diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e530e293..36d530b2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -35,6 +35,8 @@ jobs:
   build:
     needs: changes
     if: always()
+    permissions:
+      contents: read
     # A hung test would otherwise pin a runner for GitHub's 6h default and
     # block the branch's required check indefinitely; fail fast instead. A
     # cold-cache build+test finishes well under this on every OS.
@@ -68,3 +70,94 @@ jobs:
         run: cargo build --workspace --verbose
       - if: needs.changes.result != 'success' || needs.changes.outputs.code == 'true'
         run: cargo test --workspace --verbose
+
+  clippy:
+    needs: changes
+    if: always()
+    permissions:
+      contents: read
+    timeout-minutes: 15
+    runs-on: ubuntu-latest
+    steps:
+      - if: needs.changes.result != 'success' || needs.changes.outputs.code == 'true'
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          fetch-depth: 0
+      - if: needs.changes.result != 'success' || needs.changes.outputs.code == 'true'
+        uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
+        with:
+          components: clippy
+      - if: needs.changes.result != 'success' || needs.changes.outputs.code == 'true'
+        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 # zizmor: ignore[cache-poisoning] save-if already gates writes to master
+        with:
+          save-if: ${{ github.ref == 'refs/heads/master' }}
+      # The root [lints.rust] unsafe_code and sub-crate [lints.clippy]
+      # pedantic overrides are deliberately warn-only, not deny — exempt both
+      # groups here so this gate doesn't silently escalate that policy.
+      - if: needs.changes.result != 'success' || needs.changes.outputs.code == 'true'
+        run: cargo clippy --locked --workspace --all-targets --all-features -- -D warnings -A unsafe_code -A clippy::pedantic
+
+  fmt:
+    needs: changes
+    if: always()
+    permissions:
+      contents: read
+    timeout-minutes: 10
+    runs-on: ubuntu-latest
+    steps:
+      - if: needs.changes.result != 'success' || needs.changes.outputs.code == 'true'
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          fetch-depth: 0
+      - if: needs.changes.result != 'success' || needs.changes.outputs.code == 'true'
+        uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
+        with:
+          components: rustfmt
+      - if: needs.changes.result != 'success' || needs.changes.outputs.code == 'true'
+        run: cargo fmt --check
+
+  deny:
+    # No paths filter, same rationale as security-check.yml's audit job: a
+    # path-filtered required check never reports on PRs that skip it,
+    # blocking the merge forever. cargo-deny is cheap enough to run always.
+    name: cargo-deny
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: EmbarkStudios/cargo-deny-action@bb137d7af7e4fb67e5f82a49c4fce4fad40782fe # v2
+        with:
+          manifest-path: Cargo.toml
+
+  # Single aggregating gate. Point branch protection at THIS job instead of
+  # every leg above — stays correct when jobs are added/removed and can't be
+  # bypassed by a silently-missing required check.
+  ci-green:
+    name: CI Green
+    if: always()
+    needs:
+      - build
+      - clippy
+      - fmt
+      - deny
+    runs-on: ubuntu-latest
+    permissions: {}
+    steps:
+      - name: Verify no required job failed
+        shell: bash
+        env:
+          NEEDS_JSON: ${{ toJSON(needs) }}
+        run: |
+          echo "$NEEDS_JSON"
+          python3 - <<'PY'
+          import json, os, sys
+
+          needs = json.loads(os.environ["NEEDS_JSON"])
+          blocked = {k: v["result"] for k, v in needs.items()
+                     if v["result"] in ("failure", "cancelled")}
+          if blocked:
+              print("Required CI jobs did not pass:", blocked)
+              sys.exit(1)
+          print("All required CI jobs passed (success or skipped).")
+          PY
diff --git a/crates/agent-registry/src/detect.rs b/crates/agent-registry/src/detect.rs
index 3e89e50d..b5f4a609 100644
--- a/crates/agent-registry/src/detect.rs
+++ b/crates/agent-registry/src/detect.rs
@@ -28,7 +28,7 @@ pub static PATH_LOCK: std::sync::Mutex<()> = std::sync::Mutex::new(());
 /// the approach used by `agents-cli`'s `findInPath` and `caam`'s
 /// `findBinary`, minus their shims-dir exclusion (agentflare has no shims
 /// directory yet).
-#[must_use] 
+#[must_use]
 pub fn find_binary(names: &[&str]) -> Option<PathBuf> {
     let path_var = std::env::var_os("PATH")?;
     for dir in std::env::split_paths(&path_var) {
@@ -58,7 +58,9 @@ mod find_binary_tests {
     // paths::test_support::GLOBAL_STATE_LOCK.
 
     fn with_temp_path_dir(f: impl FnOnce(&Path)) {
-        let _guard = super::PATH_LOCK.lock().unwrap_or_else(|e| e.into_inner());
+        let _guard = super::PATH_LOCK
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
         let dir = std::env::temp_dir().join(format!("agentflare-test-path-{}", std::process::id()));
         let _ = std::fs::remove_dir_all(&dir);
         std::fs::create_dir_all(&dir).unwrap();
@@ -66,17 +68,17 @@ mod find_binary_tests {
         unsafe {
             // SAFETY: PATH_LOCK mutex serializes all PATH mutations;
             // no other thread can read or write PATH concurrently.
-            std::env::set_var("PATH", &dir)
+            std::env::set_var("PATH", &dir);
         };
         f(&dir);
         match original {
             Some(p) => unsafe {
                 // SAFETY: PATH_LOCK mutex serializes all PATH mutations.
-                std::env::set_var("PATH", p)
+                std::env::set_var("PATH", p);
             },
             None => unsafe {
                 // SAFETY: PATH_LOCK mutex serializes all PATH mutations.
-                std::env::remove_var("PATH")
+                std::env::remove_var("PATH");
             },
         }
         let _ = std::fs::remove_dir_all(&dir);
@@ -111,7 +113,7 @@ mod find_binary_tests {
 /// Find the first `\d+\.\d+\.\d+`-shaped substring in `text` (a `--version`
 /// command's combined stdout+stderr). Hand-rolled instead of pulling in the
 /// `regex` crate for one pattern.
-#[must_use] 
+#[must_use]
 pub fn extract_version(text: &str) -> Option<String> {
     let chars: Vec<char> = text.chars().collect();
     for start in 0..chars.len() {
@@ -145,12 +147,18 @@ mod extract_version_tests {
 
     #[test]
     fn extracts_version_from_prefixed_output() {
-        assert_eq!(extract_version("claude-code/1.2.3"), Some("1.2.3".to_string()));
+        assert_eq!(
+            extract_version("claude-code/1.2.3"),
+            Some("1.2.3".to_string())
+        );
     }
 
     #[test]
     fn extracts_version_embedded_in_a_sentence() {
-        assert_eq!(extract_version("codex cli version 0.128.0 (build abc)"), Some("0.128.0".to_string()));
+        assert_eq!(
+            extract_version("codex cli version 0.128.0 (build abc)"),
+            Some("0.128.0".to_string())
+        );
     }
 
     #[test]
@@ -165,7 +173,10 @@ mod extract_version_tests {
 
     #[test]
     fn returns_first_match_when_multiple_numbers_present() {
-        assert_eq!(extract_version("built with node 20.11.0 for app 1.2.3"), Some("20.11.0".to_string()));
+        assert_eq!(
+            extract_version("built with node 20.11.0 for app 1.2.3"),
+            Some("20.11.0".to_string())
+        );
     }
 }
 
@@ -220,7 +231,10 @@ fn run_version_command(binary: &Path, args: &[&str]) -> Result<String, String> {
         Ok(Ok(text)) if !text.trim().is_empty() => Ok(text),
         Ok(Ok(_)) => Err(format!("{} produced no output", binary.display())),
         Ok(Err(e)) => Err(e),
-        Err(_) => Err(format!("{} timed out after {VERSION_TIMEOUT:?}", binary.display())),
+        Err(_) => Err(format!(
+            "{} timed out after {VERSION_TIMEOUT:?}",
+            binary.display()
+        )),
     }
 }
 
@@ -243,9 +257,11 @@ pub fn resolve_version_with(
     let binary_path_str = binary_path.to_string_lossy().into_owned();
 
     if let Some(entry) = cache.get(agent_key)
-        && entry.binary_path == binary_path_str && entry.mtime == mtime {
-            return Ok(entry.version.clone());
-        }
+        && entry.binary_path == binary_path_str
+        && entry.mtime == mtime
+    {
+        return Ok(entry.version.clone());
+    }
 
     let raw = runner.run(binary_path, version_args)?;
     let version = extract_version(&raw)
@@ -253,7 +269,11 @@ pub fn resolve_version_with(
 
     cache.insert(
         agent_key.to_string(),
-        VersionCacheEntry { binary_path: binary_path_str, mtime, version: version.clone() },
+        VersionCacheEntry {
+            binary_path: binary_path_str,
+            mtime,
+            version: version.clone(),
+        },
     );
     Ok(version)
 }
@@ -265,7 +285,13 @@ pub fn resolve_version(
     version_args: &[&str],
     cache: &mut HashMap<String, VersionCacheEntry>,
 ) -> Result<String, String> {
-    resolve_version_with(&RealVersionRunner, agent_key, binary_path, version_args, cache)
+    resolve_version_with(
+        &RealVersionRunner,
+        agent_key,
+        binary_path,
+        version_args,
+        cache,
+    )
 }
 
 #[cfg(test)]
@@ -286,7 +312,8 @@ mod resolve_version_tests {
     /// A real file on disk so `fs::metadata` succeeds — its content is
     /// irrelevant since `FakeRunner` never actually executes it.
     fn temp_binary_file(name: &str) -> PathBuf {
-        let dir = std::env::temp_dir().join(format!("agentflare-test-resolve-{}", std::process::id()));
+        let dir =
+            std::env::temp_dir().join(format!("agentflare-test-resolve-{}", std::process::id()));
         std::fs::create_dir_all(&dir).unwrap();
         let path = dir.join(name);
         let mut f = std::fs::File::create(&path).unwrap();
@@ -297,10 +324,13 @@ mod resolve_version_tests {
     #[test]
     fn cache_miss_spawns_and_caches_result() {
         let binary = temp_binary_file("agent-a");
-        let runner = FakeRunner { response: Ok("agent-a version 1.2.3".to_string()) };
+        let runner = FakeRunner {
+            response: Ok("agent-a version 1.2.3".to_string()),
+        };
         let mut cache = HashMap::new();
 
-        let version = resolve_version_with(&runner, "agent-a", &binary, &["--version"], &mut cache).unwrap();
+        let version =
+            resolve_version_with(&runner, "agent-a", &binary, &["--version"], &mut cache).unwrap();
 
         assert_eq!(version, "1.2.3");
         assert_eq!(cache.get("agent-a").unwrap().version, "1.2.3");
@@ -309,8 +339,13 @@ mod resolve_version_tests {
     #[test]
     fn cache_hit_does_not_call_runner_again() {
         let binary = temp_binary_file("agent-b");
-        let mtime = std::fs::metadata(&binary).unwrap().modified().unwrap()
-            .duration_since(std::time::UNIX_EPOCH).unwrap().as_secs();
+        let mtime = std::fs::metadata(&binary)
+            .unwrap()
+            .modified()
+            .unwrap()
+            .duration_since(std::time::UNIX_EPOCH)
+            .unwrap()
+            .as_secs();
         let mut cache = HashMap::new();
         cache.insert(
             "agent-b".to_string(),
@@ -328,7 +363,9 @@ mod resolve_version_tests {
             }
         }
 
-        let version = resolve_version_with(&PanicRunner, "agent-b", &binary, &["--version"], &mut cache).unwrap();
+        let version =
+            resolve_version_with(&PanicRunner, "agent-b", &binary, &["--version"], &mut cache)
+                .unwrap();
         assert_eq!(version, "9.9.9");
     }
 
@@ -344,28 +381,38 @@ mod resolve_version_tests {
                 version: "0.0.0".to_string(),
             },
         );
-        let runner = FakeRunner { response: Ok("2.0.0".to_string()) };
+        let runner = FakeRunner {
+            response: Ok("2.0.0".to_string()),
+        };
 
-        let version = resolve_version_with(&runner, "agent-c", &binary, &["--version"], &mut cache).unwrap();
+        let version =
+            resolve_version_with(&runner, "agent-c", &binary, &["--version"], &mut cache).unwrap();
         assert_eq!(version, "2.0.0");
     }
 
     #[test]
     fn failed_resolution_is_not_persisted_to_cache() {
         let binary = temp_binary_file("agent-d");
-        let runner = FakeRunner { response: Err("boom".to_string()) };
+        let runner = FakeRunner {
+            response: Err("boom".to_string()),
+        };
         let mut cache = HashMap::new();
 
         let result = resolve_version_with(&runner, "agent-d", &binary, &["--version"], &mut cache);
 
         assert!(result.is_err());
-        assert!(!cache.contains_key("agent-d"), "a failed resolution must not be cached");
+        assert!(
+            !cache.contains_key("agent-d"),
+            "a failed resolution must not be cached"
+        );
     }
 
     #[test]
     fn unparseable_success_output_is_not_persisted_to_cache() {
         let binary = temp_binary_file("agent-e");
-        let runner = FakeRunner { response: Ok("no version information here".to_string()) };
+        let runner = FakeRunner {
+            response: Ok("no version information here".to_string()),
+        };
         let mut cache = HashMap::new();
 
         let result = resolve_version_with(&runner, "agent-e", &binary, &["--version"], &mut cache);
@@ -382,7 +429,9 @@ mod resolve_version_tests {
         // Take the shared PATH_LOCK so this can't run concurrently with a
         // find_binary_tests/detect_all_tests test that has repointed PATH
         // to a temp-only directory — this test needs the real PATH intact.
-        let _guard = PATH_LOCK.lock().unwrap_or_else(|e| e.into_inner());
+        let _guard = PATH_LOCK
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
         // The one real-spawn test: `rustc` is guaranteed on PATH inside any
         // `cargo test` invocation, so this is portable without a stub binary.
         let output = run_version_command(Path::new("rustc"), &["--version"]).unwrap();
@@ -466,25 +515,28 @@ mod detect_all_tests {
     }
 
     fn with_temp_path_dir(f: impl FnOnce(&Path)) {
-        let _guard = super::PATH_LOCK.lock().unwrap_or_else(|e| e.into_inner());
-        let dir = std::env::temp_dir().join(format!("agentflare-test-detect-all-{}", std::process::id()));
+        let _guard = super::PATH_LOCK
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        let dir =
+            std::env::temp_dir().join(format!("agentflare-test-detect-all-{}", std::process::id()));
         let _ = std::fs::remove_dir_all(&dir);
         std::fs::create_dir_all(&dir).unwrap();
         let original = std::env::var_os("PATH");
         unsafe {
             // SAFETY: PATH_LOCK mutex serializes all PATH mutations;
             // no other thread can read or write PATH concurrently.
-            std::env::set_var("PATH", &dir)
+            std::env::set_var("PATH", &dir);
         };
         f(&dir);
         match original {
             Some(p) => unsafe {
                 // SAFETY: PATH_LOCK mutex serializes all PATH mutations.
-                std::env::set_var("PATH", p)
+                std::env::set_var("PATH", p);
             },
             None => unsafe {
                 // SAFETY: PATH_LOCK mutex serializes all PATH mutations.
-                std::env::remove_var("PATH")
+                std::env::remove_var("PATH");
             },
         }
         let _ = std::fs::remove_dir_all(&dir);
diff --git a/crates/agent-registry/src/lib.rs b/crates/agent-registry/src/lib.rs
index 33e6a695..5d188db3 100644
--- a/crates/agent-registry/src/lib.rs
+++ b/crates/agent-registry/src/lib.rs
@@ -1,4 +1,7 @@
 pub mod detect;
 pub mod registry;
-pub use registry::{headless_args, Agent, AgentSpec, Tier, REGISTRY, spec};
-pub use detect::{detect_all, detect_all_with, find_binary, resolve_version, resolve_version_with, DetectedAgent, VersionRunner, RealVersionRunner, VersionCacheEntry};
+pub use detect::{
+    DetectedAgent, RealVersionRunner, VersionCacheEntry, VersionRunner, detect_all,
+    detect_all_with, find_binary, resolve_version, resolve_version_with,
+};
+pub use registry::{Agent, AgentSpec, REGISTRY, Tier, headless_args, spec};
diff --git a/crates/agent-registry/src/registry.rs b/crates/agent-registry/src/registry.rs
index fd08625a..77b08338 100644
--- a/crates/agent-registry/src/registry.rs
+++ b/crates/agent-registry/src/registry.rs
@@ -30,7 +30,7 @@ pub enum Agent {
 }
 
 impl Agent {
-    #[must_use] 
+    #[must_use]
     pub fn as_str(self) -> &'static str {
         match self {
             Agent::ClaudeCode => "claude-code",
@@ -278,7 +278,7 @@ pub static REGISTRY: &[AgentSpec] = &[
 /// Not yet consumed outside tests — wired up by the upcoming agent detection
 /// engine and CLI commands.
 #[allow(dead_code)]
-#[must_use] 
+#[must_use]
 pub fn spec(agent: Agent) -> &'static AgentSpec {
     REGISTRY
         .iter()
@@ -314,7 +314,10 @@ mod tests {
     #[test]
     fn registry_has_seventeen_cli_tier_and_three_extension_tier() {
         let cli_count = REGISTRY.iter().filter(|s| s.tier == Tier::Cli).count();
-        let ext_count = REGISTRY.iter().filter(|s| s.tier == Tier::Extension).count();
+        let ext_count = REGISTRY
+            .iter()
+            .filter(|s| s.tier == Tier::Extension)
+            .count();
         assert_eq!(cli_count, 17);
         assert_eq!(ext_count, 3);
     }
diff --git a/crates/agentflare-artifacts/src/lib.rs b/crates/agentflare-artifacts/src/lib.rs
index 1ee9007b..d4ac389c 100644
--- a/crates/agentflare-artifacts/src/lib.rs
+++ b/crates/agentflare-artifacts/src/lib.rs
@@ -30,7 +30,9 @@ mod tests {
         use std::io::Write;
         stream.write_all(req.as_bytes()).unwrap();
         stream.flush().unwrap();
-        stream.set_read_timeout(Some(Duration::from_secs(2))).unwrap();
+        stream
+            .set_read_timeout(Some(Duration::from_secs(2)))
+            .unwrap();
         let mut reader = BufReader::new(&stream);
         let mut full = String::new();
         let _ = reader.read_to_string(&mut full);
@@ -158,10 +160,16 @@ mod tests {
             .unwrap();
 
         let listing = read_http("/", port);
-        assert!(listing.contains("http-test"), "index page shows artifact: {listing}");
+        assert!(
+            listing.contains("http-test"),
+            "index page shows artifact: {listing}"
+        );
 
         let resp = read_http("/", port);
-        assert!(resp.contains("HTTP/1.0 200") || resp.contains("HTTP/1.1 200"), "bad status: {resp}");
+        assert!(
+            resp.contains("HTTP/1.0 200") || resp.contains("HTTP/1.1 200"),
+            "bad status: {resp}"
+        );
     }
 
     #[test]
@@ -360,11 +368,20 @@ mod tests {
             .unwrap();
 
         let page = read_http(&format!("/{}", resp.id), port);
-        assert!(!page.contains("<script>alert"), "raw script must not survive: {page}");
-        assert!(page.contains("&lt;script&gt;"), "escaped form present: {page}");
+        assert!(
+            !page.contains("<script>alert"),
+            "raw script must not survive: {page}"
+        );
+        assert!(
+            page.contains("&lt;script&gt;"),
+            "escaped form present: {page}"
+        );
 
         let index = read_http("/", port);
-        assert!(!index.contains("<script>alert"), "index escapes names: {index}");
+        assert!(
+            !index.contains("<script>alert"),
+            "index escapes names: {index}"
+        );
     }
 
     #[test]
@@ -397,7 +414,10 @@ mod tests {
         assert!(old.contains("OLD-CONTENT"), "{old}");
 
         let history = read_http(&format!("/{id}/versions"), port);
-        assert!(history.contains("\"version\": 1") || history.contains("\"version\":1"), "{history}");
+        assert!(
+            history.contains("\"version\": 1") || history.contains("\"version\":1"),
+            "{history}"
+        );
         assert!(history.contains("draft"), "label in history: {history}");
     }
 
@@ -414,7 +434,10 @@ mod tests {
             })
             .unwrap();
         let page = read_http(&format!("/{}", md.id), port);
-        assert!(page.contains("marked"), "markdown page loads renderer: {page}");
+        assert!(
+            page.contains("marked"),
+            "markdown page loads renderer: {page}"
+        );
 
         let mm = store
             .publish(&PublishRequest {
@@ -426,7 +449,10 @@ mod tests {
             })
             .unwrap();
         let page = read_http(&format!("/{}", mm.id), port);
-        assert!(page.contains("mermaid"), "mermaid page loads renderer: {page}");
+        assert!(
+            page.contains("mermaid"),
+            "mermaid page loads renderer: {page}"
+        );
     }
 
     #[test]
@@ -503,9 +529,15 @@ mod tests {
                 ..Default::default()
             })
             .unwrap();
-        assert_eq!(resp.version, 1, "identical content must not bump the version");
+        assert_eq!(
+            resp.version, 1,
+            "identical content must not bump the version"
+        );
         assert_eq!(store.versions(&id).unwrap().len(), 1);
-        assert_eq!(store.get(&id).unwrap().description.as_deref(), Some("added later"));
+        assert_eq!(
+            store.get(&id).unwrap().description.as_deref(),
+            Some("added later")
+        );
 
         // different content still bumps
         let resp = store
@@ -610,7 +642,9 @@ mod tests {
         use std::io::{Read, Write};
         write!(stream, "GET /{id}/live HTTP/1.0\r\nHost: 127.0.0.1\r\n\r\n").unwrap();
         stream.flush().unwrap();
-        stream.set_read_timeout(Some(Duration::from_secs(10))).unwrap();
+        stream
+            .set_read_timeout(Some(Duration::from_secs(10)))
+            .unwrap();
 
         // Wait for the SSE headers (and a beat for the handler to snapshot
         // its baseline version) before publishing, else the handler's first
@@ -645,6 +679,9 @@ mod tests {
                 Err(_) => break,
             }
         }
-        assert!(buf.contains("event:"), "poll fallback must emit an update event: {buf}");
+        assert!(
+            buf.contains("event:"),
+            "poll fallback must emit an update event: {buf}"
+        );
     }
 }
diff --git a/crates/agentflare-artifacts/src/server.rs b/crates/agentflare-artifacts/src/server.rs
index 236f3ef0..5dea77bb 100644
--- a/crates/agentflare-artifacts/src/server.rs
+++ b/crates/agentflare-artifacts/src/server.rs
@@ -13,6 +13,8 @@ pub const DEFAULT_PORT: u16 = 64009;
 pub struct ArtifactServer {
     host: String,
     port: u16,
+    #[allow(dead_code)]
+    // kept alive for the server's lifetime; the listener thread holds its own clone
     store: Arc<ArtifactStore>,
 }
 
@@ -119,15 +121,23 @@ fn handle_connection(mut stream: TcpStream, store: &ArtifactStore) {
             headers.push(line.trim().to_string());
         }
 
-        (method.to_string(), path.to_string(), content_length, reader.into_inner())
+        (
+            method.to_string(),
+            path.to_string(),
+            content_length,
+            reader.into_inner(),
+        )
     };
 
     let (method, path, _content_length, _remaining) = buf;
 
     let response = match (method.as_str(), path.as_str()) {
-        ("GET", path) if path == "/" => index_page(store),
+        ("GET", "/") => index_page(store),
         ("GET", path) if path.ends_with("/live") => {
-            let id = path.strip_suffix("/live").unwrap_or("").trim_start_matches('/');
+            let id = path
+                .strip_suffix("/live")
+                .unwrap_or("")
+                .trim_start_matches('/');
             if !valid_id(id) {
                 let _ = stream.write_all(not_found().0.as_bytes());
                 let _ = stream.flush();
@@ -136,7 +146,10 @@ fn handle_connection(mut stream: TcpStream, store: &ArtifactStore) {
             return serve_sse(&mut stream, store, id);
         }
         ("GET", path) if path.ends_with("/versions") => {
-            let id = path.strip_suffix("/versions").unwrap_or("").trim_start_matches('/');
+            let id = path
+                .strip_suffix("/versions")
+                .unwrap_or("")
+                .trim_start_matches('/');
             versions_json(store, id)
         }
         ("GET", path) => {
@@ -149,9 +162,7 @@ fn handle_connection(mut stream: TcpStream, store: &ArtifactStore) {
                 None => serve_artifact(store, rest, None),
             }
         }
-        _ => (
-            "HTTP/1.0 405 Method Not Allowed\r\n\r\nMethod Not Allowed".to_string(),
-        ),
+        _ => ("HTTP/1.0 405 Method Not Allowed\r\n\r\nMethod Not Allowed".to_string(),),
     };
 
     let _ = stream.write_all(response.0.as_bytes());
@@ -167,10 +178,7 @@ pub fn valid_id(id: &str) -> bool {
 }
 
 fn not_found() -> (String,) {
-    (
-        "HTTP/1.0 404 Not Found\r\nContent-Type: text/plain\r\n\r\nArtifact not found"
-            .to_string(),
-    )
+    ("HTTP/1.0 404 Not Found\r\nContent-Type: text/plain\r\n\r\nArtifact not found".to_string(),)
 }
 
 fn http_200(content_type: &str, body: &str) -> (String,) {
@@ -244,7 +252,11 @@ pub fn render_index(store: &ArtifactStore, prefix: &str) -> String {
     }
     let mut groups = String::new();
     for (session, items) in &sessions {
-        let session_label = if session.is_empty() { "(no session)" } else { session };
+        let session_label = if session.is_empty() {
+            "(no session)"
+        } else {
+            session
+        };
         groups.push_str(&format!("<h2>{}</h2>\n<ul>\n", html_escape(session_label)));
         for a in items {
             let icon = a.favicon.as_deref().unwrap_or("📄");
diff --git a/crates/agentflare-artifacts/src/store.rs b/crates/agentflare-artifacts/src/store.rs
index eb1f4005..50d85fcb 100644
--- a/crates/agentflare-artifacts/src/store.rs
+++ b/crates/agentflare-artifacts/src/store.rs
@@ -134,12 +134,15 @@ impl ArtifactStore {
 
         fs::create_dir_all(dir.join(VERSIONS_DIR))?;
         if !unchanged {
-            fs::write(dir.join(VERSIONS_DIR).join(version.to_string()), &req.content)?;
+            fs::write(
+                dir.join(VERSIONS_DIR).join(version.to_string()),
+                &req.content,
+            )?;
         }
         fs::write(dir.join(META_FILE), serde_json::to_string_pretty(&meta)?)?;
         fs::write(dir.join(CONTENT_FILE), &req.content)?;
 
-        let url = format!("/{}", &id);
+        let url = format!("/{id}");
         let response = PublishResponse {
             id,
             url,
@@ -168,20 +171,21 @@ impl ArtifactStore {
 
     /// Version history, oldest first.
     pub fn versions(&self, id: &str) -> std::io::Result<Vec<VersionInfo>> {
-        self.read_meta(id)
-            .map(|m| m.history)
-            .ok_or_else(|| {
-                std::io::Error::new(
-                    std::io::ErrorKind::NotFound,
-                    format!("artifact {id} not found"),
-                )
-            })
+        self.read_meta(id).map(|m| m.history).ok_or_else(|| {
+            std::io::Error::new(
+                std::io::ErrorKind::NotFound,
+                format!("artifact {id} not found"),
+            )
+        })
     }
 
     /// A specific version's snapshot; `get()` always serves the latest.
     pub fn get_version(&self, id: &str, version: u32) -> std::io::Result<Artifact> {
         let mut artifact = self.get(id)?;
-        let content_path = self.artifact_dir(id).join(VERSIONS_DIR).join(version.to_string());
+        let content_path = self
+            .artifact_dir(id)
+            .join(VERSIONS_DIR)
+            .join(version.to_string());
         artifact.content = fs::read_to_string(content_path)?;
         artifact.version = version;
         Ok(artifact)
@@ -195,8 +199,7 @@ impl ArtifactStore {
                 format!("artifact {id} not found"),
             ));
         }
-        let meta: ArtifactMeta =
-            serde_json::from_str(&fs::read_to_string(dir.join(META_FILE))?)?;
+        let meta: ArtifactMeta = serde_json::from_str(&fs::read_to_string(dir.join(META_FILE))?)?;
         let content = fs::read_to_string(dir.join(CONTENT_FILE))?;
         Ok(Artifact {
             id: meta.id,
@@ -251,7 +254,7 @@ impl ArtifactStore {
                 }
             }
         }
-        artifacts.sort_by(|a, b| b.created_at.cmp(&a.created_at));
+        artifacts.sort_by_key(|a| std::cmp::Reverse(a.created_at));
         Ok(artifacts)
     }
 
diff --git a/crates/caveman/src/compress.rs b/crates/caveman/src/compress.rs
index ebebb573..aacf760f 100644
--- a/crates/caveman/src/compress.rs
+++ b/crates/caveman/src/compress.rs
@@ -60,7 +60,9 @@ pub fn compress(
     let in_place = source == target;
     let backup_path = backup_path_for(target, backup);
     if in_place && backup_path.exists() {
-        return Err(CavemanError::BackupExists(backup_path.display().to_string()));
+        return Err(CavemanError::BackupExists(
+            backup_path.display().to_string(),
+        ));
     }
 
     let compressed_body = llm.call(&prompt.build_compress_prompt(&body))?;
@@ -81,7 +83,9 @@ pub fn compress(
         let readback = std::fs::read_to_string(&backup_path)?;
         if readback != original_text {
             let _ = std::fs::remove_file(&backup_path);
-            return Err(CavemanError::BackupVerifyFailed(backup_path.display().to_string()));
+            return Err(CavemanError::BackupVerifyFailed(
+                backup_path.display().to_string(),
+            ));
         }
     }
 
@@ -90,7 +94,7 @@ pub fn compress(
     }
     std::fs::write(target, &compressed)?;
 
-    let mut errors = Vec::new();
+    let mut errors;
     for attempt in 0..MAX_RETRIES {
         let current = std::fs::read_to_string(target)?;
         errors = validate(&original_text, &current);
@@ -123,7 +127,10 @@ pub fn compress(
 fn backup_path_for(target: &Path, mode: BackupMode) -> PathBuf {
     match mode {
         BackupMode::Sibling => {
-            let file_name = target.file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_default();
+            let file_name = target
+                .file_name()
+                .map(|n| n.to_string_lossy().to_string())
+                .unwrap_or_default();
             target.with_file_name(format!("{file_name}.orig"))
         }
         BackupMode::OutOfTree => {
@@ -137,13 +144,20 @@ fn backup_path_for(target: &Path, mode: BackupMode) -> PathBuf {
             // identically-named parent dirs (e.g. "project-a/docs/README.md"
             // and "project-b/docs/README.md") would otherwise collide on
             // the same backup path.
-            let parent = target.parent().map(|p| p.to_path_buf()).unwrap_or_default();
+            let parent = target
+                .parent()
+                .map(std::path::Path::to_path_buf)
+                .unwrap_or_default();
             let canonical_parent = std::fs::canonicalize(&parent).unwrap_or(parent);
             let mut hasher = std::collections::hash_map::DefaultHasher::new();
             canonical_parent.hash(&mut hasher);
             let dir_hash = hasher.finish();
-            let stem = target.file_stem().map(|s| s.to_string_lossy().to_string()).unwrap_or_default();
-            base.join(format!("{dir_hash:016x}")).join(format!("{stem}.original.md"))
+            let stem = target
+                .file_stem()
+                .map(|s| s.to_string_lossy().to_string())
+                .unwrap_or_default();
+            base.join(format!("{dir_hash:016x}"))
+                .join(format!("{stem}.original.md"))
         }
     }
 }
@@ -165,12 +179,19 @@ mod tests {
         let dir = tempdir().unwrap();
         let source = write(dir.path(), "doc.md", "# Title\n\nverbose text here");
         let llm = FakeLlm::queue(&["# Title\n\nterse"]);
-        let report = compress(&llm, &source, &source, Prompt::Generic, BackupMode::Sibling).unwrap();
+        let report =
+            compress(&llm, &source, &source, Prompt::Generic, BackupMode::Sibling).unwrap();
         assert_eq!(report.original_bytes, "# Title\n\nverbose text here".len());
-        assert_eq!(std::fs::read_to_string(&source).unwrap(), "# Title\n\nterse");
+        assert_eq!(
+            std::fs::read_to_string(&source).unwrap(),
+            "# Title\n\nterse"
+        );
         let backup = dir.path().join("doc.md.orig");
         assert!(backup.exists());
-        assert_eq!(std::fs::read_to_string(&backup).unwrap(), "# Title\n\nverbose text here");
+        assert_eq!(
+            std::fs::read_to_string(&backup).unwrap(),
+            "# Title\n\nverbose text here"
+        );
     }
 
     #[test]
@@ -178,7 +199,8 @@ mod tests {
         let dir = tempdir().unwrap();
         let source = write(dir.path(), "credentials.md", "some content");
         let llm = FakeLlm::queue(&["irrelevant"]);
-        let err = compress(&llm, &source, &source, Prompt::Generic, BackupMode::Sibling).unwrap_err();
+        let err =
+            compress(&llm, &source, &source, Prompt::Generic, BackupMode::Sibling).unwrap_err();
         assert!(matches!(err, CavemanError::Sensitive(_)), "{err:?}");
     }
 
@@ -187,7 +209,8 @@ mod tests {
         let dir = tempdir().unwrap();
         let source = write(dir.path(), "doc.md", "   \n  ");
         let llm = FakeLlm::queue(&["irrelevant"]);
-        let err = compress(&llm, &source, &source, Prompt::Generic, BackupMode::Sibling).unwrap_err();
+        let err =
+            compress(&llm, &source, &source, Prompt::Generic, BackupMode::Sibling).unwrap_err();
         assert!(matches!(err, CavemanError::Empty(_)), "{err:?}");
     }
 
@@ -197,7 +220,8 @@ mod tests {
         let big = "x".repeat(600_000);
         let source = write(dir.path(), "doc.md", &big);
         let llm = FakeLlm::queue(&["irrelevant"]);
-        let err = compress(&llm, &source, &source, Prompt::Generic, BackupMode::Sibling).unwrap_err();
+        let err =
+            compress(&llm, &source, &source, Prompt::Generic, BackupMode::Sibling).unwrap_err();
         assert!(matches!(err, CavemanError::TooLarge(_)), "{err:?}");
     }
 
@@ -207,7 +231,8 @@ mod tests {
         let source = write(dir.path(), "doc.md", "some real content");
         write(dir.path(), "doc.md.orig", "pre-existing backup");
         let llm = FakeLlm::queue(&["irrelevant"]);
-        let err = compress(&llm, &source, &source, Prompt::Generic, BackupMode::Sibling).unwrap_err();
+        let err =
+            compress(&llm, &source, &source, Prompt::Generic, BackupMode::Sibling).unwrap_err();
         assert!(matches!(err, CavemanError::BackupExists(_)), "{err:?}");
     }
 
@@ -216,7 +241,8 @@ mod tests {
         let dir = tempdir().unwrap();
         let source = write(dir.path(), "doc.md", "real content here");
         let llm = FakeLlm::queue(&[""]);
-        let err = compress(&llm, &source, &source, Prompt::Generic, BackupMode::Sibling).unwrap_err();
+        let err =
+            compress(&llm, &source, &source, Prompt::Generic, BackupMode::Sibling).unwrap_err();
         assert!(matches!(err, CavemanError::EmptyResponse), "{err:?}");
     }
 
@@ -225,7 +251,8 @@ mod tests {
         let dir = tempdir().unwrap();
         let source = write(dir.path(), "doc.md", "unchanged text");
         let llm = FakeLlm::queue(&["unchanged text"]);
-        let err = compress(&llm, &source, &source, Prompt::Generic, BackupMode::Sibling).unwrap_err();
+        let err =
+            compress(&llm, &source, &source, Prompt::Generic, BackupMode::Sibling).unwrap_err();
         assert!(matches!(err, CavemanError::IdenticalOutput), "{err:?}");
     }
 
@@ -236,9 +263,17 @@ mod tests {
         let source = write(dir.path(), "doc.md", original);
         // First compress response drops the code block (fails validation),
         // second (fix) response restores it (passes).
-        let llm = FakeLlm::queue(&["# T\n\nterse, no code block", "# T\n\n```py\nprint(1)\n```\nterse"]);
-        let report = compress(&llm, &source, &source, Prompt::Generic, BackupMode::Sibling).unwrap();
-        assert!(std::fs::read_to_string(&source).unwrap().contains("print(1)"));
+        let llm = FakeLlm::queue(&[
+            "# T\n\nterse, no code block",
+            "# T\n\n```py\nprint(1)\n```\nterse",
+        ]);
+        let report =
+            compress(&llm, &source, &source, Prompt::Generic, BackupMode::Sibling).unwrap();
+        assert!(
+            std::fs::read_to_string(&source)
+                .unwrap()
+                .contains("print(1)")
+        );
         assert!(report.compressed_bytes > 0);
     }
 
@@ -249,10 +284,21 @@ mod tests {
         let source = write(dir.path(), "doc.md", original);
         // Every response drops the code block — validation never passes.
         let llm = FakeLlm::queue(&["missing code", "still missing code"]);
-        let err = compress(&llm, &source, &source, Prompt::Generic, BackupMode::Sibling).unwrap_err();
-        assert!(matches!(err, CavemanError::ValidationFailed(2, _)), "{err:?}");
-        assert_eq!(std::fs::read_to_string(&source).unwrap(), original, "source must be restored");
-        assert!(!dir.path().join("doc.md.orig").exists(), "backup must be cleaned up");
+        let err =
+            compress(&llm, &source, &source, Prompt::Generic, BackupMode::Sibling).unwrap_err();
+        assert!(
+            matches!(err, CavemanError::ValidationFailed(2, _)),
+            "{err:?}"
+        );
+        assert_eq!(
+            std::fs::read_to_string(&source).unwrap(),
+            original,
+            "source must be restored"
+        );
+        assert!(
+            !dir.path().join("doc.md.orig").exists(),
+            "backup must be cleaned up"
+        );
     }
 
     #[test]
@@ -267,7 +313,10 @@ mod tests {
 
         let backup_a = backup_path_for(&a, BackupMode::OutOfTree);
         let backup_b = backup_path_for(&b, BackupMode::OutOfTree);
-        assert_ne!(backup_a, backup_b, "same-named parent dirs must not collide");
+        assert_ne!(
+            backup_a, backup_b,
+            "same-named parent dirs must not collide"
+        );
     }
 
     #[test]
@@ -278,6 +327,10 @@ mod tests {
         let llm = FakeLlm::queue(&["compressed content"]);
         compress(&llm, &source, &target, Prompt::Generic, BackupMode::Sibling).unwrap();
         assert!(!dir.path().join("shadow.md.orig").exists());
-        assert_eq!(std::fs::read_to_string(&source).unwrap(), "plugin content here", "source untouched");
+        assert_eq!(
+            std::fs::read_to_string(&source).unwrap(),
+            "plugin content here",
+            "source untouched"
+        );
     }
 }
diff --git a/crates/caveman/src/lib.rs b/crates/caveman/src/lib.rs
index 43b20a2c..c2e15d24 100644
--- a/crates/caveman/src/lib.rs
+++ b/crates/caveman/src/lib.rs
@@ -6,7 +6,7 @@ mod prompt;
 mod sensitive;
 mod validate;
 
-pub use compress::{compress, BackupMode, Report};
+pub use compress::{BackupMode, Report, compress};
 pub use error::CavemanError;
 pub use llm::{Llm, RealLlm};
 pub use prompt::Prompt;
diff --git a/crates/caveman/src/llm.rs b/crates/caveman/src/llm.rs
index b379d591..3def50d2 100644
--- a/crates/caveman/src/llm.rs
+++ b/crates/caveman/src/llm.rs
@@ -1,4 +1,4 @@
-//! LLM invocation: raw HTTP to the Anthropic API when ANTHROPIC_API_KEY is
+//! LLM invocation: raw HTTP to the Anthropic API when `ANTHROPIC_API_KEY` is
 //! set, else shell out to `claude --print` (handles desktop/OAuth auth).
 //! Every I/O boundary here is explicit UTF-8 — unlike the ported Python
 //! version, which only pinned UTF-8 on this subprocess path and left plain
@@ -36,11 +36,12 @@ fn call_via_api(api_key: &str, prompt: &str) -> Result<String, CavemanError> {
         .set("x-api-key", api_key)
         .set("anthropic-version", "2023-06-01")
         .set("content-type", "application/json")
-        .timeout(std::time::Duration::from_secs(120))
+        .timeout(std::time::Duration::from_mins(2))
         .send_json(body)
         .map_err(|e| CavemanError::Llm(format!("API call failed: {e}")))?;
-    let json: serde_json::Value =
-        resp.into_json().map_err(|e| CavemanError::Llm(format!("bad API response: {e}")))?;
+    let json: serde_json::Value = resp
+        .into_json()
+        .map_err(|e| CavemanError::Llm(format!("bad API response: {e}")))?;
     json["content"][0]["text"]
         .as_str()
         .map(|s| s.trim().to_string())
@@ -48,9 +49,8 @@ fn call_via_api(api_key: &str, prompt: &str) -> Result<String, CavemanError> {
 }
 
 fn call_via_cli(prompt: &str) -> Result<String, CavemanError> {
-    let claude_bin = which::which("claude")
-        .map(|p| p.display().to_string())
-        .unwrap_or_else(|_| "claude".to_string());
+    let claude_bin =
+        which::which("claude").map_or_else(|_| "claude".to_string(), |p| p.display().to_string());
     let mut child = Command::new(&claude_bin)
         .arg("--print")
         .stdin(Stdio::piped())
@@ -68,10 +68,11 @@ fn call_via_cli(prompt: &str) -> Result<String, CavemanError> {
     let output = child
         .wait_with_output()
         .map_err(|e| CavemanError::Llm(format!("'{claude_bin}' failed: {e}")))?;
-    let write_result = writer
-        .join()
-        .map_err(|_| CavemanError::Llm(format!("stdin writer thread for '{claude_bin}' panicked")))?;
-    write_result.map_err(|e| CavemanError::Llm(format!("write to '{claude_bin}' stdin failed: {e}")))?;
+    let write_result = writer.join().map_err(|_| {
+        CavemanError::Llm(format!("stdin writer thread for '{claude_bin}' panicked"))
+    })?;
+    write_result
+        .map_err(|e| CavemanError::Llm(format!("write to '{claude_bin}' stdin failed: {e}")))?;
     if !output.status.success() {
         let stderr = String::from_utf8_lossy(&output.stderr);
         return Err(CavemanError::Llm(format!("Claude call failed:\n{stderr}")));
@@ -88,7 +89,12 @@ pub struct FakeLlm {
 impl FakeLlm {
     pub fn queue(responses: &[&str]) -> Self {
         Self {
-            responses: std::cell::RefCell::new(responses.iter().map(|s| s.to_string()).collect()),
+            responses: std::cell::RefCell::new(
+                responses
+                    .iter()
+                    .map(std::string::ToString::to_string)
+                    .collect(),
+            ),
         }
     }
 }
diff --git a/crates/caveman/src/prompt.rs b/crates/caveman/src/prompt.rs
index 815cd742..855d6e9e 100644
--- a/crates/caveman/src/prompt.rs
+++ b/crates/caveman/src/prompt.rs
@@ -23,10 +23,13 @@ const GENERIC_RULES: &str = "STRICT RULES:
 Only compress natural language.";
 
 impl Prompt {
+    #[must_use]
     pub fn build_compress_prompt(&self, body: &str) -> String {
         match self {
             Prompt::Generic => {
-                format!("Compress this markdown into caveman format.\n\n{GENERIC_RULES}\n\nTEXT:\n{body}")
+                format!(
+                    "Compress this markdown into caveman format.\n\n{GENERIC_RULES}\n\nTEXT:\n{body}"
+                )
             }
             Prompt::Custom(spec) => format!(
                 "Compress this markdown body per the spec below.\n\n{spec}\n\nReturn ONLY the compressed markdown body — no outer fence, no explanation.\n\nBODY:\n{body}"
@@ -34,8 +37,13 @@ impl Prompt {
         }
     }
 
+    #[must_use]
     pub fn build_fix_prompt(&self, original: &str, compressed: &str, errors: &[String]) -> String {
-        let errors_str = errors.iter().map(|e| format!("- {e}")).collect::<Vec<_>>().join("\n");
+        let errors_str = errors
+            .iter()
+            .map(|e| format!("- {e}"))
+            .collect::<Vec<_>>()
+            .join("\n");
         format!(
             "You are fixing a compressed markdown file. Specific validation errors were found.\n\n\
 CRITICAL RULES:\n\
diff --git a/crates/caveman/src/sensitive.rs b/crates/caveman/src/sensitive.rs
index c349d2af..e3e7c8e7 100644
--- a/crates/caveman/src/sensitive.rs
+++ b/crates/caveman/src/sensitive.rs
@@ -24,7 +24,14 @@ static SENSITIVE_BASENAME_REGEX: LazyLock<Regex> = LazyLock::new(|| {
 
 const SENSITIVE_PATH_COMPONENTS: &[&str] = &[".ssh", ".aws", ".gnupg", ".kube", ".docker"];
 const SENSITIVE_NAME_TOKENS: &[&str] = &[
-    "secret", "credential", "password", "passwd", "apikey", "accesskey", "token", "privatekey",
+    "secret",
+    "credential",
+    "password",
+    "passwd",
+    "apikey",
+    "accesskey",
+    "token",
+    "privatekey",
 ];
 
 pub fn is_sensitive_path(path: &Path) -> bool {
@@ -37,14 +44,19 @@ pub fn is_sensitive_path(path: &Path) -> bool {
     let has_sensitive_component = path.components().any(|c| {
         c.as_os_str()
             .to_str()
-            .map(|s| SENSITIVE_PATH_COMPONENTS.contains(&s.to_lowercase().as_str()))
-            .unwrap_or(false)
+            .is_some_and(|s| SENSITIVE_PATH_COMPONENTS.contains(&s.to_lowercase().as_str()))
     });
     if has_sensitive_component {
         return true;
     }
-    let normalized: String = name.to_lowercase().chars().filter(|c| !"_- .".contains(*c)).collect();
-    SENSITIVE_NAME_TOKENS.iter().any(|tok| normalized.contains(tok))
+    let normalized: String = name
+        .to_lowercase()
+        .chars()
+        .filter(|c| !"_- .".contains(*c))
+        .collect();
+    SENSITIVE_NAME_TOKENS
+        .iter()
+        .any(|tok| normalized.contains(tok))
 }
 
 #[cfg(test)]
@@ -70,7 +82,9 @@ mod tests {
 
     #[test]
     fn matches_ssh_path_component() {
-        assert!(is_sensitive_path(&PathBuf::from("/home/user/.ssh/id_ed25519")));
+        assert!(is_sensitive_path(&PathBuf::from(
+            "/home/user/.ssh/id_ed25519"
+        )));
     }
 
     #[test]
diff --git a/crates/caveman/src/validate.rs b/crates/caveman/src/validate.rs
index 177306cd..1871dc09 100644
--- a/crates/caveman/src/validate.rs
+++ b/crates/caveman/src/validate.rs
@@ -10,7 +10,8 @@ use std::sync::LazyLock;
 static URL_REGEX: LazyLock<Regex> = LazyLock::new(|| Regex::new(r"https?://[^\s)]+").unwrap());
 static FENCE_OPEN_REGEX: LazyLock<Regex> =
     LazyLock::new(|| Regex::new(r"^(\s{0,3})(`{3,}|~{3,})(.*)$").unwrap());
-static HEADING_REGEX: LazyLock<Regex> = LazyLock::new(|| Regex::new(r"(?m)^(#{1,6})\s+(.*)").unwrap());
+static HEADING_REGEX: LazyLock<Regex> =
+    LazyLock::new(|| Regex::new(r"(?m)^(#{1,6})\s+(.*)").unwrap());
 static INLINE_CODE_REGEX: LazyLock<Regex> = LazyLock::new(|| Regex::new(r"`([^`]+)`").unwrap());
 
 fn extract_headings(text: &str) -> Vec<(String, String)> {
@@ -39,16 +40,15 @@ fn extract_code_blocks(text: &str) -> Vec<String> {
         i += 1;
         let mut closed = false;
         while i < lines.len() {
-            if let Some(close_caps) = FENCE_OPEN_REGEX.captures(lines[i]) {
-                if close_caps[2].chars().next() == Some(fence_char)
-                    && close_caps[2].len() >= fence_len
-                    && close_caps[3].trim().is_empty()
-                {
-                    block_lines.push(lines[i]);
-                    closed = true;
-                    i += 1;
-                    break;
-                }
+            if let Some(close_caps) = FENCE_OPEN_REGEX.captures(lines[i])
+                && close_caps[2].starts_with(fence_char)
+                && close_caps[2].len() >= fence_len
+                && close_caps[3].trim().is_empty()
+            {
+                block_lines.push(lines[i]);
+                closed = true;
+                i += 1;
+                break;
             }
             block_lines.push(lines[i]);
             i += 1;
@@ -63,7 +63,10 @@ fn extract_code_blocks(text: &str) -> Vec<String> {
 }
 
 fn extract_urls(text: &str) -> HashSet<String> {
-    URL_REGEX.find_iter(text).map(|m| m.as_str().to_string()).collect()
+    URL_REGEX
+        .find_iter(text)
+        .map(|m| m.as_str().to_string())
+        .collect()
 }
 
 fn extract_inline_codes(text: &str) -> Vec<String> {
@@ -93,7 +96,11 @@ pub fn validate(orig: &str, comp: &str) -> Vec<String> {
     let h1 = extract_headings(orig);
     let h2 = extract_headings(comp);
     if h1.len() != h2.len() {
-        errors.push(format!("Heading count mismatch: {} vs {}", h1.len(), h2.len()));
+        errors.push(format!(
+            "Heading count mismatch: {} vs {}",
+            h1.len(),
+            h2.len()
+        ));
     } else if h1 != h2 {
         // Same count but different level/text — the compressor rewrote a
         // heading instead of preserving it, which the prompt promises not
@@ -148,7 +155,10 @@ mod tests {
         let orig = "# One\n\n## Two\n\nbody";
         let comp = "# One\n\nbody";
         let errors = validate(orig, comp);
-        assert!(errors.iter().any(|e| e.contains("Heading count mismatch")), "{errors:?}");
+        assert!(
+            errors.iter().any(|e| e.contains("Heading count mismatch")),
+            "{errors:?}"
+        );
     }
 
     #[test]
@@ -156,7 +166,12 @@ mod tests {
         let orig = "# One\n\n## Getting Started\n\nbody";
         let comp = "# One\n\n## Start\n\nbody";
         let errors = validate(orig, comp);
-        assert!(errors.iter().any(|e| e.contains("Headings not preserved exactly")), "{errors:?}");
+        assert!(
+            errors
+                .iter()
+                .any(|e| e.contains("Headings not preserved exactly")),
+            "{errors:?}"
+        );
     }
 
     #[test]
@@ -164,7 +179,12 @@ mod tests {
         let orig = "```py\nprint(1)\n```\n";
         let comp = "```py\nprint(2)\n```\n";
         let errors = validate(orig, comp);
-        assert!(errors.iter().any(|e| e.contains("Code blocks not preserved")), "{errors:?}");
+        assert!(
+            errors
+                .iter()
+                .any(|e| e.contains("Code blocks not preserved")),
+            "{errors:?}"
+        );
     }
 
     #[test]
@@ -172,7 +192,10 @@ mod tests {
         let orig = "see https://x.com for details";
         let comp = "see the docs for details";
         let errors = validate(orig, comp);
-        assert!(errors.iter().any(|e| e.contains("URL mismatch")), "{errors:?}");
+        assert!(
+            errors.iter().any(|e| e.contains("URL mismatch")),
+            "{errors:?}"
+        );
     }
 
     #[test]
@@ -180,7 +203,10 @@ mod tests {
         let orig = "run `cargo test` to check";
         let comp = "run the tests to check";
         let errors = validate(orig, comp);
-        assert!(errors.iter().any(|e| e.contains("Inline code lost")), "{errors:?}");
+        assert!(
+            errors.iter().any(|e| e.contains("Inline code lost")),
+            "{errors:?}"
+        );
     }
 
     #[test]
diff --git a/crates/gateway-registry/src/audit.rs b/crates/gateway-registry/src/audit.rs
index 694372de..3a541a60 100644
--- a/crates/gateway-registry/src/audit.rs
+++ b/crates/gateway-registry/src/audit.rs
@@ -32,13 +32,23 @@ pub fn record(path: &Path, server: &str, tool: &str, args: &Value, outcome: Resu
             "outcome": "err", "error_kind": error_kind,
         }),
     };
-    match std::fs::OpenOptions::new().create(true).append(true).open(path) {
+    match std::fs::OpenOptions::new()
+        .create(true)
+        .append(true)
+        .open(path)
+    {
         Ok(mut f) => {
             if let Err(e) = writeln!(f, "{line}") {
-                eprintln!("gateway-registry: failed to write audit log entry to {}: {e}", path.display());
+                eprintln!(
+                    "gateway-registry: failed to write audit log entry to {}: {e}",
+                    path.display()
+                );
             }
         }
-        Err(e) => eprintln!("gateway-registry: failed to open audit log {}: {e}", path.display()),
+        Err(e) => eprintln!(
+            "gateway-registry: failed to open audit log {}: {e}",
+            path.display()
+        ),
     }
 }
 
diff --git a/crates/gateway-registry/src/circuit.rs b/crates/gateway-registry/src/circuit.rs
index 9b972088..49e766d1 100644
--- a/crates/gateway-registry/src/circuit.rs
+++ b/crates/gateway-registry/src/circuit.rs
@@ -26,7 +26,11 @@ pub struct CircuitBreaker {
 
 impl CircuitBreaker {
     pub fn new(failure_threshold: u32, recovery_timeout: Duration) -> Self {
-        Self { state: tokio::sync::Mutex::new(CircuitState::default()), failure_threshold, recovery_timeout }
+        Self {
+            state: tokio::sync::Mutex::new(CircuitState::default()),
+            failure_threshold,
+            recovery_timeout,
+        }
     }
 
     /// Fast-fails without attempting a connection if the circuit is open.
diff --git a/crates/gateway-registry/src/config.rs b/crates/gateway-registry/src/config.rs
index 6b2bad51..83237018 100644
--- a/crates/gateway-registry/src/config.rs
+++ b/crates/gateway-registry/src/config.rs
@@ -52,15 +52,23 @@ pub enum ConfigError {
          (got auth_ref={auth_ref:?}, auth_env={auth_env:?}) — a lone auth_ref silently \
          injects no credentials at runtime, so this is rejected at parse time instead"
     )]
-    IncompleteAuthConfig { server: String, auth_ref: Option<String>, auth_env: Option<String> },
+    IncompleteAuthConfig {
+        server: String,
+        auth_ref: Option<String>,
+        auth_env: Option<String>,
+    },
 }
 
 pub fn parse(toml_str: &str) -> Result<GatewayConfig, ConfigError> {
     let cfg: GatewayConfig = toml::from_str(toml_str)?;
     for (name, server) in &cfg.servers {
         let (auth_ref, auth_env) = match server {
-            ServerConfig::McpStdio { auth_ref, auth_env, .. } => (auth_ref, auth_env),
-            ServerConfig::McpHttp { auth_ref, auth_env, .. } => (auth_ref, auth_env),
+            ServerConfig::McpStdio {
+                auth_ref, auth_env, ..
+            } => (auth_ref, auth_env),
+            ServerConfig::McpHttp {
+                auth_ref, auth_env, ..
+            } => (auth_ref, auth_env),
         };
         if auth_ref.is_some() != auth_env.is_some() {
             return Err(ConfigError::IncompleteAuthConfig {
@@ -90,8 +98,12 @@ mod tests {
             "#,
         )
         .unwrap();
-        let ServerConfig::McpStdio { command, args, auth_ref, auth_env } =
-            cfg.servers.get("narsil").unwrap()
+        let ServerConfig::McpStdio {
+            command,
+            args,
+            auth_ref,
+            auth_env,
+        } = cfg.servers.get("narsil").unwrap()
         else {
             panic!("expected McpStdio");
         };
@@ -118,7 +130,9 @@ mod tests {
             "#,
         )
         .unwrap_err();
-        assert!(matches!(err, ConfigError::IncompleteAuthConfig { server, .. } if server == "narsil"));
+        assert!(
+            matches!(err, ConfigError::IncompleteAuthConfig { server, .. } if server == "narsil")
+        );
     }
 
     #[test]
@@ -132,7 +146,9 @@ mod tests {
             "#,
         )
         .unwrap_err();
-        assert!(matches!(err, ConfigError::IncompleteAuthConfig { server, .. } if server == "narsil"));
+        assert!(
+            matches!(err, ConfigError::IncompleteAuthConfig { server, .. } if server == "narsil")
+        );
     }
 
     #[test]
@@ -145,8 +161,12 @@ mod tests {
             "#,
         )
         .unwrap();
-        let ServerConfig::McpStdio { args, auth_ref, auth_env, .. } =
-            cfg.servers.get("bare").unwrap()
+        let ServerConfig::McpStdio {
+            args,
+            auth_ref,
+            auth_env,
+            ..
+        } = cfg.servers.get("bare").unwrap()
         else {
             panic!("expected McpStdio");
         };
@@ -168,8 +188,12 @@ mod tests {
             "#,
         )
         .unwrap();
-        let ServerConfig::McpHttp { url, auth_ref, auth_env, auth_header } =
-            cfg.servers.get("narsil").unwrap()
+        let ServerConfig::McpHttp {
+            url,
+            auth_ref,
+            auth_env,
+            auth_header,
+        } = cfg.servers.get("narsil").unwrap()
         else {
             panic!("expected McpHttp");
         };
@@ -189,8 +213,12 @@ mod tests {
             "#,
         )
         .unwrap();
-        let ServerConfig::McpHttp { auth_ref, auth_env, auth_header, .. } =
-            cfg.servers.get("bare").unwrap()
+        let ServerConfig::McpHttp {
+            auth_ref,
+            auth_env,
+            auth_header,
+            ..
+        } = cfg.servers.get("bare").unwrap()
         else {
             panic!("expected McpHttp");
         };
@@ -210,6 +238,8 @@ mod tests {
             "#,
         )
         .unwrap_err();
-        assert!(matches!(err, ConfigError::IncompleteAuthConfig { server, .. } if server == "narsil"));
+        assert!(
+            matches!(err, ConfigError::IncompleteAuthConfig { server, .. } if server == "narsil")
+        );
     }
 }
diff --git a/crates/gateway-registry/src/db.rs b/crates/gateway-registry/src/db.rs
index 35b47318..7eaa3af0 100644
--- a/crates/gateway-registry/src/db.rs
+++ b/crates/gateway-registry/src/db.rs
@@ -4,7 +4,7 @@
 //! transaction (same pattern as `crates/skill-registry/src/db.rs`).
 
 use crate::types::ToolEntry;
-use rusqlite::{params, Connection};
+use rusqlite::{Connection, params};
 use std::path::Path;
 
 const SCHEMA: &str = "
@@ -94,7 +94,11 @@ pub fn server_tools(conn: &Connection, server: &str) -> rusqlite::Result<Vec<Too
         let schema_json: String = r.get(2)?;
         let input_schema: serde_json::Value =
             serde_json::from_str(&schema_json).unwrap_or(serde_json::Value::Null);
-        Ok(ToolEntry { name: r.get(0)?, description: r.get(1)?, input_schema })
+        Ok(ToolEntry {
+            name: r.get(0)?,
+            description: r.get(1)?,
+            input_schema,
+        })
     })?;
     rows.collect()
 }
@@ -118,28 +122,46 @@ mod tests {
             &mut conn,
             &[ServerTools {
                 server: "narsil".into(),
-                tools: vec![entry("find_symbols", "alpha desc"), entry("references", "beta desc")],
+                tools: vec![
+                    entry("find_symbols", "alpha desc"),
+                    entry("references", "beta desc"),
+                ],
             }],
         )
         .unwrap();
-        let n: i64 = conn.query_row("SELECT count(*) FROM tools", [], |r| r.get(0)).unwrap();
+        let n: i64 = conn
+            .query_row("SELECT count(*) FROM tools", [], |r| r.get(0))
+            .unwrap();
         assert_eq!(n, 2);
         rebuild(
             &mut conn,
-            &[ServerTools { server: "narsil".into(), tools: vec![entry("gamma", "gamma desc")] }],
+            &[ServerTools {
+                server: "narsil".into(),
+                tools: vec![entry("gamma", "gamma desc")],
+            }],
         )
         .unwrap();
-        let n: i64 = conn.query_row("SELECT count(*) FROM tools", [], |r| r.get(0)).unwrap();
+        let n: i64 = conn
+            .query_row("SELECT count(*) FROM tools", [], |r| r.get(0))
+            .unwrap();
         assert_eq!(n, 1);
-        let f: i64 = conn.query_row("SELECT count(*) FROM tools_fts", [], |r| r.get(0)).unwrap();
+        let f: i64 = conn
+            .query_row("SELECT count(*) FROM tools_fts", [], |r| r.get(0))
+            .unwrap();
         assert_eq!(f, 1);
     }
 
     #[test]
     fn fts_rowids_match_tools_rowids() {
         let mut conn = open_in_memory().unwrap();
-        rebuild(&mut conn, &[ServerTools { server: "s".into(), tools: vec![entry("a", "alpha")] }])
-            .unwrap();
+        rebuild(
+            &mut conn,
+            &[ServerTools {
+                server: "s".into(),
+                tools: vec![entry("a", "alpha")],
+            }],
+        )
+        .unwrap();
         let pair: (i64, i64) = conn
             .query_row(
                 "SELECT t.rowid, f.rowid FROM tools t, tools_fts f WHERE f.name = t.name",
@@ -156,8 +178,14 @@ mod tests {
         rebuild(
             &mut conn,
             &[
-                ServerTools { server: "a".into(), tools: vec![entry("x", "")] },
-                ServerTools { server: "b".into(), tools: vec![entry("y", "")] },
+                ServerTools {
+                    server: "a".into(),
+                    tools: vec![entry("x", "")],
+                },
+                ServerTools {
+                    server: "b".into(),
+                    tools: vec![entry("y", "")],
+                },
             ],
         )
         .unwrap();
@@ -176,7 +204,10 @@ mod tests {
                     server: "a".into(),
                     tools: vec![entry("x", "desc-x")],
                 },
-                ServerTools { server: "b".into(), tools: vec![entry("y", "desc-y")] },
+                ServerTools {
+                    server: "b".into(),
+                    tools: vec![entry("y", "desc-y")],
+                },
             ],
         )
         .unwrap();
@@ -184,7 +215,10 @@ mod tests {
         assert_eq!(a_tools.len(), 1);
         assert_eq!(a_tools[0].name, "x");
         assert_eq!(a_tools[0].description, "desc-x");
-        assert_eq!(a_tools[0].input_schema, serde_json::json!({"type": "object"}));
+        assert_eq!(
+            a_tools[0].input_schema,
+            serde_json::json!({"type": "object"})
+        );
         assert!(server_tools(&conn, "missing").unwrap().is_empty());
     }
 
@@ -192,7 +226,9 @@ mod tests {
     fn open_db_sets_wal_journal_mode() {
         let tmp = tempfile::tempdir().unwrap();
         let conn = open_db(&tmp.path().join("gateway.db")).unwrap();
-        let mode: String = conn.query_row("PRAGMA journal_mode", [], |r| r.get(0)).unwrap();
+        let mode: String = conn
+            .query_row("PRAGMA journal_mode", [], |r| r.get(0))
+            .unwrap();
         assert_eq!(mode, "wal");
     }
 }
diff --git a/crates/gateway-registry/src/error.rs b/crates/gateway-registry/src/error.rs
index fe7ec4d4..c7860a09 100644
--- a/crates/gateway-registry/src/error.rs
+++ b/crates/gateway-registry/src/error.rs
@@ -42,13 +42,15 @@ pub fn levenshtein(a: &str, b: &str) -> usize {
     for (i, row) in dp.iter_mut().enumerate().take(la + 1) {
         row[0] = i;
     }
-    for j in 0..=lb {
-        dp[0][j] = j;
+    for (j, cell) in dp[0].iter_mut().enumerate() {
+        *cell = j;
     }
     for i in 1..=la {
         for j in 1..=lb {
             let cost = if a[i - 1] == b[j - 1] { 0 } else { 1 };
-            dp[i][j] = (dp[i - 1][j] + 1).min(dp[i][j - 1] + 1).min(dp[i - 1][j - 1] + cost);
+            dp[i][j] = (dp[i - 1][j] + 1)
+                .min(dp[i][j - 1] + 1)
+                .min(dp[i - 1][j - 1] + cost);
         }
     }
     dp[la][lb]
@@ -82,7 +84,10 @@ mod tests {
     #[test]
     fn suggest_picks_closest_within_threshold() {
         let candidates = vec!["find_symbols".to_string(), "list_issues".to_string()];
-        assert_eq!(suggest("find_symbls", &candidates), Some("find_symbols".to_string()));
+        assert_eq!(
+            suggest("find_symbls", &candidates),
+            Some("find_symbols".to_string())
+        );
     }
 
     #[test]
diff --git a/crates/gateway-registry/src/lib.rs b/crates/gateway-registry/src/lib.rs
index 90eb8ae8..4b3a7d7e 100644
--- a/crates/gateway-registry/src/lib.rs
+++ b/crates/gateway-registry/src/lib.rs
@@ -4,8 +4,8 @@ mod circuit;
 mod config;
 mod db;
 mod error;
-mod mcp_stdio;
 mod mcp_http;
+mod mcp_stdio;
 mod redact;
 mod registry;
 mod sanitize;
@@ -14,12 +14,12 @@ mod truncate;
 mod types;
 
 pub use backend::Backend;
-pub use config::{parse as parse_config, ConfigError, GatewayConfig, ServerConfig};
-pub use error::{suggest, GatewayError};
+pub use config::{ConfigError, GatewayConfig, ServerConfig, parse as parse_config};
+pub use error::{GatewayError, suggest};
 pub use mcp_http::McpHttpBackend;
-pub use mcp_stdio::{McpStdioBackend, DEFAULT_TIMEOUT};
+pub use mcp_stdio::{DEFAULT_TIMEOUT, McpStdioBackend};
 pub use redact::redact_error_for_llm;
 pub use registry::Registry;
-pub use search::{search as search_tools, MatchMode, ToolHit};
-pub use truncate::{truncate_if_needed, DEFAULT_MAX_CHARS};
+pub use search::{MatchMode, ToolHit, search as search_tools};
+pub use truncate::{DEFAULT_MAX_CHARS, truncate_if_needed};
 pub use types::ToolEntry;
diff --git a/crates/gateway-registry/src/mcp_http.rs b/crates/gateway-registry/src/mcp_http.rs
index 5028fd03..da796358 100644
--- a/crates/gateway-registry/src/mcp_http.rs
+++ b/crates/gateway-registry/src/mcp_http.rs
@@ -3,16 +3,16 @@
 //! handshake via `ServiceExt::serve`) — same shape as `mcp_stdio.rs`'s
 //! stdio backend, just a different transport underneath.
 
-use crate::circuit::{CircuitBreaker, CIRCUIT_FAILURE_THRESHOLD, CIRCUIT_RECOVERY_TIMEOUT};
+use crate::circuit::{CIRCUIT_FAILURE_THRESHOLD, CIRCUIT_RECOVERY_TIMEOUT, CircuitBreaker};
 use crate::error::GatewayError;
 use crate::types::ToolEntry;
 use http::{HeaderName, HeaderValue};
 use rmcp::{
+    RoleClient, ServiceExt,
     service::RunningService,
     transport::{
-        streamable_http_client::StreamableHttpClientTransportConfig, StreamableHttpClientTransport,
+        StreamableHttpClientTransport, streamable_http_client::StreamableHttpClientTransportConfig,
     },
-    RoleClient, ServiceExt,
 };
 use serde_json::Value;
 use std::collections::HashMap;
@@ -34,7 +34,12 @@ pub struct McpHttpBackend {
 
 impl McpHttpBackend {
     pub fn new(url: String, auth_header: Option<(String, String)>) -> Self {
-        Self::with_timeout_and_circuit_recovery(url, auth_header, DEFAULT_TIMEOUT, CIRCUIT_RECOVERY_TIMEOUT)
+        Self::with_timeout_and_circuit_recovery(
+            url,
+            auth_header,
+            DEFAULT_TIMEOUT,
+            CIRCUIT_RECOVERY_TIMEOUT,
+        )
     }
 
     /// Same as [`Self::new`] but with an explicit timeout and circuit
@@ -58,16 +63,19 @@ impl McpHttpBackend {
 
     async fn ensure_connected(
         &self,
-    ) -> Result<tokio::sync::MutexGuard<'_, Option<RunningService<RoleClient, ()>>>, GatewayError> {
+    ) -> Result<tokio::sync::MutexGuard<'_, Option<RunningService<RoleClient, ()>>>, GatewayError>
+    {
         let mut guard = self.running.lock().await;
         if guard.is_none() {
             let mut cfg = StreamableHttpClientTransportConfig::with_uri(self.url.clone());
             if let Some((name, value)) = &self.auth_header {
                 let mut headers = HashMap::new();
-                let header_name = HeaderName::from_bytes(name.as_bytes())
-                    .map_err(|e| GatewayError::Connection(format!("invalid header name '{name}': {e}")))?;
-                let header_value = HeaderValue::from_str(value)
-                    .map_err(|e| GatewayError::Connection(format!("invalid header value for '{name}': {e}")))?;
+                let header_name = HeaderName::from_bytes(name.as_bytes()).map_err(|e| {
+                    GatewayError::Connection(format!("invalid header name '{name}': {e}"))
+                })?;
+                let header_value = HeaderValue::from_str(value).map_err(|e| {
+                    GatewayError::Connection(format!("invalid header value for '{name}': {e}"))
+                })?;
                 headers.insert(header_name, header_value);
                 cfg = cfg.custom_headers(headers);
             }
@@ -148,7 +156,7 @@ impl McpHttpBackend {
             other => {
                 return Err(GatewayError::InvalidArgument(format!(
                     "args must be a JSON object, got {other}"
-                )))
+                )));
             }
         };
         let mut guard = self.ensure_connected().await?;
diff --git a/crates/gateway-registry/src/mcp_stdio.rs b/crates/gateway-registry/src/mcp_stdio.rs
index 9b0e18e5..f857c0b1 100644
--- a/crates/gateway-registry/src/mcp_stdio.rs
+++ b/crates/gateway-registry/src/mcp_stdio.rs
@@ -2,13 +2,13 @@
 //! transport (`TokioChildProcess` + the `initialize` handshake via
 //! `ServiceExt::serve`) — not a bespoke REST bridge.
 
-use crate::circuit::{CircuitBreaker, CIRCUIT_FAILURE_THRESHOLD, CIRCUIT_RECOVERY_TIMEOUT};
+use crate::circuit::{CIRCUIT_FAILURE_THRESHOLD, CIRCUIT_RECOVERY_TIMEOUT, CircuitBreaker};
 use crate::error::GatewayError;
 use crate::types::ToolEntry;
 use rmcp::{
+    RoleClient, ServiceExt,
     service::RunningService,
     transport::{ConfigureCommandExt, TokioChildProcess},
-    RoleClient, ServiceExt,
 };
 use serde_json::Value;
 use std::collections::HashMap;
@@ -50,7 +50,13 @@ impl McpStdioBackend {
         env: HashMap<String, String>,
         timeout: Duration,
     ) -> Self {
-        Self::with_timeout_and_circuit_recovery(command, args, env, timeout, CIRCUIT_RECOVERY_TIMEOUT)
+        Self::with_timeout_and_circuit_recovery(
+            command,
+            args,
+            env,
+            timeout,
+            CIRCUIT_RECOVERY_TIMEOUT,
+        )
     }
 
     /// Same as [`Self::with_timeout`] but with an explicit circuit-breaker
@@ -76,11 +82,12 @@ impl McpStdioBackend {
 
     async fn ensure_connected(
         &self,
-    ) -> Result<tokio::sync::MutexGuard<'_, Option<RunningService<RoleClient, ()>>>, GatewayError> {
+    ) -> Result<tokio::sync::MutexGuard<'_, Option<RunningService<RoleClient, ()>>>, GatewayError>
+    {
         let mut guard = self.running.lock().await;
         if guard.is_none() {
-            let transport = TokioChildProcess::new(tokio::process::Command::new(&self.command).configure(
-                |cmd| {
+            let transport = TokioChildProcess::new(
+                tokio::process::Command::new(&self.command).configure(|cmd| {
                     cmd.args(&self.args);
                     for (k, v) in &self.env {
                         cmd.env(k, v);
@@ -93,9 +100,11 @@ impl McpStdioBackend {
                     // timeout actually terminates the hung child, not just our
                     // side of the connection.
                     cmd.kill_on_drop(true);
-                },
-            ))
-            .map_err(|e| GatewayError::Connection(format!("spawn '{}' failed: {e}", self.command)))?;
+                }),
+            )
+            .map_err(|e| {
+                GatewayError::Connection(format!("spawn '{}' failed: {e}", self.command))
+            })?;
             let running = tokio::time::timeout(self.timeout, ().serve(transport))
                 .await
                 .map_err(|_| {
@@ -190,7 +199,7 @@ impl McpStdioBackend {
                 // so `gateway_execute` maps it to `invalid_params`.
                 return Err(GatewayError::InvalidArgument(format!(
                     "args must be a JSON object, got {other}"
-                )))
+                )));
             }
         };
         let mut guard = self.ensure_connected().await?;
diff --git a/crates/gateway-registry/src/redact.rs b/crates/gateway-registry/src/redact.rs
index 8668064b..fcd0a366 100644
--- a/crates/gateway-registry/src/redact.rs
+++ b/crates/gateway-registry/src/redact.rs
@@ -18,8 +18,9 @@ use std::sync::LazyLock;
 static URL_RE: LazyLock<Regex> = LazyLock::new(|| Regex::new(r#"https?://[^\s'")]+"#).unwrap());
 static IPV4_RE: LazyLock<Regex> =
     LazyLock::new(|| Regex::new(r"\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(:\d+)?\b").unwrap());
-static UNIX_PATH_RE: LazyLock<Regex> =
-    LazyLock::new(|| Regex::new(r"/(?:home|Users|etc|var|tmp|opt|usr|root)(?:/[\w.\-]+)+").unwrap());
+static UNIX_PATH_RE: LazyLock<Regex> = LazyLock::new(|| {
+    Regex::new(r"/(?:home|Users|etc|var|tmp|opt|usr|root)(?:/[\w.\-]+)+").unwrap()
+});
 static WINDOWS_PATH_RE: LazyLock<Regex> =
     LazyLock::new(|| Regex::new(r"[A-Za-z]:\\[\w.\\ \-]+").unwrap());
 static CREDENTIAL_RE: LazyLock<Regex> = LazyLock::new(|| {
@@ -40,7 +41,10 @@ pub fn redact_error_for_llm(error: &str) -> String {
     msg = UNIX_PATH_RE.replace_all(&msg, "[path]").to_string();
     msg = IPV4_RE.replace_all(&msg, "[addr]").to_string();
     msg = STACK_FRAME_RE.replace_all(&msg, "").to_string();
-    msg.lines().filter(|l| !l.trim().is_empty()).collect::<Vec<_>>().join("\n")
+    msg.lines()
+        .filter(|l| !l.trim().is_empty())
+        .collect::<Vec<_>>()
+        .join("\n")
 }
 
 #[cfg(test)]
@@ -70,7 +74,9 @@ mod tests {
 
     #[test]
     fn redacts_windows_paths() {
-        let result = redact_error_for_llm(r"spawn failed: C:\Users\shiva\.agentflare\gateway.toml not found");
+        let result = redact_error_for_llm(
+            r"spawn failed: C:\Users\shiva\.agentflare\gateway.toml not found",
+        );
         assert!(result.contains("[path]"), "{result}");
         assert!(!result.contains("shiva"), "{result}");
     }
@@ -95,7 +101,10 @@ mod tests {
     #[test]
     fn preserves_tool_names_and_validation_errors() {
         let result = redact_error_for_llm("field 'pattern' is required for tool 'find_symbols'");
-        assert_eq!(result, "field 'pattern' is required for tool 'find_symbols'");
+        assert_eq!(
+            result,
+            "field 'pattern' is required for tool 'find_symbols'"
+        );
     }
 
     #[test]
diff --git a/crates/gateway-registry/src/registry.rs b/crates/gateway-registry/src/registry.rs
index e96f697f..b3b307ac 100644
--- a/crates/gateway-registry/src/registry.rs
+++ b/crates/gateway-registry/src/registry.rs
@@ -4,11 +4,11 @@
 use crate::backend::Backend;
 use crate::config::{GatewayConfig, ServerConfig};
 use crate::db::{self, ServerTools};
-use crate::error::{suggest, GatewayError};
+use crate::error::{GatewayError, suggest};
 use crate::mcp_http::McpHttpBackend;
 use crate::mcp_stdio::McpStdioBackend;
 use crate::sanitize::sanitize_tool_entry;
-use crate::search::{search, MatchMode, ToolHit};
+use crate::search::{MatchMode, ToolHit, search};
 use rusqlite::Connection;
 use serde_json::Value;
 use std::collections::HashMap;
@@ -46,7 +46,12 @@ impl Registry {
         let conn = db::open_db(db_path)?;
         let backends = build_backends(config, secrets);
         let audit_log_path = Some(db_path.with_file_name("gateway-audit.log"));
-        let mut reg = Self { conn: std::sync::Mutex::new(conn), backends, last_refresh: None, audit_log_path };
+        let mut reg = Self {
+            conn: std::sync::Mutex::new(conn),
+            backends,
+            last_refresh: None,
+            audit_log_path,
+        };
         reg.ensure_fresh().await?;
         Ok(reg)
     }
@@ -65,28 +70,33 @@ impl Registry {
     ) -> Result<Self, GatewayError> {
         let conn = db::open_in_memory()?;
         let backends = build_backends(config, secrets);
-        let mut reg =
-            Self { conn: std::sync::Mutex::new(conn), backends, last_refresh: None, audit_log_path: None };
+        let mut reg = Self {
+            conn: std::sync::Mutex::new(conn),
+            backends,
+            last_refresh: None,
+            audit_log_path: None,
+        };
         reg.ensure_fresh().await?;
         Ok(reg)
     }
 
     pub async fn ensure_fresh(&mut self) -> Result<(), GatewayError> {
-        if let Some(t) = self.last_refresh {
-            if t.elapsed() < REFRESH_DEBOUNCE {
-                return Ok(());
-            }
+        if let Some(t) = self.last_refresh
+            && t.elapsed() < REFRESH_DEBOUNCE
+        {
+            return Ok(());
         }
         // Backends are independent (each owns its own child-process
         // connection), so discover() runs concurrently across all of them
         // instead of one-at-a-time — with N configured servers, a single
         // slow/hanging backend no longer serializes the others' startup
         // behind it (each still bounded by its own DEFAULT_TIMEOUT).
-        let discovered = futures_util::future::join_all(self.backends.iter().map(|(name, backend)| {
-            let name = name.clone();
-            async move { (name, backend.discover().await) }
-        }))
-        .await;
+        let discovered =
+            futures_util::future::join_all(self.backends.iter().map(|(name, backend)| {
+                let name = name.clone();
+                async move { (name, backend.discover().await) }
+            }))
+            .await;
 
         let mut entries = Vec::new();
         for (name, result) in discovered {
@@ -103,7 +113,10 @@ impl Registry {
                 // first discovered, so it doesn't need this again.
                 Ok(tools) => {
                     let tools = tools.into_iter().map(sanitize_tool_entry).collect();
-                    entries.push(ServerTools { server: name, tools });
+                    entries.push(ServerTools {
+                        server: name,
+                        tools,
+                    });
                 }
                 Err(e) => {
                     eprintln!("gateway-registry: discover failed for backend '{name}': {e}");
@@ -115,29 +128,51 @@ impl Registry {
                     // for this server as of the previous successful refresh,
                     // if any, rather than contributing nothing.
                     let previous = {
-                        let conn = self.conn.lock().expect("gateway registry db mutex poisoned");
+                        let conn = self
+                            .conn
+                            .lock()
+                            .expect("gateway registry db mutex poisoned");
                         db::server_tools(&conn, &name).unwrap_or_default()
                     };
                     if !previous.is_empty() {
-                        entries.push(ServerTools { server: name, tools: previous });
+                        entries.push(ServerTools {
+                            server: name,
+                            tools: previous,
+                        });
                     }
                 }
             }
         }
         {
-            let mut conn = self.conn.lock().expect("gateway registry db mutex poisoned");
+            let mut conn = self
+                .conn
+                .lock()
+                .expect("gateway registry db mutex poisoned");
             db::rebuild(&mut conn, &entries)?;
         }
         self.last_refresh = Some(Instant::now());
         Ok(())
     }
 
-    pub fn search(&self, query: &str, limit: usize, mode: MatchMode) -> Result<Vec<ToolHit>, GatewayError> {
-        let conn = self.conn.lock().expect("gateway registry db mutex poisoned");
+    pub fn search(
+        &self,
+        query: &str,
+        limit: usize,
+        mode: MatchMode,
+    ) -> Result<Vec<ToolHit>, GatewayError> {
+        let conn = self
+            .conn
+            .lock()
+            .expect("gateway registry db mutex poisoned");
         Ok(search(&conn, query, limit, mode)?)
     }
 
-    pub async fn execute(&self, server: &str, tool: &str, args: Value) -> Result<Value, GatewayError> {
+    pub async fn execute(
+        &self,
+        server: &str,
+        tool: &str,
+        args: Value,
+    ) -> Result<Value, GatewayError> {
         let backend = match self.backends.get(server) {
             Some(b) => b,
             None => {
@@ -150,12 +185,17 @@ impl Registry {
             }
         };
         let known_tools = {
-            let conn = self.conn.lock().expect("gateway registry db mutex poisoned");
+            let conn = self
+                .conn
+                .lock()
+                .expect("gateway registry db mutex poisoned");
             db::tool_names(&conn, server)?
         };
         if !known_tools.is_empty() && !known_tools.contains(&tool.to_string()) {
             let msg = match suggest(tool, &known_tools) {
-                Some(s) => format!("tool '{tool}' not found on server '{server}' — did you mean '{s}'?"),
+                Some(s) => {
+                    format!("tool '{tool}' not found on server '{server}' — did you mean '{s}'?")
+                }
                 None => format!("tool '{tool}' not found on server '{server}'"),
             };
             return Err(GatewayError::ToolNotFound(msg));
@@ -188,11 +228,19 @@ fn error_kind(e: &GatewayError) -> &'static str {
     }
 }
 
-fn build_backends(config: &GatewayConfig, secrets: &HashMap<String, String>) -> HashMap<String, Backend> {
+fn build_backends(
+    config: &GatewayConfig,
+    secrets: &HashMap<String, String>,
+) -> HashMap<String, Backend> {
     let mut out = HashMap::new();
     for (name, server_config) in &config.servers {
         let backend = match server_config {
-            ServerConfig::McpStdio { command, args, auth_ref, auth_env } => {
+            ServerConfig::McpStdio {
+                command,
+                args,
+                auth_ref,
+                auth_env,
+            } => {
                 let mut env = HashMap::new();
                 if let (Some(auth_ref), Some(auth_env)) = (auth_ref, auth_env) {
                     match secrets.get(auth_ref) {
@@ -214,8 +262,14 @@ fn build_backends(config: &GatewayConfig, secrets: &HashMap<String, String>) ->
                 }
                 Backend::McpStdio(McpStdioBackend::new(command.clone(), args.clone(), env))
             }
-            ServerConfig::McpHttp { url, auth_ref, auth_env, auth_header } => {
-                let resolved = resolve_mcp_http_auth_header(name, auth_ref, auth_env, auth_header, secrets);
+            ServerConfig::McpHttp {
+                url,
+                auth_ref,
+                auth_env,
+                auth_header,
+            } => {
+                let resolved =
+                    resolve_mcp_http_auth_header(name, auth_ref, auth_env, auth_header, secrets);
                 Backend::McpHttp(McpHttpBackend::new(url.clone(), resolved))
             }
         };
@@ -248,7 +302,9 @@ fn resolve_mcp_http_auth_header(
     };
     match secrets.get(auth_ref) {
         Some(secret) => {
-            let header_name = auth_header.clone().unwrap_or_else(|| "Authorization".to_string());
+            let header_name = auth_header
+                .clone()
+                .unwrap_or_else(|| "Authorization".to_string());
             Some((header_name, secret.clone()))
         }
         None => {
@@ -308,15 +364,23 @@ mod tests {
         );
         // `last_refresh: None` so `ensure_fresh` doesn't skip via the
         // debounce and actually runs the discover-fails-then-fallback path.
-        let mut reg =
-            Registry { conn: std::sync::Mutex::new(conn), backends, last_refresh: None, audit_log_path: None };
+        let mut reg = Registry {
+            conn: std::sync::Mutex::new(conn),
+            backends,
+            last_refresh: None,
+            audit_log_path: None,
+        };
 
         reg.ensure_fresh().await.unwrap();
 
         // The failed refresh must NOT have wiped "flaky"'s previously
         // indexed tool — it should still be searchable/known.
         let hits = reg.search("old_tool", 5, MatchMode::All).unwrap();
-        assert_eq!(hits.len(), 1, "expected previously-indexed tool to survive a failed discover(), got {hits:?}");
+        assert_eq!(
+            hits.len(),
+            1,
+            "expected previously-indexed tool to survive a failed discover(), got {hits:?}"
+        );
         assert_eq!(hits[0].server, "flaky");
         assert_eq!(hits[0].tool, "old_tool");
 
diff --git a/crates/gateway-registry/src/sanitize.rs b/crates/gateway-registry/src/sanitize.rs
index ff25f361..de89555f 100644
--- a/crates/gateway-registry/src/sanitize.rs
+++ b/crates/gateway-registry/src/sanitize.rs
@@ -54,7 +54,11 @@ mod tests {
     use super::*;
 
     fn entry(name: &str, description: &str) -> ToolEntry {
-        ToolEntry { name: name.to_string(), description: description.to_string(), input_schema: serde_json::json!({}) }
+        ToolEntry {
+            name: name.to_string(),
+            description: description.to_string(),
+            input_schema: serde_json::json!({}),
+        }
     }
 
     #[test]
diff --git a/crates/gateway-registry/src/search.rs b/crates/gateway-registry/src/search.rs
index 0d0a8859..1d3693ed 100644
--- a/crates/gateway-registry/src/search.rs
+++ b/crates/gateway-registry/src/search.rs
@@ -91,7 +91,7 @@ pub fn search(
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::db::{open_in_memory, rebuild, ServerTools};
+    use crate::db::{ServerTools, open_in_memory, rebuild};
     use crate::types::ToolEntry;
 
     fn seed() -> Connection {
@@ -149,7 +149,13 @@ mod tests {
     #[test]
     fn fts_operators_in_query_are_neutralized() {
         let conn = seed();
-        for q in ["symbol\" OR \"x", "NEAR(a b)", "issues*", "(references)", "col:val"] {
+        for q in [
+            "symbol\" OR \"x",
+            "NEAR(a b)",
+            "issues*",
+            "(references)",
+            "col:val",
+        ] {
             search(&conn, q, 5, MatchMode::Any).unwrap();
         }
     }
diff --git a/crates/gateway-registry/src/truncate.rs b/crates/gateway-registry/src/truncate.rs
index 928a6753..f95762ed 100644
--- a/crates/gateway-registry/src/truncate.rs
+++ b/crates/gateway-registry/src/truncate.rs
@@ -54,23 +54,29 @@ fn build_envelope(json: &str, cut: usize) -> Value {
 /// `gateway_execute` (`src/mcp_server.rs`), which serializes the capped
 /// value with `serde_json::to_string_pretty` before returning it.
 fn envelope_len(envelope: &Value) -> usize {
-    serde_json::to_string_pretty(envelope).map(|s| s.len()).unwrap_or(usize::MAX)
+    serde_json::to_string_pretty(envelope)
+        .map(|s| s.len())
+        .unwrap_or(usize::MAX)
 }
 
 fn find_safe_cut_point(json: &str, max_pos: usize) -> usize {
     let limit = floor_char_boundary(json, max_pos);
     let region = &json[..limit];
-    if let Some(pos) = region.rfind('\n') {
-        if pos > limit / 2 {
-            return pos;
-        }
+    if let Some(pos) = region.rfind('\n')
+        && pos > limit / 2
+    {
+        return pos;
     }
-    if let Some(pos) = region.rfind(',') {
-        if pos > limit / 2 {
-            return pos + 1;
-        }
+    if let Some(pos) = region.rfind(',')
+        && pos > limit / 2
+    {
+        return pos + 1;
     }
-    region.char_indices().last().map(|(i, c)| i + c.len_utf8()).unwrap_or(0)
+    region
+        .char_indices()
+        .last()
+        .map(|(i, c)| i + c.len_utf8())
+        .unwrap_or(0)
 }
 
 fn floor_char_boundary(s: &str, max: usize) -> usize {
diff --git a/crates/gateway-registry/tests/fixtures/fixture_server.rs b/crates/gateway-registry/tests/fixtures/fixture_server.rs
index 24b309f5..6224e480 100644
--- a/crates/gateway-registry/tests/fixtures/fixture_server.rs
+++ b/crates/gateway-registry/tests/fixtures/fixture_server.rs
@@ -3,11 +3,11 @@
 //! end-to-end. Exposes one tool: `echo`.
 
 use rmcp::{
+    ServerHandler, ServiceExt,
     handler::server::wrapper::Parameters,
     model::{Implementation, ServerCapabilities, ServerInfo},
     schemars, tool, tool_handler, tool_router,
     transport::stdio,
-    ServerHandler, ServiceExt,
 };
 use serde::Deserialize;
 
@@ -72,7 +72,11 @@ async fn main() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     // rather than just that some later call happened to succeed.
     if let Ok(marker_path) = std::env::var("GATEWAY_FIXTURE_MARKER_FILE") {
         use std::io::Write as _;
-        if let Ok(mut f) = std::fs::OpenOptions::new().create(true).append(true).open(marker_path) {
+        if let Ok(mut f) = std::fs::OpenOptions::new()
+            .create(true)
+            .append(true)
+            .open(marker_path)
+        {
             let _ = writeln!(f, "{}", std::process::id());
         }
     }
diff --git a/crates/gateway-registry/tests/gateway_audit_log.rs b/crates/gateway-registry/tests/gateway_audit_log.rs
index a5e9ac5f..7b133c15 100644
--- a/crates/gateway-registry/tests/gateway_audit_log.rs
+++ b/crates/gateway-registry/tests/gateway_audit_log.rs
@@ -20,25 +20,50 @@ async fn execute_appends_an_audit_log_entry_without_leaking_raw_args() {
     let mut servers = HashMap::new();
     servers.insert(
         "fixture".to_string(),
-        ServerConfig::McpStdio { command: fixture_path(), args: vec![], auth_ref: None, auth_env: None },
+        ServerConfig::McpStdio {
+            command: fixture_path(),
+            args: vec![],
+            auth_ref: None,
+            auth_env: None,
+        },
     );
     let config = GatewayConfig { servers };
 
-    let reg = Registry::open_default(&db_path, &config, &HashMap::new()).await.unwrap();
-    assert!(!audit_path.exists(), "no calls yet — audit log shouldn't exist before the first execute()");
+    let reg = Registry::open_default(&db_path, &config, &HashMap::new())
+        .await
+        .unwrap();
+    assert!(
+        !audit_path.exists(),
+        "no calls yet — audit log shouldn't exist before the first execute()"
+    );
 
-    reg.execute("fixture", "echo", serde_json::json!({"text": "top-secret-value"})).await.unwrap();
+    reg.execute(
+        "fixture",
+        "echo",
+        serde_json::json!({"text": "top-secret-value"}),
+    )
+    .await
+    .unwrap();
     // "fail" is a real, discovered tool (added to the fixture for the
     // reconnect tests) that always errors — unlike an unknown tool name,
     // this actually reaches `backend.call()` instead of being rejected by
     // `execute()`'s own pre-flight ToolNotFound check, so it exercises the
     // audit log's error path.
-    reg.execute("fixture", "fail", serde_json::json!({})).await.unwrap_err();
+    reg.execute("fixture", "fail", serde_json::json!({}))
+        .await
+        .unwrap_err();
 
     let contents = std::fs::read_to_string(&audit_path).unwrap();
-    assert!(!contents.contains("top-secret-value"), "raw args must never appear in the audit log: {contents}");
+    assert!(
+        !contents.contains("top-secret-value"),
+        "raw args must never appear in the audit log: {contents}"
+    );
 
-    let lines: Vec<Value> = contents.lines().filter(|l| !l.is_empty()).map(|l| serde_json::from_str(l).unwrap()).collect();
+    let lines: Vec<Value> = contents
+        .lines()
+        .filter(|l| !l.is_empty())
+        .map(|l| serde_json::from_str(l).unwrap())
+        .collect();
     assert_eq!(lines.len(), 2);
 
     assert_eq!(lines[0]["server"], "fixture");
diff --git a/crates/gateway-registry/tests/mcp_http_call.rs b/crates/gateway-registry/tests/mcp_http_call.rs
index e9039633..ec101446 100644
--- a/crates/gateway-registry/tests/mcp_http_call.rs
+++ b/crates/gateway-registry/tests/mcp_http_call.rs
@@ -9,8 +9,14 @@ use agentflare_gateway_registry::{GatewayError, McpHttpBackend};
 async fn call_echo_returns_the_downstream_result() {
     let fixture = support::start().await;
     let backend = McpHttpBackend::new(fixture.url.clone(), None);
-    let result = backend.call("echo", serde_json::json!({"text": "hi"})).await.unwrap();
-    let text = result.get(0).and_then(|c| c.get("text")).and_then(|t| t.as_str());
+    let result = backend
+        .call("echo", serde_json::json!({"text": "hi"}))
+        .await
+        .unwrap();
+    let text = result
+        .get(0)
+        .and_then(|c| c.get("text"))
+        .and_then(|t| t.as_str());
     assert_eq!(text, Some("echo: hi"));
 }
 
@@ -18,7 +24,10 @@ async fn call_echo_returns_the_downstream_result() {
 async fn call_unknown_tool_surfaces_as_upstream_error() {
     let fixture = support::start().await;
     let backend = McpHttpBackend::new(fixture.url.clone(), None);
-    let err = backend.call("does_not_exist", serde_json::json!({})).await.unwrap_err();
+    let err = backend
+        .call("does_not_exist", serde_json::json!({}))
+        .await
+        .unwrap_err();
     assert!(matches!(err, GatewayError::Upstream(_)));
 }
 
@@ -26,8 +35,14 @@ async fn call_unknown_tool_surfaces_as_upstream_error() {
 async fn call_with_non_object_args_is_invalid_argument_not_upstream() {
     let fixture = support::start().await;
     let backend = McpHttpBackend::new(fixture.url.clone(), None);
-    let err = backend.call("echo", serde_json::json!("not an object")).await.unwrap_err();
-    assert!(matches!(err, GatewayError::InvalidArgument(_)), "expected InvalidArgument, got {err:?}");
+    let err = backend
+        .call("echo", serde_json::json!("not an object"))
+        .await
+        .unwrap_err();
+    assert!(
+        matches!(err, GatewayError::InvalidArgument(_)),
+        "expected InvalidArgument, got {err:?}"
+    );
 }
 
 #[tokio::test]
@@ -36,6 +51,12 @@ async fn call_against_unreachable_url_is_a_connection_error() {
     // refused immediately — same "always fails, no real wait" property
     // `tests/mcp_stdio_circuit_breaker.rs` gets from a nonexistent binary.
     let backend = McpHttpBackend::new("http://127.0.0.1:1/mcp".to_string(), None);
-    let err = backend.call("echo", serde_json::json!({})).await.unwrap_err();
-    assert!(matches!(err, GatewayError::Connection(_)), "expected Connection, got {err:?}");
+    let err = backend
+        .call("echo", serde_json::json!({}))
+        .await
+        .unwrap_err();
+    assert!(
+        matches!(err, GatewayError::Connection(_)),
+        "expected Connection, got {err:?}"
+    );
 }
diff --git a/crates/gateway-registry/tests/mcp_http_circuit_breaker.rs b/crates/gateway-registry/tests/mcp_http_circuit_breaker.rs
index 3cb7fb42..985404cc 100644
--- a/crates/gateway-registry/tests/mcp_http_circuit_breaker.rs
+++ b/crates/gateway-registry/tests/mcp_http_circuit_breaker.rs
@@ -18,24 +18,51 @@ fn broken_backend(circuit_recovery: Duration) -> McpHttpBackend {
 async fn circuit_opens_after_threshold_consecutive_failures() {
     let backend = broken_backend(Duration::from_secs(60));
     for _ in 0..3 {
-        let err = backend.call("echo", serde_json::json!({})).await.unwrap_err();
-        assert!(matches!(err, GatewayError::Connection(_)), "expected Connection, got {err:?}");
+        let err = backend
+            .call("echo", serde_json::json!({}))
+            .await
+            .unwrap_err();
+        assert!(
+            matches!(err, GatewayError::Connection(_)),
+            "expected Connection, got {err:?}"
+        );
     }
-    let err = backend.call("echo", serde_json::json!({})).await.unwrap_err();
-    assert!(matches!(err, GatewayError::CircuitOpen(_)), "expected CircuitOpen, got {err:?}");
+    let err = backend
+        .call("echo", serde_json::json!({}))
+        .await
+        .unwrap_err();
+    assert!(
+        matches!(err, GatewayError::CircuitOpen(_)),
+        "expected CircuitOpen, got {err:?}"
+    );
 }
 
 #[tokio::test]
 async fn circuit_allows_one_probe_after_recovery_window() {
     let backend = broken_backend(Duration::from_millis(200));
     for _ in 0..3 {
-        backend.call("echo", serde_json::json!({})).await.unwrap_err();
+        backend
+            .call("echo", serde_json::json!({}))
+            .await
+            .unwrap_err();
     }
-    let err = backend.call("echo", serde_json::json!({})).await.unwrap_err();
-    assert!(matches!(err, GatewayError::CircuitOpen(_)), "expected CircuitOpen, got {err:?}");
+    let err = backend
+        .call("echo", serde_json::json!({}))
+        .await
+        .unwrap_err();
+    assert!(
+        matches!(err, GatewayError::CircuitOpen(_)),
+        "expected CircuitOpen, got {err:?}"
+    );
 
     tokio::time::sleep(Duration::from_millis(250)).await;
 
-    let err = backend.call("echo", serde_json::json!({})).await.unwrap_err();
-    assert!(matches!(err, GatewayError::Connection(_)), "expected a real probe attempt, got {err:?}");
+    let err = backend
+        .call("echo", serde_json::json!({}))
+        .await
+        .unwrap_err();
+    assert!(
+        matches!(err, GatewayError::Connection(_)),
+        "expected a real probe attempt, got {err:?}"
+    );
 }
diff --git a/crates/gateway-registry/tests/mcp_http_discover.rs b/crates/gateway-registry/tests/mcp_http_discover.rs
index 09fd49d4..8221242b 100644
--- a/crates/gateway-registry/tests/mcp_http_discover.rs
+++ b/crates/gateway-registry/tests/mcp_http_discover.rs
@@ -11,7 +11,10 @@ async fn discover_lists_the_fixture_servers_echo_tool() {
     let fixture = support::start().await;
     let backend = McpHttpBackend::new(fixture.url.clone(), None);
     let tools = backend.discover().await.unwrap();
-    let echo = tools.iter().find(|t| t.name == "echo").expect("echo tool present");
+    let echo = tools
+        .iter()
+        .find(|t| t.name == "echo")
+        .expect("echo tool present");
     assert!(echo.description.contains("Echoes"));
 }
 
diff --git a/crates/gateway-registry/tests/mcp_stdio_call.rs b/crates/gateway-registry/tests/mcp_stdio_call.rs
index 120a3137..fcc95307 100644
--- a/crates/gateway-registry/tests/mcp_stdio_call.rs
+++ b/crates/gateway-registry/tests/mcp_stdio_call.rs
@@ -18,15 +18,24 @@ fn fixture_path() -> String {
 #[tokio::test]
 async fn call_echo_returns_the_downstream_result() {
     let backend = McpStdioBackend::new(fixture_path(), vec![], HashMap::new());
-    let result = backend.call("echo", serde_json::json!({"text": "hi"})).await.unwrap();
-    let text = result.get(0).and_then(|c| c.get("text")).and_then(|t| t.as_str());
+    let result = backend
+        .call("echo", serde_json::json!({"text": "hi"}))
+        .await
+        .unwrap();
+    let text = result
+        .get(0)
+        .and_then(|c| c.get("text"))
+        .and_then(|t| t.as_str());
     assert_eq!(text, Some("echo: hi"));
 }
 
 #[tokio::test]
 async fn call_unknown_tool_surfaces_as_upstream_error() {
     let backend = McpStdioBackend::new(fixture_path(), vec![], HashMap::new());
-    let err = backend.call("does_not_exist", serde_json::json!({})).await.unwrap_err();
+    let err = backend
+        .call("does_not_exist", serde_json::json!({}))
+        .await
+        .unwrap_err();
     assert!(matches!(err, GatewayError::Upstream(_)));
 }
 
@@ -38,6 +47,12 @@ async fn call_with_non_object_args_is_invalid_argument_not_upstream() {
     // (which `gateway_execute` maps to `invalid_params`), not `Upstream`
     // (which maps to `internal_error`).
     let backend = McpStdioBackend::new(fixture_path(), vec![], HashMap::new());
-    let err = backend.call("echo", serde_json::json!("not an object")).await.unwrap_err();
-    assert!(matches!(err, GatewayError::InvalidArgument(_)), "expected InvalidArgument, got {err:?}");
+    let err = backend
+        .call("echo", serde_json::json!("not an object"))
+        .await
+        .unwrap_err();
+    assert!(
+        matches!(err, GatewayError::InvalidArgument(_)),
+        "expected InvalidArgument, got {err:?}"
+    );
 }
diff --git a/crates/gateway-registry/tests/mcp_stdio_circuit_breaker.rs b/crates/gateway-registry/tests/mcp_stdio_circuit_breaker.rs
index e2930c09..38411aeb 100644
--- a/crates/gateway-registry/tests/mcp_stdio_circuit_breaker.rs
+++ b/crates/gateway-registry/tests/mcp_stdio_circuit_breaker.rs
@@ -27,14 +27,26 @@ async fn circuit_opens_after_threshold_consecutive_failures() {
 
     // First 3 failures are genuine spawn-connection failures.
     for _ in 0..3 {
-        let err = backend.call("echo", serde_json::json!({})).await.unwrap_err();
-        assert!(matches!(err, GatewayError::Connection(_)), "expected Connection, got {err:?}");
+        let err = backend
+            .call("echo", serde_json::json!({}))
+            .await
+            .unwrap_err();
+        assert!(
+            matches!(err, GatewayError::Connection(_)),
+            "expected Connection, got {err:?}"
+        );
     }
 
     // 4th call must short-circuit as CircuitOpen instead of attempting
     // another spawn.
-    let err = backend.call("echo", serde_json::json!({})).await.unwrap_err();
-    assert!(matches!(err, GatewayError::CircuitOpen(_)), "expected CircuitOpen, got {err:?}");
+    let err = backend
+        .call("echo", serde_json::json!({}))
+        .await
+        .unwrap_err();
+    assert!(
+        matches!(err, GatewayError::CircuitOpen(_)),
+        "expected CircuitOpen, got {err:?}"
+    );
 }
 
 #[tokio::test]
@@ -42,18 +54,33 @@ async fn circuit_allows_one_probe_after_recovery_window() {
     let backend = broken_backend(Duration::from_millis(200));
 
     for _ in 0..3 {
-        backend.call("echo", serde_json::json!({})).await.unwrap_err();
+        backend
+            .call("echo", serde_json::json!({}))
+            .await
+            .unwrap_err();
     }
-    let err = backend.call("echo", serde_json::json!({})).await.unwrap_err();
-    assert!(matches!(err, GatewayError::CircuitOpen(_)), "expected CircuitOpen, got {err:?}");
+    let err = backend
+        .call("echo", serde_json::json!({}))
+        .await
+        .unwrap_err();
+    assert!(
+        matches!(err, GatewayError::CircuitOpen(_)),
+        "expected CircuitOpen, got {err:?}"
+    );
 
     tokio::time::sleep(Duration::from_millis(250)).await;
 
     // Past the recovery window, the next call must be a real probe attempt
     // (Connection failure again, since the binary still doesn't exist) —
     // not another fast-failed CircuitOpen.
-    let err = backend.call("echo", serde_json::json!({})).await.unwrap_err();
-    assert!(matches!(err, GatewayError::Connection(_)), "expected a real probe attempt, got {err:?}");
+    let err = backend
+        .call("echo", serde_json::json!({}))
+        .await
+        .unwrap_err();
+    assert!(
+        matches!(err, GatewayError::Connection(_)),
+        "expected a real probe attempt, got {err:?}"
+    );
 }
 
 #[tokio::test]
@@ -69,13 +96,31 @@ async fn a_success_resets_the_failure_count() {
 
     // Two real failures (unknown tool — a service-level error, not enough
     // on its own to open a 3-failure circuit)...
-    backend.call("no-such-tool", serde_json::json!({})).await.unwrap_err();
-    backend.call("no-such-tool", serde_json::json!({})).await.unwrap_err();
+    backend
+        .call("no-such-tool", serde_json::json!({}))
+        .await
+        .unwrap_err();
+    backend
+        .call("no-such-tool", serde_json::json!({}))
+        .await
+        .unwrap_err();
 
     // ...then a success must reset the counter, so two MORE failures still
     // don't open the circuit.
-    backend.call("echo", serde_json::json!({"text": "hi"})).await.unwrap();
-    backend.call("no-such-tool", serde_json::json!({})).await.unwrap_err();
-    let err = backend.call("no-such-tool", serde_json::json!({})).await.unwrap_err();
-    assert!(matches!(err, GatewayError::Upstream(_)), "expected Upstream (circuit still closed), got {err:?}");
+    backend
+        .call("echo", serde_json::json!({"text": "hi"}))
+        .await
+        .unwrap();
+    backend
+        .call("no-such-tool", serde_json::json!({}))
+        .await
+        .unwrap_err();
+    let err = backend
+        .call("no-such-tool", serde_json::json!({}))
+        .await
+        .unwrap_err();
+    assert!(
+        matches!(err, GatewayError::Upstream(_)),
+        "expected Upstream (circuit still closed), got {err:?}"
+    );
 }
diff --git a/crates/gateway-registry/tests/mcp_stdio_discover.rs b/crates/gateway-registry/tests/mcp_stdio_discover.rs
index ace42167..0c44713c 100644
--- a/crates/gateway-registry/tests/mcp_stdio_discover.rs
+++ b/crates/gateway-registry/tests/mcp_stdio_discover.rs
@@ -22,7 +22,10 @@ async fn discover_lists_the_fixture_servers_echo_tool() {
     // `tests/mcp_stdio_timeout.rs` to test Fix 1's reconnect-after-timeout
     // behavior), so assert the `echo` tool specifically rather than the
     // exact total count.
-    let echo = tools.iter().find(|t| t.name == "echo").expect("echo tool present");
+    let echo = tools
+        .iter()
+        .find(|t| t.name == "echo")
+        .expect("echo tool present");
     assert!(echo.description.contains("Echoes"));
 }
 
diff --git a/crates/gateway-registry/tests/mcp_stdio_reconnect.rs b/crates/gateway-registry/tests/mcp_stdio_reconnect.rs
index 0d68bb17..dc1d2920 100644
--- a/crates/gateway-registry/tests/mcp_stdio_reconnect.rs
+++ b/crates/gateway-registry/tests/mcp_stdio_reconnect.rs
@@ -20,20 +20,35 @@ async fn service_error_on_a_cached_connection_clears_it_so_the_next_call_reconne
     let marker_path = marker.path().to_path_buf();
     let fixture = env!("CARGO_BIN_EXE_gateway-fixture-server").to_string();
     let mut env = HashMap::new();
-    env.insert("GATEWAY_FIXTURE_MARKER_FILE".to_string(), marker_path.to_string_lossy().to_string());
+    env.insert(
+        "GATEWAY_FIXTURE_MARKER_FILE".to_string(),
+        marker_path.to_string_lossy().to_string(),
+    );
     let backend = McpStdioBackend::with_timeout(fixture, vec![], env, Duration::from_secs(5));
 
     // First call connects (spawn #1) and succeeds normally, populating the cache.
-    backend.call("echo", serde_json::json!({"text": "hi"})).await.unwrap();
+    backend
+        .call("echo", serde_json::json!({"text": "hi"}))
+        .await
+        .unwrap();
 
     // Second call reuses the cached connection but the fixture's "fail" tool
     // returns a service-level error, not a timeout.
-    let err = backend.call("fail", serde_json::json!({})).await.unwrap_err();
-    assert!(matches!(err, GatewayError::Upstream(_)), "expected Upstream, got {err:?}");
+    let err = backend
+        .call("fail", serde_json::json!({}))
+        .await
+        .unwrap_err();
+    assert!(
+        matches!(err, GatewayError::Upstream(_)),
+        "expected Upstream, got {err:?}"
+    );
 
     // Third call must NOT reuse the connection from before the error — it
     // must respawn a fresh child process, same as the timeout case.
-    backend.call("echo", serde_json::json!({"text": "again"})).await.unwrap();
+    backend
+        .call("echo", serde_json::json!({"text": "again"}))
+        .await
+        .unwrap();
 
     let marker_contents = std::fs::read_to_string(&marker_path).unwrap();
     let spawn_count = marker_contents.lines().filter(|l| !l.is_empty()).count();
@@ -54,8 +69,15 @@ async fn concurrent_calls_to_the_same_backend_never_panic() {
     ));
     let calls = (0..20).map(|i| {
         let backend = backend.clone();
-        async move { backend.call("echo", serde_json::json!({"text": i.to_string()})).await }
+        async move {
+            backend
+                .call("echo", serde_json::json!({"text": i.to_string()}))
+                .await
+        }
     });
     let results = futures_util::future::join_all(calls).await;
-    assert!(results.iter().all(|r| r.is_ok()), "expected all concurrent calls to succeed: {results:?}");
+    assert!(
+        results.iter().all(|r| r.is_ok()),
+        "expected all concurrent calls to succeed: {results:?}"
+    );
 }
diff --git a/crates/gateway-registry/tests/mcp_stdio_timeout.rs b/crates/gateway-registry/tests/mcp_stdio_timeout.rs
index 4aa2a61d..1cbedd6d 100644
--- a/crates/gateway-registry/tests/mcp_stdio_timeout.rs
+++ b/crates/gateway-registry/tests/mcp_stdio_timeout.rs
@@ -26,14 +26,23 @@ fn hung_backend(timeout: Duration) -> McpStdioBackend {
 async fn discover_against_a_hung_backend_times_out_instead_of_hanging_forever() {
     let backend = hung_backend(Duration::from_secs(1));
     let err = backend.discover().await.unwrap_err();
-    assert!(matches!(err, GatewayError::Timeout(_)), "expected Timeout, got {err:?}");
+    assert!(
+        matches!(err, GatewayError::Timeout(_)),
+        "expected Timeout, got {err:?}"
+    );
 }
 
 #[tokio::test]
 async fn call_against_a_hung_backend_times_out_instead_of_hanging_forever() {
     let backend = hung_backend(Duration::from_secs(1));
-    let err = backend.call("echo", serde_json::json!({"text": "hi"})).await.unwrap_err();
-    assert!(matches!(err, GatewayError::Timeout(_)), "expected Timeout, got {err:?}");
+    let err = backend
+        .call("echo", serde_json::json!({"text": "hi"}))
+        .await
+        .unwrap_err();
+    assert!(
+        matches!(err, GatewayError::Timeout(_)),
+        "expected Timeout, got {err:?}"
+    );
 }
 
 /// Fix 1 (final review): a timed-out `call()`/`discover()` must clear the
@@ -54,20 +63,35 @@ async fn timeout_on_a_cached_connection_clears_it_so_the_next_call_reconnects()
     let marker_path = marker.path().to_path_buf();
     let fixture = env!("CARGO_BIN_EXE_gateway-fixture-server").to_string();
     let mut env = HashMap::new();
-    env.insert("GATEWAY_FIXTURE_MARKER_FILE".to_string(), marker_path.to_string_lossy().to_string());
+    env.insert(
+        "GATEWAY_FIXTURE_MARKER_FILE".to_string(),
+        marker_path.to_string_lossy().to_string(),
+    );
     let backend = McpStdioBackend::with_timeout(fixture, vec![], env, Duration::from_millis(500));
 
     // First call connects (spawn #1) and succeeds normally, populating the cache.
-    backend.call("echo", serde_json::json!({"text": "hi"})).await.unwrap();
+    backend
+        .call("echo", serde_json::json!({"text": "hi"}))
+        .await
+        .unwrap();
 
     // Second call reuses the cached connection but hangs forever on the
     // "hang" tool, so it must time out.
-    let err = backend.call("hang", serde_json::json!({})).await.unwrap_err();
-    assert!(matches!(err, GatewayError::Timeout(_)), "expected Timeout, got {err:?}");
+    let err = backend
+        .call("hang", serde_json::json!({}))
+        .await
+        .unwrap_err();
+    assert!(
+        matches!(err, GatewayError::Timeout(_)),
+        "expected Timeout, got {err:?}"
+    );
 
     // Third call must NOT reuse the (potentially wedged) cached connection
     // from before the timeout — it must respawn a fresh child process.
-    backend.call("echo", serde_json::json!({"text": "again"})).await.unwrap();
+    backend
+        .call("echo", serde_json::json!({"text": "again"}))
+        .await
+        .unwrap();
 
     let marker_contents = std::fs::read_to_string(&marker_path).unwrap();
     let spawn_count = marker_contents.lines().filter(|l| !l.is_empty()).count();
diff --git a/crates/gateway-registry/tests/registry.rs b/crates/gateway-registry/tests/registry.rs
index 1c6094fa..c479f6fe 100644
--- a/crates/gateway-registry/tests/registry.rs
+++ b/crates/gateway-registry/tests/registry.rs
@@ -22,14 +22,21 @@ fn config_with_fixture() -> GatewayConfig {
     let mut servers = HashMap::new();
     servers.insert(
         "fixture".to_string(),
-        ServerConfig::McpStdio { command: fixture_path(), args: vec![], auth_ref: None, auth_env: None },
+        ServerConfig::McpStdio {
+            command: fixture_path(),
+            args: vec![],
+            auth_ref: None,
+            auth_env: None,
+        },
     );
     GatewayConfig { servers }
 }
 
 #[tokio::test]
 async fn search_finds_the_fixture_tool_after_open() {
-    let reg = Registry::open_in_memory(&config_with_fixture(), &HashMap::new()).await.unwrap();
+    let reg = Registry::open_in_memory(&config_with_fixture(), &HashMap::new())
+        .await
+        .unwrap();
     let hits = reg.search("echo", 5, MatchMode::All).unwrap();
     assert_eq!(hits.len(), 1);
     assert_eq!(hits[0].tool, "echo");
@@ -38,9 +45,17 @@ async fn search_finds_the_fixture_tool_after_open() {
 
 #[tokio::test]
 async fn execute_dispatches_to_the_right_backend() {
-    let reg = Registry::open_in_memory(&config_with_fixture(), &HashMap::new()).await.unwrap();
-    let result = reg.execute("fixture", "echo", serde_json::json!({"text": "hi"})).await.unwrap();
-    let text = result.get(0).and_then(|c| c.get("text")).and_then(|t| t.as_str());
+    let reg = Registry::open_in_memory(&config_with_fixture(), &HashMap::new())
+        .await
+        .unwrap();
+    let result = reg
+        .execute("fixture", "echo", serde_json::json!({"text": "hi"}))
+        .await
+        .unwrap();
+    let text = result
+        .get(0)
+        .and_then(|c| c.get("text"))
+        .and_then(|t| t.as_str());
     assert_eq!(text, Some("echo: hi"));
 }
 
@@ -62,21 +77,34 @@ async fn execute_dispatches_to_an_mcp_http_backend() {
     );
     let config = GatewayConfig { servers };
 
-    let reg = Registry::open_in_memory(&config, &HashMap::new()).await.unwrap();
+    let reg = Registry::open_in_memory(&config, &HashMap::new())
+        .await
+        .unwrap();
 
     let hits = reg.search("echo", 5, MatchMode::All).unwrap();
     assert_eq!(hits.len(), 1);
     assert_eq!(hits[0].server, "http_fixture");
 
-    let result = reg.execute("http_fixture", "echo", serde_json::json!({"text": "hi"})).await.unwrap();
-    let text = result.get(0).and_then(|c| c.get("text")).and_then(|t| t.as_str());
+    let result = reg
+        .execute("http_fixture", "echo", serde_json::json!({"text": "hi"}))
+        .await
+        .unwrap();
+    let text = result
+        .get(0)
+        .and_then(|c| c.get("text"))
+        .and_then(|t| t.as_str());
     assert_eq!(text, Some("echo: hi"));
 }
 
 #[tokio::test]
 async fn execute_unknown_server_suggests_the_closest_name() {
-    let reg = Registry::open_in_memory(&config_with_fixture(), &HashMap::new()).await.unwrap();
-    let err = reg.execute("fixtur", "echo", serde_json::json!({})).await.unwrap_err();
+    let reg = Registry::open_in_memory(&config_with_fixture(), &HashMap::new())
+        .await
+        .unwrap();
+    let err = reg
+        .execute("fixtur", "echo", serde_json::json!({}))
+        .await
+        .unwrap_err();
     match err {
         GatewayError::ServerNotFound(msg) => assert!(msg.contains("fixture")),
         other => panic!("expected ServerNotFound, got {other:?}"),
@@ -85,8 +113,13 @@ async fn execute_unknown_server_suggests_the_closest_name() {
 
 #[tokio::test]
 async fn execute_unknown_tool_suggests_the_closest_name() {
-    let reg = Registry::open_in_memory(&config_with_fixture(), &HashMap::new()).await.unwrap();
-    let err = reg.execute("fixture", "ech", serde_json::json!({})).await.unwrap_err();
+    let reg = Registry::open_in_memory(&config_with_fixture(), &HashMap::new())
+        .await
+        .unwrap();
+    let err = reg
+        .execute("fixture", "ech", serde_json::json!({}))
+        .await
+        .unwrap_err();
     match err {
         GatewayError::ToolNotFound(msg) => assert!(msg.contains("echo")),
         other => panic!("expected ToolNotFound, got {other:?}"),
@@ -103,7 +136,12 @@ async fn one_failing_backend_does_not_block_the_others() {
     let mut servers = HashMap::new();
     servers.insert(
         "fixture".to_string(),
-        ServerConfig::McpStdio { command: fixture_path(), args: vec![], auth_ref: None, auth_env: None },
+        ServerConfig::McpStdio {
+            command: fixture_path(),
+            args: vec![],
+            auth_ref: None,
+            auth_env: None,
+        },
     );
     servers.insert(
         "broken".to_string(),
@@ -116,14 +154,22 @@ async fn one_failing_backend_does_not_block_the_others() {
     );
     let config = GatewayConfig { servers };
 
-    let reg = Registry::open_in_memory(&config, &HashMap::new()).await.unwrap();
+    let reg = Registry::open_in_memory(&config, &HashMap::new())
+        .await
+        .unwrap();
 
     let hits = reg.search("echo", 5, MatchMode::All).unwrap();
     assert_eq!(hits.len(), 1);
     assert_eq!(hits[0].tool, "echo");
     assert_eq!(hits[0].server, "fixture");
 
-    let result = reg.execute("fixture", "echo", serde_json::json!({"text": "hi"})).await.unwrap();
-    let text = result.get(0).and_then(|c| c.get("text")).and_then(|t| t.as_str());
+    let result = reg
+        .execute("fixture", "echo", serde_json::json!({"text": "hi"}))
+        .await
+        .unwrap();
+    let text = result
+        .get(0)
+        .and_then(|c| c.get("text"))
+        .and_then(|t| t.as_str());
     assert_eq!(text, Some("echo: hi"));
 }
diff --git a/crates/gateway-registry/tests/support/mod.rs b/crates/gateway-registry/tests/support/mod.rs
index 9409b089..ca0d20e4 100644
--- a/crates/gateway-registry/tests/support/mod.rs
+++ b/crates/gateway-registry/tests/support/mod.rs
@@ -12,13 +12,13 @@
 //! pulled in via `mod support;` from each real test file instead.
 
 use rmcp::{
+    ServerHandler,
     handler::server::wrapper::Parameters,
     model::{Implementation, ServerCapabilities, ServerInfo},
-    schemars,
+    schemars, tool, tool_handler, tool_router,
     transport::streamable_http_server::{
-        session::local::LocalSessionManager, StreamableHttpServerConfig, StreamableHttpService,
+        StreamableHttpServerConfig, StreamableHttpService, session::local::LocalSessionManager,
     },
-    tool, tool_handler, tool_router, ServerHandler,
 };
 use serde::Deserialize;
 use tokio_util::sync::CancellationToken;
@@ -77,15 +77,18 @@ impl Drop for HttpFixture {
 /// its full MCP endpoint URL (e.g. `http://127.0.0.1:54321/mcp`).
 pub async fn start() -> HttpFixture {
     let ct = CancellationToken::new();
-    let service: StreamableHttpService<HttpFixtureServer, LocalSessionManager> = StreamableHttpService::new(
-        || Ok(HttpFixtureServer),
-        Default::default(),
-        StreamableHttpServerConfig::default()
-            .with_sse_keep_alive(None)
-            .with_cancellation_token(ct.child_token()),
-    );
+    let service: StreamableHttpService<HttpFixtureServer, LocalSessionManager> =
+        StreamableHttpService::new(
+            || Ok(HttpFixtureServer),
+            Default::default(),
+            StreamableHttpServerConfig::default()
+                .with_sse_keep_alive(None)
+                .with_cancellation_token(ct.child_token()),
+        );
     let router = axum::Router::new().nest_service("/mcp", service);
-    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.expect("bind fixture http listener");
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("bind fixture http listener");
     let addr = listener.local_addr().expect("fixture listener local_addr");
 
     let server_ct = ct.clone();
@@ -95,5 +98,8 @@ pub async fn start() -> HttpFixture {
             .await;
     });
 
-    HttpFixture { url: format!("http://{addr}/mcp"), cancel: ct }
+    HttpFixture {
+        url: format!("http://{addr}/mcp"),
+        cancel: ct,
+    }
 }
diff --git a/crates/ponytail/src/config.rs b/crates/ponytail/src/config.rs
index 26f81d8b..55e769da 100644
--- a/crates/ponytail/src/config.rs
+++ b/crates/ponytail/src/config.rs
@@ -3,21 +3,33 @@ use std::path::PathBuf;
 
 pub const DEFAULT_MODE: &str = "full";
 pub const VALID_MODES: &[&str] = &[
-    "off", "lite", "full", "ultra", "review", "audit", "debt", "gain", "help", "playbook",
+    "off",
+    "lite",
+    "full",
+    "ultra",
+    "review",
+    "audit",
+    "debt",
+    "gain",
+    "help",
+    "playbook",
     "no-hallucination",
 ];
 pub const RUNTIME_MODES: &[&str] = &["off", "lite", "full", "ultra"];
 
+#[must_use]
 pub fn normalize_mode(mode: &str) -> Option<&'static str> {
     let m = mode.trim().to_lowercase();
     RUNTIME_MODES.iter().find(|&&v| v == m).copied()
 }
 
+#[must_use]
 pub fn normalize_config_mode(mode: &str) -> Option<&'static str> {
     let m = mode.trim().to_lowercase();
     VALID_MODES.iter().find(|&&v| v == m).copied()
 }
 
+#[must_use]
 pub fn normalize_persisted_mode(mode: &str) -> Option<&'static str> {
     normalize_mode(mode).or_else(|| normalize_config_mode(mode))
 }
@@ -56,6 +68,7 @@ fn claude_dir() -> PathBuf {
 /// Scans `~/.claude/settings.json` (or `$CLAUDE_CONFIG_DIR/settings.json`)
 /// for known compression/persona plugins so ponytail can add a
 /// deconfliction note instead of silently contradicting them.
+#[must_use]
 pub fn detect_compression_plugins() -> Vec<&'static str> {
     let Ok(raw) = std::fs::read_to_string(claude_dir().join("settings.json")) else {
         return Vec::new();
@@ -68,6 +81,7 @@ pub fn detect_compression_plugins() -> Vec<&'static str> {
         .collect()
 }
 
+#[must_use]
 pub fn is_deactivation(text: &str) -> bool {
     let t = text.trim().to_lowercase();
     let t = t.trim_end_matches(|c: char| c == '.' || c == '!' || c == '?' || c.is_whitespace());
@@ -77,7 +91,8 @@ pub fn is_deactivation(text: &str) -> bool {
 /// `dirs::config_dir()` resolves via the OS directly and ignores env-var
 /// overrides — same footgun `paths::home()` documents in the root crate
 /// (a "sandboxed" test run silently writing to the real ~/.config).
-/// PONYTAIL_CONFIG_DIR_OVERRIDE is this crate's own escape hatch for tests.
+/// `PONYTAIL_CONFIG_DIR_OVERRIDE` is this crate's own escape hatch for tests.
+#[must_use]
 pub fn config_dir() -> PathBuf {
     if let Ok(p) = std::env::var("PONYTAIL_CONFIG_DIR_OVERRIDE") {
         return PathBuf::from(p);
@@ -107,7 +122,9 @@ impl Drop for ConfigDirOverrideGuard {
 #[cfg(test)]
 #[allow(unsafe_code)]
 fn with_temp_config_dir<T>(f: impl FnOnce() -> T) -> T {
-    let _guard = ENV_TEST_LOCK.lock().unwrap_or_else(|e| e.into_inner());
+    let _guard = ENV_TEST_LOCK
+        .lock()
+        .unwrap_or_else(std::sync::PoisonError::into_inner);
     let dir = std::env::temp_dir().join("ponytail-test-config-dir");
     let _ = std::fs::remove_dir_all(&dir);
     std::fs::create_dir_all(&dir).unwrap();
@@ -119,6 +136,7 @@ fn with_temp_config_dir<T>(f: impl FnOnce() -> T) -> T {
     f()
 }
 
+#[must_use]
 pub fn config_path() -> PathBuf {
     config_dir().join("config.json")
 }
@@ -128,6 +146,7 @@ struct ConfigFile {
     default_mode: Option<String>,
 }
 
+#[must_use]
 pub fn default_mode() -> String {
     if let Ok(val) = std::env::var("PONYTAIL_DEFAULT_MODE")
         && let Some(m) = normalize_extended_mode(&val)
@@ -145,7 +164,8 @@ pub fn default_mode() -> String {
 }
 
 pub fn set_default_mode(mode: &str) -> Result<(), String> {
-    let normalized = normalize_extended_mode(mode).ok_or_else(|| format!("invalid mode: {mode}"))?;
+    let normalized =
+        normalize_extended_mode(mode).ok_or_else(|| format!("invalid mode: {mode}"))?;
     let dir = config_dir();
     std::fs::create_dir_all(&dir).map_err(|e| e.to_string())?;
     let mut cfg: ConfigFile = std::fs::read_to_string(config_path())
@@ -180,7 +200,9 @@ mod tests {
 
     #[test]
     fn no_compression_plugins_when_settings_missing() {
-        let _guard = ENV_TEST_LOCK.lock().unwrap_or_else(|e| e.into_inner());
+        let _guard = ENV_TEST_LOCK
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
         unsafe { std::env::set_var("CLAUDE_CONFIG_DIR", "/nonexistent/ponytail-test-dir") };
         assert!(detect_compression_plugins().is_empty());
         unsafe { std::env::remove_var("CLAUDE_CONFIG_DIR") };
@@ -188,7 +210,9 @@ mod tests {
 
     #[test]
     fn detects_caveman_in_settings_json() {
-        let _guard = ENV_TEST_LOCK.lock().unwrap_or_else(|e| e.into_inner());
+        let _guard = ENV_TEST_LOCK
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
         let dir = std::env::temp_dir().join("ponytail_test_compression_conflict");
         std::fs::create_dir_all(&dir).unwrap();
         std::fs::write(dir.join("settings.json"), r#"{"plugins": ["caveman"]}"#).unwrap();
diff --git a/crates/ponytail/src/detect.rs b/crates/ponytail/src/detect.rs
index c3dd5deb..e7995c5e 100644
--- a/crates/ponytail/src/detect.rs
+++ b/crates/ponytail/src/detect.rs
@@ -21,77 +21,354 @@ struct AgentEntry {
 }
 
 static AGENTS: &[AgentEntry] = &[
-    AgentEntry { name: "cursor", process_names: &["cursor"], env_vars: &["CURSOR_TRACE_ID"] },
-    AgentEntry { name: "cursor-cli", process_names: &[], env_vars: &["CURSOR_AGENT", "CURSOR_EXTENSION_HOST_ROLE"] },
-    AgentEntry { name: "gemini", process_names: &["gemini"], env_vars: &["GEMINI_CLI"] },
-    AgentEntry { name: "codex", process_names: &["codex"], env_vars: &["CODEX_SANDBOX", "CODEX_CI", "CODEX_THREAD_ID"] },
-    AgentEntry { name: "antigravity", process_names: &["amp"], env_vars: &["ANTIGRAVITY_AGENT"] },
-    AgentEntry { name: "augment-cli", process_names: &["augment-cli"], env_vars: &["AUGMENT_AGENT"] },
-    AgentEntry { name: "opencode", process_names: &["opencode"], env_vars: &["OPENCODE_CLIENT"] },
-    AgentEntry { name: "claude-code", process_names: &["claude"], env_vars: &["CLAUDECODE", "CLAUDE_CODE"] },
-    AgentEntry { name: "cline", process_names: &[], env_vars: &["CLINE_ACTIVE"] },
-    AgentEntry { name: "goose", process_names: &["goose"], env_vars: &["GOOSE_TERMINAL"] },
-    AgentEntry { name: "openclaw", process_names: &[], env_vars: &["OPENCLAW_SHELL"] },
-    AgentEntry { name: "pi", process_names: &[], env_vars: &["PI_CODING_AGENT"] },
-    AgentEntry { name: "roo-code", process_names: &[], env_vars: &["ROO_ACTIVE"] },
-    AgentEntry { name: "trae", process_names: &["trae"], env_vars: &["TRAE_AI_SHELL_ID"] },
-    AgentEntry { name: "replit", process_names: &[], env_vars: &["REPL_ID"] },
-    AgentEntry { name: "github-copilot", process_names: &["copilot"], env_vars: &["COPILOT_MODEL", "COPILOT_ALLOW_ALL", "COPILOT_GITHUB_TOKEN"] },
-    AgentEntry { name: "aider", process_names: &["aider"], env_vars: &[] },
-    AgentEntry { name: "carapace", process_names: &["cara"], env_vars: &[] },
-    AgentEntry { name: "codebuddy", process_names: &["codebuddy"], env_vars: &[] },
-    AgentEntry { name: "devin", process_names: &["devin"], env_vars: &[] },
-    AgentEntry { name: "gloamy", process_names: &["gloamy"], env_vars: &[] },
-    AgentEntry { name: "hermes", process_names: &["hermes"], env_vars: &[] },
-    AgentEntry { name: "ironclaw", process_names: &["ironclaw"], env_vars: &[] },
-    AgentEntry { name: "kimi-cli", process_names: &["kimi", "kimi-cli"], env_vars: &[] },
-    AgentEntry { name: "loong", process_names: &["loong"], env_vars: &[] },
-    AgentEntry { name: "microclaw", process_names: &["microclaw"], env_vars: &[] },
-    AgentEntry { name: "moltis", process_names: &["moltis"], env_vars: &[] },
-    AgentEntry { name: "nanobot", process_names: &["nanobot"], env_vars: &[] },
-    AgentEntry { name: "picoclaw", process_names: &["picoclaw"], env_vars: &[] },
-    AgentEntry { name: "windsurf", process_names: &["windsurf"], env_vars: &[] },
-    AgentEntry { name: "zeroclaw", process_names: &["zeroclaw"], env_vars: &[] },
-    AgentEntry { name: "alayacore", process_names: &["alayacore"], env_vars: &[] },
-    AgentEntry { name: "anda-bot", process_names: &["anda"], env_vars: &[] },
-    AgentEntry { name: "astrbot", process_names: &["astrbot"], env_vars: &["ASTRBOT_CLI"] },
-    AgentEntry { name: "autohand-code", process_names: &["autohand"], env_vars: &["AUTOHAND_CLI"] },
-    AgentEntry { name: "axiomate", process_names: &["axiomate"], env_vars: &[] },
-    AgentEntry { name: "bash-agent", process_names: &[], env_vars: &["BASH_AGENT_HOME"] },
-    AgentEntry { name: "clawx", process_names: &["clawx"], env_vars: &["CLAWHUB_WORKDIR"] },
-    AgentEntry { name: "codeproxy-cli", process_names: &["codeproxy"], env_vars: &[] },
-    AgentEntry { name: "cow-agent", process_names: &["cow"], env_vars: &[] },
-    AgentEntry { name: "crush", process_names: &["crush"], env_vars: &[] },
-    AgentEntry { name: "ctrl", process_names: &["ctrl"], env_vars: &[] },
-    AgentEntry { name: "deep-code", process_names: &["deepcode"], env_vars: &[] },
-    AgentEntry { name: "deep-copilot", process_names: &["deep-copilot"], env_vars: &[] },
-    AgentEntry { name: "deeplossless", process_names: &["deeplossless"], env_vars: &[] },
-    AgentEntry { name: "deepseek-tui", process_names: &["deepseek-tui"], env_vars: &[] },
-    AgentEntry { name: "deepseekx", process_names: &["deepseekx"], env_vars: &[] },
-    AgentEntry { name: "dscli", process_names: &["dscli"], env_vars: &[] },
-    AgentEntry { name: "dscode", process_names: &["dscode"], env_vars: &[] },
-    AgentEntry { name: "goagent", process_names: &["goagent"], env_vars: &[] },
-    AgentEntry { name: "halfcopilot", process_names: &["halfcopilot"], env_vars: &[] },
-    AgentEntry { name: "kilo-code", process_names: &["kilo"], env_vars: &[] },
-    AgentEntry { name: "kimix", process_names: &["kimix"], env_vars: &[] },
-    AgentEntry { name: "langbot", process_names: &["langbot"], env_vars: &[] },
-    AgentEntry { name: "langcli", process_names: &["langcli"], env_vars: &[] },
-    AgentEntry { name: "markus", process_names: &["markus"], env_vars: &[] },
-    AgentEntry { name: "morph", process_names: &["mistermorph"], env_vars: &[] },
-    AgentEntry { name: "oh-my-pi", process_names: &["omp"], env_vars: &[] },
-    AgentEntry { name: "operit", process_names: &["operit"], env_vars: &[] },
-    AgentEntry { name: "proma", process_names: &["proma"], env_vars: &[] },
-    AgentEntry { name: "qwen-code", process_names: &["qwen"], env_vars: &[] },
-    AgentEntry { name: "reasonix", process_names: &["reasonix"], env_vars: &[] },
-    AgentEntry { name: "snow-cli", process_names: &["snow"], env_vars: &[] },
-    AgentEntry { name: "soloncode", process_names: &["soloncode"], env_vars: &[] },
-    AgentEntry { name: "tday", process_names: &["tday"], env_vars: &[] },
-    AgentEntry { name: "tiangong", process_names: &["tiangong"], env_vars: &[] },
-    AgentEntry { name: "whale", process_names: &["whale"], env_vars: &[] },
-    AgentEntry { name: "xpro", process_names: &["xpro"], env_vars: &[] },
-    AgentEntry { name: "zot", process_names: &["zot"], env_vars: &[] },
+    AgentEntry {
+        name: "cursor",
+        process_names: &["cursor"],
+        env_vars: &["CURSOR_TRACE_ID"],
+    },
+    AgentEntry {
+        name: "cursor-cli",
+        process_names: &[],
+        env_vars: &["CURSOR_AGENT", "CURSOR_EXTENSION_HOST_ROLE"],
+    },
+    AgentEntry {
+        name: "gemini",
+        process_names: &["gemini"],
+        env_vars: &["GEMINI_CLI"],
+    },
+    AgentEntry {
+        name: "codex",
+        process_names: &["codex"],
+        env_vars: &["CODEX_SANDBOX", "CODEX_CI", "CODEX_THREAD_ID"],
+    },
+    AgentEntry {
+        name: "antigravity",
+        process_names: &["amp"],
+        env_vars: &["ANTIGRAVITY_AGENT"],
+    },
+    AgentEntry {
+        name: "augment-cli",
+        process_names: &["augment-cli"],
+        env_vars: &["AUGMENT_AGENT"],
+    },
+    AgentEntry {
+        name: "opencode",
+        process_names: &["opencode"],
+        env_vars: &["OPENCODE_CLIENT"],
+    },
+    AgentEntry {
+        name: "claude-code",
+        process_names: &["claude"],
+        env_vars: &["CLAUDECODE", "CLAUDE_CODE"],
+    },
+    AgentEntry {
+        name: "cline",
+        process_names: &[],
+        env_vars: &["CLINE_ACTIVE"],
+    },
+    AgentEntry {
+        name: "goose",
+        process_names: &["goose"],
+        env_vars: &["GOOSE_TERMINAL"],
+    },
+    AgentEntry {
+        name: "openclaw",
+        process_names: &[],
+        env_vars: &["OPENCLAW_SHELL"],
+    },
+    AgentEntry {
+        name: "pi",
+        process_names: &[],
+        env_vars: &["PI_CODING_AGENT"],
+    },
+    AgentEntry {
+        name: "roo-code",
+        process_names: &[],
+        env_vars: &["ROO_ACTIVE"],
+    },
+    AgentEntry {
+        name: "trae",
+        process_names: &["trae"],
+        env_vars: &["TRAE_AI_SHELL_ID"],
+    },
+    AgentEntry {
+        name: "replit",
+        process_names: &[],
+        env_vars: &["REPL_ID"],
+    },
+    AgentEntry {
+        name: "github-copilot",
+        process_names: &["copilot"],
+        env_vars: &["COPILOT_MODEL", "COPILOT_ALLOW_ALL", "COPILOT_GITHUB_TOKEN"],
+    },
+    AgentEntry {
+        name: "aider",
+        process_names: &["aider"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "carapace",
+        process_names: &["cara"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "codebuddy",
+        process_names: &["codebuddy"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "devin",
+        process_names: &["devin"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "gloamy",
+        process_names: &["gloamy"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "hermes",
+        process_names: &["hermes"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "ironclaw",
+        process_names: &["ironclaw"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "kimi-cli",
+        process_names: &["kimi", "kimi-cli"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "loong",
+        process_names: &["loong"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "microclaw",
+        process_names: &["microclaw"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "moltis",
+        process_names: &["moltis"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "nanobot",
+        process_names: &["nanobot"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "picoclaw",
+        process_names: &["picoclaw"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "windsurf",
+        process_names: &["windsurf"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "zeroclaw",
+        process_names: &["zeroclaw"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "alayacore",
+        process_names: &["alayacore"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "anda-bot",
+        process_names: &["anda"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "astrbot",
+        process_names: &["astrbot"],
+        env_vars: &["ASTRBOT_CLI"],
+    },
+    AgentEntry {
+        name: "autohand-code",
+        process_names: &["autohand"],
+        env_vars: &["AUTOHAND_CLI"],
+    },
+    AgentEntry {
+        name: "axiomate",
+        process_names: &["axiomate"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "bash-agent",
+        process_names: &[],
+        env_vars: &["BASH_AGENT_HOME"],
+    },
+    AgentEntry {
+        name: "clawx",
+        process_names: &["clawx"],
+        env_vars: &["CLAWHUB_WORKDIR"],
+    },
+    AgentEntry {
+        name: "codeproxy-cli",
+        process_names: &["codeproxy"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "cow-agent",
+        process_names: &["cow"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "crush",
+        process_names: &["crush"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "ctrl",
+        process_names: &["ctrl"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "deep-code",
+        process_names: &["deepcode"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "deep-copilot",
+        process_names: &["deep-copilot"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "deeplossless",
+        process_names: &["deeplossless"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "deepseek-tui",
+        process_names: &["deepseek-tui"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "deepseekx",
+        process_names: &["deepseekx"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "dscli",
+        process_names: &["dscli"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "dscode",
+        process_names: &["dscode"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "goagent",
+        process_names: &["goagent"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "halfcopilot",
+        process_names: &["halfcopilot"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "kilo-code",
+        process_names: &["kilo"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "kimix",
+        process_names: &["kimix"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "langbot",
+        process_names: &["langbot"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "langcli",
+        process_names: &["langcli"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "markus",
+        process_names: &["markus"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "morph",
+        process_names: &["mistermorph"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "oh-my-pi",
+        process_names: &["omp"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "operit",
+        process_names: &["operit"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "proma",
+        process_names: &["proma"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "qwen-code",
+        process_names: &["qwen"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "reasonix",
+        process_names: &["reasonix"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "snow-cli",
+        process_names: &["snow"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "soloncode",
+        process_names: &["soloncode"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "tday",
+        process_names: &["tday"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "tiangong",
+        process_names: &["tiangong"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "whale",
+        process_names: &["whale"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "xpro",
+        process_names: &["xpro"],
+        env_vars: &[],
+    },
+    AgentEntry {
+        name: "zot",
+        process_names: &["zot"],
+        env_vars: &[],
+    },
 ];
 
+#[must_use]
 pub fn detect() -> Option<DetectResult> {
     #[cfg(feature = "process-tree")]
     if let Some(name) = find_in_parent_tree() {
@@ -115,16 +392,10 @@ fn find_in_parent_tree() -> Option<String> {
     use sysinfo::ProcessRefreshKind;
 
     let mut system = System::new();
-    system.refresh_processes_specifics(
-        ProcessesToUpdate::All,
-        true,
-        ProcessRefreshKind::nothing(),
-    );
+    system.refresh_processes_specifics(ProcessesToUpdate::All, true, ProcessRefreshKind::nothing());
 
     let current_pid = Pid::from_u32(std::process::id());
-    let mut pid = system
-        .process(current_pid)
-        .and_then(|p| p.parent());
+    let mut pid = system.process(current_pid).and_then(|p| p.parent());
 
     while let Some(p) = pid {
         let proc = system.process(p)?;
diff --git a/crates/ponytail/src/instructions.rs b/crates/ponytail/src/instructions.rs
index 2ba0b5aa..06d073be 100644
--- a/crates/ponytail/src/instructions.rs
+++ b/crates/ponytail/src/instructions.rs
@@ -13,10 +13,10 @@ fn find_workspace_agents_md() -> Option<String> {
     let mut dir = std::env::current_dir().ok()?;
     loop {
         let path = dir.join("AGENTS.md");
-        if let Ok(content) = std::fs::read_to_string(&path) {
-            if content.contains("PONYTAIL") {
-                return Some(content);
-            }
+        if let Ok(content) = std::fs::read_to_string(&path)
+            && content.contains("PONYTAIL")
+        {
+            return Some(content);
         }
         if !dir.pop() {
             return None;
@@ -44,7 +44,10 @@ pub fn build(mode: &str, skill_path: Option<&Path>) -> Instructions {
     // Custom skills have no harness-installed /ponytail-<name> skill to point
     // at, so their authored body is delivered inline.
     if let Some(body) = crate::sub_skills::get_custom(&effective) {
-        return Instructions { mode: effective, body };
+        return Instructions {
+            mode: effective,
+            body,
+        };
     }
 
     let skill_body = if let Some(path) = skill_path {
@@ -82,6 +85,7 @@ fn compression_deconfliction() -> String {
     )
 }
 
+#[must_use]
 pub fn filter_skill_body(body: &str, mode: &str) -> String {
     let effective = config::normalize_mode(mode).unwrap_or(config::DEFAULT_MODE);
     body.lines()
@@ -122,7 +126,9 @@ mod tests {
     #[test]
     #[allow(unsafe_code)]
     fn build_appends_deconfliction_when_compression_plugin_present() {
-        let _guard = config::ENV_TEST_LOCK.lock().unwrap_or_else(|e| e.into_inner());
+        let _guard = config::ENV_TEST_LOCK
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
         let dir = std::env::temp_dir().join("ponytail_test_instructions_compression");
         std::fs::create_dir_all(&dir).unwrap();
         std::fs::write(dir.join("settings.json"), r#"{"plugins": ["caveman"]}"#).unwrap();
diff --git a/crates/ponytail/src/lib.rs b/crates/ponytail/src/lib.rs
index 42bf3048..b72a28fd 100644
--- a/crates/ponytail/src/lib.rs
+++ b/crates/ponytail/src/lib.rs
@@ -10,4 +10,4 @@ pub use config::{default_mode, normalize_config_mode, set_default_mode};
 pub use instructions::build as build_instructions;
 pub use platform::{detect_platform, format_hook_output};
 pub use state::{active_mode, active_scope, clear_active, clear_session, set_active, set_session};
-pub use switcher::{detect as detect_switch, SwitchAction};
+pub use switcher::{SwitchAction, detect as detect_switch};
diff --git a/crates/ponytail/src/platform.rs b/crates/ponytail/src/platform.rs
index 5a9693cc..1f57cbfb 100644
--- a/crates/ponytail/src/platform.rs
+++ b/crates/ponytail/src/platform.rs
@@ -9,6 +9,7 @@ pub enum AgentPlatform {
     Fallback,
 }
 
+#[must_use]
 pub fn detect_platform() -> AgentPlatform {
     if let Some(result) = detect::detect() {
         match result.name.as_str() {
@@ -22,17 +23,16 @@ pub fn detect_platform() -> AgentPlatform {
     }
 }
 
+#[must_use]
 pub fn format_hook_output(event: &str, ctx: &str, platform: &AgentPlatform) -> String {
     match platform {
-        AgentPlatform::Claude => {
-            json!({
-                "hookSpecificOutput": {
-                    "hookEventName": event,
-                    "additionalContext": ctx,
-                }
-            })
-            .to_string()
-        }
+        AgentPlatform::Claude => json!({
+            "hookSpecificOutput": {
+                "hookEventName": event,
+                "additionalContext": ctx,
+            }
+        })
+        .to_string(),
         AgentPlatform::Codex => {
             let mut output = json!({ "additionalContext": ctx });
             if event == "SessionStart" {
diff --git a/crates/ponytail/src/state.rs b/crates/ponytail/src/state.rs
index fa98e70b..d0f47cd8 100644
--- a/crates/ponytail/src/state.rs
+++ b/crates/ponytail/src/state.rs
@@ -1,6 +1,7 @@
 use std::io;
 use std::path::PathBuf;
 
+#[must_use]
 pub fn flag_path() -> PathBuf {
     dirs::state_dir()
         .unwrap_or_else(|| dirs::data_local_dir().unwrap_or_else(|| PathBuf::from(".")))
@@ -9,6 +10,7 @@ pub fn flag_path() -> PathBuf {
         .join("active")
 }
 
+#[must_use]
 pub fn session_path() -> PathBuf {
     dirs::state_dir()
         .unwrap_or_else(|| dirs::data_local_dir().unwrap_or_else(|| PathBuf::from(".")))
@@ -24,6 +26,7 @@ fn read_session() -> Option<String> {
         .filter(|s| !s.is_empty())
 }
 
+#[must_use]
 pub fn active_mode() -> Option<String> {
     read_session().or_else(|| {
         std::fs::read_to_string(flag_path())
@@ -58,6 +61,7 @@ pub fn clear_active() {
     clear_session();
 }
 
+#[must_use]
 pub fn active_scope() -> &'static str {
     if read_session().is_some() {
         "session"
@@ -81,7 +85,9 @@ mod tests {
 
     #[test]
     fn roundtrip_active_mode() {
-        let _guard = STATE_LOCK.lock().unwrap_or_else(|e| e.into_inner());
+        let _guard = STATE_LOCK
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
         clear_active();
         assert_eq!(active_mode(), None);
 
@@ -103,7 +109,9 @@ mod tests {
 
     #[test]
     fn clear_nonexistent_is_noop() {
-        let _guard = STATE_LOCK.lock().unwrap_or_else(|e| e.into_inner());
+        let _guard = STATE_LOCK
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
         clear_active();
         clear_active();
         clear_session();
diff --git a/crates/ponytail/src/sub_skills.rs b/crates/ponytail/src/sub_skills.rs
index 05e96c71..342f4efd 100644
--- a/crates/ponytail/src/sub_skills.rs
+++ b/crates/ponytail/src/sub_skills.rs
@@ -9,6 +9,7 @@ pub const SKILL_HELP: &str = include_str!("skill-help.md");
 pub const SKILL_PLAYBOOK: &str = include_str!("skill-playbook.md");
 pub const SKILL_NO_HALLUCINATION: &str = include_str!("skill-no-hallucination.md");
 
+#[must_use]
 pub fn get(name: &str) -> Option<&'static str> {
     match name {
         "review" => Some(SKILL_REVIEW),
@@ -22,6 +23,7 @@ pub fn get(name: &str) -> Option<&'static str> {
     }
 }
 
+#[must_use]
 pub fn skills_dir() -> std::path::PathBuf {
     dirs::config_dir()
         .unwrap_or_else(|| std::path::PathBuf::from("."))
@@ -36,18 +38,18 @@ static CUSTOM_SKILLS: LazyLock<HashMap<String, String>> = LazyLock::new(|| {
     if let Ok(entries) = std::fs::read_dir(&dir) {
         for entry in entries.flatten() {
             let path = entry.path();
-            if path.extension().map_or(false, |e| e == "md") {
-                if let Some(name) = path.file_stem().and_then(|s| s.to_str()) {
-                    // Reserved built-in mode/skill names can't be shadowed by
-                    // custom files — a user's full.md must not hijack full mode.
-                    if crate::config::VALID_MODES.contains(&name) {
-                        continue;
-                    }
-                    if let Ok(body) = std::fs::read_to_string(&path) {
-                        if !body.is_empty() {
-                            map.insert(name.to_string(), body);
-                        }
-                    }
+            if path.extension().is_some_and(|e| e == "md")
+                && let Some(name) = path.file_stem().and_then(|s| s.to_str())
+            {
+                // Reserved built-in mode/skill names can't be shadowed by
+                // custom files — a user's full.md must not hijack full mode.
+                if crate::config::VALID_MODES.contains(&name) {
+                    continue;
+                }
+                if let Ok(body) = std::fs::read_to_string(&path)
+                    && !body.is_empty()
+                {
+                    map.insert(name.to_string(), body);
                 }
             }
         }
@@ -73,6 +75,7 @@ pub struct Finding {
     pub snippet: String,
 }
 
+#[must_use]
 pub fn detect_over_engineering(text: &str) -> Vec<Finding> {
     let mut findings = Vec::new();
     ponytail_engineering_check_internal(text, &mut findings, 0);
@@ -82,10 +85,45 @@ pub fn detect_over_engineering(text: &str) -> Vec<Finding> {
 
 fn ponytail_engineering_check_internal(text: &str, findings: &mut Vec<Finding>, base_line: usize) {
     let patterns: &[(&str, &str, &str, &[&str])] = &[
-        ("lodash", "stdlib", "Use native JS methods: Array.map, Array.filter, Object.keys.", &["from \"lodash\"", "from 'lodash'", "require(\"lodash\")", "require('lodash')"]),
-        ("moment", "native", "Use Intl.DateTimeFormat, Date.toLocaleDateString, or Temporal.", &["from \"moment\"", "from 'moment'", "require(\"moment\")", "require('moment')"]),
-        ("axios", "native", "Use native fetch() instead of axios.", &["from \"axios\"", "from 'axios'", "require(\"axios\")", "require('axios')"]),
-        ("JSON.parse(JSON.stringify(", "stdlib", "Use structuredClone() for deep copy.", &["JSON.parse(JSON.stringify("]),
+        (
+            "lodash",
+            "stdlib",
+            "Use native JS methods: Array.map, Array.filter, Object.keys.",
+            &[
+                "from \"lodash\"",
+                "from 'lodash'",
+                "require(\"lodash\")",
+                "require('lodash')",
+            ],
+        ),
+        (
+            "moment",
+            "native",
+            "Use Intl.DateTimeFormat, Date.toLocaleDateString, or Temporal.",
+            &[
+                "from \"moment\"",
+                "from 'moment'",
+                "require(\"moment\")",
+                "require('moment')",
+            ],
+        ),
+        (
+            "axios",
+            "native",
+            "Use native fetch() instead of axios.",
+            &[
+                "from \"axios\"",
+                "from 'axios'",
+                "require(\"axios\")",
+                "require('axios')",
+            ],
+        ),
+        (
+            "JSON.parse(JSON.stringify(",
+            "stdlib",
+            "Use structuredClone() for deep copy.",
+            &["JSON.parse(JSON.stringify("],
+        ),
     ];
 
     for (line_num, line) in text.lines().enumerate() {
@@ -93,7 +131,10 @@ fn ponytail_engineering_check_internal(text: &str, findings: &mut Vec<Finding>,
         for (_name, tag, replacement, needles) in patterns {
             if needles.iter().any(|n| lower.contains(&n.to_lowercase())) {
                 let trimmed = line.trim().to_string();
-                if !findings.iter().any(|f| f.line == base_line + line_num + 1 && f.problem == trimmed) {
+                if !findings
+                    .iter()
+                    .any(|f| f.line == base_line + line_num + 1 && f.problem == trimmed)
+                {
                     findings.push(Finding {
                         line: base_line + line_num + 1,
                         tag: (*tag).to_string(),
diff --git a/crates/ponytail/src/switcher.rs b/crates/ponytail/src/switcher.rs
index 6d73f159..4a8c5cfe 100644
--- a/crates/ponytail/src/switcher.rs
+++ b/crates/ponytail/src/switcher.rs
@@ -19,9 +19,9 @@ fn all_skill_names() -> Vec<String> {
         "playbook",
         "no-hallucination",
     ]
-        .iter()
-        .map(|s| s.to_string())
-        .collect();
+    .iter()
+    .map(std::string::ToString::to_string)
+    .collect();
     names.extend(sub_skills::custom_skill_names());
     names
 }
@@ -29,12 +29,13 @@ fn all_skill_names() -> Vec<String> {
 fn all_mode_names() -> Vec<String> {
     let mut names: Vec<String> = ["lite", "full", "ultra"]
         .iter()
-        .map(|s| s.to_string())
+        .map(std::string::ToString::to_string)
         .collect();
     names.extend(all_skill_names());
     names
 }
 
+#[must_use]
 pub fn detect(input: &str) -> Option<SwitchAction> {
     let prompt = input.trim().to_lowercase();
 
@@ -122,7 +123,9 @@ mod tests {
 
     #[test]
     fn detects_default() {
-        assert!(matches!(detect("/ponytail default ultra"), Some(SwitchAction::SetDefault(m)) if m == "ultra"));
+        assert!(
+            matches!(detect("/ponytail default ultra"), Some(SwitchAction::SetDefault(m)) if m == "ultra")
+        );
     }
 
     #[test]
@@ -133,38 +136,53 @@ mod tests {
 
     #[test]
     fn detects_sub_skill_review() {
-        assert!(matches!(detect("/ponytail-review"), Some(SwitchAction::SetMode(m)) if m == "review"));
+        assert!(
+            matches!(detect("/ponytail-review"), Some(SwitchAction::SetMode(m)) if m == "review")
+        );
     }
 
     #[test]
     fn detects_sub_skill_audit() {
-        assert!(matches!(detect("/ponytail-audit"), Some(SwitchAction::SetMode(m)) if m == "audit"));
+        assert!(
+            matches!(detect("/ponytail-audit"), Some(SwitchAction::SetMode(m)) if m == "audit")
+        );
     }
 
     #[test]
     fn detects_sub_skill_inline() {
-        assert!(matches!(detect("/ponytail review"), Some(SwitchAction::SetMode(m)) if m == "review"));
+        assert!(
+            matches!(detect("/ponytail review"), Some(SwitchAction::SetMode(m)) if m == "review")
+        );
     }
 
     #[test]
     fn detects_sub_skill_playbook() {
-        assert!(matches!(detect("/ponytail-playbook"), Some(SwitchAction::SetMode(m)) if m == "playbook"));
+        assert!(
+            matches!(detect("/ponytail-playbook"), Some(SwitchAction::SetMode(m)) if m == "playbook")
+        );
     }
 
     #[test]
     fn detects_sub_skill_no_hallucination() {
-        assert!(matches!(detect("/ponytail-no-hallucination"), Some(SwitchAction::SetMode(m)) if m == "no-hallucination"));
+        assert!(
+            matches!(detect("/ponytail-no-hallucination"), Some(SwitchAction::SetMode(m)) if m == "no-hallucination")
+        );
     }
 
     #[test]
     fn detects_session_mode() {
-        assert!(matches!(detect("/ponytail session ultra"), Some(SwitchAction::SetSession(m)) if m == "ultra"));
+        assert!(
+            matches!(detect("/ponytail session ultra"), Some(SwitchAction::SetSession(m)) if m == "ultra")
+        );
         assert!(detect("/ponytail session").is_none());
     }
 
     #[test]
     fn detects_status() {
-        assert!(matches!(detect("/ponytail status"), Some(SwitchAction::Report)));
+        assert!(matches!(
+            detect("/ponytail status"),
+            Some(SwitchAction::Report)
+        ));
     }
 
     #[test]
@@ -174,7 +192,9 @@ mod tests {
 
     #[test]
     fn detects_mode_shortcut() {
-        assert!(matches!(detect("/ponytail-ultra"), Some(SwitchAction::SetMode(m)) if m == "ultra"));
+        assert!(
+            matches!(detect("/ponytail-ultra"), Some(SwitchAction::SetMode(m)) if m == "ultra")
+        );
         assert!(matches!(detect("/ponytail-lite"), Some(SwitchAction::SetMode(m)) if m == "lite"));
     }
 }
diff --git a/crates/skill-registry/src/db.rs b/crates/skill-registry/src/db.rs
index 0f13ae47..23d1fd5d 100644
--- a/crates/skill-registry/src/db.rs
+++ b/crates/skill-registry/src/db.rs
@@ -3,7 +3,7 @@
 //! inside one transaction.
 
 use crate::sources::SkillEntry;
-use rusqlite::{params, Connection};
+use rusqlite::{Connection, params};
 use std::path::Path;
 
 const SCHEMA: &str = "
@@ -64,7 +64,9 @@ pub fn rebuild(conn: &mut Connection, entries: &[SkillEntry]) -> rusqlite::Resul
                 e.tags,
                 e.est_tokens,
                 e.mtime,
-                e.shadow_path.as_ref().map(|p| p.to_string_lossy().to_string()),
+                e.shadow_path
+                    .as_ref()
+                    .map(|p| p.to_string_lossy().to_string()),
             ])?;
             if tx.changes() == 0 {
                 // Duplicate (name, source) was ignored: no new skills row,
@@ -99,13 +101,23 @@ mod tests {
     #[test]
     fn rebuild_replaces_rows_and_fts_stays_in_sync() {
         let mut conn = open_in_memory().unwrap();
-        rebuild(&mut conn, &[entry("a", "s", "alpha desc"), entry("b", "s", "beta desc")]).unwrap();
-        let n: i64 = conn.query_row("SELECT count(*) FROM skills", [], |r| r.get(0)).unwrap();
+        rebuild(
+            &mut conn,
+            &[entry("a", "s", "alpha desc"), entry("b", "s", "beta desc")],
+        )
+        .unwrap();
+        let n: i64 = conn
+            .query_row("SELECT count(*) FROM skills", [], |r| r.get(0))
+            .unwrap();
         assert_eq!(n, 2);
         rebuild(&mut conn, &[entry("c", "s", "gamma desc")]).unwrap();
-        let n: i64 = conn.query_row("SELECT count(*) FROM skills", [], |r| r.get(0)).unwrap();
+        let n: i64 = conn
+            .query_row("SELECT count(*) FROM skills", [], |r| r.get(0))
+            .unwrap();
         assert_eq!(n, 1);
-        let f: i64 = conn.query_row("SELECT count(*) FROM skills_fts", [], |r| r.get(0)).unwrap();
+        let f: i64 = conn
+            .query_row("SELECT count(*) FROM skills_fts", [], |r| r.get(0))
+            .unwrap();
         assert_eq!(f, 1);
     }
 
@@ -128,12 +140,19 @@ mod tests {
         let mut conn = open_in_memory().unwrap();
         rebuild(
             &mut conn,
-            &[entry("dup", "s", "first desc"), entry("dup", "s", "second desc")],
+            &[
+                entry("dup", "s", "first desc"),
+                entry("dup", "s", "second desc"),
+            ],
         )
         .unwrap();
-        let n: i64 = conn.query_row("SELECT count(*) FROM skills", [], |r| r.get(0)).unwrap();
+        let n: i64 = conn
+            .query_row("SELECT count(*) FROM skills", [], |r| r.get(0))
+            .unwrap();
         assert_eq!(n, 1);
-        let f: i64 = conn.query_row("SELECT count(*) FROM skills_fts", [], |r| r.get(0)).unwrap();
+        let f: i64 = conn
+            .query_row("SELECT count(*) FROM skills_fts", [], |r| r.get(0))
+            .unwrap();
         assert_eq!(f, 1);
         let hits = crate::search::search(&conn, "first", 5, crate::search::MatchMode::All).unwrap();
         assert_eq!(hits.len(), 1);
@@ -144,7 +163,9 @@ mod tests {
     fn open_db_sets_wal_journal_mode() {
         let tmp = tempfile::tempdir().unwrap();
         let conn = open_db(&tmp.path().join("skills.db")).unwrap();
-        let mode: String = conn.query_row("PRAGMA journal_mode", [], |r| r.get(0)).unwrap();
+        let mode: String = conn
+            .query_row("PRAGMA journal_mode", [], |r| r.get(0))
+            .unwrap();
         assert_eq!(mode, "wal");
     }
 }
diff --git a/crates/skill-registry/src/frontmatter.rs b/crates/skill-registry/src/frontmatter.rs
index 51d60e38..e552d00b 100644
--- a/crates/skill-registry/src/frontmatter.rs
+++ b/crates/skill-registry/src/frontmatter.rs
@@ -16,7 +16,9 @@ pub struct Frontmatter {
 /// well-formed frontmatter block or the YAML does not parse.
 pub fn parse_frontmatter(text: &str) -> Option<(Frontmatter, &str)> {
     let rest = text.strip_prefix("---")?;
-    let rest = rest.strip_prefix("\r\n").or_else(|| rest.strip_prefix('\n'))?;
+    let rest = rest
+        .strip_prefix("\r\n")
+        .or_else(|| rest.strip_prefix('\n'))?;
     // Closing fence: a line that is exactly `---` (allow trailing \r).
     let mut offset = 0usize;
     for line in rest.split_inclusive('\n') {
@@ -38,7 +40,8 @@ mod tests {
     #[test]
     fn parses_simple_frontmatter_and_body() {
         let (fm, body) =
-            parse_frontmatter("---\nname: live\ndescription: Use when X\n---\nBody here\n").unwrap();
+            parse_frontmatter("---\nname: live\ndescription: Use when X\n---\nBody here\n")
+                .unwrap();
         assert_eq!(fm.name.as_deref(), Some("live"));
         assert_eq!(fm.description.as_deref(), Some("Use when X"));
         assert_eq!(body.trim(), "Body here");
diff --git a/crates/skill-registry/src/lib.rs b/crates/skill-registry/src/lib.rs
index a35c8465..64f6a9c1 100644
--- a/crates/skill-registry/src/lib.rs
+++ b/crates/skill-registry/src/lib.rs
@@ -4,5 +4,5 @@ pub mod load;
 pub mod search;
 pub mod sources;
 
-pub use load::{load, LoadError, LoadedSkill, Registry};
-pub use search::{search, MatchMode, SkillHit};
+pub use load::{LoadError, LoadedSkill, Registry, load};
+pub use search::{MatchMode, SkillHit, search};
diff --git a/crates/skill-registry/src/load.rs b/crates/skill-registry/src/load.rs
index 839de312..5eae2ecf 100644
--- a/crates/skill-registry/src/load.rs
+++ b/crates/skill-registry/src/load.rs
@@ -82,10 +82,20 @@ pub fn load(conn: &Connection, name: &str, original: bool) -> Result<LoadedSkill
                     }
                 }
             }
-            Ok(LoadedSkill { name, source, path: body_path, compressed: use_shadow, body, siblings })
+            Ok(LoadedSkill {
+                name,
+                source,
+                path: body_path,
+                compressed: use_shadow,
+                body,
+                siblings,
+            })
         }
         _ => Err(LoadError::Ambiguous(
-            candidates.into_iter().map(|(n, s, ..)| format!("{s}:{n}")).collect(),
+            candidates
+                .into_iter()
+                .map(|(n, s, ..)| format!("{s}:{n}"))
+                .collect(),
         )),
     }
 }
@@ -102,14 +112,16 @@ pub const REFRESH_DEBOUNCE_SECS: u64 = 60;
 impl Registry {
     pub fn open_default(db_path: &Path) -> Result<Self, LoadError> {
         let conn = crate::db::open_db(db_path).map_err(|e| LoadError::Db(e.to_string()))?;
-        Ok(Registry { conn, last_refresh: std::time::Instant::now(), refreshed_once: false })
+        Ok(Registry {
+            conn,
+            last_refresh: std::time::Instant::now(),
+            refreshed_once: false,
+        })
     }
 
     /// Rescan sources when never scanned or debounce elapsed.
     pub fn ensure_fresh(&mut self) -> Result<(), LoadError> {
-        if self.refreshed_once
-            && self.last_refresh.elapsed().as_secs() < REFRESH_DEBOUNCE_SECS
-        {
+        if self.refreshed_once && self.last_refresh.elapsed().as_secs() < REFRESH_DEBOUNCE_SECS {
             return Ok(());
         }
         let home = dirs::home_dir().unwrap_or_else(|| PathBuf::from("."));
@@ -117,20 +129,28 @@ impl Registry {
         // Detected agents: agent-registry's detect_all needs a version cache;
         // skill discovery only needs agent IDs, so pass an empty cache.
         let mut cache = std::collections::HashMap::new();
-        let detected: Vec<String> = agent_registry::detect_all(agent_registry::REGISTRY, &mut cache)
-            .into_iter()
-            .map(|d| d.id.to_lowercase())
-            .collect();
+        let detected: Vec<String> =
+            agent_registry::detect_all(agent_registry::REGISTRY, &mut cache)
+                .into_iter()
+                .map(|d| d.id.to_lowercase())
+                .collect();
         let sources = crate::sources::default_sources(&home, &cwd, &detected);
         let out = crate::sources::scan_sources(&sources);
-        crate::db::rebuild(&mut self.conn, &out.entries).map_err(|e| LoadError::Db(e.to_string()))?;
+        crate::db::rebuild(&mut self.conn, &out.entries)
+            .map_err(|e| LoadError::Db(e.to_string()))?;
         self.last_refresh = std::time::Instant::now();
         self.refreshed_once = true;
         Ok(())
     }
 
-    pub fn search(&self, query: &str, limit: usize, mode: MatchMode) -> Result<Vec<SkillHit>, LoadError> {
-        crate::search::search(&self.conn, query, limit, mode).map_err(|e| LoadError::Db(e.to_string()))
+    pub fn search(
+        &self,
+        query: &str,
+        limit: usize,
+        mode: MatchMode,
+    ) -> Result<Vec<SkillHit>, LoadError> {
+        crate::search::search(&self.conn, query, limit, mode)
+            .map_err(|e| LoadError::Db(e.to_string()))
     }
 
     /// Every distinct skill name currently indexed, regardless of source.
@@ -221,6 +241,9 @@ mod tests {
     #[test]
     fn unknown_name_is_not_found() {
         let (_tmp, conn) = seed_with_files();
-        assert!(matches!(load(&conn, "nope", false), Err(LoadError::NotFound(_))));
+        assert!(matches!(
+            load(&conn, "nope", false),
+            Err(LoadError::NotFound(_))
+        ));
     }
 }
diff --git a/crates/skill-registry/src/search.rs b/crates/skill-registry/src/search.rs
index 005ad0cc..3e491c2b 100644
--- a/crates/skill-registry/src/search.rs
+++ b/crates/skill-registry/src/search.rs
@@ -101,9 +101,21 @@ mod tests {
         rebuild(
             &mut conn,
             &[
-                mk("live", "Use when the user asks about running sessions, agent status", true),
-                mk("cv-usage", "Use when the user asks about usage analytics, token usage, cost summary", false),
-                mk("win-cleanup", "Use when the user asks to free disk space on Windows", false),
+                mk(
+                    "live",
+                    "Use when the user asks about running sessions, agent status",
+                    true,
+                ),
+                mk(
+                    "cv-usage",
+                    "Use when the user asks about usage analytics, token usage, cost summary",
+                    false,
+                ),
+                mk(
+                    "win-cleanup",
+                    "Use when the user asks to free disk space on Windows",
+                    false,
+                ),
             ],
         )
         .unwrap();
@@ -145,7 +157,13 @@ mod tests {
     #[test]
     fn fts_operators_in_query_are_neutralized() {
         let conn = seed();
-        for q in ["cost\" OR \"x", "NEAR(a b)", "usage*", "(sessions)", "col:val"] {
+        for q in [
+            "cost\" OR \"x",
+            "NEAR(a b)",
+            "usage*",
+            "(sessions)",
+            "col:val",
+        ] {
             // must not error; may or may not match
             search(&conn, q, 5, MatchMode::Any).unwrap();
         }
@@ -162,7 +180,11 @@ mod tests {
         let conn = seed();
         assert_eq!(
             list_all_names(&conn).unwrap(),
-            vec!["cv-usage".to_string(), "live".to_string(), "win-cleanup".to_string()]
+            vec![
+                "cv-usage".to_string(),
+                "live".to_string(),
+                "win-cleanup".to_string()
+            ]
         );
     }
 }
diff --git a/crates/skill-registry/src/sources.rs b/crates/skill-registry/src/sources.rs
index d8681841..206046a5 100644
--- a/crates/skill-registry/src/sources.rs
+++ b/crates/skill-registry/src/sources.rs
@@ -9,7 +9,7 @@ pub struct SkillEntry {
     pub source: String,
     pub path: PathBuf,
     pub description: String,
-    pub tags: String,      // space-joined, FTS column
+    pub tags: String, // space-joined, FTS column
     pub est_tokens: i64,
     pub mtime: i64,
     /// Compressed shadow copy of this skill, when one exists.
@@ -82,15 +82,16 @@ fn read_entry(id: &str, path: &Path) -> Option<SkillEntry> {
     })
 }
 
-static SHADOW_RE: std::sync::LazyLock<regex::Regex> = std::sync::LazyLock::new(|| {
-    regex::Regex::new(r"compressed-from:\s+(.+?)\s+\d+B").unwrap()
-});
+static SHADOW_RE: std::sync::LazyLock<regex::Regex> =
+    std::sync::LazyLock::new(|| regex::Regex::new(r"compressed-from:\s+(.+?)\s+\d+B").unwrap());
 
 /// `<!-- compressed-from: <path> <N>B → <M>B, <date> -->` in the first 2000 chars.
 fn shadow_origin(path: &Path) -> Option<PathBuf> {
     let text = std::fs::read_to_string(path).ok()?;
     let head: String = text.chars().take(2000).collect();
-    SHADOW_RE.captures(&head).map(|c| PathBuf::from(c[1].to_string()))
+    SHADOW_RE
+        .captures(&head)
+        .map(|c| PathBuf::from(c[1].to_string()))
 }
 
 pub fn scan_sources(sources: &[Source]) -> ScanOutput {
@@ -98,7 +99,9 @@ pub fn scan_sources(sources: &[Source]) -> ScanOutput {
     for src in sources {
         match &src.kind {
             SourceKind::FlatDir(root) => {
-                let Ok(read) = std::fs::read_dir(root) else { continue };
+                let Ok(read) = std::fs::read_dir(root) else {
+                    continue;
+                };
                 for dir in read.flatten() {
                     let skill_md = dir.path().join("SKILL.md");
                     if !skill_md.is_file() {
@@ -115,8 +118,16 @@ pub fn scan_sources(sources: &[Source]) -> ScanOutput {
                 let mut best: std::collections::HashMap<(String, String), PathBuf> =
                     std::collections::HashMap::new();
                 for mkt in std::fs::read_dir(root).into_iter().flatten().flatten() {
-                    for plugin in std::fs::read_dir(mkt.path()).into_iter().flatten().flatten() {
-                        for ver in std::fs::read_dir(plugin.path()).into_iter().flatten().flatten() {
+                    for plugin in std::fs::read_dir(mkt.path())
+                        .into_iter()
+                        .flatten()
+                        .flatten()
+                    {
+                        for ver in std::fs::read_dir(plugin.path())
+                            .into_iter()
+                            .flatten()
+                            .flatten()
+                        {
                             let skills = ver.path().join("skills");
                             for sk in std::fs::read_dir(&skills).into_iter().flatten().flatten() {
                                 let f = sk.path().join("SKILL.md");
@@ -130,7 +141,9 @@ pub fn scan_sources(sources: &[Source]) -> ScanOutput {
                                 let replace = match best.get(&key) {
                                     // parents: SKILL.md -> <skill> -> skills -> <version>
                                     Some(cur) => {
-                                        let cur_ver = cur.ancestors().nth(3)
+                                        let cur_ver = cur
+                                            .ancestors()
+                                            .nth(3)
                                             .and_then(|p| p.file_name())
                                             .map(|n| version_key(&n.to_string_lossy()))
                                             .unwrap_or_default();
@@ -159,9 +172,10 @@ pub fn scan_sources(sources: &[Source]) -> ScanOutput {
     let mut shadows: Vec<(usize, PathBuf)> = Vec::new(); // (entry idx of shadow, origin path)
     for (i, e) in out.entries.iter().enumerate() {
         if e.source.starts_with("claude-user")
-            && let Some(origin) = shadow_origin(&e.path) {
-                shadows.push((i, origin));
-            }
+            && let Some(origin) = shadow_origin(&e.path)
+        {
+            shadows.push((i, origin));
+        }
     }
     let mut drop_idx: Vec<usize> = Vec::new();
     for (shadow_i, origin) in &shadows {
@@ -193,20 +207,35 @@ pub fn scan_sources(sources: &[Source]) -> ScanOutput {
 /// directory exists.
 pub fn default_sources(home: &Path, cwd: &Path, detected_agents: &[String]) -> Vec<Source> {
     let mut v = vec![
-        Source { id: "claude-user".into(), kind: SourceKind::FlatDir(home.join(".claude").join("skills")) },
-        Source { id: "claude-project".into(), kind: SourceKind::FlatDir(cwd.join(".claude").join("skills")) },
-        Source { id: "claude-plugin".into(), kind: SourceKind::PluginCache(home.join(".claude").join("plugins").join("cache")) },
+        Source {
+            id: "claude-user".into(),
+            kind: SourceKind::FlatDir(home.join(".claude").join("skills")),
+        },
+        Source {
+            id: "claude-project".into(),
+            kind: SourceKind::FlatDir(cwd.join(".claude").join("skills")),
+        },
+        Source {
+            id: "claude-plugin".into(),
+            kind: SourceKind::PluginCache(home.join(".claude").join("plugins").join("cache")),
+        },
     ];
     // Conventional flat skill dirs for other agents; contributed only when the
     // agent is detected AND the dir exists (harmless no-op otherwise).
     let conventions: &[(&str, PathBuf)] = &[
         ("codex", home.join(".codex").join("skills")),
         ("cursor", home.join(".cursor").join("skills")),
-        ("opencode", home.join(".config").join("opencode").join("skills")),
+        (
+            "opencode",
+            home.join(".config").join("opencode").join("skills"),
+        ),
     ];
     for (agent, dir) in conventions {
         if detected_agents.iter().any(|a| a == agent) && dir.is_dir() {
-            v.push(Source { id: (*agent).to_string(), kind: SourceKind::FlatDir(dir.clone()) });
+            v.push(Source {
+                id: (*agent).to_string(),
+                kind: SourceKind::FlatDir(dir.clone()),
+            });
         }
     }
     v.retain(|s| match &s.kind {
@@ -265,8 +294,18 @@ mod tests {
     fn plugin_cache_picks_newest_version() {
         let tmp = tempfile::tempdir().unwrap();
         for v in ["6.0.3", "6.1.1", "6.1.0"] {
-            let d = tmp.path().join("mkt").join("superpowers").join(v).join("skills");
-            write_skill(&d, "writing-skills", "Use when creating skills", &format!("v{v}"));
+            let d = tmp
+                .path()
+                .join("mkt")
+                .join("superpowers")
+                .join(v)
+                .join("skills");
+            write_skill(
+                &d,
+                "writing-skills",
+                "Use when creating skills",
+                &format!("v{v}"),
+            );
         }
         let out = scan_sources(&[Source {
             id: "claude-plugin".into(),
@@ -284,7 +323,12 @@ mod tests {
         let tmp = tempfile::tempdir().unwrap();
         let cache = tmp.path().join("cache");
         let d = cache.join("mkt").join("cv").join("1.0.0").join("skills");
-        write_skill(&d, "live", "Use when checking live sessions", "ORIGINAL BODY");
+        write_skill(
+            &d,
+            "live",
+            "Use when checking live sessions",
+            "ORIGINAL BODY",
+        );
         let orig = d.join("live").join("SKILL.md");
 
         let user = tmp.path().join("user-skills");
@@ -300,8 +344,14 @@ mod tests {
         .unwrap();
 
         let out = scan_sources(&[
-            Source { id: "claude-user".into(), kind: SourceKind::FlatDir(user) },
-            Source { id: "claude-plugin".into(), kind: SourceKind::PluginCache(cache) },
+            Source {
+                id: "claude-user".into(),
+                kind: SourceKind::FlatDir(user),
+            },
+            Source {
+                id: "claude-plugin".into(),
+                kind: SourceKind::PluginCache(cache),
+            },
         ]);
         // one logical skill: the plugin original carrying its shadow
         assert_eq!(out.entries.len(), 1);
@@ -331,7 +381,10 @@ mod tests {
             kind: SourceKind::FlatDir(tmp.path().to_path_buf()),
         }]);
         assert_eq!(out.entries.len(), 1);
-        assert_eq!(out.entries[0].shadow_path.as_deref(), Some(ud.join("SKILL.md").as_path()));
+        assert_eq!(
+            out.entries[0].shadow_path.as_deref(),
+            Some(ud.join("SKILL.md").as_path())
+        );
     }
 
     #[test]
diff --git a/crates/skill-registry/tests/golden_queries.rs b/crates/skill-registry/tests/golden_queries.rs
index 5ee63ef3..7030990f 100644
--- a/crates/skill-registry/tests/golden_queries.rs
+++ b/crates/skill-registry/tests/golden_queries.rs
@@ -3,18 +3,36 @@
 //! below 85%, the v2 embeddings feature is justified.
 
 use agentflare_skill_registry::db::{open_in_memory, rebuild};
-use agentflare_skill_registry::search::{search, MatchMode};
-use agentflare_skill_registry::sources::{scan_sources, Source, SourceKind};
+use agentflare_skill_registry::search::{MatchMode, search};
+use agentflare_skill_registry::sources::{Source, SourceKind, scan_sources};
 use std::fs;
 use std::path::Path;
 
 const FIXTURES: &[(&str, &str)] = &[
-    ("live", "Use when the user asks about running sessions, agent status, what needs attention — e.g. 'what's running', 'live status', 'anything stuck'"),
-    ("cv-usage", "Use when the user asks about usage analytics, statistics, token usage, or cost summary — e.g. 'usage stats', 'how many sessions this week', 'cost report'"),
-    ("win-cleanup", "Use when the user asks to free disk space, clean up the Windows system, says disk is full, or wants a disk usage report"),
-    ("code-review", "Review the current diff for correctness bugs and reuse, simplification, efficiency cleanups"),
-    ("deep-research", "Deep research harness — fan-out web searches, fetch sources, verify claims, synthesize a cited report"),
-    ("short-skill", "Use when the user wants a compressed shorthand version of an installed skill, complains a skill is bloated, verbose, or token-heavy"),
+    (
+        "live",
+        "Use when the user asks about running sessions, agent status, what needs attention — e.g. 'what's running', 'live status', 'anything stuck'",
+    ),
+    (
+        "cv-usage",
+        "Use when the user asks about usage analytics, statistics, token usage, or cost summary — e.g. 'usage stats', 'how many sessions this week', 'cost report'",
+    ),
+    (
+        "win-cleanup",
+        "Use when the user asks to free disk space, clean up the Windows system, says disk is full, or wants a disk usage report",
+    ),
+    (
+        "code-review",
+        "Review the current diff for correctness bugs and reuse, simplification, efficiency cleanups",
+    ),
+    (
+        "deep-research",
+        "Deep research harness — fan-out web searches, fetch sources, verify claims, synthesize a cited report",
+    ),
+    (
+        "short-skill",
+        "Use when the user wants a compressed shorthand version of an installed skill, complains a skill is bloated, verbose, or token-heavy",
+    ),
 ];
 
 const GOLDEN: &[(&str, &str)] = &[
@@ -75,11 +93,21 @@ fn golden_queries_hit_at_3_is_at_least_85_percent() {
         if r.iter().any(|h| h.name == *expected) {
             hits += 1;
         } else {
-            misses.push(format!("{query:?} -> wanted {expected}, got {:?}",
-                r.iter().map(|h| h.name.clone()).collect::<Vec<_>>()));
+            misses.push(format!(
+                "{query:?} -> wanted {expected}, got {:?}",
+                r.iter().map(|h| h.name.clone()).collect::<Vec<_>>()
+            ));
         }
     }
     let rate = hits as f64 / GOLDEN.len() as f64;
-    println!("hit@3 = {rate:.2} ({} / {} queries matched)", hits, GOLDEN.len());
-    assert!(rate >= 0.85, "hit@3 {rate:.2} below gate; misses:\n{}", misses.join("\n"));
+    println!(
+        "hit@3 = {rate:.2} ({} / {} queries matched)",
+        hits,
+        GOLDEN.len()
+    );
+    assert!(
+        rate >= 0.85,
+        "hit@3 {rate:.2} below gate; misses:\n{}",
+        misses.join("\n")
+    );
 }
diff --git a/deny.toml b/deny.toml
new file mode 100644
index 00000000..9e940523
--- /dev/null
+++ b/deny.toml
@@ -0,0 +1,55 @@
+[graph]
+targets = []
+all-features = true
+
+[advisories]
+# cargo-deny >= 0.19 removed `vulnerability` and `notice` config knobs:
+# all vulnerability/notice advisories now emit errors unless explicitly ignored.
+# `unmaintained`/`unsound` now control which dependencies can fail the check.
+unmaintained = "workspace"
+yanked = "warn"
+unused-ignored-advisory = "warn"
+ignore = []
+
+[licenses]
+# The allow-list below is a deliberately curated, forward-looking policy. Some
+# entries (e.g. OpenSSL for `ring`, Unicode-DFS-2016) are kept so dependency
+# bumps don't trip the check; `allow` silences the pedantic "not encountered"
+# notice for those without weakening the policy itself.
+unused-allowed-license = "allow"
+allow = [
+    "MIT",
+    "Apache-2.0",
+    "Apache-2.0 WITH LLVM-exception",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "0BSD",
+    "ISC",
+    "Unicode-3.0",
+    "Unicode-DFS-2016",
+    "Zlib",
+    "Unlicense",
+    "MPL-2.0",
+    "BSL-1.0",
+    "CC0-1.0",
+    "CDLA-Permissive-2.0",
+    "OpenSSL",
+    "bzip2-1.0.6",
+    "WTFPL",
+]
+confidence-threshold = 0.8
+
+[[licenses.clarify]]
+name = "ring"
+expression = "MIT AND ISC AND OpenSSL"
+license-files = [{ path = "LICENSE", hash = 0xbd0eed23 }]
+
+[bans]
+multiple-versions = "warn"
+wildcards = "allow"
+
+[sources]
+unknown-registry = "warn"
+unknown-git = "warn"
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]
+allow-git = []
diff --git a/src/agent_install.rs b/src/agent_install.rs
index 8cadc735..ac6cb545 100644
--- a/src/agent_install.rs
+++ b/src/agent_install.rs
@@ -53,8 +53,16 @@ fn uninstall_args(spec: &AgentSpec) -> Option<Vec<String>> {
     let pm = spec.package_manager?;
     let pkg = spec.package_name?;
     match pm {
-        "npm" => Some(vec!["uninstall".to_string(), "-g".to_string(), pkg.to_string()]),
-        "pip" => Some(vec!["uninstall".to_string(), "-y".to_string(), pkg.to_string()]),
+        "npm" => Some(vec![
+            "uninstall".to_string(),
+            "-g".to_string(),
+            pkg.to_string(),
+        ]),
+        "pip" => Some(vec![
+            "uninstall".to_string(),
+            "-y".to_string(),
+            pkg.to_string(),
+        ]),
         _ => None,
     }
 }
@@ -70,14 +78,16 @@ pub fn run_install(
         None => return Outcome::Err(format!("unknown agent: {agent}")),
     };
     if spec.tier != agent_registry::Tier::Cli {
-        return Outcome::Skipped(format!("{agent} is an editor extension, no binary to install"));
+        return Outcome::Skipped(format!(
+            "{agent} is an editor extension, no binary to install"
+        ));
     }
     let pm = match spec.package_manager {
         Some(p) => p,
         None => {
             return Outcome::Skipped(format!(
                 "{agent} has no automated install — download from the official site"
-            ))
+            ));
         }
     };
     let args = match install_args(spec, version) {
@@ -101,7 +111,7 @@ pub fn run_update(registry: &[AgentSpec], agent: &str, dry_run: bool) -> Outcome
         None => {
             return Outcome::Skipped(format!(
                 "{agent} is manually installed — re-download from the official site"
-            ))
+            ));
         }
     };
     let pkg = match spec.package_name {
@@ -121,14 +131,16 @@ pub fn run_uninstall(registry: &[AgentSpec], agent: &str, dry_run: bool) -> Outc
         None => return Outcome::Err(format!("unknown agent: {agent}")),
     };
     if spec.tier != agent_registry::Tier::Cli {
-        return Outcome::Skipped(format!("{agent} is an editor extension, nothing to uninstall"));
+        return Outcome::Skipped(format!(
+            "{agent} is an editor extension, nothing to uninstall"
+        ));
     }
     let pm = match spec.package_manager {
         Some(p) => p,
         None => {
             return Outcome::Skipped(format!(
                 "{agent} is manually installed — remove from your system manually"
-            ))
+            ));
         }
     };
     let args = match uninstall_args(spec) {
diff --git a/src/agent_launch.rs b/src/agent_launch.rs
index 5ae2515a..de41524b 100644
--- a/src/agent_launch.rs
+++ b/src/agent_launch.rs
@@ -2,12 +2,13 @@
 // Finds the agent binary on PATH, maps --model/--mode to agent-native
 // flags, and executes with pass-through args and inherited stdio.
 use agent_registry::detect::find_binary;
-use agent_registry::{headless_args, Agent, AgentSpec, Tier};
+use agent_registry::{Agent, AgentSpec, Tier, headless_args};
 use std::io::Read;
 use std::path::Path;
 use std::process::{Command, Stdio};
 use std::time::{Duration, Instant};
 
+#[derive(Debug)]
 pub enum LaunchOutcome {
     Launched,
     NotFound(String),
@@ -61,7 +62,11 @@ pub fn run_launch_env(
 
     // `mise exec -- <binary> …` runs the agent inside mise's environment, so its
     // tool paths are on PATH for the agent and its child shells.
-    let mise = if via_mise { crate::mise_install::mise_bin() } else { None };
+    let mise = if via_mise {
+        crate::mise_install::mise_bin()
+    } else {
+        None
+    };
     let mut cmd = match &mise {
         Some(m) => {
             let mut c = Command::new(m);
@@ -93,10 +98,7 @@ pub fn run_launch_env(
             let code = s.code().unwrap_or(-1);
             std::process::exit(code);
         }
-        Err(e) => LaunchOutcome::NotFound(format!(
-            "failed to launch {}: {e}",
-            binary.display()
-        )),
+        Err(e) => LaunchOutcome::NotFound(format!("failed to launch {}: {e}", binary.display())),
     }
 }
 
@@ -320,7 +322,7 @@ mod tests {
         // "aider" unlikely to be on a test PATH
         match run_launch(&reg, "aider", None, None, &[]) {
             LaunchOutcome::NotFound(msg) => assert!(msg.contains("not found on PATH")),
-            _ => {}
+            other => panic!("expected NotFound, got {other:?}"),
         }
     }
 
@@ -347,7 +349,10 @@ mod tests {
         assert!(out.timed_out, "should report timeout");
         assert!(!out.success, "a killed child is not a success");
         // Must return promptly, not wait out the full 5s sleep.
-        assert!(start.elapsed() < std::time::Duration::from_secs(2), "did not kill promptly");
+        assert!(
+            start.elapsed() < std::time::Duration::from_secs(2),
+            "did not kill promptly"
+        );
     }
 
     // Proves the fix for the "descendant outlives the direct child" hang: the
@@ -400,17 +405,28 @@ mod tests {
         let binary = std::path::Path::new("/usr/bin/claude");
         assert_eq!(
             headless_argv(Agent::ClaudeCode, binary, "hi there"),
-            Some(vec!["/usr/bin/claude".to_string(), "-p".to_string(), "hi there".to_string()])
+            Some(vec![
+                "/usr/bin/claude".to_string(),
+                "-p".to_string(),
+                "hi there".to_string()
+            ])
         );
         assert_eq!(
             headless_argv(Agent::Codex, std::path::Path::new("/x/codex"), "do it"),
-            Some(vec!["/x/codex".to_string(), "exec".to_string(), "do it".to_string()])
+            Some(vec![
+                "/x/codex".to_string(),
+                "exec".to_string(),
+                "do it".to_string()
+            ])
         );
     }
 
     #[test]
     fn headless_argv_none_without_print_mode() {
-        assert_eq!(headless_argv(Agent::Aider, std::path::Path::new("/x/aider"), "p"), None);
+        assert_eq!(
+            headless_argv(Agent::Aider, std::path::Path::new("/x/aider"), "p"),
+            None
+        );
     }
 
     #[test]
diff --git a/src/agents.rs b/src/agents.rs
index 3cd3ebdf..87e61e7c 100644
--- a/src/agents.rs
+++ b/src/agents.rs
@@ -1,11 +1,11 @@
 // CLI rendering for `agentflare agents list` / `agentflare agents doctor`.
 // Kept separate from agent_detect.rs so the detection engine stays free of
 // println!/format concerns and is fully unit-testable in isolation.
-use agent_registry::detect::{self, DetectedAgent, VersionRunner};
 use crate::agent_install::{self, Outcome};
 use crate::agent_launch::{self, LaunchOutcome};
-use agent_registry::{self, AgentSpec};
 use crate::state;
+use agent_registry::detect::{self, DetectedAgent, VersionRunner};
+use agent_registry::{self, AgentSpec};
 use serde::Serialize;
 use std::collections::HashMap;
 
@@ -56,12 +56,7 @@ fn render_table(agents: &[DetectedAgent]) {
         .unwrap_or(0)
         .max(c1.len());
 
-    println!(
-        "  {}  {}  {}",
-        pad(c0, max_agent),
-        pad(c1, max_version),
-        c2
-    );
+    println!("  {}  {}  {}", pad(c0, max_agent), pad(c1, max_version), c2);
     for a in agents {
         println!(
             "  {}  {}  {}",
@@ -123,13 +118,10 @@ pub fn run_doctor(
     } else {
         render_table(&agents);
         for a in &agents {
-            if a.status == "unknown" {
-                if let Some(ref err) = a.error {
-                    println!(
-                        "  {}: {} — {}",
-                        a.display_name, a.binary_path, err
-                    );
-                }
+            if a.status == "unknown"
+                && let Some(ref err) = a.error
+            {
+                println!("  {}: {} — {}", a.display_name, a.binary_path, err);
             }
         }
     }
@@ -193,11 +185,21 @@ pub fn cli_launch(agent: &str, model: Option<&str>, mode: Option<&str>, args: &[
 /// `agentflare run <agent>` — launch through mise (so its tools are on PATH) with
 /// wrangler-style `.dev.vars`[.<stage>] env vars injected. Reports what it
 /// injects on stderr so it doesn't pollute the agent's stdout.
-pub fn cli_run(agent: &str, stage: Option<&str>, model: Option<&str>, mode: Option<&str>, args: &[String]) {
+pub fn cli_run(
+    agent: &str,
+    stage: Option<&str>,
+    model: Option<&str>,
+    mode: Option<&str>,
+    args: &[String],
+) {
     let cwd = std::env::current_dir().unwrap_or_default();
     let env = match crate::dev_vars::load(&cwd, stage) {
         Some((path, vars)) => {
-            eprintln!("agentflare run: injecting {} var(s) from {}", vars.len(), path.display());
+            eprintln!(
+                "agentflare run: injecting {} var(s) from {}",
+                vars.len(),
+                path.display()
+            );
             vars
         }
         None => {
@@ -207,7 +209,15 @@ pub fn cli_run(agent: &str, stage: Option<&str>, model: Option<&str>, mode: Opti
             Vec::new()
         }
     };
-    match agent_launch::run_launch_env(agent_registry::REGISTRY, agent, model, mode, args, &env, true) {
+    match agent_launch::run_launch_env(
+        agent_registry::REGISTRY,
+        agent,
+        model,
+        mode,
+        args,
+        &env,
+        true,
+    ) {
         LaunchOutcome::Launched => {}
         LaunchOutcome::NotFound(msg) => eprintln!("error: {msg}"),
         LaunchOutcome::UnknownAgent(msg) => eprintln!("error: unknown agent: {msg}"),
@@ -251,9 +261,11 @@ mod tests {
     }
 
     fn with_temp_path_dir(f: impl FnOnce(&Path)) {
-        let _guard = agent_registry::detect::PATH_LOCK.lock().unwrap_or_else(|e| e.into_inner());
-        let dir = std::env::temp_dir()
-            .join(format!("agentflare-test-agents-cli-{}", std::process::id()));
+        let _guard = agent_registry::detect::PATH_LOCK
+            .lock()
+            .unwrap_or_else(|e| e.into_inner());
+        let dir =
+            std::env::temp_dir().join(format!("agentflare-test-agents-cli-{}", std::process::id()));
         let _ = std::fs::remove_dir_all(&dir);
         std::fs::create_dir_all(&dir).unwrap();
         let original = std::env::var_os("PATH");
@@ -297,12 +309,10 @@ mod tests {
             };
             let mut cache = HashMap::new();
 
-            let detected = detect::detect_all_with(
-                &test_registry(),
-                &mut cache,
-                &runner,
-            );
-            let output = ListOutput { agents: to_rows(&detected) };
+            let detected = detect::detect_all_with(&test_registry(), &mut cache, &runner);
+            let output = ListOutput {
+                agents: to_rows(&detected),
+            };
             let json = serde_json::to_string_pretty(&output).unwrap();
             assert!(json.contains("\"agent\": \"test-agent\""));
             assert!(json.contains("\"version\": \"1.2.3\""));
@@ -330,12 +340,10 @@ mod tests {
                 package_manager: None,
                 package_name: None,
             }];
-            let detected = detect::detect_all_with(
-                &registry,
-                &mut cache,
-                &runner,
-            );
-            let output = ListOutput { agents: to_rows(&detected) };
+            let detected = detect::detect_all_with(&registry, &mut cache, &runner);
+            let output = ListOutput {
+                agents: to_rows(&detected),
+            };
             let json = serde_json::to_string_pretty(&output).unwrap();
             assert!(json.contains("\"status\": \"unknown\""));
             assert!(json.contains("\"error\""));
@@ -406,12 +414,10 @@ mod tests {
                 package_manager: None,
                 package_name: None,
             }];
-            let detected = detect::detect_all_with(
-                &registry,
-                &mut cache,
-                &runner,
-            );
-            let output = ListOutput { agents: to_rows(&detected) };
+            let detected = detect::detect_all_with(&registry, &mut cache, &runner);
+            let output = ListOutput {
+                agents: to_rows(&detected),
+            };
             let json = serde_json::to_string_pretty(&output).unwrap();
             assert!(json.contains("\"agent\": \"dr-agent\""));
             assert!(json.contains("\"version\": \"7.8.9\""));
diff --git a/src/alias.rs b/src/alias.rs
index 865f31d2..6bb1a82f 100644
--- a/src/alias.rs
+++ b/src/alias.rs
@@ -94,30 +94,28 @@ pub fn run(
 
     let existing_content = std::fs::read_to_string(&profile).ok();
 
-    if !force {
-        if let Some(ref content) = existing_content {
-            if let Some(existing_alias) = read_managed_block_alias(content) {
-                if existing_alias == shell.alias_line(preferred, "agentflare") {
-                    if !json && !print_only {
-                        println!(
-                            "alias '{preferred}' already installed in {}",
-                            profile.display()
-                        );
-                    }
-                    if json {
-                        emit_json(JsonOutput {
-                            requested: preferred.to_string(),
-                            installed: preferred.to_string(),
-                            status: Status::AlreadyInstalled.as_str(),
-                            profile: profile.to_string_lossy().into_owned(),
-                            snippet: None,
-                            error: None,
-                        });
-                    }
-                    return;
-                }
-            }
+    if !force
+        && let Some(ref content) = existing_content
+        && let Some(existing_alias) = read_managed_block_alias(content)
+        && existing_alias == shell.alias_line(preferred, "agentflare")
+    {
+        if !json && !print_only {
+            println!(
+                "alias '{preferred}' already installed in {}",
+                profile.display()
+            );
         }
+        if json {
+            emit_json(JsonOutput {
+                requested: preferred.to_string(),
+                installed: preferred.to_string(),
+                status: Status::AlreadyInstalled.as_str(),
+                profile: profile.to_string_lossy().into_owned(),
+                snippet: None,
+                error: None,
+            });
+        }
+        return;
     }
 
     let name = resolve_name(preferred, force, shell, existing_content.as_deref());
@@ -254,8 +252,7 @@ fn resolve_name(
 
     for name in candidates {
         let on_path = agent_registry::detect::find_binary(&[name]).is_some();
-        let in_profile =
-            profile_content.map_or(false, |c| shell.is_defined_in_profile(c, name));
+        let in_profile = profile_content.is_some_and(|c| shell.is_defined_in_profile(c, name));
         if !on_path && !in_profile {
             return name.to_string();
         }
@@ -287,17 +284,16 @@ fn write_managed_block(
     let content = existing.unwrap_or("");
     let new_block = format!("{BLOCK_START}\n{alias_line}\n{BLOCK_END}\n");
 
-    if let Some(start) = content.find(BLOCK_START) {
-        if let Some(end_rel) = content[start..].find(BLOCK_END) {
-            let mut end = start + end_rel + BLOCK_END.len();
-            if content[end..].starts_with('\n') {
-                end += 1;
-            }
-            let new_content =
-                content[..start].to_string() + &new_block + &content[end..];
-            std::fs::write(profile, new_content)?;
-            return Ok(());
+    if let Some(start) = content.find(BLOCK_START)
+        && let Some(end_rel) = content[start..].find(BLOCK_END)
+    {
+        let mut end = start + end_rel + BLOCK_END.len();
+        if content[end..].starts_with('\n') {
+            end += 1;
         }
+        let new_content = content[..start].to_string() + &new_block + &content[end..];
+        std::fs::write(profile, new_content)?;
+        return Ok(());
     }
 
     let mut new_content = content.to_string();
@@ -316,7 +312,8 @@ mod tests {
     static ALIAS_FILE_LOCK: std::sync::Mutex<()> = std::sync::Mutex::new(());
 
     fn temp_profile(name: &str) -> PathBuf {
-        let dir = std::env::temp_dir().join(format!("agentflare-test-alias-{}", std::process::id()));
+        let dir =
+            std::env::temp_dir().join(format!("agentflare-test-alias-{}", std::process::id()));
         let _ = std::fs::remove_dir_all(&dir);
         std::fs::create_dir_all(&dir).unwrap();
         dir.join(name)
@@ -346,7 +343,8 @@ mod tests {
 
     #[test]
     fn read_managed_block_alias_finds_content() {
-        let content = "# >>> agentflare alias >>>\nalias af='agentflare'\n# <<< agentflare alias <<<\n";
+        let content =
+            "# >>> agentflare alias >>>\nalias af='agentflare'\n# <<< agentflare alias <<<\n";
         assert_eq!(
             read_managed_block_alias(content),
             Some("alias af='agentflare'".to_string())
@@ -397,7 +395,8 @@ mod tests {
     fn write_managed_block_idempotent() {
         let _guard = ALIAS_FILE_LOCK.lock().unwrap_or_else(|e| e.into_inner());
         let profile = temp_profile("test_idempotent.sh");
-        let original = "# >>> agentflare alias >>>\nalias af='agentflare'\n# <<< agentflare alias <<<\n";
+        let original =
+            "# >>> agentflare alias >>>\nalias af='agentflare'\n# <<< agentflare alias <<<\n";
         std::fs::write(&profile, original).unwrap();
 
         write_managed_block(
diff --git a/src/auth.rs b/src/auth.rs
index b78c0833..296c0aea 100644
--- a/src/auth.rs
+++ b/src/auth.rs
@@ -27,9 +27,7 @@ static CATALOG: &[AuthCatalog] = &[
     },
     AuthCatalog {
         agent_key: "codex",
-        files: &[
-            ".codex/auth.json",
-        ],
+        files: &[".codex/auth.json"],
     },
     AuthCatalog {
         agent_key: "antigravity",
@@ -40,22 +38,15 @@ static CATALOG: &[AuthCatalog] = &[
     },
     AuthCatalog {
         agent_key: "gemini",
-        files: &[
-            ".gemini/settings.json",
-            ".gemini/oauth_creds.json",
-        ],
+        files: &[".gemini/settings.json", ".gemini/oauth_creds.json"],
     },
     AuthCatalog {
         agent_key: "opencode",
-        files: &[
-            ".opencode/auth.json",
-        ],
+        files: &[".opencode/auth.json"],
     },
     AuthCatalog {
         agent_key: "copilot",
-        files: &[
-            ".copilot/auth.json",
-        ],
+        files: &[".copilot/auth.json"],
     },
 ];
 
@@ -64,7 +55,11 @@ fn catalog_for(agent: &str) -> Option<&'static AuthCatalog> {
 }
 
 fn vault_dir() -> PathBuf {
-    home().join(".local").join("share").join("agentflare").join(VAULT_DIR)
+    home()
+        .join(".local")
+        .join("share")
+        .join("agentflare")
+        .join(VAULT_DIR)
 }
 
 fn profile_dir(agent: &str, profile: &str) -> PathBuf {
@@ -73,7 +68,10 @@ fn profile_dir(agent: &str, profile: &str) -> PathBuf {
 
 fn validate_name(name: &str, kind: &'static str) -> Result<(), AuthError> {
     if name.is_empty() || name.contains('/') || name.contains('\\') {
-        Err(AuthError::InvalidName { name: name.to_string(), kind: kind.to_string() })
+        Err(AuthError::InvalidName {
+            name: name.to_string(),
+            kind: kind.to_string(),
+        })
     } else {
         Ok(())
     }
@@ -166,7 +164,10 @@ pub fn activate_with(agent: &str, profile: &str, reload_daemon: bool, json: bool
     let vault = profile_dir(agent, &profile);
     if !vault.exists() {
         if json {
-            println!("{}", serde_json::json!({"error": "profile not found", "profile": profile}));
+            println!(
+                "{}",
+                serde_json::json!({"error": "profile not found", "profile": profile})
+            );
         } else {
             eprintln!("error: profile '{profile}' not found for {agent}");
         }
@@ -176,9 +177,7 @@ pub fn activate_with(agent: &str, profile: &str, reload_daemon: bool, json: bool
     let mut restored = 0;
     let passphrase = auth_crypt::get_passphrase();
     for &rel in cat.files {
-        let src = vault.join(
-            rel.split('/').next_back().unwrap_or(rel)
-        );
+        let src = vault.join(rel.split('/').next_back().unwrap_or(rel));
         if src.exists() {
             let dest = home().join(rel);
             if let Some(parent) = dest.parent() {
@@ -190,7 +189,10 @@ pub fn activate_with(agent: &str, profile: &str, reload_daemon: bool, json: bool
                     if let Some(decrypted) = auth_crypt::decrypt(&data, pw) {
                         fs::write(&dest, decrypted).expect("write");
                     } else {
-                        eprintln!("warning: cannot decrypt {} — wrong passphrase", src.display());
+                        eprintln!(
+                            "warning: cannot decrypt {} — wrong passphrase",
+                            src.display()
+                        );
                         continue;
                     }
                 } else {
@@ -211,11 +213,14 @@ pub fn activate_with(agent: &str, profile: &str, reload_daemon: bool, json: bool
     crate::auth_db::touch_last_used(&conn, agent, &profile);
 
     if json {
-        println!("{}", serde_json::json!({
-            "agent": agent,
-            "profile": profile,
-            "restored": restored,
-        }));
+        println!(
+            "{}",
+            serde_json::json!({
+                "agent": agent,
+                "profile": profile,
+                "restored": restored,
+            })
+        );
     } else {
         println!("activated {agent}/{profile} — restored {restored} file(s)");
     }
@@ -229,7 +234,9 @@ pub fn activate_with(agent: &str, profile: &str, reload_daemon: bool, json: bool
                 println!("daemon restarted — auth changes now active");
             }
         } else if !json {
-            eprintln!("warning: {agent} daemon is running — auth changes won't take effect until restart. Use --reload-daemon to auto-restart.");
+            eprintln!(
+                "warning: {agent} daemon is running — auth changes won't take effect until restart. Use --reload-daemon to auto-restart."
+            );
         }
     }
 }
@@ -256,7 +263,11 @@ pub fn status(agent: Option<&str>, json: bool) {
         } else {
             println!("{}:", cat.agent_key);
             for p in &profiles {
-                let mark = if Some(p.as_str()) == active.as_deref() { " *" } else { "" };
+                let mark = if Some(p.as_str()) == active.as_deref() {
+                    " *"
+                } else {
+                    ""
+                };
                 println!("  {p}{mark}");
             }
             if active.is_none() {
@@ -282,7 +293,7 @@ pub fn list_agents(json: bool) {
 }
 
 pub fn ls(agent: &str, json: bool) {
-    if !catalog_for(agent).is_some() {
+    if catalog_for(agent).is_none() {
         fail("unknown agent", agent, json);
         return;
     }
@@ -310,7 +321,10 @@ pub fn delete(agent: &str, profile: &str, json: bool) {
     }
     fs::remove_dir_all(&dir).expect("remove dir");
     if json {
-        println!("{}", serde_json::json!({"deleted": true, "agent": agent, "profile": profile}));
+        println!(
+            "{}",
+            serde_json::json!({"deleted": true, "agent": agent, "profile": profile})
+        );
     } else {
         println!("deleted {agent}/{profile}");
     }
@@ -333,7 +347,10 @@ pub fn clear(agent: &str, json: bool) {
         }
     }
     if json {
-        println!("{}", serde_json::json!({"cleared": removed, "agent": agent}));
+        println!(
+            "{}",
+            serde_json::json!({"cleared": removed, "agent": agent})
+        );
     } else {
         println!("cleared {removed} auth file(s) for {agent}");
     }
@@ -361,7 +378,10 @@ pub fn rename(agent: &str, old: &str, new: &str, json: bool) {
     fs::create_dir_all(new_dir.parent().unwrap()).expect("create parent");
     fs::rename(&old_dir, &new_dir).expect("rename");
     if json {
-        println!("{}", serde_json::json!({"renamed": true, "agent": agent, "old": old, "new": new}));
+        println!(
+            "{}",
+            serde_json::json!({"renamed": true, "agent": agent, "old": old, "new": new})
+        );
     } else {
         println!("renamed {agent}/{old} → {new}");
     }
@@ -408,11 +428,11 @@ fn hash_live_files(cat: &AuthCatalog) -> String {
     let mut hasher = Sha256::new();
     for &rel in cat.files {
         let path = home().join(rel);
-        if path.exists() {
-            if let Ok(data) = fs::read(&path) {
-                hasher.update(rel.as_bytes());
-                hasher.update(data);
-            }
+        if path.exists()
+            && let Ok(data) = fs::read(&path)
+        {
+            hasher.update(rel.as_bytes());
+            hasher.update(data);
         }
     }
     format!("{:x}", hasher.finalize())
@@ -424,11 +444,11 @@ fn hash_vault_profile(cat: &AuthCatalog, profile: &str) -> String {
     for &rel in cat.files {
         let fname = rel.split('/').next_back().unwrap_or(rel);
         let path = dir.join(fname);
-        if path.exists() {
-            if let Ok(data) = fs::read(&path) {
-                hasher.update(rel.as_bytes());
-                hasher.update(data);
-            }
+        if path.exists()
+            && let Ok(data) = fs::read(&path)
+        {
+            hasher.update(rel.as_bytes());
+            hasher.update(data);
         }
     }
     format!("{:x}", hasher.finalize())
@@ -436,7 +456,10 @@ fn hash_vault_profile(cat: &AuthCatalog, profile: &str) -> String {
 
 fn fail(msg: &(impl std::fmt::Display + ?Sized), detail: &str, json: bool) {
     if json {
-        println!("{}", serde_json::json!({"error": msg.to_string(), "detail": detail}));
+        println!(
+            "{}",
+            serde_json::json!({"error": msg.to_string(), "detail": detail})
+        );
     } else {
         eprintln!("error: {msg}: {detail}");
     }
@@ -452,7 +475,10 @@ fn validate_algorithm(name: &str) -> Result<&str, AuthError> {
 pub fn rotate(agent: &str, algorithm: &str, json: bool) {
     let algorithm = match validate_algorithm(algorithm) {
         Ok(a) => a,
-        Err(e) => { fail(&e, "", json); return; }
+        Err(e) => {
+            fail(&e, "", json);
+            return;
+        }
     };
     let conn = auth_db::open_or_rebuild();
     let cooldowns = auth_db::list_cooldowns(&conn, Some(agent));
@@ -462,7 +488,10 @@ pub fn rotate(agent: &str, algorithm: &str, json: bool) {
 
     if active.is_empty() {
         if json {
-            println!("{}", serde_json::json!({"error": "no non-cooldown profiles available"}));
+            println!(
+                "{}",
+                serde_json::json!({"error": "no non-cooldown profiles available"})
+            );
         } else {
             eprintln!("error: all profiles are in cooldown");
         }
@@ -508,7 +537,11 @@ fn smart_pick(health: &[ProfileHealth], profiles: &[String]) -> String {
                 _ => 100.0,
             };
             let penalty = h.map(|h| h.penalty).unwrap_or(0.0);
-            let recency = if h.and_then(|h| h.last_used_at.as_ref()).is_some() { 0.0 } else { 10.0 };
+            let recency = if h.and_then(|h| h.last_used_at.as_ref()).is_some() {
+                0.0
+            } else {
+                10.0
+            };
             let jitter = (rand::random::<f64>() * 10.0) - 5.0;
             (p.clone(), base - penalty + recency + jitter)
         })
@@ -518,11 +551,11 @@ fn smart_pick(health: &[ProfileHealth], profiles: &[String]) -> String {
 }
 
 fn round_robin(conn: &Connection, agent: &str, profiles: &[String]) -> String {
-    if let Some((last, _)) = auth_db::get_rotation_last(conn, agent) {
-        if let Some(pos) = profiles.iter().position(|p| *p == last) {
-            let next = (pos + 1) % profiles.len();
-            return profiles[next].clone();
-        }
+    if let Some((last, _)) = auth_db::get_rotation_last(conn, agent)
+        && let Some(pos) = profiles.iter().position(|p| *p == last)
+    {
+        let next = (pos + 1) % profiles.len();
+        return profiles[next].clone();
     }
     profiles[0].clone()
 }
@@ -535,7 +568,10 @@ fn random_pick(profiles: &[String]) -> String {
 pub fn next(agent: &str, algorithm: &str, json: bool) {
     let algorithm = match validate_algorithm(algorithm) {
         Ok(a) => a,
-        Err(e) => { fail(&e, "", json); return; }
+        Err(e) => {
+            fail(&e, "", json);
+            return;
+        }
     };
     let conn = auth_db::open_or_rebuild();
     let cooldowns = auth_db::list_cooldowns(&conn, Some(agent));
@@ -549,7 +585,10 @@ pub fn next(agent: &str, algorithm: &str, json: bool) {
         select_profile(&conn, agent, algorithm, &health, &active)
     };
     if json {
-        println!("{}", serde_json::json!({"agent": agent, "next": chosen, "algorithm": algorithm}));
+        println!(
+            "{}",
+            serde_json::json!({"agent": agent, "next": chosen, "algorithm": algorithm})
+        );
     } else {
         println!("next rotation for {agent} [{algorithm}]: {chosen}");
     }
@@ -569,11 +608,12 @@ pub fn pick(agent: &str) {
     std::io::stdout().flush().ok();
     let mut input = String::new();
     std::io::stdin().read_line(&mut input).ok();
-    if let Ok(idx) = input.trim().parse::<usize>() {
-        if idx > 0 && idx <= profiles.len() {
-            activate(agent, &profiles[idx - 1], false);
-            return;
-        }
+    if let Ok(idx) = input.trim().parse::<usize>()
+        && idx > 0
+        && idx <= profiles.len()
+    {
+        activate(agent, &profiles[idx - 1], false);
+        return;
     }
     eprintln!("invalid selection");
 }
@@ -583,7 +623,10 @@ pub fn cooldown_set(target: &str, minutes: Option<u32>, json: bool) {
         Some(p) => p,
         None => {
             if json {
-                println!("{}", serde_json::json!({"error": "expected <agent>/<profile>"}));
+                println!(
+                    "{}",
+                    serde_json::json!({"error": "expected <agent>/<profile>"})
+                );
             } else {
                 eprintln!("error: expected <agent>/<profile>");
             }
@@ -642,7 +685,10 @@ pub fn cooldown_clear(target: &str, json: bool) {
         Some(p) => p,
         None => {
             if json {
-                println!("{}", serde_json::json!({"error": "expected <agent>/<profile>"}));
+                println!(
+                    "{}",
+                    serde_json::json!({"error": "expected <agent>/<profile>"})
+                );
             } else {
                 eprintln!("error: expected <agent>/<profile>");
             }
@@ -662,7 +708,9 @@ pub fn cooldown_clear(target: &str, json: bool) {
 }
 
 fn parse_target(target: &str) -> Option<(String, String)> {
-    if target.is_empty() { return None; }
+    if target.is_empty() {
+        return None;
+    }
     let parts: Vec<&str> = target.splitn(2, '/').collect();
     if parts.len() == 2 && !parts[0].is_empty() && !parts[1].is_empty() {
         Some((parts[0].to_string(), parts[1].to_string()))
@@ -739,7 +787,11 @@ pub fn project_unset(agent: &str, json: bool) {
 const ISOLATE_DIR: &str = "isolate";
 
 fn isolates_dir() -> PathBuf {
-    home().join(".local").join("share").join("agentflare").join(ISOLATE_DIR)
+    home()
+        .join(".local")
+        .join("share")
+        .join("agentflare")
+        .join(ISOLATE_DIR)
 }
 
 pub fn isolate_add(agent: &str, profile: &str, json: bool) {
@@ -750,7 +802,10 @@ pub fn isolate_add_with(agent: &str, profile: &str, shallow: bool, json: bool) {
     let dir = isolates_dir().join(agent).join(profile);
     if dir.exists() {
         if json {
-            println!("{}", serde_json::json!({"error": "isolated profile already exists"}));
+            println!(
+                "{}",
+                serde_json::json!({"error": "isolated profile already exists"})
+            );
         } else {
             eprintln!("isolated profile '{agent}/{profile}' already exists");
         }
@@ -782,12 +837,22 @@ pub fn isolate_add_with(agent: &str, profile: &str, shallow: bool, json: bool) {
 
     // Store metadata
     let meta = serde_json::json!({"mode": if shallow { "shallow" } else { "deep" }, "agent": agent, "profile": profile});
-    fs::write(dir.join("isolate.json"), serde_json::to_string_pretty(&meta).unwrap() + "\n").ok();
+    fs::write(
+        dir.join("isolate.json"),
+        serde_json::to_string_pretty(&meta).unwrap() + "\n",
+    )
+    .ok();
 
     if json {
-        println!("{}", serde_json::json!({"agent": agent, "profile": profile, "isolate_dir": dir.to_string_lossy()}));
+        println!(
+            "{}",
+            serde_json::json!({"agent": agent, "profile": profile, "isolate_dir": dir.to_string_lossy()})
+        );
     } else {
-        println!("isolated profile created: {agent}/{profile} at {}", dir.display());
+        println!(
+            "isolated profile created: {agent}/{profile} at {}",
+            dir.display()
+        );
     }
 }
 
@@ -804,14 +869,22 @@ pub fn isolate_ls(agent: Option<&str>, json: bool) {
     let mut results: Vec<serde_json::Value> = Vec::new();
     let agents: Vec<String> = match agent {
         Some(a) => vec![a.to_string()],
-        None => fs::read_dir(&dir).ok().map(|entries| {
-            entries.flatten().filter(|e| e.file_type().map(|t| t.is_dir()).unwrap_or(false))
-                .map(|e| e.file_name().to_string_lossy().to_string()).collect()
-        }).unwrap_or_default(),
+        None => fs::read_dir(&dir)
+            .ok()
+            .map(|entries| {
+                entries
+                    .flatten()
+                    .filter(|e| e.file_type().map(|t| t.is_dir()).unwrap_or(false))
+                    .map(|e| e.file_name().to_string_lossy().to_string())
+                    .collect()
+            })
+            .unwrap_or_default(),
     };
     for a in &agents {
         let agent_dir = dir.join(a);
-        if !agent_dir.exists() { continue; }
+        if !agent_dir.exists() {
+            continue;
+        }
         if let Ok(entries) = fs::read_dir(&agent_dir) {
             for entry in entries.flatten() {
                 if entry.file_type().map(|t| t.is_dir()).unwrap_or(false) {
@@ -844,7 +917,10 @@ pub fn isolate_delete(agent: &str, profile: &str, json: bool) {
     }
     fs::remove_dir_all(&dir).expect("remove isolate dir");
     if json {
-        println!("{}", serde_json::json!({"deleted": true, "agent": agent, "profile": profile}));
+        println!(
+            "{}",
+            serde_json::json!({"deleted": true, "agent": agent, "profile": profile})
+        );
     } else {
         println!("deleted isolated profile: {agent}/{profile}");
     }
@@ -854,9 +930,14 @@ pub fn auth_exec(agent: &str, profile: &str, args: &[String], json: bool) {
     let dir = isolates_dir().join(agent).join(profile);
     if !dir.exists() {
         if json {
-            println!("{}", serde_json::json!({"error": "isolated profile not found"}));
+            println!(
+                "{}",
+                serde_json::json!({"error": "isolated profile not found"})
+            );
         } else {
-            eprintln!("error: isolated profile '{agent}/{profile}' not found — run 'auth isolate add' first");
+            eprintln!(
+                "error: isolated profile '{agent}/{profile}' not found — run 'auth isolate add' first"
+            );
         }
         return;
     }
@@ -878,13 +959,10 @@ pub fn auth_exec(agent: &str, profile: &str, args: &[String], json: bool) {
         cmd.env("HOMEDRIVE", "");
         cmd.env("HOMEPATH", &dir);
     }
-    let status = cmd
-        .spawn()
-        .and_then(|mut c| c.wait())
-        .unwrap_or_else(|e| {
-            eprintln!("error: {e}");
-            std::process::exit(1);
-        });
+    let status = cmd.spawn().and_then(|mut c| c.wait()).unwrap_or_else(|e| {
+        eprintln!("error: {e}");
+        std::process::exit(1);
+    });
 
     if !status.success() {
         std::process::exit(status.code().unwrap_or(1));
@@ -915,18 +993,20 @@ pub fn auth_login(agent: &str, profile: &str, args: &[String], json: bool) {
         cmd.env("HOMEDRIVE", "");
         cmd.env("HOMEPATH", &dir);
     }
-    let status = cmd
-        .spawn()
-        .and_then(|mut c| c.wait())
-        .unwrap_or_else(|e| {
-            eprintln!("error: {e}");
-            std::process::exit(1);
-        });
+    let status = cmd.spawn().and_then(|mut c| c.wait()).unwrap_or_else(|e| {
+        eprintln!("error: {e}");
+        std::process::exit(1);
+    });
 
     if status.success() {
         let passphrase = auth_crypt::get_passphrase();
         let dir = isolates_dir().join(agent).join(profile);
-        for &rel in CATALOG.iter().find(|c| c.agent_key == agent).map(|c| c.files).unwrap_or(&[]) {
+        for &rel in CATALOG
+            .iter()
+            .find(|c| c.agent_key == agent)
+            .map(|c| c.files)
+            .unwrap_or(&[])
+        {
             let dest = profile_dir(agent, profile).join(rel.rsplit('/').next().unwrap_or(rel));
             let src = dir.join(rel);
             if src.exists() {
@@ -948,19 +1028,23 @@ pub fn auth_login(agent: &str, profile: &str, args: &[String], json: bool) {
     }
 }
 
-
 fn read_isolate_mode(dir: &std::path::Path) -> Option<String> {
     let meta_path = dir.join("isolate.json");
-    if let Ok(data) = fs::read_to_string(&meta_path) {
-        if let Ok(meta) = serde_json::from_str::<serde_json::Value>(&data) {
-            return meta["mode"].as_str().map(|s| s.to_string());
-        }
+    if let Ok(data) = fs::read_to_string(&meta_path)
+        && let Ok(meta) = serde_json::from_str::<serde_json::Value>(&data)
+    {
+        return meta["mode"].as_str().map(|s| s.to_string());
     }
     None
 }
 
 fn activate_into(agent: &str, profile: &str, target_dir: &std::path::Path) {
-    let cat = match catalog_for(agent) { Some(c) => c, None => { return; } };
+    let cat = match catalog_for(agent) {
+        Some(c) => c,
+        None => {
+            return;
+        }
+    };
     let vault = profile_dir(agent, profile);
     let passphrase = auth_crypt::get_passphrase();
     for &rel in cat.files {
@@ -976,11 +1060,17 @@ fn activate_into(agent: &str, profile: &str, target_dir: &std::path::Path) {
                     if let Some(decrypted) = auth_crypt::decrypt(&data, pw) {
                         fs::write(&dest, decrypted).expect("write");
                     } else {
-                        eprintln!("warning: cannot decrypt {} — wrong passphrase", src.display());
+                        eprintln!(
+                            "warning: cannot decrypt {} — wrong passphrase",
+                            src.display()
+                        );
                         continue;
                     }
                 } else {
-                    eprintln!("warning: {} is encrypted but no passphrase set", src.display());
+                    eprintln!(
+                        "warning: {} is encrypted but no passphrase set",
+                        src.display()
+                    );
                     continue;
                 }
             } else {
@@ -1171,13 +1261,19 @@ mod tests {
 
     #[test]
     fn parse_target_validates() {
-        assert_eq!(parse_target("claude-code/alice"), Some(("claude-code".to_string(), "alice".to_string())));
+        assert_eq!(
+            parse_target("claude-code/alice"),
+            Some(("claude-code".to_string(), "alice".to_string()))
+        );
         assert_eq!(parse_target(""), None);
         assert_eq!(parse_target("/"), None);
         assert_eq!(parse_target("a/"), None);
         assert_eq!(parse_target("/b"), None);
         assert_eq!(parse_target("no-slash"), None);
-        assert_eq!(parse_target("a/b/c"), Some(("a".to_string(), "b/c".to_string())));
+        assert_eq!(
+            parse_target("a/b/c"),
+            Some(("a".to_string(), "b/c".to_string()))
+        );
     }
 
     #[test]
diff --git a/src/auth_crypt.rs b/src/auth_crypt.rs
index ada4040e..89987929 100644
--- a/src/auth_crypt.rs
+++ b/src/auth_crypt.rs
@@ -10,10 +10,10 @@ const NONCE_SIZE: usize = 12;
 const ITERATIONS: u32 = 600_000;
 
 pub fn get_passphrase() -> Option<String> {
-    if let Ok(pw) = std::env::var("AGENTFLARE_VAULT_PASSPHRASE") {
-        if !pw.is_empty() {
-            return Some(pw);
-        }
+    if let Ok(pw) = std::env::var("AGENTFLARE_VAULT_PASSPHRASE")
+        && !pw.is_empty()
+    {
+        return Some(pw);
     }
     prompt_passphrase()
 }
@@ -25,7 +25,11 @@ fn prompt_passphrase() -> Option<String> {
     }
     let pw = rpassword::prompt_password("vault passphrase: ").unwrap_or_default();
     let trimmed = pw.trim().to_string();
-    if trimmed.is_empty() { None } else { Some(trimmed) }
+    if trimmed.is_empty() {
+        None
+    } else {
+        Some(trimmed)
+    }
 }
 
 fn derive_key(passphrase: &str, salt: &[u8]) -> [u8; 32] {
diff --git a/src/auth_db.rs b/src/auth_db.rs
index 323b8f00..951e7193 100644
--- a/src/auth_db.rs
+++ b/src/auth_db.rs
@@ -1,5 +1,5 @@
 use crate::paths::home;
-use rusqlite::{params, Connection, Result as SqlResult};
+use rusqlite::{Connection, Result as SqlResult, params};
 use std::path::PathBuf;
 
 const SCHEMA_VERSION: i32 = 1;
@@ -11,6 +11,7 @@ pub struct CooldownRow {
     pub reason: Option<String>,
 }
 
+#[allow(dead_code)]
 pub struct ProfileHealth {
     pub agent: String,
     pub profile: String,
@@ -21,7 +22,11 @@ pub struct ProfileHealth {
 }
 
 fn db_path() -> PathBuf {
-    home().join(".local").join("share").join("agentflare").join("auth.db")
+    home()
+        .join(".local")
+        .join("share")
+        .join("agentflare")
+        .join("auth.db")
 }
 
 pub fn migrate(conn: &Connection) -> SqlResult<()> {
@@ -105,9 +110,13 @@ fn penalty_for_error(msg: &str) -> f64 {
         10.0
     } else if m.contains("401") || m.contains("403") || m.contains("unauthorized") {
         100.0
-    } else if m.contains("timeout") || m.contains("deadline exceeded") {
-        5.0
-    } else if m.contains("500") || m.contains("502") || m.contains("503") || m.contains("504") {
+    } else if m.contains("timeout")
+        || m.contains("deadline exceeded")
+        || m.contains("500")
+        || m.contains("502")
+        || m.contains("503")
+        || m.contains("504")
+    {
         5.0
     } else {
         3.0
@@ -259,6 +268,7 @@ pub fn clear_cooldown(conn: &Connection, agent: &str, profile: &str) {
     .ok();
 }
 
+#[allow(dead_code)]
 pub fn get_health(conn: &Connection, agent: &str, profile: &str) -> ProfileHealth {
     conn.query_row(
         "SELECT agent, profile, status, error_count_1h, penalty, last_used_at FROM profile_health WHERE agent = ?1 AND profile = ?2",
@@ -484,10 +494,7 @@ mod tests {
             let conn = open_or_rebuild();
             set_rotation_last(&conn, "claude-code", "alice", "smart");
             let last = get_rotation_last(&conn, "claude-code");
-            assert_eq!(
-                last,
-                Some(("alice".to_string(), "smart".to_string()))
-            );
+            assert_eq!(last, Some(("alice".to_string(), "smart".to_string())));
         });
     }
 }
diff --git a/src/auth_runner.rs b/src/auth_runner.rs
index d27c521a..8c32d674 100644
--- a/src/auth_runner.rs
+++ b/src/auth_runner.rs
@@ -7,8 +7,13 @@ use std::thread;
 use std::time::Duration;
 
 const RATE_LIMIT_PATTERNS: &[&str] = &[
-    "429", "rate limit", "too many requests", "quota exceeded",
-    "usage limit", "billing limit", "try again",
+    "429",
+    "rate limit",
+    "too many requests",
+    "quota exceeded",
+    "usage limit",
+    "billing limit",
+    "try again",
 ];
 const MAX_RETRIES: usize = 5;
 
@@ -89,12 +94,10 @@ fn spawn_and_capture(agent: &str, args: &[String]) -> (i32, String) {
     thread::spawn(move || {
         let reader = BufReader::new(stderr_handle);
         let mut buf = String::new();
-        for line in reader.lines() {
-            if let Ok(l) = line {
-                eprintln!("{l}");
-                buf.push_str(&l);
-                buf.push('\n');
-            }
+        for l in reader.lines().map_while(Result::ok) {
+            eprintln!("{l}");
+            buf.push_str(&l);
+            buf.push('\n');
         }
         tx.send(buf).ok();
     });
@@ -117,10 +120,7 @@ pub fn daemon_running(agent: &str) -> bool {
         "claude-code" => &["claude"][..],
         _ => return false,
     };
-    if let Ok(output) = std::process::Command::new("pgrep")
-        .args(names)
-        .output()
-    {
+    if let Ok(output) = std::process::Command::new("pgrep").args(names).output() {
         return !output.stdout.is_empty();
     }
     if let Ok(output) = std::process::Command::new("tasklist")
@@ -153,9 +153,7 @@ pub fn reload_daemon(agent: &str) -> Result<(), DaemonError> {
     }
     #[cfg(not(windows))]
     {
-        std::process::Command::new("pkill")
-            .args(names)
-            .output()?;
+        std::process::Command::new("pkill").args(names).output()?;
     }
     Ok(())
 }
diff --git a/src/build_time.rs b/src/build_time.rs
index 29ac7358..89228d15 100644
--- a/src/build_time.rs
+++ b/src/build_time.rs
@@ -5,10 +5,9 @@ pub mod built_info {
     include!(concat!(env!("OUT_DIR"), "/built.rs"));
 }
 
-pub static BUILD_TIME: Lazy<DateTime<FixedOffset>> =
-    Lazy::new(|| {
-        DateTime::parse_from_rfc2822(built_info::BUILT_TIME_UTC)
-            .expect("built_info::BUILT_TIME_UTC should always be a valid RFC2822 timestamp")
-    });
+pub static BUILD_TIME: Lazy<DateTime<FixedOffset>> = Lazy::new(|| {
+    DateTime::parse_from_rfc2822(built_info::BUILT_TIME_UTC)
+        .expect("built_info::BUILT_TIME_UTC should always be a valid RFC2822 timestamp")
+});
 
 pub static TARGET: &str = built_info::TARGET;
diff --git a/src/channels.rs b/src/channels.rs
index 69ee24bd..62f6879d 100644
--- a/src/channels.rs
+++ b/src/channels.rs
@@ -10,7 +10,7 @@
 //! - Slack:    `POST slack.com/api/chat.postMessage`  body `{channel, text}`    (Authorization: Bearer)
 //! - Discord:  `POST discord.com/api/v10/channels/{id}/messages`  body `{content}` (Authorization: Bot)
 
-use serde_json::{json, Value};
+use serde_json::{Value, json};
 
 /// A supported outbound chat platform.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
@@ -177,7 +177,9 @@ pub fn send_message(
     let token = crate::gateway_secrets::get_secret(conn, name)
         .map_err(|e| e.to_string())?
         .ok_or_else(|| {
-            format!("no {name} configured — store the bot token as the gateway secret '{name}' first")
+            format!(
+                "no {name} configured — store the bot token as the gateway secret '{name}' first"
+            )
         })?;
     let req = build_request(platform, target, text, &token);
     send(platform, &req)
@@ -239,9 +241,16 @@ mod tests {
     #[test]
     fn interpret_slack_checks_the_ok_field_even_on_http_200() {
         assert!(interpret_response(Platform::Slack, 200, r#"{"ok":true,"ts":"1"}"#).is_ok());
-        let err = interpret_response(Platform::Slack, 200, r#"{"ok":false,"error":"channel_not_found"}"#)
-            .unwrap_err();
-        assert!(err.contains("channel_not_found"), "error should surface Slack's reason: {err}");
+        let err = interpret_response(
+            Platform::Slack,
+            200,
+            r#"{"ok":false,"error":"channel_not_found"}"#,
+        )
+        .unwrap_err();
+        assert!(
+            err.contains("channel_not_found"),
+            "error should surface Slack's reason: {err}"
+        );
     }
 
     #[test]
@@ -268,9 +277,18 @@ mod tests {
         );
 
         let msg = describe_send_error(Platform::Telegram, &err);
-        assert!(!msg.contains(token), "error message must not leak the bot token: {msg}");
-        assert!(!msg.contains(&url), "error message must not leak the request URL: {msg}");
-        assert!(msg.contains("Telegram"), "error message should name the platform: {msg}");
+        assert!(
+            !msg.contains(token),
+            "error message must not leak the bot token: {msg}"
+        );
+        assert!(
+            !msg.contains(&url),
+            "error message must not leak the request URL: {msg}"
+        );
+        assert!(
+            msg.contains("Telegram"),
+            "error message should name the platform: {msg}"
+        );
     }
 
     #[test]
diff --git a/src/claims.rs b/src/claims.rs
index f53102a6..559a28f5 100644
--- a/src/claims.rs
+++ b/src/claims.rs
@@ -4,7 +4,7 @@
 //! stale-steal are ONE atomic statement, which a filesystem lock can't give
 //! for the steal case. Models [Beads](https://github.com/gastownhall/beads)'s
 //! claim/close model, minus the full issue-tracker surface.
-use rusqlite::{params, Connection, OptionalExtension};
+use rusqlite::{Connection, params};
 
 /// Default lease: a claim whose owner hasn't heartbeat within this window is
 /// stealable, so a crashed/hung agent can't wedge a target forever.
@@ -86,13 +86,22 @@ pub fn acquire(
     Ok(if row_owner == owner {
         Acquire::Acquired
     } else {
-        Acquire::Held { owner: row_owner, age_secs: now - heartbeat_at }
+        Acquire::Held {
+            owner: row_owner,
+            age_secs: now - heartbeat_at,
+        }
     })
 }
 
 /// Refreshes the lease on a claim we own. Returns false if the claim is gone
 /// or owned by someone else (don't heartbeat what isn't yours).
-pub fn heartbeat(conn: &Connection, repo: &str, target: &str, owner: &str, now: i64) -> rusqlite::Result<bool> {
+pub fn heartbeat(
+    conn: &Connection,
+    repo: &str,
+    target: &str,
+    owner: &str,
+    now: i64,
+) -> rusqlite::Result<bool> {
     let changed = conn.execute(
         "UPDATE claims SET heartbeat_at = ?4 WHERE repo = ?1 AND target = ?2 AND owner = ?3",
         params![repo, target, owner, now],
@@ -110,7 +119,13 @@ pub fn release(conn: &Connection, repo: &str, target: &str, owner: &str) -> rusq
 }
 
 /// Marks our claim done (kept for audit; a done target is re-acquirable).
-pub fn done(conn: &Connection, repo: &str, target: &str, owner: &str, now: i64) -> rusqlite::Result<bool> {
+pub fn done(
+    conn: &Connection,
+    repo: &str,
+    target: &str,
+    owner: &str,
+    now: i64,
+) -> rusqlite::Result<bool> {
     let changed = conn.execute(
         "UPDATE claims SET status = 'done', heartbeat_at = ?4 WHERE repo = ?1 AND target = ?2 AND owner = ?3",
         params![repo, target, owner, now],
@@ -153,7 +168,9 @@ pub fn list(
     Ok(if include_stale {
         all
     } else {
-        all.into_iter().filter(|c| c.status == "claimed" && !c.stale).collect()
+        all.into_iter()
+            .filter(|c| c.status == "claimed" && !c.stale)
+            .collect()
     })
 }
 
@@ -209,7 +226,10 @@ pub fn normalize_repo(remote_url: &str) -> String {
         // scp-like: host:owner/name
         Some((_host, path)) if !path.starts_with('/') => path,
         // https-like: host/owner/name  (or host:port/owner/name)
-        _ => after_scheme.splitn(2, '/').nth(1).unwrap_or(after_scheme),
+        _ => after_scheme
+            .split_once('/')
+            .map(|x| x.1)
+            .unwrap_or(after_scheme),
     };
     let path = path.trim_start_matches('/').trim_end_matches(".git");
     // Keep the last two segments (owner/name); fall back to whatever's there.
@@ -283,7 +303,9 @@ mod tests {
             acquire(&c, "o/r", "issue#1", "b:2", None, 1000 + TTL + 1, TTL).unwrap(),
             Acquire::Acquired
         );
-        let owner: String = c.query_row("SELECT owner FROM claims", [], |r| r.get(0)).unwrap();
+        let owner: String = c
+            .query_row("SELECT owner FROM claims", [], |r| r.get(0))
+            .unwrap();
         assert_eq!(owner, "b:2");
     }
 
@@ -337,11 +359,26 @@ mod tests {
 
     #[test]
     fn normalize_repo_handles_https_ssh_alias_and_dotgit() {
-        assert_eq!(normalize_repo("https://github.com/getappz/agentflare.git"), "getappz/agentflare");
-        assert_eq!(normalize_repo("https://github.com/getappz/agentflare"), "getappz/agentflare");
-        assert_eq!(normalize_repo("git@github.com:getappz/agentflare.git"), "getappz/agentflare");
+        assert_eq!(
+            normalize_repo("https://github.com/getappz/agentflare.git"),
+            "getappz/agentflare"
+        );
+        assert_eq!(
+            normalize_repo("https://github.com/getappz/agentflare"),
+            "getappz/agentflare"
+        );
+        assert_eq!(
+            normalize_repo("git@github.com:getappz/agentflare.git"),
+            "getappz/agentflare"
+        );
         // SSH host alias (this repo's real remote shape).
-        assert_eq!(normalize_repo("git@github-appzdev:getappz/agentflare.git"), "getappz/agentflare");
-        assert_eq!(normalize_repo("ssh://git@github.com/getappz/agentflare.git"), "getappz/agentflare");
+        assert_eq!(
+            normalize_repo("git@github-appzdev:getappz/agentflare.git"),
+            "getappz/agentflare"
+        );
+        assert_eq!(
+            normalize_repo("ssh://git@github.com/getappz/agentflare.git"),
+            "getappz/agentflare"
+        );
     }
 }
diff --git a/src/cli/agents.rs b/src/cli/agents.rs
index e53e8e25..aed9fe6d 100644
--- a/src/cli/agents.rs
+++ b/src/cli/agents.rs
@@ -49,10 +49,15 @@ impl AgentsArgs {
             AgentsAction::Doctor { json } => crate::agents::cli_doctor(json),
             AgentsAction::Install { agent, dry_run } => crate::agents::cli_install(&agent, dry_run),
             AgentsAction::Update { agent, dry_run } => crate::agents::cli_update(&agent, dry_run),
-            AgentsAction::Uninstall { agent, dry_run } => crate::agents::cli_uninstall(&agent, dry_run),
-            AgentsAction::Launch { agent, model, mode, args } => {
-                crate::agents::cli_launch(&agent, model.as_deref(), mode.as_deref(), &args)
+            AgentsAction::Uninstall { agent, dry_run } => {
+                crate::agents::cli_uninstall(&agent, dry_run)
             }
+            AgentsAction::Launch {
+                agent,
+                model,
+                mode,
+                args,
+            } => crate::agents::cli_launch(&agent, model.as_deref(), mode.as_deref(), &args),
         }
     }
 }
diff --git a/src/cli/auth.rs b/src/cli/auth.rs
index 8020bbb7..5c480185 100644
--- a/src/cli/auth.rs
+++ b/src/cli/auth.rs
@@ -177,45 +177,99 @@ pub struct AuthArgs {
 impl AuthArgs {
     pub fn run(self) {
         match self.action {
-            AuthAction::Backup { agent, profile, json } => crate::auth::backup(&agent, &profile, json),
-            AuthAction::Activate { agent, profile, json, reload_daemon } => {
-                crate::auth::activate_with(&agent, &profile, reload_daemon, json)
-            }
+            AuthAction::Backup {
+                agent,
+                profile,
+                json,
+            } => crate::auth::backup(&agent, &profile, json),
+            AuthAction::Activate {
+                agent,
+                profile,
+                json,
+                reload_daemon,
+            } => crate::auth::activate_with(&agent, &profile, reload_daemon, json),
             AuthAction::Status { agent, json } => crate::auth::status(agent.as_deref(), json),
             AuthAction::Catalog { json } => crate::auth::list_agents(json),
             AuthAction::Ls { agent, json } => crate::auth::ls(&agent, json),
             AuthAction::Clear { agent, json } => crate::auth::clear(&agent, json),
-            AuthAction::Delete { agent, profile, json } => crate::auth::delete(&agent, &profile, json),
-            AuthAction::Rename { agent, old, new, json } => crate::auth::rename(&agent, &old, &new, json),
-            AuthAction::Rotate { agent, algorithm, json } => crate::auth::rotate(&agent, &algorithm, json),
-            AuthAction::Next { agent, algorithm, json } => crate::auth::next(&agent, &algorithm, json),
+            AuthAction::Delete {
+                agent,
+                profile,
+                json,
+            } => crate::auth::delete(&agent, &profile, json),
+            AuthAction::Rename {
+                agent,
+                old,
+                new,
+                json,
+            } => crate::auth::rename(&agent, &old, &new, json),
+            AuthAction::Rotate {
+                agent,
+                algorithm,
+                json,
+            } => crate::auth::rotate(&agent, &algorithm, json),
+            AuthAction::Next {
+                agent,
+                algorithm,
+                json,
+            } => crate::auth::next(&agent, &algorithm, json),
             AuthAction::Pick { agent } => crate::auth::pick(&agent),
             AuthAction::Cooldown { action } => match action {
-                CooldownAction::Set { target, minutes, json } => crate::auth::cooldown_set(&target, minutes, json),
-                CooldownAction::List { agent, json } => crate::auth::cooldown_list(agent.as_deref(), json),
-                CooldownAction::Clear { target, json } => crate::auth::cooldown_clear(&target, json),
+                CooldownAction::Set {
+                    target,
+                    minutes,
+                    json,
+                } => crate::auth::cooldown_set(&target, minutes, json),
+                CooldownAction::List { agent, json } => {
+                    crate::auth::cooldown_list(agent.as_deref(), json)
+                }
+                CooldownAction::Clear { target, json } => {
+                    crate::auth::cooldown_clear(&target, json)
+                }
             },
-            AuthAction::Alias { agent, profile, alias, json } => {
-                crate::auth::set_alias_cmd(&agent, &profile, &alias, json)
-            }
+            AuthAction::Alias {
+                agent,
+                profile,
+                alias,
+                json,
+            } => crate::auth::set_alias_cmd(&agent, &profile, &alias, json),
             AuthAction::Project { action } => match action {
-                ProjectAction::Set { agent, profile, json } => crate::auth::project_set(&agent, &profile, json),
+                ProjectAction::Set {
+                    agent,
+                    profile,
+                    json,
+                } => crate::auth::project_set(&agent, &profile, json),
                 ProjectAction::Unset { agent, json } => crate::auth::project_unset(&agent, json),
             },
             AuthAction::Run { agent, json, args } => crate::auth_runner::run(&agent, &args, json),
             AuthAction::Isolate { action } => match action {
-                IsolateAction::Add { agent, profile, json, shallow } => {
-                    crate::auth::isolate_add_with(&agent, &profile, shallow, json)
+                IsolateAction::Add {
+                    agent,
+                    profile,
+                    json,
+                    shallow,
+                } => crate::auth::isolate_add_with(&agent, &profile, shallow, json),
+                IsolateAction::Ls { agent, json } => {
+                    crate::auth::isolate_ls(agent.as_deref(), json)
                 }
-                IsolateAction::Ls { agent, json } => crate::auth::isolate_ls(agent.as_deref(), json),
-                IsolateAction::Delete { agent, profile, json } => crate::auth::isolate_delete(&agent, &profile, json),
+                IsolateAction::Delete {
+                    agent,
+                    profile,
+                    json,
+                } => crate::auth::isolate_delete(&agent, &profile, json),
             },
-            AuthAction::Exec { agent, profile, json, args } => {
-                crate::auth::auth_exec(&agent, &profile, &args, json)
-            }
-            AuthAction::Login { agent, profile, json, args } => {
-                crate::auth::auth_login(&agent, &profile, &args, json)
-            }
+            AuthAction::Exec {
+                agent,
+                profile,
+                json,
+                args,
+            } => crate::auth::auth_exec(&agent, &profile, &args, json),
+            AuthAction::Login {
+                agent,
+                profile,
+                json,
+                args,
+            } => crate::auth::auth_login(&agent, &profile, &args, json),
         }
     }
 }
diff --git a/src/cli/caveman.rs b/src/cli/caveman.rs
index 76d64d61..a6933700 100644
--- a/src/cli/caveman.rs
+++ b/src/cli/caveman.rs
@@ -27,7 +27,12 @@ pub struct CavemanArgs {
 impl CavemanArgs {
     pub fn run(self) {
         match self.action {
-            CavemanAction::Compress { source, target, spec_file, backup } => {
+            CavemanAction::Compress {
+                source,
+                target,
+                spec_file,
+                backup,
+            } => {
                 let target = target.unwrap_or_else(|| source.clone());
                 let prompt = match &spec_file {
                     Some(path) => match std::fs::read_to_string(path) {
@@ -47,12 +52,16 @@ impl CavemanArgs {
                         std::process::exit(1);
                     }
                 };
-                let result = caveman::compress(&caveman::RealLlm, &source, &target, prompt, backup_mode);
+                let result =
+                    caveman::compress(&caveman::RealLlm, &source, &target, prompt, backup_mode);
                 match result {
                     Ok(report) => {
                         let ratio = 100 * report.compressed_bytes / report.original_bytes.max(1);
                         let pct = 100usize.saturating_sub(ratio);
-                        println!("{}→{}B ▼{pct}%", report.original_bytes, report.compressed_bytes);
+                        println!(
+                            "{}→{}B ▼{pct}%",
+                            report.original_bytes, report.compressed_bytes
+                        );
                     }
                     Err(e) => {
                         eprintln!("{e}");
diff --git a/src/cli/channel.rs b/src/cli/channel.rs
index aa9b02ad..0e63cc44 100644
--- a/src/cli/channel.rs
+++ b/src/cli/channel.rs
@@ -26,9 +26,15 @@ pub enum ChannelAction {
 impl ChannelArgs {
     pub fn run(self) {
         match self.action {
-            ChannelAction::Send { to, target, message } => {
+            ChannelAction::Send {
+                to,
+                target,
+                message,
+            } => {
                 let Some(platform) = crate::channels::Platform::parse(&to) else {
-                    eprintln!("error: unknown platform '{to}' (expected telegram, slack, or discord)");
+                    eprintln!(
+                        "error: unknown platform '{to}' (expected telegram, slack, or discord)"
+                    );
                     std::process::exit(1);
                 };
                 let conn = match crate::db::open() {
diff --git a/src/cli/claim.rs b/src/cli/claim.rs
index 0c286889..ede7263b 100644
--- a/src/cli/claim.rs
+++ b/src/cli/claim.rs
@@ -70,12 +70,25 @@ impl ClaimArgs {
                 // repository, so HEAD here would be misleading provenance.
                 let commit = if repo.is_none() { git_commit() } else { None };
                 let repo = require_repo(repo);
-                match crate::claims::acquire(&conn, &repo, &target, &owner, commit.as_deref(), now, ttl) {
+                match crate::claims::acquire(
+                    &conn,
+                    &repo,
+                    &target,
+                    &owner,
+                    commit.as_deref(),
+                    now,
+                    ttl,
+                ) {
                     Ok(crate::claims::Acquire::Acquired) => {
                         println!("claimed {repo} {target}  (owner {owner})");
                     }
-                    Ok(crate::claims::Acquire::Held { owner: holder, age_secs }) => {
-                        eprintln!("{repo} {target} already held by {holder} ({age_secs}s since heartbeat)");
+                    Ok(crate::claims::Acquire::Held {
+                        owner: holder,
+                        age_secs,
+                    }) => {
+                        eprintln!(
+                            "{repo} {target} already held by {holder} ({age_secs}s since heartbeat)"
+                        );
                         std::process::exit(1);
                     }
                     Err(e) => fail(e),
@@ -83,18 +96,44 @@ impl ClaimArgs {
             }
             ClaimAction::Heartbeat { target, repo } => {
                 let repo = require_repo(repo);
-                report(crate::claims::heartbeat(&conn, &repo, &target, &owner, now), "heartbeat", &repo, &target, &owner);
+                report(
+                    crate::claims::heartbeat(&conn, &repo, &target, &owner, now),
+                    "heartbeat",
+                    &repo,
+                    &target,
+                    &owner,
+                );
             }
             ClaimAction::Release { target, repo } => {
                 let repo = require_repo(repo);
-                report(crate::claims::release(&conn, &repo, &target, &owner), "released", &repo, &target, &owner);
+                report(
+                    crate::claims::release(&conn, &repo, &target, &owner),
+                    "released",
+                    &repo,
+                    &target,
+                    &owner,
+                );
             }
             ClaimAction::Done { target, repo } => {
                 let repo = require_repo(repo);
-                report(crate::claims::done(&conn, &repo, &target, &owner, now), "done", &repo, &target, &owner);
+                report(
+                    crate::claims::done(&conn, &repo, &target, &owner, now),
+                    "done",
+                    &repo,
+                    &target,
+                    &owner,
+                );
             }
-            ClaimAction::List { repo, all, all_repos } => {
-                let scope = if all_repos { None } else { Some(require_repo(repo)) };
+            ClaimAction::List {
+                repo,
+                all,
+                all_repos,
+            } => {
+                let scope = if all_repos {
+                    None
+                } else {
+                    Some(require_repo(repo))
+                };
                 match crate::claims::list(&conn, scope.as_deref(), all, now, ttl) {
                     Ok(claims) if claims.is_empty() => println!("no claims"),
                     Ok(claims) => {
@@ -130,7 +169,9 @@ fn report(res: rusqlite::Result<bool>, verb: &str, repo: &str, target: &str, own
 
 fn require_repo(explicit: Option<String>) -> String {
     crate::claims::resolve_repo(explicit).unwrap_or_else(|| {
-        eprintln!("claim: could not determine repo — run inside a git repo or pass --repo owner/name");
+        eprintln!(
+            "claim: could not determine repo — run inside a git repo or pass --repo owner/name"
+        );
         std::process::exit(1);
     })
 }
diff --git a/src/cli/coaching.rs b/src/cli/coaching.rs
index b50f936c..b02f9a65 100644
--- a/src/cli/coaching.rs
+++ b/src/cli/coaching.rs
@@ -25,7 +25,9 @@ impl CoachingArgs {
     pub fn run(self) {
         match self.action {
             CoachingAction::List => crate::coaching::print_list(),
-            CoachingAction::Apply { id, title, body } => crate::coaching::cli_apply(&id, &title, &body),
+            CoachingAction::Apply { id, title, body } => {
+                crate::coaching::cli_apply(&id, &title, &body)
+            }
             CoachingAction::Remove { id } => crate::coaching::cli_remove(&id),
         }
     }
diff --git a/src/cli/gateway.rs b/src/cli/gateway.rs
index a4de1b86..07e2465b 100644
--- a/src/cli/gateway.rs
+++ b/src/cli/gateway.rs
@@ -74,16 +74,18 @@ fn run_secret(action: GatewaySecretAction) {
                 std::process::exit(1);
             }
         },
-        GatewaySecretAction::Remove { name } => match crate::gateway_secrets::remove_secret(&conn, &name) {
-            Ok(true) => println!("removed secret '{name}'"),
-            Ok(false) => {
-                eprintln!("no secret named '{name}'");
-                std::process::exit(1);
-            }
-            Err(e) => {
-                eprintln!("failed to remove secret: {e}");
-                std::process::exit(1);
+        GatewaySecretAction::Remove { name } => {
+            match crate::gateway_secrets::remove_secret(&conn, &name) {
+                Ok(true) => println!("removed secret '{name}'"),
+                Ok(false) => {
+                    eprintln!("no secret named '{name}'");
+                    std::process::exit(1);
+                }
+                Err(e) => {
+                    eprintln!("failed to remove secret: {e}");
+                    std::process::exit(1);
+                }
             }
-        },
+        }
     }
 }
diff --git a/src/cli/handoff.rs b/src/cli/handoff.rs
index 62ab7f31..99f124ca 100644
--- a/src/cli/handoff.rs
+++ b/src/cli/handoff.rs
@@ -44,7 +44,10 @@ impl HandoffArgs {
         let recipient = self.recipient.clone();
         match self.publish() {
             Ok(out) => {
-                println!("Handed off artifact {} (v{}) to {recipient}", out.id, out.version);
+                println!(
+                    "Handed off artifact {} (v{}) to {recipient}",
+                    out.id, out.version
+                );
                 println!("  thread: {}", out.thread_id);
                 println!("  hint: {recipient} reads it via /flare:handoff inbox (or artifact_get)");
             }
@@ -78,7 +81,11 @@ impl HandoffArgs {
         });
         let sender = self
             .sender
-            .or_else(|| std::env::var("AGENTFLARE_AGENT").ok().filter(|s| !s.is_empty()))
+            .or_else(|| {
+                std::env::var("AGENTFLARE_AGENT")
+                    .ok()
+                    .filter(|s| !s.is_empty())
+            })
             .or_else(agent_detector::agent_name)
             .unwrap_or_else(|| "cli".into());
 
@@ -105,7 +112,11 @@ impl HandoffArgs {
             git: crate::mcp_server::AgentflareMcp::git_provenance(),
         };
         let resp = store.publish(&req).map_err(|e| e.to_string())?;
-        Ok(HandoffOutcome { id: resp.id, version: resp.version, thread_id })
+        Ok(HandoffOutcome {
+            id: resp.id,
+            version: resp.version,
+            thread_id,
+        })
     }
 }
 
@@ -148,7 +159,10 @@ mod tests {
         assert_eq!(artifact.sender.as_deref(), Some("claude-code"));
         assert_eq!(artifact.thread_id.as_deref(), Some("t-pr42"));
         assert_eq!(artifact.name, "review-notes");
-        assert_eq!(artifact.artifact_type, agentflare_artifacts::ArtifactType::Markdown);
+        assert_eq!(
+            artifact.artifact_type,
+            agentflare_artifacts::ArtifactType::Markdown
+        );
         assert!(artifact.content.contains("please review"));
     }
 
diff --git a/src/cli/memory.rs b/src/cli/memory.rs
index 6a1a08af..833bf668 100644
--- a/src/cli/memory.rs
+++ b/src/cli/memory.rs
@@ -42,7 +42,10 @@ pub enum MemoryCommands {
 impl MemoryArgs {
     pub fn run(self) {
         match self.command {
-            MemoryCommands::Context { project, session_id } => {
+            MemoryCommands::Context {
+                project,
+                session_id,
+            } => {
                 let input = crate::memory::mcp::ContextInput {
                     session_id,
                     project,
@@ -52,7 +55,11 @@ impl MemoryArgs {
                     Err(e) => eprintln!("error: {e}"),
                 }
             }
-            MemoryCommands::Search { query, project, limit } => {
+            MemoryCommands::Search {
+                query,
+                project,
+                limit,
+            } => {
                 let input = crate::memory::mcp::RecallInput {
                     query,
                     id: None,
@@ -65,24 +72,32 @@ impl MemoryArgs {
                     Err(e) => eprintln!("error: {e}"),
                 }
             }
-            MemoryCommands::Sessions { project, limit } => {
-                match crate::memory::store::open() {
-                    Err(e) => eprintln!("error: {e}"),
-                    Ok(conn) => match crate::memory::sessions::list_recent(&conn, project.as_deref(), limit) {
-                        Ok(sessions) => println!("{}", serde_json::to_string_pretty(&sessions).unwrap_or_default()),
+            MemoryCommands::Sessions { project, limit } => match crate::memory::store::open() {
+                Err(e) => eprintln!("error: {e}"),
+                Ok(conn) => {
+                    match crate::memory::sessions::list_recent(&conn, project.as_deref(), limit) {
+                        Ok(sessions) => println!(
+                            "{}",
+                            serde_json::to_string_pretty(&sessions).unwrap_or_default()
+                        ),
                         Err(e) => eprintln!("error: {e}"),
-                    },
+                    }
                 }
-            }
-            MemoryCommands::Observations { project, limit } => {
-                match crate::memory::store::open() {
+            },
+            MemoryCommands::Observations { project, limit } => match crate::memory::store::open() {
+                Err(e) => eprintln!("error: {e}"),
+                Ok(conn) => match crate::memory::observations::list_recent(
+                    &conn,
+                    project.as_deref(),
+                    None,
+                    limit,
+                ) {
+                    Ok(obs) => {
+                        println!("{}", serde_json::to_string_pretty(&obs).unwrap_or_default())
+                    }
                     Err(e) => eprintln!("error: {e}"),
-                    Ok(conn) => match crate::memory::observations::list_recent(&conn, project.as_deref(), None, limit) {
-                        Ok(obs) => println!("{}", serde_json::to_string_pretty(&obs).unwrap_or_default()),
-                        Err(e) => eprintln!("error: {e}"),
-                    },
-                }
-            }
+                },
+            },
         }
     }
 }
diff --git a/src/cli/ponytail.rs b/src/cli/ponytail.rs
index 001d5de5..ec36b7db 100644
--- a/src/cli/ponytail.rs
+++ b/src/cli/ponytail.rs
@@ -4,7 +4,8 @@ use std::io::Read;
 /// Read-only/investigative subagent types get no ponytail persona by
 /// default — the persona's lazy-code/commit-style/etc. guidance is dead
 /// weight (~1300 tokens) for an agent that never writes code.
-const DEFAULT_EXCLUDE_AGENT_TYPES: &str = "explore|investigat|search|review|readonly|read-only|verify";
+const DEFAULT_EXCLUDE_AGENT_TYPES: &str =
+    "explore|investigat|search|review|readonly|read-only|verify";
 
 /// Decides whether to inject for a given `agent_type`. With no override,
 /// `DEFAULT_EXCLUDE_AGENT_TYPES` is a DENY-list (matches → skip injection).
@@ -125,11 +126,10 @@ impl PonytailArgs {
                 println!("{mode}");
             }
             PonytailAction::Set { mode } => {
-                let normalized = ponytail::normalize_config_mode(&mode)
-                    .unwrap_or_else(|| {
-                        eprintln!("error: invalid mode: {mode}");
-                        std::process::exit(1);
-                    });
+                let normalized = ponytail::normalize_config_mode(&mode).unwrap_or_else(|| {
+                    eprintln!("error: invalid mode: {mode}");
+                    std::process::exit(1);
+                });
                 ponytail::set_active(normalized).unwrap_or_else(|e| {
                     eprintln!("error: {e}");
                     std::process::exit(1);
@@ -137,11 +137,10 @@ impl PonytailArgs {
                 println!("{normalized}");
             }
             PonytailAction::Default { mode } => {
-                let normalized = ponytail::normalize_config_mode(&mode)
-                    .unwrap_or_else(|| {
-                        eprintln!("error: invalid mode: {mode}");
-                        std::process::exit(1);
-                    });
+                let normalized = ponytail::normalize_config_mode(&mode).unwrap_or_else(|| {
+                    eprintln!("error: invalid mode: {mode}");
+                    std::process::exit(1);
+                });
                 ponytail::set_default_mode(normalized).unwrap_or_else(|e| {
                     eprintln!("error: {e}");
                     std::process::exit(1);
@@ -181,8 +180,7 @@ impl PonytailArgs {
                     // session starts — otherwise active_mode() reads the stale
                     // override and set_active() below promotes it to global.
                     ponytail::clear_session();
-                    let mode = ponytail::active_mode()
-                        .unwrap_or_else(ponytail::default_mode);
+                    let mode = ponytail::active_mode().unwrap_or_else(ponytail::default_mode);
                     if mode != "off" {
                         ponytail::set_active(&mode).ok();
                     }
@@ -212,8 +210,8 @@ impl PonytailArgs {
                                 ponytail::clear_active();
                             }
                             ponytail::SwitchAction::Report => {
-                                let mode = ponytail::active_mode()
-                                    .unwrap_or_else(ponytail::default_mode);
+                                let mode =
+                                    ponytail::active_mode().unwrap_or_else(ponytail::default_mode);
                                 let platform = ponytail::detect_platform();
                                 let ctx = report_message(&mode);
                                 let output = ponytail::format_hook_output(
@@ -229,8 +227,7 @@ impl PonytailArgs {
                     println!("OK");
                 }
                 PonytailHookEvent::Statusline => {
-                    let mode = ponytail::active_mode()
-                        .unwrap_or_else(ponytail::default_mode);
+                    let mode = ponytail::active_mode().unwrap_or_else(ponytail::default_mode);
                     if mode == "off" || mode.is_empty() {
                         return;
                     }
diff --git a/src/cli/review.rs b/src/cli/review.rs
index 8c1542b5..f70770af 100644
--- a/src/cli/review.rs
+++ b/src/cli/review.rs
@@ -87,22 +87,41 @@ impl ReviewArgs {
             Err(e) => fail(format!("cannot open ledger: {e}")),
         };
         match self.action {
-            ReviewAction::Submit { pr, agent, file, repo } => {
+            ReviewAction::Submit {
+                pr,
+                agent,
+                file,
+                repo,
+            } => {
                 let repo = require_repo(repo);
                 let pr = resolve_pr(pr);
                 let agent = agent.unwrap_or_else(crate::review::submitter_name);
                 let raw = match &file {
-                    Some(p) => std::fs::read_to_string(p).unwrap_or_else(|e| fail(format!("cannot read {}: {e}", p.display()))),
+                    Some(p) => std::fs::read_to_string(p)
+                        .unwrap_or_else(|e| fail(format!("cannot read {}: {e}", p.display()))),
                     None => read_stdin(),
                 };
                 let findings: Vec<crate::review::Finding> = serde_json::from_str(&raw)
                     .unwrap_or_else(|e| fail(format!("invalid findings JSON: {e}")));
-                match crate::review::submit(&conn, &repo, &pr, &agent, &findings, crate::claims::now()) {
+                match crate::review::submit(
+                    &conn,
+                    &repo,
+                    &pr,
+                    &agent,
+                    &findings,
+                    crate::claims::now(),
+                ) {
                     Ok(n) => println!("submitted {n} finding(s) as {agent} for {repo}#{pr}"),
                     Err(e) => fail(format!("submit failed: {e}")),
                 }
             }
-            ReviewAction::Consensus { pr, base, head, repo, json } => {
+            ReviewAction::Consensus {
+                pr,
+                base,
+                head,
+                repo,
+                json,
+            } => {
                 let repo = require_repo(repo);
                 let pr = resolve_pr(pr);
                 let findings = crate::review::load(&conn, &repo, &pr)
@@ -112,7 +131,10 @@ impl ReviewArgs {
                 let changed = crate::review::changed_lines(&diff);
                 let items = crate::review::consensus(&findings, &changed);
                 if json {
-                    println!("{}", serde_json::to_string_pretty(&items).unwrap_or_default());
+                    println!(
+                        "{}",
+                        serde_json::to_string_pretty(&items).unwrap_or_default()
+                    );
                 } else {
                     println!("{}", crate::review::render_markdown(&items));
                 }
@@ -124,7 +146,10 @@ impl ReviewArgs {
                     Ok(fs) if fs.is_empty() => println!("no findings for {repo}#{pr}"),
                     Ok(fs) => {
                         for sf in fs {
-                            println!("{}  {}:{}  {}", sf.agent, sf.finding.file, sf.finding.line, sf.finding.message);
+                            println!(
+                                "{}  {}:{}  {}",
+                                sf.agent, sf.finding.file, sf.finding.line, sf.finding.message
+                            );
                         }
                     }
                     Err(e) => fail(format!("list failed: {e}")),
@@ -138,7 +163,12 @@ impl ReviewArgs {
                     Err(e) => fail(format!("clear failed: {e}")),
                 }
             }
-            ReviewAction::Record { pr, base, head, repo } => {
+            ReviewAction::Record {
+                pr,
+                base,
+                head,
+                repo,
+            } => {
                 let repo = require_repo(repo);
                 let pr = resolve_pr(pr);
                 let findings = crate::review::load(&conn, &repo, &pr)
@@ -146,23 +176,47 @@ impl ReviewArgs {
                 let diff = crate::review::compute_diff(base.as_deref(), head.as_deref())
                     .unwrap_or_else(|e| fail(e));
                 let changed = crate::review::changed_lines(&diff);
-                match crate::review::record_round(&conn, &repo, &pr, &findings, &changed, crate::claims::now()) {
+                match crate::review::record_round(
+                    &conn,
+                    &repo,
+                    &pr,
+                    &findings,
+                    &changed,
+                    crate::claims::now(),
+                ) {
                     Ok(n) => println!("recorded accuracy for {n} agent(s) on {repo}#{pr}"),
                     Err(e) => fail(format!("record failed: {e}")),
                 }
             }
-            ReviewAction::Scores { repo, all_repos, json } => {
-                let scope = if all_repos { None } else { Some(require_repo(repo)) };
+            ReviewAction::Scores {
+                repo,
+                all_repos,
+                json,
+            } => {
+                let scope = if all_repos {
+                    None
+                } else {
+                    Some(require_repo(repo))
+                };
                 let scores = crate::review::scores(&conn, scope.as_deref())
                     .unwrap_or_else(|e| fail(format!("scores failed: {e}")));
                 if json {
-                    println!("{}", serde_json::to_string_pretty(&scores).unwrap_or_default());
+                    println!(
+                        "{}",
+                        serde_json::to_string_pretty(&scores).unwrap_or_default()
+                    );
                 } else if scores.is_empty() {
                     println!("no recorded scores");
                 } else {
                     for s in scores {
-                        println!("{:<20} {:.0}%  ({}/{} verified, {} round(s))",
-                            s.agent, s.accuracy * 100.0, s.verified, s.findings, s.rounds);
+                        println!(
+                            "{:<20} {:.0}%  ({}/{} verified, {} round(s))",
+                            s.agent,
+                            s.accuracy * 100.0,
+                            s.verified,
+                            s.findings,
+                            s.rounds
+                        );
                     }
                 }
             }
@@ -185,8 +239,9 @@ fn resolve_pr(explicit: Option<String>) -> String {
 }
 
 fn require_repo(explicit: Option<String>) -> String {
-    crate::claims::resolve_repo(explicit)
-        .unwrap_or_else(|| fail("could not determine repo — run in a git repo or pass --repo owner/name".to_string()))
+    crate::claims::resolve_repo(explicit).unwrap_or_else(|| {
+        fail("could not determine repo — run in a git repo or pass --repo owner/name".to_string())
+    })
 }
 
 fn read_stdin() -> String {
diff --git a/src/coaching.rs b/src/coaching.rs
index 04372ffe..0ab0bb04 100644
--- a/src/coaching.rs
+++ b/src/coaching.rs
@@ -58,7 +58,7 @@ fn parse_rule_file(path: &std::path::Path) -> Option<CoachingRule> {
         }
         if in_header {
             if let Some(rest) = line.strip_prefix("# Pattern:") {
-                if let Some(t) = rest.splitn(2, '\u{2014}').nth(1) {
+                if let Some(t) = rest.split_once('\u{2014}').map(|x| x.1) {
                     title = t.trim().to_string();
                 }
             } else if let Some(rest) = line.strip_prefix("# Applied:") {
@@ -109,7 +109,8 @@ pub fn list_rules() -> Vec<CoachingRule> {
 fn write_rule_file(id: &str, title: &str, body: &str) -> std::io::Result<()> {
     std::fs::create_dir_all(rules_dir())?;
     let date = chrono::Local::now().date_naive();
-    let content = format!("---\n# Pattern: {id} \u{2014} {title}\n# Applied: {date}\n---\n\n{body}\n");
+    let content =
+        format!("---\n# Pattern: {id} \u{2014} {title}\n# Applied: {date}\n---\n\n{body}\n");
     std::fs::write(rules_dir().join(format!("coaching-{id}.md")), content)
 }
 
@@ -126,7 +127,9 @@ pub fn apply_rule(id: &str, title: &str, body: &str) -> Result<CoachingRule, Str
     let existing = list_rules();
     let is_overwrite = existing.iter().any(|r| r.id == id);
     if !is_overwrite && existing.len() >= MAX_RULES {
-        return Err(format!("maximum {MAX_RULES} coaching rules reached — remove one first"));
+        return Err(format!(
+            "maximum {MAX_RULES} coaching rules reached — remove one first"
+        ));
     }
 
     write_rule_file(id, title, body).map_err(|e| format!("failed to write rule file: {e}"))?;
@@ -220,7 +223,12 @@ mod tests {
     #[test]
     fn apply_rule_then_list_rules_roundtrips() {
         with_temp_home(|| {
-            let applied = apply_rule("hygiene", "Close sessions promptly", "Wrap up each phase before starting the next.").unwrap();
+            let applied = apply_rule(
+                "hygiene",
+                "Close sessions promptly",
+                "Wrap up each phase before starting the next.",
+            )
+            .unwrap();
             assert_eq!(applied.id, "hygiene");
             assert_eq!(applied.title, "Close sessions promptly");
             assert_eq!(applied.body, "Wrap up each phase before starting the next.");
@@ -289,7 +297,11 @@ mod tests {
             apply_rule("good", "T", "B").unwrap();
 
             let rules = list_rules();
-            assert_eq!(rules.len(), 1, "malformed file with no # Applied: header is skipped");
+            assert_eq!(
+                rules.len(),
+                1,
+                "malformed file with no # Applied: header is skipped"
+            );
             assert_eq!(rules[0].id, "good");
         });
     }
@@ -299,7 +311,10 @@ mod tests {
         with_temp_home(|| {
             apply_rule("b-rule", "Title B", "Body B").unwrap();
             apply_rule("a-rule", "Title A", "Body A").unwrap();
-            assert_eq!(active_rule_bodies(), vec!["Body A".to_string(), "Body B".to_string()]);
+            assert_eq!(
+                active_rule_bodies(),
+                vec!["Body A".to_string(), "Body B".to_string()]
+            );
         });
     }
 
@@ -307,8 +322,16 @@ mod tests {
     fn apply_rule_body_with_dashes_line_is_not_truncated() {
         with_temp_home(|| {
             let applied = apply_rule("dashes", "Title", "before\n---\nafter").unwrap();
-            assert!(applied.body.contains("before"), "body should contain text before the --- line: {}", applied.body);
-            assert!(applied.body.contains("after"), "body should contain text after the --- line: {}", applied.body);
+            assert!(
+                applied.body.contains("before"),
+                "body should contain text before the --- line: {}",
+                applied.body
+            );
+            assert!(
+                applied.body.contains("after"),
+                "body should contain text after the --- line: {}",
+                applied.body
+            );
 
             let rules = list_rules();
             assert_eq!(rules.len(), 1);
diff --git a/src/components.rs b/src/components.rs
index 08442f85..d92c1508 100644
--- a/src/components.rs
+++ b/src/components.rs
@@ -66,7 +66,11 @@ fn write_pinned_mode(path: &PathBuf) -> bool {
     let current: Option<String> = fs::read_to_string(path)
         .ok()
         .and_then(|s| serde_json::from_str::<Value>(&s).ok())
-        .and_then(|v| v.get("defaultMode").and_then(|m| m.as_str()).map(String::from));
+        .and_then(|v| {
+            v.get("defaultMode")
+                .and_then(|m| m.as_str())
+                .map(String::from)
+        });
     if current.is_some() {
         return false;
     }
@@ -94,7 +98,11 @@ fn merge_json(path: &PathBuf, key: &str, value: Value) -> bool {
     if let Some(parent) = path.parent() {
         let _ = fs::create_dir_all(parent);
     }
-    fs::write(path, serde_json::to_string_pretty(&existing).unwrap_or_default() + "\n").is_ok()
+    fs::write(
+        path,
+        serde_json::to_string_pretty(&existing).unwrap_or_default() + "\n",
+    )
+    .is_ok()
 }
 
 fn merge_opencode_mcp(path: &PathBuf, key: &str, entry: Value) -> bool {
@@ -106,33 +114,42 @@ fn merge_opencode_mcp(path: &PathBuf, key: &str, entry: Value) -> bool {
         existing = serde_json::json!({});
     }
     let obj = existing.as_object_mut().unwrap();
-    let mcp = obj
-        .entry("mcp")
-        .or_insert_with(|| serde_json::json!({}));
-    if let Some(m) = mcp.as_object_mut() {
-        if !m.contains_key(key) {
-            let command = entry.get("command").and_then(|c| c.as_str()).map(|s| s.to_string());
-            let args: Vec<String> = entry
-                .get("args")
-                .and_then(|a| a.as_array())
-                .map(|a| a.iter().filter_map(|v| v.as_str().map(String::from)).collect())
-                .unwrap_or_default();
-            let mut cmd = vec![command.unwrap_or_else(|| key.to_string())];
-            cmd.extend(args);
-            m.insert(
-                key.to_string(),
-                serde_json::json!({
-                    "command": cmd,
-                    "enabled": true,
-                    "type": "local",
-                }),
-            );
-        }
+    let mcp = obj.entry("mcp").or_insert_with(|| serde_json::json!({}));
+    if let Some(m) = mcp.as_object_mut()
+        && !m.contains_key(key)
+    {
+        let command = entry
+            .get("command")
+            .and_then(|c| c.as_str())
+            .map(|s| s.to_string());
+        let args: Vec<String> = entry
+            .get("args")
+            .and_then(|a| a.as_array())
+            .map(|a| {
+                a.iter()
+                    .filter_map(|v| v.as_str().map(String::from))
+                    .collect()
+            })
+            .unwrap_or_default();
+        let mut cmd = vec![command.unwrap_or_else(|| key.to_string())];
+        cmd.extend(args);
+        m.insert(
+            key.to_string(),
+            serde_json::json!({
+                "command": cmd,
+                "enabled": true,
+                "type": "local",
+            }),
+        );
     }
     if let Some(parent) = path.parent() {
         let _ = fs::create_dir_all(parent);
     }
-    fs::write(path, serde_json::to_string_pretty(&existing).unwrap_or_default() + "\n").is_ok()
+    fs::write(
+        path,
+        serde_json::to_string_pretty(&existing).unwrap_or_default() + "\n",
+    )
+    .is_ok()
 }
 
 fn write_if_absent(path: &PathBuf, content: &str) -> bool {
@@ -163,20 +180,32 @@ pub(crate) fn rule_targets(host: &str) -> Vec<(PathBuf, String)> {
         }
         "cursor" => {
             let content = format!("---\nalwaysApply: true\n---\n\n{}", joined());
-            vec![(cwd().join(".cursor").join("rules").join("agentflare.mdc"), content)]
+            vec![(
+                cwd().join(".cursor").join("rules").join("agentflare.mdc"),
+                content,
+            )]
         }
         "codex" => {
             let content = format!("# Rules (agentflare)\n\n{}\n", joined());
             vec![(cwd().join("AGENTS.md"), content)]
         }
         "windsurf" => {
-            vec![(cwd().join(".windsurf").join("rules").join("agentflare.md"), joined() + "\n")]
+            vec![(
+                cwd().join(".windsurf").join("rules").join("agentflare.md"),
+                joined() + "\n",
+            )]
         }
         "vscode-copilot" => {
-            vec![(cwd().join(".github").join("copilot-instructions.md"), joined() + "\n")]
+            vec![(
+                cwd().join(".github").join("copilot-instructions.md"),
+                joined() + "\n",
+            )]
         }
         "cline" => {
-            vec![(cwd().join(".clinerules").join("agentflare.md"), joined() + "\n")]
+            vec![(
+                cwd().join(".clinerules").join("agentflare.md"),
+                joined() + "\n",
+            )]
         }
         "opencode" => {
             let dir = home().join(".config").join("opencode").join("rules");
@@ -236,8 +265,11 @@ fn sync_skill_overrides() -> Result<usize, String> {
     let mut settings = claude_settings();
     let added = apply_skill_overrides(&names, &mut settings)?;
     if added > 0 {
-        fs::write(&path, serde_json::to_string_pretty(&settings).unwrap_or_default() + "\n")
-            .map_err(|e| e.to_string())?;
+        fs::write(
+            &path,
+            serde_json::to_string_pretty(&settings).unwrap_or_default() + "\n",
+        )
+        .map_err(|e| e.to_string())?;
     }
     Ok(added)
 }
@@ -633,12 +665,29 @@ mod tests {
         // testing: these two components must report "satisfied" (no
         // pending nag, no attempted install) on every host except
         // claude-code, since Ponytail/Caveman have no equivalent elsewhere.
-        for host in ["codex", "cursor", "windsurf", "vscode-copilot", "cline", "continue", "opencode"] {
+        for host in [
+            "codex",
+            "cursor",
+            "windsurf",
+            "vscode-copilot",
+            "cline",
+            "continue",
+            "opencode",
+        ] {
             let components = get_components(host);
-            let ponytail_plugin = components.iter().find(|c| c.id == "ponytail-plugin").unwrap();
+            let ponytail_plugin = components
+                .iter()
+                .find(|c| c.id == "ponytail-plugin")
+                .unwrap();
             let caveman_mode = components.iter().find(|c| c.id == "caveman-mode").unwrap();
-            assert!((ponytail_plugin.check)(), "ponytail-plugin should be satisfied on '{host}'");
-            assert!((caveman_mode.check)(), "caveman-mode should be satisfied on '{host}'");
+            assert!(
+                (ponytail_plugin.check)(),
+                "ponytail-plugin should be satisfied on '{host}'"
+            );
+            assert!(
+                (caveman_mode.check)(),
+                "caveman-mode should be satisfied on '{host}'"
+            );
         }
     }
 
@@ -648,18 +697,38 @@ mod tests {
         // format wired here yet — must never nag or attempt registration.
         for host in ["codex", "cursor", "windsurf", "vscode-copilot"] {
             let components = get_components(host);
-            let agentflare_mcp = components.iter().find(|c| c.id == "agentflare-mcp").unwrap();
-            assert!((agentflare_mcp.check)(), "agentflare-mcp should be satisfied on '{host}'");
+            let agentflare_mcp = components
+                .iter()
+                .find(|c| c.id == "agentflare-mcp")
+                .unwrap();
+            assert!(
+                (agentflare_mcp.check)(),
+                "agentflare-mcp should be satisfied on '{host}'"
+            );
         }
     }
 
     #[test]
     #[cfg(feature = "skill-overrides-sync")]
     fn skill_overrides_sync_reports_satisfied_on_non_claude_code_hosts() {
-        for host in ["codex", "cursor", "windsurf", "vscode-copilot", "cline", "continue", "opencode"] {
+        for host in [
+            "codex",
+            "cursor",
+            "windsurf",
+            "vscode-copilot",
+            "cline",
+            "continue",
+            "opencode",
+        ] {
             let components = get_components(host);
-            let sync = components.iter().find(|c| c.id == "skill-overrides-sync").unwrap();
-            assert!((sync.check)(), "skill-overrides-sync should be satisfied on '{host}'");
+            let sync = components
+                .iter()
+                .find(|c| c.id == "skill-overrides-sync")
+                .unwrap();
+            assert!(
+                (sync.check)(),
+                "skill-overrides-sync should be satisfied on '{host}'"
+            );
         }
     }
 
diff --git a/src/cost.rs b/src/cost.rs
index c87b6ecc..51d9c1f9 100644
--- a/src/cost.rs
+++ b/src/cost.rs
@@ -222,7 +222,10 @@ pub(crate) fn aggregate(
             }
 
             let key = match group_by {
-                GroupBy::Model => parsed.model.clone().unwrap_or_else(|| "unknown".to_string()),
+                GroupBy::Model => parsed
+                    .model
+                    .clone()
+                    .unwrap_or_else(|| "unknown".to_string()),
                 GroupBy::Project => project.clone(),
             };
             let cost = calculate_cost(&parsed.tokens, parsed.model.as_deref(), pricing);
@@ -241,7 +244,11 @@ pub fn run(days: Option<u32>, by_project: bool) {
     let today = Local::now().date_naive();
     let window = days.unwrap_or(1).max(1);
     let start = today - chrono::Duration::days(window as i64 - 1);
-    let group_by = if by_project { GroupBy::Project } else { GroupBy::Model };
+    let group_by = if by_project {
+        GroupBy::Project
+    } else {
+        GroupBy::Model
+    };
 
     let mut conn = crate::rollup::open_or_rebuild();
     crate::rollup::sync(&mut conn, &claude_projects_dir());
@@ -271,7 +278,12 @@ pub fn run(days: Option<u32>, by_project: bool) {
     // Model names always fit in 32 chars, so this floor keeps the no-flags/
     // by-model output byte-identical; project directory names can be much
     // longer, so the column widens to fit them instead of going ragged.
-    let key_width = rows.iter().map(|(k, _)| k.len()).max().unwrap_or(32).max(32);
+    let key_width = rows
+        .iter()
+        .map(|(k, _)| k.len())
+        .max()
+        .unwrap_or(32)
+        .max(32);
 
     let mut total_cost = 0.0;
     let mut total_tokens = TokenUsage::default();
@@ -342,7 +354,10 @@ mod tests {
         let mut seen = HashSet::new();
         let make = |input: u64| LineUsage {
             model: None,
-            tokens: TokenUsage { input_tokens: input, ..Default::default() },
+            tokens: TokenUsage {
+                input_tokens: input,
+                ..Default::default()
+            },
             message_id: Some("msg_1".to_string()),
             request_id: Some("req_1".to_string()),
             date: None,
@@ -357,7 +372,10 @@ mod tests {
         let mut seen = HashSet::new();
         let line = LineUsage {
             model: None,
-            tokens: TokenUsage { input_tokens: 5, ..Default::default() },
+            tokens: TokenUsage {
+                input_tokens: 5,
+                ..Default::default()
+            },
             message_id: None,
             request_id: None,
             date: None,
@@ -390,16 +408,10 @@ mod tests {
         let yesterday_ts = "2026-07-05T10:00:00Z";
 
         let content = format!(
-            "{}\n{}\n{}\n",
-            format!(
-                r#"{{"type":"assistant","timestamp":"{today_ts}","message":{{"id":"m1","model":"claude-opus-4-8","usage":{{"input_tokens":100,"output_tokens":50}}}},"requestId":"r1"}}"#
-            ),
-            format!(
-                r#"{{"type":"assistant","timestamp":"{today_ts}","message":{{"id":"m2","model":"claude-opus-4-8","usage":{{"input_tokens":20,"output_tokens":10}}}},"requestId":"r2"}}"#
-            ),
-            format!(
-                r#"{{"type":"assistant","timestamp":"{yesterday_ts}","message":{{"id":"m3","model":"claude-opus-4-8","usage":{{"input_tokens":999,"output_tokens":999}}}},"requestId":"r3"}}"#
-            ),
+            r#"{{"type":"assistant","timestamp":"{today_ts}","message":{{"id":"m1","model":"claude-opus-4-8","usage":{{"input_tokens":100,"output_tokens":50}}}},"requestId":"r1"}}
+{{"type":"assistant","timestamp":"{today_ts}","message":{{"id":"m2","model":"claude-opus-4-8","usage":{{"input_tokens":20,"output_tokens":10}}}},"requestId":"r2"}}
+{{"type":"assistant","timestamp":"{yesterday_ts}","message":{{"id":"m3","model":"claude-opus-4-8","usage":{{"input_tokens":999,"output_tokens":999}}}},"requestId":"r3"}}
+"#
         );
         std::fs::write(project_dir.join("session1.jsonl"), content).unwrap();
 
@@ -409,7 +421,10 @@ mod tests {
         let pricing = load_pricing();
         let totals = aggregate(&files, (today, today), GroupBy::Model, &pricing);
         let opus = totals.get("claude-opus-4-8").expect("expected opus entry");
-        assert_eq!(opus.tokens.input_tokens, 120, "yesterday's tokens must be excluded when range is today-only");
+        assert_eq!(
+            opus.tokens.input_tokens, 120,
+            "yesterday's tokens must be excluded when range is today-only"
+        );
         assert_eq!(opus.tokens.output_tokens, 60);
 
         let _ = std::fs::remove_dir_all(&dir);
@@ -439,8 +454,13 @@ mod tests {
 
         let pricing = load_pricing();
         let totals = aggregate(&files, range, GroupBy::Model, &pricing);
-        let opus = totals.get("claude-opus-4-8").expect("expected opus entry from within range");
-        assert_eq!(opus.tokens.input_tokens, 100, "the 2026-07-03 line is outside the 3-day window and must be excluded");
+        let opus = totals
+            .get("claude-opus-4-8")
+            .expect("expected opus entry from within range");
+        assert_eq!(
+            opus.tokens.input_tokens, 100,
+            "the 2026-07-03 line is outside the 3-day window and must be excluded"
+        );
 
         let _ = std::fs::remove_dir_all(&dir);
     }
@@ -465,9 +485,26 @@ mod tests {
 
         let pricing = load_pricing();
         let totals = aggregate(&files, (today, today), GroupBy::Project, &pricing);
-        assert_eq!(totals.get("proj-a").expect("expected proj-a entry").tokens.input_tokens, 100);
-        assert_eq!(totals.get("proj-b").expect("expected proj-b entry").tokens.input_tokens, 10);
-        assert!(totals.get("claude-opus-4-8").is_none(), "grouping by project must not key by model name");
+        assert_eq!(
+            totals
+                .get("proj-a")
+                .expect("expected proj-a entry")
+                .tokens
+                .input_tokens,
+            100
+        );
+        assert_eq!(
+            totals
+                .get("proj-b")
+                .expect("expected proj-b entry")
+                .tokens
+                .input_tokens,
+            10
+        );
+        assert!(
+            !totals.contains_key("claude-opus-4-8"),
+            "grouping by project must not key by model name"
+        );
 
         let _ = std::fs::remove_dir_all(&dir);
     }
@@ -483,14 +520,21 @@ mod tests {
 
         let opus_line = r#"{"type":"assistant","timestamp":"2026-07-06T10:00:00Z","message":{"id":"m1","model":"claude-opus-4-8","usage":{"input_tokens":1000,"output_tokens":0}},"requestId":"r1"}"#;
         let haiku_line = r#"{"type":"assistant","timestamp":"2026-07-06T10:00:00Z","message":{"id":"m2","model":"claude-haiku-4-5","usage":{"input_tokens":1000,"output_tokens":0}},"requestId":"r2"}"#;
-        std::fs::write(project_dir.join("session1.jsonl"), format!("{opus_line}\n{haiku_line}\n")).unwrap();
+        std::fs::write(
+            project_dir.join("session1.jsonl"),
+            format!("{opus_line}\n{haiku_line}\n"),
+        )
+        .unwrap();
 
         let files = find_session_files_under(&dir);
         let today = NaiveDate::from_ymd_opt(2026, 7, 6).unwrap();
         let pricing = load_pricing();
 
         let by_project = aggregate(&files, (today, today), GroupBy::Project, &pricing);
-        let project_cost = by_project.get("proj-mixed").expect("expected proj-mixed entry").cost_usd;
+        let project_cost = by_project
+            .get("proj-mixed")
+            .expect("expected proj-mixed entry")
+            .cost_usd;
 
         let by_model = aggregate(&files, (today, today), GroupBy::Model, &pricing);
         let expected_total: f64 = by_model.values().map(|g| g.cost_usd).sum();
@@ -499,7 +543,10 @@ mod tests {
             (project_cost - expected_total).abs() < 0.000_001,
             "project-grouped cost ({project_cost}) must equal the sum of correctly-priced per-model costs ({expected_total}), not a single blended/unpriced rate"
         );
-        assert!(project_cost > 0.0, "opus and haiku are both known, priced models — cost must be nonzero");
+        assert!(
+            project_cost > 0.0,
+            "opus and haiku are both known, priced models — cost must be nonzero"
+        );
 
         let _ = std::fs::remove_dir_all(&dir);
     }
@@ -525,7 +572,11 @@ mod tests {
         let line_2 = format!(
             r#"{{"type":"assistant","timestamp":"2026-07-06T10:00:00Z","message":{{"id":"m2","model":"{MODEL}","usage":{{"input_tokens":150000,"output_tokens":0}}}},"requestId":"r2"}}"#
         );
-        std::fs::write(project_dir.join("session1.jsonl"), format!("{line_1}\n{line_2}\n")).unwrap();
+        std::fs::write(
+            project_dir.join("session1.jsonl"),
+            format!("{line_1}\n{line_2}\n"),
+        )
+        .unwrap();
 
         let files = find_session_files_under(&dir);
         let today = NaiveDate::from_ymd_opt(2026, 7, 6).unwrap();
@@ -536,7 +587,10 @@ mod tests {
 
         // Hypothetical: what the cost WOULD be if both lines' tokens were
         // summed first and priced once as a single 300,000-token call.
-        let combined_tokens = crate::pricing::TokenUsage { input_tokens: 300_000, ..Default::default() };
+        let combined_tokens = crate::pricing::TokenUsage {
+            input_tokens: 300_000,
+            ..Default::default()
+        };
         let combined_cost =
             crate::pricing::calculate_cost(&combined_tokens, Some(MODEL), &pricing).total_usd;
 
diff --git a/src/db.rs b/src/db.rs
index 9e33b9f7..a1bbeaab 100644
--- a/src/db.rs
+++ b/src/db.rs
@@ -3,12 +3,14 @@
 //! (see #138 — gateway secrets fold in later). The rebuildable caches under
 //! `~/.local/share/agentflare/` (skills index, gateway tool-index) stay
 //! separate: they belong in the data dir, not next to source-of-truth state.
-use rusqlite::{params, Connection};
+use rusqlite::{Connection, params};
 use std::path::PathBuf;
 use std::time::Duration;
 
 pub fn agentflare_db_path() -> PathBuf {
-    crate::paths::home().join(".agentflare").join("agentflare.db")
+    crate::paths::home()
+        .join(".agentflare")
+        .join("agentflare.db")
 }
 
 fn old_gateway_db_path() -> PathBuf {
@@ -144,13 +146,21 @@ mod tests {
         let conn = new_db();
         import_legacy_secrets(&conn, &old_path).unwrap();
         let present: i64 = conn
-            .query_row("SELECT COUNT(*) FROM gateway_secrets WHERE name='github_pat'", [], |r| r.get(0))
+            .query_row(
+                "SELECT COUNT(*) FROM gateway_secrets WHERE name='github_pat'",
+                [],
+                |r| r.get(0),
+            )
             .unwrap();
         assert_eq!(present, 1, "secret should import on first open");
 
         // Legacy file is renamed once migrated, so a re-import can't resurrect.
-        assert!(!old_path.exists(), "legacy file should be renamed after migration");
-        conn.execute("DELETE FROM gateway_secrets WHERE name='github_pat'", []).unwrap();
+        assert!(
+            !old_path.exists(),
+            "legacy file should be renamed after migration"
+        );
+        conn.execute("DELETE FROM gateway_secrets WHERE name='github_pat'", [])
+            .unwrap();
         import_legacy_secrets(&conn, &old_path).unwrap();
         let after: i64 = conn
             .query_row("SELECT COUNT(*) FROM gateway_secrets", [], |r| r.get(0))
@@ -164,8 +174,13 @@ mod tests {
         let old_path = dir.path().join("gateway.db");
         // gateway_secrets exists but lacks the `ciphertext` column.
         let old = Connection::open(&old_path).unwrap();
-        old.execute_batch("CREATE TABLE gateway_secrets (name TEXT, blob BLOB);").unwrap();
-        old.execute("INSERT INTO gateway_secrets (name, blob) VALUES ('x', X'00')", []).unwrap();
+        old.execute_batch("CREATE TABLE gateway_secrets (name TEXT, blob BLOB);")
+            .unwrap();
+        old.execute(
+            "INSERT INTO gateway_secrets (name, blob) VALUES ('x', X'00')",
+            [],
+        )
+        .unwrap();
         drop(old);
 
         let conn = new_db();
diff --git a/src/dev_vars.rs b/src/dev_vars.rs
index 3d237e9f..cbd416ce 100644
--- a/src/dev_vars.rs
+++ b/src/dev_vars.rs
@@ -87,7 +87,8 @@ mod tests {
 
     #[test]
     fn returns_none_when_no_file() {
-        let dir = std::env::temp_dir().join(format!("agentflare-devvars-none-{}", std::process::id()));
+        let dir =
+            std::env::temp_dir().join(format!("agentflare-devvars-none-{}", std::process::id()));
         let _ = std::fs::remove_dir_all(&dir);
         std::fs::create_dir_all(&dir).unwrap();
         assert!(load(&dir, None).is_none());
diff --git a/src/errors.rs b/src/errors.rs
index a3c81a51..6b43d5f1 100644
--- a/src/errors.rs
+++ b/src/errors.rs
@@ -1,6 +1,7 @@
 use thiserror::Error;
 
 #[derive(Error, Debug)]
+#[allow(dead_code)]
 pub enum AgentDetectError {
     #[error("{0} produced no output")]
     NoOutput(String),
@@ -13,6 +14,7 @@ pub enum AgentDetectError {
 }
 
 #[derive(Error, Debug)]
+#[allow(dead_code)]
 pub enum AuthError {
     #[error("invalid {kind}: '{name}' (must not contain path separators)")]
     InvalidName { name: String, kind: String },
@@ -41,6 +43,7 @@ pub enum DaemonError {
 }
 
 #[derive(Error, Debug)]
+#[allow(dead_code)]
 pub enum UpdateError {
     #[error("HTTP request failed: {0}")]
     Http(String),
@@ -49,12 +52,14 @@ pub enum UpdateError {
 }
 
 #[derive(Error, Debug)]
+#[allow(dead_code)]
 pub enum AliasError {
     #[error("unsupported shell: {0}")]
     UnsupportedShell(String),
 }
 
 #[derive(Error, Debug)]
+#[allow(dead_code)]
 pub enum AgentInstallError {
     #[error("unknown agent: {0}")]
     UnknownAgent(String),
@@ -69,6 +74,7 @@ pub enum AgentInstallError {
 }
 
 #[derive(Error, Debug)]
+#[allow(dead_code)]
 pub enum CoachingError {
     #[error("invalid coaching rule: {0}")]
     InvalidRule(String),
diff --git a/src/gateway_integrations.rs b/src/gateway_integrations.rs
index 5525c1d4..3c697cb2 100644
--- a/src/gateway_integrations.rs
+++ b/src/gateway_integrations.rs
@@ -87,7 +87,11 @@ pub fn already_registered(name: &str) -> bool {
 pub fn register(intg: &GatewayIntegration) -> String {
     let path = gateway_toml_path();
     if already_registered(intg.name) {
-        return format!("skip  {} already registered ({})", intg.name, path.display());
+        return format!(
+            "skip  {} already registered ({})",
+            intg.name,
+            path.display()
+        );
     }
     let existing = fs::read_to_string(&path).unwrap_or_default();
 
@@ -102,7 +106,11 @@ pub fn register(intg: &GatewayIntegration) -> String {
         let _ = fs::create_dir_all(parent);
     }
     match fs::write(&path, out) {
-        Ok(_) => format!("ok    {} MCP registered behind the gateway ({})", intg.name, path.display()),
+        Ok(_) => format!(
+            "ok    {} MCP registered behind the gateway ({})",
+            intg.name,
+            path.display()
+        ),
         Err(e) => format!("fail  writing {}: {e}", path.display()),
     }
 }
@@ -114,15 +122,23 @@ mod tests {
 
     #[test]
     fn remotes_mention_github_matches_https_ssh_and_aliases() {
-        assert!(remotes_mention_github("origin\thttps://github.com/org/repo.git (fetch)"));
-        assert!(remotes_mention_github("origin\tgit@github.com:org/repo.git (push)"));
+        assert!(remotes_mention_github(
+            "origin\thttps://github.com/org/repo.git (fetch)"
+        ));
+        assert!(remotes_mention_github(
+            "origin\tgit@github.com:org/repo.git (push)"
+        ));
         // SSH host alias (this very repo's shape).
-        assert!(remotes_mention_github("origin\tgit@github-work:org/repo.git (fetch)"));
+        assert!(remotes_mention_github(
+            "origin\tgit@github-work:org/repo.git (fetch)"
+        ));
     }
 
     #[test]
     fn remotes_mention_github_ignores_other_forges() {
-        assert!(!remotes_mention_github("origin\tgit@gitlab.com:org/repo.git (fetch)"));
+        assert!(!remotes_mention_github(
+            "origin\tgit@gitlab.com:org/repo.git (fetch)"
+        ));
         assert!(!remotes_mention_github(""));
     }
 
diff --git a/src/gateway_secrets.rs b/src/gateway_secrets.rs
index f4b5ff59..b50aa3aa 100644
--- a/src/gateway_secrets.rs
+++ b/src/gateway_secrets.rs
@@ -5,8 +5,7 @@
 //! rotation/cooldowns/isolation vs. one secret per downstream MCP server).
 
 use crate::auth_crypt;
-use rusqlite::{params, Connection, OptionalExtension};
-use std::path::Path;
+use rusqlite::{Connection, OptionalExtension, params};
 
 /// Creates the `gateway_secrets` table in an existing connection (called
 /// from `db::open()` so the table lives in `agentflare.db`).
@@ -35,7 +34,9 @@ impl std::fmt::Display for SecretError {
                 "no vault passphrase available (set AGENTFLARE_VAULT_PASSPHRASE or run interactively)"
             ),
             SecretError::EncryptionFailed => write!(f, "encryption failed"),
-            SecretError::WrongPassphrase => write!(f, "wrong vault passphrase, or secret is corrupt"),
+            SecretError::WrongPassphrase => {
+                write!(f, "wrong vault passphrase, or secret is corrupt")
+            }
             SecretError::Sqlite(e) => write!(f, "gateway secrets database error: {e}"),
         }
     }
@@ -63,16 +64,21 @@ pub fn set_secret(conn: &Connection, name: &str, value: &str) -> Result<(), Secr
 
 pub fn get_secret(conn: &Connection, name: &str) -> Result<Option<String>, SecretError> {
     let ciphertext: Option<Vec<u8>> = conn
-        .query_row("SELECT ciphertext FROM gateway_secrets WHERE name = ?1", params![name], |r| {
-            r.get(0)
-        })
+        .query_row(
+            "SELECT ciphertext FROM gateway_secrets WHERE name = ?1",
+            params![name],
+            |r| r.get(0),
+        )
         .optional()?;
     let Some(ciphertext) = ciphertext else {
         return Ok(None);
     };
     let passphrase = auth_crypt::get_passphrase().ok_or(SecretError::NoPassphrase)?;
-    let plaintext = auth_crypt::decrypt(&ciphertext, &passphrase).ok_or(SecretError::WrongPassphrase)?;
-    String::from_utf8(plaintext).map(Some).map_err(|_| SecretError::WrongPassphrase)
+    let plaintext =
+        auth_crypt::decrypt(&ciphertext, &passphrase).ok_or(SecretError::WrongPassphrase)?;
+    String::from_utf8(plaintext)
+        .map(Some)
+        .map_err(|_| SecretError::WrongPassphrase)
 }
 
 pub fn list_secrets(conn: &Connection) -> Result<Vec<String>, SecretError> {
@@ -121,7 +127,10 @@ mod tests {
         set_passphrase("test-pass");
         let conn = mem_migrated();
         set_secret(&conn, "github_pat", "ghp_abc123").unwrap();
-        assert_eq!(get_secret(&conn, "github_pat").unwrap(), Some("ghp_abc123".to_string()));
+        assert_eq!(
+            get_secret(&conn, "github_pat").unwrap(),
+            Some("ghp_abc123".to_string())
+        );
         clear_passphrase();
     }
 
@@ -151,7 +160,10 @@ mod tests {
         let conn = mem_migrated();
         set_secret(&conn, "a", "1").unwrap();
         set_secret(&conn, "b", "2").unwrap();
-        assert_eq!(list_secrets(&conn).unwrap(), vec!["a".to_string(), "b".to_string()]);
+        assert_eq!(
+            list_secrets(&conn).unwrap(),
+            vec!["a".to_string(), "b".to_string()]
+        );
         assert!(remove_secret(&conn, "a").unwrap());
         assert!(!remove_secret(&conn, "a").unwrap());
         assert_eq!(list_secrets(&conn).unwrap(), vec!["b".to_string()]);
diff --git a/src/hook.rs b/src/hook.rs
index c82331f5..1a4b0b50 100644
--- a/src/hook.rs
+++ b/src/hook.rs
@@ -114,12 +114,20 @@ fn parse_pre_tool_use(input: &str) -> Option<PreToolUseInput> {
         .get("tool_input")
         .and_then(|ti| ti.get("delaySeconds"))
         .and_then(|d| d.as_u64());
-    Some(PreToolUseInput { session_id, tool_name, delay_seconds })
+    Some(PreToolUseInput {
+        session_id,
+        tool_name,
+        delay_seconds,
+    })
 }
 
 pub fn pre_tool_use(_agent: &str) {
-    let Some(input) = read_stdin_or_skip("PreToolUse") else { return };
-    let Some(parsed) = parse_pre_tool_use(&input) else { return };
+    let Some(input) = read_stdin_or_skip("PreToolUse") else {
+        return;
+    };
+    let Some(parsed) = parse_pre_tool_use(&input) else {
+        return;
+    };
 
     let mut runtime = crate::optimize::load_runtime();
     let now = std::time::SystemTime::now()
@@ -139,22 +147,25 @@ pub fn pre_tool_use(_agent: &str) {
 
     let mut nudges: Vec<String> = vec![];
 
-    if let Some(nudge) = crate::optimize::batching_nudge(&record.recent_tool_calls, &parsed.tool_name) {
+    if let Some(nudge) =
+        crate::optimize::batching_nudge(&record.recent_tool_calls, &parsed.tool_name)
+    {
         nudges.push(nudge);
     }
 
-    if parsed.tool_name == "ScheduleWakeup" {
-        if let Some(delay) = parsed.delay_seconds {
-            if let Some(nudge) = crate::optimize::schedule_wakeup_nudge(delay) {
-                nudges.push(nudge.to_string());
-            }
-        }
+    if parsed.tool_name == "ScheduleWakeup"
+        && let Some(delay) = parsed.delay_seconds
+        && let Some(nudge) = crate::optimize::schedule_wakeup_nudge(delay)
+    {
+        nudges.push(nudge.to_string());
     }
 
-    record.recent_tool_calls.push(crate::optimize::ToolCallRecord {
-        name: parsed.tool_name.clone(),
-        ts: now,
-    });
+    record
+        .recent_tool_calls
+        .push(crate::optimize::ToolCallRecord {
+            name: parsed.tool_name.clone(),
+            ts: now,
+        });
     if record.recent_tool_calls.len() > 10 {
         record.recent_tool_calls.remove(0);
     }
@@ -176,13 +187,19 @@ pub fn pre_tool_use(_agent: &str) {
 pub fn session_end(_agent: &str) {}
 
 pub fn prompt_submit(agent: &str) {
-    let Some(input) = read_stdin_or_skip("UserPromptSubmit") else { return };
+    let Some(input) = read_stdin_or_skip("UserPromptSubmit") else {
+        return;
+    };
     let prompt = extract_prompt(&input);
     let prompt = prompt.trim();
 
     let session_id: Option<String> = serde_json::from_str::<serde_json::Value>(&input)
         .ok()
-        .and_then(|v| v.get("session_id").and_then(|s| s.as_str()).map(String::from));
+        .and_then(|v| {
+            v.get("session_id")
+                .and_then(|s| s.as_str())
+                .map(String::from)
+        });
 
     let mut s = state::load();
 
@@ -221,7 +238,9 @@ pub fn prompt_submit(agent: &str) {
         .iter()
         .any(|c| c.needs_consent && !(c.check)());
     if pending {
-        bits.push(format!("Reminder: `agentflare init --agent {agent}` to finish setup."));
+        bits.push(format!(
+            "Reminder: `agentflare init --agent {agent}` to finish setup."
+        ));
     }
 
     let router = crate::optimize::active_router();
@@ -233,14 +252,15 @@ pub fn prompt_submit(agent: &str) {
             .map(|d| d.as_secs())
             .unwrap_or(0);
         crate::optimize::prune_stale_sessions(&mut runtime, now);
-        let record = runtime
-            .sessions
-            .entry(sid.clone())
-            .or_insert_with(|| crate::optimize::SessionRecord {
-                start_ts: now,
-                turn_count: 0,
-                recent_tool_calls: vec![],
-            });
+        let record =
+            runtime
+                .sessions
+                .entry(sid.clone())
+                .or_insert_with(|| crate::optimize::SessionRecord {
+                    start_ts: now,
+                    turn_count: 0,
+                    recent_tool_calls: vec![],
+                });
         record.turn_count += 1;
 
         let ctx = crate::optimize::RouteContext {
@@ -292,7 +312,10 @@ mod tests {
 
     #[test]
     fn extract_prompt_reads_prompt_key() {
-        assert_eq!(extract_prompt(r#"{"prompt": "Hello World"}"#), "hello world");
+        assert_eq!(
+            extract_prompt(r#"{"prompt": "Hello World"}"#),
+            "hello world"
+        );
     }
 
     #[test]
@@ -307,7 +330,10 @@ mod tests {
 
     #[test]
     fn extract_prompt_prefers_prompt_over_text_and_message() {
-        assert_eq!(extract_prompt(r#"{"prompt": "A", "text": "B", "message": "C"}"#), "a");
+        assert_eq!(
+            extract_prompt(r#"{"prompt": "A", "text": "B", "message": "C"}"#),
+            "a"
+        );
     }
 
     #[test]
@@ -345,7 +371,12 @@ mod tests {
     fn session_start_includes_active_coaching_rule_bodies() {
         use crate::paths::test_support::with_temp_home;
         with_temp_home(|| {
-            crate::coaching::apply_rule("hygiene", "Close sessions promptly", "Wrap up each phase before starting the next.").unwrap();
+            crate::coaching::apply_rule(
+                "hygiene",
+                "Close sessions promptly",
+                "Wrap up each phase before starting the next.",
+            )
+            .unwrap();
 
             // session_start prints via println!; session_start_message
             // (below) covers the actual message content, this just confirms
@@ -356,7 +387,10 @@ mod tests {
             session_start("claude-code");
 
             let bodies = crate::coaching::active_rule_bodies();
-            assert_eq!(bodies, vec!["Wrap up each phase before starting the next.".to_string()]);
+            assert_eq!(
+                bodies,
+                vec!["Wrap up each phase before starting the next.".to_string()]
+            );
         });
     }
 
diff --git a/src/init.rs b/src/init.rs
index 261b9248..0fd0a44c 100644
--- a/src/init.rs
+++ b/src/init.rs
@@ -8,7 +8,7 @@
 use crate::components::{get_components, rule_targets};
 use crate::paths::{agentflare_binary, home};
 use crate::rule_text;
-use serde_json::{json, Map, Value};
+use serde_json::{Map, Value, json};
 use std::fs;
 use std::path::PathBuf;
 
@@ -78,19 +78,19 @@ fn confirm_ponytail_migration(agent: &str, yes: bool) -> bool {
 
 fn has_existing_ponytail_claude() -> bool {
     let path = home().join(".claude").join("settings.json");
-    if let Ok(content) = fs::read_to_string(&path) {
-        if let Ok(settings) = serde_json::from_str::<Value>(&content) {
-            let hooks = settings.get("hooks");
-            let has_ponytail = hooks
-                .and_then(|h| h.get("SessionStart"))
-                .map(|v| v.to_string().contains("ponytail"))
-                .unwrap_or(false);
-            let not_agentflare = hooks
-                .and_then(|h| h.get("SessionStart"))
-                .map(|v| !v.to_string().contains("agentflare"))
-                .unwrap_or(true);
-            return has_ponytail && not_agentflare;
-        }
+    if let Ok(content) = fs::read_to_string(&path)
+        && let Ok(settings) = serde_json::from_str::<Value>(&content)
+    {
+        let hooks = settings.get("hooks");
+        let has_ponytail = hooks
+            .and_then(|h| h.get("SessionStart"))
+            .map(|v| v.to_string().contains("ponytail"))
+            .unwrap_or(false);
+        let not_agentflare = hooks
+            .and_then(|h| h.get("SessionStart"))
+            .map(|v| !v.to_string().contains("agentflare"))
+            .unwrap_or(true);
+        return has_ponytail && not_agentflare;
     }
     false
 }
@@ -105,7 +105,10 @@ fn has_existing_ponytail_cursor() -> bool {
 }
 
 fn has_existing_ponytail_opencode() -> bool {
-    let path = home().join(".config").join("opencode").join("opencode.jsonc");
+    let path = home()
+        .join(".config")
+        .join("opencode")
+        .join("opencode.jsonc");
     if let Ok(content) = fs::read_to_string(&path) {
         has_ponytail_ref(&content) && !content.contains("agentflare")
     } else {
@@ -122,14 +125,20 @@ fn has_ponytail_ref(content: &str) -> bool {
 /// current, or diverging for some other reason) is left untouched, since
 /// that "some other reason" is most likely a user edit.
 fn is_stale_rule(path: &PathBuf, current: &str) -> bool {
-    let Some(filename) = path.file_name().and_then(|f| f.to_str()) else { return false };
+    let Some(filename) = path.file_name().and_then(|f| f.to_str()) else {
+        return false;
+    };
     let superseded = rule_text::superseded(filename);
     if superseded.is_empty() {
         return false;
     }
-    let Ok(existing) = fs::read_to_string(path) else { return false };
+    let Ok(existing) = fs::read_to_string(path) else {
+        return false;
+    };
     existing.trim_end() != current.trim_end()
-        && superseded.iter().any(|old| existing.trim_end() == old.trim_end())
+        && superseded
+            .iter()
+            .any(|old| existing.trim_end() == old.trim_end())
 }
 
 fn prompt_yes(message: &str, agent: &str, yes: bool) -> bool {
@@ -164,7 +173,10 @@ fn confirm_rule_refresh(agent: &str, yes: bool) {
         }
 
         println!();
-        println!("⚠ {} has outdated guidance (from an earlier agentflare version).", path.display());
+        println!(
+            "⚠ {} has outdated guidance (from an earlier agentflare version).",
+            path.display()
+        );
         if !prompt_yes("  Refresh to the current version? [Y/n] ", agent, yes) {
             continue;
         }
@@ -227,20 +239,27 @@ pub fn run(agent: &str, yes: bool) {
 /// rest of `init` since it wires an outside service; idempotent via
 /// `already_registered`, so re-running never re-prompts once wired.
 fn confirm_gateway_integrations(agent: &str, yes: bool) {
-    use crate::gateway_integrations::{already_registered, register, INTEGRATIONS};
+    use crate::gateway_integrations::{INTEGRATIONS, already_registered, register};
 
     for intg in INTEGRATIONS {
         if !(intg.detect)() {
             continue;
         }
         if already_registered(intg.name) {
-            println!("  skip  {} MCP already registered behind the gateway", intg.name);
+            println!(
+                "  skip  {} MCP already registered behind the gateway",
+                intg.name
+            );
             continue;
         }
 
         println!();
         println!("{}", intg.prompt);
-        if !prompt_yes("  Register it behind the agentflare gateway? [Y/n] ", agent, yes) {
+        if !prompt_yes(
+            "  Register it behind the agentflare gateway? [Y/n] ",
+            agent,
+            yes,
+        ) {
             continue;
         }
 
@@ -266,8 +285,18 @@ fn confirm_gateway_integrations(agent: &str, yes: bool) {
 /// flagless commands and older installs that still carry `--agent <host>`
 /// (upgrades stay idempotent either way). It must not match ponytail's own
 /// hook commands (`"<bin>" ponytail hook X"`), so both can coexist per event.
-fn add_hook_entry(hooks_obj: &mut Map<String, Value>, event: &str, marker: &str, command: String, timeout: u64) -> bool {
-    let arr = hooks_obj.entry(event).or_insert_with(|| json!([])).as_array_mut().unwrap();
+fn add_hook_entry(
+    hooks_obj: &mut Map<String, Value>,
+    event: &str,
+    marker: &str,
+    command: String,
+    timeout: u64,
+) -> bool {
+    let arr = hooks_obj
+        .entry(event)
+        .or_insert_with(|| json!([]))
+        .as_array_mut()
+        .unwrap();
     if arr.iter().any(|v| v.to_string().contains(marker)) {
         return false;
     }
@@ -292,16 +321,25 @@ fn wire_claude_code() {
 
     let mut added = false;
     added |= add_hook_entry(
-        hooks_obj, "SessionStart", "hook session-start",
-        format!("\"{bin}\" hook session-start"), 10,
+        hooks_obj,
+        "SessionStart",
+        "hook session-start",
+        format!("\"{bin}\" hook session-start"),
+        10,
     );
     added |= add_hook_entry(
-        hooks_obj, "UserPromptSubmit", "hook prompt-submit",
-        format!("\"{bin}\" hook prompt-submit"), 5,
+        hooks_obj,
+        "UserPromptSubmit",
+        "hook prompt-submit",
+        format!("\"{bin}\" hook prompt-submit"),
+        5,
     );
     added |= add_hook_entry(
-        hooks_obj, "PreToolUse", "hook pre-tool-use",
-        format!("\"{bin}\" hook pre-tool-use"), 5,
+        hooks_obj,
+        "PreToolUse",
+        "hook pre-tool-use",
+        format!("\"{bin}\" hook pre-tool-use"),
+        5,
     );
 
     if !added {
@@ -312,7 +350,10 @@ fn wire_claude_code() {
     if let Some(parent) = path.parent() {
         let _ = fs::create_dir_all(parent);
     }
-    match fs::write(&path, serde_json::to_string_pretty(&settings).unwrap() + "\n") {
+    match fs::write(
+        &path,
+        serde_json::to_string_pretty(&settings).unwrap() + "\n",
+    ) {
         Ok(_) => println!("  ok    ~/.claude/settings.json hooks wired"),
         Err(e) => println!("  fail  writing ~/.claude/settings.json: {e}"),
     }
@@ -340,14 +381,20 @@ fn wire_cursor() {
     if let Some(parent) = path.parent() {
         let _ = fs::create_dir_all(parent);
     }
-    match fs::write(&path, serde_json::to_string_pretty(&content).unwrap() + "\n") {
+    match fs::write(
+        &path,
+        serde_json::to_string_pretty(&content).unwrap() + "\n",
+    ) {
         Ok(_) => println!("  ok    .cursor/hooks.json written"),
         Err(e) => println!("  fail  writing .cursor/hooks.json: {e}"),
     }
 }
 
 fn wire_opencode() {
-    let path = home().join(".config").join("opencode").join("opencode.jsonc");
+    let path = home()
+        .join(".config")
+        .join("opencode")
+        .join("opencode.jsonc");
     let rules_dir = home().join(".config").join("opencode").join("rules");
     let rule_files: &[&str] = &["exa.md", "git.md", "lean-ctx.md"];
 
@@ -376,7 +423,10 @@ fn wire_opencode() {
     // Drop a legacy engram.md entry from an install wired before engram was
     // removed — `rule_files` no longer lists it, so it would otherwise sit
     // there forever, unrewritten, since nothing below ever adds it back.
-    let legacy_engram_path = rules_dir.join("engram.md").to_string_lossy().replace('\\', "/");
+    let legacy_engram_path = rules_dir
+        .join("engram.md")
+        .to_string_lossy()
+        .replace('\\', "/");
     let before_cleanup = arr.len();
     arr.retain(|v| v.as_str() != Some(legacy_engram_path.as_str()));
     let removed_legacy = arr.len() != before_cleanup;
@@ -385,11 +435,9 @@ fn wire_opencode() {
     for &file in rule_files {
         let rule_path = rules_dir.join(file);
         let path_str = rule_path.to_string_lossy().replace('\\', "/");
-        let has_it = arr.iter().any(|v| {
-            v.as_str()
-                .map(|s| s.contains(file))
-                .unwrap_or(false)
-        });
+        let has_it = arr
+            .iter()
+            .any(|v| v.as_str().map(|s| s.contains(file)).unwrap_or(false));
         if !has_it && rule_path.exists() {
             arr.push(json!(path_str));
             added += 1;
@@ -402,7 +450,9 @@ fn wire_opencode() {
         }
         match fs::write(&path, serde_json::to_string_pretty(&config).unwrap() + "\n") {
             Ok(_) if removed_legacy => {
-                println!("  ok    opencode.jsonc instructions wired ({added} rule(s), removed stale engram.md)")
+                println!(
+                    "  ok    opencode.jsonc instructions wired ({added} rule(s), removed stale engram.md)"
+                )
             }
             Ok(_) => println!("  ok    opencode.jsonc instructions wired ({added} rule(s))"),
             Err(e) => println!("  fail  writing opencode.jsonc: {e}"),
@@ -458,15 +508,21 @@ fn wire_ponytail_claude_code() {
         "hooks": [{ "type": "command", "command": format!("\"{bin}\" ponytail hook prompt-submit"), "timeout": 5 }]
     }));
 
-    obj.insert("statusLine".to_string(), json!({
-        "type": "command",
-        "command": format!("\"{bin}\" ponytail hook statusline")
-    }));
+    obj.insert(
+        "statusLine".to_string(),
+        json!({
+            "type": "command",
+            "command": format!("\"{bin}\" ponytail hook statusline")
+        }),
+    );
 
     if let Some(parent) = path.parent() {
         let _ = fs::create_dir_all(parent);
     }
-    match fs::write(&path, serde_json::to_string_pretty(&settings).unwrap() + "\n") {
+    match fs::write(
+        &path,
+        serde_json::to_string_pretty(&settings).unwrap() + "\n",
+    ) {
         Ok(_) => println!("  ok    ponytail hooks wired in ~/.claude/settings.json"),
         Err(e) => println!("  fail  writing ~/.claude/settings.json: {e}"),
     }
@@ -492,25 +548,41 @@ fn wire_ponytail_cursor() {
         content = json!({ "version": 1, "hooks": {} });
     }
 
-    let hooks = content.as_object_mut().unwrap()
-        .entry("hooks").or_insert_with(|| json!({}));
+    let hooks = content
+        .as_object_mut()
+        .unwrap()
+        .entry("hooks")
+        .or_insert_with(|| json!({}));
     let hooks_obj = hooks.as_object_mut().unwrap();
 
-    hooks_obj.entry("sessionStart").or_insert_with(|| json!([])).as_array_mut().unwrap().push(json!({
-        "command": format!("\"{bin}\" ponytail hook session-start"),
-        "type": "command",
-        "timeout": 30
-    }));
-    hooks_obj.entry("beforeSubmitPrompt").or_insert_with(|| json!([])).as_array_mut().unwrap().push(json!({
-        "command": format!("\"{bin}\" ponytail hook prompt-submit"),
-        "type": "command",
-        "timeout": 10
-    }));
+    hooks_obj
+        .entry("sessionStart")
+        .or_insert_with(|| json!([]))
+        .as_array_mut()
+        .unwrap()
+        .push(json!({
+            "command": format!("\"{bin}\" ponytail hook session-start"),
+            "type": "command",
+            "timeout": 30
+        }));
+    hooks_obj
+        .entry("beforeSubmitPrompt")
+        .or_insert_with(|| json!([]))
+        .as_array_mut()
+        .unwrap()
+        .push(json!({
+            "command": format!("\"{bin}\" ponytail hook prompt-submit"),
+            "type": "command",
+            "timeout": 10
+        }));
 
     if let Some(parent) = path.parent() {
         let _ = fs::create_dir_all(parent);
     }
-    match fs::write(&path, serde_json::to_string_pretty(&content).unwrap() + "\n") {
+    match fs::write(
+        &path,
+        serde_json::to_string_pretty(&content).unwrap() + "\n",
+    ) {
         Ok(_) => println!("  ok    ponytail hooks wired in .cursor/hooks.json"),
         Err(e) => println!("  fail  writing .cursor/hooks.json: {e}"),
     }
@@ -763,7 +835,10 @@ mod tests {
     #[test]
     fn wire_opencode_adds_instructions_to_fresh_config() {
         with_temp_home(|| {
-            let config_path = home().join(".config").join("opencode").join("opencode.jsonc");
+            let config_path = home()
+                .join(".config")
+                .join("opencode")
+                .join("opencode.jsonc");
             let rules_dir = home().join(".config").join("opencode").join("rules");
             fs::create_dir_all(&rules_dir).unwrap();
             for &f in &["exa.md", "git.md", "lean-ctx.md"] {
@@ -774,15 +849,22 @@ mod tests {
             let content = fs::read_to_string(&config_path).unwrap();
             let parsed: Value = serde_json::from_str(&content).unwrap();
             let instructions = parsed["instructions"].as_array().unwrap();
-            assert!(instructions.len() >= 1);
-            assert!(instructions.iter().any(|v| v.as_str().unwrap().contains("exa.md")));
+            assert!(!instructions.is_empty());
+            assert!(
+                instructions
+                    .iter()
+                    .any(|v| v.as_str().unwrap().contains("exa.md"))
+            );
         });
     }
 
     #[test]
     fn wire_opencode_is_idempotent() {
         with_temp_home(|| {
-            let config_path = home().join(".config").join("opencode").join("opencode.jsonc");
+            let config_path = home()
+                .join(".config")
+                .join("opencode")
+                .join("opencode.jsonc");
             let rules_dir = home().join(".config").join("opencode").join("rules");
             fs::create_dir_all(&rules_dir).unwrap();
             fs::write(rules_dir.join("exa.md"), "# exa\n").unwrap();
@@ -791,17 +873,27 @@ mod tests {
             let first = fs::read_to_string(&config_path).unwrap();
             wire_opencode();
             let second = fs::read_to_string(&config_path).unwrap();
-            assert_eq!(first, second, "second run should not duplicate instructions");
+            assert_eq!(
+                first, second,
+                "second run should not duplicate instructions"
+            );
         });
     }
 
     #[test]
     fn wire_opencode_preserves_existing_instructions() {
         with_temp_home(|| {
-            let config_path = home().join(".config").join("opencode").join("opencode.jsonc");
+            let config_path = home()
+                .join(".config")
+                .join("opencode")
+                .join("opencode.jsonc");
             let rules_dir = home().join(".config").join("opencode").join("rules");
             fs::create_dir_all(config_path.parent().unwrap()).unwrap();
-            fs::write(&config_path, r#"{"instructions": ["/some/existing/rule.md"], "mcp": {}}"#).unwrap();
+            fs::write(
+                &config_path,
+                r#"{"instructions": ["/some/existing/rule.md"], "mcp": {}}"#,
+            )
+            .unwrap();
             fs::create_dir_all(&rules_dir).unwrap();
             fs::write(rules_dir.join("exa.md"), "# exa\n").unwrap();
 
@@ -816,7 +908,10 @@ mod tests {
     #[test]
     fn wire_opencode_removes_legacy_engram_instruction_on_upgrade() {
         with_temp_home(|| {
-            let config_path = home().join(".config").join("opencode").join("opencode.jsonc");
+            let config_path = home()
+                .join(".config")
+                .join("opencode")
+                .join("opencode.jsonc");
             let rules_dir = home().join(".config").join("opencode").join("rules");
             fs::create_dir_all(&rules_dir).unwrap();
             // Simulates an install wired before engram was removed: all three
@@ -824,7 +919,10 @@ mod tests {
             for f in ["exa.md", "git.md", "lean-ctx.md"] {
                 fs::write(rules_dir.join(f), format!("# {f}\n")).unwrap();
             }
-            let legacy_engram_path = rules_dir.join("engram.md").to_string_lossy().replace('\\', "/");
+            let legacy_engram_path = rules_dir
+                .join("engram.md")
+                .to_string_lossy()
+                .replace('\\', "/");
             fs::create_dir_all(config_path.parent().unwrap()).unwrap();
             fs::write(
                 &config_path,
@@ -835,18 +933,22 @@ mod tests {
                         format!("{}/lean-ctx.md", rules_dir.to_string_lossy().replace('\\', "/")),
                         legacy_engram_path.clone(),
                     ]
-                })).unwrap(),
-            ).unwrap();
+                }))
+                .unwrap(),
+            )
+            .unwrap();
 
             // Nothing new to add (all 3 current rules already wired), so this
             // exercises the "rewrite triggered by removal alone" path.
             wire_opencode();
 
             let content = fs::read_to_string(&config_path).unwrap();
-            assert!(!content.contains(&legacy_engram_path), "stale engram.md entry should be removed: {content}");
+            assert!(
+                !content.contains(&legacy_engram_path),
+                "stale engram.md entry should be removed: {content}"
+            );
             assert!(content.contains("exa.md"));
             assert!(content.contains("lean-ctx.md"));
         });
     }
-
 }
diff --git a/src/main.rs b/src/main.rs
index 56c4ca97..ec61f1b8 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -10,15 +10,15 @@ mod auth_runner;
 mod build_time;
 mod channels;
 mod claims;
-mod gateway_integrations;
-mod gateway_secrets;
 mod cli;
 mod coaching;
 mod components;
+mod cost;
 mod db;
 mod dev_vars;
-mod cost;
 mod errors;
+mod gateway_integrations;
+mod gateway_secrets;
 mod hook;
 mod init;
 mod mcp_prompts;
diff --git a/src/mcp_prompts.rs b/src/mcp_prompts.rs
index c7e8f5ea..abc8a0f4 100644
--- a/src/mcp_prompts.rs
+++ b/src/mcp_prompts.rs
@@ -10,13 +10,34 @@ use rmcp::model::{
 };
 
 const SUB_SKILLS: &[(&str, &str)] = &[
-    ("review", "Over-engineering review of the current diff/branch/repo"),
-    ("audit", "Whole-repo over-engineering audit: ranked list of what to delete"),
-    ("debt", "Harvest `ponytail:` shortcut comments into a tracked ledger"),
-    ("gain", "Measured-impact scoreboard: less code, less cost, more speed"),
-    ("help", "Quick-reference card for all ponytail modes, skills, and commands"),
-    ("playbook", "TDD-aware project companion — red-green-refactor enforced"),
-    ("no-hallucination", "Reality-check layer: blocks invented APIs, deprecated methods, undeclared variables"),
+    (
+        "review",
+        "Over-engineering review of the current diff/branch/repo",
+    ),
+    (
+        "audit",
+        "Whole-repo over-engineering audit: ranked list of what to delete",
+    ),
+    (
+        "debt",
+        "Harvest `ponytail:` shortcut comments into a tracked ledger",
+    ),
+    (
+        "gain",
+        "Measured-impact scoreboard: less code, less cost, more speed",
+    ),
+    (
+        "help",
+        "Quick-reference card for all ponytail modes, skills, and commands",
+    ),
+    (
+        "playbook",
+        "TDD-aware project companion — red-green-refactor enforced",
+    ),
+    (
+        "no-hallucination",
+        "Reality-check layer: blocks invented APIs, deprecated methods, undeclared variables",
+    ),
 ];
 
 pub fn list_prompts() -> Vec<Prompt> {
@@ -71,7 +92,10 @@ pub fn get_prompt(
 }
 
 fn assistant_text(msg: impl Into<String>) -> GetPromptResult {
-    GetPromptResult::new(vec![PromptMessage::new_text(PromptMessageRole::Assistant, msg)])
+    GetPromptResult::new(vec![PromptMessage::new_text(
+        PromptMessageRole::Assistant,
+        msg,
+    )])
 }
 
 fn get_ponytail_mode(request: &GetPromptRequestParams) -> GetPromptResult {
@@ -146,10 +170,7 @@ fn get_artifact_command(request: &GetPromptRequestParams) -> GetPromptResult {
     ))
 }
 
-fn get_handoff_command(
-    request: &GetPromptRequestParams,
-    agent: Option<&str>,
-) -> GetPromptResult {
+fn get_handoff_command(request: &GetPromptRequestParams, agent: Option<&str>) -> GetPromptResult {
     // Identity comes from AGENTFLARE_AGENT baked into the MCP entry by
     // `agentflare init --agent <name>`; claude-code is the legacy default.
     let me = agent.unwrap_or("claude-code");
@@ -277,7 +298,10 @@ mod tests {
         let params = GetPromptRequestParams::new("artifact").with_arguments(args);
         let result = get_prompt(&params, None).unwrap();
         let text = format!("{:?}", result.messages[0].content);
-        assert!(text.contains("publish --type markdown --favicon 🚀"), "{text}");
+        assert!(
+            text.contains("publish --type markdown --favicon 🚀"),
+            "{text}"
+        );
         assert!(text.contains("artifact_publish"), "{text}");
         assert!(text.contains("artifact_delete"), "{text}");
     }
diff --git a/src/mcp_server.rs b/src/mcp_server.rs
index dbfb428a..f1dc5874 100644
--- a/src/mcp_server.rs
+++ b/src/mcp_server.rs
@@ -4,6 +4,7 @@
 
 use crate::optimize;
 use rmcp::{
+    ServerHandler, ServiceExt,
     handler::server::wrapper::Parameters,
     model::{
         AnnotateAble, ErrorData, GetPromptRequestParams, GetPromptResult, Implementation,
@@ -15,7 +16,6 @@ use rmcp::{
     service::{RequestContext, RoleServer},
     tool, tool_handler, tool_router,
     transport::stdio,
-    ServerHandler, ServiceExt,
 };
 use serde::Deserialize;
 
@@ -38,14 +38,18 @@ struct SkillSearchRequest {
     #[schemars(description = "Max results (default 5)")]
     #[serde(default)]
     limit: Option<usize>,
-    #[schemars(description = "'all' = every word must match (default); 'any' = broader recall for retries")]
+    #[schemars(
+        description = "'all' = every word must match (default); 'any' = broader recall for retries"
+    )]
     #[serde(default)]
     mode: Option<String>,
 }
 
 #[derive(Debug, Deserialize, schemars::JsonSchema)]
 struct SkillLoadRequest {
-    #[schemars(description = "Skill name from skill_search; qualify as 'source:name' if ambiguous")]
+    #[schemars(
+        description = "Skill name from skill_search; qualify as 'source:name' if ambiguous"
+    )]
     name: String,
     #[schemars(description = "true = load the original even when a compressed copy exists")]
     #[serde(default)]
@@ -59,7 +63,9 @@ struct GatewaySearchRequest {
     #[schemars(description = "Max results (default 5)")]
     #[serde(default)]
     limit: Option<usize>,
-    #[schemars(description = "'all' = every word must match (default); 'any' = broader recall for retries")]
+    #[schemars(
+        description = "'all' = every word must match (default); 'any' = broader recall for retries"
+    )]
     #[serde(default)]
     mode: Option<String>,
 }
@@ -170,15 +176,21 @@ struct ArtifactPublishRequest {
     #[schemars(description = "html | markdown | mermaid | diagram | text (default: text)")]
     #[serde(default)]
     r#type: Option<String>,
-    #[schemars(description = "Full artifact content (HTML document, markdown source, plain text, ...)")]
+    #[schemars(
+        description = "Full artifact content (HTML document, markdown source, plain text, ...)"
+    )]
     content: String,
     #[schemars(description = "Session ID for grouping artifacts (optional)")]
     #[serde(default)]
     session_id: Option<String>,
-    #[schemars(description = "Existing artifact id to update in place — keeps the same URL and live-reloads open viewers")]
+    #[schemars(
+        description = "Existing artifact id to update in place — keeps the same URL and live-reloads open viewers"
+    )]
     #[serde(default)]
     update_id: Option<String>,
-    #[schemars(description = "Short label for this version, shown in history (e.g. \"draft\", \"final\")")]
+    #[schemars(
+        description = "Short label for this version, shown in history (e.g. \"draft\", \"final\")"
+    )]
     #[serde(default)]
     label: Option<String>,
     #[schemars(description = "One-line description shown in the gallery")]
@@ -187,16 +199,24 @@ struct ArtifactPublishRequest {
     #[schemars(description = "One or two emoji used as the page icon")]
     #[serde(default)]
     favicon: Option<String>,
-    #[schemars(description = "Optimistic-concurrency guard: update only applies if the artifact's current version equals this; otherwise a version-conflict error is returned")]
+    #[schemars(
+        description = "Optimistic-concurrency guard: update only applies if the artifact's current version equals this; otherwise a version-conflict error is returned"
+    )]
     #[serde(default)]
     base_version: Option<u32>,
-    #[schemars(description = "Handoff envelope: which agent/runtime is publishing (e.g. claude-code, codex)")]
+    #[schemars(
+        description = "Handoff envelope: which agent/runtime is publishing (e.g. claude-code, codex)"
+    )]
     #[serde(default)]
     sender: Option<String>,
-    #[schemars(description = "Handoff envelope: agent/runtime this artifact is addressed to — for WORK PRODUCTS only; facts and decisions belong in memory (memory_remember), not artifacts")]
+    #[schemars(
+        description = "Handoff envelope: agent/runtime this artifact is addressed to — for WORK PRODUCTS only; facts and decisions belong in memory (memory_remember), not artifacts"
+    )]
     #[serde(default)]
     recipient: Option<String>,
-    #[schemars(description = "Handoff envelope: thread this belongs to; replies reuse the sender's thread_id")]
+    #[schemars(
+        description = "Handoff envelope: thread this belongs to; replies reuse the sender's thread_id"
+    )]
     #[serde(default)]
     thread_id: Option<String>,
     #[schemars(description = "Handoff envelope: artifact id this replies to")]
@@ -210,11 +230,15 @@ struct ArtifactPublishRequest {
 /// intended handoff can't silently land in no inbox.
 #[derive(Debug, Default, Deserialize, schemars::JsonSchema)]
 struct HandoffRequest {
-    #[schemars(description = "Agent/runtime this handoff is addressed to — its inbox (artifact_list recipient=...). Required.")]
+    #[schemars(
+        description = "Agent/runtime this handoff is addressed to — its inbox (artifact_list recipient=...). Required."
+    )]
     recipient: String,
     #[schemars(description = "Short name/brief for the handoff, shown in the recipient's inbox")]
     name: String,
-    #[schemars(description = "The work product being handed off (diff, review, document, ...). Prepend the brief so the recipient knows the ask.")]
+    #[schemars(
+        description = "The work product being handed off (diff, review, document, ...). Prepend the brief so the recipient knows the ask."
+    )]
     content: String,
     #[schemars(description = "html | markdown | mermaid | diagram | text (default: markdown)")]
     #[serde(default)]
@@ -360,7 +384,9 @@ struct MemoryRelateRequest {
     source_id: i64,
     #[schemars(description = "Target observation ID")]
     target_id: i64,
-    #[schemars(description = "Relation: related|compatible|scoped|conflicts_with|supersedes|not_conflict")]
+    #[schemars(
+        description = "Relation: related|compatible|scoped|conflicts_with|supersedes|not_conflict"
+    )]
     relation: String,
     #[schemars(description = "Reason for the relation")]
     #[serde(default)]
@@ -489,7 +515,9 @@ impl ArtifactBackend {
 
 #[tool_router]
 impl AgentflareMcp {
-    #[tool(description = "Check if a session should be refreshed based on turn count and elapsed time.")]
+    #[tool(
+        description = "Check if a session should be refreshed based on turn count and elapsed time."
+    )]
     fn check_session_health(
         &self,
         Parameters(CheckSessionHealthRequest { session_id }): Parameters<CheckSessionHealthRequest>,
@@ -504,10 +532,14 @@ impl AgentflareMcp {
             .unwrap_or(0);
         let result = match runtime.sessions.get(&session_id) {
             Some(record) => match optimize::session_hygiene_nudge(record, now) {
-                Some(nudge) => serde_json::json!({"session_id": session_id, "status": "stale", "nudge": nudge}),
+                Some(nudge) => {
+                    serde_json::json!({"session_id": session_id, "status": "stale", "nudge": nudge})
+                }
                 None => serde_json::json!({"session_id": session_id, "status": "healthy"}),
             },
-            None => serde_json::json!({"session_id": session_id, "status": "unknown", "message": "Session not tracked"}),
+            None => {
+                serde_json::json!({"session_id": session_id, "status": "unknown", "message": "Session not tracked"})
+            }
         };
         Ok(serde_json::to_string_pretty(&result).unwrap_or_default())
     }
@@ -560,7 +592,9 @@ impl AgentflareMcp {
         Ok(f(reg))
     }
 
-    #[tool(description = "Search installed skills (all agents' skill dirs) by task description. Returns name, source, description, and estimated token cost; call skill_load to fetch one.")]
+    #[tool(
+        description = "Search installed skills (all agents' skill dirs) by task description. Returns name, source, description, and estimated token cost; call skill_load to fetch one."
+    )]
     fn skill_search(
         &self,
         Parameters(SkillSearchRequest { query, limit, mode }): Parameters<SkillSearchRequest>,
@@ -575,7 +609,7 @@ impl AgentflareMcp {
                 return Err(ErrorData::invalid_params(
                     format!("mode must be 'all' or 'any', got '{other}'"),
                     None,
-                ))
+                ));
             }
         };
         let hits = self
@@ -584,7 +618,9 @@ impl AgentflareMcp {
         Ok(serde_json::to_string_pretty(&hits).unwrap_or_default())
     }
 
-    #[tool(description = "Load a skill's full instructions by name. Serves the compressed copy when one exists (original=true for the source). Sibling reference files are listed, not inlined.")]
+    #[tool(
+        description = "Load a skill's full instructions by name. Serves the compressed copy when one exists (original=true for the source). Sibling reference files are listed, not inlined."
+    )]
     fn skill_load(
         &self,
         Parameters(SkillLoadRequest { name, original }): Parameters<SkillLoadRequest>,
@@ -629,16 +665,14 @@ impl AgentflareMcp {
                 // Overridden stores (tests) stay private: the shared fixed
                 // port serves the default store, not this one.
                 Some(dir) => {
-                    let store =
-                        std::sync::Arc::new(agentflare_artifacts::ArtifactStore::new(dir));
+                    let store = std::sync::Arc::new(agentflare_artifacts::ArtifactStore::new(dir));
                     let server = agentflare_artifacts::ArtifactServer::start(store.clone(), 0)
                         .map_err(|e| ErrorData::internal_error(e.to_string(), None))?;
                     (store, ArtifactBackend::Owned(server))
                 }
                 None => {
                     let dir = crate::paths::home().join(".agentflare").join("artifacts");
-                    let store =
-                        std::sync::Arc::new(agentflare_artifacts::ArtifactStore::new(dir));
+                    let store = std::sync::Arc::new(agentflare_artifacts::ArtifactStore::new(dir));
                     let backend = Self::shared_backend(&store)?;
                     (store, backend)
                 }
@@ -679,7 +713,9 @@ impl AgentflareMcp {
         }
     }
 
-    #[tool(description = "Publish a live-shareable artifact page (HTML, markdown, mermaid, text, ...) and return its local URL. Pass update_id to update in place — same URL, open viewers live-reload; every publish snapshots a version. Pass base_version to fail on concurrent edits instead of clobbering.")]
+    #[tool(
+        description = "Publish a live-shareable artifact page (HTML, markdown, mermaid, text, ...) and return its local URL. Pass update_id to update in place — same URL, open viewers live-reload; every publish snapshots a version. Pass base_version to fail on concurrent edits instead of clobbering."
+    )]
     fn artifact_publish(
         &self,
         Parameters(ArtifactPublishRequest {
@@ -733,7 +769,9 @@ impl AgentflareMcp {
         Ok(serde_json::to_string_pretty(&result).unwrap_or_default())
     }
 
-    #[tool(description = "Hand a work product to another agent's inbox. Like artifact_publish, but recipient is REQUIRED, so the artifact is routed and shows up in that agent's artifact_list(recipient=...) inbox — it can't silently land nowhere. Use for agent-to-agent handoffs (reviews, diffs, docs); use artifact_publish for plain shareable pages. Sender is this runtime's own identity.")]
+    #[tool(
+        description = "Hand a work product to another agent's inbox. Like artifact_publish, but recipient is REQUIRED, so the artifact is routed and shows up in that agent's artifact_list(recipient=...) inbox — it can't silently land nowhere. Use for agent-to-agent handoffs (reviews, diffs, docs); use artifact_publish for plain shareable pages. Sender is this runtime's own identity."
+    )]
     fn handoff(
         &self,
         Parameters(HandoffRequest {
@@ -821,10 +859,16 @@ impl AgentflareMcp {
         }
     }
 
-    #[tool(description = "List published artifacts (id, name, type, version, description, session, handoff envelope) with their local URLs. Filter by session_id, recipient (inbox), or thread_id.")]
+    #[tool(
+        description = "List published artifacts (id, name, type, version, description, session, handoff envelope) with their local URLs. Filter by session_id, recipient (inbox), or thread_id."
+    )]
     fn artifact_list(
         &self,
-        Parameters(ArtifactListRequest { session_id, recipient, thread_id }): Parameters<ArtifactListRequest>,
+        Parameters(ArtifactListRequest {
+            session_id,
+            recipient,
+            thread_id,
+        }): Parameters<ArtifactListRequest>,
     ) -> Result<String, ErrorData> {
         let (store, base) = self.ensure_artifact_server()?;
         let summaries = store
@@ -833,16 +877,17 @@ impl AgentflareMcp {
         let items: Vec<serde_json::Value> = summaries
             .iter()
             .filter(|s| {
-                recipient.as_deref().is_none_or(|r| s.recipient.as_deref() == Some(r))
-                    && thread_id.as_deref().is_none_or(|t| s.thread_id.as_deref() == Some(t))
+                recipient
+                    .as_deref()
+                    .is_none_or(|r| s.recipient.as_deref() == Some(r))
+                    && thread_id
+                        .as_deref()
+                        .is_none_or(|t| s.thread_id.as_deref() == Some(t))
             })
             .map(|s| {
                 let mut v = serde_json::to_value(s).unwrap_or_default();
                 if let Some(obj) = v.as_object_mut() {
-                    obj.insert(
-                        "url".into(),
-                        serde_json::json!(format!("{base}/{}", s.id)),
-                    );
+                    obj.insert("url".into(), serde_json::json!(format!("{base}/{}", s.id)));
                 }
                 v
             })
@@ -850,7 +895,9 @@ impl AgentflareMcp {
         Ok(serde_json::to_string_pretty(&items).unwrap_or_default())
     }
 
-    #[tool(description = "Fetch an artifact's full content and metadata by id; pass version to read an older snapshot. Version history itself is at GET /{id}/versions.")]
+    #[tool(
+        description = "Fetch an artifact's full content and metadata by id; pass version to read an older snapshot. Version history itself is at GET /{id}/versions."
+    )]
     fn artifact_get(
         &self,
         Parameters(ArtifactGetRequest { id, version }): Parameters<ArtifactGetRequest>,
@@ -867,10 +914,16 @@ impl AgentflareMcp {
         Ok(serde_json::to_string_pretty(&artifact).unwrap_or_default())
     }
 
-    #[tool(description = "Unified diff between two versions of an artifact; to_version defaults to the latest. Use after an update to see what changed.")]
+    #[tool(
+        description = "Unified diff between two versions of an artifact; to_version defaults to the latest. Use after an update to see what changed."
+    )]
     fn artifact_diff(
         &self,
-        Parameters(ArtifactDiffRequest { id, from_version, to_version }): Parameters<ArtifactDiffRequest>,
+        Parameters(ArtifactDiffRequest {
+            id,
+            from_version,
+            to_version,
+        }): Parameters<ArtifactDiffRequest>,
     ) -> Result<String, ErrorData> {
         if id.trim().is_empty() {
             return Err(ErrorData::invalid_params("id is required", None));
@@ -880,10 +933,14 @@ impl AgentflareMcp {
             Some(v) => v,
             None => store.get(&id).map_err(Self::artifact_error)?.version,
         };
-        store.diff(&id, from_version, to).map_err(Self::artifact_error)
+        store
+            .diff(&id, from_version, to)
+            .map_err(Self::artifact_error)
     }
 
-    #[tool(description = "Case-insensitive search across artifact names, descriptions, and content; returns matching summaries with a snippet around the first content match.")]
+    #[tool(
+        description = "Case-insensitive search across artifact names, descriptions, and content; returns matching summaries with a snippet around the first content match."
+    )]
     fn artifact_search(
         &self,
         Parameters(ArtifactSearchRequest { query, session_id }): Parameters<ArtifactSearchRequest>,
@@ -894,13 +951,19 @@ impl AgentflareMcp {
         let (store, base) = self.ensure_artifact_server()?;
         let needle = query.to_lowercase();
         let mut hits = Vec::new();
-        for summary in store.list(session_id.as_deref()).map_err(Self::artifact_error)? {
+        for summary in store
+            .list(session_id.as_deref())
+            .map_err(Self::artifact_error)?
+        {
             let name_hit = summary.name.to_lowercase().contains(&needle);
             let desc_hit = summary
                 .description
                 .as_deref()
                 .is_some_and(|d| d.to_lowercase().contains(&needle));
-            let content = store.get(&summary.id).map(|a| a.content).unwrap_or_default();
+            let content = store
+                .get(&summary.id)
+                .map(|a| a.content)
+                .unwrap_or_default();
             let content_pos = content.to_lowercase().find(&needle);
             if !(name_hit || desc_hit || content_pos.is_some()) {
                 continue;
@@ -944,10 +1007,16 @@ impl AgentflareMcp {
         Ok(serde_json::json!({ "deleted": deleted }).to_string())
     }
 
-    #[tool(description = "Send a text message out to a chat platform (telegram, slack, or discord). The bot token must already be stored as the gateway secret '<platform>_bot_token'. target is the Telegram chat_id or Slack/Discord channel id.")]
+    #[tool(
+        description = "Send a text message out to a chat platform (telegram, slack, or discord). The bot token must already be stored as the gateway secret '<platform>_bot_token'. target is the Telegram chat_id or Slack/Discord channel id."
+    )]
     fn channel_send(
         &self,
-        Parameters(ChannelSendRequest { platform, target, message }): Parameters<ChannelSendRequest>,
+        Parameters(ChannelSendRequest {
+            platform,
+            target,
+            message,
+        }): Parameters<ChannelSendRequest>,
     ) -> Result<String, ErrorData> {
         let plat = crate::channels::Platform::parse(&platform).ok_or_else(|| {
             ErrorData::invalid_params(
@@ -962,7 +1031,9 @@ impl AgentflareMcp {
         Ok(serde_json::json!({ "sent": true, "platform": platform, "target": target }).to_string())
     }
 
-    #[tool(description = "Claim a GitHub issue/PR so other agents don't duplicate the work. Returns 'acquired' if you now own it, or 'held' with the current owner if a live claim exists. Only stale (past-TTL) or done claims are stolen. Re-heartbeat periodically to keep it.")]
+    #[tool(
+        description = "Claim a GitHub issue/PR so other agents don't duplicate the work. Returns 'acquired' if you now own it, or 'held' with the current owner if a live claim exists. Only stale (past-TTL) or done claims are stolen. Re-heartbeat periodically to keep it."
+    )]
     fn claim_acquire(
         &self,
         Parameters(ClaimTargetRequest { target, repo }): Parameters<ClaimTargetRequest>,
@@ -972,10 +1043,19 @@ impl AgentflareMcp {
         let repo_overridden = repo.as_ref().is_some_and(|r| !r.is_empty());
         let (conn, repo) = Self::claim_ctx(&target, repo)?;
         let owner = crate::claims::owner_id();
-        let commit = if repo_overridden { None } else { Self::git_provenance().and_then(|g| g.commit) };
+        let commit = if repo_overridden {
+            None
+        } else {
+            Self::git_provenance().and_then(|g| g.commit)
+        };
         let outcome = crate::claims::acquire(
-            &conn, &repo, &target, &owner, commit.as_deref(),
-            crate::claims::now(), crate::claims::ttl_secs(),
+            &conn,
+            &repo,
+            &target,
+            &owner,
+            commit.as_deref(),
+            crate::claims::now(),
+            crate::claims::ttl_secs(),
         )
         .map_err(|e| ErrorData::internal_error(e.to_string(), None))?;
         Ok(match outcome {
@@ -989,7 +1069,9 @@ impl AgentflareMcp {
         .to_string())
     }
 
-    #[tool(description = "Refresh the lease on a claim you own, so it isn't reclaimed as stale. Returns refreshed=false if the claim is gone or owned by someone else.")]
+    #[tool(
+        description = "Refresh the lease on a claim you own, so it isn't reclaimed as stale. Returns refreshed=false if the claim is gone or owned by someone else."
+    )]
     fn claim_heartbeat(
         &self,
         Parameters(ClaimTargetRequest { target, repo }): Parameters<ClaimTargetRequest>,
@@ -1001,7 +1083,9 @@ impl AgentflareMcp {
         Ok(serde_json::json!({ "refreshed": ok, "repo": repo, "target": target }).to_string())
     }
 
-    #[tool(description = "Release a claim you own, freeing the target for other agents. Returns released=false if it wasn't yours.")]
+    #[tool(
+        description = "Release a claim you own, freeing the target for other agents. Returns released=false if it wasn't yours."
+    )]
     fn claim_release(
         &self,
         Parameters(ClaimTargetRequest { target, repo }): Parameters<ClaimTargetRequest>,
@@ -1013,7 +1097,9 @@ impl AgentflareMcp {
         Ok(serde_json::json!({ "released": ok, "repo": repo, "target": target }).to_string())
     }
 
-    #[tool(description = "Mark a claim you own as done — keeps the audit row (unlike release, which deletes it) while freeing the target for re-acquisition. Returns done=false if it wasn't yours.")]
+    #[tool(
+        description = "Mark a claim you own as done — keeps the audit row (unlike release, which deletes it) while freeing the target for re-acquisition. Returns done=false if it wasn't yours."
+    )]
     fn claim_done(
         &self,
         Parameters(ClaimTargetRequest { target, repo }): Parameters<ClaimTargetRequest>,
@@ -1025,10 +1111,16 @@ impl AgentflareMcp {
         Ok(serde_json::json!({ "done": ok, "repo": repo, "target": target }).to_string())
     }
 
-    #[tool(description = "List work claims. Defaults to live claims for the current repo; set all=true to include stale/done, all_repos=true to span every repo.")]
+    #[tool(
+        description = "List work claims. Defaults to live claims for the current repo; set all=true to include stale/done, all_repos=true to span every repo."
+    )]
     fn claim_list(
         &self,
-        Parameters(ClaimListRequest { repo, all, all_repos }): Parameters<ClaimListRequest>,
+        Parameters(ClaimListRequest {
+            repo,
+            all,
+            all_repos,
+        }): Parameters<ClaimListRequest>,
     ) -> Result<String, ErrorData> {
         let conn = Self::claim_db()?;
         let scope = if all_repos {
@@ -1041,19 +1133,29 @@ impl AgentflareMcp {
                 )
             })?)
         };
-        let claims = crate::claims::list(&conn, scope.as_deref(), all, crate::claims::now(), crate::claims::ttl_secs())
-            .map_err(|e| ErrorData::internal_error(e.to_string(), None))?;
+        let claims = crate::claims::list(
+            &conn,
+            scope.as_deref(),
+            all,
+            crate::claims::now(),
+            crate::claims::ttl_secs(),
+        )
+        .map_err(|e| ErrorData::internal_error(e.to_string(), None))?;
         Ok(serde_json::to_string_pretty(&claims).unwrap_or_default())
     }
 
     /// Opens the ledger db, mapping errors to MCP internal_error.
     fn claim_db() -> Result<rusqlite::Connection, ErrorData> {
-        crate::db::open().map_err(|e| ErrorData::internal_error(format!("cannot open ledger: {e}"), None))
+        crate::db::open()
+            .map_err(|e| ErrorData::internal_error(format!("cannot open ledger: {e}"), None))
     }
 
     /// Shared prelude for the per-target claim tools: validate target, open the
     /// ledger, resolve the repo key.
-    fn claim_ctx(target: &str, repo: Option<String>) -> Result<(rusqlite::Connection, String), ErrorData> {
+    fn claim_ctx(
+        target: &str,
+        repo: Option<String>,
+    ) -> Result<(rusqlite::Connection, String), ErrorData> {
         if target.trim().is_empty() {
             return Err(ErrorData::invalid_params("target is required", None));
         }
@@ -1067,15 +1169,24 @@ impl AgentflareMcp {
         Ok((conn, repo))
     }
 
-    #[tool(description = "Submit a finder's review findings for a round (each finding is {file, line, message, severity?, category?}). Replaces this finder's prior findings for the round. Call from each reviewing agent, then call review_consensus to verify + dedup + tag.")]
+    #[tool(
+        description = "Submit a finder's review findings for a round (each finding is {file, line, message, severity?, category?}). Replaces this finder's prior findings for the round. Call from each reviewing agent, then call review_consensus to verify + dedup + tag."
+    )]
     fn review_submit(
         &self,
-        Parameters(ReviewSubmitRequest { findings, pr, agent, repo }): Parameters<ReviewSubmitRequest>,
+        Parameters(ReviewSubmitRequest {
+            findings,
+            pr,
+            agent,
+            repo,
+        }): Parameters<ReviewSubmitRequest>,
     ) -> Result<String, ErrorData> {
         let conn = Self::claim_db()?;
         let repo = Self::resolve_repo_or_err(repo)?;
         let pr = Self::resolve_round(pr)?;
-        let agent = agent.filter(|s| !s.is_empty()).unwrap_or_else(crate::review::submitter_name);
+        let agent = agent
+            .filter(|s| !s.is_empty())
+            .unwrap_or_else(crate::review::submitter_name);
         let parsed: Vec<crate::review::Finding> = findings
             .into_iter()
             .map(serde_json::from_value)
@@ -1083,13 +1194,23 @@ impl AgentflareMcp {
             .map_err(|e| ErrorData::invalid_params(format!("invalid finding: {e}"), None))?;
         let n = crate::review::submit(&conn, &repo, &pr, &agent, &parsed, crate::claims::now())
             .map_err(|e| ErrorData::internal_error(e.to_string(), None))?;
-        Ok(serde_json::json!({ "submitted": n, "repo": repo, "pr": pr, "agent": agent }).to_string())
+        Ok(
+            serde_json::json!({ "submitted": n, "repo": repo, "pr": pr, "agent": agent })
+                .to_string(),
+        )
     }
 
-    #[tool(description = "Verify all submitted findings for a round against the git diff (base...head), dedup overlapping ones, and tag each CONFIRMED/UNIQUE/DISPUTED/UNVERIFIED. Returns the ranked consensus items.")]
+    #[tool(
+        description = "Verify all submitted findings for a round against the git diff (base...head), dedup overlapping ones, and tag each CONFIRMED/UNIQUE/DISPUTED/UNVERIFIED. Returns the ranked consensus items."
+    )]
     fn review_consensus(
         &self,
-        Parameters(ReviewConsensusRequest { pr, base, head, repo }): Parameters<ReviewConsensusRequest>,
+        Parameters(ReviewConsensusRequest {
+            pr,
+            base,
+            head,
+            repo,
+        }): Parameters<ReviewConsensusRequest>,
     ) -> Result<String, ErrorData> {
         let conn = Self::claim_db()?;
         let repo = Self::resolve_repo_or_err(repo)?;
@@ -1139,10 +1260,17 @@ impl AgentflareMcp {
         Ok(serde_json::json!({ "cleared": n, "repo": repo, "pr": pr }).to_string())
     }
 
-    #[tool(description = "Record this round's per-agent accuracy: how many of each finder's findings cited a real changed line (verified) vs total. Idempotent per round. Feeds review_scores.")]
+    #[tool(
+        description = "Record this round's per-agent accuracy: how many of each finder's findings cited a real changed line (verified) vs total. Idempotent per round. Feeds review_scores."
+    )]
     fn review_record(
         &self,
-        Parameters(ReviewConsensusRequest { pr, base, head, repo }): Parameters<ReviewConsensusRequest>,
+        Parameters(ReviewConsensusRequest {
+            pr,
+            base,
+            head,
+            repo,
+        }): Parameters<ReviewConsensusRequest>,
     ) -> Result<String, ErrorData> {
         let conn = Self::claim_db()?;
         let repo = Self::resolve_repo_or_err(repo)?;
@@ -1152,18 +1280,31 @@ impl AgentflareMcp {
         let diff = crate::review::compute_diff(base.as_deref(), head.as_deref())
             .map_err(|e| ErrorData::invalid_params(e, None))?;
         let changed = crate::review::changed_lines(&diff);
-        let n = crate::review::record_round(&conn, &repo, &pr, &findings, &changed, crate::claims::now())
-            .map_err(|e| ErrorData::internal_error(e.to_string(), None))?;
+        let n = crate::review::record_round(
+            &conn,
+            &repo,
+            &pr,
+            &findings,
+            &changed,
+            crate::claims::now(),
+        )
+        .map_err(|e| ErrorData::internal_error(e.to_string(), None))?;
         Ok(serde_json::json!({ "recorded_agents": n, "repo": repo, "pr": pr }).to_string())
     }
 
-    #[tool(description = "Per-agent accuracy across recorded rounds: verified/total citation rate, ranked. Use to weight which finders to trust or dispatch.")]
+    #[tool(
+        description = "Per-agent accuracy across recorded rounds: verified/total citation rate, ranked. Use to weight which finders to trust or dispatch."
+    )]
     fn review_scores(
         &self,
         Parameters(ReviewScoresRequest { repo, all_repos }): Parameters<ReviewScoresRequest>,
     ) -> Result<String, ErrorData> {
         let conn = Self::claim_db()?;
-        let scope = if all_repos { None } else { Some(Self::resolve_repo_or_err(repo)?) };
+        let scope = if all_repos {
+            None
+        } else {
+            Some(Self::resolve_repo_or_err(repo)?)
+        };
         let scores = crate::review::scores(&conn, scope.as_deref())
             .map_err(|e| ErrorData::internal_error(e.to_string(), None))?;
         Ok(serde_json::to_string_pretty(&scores).unwrap_or_default())
@@ -1171,7 +1312,10 @@ impl AgentflareMcp {
 
     fn resolve_repo_or_err(repo: Option<String>) -> Result<String, ErrorData> {
         crate::claims::resolve_repo(repo).ok_or_else(|| {
-            ErrorData::invalid_params("could not determine repo — run in a git repo or pass repo=owner/name", None)
+            ErrorData::invalid_params(
+                "could not determine repo — run in a git repo or pass repo=owner/name",
+                None,
+            )
         })
     }
 
@@ -1191,11 +1335,16 @@ impl AgentflareMcp {
     }
 
     fn gateway_db_path() -> std::path::PathBuf {
-        dirs::data_local_dir().unwrap_or_else(std::env::temp_dir).join("agentflare").join("gateway.db")
+        dirs::data_local_dir()
+            .unwrap_or_else(std::env::temp_dir)
+            .join("agentflare")
+            .join("gateway.db")
     }
 
     fn load_gateway_config() -> gateway_registry::GatewayConfig {
-        let path = crate::paths::home().join(".agentflare").join("gateway.toml");
+        let path = crate::paths::home()
+            .join(".agentflare")
+            .join("gateway.toml");
         match std::fs::read_to_string(&path) {
             Ok(s) => match gateway_registry::parse_config(&s) {
                 Ok(config) => config,
@@ -1238,19 +1387,21 @@ impl AgentflareMcp {
         };
         names
             .into_iter()
-            .filter_map(|name| match crate::gateway_secrets::get_secret(&conn, &name) {
-                Ok(Some(v)) => Some((name, v)),
-                Ok(None) => None,
-                Err(e) => {
-                    // A wrong/missing vault passphrase used to look
-                    // identical to "no secret configured" — `.ok().flatten()`
-                    // discarded the `Err` entirely. Surface it so a wrong
-                    // passphrase is at least visible in stderr instead of
-                    // silently leaving downstream backends uncredentialed.
-                    eprintln!("agentflare: failed to resolve gateway secret '{name}': {e}");
-                    None
-                }
-            })
+            .filter_map(
+                |name| match crate::gateway_secrets::get_secret(&conn, &name) {
+                    Ok(Some(v)) => Some((name, v)),
+                    Ok(None) => None,
+                    Err(e) => {
+                        // A wrong/missing vault passphrase used to look
+                        // identical to "no secret configured" — `.ok().flatten()`
+                        // discarded the `Err` entirely. Surface it so a wrong
+                        // passphrase is at least visible in stderr instead of
+                        // silently leaving downstream backends uncredentialed.
+                        eprintln!("agentflare: failed to resolve gateway secret '{name}': {e}");
+                        None
+                    }
+                },
+            )
             .collect()
     }
 
@@ -1270,7 +1421,10 @@ impl AgentflareMcp {
     ) -> Result<tokio::sync::MutexGuard<'_, Option<gateway_registry::Registry>>, ErrorData> {
         let mut guard = self.gateway_registry.lock().await;
         if guard.is_none() {
-            let db_path = self.gateway_db_override.clone().unwrap_or_else(Self::gateway_db_path);
+            let db_path = self
+                .gateway_db_override
+                .clone()
+                .unwrap_or_else(Self::gateway_db_path);
             let config = Self::load_gateway_config();
             let secrets = Self::resolve_gateway_secrets();
             let reg = gateway_registry::Registry::open_default(&db_path, &config, &secrets)
@@ -1287,7 +1441,9 @@ impl AgentflareMcp {
         Ok(guard)
     }
 
-    #[tool(description = "Search downstream MCP servers' tools by task description. Returns server, tool, description, and input_schema; call gateway_execute to run one.")]
+    #[tool(
+        description = "Search downstream MCP servers' tools by task description. Returns server, tool, description, and input_schema; call gateway_execute to run one."
+    )]
     async fn gateway_search(
         &self,
         Parameters(GatewaySearchRequest { query, limit, mode }): Parameters<GatewaySearchRequest>,
@@ -1299,7 +1455,10 @@ impl AgentflareMcp {
             None | Some("all") => gateway_registry::MatchMode::All,
             Some("any") => gateway_registry::MatchMode::Any,
             Some(other) => {
-                return Err(ErrorData::invalid_params(format!("mode must be 'all' or 'any', got '{other}'"), None))
+                return Err(ErrorData::invalid_params(
+                    format!("mode must be 'all' or 'any', got '{other}'"),
+                    None,
+                ));
             }
         };
         let guard = self.ensure_gateway_registry().await?;
@@ -1310,20 +1469,30 @@ impl AgentflareMcp {
         Ok(serde_json::to_string_pretty(&hits).unwrap_or_default())
     }
 
-    #[tool(description = "Execute a tool on a downstream MCP server found via gateway_search. args must match that tool's input_schema.")]
+    #[tool(
+        description = "Execute a tool on a downstream MCP server found via gateway_search. args must match that tool's input_schema."
+    )]
     async fn gateway_execute(
         &self,
         Parameters(GatewayExecuteRequest { server, tool, args }): Parameters<GatewayExecuteRequest>,
     ) -> Result<String, ErrorData> {
         if server.trim().is_empty() || tool.trim().is_empty() {
-            return Err(ErrorData::invalid_params("server and tool are required", None));
+            return Err(ErrorData::invalid_params(
+                "server and tool are required",
+                None,
+            ));
         }
-        let args = args.map(serde_json::Value::Object).unwrap_or(serde_json::Value::Null);
+        let args = args
+            .map(serde_json::Value::Object)
+            .unwrap_or(serde_json::Value::Null);
         let guard = self.ensure_gateway_registry().await?;
         let reg = guard.as_ref().expect("ensured above");
         match reg.execute(&server, &tool, args).await {
             Ok(value) => {
-                let capped = gateway_registry::truncate_if_needed(&value, gateway_registry::DEFAULT_MAX_CHARS);
+                let capped = gateway_registry::truncate_if_needed(
+                    &value,
+                    gateway_registry::DEFAULT_MAX_CHARS,
+                );
                 Ok(serde_json::to_string_pretty(&capped).unwrap_or_default())
             }
             Err(e @ gateway_registry::GatewayError::ServerNotFound(_))
@@ -1337,7 +1506,10 @@ impl AgentflareMcp {
             // controlled messages. Redact before it reaches the LLM: a
             // downstream server's raw error could otherwise leak a file
             // path, connection string, or an echoed credential.
-            Err(e) => Err(ErrorData::internal_error(gateway_registry::redact_error_for_llm(&e.to_string()), None)),
+            Err(e) => Err(ErrorData::internal_error(
+                gateway_registry::redact_error_for_llm(&e.to_string()),
+                None,
+            )),
         }
     }
 
@@ -1352,10 +1524,20 @@ impl AgentflareMcp {
     // passed), but is never registered as an MCP tool and is invisible to
     // every real MCP client — silently dead on arrival.
 
-    #[tool(description = "Save an observation to persistent memory. Creates, updates (by topic_key), or deduplicates. Returns status: created|updated|duplicate.")]
+    #[tool(
+        description = "Save an observation to persistent memory. Creates, updates (by topic_key), or deduplicates. Returns status: created|updated|duplicate."
+    )]
     fn memory_remember(
         &self,
-        Parameters(MemoryRememberRequest { title, content, r#type, session_id, project, topic_key, scope }): Parameters<MemoryRememberRequest>,
+        Parameters(MemoryRememberRequest {
+            title,
+            content,
+            r#type,
+            session_id,
+            project,
+            topic_key,
+            scope,
+        }): Parameters<MemoryRememberRequest>,
     ) -> Result<String, ErrorData> {
         let input = crate::memory::mcp::RememberInput {
             title,
@@ -1366,14 +1548,21 @@ impl AgentflareMcp {
             topic_key,
             scope,
         };
-        crate::memory::mcp::handle_remember(input)
-            .map_err(|e| ErrorData::internal_error(e, None))
+        crate::memory::mcp::handle_remember(input).map_err(|e| ErrorData::internal_error(e, None))
     }
 
-    #[tool(description = "Search or retrieve observations. Pass id for direct lookup, query for FTS5 BM25 search, omit query for recent listing. Filters by type/project.")]
+    #[tool(
+        description = "Search or retrieve observations. Pass id for direct lookup, query for FTS5 BM25 search, omit query for recent listing. Filters by type/project."
+    )]
     fn memory_recall(
         &self,
-        Parameters(MemoryRecallRequest { query, id, r#type, project, limit }): Parameters<MemoryRecallRequest>,
+        Parameters(MemoryRecallRequest {
+            query,
+            id,
+            r#type,
+            project,
+            limit,
+        }): Parameters<MemoryRecallRequest>,
     ) -> Result<String, ErrorData> {
         let input = crate::memory::mcp::RecallInput {
             query,
@@ -1382,27 +1571,39 @@ impl AgentflareMcp {
             project,
             limit,
         };
-        crate::memory::mcp::handle_recall(input)
-            .map_err(|e| ErrorData::internal_error(e, None))
+        crate::memory::mcp::handle_recall(input).map_err(|e| ErrorData::internal_error(e, None))
     }
 
-    #[tool(description = "Return session context: active session (findings/decisions/files_touched), recent sessions, recent observations, and recent session summaries.")]
+    #[tool(
+        description = "Return session context: active session (findings/decisions/files_touched), recent sessions, recent observations, and recent session summaries."
+    )]
     fn memory_context(
         &self,
-        Parameters(MemoryContextRequest { session_id, project }): Parameters<MemoryContextRequest>,
+        Parameters(MemoryContextRequest {
+            session_id,
+            project,
+        }): Parameters<MemoryContextRequest>,
     ) -> Result<String, ErrorData> {
         let input = crate::memory::mcp::ContextInput {
             session_id,
             project,
         };
-        crate::memory::mcp::handle_context(input)
-            .map_err(|e| ErrorData::internal_error(e, None))
+        crate::memory::mcp::handle_context(input).map_err(|e| ErrorData::internal_error(e, None))
     }
 
-    #[tool(description = "Close a session with a handoff summary. Enriches the session with findings/decisions/files_touched/evidence, builds a compaction snapshot, appends to session_summaries, and marks the session closed.")]
+    #[tool(
+        description = "Close a session with a handoff summary. Enriches the session with findings/decisions/files_touched/evidence, builds a compaction snapshot, appends to session_summaries, and marks the session closed."
+    )]
     fn memory_handoff(
         &self,
-        Parameters(MemoryHandoffRequest { session_id, summary, findings, decisions, files_touched, evidence }): Parameters<MemoryHandoffRequest>,
+        Parameters(MemoryHandoffRequest {
+            session_id,
+            summary,
+            findings,
+            decisions,
+            files_touched,
+            evidence,
+        }): Parameters<MemoryHandoffRequest>,
     ) -> Result<String, ErrorData> {
         let input = crate::memory::mcp::HandoffInput {
             session_id,
@@ -1412,14 +1613,21 @@ impl AgentflareMcp {
             files_touched,
             evidence,
         };
-        crate::memory::mcp::handle_handoff(input)
-            .map_err(|e| ErrorData::internal_error(e, None))
+        crate::memory::mcp::handle_handoff(input).map_err(|e| ErrorData::internal_error(e, None))
     }
 
-    #[tool(description = "Record a semantic relation verdict between two observations. Relation: related|compatible|scoped|conflicts_with|supersedes|not_conflict.")]
+    #[tool(
+        description = "Record a semantic relation verdict between two observations. Relation: related|compatible|scoped|conflicts_with|supersedes|not_conflict."
+    )]
     fn memory_relate(
         &self,
-        Parameters(MemoryRelateRequest { source_id, target_id, relation, reason, confidence }): Parameters<MemoryRelateRequest>,
+        Parameters(MemoryRelateRequest {
+            source_id,
+            target_id,
+            relation,
+            reason,
+            confidence,
+        }): Parameters<MemoryRelateRequest>,
     ) -> Result<String, ErrorData> {
         let input = crate::memory::mcp::RelateInput {
             source_id,
@@ -1428,14 +1636,22 @@ impl AgentflareMcp {
             reason,
             confidence,
         };
-        crate::memory::mcp::handle_relate(input)
-            .map_err(|e| ErrorData::internal_error(e, None))
+        crate::memory::mcp::handle_relate(input).map_err(|e| ErrorData::internal_error(e, None))
     }
 
-    #[tool(description = "Update, soft-delete, pin, or unpin an observation by ID. Actions: update (title/content/type/pinned), delete, pin, unpin.")]
+    #[tool(
+        description = "Update, soft-delete, pin, or unpin an observation by ID. Actions: update (title/content/type/pinned), delete, pin, unpin."
+    )]
     fn memory_curate(
         &self,
-        Parameters(MemoryCurateRequest { action, id, title, content, r#type, pinned }): Parameters<MemoryCurateRequest>,
+        Parameters(MemoryCurateRequest {
+            action,
+            id,
+            title,
+            content,
+            r#type,
+            pinned,
+        }): Parameters<MemoryCurateRequest>,
     ) -> Result<String, ErrorData> {
         let input = crate::memory::mcp::CurateInput {
             action,
@@ -1445,8 +1661,7 @@ impl AgentflareMcp {
             r#type,
             pinned,
         };
-        crate::memory::mcp::handle_curate(input)
-            .map_err(|e| ErrorData::internal_error(e, None))
+        crate::memory::mcp::handle_curate(input).map_err(|e| ErrorData::internal_error(e, None))
     }
 }
 
@@ -1528,7 +1743,8 @@ impl AgentflareMcp {
                         "description": "Warns about cache-miss dead zone in scheduling delays"
                     }
                 ]
-            })).unwrap_or_default(),
+            }))
+            .unwrap_or_default(),
             _ => {
                 return Err(ErrorData::resource_not_found(
                     format!("Unknown resource: {uri}"),
@@ -1599,7 +1815,9 @@ impl AgentflareMcp {
     /// Runtime identity: explicit override wins, else auto-detect the host
     /// that launched us (parent process walk + agent env fingerprints).
     fn identity(explicit: Option<String>) -> Option<String> {
-        explicit.filter(|s| !s.is_empty()).or_else(agent_detector::agent_name)
+        explicit
+            .filter(|s| !s.is_empty())
+            .or_else(agent_detector::agent_name)
     }
 
     /// Production constructor: identity from AGENTFLARE_AGENT or detection.
@@ -1624,11 +1842,17 @@ mod tests {
     #[test]
     fn parse_flared_port_reads_top_level_key_only() {
         assert_eq!(parse_flared_port("port = 4444\n"), Some(4444));
-        assert_eq!(parse_flared_port("# comment\nport=9999 # inline\n"), Some(9999));
+        assert_eq!(
+            parse_flared_port("# comment\nport=9999 # inline\n"),
+            Some(9999)
+        );
         // tables end the top-level scan; a port inside one is not flared's
         assert_eq!(parse_flared_port("[[registries]]\nport = 1\n"), None);
         // prefix collisions and malformed values are not overrides
-        assert_eq!(parse_flared_port("portable = 1\nlight_interval_secs = 60\n"), None);
+        assert_eq!(
+            parse_flared_port("portable = 1\nlight_interval_secs = 60\n"),
+            None
+        );
         assert_eq!(parse_flared_port("port = not-a-number\n"), None);
         assert_eq!(parse_flared_port(""), None);
     }
@@ -1776,7 +2000,11 @@ mod tests {
             ..Default::default()
         };
         let err = s
-            .gateway_search(Parameters(GatewaySearchRequest { query: "".into(), limit: None, mode: None }))
+            .gateway_search(Parameters(GatewaySearchRequest {
+                query: "".into(),
+                limit: None,
+                mode: None,
+            }))
             .await
             .unwrap_err();
         assert!(err.to_string().contains("query is required"));
@@ -1844,7 +2072,10 @@ mod tests {
     fn gateway_execute_args_schema_is_object_or_null() {
         let schema = schemars::schema_for!(GatewayExecuteRequest);
         let schema_json = serde_json::to_value(&schema).unwrap();
-        let args_schema = schema_json.get("properties").and_then(|p| p.get("args")).expect("args schema present");
+        let args_schema = schema_json
+            .get("properties")
+            .and_then(|p| p.get("args"))
+            .expect("args schema present");
         let rendered = args_schema.to_string();
         assert!(rendered.contains("\"object\""), "{rendered}");
         assert!(rendered.contains("\"null\""), "{rendered}");
@@ -1892,7 +2123,10 @@ mod tests {
 
         let resp = http_get(url);
         assert!(resp.contains("200"), "serves published artifact: {resp}");
-        assert!(resp.contains("artifact-body-marker"), "body present: {resp}");
+        assert!(
+            resp.contains("artifact-body-marker"),
+            "body present: {resp}"
+        );
     }
 
     #[test]
@@ -1957,9 +2191,11 @@ mod tests {
         let a = publish("alpha", "ses-1");
         let _b = publish("beta", "ses-2");
 
-        let all: serde_json::Value =
-            serde_json::from_str(&s.artifact_list(Parameters(ArtifactListRequest::default())).unwrap())
-                .unwrap();
+        let all: serde_json::Value = serde_json::from_str(
+            &s.artifact_list(Parameters(ArtifactListRequest::default()))
+                .unwrap(),
+        )
+        .unwrap();
         assert_eq!(all.as_array().unwrap().len(), 2);
 
         let one: serde_json::Value = serde_json::from_str(
@@ -1976,13 +2212,18 @@ mod tests {
 
         let id = a["id"].as_str().unwrap().to_string();
         let got: serde_json::Value = serde_json::from_str(
-            &s.artifact_get(Parameters(ArtifactGetRequest { id: id.clone(), version: None })).unwrap(),
+            &s.artifact_get(Parameters(ArtifactGetRequest {
+                id: id.clone(),
+                version: None,
+            }))
+            .unwrap(),
         )
         .unwrap();
         assert_eq!(got["content"], "content-of-alpha");
 
         let del: serde_json::Value = serde_json::from_str(
-            &s.artifact_delete(Parameters(ArtifactDeleteRequest { id: id.clone() })).unwrap(),
+            &s.artifact_delete(Parameters(ArtifactDeleteRequest { id: id.clone() }))
+                .unwrap(),
         )
         .unwrap();
         assert_eq!(del["deleted"], true);
@@ -2028,7 +2269,8 @@ mod tests {
                 ..Default::default()
             }))
         };
-        let second: serde_json::Value = serde_json::from_str(&update(Some(1), "v2").unwrap()).unwrap();
+        let second: serde_json::Value =
+            serde_json::from_str(&update(Some(1), "v2").unwrap()).unwrap();
         assert_eq!(second["version"], 2);
 
         let err = update(Some(1), "v3-stale").unwrap_err();
@@ -2043,20 +2285,21 @@ mod tests {
             artifacts_dir_override: Some(tmp.path().to_path_buf()),
             ..Default::default()
         };
-        let publish = |name: &str, recipient: Option<&str>, thread: Option<&str>| -> serde_json::Value {
-            serde_json::from_str(
-                &s.artifact_publish(Parameters(ArtifactPublishRequest {
-                    name: name.into(),
-                    content: format!("content {name}"),
-                    sender: Some("claude-code".into()),
-                    recipient: recipient.map(Into::into),
-                    thread_id: thread.map(Into::into),
-                    ..Default::default()
-                }))
-                .unwrap(),
-            )
-            .unwrap()
-        };
+        let publish =
+            |name: &str, recipient: Option<&str>, thread: Option<&str>| -> serde_json::Value {
+                serde_json::from_str(
+                    &s.artifact_publish(Parameters(ArtifactPublishRequest {
+                        name: name.into(),
+                        content: format!("content {name}"),
+                        sender: Some("claude-code".into()),
+                        recipient: recipient.map(Into::into),
+                        thread_id: thread.map(Into::into),
+                        ..Default::default()
+                    }))
+                    .unwrap(),
+                )
+                .unwrap()
+            };
         publish("packet", Some("codex"), Some("t1"));
         publish("reply", Some("claude-code"), Some("t1"));
         publish("other", None, None);
@@ -2226,7 +2469,11 @@ mod tests {
         assert_eq!(hits.as_array().unwrap().len(), 1);
         assert_eq!(hits[0]["name"], "alpha");
         assert!(
-            hits[0]["snippet"].as_str().unwrap().to_lowercase().contains("needle"),
+            hits[0]["snippet"]
+                .as_str()
+                .unwrap()
+                .to_lowercase()
+                .contains("needle"),
             "{hits}"
         );
 
@@ -2318,7 +2565,10 @@ mod tests {
         );
         // …empty counts as unset, and without an override identity falls
         // back to detecting the host that launched us (None outside agents).
-        assert_eq!(AgentflareMcp::identity(Some(String::new())), agent_detector::agent_name());
+        assert_eq!(
+            AgentflareMcp::identity(Some(String::new())),
+            agent_detector::agent_name()
+        );
         assert_eq!(AgentflareMcp::identity(None), agent_detector::agent_name());
     }
 
diff --git a/src/memory/mcp.rs b/src/memory/mcp.rs
index d1226802..5e41ea52 100644
--- a/src/memory/mcp.rs
+++ b/src/memory/mcp.rs
@@ -67,11 +67,22 @@ fn recall_with_conn(conn: &rusqlite::Connection, input: RecallInput) -> Result<S
     }
     let limit = input.limit.unwrap_or(10).min(50);
     let results = if let Some(ref q) = input.query.filter(|q| !q.trim().is_empty()) {
-        search::search(conn, q, input.project.as_deref(), input.r#type.as_deref(), limit)
-            .map_err(|e| format!("search failed: {e}"))?
+        search::search(
+            conn,
+            q,
+            input.project.as_deref(),
+            input.r#type.as_deref(),
+            limit,
+        )
+        .map_err(|e| format!("search failed: {e}"))?
     } else {
-        observations::list_recent(conn, input.project.as_deref(), input.r#type.as_deref(), limit)
-            .map_err(|e| format!("list failed: {e}"))?
+        observations::list_recent(
+            conn,
+            input.project.as_deref(),
+            input.r#type.as_deref(),
+            limit,
+        )
+        .map_err(|e| format!("list failed: {e}"))?
     };
     Ok(json!(results).to_string())
 }
@@ -85,7 +96,9 @@ pub struct ContextInput {
 pub fn handle_context(input: ContextInput) -> Result<String, String> {
     let conn = open_db()?;
     let session = match input.session_id.as_deref() {
-        Some(id) if !id.is_empty() => sessions::get(&conn, id).map_err(|e| format!("session lookup: {e}"))?,
+        Some(id) if !id.is_empty() => {
+            sessions::get(&conn, id).map_err(|e| format!("session lookup: {e}"))?
+        }
         _ => None,
     };
     let recent_sessions = sessions::list_recent(&conn, input.project.as_deref(), 5)
@@ -128,23 +141,38 @@ fn handoff_with_conn(conn: &rusqlite::Connection, input: HandoffInput) -> Result
     // `&mut Connection`) so enrich+close+append commit atomically: a failure
     // partway through used to leave the session closed without its summary,
     // with no way to retry since it was already closed.
-    let tx = conn.unchecked_transaction().map_err(|e| format!("begin transaction: {e}"))?;
+    let tx = conn
+        .unchecked_transaction()
+        .map_err(|e| format!("begin transaction: {e}"))?;
 
     // `sessions::create` was never called from any CLI subcommand or MCP
     // tool, so the sessions table was always empty in practice and this
     // lookup would unconditionally fail with "session not found" for every
     // session_id. Auto-create instead, so handoff works standalone.
-    let session = match sessions::get(&tx, &input.session_id).map_err(|e| format!("session lookup: {e}"))? {
-        Some(session) => session,
-        None => sessions::create(&tx, &input.session_id, None, None)
-            .map_err(|e| format!("create session: {e}"))?,
-    };
+    let session =
+        match sessions::get(&tx, &input.session_id).map_err(|e| format!("session lookup: {e}"))? {
+            Some(session) => session,
+            None => sessions::create(&tx, &input.session_id, None, None)
+                .map_err(|e| format!("create session: {e}"))?,
+        };
 
     let project = session.project.clone().unwrap_or_default();
-    let findings = input.findings.as_ref().map(|v| serde_json::to_string(&v).unwrap_or_default());
-    let decisions = input.decisions.as_ref().map(|v| serde_json::to_string(&v).unwrap_or_default());
-    let files = input.files_touched.as_ref().map(|v| serde_json::to_string(&v).unwrap_or_default());
-    let evidence = input.evidence.as_ref().map(|v| serde_json::to_string(&v).unwrap_or_default());
+    let findings = input
+        .findings
+        .as_ref()
+        .map(|v| serde_json::to_string(&v).unwrap_or_default());
+    let decisions = input
+        .decisions
+        .as_ref()
+        .map(|v| serde_json::to_string(&v).unwrap_or_default());
+    let files = input
+        .files_touched
+        .as_ref()
+        .map(|v| serde_json::to_string(&v).unwrap_or_default());
+    let evidence = input
+        .evidence
+        .as_ref()
+        .map(|v| serde_json::to_string(&v).unwrap_or_default());
 
     let snapshot = json!({
         "session_id": input.session_id,
@@ -231,26 +259,34 @@ pub fn handle_curate(input: CurateInput) -> Result<String, String> {
     let conn = open_db()?;
     match input.action.as_str() {
         "update" => {
-            let ok = observations::update(&conn, input.id, input.title.as_deref(), input.content.as_deref(), input.r#type.as_deref(), input.pinned)
-                .map_err(|e| format!("update: {e}"))?;
+            let ok = observations::update(
+                &conn,
+                input.id,
+                input.title.as_deref(),
+                input.content.as_deref(),
+                input.r#type.as_deref(),
+                input.pinned,
+            )
+            .map_err(|e| format!("update: {e}"))?;
             Ok(json!({"status": if ok { "updated" } else { "not_found" }}).to_string())
         }
         "delete" => {
-            let ok = observations::soft_delete(&conn, input.id)
-                .map_err(|e| format!("delete: {e}"))?;
+            let ok =
+                observations::soft_delete(&conn, input.id).map_err(|e| format!("delete: {e}"))?;
             Ok(json!({"status": if ok { "deleted" } else { "not_found" }}).to_string())
         }
         "pin" => {
-            let ok = observations::pin(&conn, input.id, true)
-                .map_err(|e| format!("pin: {e}"))?;
+            let ok = observations::pin(&conn, input.id, true).map_err(|e| format!("pin: {e}"))?;
             Ok(json!({"status": if ok { "pinned" } else { "not_found" }}).to_string())
         }
         "unpin" => {
-            let ok = observations::pin(&conn, input.id, false)
-                .map_err(|e| format!("unpin: {e}"))?;
+            let ok =
+                observations::pin(&conn, input.id, false).map_err(|e| format!("unpin: {e}"))?;
             Ok(json!({"status": if ok { "unpinned" } else { "not_found" }}).to_string())
         }
-        other => Err(format!("unknown action '{other}'; use update, delete, pin, or unpin")),
+        other => Err(format!(
+            "unknown action '{other}'; use update, delete, pin, or unpin"
+        )),
     }
 }
 
@@ -299,7 +335,9 @@ mod tests {
         let input = HandoffInput {
             session_id: "sess-enrich".to_string(),
             summary: "did the thing".to_string(),
-            findings: Some(vec![serde_json::json!({"file": "a.rs", "summary": "found x"})]),
+            findings: Some(vec![
+                serde_json::json!({"file": "a.rs", "summary": "found x"}),
+            ]),
             decisions: None,
             files_touched: None,
             evidence: None,
@@ -309,7 +347,12 @@ mod tests {
         let session = sessions::get(&conn, "sess-enrich").unwrap().unwrap();
         assert!(session.findings.contains("found x"));
         assert!(session.compaction_snapshot.is_some());
-        assert!(session.compaction_snapshot.unwrap().contains("did the thing"));
+        assert!(
+            session
+                .compaction_snapshot
+                .unwrap()
+                .contains("did the thing")
+        );
     }
 
     // Regression test for item 7: the type filter used to be applied via
@@ -323,9 +366,31 @@ mod tests {
         // follow it. list_recent orders by created_at DESC, so a naive
         // "fetch top-N then filter by type" with a small limit would only
         // ever see the newer bugfix rows and never reach the decision row.
-        observations::save(&conn, None, "decision", "the one decision", "the only decision here", None, Some("proj-a"), None, None).unwrap();
+        observations::save(
+            &conn,
+            None,
+            "decision",
+            "the one decision",
+            "the only decision here",
+            None,
+            Some("proj-a"),
+            None,
+            None,
+        )
+        .unwrap();
         for i in 0..5 {
-            observations::save(&conn, None, "bugfix", &format!("bug {i}"), "irrelevant filler content", None, Some("proj-a"), None, None).unwrap();
+            observations::save(
+                &conn,
+                None,
+                "bugfix",
+                &format!("bug {i}"),
+                "irrelevant filler content",
+                None,
+                Some("proj-a"),
+                None,
+                None,
+            )
+            .unwrap();
         }
 
         let input = RecallInput {
diff --git a/src/memory/observations.rs b/src/memory/observations.rs
index c5462302..6dbed82c 100644
--- a/src/memory/observations.rs
+++ b/src/memory/observations.rs
@@ -1,4 +1,4 @@
-use rusqlite::{params, Connection, OptionalExtension};
+use rusqlite::{Connection, OptionalExtension, params};
 use sha2::{Digest, Sha256};
 
 #[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
@@ -30,6 +30,7 @@ pub enum SaveOutcome {
     Duplicate(i64),
 }
 
+#[allow(clippy::too_many_arguments)]
 pub fn save(
     conn: &Connection,
     session_id: Option<&str>,
@@ -53,8 +54,8 @@ pub fn save(
         return Ok(SaveOutcome::Duplicate(id));
     }
 
-    if let Some(tk) = topic_key.filter(|t| !t.is_empty()) {
-        if let Some(existing) = conn
+    if let Some(tk) = topic_key.filter(|t| !t.is_empty())
+        && let Some(existing) = conn
             .query_row(
                 "SELECT id, revision_count FROM observations
                  WHERE topic_key = ?1 AND deleted_at IS NULL AND (?2 IS NULL OR project = ?2) LIMIT 1",
@@ -70,14 +71,15 @@ pub fn save(
             )?;
             return Ok(SaveOutcome::Updated(id));
         }
-    }
 
     conn.execute(
         "INSERT INTO observations
             (session_id, type, title, content, tool_name, project, scope,
              topic_key, normalized_hash, created_at, updated_at, last_seen_at)
          VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?10, ?10)",
-        params![session_id, r#type, title, content, tool_name, project, scope, topic_key, &hash, now],
+        params![
+            session_id, r#type, title, content, tool_name, project, scope, topic_key, &hash, now
+        ],
     )?;
     let id = conn.last_insert_rowid();
     Ok(SaveOutcome::Created(id))
@@ -91,7 +93,8 @@ pub fn get(conn: &Connection, id: i64) -> rusqlite::Result<Option<Observation>>
          FROM observations WHERE id = ?1",
         params![id],
         map_observation,
-    ).optional()
+    )
+    .optional()
 }
 
 pub fn update(
@@ -177,14 +180,19 @@ pub fn list_recent(
     rows.collect()
 }
 
-fn find_duplicate(conn: &Connection, hash: &str, project: Option<&str>) -> rusqlite::Result<Option<(i64, String)>> {
+fn find_duplicate(
+    conn: &Connection,
+    hash: &str,
+    project: Option<&str>,
+) -> rusqlite::Result<Option<(i64, String)>> {
     conn.query_row(
         "SELECT id, created_at FROM observations
          WHERE normalized_hash = ?1 AND deleted_at IS NULL AND (?2 IS NULL OR project = ?2)
          ORDER BY created_at DESC LIMIT 1",
         params![hash, project],
         |r| Ok((r.get(0)?, r.get(1)?)),
-    ).optional()
+    )
+    .optional()
 }
 
 pub fn hash_normalized(title: &str, content: &str) -> String {
@@ -199,7 +207,9 @@ pub fn hash_normalized(title: &str, content: &str) -> String {
 }
 
 fn now_iso() -> String {
-    chrono::Utc::now().format("%Y-%m-%dT%H:%M:%S%.3fZ").to_string()
+    chrono::Utc::now()
+        .format("%Y-%m-%dT%H:%M:%S%.3fZ")
+        .to_string()
 }
 
 fn map_observation(r: &rusqlite::Row<'_>) -> rusqlite::Result<Observation> {
@@ -242,15 +252,48 @@ mod tests {
     #[test]
     fn cross_project_observations_with_identical_content_do_not_collide() {
         let conn = new_db();
-        let outcome_a = save(&conn, None, "note", "same title", "same content", None, Some("proj-a"), None, None).unwrap();
-        let outcome_b = save(&conn, None, "note", "same title", "same content", None, Some("proj-b"), None, None).unwrap();
+        let outcome_a = save(
+            &conn,
+            None,
+            "note",
+            "same title",
+            "same content",
+            None,
+            Some("proj-a"),
+            None,
+            None,
+        )
+        .unwrap();
+        let outcome_b = save(
+            &conn,
+            None,
+            "note",
+            "same title",
+            "same content",
+            None,
+            Some("proj-b"),
+            None,
+            None,
+        )
+        .unwrap();
 
         assert!(matches!(outcome_a, SaveOutcome::Created(_)));
         assert!(matches!(outcome_b, SaveOutcome::Created(_)));
 
         // Saving the same content again *within* proj-a should still be
         // detected as a duplicate (scoping must not break same-project dedup).
-        let outcome_a2 = save(&conn, None, "note", "same title", "same content", None, Some("proj-a"), None, None).unwrap();
+        let outcome_a2 = save(
+            &conn,
+            None,
+            "note",
+            "same title",
+            "same content",
+            None,
+            Some("proj-a"),
+            None,
+            None,
+        )
+        .unwrap();
         assert!(matches!(outcome_a2, SaveOutcome::Duplicate(_)));
     }
 
@@ -260,22 +303,58 @@ mod tests {
     #[test]
     fn topic_key_revision_refreshes_normalized_hash() {
         let conn = new_db();
-        let outcome1 = save(&conn, None, "decision", "v1 title", "v1 content", None, Some("proj-a"), None, Some("topic-x")).unwrap();
+        let outcome1 = save(
+            &conn,
+            None,
+            "decision",
+            "v1 title",
+            "v1 content",
+            None,
+            Some("proj-a"),
+            None,
+            Some("topic-x"),
+        )
+        .unwrap();
         let id = match outcome1 {
             SaveOutcome::Created(id) => id,
             other => panic!("expected Created, got {other:?}"),
         };
 
-        let outcome2 = save(&conn, None, "decision", "v2 title", "v2 content", None, Some("proj-a"), None, Some("topic-x")).unwrap();
+        let outcome2 = save(
+            &conn,
+            None,
+            "decision",
+            "v2 title",
+            "v2 content",
+            None,
+            Some("proj-a"),
+            None,
+            Some("topic-x"),
+        )
+        .unwrap();
         assert_eq!(outcome2, SaveOutcome::Updated(id));
 
         let obs = get(&conn, id).unwrap().unwrap();
-        assert_eq!(obs.normalized_hash.as_deref(), Some(hash_normalized("v2 title", "v2 content").as_str()));
+        assert_eq!(
+            obs.normalized_hash.as_deref(),
+            Some(hash_normalized("v2 title", "v2 content").as_str())
+        );
 
         // Now a fresh save with content matching the *revised* version
         // (different topic_key so it goes through the dedup path, not the
         // topic_key path) should be recognized as a duplicate of `id`.
-        let outcome3 = save(&conn, None, "decision", "v2 title", "v2 content", None, Some("proj-a"), None, None).unwrap();
+        let outcome3 = save(
+            &conn,
+            None,
+            "decision",
+            "v2 title",
+            "v2 content",
+            None,
+            Some("proj-a"),
+            None,
+            None,
+        )
+        .unwrap();
         assert_eq!(outcome3, SaveOutcome::Duplicate(id));
     }
 
@@ -286,7 +365,18 @@ mod tests {
         // this build's bundled SQLite enforces foreign keys by default, so
         // create the referenced session first.
         crate::memory::sessions::create(&conn, "sess-1", Some("proj-a"), None).unwrap();
-        let outcome = save(&conn, Some("sess-1"), "learning", "title", "content", None, Some("proj-a"), None, None).unwrap();
+        let outcome = save(
+            &conn,
+            Some("sess-1"),
+            "learning",
+            "title",
+            "content",
+            None,
+            Some("proj-a"),
+            None,
+            None,
+        )
+        .unwrap();
         let id = match outcome {
             SaveOutcome::Created(id) => id,
             other => panic!("expected Created, got {other:?}"),
diff --git a/src/memory/prompts.rs b/src/memory/prompts.rs
index a33cef23..ea1a846c 100644
--- a/src/memory/prompts.rs
+++ b/src/memory/prompts.rs
@@ -1,6 +1,12 @@
-use rusqlite::{params, Connection};
+use rusqlite::{Connection, params};
 
-pub fn save(conn: &Connection, session_id: Option<&str>, content: &str, project: Option<&str>) -> rusqlite::Result<i64> {
+#[allow(dead_code)]
+pub fn save(
+    conn: &Connection,
+    session_id: Option<&str>,
+    content: &str,
+    project: Option<&str>,
+) -> rusqlite::Result<i64> {
     let now = now_iso();
     conn.execute(
         "INSERT INTO user_prompts (session_id, content, project, created_at) VALUES (?1, ?2, ?3, ?4)",
@@ -9,7 +15,12 @@ pub fn save(conn: &Connection, session_id: Option<&str>, content: &str, project:
     Ok(conn.last_insert_rowid())
 }
 
-pub fn list_recent(conn: &Connection, project: Option<&str>, limit: usize) -> rusqlite::Result<Vec<(i64, String, String, String)>> {
+#[allow(dead_code)]
+pub fn list_recent(
+    conn: &Connection,
+    project: Option<&str>,
+    limit: usize,
+) -> rusqlite::Result<Vec<(i64, String, String, String)>> {
     let mut stmt = conn.prepare(
         "SELECT id, content, project, created_at FROM user_prompts
          WHERE (?1 IS NULL OR project = ?1)
@@ -21,6 +32,9 @@ pub fn list_recent(conn: &Connection, project: Option<&str>, limit: usize) -> ru
     rows.collect()
 }
 
+#[allow(dead_code)]
 fn now_iso() -> String {
-    chrono::Utc::now().format("%Y-%m-%dT%H:%M:%S%.3fZ").to_string()
+    chrono::Utc::now()
+        .format("%Y-%m-%dT%H:%M:%S%.3fZ")
+        .to_string()
 }
diff --git a/src/memory/relations.rs b/src/memory/relations.rs
index 5cffc95c..4fec0a67 100644
--- a/src/memory/relations.rs
+++ b/src/memory/relations.rs
@@ -1,4 +1,4 @@
-use rusqlite::{params, Connection, OptionalExtension};
+use rusqlite::{Connection, OptionalExtension, params};
 
 #[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
 pub struct Relation {
@@ -18,6 +18,7 @@ pub struct Relation {
     pub updated_at: String,
 }
 
+#[allow(clippy::too_many_arguments)]
 pub fn create(
     conn: &Connection,
     source_id: i64,
@@ -49,6 +50,7 @@ pub fn create(
     )
 }
 
+#[allow(dead_code)]
 pub fn get(conn: &Connection, id: i64) -> rusqlite::Result<Option<Relation>> {
     conn.query_row(
         "SELECT id, source_id, target_id, relation, judgment_status, reason, evidence,
@@ -57,9 +59,11 @@ pub fn get(conn: &Connection, id: i64) -> rusqlite::Result<Option<Relation>> {
          FROM memory_relations WHERE id = ?1",
         params![id],
         map_relation,
-    ).optional()
+    )
+    .optional()
 }
 
+#[allow(dead_code)]
 pub fn list_for_observation(conn: &Connection, obs_id: i64) -> rusqlite::Result<Vec<Relation>> {
     let mut stmt = conn.prepare(
         "SELECT id, source_id, target_id, relation, judgment_status, reason, evidence,
@@ -73,6 +77,7 @@ pub fn list_for_observation(conn: &Connection, obs_id: i64) -> rusqlite::Result<
     rows.collect()
 }
 
+#[allow(dead_code)]
 fn map_relation(r: &rusqlite::Row<'_>) -> rusqlite::Result<Relation> {
     Ok(Relation {
         id: r.get(0)?,
@@ -93,7 +98,9 @@ fn map_relation(r: &rusqlite::Row<'_>) -> rusqlite::Result<Relation> {
 }
 
 fn now_iso() -> String {
-    chrono::Utc::now().format("%Y-%m-%dT%H:%M:%S%.3fZ").to_string()
+    chrono::Utc::now()
+        .format("%Y-%m-%dT%H:%M:%S%.3fZ")
+        .to_string()
 }
 
 #[cfg(test)]
@@ -108,7 +115,9 @@ mod tests {
     }
 
     fn make_obs(conn: &Connection, title: &str) -> i64 {
-        match observations::save(conn, None, "note", title, "content", None, None, None, None).unwrap() {
+        match observations::save(conn, None, "note", title, "content", None, None, None, None)
+            .unwrap()
+        {
             observations::SaveOutcome::Created(id) => id,
             other => panic!("expected Created, got {other:?}"),
         }
@@ -123,8 +132,28 @@ mod tests {
         let source = make_obs(&conn, "source obs");
         let target = make_obs(&conn, "target obs");
 
-        let id1 = create(&conn, source, target, "related", None, Some("first reason"), None, None).unwrap();
-        let id2 = create(&conn, source, target, "related", None, Some("second reason"), None, None).unwrap();
+        let id1 = create(
+            &conn,
+            source,
+            target,
+            "related",
+            None,
+            Some("first reason"),
+            None,
+            None,
+        )
+        .unwrap();
+        let id2 = create(
+            &conn,
+            source,
+            target,
+            "related",
+            None,
+            Some("second reason"),
+            None,
+            None,
+        )
+        .unwrap();
 
         assert_eq!(id1, id2);
         let rel = get(&conn, id1).unwrap().unwrap();
diff --git a/src/memory/search.rs b/src/memory/search.rs
index 0d863f42..b48d1c53 100644
--- a/src/memory/search.rs
+++ b/src/memory/search.rs
@@ -1,4 +1,4 @@
-use rusqlite::{params, Connection};
+use rusqlite::{Connection, params};
 
 use super::observations::Observation;
 
@@ -52,7 +52,8 @@ pub fn search(
          ORDER BY o.created_at DESC
          LIMIT ?2";
     let mut like_stmt = conn.prepare(like_sql)?;
-    let like_rows = like_stmt.query_map(params![like_pat, limit, project, r#type], map_search_row)?;
+    let like_rows =
+        like_stmt.query_map(params![like_pat, limit, project, r#type], map_search_row)?;
     like_rows.collect()
 }
 
@@ -122,8 +123,30 @@ mod tests {
     #[test]
     fn project_scoped_search_returns_only_matching_project() {
         let conn = new_db();
-        observations::save(&conn, None, "note", "widget rollout", "shipping the widget rollout", None, Some("proj-a"), None, None).unwrap();
-        observations::save(&conn, None, "note", "widget outage", "widget rollout caused an outage", None, Some("proj-b"), None, None).unwrap();
+        observations::save(
+            &conn,
+            None,
+            "note",
+            "widget rollout",
+            "shipping the widget rollout",
+            None,
+            Some("proj-a"),
+            None,
+            None,
+        )
+        .unwrap();
+        observations::save(
+            &conn,
+            None,
+            "note",
+            "widget outage",
+            "widget rollout caused an outage",
+            None,
+            Some("proj-b"),
+            None,
+            None,
+        )
+        .unwrap();
 
         let results = search(&conn, "widget", Some("proj-a"), None, 10).unwrap();
         assert_eq!(results.len(), 1);
@@ -153,9 +176,31 @@ mod tests {
         // matching row entirely depending on rank order — the filter must
         // be applied in SQL before LIMIT to reliably surface it.
         for i in 0..5 {
-            observations::save(&conn, None, "bugfix", &format!("bug {i}"), "marker filler content", None, Some("proj-a"), None, None).unwrap();
+            observations::save(
+                &conn,
+                None,
+                "bugfix",
+                &format!("bug {i}"),
+                "marker filler content",
+                None,
+                Some("proj-a"),
+                None,
+                None,
+            )
+            .unwrap();
         }
-        observations::save(&conn, None, "decision", "the decision", "marker decided content", None, Some("proj-a"), None, None).unwrap();
+        observations::save(
+            &conn,
+            None,
+            "decision",
+            "the decision",
+            "marker decided content",
+            None,
+            Some("proj-a"),
+            None,
+            None,
+        )
+        .unwrap();
 
         let results = search(&conn, "marker", Some("proj-a"), Some("decision"), 3).unwrap();
         assert_eq!(results.len(), 1);
diff --git a/src/memory/sessions.rs b/src/memory/sessions.rs
index 1ea0831b..1c876d5a 100644
--- a/src/memory/sessions.rs
+++ b/src/memory/sessions.rs
@@ -1,4 +1,4 @@
-use rusqlite::{params, Connection, OptionalExtension};
+use rusqlite::{Connection, OptionalExtension, params};
 
 #[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
 pub struct Session {
@@ -32,7 +32,9 @@ pub fn create(
          VALUES (?1, ?2, ?3, ?4, 'active', ?4, ?4)",
         params![id, project, directory, now],
     )?;
-    get(conn, id)?.ok_or_else(|| rusqlite::Error::InvalidParameterName("insert succeeded but readback failed".into()))
+    get(conn, id)?.ok_or_else(|| {
+        rusqlite::Error::InvalidParameterName("insert succeeded but readback failed".into())
+    })
 }
 
 pub fn get(conn: &Connection, id: &str) -> rusqlite::Result<Option<Session>> {
@@ -62,9 +64,11 @@ pub fn get(conn: &Connection, id: &str) -> rusqlite::Result<Option<Session>> {
                 updated_at: r.get(15)?,
             })
         },
-    ).optional()
+    )
+    .optional()
 }
 
+#[allow(dead_code)]
 pub fn update_status(conn: &Connection, id: &str, status: &str) -> rusqlite::Result<()> {
     let now = now_iso();
     conn.execute(
@@ -83,6 +87,7 @@ pub fn close(conn: &Connection, id: &str, summary: &str) -> rusqlite::Result<()>
     Ok(())
 }
 
+#[allow(clippy::too_many_arguments)]
 pub fn update_enriched(
     conn: &Connection,
     id: &str,
@@ -106,12 +111,26 @@ pub fn update_enriched(
             compaction_snapshot = COALESCE(?8, compaction_snapshot),
             updated_at = ?9
          WHERE id = ?1",
-        params![id, task, findings, decisions, files_touched, evidence, stats, compaction_snapshot, now],
+        params![
+            id,
+            task,
+            findings,
+            decisions,
+            files_touched,
+            evidence,
+            stats,
+            compaction_snapshot,
+            now
+        ],
     )?;
     Ok(())
 }
 
-pub fn list_recent(conn: &Connection, project: Option<&str>, limit: usize) -> rusqlite::Result<Vec<Session>> {
+pub fn list_recent(
+    conn: &Connection,
+    project: Option<&str>,
+    limit: usize,
+) -> rusqlite::Result<Vec<Session>> {
     let mut stmt = conn.prepare(
         "SELECT id, project, directory, started_at, ended_at, summary, status,
                 task, findings, decisions, files_touched, evidence, stats,
@@ -144,13 +163,16 @@ pub fn list_recent(conn: &Connection, project: Option<&str>, limit: usize) -> ru
     rows.collect()
 }
 
+#[allow(dead_code)]
 pub fn delete(conn: &Connection, id: &str) -> rusqlite::Result<bool> {
     let n = conn.execute("DELETE FROM sessions WHERE id = ?1", params![id])?;
     Ok(n > 0)
 }
 
 fn now_iso() -> String {
-    chrono::Utc::now().format("%Y-%m-%dT%H:%M:%S%.3fZ").to_string()
+    chrono::Utc::now()
+        .format("%Y-%m-%dT%H:%M:%S%.3fZ")
+        .to_string()
 }
 
 #[cfg(test)]
diff --git a/src/memory/store.rs b/src/memory/store.rs
index 2ddeacf7..dc84bf93 100644
--- a/src/memory/store.rs
+++ b/src/memory/store.rs
@@ -3,7 +3,10 @@ use std::path::PathBuf;
 use std::time::Duration;
 
 pub fn brain_db_path() -> PathBuf {
-    crate::paths::home().join(".agentflare").join("memory").join("brain.db")
+    crate::paths::home()
+        .join(".agentflare")
+        .join("memory")
+        .join("brain.db")
 }
 
 /// Wraps a non-rusqlite error (e.g. a filesystem error) so it can propagate
@@ -19,7 +22,8 @@ pub fn open() -> rusqlite::Result<Connection> {
         #[cfg(unix)]
         {
             use std::os::unix::fs::PermissionsExt;
-            std::fs::set_permissions(parent, std::fs::Permissions::from_mode(0o700)).map_err(io_err)?;
+            std::fs::set_permissions(parent, std::fs::Permissions::from_mode(0o700))
+                .map_err(io_err)?;
         }
     }
     let conn = Connection::open(&path)?;
diff --git a/src/memory/summaries.rs b/src/memory/summaries.rs
index 6ca9729a..8d1b8757 100644
--- a/src/memory/summaries.rs
+++ b/src/memory/summaries.rs
@@ -1,4 +1,4 @@
-use rusqlite::{params, Connection};
+use rusqlite::{Connection, params};
 
 #[derive(Debug, Clone, serde::Serialize)]
 pub struct SessionSummary {
@@ -37,7 +37,11 @@ pub fn append(
     Ok(conn.last_insert_rowid())
 }
 
-pub fn list_recent(conn: &Connection, project: Option<&str>, limit: usize) -> rusqlite::Result<Vec<SessionSummary>> {
+pub fn list_recent(
+    conn: &Connection,
+    project: Option<&str>,
+    limit: usize,
+) -> rusqlite::Result<Vec<SessionSummary>> {
     let mut stmt = conn.prepare(
         "SELECT id, project, session_id, seq, summary, searchable_text, created_at
          FROM session_summaries
@@ -60,7 +64,9 @@ pub fn list_recent(conn: &Connection, project: Option<&str>, limit: usize) -> ru
 }
 
 fn now_iso() -> String {
-    chrono::Utc::now().format("%Y-%m-%dT%H:%M:%S%.3fZ").to_string()
+    chrono::Utc::now()
+        .format("%Y-%m-%dT%H:%M:%S%.3fZ")
+        .to_string()
 }
 
 #[cfg(test)]
diff --git a/src/mise_install.rs b/src/mise_install.rs
index 0fb87b32..3c5613d7 100644
--- a/src/mise_install.rs
+++ b/src/mise_install.rs
@@ -7,6 +7,7 @@ use std::process::{Command, Stdio};
 
 pub enum MiseOutcome {
     /// Already on the system (path to the binary).
+    #[allow(dead_code)]
     Present(String),
     /// We just installed it (path to the binary).
     Installed(String),
diff --git a/src/optimize.rs b/src/optimize.rs
index 2c260e5d..94aeaed0 100644
--- a/src/optimize.rs
+++ b/src/optimize.rs
@@ -92,6 +92,7 @@ fn has_word_boundary_match(text: &str, keyword: &str) -> bool {
 
 /// Context available to every routing decision.
 #[derive(Debug, Clone)]
+#[allow(dead_code)]
 pub struct RouteContext {
     pub prompt: String,
     pub session_id: String,
@@ -172,7 +173,10 @@ pub fn active_router() -> Box<dyn Router> {
 /// compatibility with existing test assertions.
 pub fn model_routing_nudge(prompt: &str) -> Option<&'static str> {
     let lower = prompt.to_lowercase();
-    if LOCATE_KEYWORDS.iter().any(|kw| has_word_boundary_match(&lower, kw)) {
+    if LOCATE_KEYWORDS
+        .iter()
+        .any(|kw| has_word_boundary_match(&lower, kw))
+    {
         return Some(
             "This looks like a locate/investigate task — consider a cheap-model subagent (e.g. haiku) instead of running it inline.",
         );
@@ -235,7 +239,11 @@ mod tests {
             let mut state = RuntimeState::default();
             state.sessions.insert(
                 "sess-1".to_string(),
-                SessionRecord { start_ts: 1000, turn_count: 3, recent_tool_calls: vec![] },
+                SessionRecord {
+                    start_ts: 1000,
+                    turn_count: 3,
+                    recent_tool_calls: vec![],
+                },
             );
             save_runtime(&state);
             let loaded = load_runtime();
@@ -258,11 +266,19 @@ mod tests {
         let mut state = RuntimeState::default();
         state.sessions.insert(
             "old".to_string(),
-            SessionRecord { start_ts: 0, turn_count: 1, recent_tool_calls: vec![] },
+            SessionRecord {
+                start_ts: 0,
+                turn_count: 1,
+                recent_tool_calls: vec![],
+            },
         );
         state.sessions.insert(
             "recent".to_string(),
-            SessionRecord { start_ts: 100_000, turn_count: 1, recent_tool_calls: vec![] },
+            SessionRecord {
+                start_ts: 100_000,
+                turn_count: 1,
+                recent_tool_calls: vec![],
+            },
         );
         let now = 100_100; // 100s after "recent", ~27.7h after "old"
         prune_stale_sessions(&mut state, now);
@@ -272,19 +288,31 @@ mod tests {
 
     #[test]
     fn session_hygiene_no_nudge_below_thresholds() {
-        let record = SessionRecord { start_ts: 0, turn_count: 5, recent_tool_calls: vec![] };
+        let record = SessionRecord {
+            start_ts: 0,
+            turn_count: 5,
+            recent_tool_calls: vec![],
+        };
         assert!(session_hygiene_nudge(&record, 100).is_none());
     }
 
     #[test]
     fn session_hygiene_nudges_past_turn_threshold() {
-        let record = SessionRecord { start_ts: 0, turn_count: 81, recent_tool_calls: vec![] };
+        let record = SessionRecord {
+            start_ts: 0,
+            turn_count: 81,
+            recent_tool_calls: vec![],
+        };
         assert!(session_hygiene_nudge(&record, 100).is_some());
     }
 
     #[test]
     fn session_hygiene_nudges_past_time_threshold() {
-        let record = SessionRecord { start_ts: 0, turn_count: 1, recent_tool_calls: vec![] };
+        let record = SessionRecord {
+            start_ts: 0,
+            turn_count: 1,
+            recent_tool_calls: vec![],
+        };
         assert!(session_hygiene_nudge(&record, 2 * 60 * 60 + 1).is_some());
     }
 
@@ -325,8 +353,14 @@ mod tests {
     #[test]
     fn batching_flags_three_consecutive_solo_calls() {
         let recent = vec![
-            ToolCallRecord { name: "Read".to_string(), ts: 1 },
-            ToolCallRecord { name: "Read".to_string(), ts: 2 },
+            ToolCallRecord {
+                name: "Read".to_string(),
+                ts: 1,
+            },
+            ToolCallRecord {
+                name: "Read".to_string(),
+                ts: 2,
+            },
         ];
         assert!(batching_nudge(&recent, "Read").is_some());
     }
@@ -334,8 +368,14 @@ mod tests {
     #[test]
     fn batching_ignores_non_batchable_tool() {
         let recent = vec![
-            ToolCallRecord { name: "Write".to_string(), ts: 1 },
-            ToolCallRecord { name: "Write".to_string(), ts: 2 },
+            ToolCallRecord {
+                name: "Write".to_string(),
+                ts: 1,
+            },
+            ToolCallRecord {
+                name: "Write".to_string(),
+                ts: 2,
+            },
         ];
         assert!(batching_nudge(&recent, "Write").is_none());
     }
@@ -343,15 +383,24 @@ mod tests {
     #[test]
     fn batching_ignores_mixed_recent_calls() {
         let recent = vec![
-            ToolCallRecord { name: "Read".to_string(), ts: 1 },
-            ToolCallRecord { name: "Grep".to_string(), ts: 2 },
+            ToolCallRecord {
+                name: "Read".to_string(),
+                ts: 1,
+            },
+            ToolCallRecord {
+                name: "Grep".to_string(),
+                ts: 2,
+            },
         ];
         assert!(batching_nudge(&recent, "Read").is_none());
     }
 
     #[test]
     fn batching_ignores_short_history() {
-        let recent = vec![ToolCallRecord { name: "Read".to_string(), ts: 1 }];
+        let recent = vec![ToolCallRecord {
+            name: "Read".to_string(),
+            ts: 1,
+        }];
         assert!(batching_nudge(&recent, "Read").is_none());
     }
 
@@ -443,7 +492,11 @@ mod tests {
         // KeywordRouter is silent on prompts with no locate-style keywords.
         assert!(r.route(&ctx("refactor the payment module")).is_none());
         // ...but flags them, same as KeywordRouter directly.
-        assert!(router_by_name("nonsense").route(&ctx("find the auth handler")).is_some());
+        assert!(
+            router_by_name("nonsense")
+                .route(&ctx("find the auth handler"))
+                .is_some()
+        );
     }
 
     #[test]
diff --git a/src/pricing.rs b/src/pricing.rs
index bd0ebba9..086c5c77 100644
--- a/src/pricing.rs
+++ b/src/pricing.rs
@@ -71,8 +71,7 @@ static PRICING_CACHE: OnceLock<HashMap<String, ModelPricing>> = OnceLock::new();
 pub fn load_pricing() -> HashMap<String, ModelPricing> {
     PRICING_CACHE
         .get_or_init(|| {
-            parse_pricing_file(PRICING_JSON)
-                .expect("embedded anthropic-pricing.json is invalid")
+            parse_pricing_file(PRICING_JSON).expect("embedded anthropic-pricing.json is invalid")
         })
         .clone()
 }
@@ -159,10 +158,10 @@ fn parse_claude_model(model_id: &str) -> Option<(Family, (u32, u32))> {
     for token in lower.split('-') {
         if let Some(f) = Family::from_token(token) {
             family = Some(f);
-        } else if let Ok(n) = token.parse::<u32>() {
-            if n < 1000 {
-                versions.push(n);
-            }
+        } else if let Ok(n) = token.parse::<u32>()
+            && n < 1000
+        {
+            versions.push(n);
         }
     }
     let family = family?;
@@ -187,7 +186,7 @@ fn family_nearest_pricing<'a>(
     if candidates.is_empty() {
         return None;
     }
-    candidates.sort_by(|a, b| a.0.cmp(&b.0));
+    candidates.sort_by_key(|a| a.0);
 
     candidates
         .iter()
@@ -208,10 +207,10 @@ pub fn lookup_pricing<'a>(
     if let Some(p) = pricing.get(model_id) {
         return Some(p);
     }
-    if let Some(resolved) = resolve_model_alias(model_id) {
-        if let Some(p) = pricing.get(resolved) {
-            return Some(p);
-        }
+    if let Some(resolved) = resolve_model_alias(model_id)
+        && let Some(p) = pricing.get(resolved)
+    {
+        return Some(p);
     }
     // Longest matching prefix wins — HashMap iteration order is random, so
     // taking the first match would resolve ambiguous ids nondeterministically.
@@ -350,7 +349,10 @@ mod tests {
     #[test]
     fn test_opus_46_flat_pricing() {
         let pricing = pricing();
-        let tokens = TokenUsage { input_tokens: 500_000, ..Default::default() };
+        let tokens = TokenUsage {
+            input_tokens: 500_000,
+            ..Default::default()
+        };
         let cost = calculate_cost(&tokens, Some("claude-opus-4-6"), &pricing);
         assert!((cost.total_usd - 2.50).abs() < 0.001);
         assert!(!cost.has_unpriced_usage);
@@ -359,7 +361,10 @@ mod tests {
     #[test]
     fn test_sonnet_45_tiered_pricing() {
         let pricing = pricing();
-        let tokens = TokenUsage { input_tokens: 500_000, ..Default::default() };
+        let tokens = TokenUsage {
+            input_tokens: 500_000,
+            ..Default::default()
+        };
         let cost = calculate_cost(&tokens, Some("claude-sonnet-4-5-20250929"), &pricing);
         assert!((cost.total_usd - 2.40).abs() < 0.001);
     }
@@ -367,7 +372,10 @@ mod tests {
     #[test]
     fn test_unknown_model_has_no_fake_usd() {
         let pricing = pricing();
-        let tokens = TokenUsage { input_tokens: 1_000_000, ..Default::default() };
+        let tokens = TokenUsage {
+            input_tokens: 1_000_000,
+            ..Default::default()
+        };
         let cost = calculate_cost(&tokens, Some("gpt-4o"), &pricing);
         assert_eq!(cost.total_usd, 0.0);
         assert!(cost.has_unpriced_usage);
diff --git a/src/review.rs b/src/review.rs
index 1bea992f..0417c038 100644
--- a/src/review.rs
+++ b/src/review.rs
@@ -4,7 +4,7 @@
 //! changed line, cluster overlapping findings, and tag each cluster by
 //! agreement + verification. No agent launching, no posting — just the
 //! verifiable consensus core (see issue #142).
-use rusqlite::{params, Connection};
+use rusqlite::{Connection, params};
 use std::collections::{HashMap, HashSet};
 
 /// Lines within this many rows of each other (same file) are treated as the
@@ -142,10 +142,10 @@ pub fn load(conn: &Connection, repo: &str, pr: &str) -> rusqlite::Result<Vec<Sto
 }
 
 pub fn clear(conn: &Connection, repo: &str, pr: &str) -> rusqlite::Result<usize> {
-    Ok(conn.execute(
+    conn.execute(
         "DELETE FROM review_findings WHERE repo = ?1 AND pr = ?2",
         params![repo, pr],
-    )?)
+    )
 }
 
 // --- accuracy scoring --------------------------------------------------------
@@ -177,7 +177,10 @@ pub fn record_round(
     for sf in findings {
         let entry = per_agent.entry(sf.agent.as_str()).or_default();
         entry.0 += 1;
-        if changed.get(&sf.finding.file).is_some_and(|s| s.contains(&sf.finding.line)) {
+        if changed
+            .get(&sf.finding.file)
+            .is_some_and(|s| s.contains(&sf.finding.line))
+        {
             entry.1 += 1;
         }
     }
@@ -213,7 +216,11 @@ pub fn scores(conn: &Connection, repo: Option<&str>) -> rusqlite::Result<Vec<Age
                 agent: r.get(0)?,
                 findings: findings as u32,
                 verified: verified as u32,
-                accuracy: if findings > 0 { verified as f64 / findings as f64 } else { 0.0 },
+                accuracy: if findings > 0 {
+                    verified as f64 / findings as f64
+                } else {
+                    0.0
+                },
                 rounds: rounds as u32,
             })
         })?
@@ -250,7 +257,12 @@ pub fn changed_lines(diff: &str) -> HashMap<String, HashSet<u32>> {
             file = (p != "/dev/null").then(|| p.to_string());
         } else if let Some(hunk) = raw.strip_prefix("@@") {
             // "@@ -a,b +c,d @@ ..." — grab the new-side start `c`.
-            if let Some(start) = hunk.split('+').nth(1).and_then(|s| s.split([',', ' ']).next()).and_then(|s| s.parse::<u32>().ok()) {
+            if let Some(start) = hunk
+                .split('+')
+                .nth(1)
+                .and_then(|s| s.split([',', ' ']).next())
+                .and_then(|s| s.parse::<u32>().ok())
+            {
                 new_line = start;
             }
         } else if let Some(f) = &file {
@@ -277,13 +289,19 @@ pub fn changed_lines(diff: &str) -> HashMap<String, HashSet<u32>> {
 
 /// Verifies, clusters, and tags submitted findings against the diff's changed
 /// lines. Returns items ranked most-confident first.
-pub fn consensus(findings: &[StoredFinding], changed: &HashMap<String, HashSet<u32>>) -> Vec<ConsensusItem> {
+pub fn consensus(
+    findings: &[StoredFinding],
+    changed: &HashMap<String, HashSet<u32>>,
+) -> Vec<ConsensusItem> {
     let mut items: Vec<ConsensusItem> = Vec::new();
 
     // Unverified: cited line isn't a changed line. Each stands alone.
-    let (verified, unverified): (Vec<&StoredFinding>, Vec<&StoredFinding>) = findings
-        .iter()
-        .partition(|sf| changed.get(&sf.finding.file).is_some_and(|s| s.contains(&sf.finding.line)));
+    let (verified, unverified): (Vec<&StoredFinding>, Vec<&StoredFinding>) =
+        findings.iter().partition(|sf| {
+            changed
+                .get(&sf.finding.file)
+                .is_some_and(|s| s.contains(&sf.finding.line))
+        });
 
     for sf in unverified {
         items.push(single_item(Verdict::Unverified, sf));
@@ -292,7 +310,10 @@ pub fn consensus(findings: &[StoredFinding], changed: &HashMap<String, HashSet<u
     // Cluster verified findings per file by line proximity.
     let mut by_file: HashMap<&str, Vec<&StoredFinding>> = HashMap::new();
     for sf in verified {
-        by_file.entry(sf.finding.file.as_str()).or_default().push(sf);
+        by_file
+            .entry(sf.finding.file.as_str())
+            .or_default()
+            .push(sf);
     }
     for (_file, mut group) in by_file {
         group.sort_by_key(|sf| sf.finding.line);
@@ -356,7 +377,10 @@ fn tag_cluster(cluster: &[&StoredFinding]) -> ConsensusItem {
         line_start: cluster.iter().map(|sf| sf.finding.line).min().unwrap_or(0),
         line_end: cluster.iter().map(|sf| sf.finding.line).max().unwrap_or(0),
         agents,
-        messages: cluster.iter().map(|sf| sf.finding.message.clone()).collect(),
+        messages: cluster
+            .iter()
+            .map(|sf| sf.finding.message.clone())
+            .collect(),
         severities,
     }
 }
@@ -507,7 +531,11 @@ diff --git a/f2 b/f2
 +new
 ";
         let c = changed_lines(diff);
-        assert_eq!(c["f1"], [1u32, 2].into_iter().collect::<HashSet<_>>(), "f1 should be exactly {{1,2}}, no phantom line 3");
+        assert_eq!(
+            c["f1"],
+            [1u32, 2].into_iter().collect::<HashSet<_>>(),
+            "f1 should be exactly {{1,2}}, no phantom line 3"
+        );
         assert_eq!(c["f2"], [1u32].into_iter().collect::<HashSet<_>>());
     }
 
@@ -528,7 +556,10 @@ diff --git a/f b/f
 
     #[test]
     fn finding_off_the_diff_is_unverified() {
-        let items = consensus(&[sf("a", "src/foo.rs", 99, None)], &changed(&[("src/foo.rs", &[10, 11])]));
+        let items = consensus(
+            &[sf("a", "src/foo.rs", 99, None)],
+            &changed(&[("src/foo.rs", &[10, 11])]),
+        );
         assert_eq!(items.len(), 1);
         assert_eq!(items[0].verdict, Verdict::Unverified);
     }
@@ -536,7 +567,13 @@ diff --git a/f b/f
     #[test]
     fn two_agents_same_area_is_confirmed() {
         let ch = changed(&[("src/foo.rs", &[10, 11, 12])]);
-        let items = consensus(&[sf("a", "src/foo.rs", 10, None), sf("b", "src/foo.rs", 12, None)], &ch);
+        let items = consensus(
+            &[
+                sf("a", "src/foo.rs", 10, None),
+                sf("b", "src/foo.rs", 12, None),
+            ],
+            &ch,
+        );
         assert_eq!(items.len(), 1, "should cluster into one");
         assert_eq!(items[0].verdict, Verdict::Confirmed);
         assert_eq!(items[0].agents.len(), 2);
@@ -544,14 +581,23 @@ diff --git a/f b/f
 
     #[test]
     fn single_agent_is_unique() {
-        let items = consensus(&[sf("a", "src/foo.rs", 10, None)], &changed(&[("src/foo.rs", &[10])]));
+        let items = consensus(
+            &[sf("a", "src/foo.rs", 10, None)],
+            &changed(&[("src/foo.rs", &[10])]),
+        );
         assert_eq!(items[0].verdict, Verdict::Unique);
     }
 
     #[test]
     fn same_agent_twice_is_not_confirmed() {
         let ch = changed(&[("src/foo.rs", &[10, 11])]);
-        let items = consensus(&[sf("a", "src/foo.rs", 10, None), sf("a", "src/foo.rs", 11, None)], &ch);
+        let items = consensus(
+            &[
+                sf("a", "src/foo.rs", 10, None),
+                sf("a", "src/foo.rs", 11, None),
+            ],
+            &ch,
+        );
         assert_eq!(items[0].agents.len(), 1);
         assert_eq!(items[0].verdict, Verdict::Unique);
     }
@@ -560,7 +606,10 @@ diff --git a/f b/f
     fn conflicting_severity_across_agents_is_disputed() {
         let ch = changed(&[("src/foo.rs", &[10, 11])]);
         let items = consensus(
-            &[sf("a", "src/foo.rs", 10, Some("bug")), sf("b", "src/foo.rs", 11, Some("nit"))],
+            &[
+                sf("a", "src/foo.rs", 10, Some("bug")),
+                sf("b", "src/foo.rs", 11, Some("nit")),
+            ],
             &ch,
         );
         assert_eq!(items[0].verdict, Verdict::Disputed);
@@ -569,7 +618,13 @@ diff --git a/f b/f
     #[test]
     fn distant_lines_do_not_cluster() {
         let ch = changed(&[("src/foo.rs", &[10, 50])]);
-        let items = consensus(&[sf("a", "src/foo.rs", 10, None), sf("b", "src/foo.rs", 50, None)], &ch);
+        let items = consensus(
+            &[
+                sf("a", "src/foo.rs", 10, None),
+                sf("b", "src/foo.rs", 50, None),
+            ],
+            &ch,
+        );
         assert_eq!(items.len(), 2, "10 and 50 are far apart → separate");
         assert!(items.iter().all(|i| i.verdict == Verdict::Unique));
     }
@@ -580,8 +635,8 @@ diff --git a/f b/f
         let items = consensus(
             &[
                 sf("a", "f", 1, None),
-                sf("b", "f", 2, None), // f:1-2 confirmed
-                sf("a", "g", 1, None), // g:1 unique
+                sf("b", "f", 2, None),   // f:1-2 confirmed
+                sf("a", "g", 1, None),   // g:1 unique
                 sf("a", "f", 999, None), // unverified
             ],
             &ch,
@@ -594,8 +649,20 @@ diff --git a/f b/f
     fn submit_replaces_prior_findings_from_same_agent() {
         let conn = Connection::open_in_memory().unwrap();
         migrate(&conn).unwrap();
-        let f1 = Finding { file: "a".into(), line: 1, message: "one".into(), severity: None, category: None };
-        let f2 = Finding { file: "a".into(), line: 2, message: "two".into(), severity: None, category: None };
+        let f1 = Finding {
+            file: "a".into(),
+            line: 1,
+            message: "one".into(),
+            severity: None,
+            category: None,
+        };
+        let f2 = Finding {
+            file: "a".into(),
+            line: 2,
+            message: "two".into(),
+            severity: None,
+            category: None,
+        };
         submit(&conn, "o/r", "7", "agentA", std::slice::from_ref(&f1), 100).unwrap();
         submit(&conn, "o/r", "7", "agentA", std::slice::from_ref(&f2), 200).unwrap();
         let loaded = load(&conn, "o/r", "7").unwrap();
@@ -636,7 +703,11 @@ diff --git a/f b/f
         record_round(&conn, "o/r", "7", &findings, &ch, 200).unwrap();
         let s = scores(&conn, Some("o/r")).unwrap();
         assert_eq!(s.len(), 1);
-        assert_eq!((s[0].findings, s[0].rounds), (1, 1), "same round must not double-count");
+        assert_eq!(
+            (s[0].findings, s[0].rounds),
+            (1, 1),
+            "same round must not double-count"
+        );
     }
 
     #[test]
@@ -654,7 +725,13 @@ diff --git a/f b/f
     fn load_and_clear_are_round_scoped() {
         let conn = Connection::open_in_memory().unwrap();
         migrate(&conn).unwrap();
-        let f = Finding { file: "a".into(), line: 1, message: "m".into(), severity: None, category: None };
+        let f = Finding {
+            file: "a".into(),
+            line: 1,
+            message: "m".into(),
+            severity: None,
+            category: None,
+        };
         submit(&conn, "o/r", "7", "a", std::slice::from_ref(&f), 100).unwrap();
         submit(&conn, "o/r", "8", "a", std::slice::from_ref(&f), 100).unwrap();
         assert_eq!(clear(&conn, "o/r", "7").unwrap(), 1);
diff --git a/src/rollup.rs b/src/rollup.rs
index ac667c82..9231f216 100644
--- a/src/rollup.rs
+++ b/src/rollup.rs
@@ -46,7 +46,9 @@ fn migrate(conn: &Connection) -> rusqlite::Result<()> {
     if version > 1 {
         return Err(rusqlite::Error::SqliteFailure(
             rusqlite::ffi::Error::new(rusqlite::ffi::SQLITE_SCHEMA),
-            Some(format!("analytics.db schema version {version} is newer than this build supports")),
+            Some(format!(
+                "analytics.db schema version {version} is newer than this build supports"
+            )),
         ));
     }
     if version < 1 {
@@ -150,7 +152,7 @@ pub(crate) fn open_or_rebuild() -> Connection {
 }
 
 use crate::cost::{
-    add_tokens, find_session_files_under, project_name_for, should_count_line, GroupTotals,
+    GroupTotals, add_tokens, find_session_files_under, project_name_for, should_count_line,
 };
 use chrono::NaiveDate;
 use rusqlite::params;
@@ -220,9 +222,18 @@ fn prune_deleted_files(conn: &mut Connection, on_disk: &[std::path::PathBuf]) {
         return;
     };
     for path in stale {
-        tx.execute("DELETE FROM session_files WHERE file_path = ?1", params![path]).ok();
-        tx.execute("DELETE FROM file_rollup WHERE file_path = ?1", params![path]).ok();
-        tx.execute("DELETE FROM dedup_keys WHERE file_path = ?1", params![path]).ok();
+        tx.execute(
+            "DELETE FROM session_files WHERE file_path = ?1",
+            params![path],
+        )
+        .ok();
+        tx.execute(
+            "DELETE FROM file_rollup WHERE file_path = ?1",
+            params![path],
+        )
+        .ok();
+        tx.execute("DELETE FROM dedup_keys WHERE file_path = ?1", params![path])
+            .ok();
     }
     tx.commit().ok();
 }
@@ -245,13 +256,19 @@ fn reindex_file(
     };
 
     if tx
-        .execute("DELETE FROM file_rollup WHERE file_path = ?1", params![path_str])
+        .execute(
+            "DELETE FROM file_rollup WHERE file_path = ?1",
+            params![path_str],
+        )
         .is_err()
     {
         return;
     }
     if tx
-        .execute("DELETE FROM dedup_keys WHERE file_path = ?1", params![path_str])
+        .execute(
+            "DELETE FROM dedup_keys WHERE file_path = ?1",
+            params![path_str],
+        )
         .is_err()
     {
         return;
@@ -306,7 +323,10 @@ fn reindex_file(
             }
         }
 
-        let model = parsed.model.clone().unwrap_or_else(|| "unknown".to_string());
+        let model = parsed
+            .model
+            .clone()
+            .unwrap_or_else(|| "unknown".to_string());
         let cost = crate::pricing::calculate_cost(&parsed.tokens, parsed.model.as_deref(), pricing);
 
         let entry = sums.entry((date, model)).or_default();
@@ -350,7 +370,12 @@ fn reindex_file(
             mtime_secs = excluded.mtime_secs,
             size_bytes = excluded.size_bytes,
             indexed_at = excluded.indexed_at",
-        params![path_str, mtime_secs, size_bytes, chrono::Local::now().to_rfc3339()],
+        params![
+            path_str,
+            mtime_secs,
+            size_bytes,
+            chrono::Local::now().to_rfc3339()
+        ],
     );
     if upserted.is_err() {
         return;
@@ -427,7 +452,10 @@ mod tests {
                 .unwrap()
                 .map(|r| r.unwrap())
                 .collect();
-            assert_eq!(names, vec!["dedup_keys", "file_rollup", "meta", "session_files"]);
+            assert_eq!(
+                names,
+                vec!["dedup_keys", "file_rollup", "meta", "session_files"]
+            );
 
             let version: i32 = conn
                 .pragma_query_value(None, "user_version", |row| row.get(0))
@@ -463,7 +491,12 @@ mod tests {
         });
     }
 
-    fn write_session_file(dir: &std::path::Path, project: &str, file: &str, content: &str) -> PathBuf {
+    fn write_session_file(
+        dir: &std::path::Path,
+        project: &str,
+        file: &str,
+        content: &str,
+    ) -> PathBuf {
         let project_dir = dir.join(project);
         std::fs::create_dir_all(&project_dir).unwrap();
         let path = project_dir.join(file);
@@ -472,8 +505,10 @@ mod tests {
     }
 
     fn row_count(conn: &Connection, table: &str) -> i64 {
-        conn.query_row(&format!("SELECT COUNT(*) FROM {table}"), [], |row| row.get(0))
-            .unwrap()
+        conn.query_row(&format!("SELECT COUNT(*) FROM {table}"), [], |row| {
+            row.get(0)
+        })
+        .unwrap()
     }
 
     #[test]
@@ -490,11 +525,9 @@ mod tests {
             assert_eq!(row_count(&conn, "session_files"), 1);
             assert_eq!(row_count(&conn, "file_rollup"), 1);
             let (model, input_tokens): (String, i64) = conn
-                .query_row(
-                    "SELECT model, input_tokens FROM file_rollup",
-                    [],
-                    |row| Ok((row.get(0)?, row.get(1)?)),
-                )
+                .query_row("SELECT model, input_tokens FROM file_rollup", [], |row| {
+                    Ok((row.get(0)?, row.get(1)?))
+                })
                 .unwrap();
             assert_eq!(model, "claude-opus-4-8");
             assert_eq!(input_tokens, 100);
@@ -547,11 +580,18 @@ mod tests {
 
             sync(&mut conn, &dir);
 
-            assert_eq!(row_count(&conn, "file_rollup"), 1, "same date+model still one row");
+            assert_eq!(
+                row_count(&conn, "file_rollup"),
+                1,
+                "same date+model still one row"
+            );
             let input_tokens: i64 = conn
                 .query_row("SELECT input_tokens FROM file_rollup", [], |row| row.get(0))
                 .unwrap();
-            assert_eq!(input_tokens, 120, "reindex must reflect the appended line, not double-count the original");
+            assert_eq!(
+                input_tokens, 120,
+                "reindex must reflect the appended line, not double-count the original"
+            );
 
             let _ = std::fs::remove_dir_all(&dir);
         });
@@ -569,7 +609,12 @@ mod tests {
             // is applied to both instants alike.
             let day1 = r#"{"type":"assistant","timestamp":"2026-07-05T12:00:00Z","message":{"id":"m1","model":"claude-opus-4-8","usage":{"input_tokens":100,"output_tokens":0}},"requestId":"r1"}"#;
             let day2 = r#"{"type":"assistant","timestamp":"2026-07-06T13:00:00Z","message":{"id":"m2","model":"claude-opus-4-8","usage":{"input_tokens":30,"output_tokens":0}},"requestId":"r2"}"#;
-            write_session_file(&dir, "proj1", "session1.jsonl", &format!("{day1}\n{day2}\n"));
+            write_session_file(
+                &dir,
+                "proj1",
+                "session1.jsonl",
+                &format!("{day1}\n{day2}\n"),
+            );
 
             let mut conn = open_or_rebuild();
             sync(&mut conn, &dir);
@@ -589,7 +634,12 @@ mod tests {
             // message.id:requestId) must be counted once, not twice.
             let block1 = r#"{"type":"assistant","timestamp":"2026-07-06T10:00:00Z","message":{"id":"m1","model":"claude-opus-4-8","usage":{"input_tokens":100,"output_tokens":50}},"requestId":"r1"}"#;
             let block2 = r#"{"type":"assistant","timestamp":"2026-07-06T10:00:00Z","message":{"id":"m1","model":"claude-opus-4-8","usage":{"input_tokens":100,"output_tokens":50}},"requestId":"r1"}"#;
-            write_session_file(&dir, "proj1", "session1.jsonl", &format!("{block1}\n{block2}\n"));
+            write_session_file(
+                &dir,
+                "proj1",
+                "session1.jsonl",
+                &format!("{block1}\n{block2}\n"),
+            );
 
             let mut conn = open_or_rebuild();
             sync(&mut conn, &dir);
@@ -597,7 +647,10 @@ mod tests {
             let input_tokens: i64 = conn
                 .query_row("SELECT input_tokens FROM file_rollup", [], |row| row.get(0))
                 .unwrap();
-            assert_eq!(input_tokens, 100, "duplicate content-block lines must be deduped");
+            assert_eq!(
+                input_tokens, 100,
+                "duplicate content-block lines must be deduped"
+            );
 
             let _ = std::fs::remove_dir_all(&dir);
         });
@@ -619,7 +672,9 @@ mod tests {
             sync(&mut conn, &dir);
 
             let total_input: i64 = conn
-                .query_row("SELECT SUM(input_tokens) FROM file_rollup", [], |row| row.get(0))
+                .query_row("SELECT SUM(input_tokens) FROM file_rollup", [], |row| {
+                    row.get(0)
+                })
                 .unwrap();
             assert_eq!(
                 total_input, 100,
@@ -648,15 +703,34 @@ mod tests {
 
             let files = find_session_files_under(&dir);
             let pricing = crate::pricing::load_pricing();
-            let expected = crate::cost::aggregate(&files, (today, today), crate::cost::GroupBy::Model, &pricing);
+            let expected = crate::cost::aggregate(
+                &files,
+                (today, today),
+                crate::cost::GroupBy::Model,
+                &pricing,
+            );
 
             assert_eq!(actual.len(), expected.len());
             for (key, expected_totals) in &expected {
-                let actual_totals = actual.get(key).unwrap_or_else(|| panic!("missing key {key}"));
-                assert_eq!(actual_totals.tokens.input_tokens, expected_totals.tokens.input_tokens, "key {key}");
-                assert_eq!(actual_totals.tokens.output_tokens, expected_totals.tokens.output_tokens, "key {key}");
-                assert!((actual_totals.cost_usd - expected_totals.cost_usd).abs() < 0.000_001, "key {key}");
-                assert_eq!(actual_totals.has_unpriced_usage, expected_totals.has_unpriced_usage, "key {key}");
+                let actual_totals = actual
+                    .get(key)
+                    .unwrap_or_else(|| panic!("missing key {key}"));
+                assert_eq!(
+                    actual_totals.tokens.input_tokens, expected_totals.tokens.input_tokens,
+                    "key {key}"
+                );
+                assert_eq!(
+                    actual_totals.tokens.output_tokens, expected_totals.tokens.output_tokens,
+                    "key {key}"
+                );
+                assert!(
+                    (actual_totals.cost_usd - expected_totals.cost_usd).abs() < 0.000_001,
+                    "key {key}"
+                );
+                assert_eq!(
+                    actual_totals.has_unpriced_usage, expected_totals.has_unpriced_usage,
+                    "key {key}"
+                );
             }
 
             let _ = std::fs::remove_dir_all(&dir);
@@ -681,13 +755,26 @@ mod tests {
 
             let files = find_session_files_under(&dir);
             let pricing = crate::pricing::load_pricing();
-            let expected = crate::cost::aggregate(&files, (today, today), crate::cost::GroupBy::Project, &pricing);
+            let expected = crate::cost::aggregate(
+                &files,
+                (today, today),
+                crate::cost::GroupBy::Project,
+                &pricing,
+            );
 
             assert_eq!(actual.len(), expected.len());
             for (key, expected_totals) in &expected {
-                let actual_totals = actual.get(key).unwrap_or_else(|| panic!("missing key {key}"));
-                assert_eq!(actual_totals.tokens.input_tokens, expected_totals.tokens.input_tokens, "key {key}");
-                assert!((actual_totals.cost_usd - expected_totals.cost_usd).abs() < 0.000_001, "key {key}");
+                let actual_totals = actual
+                    .get(key)
+                    .unwrap_or_else(|| panic!("missing key {key}"));
+                assert_eq!(
+                    actual_totals.tokens.input_tokens, expected_totals.tokens.input_tokens,
+                    "key {key}"
+                );
+                assert!(
+                    (actual_totals.cost_usd - expected_totals.cost_usd).abs() < 0.000_001,
+                    "key {key}"
+                );
             }
 
             let _ = std::fs::remove_dir_all(&dir);
@@ -701,7 +788,12 @@ mod tests {
             let _ = std::fs::remove_dir_all(&dir);
             let in_range = r#"{"type":"assistant","timestamp":"2026-07-04T10:00:00Z","message":{"id":"m1","model":"claude-opus-4-8","usage":{"input_tokens":100,"output_tokens":50}},"requestId":"r1"}"#;
             let out_of_range = r#"{"type":"assistant","timestamp":"2026-07-03T10:00:00Z","message":{"id":"m2","model":"claude-opus-4-8","usage":{"input_tokens":999,"output_tokens":999}},"requestId":"r2"}"#;
-            write_session_file(&dir, "proj1", "session1.jsonl", &format!("{in_range}\n{out_of_range}\n"));
+            write_session_file(
+                &dir,
+                "proj1",
+                "session1.jsonl",
+                &format!("{in_range}\n{out_of_range}\n"),
+            );
 
             let mut conn = open_or_rebuild();
             sync(&mut conn, &dir);
@@ -711,7 +803,10 @@ mod tests {
             let totals = query(&conn, range, crate::cost::GroupBy::Model);
 
             let opus = totals.get("claude-opus-4-8").expect("expected opus entry");
-            assert_eq!(opus.tokens.input_tokens, 100, "2026-07-03 line is outside the 3-day window");
+            assert_eq!(
+                opus.tokens.input_tokens, 100,
+                "2026-07-03 line is outside the 3-day window"
+            );
 
             let _ = std::fs::remove_dir_all(&dir);
         });
@@ -731,7 +826,9 @@ mod tests {
             let today = NaiveDate::from_ymd_opt(2026, 7, 6).unwrap();
             let totals = query(&conn, (today, today), crate::cost::GroupBy::Model);
 
-            let entry = totals.get("some-unrecognized-model").expect("expected entry");
+            let entry = totals
+                .get("some-unrecognized-model")
+                .expect("expected entry");
             assert!(entry.has_unpriced_usage);
 
             let _ = std::fs::remove_dir_all(&dir);
@@ -750,7 +847,10 @@ mod tests {
             let version: i32 = conn
                 .pragma_query_value(None, "user_version", |row| row.get(0))
                 .unwrap();
-            assert_eq!(version, 1, "a newer-than-supported schema version must be rejected and rebuilt, not silently accepted");
+            assert_eq!(
+                version, 1,
+                "a newer-than-supported schema version must be rejected and rebuilt, not silently accepted"
+            );
         });
     }
 
@@ -778,7 +878,11 @@ mod tests {
 
             // Reopening must detect the mismatch and wipe the stale rollup.
             let conn = open_or_rebuild();
-            assert_eq!(row_count(&conn, "file_rollup"), 0, "stale rollup rows must be cleared when the pricing fingerprint no longer matches");
+            assert_eq!(
+                row_count(&conn, "file_rollup"),
+                0,
+                "stale rollup rows must be cleared when the pricing fingerprint no longer matches"
+            );
             assert_eq!(row_count(&conn, "session_files"), 0);
 
             let _ = std::fs::remove_dir_all(&dir);
diff --git a/src/shell.rs b/src/shell.rs
index 43e1e64d..fed7b12a 100644
--- a/src/shell.rs
+++ b/src/shell.rs
@@ -1,6 +1,7 @@
 use std::path::PathBuf;
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[allow(clippy::enum_variant_names)]
 pub enum Shell {
     Bash,
     Zsh,
@@ -61,7 +62,7 @@ impl Shell {
                     .join("Documents")
                     .join("PowerShell")
                     .join("Microsoft.PowerShell_profile.ps1");
-                if ps7.parent().map_or(false, |p| p.exists()) {
+                if ps7.parent().is_some_and(|p| p.exists()) {
                     ps7
                 } else {
                     home.join("Documents")
@@ -157,7 +158,8 @@ mod tests {
 
     #[test]
     fn is_defined_in_profile_ignores_own_managed_block() {
-        let content = "# >>> agentflare alias >>>\nalias af='agentflare'\n# <<< agentflare alias <<<\n";
+        let content =
+            "# >>> agentflare alias >>>\nalias af='agentflare'\n# <<< agentflare alias <<<\n";
         assert!(!Shell::Bash.is_defined_in_profile(content, "af"));
     }
 
@@ -189,7 +191,8 @@ mod tests {
 
     #[test]
     fn strip_managed_blocks_preserves_content_outside() {
-        let content = "line1\n# >>> agentflare alias >>>\ninside\n# <<< agentflare alias <<<\nline2\n";
+        let content =
+            "line1\n# >>> agentflare alias >>>\ninside\n# <<< agentflare alias <<<\nline2\n";
         let stripped = strip_managed_blocks(content);
         assert!(stripped.contains("line1"));
         assert!(stripped.contains("line2"));
diff --git a/src/state.rs b/src/state.rs
index dcf76087..e364356f 100644
--- a/src/state.rs
+++ b/src/state.rs
@@ -32,7 +32,10 @@ pub fn load() -> State {
     fs::read_to_string(state_path())
         .ok()
         .and_then(|s| serde_json::from_str(&s).ok())
-        .unwrap_or_else(|| State { active: true, ..Default::default() })
+        .unwrap_or_else(|| State {
+            active: true,
+            ..Default::default()
+        })
 }
 
 pub fn save(state: &State) {
@@ -65,7 +68,10 @@ mod tests {
     #[test]
     fn save_then_load_roundtrips() {
         with_temp_home(|| {
-            save(&State { active: false, ..Default::default() });
+            save(&State {
+                active: false,
+                ..Default::default()
+            });
             assert!(!load().active);
         });
     }
diff --git a/src/tool_install.rs b/src/tool_install.rs
index 6f30db87..ed989790 100644
--- a/src/tool_install.rs
+++ b/src/tool_install.rs
@@ -168,10 +168,12 @@ mod tests {
                 && argv.contains(&"agentflare")
                 && argv.contains(&"mise")
         }));
-        assert!(LEAN_CTX
-            .post_install
-            .iter()
-            .any(|argv| argv.contains(&"compression_level") && argv.contains(&"max")));
+        assert!(
+            LEAN_CTX
+                .post_install
+                .iter()
+                .any(|argv| argv.contains(&"compression_level") && argv.contains(&"max"))
+        );
     }
 
     #[test]
diff --git a/src/uninstall.rs b/src/uninstall.rs
index ba512a37..45d9aeef 100644
--- a/src/uninstall.rs
+++ b/src/uninstall.rs
@@ -58,36 +58,45 @@ fn clean_claude_code(dry_run: bool) {
     let settings_path = home().join(".claude").join("settings.json");
     if settings_path.exists() {
         let content = fs::read_to_string(&settings_path).unwrap_or_default();
-        if content.contains("agentflare") {
-            if let Ok(mut settings) = serde_json::from_str::<Value>(&content) {
-                if let Some(hooks) = settings.get_mut("hooks").and_then(|h| h.as_object_mut()) {
-                    for key in &["SessionStart", "UserPromptSubmit", "PreToolUse"] {
-                        if let Some(arr) = hooks.get(*key).and_then(|v| v.as_array()) {
-                            hooks[*key] = Value::Array(
-                                arr.iter()
-                                    .filter(|entry| !entry.to_string().contains("agentflare"))
-                                    .cloned()
-                                    .collect(),
-                            );
-                        }
-                    }
-                    if hooks.get("SessionStart").map_or(true, |v| v.as_array().map_or(true, |a| a.is_empty()))
-                        && hooks.get("UserPromptSubmit").map_or(true, |v| v.as_array().map_or(true, |a| a.is_empty()))
-                        && hooks.get("PreToolUse").map_or(true, |v| v.as_array().map_or(true, |a| a.is_empty()))
-                    {
-                        hooks.remove("SessionStart");
-                        hooks.remove("UserPromptSubmit");
-                        hooks.remove("PreToolUse");
-                    }
-                    if hooks.is_empty() {
-                        settings.as_object_mut().unwrap().remove("hooks");
+        if content.contains("agentflare")
+            && let Ok(mut settings) = serde_json::from_str::<Value>(&content)
+        {
+            if let Some(hooks) = settings.get_mut("hooks").and_then(|h| h.as_object_mut()) {
+                for key in &["SessionStart", "UserPromptSubmit", "PreToolUse"] {
+                    if let Some(arr) = hooks.get(*key).and_then(|v| v.as_array()) {
+                        hooks[*key] = Value::Array(
+                            arr.iter()
+                                .filter(|entry| !entry.to_string().contains("agentflare"))
+                                .cloned()
+                                .collect(),
+                        );
                     }
                 }
-                if dry_run {
-                    println!("  clean ~/.claude/settings.json (remove agentflare hooks)");
-                } else {
-                    let _ = fs::write(&settings_path, serde_json::to_string_pretty(&settings).unwrap() + "\n");
+                if hooks
+                    .get("SessionStart")
+                    .is_none_or(|v| v.as_array().is_none_or(|a| a.is_empty()))
+                    && hooks
+                        .get("UserPromptSubmit")
+                        .is_none_or(|v| v.as_array().is_none_or(|a| a.is_empty()))
+                    && hooks
+                        .get("PreToolUse")
+                        .is_none_or(|v| v.as_array().is_none_or(|a| a.is_empty()))
+                {
+                    hooks.remove("SessionStart");
+                    hooks.remove("UserPromptSubmit");
+                    hooks.remove("PreToolUse");
                 }
+                if hooks.is_empty() {
+                    settings.as_object_mut().unwrap().remove("hooks");
+                }
+            }
+            if dry_run {
+                println!("  clean ~/.claude/settings.json (remove agentflare hooks)");
+            } else {
+                let _ = fs::write(
+                    &settings_path,
+                    serde_json::to_string_pretty(&settings).unwrap() + "\n",
+                );
             }
         }
     }
@@ -99,29 +108,42 @@ fn clean_opencode(dry_run: bool) {
         remove_file(&rules_dir.join(f), dry_run);
     }
 
-    let config_path = home().join(".config").join("opencode").join("opencode.jsonc");
+    let config_path = home()
+        .join(".config")
+        .join("opencode")
+        .join("opencode.jsonc");
     if config_path.exists() {
         let content = fs::read_to_string(&config_path).unwrap_or_default();
-        if content.contains("agentflare") || content.contains("exa.md") || content.contains("engram.md") {
-            if let Ok(mut config) = serde_json::from_str::<Value>(&content) {
-                if let Some(instructions) = config.get_mut("instructions").and_then(|v| v.as_array_mut()) {
-                    instructions.retain(|v| {
-                        let s = v.as_str().unwrap_or("");
-                        !s.contains("exa.md")
-                            && !s.contains("git.md")
-                            && !s.contains("lean-ctx.md")
-                            && !s.contains("engram.md")
-                    });
-                    if instructions.is_empty() {
-                        config.as_object_mut().unwrap().remove("instructions");
-                    }
-                }
-                if dry_run {
-                    println!("  clean ~/.config/opencode/opencode.jsonc (remove agentflare instructions)");
-                } else {
-                    let _ = fs::write(&config_path, serde_json::to_string_pretty(&config).unwrap() + "\n");
+        if (content.contains("agentflare")
+            || content.contains("exa.md")
+            || content.contains("engram.md"))
+            && let Ok(mut config) = serde_json::from_str::<Value>(&content)
+        {
+            if let Some(instructions) = config
+                .get_mut("instructions")
+                .and_then(|v| v.as_array_mut())
+            {
+                instructions.retain(|v| {
+                    let s = v.as_str().unwrap_or("");
+                    !s.contains("exa.md")
+                        && !s.contains("git.md")
+                        && !s.contains("lean-ctx.md")
+                        && !s.contains("engram.md")
+                });
+                if instructions.is_empty() {
+                    config.as_object_mut().unwrap().remove("instructions");
                 }
             }
+            if dry_run {
+                println!(
+                    "  clean ~/.config/opencode/opencode.jsonc (remove agentflare instructions)"
+                );
+            } else {
+                let _ = fs::write(
+                    &config_path,
+                    serde_json::to_string_pretty(&config).unwrap() + "\n",
+                );
+            }
         }
     }
 }
@@ -154,22 +176,31 @@ fn clean_mcp_configs(dry_run: bool) {
 
     let cwd = std::env::current_dir().unwrap_or_default();
     let engram_mcp = cwd.join(".continue").join("mcpServers").join("engram.json");
-    let agentflare_mcp = cwd.join(".continue").join("mcpServers").join("agentflare.json");
+    let agentflare_mcp = cwd
+        .join(".continue")
+        .join("mcpServers")
+        .join("agentflare.json");
     remove_file(&engram_mcp, dry_run);
     remove_file(&agentflare_mcp, dry_run);
 }
 
 fn clean_mcp_entry(path: &PathBuf, dry_run: bool) {
-    if !path.exists() { return; }
+    if !path.exists() {
+        return;
+    }
     let content = fs::read_to_string(path).unwrap_or_default();
     // "flare" also matches "agentflare", covering the legacy entry name.
     if !content.contains("engram") && !content.contains("lean-ctx") && !content.contains("flare") {
         return;
     }
     if let Ok(mut config) = serde_json::from_str::<Value>(&content) {
-        let key = if config.get("mcpServers").is_some() { "mcpServers" }
-                  else if config.get("mcp").is_some() { "mcp" }
-                  else { return };
+        let key = if config.get("mcpServers").is_some() {
+            "mcpServers"
+        } else if config.get("mcp").is_some() {
+            "mcp"
+        } else {
+            return;
+        };
         if let Some(mcp) = config.get_mut(key).and_then(|v| v.as_object_mut()) {
             mcp.remove("engram");
             mcp.remove("lean-ctx");
@@ -188,8 +219,14 @@ fn clean_mcp_entry(path: &PathBuf, dry_run: bool) {
 }
 
 fn clean_ponytail_caveman(dry_run: bool) {
-    remove_file(&home().join(".config").join("ponytail").join("config.json"), dry_run);
-    remove_file(&home().join(".config").join("caveman").join("config.json"), dry_run);
+    remove_file(
+        &home().join(".config").join("ponytail").join("config.json"),
+        dry_run,
+    );
+    remove_file(
+        &home().join(".config").join("caveman").join("config.json"),
+        dry_run,
+    );
 }
 
 fn clean_state_dir(dry_run: bool) {
@@ -203,17 +240,27 @@ fn clean_binary(dry_run: bool) {
         .unwrap_or_else(|_| home().join(".local").join("bin"));
 
     let current = std::env::current_exe().ok();
-    if let Some(ref current) = current {
-        if current.to_string_lossy().contains("/target/") {
-            if !dry_run {
-                println!("  skip binary (running from dev build at {})", current.display());
-            }
-            return;
+    if let Some(ref current) = current
+        && current.to_string_lossy().contains("/target/")
+    {
+        if !dry_run {
+            println!(
+                "  skip binary (running from dev build at {})",
+                current.display()
+            );
         }
+        return;
     }
 
-    let binary_name = if cfg!(windows) { "agentflare.exe" } else { "agentflare" };
-    let locations = &[install_dir.join(binary_name), PathBuf::from("/usr/local/bin").join(binary_name)];
+    let binary_name = if cfg!(windows) {
+        "agentflare.exe"
+    } else {
+        "agentflare"
+    };
+    let locations = &[
+        install_dir.join(binary_name),
+        PathBuf::from("/usr/local/bin").join(binary_name),
+    ];
 
     for loc in locations {
         if loc.exists() {
diff --git a/src/update.rs b/src/update.rs
index 8d0dee5c..3b0f8469 100644
--- a/src/update.rs
+++ b/src/update.rs
@@ -22,15 +22,16 @@ fn target_triple() -> &'static str {
 }
 
 fn asset_ext() -> &'static str {
-    if cfg!(windows) {
-        "zip"
-    } else {
-        "tar.gz"
-    }
+    if cfg!(windows) { "zip" } else { "tar.gz" }
 }
 
 fn asset_name(version: &str) -> String {
-    format!("agentflare-{}-{}.{}", target_triple(), clear_v(version), asset_ext())
+    format!(
+        "agentflare-{}-{}.{}",
+        target_triple(),
+        clear_v(version),
+        asset_ext()
+    )
 }
 
 fn checksums_name() -> String {
@@ -38,9 +39,7 @@ fn checksums_name() -> String {
 }
 
 fn release_url(version: &str, asset: &str) -> String {
-    format!(
-        "https://github.com/{REPO}/releases/download/{version}/{asset}"
-    )
+    format!("https://github.com/{REPO}/releases/download/{version}/{asset}")
 }
 
 fn clear_v(version: &str) -> &str {
@@ -101,7 +100,10 @@ pub fn run(version: Option<String>, check_only: bool, quiet: bool) {
             };
             if check_only {
                 if !quiet {
-                    println!("new version available: {latest} (current: v{})", env!("CARGO_PKG_VERSION"));
+                    println!(
+                        "new version available: {latest} (current: v{})",
+                        env!("CARGO_PKG_VERSION")
+                    );
                 }
                 return;
             }
@@ -157,7 +159,11 @@ pub fn run(version: Option<String>, check_only: bool, quiet: bool) {
     let _ = std::fs::remove_dir_all(&tmpdir);
     std::fs::create_dir_all(&tmpdir).unwrap();
 
-    let binary_name = if cfg!(windows) { "agentflare.exe" } else { "agentflare" };
+    let binary_name = if cfg!(windows) {
+        "agentflare.exe"
+    } else {
+        "agentflare"
+    };
 
     match asset_ext() {
         "tar.gz" => {
@@ -170,7 +176,9 @@ pub fn run(version: Option<String>, check_only: bool, quiet: bool) {
         }
         "zip" => {
             let cursor = std::io::Cursor::new(&data);
-            let mut archive = zip::ZipArchive::new(cursor).map_err(|e| format!("zip error: {e}")).unwrap();
+            let mut archive = zip::ZipArchive::new(cursor)
+                .map_err(|e| format!("zip error: {e}"))
+                .unwrap();
             archive
                 .extract(&tmpdir)
                 .map_err(|e| format!("extract error: {e}"))
diff --git a/tests/caveman_cli.rs b/tests/caveman_cli.rs
index a705ca4c..6e0d64b3 100644
--- a/tests/caveman_cli.rs
+++ b/tests/caveman_cli.rs
@@ -43,7 +43,12 @@ fn caveman_compress_generic_uses_the_stubbed_claude_cli() {
     std::fs::write(&source, "verbose original text").unwrap();
 
     let existing_path = std::env::var("PATH").unwrap_or_default();
-    let new_path = format!("{}{}{}", stub_dir.display(), if cfg!(windows) { ";" } else { ":" }, existing_path);
+    let new_path = format!(
+        "{}{}{}",
+        stub_dir.display(),
+        if cfg!(windows) { ";" } else { ":" },
+        existing_path
+    );
 
     let output = Command::new(agentflare_bin())
         .args(["caveman", "compress"])
@@ -53,10 +58,20 @@ fn caveman_compress_generic_uses_the_stubbed_claude_cli() {
         .output()
         .expect("failed to run agentflare");
 
-    assert!(output.status.success(), "stderr: {}", String::from_utf8_lossy(&output.stderr));
+    assert!(
+        output.status.success(),
+        "stderr: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
     let stdout = String::from_utf8_lossy(&output.stdout);
-    assert!(stdout.contains("B ▼"), "expected a summary line, got: {stdout}");
-    assert_eq!(std::fs::read_to_string(&source).unwrap(), "compressed output");
+    assert!(
+        stdout.contains("B ▼"),
+        "expected a summary line, got: {stdout}"
+    );
+    assert_eq!(
+        std::fs::read_to_string(&source).unwrap(),
+        "compressed output"
+    );
     // Generic compression defaults to BackupMode::OutOfTree, so the backup
     // does NOT live next to the source as doc.md.orig — it lives under
     // dirs::cache_dir()/agentflare/caveman/backups/. Not asserted here