Never crash: render and gpu crates without panic!()

render: the debug-only quantisation check uses debug_assert! instead of panic!. gpu: the
test-only panic on a wgpu validation error is cfg(test) with a narrow allow, and release
builds only log. Test-only unreachable!() calls become panic!(). Denies the panic lints in both
crates.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

clippy.toml

@@ -0,0 +1,4 @@
+allow-unwrap-in-tests = true
+allow-expect-in-tests = true
+allow-panic-in-tests = true
+allow-indexing-slicing-in-tests = true

crates/gpu/src/context.rs

@@ -507,9 +507,12 @@ impl GpuContext {
             .map_err(|e| format!("no device: {e}"))?;
         device.on_uncaptured_error(Arc::new(|e| {
             // Under test a validation error (a WGSL typo invalidates every kernel) fails loudly.
-            if cfg!(test) {
+            #[cfg(test)]
-                panic!("wgpu: {e}");
+            #[allow(clippy::panic)] // test builds only
+            {
+                panic!("wgpu: {e}")
             }
+            #[cfg(not(test))]
             log::error!("wgpu: {e}")
         }));
         GpuContext::new(&adapter, device, queue)

crates/gpu/src/lib.rs

@@ -51,6 +51,8 @@
 //! skip readback entirely with [`Gpu::render_display`], which leaves an RGBA8 texture for
 //! egui-wgpu to draw.
 
+#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
+
 mod adv3d;
 mod bokeh;
 mod classic3d;

crates/render/src/color.rs

@@ -131,7 +131,8 @@ impl Pipe {
                 (p[3] - a).abs() > 1e-5 || (0..3).any(|c| (p[c] - q(p[c], a)).abs() > 1e-5)
             });
             if let Some(i) = bad {
-                panic!(
+                debug_assert!(
+                    false,
                     "pixel ({}, {}) outside the quantised region {region:?} is not quantised: {:?}",
                     i as u32 % img.width,
                     i as u32 / img.width,

crates/render/src/lib.rs

@@ -6,6 +6,8 @@
 //! with motion blur sub-samples) → **track matte** → **blend** with the layer's mode and opacity.
 //! Adjustment layers run their effects on everything below, limited by their own bounds/masks.
 
+#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
+
 pub mod audio;
 pub mod auto;
 pub mod cache;

crates/render/src/shapes/tests.rs

@@ -314,7 +314,7 @@ fn shape_perf_repeater_60_copies_1080p() {
     }
     let ms = t0.elapsed().as_secs_f64() * 1000.0 / n as f64;
     println!("shape_perf: 60-copy repeater at 1920x1080: {ms:.2} ms/frame");
-    let ItemKind::Comp(comp) = &p.item(cid).unwrap().kind else { unreachable!() };
+    let ItemKind::Comp(comp) = &p.item(cid).unwrap().kind else { panic!("not a composition") };
     let layer = &comp.layers[0];
     let ctx = crate::eval::EvalCtx::new(&p, cid, comp, Tick::ZERO);
     let contents = layer.props.sub("contents").unwrap();

crates/render/src/tests.rs

@@ -309,7 +309,7 @@ fn edits_invalidate_cached_layers() {
         (
             "solid colour",
             Box::new(|p, cid| {
-                let LayerSource::Solid { item } = p.comp(cid).unwrap().layers[2].source else { unreachable!() };
+                let LayerSource::Solid { item } = p.comp(cid).unwrap().layers[2].source else { panic!("not a solid layer") };
                 if let ItemKind::Solid(s) = &mut p.item_mut(item).unwrap().kind {
                     s.color = [0.9, 0.1, 0.1];
                 }