chore(protocols): narrow the SessionDiag blanket to its one unread field

The last item-level bare allow of backlog#1823 step 10. `SessionDiag` itself is live — `sftp/server.rs` constructs one per accepted connection and `wedge_watchdog` reads `session_id`, `peer` and `last_activity_ms` off it — so the struct-level blanket was covering exactly one field: `accepted_at`, which is written at accept time and never read back. The allow moves onto that field with a reason.

The three remaining `#![allow(dead_code)]` in this crate (`sftp/test_support.rs`, `common/dummy_storage.rs`) are module-root blankets in test-support files, which belong to steps 1-5 rather than step 10.

Refs backlog#1823

crates/common/src/last_minute.rs

@@ -13,6 +13,82 @@
 // limitations under the License.
 
 use std::time::{Duration, SystemTime, UNIX_EPOCH};
+
+#[allow(dead_code)]
+#[derive(Debug, Default)]
+struct TimedAction {
+    count: u64,
+    acc_time: u64,
+    min_time: Option<u64>,
+    max_time: Option<u64>,
+    bytes: u64,
+}
+
+#[allow(dead_code)]
+impl TimedAction {
+    // Avg returns the average time spent on the action.
+    pub fn avg(&self) -> Option<Duration> {
+        if self.count == 0 {
+            return None;
+        }
+        Some(Duration::from_nanos(self.acc_time / self.count))
+    }
+
+    // AvgBytes returns the average bytes processed.
+    pub fn avg_bytes(&self) -> u64 {
+        if self.count == 0 {
+            return 0;
+        }
+        self.bytes / self.count
+    }
+
+    // Merge other into t.
+    pub fn merge(&mut self, other: TimedAction) {
+        self.count += other.count;
+        self.acc_time += other.acc_time;
+        self.bytes += other.bytes;
+
+        if self.count == 0 {
+            self.min_time = other.min_time;
+        }
+        if let Some(other_min) = other.min_time {
+            self.min_time = self.min_time.map_or(Some(other_min), |min| Some(min.min(other_min)));
+        }
+
+        self.max_time = self
+            .max_time
+            .map_or(other.max_time, |max| Some(max.max(other.max_time.unwrap_or(0))));
+    }
+}
+
+#[allow(dead_code)]
+#[derive(Debug)]
+enum SizeCategory {
+    SizeLessThan1KiB = 0,
+    SizeLessThan1MiB,
+    SizeLessThan10MiB,
+    SizeLessThan100MiB,
+    SizeLessThan1GiB,
+    SizeGreaterThan1GiB,
+    // Add new entries here
+    SizeLastElemMarker,
+}
+
+impl std::fmt::Display for SizeCategory {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        let s = match *self {
+            SizeCategory::SizeLessThan1KiB => "SizeLessThan1KiB",
+            SizeCategory::SizeLessThan1MiB => "SizeLessThan1MiB",
+            SizeCategory::SizeLessThan10MiB => "SizeLessThan10MiB",
+            SizeCategory::SizeLessThan100MiB => "SizeLessThan100MiB",
+            SizeCategory::SizeLessThan1GiB => "SizeLessThan1GiB",
+            SizeCategory::SizeGreaterThan1GiB => "SizeGreaterThan1GiB",
+            SizeCategory::SizeLastElemMarker => "SizeLastElemMarker",
+        };
+        write!(f, "{s}")
+    }
+}
+
 #[derive(Clone, Debug, Default, Copy)]
 pub struct AccElem {
     pub total: u64,

crates/config/src/notify/mod.rs

@@ -92,11 +92,15 @@ pub const NOTIFY_SUB_SYSTEMS: &[&str] = &[
 pub const NOTIFY_KAFKA_SUB_SYS: &str = "notify_kafka";
 pub const NOTIFY_MQTT_SUB_SYS: &str = "notify_mqtt";
 pub const NOTIFY_MYSQL_SUB_SYS: &str = "notify_mysql";
+#[allow(dead_code)]
 pub const NOTIFY_NATS_SUB_SYS: &str = "notify_nats";
+#[allow(dead_code)]
 pub const NOTIFY_NSQ_SUB_SYS: &str = "notify_nsq";
+#[allow(dead_code)]
 pub const NOTIFY_ES_SUB_SYS: &str = "notify_elasticsearch";
 pub const NOTIFY_AMQP_SUB_SYS: &str = "notify_amqp";
 pub const NOTIFY_POSTGRES_SUB_SYS: &str = "notify_postgres";
+#[allow(dead_code)]
 pub const NOTIFY_REDIS_SUB_SYS: &str = "notify_redis";
 pub const NOTIFY_REDIS_DEFAULT_CHANNEL: &str = "rustfs_notify_channel";
 pub const NOTIFY_PULSAR_SUB_SYS: &str = "notify_pulsar";

crates/e2e_test/src/kms/kms_local_test.rs

@@ -647,6 +647,7 @@ async fn test_multipart_upload_with_sse_c(
 }
 
 /// Test large multipart upload to verify streaming encryption works correctly
+#[allow(dead_code)]
 async fn test_large_multipart_upload(
     s3_client: &aws_sdk_s3::Client,
     bucket: &str,

crates/e2e_test/src/policy/test_runner.rs

@@ -35,6 +35,7 @@ impl TestCategory {}
 #[derive(Debug, Clone)]
 pub struct TestDefinition {
     pub name: String,
+    #[allow(dead_code)]
     pub category: TestCategory,
     pub is_critical: bool,
 }

crates/heal/src/heal/manager.rs

@@ -581,6 +581,14 @@ impl PriorityHealQueue {
             }
         }
     }
+
+    /// Check if a request with the same key already exists in the queue
+    #[allow(dead_code)]
+    fn contains_key(&self, request: &HealRequest) -> bool {
+        let key = Self::make_dedup_key(request);
+        self.dedup_keys.contains_key(&key)
+    }
+
     /// Check if an erasure set heal request for a specific set_disk_id exists
     fn contains_erasure_set(&self, set_disk_id: &str) -> bool {
         let key = format!("erasure_set:{set_disk_id}");

crates/heal/src/heal/storage.rs

@@ -42,10 +42,7 @@ pub struct HealLifecycleExpiryContext {
 
 enum HealLifecycleExpiryContextInner {
     Ecstore(EcstoreHealLifecycleExpiryContext),
-    #[allow(
-        dead_code,
-        reason = "constructed by the #[cfg(test)] `test()` helper; the lib target cannot see test-only consumers (backlog#1823)"
-    )]
+    #[allow(dead_code)]
     Test,
 }
 

crates/madmin/src/service_commands.rs

@@ -19,6 +19,7 @@ use hyper::Uri;
 use crate::{trace::TraceType, utils::parse_duration};
 
 #[derive(Debug, Default)]
+#[allow(dead_code)]
 pub struct ServiceTraceOpts {
     s3: bool,
     internal: bool,
@@ -40,6 +41,7 @@ pub struct ServiceTraceOpts {
     threshold: Duration,
 }
 
+#[allow(dead_code)]
 impl ServiceTraceOpts {
     pub fn trace_types(&self) -> TraceType {
         let mut tt = TraceType::default();

crates/notify/examples/base.rs

@@ -15,6 +15,7 @@
 use std::io::IsTerminal;
 use tracing_subscriber::{EnvFilter, fmt, prelude::*, util::SubscriberInitExt};
 
+#[allow(dead_code)]
 fn main() {
     init_logger(LogLevel::Info);
     tracing::info!("Tracing logger initialized with Info level");

crates/protocols/src/sftp/lifecycle.rs

@@ -84,11 +84,11 @@ const TCP_STATE_RADIX: u32 = 16;
 /// and the SftpDriver, registered weakly into the SessionRegistry so an
 /// outside observer can enumerate live sessions without holding their
 /// lifetime.
-#[allow(dead_code)]
 pub struct SessionDiag {
     pub session_id: u64,
     pub local: SocketAddr,
     pub peer: SocketAddr,
+    #[allow(dead_code, reason = "written at accept time but never read back (backlog#1823)")]
     pub accepted_at: Instant,
     pub last_activity_ms: AtomicU64,
 }

crates/s3select-query/src/sql/logical/optimizer.rs

@@ -46,6 +46,15 @@ pub struct DefaultLogicalOptimizer {
     analyzer: AnalyzerRef,
     rules: Vec<Arc<dyn OptimizerRule + Send + Sync>>,
 }
+
+impl DefaultLogicalOptimizer {
+    #[allow(dead_code)]
+    fn with_optimizer_rules(mut self, rules: Vec<Arc<dyn OptimizerRule + Send + Sync>>) -> Self {
+        self.rules = rules;
+        self
+    }
+}
+
 impl Default for DefaultLogicalOptimizer {
     fn default() -> Self {
         let analyzer = Arc::new(DefaultAnalyzer::default());

crates/s3select-query/src/sql/physical/planner.rs

@@ -36,9 +36,21 @@ pub struct DefaultPhysicalPlanner {
     ext_physical_optimizer_rules: Vec<Arc<dyn PhysicalOptimizerRule + Send + Sync>>,
 }
 
-impl DefaultPhysicalPlanner {}
+impl DefaultPhysicalPlanner {
+    #[allow(dead_code)]
+    fn with_physical_transform_rules(mut self, rules: Vec<Arc<dyn ExtensionPlanner + Send + Sync>>) -> Self {
+        self.ext_physical_transform_rules = rules;
+        self
+    }
+}
 
-impl DefaultPhysicalPlanner {}
+impl DefaultPhysicalPlanner {
+    #[allow(dead_code)]
+    fn with_optimizer_rules(mut self, rules: Vec<Arc<dyn PhysicalOptimizerRule + Send + Sync>>) -> Self {
+        self.ext_physical_optimizer_rules = rules;
+        self
+    }
+}
 
 impl Default for DefaultPhysicalPlanner {
     fn default() -> Self {

crates/signer/src/request_signature_streaming.rs

@@ -22,7 +22,7 @@ use s3s::Body;
 
 const STREAMING_SIGN_ALGORITHM: &str = "STREAMING-AWS4-HMAC-SHA256-PAYLOAD";
 const STREAMING_SIGN_TRAILER_ALGORITHM: &str = "STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER";
-const _STREAMING_PAYLOAD_HDR: &str = "AWS4-HMAC-SHA256-PAYLOAD";
+const STREAMING_PAYLOAD_HDR: &str = "AWS4-HMAC-SHA256-PAYLOAD";
 const _STREAMING_TRAILER_HDR: &str = "AWS4-HMAC-SHA256-TRAILER";
 const _PAYLOAD_CHUNK_SIZE: i64 = 64 * 1024;
 const _CHUNK_SIGCONST_LEN: i64 = 17;
@@ -51,14 +51,15 @@ fn streaming_fail(request: request::Request<Body>, error: SignV4Error) -> Stream
     Err(Box::new(StreamingSignFailure { request, error }))
 }
 
-fn _try_build_chunk_string_to_sign(
+#[allow(dead_code)]
+fn try_build_chunk_string_to_sign(
     t: OffsetDateTime,
     region: &str,
     previous_sig: &str,
     chunk_check_sum: &str,
 ) -> Result<String, SignV4Error> {
     let mut string_to_sign_parts = <Vec<String>>::new();
-    string_to_sign_parts.push(_STREAMING_PAYLOAD_HDR.to_string());
+    string_to_sign_parts.push(STREAMING_PAYLOAD_HDR.to_string());
     let format = format_description!("[year][month][day]T[hour][minute][second]Z");
     string_to_sign_parts.push(
         t.format(&format)
@@ -78,7 +79,7 @@ fn _try_build_chunk_signature(
     previous_signature: &str,
     secret_access_key: &str,
 ) -> Result<String, SignV4Error> {
-    let chunk_string_to_sign = _try_build_chunk_string_to_sign(req_time, region, previous_signature, chunk_check_sum)?;
+    let chunk_string_to_sign = try_build_chunk_string_to_sign(req_time, region, previous_signature, chunk_check_sum)?;
     let signing_key = get_signing_key(secret_access_key, region, req_time, SERVICE_TYPE_S3);
     Ok(get_signature(signing_key, &chunk_string_to_sign))
 }