fix(ci): align lint-safe security paths

crates/aether-data/runtime/src/backend/referrals.rs

@@ -21,7 +21,7 @@ const REFERRAL_RECONCILIATION_LIMIT: usize = 200;
 // The list tests intentionally build one page larger than the historical
 // in-memory fetch cap. Keep the fixture cap test-only now that production
 // queries paginate directly in SQL.
-#[cfg(test)]
+#[cfg(all(test, feature = "sqlite"))]
 const REFERRAL_FETCH_LIMIT: usize = 5_000;
 
 #[derive(Debug, Clone, Serialize)]
@@ -367,6 +367,10 @@ fn referral_amounts_match(left: f64, right: f64) -> bool {
 /// `applying` reward into `applied` without ever increasing the inviter's gift
 /// balance.  The normal credit path writes a complete before/after snapshot,
 /// so recovery can require those same invariants before trusting the fact.
+// The fact validator compares the complete before/after ledger snapshot. Keep
+// each value explicit so a caller cannot accidentally substitute a bucket or
+// omit one of the persisted invariants.
+#[allow(clippy::too_many_arguments)]
 fn referral_credit_transaction_fact_valid(
     reward_amount_usd: f64,
     amount: f64,

crates/aether-data/runtime/src/lifecycle/export.rs

@@ -643,22 +643,22 @@ fn deactivate_imported_credentials(
         .trim_matches(|ch| matches!(ch, '"' | '`'));
 
     match table_name {
-        "users" => {
+        "users"
             if object
                 .get("password_hash")
-                .is_some_and(|value| !value.is_null())
-            {
-                set_supported_import_value(
-                    object,
-                    &target_has_column,
-                    "password_hash",
-                    Value::String(format!(
-                        "$aether-import-revoked${}",
-                        imported_credential_tombstone()
-                    )),
-                );
-            }
+                .is_some_and(|value| !value.is_null()) =>
+        {
+            set_supported_import_value(
+                object,
+                &target_has_column,
+                "password_hash",
+                Value::String(format!(
+                    "$aether-import-revoked${}",
+                    imported_credential_tombstone()
+                )),
+            );
         }
+        "users" => {}
         "api_keys" => {
             if object.contains_key("key_hash") {
                 set_supported_import_value(

crates/aether-data/runtime/src/lifecycle/export/mysql.rs

@@ -153,7 +153,7 @@ async fn enforce_mysql_identity_import_invariants(
     for user_id in &scope.user_ids {
         let auth_source =
             sqlx::query_scalar::<_, String>("SELECT auth_source FROM users WHERE id = ? LIMIT 1")
-                .bind(&user_id)
+                .bind(user_id)
                 .fetch_optional(&mut **tx)
                 .await
                 .map_sql_err()?
@@ -169,7 +169,7 @@ async fn enforce_mysql_identity_import_invariants(
         }
         if auth_source == "oauth" {
             sqlx::query("UPDATE users SET email_verified = 0 WHERE id = ?")
-                .bind(&user_id)
+                .bind(user_id)
                 .execute(&mut **tx)
                 .await
                 .map_sql_err()?;

crates/aether-data/runtime/src/lifecycle/export/postgres.rs

@@ -166,7 +166,7 @@ async fn enforce_postgres_identity_import_invariants(
         let auth_source = sqlx::query_scalar::<_, String>(
             "SELECT auth_source::text FROM public.users WHERE id = $1 LIMIT 1",
         )
-        .bind(&user_id)
+        .bind(user_id)
         .fetch_optional(&mut **tx)
         .await
         .map_sql_err()?
@@ -182,7 +182,7 @@ async fn enforce_postgres_identity_import_invariants(
         }
         if auth_source == "oauth" {
             sqlx::query("UPDATE public.users SET email_verified = FALSE WHERE id = $1")
-                .bind(&user_id)
+                .bind(user_id)
                 .execute(&mut **tx)
                 .await
                 .map_sql_err()?;

crates/aether-data/runtime/src/lifecycle/export/sqlite.rs

@@ -147,7 +147,7 @@ async fn enforce_sqlite_identity_import_invariants(
     for user_id in &scope.user_ids {
         let auth_source =
             sqlx::query_scalar::<_, String>("SELECT auth_source FROM users WHERE id = ? LIMIT 1")
-                .bind(&user_id)
+                .bind(user_id)
                 .fetch_optional(&mut **tx)
                 .await
                 .map_sql_err()?
@@ -163,7 +163,7 @@ async fn enforce_sqlite_identity_import_invariants(
         }
         if auth_source == "oauth" {
             sqlx::query("UPDATE users SET email_verified = 0 WHERE id = ?")
-                .bind(&user_id)
+                .bind(user_id)
                 .execute(&mut **tx)
                 .await
                 .map_sql_err()?;

crates/aether-data/runtime/src/repository/auth/memory.rs

@@ -83,6 +83,10 @@ impl From<&StoredUserAuthRecord> for MemoryAuthApiKeyOwnerSnapshot {
     }
 }
 
+// The trusted snapshot is returned on the common path so callers can use the
+// complete immutable view without another lookup. Preserve this established
+// in-memory registry representation rather than introducing heap allocation.
+#[allow(clippy::large_enum_variant)]
 #[derive(Debug)]
 enum MemoryAuthApiKeyOwnerRegistryEntry {
     Trusted(MemoryAuthApiKeyOwnerSnapshot),

crates/aether-data/runtime/src/repository/wallet/memory.rs

@@ -1825,9 +1825,9 @@ impl WalletWriteRepository for InMemoryWalletRepository {
             ));
         }
         let now_secs = current_unix_secs();
-        if !current_order
+        if current_order
             .expires_at_unix_secs
-            .is_some_and(|expires_at| expires_at > now_secs)
+            .is_none_or(|expires_at| expires_at <= now_secs)
         {
             return Ok(WalletMutationOutcome::Invalid(
                 "wallet recharge order is expired".to_string(),