Clear all clippy warnings (style/lint cleanup)

clippy reported ~109 warnings (it had never been enforced on the ffi crate).
Drive the lib, ffi-default, and ffi-loadable-extension builds all to zero,
with no behavior change:

- Machine-applicable fixes via clippy --fix: io::Error::other, div_ceil,
  slice .first(), derivable impls, sort_by_key, c"..." literals, etc.
- suspicious_open_options: added explicit .truncate(false) — preserves the
  current default behavior, just makes it intentional (never truncate(true)).
- too_many_arguments: allowed crate-wide; the tiered pipeline threads many
  params through flush/compact/prefetch by design.
- missing_safety_doc: added # Safety sections to the unsafe extern "C" FFI
  entry points.
- Deprecated SyncMode::S3Primary / set_local_checkpoint_only: scoped
  #[allow(deprecated)] with comments (kept for back-compat; no behavior change).

Verified: lib 568 passed, loadable-ext 27/27, clippy clean in all three modes.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: russellromney

src/compress.rs

@@ -20,13 +20,13 @@ pub fn compress(
 
     if let Some(encoder_dict) = encoder_dict {
         let mut encoder = zstd::stream::Encoder::with_prepared_dictionary(Vec::new(), encoder_dict)
-            .map_err(|e| io::Error::new(io::ErrorKind::Other, e))?;
+            .map_err(io::Error::other)?;
         encoder.write_all(data)?;
         encoder
             .finish()
-            .map_err(|e| io::Error::new(io::ErrorKind::Other, e))
+            .map_err(io::Error::other)
     } else {
-        encode_all(data, level).map_err(|e| io::Error::new(io::ErrorKind::Other, e))
+        encode_all(data, level).map_err(io::Error::other)
     }
 }
 
@@ -40,12 +40,12 @@ pub fn decompress(
 
     if let Some(decoder_dict) = decoder_dict {
         let mut decoder = zstd::stream::Decoder::with_prepared_dictionary(data, decoder_dict)
-            .map_err(|e| io::Error::new(io::ErrorKind::Other, e))?;
+            .map_err(io::Error::other)?;
         let mut output = Vec::new();
         decoder.read_to_end(&mut output)?;
         Ok(output)
     } else {
-        decode_all(data).map_err(|e| io::Error::new(io::ErrorKind::Other, e))
+        decode_all(data).map_err(io::Error::other)
     }
 }
 
@@ -70,11 +70,11 @@ pub fn decompress_capped(
     let mut output = Vec::new();
     let n = if let Some(decoder_dict) = decoder_dict {
         let decoder = zstd::stream::Decoder::with_prepared_dictionary(data, decoder_dict)
-            .map_err(|e| io::Error::new(io::ErrorKind::Other, e))?;
+            .map_err(io::Error::other)?;
         decoder.take(cap as u64).read_to_end(&mut output)?
     } else {
         let decoder = zstd::stream::Decoder::new(data)
-            .map_err(|e| io::Error::new(io::ErrorKind::Other, e))?;
+            .map_err(io::Error::other)?;
         decoder.take(cap as u64).read_to_end(&mut output)?
     };
     if n > max_len {

src/dict.rs

@@ -46,8 +46,7 @@ pub fn train_dictionary(samples: &[Vec<u8>], dict_size: usize) -> io::Result<Vec
     let sample_refs: Vec<&[u8]> = samples.iter().map(|s| s.as_slice()).collect();
 
     from_samples(&sample_refs, dict_size).map_err(|e| {
-        io::Error::new(
-            io::ErrorKind::Other,
+        io::Error::other(
             format!("Dictionary training failed: {}", e),
         )
     })
@@ -101,11 +100,11 @@ pub fn compress_with_dict(data: &[u8], dict: &[u8], level: i32) -> io::Result<Ve
 
     let encoder_dict = EncoderDictionary::copy(dict, level);
     let mut encoder = zstd::stream::Encoder::with_prepared_dictionary(Vec::new(), &encoder_dict)
-        .map_err(|e| io::Error::new(io::ErrorKind::Other, e))?;
+        .map_err(io::Error::other)?;
     encoder.write_all(data)?;
     encoder
         .finish()
-        .map_err(|e| io::Error::new(io::ErrorKind::Other, e))
+        .map_err(io::Error::other)
 }
 
 /// Decompress data using a dictionary.
@@ -116,7 +115,7 @@ pub fn decompress_with_dict(data: &[u8], dict: &[u8]) -> io::Result<Vec<u8>> {
 
     let decoder_dict = DecoderDictionary::copy(dict);
     let mut decoder = zstd::stream::Decoder::with_prepared_dictionary(data, &decoder_dict)
-        .map_err(|e| io::Error::new(io::ErrorKind::Other, e))?;
+        .map_err(io::Error::other)?;
     let mut output = Vec::new();
     decoder.read_to_end(&mut output)?;
     Ok(output)

src/install_hook.rs

@@ -120,7 +120,7 @@ unsafe fn install(db: *mut ffi::sqlite3) {
 
     let queue_ptr = Arc::into_raw(queue) as *mut std::ffi::c_void;
 
-    let name = b"turbolite_config_set\0".as_ptr() as *const c_char;
+    let name = c"turbolite_config_set".as_ptr() as *const c_char;
     let rc = ffi::sqlite3_create_function_v2(
         db,
         name,
@@ -220,7 +220,7 @@ unsafe extern "C" fn destroy(ptr: *mut std::ffi::c_void) {
 /// connection was opened with `vfs=<some name passed to turbolite::tiered::register>`.
 unsafe fn connection_uses_turbolite_vfs(db: *mut ffi::sqlite3) -> bool {
     let mut vfs_ptr: *mut ffi::sqlite3_vfs = std::ptr::null_mut();
-    let main = b"main\0".as_ptr() as *const c_char;
+    let main = c"main".as_ptr() as *const c_char;
     let rc = ffi::sqlite3_file_control(
         db,
         main,

src/lib.rs

@@ -22,6 +22,12 @@
 //! turbolite::tiered::register("mydb", vfs)?;
 //! ```
 
+// The tiered storage pipeline threads many parameters (offsets, codecs,
+// counters, manifests) through its flush/compact/prefetch paths. Grouping them
+// into structs is a worthwhile refactor but a separate one; until then these
+// signatures are intentional, not an oversight.
+#![allow(clippy::too_many_arguments)]
+
 /// Debug logging macro. Emits a `tracing::debug!` event under the
 /// `turbolite` target. Users filter via `RUST_LOG=turbolite=debug` like any
 /// other tracing-instrumented library. Silent by default — no subscriber
@@ -144,7 +150,7 @@ pub fn connect(path: &str, config: TurboliteConfig) -> Result<rusqlite::Connecti
 /// # SQL function return codes
 ///
 /// - `0` — update queued successfully; the handle applies it on the next
-///    slow-path read.
+///   slow-path read.
 /// - SQL error — validation failed (unknown key or bad value). The
 ///   captured queue makes "no active handle" unreachable through this
 ///   function: the closure holds an `Arc` to its queue for the function's
@@ -314,7 +320,7 @@ const WAL_LOCK_OFFSET: u64 = 120;
 
 /// Lock tracing events are emitted under the `turbolite::locks` tracing
 /// target. Filter with `RUST_LOG=turbolite::locks=trace`.
-
+///
 /// The five SQLite database lock levels, ordered from weakest to strongest.
 /// Turbolite's own type (the VFS backend is sqlite-plugin; we no longer pull
 /// these from sqlite-vfs). See <https://www.sqlite.org/lockingv3.html>.
@@ -405,6 +411,7 @@ impl FileWalIndex {
                 .read(true)
                 .write(true)
                 .create(true)
+                .truncate(false)
                 .open(&self.path)?;
             self.file = Some(file);
         }
@@ -417,6 +424,7 @@ impl FileWalIndex {
                 .read(true)
                 .write(true)
                 .create(true)
+                .truncate(false)
                 .open(&self.path)?;
             self.lock_file = Some(std::sync::Arc::new(file));
         }

src/local/mod.rs

@@ -450,6 +450,7 @@ impl MainHandle {
         let lock_path = lock_path_for(&path);
         let lock_file = std::fs::OpenOptions::new()
             .create(true)
+            .truncate(false)
             .read(true)
             .write(true)
             .open(&lock_path)?;
@@ -588,8 +589,7 @@ fn decode_file(bytes: &[u8], codec: &PageCodec) -> Result<(Vec<u8>, u32), io::Er
     }
     // Exact-tail invariant: the directory occupies the remainder of the file.
     if dir_off
-        .checked_add(page_count * DIR_ENTRY_LEN)
-        .map_or(true, |end| end != bytes.len())
+        .checked_add(page_count * DIR_ENTRY_LEN) != Some(bytes.len())
     {
         return Err(io::Error::new(
             io::ErrorKind::InvalidData,

src/tiered/bench.rs

@@ -449,9 +449,7 @@ impl TurboliteSharedState {
         let mut groups_submitted = 0u32;
 
         let Some(ref pool) = self.prefetch_pool else {
-            return format!(
-                "{{\"trees_warmed\":[],\"groups_submitted\":0,\"note\":\"no prefetch pool (local mode)\"}}",
-            );
+            return "{\"trees_warmed\":[],\"groups_submitted\":0,\"note\":\"no prefetch pool (local mode)\"}".to_string();
         };
 
         for access in accesses {

src/tiered/cache_tracking.rs

@@ -105,7 +105,7 @@ impl PageBitmap {
     /// but safe to call while readers use `is_present()` on existing pages
     /// (they only access indices < current len).
     pub(crate) fn resize(&mut self, page_count: u64) {
-        let needed_bytes = (page_count as usize + 7) / 8;
+        let needed_bytes = (page_count as usize).div_ceil(8);
         if self.bits.len() < needed_bytes {
             self.bits.resize_with(needed_bytes, || AtomicU8::new(0));
         }
@@ -309,7 +309,7 @@ impl SubChunkTracker {
     /// Correct for B-tree-aware groups where pages are non-positional.
     pub(crate) fn sub_chunk_id_for(&self, gid: u64, index_in_group: u32) -> SubChunkId {
         let spf = self.sub_pages_per_frame;
-        let frame_idx = if spf > 0 { index_in_group / spf } else { 0 };
+        let frame_idx = index_in_group.checked_div(spf).unwrap_or(0);
         SubChunkId {
             group_id: gid as u32,
             frame_index: frame_idx as u16,
@@ -647,8 +647,7 @@ impl SubChunkTracker {
             })
             .collect();
         let data = serde_json::to_vec(&entries).map_err(|e| {
-            io::Error::new(
-                io::ErrorKind::Other,
+            io::Error::other(
                 format!("serialize sub-chunk tracker: {}", e),
             )
         })?;

src/tiered/compact.rs

@@ -425,11 +425,11 @@ pub(crate) fn compact_override_group(
             encryption_key,
         )?;
         let ps = page_size as usize;
-        for i in 0..group_size {
+        for (i, slot) in page_buffers.iter_mut().enumerate().take(group_size) {
             let start = i * ps;
             let end = start + ps;
             if end <= bulk_data.len() {
-                page_buffers[i] = Some(bulk_data[start..end].to_vec());
+                *slot = Some(bulk_data[start..end].to_vec());
             }
         }
     } else {
@@ -468,11 +468,11 @@ pub(crate) fn compact_override_group(
         let frame_start = frame_idx * sub_ppf as usize;
         let frame_end = std::cmp::min(frame_start + sub_ppf as usize, group_size);
         let ps = page_size as usize;
-        for pos in frame_start..frame_end {
-            let offset_in_frame = (pos - frame_start) * ps;
+        for (i, slot) in page_buffers[frame_start..frame_end].iter_mut().enumerate() {
+            let offset_in_frame = i * ps;
             let end = offset_in_frame + ps;
             if end <= decompressed.len() {
-                page_buffers[pos] = Some(decompressed[offset_in_frame..end].to_vec());
+                *slot = Some(decompressed[offset_in_frame..end].to_vec());
             }
         }
     }

src/tiered/config.rs

@@ -4,9 +4,11 @@ use super::*;
 
 /// Where to load the manifest on connection open.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[derive(Default)]
 pub enum ManifestSource {
     /// Use local manifest if present, fall back to remote. Correct for single-writer.
     /// Checkpoints keep the local cache fresh; no remote fetch on warm reconnect.
+    #[default]
     Auto,
     /// Always fetch from the remote backend on open. For HA followers and
     /// multi-reader setups where another process may have checkpointed.
@@ -15,31 +17,23 @@ pub enum ManifestSource {
     S3,
 }
 
-impl Default for ManifestSource {
-    fn default() -> Self {
-        ManifestSource::Auto
-    }
-}
 
 // ===== Checkpoint mode =====
 
 /// How checkpoints interact with the configured storage backend.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[derive(Default)]
 pub enum CheckpointMode {
     /// A SQLite checkpoint uploads dirty page groups to the backend before
     /// returning. This is the default durability mode.
+    #[default]
     Durable,
     /// A SQLite checkpoint commits into the local cache/staging log and returns
     /// without backend I/O. Call `flush_to_storage()` to publish the exact
     /// checkpointed image to the backend later.
     LocalThenFlush,
 }
 
-impl Default for CheckpointMode {
-    fn default() -> Self {
-        CheckpointMode::Durable
-    }
-}
 
 // ===== Legacy sync mode =====
 
@@ -53,36 +47,31 @@ impl Default for CheckpointMode {
     note = "use TurboliteConfig.cache.checkpoint_mode instead"
 )]
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[derive(Default)]
+// S3Primary is the deprecated default; the derived Default references it on
+// purpose for back-compat with existing serialized configs.
+#[allow(deprecated)]
 pub enum SyncMode {
+    #[default]
     S3Primary,
     LocalThenFlush,
 }
 
-#[allow(deprecated)]
-impl Default for SyncMode {
-    fn default() -> Self {
-        SyncMode::S3Primary
-    }
-}
-
 // ===== Grouping strategy =====
 
 /// Grouping strategy marker. Only BTreeAware is supported.
 /// Kept as an enum for serde backward compatibility with existing manifests.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[derive(Default)]
 pub enum GroupingStrategy {
     /// Legacy positional mapping. No longer used for new databases.
     /// Existing Positional manifests are read-only compatible.
     Positional,
     /// B-tree-aware: explicit page-to-group mapping from btree walking.
+    #[default]
     BTreeAware,
 }
 
-impl Default for GroupingStrategy {
-    fn default() -> Self {
-        GroupingStrategy::BTreeAware
-    }
-}
 
 // ===== Group state for prefetch coordination =====
 
@@ -315,7 +304,6 @@ impl PrefetchConfig {
                     _ => ManifestSource::Auto,
                 })
                 .unwrap_or(d.manifest_source),
-            ..d
         }
     }
 }