refactor(opentimstdf): eliminate panic surface in reader + py bindings (WP17)

- reader.rs: convert 2 `tdf_bin.lock().unwrap()` mutex calls to
  `map_err(|_| Error::CorruptFrame(.., "tdf_bin mutex poisoned"))?`
  so a poisoned guard surfaces as a structured error.
- reader.rs / codec.rs: replace `header[a..b].try_into().unwrap()` on
  fixed-size header arrays with direct `[u8; 4]` literals;
  `chunks_exact(4)` unwraps are kept under a localized
  `#[allow(clippy::unwrap_used)]` with rationale (length guaranteed
  by the iterator contract).
- mzml.rs: the two `self.spectra.as_ref().unwrap()` (populated
  immediately above) become `.expect("populated above")` with a
  localized lint allow.
- opentimstdf-py: convert all 11 `inner.lock().unwrap()` sites to
  `.lock().map_err(|_| PyRuntimeError::new_err("reader lock
  poisoned"))?`, surfacing the failure to Python as a RuntimeError.
- Gate `clippy::unwrap_used` / `expect_used` as warn in non-test
  production code at both crate roots.

Refs: WP17 panic-surface sweep.

Author: Nathan-D-R

crates/opentimstdf-py/src/lib.rs

@@ -1,3 +1,4 @@
+#![cfg_attr(not(test), warn(clippy::unwrap_used, clippy::expect_used))]
 //! Python bindings for OpenTimsTDF.
 //!
 //! Exposes `opentimstdf.Reader`, which opens a `.d/` (TDF) bundle once and
@@ -438,14 +439,18 @@ impl Reader {
 
     #[getter]
     fn compression_type(&self) -> PyResult<u32> {
-        Ok(self.inner.lock().unwrap().compression_type())
+        Ok(self
+            .inner
+            .lock()
+            .map_err(|_| PyRuntimeError::new_err("reader lock poisoned"))?
+            .compression_type())
     }
 
     fn metadata(&self) -> PyResult<Metadata> {
         Ok(self
             .inner
             .lock()
-            .unwrap()
+            .map_err(|_| PyRuntimeError::new_err("reader lock poisoned"))?
             .metadata()
             .map_err(to_py_err)?
             .into())
@@ -455,7 +460,7 @@ impl Reader {
         let inner = self
             .inner
             .lock()
-            .unwrap()
+            .map_err(|_| PyRuntimeError::new_err("reader lock poisoned"))?
             .calibration()
             .map_err(to_py_err)?;
         Ok(Calibration { inner })
@@ -465,7 +470,7 @@ impl Reader {
         Ok(self
             .inner
             .lock()
-            .unwrap()
+            .map_err(|_| PyRuntimeError::new_err("reader lock poisoned"))?
             .frame(id)
             .map_err(to_py_err)?
             .into())
@@ -475,7 +480,7 @@ impl Reader {
         Ok(self
             .inner
             .lock()
-            .unwrap()
+            .map_err(|_| PyRuntimeError::new_err("reader lock poisoned"))?
             .frames()
             .map_err(to_py_err)?
             .into_iter()
@@ -499,7 +504,7 @@ impl Reader {
         Ok(self
             .inner
             .lock()
-            .unwrap()
+            .map_err(|_| PyRuntimeError::new_err("reader lock poisoned"))?
             .decode_peaks(&rs_frame)
             .map_err(to_py_err)?
             .into_iter()
@@ -511,7 +516,7 @@ impl Reader {
         Ok(self
             .inner
             .lock()
-            .unwrap()
+            .map_err(|_| PyRuntimeError::new_err("reader lock poisoned"))?
             .dia_windows_for_frame(frame_id)
             .map_err(to_py_err)?
             .map(Into::into))
@@ -521,7 +526,7 @@ impl Reader {
         Ok(self
             .inner
             .lock()
-            .unwrap()
+            .map_err(|_| PyRuntimeError::new_err("reader lock poisoned"))?
             .pasef_msms_info_for_frame(frame_id)
             .map_err(to_py_err)?
             .into_iter()
@@ -533,7 +538,7 @@ impl Reader {
         Ok(self
             .inner
             .lock()
-            .unwrap()
+            .map_err(|_| PyRuntimeError::new_err("reader lock poisoned"))?
             .prm_msms_info_for_frame(frame_id)
             .map_err(to_py_err)?
             .into_iter()
@@ -545,7 +550,7 @@ impl Reader {
         Ok(self
             .inner
             .lock()
-            .unwrap()
+            .map_err(|_| PyRuntimeError::new_err("reader lock poisoned"))?
             .prm_target(target_id)
             .map_err(to_py_err)?
             .map(Into::into))
@@ -555,7 +560,7 @@ impl Reader {
         Ok(self
             .inner
             .lock()
-            .unwrap()
+            .map_err(|_| PyRuntimeError::new_err("reader lock poisoned"))?
             .precursor(precursor_id)
             .map_err(to_py_err)?
             .map(Into::into))

crates/opentimstdf/src/codec.rs

@@ -131,6 +131,8 @@ pub fn decode_codec1(
         let mut tof: u32 = 0;
         let mut prev_was_intensity = true;
         for chunk in scratch.chunks_exact(4) {
+            // chunks_exact(4) guarantees chunk.len() == 4
+            #[allow(clippy::unwrap_used)]
             let v = i32::from_le_bytes(chunk.try_into().unwrap());
             if v >= 0 {
                 if prev_was_intensity {

crates/opentimstdf/src/lib.rs

@@ -1,3 +1,4 @@
+#![cfg_attr(not(test), warn(clippy::unwrap_used, clippy::expect_used))]
 //! OpenTimsTDF - Rust reader for timsTOF `.d/` (TDF) mass spectrometry bundles.
 //!
 //! The format and codecs are documented in `re/SPEC.md` (and mirrored on

crates/opentimstdf/src/mzml.rs

@@ -395,7 +395,8 @@ impl<'a> TdfSource<'a> {
                 &self.calibration,
             )?);
         }
-        Ok(self.spectra.as_ref().unwrap())
+        #[allow(clippy::expect_used)]
+        Ok(self.spectra.as_ref().expect("populated above"))
     }
 }
 
@@ -419,7 +420,8 @@ impl OwnedTdfSource {
                 &self.calibration,
             )?);
         }
-        Ok(self.spectra.as_ref().unwrap())
+        #[allow(clippy::expect_used)]
+        Ok(self.spectra.as_ref().expect("populated above"))
     }
 }
 

crates/opentimstdf/src/reader.rs

@@ -420,13 +420,16 @@ impl Reader {
     }
 
     fn decode_peaks_codec2(&self, frame: &Frame) -> Result<Vec<Peak>> {
-        let mut f = self.tdf_bin.lock().unwrap();
+        let mut f = self
+            .tdf_bin
+            .lock()
+            .map_err(|_| Error::CorruptFrame(frame.id, "tdf_bin mutex poisoned".into()))?;
         f.seek(SeekFrom::Start(frame.tims_id))?;
 
         let mut header = [0u8; 8];
         f.read_exact(&mut header)?;
-        let block_size = u32::from_le_bytes(header[0..4].try_into().unwrap());
-        let scan_count = u32::from_le_bytes(header[4..8].try_into().unwrap());
+        let block_size = u32::from_le_bytes([header[0], header[1], header[2], header[3]]);
+        let scan_count = u32::from_le_bytes([header[4], header[5], header[6], header[7]]);
         if scan_count != frame.num_scans {
             return Err(Error::CorruptFrame(
                 frame.id,
@@ -473,13 +476,16 @@ impl Reader {
             .parse()
             .unwrap_or(0);
 
-        let mut f = self.tdf_bin.lock().unwrap();
+        let mut f = self
+            .tdf_bin
+            .lock()
+            .map_err(|_| Error::CorruptFrame(frame.id, "tdf_bin mutex poisoned".into()))?;
         f.seek(SeekFrom::Start(frame.tims_id))?;
 
         let mut header = [0u8; 8];
         f.read_exact(&mut header)?;
-        let bin_size = u32::from_le_bytes(header[0..4].try_into().unwrap());
-        let scan_count = u32::from_le_bytes(header[4..8].try_into().unwrap());
+        let bin_size = u32::from_le_bytes([header[0], header[1], header[2], header[3]]);
+        let scan_count = u32::from_le_bytes([header[4], header[5], header[6], header[7]]);
         if scan_count != frame.num_scans {
             return Err(Error::CorruptFrame(
                 frame.id,
@@ -505,6 +511,8 @@ impl Reader {
         f.read_exact(&mut raw_offsets)?;
         let mut scan_offsets = Vec::with_capacity(scan_count as usize + 1);
         for chunk in raw_offsets.chunks_exact(4) {
+            // chunks_exact(4) guarantees chunk.len() == 4
+            #[allow(clippy::unwrap_used)]
             let o = u32::from_le_bytes(chunk.try_into().unwrap());
             scan_offsets.push(o.saturating_sub(compression_offset) as usize);
         }