S226: deep debt audit — workspace clippy clean + lint hygiene

Full deep debt survey: zero production files >800 LOC, zero production
TODOs/FIXMEs, all 46 unsafe blocks at kernel FFI with SAFETY docs,
all mocks test-gated, all primal names intentional legacy compat.

Fixed 8 clippy errors in integration-primals: 4 unused_async (removed
async from sync fns), 2 redundant closures, 1 debug formatting
(Display instead of Debug), 1 map_unwrap_or → map_or_else. Bare
allow(dead_code) in distributed/network/metrics.rs given reason.
deny.toml stale ring comment corrected. auto_config
items_after_statements fixed (S225 carryover).

Workspace cargo clippy --workspace -- -D warnings: zero errors.
22,843 workspace tests, 0 failures.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: BiomeOS Developer

DOCUMENTATION.md

@@ -1,6 +1,6 @@
 # ToadStool Documentation Hub
 
-**Last Updated**: May 2026 — S225
+**Last Updated**: May 2026 — S226
 
 ---
 
@@ -30,7 +30,7 @@ These root documents were **fully resolved** and **fossilized** in wateringHole
 
 ---
 
-## Current State (S225 — May 2026)
+## Current State (S226 — May 2026)
 
 **Post-budding, dependency-sovereign, IPC-first, fully concurrent, capability-based.** barraCuda is a separate primal at `ecoPrimals/barraCuda/`. ToadStool is the hardware infrastructure layer — GPU/NPU/CPU discovery, capability probing, workload orchestration, and shader dispatch.
 

NEXT_STEPS.md

@@ -1,8 +1,9 @@
 # ToadStool -- Next Steps
 
-**Updated**: May 2026 — S225 (PG-62: Health Liveness Fast-Path + Startup Reorder)
+**Updated**: May 2026 — S226 (Deep Debt Audit — Workspace Clippy Clean)
 **Status**: Production-grade | Rust edition **2024** (MSRV 1.85) | **AGPL-3.0-or-later** | **All quality gates green** | tests verified (22,843 workspace, 0 failures) | **~65 JSON-RPC methods** | Wire Standard L3 (partial) | Zero C FFI deps (ecoBin v3.0) | **Zero production panics/expects** | IPC-first | workspace `unsafe_code = "deny"`, **41 crates `forbid`** | **46 unsafe blocks** (all in hw containment, all SAFETY-documented, reconciled S221) | **0 production TODOs** | **rustix 1.x workspace-wide** | **capability-based primal references (no hardcoded names, S221)** | **`async-trait` DEPRECATED** (banned in `deny.toml`) | **`deny.toml` ring + async-trait + zstd-sys bans active** | **BTSP Phase 3 encrypted channel (ChaCha20-Poly1305, S215)** | **BTSP Phase 3 transport switch verified (S218)** | **BTSP handshake bounded + connection-reused** (PG-46 resolved, S214) | **All lint attrs with reason (S211+S213)** | **Auth issuer capability-based (S209)** | **Self-registration with Songbird (S207)** | **Encrypted compute dispatch (Phase 55)** | **Display Phase 2 (petalTongue IPC)** | **BTSP JSON-line relay (Phase 45c)** | **Orchestrator lock-panic-free (S213)** | **Health liveness fast-path (PG-62, S225)**
-**Latest**: S225 — PG-62: `health.liveness` fast-path returns `{"status":"starting"}` during initialization, `{"status":"alive"}` once ready. Discovery registration moved after listener spawn. Recommended caller timeout: ≥3s. BearDog `crypto.sign_contract` (PG-60+) tracked for Phase 60+. +5 tests. 22,843 tests, 0 failures.
+**Latest**: S226 — Deep debt audit: workspace `cargo clippy -- -D warnings` zero errors. 8 clippy errors in integration-primals fixed (unused_async, redundant closures, debug formatting). Bare `allow(dead_code)` given reason. `deny.toml` ring comment corrected.
+**Previous**: S225 — PG-62: `health.liveness` fast-path returns `{"status":"starting"}` during initialization, `{"status":"alive"}` once ready. Discovery registration moved after listener spawn. Recommended caller timeout: ≥3s. BearDog `crypto.sign_contract` (PG-60+) tracked for Phase 60+. +5 tests. 22,843 tests, 0 failures.
 
 ---
 

README.md

@@ -285,6 +285,7 @@ toadStool/
 - **NUCLEUS crypto integration** -- compute payloads encrypted via Tower `crypto.encrypt`/`crypto.decrypt` (S205); **self-registration with Songbird** via `DISCOVERY_SOCKET` + `ipc.register` at startup (S207)
 
 ### Recently Completed
+- **S226 (May 7, 2026)**: **Deep Debt Audit — Workspace Clippy Clean + Lint Hygiene** — Full deep debt survey: **zero** production files >800 LOC, **zero** production TODOs/FIXMEs, all 46 unsafe blocks at kernel FFI boundaries with SAFETY docs, all mocks test-gated, all primal names intentional legacy compat. Fixed 8 clippy errors in `integration-primals` (4 `unused_async` → removed `async`, 2 redundant closures, 1 debug formatting, 1 `map_unwrap_or`). Bare `#[allow(dead_code)]` in `distributed/network/metrics.rs` given reason. `deny.toml` stale `ring` comment corrected. `auto_config` `items_after_statements` fixed (S225). **Workspace `cargo clippy -- -D warnings`: zero errors.** 22,843 tests.
 - **S225 (May 7, 2026)**: **PG-62 — Health Liveness Fast-Path + Startup Reorder** — `health.liveness` now returns `{"status":"starting"}` during initialization and `{"status":"alive"}` once fully ready (via `Arc<AtomicBool>` readiness flag). `health.readiness` likewise returns `"starting"` → `"ready"`. Discovery registration + biomeOS scan moved **after** listener spawn so the socket accepts connections immediately. Recommended caller timeout: **≥3 seconds** (documented). BearDog cross-family `crypto.sign_contract` (PG-60+) tracked for Phase 60+. +5 tests. 22,843 tests.
 - **S224 (May 7, 2026)**: **PG-55 — `--bind` Flag + Localhost Default (Security)** — Added `--bind host:port` CLI flag to `server`/`daemon` subcommands. Default TCP bind changed from `0.0.0.0` to `127.0.0.1`. Priority: CLI `--bind` > `TOADSTOOL_BIND_ADDRESS` env > localhost default. +5 tests. 22,838 tests.
 - **S223 (May 6, 2026)**: **Deep Debt — Smart Refactor + Sleep Elimination + Test Speed** — Smart-refactored `btsp/json_line.rs` (905→478 LOC + `relay.rs` 255 + `negotiate.rs` 189; zero files >800 LOC). Eliminated 4 test sleeps: `thread::sleep` → deterministic time manipulation (backdated timestamps, `tokio::time::pause`). Evolved `intrusion.rs` to `tokio::time::Instant` for testable time. Fixed `auto_config` ecosystem discovery blocking 10s on mDNS daemon startup/shutdown and DNS resolution in tests — `cfg!(test)` early-returns skip network I/O (237 tests: 10.02s→0.24s, 41x speedup). Confirmed zero production `unwrap()`. Stale `/tmp/ecoPrimals/discovery/` comments evolved to capability-based language. +12 tests (resource_validator/analysis). 22,833 tests.
@@ -410,7 +411,7 @@ See [DEBT.md](DEBT.md) for full register and evolution paths.
 
 ---
 
-**Last Updated**: May 2026 — S225 (PG-62: Health Liveness Fast-Path + Startup Reorder). **22,843** workspace tests, 0 failures (7,884+ lib-only). ~83.6% lib-only line coverage (target 90%). **65 JSON-RPC methods** (direct) + semantic registry with **Wire Standard L3** (cost_estimates + operation_dependencies). AGPL-3.0-or-later. Zero C FFI deps (ecoBin v3.0). **46 unsafe blocks** (all in hw-safe/GPU/VFIO/display/plugin containment crates); all SAFETY-documented; workspace `unsafe_code = "deny"`, **41 crates `forbid`** + 5 hw crates with narrow `#[allow(unsafe_code, reason)]`. **Zero production panics/expects**. IPC-first JSON-RPC (dual-socket: `compute.sock` + `compute-tarpc.sock`). Rust 1.85+ (edition 2024, MSRV). **BTSP Phase 3 encrypted channel** (ChaCha20-Poly1305, S215; transport switch verified S218). **PG-46 resolved** (socket reuse, S214). **Self-registration** with Songbird via `DISCOVERY_SOCKET` (S207). **Capability-based discovery compliant** per `CAPABILITY_BASED_DISCOVERY_STANDARD.md` v1.2.
+**Last Updated**: May 2026 — S226 (Deep Debt Audit — Workspace Clippy Clean). **22,843** workspace tests, 0 failures (7,884+ lib-only). ~83.6% lib-only line coverage (target 90%). **65 JSON-RPC methods** (direct) + semantic registry with **Wire Standard L3** (cost_estimates + operation_dependencies). AGPL-3.0-or-later. Zero C FFI deps (ecoBin v3.0). **46 unsafe blocks** (all in hw-safe/GPU/VFIO/display/plugin containment crates); all SAFETY-documented; workspace `unsafe_code = "deny"`, **41 crates `forbid`** + 5 hw crates with narrow `#[allow(unsafe_code, reason)]`. **Zero production panics/expects**. IPC-first JSON-RPC (dual-socket: `compute.sock` + `compute-tarpc.sock`). Rust 1.85+ (edition 2024, MSRV). **BTSP Phase 3 encrypted channel** (ChaCha20-Poly1305, S215; transport switch verified S218). **PG-46 resolved** (socket reuse, S214). **Self-registration** with Songbird via `DISCOVERY_SOCKET` (S207). **Capability-based discovery compliant** per `CAPABILITY_BASED_DISCOVERY_STANDARD.md` v1.2.
 
 ---
 

crates/distributed/src/network/metrics.rs

@@ -5,7 +5,7 @@ use tokio::sync::RwLock;
 
 /// Network metrics collector for distributed execution
 pub struct NetworkMetricsCollector {
-    #[cfg_attr(not(test), allow(dead_code))]
+    #[cfg_attr(not(test), allow(dead_code, reason = "stored for lifecycle; consumed in test assertions"))]
     metrics: Arc<RwLock<NetworkMetricsData>>,
 }
 

crates/integration/primals/src/client.rs

@@ -54,7 +54,7 @@ impl PrimalClient {
                     }
                 } else if msg.contains("No such file") || msg.contains("not found") {
                     PrimalError::ServiceUnavailable {
-                        service: format!("primal at {:?}", self.rpc_client.socket_path()),
+                        service: format!("primal at {}", self.rpc_client.socket_path().display()),
                     }
                 } else {
                     PrimalError::Integration {
@@ -67,7 +67,7 @@ impl PrimalClient {
         // Parse result into PrimalResponse if it's an object with success/data/error
         let response = if let Some(obj) = result.as_object() {
             PrimalResponse {
-                success: obj.get("success").and_then(|v| v.as_bool()).unwrap_or(true),
+                success: obj.get("success").and_then(serde_json::Value::as_bool).unwrap_or(true),
                 data: obj.get("data").cloned().unwrap_or(serde_json::Value::Null),
                 error: obj
                     .get("error")

crates/integration/primals/src/orchestrator.rs

@@ -95,14 +95,16 @@ impl PrimalOrchestrator {
             .data
             .get("deployment_id")
             .or_else(|| response.data.get("id"))
-            .and_then(|v| v.as_str())
-            .map(std::string::ToString::to_string)
-            .unwrap_or_else(|| format!("deployed-{}", manifest.name));
+            .and_then(serde_json::Value::as_str)
+            .map_or_else(
+                || format!("deployed-{}", manifest.name),
+                std::string::ToString::to_string,
+            );
 
         Ok(deployment_id)
     }
 
-    pub async fn register_primal(
+    pub fn register_primal(
         &mut self,
         primal_id: String,
         primal: Box<dyn PrimalIntegration>,
@@ -111,8 +113,8 @@ impl PrimalOrchestrator {
         Ok(())
     }
 
-    pub async fn get_primal(&self, primal_id: &str) -> Option<&dyn PrimalIntegration> {
-        self.primals.get(primal_id).map(|p| p.as_ref())
+    pub fn get_primal(&self, primal_id: &str) -> Option<&dyn PrimalIntegration> {
+        self.primals.get(primal_id).map(std::convert::AsRef::as_ref)
     }
 }
 
@@ -198,9 +200,8 @@ mod tests {
             should_fail: false,
         };
         orch.register_primal("test".to_string(), Box::new(mock))
-            .await
             .unwrap();
-        assert!(orch.get_primal("test").await.is_some());
-        assert!(orch.get_primal("nonexistent").await.is_none());
+        assert!(orch.get_primal("test").is_some());
+        assert!(orch.get_primal("nonexistent").is_none());
     }
 }

crates/integration/primals/src/services.rs

@@ -38,7 +38,7 @@ impl ServiceManager {
         }
     }
 
-    pub async fn start_service(
+    pub fn start_service(
         &mut self,
         service_id: String,
         service_type: String,
@@ -68,7 +68,7 @@ impl ServiceManager {
         Ok(())
     }
 
-    pub async fn stop_service(&mut self, service_id: &str) -> PrimalResult<()> {
+    pub fn stop_service(&mut self, service_id: &str) -> PrimalResult<()> {
         if let Some(service) = self.services.get_mut(service_id) {
             service.status = ServiceStatus::Stopped;
         }

deny.toml

@@ -74,8 +74,9 @@ deny = [
     # OpenSSL — use rustls + aws-lc-rs / *ring* instead
     { name = "openssl" },
     { name = "openssl-sys" },
-    # ring — C/asm crypto; use aws-lc-rs or other pure Rust alternatives
-    # License clarified in [[licenses.clarify]]; verified absent from Cargo.lock (S203l).
+    # ring — C/asm crypto; use aws-lc-rs or other pure Rust alternatives.
+    # License clarified in [[licenses.clarify]]; not in resolved workspace graph
+    # (stale lockfile entry may persist from older resolves — `cargo tree -i ring` returns empty).
     { name = "ring" },
     # async-trait — proc macro for dyn-safe async traits; fully evolved to manual
     # Pin<Box<dyn Future>> and native AFIT (S203r). No workspace crate depends on it directly.