chore: restore clippy quality gate

crates/geth-auth/src/lib.rs

@@ -258,8 +258,9 @@ fn explain_from_ops_and_view(
     let evaluated_ops = ops.len();
     if let Some(secret) = subject.as_str().strip_prefix("bearer:") {
         let secret = SecretId::new(secret.to_owned());
-        if let Some(access) = view.bearer_access.get(&secret) {
+        if let Some(access) = view.bearer_access.get(&secret)
-            if access.resource == resource {
+            && access.resource == resource
+        {
             if let Some(granted_capability) = access
                 .capabilities
                 .iter()
@@ -298,7 +299,6 @@ fn explain_from_ops_and_view(
                 ],
             };
         }
-        }
 
         if ops.iter().any(|op| {
             op.resource == resource

crates/geth-keychain/src/lib.rs

@@ -491,13 +491,13 @@ pub fn reduce_keychain_ops(ops: &[KeychainOp]) -> KeychainView {
                 revoked_devices.insert(device.clone());
             }
             KeychainOpKind::DeviceKeyAdd { device, key } => {
-                if let Some(record) = devices.get_mut(device) {
+                if let Some(record) = devices.get_mut(device)
-                    if !record.keys.contains(key) {
+                    && !record.keys.contains(key)
+                {
                     record.keys.push(key.clone());
                     record.keys.sort();
                 }
             }
-            }
             KeychainOpKind::DeviceKeyRevoke { device, key } => {
                 if let Some(record) = devices.get_mut(device) {
                     record.keys.retain(|item| item != key);
@@ -521,13 +521,13 @@ pub fn reduce_keychain_ops(ops: &[KeychainOp]) -> KeychainView {
                 revoked_nodes.insert(node.clone());
             }
             KeychainOpKind::NodeEndpointAdd { node, endpoint } => {
-                if let Some(record) = nodes.get_mut(node) {
+                if let Some(record) = nodes.get_mut(node)
-                    if !record.endpoints.contains(endpoint) {
+                    && !record.endpoints.contains(endpoint)
+                {
                     record.endpoints.push(endpoint.clone());
                     record.endpoints.sort();
                 }
             }
-            }
             KeychainOpKind::NodeEndpointRevoke { node, endpoint } => {
                 if let Some(record) = nodes.get_mut(node) {
                     record.endpoints.retain(|item| item != endpoint);

crates/geth-node/src/lib.rs

@@ -1657,14 +1657,14 @@ async fn cas_root_sync_from_peer(
                     let stored_name = remote_file_root_name(&node_id, &remote_root.name);
                     let stored_path = format!("remote:{node_id}:{}", remote_root.name);
                     let existing_remote_root = store.get_file_root_by_name(&stored_name)?;
-                    if let Some(existing) = &existing_remote_root {
+                    if let Some(existing) = &existing_remote_root
-                        if existing.path != stored_path {
+                        && existing.path != stored_path
+                    {
                         return Err(NodeError::IrohPeer(format!(
                             "refusing to overwrite existing file root {} at {}",
                             existing.name, existing.path
                         )));
                     }
-                    }
                     let base_tree = existing_remote_root
                         .as_ref()
                         .and_then(|existing| existing.latest_tree_json.as_deref())
@@ -1695,8 +1695,8 @@ async fn cas_root_sync_from_peer(
                         remote_tree_json = Some(serde_json::to_string(&remote_tree)?);
                         if let (Some(base_tree), Some(local_root)) =
                             (&base_tree, store.get_file_root_by_name(&remote_root.name)?)
+                            && local_root.latest_tree_json.is_some()
                         {
-                            if local_root.latest_tree_json.is_some() {
                             sync_conflicts.extend(record_sync_tree_conflicts(
                                 &store,
                                 &local_root,
@@ -1710,7 +1710,6 @@ async fn cas_root_sync_from_peer(
                             )?);
                         }
                     }
-                    }
                     let stored = StoredFileRoot {
                         root_id: format!("file-root:remote:{node_id}:{}", remote_root.name),
                         resource_id: remote_root.resource.clone(),
@@ -3735,11 +3734,11 @@ async fn db_sync_from_peer(
                     } else {
                         0
                     };
-                    if schema_match {
+                    if schema_match
-                        if let Some(next_cursor) = high_water_db_version.or(max_db_version) {
+                        && let Some(next_cursor) = high_water_db_version.or(max_db_version)
+                    {
                         store_live_sync_cursor(&store, peer_node, &stream, next_cursor)?;
                     }
-                    }
                     (
                         changes_received,
                         changes_applied,
@@ -4056,15 +4055,15 @@ fn sync_watermarks_for_peer(
         }
     }
     for db in store.list_db_resources()? {
-        if can_sync_resource(store, &peer, &db.resource_id, "db.sync")? {
+        if can_sync_resource(store, &peer, &db.resource_id, "db.sync")?
-            if let Ok(metadata) = geth_db::crsqlite_change_metadata(Path::new(&db.path)) {
+            && let Ok(metadata) = geth_db::crsqlite_change_metadata(Path::new(&db.path))
+        {
             watermarks.push(SyncWatermark {
                 stream: format!("db:{}", db.name),
                 high_water: metadata.max_db_version.unwrap_or(0),
             });
         }
     }
-    }
     for root in store.list_file_roots()? {
         if root.path.starts_with("remote:") {
             continue;

docs/production-readiness-roadmap.md

@@ -27,7 +27,7 @@ Goal: make the documented local quality gate pass before deeper refactors.
   - `[x]` `cargo fmt --all -- --check` passes.
   - `[x]` `cargo check --workspace --all-targets` passes.
   - `[x]` `cargo test --workspace` passes.
-  - `[ ]` `cargo clippy --workspace --all-targets -- -D warnings` passes.
+  - `[x]` `cargo clippy --workspace --all-targets -- -D warnings` passes.
   - `[ ]` CI enforces the same required checks.
 
 ## Phase 1: Daemon Subsystem Refactor