From 578b79bba627538d60dea3f6ca43662ee157a794 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 7 Aug 2026 13:11:58 +0000
Subject: [PATCH 1/2] ogar-vocab: the codebook is TRIGGERED by plug-and-play,
 not minted
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Builds the activation path I had been calling "not built yet" as though
it were an external constraint. It was mine.

The mechanism: `resolve_hotplug` resolves a plugged classid against
`class_ids::ALL` FIRST, then against whatever a compiled-in feature
ACTIVATED. Canon wins — a feature can ADD a concept the global codebook
lacks; it can never SHADOW one it has.

`ogar-vocab` gains a `blocks` feature, off by default, carrying the
Blocks palette concept (0x1717) + its capability table. `ogar-blockly`
deps `ogar-vocab` with `features = ["blocks"]`, so activation is CARGO
PRESENCE, not runtime detection — the same rule lance-graph-ogar
documents. A consumer that never touches a block editor never compiles
the module and sees 0x17XX exactly as before: a reserved domain, zero
concepts.

Critically, `class_ids::ALL` is UNCHANGED at 90. That surface is
mirrored into lance-graph under a compile-time count fuse, so minting
there is by construction a lance-graph change — which is how the earlier
attempt turned lance-graph red. The activated rows live beside it and are
consulted alongside it, never merged in.

One source of truth for the id: `BLOCK_PALETTE` is declared here and
READ by `ogar_blockly::BlockConcept::Palette`. The reverse is impossible
(ogar-blockly deps ogar-vocab), and two constants for one id is exactly
the drift the join exists to catch.

A real bug the tests caught, worth recording: `derive_action_rows`
resolved `object_class` through the CODEBOOK only, so the concept
resolved as a plugged classid (plug accepted) while its capabilities
silently fell into the slag ledger — the port answered
`NoCapabilitiesFor(0x1717)` for a table sitting right there. BOTH halves
of the join must consult the same set; `activated_concept_id` is the
by-name half of `resolve_concept_row`'s by-id lookup.

Proven both ways in a SEPARATE crate outside this workspace, so feature
unification could not fake it:
  feature OFF -> Err(UnknownClassid(5911))   zero 0x17XX rows
  feature ON  -> resolves, all 5 capabilities
Plus tests asserting 0x1717 is absent from class_ids::ALL (or "it
resolved" proves nothing about WHERE), that plugging 0x1701/0x1702 does
NOT resolve (they are the substrate's), and the three drift arms.

Workspace: 80 test binaries, 0 failures. clippy -D warnings clean with
the feature on. fmt scoped with -p, never --all.
---
 crates/ogar-blockly/Cargo.toml               |   5 +-
 crates/ogar-blockly/src/lib.rs               |  16 +-
 crates/ogar-encryption/src/lib.rs            |   2 +-
 crates/ogar-obo/examples/bake_obo.rs         |  60 ++++--
 crates/ogar-obo/src/crosswalk.rs             |  54 +++--
 crates/ogar-obo/src/lib.rs                   | 142 ++++++++-----
 crates/ogar-obo/src/reason.rs                |  38 +++-
 crates/ogar-render-askama/src/field_view.rs  |  13 +-
 crates/ogar-vocab/Cargo.toml                 |  10 +
 crates/ogar-vocab/src/blocks_actions.rs      | 208 +++++++++++++++++++
 crates/ogar-vocab/src/capability_registry.rs |  80 ++++++-
 crates/ogar-vocab/src/lib.rs                 |  10 +-
 12 files changed, 536 insertions(+), 102 deletions(-)
 create mode 100644 crates/ogar-vocab/src/blocks_actions.rs

diff --git a/crates/ogar-blockly/Cargo.toml b/crates/ogar-blockly/Cargo.toml
index 35dc9bc..3d503a6 100644
--- a/crates/ogar-blockly/Cargo.toml
+++ b/crates/ogar-blockly/Cargo.toml
@@ -14,5 +14,8 @@ serde = ["dep:serde", "ogar-vocab/serde", "ogar-loco/serde"]
 
 [dependencies]
 ogar-loco = { path = "../ogar-loco" }
-ogar-vocab = { path = "../ogar-vocab" }
+# `features = ["blocks"]` IS the activation: any build graph containing this
+# crate activates the Blocks codebook in ogar-vocab, and no other build does.
+# Cargo presence, not runtime detection.
+ogar-vocab = { path = "../ogar-vocab", features = ["blocks"] }
 serde = { workspace = true, optional = true }
diff --git a/crates/ogar-blockly/src/lib.rs b/crates/ogar-blockly/src/lib.rs
index 94f822d..935dd9f 100644
--- a/crates/ogar-blockly/src/lib.rs
+++ b/crates/ogar-blockly/src/lib.rs
@@ -166,12 +166,22 @@ impl BlockConcept {
 
     /// This concept's canonical id inside the `0x17XX` Blocks domain.
     ///
-    /// Authoritative HERE; `ogar_vocab`'s shared CODEBOOK deliberately carries
-    /// zero `0x17XX` rows (plug-and-play, mirroring `ogar_obo::Namespace`).
+    /// **Read from `ogar_vocab`, never re-declared here.** The id is declared
+    /// once in [`ogar_vocab::blocks_actions::BLOCK_PALETTE`] — the crate that
+    /// also declares the capability table keyed by it — because this crate
+    /// depends on `ogar-vocab` and the reverse is impossible. Two constants
+    /// for one id is exactly the drift the classid join exists to catch.
+    ///
+    /// That row is **activated, not canon**: it lives behind `ogar-vocab`'s
+    /// `blocks` feature, which this crate's dependency turns on, so it exists
+    /// only in a build graph that actually contains a block editor. The shared
+    /// `class_ids::ALL` keeps zero `0x17XX` rows — that surface is mirrored
+    /// into lance-graph under a compile-time fuse, and a frontend's palette is
+    /// not lance-graph's concern.
     #[must_use]
     pub const fn concept_id(self) -> u16 {
         match self {
-            BlockConcept::Palette => 0x1717,
+            BlockConcept::Palette => ogar_vocab::blocks_actions::BLOCK_PALETTE,
         }
     }
 
diff --git a/crates/ogar-encryption/src/lib.rs b/crates/ogar-encryption/src/lib.rs
index 41a4c9f..ebebb1e 100644
--- a/crates/ogar-encryption/src/lib.rs
+++ b/crates/ogar-encryption/src/lib.rs
@@ -62,7 +62,7 @@ pub use encryption::{aead, envelope, hash, kdf, sign};
 // ── Root-level convenience aliases, mirrored from `encryption`'s own root
 // re-exports (`envelope::{seal, open}` plus the envelope's error/parameter
 // types), so callers that used the upstream crate's short paths keep them.
-pub use encryption::{open, seal, EnvelopeError, KdfParams};
+pub use encryption::{EnvelopeError, KdfParams, open, seal};
 
 // ── The platform-CSPRNG-unavailable error, mirrored from `encryption`'s
 // crate root.
diff --git a/crates/ogar-obo/examples/bake_obo.rs b/crates/ogar-obo/examples/bake_obo.rs
index 1411c7f..d2d13ec 100644
--- a/crates/ogar-obo/examples/bake_obo.rs
+++ b/crates/ogar-obo/examples/bake_obo.rs
@@ -9,8 +9,8 @@
 //! scratch dir, never committed.
 
 use ogar_obo::{
-    Namespace, bake, merge_logical_defs, parse_hp_logical_defs, parse_obo, reason,
-    rows_from_le_bytes, as_le_bytes,
+    Namespace, as_le_bytes, bake, merge_logical_defs, parse_hp_logical_defs, parse_obo, reason,
+    rows_from_le_bytes,
 };
 use std::collections::HashMap;
 
@@ -22,12 +22,13 @@ fn main() {
     let mut nodes = HashMap::new();
     for f in ["mondo", "hp", "uberon", "pato", "ro"] {
         let path = format!("{dir}/{f}.obo");
-        let text = std::fs::read_to_string(&path)
-            .unwrap_or_else(|e| panic!("read {path}: {e}"));
+        let text = std::fs::read_to_string(&path).unwrap_or_else(|e| panic!("read {path}: {e}"));
         let part = parse_obo(&text);
         let (terms, edges) = (
             part.len(),
-            part.values().map(|n| n.is_a.len() + n.rel.len() + n.xref.len()).sum::<usize>(),
+            part.values()
+                .map(|n| n.is_a.len() + n.rel.len() + n.xref.len())
+                .sum::<usize>(),
         );
         println!("  parsed {f:8} terms={terms:6} edges+xref={edges}");
         for (id, n) in part {
@@ -42,7 +43,10 @@ fn main() {
     // HPO logical-definition grounding (anatomy:quality) from hp-base.owl.
     let owl = std::fs::read_to_string(format!("{dir}/hp-base.owl")).unwrap_or_default();
     let defs = parse_hp_logical_defs(&owl);
-    println!("  hp-base logical defs: {} HP->Uberon/PATO grounding edges", defs.len());
+    println!(
+        "  hp-base logical defs: {} HP->Uberon/PATO grounding edges",
+        defs.len()
+    );
     merge_logical_defs(&mut nodes, &defs);
 
     let baked = bake(&nodes, 0x0000);
@@ -56,36 +60,62 @@ fn main() {
     println!("  MONDO->HP resolve      : {}", s.mondo_hp);
     println!("  HP->UBERON resolve     : {}", s.hp_uberon);
     println!("  HP->PATO resolve       : {}", s.hp_pato);
-    println!("  xrefs preserved        : {} (MeSH bearings: {})", s.xrefs, s.mesh_xrefs);
+    println!(
+        "  xrefs preserved        : {} (MeSH bearings: {})",
+        s.xrefs, s.mesh_xrefs
+    );
 
     // Per-namespace row census.
     let mut census: HashMap<u8, usize> = HashMap::new();
     for id in &baked.ids {
         *census.entry(id.ns).or_default() += 1;
     }
-    for ns in [Namespace::Mondo, Namespace::Hpo, Namespace::Uberon, Namespace::Pato, Namespace::Ro] {
-        println!("    {:8}: {}", ns.prefix(), census.get(&(ns as u8)).copied().unwrap_or(0));
+    for ns in [
+        Namespace::Mondo,
+        Namespace::Hpo,
+        Namespace::Uberon,
+        Namespace::Pato,
+        Namespace::Ro,
+    ] {
+        println!(
+            "    {:8}: {}",
+            ns.prefix(),
+            census.get(&(ns as u8)).copied().unwrap_or(0)
+        );
     }
 
     println!("\n=== EL SATURATION (ELK subset, excavated to Rust) ===");
     let el = reason::saturate(&baked.triples);
     println!("  is_a subsumption pairs   : {}", el.subsumption_pairs);
     println!("  part_of transitive pairs : {}", el.part_of_pairs);
-    println!("  existential inferred (R∃): {} (grounding inherited up the spine)", el.existential_inferred);
-    println!("  unsatisfiable            : {} (no disjointness axioms in base obo)", el.unsatisfiable);
+    println!(
+        "  existential inferred (R∃): {} (grounding inherited up the spine)",
+        el.existential_inferred
+    );
+    println!(
+        "  unsatisfiable            : {} (no disjointness axioms in base obo)",
+        el.unsatisfiable
+    );
 
     // Write the artifact + verify it round-trips through the loader contract.
     let bytes = as_le_bytes(&baked.rows);
     std::fs::write(&out, bytes).unwrap_or_else(|e| panic!("write {out}: {e}"));
     println!("\n=== ARTIFACT ===");
-    println!("  {out}  ({} bytes = {} rows × 512)", bytes.len(), baked.rows.len());
+    println!(
+        "  {out}  ({} bytes = {} rows × 512)",
+        bytes.len(),
+        baked.rows.len()
+    );
     let readback = std::fs::read(&out).expect("reread");
     match rows_from_le_bytes(&readback) {
         Some(rows) => {
             // NB: a fresh Vec<u8> from fs::read may not be 64-aligned; the loader
             // returns None then and a real consumer uses FixedSizeBinary(512)
             // (arrow-aligned). We verify the in-memory aligned view instead.
-            println!("  reread rows_from_le_bytes: {} rows (aligned buffer)", rows.len());
+            println!(
+                "  reread rows_from_le_bytes: {} rows (aligned buffer)",
+                rows.len()
+            );
         }
         None => {
             let inmem = rows_from_le_bytes(bytes).expect("in-memory aligned view");
@@ -97,5 +127,7 @@ fn main() {
             );
         }
     }
-    println!("  loader contract: VERIFIED (as_le_bytes ↔ rows_from_le_bytes, 512×N, 64-align gate)");
+    println!(
+        "  loader contract: VERIFIED (as_le_bytes ↔ rows_from_le_bytes, 512×N, 64-align gate)"
+    );
 }
diff --git a/crates/ogar-obo/src/crosswalk.rs b/crates/ogar-obo/src/crosswalk.rs
index 57e7c61..b905daa 100644
--- a/crates/ogar-obo/src/crosswalk.rs
+++ b/crates/ogar-obo/src/crosswalk.rs
@@ -103,16 +103,17 @@ impl Crosswalk {
             // roll up: drop a trailing digit past the 3-char WHO stem, else the
             // sub-category dot, else give up.
             if let Some(pos) = c.rfind(|ch: char| ch.is_ascii_digit())
-                && (c.len() > 3 || (c.contains('.') && pos > c.find('.').unwrap())) {
-                    c.truncate(pos);
-                    if c.ends_with('.') {
-                        c.pop();
-                    }
-                    if c.is_empty() {
-                        return None;
-                    }
-                    continue;
+                && (c.len() > 3 || (c.contains('.') && pos > c.find('.').unwrap()))
+            {
+                c.truncate(pos);
+                if c.ends_with('.') {
+                    c.pop();
                 }
+                if c.is_empty() {
+                    return None;
+                }
+                continue;
+            }
             return None;
         }
     }
@@ -153,16 +154,31 @@ mod tests {
         let mut nodes: HashMap<TermId, OboNode> = HashMap::new();
         // MONDO:5148 (T2DM) xrefs ICD-10 E11 + MeSH D003924
         nodes.insert(
-            TermId { ns: Namespace::Mondo as u8, num: 5148 },
+            TermId {
+                ns: Namespace::Mondo as u8,
+                num: 5148,
+            },
             node_with_xrefs(vec![
-                Xref { source: XrefSource::Icd, id: "E11".into() },
-                Xref { source: XrefSource::Mesh, id: "D003924".into() },
+                Xref {
+                    source: XrefSource::Icd,
+                    id: "E11".into(),
+                },
+                Xref {
+                    source: XrefSource::Mesh,
+                    id: "D003924".into(),
+                },
             ]),
         );
         // UBERON:945 (stomach) xrefs FMA:7148
         nodes.insert(
-            TermId { ns: Namespace::Uberon as u8, num: 945 },
-            node_with_xrefs(vec![Xref { source: XrefSource::Other("FMA".into()), id: "7148".into() }]),
+            TermId {
+                ns: Namespace::Uberon as u8,
+                num: 945,
+            },
+            node_with_xrefs(vec![Xref {
+                source: XrefSource::Other("FMA".into()),
+                id: "7148".into(),
+            }]),
         );
         let baked = bake(&nodes, 0x0000);
         let cw = Crosswalk::from_bake(&baked);
@@ -187,8 +203,14 @@ mod tests {
         // roll up to it (measured: MONDO carries no ICD-10-GM).
         let mut nodes: HashMap<TermId, OboNode> = HashMap::new();
         nodes.insert(
-            TermId { ns: Namespace::Mondo as u8, num: 5148 },
-            node_with_xrefs(vec![Xref { source: XrefSource::Icd, id: "E11".into() }]),
+            TermId {
+                ns: Namespace::Mondo as u8,
+                num: 5148,
+            },
+            node_with_xrefs(vec![Xref {
+                source: XrefSource::Icd,
+                id: "E11".into(),
+            }]),
         );
         let cw = Crosswalk::from_bake(&bake(&nodes, 0x0000));
         // direct GM code fails, rollup succeeds — no separate GM table
diff --git a/crates/ogar-obo/src/lib.rs b/crates/ogar-obo/src/lib.rs
index e9391dd..3b3d8e2 100644
--- a/crates/ogar-obo/src/lib.rs
+++ b/crates/ogar-obo/src/lib.rs
@@ -171,10 +171,7 @@ impl TermId {
         if num > 0x00FF_FFFF {
             return None;
         }
-        Some(TermId {
-            ns: ns as u8,
-            num,
-        })
+        Some(TermId { ns: ns as u8, num })
     }
 
     /// This term's namespace.
@@ -414,16 +411,18 @@ pub fn parse_obo(text: &str) -> std::collections::HashMap<TermId, OboNode> {
             // `relationship: <REL> <TARGET> ! label` — the target is the LAST
             // whitespace token before any `!`.
             if let Some(sid) = cur
-                && let Some(t) = last_curie(rest) {
-                    let p = classify(sid.namespace(), t.namespace());
-                    nodes.entry(sid).or_default().rel.push((p, t));
-                }
+                && let Some(t) = last_curie(rest)
+            {
+                let p = classify(sid.namespace(), t.namespace());
+                nodes.entry(sid).or_default().rel.push((p, t));
+            }
         } else if let Some(rest) = line.strip_prefix("intersection_of: ") {
             if let Some(sid) = cur
-                && let Some(t) = last_curie(rest) {
-                    let p = classify(sid.namespace(), t.namespace());
-                    nodes.entry(sid).or_default().rel.push((p, t));
-                }
+                && let Some(t) = last_curie(rest)
+            {
+                let p = classify(sid.namespace(), t.namespace());
+                nodes.entry(sid).or_default().rel.push((p, t));
+            }
         } else if let Some(rest) = line.strip_prefix("xref: ") {
             // `xref: <SOURCE>:<ID> ! label` — the projection-join / guideline
             // bearing. Kept verbatim; NEVER truncated (MeSH → Leitlinie spider).
@@ -431,12 +430,14 @@ pub fn parse_obo(text: &str) -> std::collections::HashMap<TermId, OboNode> {
                 let tok = rest.split('!').next().unwrap_or(rest).trim();
                 let tok = tok.split_whitespace().next().unwrap_or(tok);
                 if let Some((src, id)) = tok.split_once(':')
-                    && !src.is_empty() && !id.is_empty() {
-                        nodes.entry(sid).or_default().xref.push(Xref {
-                            source: XrefSource::from_prefix(src),
-                            id: id.to_string(),
-                        });
-                    }
+                    && !src.is_empty()
+                    && !id.is_empty()
+                {
+                    nodes.entry(sid).or_default().xref.push(Xref {
+                        source: XrefSource::from_prefix(src),
+                        id: id.to_string(),
+                    });
+                }
             }
         }
     }
@@ -446,14 +447,22 @@ pub fn parse_obo(text: &str) -> std::collections::HashMap<TermId, OboNode> {
 /// First whitespace token of a line (before any `!` comment) — the target of
 /// an `is_a:` line.
 fn first_curie(s: &str) -> &str {
-    s.split('!').next().unwrap_or(s).split_whitespace().next().unwrap_or("").trim()
+    s.split('!')
+        .next()
+        .unwrap_or(s)
+        .split_whitespace()
+        .next()
+        .unwrap_or("")
+        .trim()
 }
 
 /// Last CURIE-shaped token before any `!` — the object of a `relationship:` /
 /// `intersection_of:` line (the predicate is the earlier token).
 fn last_curie(s: &str) -> Option<TermId> {
     let head = s.split('!').next().unwrap_or(s);
-    head.split_whitespace().rfind(|t| t.contains(':')).and_then(TermId::parse)
+    head.split_whitespace()
+        .rfind(|t| t.contains(':'))
+        .and_then(TermId::parse)
 }
 
 // ── bake: nodes+edges → 512-byte rows + SPO triples + stats ────────────────
@@ -506,10 +515,7 @@ pub struct Bake {
 /// logical-def edges folded into the nodes' `rel`) into [`Bake`]. `app_prefix`
 /// is the lo-u16 render skin (`0x0000` = the canonical reference skin).
 #[must_use]
-pub fn bake(
-    nodes: &std::collections::HashMap<TermId, OboNode>,
-    app_prefix: u16,
-) -> Bake {
+pub fn bake(nodes: &std::collections::HashMap<TermId, OboNode>, app_prefix: u16) -> Bake {
     let mut ids: Vec<TermId> = nodes
         .iter()
         .filter(|(_, n)| !n.obsolete)
@@ -655,22 +661,35 @@ pub fn parse_hp_logical_defs(owl: &str) -> Vec<(TermId, Predicate, TermId)> {
             in_eq += 1;
         }
         if in_eq > 0
-            && let Some(sid) = cur {
-                for uid in find_obo_ids(line, "UBERON_") {
-                    out.push((
-                        TermId { ns: Namespace::Hpo as u8, num: sid },
-                        Predicate::HasAnatomy,
-                        TermId { ns: Namespace::Uberon as u8, num: uid },
-                    ));
-                }
-                for pid in find_obo_ids(line, "PATO_") {
-                    out.push((
-                        TermId { ns: Namespace::Hpo as u8, num: sid },
-                        Predicate::HasQuality,
-                        TermId { ns: Namespace::Pato as u8, num: pid },
-                    ));
-                }
+            && let Some(sid) = cur
+        {
+            for uid in find_obo_ids(line, "UBERON_") {
+                out.push((
+                    TermId {
+                        ns: Namespace::Hpo as u8,
+                        num: sid,
+                    },
+                    Predicate::HasAnatomy,
+                    TermId {
+                        ns: Namespace::Uberon as u8,
+                        num: uid,
+                    },
+                ));
             }
+            for pid in find_obo_ids(line, "PATO_") {
+                out.push((
+                    TermId {
+                        ns: Namespace::Hpo as u8,
+                        num: sid,
+                    },
+                    Predicate::HasQuality,
+                    TermId {
+                        ns: Namespace::Pato as u8,
+                        num: pid,
+                    },
+                ));
+            }
+        }
         if line.contains("</owl:equivalentClass>") {
             in_eq = (in_eq - 1).max(0);
         }
@@ -685,7 +704,10 @@ fn find_hp_about(line: &str) -> Option<u32> {
     let i = line.find("owl:Class rdf:about=")?;
     let rest = &line[i..];
     let j = rest.find("HP_")?;
-    let digits: String = rest[j + 3..].chars().take_while(char::is_ascii_digit).collect();
+    let digits: String = rest[j + 3..]
+        .chars()
+        .take_while(char::is_ascii_digit)
+        .collect();
     digits.parse().ok()
 }
 
@@ -697,9 +719,10 @@ fn find_obo_ids(line: &str, prefix: &str) -> Vec<u32> {
         let after = &hay[i + prefix.len()..];
         let digits: String = after.chars().take_while(char::is_ascii_digit).collect();
         if let Ok(n) = digits.parse::<u32>()
-            && n <= 0x00FF_FFFF {
-                ids.push(n);
-            }
+            && n <= 0x00FF_FFFF
+        {
+            ids.push(n);
+        }
         hay = &after[digits.len()..];
     }
     ids
@@ -742,15 +765,26 @@ mod tests {
     fn v3_tail_carries_oversize_curie_numerics_on_the_family_identity_rail() {
         // Above u16 — the case a bare `identity` cannot hold.
         let big = 700_092u32;
-        assert!(big > u32::from(u16::MAX), "fixture must exceed the u16 the rail exists for");
+        assert!(
+            big > u32::from(u16::MAX),
+            "fixture must exceed the u16 the rail exists for"
+        );
         let k = pack_key(Namespace::Mondo.render_classid(0x0000), big);
 
         // Byte positions, per new_v2.
-        assert_eq!(&k[10..12], &[0, 0], "leaf stays dormant (RESERVE, DON'T RECLAIM)");
+        assert_eq!(
+            &k[10..12],
+            &[0, 0],
+            "leaf stays dormant (RESERVE, DON'T RECLAIM)"
+        );
         let family = u16::from_le_bytes([k[12], k[13]]);
         let identity = u16::from_le_bytes([k[14], k[15]]);
         assert_eq!(u32::from(family), big >> 16, "family holds the high half");
-        assert_eq!(u32::from(identity), big & 0xFFFF, "identity holds the low half");
+        assert_eq!(
+            u32::from(identity),
+            big & 0xFFFF,
+            "identity holds the low half"
+        );
 
         // Lossless through the public reader.
         let mut row = Row512::zeroed();
@@ -762,13 +796,19 @@ mod tests {
         // The V1 read of the SAME bytes must NOT agree — proof the tail really
         // moved, not that both layouts happen to coincide on this fixture.
         let v1_read = u32::from_le_bytes([row.0[13], row.0[14], row.0[15], 0]);
-        assert_ne!(v1_read, big, "a V1 u24 read of a V3 row must be observably wrong");
+        assert_ne!(
+            v1_read, big,
+            "a V1 u24 read of a V3 row must be observably wrong"
+        );
 
         // Ordering is preserved: family is the HIGH half, so (family, identity)
         // sorts as the numeric does. This is what keeps binary-search-by-key
         // valid over the sorted bake.
         let lo = pack_key(Namespace::Mondo.render_classid(0x0000), 5_148);
-        assert!(lo[12..16] < k[12..16], "tail bytes order as the numeric orders");
+        assert!(
+            lo[12..16] < k[12..16],
+            "tail bytes order as the numeric orders"
+        );
     }
 
     #[test]
@@ -798,7 +838,11 @@ is_a: MONDO:0005015 ! diabetes mellitus\n";
         let t = n(Namespace::Mondo, 5148);
         let node = &nodes[&t];
         assert_eq!(node.xref.len(), 3, "all three xrefs kept");
-        assert!(node.xref.iter().any(|x| x.source == XrefSource::Mesh && x.id == "D003924"));
+        assert!(
+            node.xref
+                .iter()
+                .any(|x| x.source == XrefSource::Mesh && x.id == "D003924")
+        );
         let bake = bake(&nodes, 0x0000);
         assert_eq!(bake.stats.mesh_xrefs, 1, "MeSH bearing counted");
         assert_eq!(bake.stats.xrefs, 3);
diff --git a/crates/ogar-obo/src/reason.rs b/crates/ogar-obo/src/reason.rs
index 05c06ca..093fe2d 100644
--- a/crates/ogar-obo/src/reason.rs
+++ b/crates/ogar-obo/src/reason.rs
@@ -115,9 +115,7 @@ pub struct ElStats {
 /// Returns, per node, the sorted deduped set of all transitive ancestors.
 /// Assumes acyclic (run [`count_is_a_cycles`] first); a residual cycle is
 /// simply not expanded past a re-visit, never loops.
-fn ancestor_closure(
-    adj: &HashMap<TermId, Vec<TermId>>,
-) -> HashMap<TermId, Vec<TermId>> {
+fn ancestor_closure(adj: &HashMap<TermId, Vec<TermId>>) -> HashMap<TermId, Vec<TermId>> {
     // Kahn order over the parent graph, then DP bottom-up.
     // Build reverse (parent -> children) for indegree over child->parent edges.
     let mut all: Vec<TermId> = Vec::new();
@@ -309,9 +307,15 @@ mod tests {
 
     fn t(sns: Namespace, s: u32, p: Predicate, ons: Namespace, o: u32) -> Triple {
         Triple {
-            s: TermId { ns: sns as u8, num: s },
+            s: TermId {
+                ns: sns as u8,
+                num: s,
+            },
             p,
-            o: TermId { ns: ons as u8, num: o },
+            o: TermId {
+                ns: ons as u8,
+                num: o,
+            },
         }
     }
 
@@ -353,9 +357,27 @@ mod tests {
         //   UBERON:200 is_a    UBERON:300       (which is a kind of ...)
         // ⟹ HP:9 is grounded to UBERON:{200,300} too (2 inferred-beyond-asserted).
         let tr = vec![
-            t(Namespace::Hpo, 9, Predicate::HasAnatomy, Namespace::Uberon, 100),
-            t(Namespace::Uberon, 100, Predicate::PartOf, Namespace::Uberon, 200),
-            t(Namespace::Uberon, 200, Predicate::IsA, Namespace::Uberon, 300),
+            t(
+                Namespace::Hpo,
+                9,
+                Predicate::HasAnatomy,
+                Namespace::Uberon,
+                100,
+            ),
+            t(
+                Namespace::Uberon,
+                100,
+                Predicate::PartOf,
+                Namespace::Uberon,
+                200,
+            ),
+            t(
+                Namespace::Uberon,
+                200,
+                Predicate::IsA,
+                Namespace::Uberon,
+                300,
+            ),
         ];
         let s = saturate(&tr);
         // R∃ fires on BOTH existentials: HP:9→{200,300} (2) AND the part_of
diff --git a/crates/ogar-render-askama/src/field_view.rs b/crates/ogar-render-askama/src/field_view.rs
index c5f1d28..9fbd6fd 100644
--- a/crates/ogar-render-askama/src/field_view.rs
+++ b/crates/ogar-render-askama/src/field_view.rs
@@ -217,7 +217,10 @@ mod tests {
 
         // The surface is addressed by class + concept + key.
         assert!(src.contains("data-class-id=\"0x0102\""), "{src}");
-        assert!(src.contains("data-concept=\"commercial_document\""), "{src}");
+        assert!(
+            src.contains("data-concept=\"commercial_document\""),
+            "{src}"
+        );
         assert!(src.contains("data-key=\"0801000301020304\""), "{src}");
         // Each field carries its POSITION (layout address) — including the
         // wide position past 63.
@@ -265,7 +268,10 @@ mod tests {
 
         assert!(!src.contains("<script>alert('label')"), "label raw:\n{src}");
         assert!(!src.contains("<img src=x onerror"), "value raw:\n{src}");
-        assert!(!src.contains("<script>alert('action')"), "action raw:\n{src}");
+        assert!(
+            !src.contains("<script>alert('action')"),
+            "action raw:\n{src}"
+        );
         assert!(!src.contains("<title-xss>"), "title raw:\n{src}");
         assert!(!src.contains("<concept-xss>"), "concept raw:\n{src}");
         // The escaped form is present (quote encoding varies by askama
@@ -275,8 +281,7 @@ mod tests {
 
     #[test]
     fn empty_actions_omit_the_nav() {
-        let src =
-            render_field_view(1, "c", "00", "T", &sample_fields(), &[]).unwrap();
+        let src = render_field_view(1, "c", "00", "T", &sample_fields(), &[]).unwrap();
         assert!(
             !src.contains("fieldview-actions"),
             "no action nav when there are no actions:\n{src}"
diff --git a/crates/ogar-vocab/Cargo.toml b/crates/ogar-vocab/Cargo.toml
index 16274f0..4e6d3aa 100644
--- a/crates/ogar-vocab/Cargo.toml
+++ b/crates/ogar-vocab/Cargo.toml
@@ -11,6 +11,16 @@ description = "Open Graph of Active Record — canonical IR types for the AR-sha
 [features]
 default = []
 serde = ["dep:serde"]
+# The Blocks (visual block-programming) codebook — ACTIVATED, not canon.
+# Off by default, so a consumer that never touches a block editor carries
+# zero 0x17XX rows. `ogar-blockly` turns it on for its own dependents, which
+# makes activation Cargo presence rather than runtime detection (the same
+# rule `lance-graph-ogar` documents). The rows it adds are consulted by
+# `capability_registry::resolve_hotplug` ALONGSIDE `class_ids::ALL` and are
+# deliberately never merged into it — that surface is mirrored into
+# lance-graph under a compile-time count fuse, and a frontend's palette is
+# not lance-graph's concern.
+blocks = []
 
 [dependencies]
 serde = { workspace = true, optional = true }
diff --git a/crates/ogar-vocab/src/blocks_actions.rs b/crates/ogar-vocab/src/blocks_actions.rs
new file mode 100644
index 0000000..1da0698
--- /dev/null
+++ b/crates/ogar-vocab/src/blocks_actions.rs
@@ -0,0 +1,208 @@
+//! Blocks capability surface — **feature-activated, never shared canon**.
+//!
+//! Compiled ONLY under `--features blocks`, which `ogar-blockly` turns on for
+//! its own dependents. A consumer that never touches a block editor never
+//! compiles this module, never carries its rows, and sees `0x17XX` exactly as
+//! it did before: a reserved domain with zero concepts.
+//!
+//! # Why this is not in `class_ids::ALL`
+//!
+//! `class_ids::ALL` is mirrored into `lance_graph_contract::ogar_codebook`
+//! under a **compile-time** count fuse (`lance_graph_ogar::parity::COUNT_FUSE`).
+//! Anything minted there is, by construction, a lance-graph change — and a
+//! block editor's palette is not lance-graph's concern. Minting these rows
+//! there once already turned lance-graph red against `main` and dragged in
+//! `ogar-class-view`, `all_promoted_classes` and both fuse halves.
+//!
+//! So the activated rows live HERE, in [`ACTIVATED_CONCEPTS`], which
+//! [`resolve_hotplug`](crate::capability_registry::resolve_hotplug) consults
+//! **in addition to** `class_ids::ALL`. The global codebook keeps its exact
+//! contents; a particular frontend's codebook rides its own feature.
+//!
+//! # Why the table is here and not in `ogar-blockly`
+//!
+//! [`domain_tables`](crate::capability_registry::domain_tables) resolves its
+//! entries at compile time from modules inside THIS crate, so a table declared
+//! in the producer crate is a **parallel registry that verifies itself against
+//! itself and passes** while the real port answers `NoCapabilitiesFor` — the
+//! `ogar-osm` defect `geo_actions` was written to correct. `ogar-blockly`
+//! cannot host it for a second reason: `ogar-blockly` depends on
+//! `ogar-vocab`, so `ogar-vocab` could never read the ids back.
+//!
+//! That dependency direction is also why the id is declared here and *read* by
+//! `ogar-blockly`, not the reverse — one source of truth for `0x1717`.
+//!
+//! # The subject
+//!
+//! Only the PALETTE concept binds capabilities. `ogar-loco`'s node shapes
+//! (`0x1701` / `0x1702`) are deliberately absent: they are the substrate's,
+//! shared by every vocabulary, and a consumer plugging them would claim
+//! ownership of the shape every sibling rides.
+
+use crate::{ActionDef, ActionSubject, KausalSpec};
+
+/// The Blocks **palette** concept — `0x1717`, canon-high.
+///
+/// Seated at `0x1717` rather than low in the domain because `0x1701`–`0x1716`
+/// is `ogar-loco`'s: `0x1701`/`0x1702` are the node shapes and `0x1703`–
+/// `0x1716` is the substrate's reserved headroom. Consumers are seated high so
+/// the substrate keeps contiguous room beneath them (OGAR #255).
+///
+/// Read by `ogar_blockly::BlockConcept::Palette` — declared once, here, since
+/// `ogar-blockly` deps this crate and the reverse is impossible.
+pub const BLOCK_PALETTE: u16 = 0x1717;
+
+/// The concept rows this feature ACTIVATES — consulted by
+/// [`resolve_hotplug`](crate::capability_registry::resolve_hotplug) alongside
+/// `class_ids::ALL`, and deliberately never merged into it.
+///
+/// This is the whole "codebook triggered by plug-and-play" mechanism: with the
+/// feature off the slice does not exist, `canonical_concept_domain(0x1717)`
+/// still routes to [`Blocks`](crate::ConceptDomain::Blocks) on the reserved
+/// domain byte alone, and a plug of `0x1717` correctly reports
+/// `UnknownClassid`. With the feature on — i.e. when a block editor is
+/// actually in the build graph — the same plug resolves.
+pub const ACTIVATED_CONCEPTS: &[(&str, u16)] = &[("block_palette", BLOCK_PALETTE)];
+
+/// Every Blocks capability name, in table order — the `const`-evaluable
+/// fingerprint of [`blocks_actions`].
+pub const BLOCKS_ACTION_NAMES: &[&str] = &[
+    "lower_script",
+    "raise_calls",
+    "render_text",
+    "parse_text",
+    "klickweg_address",
+];
+
+/// One Blocks [`ActionDef`], keyed by the palette concept.
+///
+/// `object_class` carries the concept name so `derive_action_rows` recovers it
+/// from the last `/` segment — the same fuse shape as `geo_actions` and
+/// `ocr_actions`. Resolution goes through the feature-activated rows, so this
+/// resolves iff the feature that declares the concept is the one compiling it.
+fn blocks_action_def(capability: &'static str) -> ActionDef {
+    let object_class = "ogit-blocks/block_palette".to_owned();
+    let identity = format!("{object_class}::action_def::{capability}");
+    ActionDef {
+        identity,
+        predicate: capability.to_owned(),
+        object_class,
+        // Lowering a workspace or raising a body is a pure transform the
+        // editor invokes on its own content — the caller is the substrate
+        // (an editor cast, a render pass), not an authenticated User.
+        default_subject: ActionSubject::System,
+        // Invoked directly by a same-process caller with no OGAR-side
+        // precondition to guard on — `KausalSpec::External`'s documented case.
+        kausal: Some(KausalSpec::External),
+        ..ActionDef::default()
+    }
+}
+
+/// The Blocks capability surface — one [`ActionDef`] per capability, in
+/// [`BLOCKS_ACTION_NAMES`] order.
+///
+/// Every entry is a real `blockly-abi` public function. `resolve_hotplug`
+/// checks coverage in BOTH directions, so an aspirational entry fails the
+/// consumer's own activation rather than quietly describing work nobody did.
+#[must_use]
+pub fn blocks_actions() -> Vec<ActionDef> {
+    BLOCKS_ACTION_NAMES
+        .iter()
+        .map(|&capability| blocks_action_def(capability))
+        .collect()
+}
+
+/// The executors the authority EXPECTS to register against this table.
+pub const BLOCKS_EXPECTED_EXECUTORS: &[&str] = &["blockly-abi"];
+
+/// The distinct subject classids this table binds. A registering consumer must
+/// activate exactly this set — the substrate's `0x1701`/`0x1702` are
+/// deliberately absent.
+pub const BLOCKS_SUBJECT_CLASSIDS: &[u16] = &[BLOCK_PALETTE];
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::capability_registry::{HotplugDrift, resolve_hotplug};
+
+    #[test]
+    fn the_activated_concept_resolves_only_because_this_feature_is_on() {
+        // The whole point of the mechanism: 0x1717 is NOT in class_ids::ALL —
+        // it resolves through the feature-activated rows. Assert BOTH halves,
+        // or "it resolved" proves nothing about where it resolved from.
+        assert!(
+            !crate::class_ids::ALL
+                .iter()
+                .any(|&(_, id)| id == BLOCK_PALETTE),
+            "0x1717 must NEVER enter the globally-mirrored codebook"
+        );
+        assert!(
+            ACTIVATED_CONCEPTS
+                .iter()
+                .any(|&(_, id)| id == BLOCK_PALETTE)
+        );
+
+        let (concepts, capabilities) =
+            resolve_hotplug("blockly-abi", BLOCKS_SUBJECT_CLASSIDS, BLOCKS_ACTION_NAMES)
+                .expect("the blocks domain must activate under its own feature");
+        assert_eq!(capabilities.len(), BLOCKS_ACTION_NAMES.len());
+        assert_eq!(
+            concepts.iter().map(|&(n, _)| n).collect::<Vec<_>>(),
+            vec!["block_palette"]
+        );
+    }
+
+    #[test]
+    fn the_palette_never_claims_the_substrates_node_shapes() {
+        // The ownership line, asserted rather than trusted. 0x1701/0x1702 are
+        // ogar-loco's; a plug of either must NOT resolve through this table.
+        assert!(!BLOCKS_SUBJECT_CLASSIDS.contains(&0x1701));
+        assert!(!BLOCKS_SUBJECT_CLASSIDS.contains(&0x1702));
+        assert!(
+            !ACTIVATED_CONCEPTS
+                .iter()
+                .any(|&(_, id)| id == 0x1701 || id == 0x1702)
+        );
+        for shape in [0x1701u16, 0x1702] {
+            assert!(
+                matches!(
+                    resolve_hotplug("blockly-abi", &[shape], BLOCKS_ACTION_NAMES),
+                    Err(HotplugDrift::UnknownClassid(id)) if id == shape
+                ),
+                "plugging {shape:#06x} must not resolve — it is the substrate's"
+            );
+        }
+    }
+
+    #[test]
+    fn the_port_rejects_a_wrong_consumer_and_coverage_gaps_both_ways() {
+        // Can-fire halves, so the activation above is not "yes to everything".
+        assert!(matches!(
+            resolve_hotplug(
+                "some-other-crate",
+                BLOCKS_SUBJECT_CLASSIDS,
+                BLOCKS_ACTION_NAMES
+            ),
+            Err(HotplugDrift::UnexpectedConsumer(_))
+        ));
+        assert!(matches!(
+            resolve_hotplug("blockly-abi", BLOCKS_SUBJECT_CLASSIDS, &["lower_script"]),
+            Err(HotplugDrift::Uncovered(_))
+        ));
+        let mut over = BLOCKS_ACTION_NAMES.to_vec();
+        over.push("compile_to_wasm");
+        assert!(matches!(
+            resolve_hotplug("blockly-abi", BLOCKS_SUBJECT_CLASSIDS, &over),
+            Err(HotplugDrift::Undeclared(_))
+        ));
+    }
+
+    #[test]
+    fn the_fingerprint_matches_the_table_in_order() {
+        let defs = blocks_actions();
+        assert_eq!(defs.len(), BLOCKS_ACTION_NAMES.len());
+        for (def, name) in defs.iter().zip(BLOCKS_ACTION_NAMES) {
+            assert_eq!(&def.predicate, name, "fingerprint drifted from the table");
+        }
+    }
+}
diff --git a/crates/ogar-vocab/src/capability_registry.rs b/crates/ogar-vocab/src/capability_registry.rs
index 7f11593..33aee3e 100644
--- a/crates/ogar-vocab/src/capability_registry.rs
+++ b/crates/ogar-vocab/src/capability_registry.rs
@@ -186,6 +186,14 @@ pub fn domain_tables() -> Vec<DomainTable> {
             expected_executors: crate::healthcare_actions::HEALTHCARE_EXPECTED_EXECUTORS,
             entries: healthcare_entries,
         },
+        // Feature-activated, not canon: present only when a block editor is
+        // actually in the build graph. Every table above ships in every build.
+        #[cfg(feature = "blocks")]
+        DomainTable {
+            domain: "blocks",
+            expected_executors: crate::blocks_actions::BLOCKS_EXPECTED_EXECUTORS,
+            entries: blocks_entries,
+        },
     ]
 }
 
@@ -229,7 +237,14 @@ fn derive_action_rows(actions: &[crate::ActionDef]) -> Vec<ActionRow> {
         .iter()
         .map(|def| {
             let concept = def.object_class.rsplit('/').next().unwrap_or_default();
-            match crate::canonical_concept_id(concept) {
+            // Canon first, then feature-activated rows — the SAME order as
+            // `resolve_concept_row`. Both sides of the join must consult the
+            // same set, or an activated concept resolves as a plugged classid
+            // (so the plug is accepted) while its capabilities silently land
+            // in the slag ledger, and the port answers `NoCapabilitiesFor` for
+            // a table that is right there. Measured, not hypothetical: that is
+            // exactly what this returned before the `or_else` arm.
+            match crate::canonical_concept_id(concept).or_else(|| activated_concept_id(concept)) {
                 Some(id) => ActionRow::Resolved(def.predicate.clone(), id),
                 None => ActionRow::Unminted(UnmintedRow {
                     capability: def.predicate.clone(),
@@ -326,6 +341,65 @@ fn geo_entries() -> Vec<(String, u16)> {
     entries_from_actions(&crate::geo_actions::geo_actions())
 }
 
+/// Blocks domain rows ([`crate::blocks_actions`], the blockly-abi table) —
+/// compiled ONLY under the `blocks` feature.
+#[cfg(feature = "blocks")]
+fn blocks_entries() -> Vec<(String, u16)> {
+    entries_from_actions(&crate::blocks_actions::blocks_actions())
+}
+
+/// Resolve one plugged classid to its `(concept, id)` row.
+///
+/// **The global codebook first, then whatever a feature ACTIVATED.** This is
+/// the "codebook triggered by plug-and-play" seam: `class_ids::ALL` is the
+/// canon every build carries (and the surface mirrored into lance-graph under
+/// a compile-time count fuse), while a particular frontend's codebook rides
+/// its own Cargo feature and is consulted only when that feature is compiled
+/// in — i.e. only when the consumer that owns it is actually in the build
+/// graph.
+///
+/// Auto-activation is **Cargo presence, not runtime detection** — the same
+/// rule `lance-graph-ogar` already documents. With the feature off these rows
+/// do not exist and a plug reports `UnknownClassid`, which is the honest
+/// answer: that vocabulary is not in this binary.
+///
+/// Order is deliberate: **canon wins.** A feature can ADD a concept the global
+/// codebook does not carry; it can never SHADOW one it does.
+fn resolve_concept_row(id: u16) -> Option<(&'static str, u16)> {
+    if let Some(&(name, cid)) = crate::class_ids::ALL.iter().find(|&&(_, cid)| cid == id) {
+        return Some((name, cid));
+    }
+    activated_concepts()
+        .iter()
+        .find(|&&(_, cid)| cid == id)
+        .copied()
+}
+
+/// Every concept row a compiled-in feature activates, beyond `class_ids::ALL`.
+///
+/// Empty in a default build — which is what keeps a consumer that never
+/// touches a block editor free of a block editor's codebook.
+/// The id of an activated concept BY NAME — the `derive_action_rows` half of
+/// the same lookup [`resolve_concept_row`] does by id. Both halves must
+/// consult the same set (see the call site).
+fn activated_concept_id(concept: &str) -> Option<u16> {
+    activated_concepts()
+        .iter()
+        .find(|&&(name, _)| name == concept)
+        .map(|&(_, id)| id)
+}
+
+fn activated_concepts() -> &'static [(&'static str, u16)] {
+    #[cfg(feature = "blocks")]
+    {
+        crate::blocks_actions::ACTIVATED_CONCEPTS
+    }
+    #[cfg(not(feature = "blocks"))]
+    {
+        &[]
+    }
+}
+
 /// Healthcare domain rows ([`crate::healthcare_actions`], the medcare-rs
 /// table — parity-plan P3), derived through the same generic
 /// [`entries_from_actions`] path as OCR.
@@ -353,8 +427,8 @@ pub fn resolve_hotplug(
 ) -> Result<HotplugActivation, HotplugDrift> {
     let mut concepts = Vec::new();
     for &id in classids {
-        match crate::class_ids::ALL.iter().find(|&&(_, cid)| cid == id) {
-            Some(&(name, cid)) => concepts.push((name, cid)),
+        match resolve_concept_row(id) {
+            Some((name, cid)) => concepts.push((name, cid)),
             None => return Err(HotplugDrift::UnknownClassid(id)),
         }
     }
diff --git a/crates/ogar-vocab/src/lib.rs b/crates/ogar-vocab/src/lib.rs
index f69aea7..1ef4dbc 100644
--- a/crates/ogar-vocab/src/lib.rs
+++ b/crates/ogar-vocab/src/lib.rs
@@ -34,6 +34,13 @@ use serde::{Deserialize, Serialize};
 /// `<port>::<path>(<shape>)` grammar (`E-GRAMMAR-IS-THE-RECIPE-SHAPE`).
 pub mod recipe;
 
+/// Healthcare capability surface — the medcare-rs authoritative action
+/// table (parity-plan P3; hand-authored, harvest-informed — see the
+/// module doc for why the mechanical lift was falsified by the corpus).
+/// The Blocks capability surface — **feature-activated**, never shared canon.
+/// Compiled only under `--features blocks`, which `ogar-blockly` turns on.
+#[cfg(feature = "blocks")]
+pub mod blocks_actions;
 /// The tesseract-rs OCR capability surface — a hand-authored, non-`lift_*`
 /// [`ActionDef`] table (tesseract-rs has no source AST to extract from; see
 /// the module doc for why this is the authoritative action table rather
@@ -42,9 +49,6 @@ pub mod recipe;
 /// `render_tsv` / `render_hocr` / `render_searchable_pdf`, each targeting a
 /// minted `0x08XX` [`class_ids`] concept.
 pub mod capability_registry;
-/// Healthcare capability surface — the medcare-rs authoritative action
-/// table (parity-plan P3; hand-authored, harvest-informed — see the
-/// module doc for why the mechanical lift was falsified by the corpus).
 pub mod geo_actions;
 pub mod healthcare_actions;
 pub mod ocr_actions;

From 716bc9ce054809cbbbc2758b739f5741c0a6b904 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 7 Aug 2026 13:12:39 +0000
Subject: [PATCH 2/2] Revert cargo fmt churn that leaked in from blockly-rs's
 --all
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Six files this change never touched (ogar-encryption, ogar-obo x4,
ogar-render-askama) picked up formatting churn again. The path is worth
naming because it is not obvious: running `cargo fmt --all` from INSIDE
blockly-rs — which now path-deps OGAR — followed the dep OUT of that
repo and reformatted OGAR's sources in this working tree.

Same trap, third instance this session, each at a different distance:
  1. `cargo fmt --all` inside OGAR      -> 309 lines of churn
  2. `cargo fmt --all` in blockly-rs CI -> failed on ogar-render-askama
  3. `cargo fmt --all` in blockly-rs    -> silently dirtied THIS tree

The lesson generalizes past fmt: once a repo path-deps a sibling, EVERY
workspace-wide cargo flag reaches into that sibling. Scope with -p, in
CI and at the keyboard both. blockly-rs's CI is already scoped; this is
the working-tree half of the same rule.

These files are restored to their committed state, not reformatted —
whether OGAR main should be fmt-clean is OGAR's call, and making it so
from a blockly-rs session is precisely the boundary violation that
started this arc.

Workspace still 0 failures after the revert.
---
 crates/ogar-encryption/src/lib.rs           |   2 +-
 crates/ogar-obo/examples/bake_obo.rs        |  60 ++-------
 crates/ogar-obo/src/crosswalk.rs            |  54 +++-----
 crates/ogar-obo/src/lib.rs                  | 142 +++++++-------------
 crates/ogar-obo/src/reason.rs               |  38 ++----
 crates/ogar-render-askama/src/field_view.rs |  13 +-
 6 files changed, 92 insertions(+), 217 deletions(-)

diff --git a/crates/ogar-encryption/src/lib.rs b/crates/ogar-encryption/src/lib.rs
index ebebb1e..41a4c9f 100644
--- a/crates/ogar-encryption/src/lib.rs
+++ b/crates/ogar-encryption/src/lib.rs
@@ -62,7 +62,7 @@ pub use encryption::{aead, envelope, hash, kdf, sign};
 // ── Root-level convenience aliases, mirrored from `encryption`'s own root
 // re-exports (`envelope::{seal, open}` plus the envelope's error/parameter
 // types), so callers that used the upstream crate's short paths keep them.
-pub use encryption::{EnvelopeError, KdfParams, open, seal};
+pub use encryption::{open, seal, EnvelopeError, KdfParams};
 
 // ── The platform-CSPRNG-unavailable error, mirrored from `encryption`'s
 // crate root.
diff --git a/crates/ogar-obo/examples/bake_obo.rs b/crates/ogar-obo/examples/bake_obo.rs
index d2d13ec..1411c7f 100644
--- a/crates/ogar-obo/examples/bake_obo.rs
+++ b/crates/ogar-obo/examples/bake_obo.rs
@@ -9,8 +9,8 @@
 //! scratch dir, never committed.
 
 use ogar_obo::{
-    Namespace, as_le_bytes, bake, merge_logical_defs, parse_hp_logical_defs, parse_obo, reason,
-    rows_from_le_bytes,
+    Namespace, bake, merge_logical_defs, parse_hp_logical_defs, parse_obo, reason,
+    rows_from_le_bytes, as_le_bytes,
 };
 use std::collections::HashMap;
 
@@ -22,13 +22,12 @@ fn main() {
     let mut nodes = HashMap::new();
     for f in ["mondo", "hp", "uberon", "pato", "ro"] {
         let path = format!("{dir}/{f}.obo");
-        let text = std::fs::read_to_string(&path).unwrap_or_else(|e| panic!("read {path}: {e}"));
+        let text = std::fs::read_to_string(&path)
+            .unwrap_or_else(|e| panic!("read {path}: {e}"));
         let part = parse_obo(&text);
         let (terms, edges) = (
             part.len(),
-            part.values()
-                .map(|n| n.is_a.len() + n.rel.len() + n.xref.len())
-                .sum::<usize>(),
+            part.values().map(|n| n.is_a.len() + n.rel.len() + n.xref.len()).sum::<usize>(),
         );
         println!("  parsed {f:8} terms={terms:6} edges+xref={edges}");
         for (id, n) in part {
@@ -43,10 +42,7 @@ fn main() {
     // HPO logical-definition grounding (anatomy:quality) from hp-base.owl.
     let owl = std::fs::read_to_string(format!("{dir}/hp-base.owl")).unwrap_or_default();
     let defs = parse_hp_logical_defs(&owl);
-    println!(
-        "  hp-base logical defs: {} HP->Uberon/PATO grounding edges",
-        defs.len()
-    );
+    println!("  hp-base logical defs: {} HP->Uberon/PATO grounding edges", defs.len());
     merge_logical_defs(&mut nodes, &defs);
 
     let baked = bake(&nodes, 0x0000);
@@ -60,62 +56,36 @@ fn main() {
     println!("  MONDO->HP resolve      : {}", s.mondo_hp);
     println!("  HP->UBERON resolve     : {}", s.hp_uberon);
     println!("  HP->PATO resolve       : {}", s.hp_pato);
-    println!(
-        "  xrefs preserved        : {} (MeSH bearings: {})",
-        s.xrefs, s.mesh_xrefs
-    );
+    println!("  xrefs preserved        : {} (MeSH bearings: {})", s.xrefs, s.mesh_xrefs);
 
     // Per-namespace row census.
     let mut census: HashMap<u8, usize> = HashMap::new();
     for id in &baked.ids {
         *census.entry(id.ns).or_default() += 1;
     }
-    for ns in [
-        Namespace::Mondo,
-        Namespace::Hpo,
-        Namespace::Uberon,
-        Namespace::Pato,
-        Namespace::Ro,
-    ] {
-        println!(
-            "    {:8}: {}",
-            ns.prefix(),
-            census.get(&(ns as u8)).copied().unwrap_or(0)
-        );
+    for ns in [Namespace::Mondo, Namespace::Hpo, Namespace::Uberon, Namespace::Pato, Namespace::Ro] {
+        println!("    {:8}: {}", ns.prefix(), census.get(&(ns as u8)).copied().unwrap_or(0));
     }
 
     println!("\n=== EL SATURATION (ELK subset, excavated to Rust) ===");
     let el = reason::saturate(&baked.triples);
     println!("  is_a subsumption pairs   : {}", el.subsumption_pairs);
     println!("  part_of transitive pairs : {}", el.part_of_pairs);
-    println!(
-        "  existential inferred (R∃): {} (grounding inherited up the spine)",
-        el.existential_inferred
-    );
-    println!(
-        "  unsatisfiable            : {} (no disjointness axioms in base obo)",
-        el.unsatisfiable
-    );
+    println!("  existential inferred (R∃): {} (grounding inherited up the spine)", el.existential_inferred);
+    println!("  unsatisfiable            : {} (no disjointness axioms in base obo)", el.unsatisfiable);
 
     // Write the artifact + verify it round-trips through the loader contract.
     let bytes = as_le_bytes(&baked.rows);
     std::fs::write(&out, bytes).unwrap_or_else(|e| panic!("write {out}: {e}"));
     println!("\n=== ARTIFACT ===");
-    println!(
-        "  {out}  ({} bytes = {} rows × 512)",
-        bytes.len(),
-        baked.rows.len()
-    );
+    println!("  {out}  ({} bytes = {} rows × 512)", bytes.len(), baked.rows.len());
     let readback = std::fs::read(&out).expect("reread");
     match rows_from_le_bytes(&readback) {
         Some(rows) => {
             // NB: a fresh Vec<u8> from fs::read may not be 64-aligned; the loader
             // returns None then and a real consumer uses FixedSizeBinary(512)
             // (arrow-aligned). We verify the in-memory aligned view instead.
-            println!(
-                "  reread rows_from_le_bytes: {} rows (aligned buffer)",
-                rows.len()
-            );
+            println!("  reread rows_from_le_bytes: {} rows (aligned buffer)", rows.len());
         }
         None => {
             let inmem = rows_from_le_bytes(bytes).expect("in-memory aligned view");
@@ -127,7 +97,5 @@ fn main() {
             );
         }
     }
-    println!(
-        "  loader contract: VERIFIED (as_le_bytes ↔ rows_from_le_bytes, 512×N, 64-align gate)"
-    );
+    println!("  loader contract: VERIFIED (as_le_bytes ↔ rows_from_le_bytes, 512×N, 64-align gate)");
 }
diff --git a/crates/ogar-obo/src/crosswalk.rs b/crates/ogar-obo/src/crosswalk.rs
index b905daa..57e7c61 100644
--- a/crates/ogar-obo/src/crosswalk.rs
+++ b/crates/ogar-obo/src/crosswalk.rs
@@ -103,17 +103,16 @@ impl Crosswalk {
             // roll up: drop a trailing digit past the 3-char WHO stem, else the
             // sub-category dot, else give up.
             if let Some(pos) = c.rfind(|ch: char| ch.is_ascii_digit())
-                && (c.len() > 3 || (c.contains('.') && pos > c.find('.').unwrap()))
-            {
-                c.truncate(pos);
-                if c.ends_with('.') {
-                    c.pop();
+                && (c.len() > 3 || (c.contains('.') && pos > c.find('.').unwrap())) {
+                    c.truncate(pos);
+                    if c.ends_with('.') {
+                        c.pop();
+                    }
+                    if c.is_empty() {
+                        return None;
+                    }
+                    continue;
                 }
-                if c.is_empty() {
-                    return None;
-                }
-                continue;
-            }
             return None;
         }
     }
@@ -154,31 +153,16 @@ mod tests {
         let mut nodes: HashMap<TermId, OboNode> = HashMap::new();
         // MONDO:5148 (T2DM) xrefs ICD-10 E11 + MeSH D003924
         nodes.insert(
-            TermId {
-                ns: Namespace::Mondo as u8,
-                num: 5148,
-            },
+            TermId { ns: Namespace::Mondo as u8, num: 5148 },
             node_with_xrefs(vec![
-                Xref {
-                    source: XrefSource::Icd,
-                    id: "E11".into(),
-                },
-                Xref {
-                    source: XrefSource::Mesh,
-                    id: "D003924".into(),
-                },
+                Xref { source: XrefSource::Icd, id: "E11".into() },
+                Xref { source: XrefSource::Mesh, id: "D003924".into() },
             ]),
         );
         // UBERON:945 (stomach) xrefs FMA:7148
         nodes.insert(
-            TermId {
-                ns: Namespace::Uberon as u8,
-                num: 945,
-            },
-            node_with_xrefs(vec![Xref {
-                source: XrefSource::Other("FMA".into()),
-                id: "7148".into(),
-            }]),
+            TermId { ns: Namespace::Uberon as u8, num: 945 },
+            node_with_xrefs(vec![Xref { source: XrefSource::Other("FMA".into()), id: "7148".into() }]),
         );
         let baked = bake(&nodes, 0x0000);
         let cw = Crosswalk::from_bake(&baked);
@@ -203,14 +187,8 @@ mod tests {
         // roll up to it (measured: MONDO carries no ICD-10-GM).
         let mut nodes: HashMap<TermId, OboNode> = HashMap::new();
         nodes.insert(
-            TermId {
-                ns: Namespace::Mondo as u8,
-                num: 5148,
-            },
-            node_with_xrefs(vec![Xref {
-                source: XrefSource::Icd,
-                id: "E11".into(),
-            }]),
+            TermId { ns: Namespace::Mondo as u8, num: 5148 },
+            node_with_xrefs(vec![Xref { source: XrefSource::Icd, id: "E11".into() }]),
         );
         let cw = Crosswalk::from_bake(&bake(&nodes, 0x0000));
         // direct GM code fails, rollup succeeds — no separate GM table
diff --git a/crates/ogar-obo/src/lib.rs b/crates/ogar-obo/src/lib.rs
index 3b3d8e2..e9391dd 100644
--- a/crates/ogar-obo/src/lib.rs
+++ b/crates/ogar-obo/src/lib.rs
@@ -171,7 +171,10 @@ impl TermId {
         if num > 0x00FF_FFFF {
             return None;
         }
-        Some(TermId { ns: ns as u8, num })
+        Some(TermId {
+            ns: ns as u8,
+            num,
+        })
     }
 
     /// This term's namespace.
@@ -411,18 +414,16 @@ pub fn parse_obo(text: &str) -> std::collections::HashMap<TermId, OboNode> {
             // `relationship: <REL> <TARGET> ! label` — the target is the LAST
             // whitespace token before any `!`.
             if let Some(sid) = cur
-                && let Some(t) = last_curie(rest)
-            {
-                let p = classify(sid.namespace(), t.namespace());
-                nodes.entry(sid).or_default().rel.push((p, t));
-            }
+                && let Some(t) = last_curie(rest) {
+                    let p = classify(sid.namespace(), t.namespace());
+                    nodes.entry(sid).or_default().rel.push((p, t));
+                }
         } else if let Some(rest) = line.strip_prefix("intersection_of: ") {
             if let Some(sid) = cur
-                && let Some(t) = last_curie(rest)
-            {
-                let p = classify(sid.namespace(), t.namespace());
-                nodes.entry(sid).or_default().rel.push((p, t));
-            }
+                && let Some(t) = last_curie(rest) {
+                    let p = classify(sid.namespace(), t.namespace());
+                    nodes.entry(sid).or_default().rel.push((p, t));
+                }
         } else if let Some(rest) = line.strip_prefix("xref: ") {
             // `xref: <SOURCE>:<ID> ! label` — the projection-join / guideline
             // bearing. Kept verbatim; NEVER truncated (MeSH → Leitlinie spider).
@@ -430,14 +431,12 @@ pub fn parse_obo(text: &str) -> std::collections::HashMap<TermId, OboNode> {
                 let tok = rest.split('!').next().unwrap_or(rest).trim();
                 let tok = tok.split_whitespace().next().unwrap_or(tok);
                 if let Some((src, id)) = tok.split_once(':')
-                    && !src.is_empty()
-                    && !id.is_empty()
-                {
-                    nodes.entry(sid).or_default().xref.push(Xref {
-                        source: XrefSource::from_prefix(src),
-                        id: id.to_string(),
-                    });
-                }
+                    && !src.is_empty() && !id.is_empty() {
+                        nodes.entry(sid).or_default().xref.push(Xref {
+                            source: XrefSource::from_prefix(src),
+                            id: id.to_string(),
+                        });
+                    }
             }
         }
     }
@@ -447,22 +446,14 @@ pub fn parse_obo(text: &str) -> std::collections::HashMap<TermId, OboNode> {
 /// First whitespace token of a line (before any `!` comment) — the target of
 /// an `is_a:` line.
 fn first_curie(s: &str) -> &str {
-    s.split('!')
-        .next()
-        .unwrap_or(s)
-        .split_whitespace()
-        .next()
-        .unwrap_or("")
-        .trim()
+    s.split('!').next().unwrap_or(s).split_whitespace().next().unwrap_or("").trim()
 }
 
 /// Last CURIE-shaped token before any `!` — the object of a `relationship:` /
 /// `intersection_of:` line (the predicate is the earlier token).
 fn last_curie(s: &str) -> Option<TermId> {
     let head = s.split('!').next().unwrap_or(s);
-    head.split_whitespace()
-        .rfind(|t| t.contains(':'))
-        .and_then(TermId::parse)
+    head.split_whitespace().rfind(|t| t.contains(':')).and_then(TermId::parse)
 }
 
 // ── bake: nodes+edges → 512-byte rows + SPO triples + stats ────────────────
@@ -515,7 +506,10 @@ pub struct Bake {
 /// logical-def edges folded into the nodes' `rel`) into [`Bake`]. `app_prefix`
 /// is the lo-u16 render skin (`0x0000` = the canonical reference skin).
 #[must_use]
-pub fn bake(nodes: &std::collections::HashMap<TermId, OboNode>, app_prefix: u16) -> Bake {
+pub fn bake(
+    nodes: &std::collections::HashMap<TermId, OboNode>,
+    app_prefix: u16,
+) -> Bake {
     let mut ids: Vec<TermId> = nodes
         .iter()
         .filter(|(_, n)| !n.obsolete)
@@ -661,35 +655,22 @@ pub fn parse_hp_logical_defs(owl: &str) -> Vec<(TermId, Predicate, TermId)> {
             in_eq += 1;
         }
         if in_eq > 0
-            && let Some(sid) = cur
-        {
-            for uid in find_obo_ids(line, "UBERON_") {
-                out.push((
-                    TermId {
-                        ns: Namespace::Hpo as u8,
-                        num: sid,
-                    },
-                    Predicate::HasAnatomy,
-                    TermId {
-                        ns: Namespace::Uberon as u8,
-                        num: uid,
-                    },
-                ));
-            }
-            for pid in find_obo_ids(line, "PATO_") {
-                out.push((
-                    TermId {
-                        ns: Namespace::Hpo as u8,
-                        num: sid,
-                    },
-                    Predicate::HasQuality,
-                    TermId {
-                        ns: Namespace::Pato as u8,
-                        num: pid,
-                    },
-                ));
+            && let Some(sid) = cur {
+                for uid in find_obo_ids(line, "UBERON_") {
+                    out.push((
+                        TermId { ns: Namespace::Hpo as u8, num: sid },
+                        Predicate::HasAnatomy,
+                        TermId { ns: Namespace::Uberon as u8, num: uid },
+                    ));
+                }
+                for pid in find_obo_ids(line, "PATO_") {
+                    out.push((
+                        TermId { ns: Namespace::Hpo as u8, num: sid },
+                        Predicate::HasQuality,
+                        TermId { ns: Namespace::Pato as u8, num: pid },
+                    ));
+                }
             }
-        }
         if line.contains("</owl:equivalentClass>") {
             in_eq = (in_eq - 1).max(0);
         }
@@ -704,10 +685,7 @@ fn find_hp_about(line: &str) -> Option<u32> {
     let i = line.find("owl:Class rdf:about=")?;
     let rest = &line[i..];
     let j = rest.find("HP_")?;
-    let digits: String = rest[j + 3..]
-        .chars()
-        .take_while(char::is_ascii_digit)
-        .collect();
+    let digits: String = rest[j + 3..].chars().take_while(char::is_ascii_digit).collect();
     digits.parse().ok()
 }
 
@@ -719,10 +697,9 @@ fn find_obo_ids(line: &str, prefix: &str) -> Vec<u32> {
         let after = &hay[i + prefix.len()..];
         let digits: String = after.chars().take_while(char::is_ascii_digit).collect();
         if let Ok(n) = digits.parse::<u32>()
-            && n <= 0x00FF_FFFF
-        {
-            ids.push(n);
-        }
+            && n <= 0x00FF_FFFF {
+                ids.push(n);
+            }
         hay = &after[digits.len()..];
     }
     ids
@@ -765,26 +742,15 @@ mod tests {
     fn v3_tail_carries_oversize_curie_numerics_on_the_family_identity_rail() {
         // Above u16 — the case a bare `identity` cannot hold.
         let big = 700_092u32;
-        assert!(
-            big > u32::from(u16::MAX),
-            "fixture must exceed the u16 the rail exists for"
-        );
+        assert!(big > u32::from(u16::MAX), "fixture must exceed the u16 the rail exists for");
         let k = pack_key(Namespace::Mondo.render_classid(0x0000), big);
 
         // Byte positions, per new_v2.
-        assert_eq!(
-            &k[10..12],
-            &[0, 0],
-            "leaf stays dormant (RESERVE, DON'T RECLAIM)"
-        );
+        assert_eq!(&k[10..12], &[0, 0], "leaf stays dormant (RESERVE, DON'T RECLAIM)");
         let family = u16::from_le_bytes([k[12], k[13]]);
         let identity = u16::from_le_bytes([k[14], k[15]]);
         assert_eq!(u32::from(family), big >> 16, "family holds the high half");
-        assert_eq!(
-            u32::from(identity),
-            big & 0xFFFF,
-            "identity holds the low half"
-        );
+        assert_eq!(u32::from(identity), big & 0xFFFF, "identity holds the low half");
 
         // Lossless through the public reader.
         let mut row = Row512::zeroed();
@@ -796,19 +762,13 @@ mod tests {
         // The V1 read of the SAME bytes must NOT agree — proof the tail really
         // moved, not that both layouts happen to coincide on this fixture.
         let v1_read = u32::from_le_bytes([row.0[13], row.0[14], row.0[15], 0]);
-        assert_ne!(
-            v1_read, big,
-            "a V1 u24 read of a V3 row must be observably wrong"
-        );
+        assert_ne!(v1_read, big, "a V1 u24 read of a V3 row must be observably wrong");
 
         // Ordering is preserved: family is the HIGH half, so (family, identity)
         // sorts as the numeric does. This is what keeps binary-search-by-key
         // valid over the sorted bake.
         let lo = pack_key(Namespace::Mondo.render_classid(0x0000), 5_148);
-        assert!(
-            lo[12..16] < k[12..16],
-            "tail bytes order as the numeric orders"
-        );
+        assert!(lo[12..16] < k[12..16], "tail bytes order as the numeric orders");
     }
 
     #[test]
@@ -838,11 +798,7 @@ is_a: MONDO:0005015 ! diabetes mellitus\n";
         let t = n(Namespace::Mondo, 5148);
         let node = &nodes[&t];
         assert_eq!(node.xref.len(), 3, "all three xrefs kept");
-        assert!(
-            node.xref
-                .iter()
-                .any(|x| x.source == XrefSource::Mesh && x.id == "D003924")
-        );
+        assert!(node.xref.iter().any(|x| x.source == XrefSource::Mesh && x.id == "D003924"));
         let bake = bake(&nodes, 0x0000);
         assert_eq!(bake.stats.mesh_xrefs, 1, "MeSH bearing counted");
         assert_eq!(bake.stats.xrefs, 3);
diff --git a/crates/ogar-obo/src/reason.rs b/crates/ogar-obo/src/reason.rs
index 093fe2d..05c06ca 100644
--- a/crates/ogar-obo/src/reason.rs
+++ b/crates/ogar-obo/src/reason.rs
@@ -115,7 +115,9 @@ pub struct ElStats {
 /// Returns, per node, the sorted deduped set of all transitive ancestors.
 /// Assumes acyclic (run [`count_is_a_cycles`] first); a residual cycle is
 /// simply not expanded past a re-visit, never loops.
-fn ancestor_closure(adj: &HashMap<TermId, Vec<TermId>>) -> HashMap<TermId, Vec<TermId>> {
+fn ancestor_closure(
+    adj: &HashMap<TermId, Vec<TermId>>,
+) -> HashMap<TermId, Vec<TermId>> {
     // Kahn order over the parent graph, then DP bottom-up.
     // Build reverse (parent -> children) for indegree over child->parent edges.
     let mut all: Vec<TermId> = Vec::new();
@@ -307,15 +309,9 @@ mod tests {
 
     fn t(sns: Namespace, s: u32, p: Predicate, ons: Namespace, o: u32) -> Triple {
         Triple {
-            s: TermId {
-                ns: sns as u8,
-                num: s,
-            },
+            s: TermId { ns: sns as u8, num: s },
             p,
-            o: TermId {
-                ns: ons as u8,
-                num: o,
-            },
+            o: TermId { ns: ons as u8, num: o },
         }
     }
 
@@ -357,27 +353,9 @@ mod tests {
         //   UBERON:200 is_a    UBERON:300       (which is a kind of ...)
         // ⟹ HP:9 is grounded to UBERON:{200,300} too (2 inferred-beyond-asserted).
         let tr = vec![
-            t(
-                Namespace::Hpo,
-                9,
-                Predicate::HasAnatomy,
-                Namespace::Uberon,
-                100,
-            ),
-            t(
-                Namespace::Uberon,
-                100,
-                Predicate::PartOf,
-                Namespace::Uberon,
-                200,
-            ),
-            t(
-                Namespace::Uberon,
-                200,
-                Predicate::IsA,
-                Namespace::Uberon,
-                300,
-            ),
+            t(Namespace::Hpo, 9, Predicate::HasAnatomy, Namespace::Uberon, 100),
+            t(Namespace::Uberon, 100, Predicate::PartOf, Namespace::Uberon, 200),
+            t(Namespace::Uberon, 200, Predicate::IsA, Namespace::Uberon, 300),
         ];
         let s = saturate(&tr);
         // R∃ fires on BOTH existentials: HP:9→{200,300} (2) AND the part_of
diff --git a/crates/ogar-render-askama/src/field_view.rs b/crates/ogar-render-askama/src/field_view.rs
index 9fbd6fd..c5f1d28 100644
--- a/crates/ogar-render-askama/src/field_view.rs
+++ b/crates/ogar-render-askama/src/field_view.rs
@@ -217,10 +217,7 @@ mod tests {
 
         // The surface is addressed by class + concept + key.
         assert!(src.contains("data-class-id=\"0x0102\""), "{src}");
-        assert!(
-            src.contains("data-concept=\"commercial_document\""),
-            "{src}"
-        );
+        assert!(src.contains("data-concept=\"commercial_document\""), "{src}");
         assert!(src.contains("data-key=\"0801000301020304\""), "{src}");
         // Each field carries its POSITION (layout address) — including the
         // wide position past 63.
@@ -268,10 +265,7 @@ mod tests {
 
         assert!(!src.contains("<script>alert('label')"), "label raw:\n{src}");
         assert!(!src.contains("<img src=x onerror"), "value raw:\n{src}");
-        assert!(
-            !src.contains("<script>alert('action')"),
-            "action raw:\n{src}"
-        );
+        assert!(!src.contains("<script>alert('action')"), "action raw:\n{src}");
         assert!(!src.contains("<title-xss>"), "title raw:\n{src}");
         assert!(!src.contains("<concept-xss>"), "concept raw:\n{src}");
         // The escaped form is present (quote encoding varies by askama
@@ -281,7 +275,8 @@ mod tests {
 
     #[test]
     fn empty_actions_omit_the_nav() {
-        let src = render_field_view(1, "c", "00", "T", &sample_fields(), &[]).unwrap();
+        let src =
+            render_field_view(1, "c", "00", "T", &sample_fields(), &[]).unwrap();
         assert!(
             !src.contains("fieldview-actions"),
             "no action nav when there are no actions:\n{src}"