S211: lint reason evolution + dep unification + feature cleanup + hw-safe expect→Result

westgate · westgate · commit 268e82b78e26 · 2026-04-30T08:32:55.000-04:00
Lint evolution: ~30 production #[expect] attrs evolved to include reason="..."
across 25 files. Trailing // comments converted to structured reason parameter.

Dependency unification: runtime/edge tokio/serde/uuid and akida-driver tokio
dev-dep converted to { workspace = true }.

Feature cleanup: removed stale empty flags — pure-rust (cli), industrial and
embedded-hw (specialty). All had zero cfg gates in source.

hw-safe expect→Result: HugePageMemory and DeviceMmap null-pointer checks after
mmap now return NullPointer error variant instead of panicking.

7,842 lib tests, 0 failures, clippy -D warnings clean, fmt clean.

Made-with: Cursor
diff --git a/DEBT.md b/DEBT.md
@@ -1,13 +1,24 @@
 # Active Technical Debt Register
 
-**Date**: April 2026 — S210
+**Date**: April 2026 — S211
 **Philosophy**: Math is universal, precision is silicon. Workarounds are
 short-term solutions that increase debt. We aim to solve deep debt over
 iterations, evolving toward vendor-agnostic, capability-based solutions—
 with production stubs surfacing typed configuration errors and capability
 guidance, and auth policy driven by explicit environment configuration
 where applicable.
 
+**S211 (Deep Debt — Lint Reason + Dep Unification + Feature Cleanup + hw-safe Expect→Result)**:
+Completed comprehensive lint evolution: all remaining production `#[expect]`
+attributes evolved to include `reason = "..."` (~30 sites across 25 files).
+Workspace dependency unification: `tokio`, `serde`, `uuid` in `runtime/edge`
+and `tokio` dev-dep in `akida-driver` converted to `{ workspace = true }`.
+Stale feature flags removed: `pure-rust` (cli), `industrial`, `embedded-hw`
+(specialty). hw-safe `expect()` calls evolved to `Result`: `HugePageMemory`
+and `DeviceMmap` null-pointer post-mmap checks now return `NullPointer` error
+variant instead of panicking. **7,842 lib-only** tests, 0 failures, clippy
+clean, fmt clean.
+
 **S210 (PG-46: BTSP Handshake Timeout)**:
 Added bounded timeouts to JSON-line BTSP handshake relay. Total handshake
 budget: 5s default (`BTSP_HANDSHAKE_TIMEOUT_SECS`). Per-BearDog-RPC budget:
diff --git a/NEXT_STEPS.md b/NEXT_STEPS.md
@@ -1,8 +1,8 @@
 # ToadStool -- Next Steps
 
-**Updated**: April 2026 — S210 (PG-46: BTSP Handshake Timeout)
-**Status**: Production-grade | Rust edition **2024** (MSRV 1.85) | **AGPL-3.0-or-later** | **All quality gates green** | **7,842 lib-only** tests verified (20,000+ workspace, 0 failures) | **~65 JSON-RPC methods** | Wire Standard L3 (partial) | Zero C FFI deps (ecoBin v3.0) | **Zero production panics/expects** | IPC-first | workspace `unsafe_code = "deny"`, **41 crates `forbid`** | **49 unsafe blocks** (all in hw containment, all SAFETY-documented) | **0 production TODOs** | **rustix 1.x workspace-wide** | **capability-based primal references (no hardcoded names)** | **`async-trait` DEPRECATED** (banned in `deny.toml`) | **`deny.toml` ring + async-trait + zstd-sys bans active** | **BTSP handshake bounded** (5s default, PG-46, S210) | **All lint attrs with reason (S209)** | **Auth issuer capability-based (S209)** | **Self-registration with Songbird (S207)** | **Encrypted compute dispatch (Phase 55)** | **Display Phase 2 (petalTongue IPC)** | **BTSP JSON-line relay (Phase 45c)**
-**Latest**: S210 — PG-46: BTSP Handshake Timeout. Added bounded timeouts to JSON-line BTSP handshake relay: 5s total budget (`BTSP_HANDSHAKE_TIMEOUT_SECS`), 3s per BearDog RPC (`BTSP_RPC_TIMEOUT_SECS`). `UnixJsonRpcClient::call_with_timeout` added. `BtspJsonLineError::Timeout` variant. Resolves short-timeout reads returning empty responses. **7,842 lib-only** tests, 0 failures, clippy clean, fmt clean.
+**Updated**: April 2026 — S211 (Deep Debt — Lint Reason + Dep Unification + Feature Cleanup + hw-safe Expect→Result)
+**Status**: Production-grade | Rust edition **2024** (MSRV 1.85) | **AGPL-3.0-or-later** | **All quality gates green** | **7,842 lib-only** tests verified (20,000+ workspace, 0 failures) | **~65 JSON-RPC methods** | Wire Standard L3 (partial) | Zero C FFI deps (ecoBin v3.0) | **Zero production panics/expects** | IPC-first | workspace `unsafe_code = "deny"`, **41 crates `forbid`** | **49 unsafe blocks** (all in hw containment, all SAFETY-documented) | **0 production TODOs** | **rustix 1.x workspace-wide** | **capability-based primal references (no hardcoded names)** | **`async-trait` DEPRECATED** (banned in `deny.toml`) | **`deny.toml` ring + async-trait + zstd-sys bans active** | **BTSP handshake bounded** (5s default, PG-46, S210) | **All lint attrs with reason (S211)** | **Auth issuer capability-based (S209)** | **Self-registration with Songbird (S207)** | **Encrypted compute dispatch (Phase 55)** | **Display Phase 2 (petalTongue IPC)** | **BTSP JSON-line relay (Phase 45c)**
+**Latest**: S211 — Deep Debt: Lint reason evolution (~30 production `#[expect]` attrs), workspace dep unification (edge `tokio`/`serde`/`uuid`, akida-driver `tokio`), stale feature cleanup (`pure-rust`, `industrial`, `embedded-hw`), hw-safe `expect()` → `Result` (`HugePageMemory` + `DeviceMmap` null-pointer checks). **7,842 lib-only** tests, 0 failures, clippy clean, fmt clean.
 
 ---
 
diff --git a/crates/cli/Cargo.toml b/crates/cli/Cargo.toml
@@ -140,9 +140,6 @@ npu = ["dep:akida-driver"]
 # Nautilus: proxied to barraCuda via capability-based IPC (zero library dep)
 nautilus = []
 
-# PURE RUST: Build without C dependencies (no WASM, minimal features)
-pure-rust = []
-
 [lints]
 workspace = true
 
diff --git a/crates/cli/src/ecosystem/config.rs b/crates/cli/src/ecosystem/config.rs
@@ -185,7 +185,7 @@ impl ServiceDiscoveryConfig {
     /// Uses capability-based endpoint discovery: Unix socket paths from
     /// biomeOS runtime directory. Services are discovered at runtime via
     /// well-known capability constants (primal_identity, ecosystem).
-    #[expect(deprecated)] // Intentional: IPC addressing requires well-known names
+    #[expect(deprecated, reason = "IPC addressing requires well-known names")]
     pub fn create_example() -> Self {
         use toadstool_common::constants::ecosystem::well_known;
         use toadstool_common::primal_sockets::get_biomeos_dir;
diff --git a/crates/cli/src/ecosystem/integrator_impl.rs b/crates/cli/src/ecosystem/integrator_impl.rs
@@ -235,8 +235,7 @@ impl EcosystemIntegrator {
                     .context(format!("Invalid endpoint: {endpoint}"))?;
 
                 // Store connection (capability-based, not hardcoded)
-                // ServiceConnection requires deprecated EcosystemService enum during migration
-                #[expect(deprecated)]
+                #[expect(deprecated, reason = "ServiceConnection uses deprecated EcosystemService during migration")]
                 let connection = ServiceConnection {
                     endpoint: ServiceEndpoint {
                         service_type: EcosystemService::Discovery,
@@ -338,8 +337,7 @@ impl EcosystemIntegrator {
                     .context(format!("Invalid endpoint: {endpoint}"))?;
 
                 // Store connection (capability-based, not hardcoded)
-                // ServiceConnection requires deprecated EcosystemService enum during migration
-                #[expect(deprecated)]
+                #[expect(deprecated, reason = "ServiceConnection uses deprecated EcosystemService during migration")]
                 let connection = ServiceConnection {
                     endpoint: ServiceEndpoint {
                         service_type: EcosystemService::Storage,
diff --git a/crates/cli/src/ecosystem/mod.rs b/crates/cli/src/ecosystem/mod.rs
@@ -29,7 +29,10 @@ mod connection;
 pub mod discovery;
 
 // Public re-exports
-#[expect(deprecated)] // Re-exporting deprecated EcosystemService for backward compatibility
+#[expect(
+    deprecated,
+    reason = "re-exporting deprecated EcosystemService for backward compatibility"
+)]
 pub use types::{
     BearDogPermission, CryptoVerificationContext, DiscoveredService, DiscoveryResult,
     EcosystemIntegrator, EcosystemService, NestGateMount, SecurityPermission, ServiceEndpoint,
diff --git a/crates/cli/src/ecosystem/types/discovery.rs b/crates/cli/src/ecosystem/types/discovery.rs
@@ -23,7 +23,10 @@ pub struct DiscoveryResult {
 
 /// Service discovered during a scan
 #[derive(Debug, Clone, Serialize, Deserialize)]
-#[expect(deprecated)] // Using ServiceType during migration period
+#[expect(
+    deprecated,
+    reason = "ServiceType used during migration to capability-based discovery"
+)]
 pub struct DiscoveredService {
     /// Capability type (discovery, crypto, storage, compute)
     pub service_type: ServiceType,
@@ -57,7 +60,10 @@ pub enum ServiceType {
     Generic,
 }
 
-#[expect(deprecated)] // ServiceType impl; deprecated during migration to capability-based discovery
+#[expect(
+    deprecated,
+    reason = "ServiceType impl deprecated during migration to capability-based discovery"
+)]
 impl ServiceType {
     /// Map to capability name
     pub const fn to_capability(&self) -> &'static str {
diff --git a/crates/cli/src/ecosystem/types/endpoint.rs b/crates/cli/src/ecosystem/types/endpoint.rs
@@ -7,7 +7,10 @@ use std::sync::Arc;
 
 /// Discovered ecosystem service endpoint
 #[derive(Debug, Clone)]
-#[expect(deprecated)] // ServiceEndpoint still uses EcosystemService for backward compatibility
+#[expect(
+    deprecated,
+    reason = "ServiceEndpoint uses deprecated EcosystemService for backward compatibility"
+)]
 pub struct ServiceEndpoint {
     /// Service capability type (discovery, crypto, storage)
     pub service_type: EcosystemService,
@@ -45,7 +48,10 @@ impl<'de> Deserialize<'de> for ServiceEndpoint {
         D: Deserializer<'de>,
     {
         #[derive(Deserialize)]
-        #[expect(deprecated)] // EcosystemService is deprecated but still used for backward compat
+        #[expect(
+            deprecated,
+            reason = "EcosystemService is deprecated but still used for backward compat"
+        )]
         struct ServiceEndpointHelper {
             service_type: EcosystemService,
             address: SocketAddr,
@@ -88,7 +94,7 @@ pub enum EcosystemService {
     Unknown(String),
 }
 
-#[expect(deprecated)] // Implementation of deprecated EcosystemService
+#[expect(deprecated, reason = "implementation of deprecated EcosystemService")]
 impl EcosystemService {
     /// Capability string for this service type
     pub(crate) fn name(&self) -> &str {
diff --git a/crates/cli/src/templates/basic_templates.rs b/crates/cli/src/templates/basic_templates.rs
@@ -17,7 +17,7 @@
 use std::collections::HashMap;
 use toadstool_config::env_config::EnvironmentConfig;
 
-#[expect(deprecated)] // Protocol compatibility: default PKI image
+#[expect(deprecated, reason = "protocol compatibility: default PKI image")]
 use toadstool_common::constants::ecosystem::well_known::BEARDOG;
 
 use crate::{
diff --git a/crates/core/common/src/capability_provider/provider.rs b/crates/core/common/src/capability_provider/provider.rs
@@ -81,8 +81,10 @@ impl CapabilityProvider {
         let client = {
             let mut client_lock = self.client.write().await;
 
-            #[expect(clippy::option_if_let_else)]
-            // map_or_else would cause borrow conflict with mutation
+            #[expect(
+                clippy::option_if_let_else,
+                reason = "map_or_else would cause borrow conflict with mutation"
+            )]
             if let Some(c) = client_lock.as_ref() {
                 c.clone()
             } else {
diff --git a/crates/core/common/src/config_bases/resources_validation.rs b/crates/core/common/src/config_bases/resources_validation.rs
@@ -72,7 +72,7 @@ mod humantime_serde_optional {
     use serde::{Deserialize, Deserializer, Serializer};
     use std::time::Duration;
 
-    #[expect(clippy::ref_option)] // Required by serde derive macro
+    #[expect(clippy::ref_option, reason = "required by serde derive macro")]
     pub fn serialize<S>(value: &Option<Duration>, serializer: S) -> Result<S::Ok, S::Error>
     where
         S: Serializer,
diff --git a/crates/core/common/src/universal_adapter/discovery_engine/mod.rs b/crates/core/common/src/universal_adapter/discovery_engine/mod.rs
@@ -15,7 +15,10 @@ use std::collections::HashSet;
 use std::time::Duration;
 
 use super::capability_types::{CapabilityInfo, CapabilityType, HealthStatus, ServiceEndpoint};
-#[expect(deprecated)] // Protocol compatibility: platform path convention
+#[expect(
+    deprecated,
+    reason = "protocol compatibility: platform path convention"
+)]
 use crate::constants::ecosystem::well_known::BIOMEOS;
 use crate::constants::network::{HTTP_PROTOCOL, UNIX_SOCKET_URL_PREFIX};
 use crate::interned_strings::socket_env;
@@ -516,7 +519,7 @@ impl LocalRegistrySource {
 }
 
 impl DiscoverySource for LocalRegistrySource {
-    #[expect(deprecated)] // BIOMEOS used for platform path convention
+    #[expect(deprecated, reason = "BIOMEOS used for platform path convention")]
     async fn discover(&self) -> ToadStoolResult<Vec<CapabilityInfo>> {
         let env = PathEnv::from_env();
         let paths = PlatformPaths::new(&env);
diff --git a/crates/core/config/src/runtime_defaults.rs b/crates/core/config/src/runtime_defaults.rs
@@ -165,7 +165,10 @@ impl ToadStoolConfig {
         info!("    Auto-Config: {}", self.features.enable_auto_config);
         info!("    Debug: {}", self.features.enable_debug);
         info!("  External Services (LEGACY - use capability-based discovery):");
-        #[expect(deprecated)]
+        #[expect(
+            deprecated,
+            reason = "logging legacy endpoint fallbacks for diagnostics"
+        )]
         {
             info!(
                 "    Coordination (fallback): {}",
diff --git a/crates/core/config/src/runtime_defaults/env_overrides/features.rs b/crates/core/config/src/runtime_defaults/env_overrides/features.rs
@@ -6,7 +6,10 @@ use super::parse;
 use crate::{BackendCacheConfig, MetricsConfig, ToadStoolConfig};
 use toadstool_common::interned_strings::socket_env;
 
-#[expect(clippy::unnecessary_wraps)] // Result type required for ? in apply_env_overrides chain
+#[expect(
+    clippy::unnecessary_wraps,
+    reason = "Result return required for ? in apply_env_overrides chain"
+)]
 pub(super) fn apply(config: &mut ToadStoolConfig) -> ConfigResult<()> {
     if let Ok(enabled) = std::env::var(socket_env::TOADSTOOL_ENABLE_METRICS) {
         config.metrics = if parse::parse_bool(&enabled) {
diff --git a/crates/core/config/src/types/network.rs b/crates/core/config/src/types/network.rs
@@ -51,7 +51,7 @@ impl Default for NetworkConfig {
             fallback.parse().unwrap_or_else(|_| {
                 // Last resort: LOCALHOST_IPV4:BIND_FALLBACK_PORT is guaranteed valid by IP spec
                 // This expect is justified: it's a compile-time constant that must be valid
-                #[expect(clippy::expect_used)]
+                #[expect(clippy::expect_used, reason = "compile-time constants must parse; panicking on invalid constants is correct")]
                 format!("{LOCALHOST_IPV4}:{BIND_FALLBACK_PORT}").parse().expect(
                     "Constants LOCALHOST_IPV4:BIND_FALLBACK_PORT must parse - language guarantee",
                 )
diff --git a/crates/core/hw-safe/src/device_mmap.rs b/crates/core/hw-safe/src/device_mmap.rs
@@ -31,6 +31,9 @@ pub enum DeviceMmapError {
     /// The mmap syscall failed.
     #[error("device mmap failed: {0}")]
     MmapFailed(std::io::Error),
+    /// mmap succeeded but returned a null pointer.
+    #[error("device mmap returned null pointer")]
+    NullPointer,
 }
 
 /// RAII memory-mapped device region.
@@ -91,7 +94,7 @@ impl DeviceMmap {
         }
         .map_err(|e| DeviceMmapError::MmapFailed(e.into()))?;
 
-        let ptr = NonNull::new(raw.cast()).expect("mmap returned non-null on success");
+        let ptr = NonNull::new(raw.cast()).ok_or(DeviceMmapError::NullPointer)?;
         tracing::debug!(size, offset, "device mmap region created");
         Ok(Self {
             ptr: ExclusivePtr::new(ptr),
diff --git a/crates/core/hw-safe/src/huge_page.rs b/crates/core/hw-safe/src/huge_page.rs
@@ -59,6 +59,9 @@ pub enum HugePageError {
     /// `mlock` failed (e.g. `RLIMIT_MEMLOCK` exceeded).
     #[error("mlock failed: {0}")]
     MlockFailed(std::io::Error),
+    /// `mmap_anonymous` succeeded but returned a null pointer.
+    #[error("mmap_anonymous returned null pointer")]
+    NullPointer,
 }
 
 /// RAII huge-page memory — `mmap_anonymous` + `MAP_HUGETLB` + `mlock`.
@@ -104,7 +107,7 @@ impl HugePageMemory {
         }
         .map_err(|e| HugePageError::MmapFailed(e.into()))?;
 
-        let ptr = NonNull::new(raw.cast::<u8>()).expect("mmap_anonymous returned null after Ok");
+        let ptr = NonNull::new(raw.cast::<u8>()).ok_or(HugePageError::NullPointer)?;
 
         // SAFETY: `ptr`/`aligned_size` describe the mapping returned above; rustix `mlock` requires
         // the range to be valid to read (it is).
diff --git a/crates/core/toadstool/src/encryption/types.rs b/crates/core/toadstool/src/encryption/types.rs
@@ -70,8 +70,10 @@ pub struct EncryptionMetadata {
     pub encrypted_at: i64,
 }
 
-// Unix epoch seconds fit in i64 for realistic dates
-#[expect(clippy::cast_possible_wrap)]
+#[expect(
+    clippy::cast_possible_wrap,
+    reason = "Unix epoch seconds fit in i64 for realistic dates"
+)]
 fn unix_timestamp_now() -> i64 {
     std::time::SystemTime::now()
         .duration_since(std::time::UNIX_EPOCH)
diff --git a/crates/core/toadstool/src/performance_hardening/memory.rs b/crates/core/toadstool/src/performance_hardening/memory.rs
@@ -95,7 +95,10 @@ impl<T> MemoryPool<T> {
     }
 
     /// Get pool statistics
-    #[expect(clippy::future_not_send)] // MemoryPool<T> not Sync when T: !Send; design constraint
+    #[expect(
+        clippy::future_not_send,
+        reason = "MemoryPool<T> not Sync when T: !Send; design constraint"
+    )]
     pub async fn get_stats(&self) -> PoolStats {
         self.stats.read().await.clone()
     }
diff --git a/crates/core/toadstool/src/security_hardening/intrusion.rs b/crates/core/toadstool/src/security_hardening/intrusion.rs
@@ -113,7 +113,10 @@ impl IntrusionDetectionSystem {
     }
 
     /// Check if client is banned
-    #[expect(clippy::option_if_let_else)] // need mutable borrow for remove(); map_or closure can't mutate
+    #[expect(
+        clippy::option_if_let_else,
+        reason = "mutable borrow needed for remove(); map_or closure cannot mutate"
+    )]
     pub async fn is_banned(&self, client_id: &str) -> bool {
         let mut banned = self.banned_clients.write().await;
         let now = Instant::now();
diff --git a/crates/distributed/src/cloud/cost/mod.rs b/crates/distributed/src/cloud/cost/mod.rs
@@ -19,6 +19,6 @@ pub use pricing::{CloudCostModel, PricingTier};
 pub use types::{CostError, CostEstimate, CostLineItem};
 
 // Constants (re-exported for public API compatibility)
-#[expect(unused_imports)]
+#[expect(unused_imports, reason = "re-exported for public API compatibility")]
 /// Conversion and pricing constants for cost estimation.
 pub use types::{BYTES_PER_GB, DAYS_PER_MONTH, HOURS_PER_DAY, SPOT_DISCOUNT_FACTOR};
diff --git a/crates/distributed/src/primal_capabilities/registry.rs b/crates/distributed/src/primal_capabilities/registry.rs
@@ -353,7 +353,10 @@ impl ProviderRegistry {
     }
 
     /// Prune registrations whose socket files no longer exist.
-    #[expect(clippy::needless_collect)] // Collect required: cannot mutate self.providers while iterating
+    #[expect(
+        clippy::needless_collect,
+        reason = "cannot mutate self.providers while iterating"
+    )]
     pub fn prune_stale(&mut self) -> Vec<ProviderRegistration> {
         let stale_keys: Vec<String> = self
             .providers
diff --git a/crates/distributed/src/security/client/mod.rs b/crates/distributed/src/security/client/mod.rs
@@ -112,7 +112,10 @@ impl SecurityClient {
         since = "0.3.0",
         note = "Use new_async() for capability-based discovery"
     )]
-    #[expect(deprecated)] // new() uses deprecated SecurityConfig; migration in progress
+    #[expect(
+        deprecated,
+        reason = "new() uses deprecated SecurityConfig; migration in progress"
+    )]
     pub fn new(config: SecurityConfig) -> ToadStoolResult<Self> {
         let socket_path = get_socket_path_for_capability("crypto");
         let rpc_client = UnixJsonRpcClient::new(socket_path);
diff --git a/crates/integration/primals/src/manager.rs b/crates/integration/primals/src/manager.rs
@@ -178,7 +178,10 @@ impl PrimalIntegrationManager {
     }
 
     /// Visit a Primal during topological sort
-    #[expect(clippy::self_only_used_in_recursion)]
+    #[expect(
+        clippy::self_only_used_in_recursion,
+        reason = "recursive DFS traversal: self carries the dependency graph context"
+    )]
     fn visit_primal(
         &self,
         primal_name: &str,
diff --git a/crates/neuromorphic/akida-driver/Cargo.toml b/crates/neuromorphic/akida-driver/Cargo.toml
@@ -35,7 +35,7 @@ rustix = { version = "1.1", features = ["fs", "mm"] }
 toadstool-hw-safe = { path = "../../core/hw-safe" }
 
 [dev-dependencies]
-tokio = { version = "1", features = ["full", "test-util"] }
+tokio = { workspace = true, features = ["test-util"] }
 tracing-subscriber = { workspace = true }
 criterion = { workspace = true }
 
diff --git a/crates/neuromorphic/akida-driver/src/device.rs b/crates/neuromorphic/akida-driver/src/device.rs
@@ -108,7 +108,10 @@ impl DeviceHandle {
         }
 
         // SAFETY: OFlags::NONBLOCK.bits() is always a valid i32 value (flag bits are small positive values)
-        #[expect(clippy::cast_possible_wrap)]
+        #[expect(
+            clippy::cast_possible_wrap,
+            reason = "OFlags::NONBLOCK bits are small positive values that fit in i32"
+        )]
         let nonblock_flag = OFlags::NONBLOCK.bits() as i32;
 
         let file = OpenOptions::new()
diff --git a/crates/neuromorphic/akida-reservoir-research/src/readout.rs b/crates/neuromorphic/akida-reservoir-research/src/readout.rs
@@ -129,7 +129,10 @@ impl ReadoutTrainer {
     /// 3. Solve L^T W = Y by backward substitution
     ///
     /// This is numerically stable for symmetric positive definite matrices.
-    #[expect(clippy::needless_pass_by_value)] // Ownership needed for error fallback
+    #[expect(
+        clippy::needless_pass_by_value,
+        reason = "ownership needed for error fallback"
+    )]
     fn solve_ridge(xt_x_reg: Array2<f64>, xt_y: Array2<f64>) -> Array2<f64> {
         let n = xt_x_reg.nrows();
         let n_rhs = xt_y.ncols();
diff --git a/crates/neuromorphic/neurobench-runner/src/metrics.rs b/crates/neuromorphic/neurobench-runner/src/metrics.rs
@@ -84,7 +84,10 @@ impl LatencyMetrics {
             clippy::cast_possible_truncation,
             reason = "truncation acceptable for this conversion"
         )]
-        #[expect(clippy::cast_sign_loss)]
+        #[expect(
+            clippy::cast_sign_loss,
+            reason = "variance sqrt is always non-negative"
+        )]
         let std_dev_nanos = variance.sqrt().round() as u64;
 
         // Percentiles (integer math to avoid casts)
diff --git a/crates/runtime/adaptive/src/profiler.rs b/crates/runtime/adaptive/src/profiler.rs
diff --git a/crates/runtime/display/src/input/device.rs b/crates/runtime/display/src/input/device.rs
diff --git a/crates/runtime/edge/Cargo.toml b/crates/runtime/edge/Cargo.toml
diff --git a/crates/runtime/gpu/src/cpu_resource.rs b/crates/runtime/gpu/src/cpu_resource.rs
diff --git a/crates/runtime/gpu/src/unified_memory/buffer/lifecycle.rs b/crates/runtime/gpu/src/unified_memory/buffer/lifecycle.rs
diff --git a/crates/runtime/orchestration/src/orchestrator.rs b/crates/runtime/orchestration/src/orchestrator.rs
diff --git a/crates/runtime/secure_enclave/src/isolated_memory.rs b/crates/runtime/secure_enclave/src/isolated_memory.rs
diff --git a/crates/runtime/specialty/Cargo.toml b/crates/runtime/specialty/Cargo.toml
