chore(cubesys): clear clippy -D warnings so full ./check gate is green

cargo clippy --fix applied style nits (redundant return, ?-operator,
map_or simplify) plus doc-comment list indentation. The full ./check gate
(fmt+test+clippy -D warnings) now passes; R5 read-gate + grant tests
remain green (39 cubesys lib tests).

cubesys/src/commands.rs

@@ -146,9 +146,10 @@ impl Session {
     /// or an error message to reject.
     ///
     /// Enforcement order (matches the plan's D5):
-    ///   1. owner match             -> allow
-    ///   2. else a matching grant    -> allow
+    ///   1. owner match           -> allow
+    ///   2. else a matching grant  -> allow
     ///   3. else deny
+    ///
     /// An unowned record is claimable by any (identified) writer (first-write
     /// wins), same as the Task 6 rule.
     fn admit_mutate(&self, coord: Czyx, want: Perm) -> Option<String> {
@@ -173,12 +174,11 @@ impl Session {
             }
             Some(id) => {
                 // (1) owner match — or unowned record, claimable by first writer.
-                if let Some(record_owner) = self.store.owner(&coord) {
+                {
+                    let record_owner = self.store.owner(&coord)?;
                     if record_owner == id.owner_local {
                         return None;
                     }
-                } else {
-                    return None; // unowned -> first writer claims it
                 }
                 // (2) grant.
                 let who = Owner::from(id);
@@ -227,12 +227,11 @@ impl Session {
             }
             Some(id) => {
                 // (1) owner match — or unowned record, world-readable.
-                if let Some(record_owner) = self.store.owner(&coord) {
+                {
+                    let record_owner = self.store.owner(&coord)?;
                     if record_owner == id.owner_local {
                         return None;
                     }
-                } else {
-                    return None; // unowned -> readable by anyone
                 }
                 // (2) read grant.
                 let who = Owner::from(id);
@@ -330,7 +329,7 @@ impl Session {
                     snapshot: snap,
                     ops: Vec::new(),
                 });
-                return Ok("ok: transaction begun".to_string());
+                Ok("ok: transaction begun".to_string())
             }
             "commit" => {
                 let txn = self
@@ -364,13 +363,13 @@ impl Session {
                     })
                     .collect();
                 store.commit_txn(&batch);
-                return Ok(format!("ok: committed {n} operation(s)"));
+                Ok(format!("ok: committed {n} operation(s)"))
             }
             "rollback" => {
                 if self.txn.take().is_none() {
                     return Err("rollback: no transaction is open".to_string());
                 }
-                return Ok("ok: transaction rolled back".to_string());
+                Ok("ok: transaction rolled back".to_string())
             }
             "stats" => Ok(self.stats()),
             "query" => {
@@ -542,9 +541,9 @@ impl Session {
                     Some(c) => c.pack_u32().to_string(),
                     None => "global".to_string(),
                 };
-                return Ok(format!(
+                Ok(format!(
                     "ok: granted seq={seq} {gl}<-{perms_s} over {scope_s}"
-                ));
+                ))
             }
             "revoke" => {
                 // Revoke a grant (only the original granter may). Task 6b.
@@ -583,7 +582,7 @@ impl Session {
                     remote: gr,
                 };
                 let removed = revoke(&self.store, &granter, &grantee, scope);
-                return Ok(format!("ok: revoked {removed} grant(s)"));
+                Ok(format!("ok: revoked {removed} grant(s)"))
             }
             "run" => {
                 let path = it.next().ok_or_else(|| "run needs <path>".to_string())?;

cubesys/src/grants.rs

@@ -327,7 +327,7 @@ pub fn revoke(
         .filter(|g| {
             !(g.granter == *granter
                 && g.grantee == *grantee
-                && scope.map_or(true, |sc| g.scope == Some(sc)))
+                && scope.is_none_or(|sc| g.scope == Some(sc)))
         })
         .cloned()
         .collect();