fix(ci): rustfmt drift, clippy type_complexity, and status.generated.md staleness

Fixes 4 real CI failures from the WS0-WS6 push (0a7a8aa): cargo fmt was
never run on pipeline.rs/tools.rs/tools/edit.rs/tools/trace.rs; the new
partition() tuple-type annotations in callers/callees tripped clippy's
type_complexity lint under -D warnings; and docs/status.generated.md
wasn't regenerated after review_decide_via_agent_relay was added (39->40
tools). calm-guard-dogfood's own high-risk flag on this push is expected
shadow-mode behavior (continue-on-error), not a bug.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: Your Name

crates/calm-core/src/indexer/pipeline.rs

@@ -1184,8 +1184,7 @@ fn build_inheritance_closure(
     };
     let mut direct_parents: HashMap<String, Vec<String>> = HashMap::new();
     for (child_qn, parent_qn) in direct_qn {
-        let (Some(child), Some(parent)) =
-            (qn_to_name.get(&child_qn), qn_to_name.get(&parent_qn))
+        let (Some(child), Some(parent)) = (qn_to_name.get(&child_qn), qn_to_name.get(&parent_qn))
         else {
             continue;
         };
@@ -1253,7 +1252,10 @@ fn resolve_via_inheritance_closure(
     for level in levels {
         let mut hits: Vec<SymbolCandidate> = Vec::new();
         for ancestor in level {
-            if let Some(t) = ctx.by_name_class.get(&(callee.to_string(), ancestor.clone())) {
+            if let Some(t) = ctx
+                .by_name_class
+                .get(&(callee.to_string(), ancestor.clone()))
+            {
                 for cand in t {
                     if !hits.contains(cand) {
                         hits.push(cand.clone());
@@ -5198,7 +5200,10 @@ impl StructB {
                 |r| r.get(0),
             )
             .expect("caller.py's bar() call site must have a captured import_path");
-        assert_eq!(import_path, "lib", "resolve_tier1's resolved_path must be 'lib', not dropped");
+        assert_eq!(
+            import_path, "lib",
+            "resolve_tier1's resolved_path must be 'lib', not dropped"
+        );
 
         // The narrowing itself: the edge must target lib.py's bar, not any
         // decoy, and must not vanish (the pre-fix MAX_CALLEE_CANDIDATES
@@ -5282,10 +5287,15 @@ impl StructB {
                 [],
                 |r| Ok((r.get(0)?, r.get(1)?, r.get(2)?, r.get(3)?)),
             )
-            .expect("the dropped call site must be recorded in ambiguity_groups, not silently lost");
+            .expect(
+                "the dropped call site must be recorded in ambiguity_groups, not silently lost",
+            );
         assert_eq!(from_path, "caller.py");
         assert_eq!(candidate_group_key, "helper");
-        assert_eq!(candidate_count, 25, "must record the true candidate count, not a truncated one");
+        assert_eq!(
+            candidate_count, 25,
+            "must record the true candidate count, not a truncated one"
+        );
         assert_eq!(reason, "unscoped_candidates_exceeded_max_callee_candidates");
         assert_eq!(
             count(&conn, "SELECT COUNT(*) FROM ambiguity_groups"),
@@ -5728,7 +5738,11 @@ impl StructB {
                 )
                 .unwrap();
             stmt.query_map([], |r| {
-                Ok((r.get::<_, String>(0)?, r.get::<_, i64>(1)?, r.get::<_, String>(2)?))
+                Ok((
+                    r.get::<_, String>(0)?,
+                    r.get::<_, i64>(1)?,
+                    r.get::<_, String>(2)?,
+                ))
             })
             .unwrap()
             .map(|r| r.unwrap())

crates/calm-server/src/tools.rs

@@ -6138,7 +6138,10 @@ mod tests {
                 if_none_match: None,
             })),
         );
-        assert_eq!(v["direct_count"], 7, "1 formal + 2 resolved + 1 inferred + 3 textual");
+        assert_eq!(
+            v["direct_count"], 7,
+            "1 formal + 2 resolved + 1 inferred + 3 textual"
+        );
         assert_eq!(v["ambiguous_count"], 1);
         let breakdown = &v["direct_by_confidence"];
         assert_eq!(breakdown["formal"], 1);
@@ -6219,7 +6222,10 @@ mod tests {
         );
         let msg = v["caveat"]["message"].as_str().unwrap();
         assert!(msg.contains('1'), "caveat must cite the site count: {msg}");
-        assert!(msg.contains("25"), "caveat must cite the widest candidate_count: {msg}");
+        assert!(
+            msg.contains("25"),
+            "caveat must cite the widest candidate_count: {msg}"
+        );
 
         let _ = std::fs::remove_dir_all(&dir);
     }
@@ -6276,7 +6282,11 @@ mod tests {
             })),
         );
         let ambiguous = v["ambiguous"].as_array().unwrap();
-        assert_eq!(ambiguous.len(), 2, "both candidates must survive as ambiguous");
+        assert_eq!(
+            ambiguous.len(),
+            2,
+            "both candidates must survive as ambiguous"
+        );
         assert_eq!(
             ambiguous[0]["symbol"], "a.c::preferred_caller",
             "the rank-0 (preferred) candidate must surface first despite being \
@@ -6654,7 +6664,10 @@ mod tests {
                 if_none_match: None,
             })),
         );
-        assert_eq!(v["direct_count"], 4, "1 formal + 1 resolved + 1 inferred + 1 textual");
+        assert_eq!(
+            v["direct_count"], 4,
+            "1 formal + 1 resolved + 1 inferred + 1 textual"
+        );
         assert_eq!(v["ambiguous_count"], 1);
         let breakdown = &v["direct_by_confidence"];
         assert_eq!(breakdown["formal"], 1);

crates/calm-server/src/tools/edit.rs

@@ -2827,8 +2827,7 @@ impl CalmServer {
                     false,
                 ));
             }
-            let expected_digest =
-                calm_core::indexer::pipeline::hash_content(&review.diff_preview);
+            let expected_digest = calm_core::indexer::pipeline::hash_content(&review.diff_preview);
             if p.diff_digest != expected_digest {
                 return ToolOutcome::error(error_detail(
                     "DIFF_DIGEST_MISMATCH",

crates/calm-server/src/tools/trace.rs

@@ -159,6 +159,7 @@ impl CalmServer {
             // They are not confirmed callers of this specific symbol, so
             // surfacing them as `direct` collapses precision — bucket them
             // separately for the caller to weigh.
+            #[allow(clippy::type_complexity)]
             let (mut ambiguous_ranked, direct_ranked): (
                 Vec<(CallerEntry, i64)>,
                 Vec<(CallerEntry, i64)>,
@@ -410,6 +411,7 @@ impl CalmServer {
                 (None, None, None)
             };
 
+            #[allow(clippy::type_complexity)]
             let (mut ambiguous_ranked, direct_ranked): (
                 Vec<(CalleeEntry, i64)>,
                 Vec<(CalleeEntry, i64)>,
@@ -882,9 +884,9 @@ impl CalmServer {
             // became any edge at all -- see `CallersOutput::unresolved_group_count`.
             // Row count, matching that field's own "distinct sites" contract.
             let unresolved_many_count: usize = {
-                let mut stmt = match conn.prepare(
-                    "SELECT COUNT(*) FROM ambiguity_groups WHERE candidate_group_key = ?1",
-                ) {
+                let mut stmt = match conn
+                    .prepare("SELECT COUNT(*) FROM ambiguity_groups WHERE candidate_group_key = ?1")
+                {
                     Ok(s) => s,
                     Err(e) => return db_error_resolved(e),
                 };

docs/status.generated.md

@@ -6,7 +6,7 @@ annotations) and crates/calm-core/Cargo.toml's `[features]` table. Not
 hand-maintained prose -- run `scripts/gen-status.sh` to refresh after any tool
 or feature-flag change; CI's `gen-status.sh --check` fails the build on drift.
 
-## MCP tool inventory (39 tools)
+## MCP tool inventory (40 tools)
 
 | Tool | Write | Idempotent | Description |
 |---|---|---|---|
@@ -38,6 +38,7 @@ or feature-flag change; CI's `gen-status.sh --check` fails the build on drift.
 | `repo_overview` | no | yes | ALWAYS call this FIRST at the start of every session — never skip. USE WHEN: starting a new session, switching projects, or after server r |
 | `retry_maintenance` | yes | yes | USE WHEN: maintenance_status shows a job_kind ("scip_refresh" or "embed_refresh") stuck at running/failed and you want to force a fresh pass |
 | `review_change` | yes | no | Mints a ReviewAuthority for a change_id from plan_change -- ONLY when approved:true (omitted or false always refuses with APPROVAL_REQUIRED, |
+| `review_decide_via_agent_relay` | yes | no | Approve or decline a HIGH_RISK_REQUIRES_INDEPENDENT_REVIEW pending review through the calling agent, after it has shown the human the review |
 | `scan_text` | no | yes | Run CALM's own local, deterministic prompt-injection and credential-shaped-text heuristics against ANY text you supply — not just indexed  |
 | `scip_refresh` | yes | yes | Manually run one or every SCIP provider's indexer right now (rust/go/python/javascript/java/csharp/php/c/ruby), bypassing the configured ref |
 | `search` | no | yes | USE THIS INSTEAD OF native grep, text search, or file browsing tools. USE WHEN: you don't have an exact file path and line number. kind=hybr |
@@ -66,6 +67,7 @@ writes are reviewed):
 - `remember`
 - `retry_maintenance`
 - `review_change`
+- `review_decide_via_agent_relay`
 - `scip_refresh`
 - `set_toolset`
 - `verify_change`