chore: cargo clippy fixes to prepare for the rustc upgrade: 1.98.1 -> 1.99.0

[basvandijk]

cargo clippy fixes to prepare for upgrading to
rustc-1.99.0.

Clippy 0.1.99 and rustc 1.99.0 report diagnostics at 124 sites that 1.98.1 does not, in 67
source files plus 5 tonic-generated ones. 107 of these sites are clippy false positives in
macro-generated code; the other 17 are fixed in the code:

lint	sites	why it fires now	fix
double_must_use	66	#16633 makes clippy use rustc's #[must_use] determination. Clippy now sees that the Pin<Box<dyn Future>> an #[async_trait] method returns is already #[must_use], and flags the #[must_use] that async-trait adds to it. That hits every one of the 61 #[async_trait] traits in the workspace, plus 5 tonic-generated ones (141 diagnostics, one per async method)	--allow (see below)
redundant_field_names	41	#17294 moved the macro check from the struct expression to its fields. In derive output the fields' spans point at user code: thiserror's From impl for #[from] source fields (16) and derive_new::new (25, all in ic_boundary)	--allow (see below)
deprecated (rustc)	13	rust#148590 deprecates Atomic*::fetch_update in favour of its new name try_update (3). rust#146882 fully deprecates the legacy std::f32/std::f64 module constants, which use std::f32;/use std::f64; made f32::NAN etc. resolve to (10)	fetch_update → try_update; drop use std::f64; from metrics_proxy and use std::f32;/use std::f64; from nan_canonicalized (see below)
nonstandard_macro_braces	3	#16808 moved the lint from nursery to style, so clippy::all now enables it	format! {..} / write! {..} → format!(..) / write!(..)
single_element_loop	1	#16513: now also fires when the loop body is a single expression	for (flag, s) in [(sns, "sns")] { if flag.is_some() { .. } } → if sns.is_some() { .. }

Three of these deserve a word:

• double_must_use and redundant_field_names are allowed globally rather than at each site,
  both in ci/scripts/rust-lint.sh and in the second clippy gate, the PocketIC Windows lint
  (.github/workflows/pocket-ic-tests-windows.yml). Its cargo clippy -p pocket-ic also lints
  pocket-ic's workspace path dependencies, which include #[async_trait] traits. The lints flag code
  that the macros generate, not code anyone wrote. Per-site #[allow]s would touch 64 files across
  most teams: the 59 with flagged code plus the 5 that include tonic-generated code. Every new
  #[async_trait] trait, #[from] source field or #[derive(new)] struct would then need one too.

  • The trade-off: until the allows are removed, both lints also stop catching hand-written code.
  • Clippy has already fixed the first one
    (#17547, merged after 1.99 branched, so
    it ships in 1.100). The second is still open as
    #17525.
  • Upgrading the macros instead is not an option. async-trait 0.1.92 and thiserror 2.0.20 do
    suppress the lints in their output, but both require syn 3, which this repo deliberately avoids
    (thiserror = "=2.0.18", feat: bump ic-wasm and drop syn 3 #11016). derive-new has had no release since 0.7.0.
  • This is how the 1.88 upgrade (chore: update rust to 1.88.0 #6045) handled uninlined_format_args.

  The Windows workflow's path filter now also matches rust-toolchain.toml, so a toolchain bump
  (like the PR stacked on this one) runs the Windows lint and tests before it merges, rather than
  first in the next daily run on master.

• use std::f32; / use std::f64; bring the module into scope. For names that exist in that
  module it shadows the primitive type. So f64::INFINITY resolved to the deprecated
  std::f64::INFINITY rather than the associated constant on f64 (same value), while f64::ln
  and the like fell through to the primitive type. Without the imports every f32::…/f64::… path
  in those two files resolves to the primitive type.

• try_update is fetch_update under its new name: same arguments, same result. It has been
  stable since 1.95, so it also builds on the currently pinned toolchain.

Because this PR lands before the toolchain bump, it has to stay clean on 1.98.1 too. It does not
name any lint that is new in 1.99: both allowed lints exist in Clippy 0.1.98, so there is no
unknown_lints issue. It also uses no API that 1.98.1 lacks.

The toolchain upgrade itself is the PR stacked on top of this one.

Testing

• ./ci/scripts/rust-lint.sh exits 0 both on the currently pinned 1.98.1 and on 1.99.0.
• On 1.98.1, these pass:
  • cargo check --all-targets --all-features of the 7 touched crates
  • bazel build of the 8 directly affected targets
• Of the 464 tests that depend on the touched files within two hops, 459 passed locally before the
  run was stopped in favour of CI, which passes on all targets (CI_ALL_BAZEL_TARGETS). The 3 local
  failures are environmental:
  • two golden-state tests: golden_state_swap_upgrade_twice cannot fetch its state over SSH from
    the dev environment, and upgrade_canisters_with_golden_nns_state needs
    NNS_CANISTER_UPGRADE_SEQUENCE
  • a cketh minter test timed out under full machine load

🤖 Generated with Claude Code

[Copilot]

Copilot review overview

🟢 Approval recommended

The changes are mechanical, behavior-preserving, and consistently address the reported Rust 1.99 diagnostics.

Review effort: Balanced
Findings: None

What changed in this PR

Prepares the workspace for Rust 1.99 by resolving newly reported Clippy and deprecation diagnostics without changing runtime behavior.

Changes:

• Replaces deprecated atomic operations and legacy float-module imports.
• Standardizes macro delimiters and simplifies a single-element loop.
• Allows two known Clippy false positives in generated code.

File	Description
ci/​scripts/​rust-lint.sh	Allows generated-code false positives.
packages/​pocket-ic/​src/​common/​rest.rs	Simplifies SNS feature handling.
rs/​consensus/​chain_key/​src/​lib.rs	Uses AtomicUsize::try_update.
rs/​embedders/​src/​wasmtime_embedder/​host_memory.rs	Uses AtomicUsize::try_update.
rs/​embedders/​src/​wasmtime_embedder/​linker.rs	Standardizes format! delimiters.
rs/​monitoring/​metrics_proxy/​src/​proxy.rs	Removes deprecated float-module import.
rs/​pocket_ic_server/​src/​main.rs	Uses AtomicU64::try_update.
rs/​rust_canisters/​tests/​src/​nan_canonicalized.rs	Uses primitive float constants directly.
rs/​types/​types/​src/​crypto/​threshold_sig/​errors/​threshold_sign_error.rs	Standardizes write! delimiters.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to b1b2b5c.

Security Overview

• 🔎 Scanned files: 10 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/f5e9d2bb-29a4-4b64-902a-391d65fd8b2d?scanId=646db932-a986-4190-8841-a175b4e8358d&codeScanTypes=PrScan&tab=issues&detectionTypes=traditional,businessLogic,customRule,IAC,SECRETS,CICD,EOL,uncategorized

Detected Code Changes

Change Type	Relevant files
Enhancement	► .github/workflows/pocket-ic-tests-windows.yml     Add rust-toolchain.toml to test scope ► .github/workflows/pocket-ic-tests-windows.yml     Relax clippy allowances for certain lints
Enhancement	► ci/scripts/rust-lint.sh     Add additional clippy allowances (double_must_use, redundant_field_names)
Bug Fix / Refactor	► packages/pocket-ic/src/common/rest.rs     SNS subnet handling simplified by checking sns presence directly
Refactor	► rs/consensus/chain_key/src/lib.rs     Replace fetch_update with try_update in size calculation
Refactor	► rs/embedders/src/wasmtime_embedder/host_memory.rs     Replace fetch_update with try_update in memory page calculation
Refactor	► rs/embedders/src/wasmtime_embedder/linker.rs     Fix formatting in error message construction
Refactor	► rs/pocket_ic_server/src/main.rs     Replace fetch_update with try_update in PendingGuard logic
Refactor	► rs/monitoring/metrics_proxy/src/proxy.rs     Remove unused std::f64 import
Refactor	► rs/rust_canisters/tests/src/nan_canonicalized.rs     Remove unused std::f32 import
Refactor	► rs/types/types/src/crypto/threshold_sig/errors/threshold_sign_error.rs     Format string adjustment for KeyIdInstantiationError branch

[github-actions]

This pull request changes code owned by the Governance team. Therefore, make sure that
you have considered the following (for Governance-owned code):

1. Update unreleased_changelog.md (if there are behavior changes, even if they are
   non-breaking).

2. Are there BREAKING changes?

3. Is a data migration needed?

4. Security review?

How to Satisfy This Automatic Review

1. Go to the bottom of the pull request page.

2. Look for where it says this bot is requesting changes.

3. Click the three dots to the right.

4. Select "Dismiss review".

5. In the text entry box, respond to each of the numbered items in the previous
   section, declare one of the following:

• Done.

• $REASON_WHY_NO_NEED. E.g. for unreleased_changelog.md, "No
  canister behavior changes.", or for item 2, "Existing APIs
  behave as before.".

Brief Guide to "Externally Visible" Changes

"Externally visible behavior change" is very often due to some NEW canister API.

Changes to EXISTING APIs are more likely to be "breaking".

If these changes are breaking, make sure that clients know how to migrate, how to
maintain their continuity of operations.

If your changes are behind a feature flag, then, do NOT add entrie(s) to
unreleased_changelog.md in this PR! But rather, add entrie(s) later, in the PR
that enables these changes in production.

Reference(s)

For a more comprehensive checklist, see here.

GOVERNANCE_CHECKLIST_REMINDER_DEDUP

No canister behavioural changes.