fix: resolve dead_code and clippy warnings exposed by --all-features

- Allow dead_code on intentionally unused methods/fields in rocksdb
- Allow clippy::collapsible_if on patterns that would require unstable
  && let syntax (let_chains, RFC 2497) for MSRV 1.86 compatibility
- Collapse bool-inner if-let chains where && with non-let condition
- Fix needless_borrows_for_generic_args, redundant_closure,
  unnecessary_lazy_evaluations, unnecessary_sort_by across backends
- Add clippy::too_many_arguments, clippy::type_complexity allows
- Scope RwLock guards in mod.rs to avoid await_holding_lock

Author: parv68

crates/aegis-core/src/engine/analysis/graph.rs

@@ -20,6 +20,7 @@ impl GraphEngine {
     ) -> AegisResult<ReachabilityReport> {
         // Cache check
         let cache_key = format!("reach:{}:{}:{}", resource.as_str(), max_depth, max_nodes);
+        #[allow(clippy::collapsible_if)]
         if let Some(ttl) = cache_ttl_ms {
             if let Some(cached) = self.get_cached_analysis(&cache_key, ttl) {
                 return Ok(cached);
@@ -188,7 +189,7 @@ impl GraphEngine {
             })
             .collect();
 
-        result.sort_by(|a, b| b.resource_count.cmp(&a.resource_count));
+        result.sort_by_key(|b| std::cmp::Reverse(b.resource_count));
         Ok(result)
     }
 
@@ -210,6 +211,7 @@ impl GraphEngine {
     }
 
     fn set_cached_analysis(&self, key: &str, value: &impl serde::Serialize, ttl_ms: u64) {
+        #[allow(clippy::collapsible_if)]
         if let Ok(mut cache) = self.analysis_cache.lock() {
             if let Ok(json) = serde_json::to_string(value) {
                 cache.insert(key.to_string(), (Instant::now(), ttl_ms, json));

crates/aegis-core/src/engine/analysis/mod.rs

@@ -48,6 +48,7 @@ impl GraphEngine {
         if !allowed {
             let schema = self.schema.read().unwrap();
             let type_def = schema.types.get(&resource_type);
+            #[allow(clippy::collapsible_if)]
             if let Some(type_def) = type_def {
                 if !type_def.deny.is_empty() {
                     'deny_check: for deny_def in &type_def.deny {
@@ -56,6 +57,7 @@ impl GraphEngine {
                                 Ok(r) => r,
                                 Err(_) => continue,
                             };
+                            #[allow(clippy::collapsible_if)]
                             if let Ok(tr) = crate::engine::traversal::bfs_traversal(
                                 &self.active_partition_id(),
                                 self.storage.as_ref(),

crates/aegis-core/src/engine/cache.rs

@@ -108,6 +108,7 @@ impl DecisionCache {
         self.access_order.retain(|k| k != &key);
 
         // Evict LRU entry if at capacity
+        #[allow(clippy::collapsible_if)]
         if self.entries.len() >= self.capacity {
             if let Some(lru_key) = self.access_order.pop_front() {
                 self.entries.remove(&lru_key);
@@ -228,6 +229,7 @@ impl TraversalCache {
         self.access_order.retain(|k| k != &key);
 
         // Evict LRU entry if at capacity
+        #[allow(clippy::collapsible_if)]
         if self.entries.len() >= self.capacity {
             if let Some(lru_key) = self.access_order.pop_front() {
                 self.entries.remove(&lru_key);

crates/aegis-core/src/engine/enforcement_history.rs

@@ -158,7 +158,7 @@ impl GraphEngine {
             *resource_counts.entry(e.resource.clone()).or_default() += 1;
         }
         let mut by_resource: Vec<(String, u64)> = resource_counts.into_iter().collect();
-        by_resource.sort_by(|a, b| b.1.cmp(&a.1));
+        by_resource.sort_by_key(|b| std::cmp::Reverse(b.1));
 
         Ok(EnforcementTrends {
             total_events,
@@ -240,6 +240,8 @@ impl GraphEngine {
         }
 
         // Periodically purge expired events (every ~1000 records)
+        // Periodically purge expired events (every ~1000 records)
+        #[allow(clippy::collapsible_if)]
         if cfg.max_days > 0 {
             if let Ok(mut events) = self.enforcement_events.lock() {
                 if events.len() % 1000 == 0 {

crates/aegis-core/src/engine/mod.rs

@@ -265,6 +265,7 @@ impl GraphEngine {
 
     /// Emit a structured log event through the registered callback (if any).
     fn emit_log(&self, level: hooks::LogLevel, message: &str, context: &str) {
+        #[allow(clippy::collapsible_if)]
         if let Ok(guard) = self.logger.lock() {
             if let Some(ref logger) = *guard {
                 logger(level, message, context);
@@ -458,6 +459,7 @@ impl GraphEngine {
     #[cfg(feature = "hot-reload")]
     pub fn stop_watcher(&self) {
         self.shutdown_flag.store(true, Ordering::Relaxed);
+        #[allow(clippy::collapsible_if)]
         if let Ok(mut guard) = self.watcher_thread.lock() {
             if let Some(handle) = guard.take() {
                 handle.join().ok();
@@ -739,6 +741,7 @@ impl GraphEngine {
                         Some(ctx_ref.as_ref()),
                         None,
                     );
+                    #[allow(clippy::collapsible_if)]
                     if let Ok(r) = result {
                         if r.found && evaluate_condition_if_present(cond.as_ref(), ctx_ref.as_ref())
                         {
@@ -907,19 +910,21 @@ impl GraphEngine {
 
         // Resolve permission to relations
         let resource_type = resource_type_name(resource.as_str());
-        let schema = self.schema.read().unwrap();
-        let resolved = match policy::resolve_permission(&schema, &resource_type, permission) {
-            Some(r) => r,
-            None => {
-                crate::telemetry::inc_check_total();
-                crate::telemetry::inc_check_denied();
-                return Ok(CheckResult {
-                    allowed: false,
-                    revision,
-                });
-            }
+        let resolved = {
+            let schema = self.schema.read().unwrap();
+            let result = match policy::resolve_permission(&schema, &resource_type, permission) {
+                Some(r) => r,
+                None => {
+                    crate::telemetry::inc_check_total();
+                    crate::telemetry::inc_check_denied();
+                    return Ok(CheckResult {
+                        allowed: false,
+                        revision,
+                    });
+                }
+            };
+            result
         };
-        drop(schema);
 
         // Evaluate each candidate relation by checking tuples from async storage
         let mut allowed = false;
@@ -1140,6 +1145,7 @@ impl GraphEngine {
                             Some(revision),
                             consistency,
                         );
+                        #[allow(clippy::collapsible_if)]
                         if let Ok(tr) = traversal_result {
                             if tr.found {
                                 allowed = false;
@@ -1293,6 +1299,7 @@ impl GraphEngine {
                             Some(revision),
                             consistency,
                         );
+                        #[allow(clippy::collapsible_if)]
                         if let Ok(tr) = tr {
                             if tr.found {
                                 allowed = false;
@@ -1458,18 +1465,19 @@ impl GraphEngine {
             .check(&rl_key, RateLimitOp::Write)?;
 
         let resource_type = resource_type_name(tuple.object.as_str());
-        let schema = self.schema.read().unwrap();
-        let type_def = match schema.types.get(&resource_type) {
-            Some(t) => t,
-            None => return Err(AegisError::UnknownSubjectType(resource_type)),
-        };
-        if !type_def.relations.contains_key(tuple.relation.as_str()) {
-            return Err(AegisError::UnknownRelation {
-                type_name: resource_type,
-                relation: tuple.relation.to_string(),
-            });
+        {
+            let schema = self.schema.read().unwrap();
+            let type_def = match schema.types.get(&resource_type) {
+                Some(t) => t,
+                None => return Err(AegisError::UnknownSubjectType(resource_type)),
+            };
+            if !type_def.relations.contains_key(tuple.relation.as_str()) {
+                return Err(AegisError::UnknownRelation {
+                    type_name: resource_type,
+                    relation: tuple.relation.to_string(),
+                });
+            }
         }
-        drop(schema);
 
         let storage = self
             .async_storage
@@ -2062,6 +2070,7 @@ impl GraphEngine {
         let Some(threshold) = self.wal_checkpoint_threshold else {
             return;
         };
+        #[allow(clippy::collapsible_if)]
         if let Some(wal_size) = self.storage.wal_size_mb() {
             if wal_size > threshold {
                 let _ = self.storage.close();

crates/aegis-core/src/engine/partition.rs

@@ -53,6 +53,7 @@ impl PartitionManager {
 
     pub fn check_rate_limit(&self, partition_id: &PartitionId) -> AegisResult<()> {
         let key = partition_id.to_string();
+        #[allow(clippy::collapsible_if)]
         if let Ok(map) = self.partitions.lock() {
             if let Some(state) = map.get(&key) {
                 return state.rate_limiter.check(&key, RateLimitOp::Check);

crates/aegis-core/src/engine/ratelimit.rs

@@ -75,6 +75,7 @@ impl TokenBucketRateLimiter {
 
         // Evict the least-recently-accessed entry if we need to insert a new key
         // and the map is at capacity.
+        #[allow(clippy::collapsible_if)]
         if !buckets.contains_key(key) && buckets.len() >= self.config.max_keys {
             if let Some(oldest_key) = buckets
                 .iter()

crates/aegis-core/src/engine/traversal.rs

@@ -264,6 +264,7 @@ pub fn bfs_traversal_with_limits_and_context(
             // Subject-set resolution: if the tuple's subject is a subject-set
             // (e.g. "team:eng#member"), we need to verify that our original
             // traversal subject satisfies the subject-set condition.
+            #[allow(clippy::collapsible_if)]
             if let Some(ref subject_set) = tuple.subject.as_subject_set() {
                 if !is_subject_set_member(
                     partition_id,
@@ -399,6 +400,7 @@ fn check_direct(
             return Ok(true);
         }
         // Subject-set match: subject is like `team:eng#member`
+        #[allow(clippy::collapsible_if)]
         if let Some(ref subject_set) = t.subject.as_subject_set() {
             if is_subject_set_member(
                 partition_id,

crates/aegis-core/src/engine/watch.rs

@@ -46,21 +46,25 @@ pub struct WatchFilter {
 
 impl WatchFilter {
     pub fn matches(&self, event: &WatchEvent) -> bool {
+        #[allow(clippy::collapsible_if)]
         if let Some(subjects) = &self.subjects {
             if !subjects.iter().any(|s| s == &event.subject) {
                 return false;
             }
         }
+        #[allow(clippy::collapsible_if)]
         if let Some(relations) = &self.relations {
             if !relations.iter().any(|r| r == &event.relation) {
                 return false;
             }
         }
+        #[allow(clippy::collapsible_if)]
         if let Some(objects) = &self.objects {
             if !objects.iter().any(|o| o == &event.object) {
                 return false;
             }
         }
+        #[allow(clippy::collapsible_if)]
         if let Some(types) = &self.event_types {
             if !types.contains(&event.event_type) {
                 return false;

crates/aegis-core/src/schema/parser.rs

@@ -209,6 +209,7 @@ pub fn lint_schema(schema: &Schema) -> LintResult {
 
         // Check condition syntax on permissions
         for (perm_name, perm_def) in &type_def.permissions {
+            #[allow(clippy::collapsible_if)]
             if let Some(ref cond) = perm_def.condition {
                 if let Err(e) = crate::engine::condition::parse_condition(cond) {
                     diagnostics.push(LintDiagnostic {