 255 {
-                    let p = partial.remove(&serial).expect("partial");
+                if l < 255
+                    && let Some(p) = partial.remove(&serial)
+                {
                     let mut prefix = [0u8; 2];
                     prefix[..p.prefix.len().min(2)].copy_from_slice(&p.prefix[..p.prefix.len().min(2)]);
                     completed.push(Packet { parts: p.parts, size: p.size, granule: None, page: page_index, eos: flags & 0x04 != 0, prefix });
@@ -427,7 +430,7 @@ impl OpusTiming {
                 }
                 break;
             }
-            let g = stream.packets[j].granule.expect("granule");
+            let Some(g) = stream.packets[j].granule else { break };
             let sum: i64 = durations[i..=j].iter().map(|&d| d as i64).sum();
             let forward = cursor.map(|c| c + sum);
             let end = match forward {