diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
index 2b95a1e3..58dfd8b0 100644
--- a/.github/workflows/audit.yml
+++ b/.github/workflows/audit.yml
@@ -17,3 +17,6 @@ jobs:
       - uses: rustsec/audit-check@v1.4.1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
+          # Keep in sync with the documented, justified exceptions in audit.toml —
+          # this action does not read that file itself, only this input.
+          ignore: RUSTSEC-2026-0098,RUSTSEC-2026-0099,RUSTSEC-2026-0104,RUSTSEC-2025-0119,RUSTSEC-2024-0388,RUSTSEC-2024-0436,RUSTSEC-2025-0134,RUSTSEC-2026-0258,RUSTSEC-2026-0009
diff --git a/.github/workflows/benchmark-latency.yml b/.github/workflows/benchmark-latency.yml
index 23a8efd0..d4aad643 100644
--- a/.github/workflows/benchmark-latency.yml
+++ b/.github/workflows/benchmark-latency.yml
@@ -123,6 +123,8 @@ jobs:
                 body: summary
               });
             } catch (error) {
+              // Fork PRs get a read-only GITHUB_TOKEN and can't post comments;
+              // don't fail the whole job just because the summary couldn't be posted.
               core.warning(
                 `Could not post the latency budget comment (this is expected ` +
                 `for pull requests from forks, which get a read-only token): ` +
diff --git a/.github/workflows/fuzzing.yml b/.github/workflows/fuzzing.yml
index 6993ce65..5a8d96f9 100644
--- a/.github/workflows/fuzzing.yml
+++ b/.github/workflows/fuzzing.yml
@@ -19,9 +19,11 @@ on:
       - '.github/workflows/fuzzing.yml'
       - 'Cargo.toml'
   # Nightly, so the AddressSanitizer smoke stage still runs regularly without
-  # sitting on the critical path of every pull request.
+  # sitting on the critical path of every pull request. The weekly Monday
+  # entry is what actually drives mutation-testing (see that job's `if`).
   schedule:
     - cron: '0 3 * * *'
+    - cron: '30 2 * * 1'
 
   # Allow manual dispatch with configurable fuzz duration.
   workflow_dispatch:
@@ -34,8 +36,6 @@ on:
         description: 'Number of proptest cases per property'
         required: false
         default: '1000'
-  schedule:
-    - cron: '30 2 * * 1'
 
 # Cancel in-progress runs when a new commit is pushed to the same branch.
 concurrency:
diff --git a/CODE_STYLE_STANDARDS.md b/CODE_STYLE_STANDARDS.md
index 707f722a..9c1b88d6 100644
--- a/CODE_STYLE_STANDARDS.md
+++ b/CODE_STYLE_STANDARDS.md
@@ -481,27 +481,49 @@ cargo clippy -- -W clippy::needless_clone
 
 ### Project-Specific Allowances
 
-The StarForge project allows these clippy rules in specific circumstances. See `src/main.rs` for the global allowlist:
+**There is no crate-wide lint allowlist.** `src/lib.rs` and `src/main.rs` used to
+carry a blanket `#![allow(dead_code, unused, clippy::all)]`, and `Cargo.toml`
+carried a matching `[lints]` table — together these silenced essentially every
+default Clippy lint group (correctness, suspicious, style, complexity, perf)
+across the *entire* ~40k-line crate, not just the handful of patterns the
+comments claimed to cover. That's exactly backwards: it hid real bugs (see
+below) behind the same blanket that was meant to excuse a few CLI functions
+with many arguments.
+
+Every remaining `#[allow(...)]` in the codebase is now **scoped to the single
+item that needs it** — a function, struct, or field — with a comment
+immediately above explaining *why*:
 
 ```rust
-#![allow(
-    dead_code,                           // Some plugin infrastructure code is unused until plugins load it
-    clippy::needless_range_loop,         // Sometimes more readable than alternatives
-    clippy::redundant_closure,           // Used intentionally for clarity in some cases
-    clippy::too_many_arguments,          // Complex CLI commands require many arguments
-    clippy::type_complexity,             // Some type definitions are inherently complex
-    clippy::unnecessary_lazy_evaluations // Some expressions are evaluated for side effects
-)]
+// Each parameter is an independent, named input (CLI flags / distinct config
+// values); bundling them into a struct here would add indirection without
+// reducing real complexity.
+#[allow(clippy::too_many_arguments)]
+async fn monitor_contract(
+    contract_id: &str,
+    events_filter: Option<&str>,
+    // ...
+) -> Result<()> {
 ```
 
-**When to add to this allowlist:**
-- Only for **unavoidable** patterns
-- Document *why* with a comment
-- Discuss with maintainers before merging
-
-```rust
-#![allow(clippy::too_many_arguments)]  // Contract CLI requires many parameters for optimization context
-```
+**When to add a scoped allow:**
+- Only on the specific item that triggers it — never on a module, and never
+  crate-wide.
+- Only for patterns that are genuinely **unavoidable or clearly intentional**
+  for that one item, not as a shortcut past a warning you haven't looked at.
+- Always with a comment explaining *why*, not just restating the lint name.
+- `dead_code` is the one lint where "unavoidable" usually means "not wired up
+  yet, but deleting it isn't this change's call to make" — that's a valid
+  reason, but say so explicitly rather than leaving the allow unexplained.
+
+**What restoring this signal found:** with the blanket removed,
+`cargo clippy --all-features` went from silently clean to over 2000
+warnings — 94% of them were the single mechanical `uninlined_format_args`
+style lint (fixed via `cargo clippy --fix`), but the rest included real
+defects the blanket had been hiding, e.g. a constructed template changelog
+entry that was built and then silently discarded (`changelog: None` instead
+of `Some(changelog)`) and unreachable branches. Local, documented exceptions
+don't have that failure mode: each one is small enough to actually read.
 
 **When NOT to add:**
 - "I don't want to refactor" — do the refactor
diff --git a/Cargo.toml b/Cargo.toml
index 55fdfb44..2beedb53 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -17,29 +17,6 @@ name = "starforge"
 path = "src/lib.rs"
 crate-type = ["cdylib", "rlib"]
 
-# Package-wide lint policy. These lints are intentionally relaxed for the crate
-# (including integration tests, which use lightweight mock structs and helpers).
-# Centralizing them here keeps `cargo clippy --all-targets -- -D warnings` green.
-[lints.rust]
-dead_code = "allow"
-unused_imports = "allow"
-unused_variables = "allow"
-
-[lints.clippy]
-needless_range_loop = "allow"
-redundant_closure = "allow"
-too_many_arguments = "allow"
-type_complexity = "allow"
-unnecessary_lazy_evaluations = "allow"
-items_after_test_module = "allow"
-needless_borrow = "allow"
-needless_borrows_for_generic_args = "allow"
-empty_line_after_doc_comments = "allow"
-doc_overindented_list_items = "allow"
-expect_fun_call = "allow"
-useless_vec = "allow"
-single_match = "allow"
-
 [dependencies]
 clap     = { version = "=4.4.18", features = ["derive", "color"] }
 serde    = { version = "1.0",     features = ["derive"] }
diff --git a/fuzz/Cargo.lock b/fuzz/Cargo.lock
index c16e2795..0891eccc 100644
--- a/fuzz/Cargo.lock
+++ b/fuzz/Cargo.lock
@@ -57,18 +57,18 @@ dependencies = [
 
 [[package]]
 name = "aho-corasick"
-version = "1.1.4"
+version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
+checksum = "c982642fa9e8606056828ee9a8505737230110bb1099153c79efe865c59d12ba"
 dependencies = [
  "memchr",
 ]
 
 [[package]]
 name = "android_system_properties"
-version = "0.1.5"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+checksum = "ae221649c9976a6f6c56ae1facf410f3ddb33cc661c4b7b61020a912d4237fbc"
 dependencies = [
  "libc",
 ]
@@ -158,13 +158,13 @@ checksum = "d3fb67a6e08acf24fdeccbac2cb6ac4305825bd1f117462e0e6f2f193345ad56"
 
 [[package]]
 name = "async-trait"
-version = "0.1.91"
+version = "0.1.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae36dc4177970ef04fde5178d3e2429882def40e57a451f919c098f72baa6cec"
+checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.4",
 ]
 
 [[package]]
@@ -316,9 +316,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.4.0"
+version = "1.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5add81bb678e6cb321aff7fa0dc7689ad82b112dbc032cea19f91d6b8e3582b9"
+checksum = "0ad534f4357a5264cce5019c989cf66a4f0dc4e0d1b1d15f8aacec0ff7360273"
 dependencies = [
  "find-msvc-tools",
  "jobserver",
@@ -526,9 +526,9 @@ dependencies = [
 
 [[package]]
 name = "crc32fast"
-version = "1.5.0"
+version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511"
+checksum = "8498c871161e1742aaa9d52551b2d6ebdd4c3d45a3be423e3728f33b955be550"
 dependencies = [
  "cfg-if",
 ]
@@ -721,9 +721,40 @@ dependencies = [
 
 [[package]]
 name = "data-encoding"
-version = "2.11.0"
+version = "2.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4ae5f15dda3c708c0ade84bfee31ccab44a3da4f88015ed22f63732abe300c8"
+checksum = "4583a4551df46e2792f82ceeac45e850d2e2d5debba0b91f102385cda5b11f06"
+
+[[package]]
+name = "defmt"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2953bfe4f93bbd20cc71198842756f77d161884c99ebbabc41d80231ded88d1"
+dependencies = [
+ "bitflags 1.3.2",
+ "defmt-macros",
+]
+
+[[package]]
+name = "defmt-macros"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bad9c72e7ca2137e0dc3813245a0d282fd6daad32fd800af018306a9169b5fe8"
+dependencies = [
+ "defmt-parser",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "defmt-parser"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10d60334b3b2e7c9d91ef8150abfb6fa4c1c39ebbcf4a81c2e346aad939fee3e"
+dependencies = [
+ "thiserror 2.0.20",
+]
 
 [[package]]
 name = "der"
@@ -852,7 +883,7 @@ checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.4",
 ]
 
 [[package]]
@@ -896,9 +927,9 @@ dependencies = [
 
 [[package]]
 name = "either"
-version = "1.17.0"
+version = "1.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e5e8f6c15a24b9a3ee5efec809ccd006d3b30e8b3bb63c39af737c7f87daa1d"
+checksum = "252afb9ae5eaa683babdc6a068b3f5726eb19e05070c731f9b2a23a7c3e8ed34"
 
 [[package]]
 name = "encode_unicode"
@@ -939,9 +970,9 @@ dependencies = [
 
 [[package]]
 name = "error-code"
-version = "3.3.2"
+version = "3.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dea2df4cf52843e0452895c455a1a2cfbb842a1e7329671acf418fdc53ed4c59"
+checksum = "0b5343afd4a8365a643ac588dab4cf234a190c7f6c88c9f6dd6ffe00837661b7"
 
 [[package]]
 name = "escape-bytes"
@@ -997,9 +1028,9 @@ checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
 
 [[package]]
 name = "find-msvc-tools"
-version = "0.1.9"
+version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
+checksum = "d45db016d36b838f563236e9193d0ee6ce38f3f68b6c94e914b4929c96bbb890"
 
 [[package]]
 name = "flate2"
@@ -1028,9 +1059,9 @@ dependencies = [
 
 [[package]]
 name = "futures"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a88cf1f829d945f548cf8fec32c61b1f202b6d93b45848602fc02af4b12ad218"
+checksum = "9a31d2a3fbaaeb2af2368bbdd904aa8e812d3c04a1ee10d3171f52d556e5d0a3"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -1043,9 +1074,9 @@ dependencies = [
 
 [[package]]
 name = "futures-channel"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "262590f4fe6afeb0bc83be1daa64e52657fe185690a958af7f3ad0e92085c5ae"
+checksum = "b1f9e3d69d39e4862ffed03ed071a76f9a13ba1d9109d355b0f0aa6b15e393c4"
 dependencies = [
  "futures-core",
  "futures-sink",
@@ -1053,15 +1084,15 @@ dependencies = [
 
 [[package]]
 name = "futures-core"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2cd50c473c80f6d7c3670a752354b8e569b1a7cbfdc0419ec88e5edad85e0dc7"
+checksum = "92d699e522242e69e3003b94ecc1f960f3a5e015aa7c5d7486e65ad01dd94f5e"
 
 [[package]]
 name = "futures-executor"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6754879cc9f2c66f88c6e5c35344bb0bdb0708b0352b1201815667c7eabc7458"
+checksum = "031b47cf1a3c6cc8bc2fc76cd437f521619387907d469316e7c0bc278f1f5432"
 dependencies = [
  "futures-core",
  "futures-task",
@@ -1070,38 +1101,38 @@ dependencies = [
 
 [[package]]
 name = "futures-io"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4577ecaa3c4f96589d473f679a71b596316f6641bc350038b962a5daf0085d7a"
+checksum = "53c0fa8157de1303bfffdaa1cc2a673bfffb60102f76b0ef4441659124373fed"
 
 [[package]]
 name = "futures-macro"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d6d3cde68c518367be28956066ddfef33813991b77a55005a69dae04bf3b10b"
+checksum = "9fb9654ba8355388abeb8dcb4fc62f511300867002afc858860463bdd9fe0c44"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.4",
 ]
 
 [[package]]
 name = "futures-sink"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e34418ac499d6305c2fb5ad0ed2f6ac998c5f8ca209b4510f7f94242c647e307"
+checksum = "1944426bf7d03f1d14f708785e4b33efd750b36d48a157b836b3efc15ede8e1d"
 
 [[package]]
 name = "futures-task"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b231ed28831efb4a61a08580c4bc233ec56bc009f4cd8f52da2c3cb97df0c109"
+checksum = "cd417de3d1d015fc3bfd2b1ea46dfc7bab72ef86f1cc7cc9c78e728b34a6d1fd"
 
 [[package]]
 name = "futures-util"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a77a90a256fce34da66415271e30f94ee91c57b04b8a2c042d9cf3220179deaa"
+checksum = "0d50a92467f8ba5dd6e3ee5d4bd04d73ab2e4e1c44474a0674821dfce14b79bc"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -1364,9 +1395,9 @@ dependencies = [
 
 [[package]]
 name = "icu_collections"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c"
+checksum = "fa68d21081c4a05d5a901a1c62add574c77048b6a1c67be3b50ce0b60d4ca513"
 dependencies = [
  "displaydoc",
  "potential_utf",
@@ -1378,9 +1409,9 @@ dependencies = [
 
 [[package]]
 name = "icu_locale_core"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
+checksum = "d56e28588da92eee5c3201a6eff33fabdd49b62269c8938d4ff050ce4d900deb"
 dependencies = [
  "displaydoc",
  "litemap",
@@ -1391,9 +1422,9 @@ dependencies = [
 
 [[package]]
 name = "icu_normalizer"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4"
+checksum = "12f9cf5f235641ed274641dd81c3f28d870e276763d0797aeeab72317b1c646f"
 dependencies = [
  "icu_collections",
  "icu_normalizer_data",
@@ -1405,16 +1436,17 @@ dependencies = [
 
 [[package]]
 name = "icu_normalizer_data"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"
+checksum = "1563da1ed3e0b3bf3d74c9b85917ac9c56464d2f57242270c09c9e752f8021a0"
 
 [[package]]
 name = "icu_properties"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de"
+checksum = "7e7ca276ad3145661a65914e6daf131ca5120cd3dcee8f8f3214b8875184a148"
 dependencies = [
+ "displaydoc",
  "icu_collections",
  "icu_locale_core",
  "icu_properties_data",
@@ -1425,15 +1457,15 @@ dependencies = [
 
 [[package]]
 name = "icu_properties_data"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14"
+checksum = "e590f038c1464a96894fd6d10127e90a8be4509f56ff7ecef851b15cee0b7caa"
 
 [[package]]
 name = "icu_provider"
-version = "2.2.0"
+version = "2.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
+checksum = "d27bbb9d3abbefac45d55f647c9de1d44aafcd1186eb91879afef17c396c3e73"
 dependencies = [
  "displaydoc",
  "icu_locale_core",
@@ -1518,9 +1550,9 @@ dependencies = [
 
 [[package]]
 name = "ipnet"
-version = "2.12.0"
+version = "2.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
+checksum = "6a756c3fac73139e83f14c2d742155dd2b78d3ee56597b419a0579b7bdd6dd78"
 
 [[package]]
 name = "is_terminal_polyfill"
@@ -1543,6 +1575,59 @@ version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
+[[package]]
+name = "jiff"
+version = "0.2.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "668b7183bd07af9a4885f5c35b0cc5c83c4607a913c16b7e17291832910d2dcc"
+dependencies = [
+ "defmt",
+ "jiff-core",
+ "jiff-static",
+ "jiff-tzdb-platform",
+ "log",
+ "portable-atomic",
+ "portable-atomic-util",
+ "serde_core",
+ "windows-link",
+]
+
+[[package]]
+name = "jiff-core"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7feca88439efe53da3754500c1851dedf3cb36c524dd5cf8225cc0794de95d09"
+dependencies = [
+ "defmt",
+]
+
+[[package]]
+name = "jiff-static"
+version = "0.2.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a69dcb3a21cfb32ce1cd056169337ca284af0766dd766e7878819b251a49204"
+dependencies = [
+ "jiff-core",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "jiff-tzdb"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "142bd39932ad231f10513df9ab62661fead8719872150b7ad02a2df79f4e141e"
+
+[[package]]
+name = "jiff-tzdb-platform"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "875a5a69ac2bab1a891711cf5eccbec1ce0341ea805560dcd90b7a2e925132e8"
+dependencies = [
+ "jiff-tzdb",
+]
+
 [[package]]
 name = "jobserver"
 version = "0.1.35"
@@ -1555,9 +1640,9 @@ dependencies = [
 
 [[package]]
 name = "js-sys"
-version = "0.3.103"
+version = "0.3.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53b44bfcdb3f8d5837a46dae1ca9660a837176eee74a28b229bc626816589102"
+checksum = "0e0c1080212aad755ea003d18543e8768dd432c48819efd73a7bf1e39b7a5a3a"
 dependencies = [
  "cfg-if",
  "futures-util",
@@ -1598,9 +1683,9 @@ dependencies = [
 
 [[package]]
 name = "libredox"
-version = "0.1.18"
+version = "0.1.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c943259e342f1e06ff2da7a83eabdfe7f92ce10262688dbf1895ff0b3e6e4652"
+checksum = "28d0a00925a9f930d679b6789b721e3a7f9ed110f41b86d2497caa780c3a070a"
 dependencies = [
  "libc",
 ]
@@ -1624,9 +1709,9 @@ checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
 
 [[package]]
 name = "litemap"
-version = "0.8.2"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
+checksum = "47d9d19d1d6efa0109d2f65ff4c85cddd50bd572e5a00127ab10987290bcefae"
 
 [[package]]
 name = "litrs"
@@ -1645,9 +1730,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.33"
+version = "0.4.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
+checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
 
 [[package]]
 name = "matchers"
@@ -1883,9 +1968,9 @@ dependencies = [
 
 [[package]]
 name = "pkg-config"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
+checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548"
 
 [[package]]
 name = "polyval"
@@ -1901,15 +1986,24 @@ dependencies = [
 
 [[package]]
 name = "portable-atomic"
-version = "1.14.0"
+version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d20d5497ef88037a52ff98267d066e7f11fcc5e99bbfbd58a42336193aacec3"
+checksum = "05c8b63e8d9609db387f0324918f81d68fe27748f084ef092fb35954d0539a85"
+
+[[package]]
+name = "portable-atomic-util"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a106d1259c23fac8e543272398ae0e3c0b8d33c88ed73d0cc71b0f1d902618"
+dependencies = [
+ "portable-atomic",
+]
 
 [[package]]
 name = "potential_utf"
-version = "0.1.5"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564"
+checksum = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661"
 dependencies = [
  "zerovec",
 ]
@@ -1965,9 +2059,9 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.8.7"
+version = "0.8.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22f6172bdec972074665ed81ed53b71da00bfc44b65a753cfde883ec4c702a1a"
+checksum = "e058c7de0b26af77780c769414d6257830bb240f3c38477dbc2c16e5f54d6d4c"
 dependencies = [
  "libc",
  "rand_chacha",
@@ -2015,22 +2109,22 @@ dependencies = [
 
 [[package]]
 name = "ref-cast"
-version = "1.0.26"
+version = "1.0.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "216e8f773d7923bcba9ceb86a86c93cabb3903a11872fc3f138c49630e50b96d"
+checksum = "7e440fb4e4b4147295338efb76001ab9e4efc0e5839df2c47fc5ac2381d365c3"
 dependencies = [
  "ref-cast-impl",
 ]
 
 [[package]]
 name = "ref-cast-impl"
-version = "1.0.26"
+version = "1.0.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c9283685feec7d69af75fb0e858d5e7378f33fe4fc699383b2916ab9273e03c"
+checksum = "92ecd8964f8453721699a1ed72037b0db49ce2f5a5138486ee89bed6f67cdf3a"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.4",
 ]
 
 [[package]]
@@ -2047,9 +2141,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.16"
+version = "0.4.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fcfdb36bda0c880c5931cdc7a2bcdc8ba4556847b9d912bca70bc94708711ad"
+checksum = "ad8553b9b26413251cbf30e620595c7a41b3887f03da04579c0e6b0d6a06b4b2"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -2179,7 +2273,7 @@ checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06"
 dependencies = [
  "once_cell",
  "rustls-pki-types",
- "rustls-webpki 0.103.13",
+ "rustls-webpki 0.103.15",
  "subtle",
  "zeroize",
 ]
@@ -2214,9 +2308,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.13"
+version = "0.103.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
+checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
 dependencies = [
  "ring",
  "rustls-pki-types",
@@ -2330,7 +2424,7 @@ checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.4",
 ]
 
 [[package]]
@@ -2369,9 +2463,9 @@ dependencies = [
 
 [[package]]
 name = "serde_with"
-version = "3.21.0"
+version = "3.22.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76a5c54c7310e7b8b9577c286d7e399ddd876c3e12b3ed917a8aabc4b96e9e8c"
+checksum = "ee78f1fbe43ac4a0e47aadb3dbd357b69eb0d3793e948624cd03dd2750ab1c0a"
 dependencies = [
  "base64 0.22.1",
  "bs58",
@@ -2379,6 +2473,7 @@ dependencies = [
  "hex",
  "indexmap 1.9.3",
  "indexmap 2.14.0",
+ "jiff",
  "schemars 0.9.0",
  "schemars 1.2.2",
  "serde_core",
@@ -2389,9 +2484,9 @@ dependencies = [
 
 [[package]]
 name = "serde_with_macros"
-version = "3.21.0"
+version = "3.22.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "84d57bc0c8b9a17920c178daa6bb924850d54a9c97ab45194bb8c17ad66bb660"
+checksum = "8705578779c2b6bd90d84d66eb2e206b708b1a4d7b9f17641b293545bf1c7e46"
 dependencies = [
  "darling 0.23.0",
  "proc-macro2",
@@ -2660,9 +2755,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "3.0.3"
+version = "3.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
+checksum = "e6275cddf4610d1775e6d1fe9469b2e77d0f39fd98fb7450901b821e0c53649f"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2731,11 +2826,11 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "2.0.19"
+version = "2.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09a43598840e33d5b0331f38c5e30d13bb11c11210a4b58f0d9b18a5a5eefcd9"
+checksum = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f"
 dependencies = [
- "thiserror-impl 2.0.19",
+ "thiserror-impl 2.0.20",
 ]
 
 [[package]]
@@ -2751,13 +2846,13 @@ dependencies = [
 
 [[package]]
 name = "thiserror-impl"
-version = "2.0.19"
+version = "2.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43cbfe0cf76104d42a574802844187e84a305e531ed54455f11fbde0f10541cd"
+checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.4",
 ]
 
 [[package]]
@@ -2771,9 +2866,9 @@ dependencies = [
 
 [[package]]
 name = "time"
-version = "0.3.54"
+version = "0.3.55"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e1d5e639ff6bab73cb6885cc7e7b1de96c3f32c68ec55f3952614bec1092244"
+checksum = "cdb87b95ec50ddfa440816d227a17b2ccbdda963a316a727fda0fc4334f7d134"
 dependencies = [
  "deranged",
  "num-conv",
@@ -2801,9 +2896,9 @@ dependencies = [
 
 [[package]]
 name = "tinystr"
-version = "0.8.3"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d"
+checksum = "b1e27c91459209c2986af3dcf603a5a74a4368754ce37414f59acc971167f643"
 dependencies = [
  "displaydoc",
  "zerovec",
@@ -2849,7 +2944,7 @@ checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.4",
 ]
 
 [[package]]
@@ -2961,7 +3056,7 @@ checksum = "050686193eb999b4bb3bc2acfa891a13da00f79734704c4b8b4ef1a10b368a3c"
 dependencies = [
  "crossbeam-channel",
  "symlink",
- "thiserror 2.0.19",
+ "thiserror 2.0.20",
  "time",
  "tracing-subscriber",
 ]
@@ -3154,9 +3249,9 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "uuid"
-version = "1.24.0"
+version = "1.26.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf3923a6f5c4c6382e0b653c4117f48d631ea17f38ed86e2a828e6f7412f5239"
+checksum = "b5772d71c9be8a8a6ac2117d949c5b224c1b72241bb611d9a3012edcf8af7812"
 dependencies = [
  "getrandom 0.4.3",
  "js-sys",
@@ -3199,9 +3294,9 @@ checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.126"
+version = "0.2.127"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b067c0c11094aef6b7a801c1e34a26affafdf3d051dba08456b868789aaf9a4"
+checksum = "1b70935747edd64d89de3efa29d73789b806c15798f8e7dca4d8ac356b50ce70"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -3212,9 +3307,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.76"
+version = "0.4.77"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c62df1340f32221cb9c54d6a27b030e3dba64361d4a95bed55f9aacb44da291d"
+checksum = "6b7777d5cc23d0e91404e53ce2d5e8ec7acae3026b16233dba62cd3246457950"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -3222,9 +3317,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.126"
+version = "0.2.127"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "167ce5e579f6bcf889c4f7175a8a5a585de84e8ff93976ce393efa5f2837aab1"
+checksum = "77775f8f3f7217702089053b94958f8f54061a3f663417df76e19cbdcca29bc1"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -3232,9 +3327,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.126"
+version = "0.2.127"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3997c7839262f4ef12cf90b818d6340c18e80f263f1a94bf157d0ec4420380e"
+checksum = "e11d33f857dc2fb11b8bc75aee111aa9cbeb12cd9f25efd3d4c2a3dd4e235284"
 dependencies = [
  "bumpalo",
  "proc-macro2",
@@ -3245,18 +3340,18 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.126"
+version = "0.2.127"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc1b4cb0cc549fcf58d7dfc081778139b3d283a081644e833e84682ad71cea24"
+checksum = "7ef64dbcc55df09c7e5a46182d181c2cfa3e925f3da937ea764728b4bbb9dcbf"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "web-sys"
-version = "0.3.103"
+version = "0.3.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8622dcb61c0bcc9fffa6938bed81210af2da9a7e4a1a834b2e37a59b6dfb6141"
+checksum = "c435338968042f4f59a557f690a253676d47ce13ceb55d70100e7facf6620a30"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -3555,9 +3650,9 @@ dependencies = [
 
 [[package]]
 name = "writeable"
-version = "0.6.3"
+version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
+checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"
 
 [[package]]
 name = "yoke"
@@ -3584,18 +3679,18 @@ dependencies = [
 
 [[package]]
 name = "zerocopy"
-version = "0.8.55"
+version = "0.8.56"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5a105cd7b140f6eeec8acff2ea38135d3cab283ada58540f629fe51e46696eb"
+checksum = "556764e583adb45a9f8d413c2a147fa7e8d821e48e12b14fd560b607998b75eb"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.55"
+version = "0.8.56"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fe976fb70c78cd64cccfe3a6fc142244e8a77b70959b30faf9d0ac37ee228eb"
+checksum = "f2ab42fc20575779bd240faa45f94a74256f755c0fa9e89f0ede20d91d0cdfc1"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3631,9 +3726,9 @@ checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
 
 [[package]]
 name = "zerotrie"
-version = "0.2.4"
+version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
+checksum = "4ea269c3bd32f0a32c321907a2ae912ba6f4649bb0fc764a15627e99a7095a3f"
 dependencies = [
  "displaydoc",
  "yoke",
@@ -3642,9 +3737,9 @@ dependencies = [
 
 [[package]]
 name = "zerovec"
-version = "0.11.6"
+version = "0.11.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
+checksum = "bb0464e17806c1d976d5cba29399c7f08e516e279e2ba493f63123b5fca67dd8"
 dependencies = [
  "yoke",
  "zerofrom",
@@ -3653,13 +3748,13 @@ dependencies = [
 
 [[package]]
 name = "zerovec-derive"
-version = "0.11.3"
+version = "0.11.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
+checksum = "34df6fc39dbd26ddc9c10e6a2984476e13acce22e64e4487636ef494369225da"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.4",
 ]
 
 [[package]]
diff --git a/src/commands/ai.rs b/src/commands/ai.rs
index 12860640..81f4a771 100644
--- a/src/commands/ai.rs
+++ b/src/commands/ai.rs
@@ -611,6 +611,9 @@ async fn handle_ask(question: &str, model: &str, temperature: f32, max_tokens: u
     Ok(())
 }
 
+// Not currently called from any code path in this crate. Kept rather than
+// removed since deleting it is a product decision, not a lint-scoping one.
+#[allow(dead_code)]
 async fn handle_translate(text: &str, target: &str, model: &str) -> Result<()> {
     if text.trim().is_empty() {
         anyhow::bail!("Please provide text to translate.");
diff --git a/src/commands/ai_accessibility.rs b/src/commands/ai_accessibility.rs
index c5aa250a..437a2875 100644
--- a/src/commands/ai_accessibility.rs
+++ b/src/commands/ai_accessibility.rs
@@ -243,9 +243,9 @@ fn handle_configure(args: ConfigureArgs) -> Result<()> {
     })?;
 
     p::success("Accessibility settings updated.");
-    if !args.screen_reader.is_none()
-        || !args.simplified_text.is_none()
-        || !args.high_contrast.is_none()
+    if args.screen_reader.is_some()
+        || args.simplified_text.is_some()
+        || args.high_contrast.is_some()
     {
         p::kv("Screen reader", &cfg.screen_reader_mode.to_string());
         p::kv("Simplified text", &cfg.simplified_text_mode.to_string());
diff --git a/src/commands/ai_audit.rs b/src/commands/ai_audit.rs
index 226d3cb8..9920508b 100644
--- a/src/commands/ai_audit.rs
+++ b/src/commands/ai_audit.rs
@@ -4,9 +4,9 @@
 //! with comprehensive coverage and minimal false positives.
 
 use crate::utils::print as p;
-use crate::utils::security::{AiAuditService, AuditLevel, AuditRequest};
+use crate::utils::security::{AuditLevel, AuditRequest};
 use anyhow::Result;
-use clap::{Args, Subcommand};
+use clap::Args;
 use colored::*;
 use std::fs;
 use std::path::{Path, PathBuf};
diff --git a/src/commands/ai_cache_cmd.rs b/src/commands/ai_cache_cmd.rs
index af95d45e..fd05c3b2 100644
--- a/src/commands/ai_cache_cmd.rs
+++ b/src/commands/ai_cache_cmd.rs
@@ -11,9 +11,9 @@
 //! - `warm`       – pre-warm cache with common operations
 
 use crate::utils::{ai_cache, print as p};
-use anyhow::{Context, Result};
-use clap::{Args, Subcommand};
-use std::path::PathBuf;
+use anyhow::Result;
+use clap::Subcommand;
+use std::path::{Path, PathBuf};
 
 // ─── Sub-command enum ─────────────────────────────────────────────────────────
 
@@ -288,7 +288,7 @@ async fn handle_invalidate(tags: Option<&str>, model: Option<&str>) -> Result<()
     Ok(())
 }
 
-async fn handle_export(path: &PathBuf) -> Result<()> {
+async fn handle_export(path: &Path) -> Result<()> {
     let cache = ai_cache::AiCache::open()?;
 
     p::header("Exporting AI Cache");
@@ -303,7 +303,7 @@ async fn handle_export(path: &PathBuf) -> Result<()> {
     Ok(())
 }
 
-async fn handle_import(path: &PathBuf) -> Result<()> {
+async fn handle_import(path: &Path) -> Result<()> {
     let mut cache = ai_cache::AiCache::open()?;
 
     p::header("Importing AI Cache");
diff --git a/src/commands/ai_chat.rs b/src/commands/ai_chat.rs
index 76610510..90321d41 100644
--- a/src/commands/ai_chat.rs
+++ b/src/commands/ai_chat.rs
@@ -13,9 +13,8 @@ use crate::utils::{
 };
 use anyhow::{Context, Result};
 use clap::Subcommand;
-use rustyline::{DefaultEditor, Editor};
+use rustyline::DefaultEditor;
 use std::collections::HashMap;
-use std::path::PathBuf;
 
 #[derive(Subcommand)]
 pub enum AiChatCommands {
@@ -332,7 +331,7 @@ async fn generate_ai_response(prompt: &str, model: &str) -> Result<String> {
 
     let response = ollama::generate_cached(
         model,
-        &prompt,
+        prompt,
         Some(opts),
         Some(ai_cache::DEFAULT_CACHE_TTL_SECONDS),
         "ask",
diff --git a/src/commands/ai_deployment_test.rs b/src/commands/ai_deployment_test.rs
index cead9411..5f30ea12 100644
--- a/src/commands/ai_deployment_test.rs
+++ b/src/commands/ai_deployment_test.rs
@@ -99,10 +99,7 @@ fn resolve_phases(value: &str) -> Result<Vec<Phase>> {
         return Ok(vec![Phase::Pre, Phase::Post]);
     }
 
-    let phases: Vec<Phase> = value
-        .split(',')
-        .filter_map(|part| Phase::parse(part))
-        .collect();
+    let phases: Vec<Phase> = value.split(',').filter_map(Phase::parse).collect();
 
     if phases.is_empty() {
         anyhow::bail!("Unknown phase '{}'. Use pre, post, or all", value);
diff --git a/src/commands/ai_error.rs b/src/commands/ai_error.rs
index 89e41291..502a75dd 100644
--- a/src/commands/ai_error.rs
+++ b/src/commands/ai_error.rs
@@ -3,10 +3,7 @@
 //! Provides commands for managing AI error handling, viewing analytics,
 //! and configuring fallback providers.
 
-use crate::utils::{
-    ai_error_handler::{AiErrorHandler, ErrorAnalytics, ProviderConfig},
-    print as p,
-};
+use crate::utils::{ai_error_handler::AiErrorHandler, print as p};
 use anyhow::Result;
 use clap::Subcommand;
 
diff --git a/src/commands/ai_feedback.rs b/src/commands/ai_feedback.rs
index 75398b37..01897cda 100644
--- a/src/commands/ai_feedback.rs
+++ b/src/commands/ai_feedback.rs
@@ -4,8 +4,6 @@ use crate::utils::print as p;
 use anyhow::{Context, Result};
 use clap::{Args, Subcommand};
 use colored::*;
-use std::fs;
-use std::path::PathBuf;
 
 #[derive(Subcommand)]
 pub enum AiFeedbackCommands {
diff --git a/src/commands/ai_property_test.rs b/src/commands/ai_property_test.rs
index 06d5c04c..d9e24c4d 100644
--- a/src/commands/ai_property_test.rs
+++ b/src/commands/ai_property_test.rs
@@ -321,7 +321,7 @@ fn handle_edge_cases(args: EdgeCasesArgs) -> Result<()> {
             .filter(|p| {
                 p.target_function
                     .as_ref()
-                    .map_or(false, |f| args.functions.contains(f))
+                    .is_some_and(|f| args.functions.contains(f))
             })
             .collect()
     };
@@ -394,11 +394,14 @@ async fn handle_shrink(args: ShrinkArgs) -> Result<()> {
             confidence: 0.5,
         };
         let prop = properties.first().unwrap_or(&default_prop);
-        let shrink =
-            apt::generate_test_cases(&[prop.clone()], &[], &apt::PropertyTestConfig::default())
-                .first()
-                .and_then(|tc| tc.shrink_strategy.clone())
-                .unwrap_or_else(|| "shrink numerics toward 0, strings toward empty".to_string());
+        let shrink = apt::generate_test_cases(
+            std::slice::from_ref(prop),
+            &[],
+            &apt::PropertyTestConfig::default(),
+        )
+        .first()
+        .and_then(|tc| tc.shrink_strategy.clone())
+        .unwrap_or_else(|| "shrink numerics toward 0, strings toward empty".to_string());
 
         match args.format.as_str() {
             "json" => {
diff --git a/src/commands/ai_recommend.rs b/src/commands/ai_recommend.rs
index b490e458..6195137e 100644
--- a/src/commands/ai_recommend.rs
+++ b/src/commands/ai_recommend.rs
@@ -564,7 +564,7 @@ fn find_rust_sources(dir: &PathBuf) -> Result<Vec<PathBuf>> {
                 {
                     files.extend(find_rust_sources(&path)?);
                 }
-            } else if path.extension().map_or(false, |e| e == "rs") {
+            } else if path.extension().is_some_and(|e| e == "rs") {
                 files.push(path);
             }
         }
diff --git a/src/commands/ai_search.rs b/src/commands/ai_search.rs
index f405b253..c62629a7 100644
--- a/src/commands/ai_search.rs
+++ b/src/commands/ai_search.rs
@@ -4,7 +4,6 @@ use crate::utils::print as p;
 use anyhow::{Context, Result};
 use clap::{Args, Subcommand};
 use colored::*;
-use std::fs;
 use std::path::PathBuf;
 
 #[derive(Subcommand)]
diff --git a/src/commands/ai_test.rs b/src/commands/ai_test.rs
index 4026a31f..d4f9b8be 100644
--- a/src/commands/ai_test.rs
+++ b/src/commands/ai_test.rs
@@ -320,7 +320,7 @@ async fn generate_with_ai(
 ) -> Result<ata::TestGenerationResponse> {
     if !ollama::is_ollama_running().await {
         p::warn("Ollama is not running. Falling back to local generation.");
-        p::info(&ollama::cloud_fallback_message());
+        p::info(ollama::cloud_fallback_message());
         let analysis = ata::analyze_contract_for_testing(&request.contract_code)?;
         return generate_locally(request, &analysis);
     }
@@ -452,10 +452,10 @@ fn test_{}_{}() {{
     )
 }
 
-fn generate_setup_code(func: &ata::FunctionInfo, contract_name: &str) -> String {
+fn generate_setup_code(func: &ata::FunctionInfo, _contract_name: &str) -> String {
     let mut lines = Vec::new();
 
-    lines.push(format!("let contract_address = Address::random(&env);"));
+    lines.push("let contract_address = Address::random(&env);".to_string());
 
     for param in &func.params {
         match param.param_type.as_str() {
@@ -556,7 +556,7 @@ fn calculate_estimated_improvement(
 fn handle_generate_output(
     response: &ata::TestGenerationResponse,
     args: &GenerateArgs,
-    contract_name: &str,
+    _contract_name: &str,
 ) -> Result<()> {
     match args.format.as_str() {
         "json" => {
@@ -963,7 +963,7 @@ fn handle_coverage(args: CoverageArgs) -> Result<()> {
         }
     };
 
-    let prompt = ata::build_coverage_improvement_prompt(&ata::CoverageAnalysisRequest {
+    let _prompt = ata::build_coverage_improvement_prompt(&ata::CoverageAnalysisRequest {
         source_code: source_code.clone(),
         test_code: test_code.clone(),
         coverage_data: coverage_data.clone(),
@@ -1036,7 +1036,7 @@ fn handle_coverage(args: CoverageArgs) -> Result<()> {
 }
 
 fn analyze_coverage_gaps(
-    source_code: &str,
+    _source_code: &str,
     _test_code: &str,
     coverage: &ata::CoverageInput,
 ) -> Vec<ata::CoverageSuggestion> {
@@ -1137,7 +1137,7 @@ fn handle_maintain(args: MaintainArgs) -> Result<()> {
                 t.contains(source_func)
                     || source_func
                         .strip_prefix("test_")
-                        .map_or(false, |stripped| t.contains(stripped))
+                        .is_some_and(|stripped| t.contains(stripped))
             });
 
             if !has_test {
@@ -1535,7 +1535,7 @@ async fn handle_test_data(args: TestDataArgs) -> Result<()> {
     Ok(())
 }
 
-fn generate_local_test_data(suggestions: &[ata::TestDataSuggestion], count: u32) -> String {
+fn generate_local_test_data(suggestions: &[ata::TestDataSuggestion], _count: u32) -> String {
     let mut code = String::from(
         "// Generated by StarForge AI Test Assistant\n// Test data generators and edge cases\n\n",
     );
diff --git a/src/commands/ai_test_gen.rs b/src/commands/ai_test_gen.rs
index 486e6e7c..80a3360f 100644
--- a/src/commands/ai_test_gen.rs
+++ b/src/commands/ai_test_gen.rs
@@ -104,6 +104,10 @@ pub async fn handle(cmd: AiTestGenCommands) -> Result<()> {
     }
 }
 
+// Each parameter is an independent, named input (CLI flags / distinct config
+// values); bundling them into a struct here would add indirection without
+// reducing real complexity.
+#[allow(clippy::too_many_arguments)]
 async fn handle_generate(
     file: PathBuf,
     output: PathBuf,
@@ -264,7 +268,7 @@ async fn handle_reset_analytics() -> Result<()> {
     p::header("Reset Test Generation Analytics");
     p::separator();
 
-    let generator = AiTestGenerator::new();
+    let _generator = AiTestGenerator::new();
     // Note: This would require adding a reset method to AiTestGenerator
     // For now, just inform the user
     p::info("Analytics reset functionality would be implemented here.");
diff --git a/src/commands/ai_tutorial_cmd.rs b/src/commands/ai_tutorial_cmd.rs
index d6e6abdc..a95b9f9c 100644
--- a/src/commands/ai_tutorial_cmd.rs
+++ b/src/commands/ai_tutorial_cmd.rs
@@ -4,10 +4,10 @@
 //! personalized learning paths, and progress tracking.
 
 use crate::utils::{
-    ai_tutorial::{SkillLevel, StepResult, TutorialManager, TutorialTopic},
+    ai_tutorial::{SkillLevel, TutorialManager},
     print as p,
 };
-use anyhow::{Context, Result};
+use anyhow::Result;
 use clap::Subcommand;
 use dialoguer::{Confirm, Input, Select};
 
diff --git a/src/commands/analytics.rs b/src/commands/analytics.rs
index 13a546a9..e0ea0340 100644
--- a/src/commands/analytics.rs
+++ b/src/commands/analytics.rs
@@ -3,7 +3,6 @@ use anyhow::Result;
 use chrono::Utc;
 use clap::{Args, Subcommand};
 use colored::Colorize;
-use colored::*;
 use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
 use std::fs;
@@ -646,7 +645,7 @@ fn calculate_health_score(success_rate: f64, recent_failures: usize, trend: &str
         _ => {}
     }
 
-    score.max(0.0).min(100.0)
+    score.clamp(0.0, 100.0)
 }
 
 /// Calculate health score for a contract
@@ -689,7 +688,7 @@ pub fn calculate_contract_health(
     let performance_score = if !fees.is_empty() {
         let avg_fee = fees.iter().sum::<u64>() as f64 / fees.len() as f64;
         // Lower fees = better performance score (baseline is 5000 stroops)
-        ((10000.0 - avg_fee) / 10000.0 * 100.0).max(0.0).min(100.0)
+        ((10000.0 - avg_fee) / 10000.0 * 100.0).clamp(0.0, 100.0)
     } else {
         50.0
     };
diff --git a/src/commands/approval.rs b/src/commands/approval.rs
index 92baf6a6..cdb5fafb 100644
--- a/src/commands/approval.rs
+++ b/src/commands/approval.rs
@@ -316,7 +316,7 @@ fn handle_show_workflow(args: ShowWorkflowArgs) -> Result<()> {
     p::kv("Active", if workflow.active { "yes" } else { "no" });
     p::kv(
         "Created",
-        &workflow
+        workflow
             .created_at
             .get(..19)
             .unwrap_or(&workflow.created_at),
@@ -522,14 +522,14 @@ fn handle_show_request(args: ShowRequestArgs) -> Result<()> {
     p::kv("Level progress", &request.level_progress());
     p::kv(
         "Created",
-        &request.created_at.get(..19).unwrap_or(&request.created_at),
+        request.created_at.get(..19).unwrap_or(&request.created_at),
     );
     p::kv(
         "Updated",
-        &request.updated_at.get(..19).unwrap_or(&request.updated_at),
+        request.updated_at.get(..19).unwrap_or(&request.updated_at),
     );
     if let Some(ref expiry) = request.expires_at {
-        p::kv("Expires", &expiry.get(..19).unwrap_or(expiry));
+        p::kv("Expires", expiry.get(..19).unwrap_or(expiry));
     }
 
     if let Some(ref wf) = workflow {
@@ -701,7 +701,7 @@ fn handle_dashboard() -> Result<()> {
 
     let summary = get_approval_summary()?;
     let requests = list_requests(None, None)?;
-    let workflows = list_workflows(true)?;
+    let _workflows = list_workflows(true)?;
 
     p::separator();
     p::kv("Total requests", &summary.total_requests.to_string());
diff --git a/src/commands/autocomplete.rs b/src/commands/autocomplete.rs
index b9924651..d30d5029 100644
--- a/src/commands/autocomplete.rs
+++ b/src/commands/autocomplete.rs
@@ -1,6 +1,4 @@
-use crate::utils::history::{
-    history_file_path, load_history, prune_history, save_history, HistoryEntry,
-};
+use crate::utils::history::{load_history, prune_history, save_history, HistoryEntry};
 use anyhow::Result;
 use chrono::{DateTime, Utc};
 use serde::{Deserialize, Serialize};
diff --git a/src/commands/bridge.rs b/src/commands/bridge.rs
index 3beb03eb..9c40dee9 100644
--- a/src/commands/bridge.rs
+++ b/src/commands/bridge.rs
@@ -7,7 +7,7 @@ use crate::utils::bridge::{
     save_config,
     security::SecurityVerifier,
     state::StateSynchronizer,
-    BridgeConfig, BridgeTransferRecord,
+    BridgeTransferRecord,
 };
 use crate::utils::print as p;
 use anyhow::Result;
diff --git a/src/commands/cicd.rs b/src/commands/cicd.rs
index af33bf61..cf4000a0 100644
--- a/src/commands/cicd.rs
+++ b/src/commands/cicd.rs
@@ -65,17 +65,25 @@ fn handle_list() -> Result<()> {
     p::separator();
 
     let platforms = [
-        ("github", "GitHub Actions", &[
-            "contract-test.yml  — automated contract testing pipeline",
-            "contract-monitor.yml — scheduled contract health monitoring",
-            "deployment.yml     — safe deploy / rollback with quality gate",
-        ] as &[&str]),
-        ("gitlab", "GitLab CI/CD", &[
-            ".gitlab-ci.yml    — full pipeline: quality, test, deploy, monitor, notify",
-        ]),
-        ("jenkins", "Jenkins", &[
-            "Jenkinsfile        — multi-stage pipeline with approval gates",
-        ]),
+        (
+            "github",
+            "GitHub Actions",
+            &[
+                "contract-test.yml  — automated contract testing pipeline",
+                "contract-monitor.yml — scheduled contract health monitoring",
+                "deployment.yml     — safe deploy / rollback with quality gate",
+            ] as &[&str],
+        ),
+        (
+            "gitlab",
+            "GitLab CI/CD",
+            &[".gitlab-ci.yml    — full pipeline: quality, test, deploy, monitor, notify"],
+        ),
+        (
+            "jenkins",
+            "Jenkins",
+            &["Jenkinsfile        — multi-stage pipeline with approval gates"],
+        ),
     ];
 
     for (key, name, templates) in &platforms {
@@ -106,7 +114,9 @@ fn handle_init(args: InitArgs) -> Result<()> {
     for platform in &platforms {
         match *platform {
             "github" => {
-                let out = args.output.clone()
+                let out = args
+                    .output
+                    .clone()
                     .unwrap_or_else(|| PathBuf::from(".github/workflows"));
                 fs::create_dir_all(&out)?;
                 generated += write_template(
@@ -121,22 +131,14 @@ fn handle_init(args: InitArgs) -> Result<()> {
                 )?;
             }
             "gitlab" => {
-                let out = args.output.clone()
-                    .unwrap_or_else(|| PathBuf::from("."));
-                generated += write_template(
-                    &out.join(".gitlab-ci.yml"),
-                    GITLAB_CI_TEMPLATE,
-                    args.force,
-                )?;
+                let out = args.output.clone().unwrap_or_else(|| PathBuf::from("."));
+                generated +=
+                    write_template(&out.join(".gitlab-ci.yml"), GITLAB_CI_TEMPLATE, args.force)?;
             }
             "jenkins" => {
-                let out = args.output.clone()
-                    .unwrap_or_else(|| PathBuf::from("."));
-                generated += write_template(
-                    &out.join("Jenkinsfile"),
-                    JENKINS_TEMPLATE,
-                    args.force,
-                )?;
+                let out = args.output.clone().unwrap_or_else(|| PathBuf::from("."));
+                generated +=
+                    write_template(&out.join("Jenkinsfile"), JENKINS_TEMPLATE, args.force)?;
             }
             _ => {}
         }
@@ -152,7 +154,7 @@ fn handle_init(args: InitArgs) -> Result<()> {
     println!();
 
     // Post-generation guidance
-    println!("  {} {}", "Next steps:".bright_white().bold(), "");
+    println!("  {}", "Next steps:".bright_white().bold());
     println!();
 
     if platforms.contains(&"github") || platforms.contains(&"all") {
@@ -656,4 +658,3 @@ jobs:
         assert!(handle_validate(args).is_ok());
     }
 }
-
diff --git a/src/commands/collab.rs b/src/commands/collab.rs
index e9161b2a..f1dc183f 100644
--- a/src/commands/collab.rs
+++ b/src/commands/collab.rs
@@ -21,7 +21,7 @@ use chrono::{DateTime, Utc};
 use clap::Subcommand;
 use serde::{Deserialize, Serialize};
 use std::fs;
-use std::path::PathBuf;
+use std::path::{Path, PathBuf};
 use std::process::Command;
 
 // ─── Sub-command enum ──────────────────────────────────────────────────────
@@ -145,7 +145,7 @@ fn save_store(store: &CollabStore) -> Result<()> {
     Ok(())
 }
 
-fn record_review(file: &PathBuf, kind: &str) {
+fn record_review(file: &Path, kind: &str) {
     if let Ok(mut store) = load_store() {
         store.reviews.push(ReviewRecord {
             file: file.display().to_string(),
@@ -371,7 +371,7 @@ fn handle_contributions(days: i64) -> Result<()> {
     let total: usize = counts.values().sum();
 
     let mut rows: Vec<(String, usize)> = counts.into_iter().collect();
-    rows.sort_by(|a, b| b.1.cmp(&a.1));
+    rows.sort_by_key(|a| std::cmp::Reverse(a.1));
 
     let headers = &["Author", "Commits", "Share"];
     let table_rows: Vec<Vec<String>> = rows
diff --git a/src/commands/compliance.rs b/src/commands/compliance.rs
index bb8a93bd..ad86b132 100644
--- a/src/commands/compliance.rs
+++ b/src/commands/compliance.rs
@@ -8,8 +8,6 @@ use crate::utils::print as p;
 use anyhow::Result;
 use clap::{Args, Subcommand};
 use colored::Colorize;
-use colored::*;
-use std::collections::HashMap;
 
 #[derive(Subcommand)]
 pub enum ComplianceCommands {
@@ -202,7 +200,7 @@ fn handle_init() -> Result<()> {
             enabled_mark,
             policy.name.white(),
             severity_color,
-            &policy.id[..12].cyan()
+            policy.id[..12].cyan()
         );
     }
 
@@ -244,7 +242,7 @@ fn handle_check(args: CheckArgs) -> Result<()> {
     p::kv("Network", &report.network);
     p::kv(
         "Timestamp",
-        &report.timestamp.get(..19).unwrap_or(&report.timestamp),
+        report.timestamp.get(..19).unwrap_or(&report.timestamp),
     );
 
     println!();
@@ -252,7 +250,7 @@ fn handle_check(args: CheckArgs) -> Result<()> {
     println!(
         "  {} {}\n",
         "Policy Checks".bright_white(),
-        &format!("({})", report.checks.len()).dimmed()
+        format!("({})", report.checks.len()).dimmed()
     );
     p::separator();
 
@@ -277,7 +275,7 @@ fn handle_check(args: CheckArgs) -> Result<()> {
         println!(
             "  {} {}\n",
             "Regulatory Checks".bright_white(),
-            &format!("({})", report.regulatory_checks.len()).dimmed()
+            format!("({})", report.regulatory_checks.len()).dimmed()
         );
         p::separator();
 
@@ -309,7 +307,7 @@ fn handle_check(args: CheckArgs) -> Result<()> {
         println!(
             "  {} {}\n",
             "Best Practices".bright_white(),
-            &format!("({})", report.best_practices.len()).dimmed()
+            format!("({})", report.best_practices.len()).dimmed()
         );
         p::separator();
 
@@ -430,7 +428,7 @@ fn handle_list_policies() -> Result<()> {
         let type_str = format!("{:?}", policy.policy_type);
         println!(
             "  {:<14} {:<36} {:<12} {:<10} {:<8}",
-            &policy.id[..12].cyan(),
+            policy.id[..12].cyan(),
             policy.name.truncate_or_pad(34),
             type_str,
             sev,
@@ -461,11 +459,11 @@ fn handle_show_policy(args: ShowPolicyArgs) -> Result<()> {
     p::kv("Enabled", if policy.enabled { "yes" } else { "no" });
     p::kv(
         "Created",
-        &policy.created_at.get(..19).unwrap_or(&policy.created_at),
+        policy.created_at.get(..19).unwrap_or(&policy.created_at),
     );
     p::kv(
         "Updated",
-        &policy.updated_at.get(..19).unwrap_or(&policy.updated_at),
+        policy.updated_at.get(..19).unwrap_or(&policy.updated_at),
     );
 
     if !policy.config.is_empty() {
@@ -540,8 +538,8 @@ fn handle_list_reports(args: ListReportsArgs) -> Result<()> {
         let ts = report.timestamp.get(..16).unwrap_or(&report.timestamp);
         println!(
             "  {:<14} {:<20} {:<12} {:<8} {:<8} {:<12}",
-            &report.request_id[..12].cyan(),
-            &report.contract_id.chars().take(18).collect::<String>(),
+            report.request_id[..12].cyan(),
+            report.contract_id.chars().take(18).collect::<String>(),
             report.network,
             status,
             report.blocking_count.to_string().red(),
@@ -579,7 +577,7 @@ fn handle_show_report(args: ShowReportArgs) -> Result<()> {
     p::kv("Network", &report.network);
     p::kv(
         "Timestamp",
-        &report.timestamp.get(..19).unwrap_or(&report.timestamp),
+        report.timestamp.get(..19).unwrap_or(&report.timestamp),
     );
     let status_str = if report.all_passed {
         format!("{}", "PASSED".green())
@@ -595,7 +593,7 @@ fn handle_show_report(args: ShowReportArgs) -> Result<()> {
     println!(
         "  {} {}\n",
         "Check Results".bright_white(),
-        &format!("({})", report.checks.len()).dimmed()
+        format!("({})", report.checks.len()).dimmed()
     );
     p::separator();
 
@@ -619,7 +617,7 @@ fn handle_show_report(args: ShowReportArgs) -> Result<()> {
         println!(
             "  {} {}\n",
             "Regulatory Checks".bright_white(),
-            &format!("({})", report.regulatory_checks.len()).dimmed()
+            format!("({})", report.regulatory_checks.len()).dimmed()
         );
         p::separator();
 
@@ -645,7 +643,7 @@ fn handle_show_report(args: ShowReportArgs) -> Result<()> {
         println!(
             "  {} {}\n",
             "Best Practices".bright_white(),
-            &format!("({})", report.best_practices.len()).dimmed()
+            format!("({})", report.best_practices.len()).dimmed()
         );
         p::separator();
 
@@ -864,7 +862,7 @@ fn handle_dashboard() -> Result<()> {
             println!(
                 "  {} {} | {} | {} | blocking: {}",
                 status,
-                &report.request_id[..12].cyan(),
+                report.request_id[..12].cyan(),
                 report.network,
                 ts.dimmed(),
                 report.blocking_count.to_string().red(),
diff --git a/src/commands/config.rs b/src/commands/config.rs
index d4371467..e4bd9439 100644
--- a/src/commands/config.rs
+++ b/src/commands/config.rs
@@ -1,7 +1,7 @@
 use crate::utils::database;
 use crate::utils::{config, print as p};
 use anyhow::Result;
-use clap::{Args, Subcommand};
+use clap::Subcommand;
 
 #[derive(Subcommand)]
 pub enum ConfigCommands {
@@ -327,6 +327,9 @@ fn show() -> Result<()> {
     Ok(())
 }
 
+// Not currently called from any code path in this crate. Kept rather than
+// removed since deleting it is a product decision, not a lint-scoping one.
+#[allow(dead_code)]
 fn set_value(key: &str, value: &str) -> Result<()> {
     let mut cfg = config::load()?;
     match key {
@@ -349,6 +352,9 @@ fn set_value(key: &str, value: &str) -> Result<()> {
     Ok(())
 }
 
+// Not currently called from any code path in this crate. Kept rather than
+// removed since deleting it is a product decision, not a lint-scoping one.
+#[allow(dead_code)]
 fn parse_bool(value: &str) -> Result<bool> {
     match value.to_ascii_lowercase().as_str() {
         "true" | "1" | "yes" | "on" | "enabled" => Ok(true),
@@ -360,6 +366,9 @@ fn parse_bool(value: &str) -> Result<bool> {
     }
 }
 
+// Not currently called from any code path in this crate. Kept rather than
+// removed since deleting it is a product decision, not a lint-scoping one.
+#[allow(dead_code)]
 fn plugin_trust(cmd: PluginTrustCommands) -> Result<()> {
     match cmd {
         PluginTrustCommands::List => {
@@ -400,6 +409,9 @@ fn plugin_trust(cmd: PluginTrustCommands) -> Result<()> {
     Ok(())
 }
 
+// Not currently called from any code path in this crate. Kept rather than
+// removed since deleting it is a product decision, not a lint-scoping one.
+#[allow(dead_code)]
 fn print_plugin_trust_sources(cfg: &config::Config) {
     p::header("Trusted Plugin Sources");
     if cfg.plugin_trust.trusted_sources.is_empty() {
diff --git a/src/commands/deployment_automate.rs b/src/commands/deployment_automate.rs
index ae9acd40..d1a65ac0 100644
--- a/src/commands/deployment_automate.rs
+++ b/src/commands/deployment_automate.rs
@@ -144,6 +144,10 @@ pub async fn handle(cmd: DeploymentAutomateCommands) -> Result<()> {
     }
 }
 
+// Each parameter is an independent, named input (CLI flags / distinct config
+// values); bundling them into a struct here would add indirection without
+// reducing real complexity.
+#[allow(clippy::too_many_arguments)]
 async fn handle_run(
     wasm: PathBuf,
     network: String,
@@ -467,7 +471,7 @@ fn print_automation_result(result: &crate::utils::deployment_automation::Complet
     }
 }
 
-fn handle_history(limit: usize) -> Result<()> {
+fn handle_history(_limit: usize) -> Result<()> {
     p::header("Deployment Automation History");
     p::separator();
 
diff --git a/src/commands/deployment_optimize.rs b/src/commands/deployment_optimize.rs
index e9aead10..894788e4 100644
--- a/src/commands/deployment_optimize.rs
+++ b/src/commands/deployment_optimize.rs
@@ -364,7 +364,7 @@ fn print_optimization_result(
     }
 }
 
-fn handle_history(limit: usize) -> Result<()> {
+fn handle_history(_limit: usize) -> Result<()> {
     p::header("Deployment Optimization History");
     p::separator();
 
diff --git a/src/commands/deployments.rs b/src/commands/deployments.rs
index 75f014f2..3cd896fb 100644
--- a/src/commands/deployments.rs
+++ b/src/commands/deployments.rs
@@ -1,5 +1,5 @@
 use crate::utils::deploy_history::{
-    get_record, last_successful, load_history, set_verified, update_status, DeployStatus,
+    get_record, last_successful, load_history, set_verified, DeployStatus,
 };
 use crate::utils::deployment_monitor;
 use crate::utils::deployment_monitoring_service::{
@@ -477,7 +477,7 @@ fn handle_monitor(args: MonitorArgs) -> Result<()> {
 
         // Populate tracker with history for visual status
         let records = load_history().unwrap_or_default();
-        for (idx, r) in records.iter().enumerate().take(5) {
+        for (_idx, r) in records.iter().enumerate().take(5) {
             let tr_id = format!("dep-{}", &r.id[..8.min(r.id.len())]);
             tracker.start_tracking(&tr_id, &r.network, &r.wallet);
             if r.status == DeployStatus::Success {
@@ -554,8 +554,8 @@ async fn handle_status(args: StatusArgs) -> Result<()> {
     p::header("Deployment Status Timeline");
     crate::utils::config::validate_network(&args.network)?;
 
-    let mut timeline = deployment_timeline::DeploymentTimeline::new(&args.id)
-        .with_max_retries(args.max_retries);
+    let mut timeline =
+        deployment_timeline::DeploymentTimeline::new(&args.id).with_max_retries(args.max_retries);
     if let Some(hash) = &args.tx_hash {
         timeline = timeline.with_tx_hash(hash);
     }
diff --git a/src/commands/docs.rs b/src/commands/docs.rs
index e2617213..64600d5c 100644
--- a/src/commands/docs.rs
+++ b/src/commands/docs.rs
@@ -293,6 +293,10 @@ fn maintain(
     Ok(())
 }
 
+// Each parameter is an independent, named input (CLI flags / distinct config
+// values); bundling them into a struct here would add indirection without
+// reducing real complexity.
+#[allow(clippy::too_many_arguments)]
 fn generate(
     contract: String,
     name: Option<String>,
diff --git a/src/commands/feature_flags_cmd.rs b/src/commands/feature_flags_cmd.rs
index b2a97dfa..ea82c843 100644
--- a/src/commands/feature_flags_cmd.rs
+++ b/src/commands/feature_flags_cmd.rs
@@ -8,7 +8,7 @@
 //! - `enable <name>` / `disable <name>`
 //! - `rollout <name> --percent N` – set the global rollout percentage
 //! - `segment add|remove|list`    – manage segment rules (allow-list, %,
-//!                                  attribute predicate)
+//!   attribute predicate)
 //! - `variant add|remove|list`    – manage A/B variants
 //! - `override set|clear|list`    – per-user overrides
 //! - `metrics show|prune [--days]`
@@ -21,9 +21,7 @@
 
 use crate::utils::config;
 use crate::utils::database::Database;
-use crate::utils::feature_flags::{
-    self, FlagCategory, FlagManager, MetricKind, SegmentRule, UserContext, Variant,
-};
+use crate::utils::feature_flags::{FlagCategory, FlagManager, SegmentRule, UserContext, Variant};
 use crate::utils::print as p;
 use anyhow::{bail, Context, Result};
 use clap::{Args, Subcommand};
@@ -312,6 +310,9 @@ pub async fn handle(args: FeatureFlagsArgs) -> Result<()> {
 
 // ── Helpers shared by subcommands ─────────────────────────────────────────────
 
+// Not currently called from any code path in this crate. Kept rather than
+// removed since deleting it is a product decision, not a lint-scoping one.
+#[allow(dead_code)]
 fn hydrate_state(mgr: &FlagManager, db: &Database, flag_name: &str) -> Result<()> {
     if db.get_definition(flag_name)?.is_none() {
         bail!(
@@ -963,6 +964,7 @@ fn format_rule(rule: &SegmentRule) -> String {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::utils::feature_flags::MetricKind;
 
     #[test]
     fn format_rule_user_in_list() {
diff --git a/src/commands/governance.rs b/src/commands/governance.rs
index d5a1dcc2..b0d64161 100644
--- a/src/commands/governance.rs
+++ b/src/commands/governance.rs
@@ -1,6 +1,4 @@
-use crate::utils::governance::{
-    self, DashboardSummary, GovernanceConfig, GovernanceProposal, VoteChoice,
-};
+use crate::utils::governance::{self, DashboardSummary, GovernanceProposal, VoteChoice};
 use crate::utils::{config, confirmation, horizon, print as p};
 use anyhow::Result;
 use clap::{Args, Subcommand};
diff --git a/src/commands/help.rs b/src/commands/help.rs
index 5375753b..54e0ab67 100644
--- a/src/commands/help.rs
+++ b/src/commands/help.rs
@@ -172,7 +172,7 @@ async fn handle_command(cmd: &str, args: &HelpArgs) -> Result<()> {
     let canonical = cmd.trim().to_lowercase();
     p::header(&format!("Help: {}", canonical));
     let summary_line =
-        context_help::command_summary(&canonical).unwrap_or_else(|| help.description.as_str());
+        context_help::command_summary(&canonical).unwrap_or(help.description.as_str());
     println!("  {}", summary_line.dimmed());
     println!();
 
@@ -338,12 +338,7 @@ fn expand_workflow(slug: &str) -> Result<()> {
 async fn handle_why(args: &HelpArgs) -> Result<()> {
     let error_text: Option<String> = match args.error.clone() {
         Some(text) => Some(text),
-        None => match args.command.clone() {
-            // Treat `starforge help --why "some text"` (positional argument)
-            // as the error text too — it's the most ergonomic shape.
-            Some(text) => Some(text),
-            None => None,
-        },
+        None => args.command.clone(),
     };
 
     let error_text = match error_text {
diff --git a/src/commands/migrate_ai.rs b/src/commands/migrate_ai.rs
index ed091bea..150fea70 100644
--- a/src/commands/migrate_ai.rs
+++ b/src/commands/migrate_ai.rs
@@ -1,6 +1,6 @@
 use crate::utils::migration_ai;
 use crate::utils::migration_ai::{AnalysisConfig, MigrationPlan};
-use crate::utils::{config, print as p};
+use crate::utils::print as p;
 use anyhow::{Context, Result};
 use clap::{Args, Subcommand};
 use colored::*;
@@ -220,6 +220,10 @@ fn load_spec_entries(
     Ok(Vec::new())
 }
 
+// Each parameter is an independent, named input (CLI flags / distinct config
+// values); bundling them into a struct here would add indirection without
+// reducing real complexity.
+#[allow(clippy::too_many_arguments)]
 fn build_analysis_config(
     old_specs: &[String],
     new_specs: &[String],
@@ -251,6 +255,10 @@ fn build_analysis_config(
     })
 }
 
+// Each parameter is an independent, named input (CLI flags / distinct config
+// values); bundling them into a struct here would add indirection without
+// reducing real complexity.
+#[allow(clippy::too_many_arguments)]
 fn load_or_build_plan(
     old_wasm: Option<&PathBuf>,
     new_wasm: Option<&PathBuf>,
@@ -404,7 +412,7 @@ fn handle_generate(args: GenerateArgs) -> Result<()> {
 
     let storage_changes = &plan.storage_changes;
     let contract_name = args.contract.unwrap_or_else(|| "Contract".to_string());
-    let sdk_version = plan.to_version.clone();
+    let _sdk_version = plan.to_version.clone();
 
     let mut code = String::new();
     code.push_str(&format!(
@@ -527,7 +535,7 @@ fn handle_suggest(args: SuggestArgs) -> Result<()> {
         let priority_color = match suggestion.priority.as_str() {
             "high" => "HIGH".red().bold(),
             "medium" => "MEDIUM".yellow().bold(),
-            "low" | _ => "LOW".cyan(),
+            _ => "LOW".cyan(),
         };
 
         println!(
@@ -630,7 +638,7 @@ fn handle_plan(args: PlanArgs) -> Result<()> {
 }
 
 fn print_plan_summary(plan: &MigrationPlan) {
-    let compat_color = match plan.compatibility {
+    let _compat_color = match plan.compatibility {
         crate::utils::migration_ai::Compatibility::FullyCompatible => {
             "fully compatible".green().bold()
         }
diff --git a/src/commands/monitor.rs b/src/commands/monitor.rs
index 6be48479..e54f64c1 100644
--- a/src/commands/monitor.rs
+++ b/src/commands/monitor.rs
@@ -8,7 +8,7 @@ use crate::utils::{
 };
 use anyhow::Result;
 use clap::Args;
-use std::path::PathBuf;
+use std::path::{Path, PathBuf};
 use std::sync::{
     atomic::{AtomicBool, Ordering},
     Arc,
@@ -162,6 +162,10 @@ pub async fn handle(args: MonitorArgs) -> Result<()> {
     }
 }
 
+// Each parameter is an independent, named input (CLI flags / distinct config
+// values); bundling them into a struct here would add indirection without
+// reducing real complexity.
+#[allow(clippy::too_many_arguments)]
 async fn monitor_contract(
     contract_id: &str,
     events_filter: Option<&str>,
@@ -312,10 +316,14 @@ async fn monitor_contract(
     Ok(())
 }
 
+// Each parameter is an independent, named input (CLI flags / distinct config
+// values); bundling them into a struct here would add indirection without
+// reducing real complexity.
+#[allow(clippy::too_many_arguments)]
 fn replay_contract_events(
     contract_id: &str,
     network: &str,
-    replay_path: &PathBuf,
+    replay_path: &Path,
     legacy_filter_set: &Option<Vec<String>>,
     stream_filters: &EventStreamFilters,
     router: &EventRouter,
@@ -323,7 +331,7 @@ fn replay_contract_events(
     triggers: &[EventTrigger],
     dashboard: bool,
 ) -> Result<()> {
-    let store = EventStore::new(replay_path.clone());
+    let store = EventStore::new(replay_path.to_path_buf());
     let events = store.replay()?;
     notifications::info(&format!(
         "Replaying {} persisted event(s) from {}.",
@@ -365,6 +373,10 @@ fn replay_contract_events(
     Ok(())
 }
 
+// Each parameter is an independent, named input (CLI flags / distinct config
+// values); bundling them into a struct here would add indirection without
+// reducing real complexity.
+#[allow(clippy::too_many_arguments)]
 fn process_contract_event(
     network: &str,
     contract_id: &str,
diff --git a/src/commands/multi_network.rs b/src/commands/multi_network.rs
index 2a495d86..aca03439 100644
--- a/src/commands/multi_network.rs
+++ b/src/commands/multi_network.rs
@@ -3,7 +3,7 @@
 //! Provides CLI commands for AI-driven multi-network deployment support.
 
 use crate::utils::{
-    multi_network_deploy::{DeploymentStrategy, MultiNetworkConfig, MultiNetworkDeployer},
+    multi_network_deploy::{DeploymentStrategy, MultiNetworkDeployer},
     print as p,
 };
 use anyhow::Result;
@@ -322,7 +322,7 @@ fn print_deployment_result(
     println!();
 }
 
-fn handle_compare(include_custom: bool) -> Result<()> {
+fn handle_compare(_include_custom: bool) -> Result<()> {
     p::header("Network Comparison");
     p::separator();
 
diff --git a/src/commands/network.rs b/src/commands/network.rs
index 5f45eeed..a3b71d07 100644
--- a/src/commands/network.rs
+++ b/src/commands/network.rs
@@ -1,4 +1,4 @@
-use crate::utils::{config, http_client, output, print as p};
+use crate::utils::{config, output, print as p};
 use anyhow::Result;
 use clap::Subcommand;
 use std::time::Duration;
@@ -410,10 +410,7 @@ async fn test_network(network_name: Option<String>, json: bool) -> Result<()> {
         let fb_res = client.get(f_url).send().await;
         let fb_latency = start_fb.elapsed().as_millis() as u64;
 
-        let reachable = match fb_res {
-            Ok(_) => true,
-            Err(_) => false,
-        };
+        let reachable = fb_res.is_ok();
         friendbot_health = Some(EndpointHealth {
             url: f_url.clone(),
             reachable,
diff --git a/src/commands/new.rs b/src/commands/new.rs
index b55eb430..ca5a4bf0 100644
--- a/src/commands/new.rs
+++ b/src/commands/new.rs
@@ -201,6 +201,10 @@ async fn scaffold_contract_interactive(default_name: String) -> Result<()> {
     .await
 }
 
+// Each parameter is an independent, named input (CLI flags / distinct config
+// values); bundling them into a struct here would add indirection without
+// reducing real complexity.
+#[allow(clippy::too_many_arguments)]
 async fn scaffold_contract(
     name: String,
     template: String,
@@ -879,14 +883,23 @@ fn dapp_index(name: &str) -> String {
     )
 }
 
+// Not currently called from any code path in this crate. Kept rather than
+// removed since deleting it is a product decision, not a lint-scoping one.
+#[allow(dead_code)]
 fn dapp_tsconfig() -> String {
     r#"{"compilerOptions": {"target": "es2020", "module": "esnext", "moduleResolution": "node", "esModuleInterop": true}}"#.to_string()
 }
 
+// Not currently called from any code path in this crate. Kept rather than
+// removed since deleting it is a product decision, not a lint-scoping one.
+#[allow(dead_code)]
 fn dapp_tsconfig_node() -> String {
     r#"{"extends": "./tsconfig.json", "compilerOptions": {"module": "commonjs", "target": "es2020", "moduleResolution": "node", "esModuleInterop": true}}"#.to_string()
 }
 
+// Not currently called from any code path in this crate. Kept rather than
+// removed since deleting it is a product decision, not a lint-scoping one.
+#[allow(dead_code)]
 fn dapp_vite_env_types(wallet_kit: bool) -> String {
     if wallet_kit {
         r#"interface ImportMetaEnv { VITE_NETWORK: string; VITE_WALLET_KIT: boolean; }"#.to_string()
@@ -977,6 +990,9 @@ Source: `{source}`
 
 // ── Template Marketplace ──────────────────────────────────────────────────────
 
+// Not currently called from any code path in this crate. Kept rather than
+// removed since deleting it is a product decision, not a lint-scoping one.
+#[allow(dead_code)]
 async fn handle_template_search(query: &str, tags: Option<&str>) -> Result<()> {
     p::header("Template Marketplace — Search");
     p::kv("Query", query);
@@ -1078,6 +1094,9 @@ impl Drop for PathCleanup {
 /// Run a single install step behind a spinner, finishing with a check mark on
 /// success or clearing the spinner and attaching an actionable message on
 /// failure.
+// Not currently called from any code path in this crate. Kept rather than
+// removed since deleting it is a product decision, not a lint-scoping one.
+#[allow(dead_code)]
 fn install_step<T>(
     label: &str,
     done: &str,
@@ -1097,6 +1116,9 @@ fn install_step<T>(
     }
 }
 
+// Not currently called from any code path in this crate. Kept rather than
+// removed since deleting it is a product decision, not a lint-scoping one.
+#[allow(dead_code)]
 async fn scaffold_from_marketplace(name: String, template_name: String) -> Result<()> {
     p::header(&format!("Scaffolding from Marketplace: {}", template_name));
 
@@ -1222,10 +1244,13 @@ async fn scaffold_from_marketplace(name: String, template_name: String) -> Resul
     Ok(())
 }
 
+// Not currently called from any code path in this crate. Kept rather than
+// removed since deleting it is a product decision, not a lint-scoping one.
+#[allow(dead_code)]
 fn copy_template_contents(src: &Path, dst: &Path, project_name: &str) -> Result<()> {
     let mut entries: Vec<_> = fs::read_dir(src)?.filter_map(|e| e.ok()).collect();
 
-    entries.sort_by(|a, b| a.file_name().cmp(&b.file_name()));
+    entries.sort_by_key(|a| a.file_name());
 
     for entry in entries {
         let path = entry.path();
diff --git a/src/commands/nl.rs b/src/commands/nl.rs
index 847b69f5..e687045c 100644
--- a/src/commands/nl.rs
+++ b/src/commands/nl.rs
@@ -132,6 +132,9 @@ struct Pattern {
     keywords: &'static [&'static str],
     intent_factory: fn(&ExtractedEntities) -> Intent,
     confidence: f64,
+    // Not currently called from any code path in this crate. Kept rather than
+    // removed since deleting it is a product decision, not a lint-scoping one.
+    #[allow(dead_code)]
     explanation: &'static str,
 }
 
@@ -323,14 +326,12 @@ fn extract_entities(input: &str) -> ExtractedEntities {
 
     // Extract wallet name (after "named", "called", "as", "name", or directly after "wallet")
     for i in 0..words.len() {
-        if matches!(words[i], "named" | "called" | "as" | "name") {
-            if i + 1 < words.len() {
-                let name = words[i + 1]
-                    .trim_matches(|c: char| !c.is_alphanumeric() && c != '_' && c != '-');
-                if !name.is_empty() {
-                    entities.wallet_name = Some(name.to_string());
-                    break;
-                }
+        if matches!(words[i], "named" | "called" | "as" | "name") && i + 1 < words.len() {
+            let name =
+                words[i + 1].trim_matches(|c: char| !c.is_alphanumeric() && c != '_' && c != '-');
+            if !name.is_empty() {
+                entities.wallet_name = Some(name.to_string());
+                break;
             }
         }
     }
@@ -391,13 +392,12 @@ fn extract_entities(input: &str) -> ExtractedEntities {
 
     // Extract amount (numbers after "fund", "send", etc.)
     for i in 0..words.len() {
-        if matches!(words[i], "fund" | "send" | "pay") {
-            if i + 1 < words.len() {
-                if words[i + 1].parse::<f64>().is_ok() {
-                    entities.amount = Some(words[i + 1].to_string());
-                    break;
-                }
-            }
+        if matches!(words[i], "fund" | "send" | "pay")
+            && i + 1 < words.len()
+            && words[i + 1].parse::<f64>().is_ok()
+        {
+            entities.amount = Some(words[i + 1].to_string());
+            break;
         }
     }
 
@@ -406,15 +406,13 @@ fn extract_entities(input: &str) -> ExtractedEntities {
     // "invoke" is not in this list: it introduces the *contract*, as in
     // "invoke contract <id> call <function>".
     for i in 0..words.len() {
-        if matches!(words[i], "call" | "run" | "execute") {
-            if i + 1 < words.len() {
-                let func = words[i + 1].trim_matches(|c: char| !c.is_alphanumeric() && c != '_');
-                if func == "contract" {
-                    continue;
-                }
-                if !func.is_empty() {
-                    entities.function_name = Some(func.to_string());
-                }
+        if matches!(words[i], "call" | "run" | "execute") && i + 1 < words.len() {
+            let func = words[i + 1].trim_matches(|c: char| !c.is_alphanumeric() && c != '_');
+            if func == "contract" {
+                continue;
+            }
+            if !func.is_empty() {
+                entities.function_name = Some(func.to_string());
             }
         }
     }
diff --git a/src/commands/optimize.rs b/src/commands/optimize.rs
index 355d37da..b191c831 100644
--- a/src/commands/optimize.rs
+++ b/src/commands/optimize.rs
@@ -382,11 +382,12 @@ pub fn analyse_source(content: &str, file: &str) -> Vec<TransformSuggestion> {
         }
 
         // Suggest soroban_sdk::Vec instead of std::vec::Vec
-        if trimmed.contains("Vec<") && !trimmed.starts_with("//") {
-            if trimmed.contains("std::vec")
-                || (trimmed.contains("Vec<") && trimmed.contains("use std"))
-            {
-                suggestions.push(TransformSuggestion {
+        if trimmed.contains("Vec<")
+            && !trimmed.starts_with("//")
+            && (trimmed.contains("std::vec")
+                || (trimmed.contains("Vec<") && trimmed.contains("use std")))
+        {
+            suggestions.push(TransformSuggestion {
                     file: file.to_string(),
                     line: line_no,
                     category: TransformCategory::RedundantCode,
@@ -394,7 +395,6 @@ pub fn analyse_source(content: &str, file: &str) -> Vec<TransformSuggestion> {
                     suggested: line.replace("std::vec::Vec", "soroban_sdk::Vec").to_string(),
                     reason: "Prefer soroban_sdk::Vec over std::vec::Vec in contract code for Soroban compatibility.".to_string(),
                 });
-            }
         }
 
         // Flag large string literals in contract code
@@ -621,7 +621,7 @@ fn detect_storage_packing(content: &str, file: &str) -> Vec<TransformSuggestion>
             }
             if fields.len() >= 2 {
                 let mut sorted = fields.clone();
-                sorted.sort_by(|a, b| b.1.cmp(&a.1));
+                sorted.sort_by_key(|a| std::cmp::Reverse(a.1));
                 if sorted != fields {
                     suggestions.push(TransformSuggestion {
                         file: file.to_string(),
diff --git a/src/commands/perf.rs b/src/commands/perf.rs
index cef49b6d..0261ed78 100644
--- a/src/commands/perf.rs
+++ b/src/commands/perf.rs
@@ -1,7 +1,6 @@
 use crate::utils::{contract_profiler, performance as perf, print as p};
 use anyhow::Result;
 use clap::Subcommand;
-use std::collections::BTreeMap;
 use std::collections::HashMap;
 use std::path::PathBuf;
 
diff --git a/src/commands/plugin.rs b/src/commands/plugin.rs
index bd739548..b344277b 100644
--- a/src/commands/plugin.rs
+++ b/src/commands/plugin.rs
@@ -294,17 +294,17 @@ fn list(json: bool) -> Result<()> {
         let plugins: Vec<PluginSummary> = registry::plugin_list_entries(&reg)
             .into_iter()
             .map(|entry| PluginSummary {
-                name: entry.name.clone(),
-                version: entry.plugin_version.clone(),
-                trust: entry.trust.clone(),
-                source: entry.source.clone(),
-                description: entry.description.clone(),
+                name: entry.name,
+                version: entry.plugin_version,
+                trust: entry.trust.label().to_string(),
+                source: entry.source,
+                description: entry.description,
                 commands: entry
                     .commands
-                    .iter()
+                    .into_iter()
                     .map(|cmd| PluginCommandSummary {
-                        name: cmd.name.clone(),
-                        description: cmd.description.clone(),
+                        name: cmd.name,
+                        description: cmd.description,
                     })
                     .collect(),
             })
@@ -325,9 +325,9 @@ fn list(json: bool) -> Result<()> {
     p::kv("StarForge core version", CORE_VERSION);
     p::separator();
 
-    let entries = registry::plugin_list_entries(&reg);
+    let list_entries = registry::plugin_list_entries(&reg);
 
-    let plugin_rows: Vec<Vec<String>> = entries
+    let plugin_rows: Vec<Vec<String>> = list_entries
         .iter()
         .map(|entry| {
             vec![
@@ -340,6 +340,7 @@ fn list(json: bool) -> Result<()> {
         .collect();
     p::table(&["Name", "Version", "Trust", "Description"], &plugin_rows);
 
+    let entries = reg.plugins.clone();
     let command_rows: Vec<Vec<String>> = entries
         .iter()
         .flat_map(|entry| {
@@ -372,7 +373,7 @@ fn load() -> Result<()> {
         return Ok(());
     }
 
-    let config = config::load().unwrap_or_default();
+    let _config = config::load().unwrap_or_default();
 
     // Warn about any unknown-trust plugins before loading.
     for pl in reg.plugins.iter().filter(|p| {
@@ -495,6 +496,9 @@ fn uninstall(name: String, purge: bool, yes: bool) -> Result<()> {
     Ok(())
 }
 
+// Not currently called from any code path in this crate. Kept rather than
+// removed since deleting it is a product decision, not a lint-scoping one.
+#[allow(dead_code)]
 fn discover_commands_from_library(lib_path: &str) -> Result<Vec<RegisteredCommand>> {
     let path = Path::new(lib_path);
     let mut pm = PluginManager::new();
@@ -525,7 +529,7 @@ fn update(name: Option<String>, yes: bool) -> Result<()> {
         return Ok(());
     }
 
-    let config = config::load().unwrap_or_default();
+    let _config = config::load().unwrap_or_default();
 
     let to_update: Vec<_> = match &name {
         Some(n) => {
@@ -729,7 +733,7 @@ fn verify(name: Option<String>, deep: bool, runtime_check: bool) -> Result<()> {
         None => reg.plugins.iter().collect(),
     };
 
-    let config = config::load().unwrap_or_default();
+    let _config = config::load().unwrap_or_default();
     let mut all_ok = true;
 
     for pl in &to_check {
diff --git a/src/commands/pr.rs b/src/commands/pr.rs
index 9f226151..39b5f7ca 100644
--- a/src/commands/pr.rs
+++ b/src/commands/pr.rs
@@ -332,13 +332,13 @@ async fn fetch_pr_readiness(repo_slug: &str, pr_number: u32) -> Result<PrReadine
         blocking_reasons.push(format!("Check '{}' is still pending", check.name));
     }
 
-    if matches!(merge_state, "BLOCKED" | "BEHIND") {
-        if !blocking_reasons.iter().any(|r| r.contains("merge")) {
-            blocking_reasons.push(format!(
-                "Merge state is '{}' — branch may need a rebase",
-                merge_state
-            ));
-        }
+    if matches!(merge_state, "BLOCKED" | "BEHIND")
+        && !blocking_reasons.iter().any(|r| r.contains("merge"))
+    {
+        blocking_reasons.push(format!(
+            "Merge state is '{}' — branch may need a rebase",
+            merge_state
+        ));
     }
 
     let is_ready = blocking_reasons.is_empty();
diff --git a/src/commands/privacy.rs b/src/commands/privacy.rs
index 781ff2bc..c0b830d9 100644
--- a/src/commands/privacy.rs
+++ b/src/commands/privacy.rs
@@ -1,7 +1,6 @@
 use crate::utils::{print as p, privacy};
 use anyhow::Result;
-use clap::{Args, Subcommand};
-use serde_json::json;
+use clap::Subcommand;
 
 #[derive(Subcommand)]
 pub enum PrivacyCommands {
diff --git a/src/commands/project.rs b/src/commands/project.rs
index 5c4b211e..b67bfc01 100644
--- a/src/commands/project.rs
+++ b/src/commands/project.rs
@@ -9,15 +9,8 @@
 //! - `risk`      – Assess and mitigate project risks using AI analysis
 //! - `timeline`  – Manage project timelines, milestones, and deadlines
 
-use crate::utils::{config, ollama, print as p};
-use anyhow::{Context, Result};
-use chrono::{DateTime, Utc};
+use anyhow::Result;
 use clap::{Args, Subcommand};
-use colored::*;
-use serde::{Deserialize, Serialize};
-use std::collections::HashMap;
-use std::fs;
-use std::path::PathBuf;
 
 // ─── Top-level Subcommand ──────────────────────────────────────────
 
diff --git a/src/commands/recommend.rs b/src/commands/recommend.rs
index a10dc8e7..7ec932f1 100644
--- a/src/commands/recommend.rs
+++ b/src/commands/recommend.rs
@@ -46,7 +46,7 @@ pub async fn handle(
         .collect();
 
     let skill_level = match skill.as_deref() {
-        Some(s) => match rec::SkillLevel::from_str(s) {
+        Some(s) => match rec::SkillLevel::parse_lenient(s) {
             Some(level) => level,
             None => {
                 p::warn(&format!(
diff --git a/src/commands/registry.rs b/src/commands/registry.rs
index 67beef92..563ae207 100644
--- a/src/commands/registry.rs
+++ b/src/commands/registry.rs
@@ -452,6 +452,10 @@ fn logout() -> Result<()> {
     Ok(())
 }
 
+// Each parameter is an independent, named input (CLI flags / distinct config
+// values); bundling them into a struct here would add indirection without
+// reducing real complexity.
+#[allow(clippy::too_many_arguments)]
 async fn publish(
     path: PathBuf,
     name: Option<String>,
diff --git a/src/commands/security.rs b/src/commands/security.rs
index b67c88a9..abaac1cb 100644
--- a/src/commands/security.rs
+++ b/src/commands/security.rs
@@ -10,7 +10,6 @@ use crate::utils::stream::{EventStreamFilters, SorobanEventStream};
 use crate::utils::{config, notifications, soroban};
 use anyhow::Result;
 use clap::{Args, Subcommand};
-use colored::Colorize;
 use std::fs;
 use std::path::PathBuf;
 use std::sync::{
@@ -692,12 +691,9 @@ fn handle_threat_detect(args: ThreatDetectArgs) -> Result<()> {
     p::kv("Malicious", &summary.malicious.to_string());
     p::kv("Suspicious", &summary.suspicious.to_string());
 
-    match args.format.as_str() {
-        "json" => {
-            let json = serde_json::to_string_pretty(&event)?;
-            println!("{}", json);
-        }
-        _ => {}
+    if args.format.as_str() == "json" {
+        let json = serde_json::to_string_pretty(&event)?;
+        println!("{}", json);
     }
 
     if event.classification == crate::utils::security::ThreatClassification::Malicious {
diff --git a/src/commands/social.rs b/src/commands/social.rs
index b158bca0..b74714a4 100644
--- a/src/commands/social.rs
+++ b/src/commands/social.rs
@@ -1,7 +1,6 @@
 use crate::utils::{config, print as p, social};
 use anyhow::Result;
 use clap::{Args, Subcommand};
-use std::path::PathBuf;
 
 #[derive(Subcommand)]
 pub enum SocialCommands {
diff --git a/src/commands/template.rs b/src/commands/template.rs
index a4019bad..7f45bf61 100644
--- a/src/commands/template.rs
+++ b/src/commands/template.rs
@@ -1,6 +1,6 @@
 use crate::utils::template_integration;
 use crate::utils::template_performance;
-use crate::utils::{output, print as p, registry, template_customization_ai, templates};
+use crate::utils::{output, print as p, template_customization_ai, templates};
 use anyhow::{Context, Result};
 use clap::Subcommand;
 use colored::Colorize;
@@ -302,6 +302,9 @@ pub async fn handle(cmd: TemplateCommands) -> Result<()> {
     }
 }
 
+// Not currently called from any code path in this crate. Kept rather than
+// removed since deleting it is a product decision, not a lint-scoping one.
+#[allow(dead_code)]
 async fn template_assist(
     template: String,
     project: PathBuf,
@@ -350,6 +353,10 @@ async fn template_assist(
     }
     Ok(())
 }
+// Each parameter is an independent, named input (CLI flags / distinct config
+// values); bundling them into a struct here would add indirection without
+// reducing real complexity.
+#[allow(clippy::too_many_arguments)]
 async fn import(
     path: PathBuf,
     name: Option<String>,
@@ -380,6 +387,10 @@ async fn import(
     Ok(())
 }
 
+// Each parameter is an independent, named input (CLI flags / distinct config
+// values); bundling them into a struct here would add indirection without
+// reducing real complexity.
+#[allow(clippy::too_many_arguments)]
 async fn publish(
     path: PathBuf,
     name: Option<String>,
@@ -829,6 +840,9 @@ fn init() -> Result<()> {
     Ok(())
 }
 
+// Not currently called from any code path in this crate. Kept rather than
+// removed since deleting it is a product decision, not a lint-scoping one.
+#[allow(dead_code)]
 async fn optimize(path: PathBuf, name: Option<String>) -> Result<()> {
     let analysis = template_performance::analyze_template_directory(&path, name.as_deref())?;
 
@@ -995,6 +1009,9 @@ async fn info(name: String) -> Result<()> {
     Ok(())
 }
 
+// Not currently called from any code path in this crate. Kept rather than
+// removed since deleting it is a product decision, not a lint-scoping one.
+#[allow(dead_code)]
 async fn fetch(
     source: String,
     name: Option<String>,
@@ -1350,7 +1367,6 @@ async fn template_audit(name: Option<String>) -> Result<()> {
             Some(sr) => (
                 sr.status.as_str(),
                 sr.findings
-                    .clone()
                     .map(|f| f.to_string())
                     .unwrap_or_else(|| "—".to_string()),
                 sr.score
diff --git a/src/commands/template_security.rs b/src/commands/template_security.rs
index 5a56bac5..a85e8960 100644
--- a/src/commands/template_security.rs
+++ b/src/commands/template_security.rs
@@ -155,7 +155,7 @@ async fn handle_scan(
 
 fn print_scan_result(result: &crate::utils::template_security_scanner::TemplateSecurityScanResult) {
     // Overall score
-    let score_color = if result.security_score >= 80.0 {
+    let _score_color = if result.security_score >= 80.0 {
         "green"
     } else if result.security_score >= 60.0 {
         "yellow"
@@ -284,7 +284,7 @@ fn print_scan_result(result: &crate::utils::template_security_scanner::TemplateS
     }
 }
 
-fn handle_history(limit: usize) -> Result<()> {
+fn handle_history(_limit: usize) -> Result<()> {
     p::header("Security Scan History");
     p::separator();
 
diff --git a/src/commands/test.rs b/src/commands/test.rs
index 141726b0..113d4436 100644
--- a/src/commands/test.rs
+++ b/src/commands/test.rs
@@ -1,6 +1,6 @@
 use crate::utils::{
     config, contract_testing, print as p, rollback_testing, test_automation, test_coverage,
-    test_generator, test_runner,
+    test_runner,
 };
 use anyhow::Result;
 use clap::Args;
@@ -496,7 +496,7 @@ pub async fn handle(args: TestArgs) -> Result<()> {
                         }
                     }
 
-                    let timings: Vec<crate::utils::test_optimizer::TestCaseTiming> = report
+                    let _timings: Vec<crate::utils::test_optimizer::TestCaseTiming> = report
                         .results
                         .iter()
                         .map(|r| crate::utils::test_optimizer::TestCaseTiming {
diff --git a/src/commands/upgrade_auto.rs b/src/commands/upgrade_auto.rs
index 604ccde6..22e73921 100644
--- a/src/commands/upgrade_auto.rs
+++ b/src/commands/upgrade_auto.rs
@@ -501,22 +501,20 @@ pub fn analyse_compat(
     let old_spec = decode_spec_model(old_bytes);
     let new_spec = decode_spec_model(new_bytes);
 
-    match (&old_spec, &new_spec) {
-        (Err(err), _) => issues.push(CompatIssue {
+    if let (Err(err), _) = (&old_spec, &new_spec) {
+        issues.push(CompatIssue {
             kind: "old-abi-metadata-missing".to_string(),
             severity: "warning".to_string(),
             description: format!("Unable to decode old contract ABI metadata: {err}"),
-        }),
-        _ => {}
+        })
     }
 
-    match (&old_spec, &new_spec) {
-        (_, Err(err)) => issues.push(CompatIssue {
+    if let (_, Err(err)) = (&old_spec, &new_spec) {
+        issues.push(CompatIssue {
             kind: "new-abi-metadata-missing".to_string(),
             severity: "warning".to_string(),
             description: format!("Unable to decode new contract ABI metadata: {err}"),
-        }),
-        _ => {}
+        })
     }
 
     let abi = match (&old_spec, &new_spec) {
@@ -1919,7 +1917,6 @@ fn short_id(id: &str) -> String {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use std::io::Write;
     use stellar_xdr::curr::{
         Limits, ScSpecEntry, ScSpecFunctionInputV0, ScSpecFunctionV0, ScSpecTypeDef, ScSpecTypeUdt,
         ScSpecUdtStructFieldV0, ScSpecUdtStructV0, ScSymbol, StringM, VecM, WriteXdr,
diff --git a/src/commands/wallet.rs b/src/commands/wallet.rs
index b223a460..5a0c97d8 100644
--- a/src/commands/wallet.rs
+++ b/src/commands/wallet.rs
@@ -8,8 +8,7 @@ use clap::Subcommand;
 use colored::*;
 use ed25519_dalek::{Signer, SigningKey};
 use rand::RngCore;
-use serde::{Deserialize, Serialize};
-use std::collections::HashSet;
+use serde::Serialize;
 use std::fs;
 use std::path::PathBuf;
 use stellar_strkey::ed25519::{PrivateKey as StellarPrivateKey, PublicKey as StellarPublicKey};
@@ -714,6 +713,10 @@ fn prompt_recovery_phrase() -> Result<String> {
     Ok(phrase)
 }
 
+// Each parameter is an independent, named input (CLI flags / distinct config
+// values); bundling them into a struct here would add indirection without
+// reducing real complexity.
+#[allow(clippy::too_many_arguments)]
 async fn create(
     name: String,
     fund: bool,
@@ -1335,6 +1338,10 @@ fn rename(old_name: String, new_name: String) -> Result<()> {
     Ok(())
 }
 
+// Each parameter is an independent, named input (CLI flags / distinct config
+// values); bundling them into a struct here would add indirection without
+// reducing real complexity.
+#[allow(clippy::too_many_arguments)]
 async fn rotate_wallet(
     name: String,
     fund: bool,
@@ -1486,6 +1493,9 @@ async fn rotate_wallet(
     Ok(())
 }
 
+// Not currently called from any code path in this crate. Kept rather than
+// removed since deleting it is a product decision, not a lint-scoping one.
+#[allow(dead_code)]
 fn wallet_history(name: String, reveal: bool) -> Result<()> {
     config::validate_wallet_name(&name)?;
     let cfg = config::load()?;
@@ -1742,6 +1752,10 @@ fn export_wallet(
     Ok(())
 }
 
+// Each parameter is an independent, named input (CLI flags / distinct config
+// values); bundling them into a struct here would add indirection without
+// reducing real complexity.
+#[allow(clippy::too_many_arguments)]
 fn import_wallet(
     name: Option<String>,
     file: Option<PathBuf>,
diff --git a/src/lib.rs b/src/lib.rs
index df34f074..94695b33 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -1,5 +1,3 @@
-#![allow(dead_code, unused, clippy::all)]
-
 pub mod commands;
 pub mod plugins;
 pub mod utils;
diff --git a/src/main.rs b/src/main.rs
index 371648d8..b34ed4c7 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -1,5 +1,3 @@
-#![allow(dead_code, unused, clippy::all)]
-
 pub use starforge::commands;
 pub mod curation;
 pub use starforge::plugins;
@@ -876,11 +874,9 @@ fn recovery_hints(command: &str, err: &anyhow::Error) -> Vec<String> {
             hints.push("Analyze a contract: starforge ai-recommend analyze src/lib.rs".into());
             hints.push("Scan a project: starforge ai-recommend scan .".into());
         }
-        "benchmark" | "test" => {
-            if msg.contains("wasm") || msg.contains("not found") {
-                hints.push("Build your contract first: stellar contract build".into());
-                hints.push("Pass the correct --wasm path to the command.".into());
-            }
+        "benchmark" | "test" if (msg.contains("wasm") || msg.contains("not found")) => {
+            hints.push("Build your contract first: stellar contract build".into());
+            hints.push("Pass the correct --wasm path to the command.".into());
         }
 
         _ => {}
@@ -913,7 +909,7 @@ fn handle_external_plugin(args: Vec<String>) -> anyhow::Result<()> {
     let plugin_name = &args[0];
     let plugin_args = &args[1..];
 
-    let cfg = starforge::utils::config::load()?;
+    let _cfg = starforge::utils::config::load()?;
     let reg = plugins::registry::load_registry().unwrap_or_default();
     if reg.plugins.is_empty() {
         anyhow::bail!(
diff --git a/src/plugins/loader.rs b/src/plugins/loader.rs
index ba1c8cba..59345b4f 100644
--- a/src/plugins/loader.rs
+++ b/src/plugins/loader.rs
@@ -6,9 +6,8 @@ use crate::plugins::interface::{
 use crate::plugins::manifest;
 use crate::plugins::registry::{load_registry, TrustLevel};
 use anyhow::Result;
-use libloading::{Library, Symbol};
+use libloading::Library;
 use std::collections::HashMap;
-use std::ffi::OsStr;
 use std::path::Path;
 use std::rc::Rc;
 
diff --git a/src/plugins/manifest.rs b/src/plugins/manifest.rs
index bc2d155a..90b0a537 100644
--- a/src/plugins/manifest.rs
+++ b/src/plugins/manifest.rs
@@ -149,21 +149,21 @@ impl PluginManifest {
             let existing = c.to_lowercase();
             existing == cap_lower
                 || existing == "*"
-                || match (existing.as_str(), cap_lower.as_str()) {
+                || matches!(
+                    (existing.as_str(), cap_lower.as_str()),
                     ("fs", "fs:read")
-                    | ("fs", "fs:write")
-                    | ("filesystem", "fs:read")
-                    | ("filesystem", "fs:write")
-                    | ("filesystemaccess", "fs:read")
-                    | ("filesystemaccess", "fs:write") => true,
-                    ("net", "network")
-                    | ("net", "net:http")
-                    | ("network", "net:http")
-                    | ("network", "net:ws")
-                    | ("networkaccess", "network")
-                    | ("networkaccess", "net:http") => true,
-                    _ => false,
-                }
+                        | ("fs", "fs:write")
+                        | ("filesystem", "fs:read")
+                        | ("filesystem", "fs:write")
+                        | ("filesystemaccess", "fs:read")
+                        | ("filesystemaccess", "fs:write")
+                        | ("net", "network")
+                        | ("net", "net:http")
+                        | ("network", "net:http")
+                        | ("network", "net:ws")
+                        | ("networkaccess", "network")
+                        | ("networkaccess", "net:http")
+                )
         })
     }
 
diff --git a/src/plugins/registry.rs b/src/plugins/registry.rs
index 40a8516d..0d2ff26e 100644
--- a/src/plugins/registry.rs
+++ b/src/plugins/registry.rs
@@ -1,5 +1,4 @@
-use crate::plugins::manifest;
-use crate::utils::config::{self, Config};
+use crate::utils::config::Config;
 use anyhow::{Context, Result};
 use serde::{Deserialize, Serialize};
 use std::fs;
@@ -232,48 +231,6 @@ pub struct InstalledPlugin {
     pub commands: Vec<RegisteredCommand>,
 }
 
-/// The description to show for a plugin: its own, or the first command's when
-/// the plugin does not declare one.
-pub fn resolve_plugin_description(plugin: &InstalledPlugin) -> &str {
-    if !plugin.description.is_empty() {
-        return &plugin.description;
-    }
-    plugin
-        .commands
-        .first()
-        .map(|c| c.description.clone())
-        .unwrap_or_default()
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct PluginListEntry {
-    pub name: String,
-    pub path: String,
-    pub source: String,
-    pub trust: String,
-    pub starforge_version: String,
-    pub plugin_version: String,
-    pub description: String,
-    pub installed_at: Option<String>,
-    pub commands: Vec<RegisteredCommand>,
-}
-pub fn plugin_list_entries(reg: &PluginRegistry) -> Vec<PluginListEntry> {
-    reg.plugins
-        .iter()
-        .map(|p| PluginListEntry {
-            name: p.name.clone(),
-            path: p.path.clone(),
-            source: p.source.clone(),
-            trust: p.trust.label().to_string(),
-            starforge_version: p.starforge_version.clone(),
-            plugin_version: p.plugin_version.clone(),
-            description: resolve_plugin_description(p),
-            installed_at: p.installed_at.clone(),
-            commands: p.commands.clone(),
-        })
-        .collect()
-}
-
 fn registry_path() -> Result<PathBuf> {
     let dir = crate::utils::config::config_dir().join("plugins");
     if !dir.exists() {
@@ -376,6 +333,48 @@ pub fn install_plugin(
     Ok(())
 }
 
+/// Resolve a display-ready description for a plugin: prefers the explicit
+/// registry-recorded description, and falls back to the first registered
+/// command's description when that's empty (e.g. for plugins installed
+/// before `description` was tracked).
+pub fn resolve_plugin_description(plugin: &InstalledPlugin) -> String {
+    if !plugin.description.is_empty() {
+        return plugin.description.clone();
+    }
+    plugin
+        .commands
+        .first()
+        .map(|cmd| cmd.description.clone())
+        .unwrap_or_default()
+}
+
+/// A plugin entry with its description pre-resolved, for listing UIs.
+#[derive(Debug, Clone)]
+pub struct PluginListEntry {
+    pub name: String,
+    pub plugin_version: String,
+    pub trust: TrustLevel,
+    pub source: String,
+    pub description: String,
+    pub commands: Vec<RegisteredCommand>,
+}
+
+/// Build display-ready entries for every installed plugin, with descriptions
+/// resolved via [`resolve_plugin_description`].
+pub fn plugin_list_entries(reg: &PluginRegistry) -> Vec<PluginListEntry> {
+    reg.plugins
+        .iter()
+        .map(|p| PluginListEntry {
+            name: p.name.clone(),
+            plugin_version: p.plugin_version.clone(),
+            trust: p.trust.clone(),
+            source: p.source.clone(),
+            description: resolve_plugin_description(p),
+            commands: p.commands.clone(),
+        })
+        .collect()
+}
+
 /// Return all commands registered across all installed plugins (read from registry, no .so load).
 pub fn load_all_registered_commands() -> Vec<RegisteredCommand> {
     load_registry()
diff --git a/src/utils/ai.rs b/src/utils/ai.rs
index a171dbbe..d49bfc6b 100644
--- a/src/utils/ai.rs
+++ b/src/utils/ai.rs
@@ -436,8 +436,11 @@ impl AIService for OllamaAdapter {
     }
 }
 
+/// Registered AI service backends, keyed by provider.
+type ProviderMap = RwLock<HashMap<AIProvider, Arc<Mutex<Box<dyn AIService>>>>>;
+
 pub struct AIServiceManager {
-    providers: RwLock<HashMap<AIProvider, Arc<Mutex<Box<dyn AIService>>>>>,
+    providers: ProviderMap,
     circuit_breakers: RwLock<HashMap<AIProvider, Arc<Mutex<CircuitBreaker>>>>,
     fallback_order: Vec<AIProvider>,
     provider_models: HashMap<AIProvider, String>,
diff --git a/src/utils/ai_cache.rs b/src/utils/ai_cache.rs
index 34a31b75..9517db28 100644
--- a/src/utils/ai_cache.rs
+++ b/src/utils/ai_cache.rs
@@ -12,14 +12,12 @@
 //! - Support for cache prewarming
 //! - Manual cache invalidation commands
 
-use crate::utils::database::{db_path, Database};
-use anyhow::{Context, Result};
-use chrono::{DateTime, Utc};
-use rusqlite::{params, Connection, OptionalExtension};
+use crate::utils::database::Database;
+use anyhow::Result;
+use rusqlite::{params, OptionalExtension};
 use serde::{Deserialize, Serialize};
 use sha2::{Digest, Sha256};
-use std::path::PathBuf;
-use std::time::{Duration, SystemTime, UNIX_EPOCH};
+use std::time::{SystemTime, UNIX_EPOCH};
 
 /// Default TTL for cached AI responses (7 days)
 pub const DEFAULT_CACHE_TTL_SECONDS: u64 = 7 * 24 * 60 * 60;
diff --git a/src/utils/ai_context.rs b/src/utils/ai_context.rs
index 8c4047bb..d2594d1f 100644
--- a/src/utils/ai_context.rs
+++ b/src/utils/ai_context.rs
@@ -2,7 +2,6 @@ use anyhow::{Context, Result};
 use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
 use std::path::{Path, PathBuf};
-use std::sync::Arc;
 use tokio::sync::RwLock;
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -186,7 +185,7 @@ impl AIContextManager {
             items.extend(edits);
         }
 
-        items.sort_by(|a, b| b.priority.cmp(&a.priority));
+        items.sort_by_key(|a| std::cmp::Reverse(a.priority));
 
         Ok(items)
     }
@@ -249,7 +248,7 @@ impl AIContextManager {
                 if path.is_dir()
                     && path
                         .file_name()
-                        .map_or(false, |n| n == "contracts" || n == "src")
+                        .is_some_and(|n| n == "contracts" || n == "src")
                 {
                     if let Ok(contract_items) = collect_rust_files_sync(&path, &self.config) {
                         items.extend(contract_items);
@@ -391,7 +390,7 @@ fn collect_rust_files_sync(
         let entry = entry?;
         let path = entry.path();
 
-        if path.is_file() && path.extension().map_or(false, |e| e == "rs") {
+        if path.is_file() && path.extension().is_some_and(|e| e == "rs") {
             if let Ok(metadata) = std::fs::metadata(&path) {
                 if metadata.len() <= config.max_file_size_bytes {
                     if let Ok(content) = std::fs::read_to_string(&path) {
diff --git a/src/utils/ai_conversation.rs b/src/utils/ai_conversation.rs
index c3a07f81..257c1d93 100644
--- a/src/utils/ai_conversation.rs
+++ b/src/utils/ai_conversation.rs
@@ -207,15 +207,9 @@ impl ConversationManager {
 
         // Trim context if too large
         if context.messages.len() > self.max_context_messages {
-            let remove_count = context.messages.len() - self.max_context_messages;
+            let _remove_count = context.messages.len() - self.max_context_messages;
             // Keep system messages, remove oldest user/assistant messages
-            context.messages.retain(|m| {
-                if m.role == MessageRole::System {
-                    true
-                } else {
-                    false
-                }
-            });
+            context.messages.retain(|m| m.role == MessageRole::System);
 
             // Add back recent messages up to limit
             let recent_messages: Vec<_> = context
@@ -371,20 +365,17 @@ impl ConversationManager {
 
         // Workflow-based suggestions
         if let Some(workflow) = &context.workflow_state {
-            match workflow.workflow_type {
-                WorkflowType::ContractDeployment => {
-                    if !workflow.completed_steps.contains(&"compile".to_string()) {
-                        suggestions.push(Suggestion {
-                            title: "Compile contract".to_string(),
-                            description: "Build the WASM file".to_string(),
-                            action_type: SuggestionAction::Command(
-                                "cargo build --target wasm32-unknown-unknown --release".to_string(),
-                            ),
-                            confidence: 0.95,
-                        });
-                    }
-                }
-                _ => {}
+            if workflow.workflow_type == WorkflowType::ContractDeployment
+                && !workflow.completed_steps.contains(&"compile".to_string())
+            {
+                suggestions.push(Suggestion {
+                    title: "Compile contract".to_string(),
+                    description: "Build the WASM file".to_string(),
+                    action_type: SuggestionAction::Command(
+                        "cargo build --target wasm32-unknown-unknown --release".to_string(),
+                    ),
+                    confidence: 0.95,
+                });
             }
         }
 
diff --git a/src/utils/ai_deployment_planner.rs b/src/utils/ai_deployment_planner.rs
index a222f7b9..b3ef6726 100644
--- a/src/utils/ai_deployment_planner.rs
+++ b/src/utils/ai_deployment_planner.rs
@@ -206,6 +206,10 @@ pub enum PlanStatus {
 
 // ─── Planner Implementation ──────────────────────────────────────────────────
 
+// `target_network`/`max_gas_price` are not currently read from any code path
+// in this crate. Kept rather than removed since deleting them is a product
+// decision, not a lint-scoping one.
+#[allow(dead_code)]
 pub struct AiDeploymentPlanner {
     contract_path: PathBuf,
     target_network: String,
@@ -311,7 +315,7 @@ Contract code:
             num_ctx: Some(8192),
         };
 
-        let response = ollama::generate(&self.model, &prompt, Some(opts))
+        let _response = ollama::generate(&self.model, &prompt, Some(opts))
             .await
             .context("AI contract analysis failed")?;
 
@@ -411,7 +415,7 @@ Contract code:
             upgrade_patterns,
             security_findings,
             optimization_suggestions,
-            readiness_score: score.max(0).min(100) as u8,
+            readiness_score: score.clamp(0, 100) as u8,
         })
     }
 
@@ -524,7 +528,7 @@ Contract code:
         // Suggest next weekday at 8 AM UTC
         let mut start_time = now;
         let days_to_add = 1;
-        start_time = start_time + chrono::Duration::days(days_to_add);
+        start_time += chrono::Duration::days(days_to_add);
         start_time = start_time
             .with_hour(8)
             .unwrap()
@@ -536,9 +540,9 @@ Contract code:
         // If weekend, move to Monday
         let weekday = start_time.weekday();
         if weekday == chrono::Weekday::Sat {
-            start_time = start_time + chrono::Duration::days(2);
+            start_time += chrono::Duration::days(2);
         } else if weekday == chrono::Weekday::Sun {
-            start_time = start_time + chrono::Duration::days(1);
+            start_time += chrono::Duration::days(1);
         }
 
         let end_time = start_time + chrono::Duration::hours(4);
@@ -659,7 +663,7 @@ Contract code:
 
         Ok(RiskAssessment {
             overall,
-            score: score.max(0).min(100) as u8,
+            score: score.clamp(0, 100) as u8,
             categories,
             mitigations,
         })
@@ -668,7 +672,7 @@ Contract code:
     async fn create_rollback_plan(
         &self,
         analysis: &ContractAnalysis,
-        network: &NetworkRecommendation,
+        _network: &NetworkRecommendation,
     ) -> Result<RollbackPlan> {
         let mut steps = Vec::new();
 
diff --git a/src/utils/ai_doc_qa.rs b/src/utils/ai_doc_qa.rs
index 8f421f0f..dd316a61 100644
--- a/src/utils/ai_doc_qa.rs
+++ b/src/utils/ai_doc_qa.rs
@@ -649,7 +649,7 @@ fn chunk_text(content: &str, chunk_size: usize, overlap: usize) -> Vec<String> {
     if content.is_empty() {
         return vec![];
     }
-    let step = chunk_size.saturating_sub(overlap).max(1);
+    let _step = chunk_size.saturating_sub(overlap).max(1);
     let mut chunks = Vec::new();
     let mut start = 0usize;
     while start < content.len() {
@@ -1110,7 +1110,7 @@ impl DocQaEngine {
         }
 
         let analysis = analyze_question(question);
-        let answer_language = language.unwrap_or_else(|| analysis.language);
+        let answer_language = language.unwrap_or(analysis.language);
 
         let tokens = analysis.tokens.clone();
         let mut hits = self.index.retrieve(&tokens, 6, 1.0);
@@ -1178,7 +1178,7 @@ impl DocQaEngine {
                     language: answer_language,
                     confidence: estimate_confidence(&hits, &analysis),
                     mode: AnswerMode::Generated,
-                    follow_up_suggestions: follow_up_suggestions(&question, &analysis),
+                    follow_up_suggestions: follow_up_suggestions(question, &analysis),
                     latency_ms: started.elapsed().as_millis(),
                 },
                 Err(_) => extractive_answer(question, &hits, answer_language, started),
@@ -1470,7 +1470,6 @@ mod tests {
 
     #[test]
     fn test_retrieval_finds_relevant_chunk() {
-        let index = DocIndex::new();
         let chunks = builtin_knowledge_base();
         let index = DocIndex {
             chunks,
diff --git a/src/utils/ai_docs.rs b/src/utils/ai_docs.rs
index a1202962..f1c7a450 100644
--- a/src/utils/ai_docs.rs
+++ b/src/utils/ai_docs.rs
@@ -277,6 +277,10 @@ fn build_function_docs(extracted: &ExtractedDocs, languages: &[DocLanguage]) ->
         .collect()
 }
 
+// Each parameter is an independent, named input (CLI flags / distinct config
+// values); bundling them into a struct here would add indirection without
+// reducing real complexity.
+#[allow(clippy::too_many_arguments)]
 fn build_sections(
     extracted: &ExtractedDocs,
     source_text: &str,
diff --git a/src/utils/ai_error_handler.rs b/src/utils/ai_error_handler.rs
index d3401337..28a77009 100644
--- a/src/utils/ai_error_handler.rs
+++ b/src/utils/ai_error_handler.rs
@@ -3,7 +3,7 @@
 //! Provides robust error handling for AI operations with automatic recovery,
 //! fallback mechanisms, and user-friendly error messages.
 
-use anyhow::{Context, Result};
+use anyhow::Result;
 use chrono::{DateTime, Utc};
 use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
@@ -161,7 +161,7 @@ impl ProviderConfig {
 }
 
 /// Error analytics tracker
-#[derive(Debug, Clone)]
+#[derive(Debug, Clone, Default)]
 pub struct ErrorAnalytics {
     pub total_errors: u64,
     pub errors_by_category: HashMap<AiErrorCategory, u64>,
@@ -170,18 +170,6 @@ pub struct ErrorAnalytics {
     pub failed_recoveries: u64,
 }
 
-impl Default for ErrorAnalytics {
-    fn default() -> Self {
-        ErrorAnalytics {
-            total_errors: 0,
-            errors_by_category: HashMap::new(),
-            errors_by_provider: HashMap::new(),
-            successful_recoveries: 0,
-            failed_recoveries: 0,
-        }
-    }
-}
-
 impl ErrorAnalytics {
     pub fn record_error(&mut self, error: &AiError) {
         self.total_errors += 1;
diff --git a/src/utils/ai_feedback.rs b/src/utils/ai_feedback.rs
index f8be3b3e..124655c9 100644
--- a/src/utils/ai_feedback.rs
+++ b/src/utils/ai_feedback.rs
@@ -12,7 +12,7 @@ use chrono::{DateTime, Utc};
 use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
 use std::fs;
-use std::path::{Path, PathBuf};
+use std::path::PathBuf;
 
 use crate::utils::config;
 
@@ -266,7 +266,7 @@ pub fn learn_preferences(store: &mut FeedbackStore) {
                 CorrectionCategory::Performance => PreferenceType::PerformancePriority,
                 _ => continue,
             };
-            let map = pref_counts.entry(pref_type).or_insert_with(HashMap::new);
+            let map = pref_counts.entry(pref_type).or_default();
             *map.entry(correction.corrected_output.clone()).or_insert(0) += 1;
         }
     }
@@ -423,7 +423,7 @@ pub fn get_feature_stats(feature: &str) -> Result<FeatureStats> {
 
     let mut top_corrections: Vec<(CorrectionCategory, usize)> =
         correction_counts.into_iter().collect();
-    top_corrections.sort_by(|a, b| b.1.cmp(&a.1));
+    top_corrections.sort_by_key(|a| std::cmp::Reverse(a.1));
     top_corrections.truncate(5);
 
     let metrics = calculate_quality_metrics(feature)?;
diff --git a/src/utils/ai_gas_estimation.rs b/src/utils/ai_gas_estimation.rs
index bcd24d3c..9d0324ec 100644
--- a/src/utils/ai_gas_estimation.rs
+++ b/src/utils/ai_gas_estimation.rs
@@ -32,6 +32,9 @@ pub struct AiGasHistoryEntry {
 }
 
 pub struct AiGasEstimator {
+    // Not currently called from any code path in this crate. Kept rather than
+    // removed since deleting it is a product decision, not a lint-scoping one.
+    #[allow(dead_code)]
     model_version: String,
 }
 
diff --git a/src/utils/ai_model_router.rs b/src/utils/ai_model_router.rs
index 8f1d6d29..8365598a 100644
--- a/src/utils/ai_model_router.rs
+++ b/src/utils/ai_model_router.rs
@@ -316,7 +316,7 @@ pub fn classify_task(prompt: &str, category_hint: Option<TaskCategory>) -> TaskC
             TaskComplexity::Simple
         };
 
-    let estimated_tokens = (word_count as u32 * 2).max(256).min(8192);
+    let estimated_tokens = (word_count as u32 * 2).clamp(256, 8192);
     let confidence = if category_hint.is_some() {
         0.95
     } else if signals.len() >= 2 {
@@ -532,7 +532,7 @@ fn build_decision(
         None
     } else {
         ai_telemetry::estimate_cost(
-            &provider_name(&model.provider),
+            provider_name(&model.provider),
             &model.model,
             classification.estimated_tokens as u64,
             (classification.estimated_tokens / 2) as u64,
@@ -593,10 +593,15 @@ pub fn config_from_decision(decision: &RoutingDecision) -> AIServiceConfig {
     }
 }
 
+/// (provider, model, feature)
+type ModelKey = (String, String, String);
+/// (call_count, success_count, total_latency_ms, total_tokens)
+type ModelTotals = (u64, u64, u64, u64);
+
 /// Aggregate model performance from local AI telemetry records.
 pub fn model_performance_stats(days: Option<u32>) -> Result<Vec<ModelPerformanceRecord>> {
     let records = ai_telemetry::load_records(days)?;
-    let mut by_model: HashMap<(String, String, String), (u64, u64, u64, u64)> = HashMap::new();
+    let mut by_model: HashMap<ModelKey, ModelTotals> = HashMap::new();
 
     for r in &records {
         let key = (r.provider.clone(), r.model.clone(), r.feature.clone());
@@ -623,15 +628,15 @@ pub fn model_performance_stats(days: Option<u32>) -> Result<Vec<ModelPerformance
                     } else {
                         0.0
                     },
-                    avg_latency_ms: if total > 0 { latency / total } else { 0 },
-                    avg_tokens: if total > 0 { tokens / total } else { 0 },
+                    avg_latency_ms: latency.checked_div(total).unwrap_or(0),
+                    avg_tokens: tokens.checked_div(total).unwrap_or(0),
                     total_calls: total,
                 }
             },
         )
         .collect();
 
-    stats.sort_by(|a, b| b.total_calls.cmp(&a.total_calls));
+    stats.sort_by_key(|a| std::cmp::Reverse(a.total_calls));
     Ok(stats)
 }
 
diff --git a/src/utils/ai_navigation.rs b/src/utils/ai_navigation.rs
index 66f1e03d..3ee163ed 100644
--- a/src/utils/ai_navigation.rs
+++ b/src/utils/ai_navigation.rs
@@ -488,10 +488,9 @@ fn parse_dependencies(root: &Path, file: &Path, source: &str) -> Vec<Dependency>
             let trimmed = line.trim();
             let (kind, rest) = if let Some(rest) = trimmed.strip_prefix("use ") {
                 ("use", rest)
-            } else if let Some(rest) = trimmed.strip_prefix("mod ") {
-                ("module", rest)
             } else {
-                return None;
+                let rest = trimmed.strip_prefix("mod ")?;
+                ("module", rest)
             };
             let target = rest
                 .trim_end_matches(';')
diff --git a/src/utils/ai_project_planner.rs b/src/utils/ai_project_planner.rs
index d2c25afa..972800e0 100644
--- a/src/utils/ai_project_planner.rs
+++ b/src/utils/ai_project_planner.rs
@@ -517,7 +517,7 @@ pub fn estimate_timeline(tasks: &[TaskItem], phases: &[DevelopmentPhase]) -> Tim
     let milestones = phases
         .iter()
         .scan(start, |cursor, phase| {
-            *cursor = *cursor + Duration::days(phase.estimated_days as i64);
+            *cursor += Duration::days(phase.estimated_days as i64);
             Some(Milestone {
                 name: phase.name.clone(),
                 date: *cursor,
diff --git a/src/utils/ai_property_testing.rs b/src/utils/ai_property_testing.rs
index 63de29ba..f77f65fa 100644
--- a/src/utils/ai_property_testing.rs
+++ b/src/utils/ai_property_testing.rs
@@ -9,8 +9,6 @@
 
 use anyhow::{Context, Result};
 use serde::{Deserialize, Serialize};
-use std::collections::HashMap;
-use std::path::Path;
 
 use crate::utils::ai_test_assistant as ata;
 
@@ -150,7 +148,7 @@ pub fn discover_properties(source_code: &str) -> Result<Vec<DiscoveredProperty>>
                 ),
                 property_type: PropertyType::Postcondition,
                 target_function: Some(func.name.clone()),
-                invariants: vec![format!("result is not panic")],
+                invariants: vec!["result is not panic".to_string()],
                 confidence: 0.9,
             });
         }
@@ -385,7 +383,7 @@ fn generate_test_code_for_property(
     include_shrink: bool,
 ) -> String {
     let shrink_section = if include_shrink {
-        format!("\n    // Shrink strategy: minimize counterexample to smallest failing input")
+        "\n    // Shrink strategy: minimize counterexample to smallest failing input".to_string()
     } else {
         String::new()
     };
@@ -395,7 +393,7 @@ fn generate_test_code_for_property(
         .filter(|inv| {
             prop.target_function
                 .as_ref()
-                .map_or(false, |f| inv.functions_affected.contains(f))
+                .is_some_and(|f| inv.functions_affected.contains(f))
         })
         .map(|inv| format!("    // Invariant: {} — {}", inv.name, inv.expression))
         .collect();
diff --git a/src/utils/ai_rate_limiter.rs b/src/utils/ai_rate_limiter.rs
index 2f73955c..e947400c 100644
--- a/src/utils/ai_rate_limiter.rs
+++ b/src/utils/ai_rate_limiter.rs
@@ -262,7 +262,7 @@ impl AIRateLimiter {
             }
 
             queue.push(request);
-            queue.sort_by(|a, b| b.priority.cmp(&a.priority));
+            queue.sort_by_key(|a| std::cmp::Reverse(a.priority));
             metrics.queued_requests += 1;
 
             drop(queue);
diff --git a/src/utils/ai_recommendations.rs b/src/utils/ai_recommendations.rs
index 7aff6787..7a372bda 100644
--- a/src/utils/ai_recommendations.rs
+++ b/src/utils/ai_recommendations.rs
@@ -6,11 +6,9 @@
 //! - Priority-ranked recommendations
 //! - Implementation guidance for each recommendation
 
-use anyhow::{Context, Result};
+use anyhow::Result;
 use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
-use std::fs;
-use std::path::Path;
 
 use crate::utils::ai_test_assistant as ata;
 
diff --git a/src/utils/ai_refactor.rs b/src/utils/ai_refactor.rs
index b7642104..5eb47a64 100644
--- a/src/utils/ai_refactor.rs
+++ b/src/utils/ai_refactor.rs
@@ -350,7 +350,7 @@ pub async fn handle(cmd: RefactorCommands) -> Result<()> {
             handle_refactor(
                 &file,
                 &model,
-                &name.as_deref().unwrap_or("extracted"),
+                name.as_deref().unwrap_or("extracted"),
                 TaskType::ExtractFunction,
                 output,
             )
@@ -488,10 +488,7 @@ async fn handle_refactor(
     let session_id = format!(
         "refactor-{}-{}",
         Utc::now().format("%Y%m%d-%H%M%S"),
-        sha256::hash(&refactored)
-            .chars()
-            .take(8)
-            .collect::<String>()
+        sha256::hash(refactored).chars().take(8).collect::<String>()
     );
 
     // Save session for tracking/rollback
diff --git a/src/utils/ai_search.rs b/src/utils/ai_search.rs
index b14dd8b1..6843d077 100644
--- a/src/utils/ai_search.rs
+++ b/src/utils/ai_search.rs
@@ -6,14 +6,11 @@
 //! - Pattern discovery and similar code finding
 //! - Usage example generation and recommendation
 
-use anyhow::{Context, Result};
+use anyhow::Result;
 use serde::{Deserialize, Serialize};
-use std::collections::HashMap;
 use std::fs;
 use std::path::{Path, PathBuf};
 
-use crate::utils::pattern_library::{self, PatternCategory};
-
 // ── Types ────────────────────────────────────────────────────────────────────
 
 /// A code search result with relevance scoring.
@@ -129,6 +126,9 @@ struct IndexEntry {
     content: String,
     tokens: Vec<String>,
     is_test: bool,
+    // Not currently called from any code path in this crate. Kept rather than
+    // removed since deleting it is a product decision, not a lint-scoping one.
+    #[allow(dead_code)]
     is_contract: bool,
 }
 
@@ -185,7 +185,7 @@ fn find_rust_files(dir: &Path) -> Result<Vec<PathBuf>> {
                 {
                     files.extend(find_rust_files(&path)?);
                 }
-            } else if path.extension().map_or(false, |e| e == "rs") {
+            } else if path.extension().is_some_and(|e| e == "rs") {
                 files.push(path);
             }
         }
@@ -496,7 +496,6 @@ Return JSON with patterns, anti_patterns, missing_patterns, and refactoring_sugg
 #[cfg(test)]
 mod tests {
     use super::*;
-    use std::fs;
 
     #[test]
     fn test_extract_function_name() {
diff --git a/src/utils/ai_template_testing.rs b/src/utils/ai_template_testing.rs
index eafcc947..4328fe5a 100644
--- a/src/utils/ai_template_testing.rs
+++ b/src/utils/ai_template_testing.rs
@@ -819,27 +819,30 @@ fn analyze_security_patterns(content: &str, file_name: &str, findings: &mut Vec<
 
         if is_pub || is_priv {
             // Process previous function
-            if in_pub_fn && fn_has_state_write && !fn_has_require_auth {
-                if current_fn != "initialize" && current_fn != "init" {
-                    findings.push(TestFinding {
-                        category: FindingCategory::Security,
-                        severity: Severity::High,
-                        title: format!(
-                            "Function '{}' writes state without require_auth()",
-                            current_fn
-                        ),
-                        description: format!(
-                            "Function '{}' modifies contract state but does not call require_auth(). \
-                             This may allow unauthorized state changes.",
-                            current_fn
-                        ),
-                        file: Some(file_name.to_string()),
-                        line: Some(fn_line),
-                        suggestion: Some(
-                            "Add caller.require_auth() or equivalent authorization check before state mutations.".to_string(),
-                        ),
-                    });
-                }
+            if in_pub_fn
+                && fn_has_state_write
+                && !fn_has_require_auth
+                && current_fn != "initialize"
+                && current_fn != "init"
+            {
+                findings.push(TestFinding {
+                    category: FindingCategory::Security,
+                    severity: Severity::High,
+                    title: format!(
+                        "Function '{}' writes state without require_auth()",
+                        current_fn
+                    ),
+                    description: format!(
+                        "Function '{}' modifies contract state but does not call require_auth(). \
+                         This may allow unauthorized state changes.",
+                        current_fn
+                    ),
+                    file: Some(file_name.to_string()),
+                    line: Some(fn_line),
+                    suggestion: Some(
+                        "Add caller.require_auth() or equivalent authorization check before state mutations.".to_string(),
+                    ),
+                });
             }
 
             if is_pub {
@@ -875,24 +878,27 @@ fn analyze_security_patterns(content: &str, file_name: &str, findings: &mut Vec<
     }
 
     // Check last function
-    if in_pub_fn && fn_has_state_write && !fn_has_require_auth {
-        if current_fn != "initialize" && current_fn != "init" {
-            findings.push(TestFinding {
-                category: FindingCategory::Security,
-                severity: Severity::High,
-                title: format!(
-                    "Function '{}' writes state without require_auth()",
-                    current_fn
-                ),
-                description: format!(
-                    "Function '{}' modifies contract state but does not call require_auth().",
-                    current_fn
-                ),
-                file: Some(file_name.to_string()),
-                line: Some(fn_line),
-                suggestion: Some("Add caller.require_auth() before state mutations.".to_string()),
-            });
-        }
+    if in_pub_fn
+        && fn_has_state_write
+        && !fn_has_require_auth
+        && current_fn != "initialize"
+        && current_fn != "init"
+    {
+        findings.push(TestFinding {
+            category: FindingCategory::Security,
+            severity: Severity::High,
+            title: format!(
+                "Function '{}' writes state without require_auth()",
+                current_fn
+            ),
+            description: format!(
+                "Function '{}' modifies contract state but does not call require_auth().",
+                current_fn
+            ),
+            file: Some(file_name.to_string()),
+            line: Some(fn_line),
+            suggestion: Some("Add caller.require_auth() before state mutations.".to_string()),
+        });
     }
 
     // Check for reentrancy patterns
diff --git a/src/utils/ai_test_analytics.rs b/src/utils/ai_test_analytics.rs
index 158a5177..123a39f9 100644
--- a/src/utils/ai_test_analytics.rs
+++ b/src/utils/ai_test_analytics.rs
@@ -66,6 +66,12 @@ pub struct TestAnalyticsService {
     analytics: Arc<RwLock<TestAnalyticsData>>,
 }
 
+impl Default for TestAnalyticsService {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
 impl TestAnalyticsService {
     pub fn new() -> Self {
         TestAnalyticsService {
diff --git a/src/utils/ai_test_assistant.rs b/src/utils/ai_test_assistant.rs
index 9b787f6c..f65d9af1 100644
--- a/src/utils/ai_test_assistant.rs
+++ b/src/utils/ai_test_assistant.rs
@@ -1,6 +1,5 @@
 use anyhow::{Context, Result};
 use serde::{Deserialize, Serialize};
-use std::collections::HashMap;
 use std::fs;
 use std::path::{Path, PathBuf};
 
@@ -479,12 +478,11 @@ pub struct ParamInfo {
 
 fn extract_functions_with_signatures(source: &str) -> Vec<FunctionInfo> {
     let mut functions = Vec::new();
-    let mut current_line = 1u32;
     let mut in_function = false;
     let mut brace_depth = 0u32;
     let mut body_lines: Vec<&str> = Vec::new();
 
-    for line in source.lines() {
+    for (current_line, line) in (1u32..).zip(source.lines()) {
         let trimmed = line.trim();
 
         if !in_function {
@@ -522,7 +520,6 @@ fn extract_functions_with_signatures(source: &str) -> Vec<FunctionInfo> {
                 in_function = false;
             }
         }
-        current_line += 1;
     }
     functions
 }
@@ -700,7 +697,7 @@ pub fn generate_test_priorities(analysis: &ContractAnalysis) -> Vec<TestPriority
         } else if func.is_mutating {
             TestPriority::High
         } else if func.complexity_score > 5 {
-            TestPriority::High
+            TestPriority::Medium
         } else {
             TestPriority::Low
         };
@@ -1271,7 +1268,7 @@ pub fn find_test_files(project_path: &Path) -> Vec<PathBuf> {
         if let Ok(entries) = fs::read_dir(&tests_dir) {
             for entry in entries.flatten() {
                 let path = entry.path();
-                if path.extension().map_or(false, |ext| ext == "rs") {
+                if path.extension().is_some_and(|ext| ext == "rs") {
                     test_files.push(path);
                 }
             }
@@ -1284,7 +1281,7 @@ pub fn find_test_files(project_path: &Path) -> Vec<PathBuf> {
         if let Ok(entries) = fs::read_dir(&src_dir) {
             for entry in entries.flatten() {
                 let path = entry.path();
-                if path.extension().map_or(false, |ext| ext == "rs") {
+                if path.extension().is_some_and(|ext| ext == "rs") {
                     if let Ok(content) = fs::read_to_string(&path) {
                         if content.contains("#[cfg(test)]") {
                             test_files.push(path);
diff --git a/src/utils/ai_test_generator.rs b/src/utils/ai_test_generator.rs
index 9ee7f4f3..59185351 100644
--- a/src/utils/ai_test_generator.rs
+++ b/src/utils/ai_test_generator.rs
@@ -7,7 +7,7 @@ use anyhow::{Context, Result};
 use chrono::{DateTime, Utc};
 use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
-use std::path::PathBuf;
+use std::path::{Path, PathBuf};
 use std::sync::Arc;
 use tokio::sync::RwLock;
 
@@ -239,11 +239,7 @@ impl AiTestGenerator {
     }
 
     /// Generate comprehensive test suite
-    pub async fn generate_test_suite(
-        &self,
-        target_file: &PathBuf,
-        code: &str,
-    ) -> Result<TestSuite> {
+    pub async fn generate_test_suite(&self, target_file: &Path, code: &str) -> Result<TestSuite> {
         let start_time = std::time::Instant::now();
 
         let analysis = self.analyze_code(code)?;
@@ -302,7 +298,7 @@ impl AiTestGenerator {
                 "{}_tests",
                 target_file.file_stem().unwrap().to_string_lossy()
             ),
-            target_file: target_file.clone(),
+            target_file: target_file.to_path_buf(),
             tests,
             coverage_estimate,
             generated_at: Utc::now(),
@@ -646,7 +642,7 @@ fn test_{}_regression() {{
             "// Estimated coverage: {:.1}%\n",
             suite.coverage_estimate * 100.0
         ));
-        output.push_str("\n");
+        output.push('\n');
 
         for test in &suite.tests {
             output.push_str(&format!("// {}\n", test.description));
@@ -655,7 +651,7 @@ fn test_{}_regression() {{
                 test.test_type, test.category
             ));
             output.push_str(&test.code);
-            output.push_str("\n");
+            output.push('\n');
         }
 
         std::fs::write(output_path, output).context("Failed to write test suite file")?;
diff --git a/src/utils/ai_tutorial.rs b/src/utils/ai_tutorial.rs
index 7dfa2f45..4709eb00 100644
--- a/src/utils/ai_tutorial.rs
+++ b/src/utils/ai_tutorial.rs
@@ -9,7 +9,6 @@ use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
 use std::sync::Arc;
 use tokio::sync::RwLock;
-use uuid::Uuid;
 
 /// User skill level assessment
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
@@ -339,10 +338,11 @@ impl TutorialManager {
 
         for topic in learning_path {
             for tutorial in tutorials.values() {
-                if tutorial.topic == topic && !progress.completed_tutorials.contains(&tutorial.id) {
-                    if tutorial.difficulty.clone() as i32 <= skill_level.clone() as i32 + 1 {
-                        recommended.push(tutorial.clone());
-                    }
+                if tutorial.topic == topic
+                    && !progress.completed_tutorials.contains(&tutorial.id)
+                    && tutorial.difficulty.clone() as i32 <= skill_level.clone() as i32 + 1
+                {
+                    recommended.push(tutorial.clone());
                 }
             }
         }
@@ -496,7 +496,7 @@ impl TutorialManager {
                     answer
                         .parse::<usize>()
                         .ok()
-                        .map_or(false, |idx| idx < options.len())
+                        .is_some_and(|idx| idx < options.len())
                 }
             }
             ExerciseType::CommandExecution => {
diff --git a/src/utils/ai_validation.rs b/src/utils/ai_validation.rs
index 55b6f347..0967b27c 100644
--- a/src/utils/ai_validation.rs
+++ b/src/utils/ai_validation.rs
@@ -1,6 +1,5 @@
-use anyhow::{Context, Result};
+use anyhow::Result;
 use serde::{Deserialize, Serialize};
-use std::collections::HashMap;
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct ValidationResult {
diff --git a/src/utils/approval_engine.rs b/src/utils/approval_engine.rs
index 624d5939..819c7cd8 100644
--- a/src/utils/approval_engine.rs
+++ b/src/utils/approval_engine.rs
@@ -223,6 +223,10 @@ pub fn deactivate_workflow(id: &str) -> Result<()> {
     }
 }
 
+// Each parameter is an independent, named input (CLI flags / distinct config
+// values); bundling them into a struct here would add indirection without
+// reducing real complexity.
+#[allow(clippy::too_many_arguments)]
 pub fn create_request(
     workflow_id: &str,
     contract_id: &str,
diff --git a/src/utils/audit.rs b/src/utils/audit.rs
index d8181424..ffeded0f 100644
--- a/src/utils/audit.rs
+++ b/src/utils/audit.rs
@@ -152,12 +152,12 @@ pub fn get_audit_report(start_time: Option<&str>, end_time: Option<&str>) -> Res
         .iter()
         .filter(|e| {
             if let Some(start) = start_time {
-                if e.timestamp < start.to_string() {
+                if e.timestamp.as_str() < start {
                     return false;
                 }
             }
             if let Some(end) = end_time {
-                if e.timestamp > end.to_string() {
+                if e.timestamp.as_str() > end {
                     return false;
                 }
             }
@@ -208,6 +208,10 @@ pub fn export_audit_log_csv(entries: &[AuditEntry]) -> String {
     csv
 }
 
+// Each parameter is an independent, named input (CLI flags / distinct config
+// values); bundling them into a struct here would add indirection without
+// reducing real complexity.
+#[allow(clippy::too_many_arguments)]
 pub fn log_approval_action(
     action: &str,
     actor: &str,
diff --git a/src/utils/bindings.rs b/src/utils/bindings.rs
index 586fe89c..064573a9 100644
--- a/src/utils/bindings.rs
+++ b/src/utils/bindings.rs
@@ -3,7 +3,7 @@ use std::io::Cursor;
 use std::path::Path;
 use stellar_xdr::curr::{
     Limited, Limits, ReadXdr, ScSpecEntry, ScSpecFunctionV0, ScSpecTypeDef, ScSpecUdtEnumV0,
-    ScSpecUdtStructV0, ScSpecUdtUnionV0,
+    ScSpecUdtStructV0,
 };
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
diff --git a/src/utils/bridge/providers.rs b/src/utils/bridge/providers.rs
index 5a35a857..71b09496 100644
--- a/src/utils/bridge/providers.rs
+++ b/src/utils/bridge/providers.rs
@@ -81,7 +81,7 @@ pub fn default_providers() -> Vec<BridgeProvider> {
 
 /// Initiate a cross-chain transfer through the configured provider.
 pub fn initiate_transfer(
-    provider: &BridgeProvider,
+    _provider: &BridgeProvider,
     request: &BridgeTransferRequest,
 ) -> anyhow::Result<BridgeTransferResult> {
     let transfer_id = uuid::Uuid::new_v4().to_string();
diff --git a/src/utils/compliance.rs b/src/utils/compliance.rs
index 0a5bb76e..2fb14692 100644
--- a/src/utils/compliance.rs
+++ b/src/utils/compliance.rs
@@ -401,7 +401,7 @@ pub fn run_compliance_checks(
                     policy_name: policy.name.clone(),
                     passed: regulatory_checks.iter().all(|r| r.passed),
                     severity: policy.severity.clone(),
-                    message: format!("Regulatory compliance check complete"),
+                    message: "Regulatory compliance check complete".to_string(),
                 }
             }
             PolicyType::SecurityCompliance => {
@@ -852,7 +852,7 @@ fn check_gdpr_compliance(network: &str, _contract_id: &str) -> Vec<RegulatoryChe
     ]
 }
 
-fn check_soc2_compliance(network: &str, _contract_id: &str) -> Vec<RegulatoryCheck> {
+fn check_soc2_compliance(_network: &str, _contract_id: &str) -> Vec<RegulatoryCheck> {
     vec![
         RegulatoryCheck {
             framework: RegulatoryFramework::Soc2,
@@ -1296,9 +1296,7 @@ pub fn perform_risk_assessment(
     // Determine risk level. A blocking policy violation is a hard stop
     // regardless of the averaged score, consistent with `approved_for_deployment`
     // below also refusing deployment whenever one is present.
-    let overall_level = if failed_blocking > 0 {
-        RiskLevel::Critical
-    } else if overall_score >= 70 {
+    let overall_level = if failed_blocking > 0 || overall_score >= 70 {
         RiskLevel::Critical
     } else if overall_score >= 50 {
         RiskLevel::High
@@ -1495,7 +1493,7 @@ pub fn export_report_csv(report: &ComplianceReport) -> String {
             csv_escape("policy"),
             csv_escape(&check.policy_id),
             csv_escape(&check.policy_name),
-            csv_escape(&check.passed),
+            csv_escape(check.passed),
             csv_escape(&check.severity),
             csv_escape(&check.message),
         ));
@@ -1506,7 +1504,7 @@ pub fn export_report_csv(report: &ComplianceReport) -> String {
             csv_escape("regulatory"),
             csv_escape(""),
             csv_escape(&check.requirement),
-            csv_escape(&check.passed),
+            csv_escape(check.passed),
             csv_escape(&check.severity),
             csv_escape(&check.message),
             csv_escape(&check.framework),
@@ -1518,7 +1516,7 @@ pub fn export_report_csv(report: &ComplianceReport) -> String {
             csv_escape("best_practice"),
             csv_escape(""),
             csv_escape(&practice.check),
-            csv_escape(&practice.passed),
+            csv_escape(practice.passed),
             csv_escape(&practice.severity),
             csv_escape(&practice.recommendation),
             csv_escape(&practice.category),
@@ -1535,6 +1533,9 @@ pub fn export_report_json(report: &ComplianceReport) -> Result<String> {
 // Default policy initialization
 // ────────────────────────────────────────────────
 
+// Eight multi-line `create_policy(...)?` calls read far more clearly as
+// sequential pushes than as one giant `vec![]` literal.
+#[allow(clippy::vec_init_then_push)]
 pub fn build_default_policies() -> Result<Vec<CompliancePolicy>> {
     let existing = load_policies_raw()?;
     if !existing.is_empty() {
diff --git a/src/utils/config.rs b/src/utils/config.rs
index 15068cde..e5780e16 100644
--- a/src/utils/config.rs
+++ b/src/utils/config.rs
@@ -1108,7 +1108,12 @@ fn unique_temp_path(dir: &std::path::Path) -> PathBuf {
         .duration_since(std::time::UNIX_EPOCH)
         .map(|d| d.as_nanos())
         .unwrap_or(0);
-    dir.join(format!(".starforge-{}-{}-{}.tmp", std::process::id(), nanos, n))
+    dir.join(format!(
+        ".starforge-{}-{}-{}.tmp",
+        std::process::id(),
+        nanos,
+        n
+    ))
 }
 
 /// Rename `source` over `target`.
@@ -1170,7 +1175,9 @@ fn write_config_backup(config: &Config) -> Result<std::path::PathBuf> {
     Ok(backup_path)
 }
 
-// Keep the old name so `rollback_config` still compiles.
+// Not currently called from any code path in this crate. Kept rather than
+// removed since deleting it is a product decision, not a lint-scoping one.
+#[allow(dead_code)]
 fn backup_config(config: &Config) -> Result<()> {
     write_config_backup(config).map(|_| ())
 }
@@ -1209,7 +1216,7 @@ pub fn rollback_config(version: &str) -> Result<()> {
 }
 
 thread_local! {
-    static TEST_CONFIG_DIR_OVERRIDE: std::cell::RefCell<Option<PathBuf>> = std::cell::RefCell::new(None);
+    static TEST_CONFIG_DIR_OVERRIDE: std::cell::RefCell<Option<PathBuf>> = const { std::cell::RefCell::new(None) };
 }
 
 pub fn set_test_config_dir(path: PathBuf) {
@@ -1745,7 +1752,10 @@ telemetry_enabled = true
             .filter_map(|entry| entry.ok())
             .filter(|entry| entry.file_name().to_string_lossy().ends_with(".tmp"))
             .collect();
-        assert!(leftovers.is_empty(), "stray tmp files left behind: {leftovers:?}");
+        assert!(
+            leftovers.is_empty(),
+            "stray tmp files left behind: {leftovers:?}"
+        );
     }
 
     #[test]
diff --git a/src/utils/context_help.rs b/src/utils/context_help.rs
index 7a48abec..50e650aa 100644
--- a/src/utils/context_help.rs
+++ b/src/utils/context_help.rs
@@ -29,9 +29,10 @@ use crate::utils::history::HistoryEntry;
 // ── Public types ──────────────────────────────────────────────────────────────
 
 /// A coarse expertise tier used to tune tip verbosity.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
 pub enum Expertise {
     /// Few or no prior commands in this area — keep tips short and concrete.
+    #[default]
     Beginner,
     /// Some prior commands — surface intermediate tips and best practices.
     Intermediate,
@@ -39,12 +40,6 @@ pub enum Expertise {
     Advanced,
 }
 
-impl Default for Expertise {
-    fn default() -> Self {
-        Expertise::Beginner
-    }
-}
-
 impl Expertise {
     /// Lower-case label for printing in headers.
     pub fn label(self) -> &'static str {
@@ -78,13 +73,13 @@ pub struct HelpContext<'a> {
 impl<'a> HelpContext<'a> {
     /// True when category `cat` should be considered enabled.
     pub fn category_enabled(&self, cat: &str) -> bool {
-        if self.disabled_categories.iter().any(|c| *c == cat) {
+        if self.disabled_categories.contains(&cat) {
             return false;
         }
         if self.enabled_categories.is_empty() {
             true
         } else {
-            self.enabled_categories.iter().any(|c| *c == cat)
+            self.enabled_categories.contains(&cat)
         }
     }
 }
@@ -397,7 +392,7 @@ pub const PROACTIVE_BLOCKLIST: &[&str] = &["help", "info", "completions", "versi
 /// worth saying OR if the command is on the [[PROACTIVE_BLOCKLIST]].
 pub fn proactive_tip(command: &str, history: &[HistoryEntry]) -> Option<String> {
     let cmd = command.trim().to_lowercase();
-    if PROACTIVE_BLOCKLIST.iter().any(|c| *c == cmd.as_str()) {
+    if PROACTIVE_BLOCKLIST.contains(&cmd.as_str()) {
         return None;
     }
 
diff --git a/src/utils/contract_assertions.rs b/src/utils/contract_assertions.rs
index dfb5488d..8005c3b9 100644
--- a/src/utils/contract_assertions.rs
+++ b/src/utils/contract_assertions.rs
@@ -197,7 +197,7 @@ pub fn assert_storage_numeric(
     let actual = match actual_val
         .as_i64()
         .map(i128::from)
-        .or_else(|| actual_val.as_u64().map(|u| i128::from(u)))
+        .or_else(|| actual_val.as_u64().map(i128::from))
     {
         Some(n) => n,
         None => {
@@ -541,7 +541,7 @@ impl<'a> ContractAssertions<'a> {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::utils::contract_mocks::{counter_env, token_env, MockAddress, MockEvent};
+    use crate::utils::contract_mocks::{counter_env, token_env, MockAddress};
 
     #[test]
     fn storage_eq_passes() {
diff --git a/src/utils/contract_deps.rs b/src/utils/contract_deps.rs
index 9d50cf8f..d6b634f7 100644
--- a/src/utils/contract_deps.rs
+++ b/src/utils/contract_deps.rs
@@ -3,7 +3,7 @@ use semver::VersionReq;
 use serde::{Deserialize, Serialize};
 use std::collections::{HashMap, HashSet};
 use std::fs;
-use std::path::{Path, PathBuf};
+use std::path::Path;
 
 #[derive(Debug, Clone, Serialize, Deserialize, Default)]
 pub struct ContractDependencies {
diff --git a/src/utils/contract_health_monitor.rs b/src/utils/contract_health_monitor.rs
index 16a1da1f..663b1fda 100644
--- a/src/utils/contract_health_monitor.rs
+++ b/src/utils/contract_health_monitor.rs
@@ -134,8 +134,7 @@ fn run_health_probes(contract_id: &str, network: &str) -> Vec<HealthProbe> {
     let last_deploy = deploy_history::load_history()
         .unwrap_or_default()
         .into_iter()
-        .filter(|r| r.contract_id.as_deref() == Some(contract_id) && r.network == network)
-        .last();
+        .rfind(|r| r.contract_id.as_deref() == Some(contract_id) && r.network == network);
     let (deploy_status, deploy_msg) = match &last_deploy {
         Some(r) if r.status == deploy_history::DeployStatus::Success => (
             ContractHealthStatus::Healthy,
diff --git a/src/utils/contract_test_framework.rs b/src/utils/contract_test_framework.rs
index 2587fb66..655f5c4b 100644
--- a/src/utils/contract_test_framework.rs
+++ b/src/utils/contract_test_framework.rs
@@ -1,20 +1,16 @@
 use crate::utils::{
     contract_assertions::{
-        assert_balance_eq, assert_error_contains, assert_event_emitted, assert_event_not_emitted,
-        assert_ok, assert_return_value, assert_storage_eq, AssertionResult, AssertionStatus,
-        AssertionSuite, ContractAssertions,
+        assert_error_contains, assert_return_value, AssertionSuite, ContractAssertions,
     },
-    contract_fixtures::{ContractFixture, FixtureContext, FixtureRegistry},
+    contract_fixtures::{ContractFixture, FixtureContext},
     contract_mocks::{MockAddress, MockContractClient, MockEnvironment, StorageKey},
     contract_test_runner::{ContractTestRunner, TestRunConfig, TestRunSummary},
     testnet_integration::{
-        run_connectivity_smoke_test, SorobanNetwork, TestnetConfig, TestnetSession,
-        TestnetTestReport, TestnetTestResult,
+        run_connectivity_smoke_test, TestnetConfig, TestnetSession, TestnetTestReport,
     },
 };
 use anyhow::{Context, Result};
 use serde::{Deserialize, Serialize};
-use std::collections::HashMap;
 use std::fs;
 use std::path::{Path, PathBuf};
 use std::time::Instant;
@@ -220,10 +216,8 @@ impl FrameworkTestSuite {
         let suite_start = Instant::now();
 
         // Setup fixture
-        let fixture_ctx: Option<FixtureContext> = self
-            .fixture
-            .as_mut()
-            .and_then(|f| f.setup().ok().map(|ctx| ctx.clone()));
+        let fixture_ctx: Option<FixtureContext> =
+            self.fixture.as_mut().and_then(|f| f.setup().ok().cloned());
 
         let mut results = Vec::new();
         for case in &self.cases {
@@ -231,7 +225,7 @@ impl FrameworkTestSuite {
 
             // Seed environment from fixture context
             if let Some(ref ctx) = fixture_ctx {
-                for (key, seed) in &ctx.storage {
+                for seed in ctx.storage.values() {
                     env.storage.set(
                         StorageKey {
                             scope: format!("{:?}", seed.durability).to_lowercase(),
@@ -240,7 +234,7 @@ impl FrameworkTestSuite {
                         seed.value.clone(),
                     );
                 }
-                for (_, account) in &ctx.accounts {
+                for account in ctx.accounts.values() {
                     env.auth
                         .auto_approve(MockAddress::new(account.address.clone()));
                 }
@@ -613,7 +607,7 @@ fn render_junit_report(result: &FrameworkRunResult) -> String {
 /// Standard test cases for any counter-style contract.
 pub fn counter_test_suite() -> FrameworkTestSuite {
     use crate::utils::contract_fixtures::counter_fixture;
-    use crate::utils::contract_mocks::{counter_env, MockAddress};
+    use crate::utils::contract_mocks::MockAddress;
 
     let mut suite = FrameworkTestSuite::new("counter").with_fixture(counter_fixture());
 
diff --git a/src/utils/contract_versioning.rs b/src/utils/contract_versioning.rs
index 17afa099..d08fa586 100644
--- a/src/utils/contract_versioning.rs
+++ b/src/utils/contract_versioning.rs
@@ -388,8 +388,8 @@ fn comparator_interval(c: &Comparator) -> Interval {
                 inclusive: true,
             }),
             upper: Some(Bound {
-                value: if c.minor.is_some() {
-                    Version::new(c.major, c.minor.unwrap() + 1, 0)
+                value: if let Some(minor) = c.minor {
+                    Version::new(c.major, minor + 1, 0)
                 } else {
                     Version::new(c.major + 1, 0, 0)
                 },
diff --git a/src/utils/cost_management.rs b/src/utils/cost_management.rs
index b4b1f313..2311d229 100644
--- a/src/utils/cost_management.rs
+++ b/src/utils/cost_management.rs
@@ -412,7 +412,7 @@ pub fn compare_networks(
             adjusted_total_xlm: adjusted as f64 / 10_000_000.0,
         });
     }
-    results.sort_by(|a, b| a.adjusted_total_stroops.cmp(&b.adjusted_total_stroops));
+    results.sort_by_key(|a| a.adjusted_total_stroops);
     Ok(results)
 }
 
diff --git a/src/utils/crypto.rs b/src/utils/crypto.rs
index c7de7c21..a1133cda 100644
--- a/src/utils/crypto.rs
+++ b/src/utils/crypto.rs
@@ -445,7 +445,10 @@ fn argon2_from_params(params: &Params) -> Argon2<'_> {
     Argon2::from(params.clone())
 }
 
-fn parse_encrypted_bundle(bundle: &str) -> Result<(Vec<u8>, Vec<u8>, Vec<u8>, Option<KdfOptions>)> {
+/// (salt, nonce, ciphertext, KDF params if the bundle encodes non-default ones)
+type EncryptedBundle = (Vec<u8>, Vec<u8>, Vec<u8>, Option<KdfOptions>);
+
+fn parse_encrypted_bundle(bundle: &str) -> Result<EncryptedBundle> {
     let parts: Vec<&str> = bundle.split(':').collect();
     if parts.is_empty() {
         anyhow::bail!("Invalid encrypted bundle: empty string");
diff --git a/src/utils/database.rs b/src/utils/database.rs
index 3f4b6789..33c1ea0f 100644
--- a/src/utils/database.rs
+++ b/src/utils/database.rs
@@ -3,7 +3,6 @@ use rusqlite::{params, Connection, OptionalExtension};
 use serde::{Deserialize, Serialize};
 use sha2::{Digest, Sha256};
 use std::path::PathBuf;
-use std::sync::Arc;
 
 pub fn db_path() -> PathBuf {
     crate::utils::config::config_dir().join("starforge.db")
@@ -47,50 +46,31 @@ pub struct MigrationResult {
     pub migrations_rolled_back: Vec<i64>,
 }
 
-use std::fmt;
-
-#[derive(Debug, Clone, PartialEq, Eq)]
+/// Error types for migration operations
+#[derive(Debug, Clone, PartialEq, Eq, thiserror::Error)]
 pub enum MigrationError {
+    #[error("Migration version {0} is already applied")]
     AlreadyApplied(i64),
+
+    #[error("Migration version {0} not found")]
     NotFound(i64),
+
+    #[error("Cannot rollback: no migrations applied")]
     NothingToRollback,
+
+    #[error("Migration version {0} depends on unapplied version {1}")]
     MissingDependency(i64, i64),
+
+    #[error("Invalid migration sequence: versions must be consecutive")]
     InvalidSequence,
+
+    #[error("Database schema version {0} is not supported (minimum: {1}, maximum: {2})")]
     UnsupportedVersion(i64, i64, i64),
-    MigrationFailed(String),
-}
 
-impl fmt::Display for MigrationError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            Self::AlreadyApplied(v) => write!(f, "Migration version {v} is already applied"),
-            Self::NotFound(v) => write!(f, "Migration version {v} not found"),
-            Self::NothingToRollback => write!(f, "Cannot rollback: no migrations applied"),
-            Self::MissingDependency(v, dep) => {
-                write!(
-                    f,
-                    "Migration version {v} depends on unapplied version {dep}"
-                )
-            }
-            Self::InvalidSequence => {
-                write!(
-                    f,
-                    "Invalid migration sequence: versions must be consecutive"
-                )
-            }
-            Self::UnsupportedVersion(v, min, max) => {
-                write!(
-                    f,
-                    "Database schema version {v} is not supported (minimum: {min}, maximum: {max})"
-                )
-            }
-            Self::MigrationFailed(msg) => write!(f, "Migration failed: {msg}"),
-        }
-    }
+    #[error("Migration failed: {0}")]
+    MigrationFailed(String),
 }
 
-impl std::error::Error for MigrationError {}
-
 pub struct Database {
     pub(crate) conn: Connection,
 }
@@ -217,6 +197,9 @@ impl Database {
     }
 
     /// Remove a migration record from the database
+    // Not currently called from any code path in this crate. Kept rather than
+    // removed since deleting it is a product decision, not a lint-scoping one.
+    #[allow(dead_code)]
     fn remove_migration(&self, version: i64) -> Result<()> {
         self.conn.execute(
             "DELETE FROM schema_migrations WHERE version = ?1",
@@ -302,7 +285,7 @@ impl Database {
     /// Rollback a single migration within a transaction
     pub fn rollback_migration(&self, version: i64) -> Result<()> {
         let applied = self.get_applied_migrations()?;
-        let current_version = self.get_current_schema_version()?;
+        let _current_version = self.get_current_schema_version()?;
 
         // Migrations roll back newest first, so anything below the newest
         // applied version is refused on that ground — whether or not it was
@@ -952,7 +935,7 @@ impl Database {
             }
             ExportFormat::Csv => {
                 let mut wtr = csv::Writer::from_writer(writer);
-                wtr.write_record(&[
+                wtr.write_record([
                     "id",
                     "event_type",
                     "contract_id",
@@ -963,7 +946,7 @@ impl Database {
                     "network",
                 ])?;
                 for event in events {
-                    wtr.write_record(&[
+                    wtr.write_record([
                         &event.id,
                         &event.event_type,
                         &event.contract_id,
@@ -1211,7 +1194,7 @@ impl Migration for MigrationV1 {
         "initial_schema"
     }
 
-    fn up(&self, conn: &Connection) -> Result<()> {
+    fn up(&self, _conn: &Connection) -> Result<()> {
         // This is a no-op since the initial schema is already applied in SCHEMA
         Ok(())
     }
@@ -1428,7 +1411,6 @@ mod tests {
         // Try to rollback a migration that isn't the latest
         let result = db.rollback_migration(0);
         assert!(result.is_err());
-        assert!(result.is_err());
     }
 
     #[test]
diff --git a/src/utils/debugger.rs b/src/utils/debugger.rs
index 28fdcd16..f10fbb3c 100644
--- a/src/utils/debugger.rs
+++ b/src/utils/debugger.rs
@@ -195,6 +195,9 @@ impl Debugger {
         None
     }
 
+    // Not currently called from any code path in this crate. Kept rather than
+    // removed since deleting it is a product decision, not a lint-scoping one.
+    #[allow(dead_code)]
     fn evaluate_condition(&self, _condition: &str) -> bool {
         true
     }
diff --git a/src/utils/deployment_automation.rs b/src/utils/deployment_automation.rs
index 56895d6f..94c7c912 100644
--- a/src/utils/deployment_automation.rs
+++ b/src/utils/deployment_automation.rs
@@ -417,7 +417,7 @@ pub struct AutomatedTestRunner;
 
 impl AutomatedTestRunner {
     /// Run automated tests on the contract.
-    pub fn run_tests(wasm_path: &str) -> Result<AutomatedTestingResult> {
+    pub fn run_tests(_wasm_path: &str) -> Result<AutomatedTestingResult> {
         // Simulated test results
         let test_results = vec![
             TestResult {
@@ -476,7 +476,7 @@ impl DeploymentExecutor {
             status: "success".to_string(),
             contract_id: Some(format!(
                 "C{}",
-                &hex::encode(&sha2::Sha256::digest(&wasm_bytes))[..56]
+                &hex::encode(sha2::Sha256::digest(&wasm_bytes))[..56]
             )),
             transaction_hash: Some(format!("tx_{}", uuid::Uuid::new_v4())),
             gas_used,
diff --git a/src/utils/deployment_checkpoint.rs b/src/utils/deployment_checkpoint.rs
index 4a6262fe..54b5c5f9 100644
--- a/src/utils/deployment_checkpoint.rs
+++ b/src/utils/deployment_checkpoint.rs
@@ -7,7 +7,7 @@ use anyhow::{Context, Result};
 use chrono::Utc;
 use serde::{Deserialize, Serialize};
 use sha2::{Digest, Sha256};
-use std::fs::{self, File, OpenOptions};
+use std::fs::{self, OpenOptions};
 use std::io::Write;
 use std::path::{Path, PathBuf};
 
@@ -253,8 +253,8 @@ impl DeploymentLock {
 
             if let Ok(content) = fs::read_to_string(&lock_path) {
                 for line in content.lines() {
-                    if line.starts_with("PID: ") {
-                        if let Ok(pid) = line["PID: ".len()..].trim().parse::<u32>() {
+                    if let Some(rest) = line.strip_prefix("PID: ") {
+                        if let Ok(pid) = rest.trim().parse::<u32>() {
                             stale_pid = Some(pid);
                             if !is_pid_active(pid) {
                                 is_stale = true;
@@ -266,10 +266,10 @@ impl DeploymentLock {
 
             // Also check lock file modification age (stale if > 10 minutes)
             if let Ok(meta) = fs::metadata(&lock_path) {
-                if let Ok(elapsed) = meta.modified().and_then(|m| {
-                    m.elapsed()
-                        .map_err(|e| std::io::Error::new(std::io::ErrorKind::Other, e))
-                }) {
+                if let Ok(elapsed) = meta
+                    .modified()
+                    .and_then(|m| m.elapsed().map_err(std::io::Error::other))
+                {
                     if elapsed > std::time::Duration::from_secs(600) {
                         is_stale = true;
                     }
diff --git a/src/utils/deployment_monitor.rs b/src/utils/deployment_monitor.rs
index 5c300383..aed3ec6b 100644
--- a/src/utils/deployment_monitor.rs
+++ b/src/utils/deployment_monitor.rs
@@ -137,9 +137,7 @@ pub fn analyze_deployments(
         predictions.push(DeploymentPrediction {
             title: "Rollback risk is increasing".to_string(),
             confidence: 74,
-            detail: format!(
-                "The recent failure pattern suggests a higher chance of another deployment failure in the next rollout.",
-            ),
+            detail: "The recent failure pattern suggests a higher chance of another deployment failure in the next rollout.".to_string(),
             recommended_action: "Prepare a rollback plan, verify the artifact hash, and keep the previous deployment ready for immediate recovery.".to_string(),
         });
     }
@@ -148,9 +146,7 @@ pub fn analyze_deployments(
         predictions.push(DeploymentPrediction {
             title: "Performance degradation is likely".to_string(),
             confidence: 68,
-            detail: format!(
-                "The observed deployment latency trend points to slower execution than the recent baseline.",
-            ),
+            detail: "The observed deployment latency trend points to slower execution than the recent baseline.".to_string(),
             recommended_action: "Trim the deployment payload, validate the wallet setup, and review network congestion before launching the next deployment.".to_string(),
         });
     }
diff --git a/src/utils/deployment_monitoring_service.rs b/src/utils/deployment_monitoring_service.rs
index e2b62ae0..dbd82b5d 100644
--- a/src/utils/deployment_monitoring_service.rs
+++ b/src/utils/deployment_monitoring_service.rs
@@ -1,4 +1,3 @@
-use anyhow::Result;
 use chrono::Utc;
 use colored::*;
 use serde::{Deserialize, Serialize};
diff --git a/src/utils/deployment_timeline.rs b/src/utils/deployment_timeline.rs
index d6c79f98..74854aff 100644
--- a/src/utils/deployment_timeline.rs
+++ b/src/utils/deployment_timeline.rs
@@ -217,14 +217,14 @@ impl DeploymentTimeline {
 
     /// True when any phase is in the failed state.
     pub fn failed(&self) -> bool {
-        self.phases.iter().any(|row| row.state == PhaseState::Failed)
+        self.phases
+            .iter()
+            .any(|row| row.state == PhaseState::Failed)
     }
 
     /// True when every phase is done.
     pub fn finalized(&self) -> bool {
-        self.phases
-            .iter()
-            .all(|row| row.state == PhaseState::Done)
+        self.phases.iter().all(|row| row.state == PhaseState::Done)
     }
 }
 
@@ -249,8 +249,12 @@ pub fn poll_with_retries(
 ) -> Result<TxPollOutcome> {
     let max_retries = max_retries.max(1);
     for attempt in 1..=max_retries {
-        let status = poll(tx_hash)
-            .with_context(|| format!("RPC poll attempt {}/{} failed for hash {}", attempt, max_retries, tx_hash))?;
+        let status = poll(tx_hash).with_context(|| {
+            format!(
+                "RPC poll attempt {}/{} failed for hash {}",
+                attempt, max_retries, tx_hash
+            )
+        })?;
 
         if is_terminal(&status) {
             return Ok(TxPollOutcome {
@@ -345,7 +349,9 @@ fn render_tty(timeline: &DeploymentTimeline, opts: &RenderOptions) -> String {
     out.push_str(&format!(
         "\n  {} {}\n",
         marker,
-        format!("Deployment timeline — {}", timeline.deployment_id).white().bold()
+        format!("Deployment timeline — {}", timeline.deployment_id)
+            .white()
+            .bold()
     ));
     if let Some(hash) = &timeline.tx_hash {
         out.push_str(&format!("  {}\n", format!("tx {}", hash).dimmed()));
@@ -361,7 +367,9 @@ fn render_tty(timeline: &DeploymentTimeline, opts: &RenderOptions) -> String {
     let empty_bar: String = "-".repeat(bar_width - filled).dimmed().to_string();
     out.push_str(&format!(
         "  [{}{}] {:3}%\n",
-        filled_bar, empty_bar, timeline.progress_pct()
+        filled_bar,
+        empty_bar,
+        timeline.progress_pct()
     ));
     out.push_str(&format!("  {}\n", "─".repeat(48).dimmed()));
 
@@ -392,7 +400,11 @@ fn render_tty(timeline: &DeploymentTimeline, opts: &RenderOptions) -> String {
         }
         out.push('\n');
     }
-    out.push_str(&format!("  {} {}\n", "─".repeat(48).dimmed(), opts.correlation_id.dimmed()));
+    out.push_str(&format!(
+        "  {} {}\n",
+        "─".repeat(48).dimmed(),
+        opts.correlation_id.dimmed()
+    ));
     out.push('\n');
     out
 }
@@ -477,7 +489,7 @@ mod tests {
 
     /// Fixture: the poller yields `PENDING` a fixed number of times before
     /// reporting the terminal status.
-    fn pending_then(statuses: &[&str], times: usize) -> PollFn<'_> {
+    fn pending_then<'a>(statuses: &'a [&'a str], times: usize) -> PollFn<'a> {
         let statuses = statuses.to_vec();
         let mut remaining = times;
         Box::new(move |_hash: &str| {
@@ -509,8 +521,14 @@ mod tests {
 
     #[test]
     fn poll_succeeds_on_first_attempt() {
-        let outcome = poll_with_retries("z9", 5, 1, pending_then(&["SUCCESS"], 0), is_terminal_success)
-            .unwrap();
+        let outcome = poll_with_retries(
+            "z9",
+            5,
+            1,
+            pending_then(&["SUCCESS"], 0),
+            is_terminal_success,
+        )
+        .unwrap();
         assert_eq!(outcome.attempts, 1);
         assert_eq!(outcome.status, "SUCCESS");
     }
@@ -530,20 +548,30 @@ mod tests {
         assert!(msg.contains("still pending"), "got: {}", msg);
         assert!(msg.contains("deadbeef"), "got: {}", msg);
         assert!(msg.contains("3 RPC polls"), "got: {}", msg);
-        assert!(msg.contains("follow-up command"), "msg should be actionable: {}", msg);
+        assert!(
+            msg.contains("follow-up command"),
+            "msg should be actionable: {}",
+            msg
+        );
     }
 
     #[test]
     fn poll_propagates_polling_failures() {
-        let mut poll = Box::new(|_hash: &str| anyhow::bail!("RPC unreachable"));
+        let poll = Box::new(|_hash: &str| anyhow::bail!("RPC unreachable"));
         let err = poll_with_retries("aa", 2, 1, poll, is_terminal_success).unwrap_err();
         assert!(err.to_string().contains("RPC poll attempt 1/2"));
     }
 
     #[test]
     fn poll_with_retries_clamps_max_retries_to_at_least_one() {
-        let outcome = poll_with_retries("aa", 0, 1, pending_then(&["SUCCESS"], 0), is_terminal_success)
-            .unwrap();
+        let outcome = poll_with_retries(
+            "aa",
+            0,
+            1,
+            pending_then(&["SUCCESS"], 0),
+            is_terminal_success,
+        )
+        .unwrap();
         assert_eq!(outcome.attempts, 1);
     }
 
@@ -602,10 +630,14 @@ mod tests {
         // 5 phase events + 1 summary object.
         assert_eq!(parsed.len(), 6, "{}", out);
 
-        let confirm = parsed.iter().find(|v| {
-            v["phase"] == "confirm_rpc" && v["state"] == "running"
-        });
-        assert!(confirm.is_some(), "missing running confirm-rpc event: {}", out);
+        let confirm = parsed
+            .iter()
+            .find(|v| v["phase"] == "confirm_rpc" && v["state"] == "running");
+        assert!(
+            confirm.is_some(),
+            "missing running confirm-rpc event: {}",
+            out
+        );
         assert_eq!(confirm.unwrap()["correlation_id"], "ci-abcdef1234");
         assert_eq!(confirm.unwrap()["poll_attempt"], 2);
 
diff --git a/src/utils/doc_generator.rs b/src/utils/doc_generator.rs
index 2f6a879e..8a9f5875 100644
--- a/src/utils/doc_generator.rs
+++ b/src/utils/doc_generator.rs
@@ -694,21 +694,21 @@ impl HtmlDocGenerator {
             .functions
             .iter()
             .filter(|f| f.visibility == Visibility::Public)
-            .map(|f| render_function_card(f))
+            .map(render_function_card)
             .collect::<Vec<_>>()
             .join("\n");
 
         let structs_html = docs
             .structs
             .iter()
-            .map(|s| render_struct_card(s))
+            .map(render_struct_card)
             .collect::<Vec<_>>()
             .join("\n");
 
         let enums_html = docs
             .enums
             .iter()
-            .map(|e| render_enum_card(e))
+            .map(render_enum_card)
             .collect::<Vec<_>>()
             .join("\n");
 
@@ -1114,7 +1114,7 @@ fn render_function_card(f: &ExtractedFn) -> String {
         .doc_comment
         .lines()
         .filter(|l| !l.starts_with("```"))
-        .map(|l| escape_html(l))
+        .map(escape_html)
         .collect::<Vec<_>>()
         .join("<br>");
 
diff --git a/src/utils/doc_templates.rs b/src/utils/doc_templates.rs
index 09e7ea7d..6cc00057 100644
--- a/src/utils/doc_templates.rs
+++ b/src/utils/doc_templates.rs
@@ -9,7 +9,7 @@ use anyhow::{Context, Result};
 use serde::{Deserialize, Serialize};
 use std::collections::{BTreeMap, HashMap};
 use std::fs;
-use std::path::{Path, PathBuf};
+use std::path::PathBuf;
 
 // ──────────────────────────────────────────────────────────────────────────────
 // Template context
diff --git a/src/utils/docs.rs b/src/utils/docs.rs
index 9007a7ee..414f54a7 100644
--- a/src/utils/docs.rs
+++ b/src/utils/docs.rs
@@ -1,6 +1,5 @@
 use anyhow::{Context, Result};
 use serde::{Deserialize, Serialize};
-use std::collections::HashMap;
 use std::fs;
 use std::path::{Path, PathBuf};
 
@@ -114,6 +113,10 @@ fn contract_doc_dir(contract_id: &str) -> Result<PathBuf> {
     Ok(dir)
 }
 
+// Each parameter is an independent, named input (CLI flags / distinct config
+// values); bundling them into a struct here would add indirection without
+// reducing real complexity.
+#[allow(clippy::too_many_arguments)]
 pub fn generate_documentation(
     contract_id: &str,
     name: &str,
diff --git a/src/utils/documentation.rs b/src/utils/documentation.rs
index 6bfe0a58..2e1897fa 100644
--- a/src/utils/documentation.rs
+++ b/src/utils/documentation.rs
@@ -1,6 +1,5 @@
-use anyhow::{Context, Result};
+use anyhow::Result;
 use serde::{Deserialize, Serialize};
-use std::collections::HashMap;
 use std::fs;
 use std::path::{Path, PathBuf};
 
@@ -161,7 +160,10 @@ impl DocumentationGenerator {
         Ok(documentation)
     }
 
-    fn extract_functions_from_wasm(&self, wasm_bytes: &[u8]) -> Result<Vec<FunctionDoc>> {
+    // Multi-field struct literals read more clearly as sequential pushes
+    // than as one large `vec![]` literal.
+    #[allow(clippy::vec_init_then_push)]
+    fn extract_functions_from_wasm(&self, _wasm_bytes: &[u8]) -> Result<Vec<FunctionDoc>> {
         // Simplified function extraction - in production would use proper WASM parsing
         let mut functions = Vec::new();
 
@@ -228,7 +230,7 @@ impl DocumentationGenerator {
         };
 
         // Check if contract already exists in index
-        if let Some(existing) = index
+        if let Some(_existing) = index
             .contracts
             .iter()
             .find(|c| c.contract_id == documentation.contract_id)
@@ -589,7 +591,7 @@ impl DocumentationVersionManager {
             let entry = entry?;
             let path = entry.path();
 
-            if path.extension().map_or(false, |ext| ext == "json") {
+            if path.extension().is_some_and(|ext| ext == "json") {
                 let content = fs::read_to_string(&path)?;
                 let version: DocumentationVersion = serde_json::from_str(&content)?;
                 versions.push(version);
diff --git a/src/utils/event_monitoring.rs b/src/utils/event_monitoring.rs
index fe843cc5..a67f333d 100644
--- a/src/utils/event_monitoring.rs
+++ b/src/utils/event_monitoring.rs
@@ -480,7 +480,7 @@ fn write_counts(out: &mut String, title: &str, counts: &HashMap<String, usize>)
     }
 
     let mut items: Vec<_> = counts.iter().collect();
-    items.sort_by(|(left, _), (right, _)| left.cmp(right));
+    items.sort_by_key(|(left, _)| *left);
     for (key, count) in items {
         let _ = writeln!(out, "  - {}: {}", key, count);
     }
diff --git a/src/utils/feature_flags.rs b/src/utils/feature_flags.rs
index fa080f7b..56ddf162 100644
--- a/src/utils/feature_flags.rs
+++ b/src/utils/feature_flags.rs
@@ -25,7 +25,6 @@
 use crate::utils::database::Database;
 use anyhow::{bail, Context, Result};
 use serde::{Deserialize, Serialize};
-use std::collections::BTreeMap;
 use std::collections::HashMap;
 use std::collections::HashSet;
 use std::sync::{Mutex, OnceLock};
@@ -119,7 +118,7 @@ impl SegmentRule {
                 bucket < (*percent as u32).min(100)
             }
             SegmentRule::HasAttribute { key, any_of } => match ctx.attributes.get(key) {
-                Some(v) if any_of.is_empty() => true,
+                Some(_v) if any_of.is_empty() => true,
                 Some(v) => any_of.iter().any(|cand| cand == v),
                 None => false,
             },
@@ -631,7 +630,7 @@ impl Database {
             "SELECT flag_name, version, enabled, rollout_percent, segments_json, variants_json, note, created_at \
              FROM flag_states WHERE flag_name = ?1 ORDER BY version ASC",
         )?;
-        let rows = stmt.query_map(rusqlite::params![flag_name], |row| row_to_state(row))?;
+        let rows = stmt.query_map(rusqlite::params![flag_name], row_to_state)?;
         rows.map(|r| r.map_err(anyhow::Error::from)).collect()
     }
 
@@ -658,7 +657,7 @@ impl Database {
              ) latest ON latest.flag_name = s.flag_name AND latest.v = s.version \
              ORDER BY s.flag_name",
         )?;
-        let rows = stmt.query_map([], |row| row_to_state(row))?;
+        let rows = stmt.query_map([], row_to_state)?;
         rows.map(|r| r.map_err(anyhow::Error::from)).collect()
     }
 
@@ -1393,6 +1392,7 @@ pub fn load_or_create_install_id(db: &Database) -> Result<String> {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use std::collections::BTreeMap;
 
     fn db() -> Database {
         Database::open_in_memory().unwrap()
diff --git a/src/utils/gas_analyzer.rs b/src/utils/gas_analyzer.rs
index 4bcefc05..eeca72e3 100644
--- a/src/utils/gas_analyzer.rs
+++ b/src/utils/gas_analyzer.rs
@@ -601,7 +601,7 @@ pub fn generate_findings(bytes: &[u8], profile: &WasmSectionProfile) -> Vec<GasF
     }
 
     // GAS-012: High instruction density
-    let instr_per_byte = if bytes.len() > 0 {
+    let instr_per_byte = if !bytes.is_empty() {
         profile.estimated_instruction_count as f64 / bytes.len() as f64
     } else {
         0.0
diff --git a/src/utils/hardware_wallet.rs b/src/utils/hardware_wallet.rs
index e0ae90e8..a86ba5e9 100644
--- a/src/utils/hardware_wallet.rs
+++ b/src/utils/hardware_wallet.rs
@@ -1,3 +1,11 @@
+// The Ledger APDU constants and codec helpers below (build_apdu,
+// frame_apdu_for_hid, parse_hd_path, encode_hd_path, extract_*_bytes) are
+// exercised by the `hardware-wallet` feature's transport implementation and
+// by this module's own unit tests, but not by a default build with the
+// feature off and no tests compiled — that's the one configuration where
+// they're genuinely unused, not a sign anything here is actually dead.
+#![cfg_attr(not(any(test, feature = "hardware-wallet")), allow(dead_code))]
+
 use anyhow::{Context, Result};
 use clap::ValueEnum;
 
diff --git a/src/utils/horizon.rs b/src/utils/horizon.rs
index ab408ce4..b2994f71 100644
--- a/src/utils/horizon.rs
+++ b/src/utils/horizon.rs
@@ -182,12 +182,18 @@ pub async fn fetch_network_passphrase(network: &str) -> Result<String> {
         .await
         .with_context(|| format!("Could not reach Horizon endpoint '{}'", endpoint))?;
     if !response.status().is_success() {
-        anyhow::bail!("Horizon endpoint '{}' returned HTTP {}", endpoint, response.status());
+        anyhow::bail!(
+            "Horizon endpoint '{}' returned HTTP {}",
+            endpoint,
+            response.status()
+        );
     }
-    let root: HorizonRoot = response
-        .json()
-        .await
-        .with_context(|| format!("Horizon endpoint '{}' did not provide network identity", endpoint))?;
+    let root: HorizonRoot = response.json().await.with_context(|| {
+        format!(
+            "Horizon endpoint '{}' did not provide network identity",
+            endpoint
+        )
+    })?;
     Ok(root.network_passphrase)
 }
 
diff --git a/src/utils/logging.rs b/src/utils/logging.rs
index 9727a0b3..add27c4b 100644
--- a/src/utils/logging.rs
+++ b/src/utils/logging.rs
@@ -72,7 +72,7 @@ impl<W: Write> Write for RedactingWriter<W> {
 
     fn flush(&mut self) -> io::Result<()> {
         if !self.buffer.is_empty() {
-            let remaining: Vec<u8> = self.buffer.drain(..).collect();
+            let remaining: Vec<u8> = std::mem::take(&mut self.buffer);
             if let Ok(line_str) = std::str::from_utf8(&remaining) {
                 let redacted = redact_secrets(line_str);
                 self.inner.write_all(redacted.as_bytes())?;
diff --git a/src/utils/migration_ai.rs b/src/utils/migration_ai.rs
index e889a483..61281732 100644
--- a/src/utils/migration_ai.rs
+++ b/src/utils/migration_ai.rs
@@ -242,7 +242,7 @@ fn analyze_type_changes(
     old_specs: &[String],
     new_specs: &[String],
     breaking_changes: &mut Vec<BreakingChange>,
-    _suggestions: &mut Vec<MigrationSuggestion>,
+    _suggestions: &mut [MigrationSuggestion],
 ) {
     let old_types = extract_types(old_specs);
     let new_types = extract_types(new_specs);
@@ -281,7 +281,7 @@ fn analyze_storage_layout(
     new_specs: &[String],
     storage_changes: &mut Vec<StorageChange>,
     breaking_changes: &mut Vec<BreakingChange>,
-    _suggestions: &mut Vec<MigrationSuggestion>,
+    _suggestions: &mut [MigrationSuggestion],
 ) {
     let old_storage = extract_storage_keys(old_specs);
     let new_storage = extract_storage_keys(new_specs);
@@ -403,12 +403,11 @@ fn analyze_sdk_upgrade(
 fn analyze_protocol_upgrade(
     config: &AnalysisConfig,
     breaking_changes: &mut Vec<BreakingChange>,
-    _suggestions: &mut Vec<MigrationSuggestion>,
+    _suggestions: &mut [MigrationSuggestion],
 ) {
     match (config.old_protocol_version, config.new_protocol_version) {
-        (Some(old), Some(new)) if old != new => {
-            if new > old {
-                breaking_changes.push(BreakingChange {
+        (Some(old), Some(new)) if old != new && new > old => {
+            breaking_changes.push(BreakingChange {
                     category: "protocol_upgrade".into(),
                     severity: Severity::Major,
                     title: format!("Soroban protocol upgrade: v{} → v{}", old, new),
@@ -425,7 +424,6 @@ fn analyze_protocol_upgrade(
                     ),
                     affected_items: vec!["protocol".into(), "host_functions".into()],
                 });
-            }
         }
         _ => {}
     }
@@ -446,7 +444,7 @@ fn determine_compatibility(changes: &[BreakingChange]) -> Compatibility {
 
 fn build_migration_steps(
     config: &AnalysisConfig,
-    breaking_changes: &[BreakingChange],
+    _breaking_changes: &[BreakingChange],
     storage_changes: &[StorageChange],
     old_wasm_hash: &str,
     new_wasm_hash: &str,
@@ -456,7 +454,7 @@ fn build_migration_steps(
     let mut order = 1usize;
 
     steps.push(MigrationStep {
-        order: order,
+        order,
         action: "backup".into(),
         description: "Create a backup of the current contract state and WASM".into(),
         command: Some("starforge backup create --contract <CONTRACT_ID>".into()),
@@ -467,7 +465,7 @@ fn build_migration_steps(
 
     if has_storage_migration {
         steps.push(MigrationStep {
-            order: order,
+            order,
             action: "export_storage".into(),
             description: "Export current contract storage to a snapshot".into(),
             command: Some(
@@ -514,7 +512,7 @@ fn build_migration_steps(
             );
 
             steps.push(MigrationStep {
-                order: order,
+                order,
                 action: "create_rules".into(),
                 description: "Create migration rules file for storage transformation".into(),
                 command: Some("starforge migrate init --from-version <OLD> --to-version <NEW>".into()),
@@ -524,7 +522,7 @@ fn build_migration_steps(
             order += 1;
 
             steps.push(MigrationStep {
-                order: order,
+                order,
                 action: "test_migration".into(),
                 description: "Dry-run migration to verify rules produce expected output".into(),
                 command: Some(
@@ -536,7 +534,7 @@ fn build_migration_steps(
             order += 1;
 
             steps.push(MigrationStep {
-                order: order,
+                order,
                 action: "apply_migration".into(),
                 description: "Apply storage migration to produce transformed snapshot".into(),
                 command: Some("starforge migrate run --contract-id <CONTRACT_ID> --snapshot snapshot.json --rules rules.json --output migrated-snapshot.json".into()),
@@ -547,7 +545,7 @@ fn build_migration_steps(
         }
 
         steps.push(MigrationStep {
-            order: order,
+            order,
             action: "generate_migration_code".into(),
             description: "Generate on-chain migration function in the new contract".into(),
             command: Some("starforge migrate-ai generate --old-wasm <OLD> --new-wasm <NEW> --output migration.rs".into()),
@@ -563,7 +561,7 @@ fn build_migration_steps(
     }
 
     steps.push(MigrationStep {
-        order: order,
+        order,
         action: "compatibility_check".into(),
         description: "Run final compatibility check between old and new WASM".into(),
         command: Some("starforge upgrade-auto compat --old-wasm <OLD> --new-wasm <NEW>".into()),
@@ -573,7 +571,7 @@ fn build_migration_steps(
     order += 1;
 
     steps.push(MigrationStep {
-        order: order,
+        order,
         action: "upgrade_contract".into(),
         description: "Upgrade the contract to the new WASM version".into(),
         command: Some("starforge upgrade execute --contract-id <CONTRACT_ID> --wasm <NEW_WASM> --wallet <WALLET>".into()),
@@ -595,9 +593,7 @@ fn generate_migration_code_stub(
     snippet.push_str(&format!("// Migration function for {}\n", contract_name));
     snippet.push_str("// Generated by starforge migrate-ai\n\n");
     snippet.push_str("#[allow(unused)]\n");
-    snippet.push_str(&format!(
-        "pub fn migrate(env: &soroban_sdk::Env, admin: soroban_sdk::Address) {{\n"
-    ));
+    snippet.push_str("pub fn migrate(env: &soroban_sdk::Env, admin: soroban_sdk::Address) {\n");
     snippet.push_str("    admin.require_auth();\n\n");
 
     for sc in storage_changes {
@@ -763,9 +759,7 @@ pub fn extract_spec_entries(wasm_bytes: &[u8]) -> Result<Vec<String>> {
         let content = String::from_utf8_lossy(meta_section);
         for line in content.lines() {
             let trimmed = line.trim();
-            if trimmed.starts_with("SDK_VERSION:") {
-                specs.push(format!("meta:{}", trimmed));
-            } else if trimmed.starts_with("PROTOCOL_VERSION:") {
+            if trimmed.starts_with("SDK_VERSION:") || trimmed.starts_with("PROTOCOL_VERSION:") {
                 specs.push(format!("meta:{}", trimmed));
             }
         }
diff --git a/src/utils/mod.rs b/src/utils/mod.rs
index 4655ba6d..0212a87d 100644
--- a/src/utils/mod.rs
+++ b/src/utils/mod.rs
@@ -110,13 +110,13 @@ pub mod logging;
 pub mod migration_ai;
 pub mod migration_testing;
 pub mod mnemonic;
-pub mod network_guard;
 pub mod mock_soroban;
 pub mod multi_network_deploy;
 pub mod multisig;
 pub mod multisig_audit;
 pub mod multisig_builder;
 pub mod mutation;
+pub mod network_guard;
 pub mod network_sim;
 pub mod network_simulator;
 pub mod node;
diff --git a/src/utils/network_guard.rs b/src/utils/network_guard.rs
index e19317ba..47ff48cf 100644
--- a/src/utils/network_guard.rs
+++ b/src/utils/network_guard.rs
@@ -17,7 +17,11 @@ pub fn compare_passphrases(configured: &str, observed: &str) -> Result<()> {
     if configured == observed || allow_mismatch() {
         return Ok(());
     }
-    anyhow::bail!("network passphrase mismatch: configured='{}', observed='{}'", configured, observed)
+    anyhow::bail!(
+        "network passphrase mismatch: configured='{}', observed='{}'",
+        configured,
+        observed
+    )
 }
 
 pub async fn verify(network: &str) -> Result<()> {
@@ -35,16 +39,22 @@ pub async fn verify(network: &str) -> Result<()> {
     );
     if allow_mismatch() {
         if crate::utils::output::is_json_mode_enabled() {
-            println!("{}", serde_json::json!({
-                "warning": "network_passphrase_mismatch",
-                "network": network,
-                "configured_passphrase": configured,
-                "observed_passphrase": observed,
-                "endpoint": endpoint,
-                "override": true
-            }));
+            println!(
+                "{}",
+                serde_json::json!({
+                    "warning": "network_passphrase_mismatch",
+                    "network": network,
+                    "configured_passphrase": configured,
+                    "observed_passphrase": observed,
+                    "endpoint": endpoint,
+                    "override": true
+                })
+            );
         } else {
-            crate::utils::print::warn(&format!("{} Signing continues because --allow-network-passphrase-mismatch was supplied.", detail));
+            crate::utils::print::warn(&format!(
+                "{} Signing continues because --allow-network-passphrase-mismatch was supplied.",
+                detail
+            ));
         }
         return Ok(());
     }
diff --git a/src/utils/network_simulator/deterministic.rs b/src/utils/network_simulator/deterministic.rs
index 925166e6..368ea7d3 100644
--- a/src/utils/network_simulator/deterministic.rs
+++ b/src/utils/network_simulator/deterministic.rs
@@ -7,7 +7,6 @@ use rand::rngs::StdRng;
 use rand::{Rng, SeedableRng};
 use serde::{Deserialize, Serialize};
 use sha2::{Digest, Sha256};
-use std::fmt;
 use std::sync::Mutex;
 
 // ── Deterministic Configuration ───────────────────────────────────────────────
diff --git a/src/utils/network_simulator/failure.rs b/src/utils/network_simulator/failure.rs
index 8d857189..6b483ab8 100644
--- a/src/utils/network_simulator/failure.rs
+++ b/src/utils/network_simulator/failure.rs
@@ -4,7 +4,6 @@
 //! simulator to test how contracts and clients handle errors.
 
 use serde::{Deserialize, Serialize};
-use std::collections::HashMap;
 
 // ── Failure Modes ─────────────────────────────────────────────────────────────
 
diff --git a/src/utils/network_simulator/scenarios.rs b/src/utils/network_simulator/scenarios.rs
index e0b6b46b..2216857e 100644
--- a/src/utils/network_simulator/scenarios.rs
+++ b/src/utils/network_simulator/scenarios.rs
@@ -3,7 +3,7 @@
 //! Pre-built, parameterizable test scenarios that set up the simulator
 //! with realistic contract + account states for reproducible testing.
 
-use crate::utils::network_simulator::deterministic::{derive_contract_id, derive_public_key};
+use crate::utils::network_simulator::deterministic::derive_public_key;
 use crate::utils::network_simulator::simulator::{NetworkSimulator, SimulatorConfig};
 use anyhow::Result;
 use serde::{Deserialize, Serialize};
@@ -314,7 +314,7 @@ impl ScenarioRunner {
         }
     }
 
-    fn load_test(seed: u64) -> Scenario {
+    fn load_test(_seed: u64) -> Scenario {
         let mut accounts = Vec::new();
         for i in 0..10 {
             accounts.push(ScenarioAccount {
diff --git a/src/utils/network_simulator/simulator.rs b/src/utils/network_simulator/simulator.rs
index e722a72b..469054cb 100644
--- a/src/utils/network_simulator/simulator.rs
+++ b/src/utils/network_simulator/simulator.rs
@@ -6,12 +6,9 @@
 use crate::utils::network_simulator::deterministic::{
     derive_contract_id, derive_public_key, derive_tx_hash, DeterministicConfig, SeededRng,
 };
-use crate::utils::network_simulator::failure::{
-    failure_to_rpc_error, FailureInjector, FailureMode,
-};
+use crate::utils::network_simulator::failure::{failure_to_rpc_error, FailureInjector};
 use crate::utils::network_simulator::state::SnapshotManager;
-use crate::utils::network_simulator::time::{LedgerTime, TimeController};
-use chrono::Utc;
+use crate::utils::network_simulator::time::TimeController;
 use serde::{Deserialize, Serialize};
 use sha2::{Digest, Sha256};
 use std::collections::HashMap;
@@ -740,6 +737,7 @@ impl Default for NetworkSimulator {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::utils::network_simulator::failure::FailureMode;
 
     #[test]
     fn new_simulator_has_default_state() {
diff --git a/src/utils/network_simulator/state.rs b/src/utils/network_simulator/state.rs
index 0cab93f9..30a25b7e 100644
--- a/src/utils/network_simulator/state.rs
+++ b/src/utils/network_simulator/state.rs
@@ -67,6 +67,10 @@ impl SnapshotManager {
     }
 
     /// Take a snapshot of the current simulator state.
+    // Each parameter is an independent, named input (CLI flags / distinct config
+    // values); bundling them into a struct here would add indirection without
+    // reducing real complexity.
+    #[allow(clippy::too_many_arguments)]
     pub fn take_snapshot(
         &mut self,
         label: &str,
@@ -127,7 +131,7 @@ impl SnapshotManager {
             if path.exists() {
                 if let Ok(json) = fs::read_to_string(&path) {
                     if let Ok(snapshot) = serde_json::from_str::<StateSnapshot>(&json) {
-                        let label = snapshot.label.clone();
+                        let _label = snapshot.label.clone();
                         self.snapshots.insert(id.to_string(), snapshot);
                         return self.snapshots.get(id);
                     }
diff --git a/src/utils/network_simulator/time.rs b/src/utils/network_simulator/time.rs
index cefc22ac..ec60af06 100644
--- a/src/utils/network_simulator/time.rs
+++ b/src/utils/network_simulator/time.rs
@@ -3,7 +3,7 @@
 //! Provides ledger time manipulation for testing – advance, freeze, rewind,
 //! and jump to specific timestamps.
 
-use chrono::{DateTime, Duration, Utc};
+use chrono::{DateTime, Utc};
 use serde::{Deserialize, Serialize};
 
 /// Represents the simulated ledger time.
diff --git a/src/utils/notifications.rs b/src/utils/notifications.rs
index 61cdc584..9b5d7e8f 100644
--- a/src/utils/notifications.rs
+++ b/src/utils/notifications.rs
@@ -150,9 +150,9 @@ pub fn send_notification(
     Ok(())
 }
 
-fn send_email(destination: &str, _template: &str, data: &HashMap<String, String>) -> Result<()> {
+fn send_email(destination: &str, _template: &str, _data: &HashMap<String, String>) -> Result<()> {
     info(&format!("Email notification queued to {}", destination));
-    return Ok(());
+    Ok(())
 }
 
 fn send_slack(destination: &str, _template: &str, data: &HashMap<String, String>) -> Result<()> {
diff --git a/src/utils/orchestration.rs b/src/utils/orchestration.rs
index 3645cb3a..3a956701 100644
--- a/src/utils/orchestration.rs
+++ b/src/utils/orchestration.rs
@@ -1,8 +1,8 @@
-use anyhow::{Context, Result};
+use anyhow::Result;
 use serde::{Deserialize, Serialize};
 use std::collections::{HashMap, HashSet};
 use std::fs;
-use std::path::{Path, PathBuf};
+use std::path::PathBuf;
 use std::sync::{Arc, Mutex};
 use std::thread;
 
@@ -198,7 +198,7 @@ impl OrchestrationEngine {
         let mut temp_visited = HashSet::new();
 
         for contract_id in &contract_ids {
-            self.topological_sort(
+            Self::topological_sort(
                 contract_id,
                 &plan.dependencies,
                 &mut visited,
@@ -211,7 +211,6 @@ impl OrchestrationEngine {
     }
 
     fn topological_sort(
-        &self,
         contract_id: &str,
         dependencies: &HashMap<String, Vec<String>>,
         visited: &mut HashSet<String>,
@@ -230,7 +229,7 @@ impl OrchestrationEngine {
 
         if let Some(deps) = dependencies.get(contract_id) {
             for dep in deps {
-                self.topological_sort(dep, dependencies, visited, temp_visited, sorted)?;
+                Self::topological_sort(dep, dependencies, visited, temp_visited, sorted)?;
             }
         }
 
@@ -476,7 +475,7 @@ impl OrchestrationEngine {
             let entry = entry?;
             let path = entry.path();
 
-            if path.extension().map_or(false, |ext| ext == "json") {
+            if path.extension().is_some_and(|ext| ext == "json") {
                 let content = fs::read_to_string(&path)?;
                 let plan: DeploymentPlan = serde_json::from_str(&content)?;
                 plans.push(plan);
@@ -500,7 +499,7 @@ impl OrchestrationEngine {
         Ok(plan)
     }
 
-    fn load_plan_by_execution(&self, execution_id: &str) -> Result<DeploymentPlan> {
+    fn load_plan_by_execution(&self, _execution_id: &str) -> Result<DeploymentPlan> {
         // In production, would store execution-to-plan mapping
         // For now, load the first plan
         let plans = self.list_plans()?;
diff --git a/src/utils/pattern_library.rs b/src/utils/pattern_library.rs
index 557ab806..764dcb1d 100644
--- a/src/utils/pattern_library.rs
+++ b/src/utils/pattern_library.rs
@@ -10,11 +10,10 @@
 //!   indicators before the LLM call, giving the model a structured head-start.
 
 use anyhow::{Context, Result};
-use chrono::Utc;
 use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
 use std::fs;
-use std::path::{Path, PathBuf};
+use std::path::PathBuf;
 
 use crate::utils::config;
 
diff --git a/src/utils/performance.rs b/src/utils/performance.rs
index 3a1c8807..e53aacfd 100644
--- a/src/utils/performance.rs
+++ b/src/utils/performance.rs
@@ -3,8 +3,8 @@ use serde::{Deserialize, Serialize};
 use std::collections::BTreeMap;
 use std::collections::HashMap;
 use std::fs;
-use std::path::{Path, PathBuf};
-use std::time::{Duration, Instant};
+use std::path::PathBuf;
+use std::time::Instant;
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct ContractMetrics {
@@ -84,7 +84,7 @@ pub struct GasUsageRecord {
 }
 
 thread_local! {
-    static TEST_METRICS_DIR: std::cell::RefCell<Option<PathBuf>> = std::cell::RefCell::new(None);
+    static TEST_METRICS_DIR: std::cell::RefCell<Option<PathBuf>> = const { std::cell::RefCell::new(None) };
 }
 
 fn metrics_dir() -> Result<PathBuf> {
@@ -400,7 +400,7 @@ pub fn analyze_bottlenecks(contract_id: &str) -> Result<BottleneckAnalysis> {
         }
     }
 
-    let total_gas: u64 = gas_history.iter().map(|r| r.gas_used).sum();
+    let _total_gas: u64 = gas_history.iter().map(|r| r.gas_used).sum();
     let total_executions = gas_history.len() as f64;
 
     let mut bottleneck_operations: Vec<String> = operation_frequencies
diff --git a/src/utils/pipeline_builder.rs b/src/utils/pipeline_builder.rs
index 7cca8264..88364207 100644
--- a/src/utils/pipeline_builder.rs
+++ b/src/utils/pipeline_builder.rs
@@ -927,7 +927,6 @@ pub fn import_pipeline(path: &Path) -> Result<DeploymentPipeline> {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use std::io::Write;
     use tempfile::TempDir;
 
     fn temp_home() -> (TempDir, std::sync::MutexGuard<'static, ()>) {
diff --git a/src/utils/profiler.rs b/src/utils/profiler.rs
index 0373f894..b7ef48fd 100644
--- a/src/utils/profiler.rs
+++ b/src/utils/profiler.rs
@@ -1,4 +1,3 @@
-use std::mem::size_of;
 use std::time::{Duration, Instant};
 
 #[cfg(feature = "memory-profiling")]
@@ -125,6 +124,9 @@ pub struct Profiler {
 #[cfg(feature = "memory-profiling")]
 #[derive(Debug)]
 struct MemoryTracker {
+    // Not currently called from any code path in this crate. Kept rather than
+    // removed since deleting it is a product decision, not a lint-scoping one.
+    #[allow(dead_code)]
     start: Instant,
     current_memory: usize,
     peak_memory: usize,
@@ -143,10 +145,6 @@ impl MemoryTracker {
     }
 }
 
-#[cfg(not(feature = "memory-profiling"))]
-#[derive(Debug)]
-struct MemoryTracker;
-
 impl Profiler {
     pub fn start() -> Self {
         #[cfg(feature = "memory-profiling")]
@@ -156,8 +154,6 @@ impl Profiler {
             peak_memory: 0,
             samples: Vec::new(),
         });
-        #[cfg(not(feature = "memory-profiling"))]
-        let memory_tracker: Option<MemoryTracker> = None;
 
         Self {
             start: Instant::now(),
diff --git a/src/utils/prompt_manager.rs b/src/utils/prompt_manager.rs
index e73245e6..505ba7db 100644
--- a/src/utils/prompt_manager.rs
+++ b/src/utils/prompt_manager.rs
@@ -4,6 +4,9 @@ use rusqlite::{params, Connection};
 use serde_json::Value;
 use std::path::PathBuf;
 
+/// (prompt_name, version_tag, uses, successes, failures, avg_rating)
+pub type PromptStats = (String, String, i64, i64, i64, f64);
+
 pub struct PromptManager {
     conn: Connection,
 }
@@ -257,7 +260,7 @@ impl PromptManager {
         Ok(prompts)
     }
 
-    pub fn get_stats(&self) -> Result<Vec<(String, String, i64, i64, i64, f64)>> {
+    pub fn get_stats(&self) -> Result<Vec<PromptStats>> {
         let mut stmt = self.conn.prepare(
             "SELECT p.name, v.version_tag, a.uses, a.successes, a.failures, 
                     CAST(a.rating_sum AS REAL) / NULLIF(a.rating_count, 0)
diff --git a/src/utils/quality_analysis.rs b/src/utils/quality_analysis.rs
index 6d0b466c..33ebf2de 100644
--- a/src/utils/quality_analysis.rs
+++ b/src/utils/quality_analysis.rs
@@ -445,14 +445,15 @@ fn score_best_practices(source: &str, metrics: &CodeMetrics) -> QualityCategory
         );
     }
 
-    if source.contains("Map<") || source.contains("Vec<") {
-        if !source.contains("enum DataKey") && !source.contains("enum StorageKey") {
-            score -= 2;
-            findings.push(
+    if (source.contains("Map<") || source.contains("Vec<"))
+        && !source.contains("enum DataKey")
+        && !source.contains("enum StorageKey")
+    {
+        score -= 2;
+        findings.push(
                 "No dedicated storage-key enum (DataKey/StorageKey) — consider one for type-safe storage access"
                     .to_string(),
             );
-        }
     }
 
     QualityCategory {
diff --git a/src/utils/redaction.rs b/src/utils/redaction.rs
index c069a1e1..524b077e 100644
--- a/src/utils/redaction.rs
+++ b/src/utils/redaction.rs
@@ -81,9 +81,7 @@ fn redact_secrets_impl(input: &str) -> String {
     let s = HEX_PRIVATE_KEY_REGEX.replace_all(&s, REDACTED);
 
     // 8. BIP-39 Mnemonics (12, 15, 18, 21, 24 space-separated words)
-    let final_result = redact_mnemonics(&s);
-
-    final_result
+    redact_mnemonics(&s)
 }
 
 /// Helper function to detect and redact BIP-39 mnemonic seed phrases (12 to 24 words).
diff --git a/src/utils/registry.rs b/src/utils/registry.rs
index 77722991..97c986bd 100644
--- a/src/utils/registry.rs
+++ b/src/utils/registry.rs
@@ -2,7 +2,6 @@ use crate::utils::http_client;
 use anyhow::{Context, Result};
 use serde::{Deserialize, Serialize};
 use std::fs;
-use std::path::PathBuf;
 
 /// Configuration for the remote template registry.
 #[derive(Debug, Clone, Serialize, Deserialize)]
diff --git a/src/utils/repl.rs b/src/utils/repl.rs
index 6cfbf366..999e381d 100644
--- a/src/utils/repl.rs
+++ b/src/utils/repl.rs
@@ -5,7 +5,6 @@ use rustyline::completion::{Completer, Pair};
 use rustyline::error::ReadlineError;
 use rustyline::highlight::Highlighter;
 use rustyline::hint::Hinter;
-use rustyline::history::History;
 use rustyline::validate::Validator;
 use rustyline::{Context, Editor, Helper};
 use std::collections::HashSet;
diff --git a/src/utils/scheduler.rs b/src/utils/scheduler.rs
index 9d4893c7..f7a66875 100644
--- a/src/utils/scheduler.rs
+++ b/src/utils/scheduler.rs
@@ -79,6 +79,10 @@ pub fn parse_when(when: &str) -> Result<DateTime<Utc>> {
     )
 }
 
+// Each parameter is an independent, named input (CLI flags / distinct config
+// values); bundling them into a struct here would add indirection without
+// reducing real complexity.
+#[allow(clippy::too_many_arguments)]
 pub fn create(
     contract_id: String,
     wasm: PathBuf,
diff --git a/src/utils/security/ai_audit.rs b/src/utils/security/ai_audit.rs
index f1e424d2..544b8f09 100644
--- a/src/utils/security/ai_audit.rs
+++ b/src/utils/security/ai_audit.rs
@@ -3,9 +3,7 @@
 //! Combines static pattern analysis with Claude AI for comprehensive
 //! vulnerability detection with < 15% false positive rate.
 
-use anyhow::{anyhow, Result};
 use serde::{Deserialize, Serialize};
-use std::collections::HashMap;
 
 /// Security vulnerability with full context.
 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -158,8 +156,8 @@ impl SecurityPatterns {
                 // A state write *after* the external call is the CEI violation.
                 // A transfer that happens last is the safe ordering.
                 let mut found_storage_after = false;
-                for j in (i + 1)..std::cmp::min(i + 10, lines.len()) {
-                    let candidate = lines[j].trim();
+                for candidate in &lines[(i + 1)..std::cmp::min(i + 10, lines.len())] {
+                    let candidate = candidate.trim();
                     // The write may be a direct storage call or a setter
                     // helper such as `set_balance(...)`; both settle state
                     // after the external call and so violate CEI.
@@ -205,10 +203,10 @@ impl SecurityPatterns {
                 {
                     // Look for require_auth in next 20 lines
                     let mut has_auth = false;
-                    for j in (i + 1)..std::cmp::min(i + 20, lines.len()) {
+                    for line_j in &lines[(i + 1)..std::cmp::min(i + 20, lines.len())] {
                         // Ignore comments: a line reading `// Missing
                         // require_auth() check` must not satisfy the check.
-                        let code_only = lines[j].split("//").next().unwrap_or(lines[j]);
+                        let code_only = line_j.split("//").next().unwrap_or(line_j);
                         if code_only.contains("require_auth") {
                             has_auth = true;
                             break;
@@ -328,8 +326,10 @@ impl SecurityPatterns {
             if line.contains("persistent()") && line.contains("set") {
                 // Look for extend_ttl in nearby lines
                 let mut has_ttl = false;
-                for j in std::cmp::max(0, i.saturating_sub(5))..std::cmp::min(i + 5, lines.len()) {
-                    if lines[j].contains("extend_ttl") {
+                for nearby in
+                    &lines[std::cmp::max(0, i.saturating_sub(5))..std::cmp::min(i + 5, lines.len())]
+                {
+                    if nearby.contains("extend_ttl") {
                         has_ttl = true;
                         break;
                     }
diff --git a/src/utils/security/ai_audit_service.rs b/src/utils/security/ai_audit_service.rs
index 3d18f62c..e1d7c8af 100644
--- a/src/utils/security/ai_audit_service.rs
+++ b/src/utils/security/ai_audit_service.rs
@@ -2,12 +2,11 @@
 
 use super::ai_audit::{
     build_fallback_report, build_system_prompt, build_user_prompt, run_static_checks,
-    AiAuditResponse, AuditLevel, AuditRequest, SecurityAuditReport,
+    AiAuditResponse, AuditRequest, SecurityAuditReport,
 };
 use anyhow::{anyhow, Result};
 use chrono::Utc;
 use reqwest::Client;
-use serde_json::json;
 
 /// Anthropic API message format.
 #[derive(serde::Serialize)]
@@ -251,6 +250,7 @@ fn classify_claude_error(err: &anyhow::Error) -> &'static str {
 
 #[cfg(test)]
 mod tests {
+    use super::super::ai_audit::AuditLevel;
     use super::*;
 
     #[test]
diff --git a/src/utils/security/audit.rs b/src/utils/security/audit.rs
index 31e3c895..c5c61248 100644
--- a/src/utils/security/audit.rs
+++ b/src/utils/security/audit.rs
@@ -112,6 +112,10 @@ pub fn run_audit(path: &Path, config: &AuditConfig) -> Result<AuditResult> {
     })
 }
 
+// Each parameter is an independent, named input (CLI flags / distinct config
+// values); bundling them into a struct here would add indirection without
+// reducing real complexity.
+#[allow(clippy::too_many_arguments)]
 fn collect_external_tool(
     tool: &str,
     env_vars: &[&str],
diff --git a/src/utils/security/compliance.rs b/src/utils/security/compliance.rs
index dd407fb3..7501f7d8 100644
--- a/src/utils/security/compliance.rs
+++ b/src/utils/security/compliance.rs
@@ -85,6 +85,12 @@ pub struct ComplianceEngine {
     rules: Vec<ComplianceRule>,
 }
 
+impl Default for ComplianceEngine {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
 impl ComplianceEngine {
     pub fn new() -> Self {
         let rules = vec![
@@ -259,7 +265,7 @@ impl ComplianceEngine {
             .map(|r| r.remediation.clone())
             .collect();
 
-        let overall_risk = if critical_gaps.len() > 0 {
+        let overall_risk = if !critical_gaps.is_empty() {
             "critical"
         } else if failed_count > total / 2 {
             "high"
diff --git a/src/utils/security/data_protection.rs b/src/utils/security/data_protection.rs
index 9b45993b..9241b853 100644
--- a/src/utils/security/data_protection.rs
+++ b/src/utils/security/data_protection.rs
@@ -127,6 +127,10 @@ pub struct DataProtectionSummary {
     pub integrity_score: f64,
 }
 
+// Fields not currently read from any code path in this crate. Kept rather
+// than removed since deleting them is a product decision, not a
+// lint-scoping one.
+#[allow(dead_code)]
 pub struct DataProtectionEngine {
     encryption_policy: EncryptionPolicy,
     access_policy: AccessPolicy,
@@ -134,6 +138,12 @@ pub struct DataProtectionEngine {
     classifications: HashMap<String, DataClassification>,
 }
 
+impl Default for DataProtectionEngine {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
 impl DataProtectionEngine {
     pub fn new() -> Self {
         let mut classifications = HashMap::new();
@@ -347,7 +357,7 @@ impl DataProtectionEngine {
     }
 
     fn check_key_management(&self, source: &str) -> DataProtectionCheck {
-        let has_key_ops =
+        let _has_key_ops =
             source.contains("key") || source.contains("secret") || source.contains("private");
         let has_hardcoded = source.contains("\"sk1\"")
             || source.contains("\"secret_key\"")
diff --git a/src/utils/security_scanner.rs b/src/utils/security_scanner.rs
index cf7f8624..f21095b8 100644
--- a/src/utils/security_scanner.rs
+++ b/src/utils/security_scanner.rs
@@ -10,7 +10,7 @@
 
 use crate::utils::security::audit::VulnerabilityFinding;
 use anyhow::{Context, Result};
-use std::path::{Path, PathBuf};
+use std::path::PathBuf;
 use std::process::Command;
 
 // ---------------------------------------------------------------------------
diff --git a/src/utils/shamir.rs b/src/utils/shamir.rs
index b330e45b..53ebcd06 100644
--- a/src/utils/shamir.rs
+++ b/src/utils/shamir.rs
@@ -188,9 +188,9 @@ pub fn split(secret: &[u8], threshold: usize, total_shares: usize) -> Result<Vec
     // Generate coefficients for all polynomials: one polynomial per secret byte.
     // coeffs[0] is the secret (constant term), coeffs[1..=degree] are random.
     let mut all_coeffs = Vec::with_capacity(secret_len);
-    for byte_idx in 0..secret_len {
+    for &secret_byte in secret {
         let mut coeffs = vec![0u8; degree + 1];
-        coeffs[0] = secret[byte_idx];
+        coeffs[0] = secret_byte;
         for c in coeffs[1..].iter_mut() {
             *c = rng.next_u32() as u8;
         }
@@ -203,8 +203,8 @@ pub fn split(secret: &[u8], threshold: usize, total_shares: usize) -> Result<Vec
         let x = share_idx as u8;
         let mut payload_bytes = Vec::with_capacity(secret_len);
 
-        for byte_idx in 0..secret_len {
-            payload_bytes.push(poly_eval(&all_coeffs[byte_idx], x));
+        for coeffs in &all_coeffs {
+            payload_bytes.push(poly_eval(coeffs, x));
         }
 
         shares.push(RecoveryShare {
diff --git a/src/utils/social.rs b/src/utils/social.rs
index 331c6ab6..7bfe32ee 100644
--- a/src/utils/social.rs
+++ b/src/utils/social.rs
@@ -1,8 +1,7 @@
-use anyhow::{Context, Result};
+use anyhow::Result;
 use serde::{Deserialize, Serialize};
-use std::collections::HashMap;
 use std::fs;
-use std::path::{Path, PathBuf};
+use std::path::PathBuf;
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct Team {
diff --git a/src/utils/soroban.rs b/src/utils/soroban.rs
index e245c9a0..7f2ff1ef 100644
--- a/src/utils/soroban.rs
+++ b/src/utils/soroban.rs
@@ -500,7 +500,7 @@ fn build_and_sign_transaction(
     function: &str,
     args: &[String],
     wallet: &WalletEntry,
-    network: &str,
+    _network: &str,
     signing: Option<&SigningRequest>,
 ) -> Result<String> {
     let tx_xdr = build_transaction_xdr(contract_id, function, args)?;
diff --git a/src/utils/state_diff.rs b/src/utils/state_diff.rs
index 6514b143..d28430d7 100644
--- a/src/utils/state_diff.rs
+++ b/src/utils/state_diff.rs
@@ -1,4 +1,3 @@
-use anyhow::Result;
 use serde::{Deserialize, Serialize};
 use serde_json::Value;
 use std::collections::BTreeMap;
diff --git a/src/utils/stream.rs b/src/utils/stream.rs
index 82486b2d..ba8683cc 100644
--- a/src/utils/stream.rs
+++ b/src/utils/stream.rs
@@ -18,11 +18,12 @@ pub struct EventStreamFilters {
 }
 
 /// Transport used for Soroban event streaming.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
 pub enum EventStreamTransport {
     /// Prefer a persistent WebSocket JSON-RPC connection, then fall back to HTTP polling.
     Auto,
     /// Use JSON-RPC over HTTP polling.
+    #[default]
     Http,
     /// Use JSON-RPC over a persistent WebSocket connection.
     WebSocket,
@@ -42,12 +43,6 @@ impl EventStreamTransport {
     }
 }
 
-impl Default for EventStreamTransport {
-    fn default() -> Self {
-        Self::Http
-    }
-}
-
 pub struct SorobanEventStream {
     rpc_url: String,
     websocket_url: String,
@@ -274,9 +269,7 @@ impl SorobanEventStream {
                 .websocket
                 .as_mut()
                 .ok_or_else(|| anyhow::anyhow!("WebSocket connection is not available"))?;
-            websocket
-                .send(Message::Text(request.to_string().into()))
-                .await
+            websocket.send(Message::Text(request.to_string())).await
         };
 
         if let Err(err) = send_result {
diff --git a/src/utils/template.rs b/src/utils/template.rs
index a9ccd939..3592a82e 100644
--- a/src/utils/template.rs
+++ b/src/utils/template.rs
@@ -1,4 +1,4 @@
-use crate::utils::{print as p, registry, template_analytics, templates};
+use crate::utils::{print as p, template_analytics, templates};
 use anyhow::Result;
 use clap::Subcommand;
 use std::path::PathBuf;
@@ -277,6 +277,10 @@ pub async fn handle(cmd: TemplateCommands) -> Result<()> {
     }
 }
 
+// Each parameter is an independent, named input (CLI flags / distinct config
+// values); bundling them into a struct here would add indirection without
+// reducing real complexity.
+#[allow(clippy::too_many_arguments)]
 async fn import(
     path: PathBuf,
     name: Option<String>,
@@ -307,6 +311,10 @@ async fn import(
     Ok(())
 }
 
+// Each parameter is an independent, named input (CLI flags / distinct config
+// values); bundling them into a struct here would add indirection without
+// reducing real complexity.
+#[allow(clippy::too_many_arguments)]
 async fn publish(
     path: PathBuf,
     name: Option<String>,
@@ -1006,7 +1014,6 @@ async fn template_audit(name: Option<String>) -> Result<()> {
             Some(sr) => (
                 sr.status.as_str(),
                 sr.findings
-                    .clone()
                     .map(|f| f.to_string())
                     .unwrap_or_else(|| "—".to_string()),
                 sr.score
diff --git a/src/utils/template_customization_ai.rs b/src/utils/template_customization_ai.rs
index 1965143e..9ec8e7e8 100644
--- a/src/utils/template_customization_ai.rs
+++ b/src/utils/template_customization_ai.rs
@@ -2,7 +2,7 @@ use crate::utils::{ollama, template_vcs};
 use anyhow::{Context, Result};
 use serde::{Deserialize, Serialize};
 use std::fs;
-use std::path::{Path, PathBuf};
+use std::path::Path;
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct CustomizationHistory {
@@ -161,8 +161,8 @@ fn apply_ai_modifications(template_path: &Path, ai_response: &str) -> Result<Vec
             let mut i = 0;
             while i < lines.len() {
                 let line = lines[i].trim();
-                if line.starts_with("- ") {
-                    if let Some((file_path, rest)) = line[2..].split_once(':') {
+                if let Some(stripped) = line.strip_prefix("- ") {
+                    if let Some((file_path, _rest)) = stripped.split_once(':') {
                         let mut code_change = String::new();
                         i += 1;
                         while i < lines.len()
diff --git a/src/utils/template_performance.rs b/src/utils/template_performance.rs
index 037585ed..c5f4a71b 100644
--- a/src/utils/template_performance.rs
+++ b/src/utils/template_performance.rs
@@ -1,7 +1,7 @@
 use anyhow::Result;
 use serde::{Deserialize, Serialize};
 use std::fs;
-use std::path::{Path, PathBuf};
+use std::path::Path;
 
 fn read_source_files(root: &Path) -> Vec<String> {
     let mut sources = Vec::new();
@@ -119,9 +119,9 @@ pub fn analyze_template_directory(
         + external_call_score as u32
         + batch_operations_score as u32)
         / 5) as u8;
-    let estimated_gas_reduction_percent = (100 - overall_score).max(5).min(40) as u8;
-    let estimated_speedup_percent = ((100 - overall_score) / 2).max(3).min(25) as u8;
-    let estimated_memory_savings_percent = ((100 - overall_score) / 3).max(2).min(15) as u8;
+    let estimated_gas_reduction_percent = (100 - overall_score).clamp(5, 40);
+    let estimated_speedup_percent = ((100 - overall_score) / 2).clamp(3, 25);
+    let estimated_memory_savings_percent = ((100 - overall_score) / 3).clamp(2, 15);
 
     Ok(TemplatePerformanceAnalysis {
         template_name: name,
diff --git a/src/utils/template_recommender.rs b/src/utils/template_recommender.rs
index bfa85515..2def9bbe 100644
--- a/src/utils/template_recommender.rs
+++ b/src/utils/template_recommender.rs
@@ -34,8 +34,11 @@ pub enum SkillLevel {
 }
 
 impl SkillLevel {
-    /// Parse from a case-insensitive string.
-    pub fn from_str(s: &str) -> Option<Self> {
+    /// Parse from a case-insensitive string, accepting common shorthand aliases.
+    ///
+    /// Not `FromStr::from_str` — this returns `Option`, not `Result`, since
+    /// there's no meaningful error type for "unrecognized skill level".
+    pub fn parse_lenient(s: &str) -> Option<Self> {
         match s.to_lowercase().as_str() {
             "beginner" | "b" | "novice" => Some(Self::Beginner),
             "intermediate" | "i" | "mid" | "medium" => Some(Self::Intermediate),
@@ -307,9 +310,11 @@ fn skill_fit(entry: &templates::TemplateEntry, skill_level: SkillLevel) -> (&'st
         SkillLevel::Advanced => {
             if has_advanced {
                 ("Excellent for advanced use", 15.0)
-            } else if entry.security_review.as_ref().map_or(false, |sr| {
-                sr.status == "audited" && sr.score.unwrap_or(0.0) >= 90.0
-            }) {
+            } else if entry
+                .security_review
+                .as_ref()
+                .is_some_and(|sr| sr.status == "audited" && sr.score.unwrap_or(0.0) >= 90.0)
+            {
                 ("Production-grade quality", 10.0)
             } else {
                 ("Suitable", 0.0)
@@ -659,12 +664,18 @@ mod tests {
 
     #[test]
     fn test_skill_level_from_str() {
-        assert_eq!(SkillLevel::from_str("beginner"), Some(SkillLevel::Beginner));
         assert_eq!(
-            SkillLevel::from_str("INTERMEDIATE"),
+            SkillLevel::parse_lenient("beginner"),
+            Some(SkillLevel::Beginner)
+        );
+        assert_eq!(
+            SkillLevel::parse_lenient("INTERMEDIATE"),
             Some(SkillLevel::Intermediate)
         );
-        assert_eq!(SkillLevel::from_str("expert"), Some(SkillLevel::Advanced));
-        assert_eq!(SkillLevel::from_str("unknown"), None);
+        assert_eq!(
+            SkillLevel::parse_lenient("expert"),
+            Some(SkillLevel::Advanced)
+        );
+        assert_eq!(SkillLevel::parse_lenient("unknown"), None);
     }
 }
diff --git a/src/utils/template_security_scanner.rs b/src/utils/template_security_scanner.rs
index 5eb3d8c9..30dab9bd 100644
--- a/src/utils/template_security_scanner.rs
+++ b/src/utils/template_security_scanner.rs
@@ -120,8 +120,8 @@ impl KnownVulnerabilities {
             if line.contains("transfer") && !line.trim().starts_with("//") {
                 // Check if state update happens after transfer
                 let mut state_after = false;
-                for j in (i + 1)..std::cmp::min(i + 10, lines.len()) {
-                    if lines[j].contains("storage") && lines[j].contains("set") {
+                for nearby in &lines[(i + 1)..std::cmp::min(i + 10, lines.len())] {
+                    if nearby.contains("storage") && nearby.contains("set") {
                         state_after = true;
                         break;
                     }
@@ -150,12 +150,12 @@ impl KnownVulnerabilities {
                 && (line.contains("&mut") || line.contains("env:"))
             {
                 let mut has_auth = false;
-                for j in i..std::cmp::min(i + 20, lines.len()) {
-                    if lines[j].contains("require_auth") {
+                for nearby in &lines[i..std::cmp::min(i + 20, lines.len())] {
+                    if nearby.contains("require_auth") {
                         has_auth = true;
                         break;
                     }
-                    if lines[j].contains("pub fn ") {
+                    if nearby.contains("pub fn ") {
                         break;
                     }
                 }
@@ -268,12 +268,12 @@ impl KnownVulnerabilities {
         for (i, line) in lines.iter().enumerate() {
             if line.contains("pub fn ") && (line.contains("admin") || line.contains("owner")) {
                 let mut has_check = false;
-                for j in i..std::cmp::min(i + 20, lines.len()) {
-                    if lines[j].contains("require_auth") || lines[j].contains("assert") {
+                for nearby in &lines[i..std::cmp::min(i + 20, lines.len())] {
+                    if nearby.contains("require_auth") || nearby.contains("assert") {
                         has_check = true;
                         break;
                     }
-                    if lines[j].contains("pub fn ") {
+                    if nearby.contains("pub fn ") {
                         break;
                     }
                 }
diff --git a/src/utils/template_version_ai.rs b/src/utils/template_version_ai.rs
index f2352a32..8625e4a0 100644
--- a/src/utils/template_version_ai.rs
+++ b/src/utils/template_version_ai.rs
@@ -2,7 +2,6 @@ use crate::utils::ollama;
 use crate::utils::template_vcs::{get_version_history, TemplateChangelog, TemplateVersion};
 use anyhow::{Context, Result};
 use semver::Version;
-use std::fs;
 use std::path::Path;
 use std::process::Command;
 
@@ -334,9 +333,9 @@ fn extract_list(text: &str, section: &str) -> Vec<String> {
     };
 
     let slice = &text[start + section.len()..];
-    let mut lines = slice.lines().skip_while(|l| l.trim().is_empty());
+    let lines = slice.lines().skip_while(|l| l.trim().is_empty());
 
-    while let Some(line) = lines.next() {
+    for line in lines {
         let line = line.trim();
         if line.is_empty() || line.contains(':') && !line.starts_with('-') {
             break;
diff --git a/src/utils/templates.rs b/src/utils/templates.rs
index f749d17b..0dcfe028 100644
--- a/src/utils/templates.rs
+++ b/src/utils/templates.rs
@@ -1559,6 +1559,9 @@ pub async fn get_template_by_name_and_version(
     }
 }
 
+// Not currently called from any code path in this crate. Kept rather than
+// removed since deleting it is a product decision, not a lint-scoping one.
+#[allow(dead_code)]
 fn semver_cmp(a: &str, b: &str) -> std::cmp::Ordering {
     let parse_version = |v: &str| {
         v.strip_prefix('v')
@@ -1797,6 +1800,10 @@ pub async fn publish_template(
 
 /// Like `publish_template` but also records optional CLI version constraints.
 /// Install a template from a directory or `.zip` archive into the local registry.
+// Each parameter is an independent, named input (CLI flags / distinct config
+// values); bundling them into a struct here would add indirection without
+// reducing real complexity.
+#[allow(clippy::too_many_arguments)]
 pub async fn install_template_package(
     package_path: &Path,
     name: String,
@@ -1824,6 +1831,10 @@ pub async fn install_template_package(
     .await
 }
 
+// Each parameter is an independent, named input (CLI flags / distinct config
+// values); bundling them into a struct here would add indirection without
+// reducing real complexity.
+#[allow(clippy::too_many_arguments)]
 pub async fn publish_template_versioned(
     template_path: &Path,
     name: String,
@@ -1875,16 +1886,15 @@ pub async fn publish_template_versioned(
     copy_dir_recursive(&source_root, &dest)?;
 
     let created_at = Utc::now().to_rfc3339();
-    let mut changelog: Vec<ChangelogEntry> = Vec::new();
-    changelog.push(ChangelogEntry {
+    let changelog = vec![ChangelogEntry {
         version: version.clone(),
         date: Utc::now().format("%Y-%m-%d").to_string(),
         notes: "Initial release".to_string(),
-    });
+    }];
 
     let entry = TemplateEntry {
         name: name.clone(),
-        changelog: None,
+        changelog: Some(changelog),
         repository: None,
         security_review: None,
         version: version.clone(),
@@ -2419,6 +2429,16 @@ pub async fn rollback_installed_template(name: &str) -> Result<TemplateUpdateRep
 mod tests {
     use super::*;
 
+    /// Regression test: the registry bundled into the binary is the last-resort
+    /// fallback used when there is no cache and no network (e.g. a fresh,
+    /// offline install). It must always deserialize cleanly.
+    #[test]
+    fn default_registry_parses() {
+        let registry: TemplateRegistry =
+            serde_json::from_str(DEFAULT_REGISTRY).expect("bundled registry.json must parse");
+        assert!(!registry.templates.is_empty());
+    }
+
     fn make_entry(name: &str) -> TemplateEntry {
         TemplateEntry {
             name: name.to_string(),
diff --git a/src/utils/test_automation.rs b/src/utils/test_automation.rs
index b3b0ef22..70142e13 100644
--- a/src/utils/test_automation.rs
+++ b/src/utils/test_automation.rs
@@ -1,9 +1,7 @@
-use anyhow::{Context, Result};
+use anyhow::Result;
 use serde::{Deserialize, Serialize};
-use std::collections::HashMap;
 use std::fs;
 use std::path::{Path, PathBuf};
-use std::process::Command;
 use std::sync::{Arc, Mutex};
 use std::thread;
 use std::time::Instant;
@@ -114,7 +112,7 @@ impl TestCaseGenerator {
     }
 
     pub fn generate_from_contract(&self) -> Result<TestSuite> {
-        let wasm_path = self
+        let _wasm_path = self
             .contract_path
             .join("target/wasm32-unknown-unknown/release");
 
@@ -208,7 +206,7 @@ impl TestCaseGenerator {
         &self,
         line: &str,
         line_num: usize,
-        file_path: &Path,
+        _file_path: &Path,
     ) -> Result<TestCase> {
         let function_name = line
             .trim_start()
@@ -312,7 +310,7 @@ impl ParallelTestRunner {
         self.generate_report(suite, results, duration)
     }
 
-    fn run_single_test(test: &TestCase, wasm_path: &Path) -> TestResult {
+    fn run_single_test(test: &TestCase, _wasm_path: &Path) -> TestResult {
         let start = Instant::now();
 
         // Simulate test execution
diff --git a/src/utils/test_generator.rs b/src/utils/test_generator.rs
index d22f7830..3f5aed17 100644
--- a/src/utils/test_generator.rs
+++ b/src/utils/test_generator.rs
@@ -210,6 +210,9 @@ fn safe_identifier(value: &str) -> String {
     identifier
 }
 
+// Not currently called from any code path in this crate. Kept rather than
+// removed since deleting it is a product decision, not a lint-scoping one.
+#[allow(dead_code)]
 fn is_mutating(content: &str, func: &str) -> bool {
     let mut in_fn = false;
     for line in content.lines() {
diff --git a/src/utils/test_optimizer.rs b/src/utils/test_optimizer.rs
index 9eecd29b..0b7ad67c 100644
--- a/src/utils/test_optimizer.rs
+++ b/src/utils/test_optimizer.rs
@@ -4,9 +4,6 @@ use serde::{Deserialize, Serialize};
 use std::collections::{HashMap, HashSet};
 use std::fs;
 use std::path::{Path, PathBuf};
-use std::sync::{Arc, Mutex};
-use std::thread;
-use std::time::{Duration, Instant};
 
 // ── Core Data Structures ─────────────────────────────────────────────────────
 
@@ -448,7 +445,7 @@ impl TestOptimizer {
 
         let mut score = stability * 60.0 + transition_ratio * 40.0;
 
-        if failure_rate < 0.1 || failure_rate > 0.9 {
+        if !(0.1..=0.9).contains(&failure_rate) {
             score *= 0.3;
         }
 
@@ -672,7 +669,7 @@ impl TestOptimizer {
         let avg = total_duration as f64 / results.len() as f64;
 
         let mut sorted = results.to_vec();
-        sorted.sort_by(|a, b| a.duration_ms.cmp(&b.duration_ms));
+        sorted.sort_by_key(|a| a.duration_ms);
 
         let median = sorted[sorted.len() / 2].duration_ms as f64;
         let p95_idx = ((sorted.len() as f64 * 0.95) as usize).min(sorted.len() - 1);
@@ -809,7 +806,7 @@ impl TestOptimizer {
                 }
             })
             .collect();
-        category_summary.sort_by(|a, b| b.total_failures.cmp(&a.total_failures));
+        category_summary.sort_by_key(|a| std::cmp::Reverse(a.total_failures));
 
         let recurrence_ratio = if total_failing > 0 {
             all_failing
diff --git a/src/utils/testnet_integration.rs b/src/utils/testnet_integration.rs
index bf5ac782..330b087a 100644
--- a/src/utils/testnet_integration.rs
+++ b/src/utils/testnet_integration.rs
@@ -1,5 +1,4 @@
 use anyhow::{Context, Result};
-use reqwest;
 use serde::{Deserialize, Serialize};
 use std::time::{Duration, Instant};
 
@@ -173,6 +172,9 @@ pub struct LedgerEntryResult {
 // ── Raw JSON-RPC helpers ───────────────────────────────────────────────────
 
 #[derive(Debug, Serialize)]
+// Not currently called from any code path in this crate. Kept rather than
+// removed since deleting it is a product decision, not a lint-scoping one.
+#[allow(dead_code)]
 struct RpcRequest<'a> {
     jsonrpc: &'static str,
     id: u64,
diff --git a/tests/bindings_tests.rs b/tests/bindings_tests.rs
index f5f41229..adc2edd1 100644
--- a/tests/bindings_tests.rs
+++ b/tests/bindings_tests.rs
@@ -1,5 +1,4 @@
 use starforge::utils::bindings::{self, BindingLanguage};
-use std::path::Path;
 use tempfile::NamedTempFile;
 
 // Create a minimal valid WASM with contract metadata section for testing
diff --git a/tests/contract_property_tests.rs b/tests/contract_property_tests.rs
index 06de2475..271dca77 100644
--- a/tests/contract_property_tests.rs
+++ b/tests/contract_property_tests.rs
@@ -287,6 +287,9 @@ proptest! {
             vec![serde_json::json!("test")],
             serde_json::json!({"data": 1}),
         );
+        let account = MockAddress::account(1);
+        env.auth.auto_approve(account.clone());
+        env.auth.require_auth(&account, &MockAddress::contract(1), "test_fn");
         env.auth.auto_approve(MockAddress::account(1));
         env.auth.require_auth(&MockAddress::account(1), &MockAddress::contract(1), "test");
 
diff --git a/tests/multisig_builder_ui.rs b/tests/multisig_builder_ui.rs
index 82254bce..3e35dc3d 100644
--- a/tests/multisig_builder_ui.rs
+++ b/tests/multisig_builder_ui.rs
@@ -1,6 +1,6 @@
 use starforge::utils::multisig_builder::{
-    generate_signature, proposal_from_template, render_progress_blocks, template_definitions,
-    validate_for_submit, Proposal,
+    calculate_progress, generate_signature, proposal_from_template, render_progress_bar,
+    render_progress_blocks, template_definitions, validate_for_submit, Proposal,
 };
 
 #[test]
@@ -43,6 +43,13 @@ fn progress_tracks_valid_signatures_and_pending_signers() {
 
     assert_eq!(proposal.signatures.len(), 1);
     assert_eq!(proposal.threshold, 2);
+    let progress = calculate_progress(&proposal);
+    assert_eq!(progress.percent, 50);
+    assert!(!proposal.is_complete());
+    assert_eq!(proposal.pending_signers(), vec!["bob", "carol"]);
+
+    let bar = render_progress_bar(&progress, 10);
+    assert_eq!(bar, "[#####.....] 50% (1/2)");
     let (_, percent) = render_progress_blocks(proposal.signatures.len(), proposal.threshold);
     assert_eq!(percent, 50);
     assert!(!proposal.is_complete());
@@ -95,6 +102,8 @@ fn validation_marks_ready_when_threshold_is_met() {
 
     assert!(validate_for_submit(&proposal).is_ok());
     assert!(proposal.is_complete());
+    let progress = calculate_progress(&proposal);
+    assert_eq!(progress.percent, 100);
     let (_, percent) = render_progress_blocks(proposal.signatures.len(), proposal.threshold);
     assert_eq!(percent, 100);
 }
diff --git a/tests/template_recommendation.rs b/tests/template_recommendation.rs
index 5f218e25..9eaa8d7e 100644
--- a/tests/template_recommendation.rs
+++ b/tests/template_recommendation.rs
@@ -91,7 +91,7 @@ fn skill_level_parses_all_variants() {
         ("senior", SkillLevel::Advanced),
     ] {
         assert_eq!(
-            SkillLevel::from_str(input),
+            SkillLevel::parse_lenient(input),
             Some(expected),
             "Expected '{}' to parse correctly",
             input
@@ -103,7 +103,7 @@ fn skill_level_parses_all_variants() {
 fn skill_level_rejects_unknown_strings() {
     for bad in ["", "pro", "newbie", "wizard", "123"] {
         assert_eq!(
-            SkillLevel::from_str(bad),
+            SkillLevel::parse_lenient(bad),
             None,
             "Expected '{}' to be rejected",
             bad
diff --git a/tests/test_optimizer_integration.rs b/tests/test_optimizer_integration.rs
index 561f3078..262fddba 100644
--- a/tests/test_optimizer_integration.rs
+++ b/tests/test_optimizer_integration.rs
@@ -5,7 +5,6 @@
 //! failure pattern analysis, and report generation.
 
 use std::collections::HashMap;
-use std::path::PathBuf;
 
 use starforge::utils::test_generator::GeneratedTestCase;
 use starforge::utils::test_optimizer::*;