fix(ci): read release version from Cargo.toml, not cargo metadata (ADR-0054)

The ADR-0054 version guard piped `nix develop -c cargo metadata` to node, but the flake devShell prints a banner to stdout — corrupting the JSON pipe, so the guard aborted under `set -e` and the v0.2.0 release failed there (before building anything). Replace it with a toolchain-free `grep -m1 '^version = ' Cargo.toml` (the anchor excludes dependency `version =` keys). No real version mismatch occurred — the tagged commit has version 0.2.0.
chore(release): bump version to 0.2.0
2026-06-17 21:58:32 +00:00 · 2026-06-17 21:46:52 +00:00 · 2026-06-17 21:40:58 +00:00 · 2026-06-17 21:39:19 +00:00 · 2026-06-17 21:25:45 +00:00 · 2026-06-17 19:41:34 +00:00
214 changed files with 24162 additions and 5180 deletions
@@ -0,0 +1,7 @@
+# Revisions to ignore in `git blame` — bulk, mechanical, no-behaviour-change
+# commits whose authorship is noise. Enable locally with:
+#   git config blame.ignoreRevsFile .git-blame-ignore-revs
+# (Forges that support it, e.g. GitHub, pick this up automatically.)
+
+# style: format the whole tree with cargo fmt (stock defaults, #35)
+41b7e9a04992cd9708f1775b57044de838b48b85
@@ -2,9 +2,10 @@
 # build-ci-image.yaml), so the pinned 1.95.0 toolchain is already warm — steps
 # just enter the flake devShell and run cargo.
 #
-# Gate = clippy + test. fmt is deliberately NOT gated yet (ADR-ci-002: the tree
-# isn't clean under stock rustfmt; revisit on main). The release job (static
-# binary for D2) and the platform matrix layer on later, step by step.
+# Gate = fmt + clippy + test. The fmt gate (`cargo fmt --check`, stock defaults)
+# was enabled once the tree was reformatted on main (ADR-ci-002 Amendment 1 /
+# issue #35). The release job (static binary for D2) and the platform matrix
+# layer on later, step by step.
 name: ci
 on:
  push:
@@ -13,17 +14,23 @@ on:
    # run (the release workflow owns tags). Pushing commits + a tag together
    # still gates the commits via the branch push.
    branches: ['**']
-    # Skip the gate for docs-only changes — markdown can't affect clippy/test.
-    # A push touching code *and* docs still runs (not all files are ignored).
+    # Skip the gate for changes that can't affect clippy/test — docs, markdown,
+    # and the website subproject (it has its own workflow, website.yaml, that
+    # builds + publishes it). A push touching crate code *and* these still runs
+    # (paths-ignore only skips when *all* changed files match).
    # Note: flake/toolchain changes are NOT ignored — they can shift the
    # toolchain and thus lint/test outcomes.
    paths-ignore:
      - 'docs/**'
      - '**/*.md'
+      - 'website/**'
+      - '.gitea/workflows/website.yaml'
  pull_request:
    paths-ignore:
      - 'docs/**'
      - '**/*.md'
+      - 'website/**'
+      - '.gitea/workflows/website.yaml'

 jobs:
  gate:
@@ -33,6 +40,8 @@ jobs:
      image: git.lazyeval.net/oli/rdbms-playground-ci:latest
    steps:
      - uses: actions/checkout@v4
+      - name: fmt (check, stock defaults)
+        run: nix develop -c cargo fmt --check
      - name: clippy (warnings denied)
        run: nix develop -c cargo clippy --all-targets -- -D warnings
      - name: test
@@ -5,11 +5,15 @@
 # Matrix (D1, cross-built from Linux x86_64 via cargo-zigbuild):
 #   x86_64-unknown-linux-musl   aarch64-unknown-linux-musl   (static, D2)
 #   x86_64-pc-windows-gnu       aarch64-pc-windows-gnullvm   (standalone .exe)
-# macOS is deferred — its arboard/AppKit link needs Apple's SDK (see ADR-ci-001).
-# D3 package-manager manifests layer on later.
+# The two macOS targets are built separately by the dispatched
+# release-macos.yaml (native Tart runner; ADR-ci-003 amendment), uploading to
+# the same release. D3 package-manager manifests layer on later.
 #
 # Tests run once (host) before the matrix, so a tag can never publish untested
-# code, even one pointing at a commit that was never gated on a branch.
+# code, even one pointing at a commit that was never gated on a branch. The
+# version guard (ADR-0054) refuses to publish a tag whose vX.Y.Z disagrees with
+# Cargo.toml's version, keeping `--version`, the release name, and the asset in
+# lockstep.
 name: release
 on:
  push:
@@ -23,6 +27,27 @@ jobs:
      image: git.lazyeval.net/oli/rdbms-playground-ci:latest
    steps:
      - uses: actions/checkout@v4
+      - name: version guard — tag must equal Cargo.toml version (ADR-0054)
+        shell: bash
+        env:
+          TAG: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          # Read the [package] version straight from Cargo.toml — toolchain-free
+          # and robust. (An earlier `nix develop -c cargo metadata | node` version
+          # broke: the flake devShell prints a banner to stdout, corrupting the
+          # JSON pipe.) `^version = ` is anchored, so it matches only the package
+          # version, never the `version = ` inside dependency inline tables.
+          VER=$(grep -m1 '^version = ' Cargo.toml | sed -E 's/^version = "(.*)"/\1/')
+          echo "tag=$TAG  cargo=v$VER"
+          if [ -z "$VER" ]; then
+            echo "ERROR: could not read the package version from Cargo.toml" >&2
+            exit 1
+          fi
+          if [ "$TAG" != "v$VER" ]; then
+            echo "ERROR: release tag '$TAG' != 'v$VER' (Cargo.toml). Bump Cargo.toml to the release version, commit, then retag (ADR-0054)." >&2
+            exit 1
+          fi
      - name: test
        run: nix develop -c cargo test --no-fail-fast

@@ -0,0 +1,66 @@
+# Build the docs/marketing website and deploy it to Cloudflare Pages.
+#
+# One Pages project, two branches (no second project, no sub-folders — Pages
+# maps a branch to a *subdomain alias*, not a path):
+#   main    → production   (the project's production branch → relplay.org)
+#   website → preview      (alias `website.<project>.pages.dev`; a custom
+#                           `staging.relplay.org` can be attached to it)
+# wrangler treats `--branch=<production-branch>` as a production deploy and any
+# other branch as a preview, so a single workflow covers both — the Pages
+# project's production branch MUST be set to `main`.
+#
+# Pure-Node build: the `.cast` recordings are committed, so no cargo/Rust is
+# needed here. Runs on the bare `ci-public` runner (node already present; pnpm
+# via corepack, pinned by package.json's `packageManager`). No job container —
+# unlike the Rust gate, this needs none.
+#
+# Required Actions secrets (set once in the repo/org settings):
+#   CLOUDFLARE_API_TOKEN   — token with "Cloudflare Pages: Edit" on the account
+#   CLOUDFLARE_ACCOUNT_ID  — the account id that owns the Pages project
+name: website
+on:
+  push:
+    branches: [main, website]
+    # Only when the site (or this workflow) actually changes — crate-only
+    # pushes don't redeploy the site.
+    paths:
+      - 'website/**'
+      - '.gitea/workflows/website.yaml'
+  workflow_dispatch:
+
+jobs:
+  deploy:
+    runs-on: ci-public
+    defaults:
+      run:
+        working-directory: website
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: preflight — toolchain present
+        run: |
+          node --version
+          corepack --version
+
+      - name: enable pnpm (pinned by packageManager)
+        run: corepack enable
+
+      - name: install
+        run: pnpm install --frozen-lockfile
+
+      - name: build
+        run: pnpm build
+
+      - name: deploy to Cloudflare Pages
+        shell: bash
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          BRANCH: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          # `dist` is relative to website/ (the working-directory). The branch
+          # name decides production (main) vs preview (anything else).
+          npx --yes wrangler@4 pages deploy dist \
+            --project-name=relplay \
+            --branch="$BRANCH"
@@ -12,7 +12,13 @@
 *.snap.new
 *.pending-snap

+# Website tooling — Cloudflare Wrangler local cache/state (regenerable;
+# CI deploys from website/, this dir only appears on a local wrangler run)
+.wrangler/
+
 # Editor / OS
 .DS_Store
 *.swp
 *.swo
+# Astro/template-seeded editor configs we don't track (e.g. website/.vscode)
+.vscode/
@@ -37,9 +37,9 @@ Current decisions at a glance (each backed by an ADR):
  simple to advanced (ADR-0003). No other sigils.
 - **Project format:** `project.yaml` + `data/<table>.csv` +
  `history.log`; `playground.db` is a derived artifact (ADR-0004,
-  amended by ADR-0015). Implemented through Iteration 4 +
-  cleanup; export/import (Iter 5) and migration framework /
-  --resume / persistent input history (Iter 6) pending.
+  amended by ADR-0015). Fully implemented (ADR-0015 Iterations
+  1–6): export/import, `--resume`, persistent input history, and
+  the migration framework scaffold are all done.
 - **Project storage runtime:** every command persists through to
  db + yaml + csv + history.log in one execution context, gated
  by the combined db persistence logic; commit-db-last ordering
@@ -108,41 +108,87 @@ Current decisions at a glance (each backed by an ADR):
  SQL `select` / `with` / `insert` / `update` / `delete`
  (ADR-0039). `EXPLAIN QUERY PLAN` never executes, so
  explaining a destructive command is safe.
+- **Continuous integration & release** (developed on the `ci` branch,
+  **merged to `main` 2026-06-15**; decisions in `docs/ci/adr/` —
+  **ADR-ci-001/002/003**, a namespace kept separate from the main ADR
+  sequence to avoid cross-branch number collisions, like the website's):
+  a self-hosted
+  **Gitea Actions** pipeline built on a **nix flake** (pinned Rust
+  `1.95.0` — one source of toolchain for dev *and* CI) plus a
+  prebuilt CI image. **Gate** (`ci.yaml`): `clippy -D warnings` +
+  `cargo test` on every branch push / PR. **Release** on a `v*` tag
+  (`release.yaml`): the four non-macOS **D1** targets cross-built
+  with `cargo-zigbuild` (Linux musl static + standalone Windows
+  `.exe`); the two macOS targets via the **dispatched**
+  `release-macos.yaml` on a Tart Apple-Silicon runner (de-nix the
+  `libiconv` load path + ad-hoc re-sign). All published to a Gitea
+  release with `.sha256`s. **`fmt` is intentionally not gated yet**
+  (the tree isn't stock-`rustfmt`-clean). Now that this is on `main`,
+  `release-macos` is dispatchable (`workflow_dispatch` is
+  Gitea-default-branch-only) — **dispatched and verified working**: the
+  macOS build + de-nix/re-sign + upload runs end-to-end and the binaries
+  launch.
+- **Website & docs site** (developed on the `website` branch, **merged
+  to `main`**; the branch **stays open** for future staging deploys;
+  decisions in `docs/website/adr/` — **ADR-website-001**, its own
+  namespace like CI's): an **Astro + Starlight + Tailwind** marketing
+  landing page plus the **canonical** user docs, under `website/`.
+  Showcase demos are **asciinema casts** (a scripted-input driver, paced
+  + re-recordable — *not* `history.log` replay; the `--demo` overlay,
+  ADR-0047, dresses them). **Deployed to Cloudflare Pages via Gitea
+  Actions** (`.gitea/workflows/website.yaml`; the crate gate is skipped
+  for website-only changes). Two copy rules bind user-facing text: **no
+  engine name** (continues ADR-0002) and **no "DSL"** (say "simple mode"
+  / "advanced mode"). Install docs are still partial — package-manager
+  manifests + some installation instructions are pending (`requirements.md`
+  D3 / DOC1).

 ## Repository layout

 ```
 .
-├── Cargo.toml                 # dependencies, lints (nursery)
-├── CLAUDE.md                  # this file
+├── Cargo.toml / Cargo.lock     # dependencies, lints (nursery)
+├── CLAUDE.md                   # this file
+├── flake.nix / flake.lock      # pinned Rust toolchain, one source for dev + CI (ADR-ci-002)
+├── rust-toolchain.toml         # toolchain pin
+├── .gitea/                     # Gitea Actions workflows + prebuilt CI image (ADR-ci-001..003, website)
+├── ci/                         # CI build helpers (e.g. winstub/ — Windows link stub)
 ├── docs/
-│   ├── adr/                   # all decision records (read 0000 first)
-│   ├── handoff/               # session-handover notes
-│   └── requirements.md        # the Phase-1 checklist with progress
+│   ├── adr/                    # project-wide decision records (read 0000 first)
+│   ├── ci/{adr,handoff}/       # CI subproject ADRs (ci-001..003) + handoffs
+│   ├── website/{adr,plans}/    # website subproject ADRs (website-001) + plan
+│   ├── handoff/                # session-handover notes
+│   ├── plans/                  # working plans
+│   └── requirements.md         # the Phase-1 checklist with progress
 ├── src/
-│   ├── action.rs              # Action enum (Quit / ExecuteDsl)
-│   ├── app.rs                 # App state + pure update() + Tier-1 tests
-│   ├── cli.rs                 # CLI args (--theme, --log-file)
-│   ├── db.rs                  # rusqlite worker, all DDL/DML, metadata tables
+│   ├── action.rs               # Action enum (Quit / ExecuteDsl / …)
+│   ├── app.rs                  # App state + pure update() + Tier-1 tests
+│   ├── cli.rs                  # CLI args (--theme, --log-file, --demo, --no-undo, --resume, …)
+│   ├── clipboard.rs            # copy output to the system clipboard
+│   ├── completion.rs           # Tab completion + schema cache
+│   ├── db.rs                   # rusqlite worker, all DDL/DML, metadata tables
 │   ├── dsl/
-│   │   ├── action.rs          # ReferentialAction enum + parsing
-│   │   ├── command.rs         # Command AST + RelationshipSelector + RowFilter
-│   │   ├── mod.rs             # re-exports
-│   │   ├── parser.rs          # parse entry point → unified-grammar walker
-│   │   ├── shortid.rs         # base58 generator + validator
-│   │   ├── types.rs           # user-facing Type enum + fk_target_type
-│   │   └── value.rs           # Value/Bound + per-type validation
-│   ├── event.rs               # AppEvent (input + DSL outcomes)
-│   ├── lib.rs                 # module re-exports for tests
-│   ├── logging.rs             # tracing setup, file-backed
-│   ├── main.rs                # binary entry; thin
-│   ├── mode.rs                # Simple/Advanced mode enum
-│   ├── runtime.rs             # Tokio loop, terminal setup, dispatch
-│   ├── snapshots/             # insta snapshots for Tier-2 tests
-│   ├── theme.rs               # light/dark themes
-│   └── ui.rs                  # ratatui rendering
-└── tests/
-    └── walking_skeleton.rs    # Tier-3 integration tests
+│   │   ├── grammar/            # hand-rolled unified grammar nodes (DSL + SQL)
+│   │   ├── walker/             # grammar walker (driver / context / highlight / outcome)
+│   │   ├── command.rs parser.rs types.rs value.rs action.rs shortid.rs sql_functions.rs
+│   ├── echo.rs                 # command echo / SQL rendering
+│   ├── event.rs                # AppEvent (input + DSL outcomes)
+│   ├── friendly/               # friendly-error layer + string catalog (strings/en-US.yaml) + keys
+│   ├── input_render.rs         # input-field render + ambient hint classification
+│   ├── output_render.rs        # output-panel render helpers (incl. relationship diagrams)
+│   ├── logging.rs main.rs mode.rs runtime.rs   # tracing / entry / mode enum / Tokio loop
+│   ├── persistence/            # csv + yaml + history IO + migrations
+│   ├── project/                # open/create, lock, naming, prettifier
+│   ├── seed/                   # seed generators / heuristics / vocabulary (ADR-0048)
+│   ├── snapshots/              # insta snapshots for Tier-2 tests
+│   ├── theme.rs type_change.rs ui.rs undo.rs   # themes / column type-change / render / undo ring
+│   └── lib.rs                  # module re-exports for tests
+├── tests/
+│   ├── it/                     # Tier-3 integration tests (consolidated into one binary)
+│   └── typing_surface_matrix.rs  # typing-surface matrix (separate Tier-3 target)
+└── website/                    # Astro + Starlight docs/marketing site (ADR-website-001)
+    ├── src/ public/ casts-src/ # pages + assets + asciinema cast sources
+    └── astro.config.mjs package.json …   # deploys to Cloudflare Pages via Gitea Actions
 ```

 Key invariants in the code:
@@ -165,7 +211,10 @@ Key invariants in the code:
  ADR. In-flight discussion stays in conversation or issues
  until it settles. The ADR-0000 index-upkeep rule applies:
  every ADR change updates `docs/adr/README.md` in the same
-  edit.
+  edit. ADR **numbers** are assigned at merge-to-`main` (draft
+  under a placeholder `ADR-XXXX` / `draft-<slug>.md` on a
+  branch) to avoid cross-branch collisions — see ADR-0000
+  "Numbering discipline".
 - **Issue tracking.** Bugs and enhancements are filed as Gitea
  issues (see *Issue tracking — Gitea via `tea`* below).
  `docs/requirements.md` and the ADRs remain the source of truth
@@ -318,16 +367,8 @@ all of `target/`, forcing a full from-scratch rebuild).
 These are explicitly tracked (mostly in `requirements.md`) but
 not yet implemented:

- **Project storage** (track 2): largely implemented through
-  Iteration 4 + cleanup pass + safety hardening (Iterations
-  1–4 of ADR-0015). Pending pieces: `export` / `import` (Iter
-  5), `--resume` + persistent input history hydration +
-  migration framework scaffold (Iter 6).
 - **Modify relationship** (C3a): drop+add covers the use case
  today.
- **m:n convenience** (C4): auto-generates a junction table
-  with appropriate FKs — depends on relationships being solid
-  (they are).
 - **Strong syntax-help in parse errors** (H1a): point users at
  missing keywords/clauses rather than the unexpected
  character. *(H1 — the friendly **database**-error layer — is
@@ -338,14 +379,17 @@ not yet implemented:
 - **Session log + Markdown export** (V4): the bigger UX
  project — scrollable session journal, smart structure
  rendering, save-as-markdown.
- **Readline shortcuts** (I1b): Ctrl-A/Ctrl-E, Ctrl-W/Ctrl-K/
-  Ctrl-U.
 - **Multi-line input** (I1): Enter inserts newline,
  Ctrl-Enter submits.
- **Tab completion** (I3), **syntax highlighting** (I4).
 - **ER diagram export** (V3).
- **CI** (TT5): test infrastructure exists; CI workflow not
-  yet configured.
+- **Full TT5** (CI): the pipeline is live (see the CI decision
+  above / `docs/ci/adr/`), but "all tiers on all OSes" isn't
+  complete — **Windows is build-only** (cross-compiled, not
+  executed: no Windows runner) and **Tier 4** (PTY, TT4) isn't
+  wired in CI.
+- **D3 packaging**: prebuilt binaries + checksums ship to Gitea
+  releases, but the Homebrew / Scoop / winget / `cargo binstall`
+  manifests are not done.

 ## Handoff notes

@@ -0,0 +1,20 @@
+# Contributing to rdbms-playground
+
+Contributions are welcome — bug reports, ideas, and pull requests. The
+project lives on Gitea at
+<https://git.lazyeval.net/oli/rdbms-playground>; please file issues and
+open pull requests there. It's approaching its first public release, so
+the most useful contributions right now are bug reports and rough edges
+you hit while learning.
+
+## License of contributions
+
+Unless you explicitly state otherwise, any contribution you intentionally
+submit for inclusion in this project — as defined in the Apache-2.0
+license — shall be **dual-licensed under `MIT OR Apache-2.0`** (the
+project's licenses), without any additional terms or conditions.
+
+This is the standard Rust "inbound = outbound" arrangement: your
+contribution is offered under the same licenses the project distributes
+under, so — via Apache-2.0 §5 — it carries the Apache-2.0 §3 patent grant
+to all users. No separate CLA is required.
@@ -1535,7 +1535,7 @@ dependencies = [

 [[package]]
 name = "rdbms-playground"
-version = "0.1.0"
+version = "0.2.0"
 dependencies = [
 "anyhow",
 "arboard",
@@ -1,12 +1,21 @@
 [package]
 name = "rdbms-playground"
-version = "0.1.0"
+version = "0.2.0"
 edition = "2024"
 description = "A cross-platform TUI playground for learning relational databases."
 license = "MIT OR Apache-2.0"
 repository = "https://git.lazyeval.net/oli/rdbms-playground"
+homepage = "https://relplay.org"
 readme = "README.md"
-publish = false
+keywords = ["database", "sql", "tui", "learning", "playground"]
+categories = ["command-line-utilities", "database"]
+# Keep the published crate to the code that builds the binary — the website,
+# decision records, and CI plumbing are repo-only (ADR-0056).
+exclude = ["/website", "/docs", "/.gitea", "/.codegraph"]
+# `publish = false` removed (ADR-0056): the crate is intended for
+# crates.io. The actual `cargo publish` is a deliberate, irreversible
+# maintainer step (needs the crates.io token) — do it at a tagged release
+# whose assets the binstall metadata below points at.

 [dependencies]
 anyhow = "1.0.102"
@@ -85,3 +94,33 @@ nursery = { level = "warn", priority = -1 }
 module_name_repetitions = "allow"
 missing_errors_doc = "allow"
 missing_panics_doc = "allow"
+
+# cargo-binstall (ADR-0056): let `cargo binstall rdbms-playground` fetch the
+# prebuilt release binary instead of compiling from source. Our release assets
+# are BARE binaries (no archive) named `rdbms-playground-v<version>-<target>`
+# (`.exe` on Windows) with `.sha256` sidecars (ADR-ci-003), so `pkg-fmt = "bin"`.
+# `{ version }` excludes the leading `v`, so the template spells `v{ version }`.
+#
+# Target mapping: macOS host triples match our asset triples directly. But we
+# ship the fully-static *-linux-MUSL build (glibc hosts are *-linux-gnu) and
+# *-windows-GNU/GNULLVM (most Windows hosts are *-msvc), so those common host
+# triples need explicit overrides pointing at the asset we actually publish.
+#
+# NOTE: unverified against a real `cargo binstall` run (binstall isn't a dep and
+# nothing is on crates.io yet) — validate at the first publish + matching release.
+[package.metadata.binstall]
+pkg-url = "{ repo }/releases/download/v{ version }/{ name }-v{ version }-{ target }{ archive-suffix }"
+pkg-fmt = "bin"
+bin-dir = "{ bin }{ binary-ext }"
+
+[package.metadata.binstall.overrides.x86_64-unknown-linux-gnu]
+pkg-url = "{ repo }/releases/download/v{ version }/{ name }-v{ version }-x86_64-unknown-linux-musl"
+
+[package.metadata.binstall.overrides.aarch64-unknown-linux-gnu]
+pkg-url = "{ repo }/releases/download/v{ version }/{ name }-v{ version }-aarch64-unknown-linux-musl"
+
+[package.metadata.binstall.overrides.x86_64-pc-windows-msvc]
+pkg-url = "{ repo }/releases/download/v{ version }/{ name }-v{ version }-x86_64-pc-windows-gnu.exe"
+
+[package.metadata.binstall.overrides.aarch64-pc-windows-msvc]
+pkg-url = "{ repo }/releases/download/v{ version }/{ name }-v{ version }-aarch64-pc-windows-gnullvm.exe"
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Lazy Evaluation Ltd
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Lazy Evaluation Ltd
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
@@ -0,0 +1,98 @@
+# rdbms-playground
+
+A cross-platform terminal app for **learning relational database
+concepts** — tables, columns, primary and foreign keys, relationships,
+indexes, queries, and query plans — in a safe sandbox.
+
+It's a teaching tool, not a database administration tool. It meets
+beginners with guided, keyword-based commands (**simple mode**) and grows
+with them to raw SQL (**advanced mode**), so the same playground works
+from "what is a primary key?" through to writing real queries and reading
+their execution plans.
+
+Website & documentation: **<https://relplay.org>**
+
+## Install
+
+### One line (Linux / macOS)
+
+```sh
+curl -fsSL https://git.lazyeval.net/oli/rdbms-playground/raw/branch/main/scripts/install.sh | sh
+```
+
+Detects your OS and CPU, downloads the matching release binary, verifies
+its SHA-256 checksum, and installs it to `~/.local/bin`. Set
+`RDBMS_INSTALL_DIR` to install elsewhere, or `RDBMS_VERSION=vX.Y.Z` to
+pin a version. (Prefer to read before you run? The script lives at
+`scripts/install.sh`.)
+
+### One line (Windows, PowerShell)
+
+```powershell
+irm https://git.lazyeval.net/oli/rdbms-playground/raw/branch/main/scripts/install.ps1 | iex
+```
+
+Downloads the matching `.exe`, verifies its checksum, installs to
+`%LOCALAPPDATA%\Programs\rdbms-playground`, and adds it to your user
+PATH. Or use a package manager (Scoop / winget) once those land.
+
+### With `cargo binstall`
+
+If you have [`cargo-binstall`](https://github.com/cargo-bins/cargo-binstall)
+(install it first — it is not part of `cargo` itself):
+
+```sh
+cargo binstall rdbms-playground
+```
+
+### From source
+
+```sh
+cargo install rdbms-playground          # from crates.io
+# or, from a clone:
+cargo build --release                   # binary at target/release/rdbms-playground
+```
+
+### Prebuilt binaries
+
+Every release publishes static Linux, standalone Windows, and macOS
+binaries (x86_64 and aarch64) with `.sha256` checksums on the
+[releases page](https://git.lazyeval.net/oli/rdbms-playground/releases).
+Windows users can also use the binary directly (package-manager support
+is planned).
+
+## A quick taste
+
+```
+create table Customers with pk id(serial)
+add column Customers: name (text)
+add column Customers: email (text)
+insert into Customers values ('Ann', 'ann@example.io')
+show data Customers
+```
+
+Press **F1** while typing for a contextual hint about the command you're
+building, or type `help` for the full command list. Switch to raw SQL
+with `mode advanced` (or prefix a single line with `:`).
+
+## Project status
+
+Approaching its first public release. See the website for current
+features; installation via package managers (Homebrew, Scoop, winget) is
+on the roadmap.
+
+## License
+
+Dual-licensed under either of
+
+- MIT license ([LICENSE-MIT](LICENSE-MIT))
+- Apache License 2.0 ([LICENSE-APACHE](LICENSE-APACHE))
+
+at your option.
+
+## Contribution
+
+Unless you explicitly state otherwise, any contribution intentionally
+submitted for inclusion in the work by you, as defined in the Apache-2.0
+license, shall be dual-licensed as above, without any additional terms or
+conditions. See [CONTRIBUTING.md](CONTRIBUTING.md).
@@ -38,6 +38,44 @@ The index lists ADRs in numerical order. Each entry shows the
 number, title, and — where relevant — status annotations such as
 "Superseded by ADR-NNNN" or "Deprecated".

+## Numbering discipline
+
+ADR numbers are a single global sequence, so two branches can each grab
+"the next number" independently and collide on merge. (This happened when
+the `website` branch's ADR-0042 met `main`'s ADR-0042, resolved by
+renumbering the former to ADR-0044.) To prevent it:
+
+**Assign an ADR's number at merge-to-`main`, not at creation.** While the
+work lives on a non-`main` branch, draft the ADR under a placeholder — an
+`ADR-XXXX` title and a `draft-<slug>.md` filename — and reference it that
+way from any plan or notes. Give it the next free number only when the
+branch merges to `main`, renaming the file and updating its references in
+the same step.
+
+A number is "taken" only once it appears in `main`'s `docs/adr/README.md`,
+which is the single source of truth for the next free number — never
+compute "next" from a feature branch. A branch that genuinely needs a real
+number up front may instead reserve one by landing a stub index entry on
+`main` first, but placeholder-until-merge is the default.
+
+### Subproject ADR namespaces
+
+A long-lived subproject developed on its own branch can escape the shared
+integer pool entirely by keeping its decision records in a **separate
+namespace**, rather than fighting collisions on every merge. The **website**
+(`docs/website/adr/`) is the first: its ADRs use a dated sequence —
+`<date>-adr-website-<NNN>.md`, referenced in prose as `ADR-website-NNN` —
+and are indexed by their own `docs/website/adr/README.md`. Because the
+date-plus-subproject prefix is disjoint from `main`'s integer sequence, a
+website ADR and a `main` ADR can never claim "the same number" again. (This
+namespace was created on 2026-06-10 after the website's ADR collided with
+`main`'s on consecutive numbers — drafted 0042, bumped to 0044, both times
+landing on a number `main` had taken; the move retired it from the pool as
+**ADR-website-001**.) The main `docs/adr/` index carries a pointer to each
+such namespace. Use this for a new subproject only when it is genuinely
+self-contained and branch-isolated; one-off cross-cutting decisions stay in
+the global sequence.
+
 ## Out-of-scope discipline

 ADRs (and the plans they spawn) lean heavily on "out of scope" language.
@@ -414,5 +414,41 @@ time-boxed-`recv` path. We therefore test the **pure pieces**
 exhaustively (label fn, capture state machine, nearest-deadline helper)
 and assert plumbing via Tier-3, rather than over-claiming an integration
 test of the `tokio` timeout itself.
-</content>
-</invoke>
+
+## Amendment 1 — `Ctrl-G` demo-mode alias for F1 (2026-06-15)
+
+**Context.** The contextual `hint` overlay (ADR-0053 / H2) is opened with
+**F1**. But F1 reaches the app only as an escape sequence (`\eOP` /
+`\e[11~`), and the `autocast` recorder used for our screencasts **cannot
+emit escape sequences** — so a cast can never trigger F1, and the single
+most teaching-relevant overlay is unreachable in recordings. The same
+wall already bit step-captions (which is why `Ctrl+]`, a single control
+byte, was chosen over `Ctrl+!`).
+
+**Decision.** In **demo mode only**, **`Ctrl-G`** is an alias for F1. It
+runs the exact F1 hint logic (live-input → form hint; empty input →
+recent-error / getting-started) and is **badged as `[F1]`** (not
+`[CTRL-G]`) so a recorded cast is visually identical to a genuine F1
+press. `Ctrl-G` is the only viable choice: it is a single legacy control
+byte autocast can send, whereas `Ctrl`+digit (e.g. the mnemonic `Ctrl-1`)
+is **not encodable in a legacy terminal at all** — digits have no control
+byte, so `Ctrl-1` arrives as a bare `1`; the kitty protocol *would* encode
+it but only as an escape sequence (the very thing autocast can't send),
+and this app deliberately does not enable keyboard-enhancement flags.
+
+**Why demo-gated.** The shipped keymap stays F1-only — a real user never
+trips the alias, and demo mode is also the mode teachers/presenters run,
+so the alias is available exactly where it's wanted. Outside demo mode
+`Ctrl-G` falls through to the inert catch-all (the `Char(c)` insert arm
+excludes CONTROL, so no `g` is typed).
+
+**Scope.** `hint_key` guard in `App::handle_key` gains the demo-gated
+`Ctrl-G` disjunct; `demo_badge_label` maps `Ctrl-G → [F1]` (consulted
+only in demo mode). Test-first: three `app.rs` Tier-1 tests (alias fires
+on input + on empty input; inert when demo off) + the badge-map
+assertion. The keybinding strip (ADR-0051) is **not** changed — F1 stays
+the advertised key; `Ctrl-G` is a recorder aid, and the badge already
+reads `[F1]`.
+
+*(Editorial: this amendment also removed two stray `</content>` /
+`</invoke>` lines accidentally committed at the end of this file.)*
@@ -2,7 +2,15 @@

 ## Status

-Accepted — implementation in progress. Revised after a `/runda` review
+Accepted — **implemented 2026-06-15** (plan:
+`docs/plans/20260614-adr-0053-contextual-hint-H2.md`; the F1 keybinding +
+`hint` command, the `hint_ids` per-form keying + `hint_key_for_input_in_mode`,
+`last_error_hint_key` + `friendly::error_hint_class`, the `note_hint*`
+renderers, and the `hint.cmd.*`/`hint.err.*` corpus for every command form
+ the 9 runtime error classes, with the comprehensiveness coverage test
+and the ADR-0051 strip advertising F1). Closes **A1** + requirements
+**H2**. Deferred: the pre-submit-diagnostic route + `diagnostic.*` blocks
+(#38), clause-concept hints (#37). Revised after a `/runda` review
 (2026-06-14): corrected the verbosity-default fact; re-keyed tier-3
 content off `help_id`; split the pre-submit-diagnostic and runtime-error
 paths; added a comprehensiveness coverage test. Revised again during
@@ -10,10 +18,13 @@ Phase B implementation (2026-06-15): the first exemplar showed per-*node*
 keying is too coarse for multi-form commands (`add`/`drop`/`show`/
 `create`), so D3 now keys tier-3 content **per form** via a
 `hint_ids: &[&str]` array mirroring `usage_ids` — and **clause-concept
-hints** are recorded as a deferred extension (separate tracking issue).
-The parallel question of whether the in-app `help` command should
-likewise distinguish advanced-SQL forms is tracked **separately** as
-Gitea issue #36 (it touches shipped, ADR-backed `help` behaviour).
+hints** are recorded as a deferred extension (issue #37). During Phase C
+the **pre-submit-diagnostic route + the ~33 `diagnostic.*` blocks** were
+**deferred** (issue #38) — `Diagnostic` doesn't carry its class key, so
+the route needs a broad change for marginal value (D6). v1 therefore
+ships command-form hints + the 9 runtime error-class hints. The parallel
+question of whether the in-app `help` command should likewise distinguish
+advanced-SQL forms is tracked **separately** as Gitea issue #36.

 Decided in conversation 2026-06-14. Closes the last open piece of **A1**
 (the canonical app-command set, ADR-0003): every app command is
@@ -102,7 +113,7 @@ into the output journal. (It must therefore be handled in `handle_key`

 | Trigger | Buffer / state | Result |
 |---|---|---|
-| **F1** | non-empty input | tier-3 hint for the command being typed, plus the live "expected next" (from the walker's `tail_expected` / parser `expected`) |
+| **F1** | non-empty input | tier-3 hint for the command being typed. (No "expected next" line — the always-on tier-2 ambient panel already shows it live; tier-2 owns position-awareness.) |
 | **F1** | empty input, a recent error exists | tier-3 expansion of that error |
 | **F1** | empty input, no recent error | a short "getting started" pointer (press F1 while typing a command; `help` for the full list) |
 | **`hint`** (submitted) | a recent error exists | tier-3 expansion of that error (primary use) |
@@ -112,19 +123,13 @@ F1 is inert behind a modal and while a sidebar panel holds navigation
 focus (consistent with the existing `handle_key` gates, ADR-0046); it is
 active in the input context in both Simple and Advanced mode.

-**Two error sources, one namespace.** Errors come in two kinds and reach
-`hint` by different routes:
-
- **Pre-submit diagnostics** (the ~33 `diagnostic.*` classes — arity,
-  type, unknown table/column) are computed *while typing* by the walker.
-  The **F1 live-input path** reads the current under-cursor diagnostic
-  directly from the walker (the same source the ambient panel uses) and
-  renders its `hint.err.<class>` block — no stored state needed.
- **Runtime errors** (the 9 `translate_error` classes) occur *after*
-  submit. The **`hint` command / empty-input F1** path reads them via the
-  stored `last_error_hint_key` (D5).
-
-Both render from the same `hint.err.*` namespace. **`:`-prefix handling:**
+**Error routes.** **Runtime errors** (the 9 `translate_error` classes)
+occur *after* submit; the **`hint` command / empty-input F1** path reads
+them via the stored `last_error_hint_key` (D5) and renders their
+`hint.err.<class>` block. (A second route for **pre-submit diagnostics**
+on the F1 live-input path was specified but is **deferred** — D6 / issue
+#38; with a diagnostic present, F1 shows the command block and tier-2
+shows the diagnostic.) **`:`-prefix handling:**
 on the simple-mode one-shot escape (`: SELECT …`), command
 identification for the F1 path strips the leading `:` first, so the
 advanced form is matched.
@@ -200,14 +205,17 @@ mechanics (e.g. `quit`); `what` + `example` are always present.

 ### D4 — Rendering

-Both surfaces render through one new renderer, `App::note_hint*` (sibling
-of `note_help`/`note_help_topic`, `src/app.rs`), emitting a small framed
-block into the `output` buffer as `OutputKind::System` with
-`OutputStyleClass::Hint` on the `what`/`concept` prose and `Neutral` on
-the `example` line. The block is **persistent** (scrolls in the journal),
-unlike the transient ambient panel — pressing F1 is an explicit request
-to *keep* the deeper guidance on screen. The bottom keybinding strip
-(ADR-0051) advertises F1 in the editing/typing state.
+Both surfaces render through the `App::note_hint*` family (sibling of
+`note_help`/`note_help_topic`, `src/app.rs`) via `emit_tier3_block`,
+emitting into the `output` buffer as `OutputKind::System`: a **`Hint`
+heading** followed by aligned **`What:` / `Example:` / `Concept:`** lines
+(labels + heading from `hint.block.*`). The `concept` line is muted
+(`OutputStyleClass::Hint`); the rest are plain. The block is
+**persistent** (scrolls in the journal), unlike the transient ambient
+panel — pressing F1 is an explicit request to *keep* the deeper guidance
+on screen. Its rendered shape is locked by an `insta` snapshot
+(`hint_block_insert`). The bottom keybinding strip (ADR-0051) advertises
+F1 in the editing (leading) and default states.

 ### D5 — "Most recent (runtime) error" state

@@ -220,26 +228,37 @@ Option<String>`** — set at the `translate_error` call sites
 cleared when a later command succeeds. Absent → the "getting started"
 pointer.

-The **pre-submit-diagnostic route** (the F1 live-input path) needs no
-stored state: it reads the current diagnostic from the walker at F1 time
-(D2). This is the cleaner split the `/runda` pass surfaced — typing-time
-diagnostics and post-submit runtime errors are genuinely different
-sources and should not be funnelled through one stored key.
+The **pre-submit-diagnostic route** (the F1 live-input path reading the
+under-cursor diagnostic) is **deferred** — see the scope note in D6.

-### D6 — Content scope: comprehensive for v1
+### D6 — Content scope for v1

-v1 ships tier-3 content for the **whole inventory**, not a subset (the
-graceful tier-2 fallback below is a safety net, not the plan):
+v1 ships tier-3 content for the **command forms and runtime error
+classes** — comprehensive for those (the graceful tier-2 fallback below
+is a safety net, not the plan):

 - **~37 command forms** — every distinct node in `REGISTRY` gets its own
  `hint.cmd.<hint_id>` block (app + DSL + DDL + advanced-mode SQL forms),
  each with a **mode-correct example** (the advanced-SQL forms show SQL
  syntax, their simple siblings show DSL — no sharing).
- **9 runtime error classes** — `unique`, `foreign_key` (×4 sides),
-  `not_null`, `check`, `type_mismatch`, `not_found`, `already_exists`,
-  `generic`, `invalid_value` — each gets a `hint.err.*` block.
- **~33 `diagnostic.*` pre-submit classes** — arity, type, unknown
-  table/column, etc. — each gets a `hint.err.*` block.
+- **9 runtime error classes** — `unique`, `foreign_key` (child/parent
+  side), `not_null`, `check`, `type_mismatch`, `not_found`,
+  `already_exists`, `generic`, `invalid_value` — each gets a
+  `hint.err.*` block.
+
+**Deferred — the ~33 `diagnostic.*` pre-submit classes and the F1
+diagnostic route** *(Phase C scope decision, 2026-06-15; issue #38)*. The
+original "comprehensive" scope included them, but implementation revealed
+`Diagnostic` (`walker/outcome.rs`) carries only its rendered `message`,
+not its class key — so a live diagnostic can't be mapped to
+`hint.err.<class>` without adding a `class` field threaded through every
+diagnostic-creation site (a broad change). Weighed against the value, it
+isn't worth it for v1: pre-submit diagnostics are already surfaced by
+tier-2 (ambient message + validity indicator, ADR-0027); F1 still shows
+the useful command block when a diagnostic is present; and many
+diagnostic classes duplicate runtime classes already covered
+(`type_mismatch`, `unknown_table`↔`not_found`, arity↔`invalid_value`).
+Deferred to issue #38, additively (the keying doesn't lock it out).

 The full enumerated checklist is the implementation plan's tracking
 artifact (see *Content inventory*, below).
@@ -262,32 +281,31 @@ maintainer owns, content is produced in two stages:
   **reviewable batches** (grouped by area: DDL, DML, app commands,
   error classes), not one monolithic drop.

-### Exemplars (the style reference to approve)
+### Exemplars (the style reference; shipped as the rendered format)

-**Command (F1 live-input), `insert`:**
+**Command (F1 live-input), `insert`** (the rendered shape, locked by the
+`hint_block_insert` snapshot — a `Hint` heading + aligned labels, no
+`Next:` line since tier-2 owns position-awareness):

 ```
-Hint — insert
+Hint
  What:    Add one or more rows to a table.
-  Example: insert into Customers values ('Ann', 'ann@x.io')
+  Example: insert into Customers values ('Ann', 'ann@example.io')
  Concept: A row is one record; each value lines up with a column, in
           order. Columns typed serial/shortid fill themselves — leave
           them out.
-  Next:    a value list `(...)`, or `(col, ...) values (...)` to name columns
 ```
-(The "Next:" line is the live expected-set from the walker, shown only on
-the non-empty-input F1 path.)

 **Error (`hint` command), foreign-key child-side violation:**

 ```
-Hint — no parent row to point at
-  What:    The value you inserted into Orders.customer_id doesn't match
-           any Customers row, so the foreign key has nothing to point at.
-  Example: First   insert into Customers values ('Ann', ...)
-           Then    insert into Orders values (..., 'Ann')
+Hint
+  What:    The value you gave for the child column doesn't match any
+           parent row, so the foreign key has nothing to point at.
+  Example: First insert the parent (insert into Customers …), then the
+           child that references it.
  Concept: A foreign key is a promise that every child points at a real
-           parent. The parent must exist first. To allow orphans on
+           parent, so the parent must exist first. To allow orphans on
           delete instead, set the relationship's `on delete` to
           `set null` or `cascade`.
 ```
@@ -295,7 +313,7 @@ Hint — no parent row to point at
 **Command (F1 live-input), `add 1:n relationship`:**

 ```
-Hint — add relationship
+Hint
  What:    Link two tables so a parent row can own many child rows.
  Example: add 1:n relationship from Customers.id to Orders.customer_id
  Concept: The "1:n" means one parent, many children. The child column
@@ -339,26 +357,26 @@ Hint — add relationship
  `App` state (`last_error_hint_key`), and one new renderer family
  (`note_hint*`); the `AppCommand` enum gains `Hint`, the grammar a `HINT`
  node, the REGISTRY one entry.
- **A large, durable content corpus** (~37 command blocks + ~42 error/
-  diagnostic blocks ≈ 80) enters the catalogue under `hint.cmd.*` /
+- **A durable content corpus** (~37 command blocks + 10 runtime
+  error-class blocks) enters the catalogue under `hint.cmd.*` /
  `hint.err.*`, validated by `keys.rs`. This is ongoing surface area: new
  commands/error classes should ship with their tier-3 hint (a checklist
-  item for future feature ADRs).
+  item for future feature ADRs). (Diagnostic-class blocks deferred — #38.)
 - **Testing:** Tier-1 unit tests for the trigger matrix (F1 with
  empty/non-empty input; `hint` with/without a recent error;
  `last_error_hint_key` set on the `translate_error` sites and cleared on
-  success; the pre-submit-diagnostic vs runtime-error routing; the `:`
-  strip), the command-identification logic, and the tier-2 fallback;
-  Tier-2 `insta` snapshots for a representative rendered hint block;
-  Tier-3 integration tests for the end-to-end flows (type a partial
-  command → F1 → block appears, **buffer and completion memo untouched**;
-  run a failing command → `hint` → error expansion). **A
-  comprehensiveness coverage test** (enforces D6): iterate the REGISTRY
-  and assert every node has a `hint_id` resolving to a `hint.cmd.*` block,
-  and every runtime-error/diagnostic class has a `hint.err.*` block —
-  `keys.rs` only checks that *referenced* keys resolve, not that every
-  command/error *has* one, so this test is what makes "comprehensive"
-  enforceable rather than aspirational.
+  success; the mode-aware form resolution; the `:` strip), the
+  command-identification logic, and the tier-2 fallback; Tier-2 `insta`
+  snapshots for a representative rendered hint block; Tier-3 integration
+  tests for the end-to-end flows (type a partial command → F1 → block
+  appears, **buffer and completion memo untouched**; run a failing
+  command → `hint` → error expansion). **A comprehensiveness coverage
+  test** (enforces D6): iterate the REGISTRY and assert every node with a
+  `hint_ids` entry resolves to a `hint.cmd.*` block, and every runtime
+  error class resolves to a `hint.err.*` block — `keys.rs` only checks
+  that *referenced* keys resolve, not that every command/error *has* one,
+  so this test is what makes the scope enforceable rather than
+  aspirational. (Diagnostic classes are out of this scope — D6 / #38.)

 ## Out of scope

@@ -381,6 +399,11 @@ Hint — add relationship
  recognized clause, deeper than tier-2's candidate list but narrower than
  the per-form block. Per-form keying (D3) does not lock it out. To be
  tackled as a deliberate follow-up job, not gated on usage statistics.
+- **Pre-submit-diagnostic route + `diagnostic.*` tier-3 blocks** — OOS
+  (deferred, issue #38): needs a class field on `Diagnostic` threaded
+  through every creation site (broad change) for marginal value, since
+  tier-2 already surfaces diagnostics and many duplicate runtime classes
+  (D6).

 ## Content inventory (implementation tracking)

@@ -401,4 +424,5 @@ The implementation plan enumerates and checks off every block:
 - **`hint.err.*`** — one per runtime error class (`unique`,
  `foreign_key.{child,parent}_side`, `not_null`, `check`,
  `type_mismatch`, `not_found`, `already_exists`, `generic`,
-  `invalid_value`) and per `diagnostic.*` pre-submit class.
+  `invalid_value`). The `diagnostic.*` pre-submit classes are **deferred**
+  (D6 / issue #38).
@@ -0,0 +1,73 @@
+# ADR-0054: Release versioning policy + version surfaces (`--version` / `version`)
+
+## Status
+
+Accepted — **implemented 2026-06-16** (plan:
+`docs/plans/20260616-public-availability.md`, step 1). First step on the
+road to public availability. Adds a `--version` / `-V` CLI flag and an
+in-app `version` command, both reporting `CARGO_PKG_VERSION`, plus a
+release-CI guard that the `v*` tag equals that version. No prior issue or
+`requirements.md` item existed for this — it was an untracked gap.
+
+## Context
+
+Before this, `Cargo.toml` carried `version = "0.1.0"`, the binary exposed
+**no** way to report its version, and `release.yaml` named assets from the
+**git tag** (`rdbms-playground-<tag>-<target>`) while building from
+`Cargo.toml`. Tag and crate version were **decoupled**: tagging `v0.2.0`
+would publish an asset named `…-v0.2.0-…` containing a binary that (had it
+been able to say) reported `0.1.0`. On the way to public availability —
+where users download a versioned artifact and file bug reports against "the
+version I'm running" — that drift is a correctness problem.
+
+## Decision
+
+1. **`Cargo.toml` `version` is the single source of truth.** This is the
+   idiomatic Rust position and avoids making `Cargo.toml` lie. The version
+   is read at compile time via `env!("CARGO_PKG_VERSION")`; no build-time
+   injection of the tag into the crate.
+
+2. **Two user-facing surfaces, one source:**
+   - **`--version` / `-V`** — CLI flag (hand-rolled parser, mirrors
+     `--help`): prints and exits before any other work (`main.rs`).
+   - **`version`** — an in-app app command (REGISTRY node `app::VERSION`,
+     `AppCommand::Version`), emitting the same line into the output panel.
+   Both go through `cli::version_text()` → the catalog key
+   `cli.version_line` (`"rdbms-playground {version}"`), so there is exactly
+   one rendered string and one version source.
+
+3. **Release-CI discipline.** `release.yaml`'s pre-build `test` job gains a
+   **version guard**: it reads the `[package]` version directly from
+   `Cargo.toml` (`grep -m1 '^version = '` — toolchain-free; an earlier
+   `cargo metadata | node` form broke on the flake devShell's stdout banner)
+   and **fails the release** unless the pushed tag equals `v<that version>`.
+   So `--version`, the release name, and the downloaded asset are always in
+   lockstep — enforced by the machine, not by memory.
+
+4. **The release ritual:** bump `Cargo.toml` → commit → tag `v<that
+   number>` → push the tag. The guard rejects any deviation.
+
+### Rejected / deferred
+- **Inject the tag into the build** (tag as source of truth): fiddly with
+  cargo and makes `Cargo.toml` a placeholder/lie. Rejected.
+- **Git-hash + build-date enrichment** (a `build.rs` so dev builds read
+  `0.2.0 (a1b2c3d)`): useful for bug reports, but not needed for the
+  tag↔release↔`--version` consistency this ADR is about. Deferred; can be
+  added behind the same `version_text()` seam without changing the policy.
+- **UI placement beyond the `version` command** (status-bar string, etc.):
+  the command + `help` listing is enough for now (user decision).
+
+## Consequences
+
+- A release can no longer ship a binary whose self-reported version
+  disagrees with its tag/filename.
+- Cutting a release now *requires* a `Cargo.toml` bump commit — a small,
+  deliberate step (and a natural place to update a changelog later).
+- New keys: `cli.version_line` (+ `help.app.version`, `parse.usage.version`,
+  `hint.cmd.version.what`/`.example`); a new REGISTRY command means the
+  comprehensiveness coverage test now also requires `hint.cmd.version`,
+  which is supplied. Tested: CLI flag parse (`--version`/`-V`/default-off),
+  `version_text()` carries `CARGO_PKG_VERSION`, the in-app command parses to
+  `AppCommand::Version` and emits the version.
+- This is step 1 of `docs/plans/20260616-public-availability.md`; the
+  installer (`install.sh`) and package-manager work (D3) build on top.
@@ -0,0 +1,86 @@
+# ADR-0055: `curl | sh` install script (`scripts/install.sh`)
+
+## Status
+
+Accepted — **implemented 2026-06-17** (plan:
+`docs/plans/20260616-public-availability.md`, step 2). Step 2 on the road
+to public availability, building on ADR-0054 (versioned releases) and
+ADR-ci-001/003 (the Gitea releases it downloads from). Tracked by the
+plan + this ADR (no Gitea issue — user decision, 2026-06-17).
+
+## Context
+
+Until now, installing meant: find the releases page, work out which of
+the six assets matches your machine, download it, `chmod +x`, move it
+onto `PATH`, and (on macOS) wonder about Gatekeeper. That is too much
+friction for a teaching tool aimed at beginners. The Gitea releases are
+**publicly downloadable** (confirmed), with deterministic asset names
+(`rdbms-playground-<tag>-<target>[.exe]`) and `.sha256` sidecars
+(ADR-ci-003), and a `releases/latest` API — enough to script a one-liner
+install.
+
+## Decision
+
+Ship **`scripts/install.sh`**, run as
+`curl -fsSL <gitea-raw>/scripts/install.sh | sh`:
+
+- **POSIX `sh`** (no bashisms) — it runs under the `sh` of `curl | sh`;
+  kept **shellcheck-clean** (`-s sh`).
+- **Platform detection** from `uname` → target triple: Linux →
+  `<arch>-unknown-linux-musl` (the fully-static build — one universal
+  Linux artifact, no glibc/version coupling), macOS → `<arch>-apple-darwin`;
+  `x86_64`/`amd64` and `aarch64`/`arm64` both map. **Windows is rejected**
+  with a pointer to Scoop/winget/the releases page (the binary is a `.exe`,
+  not a `curl|sh` target).
+- **Version:** the `releases/latest` API tag by default; `RDBMS_VERSION`
+  pins a specific tag.
+- **Integrity:** always download the `.sha256` sidecar and **verify**
+  (`sha256sum`/`shasum -a 256`); a mismatch aborts the install. HTTPS only.
+- **Install location:** `~/.local/bin` by default (user-writable, no
+  sudo), overridable via `RDBMS_INSTALL_DIR`; prints a PATH hint if the
+  dir isn't on `PATH`.
+- **macOS note:** a `curl` download is **not** Gatekeeper-quarantined, so
+  the binary runs as-is even while it is only ad-hoc-signed; proper
+  Developer-ID signing + notarization (for *browser* downloads) is a
+  separate, postponed task (see the plan's signing item).
+- **Testing seams:** `RDBMS_OS`/`RDBMS_ARCH` force detection and
+  `--print-target` prints the resolved triple and exits — so the mapping
+  is checkable without a download.
+
+### Rejected / deferred
+- **Hosting the script on the website domain** (Cloudflare): nicer URL,
+  but adds a moving part; the **Gitea repo raw URL** is simplest and the
+  binaries live there anyway (user decision). The website may later
+  *reference* the same command.
+- **Uploading `install.sh` as a release asset** for a stable link:
+  optional; the branch raw URL is fine for now.
+
+## Amendment 1 — `install.ps1` (Windows) added (2026-06-17)
+
+Windows was originally deferred to Scoop/winget; the user opted for **both**
+a PowerShell one-liner now *and* package managers later. Added
+**`scripts/install.ps1`** (`irm <url> | iex`): maps the host CPU to our
+`*-windows-gnu`/`-gnullvm` `.exe`, resolves the latest release (or
+`-Version`/`RDBMS_VERSION`), downloads + **SHA-256-verifies**, installs to
+`%LOCALAPPDATA%\Programs\rdbms-playground` (`-InstallDir`/`RDBMS_INSTALL_DIR`
+override), and adds that dir to the **user PATH**. **Caveat:** unlike
+`install.sh` (verified end-to-end), this was **written but not tested from
+this environment** (no PowerShell available) — validate on a real Windows
+host. Scoop/winget (D3) remain the idiomatic package-manager routes.
+
+## Consequences
+
+- A first-time user runs one line and gets a checksum-verified binary on
+  `PATH`. The website's install copy (website branch, separate agent) can
+  point at this command.
+- **Verified end-to-end** (2026-06-17) against the live public `v0.1.0`:
+  all four Linux/macOS platform mappings + Windows/unknown-arch rejection;
+  pinned and latest paths; checksum verification incl. a tamper-rejection
+  check; install + run on Linux x86_64. (The installed `v0.1.0` predates
+  `--version`, ADR-0054 — a non-issue, and the reason to cut a new
+  release.)
+- **No automated regression guard in CI yet:** shellcheck isn't in the
+  flake, and there's no shell-test harness here (no bats). Recommended
+  follow-up: add a `shellcheck scripts/*.sh` gate (touches ADR-ci-002 —
+  needs shellcheck in the devShell). For now the guard is local
+  shellcheck + the documented end-to-end verification.
@@ -0,0 +1,88 @@
+# ADR-0056: crates.io publish-readiness + `cargo binstall` metadata (D3)
+
+## Status
+
+Accepted — **prepared 2026-06-17** (plan:
+`docs/plans/20260616-public-availability.md`, step 3a). The crate is made
+**ready to publish** and carries `cargo-binstall` metadata. The actual
+`cargo publish` is a gated maintainer step (see Ordering). First D3
+package-manager mechanism; builds on ADR-0054 (versioned releases),
+ADR-0055 (installer), ADR-ci-003 (release assets). Tracked by plan + ADR
+(no Gitea issue — user decision).
+
+## Context
+
+`cargo binstall rdbms-playground` (and `cargo install`) need the crate on
+**crates.io** (user decision, 2026-06-17). The manifest had
+`publish = false`, a `readme = "README.md"` pointing at a **missing**
+file, and no `keywords`/`categories`. Our release assets are **bare
+binaries** (not archives) named `rdbms-playground-v<version>-<target>`
+(`.exe` on Windows) with `.sha256` sidecars (ADR-ci-003); critically the
+**release target triples differ from users' host triples** — we ship the
+static `*-linux-musl` build (hosts are `*-linux-gnu`) and
+`*-windows-gnu`/`-gnullvm` (hosts are `*-msvc`); only macOS matches.
+
+## Decision
+
+**Publish-readiness (this change):**
+- Drop `publish = false`; add `homepage = "https://relplay.org"`,
+  `keywords`, `categories = ["command-line-utilities", "database"]`, and
+  an `exclude` (`/website`, `/docs`, `/.gitea`, `/.codegraph`) so the
+  published crate is code-only (585 files/8.3 MiB → 353/913 KiB
+  compressed).
+- Author **`README.md`** (the `readme` target + crates.io front page;
+  engine-neutral and "simple/advanced mode" wording per ADR-0002 / the
+  website copy rules), with install instructions (curl|sh, binstall,
+  source, prebuilt).
+- Add **`LICENSE-MIT`** and **`LICENSE-APACHE`** (the latter the verbatim
+  canonical text, added by the maintainer; both © Lazy Evaluation Ltd —
+  the publication entity), and a **`CONTRIBUTING.md`** stating the
+  "inbound = outbound" dual-license arrangement (so Apache-2.0 §5 makes
+  the §3 patent grant explicit on the self-hosted forge). Dual license
+  kept (not MIT-only) — user decision after reviewing the patent-grant
+  rationale.
+
+**`cargo binstall` metadata** (`[package.metadata.binstall]`, syntax
+verified against cargo-binstall SUPPORT.md):
+- `pkg-fmt = "bin"` (bare binary), `bin-dir = "{ bin }{ binary-ext }"`,
+  and a base `pkg-url` using `v{ version }` (the `{ version }` placeholder
+  excludes the leading `v`).
+- **Per-target `overrides`** mapping the common host triples to the asset
+  we actually publish: `x86_64`/`aarch64-unknown-linux-gnu` → the `-musl`
+  asset; `x86_64`/`aarch64-pc-windows-msvc` → the `-gnu`/`-gnullvm`
+  `.exe`. macOS needs no override (host triple == asset triple). The docs
+  do **not** promise automatic musl/gnu or msvc/gnu fallback, hence
+  explicit overrides.
+
+**Ordering / gating (important):**
+- `cargo publish` is **irreversible** (needs the crates.io token; a
+  version can't be un-published, only yanked) — a deliberate **maintainer
+  step**, not done here.
+- binstall's `pkg-url` resolves to a **tagged release's** assets, so
+  publish **at a new tagged version whose release already exists**, and
+  publish **after** that release is built. **Do not publish `0.1.0`** — it
+  would diverge from the already-released `0.1.0` binaries (which predate
+  `--version`, ADR-0054). The clean path: bump → tag → release builds →
+  `cargo publish`.
+
+## Verification
+
+- `cargo publish --dry-run --allow-dirty` packages + verify-builds cleanly
+  (353 files, 913 KiB compressed; no metadata errors).
+- `cargo metadata` confirms the `binstall` block + all four `overrides`
+  parse.
+- **Unverified:** an actual `cargo binstall` run — cargo-binstall isn't a
+  dependency and nothing is on crates.io yet. **Validate at the first
+  publish + matching release** (especially the windows-msvc→gnu and
+  linux-gnu→musl overrides).
+
+## Consequences
+
+- The crate can be published at the next tagged release with `cargo
+  publish` (+ the token); `cargo install rdbms-playground` and `cargo
+  binstall rdbms-playground` then work.
+- Remaining D3: Scoop, Homebrew (`lazyeval` tap), winget (komac/manual) —
+  each a manifest + a per-release bump, tracked in the plan.
+- Remaining follow-up: run the real `cargo binstall` validation at the
+  first publish + matching release (the license files, © holder, and
+  CONTRIBUTING are now in place).
@@ -133,3 +133,13 @@ declaration of the dev *and* build environment.
  flake for `requirements.md` **TT5** (CI runs the tiers) and the
  **D1/D2/D3** distribution items (the release uses a static musl target
  built through this flake).
+
+## Amendment 1 — 2026-06-17: `fmt` gate enabled (issue #35)
+
+The deferred "revisit on `main`" is done. With the CI + website branches
+merged and before the first public release, the tree was reformatted once
+with **stock `cargo fmt`** (no `rustfmt.toml` — stable rustfmt supports no
+meaningful customisation, and the pinned 1.95.0 toolchain makes
+`fmt --check` deterministic) in a single mechanical commit (`41b7e9a`,
+102 files, behaviour-preserving; recorded in `.git-blame-ignore-revs`).
+`ci.yaml`'s gate is now **`fmt --check` + clippy + test**. Closes **#35**.
@@ -20,6 +20,17 @@ This ADR records the **cross-platform build strategy**; it sits on top of
 **ADR-ci-002** (the nix flake, which now carries the cross toolchain) and
 **ADR-ci-001** (the pipeline, whose release job this fills in).

+## Amendment 2 — 2026-06-16: CI on `main`; `release-macos` dispatched + verified
+
+The CI branch is **merged to `main`**, so `release-macos.yaml`
+(`workflow_dispatch`, Gitea-default-branch-only) is now triggerable. It
+has been **dispatched and verified end-to-end**: both `*-apple-darwin`
+targets build on the Tart runner, the de-nix/re-sign step runs, the
+assets upload to the tagged release, and the binaries launch. macOS is
+therefore runtime-verified (alongside the original Linux x86_64 +
+Windows aarch64); only **Linux aarch64** and **Windows x86_64** remain
+link-clean / valid-format without a runtime smoke-test.
+
 ## Amendment — 2026-06-14: macOS implemented (closes D1)

 macOS is no longer deferred. The two `*-apple-darwin` targets now build on a
@@ -19,5 +19,5 @@ here too).
 ## Index

 - [ADR-ci-001 — CI + release pipeline on Gitea Actions](20260612-adr-ci-001.md) — **Accepted 2026-06-12** (implemented the same day on the `ci` branch). Establishes the CI/release pipeline on the self-hosted Gitea instance's Actions runner (`ci-public`). **Runner model** (established by a throwaway probe): jobs execute *inside* a container (`catthehacker/ubuntu:act-22.04` by default), as root, so the runner host's nix is **not** reachable from steps. **Toolchain delivery:** a **baked CI image** — `node:22-bookworm-slim` (satisfies the act_runner job-container contract: `/bin/sleep` keep-alive, `bash`, `node` for JS actions; a bare `nixos/nix` image lacks these and won't start) **+ single-user nix + the flake's devShell pre-warmed** — built by `build-ci-image.yaml` via DinD and pushed to the Gitea container registry as a **public** package, so CI runs `nix develop -c …` against the **same pinned toolchain as dev** (the flake, ADR-ci-002) with a warm store (~1.4 s to a ready toolchain). **Gate** (`ci.yaml`): `clippy -D warnings` + `cargo test` inside that image on branch pushes + PRs; **fmt deliberately not gated** (the tree isn't stock-rustfmt-clean — user decision, revisit on `main`; see ADR-ci-002). **Release** (`release.yaml`): on a `v*` tag, runs the tests, builds the **static `x86_64-unknown-linux-musl` binary** (D2: single static binary, no runtime deps — the glibc/nix build is non-portable), strips it, and publishes it + a `.sha256` to a Gitea release via the API and the auto-provided `GITEA_TOKEN`. **Triggers:** gate + image-build are scoped to **branch** pushes (`branches: ['**']`) so a release tag doesn't spuriously re-run them; the image-build additionally path-filters to its inputs (Dockerfile/flake/toolchain); the release owns tags. **Auth:** a dedicated PAT (`REGISTRY_USERNAME`/`REGISTRY_TOKEN` secrets) pushes the image; the auto `GITEA_TOKEN` publishes releases. **Scope:** the original release job was Linux x86_64 only; it's now the **four non-macOS D1 targets** (Linux + Windows × x86_64/aarch64) cross-built via cargo-zigbuild — see **ADR-ci-003**. macOS, D3 package-manager manifests, CI-speed dependency caching, and the website's static→Cloudflare deploy remain deferred, added step by step. Verified live: probe → runner facts; image built + checked locally; gate green (**2424 tests**); release exercised end-to-end (`v0.0.0-citest2` published with binary + checksum). Builds on **ADR-ci-002** (the nix flake, relocated here from main's ADR-0049 to avoid exactly this cross-branch collision).
- [ADR-ci-002 — Nix flake for a reproducible dev + build environment](20260612-adr-ci-002.md) — **Accepted 2026-06-12** (relocated from main's **ADR-0049** on the same day — content unchanged — to keep CI/dev-env decisions out of `main`'s integer sequence). The single, version-pinned declaration of the **dev *and* build toolchain** so CI never relies on whatever Rust is on the build machine — mirroring **datamage ADR 0046**, but far simpler (pure-Rust TUI). Root **Nix flake** with two outputs: **`devShells.default`** (pinned **Rust 1.95.0** via `rust-toolchain.toml` + `rust-overlay`, `cargo-sweep`, and the musl cc for the static release build) and **`packages.default`** (`rustPlatform.buildRustPackage` from the committed `Cargo.lock`; `doCheck = false`). Exact-pin (not floating `stable`) so `nix flake update` can't surprise-bump clippy past the `-D warnings` gate. System inputs near-empty by design (`libsqlite3-sys bundled` → stdenv cc only; `arboard`→`x11rb` pure-Rust). `.envrc` (`use flake`) for direnv parity. Verified through the flake: `nix build` yields a working binary, clippy clean, **2424 tests pass / 0 fail / 1 intentional ignored doctest**. Consumed by **ADR-ci-001** (the pipeline). Alternatives rejected: dev-shell-only; a standard `rust:1.95` CI image (a second toolchain definition = drift); `rustup` on the build host (non-reproducible).
- [ADR-ci-003 — Cross-platform release builds (the D1 matrix)](20260613-adr-ci-003.md) — **Accepted 2026-06-13** (implemented + a real matrix release verified the same day — tag `v.0.0.0-citest3` published 8 assets). Cross-compiles the **four non-macOS D1 targets** from the Linux x86_64 runner with **`cargo-zigbuild`** (Zig's bundled clang + libc as one universal cross cc/linker, incl. rusqlite's bundled SQLite C; added to the flake devShell, replacing the single-target musl cc): **`x86_64`/`aarch64-unknown-linux-musl`** (musl + crt-static → fully static, **D2**) and **`x86_64-pc-windows-gnu`** / **`aarch64-pc-windows-gnullvm`** (Zig statically links libc → standalone `.exe`). **Windows `synchronization` stub:** Rust std links `-lsynchronization` (WaitOnAddress thread-parking), an import lib rust-overlay's toolchain doesn't ship and Zig's mingw lacks; the symbols are forwarded by `kernel32`, so an **empty 8-byte stub** `libsynchronization.a` (`ci/winstub/`, wired via `.cargo/config.toml` for the Windows targets only) satisfies the linker. **Workflow:** `release.yaml` = **`test` once (host) → `build` matrix** over the four targets (`needs: test`, `fail-fast: false`); each job packages binary (`.exe` for Windows) + `.sha256` and uploads to the **shared release** via idempotent create-or-get. **macOS** (2026-06-14 amendment) — built natively on a **Tart (Apple-Silicon) runner** (`runs-on: macos`), which makes the SDK fully licensed and dissolves the grey-area/public-image problem; `release-macos.yaml` is **dispatch-only** (intermittent runner; becomes triggerable once CI is on `main`), de-nixes the binary's libiconv load path (`install_name_tool` → `/usr/lib`) + re-signs ad-hoc, and uploads to the tagged release. **D1 complete (all six targets).** Alternatives rejected: `cross` (no macOS, needs DinD), per-target nix cross (Windows-aarch64 unpackaged, macOS-from-Linux unsupported), a real `libsynchronization.a` (more machinery, doesn't cover Windows-aarch64). Runtime-verified by the user (2026-06-13): Linux x86_64 + Windows aarch64 run correctly; Linux aarch64 + Windows x86_64 are the outstanding runtime checks. Builds on ADR-ci-002 (flake) and fills in ADR-ci-001 §3 (Release).
+- [ADR-ci-002 — Nix flake for a reproducible dev + build environment](20260612-adr-ci-002.md) — **Accepted 2026-06-12** (relocated from main's **ADR-0049** on the same day — content unchanged — to keep CI/dev-env decisions out of `main`'s integer sequence). The single, version-pinned declaration of the **dev *and* build toolchain** so CI never relies on whatever Rust is on the build machine — mirroring **datamage ADR 0046**, but far simpler (pure-Rust TUI). Root **Nix flake** with two outputs: **`devShells.default`** (pinned **Rust 1.95.0** via `rust-toolchain.toml` + `rust-overlay`, `cargo-sweep`, and the musl cc for the static release build) and **`packages.default`** (`rustPlatform.buildRustPackage` from the committed `Cargo.lock`; `doCheck = false`). Exact-pin (not floating `stable`) so `nix flake update` can't surprise-bump clippy past the `-D warnings` gate. System inputs near-empty by design (`libsqlite3-sys bundled` → stdenv cc only; `arboard`→`x11rb` pure-Rust). `.envrc` (`use flake`) for direnv parity. Verified through the flake: `nix build` yields a working binary, clippy clean, **2424 tests pass / 0 fail / 1 intentional ignored doctest**. Consumed by **ADR-ci-001** (the pipeline). Alternatives rejected: dev-shell-only; a standard `rust:1.95` CI image (a second toolchain definition = drift); `rustup` on the build host (non-reproducible). **Amendment 1 (2026-06-17, issue #35):** the deferred `fmt` gate is enabled — the tree was reformatted once with **stock `cargo fmt`** (no `rustfmt.toml`; pinned toolchain makes `fmt --check` deterministic) in a single mechanical commit (`41b7e9a`, 102 files, behaviour-preserving, in `.git-blame-ignore-revs`), and `ci.yaml`'s gate is now **`fmt --check` + clippy + test**.
+- [ADR-ci-003 — Cross-platform release builds (the D1 matrix)](20260613-adr-ci-003.md) — **Accepted 2026-06-13** (implemented + a real matrix release verified the same day — tag `v.0.0.0-citest3` published 8 assets). Cross-compiles the **four non-macOS D1 targets** from the Linux x86_64 runner with **`cargo-zigbuild`** (Zig's bundled clang + libc as one universal cross cc/linker, incl. rusqlite's bundled SQLite C; added to the flake devShell, replacing the single-target musl cc): **`x86_64`/`aarch64-unknown-linux-musl`** (musl + crt-static → fully static, **D2**) and **`x86_64-pc-windows-gnu`** / **`aarch64-pc-windows-gnullvm`** (Zig statically links libc → standalone `.exe`). **Windows `synchronization` stub:** Rust std links `-lsynchronization` (WaitOnAddress thread-parking), an import lib rust-overlay's toolchain doesn't ship and Zig's mingw lacks; the symbols are forwarded by `kernel32`, so an **empty 8-byte stub** `libsynchronization.a` (`ci/winstub/`, wired via `.cargo/config.toml` for the Windows targets only) satisfies the linker. **Workflow:** `release.yaml` = **`test` once (host) → `build` matrix** over the four targets (`needs: test`, `fail-fast: false`); each job packages binary (`.exe` for Windows) + `.sha256` and uploads to the **shared release** via idempotent create-or-get. **macOS** (2026-06-14 amendment) — built natively on a **Tart (Apple-Silicon) runner** (`runs-on: macos`), which makes the SDK fully licensed and dissolves the grey-area/public-image problem; `release-macos.yaml` is **dispatch-only** (intermittent runner), de-nixes the binary's libiconv load path (`install_name_tool` → `/usr/lib`) + re-signs ad-hoc, and uploads to the tagged release. **D1 complete (all six targets).** Alternatives rejected: `cross` (no macOS, needs DinD), per-target nix cross (Windows-aarch64 unpackaged, macOS-from-Linux unsupported), a real `libsynchronization.a` (more machinery, doesn't cover Windows-aarch64). **Amendment 2 (2026-06-16):** CI is **merged to `main`**, so `release-macos` is now triggerable (`workflow_dispatch` is default-branch-only) and has been **dispatched + verified end-to-end** (build → de-nix/re-sign → upload, binaries launch). Runtime-verified by the user: Linux x86_64, Windows aarch64, **and both macOS targets**; Linux aarch64 + Windows x86_64 are the outstanding runtime checks. Builds on ADR-ci-002 (flake) and fills in ADR-ci-001 §3 (Release).
@@ -0,0 +1,104 @@
+# CI subproject handoff — 2026-06-15 (ci-01)
+
+First handover for the **CI / release subproject** (the `ci` branch). Kept in
+`docs/ci/handoff/`, a namespace separate from the project's global
+`docs/handoff/` session sequence so it can't collide with `main`'s numbering —
+the same split as `docs/ci/adr/`, and needed for the same reason: `main`
+independently wrote its own **handoff-70** this same day (just as it took
+**ADR-0049**), which would have collided.
+
+A dedicated infrastructure session that built the project's **entire CI/CD
+pipeline** on the self-hosted Gitea Actions runner — from nothing to a live
+gate plus a six-target cross-platform release. Net: the **CI** /
+`requirements.md` **TT5** item and **D1**/**D2** are now done; **D3** and a
+couple of TT5 tails remain. Decisions are recorded in the sibling ADR namespace
+**`docs/ci/adr/`** (ADR-ci-001/002/003).
+
+## §1. State at handoff
+
+**Branch:** `ci` (worktree). **`main` has been merged into `ci`** (commit
+`138e766`, clean — `ci` and `main` touched disjoint files) so the gate runs
+against current `main` before CI lands there. Working tree clean except the
+in-progress doc updates from this handoff. Pushes/promotion are the user's
+step.
+
+**Gate verified locally on the merged code:** `clippy -D warnings` clean;
+**`cargo test` 2488 passing / 0 failing / 1 ignored** (the long-standing
+`friendly` doctest). main's features came in with their tests (2424 → 2488).
+
+**Pipeline (`.gitea/workflows/`):**
+
+- `build-ci-image.yaml` — builds + pushes the CI image (`node:22-bookworm-slim`
+  + single-user nix + the flake's devShell pre-warmed) to the Gitea registry.
+  Triggers only on image-input changes (Dockerfile / flake / toolchain).
+- `ci.yaml` — the gate: `clippy -D warnings` + `cargo test`, branch pushes + PRs
+  (docs-only changes skipped).
+- `release.yaml` — on a `v*` tag: `test` → `build` matrix over the **four
+  non-macOS** targets via `cargo-zigbuild`, upload to the Gitea release.
+- `release-macos.yaml` — **workflow_dispatch** (tag input) on the Tart
+  Apple-Silicon runner (`runs-on: macos`): test → build both `*-apple-darwin`
+  → de-nix `libiconv` + ad-hoc re-sign → upload.
+
+**Verified live this session:** the 4-target release published **8 assets**
+(binary + `.sha256` each) for tag `v.0.0.0-citest3`; the macOS build was proven
+portable (system-only deps) + signed + launches on the runner.
+
+## §2. What was built (and the non-obvious bits)
+
+- **Nix flake** (ADR-ci-002, relocated from a would-be `main` ADR-0049): one
+  pinned toolchain (`1.95.0`) for dev *and* CI; `cargo-zigbuild` + `zig` (Linux
+  only) for the cross targets; `apple-sdk` on darwin.
+- **Runner facts** (ADR-ci-001): jobs run *inside* a container (`ci-public` →
+  `catthehacker/ubuntu`), so host nix is unreachable — hence the baked image.
+  The Mac runner is **host execution**; its label is `macos` (`:host` in the
+  registration is the act_runner backend, not part of the label).
+- **Cross-compile** (ADR-ci-003): `cargo-zigbuild` for the 4 non-macOS targets.
+  Windows needs an **empty `libsynchronization.a` stub** (`ci/winstub/`, wired
+  via `.cargo/config.toml`) — std links `-lsynchronization`, absent from
+  rust-overlay's toolchain + zig's mingw, but forwarded by `kernel32`.
+- **macOS** (ADR-ci-003 amendment): built on **real Apple hardware** (Tart), so
+  the SDK is fully licensed — no osxcross grey area. The darwin stdenv bakes a
+  `/nix/store` `libiconv` path into the binary; the build rewrites it to
+  `/usr/lib/libiconv.2.dylib` (`install_name_tool`) and re-signs ad-hoc
+  (`codesign -f -s -`; `install_name_tool` invalidates the signature, arm64
+  refuses unsigned). A guard fails the build on any remaining `/nix/store` dep.
+- **Cache hygiene (Mac):** the runner wipes the workspace each run, so cargo
+  `target/` never accumulates; the persistent nix store is bounded by
+  **generation** (record the devShell in a persistent profile, keep the 2
+  newest via `nix-env --delete-generations +2`, GC the rest). First sweep
+  reclaimed a ~3.8 GB one-time backlog of build scaffolding (source + build-only
+  deps, *not* re-installed toolchains).
+
+## §3. Immediate next steps (user)
+
+1. **Push `ci`** → the gate re-runs in CI (should be green; no image rebuild —
+   the merge didn't touch the flake/Dockerfile).
+2. **Promote:** `git checkout main && git merge ci` — a **fast-forward** (`ci`
+   already contains `main`) — then push `main`. CI goes live; `release-macos`
+   becomes dispatchable (workflow_dispatch needs the default branch).
+3. **First real release:** tag `v0.1.0` (auto-builds the 4 Linux/Windows
+   assets), then **dispatch `release-macos` for `v0.1.0`** with the Mac up (adds
+   the 2 macOS assets) → a full 6-binary release.
+4. **Cleanup:** delete the `v.0.0.0-citest*` test tags + their releases.
+5. **Runner-side:** add `min-free`/`max-free` to the Mac's `/etc/nix/nix.conf`
+   as a hands-off nix-store backstop.
+
+## §4. Known gaps / follow-ups
+
+- **Versioning is not wired into the binary** (flagged by the user). The release
+  **git tag is nowhere in the produced binary** — there is no `--version` flag,
+  no `CARGO_PKG_VERSION` use anywhere in `src/`, and the release workflows use
+  the tag only for the *release name* + *asset filenames*
+  (`rdbms-playground-<tag>-<target>`). `Cargo.toml` is a static `version =
+  "0.1.0"`, decoupled from the tag. So a `v0.5.0` tag yields a `…-v0.5.0-…`
+  asset whose binary knows nothing of "0.5.0". To fix later: add a `--version`
+  flag, and inject the tag at build time (e.g. a `build.rs` reading a
+  CI-provided env, or bumping `Cargo.toml` as part of tagging) so the binary and
+  the release agree.
+- **D3 packaging** — Homebrew / Scoop / winget / `cargo binstall` manifests
+  (asset naming is already binstall-friendly).
+- **TT5 tails** — Windows is build-only (no execution runner); Tier-4 PTY (TT4)
+  is unwired in CI.
+- **`fmt` gate** — deliberately off (tree isn't stock-`rustfmt`-clean); revisit
+  on `main`.
+- **Website → Cloudflare** deploy — the separate, simpler workflow, still to do.
@@ -0,0 +1,21 @@
+# CI / Build subproject — session handoffs
+
+Handover notes for the **CI / release pipeline** work (the Gitea Actions
+workflows under `.gitea/`, the nix flake, the release tooling). Kept in their
+own namespace, separate from the project-wide session handoffs in
+[`docs/handoff/`](../../handoff/), so a CI-branch handoff never competes with
+`main`'s global handoff sequence for numbers — the same split the CI ADRs use
+([`docs/ci/adr/`](../adr/README.md)). This is not hypothetical: `main`
+independently wrote a `handoff-70` the same day this subproject's first handoff
+was drafted.
+
+**Numbering.** Files are named `<date>-handoff-ci-<NN>.md` and referenced in
+prose as `handoff-ci-NN`. Assign the next free `NN` from this index.
+
+## Index
+
+- [handoff-ci-01 — the CI/release pipeline build-out](20260615-handoff-ci-01.md)
+  — Gitea Actions gate (clippy + test) + a six-target release (four via
+  `cargo-zigbuild` on a `v*` tag, two macOS via dispatch on a Tart runner), all
+  on a nix flake; decisions in `docs/ci/adr/`. Built on the `ci` branch, merged
+  `main` in, gate green (2488 tests), ready to promote to `main`.
@@ -0,0 +1,181 @@
+# Website-branch handoff — 2026-06-10 (website-1)
+
+First handoff for the **website** work. This is a **separate sequence** from
+`main`'s `YYYYMMDD-handoff-NN.md` files — branch-scoped name on purpose, so
+the two don't collide. Continue numbering these `…-website-handoff-N.md`.
+
+## State
+
+- **Branch:** `website`. **HEAD `936d925`.** Not pushed (push is the user's
+  step). Working tree clean.
+- The website lives in **`website/`** (monorepo; the playground crate is at
+  the repo root). Decisions: **ADR-0044**
+  (`docs/adr/0044-public-website-and-documentation-site.md`). Implementation
+  plan: **`docs/plans/20260604-adr-0044-website.md`**. Living style guide:
+  **`website/STYLE.md`** (read this first — it has the binding conventions
+  and an open-decisions log).
+
+## Stack & layout
+
+- **Astro 6 + Starlight + Tailwind v4**, all under `website/`.
+- `website/astro.config.mjs` — Starlight config (title, 5-section sidebar,
+  Expressive Code `langs`, `server.host: '127.0.0.1'`).
+- `website/src/grammars/rdbms.mjs` — custom Shiki grammar, **two language
+  ids**: `rdbms` (real commands) and `rdbms-syntax` (abstract templates).
+- `website/src/styles/global.css` — Starlight↔Tailwind bridge + the `> `
+  command prompt + copy-button hiding (CSS `:has()`).
+- `website/src/content/docs/` — the five sections.
+
+## Commands
+
+```sh
+cd website
+pnpm install      # node_modules is gitignored — reinstall on a fresh checkout
+pnpm dev          # serves http://127.0.0.1:4321  (see dev-server gotcha below)
+pnpm build        # static dist/, 24 pages, Pagefind search index
+```
+
+**Dev-server gotcha (already fixed, don't re-break):** Astro/Vite's default
+`localhost` bind resolves to IPv6 `::1` here, which breaks SSH
+`-L 4321:127.0.0.1:4321` tunnels. `server.host: '127.0.0.1'` in the config
+pins IPv4. Tunnel with `ssh -L 4321:127.0.0.1:4321 <host>`.
+
+**Verify after changes:** `pnpm build` clean; then from the repo root
+`grep -rniE '\b(DSL|SQLite|STRICT|rusqlite|PRAGMA)\b' website/src/content/`
+must be empty; internal links should resolve (build doesn't fail on broken
+links — no validator installed — so sanity-check by hand or with a small
+script).
+
+## Documentation structure (5 sections, autogenerated per directory)
+
+1. **Getting started** — install, first-project, modes, example-library. **(real)**
+2. **Using the playground** — command-line-options, the-assistive-editor,
+   the-output-pane, projects, undo-and-history, export-and-import,
+   copy-to-clipboard, getting-help. **(real, grounded)** *This is "the app you
+   drive", distinct from the database-language Reference.*
+3. **Guides** — build-the-library **(DRAFT — marked; to be iterated for
+   teaching quality before publication)**.
+4. **Reference** — types **(real)**, tables **(real)**; columns,
+   relationships, indexes, constraints, inserting-and-editing-data,
+   querying-and-inspecting **(STUBS — real syntax synopsis + an "In progress"
+   note; THEY NEED WORKED EXAMPLES — this is the main remaining bulk)**.
+5. **Concepts** — projects-and-storage **(real)**.
+- Landing: `index.mdx` splash (feature cards incl. the assistive editor +
+  start-here links).
+
+## Binding conventions (STYLE.md / ADR-0044 §7)
+
+- **No "DSL"** in user-facing copy → "simple mode" / "advanced mode".
+- **No engine name** (SQLite/STRICT/rusqlite/PRAGMA) → "the database" / "the
+  engine".
+- **Code fences:** simple-mode commands → ` ```rdbms ` (highlighted; gets a
+  decorative copy-safe `> ` prompt via CSS). Abstract syntax templates →
+  ` ```rdbms-syntax ` (highlighted, **no** prompt, no copy button). Advanced
+  SQL → ` ```sql `. Shell → ` ```sh `.
+- **One command per line** in `rdbms` blocks. A multi-line *single* statement
+  (advanced `CREATE TABLE`) goes in ` ```sql `.
+- **Copy button** is hidden on multi-line `rdbms` blocks and on
+  `rdbms-syntax` (the app input is single-line — a multi-command paste isn't
+  runnable); kept on single-command `rdbms`, and all `sql`/`sh`.
+- Unshipped features → `:::caution[Planned]` aside; never presented as
+  shipped.
+- **Ground every page in source** — `parse.usage.*` / `help.*` in
+  `src/friendly/strings/en-US.yaml`, `src/dsl/command.rs`, `src/dsl/types.rs`,
+  the ADRs. **Do not** trust `requirements.md` markers (handoff-59 found
+  ~46% mis-marked; it now uses a `[/]` partial legend) — verify against code.
+
+## Canonical example database (use in every example)
+
+A small **library**: `authors`(author_id serial pk, name text, birth_year
+int) · `books`(book_id serial pk, title text, author_id int→authors,
+published int, isbn text unique) · `members`(member_id serial pk, name text,
+joined date) · `loans`(loan_id serial pk, book_id int→books, member_id
+int→members, loaned_on date, returned_on date). 1:n author→books; m:n
+books↔members via loans. **Simplest examples lead with bare `with pk`** (a
+default `id` key); the library build uses **named** keys (`author_id`, …) so
+relationships read clearly.
+
+## Verified syntax cheat-sheet (don't re-derive)
+
+- Simple create: `create table <T> with pk [<col>(<type>)[, ...]]` (bare =
+  default `id`); `add column [to] [table] <T>: <name> (<type>)`;
+  `rename column [in] [table] <T>: <old> to <new>`; `change column … (<type>)
+  [--force-conversion|--dont-convert]`; `drop column [from] [table] <T>: <col>
+  [--cascade]`.
+- Advanced create: `create table T (id serial primary key, …, col int
+  references parent(col))` (verified against `tests/it/sql_create_table.rs`).
+- Relationship: `add 1:n relationship [as <name>] from <P>.<col> to <C>.<col>
+  [on delete <action>] [on update <action>] [--create-fk]`;
+  compound: `from <P>.(a, b) to <C>.(x, y)`; drop by name or by endpoints.
+- Data: `insert into T [(cols)] [values] (vals)`; `update T set … (where … |
+  --all-rows)`; `delete from T (where … | --all-rows)`.
+- Inspect: `show data <T> [where …] [limit n]`, `show table <T>`, `show
+  tables|relationships|indexes`, `show relationship|index <name>`.
+- `explain <…>` (query plan; safe — never executes). Advanced `select …`.
+- 10 types: text int real decimal bool date datetime blob serial shortid;
+  advanced-mode SQL aliases (integer/varchar/timestamp/numeric/…).
+- App commands: save / save as / new / load / rebuild / export [path] /
+  import <zip> [as <t>] / undo / redo / replay <path> / mode / help
+  [<command>] / help types / copy [all|last] / quit. (`hint` and `seed` are
+  NOT implemented — mark planned/omit.)
+
+## Next work (priority order)
+
+1. **Fill the 6 Reference stubs** with worked examples on the library schema
+   (the remaining bulk). Each has a syntax synopsis + an "In progress" note —
+   expand to full content: worked example(s), both simple + advanced forms
+   where both apply, cross-links. This is the biggest chunk.
+2. **Iterate the Guides** for teaching quality; add guides (model a 1:n / m:n,
+   querying with joins). The user flagged guides as the most important
+   didactic content, to be polished before publication.
+3. **Phase B — landing polish:** use the `frontend-design` skill; set
+   Starlight `site` (production URL) once the domain is known (enables sitemap
+   + OG/SEO); add a logo + favicon (small Starlight config). Branding palette
+   when the user wants it (staying on Starlight; community themes were
+   surveyed — see ADR-0044 / chat).
+4. **asciinema casts — DEFERRED until the app is final** (ADR-0044 §2). When
+   starting, settle STYLE.md open-decision #9: scripted-input driver
+   (`asciinema-automation` vs `autocast` — prove with a throwaway test run),
+   `.cast` script format + repo location, terminal geometry, light/dark
+   player theme, file naming. The **assistive editor** is prime cast material
+   (completion / `[ERR]`/`[WRN]` indicator are motion a still block can't
+   show) — earmark a cast for it on the landing + the assistive-editor page.
+5. Remaining STYLE.md open decisions: **versioning** (leaning single-version
+   for launch) and **SEO/meta** (settle with Phase B + the `site` URL).
+
+## Process pins
+
+- **Commits:** user-confirmed (show the message first), **no AI attribution**,
+  **append-only** (no amend/rebase/force-push). Push is the user's step.
+- **ADR numbering:** assigned at merge-to-`main` (ADR-0000 "Numbering
+  discipline", added this branch). The website ADR is **0044** — renumbered
+  from 0042 on the `main` merge, because `main` had independently used 0042
+  (H1a) and 0043 (compound-FK).
+- **Issues:** Gitea via `tea` (repo `oli/rdbms-playground` on
+  `git.lazyeval.net`); append `< /dev/null` + `timeout 30`; never raw API.
+- **Escalate genuine forks**, declare epistemic status, write down the DA pass
+  (`/runda`) on non-trivial plans.
+
+## Commit history on this branch (newest first)
+
+```
+936d925 feat: add "Using the playground" section + Reference skeleton
+44390e7 feat: simple-mode code-block highlighting, prompt, and copy rules
+995c0ba docs: reconcile website doc inventory with merged main scope
+c72c624 chore: bind website dev/preview server to IPv4 loopback (127.0.0.1)
+9e774b2 docs: ADR numbering discipline — assign numbers at merge-to-main
+40de389 Merge branch 'main' into website (Gitea migration + ADR renumber)
+0fcb7b1 docs: website docs structure + first content pages
+cea99e8 chore: scaffold website (Astro 6 + Starlight + Tailwind v4)
+1fad29c docs: ADR-0042 — public website + documentation site plan   (now ADR-0044)
+```
+
+## Review status (what the user has signed off)
+
+Highlighting / `> ` prompt / copy behavior — good. Voice, altitude,
+terminology — good. Responsive layout (checked in Polypane) — good. Locked
+decisions: bare `with pk` leads the simplest examples; copy hidden on
+multi-command blocks (not per-command copy); the 5-section structure with
+"Using the playground" near the top; assistive editor surfaced on
+landing + Getting started. **The 6 Reference stubs have not been reviewed for
+content** — only their syntax synopses exist.
@@ -0,0 +1,205 @@
+# Website-branch handoff — 2026-06-11 (website-2)
+
+Second handoff for the **website** work (separate sequence from `main`'s
+`YYYYMMDD-handoff-NN.md`). Read `website-1` (2026-06-10) first for the
+original scaffolding context; this note covers everything since.
+
+## State
+
+- **Branch:** `website`. **HEAD `e782a28`.** Working tree clean. Pushed
+  through an earlier point; currently **ahead of `origin/website`** (push is
+  the user's step — never push).
+- The website lives in **`website/`** (monorepo; the playground crate is at
+  the repo root). Living style guide + binding conventions:
+  **`website/STYLE.md`** (read first). Website decisions:
+  **`docs/website/adr/20260604-adr-website-001.md`** (the website ADR namespace
+  — see below). Plan: `docs/website/plans/20260604-website-implementation-plan.md`.
+
+## What changed since website-1 (commit highlights, newest first)
+
+```
+e782a28 feat(website): projects cast (vi-nav load picker) + --demo on all casts
+927e6b2 Merge branch 'main' (m:n, logging, UI nav, demo overlays, vi-nav)
+52860c3 feat(website): casts for first-project/modes/undo-redo; quit via Ctrl-C
+ce153bd docs(website): add SQL queries reference page (advanced query surface)
+302329d docs(website): record the cast-placement policy in STYLE.md
+bb7887e feat(website): relationship-diagram cast on the relationships page
+65a48fa feat(website): joins cast on the querying-with-joins guide
+c0cc92a docs(website): rewrite Build the library + add Querying with joins guide
+10655e4 docs(website): fill the six Reference stubs with worked examples + output
+a8f84c9 feat(website): refine casts — trim shell, autoplay+loop landing, cap size
+…       (cast pipeline, the astro/starlight upgrade, the ADR-namespace move)
+```
+
+## ADR namespace (important — avoids the recurring collision)
+
+Website decision records live in their **own namespace**:
+`docs/website/adr/` (`<date>-adr-website-<NNN>.md`, id `ADR-website-NNN`),
+indexed by `docs/website/adr/README.md`. They do **not** draw from `main`'s
+global ADR integer pool, so a `main` ADR and a website ADR can never collide
+again (this is why the latest merge of `main`'s ADR-0045/0046/0047 was
+conflict-free). Recorded in ADR-0000 "Numbering discipline". The main
+`docs/adr/README.md` intro carries a pointer to the website namespace.
+
+## Content status
+
+**Done & verified (build clean, grounded in source, forbidden-terms clean):**
+- **Getting started** — installation, first-project, modes, example-library.
+- **Using the playground** — command-line-options, the-assistive-editor,
+  the-output-pane, projects, undo-and-history, export-and-import,
+  copy-to-clipboard, getting-help.
+- **Guides** — build-the-library (full 4-table build, 1:n + m:n bridge),
+  querying-with-joins.
+- **Reference** — types, tables, columns, relationships, indexes, constraints,
+  inserting-and-editing-data, querying-and-inspecting, **sql-queries** (the
+  advanced SELECT surface: DISTINCT, GROUP BY/HAVING, set ops, subqueries,
+  CTEs, CASE/CAST/functions, with a "supported subset" boundary note).
+- **Concepts** — projects-and-storage.
+- Landing `index.mdx` splash with the quickstart cast.
+
+**26 pages build clean.** Only expected warning: sitemap needs `site` (Phase B).
+
+## asciinema casts — the pipeline + the 7 casts
+
+Pipeline (STYLE.md "asciinema casts", ADR-website-001 §2):
+- **Driver: `autocast`** (chosen by spike; `asciinema-automation` can't drive a
+  full-screen TUI). Sources in `website/casts-src/casts.mjs`; `pnpm casts`
+  runs `casts-src/generate.mjs` → autocast YAML → `public/casts/<name>.cast`.
+  Command-lists are the durable source; **`.cast` files are regenerable** —
+  re-run `pnpm casts` (needs a `cargo build` binary at `../target/debug`).
+- **Components:** `Cast.astro` (asciinema-player island) wrapped by
+  `Demo.astro` (the WASM-swap seam, ADR-website-001 §3). Embed via `<Demo
+  src="/casts/NAME.cast" … />` in an **.mdx** page (md can't import).
+- **Generator features:** trims each cast to the in-app region (drops shell
+  launch + the return-to-shell); ends casts with **Ctrl-C** (`{ key: 'CtrlC' }`)
+  not a typed `quit` (invisible, so the cast ends on the last content frame);
+  per-cast `holdEnd`, `dataDir` (isolated data root, wiped per run), and
+  **`--demo` is default-on** (opt out with `demo:false`).
+- **The 7 casts:** quickstart (landing, autoplay+loop), assistive-editor,
+  relationship-diagram, joins, modes, undo-redo, **projects** (the new one:
+  save as → new → load via the picker, navigated with `j`).
+
+### `--demo` (#22 / ADR-0047) is on for ALL casts
+The demonstration overlay shows a **badge** for special keystrokes
+(`[ENTER]`, `[TAB]`, arrows, etc.) — plain characters are NOT badged. This
+makes e.g. the assistive-editor's Tab completion visible (`[TAB]`), and the
+projects cast's `j`/`k` picker navigation stays *un*surfaced (plain chars) by
+design. Captions exist too (a stealth `Ctrl+]`-delimited banner) — usable in
+casts for neutral "point something out" labels, not yet used.
+
+### ⚠️ Cast tooling limits (don't rediscover these)
+- autocast can only send **single characters, ASCII control codes (`^X`), and
+  waits** — **NO arrows / PageUp/PageDown / Home/End / function keys** (those
+  are escape sequences; the per-key delay makes the terminal read a lone Esc —
+  verified). So any interaction we want to demo must be reachable via typeable
+  keys. This is why #24 (vi `j/k` in the picker) was needed for the projects
+  cast, and why **output-pane scrolling has no cast** (needs PgUp/PgDn).
+- `Ctrl+]` (caption toggle) and `Ctrl-C` (quit) ARE sendable (`^]`, `^C`).
+
+### ⚠️ No-advertising constraint (user, 2026-06-11)
+The docs must **NOT** advertise that the load picker supports **vi keys**, nor
+that **`Ctrl+]`** is the caption/banner trigger. The `--demo` flag itself MAY
+be documented lightly as "a teaching helper that shows special keystrokes" —
+and nothing more. Casts may *use* vi-nav and captions (the viewer sees only the
+result/banner, not the keystroke), but cast captions must not name `j/k` or
+`Ctrl+]`.
+
+## NEXT WORK — priority order
+
+### 1. Document the features the `main` merge brought (the biggest gap)
+The merge (`927e6b2`) added app features that are **not yet documented**:
+
+- **m:n convenience command** — `create m:n relationship …` (C4, **ADR-0045**).
+  The relationships page currently models m:n only via the manual loans-bridge.
+  Document the convenience command (it auto-generates the junction table).
+  Ground in ADR-0045 + `tests/it/m2n.rs` + `tests/typing_surface/create_m2n.rs`
+  for exact syntax. Likely a new section on the **relationships** reference
+  page and/or a mention in the build-the-library guide.
+- **`--demo` flag** — document on **command-line-options** as a teaching helper
+  that "shows special keystrokes" (per the no-advertising constraint above —
+  do NOT mention badges-for-vi or captions/`Ctrl+]`).
+- **ADR-0046 UI** — the **schema sidebar** (auto-shows on wide terminals,
+  `Ctrl-O` navigation mode to peek/expand), **responsive two-row input** +
+  horizontal scroll, and the geometry-fixed hint panel. Decide where in *Using
+  the playground* (a new "the schema sidebar" page, or fold into the-output-pane
+  / the-assistive-editor). Ground in ADR-0046.
+- FK-message fixes + the X1 logging sweep: **no user-doc impact** (note only).
+
+Whenever output changed because of the merge, **re-verify any affected static
+output blocks** (capture-harness recipe below).
+
+### 2. Consider a final cast re-record sweep + optional captions
+- All casts re-record with `pnpm casts` once the app is "final".
+- **Chase up two pacing/clarity guidelines across the existing casts** (added
+  to STYLE.md "Cast pacing & clarity" 2026-06-11; the projects cast already
+  follows them):
+  1. **Don't submit a command too fast** — a typed-and-`Enter`ed-in-one-instant
+     command vanishes before the viewer reads it. Re-review each cast for
+     type-then-instant-Enter (especially modal confirms / short commands) and
+     add a pause before `Enter` (split `type` and `key:'Enter'` steps).
+  2. **Show state where the sidebar would** — at 90 cols the schema sidebar is
+     hidden (ADR-0046), so insert `show tables` / `show table` / `show data`
+     where state changes, so the viewer can follow what happened.
+- **Review whether caption banners would improve the existing casts.** The
+  demo overlay can show a neutral step **caption** (the stealth `Ctrl+]`
+  banner) to label or narrate a moment — e.g. marking the phases of the
+  build-the-library/projects casts, or calling out the relationship diagram /
+  the teaching echo in the modes cast. Go cast-by-cast and decide where a
+  caption adds clarity vs. adds noise. Constraint: caption **text must not name
+  keys** (no `j/k`, no `Ctrl+]`); it narrates *what* is happening, not *how* it
+  was typed. (Captions are wired but not yet used in any cast.)
+- Output-pane scrolling cast remains blocked (PgUp/PgDn unsendable). If desired
+  later, it needs an app-side typeable scroll key (file an enhancement like #24)
+  — otherwise leave it to static docs.
+
+### 3. Phase B — landing/site polish
+- Set Starlight **`site`** (production URL) → clears the sitemap warning,
+  enables sitemap + canonical/OG. Then SEO/meta conventions (STYLE #8).
+- Logo + favicon; branding palette (staying on Starlight).
+- **Light/dark player theme**: the asciinema player theme is currently fixed
+  (`asciinema`); sync it to the Starlight theme toggle (folded into STYLE #8).
+- Use the `frontend-design` skill.
+
+### 4. Open STYLE.md decisions
+- **#7 Versioning** (leaning single-version for launch).
+- **#8 SEO/meta** + the player light/dark theme.
+
+## Capture-harness recipe (how to get accurate static output for new pages)
+
+Output blocks must be **captured from the real app, never hand-drawn**
+(STYLE.md). Pattern used throughout:
+- For `pub` render fns (`render_data_table`, `render_explain_plan`) + the DB
+  worker API: a throwaway **external** test `tests/doc_capture.rs` that builds
+  the library schema via `Database` and prints rendered output; run
+  `cargo test --test doc_capture -- --nocapture --ignored`; paste verbatim
+  (trim trailing spaces); delete the file.
+- For `pub(crate)` fns (`render_structure_with_diagrams`,
+  `render_relationship_diagram`): an in-crate `#[ignore]` test in
+  `src/output_render.rs`'s test module instead.
+- **Verify box-drawing integrity** after pasting (top `┬` count == bottom `┴`,
+  equal line lengths) — a mis-paste truncated a CTE border once and the check
+  caught it.
+
+## Verify-after-changes checklist
+```sh
+cd website && pnpm build            # clean; 26 pages; only the `site` warning
+# from repo root — forbidden terms must be empty:
+grep -rniE '\b(DSL|SQLite|STRICT|rusqlite|PRAGMA)\b' website/src/content/
+# internal links + heading anchors: spot-check in dist/ (no link validator installed)
+cd website && pnpm casts            # regenerate all casts (needs target/debug binary)
+```
+Dev server + tunnel for visual checks (player playback, sizing, badges):
+`cd website && pnpm dev` (binds 127.0.0.1:4321) then `ssh -L 4321:127.0.0.1:4321 <host>`.
+**Visual playback of all 7 casts (now with `--demo` badges) is still pending a
+tunnel check by the user.**
+
+## Process pins
+- **Commits:** user-confirmed (show the message first), **no AI attribution**,
+  **append-only** (no amend/rebase/force-push). Push is the user's step.
+- **Ground every page in source** (`src/dsl/*`, `en-US.yaml`, the ADRs) — not
+  `requirements.md` markers. No engine name, no "DSL" in user-facing copy.
+- **Issues** via `tea` (repo `oli/rdbms-playground` on `git.lazyeval.net`;
+  append `< /dev/null` + `timeout 30`). Open/related: **#22** (demo overlay,
+  implemented), **#24** (vi picker nav, implemented). Both merged via `927e6b2`.
+- Escalate genuine forks; declare epistemic status; write down the `/runda` DA
+  pass on non-trivial plans.
@@ -0,0 +1,165 @@
+# Session handoff — 2026-06-15 (70)
+
+Seventieth handover. Continues from handoff-69 (which closed the last
+four Gitea issues and left the tracker empty). This session did the
+**ADR-0052 follow-up** (unwinding vestigial worker `source` plumbing),
+then **designed and fully implemented H2 — the contextual `hint`
+command + F1 keybinding (ADR-0053)** end to end (Phases A–D). The CI
+branch was also merged into `main` mid-session (not my work — see §5).
+
+Net: **2 feature areas shipped, 1 new ADR (0053) + 1 ADR amendment
+(0052), 4 new Gitea issues (#35–#38), the `hint` corpus (~57 teaching
+blocks), and A1 + H2 closed in `requirements.md`.**
+
+## §1. State at handoff
+
+**Branch:** `main`. Working tree **clean**; all work committed. Commits
+are local (push is the user's step).
+
+**Tests: 2499 passing / 0 failing / 0 skipped / 1 ignored** (the
+long-standing `friendly` doctest). **Clippy clean** (nursery, all
+targets). Breakdown: 1799 lib + 500 `it` + 200 typing-surface-matrix.
+
+**Open Gitea issues (4, all enhancement, all filed this session):**
+- **#35** — enforce `cargo fmt` across the codebase (single reformat +
+  CI gate). The tree is *not* fmt-clean (~1800 pre-existing diffs); do it
+  once, coordinated with CI, before first publication.
+- **#36** — `help` collapses advanced-SQL forms onto their simple sibling
+  (a `help`-list dedup artifact); they deserve distinct help content.
+- **#37** — `hint` clause-concept hints (`on delete` actions, constraint
+  slots, `with pk`, cardinality) — a deferred `hint.concept.<topic>`
+  layer.
+- **#38** — `hint` pre-submit-diagnostic route + the ~33 `diagnostic.*`
+  tier-3 blocks (deferred; `Diagnostic` carries no class key).
+
+## §2. ADR-0052 follow-up — vestigial worker `source` unwind (`e8fa859`)
+
+The first task from handoff-69 §3. ADR-0052 moved success-journaling out
+of the worker, leaving the `source` that handlers threaded purely for the
+old `history.log` write dead. **Bigger than the handoff estimated** (it
+framed it as ~28 call-site edits): the cascade ran through ~30 worker
+handlers + the `DescribeTable`/`QueryData`/`RunSelect` request fields +
+their `DatabaseHandle` methods (~164 mostly-test call sites). Fully
+unwound, compiler-guided, **no behaviour change** (journaling uses a
+`source_for_journal` clone at the spawn, independent of the worker). The
+only worker `source` left is the snapshot/undo label. Amended ADR-0052
+*Consequences* + README. (Two scope forks escalated + user-approved.)
+
+## §3. H2 — contextual `hint` (ADR-0053), Phases A–D — **shipped**
+
+The bulk of the session. ADR-0053 settles the `hint` slot ADR-0003 left
+"ADR pending"; **closes A1** (all 15 app commands now exist) and
+**requirements H2**. Read ADR-0053 before touching this area — it went
+through three revisions and several user decisions.
+
+### The design (all user-chosen)
+- **Two surfaces:** an **F1 keybinding** → tier-3 hint for the *live*
+  partial input (read-only overlay — never touches buffer/cursor/memo);
+  a submitted **`hint` command** → expands on the *most recent runtime
+  error*. No topic arg (contextual only; `help <topic>` owns reference).
+- **Tier-3 teaching layer** beneath the existing tier-1 (colour / error
+  headline) and tier-2 (ambient one-liner; the error `hint:` shown **by
+  default** since `Verbosity::Verbose` is the default). Each block is
+  `what` / `example` / `concept`, rendered as a `Hint` heading + aligned
+  labels.
+- **Per-form keying** (Phase-B revision — the original per-node `hint_id`
+  was too coarse for multi-form commands like `add`/`drop`/`show`): a new
+  **`hint_ids: &[&str]`** field on `CommandNode` mirroring `usage_ids`,
+  resolved by `hint_key_for_input_in_mode` (reuses `usage_key`'s
+  form-word disambiguation + a mode-primary fallback for shared entry
+  words so advanced `insert` → `sql_insert`, simple → `insert`).
+- **Comprehensive for v1 = command forms + 9 runtime error classes**
+  (the ~33 `diagnostic.*` classes were **deferred**, #38 — see §4).
+
+### Key files
+- `src/dsl/command.rs` — `AppCommand::Hint`.
+- `src/dsl/grammar/app.rs` — `HINT` node + `build_hint`.
+- `src/dsl/grammar/mod.rs` — the `hint_ids` field, `hint_key_for_input_in_mode`,
+  the factored `pick_form_key`, and the two **comprehensiveness coverage
+  tests** (every node has a resolving `hint.cmd.*`; every runtime error
+  class has a `hint.err.*`).
+- `src/app.rs` — F1 arm in `handle_key` (read-only overlay, placed before
+  the completion-memo clear); `note_hint_for_input` / `note_hint_for_recent_error`
+  / `note_getting_started` / `emit_tier3_block`; `last_error_hint_key`
+  state (set in `handle_dsl_failure`, cleared in `submit` for DSL
+  commands).
+- `src/friendly/translate.rs` — `error_hint_class` (maps a `DbError` +
+  ctx to its `hint.err.<class>`; mirrors `translate`'s dispatch — keep in
+  sync, unit-tested).
+- `src/friendly/strings/en-US.yaml` + `keys.rs` — the corpus under
+  `hint.cmd.<form>` / `hint.err.<class>` + `hint.block.*` labels +
+  `shortcut.hint`.
+- `src/ui.rs` — ADR-0051 strip advertises **F1** (editing + default
+  states); 12 full-panel snapshots re-accepted.
+
+### Phases (one commit each unless noted)
+- **A** (`050b363`) skeleton + tier-2 fallback; **B** (`4a5fd1b`) per-form
+  keying + 3 exemplars; **C** content in 5 batches (`4bdfce6` app,
+  `6429b56` DDL, `9c4d520` DML, `97970f2` advanced-SQL, `b6b98ad` runtime
+  errors) + `417cbc8` diagnostic deferral; **D** (`447112b`) coverage gate
+  + F1 strip + status flips; **/runda fix** (`329adfc`) — see §3.1.
+
+### 3.1 — what the final `/runda` caught (don't skip)
+Per-batch substring tests masked a **presentation gap**: `emit_tier3_block`
+was emitting three *bare, unlabelled* lines, deviating from the approved
+exemplar format. Fixed to render a `Hint` heading + aligned `What:` /
+`Example:` / `Concept:` lines, **locked by an `insta` snapshot**
+(`hint_block_insert`). Also confirmed the `Next:` line (ADR D2 exemplar)
+is correctly **omitted** — tier-2 ambient already owns live
+position-awareness. Lesson for the next content/UI work: **add a rendered
+snapshot early**; substring asserts don't see layout.
+
+## §4. Deferrals (all tracked, all user-confirmed)
+
+- **#38 diagnostic route + `diagnostic.*` blocks** — `Diagnostic`
+  (`walker/outcome.rs`) carries only its rendered `message`, not a class
+  key, so the F1 diagnostic route would need a `class` field threaded
+  through every diagnostic site (broad) for marginal value (tier-2
+  already surfaces diagnostics; many duplicate runtime classes). F1 still
+  shows the useful command block when a diagnostic is present.
+- **#37 clause-concept hints** — per-form is the right tier-3 granularity;
+  clause-level concepts are a separate `hint.concept.<topic>` layer for
+  later.
+- **#36 `help` advanced-SQL** — out of H2's scope (touches shipped `help`).
+
+## §5. CI branch merged into `main` (not my work)
+
+Mid-session the **`ci` branch was merged** (commits `47a0816`, `138e766`
+ the `ci:`/`build:`/`docs(ci):` commits). `main` now carries a CI
+pipeline, a nix flake, and **D1 cross-platform release builds** (matrix +
+macOS), documented under a **new `docs/ci/adr/` namespace** (ci-001..003).
+Implications for the roadmap: **D1 (cross-platform binaries) is now
+substantially underway** — re-assess D1/D2/D3 status against what landed
+before treating them as open. My H2 work is layered cleanly on top (all
+green post-merge).
+
+## §6. Next session — start here
+
+1. **Push** (user step) — 30-odd local commits incl. the CI merge + all
+   of H2.
+2. **Re-baseline the roadmap** against the merged CI work: D1/D2/D3 and
+   **TT5 CI** are partly/largely done now — read `docs/ci/adr/` and the
+   workflows before assuming they're open (handoff-69 §5 predates this).
+3. **#35 (cargo fmt gate)** is the natural pairing with the now-merged CI
+   — the user wanted it done once, before first publication.
+4. Other `requirements.md` open items (verify against CI merge first):
+   **TT4** PTY tier-4 (still unwired), **I1** multi-line input, **I5/B3**
+   in-flight cancellation, **V4** session journal (own ADR), **TU1**
+   tutorial system (own ADR). H2/A1 are now **done**.
+5. The H2 deferrals (#36/#37/#38) are available if the user wants to
+   round out the hint/help surface.
+
+## §7. How to take over
+
+1. Read handoffs 68 → 69 → 70, `CLAUDE.md`, `docs/requirements.md`.
+2. Confirm green: `cargo test` (expect **2499 pass / 1 ignored**) +
+   `cargo clippy --all-targets` (clean).
+3. Read `docs/ci/adr/` (the merged CI work) before touching CI/release/D*.
+4. For anything in the `hint` area, read **ADR-0053** first (3 revisions
+   + deferrals #37/#38). For journaling, ADR-0052 (+ its 2026-06-14
+   follow-up note).
+5. Project workflow unchanged: phased, test-first, `/runda` + DA before
+   commits, ADR amendment + README index-upkeep for decided-area changes,
+   confirm commit messages with the user.
+6. Consider a `cargo sweep` at this milestone (`target/` grows; see
+   CLAUDE.md "Build hygiene").
@@ -0,0 +1,120 @@
+# Session handoff — 2026-06-15 (71)
+
+Short, focused handover. Continues immediately from handoff-70 (which
+shipped H2 / the contextual `hint`, ADR-0053). **A user smoke-test
+surfaced a correctness bug in the hint content, and it implicates the
+whole corpus.** This handoff exists so the next session does a
+**systematic semantic verification pass over every hint block** — context
+ran too low to do it now.
+
+## §1. State
+
+**Branch:** `main`, clean, all committed (local; push pending). **2499
+pass / 1 ignored, clippy clean.** Open issues: #35–#38 (see handoff-70).
+H2 / ADR-0053 is *functionally* complete; the **content is not
+trustworthy** until the pass below is done.
+
+## §2. The bug (confirmed)
+
+`hint.cmd.create_table` (in `src/friendly/strings/en-US.yaml`) reads:
+
+```
+What:    Create a new table — its columns, their types, and a primary key.
+Example: create table Customers with pk id(serial), name(text), email(text)
+Concept: A table is a set of rows that share the same columns. The primary
+         key uniquely identifies each row; a `serial` key numbers the rows for you.
+```
+
+**This is wrong.** In the DSL, **everything after `with pk` is the
+primary-key column list** (a possibly *compound* PK, ADR-0005). So the
+example does **not** create a table with `pk=id` plus regular columns
+`name`/`email` — it creates a table whose **compound primary key is
+(id, name, email)**. Non-key columns are added *separately* with
+`add column`. The `what` ("its columns, their types") and the example
+both mislead a learner badly.
+
+- **Evidence:** real test usage is `create table Orders with pk
+  id(serial), CustId(int)` (a 2-column *compound PK*) and the common form
+  `create table X with pk id(int)` (single-column PK only). The usage
+  template `create table <Name> with pk [<col>(<type>)[, ...]]` is itself
+  misleading — the `[, ...]` is the PK list, not regular columns.
+- **Correct mental model:** `create table <T> with pk <pk-cols…>` then
+  `add column <T>: <name> (<type>)` for each non-key column. Confirm
+  against ADR-0005 (compound PK) and ADR-0009 (DSL syntax) when fixing.
+
+## §3. Root cause — why this needs a *full* pass
+
+During Phase C I verified *some* examples against `parse.usage.*`
+templates and real test greps, but for others I **extrapolated** beyond
+verified syntax. For `create_table` I saw `... with pk id(int)` (single
+col) and wrongly generalised to "pk + more columns," misreading the
+`with pk` list as a column list. The examples are **syntactically**
+checked but not **semantically** — i.e. not verified to *do what the
+`what`/`concept` claims*.
+
+So the corpus needs a pass that, for **every** `hint.cmd.*` and
+`hint.err.*` block, checks:
+1. the `example` parses **and runs**, and
+2. it actually demonstrates what `what`/`concept` says, and
+3. `what`/`concept` are factually true of the real behaviour.
+
+**Don't trust grep+extrapolation.** Prefer: run the example in the app
+(or a Tier-3 test), or check it against the authoritative ADR.
+
+## §4. The pass — how to do it (next session)
+
+The corpus lives in `src/friendly/strings/en-US.yaml` under `hint.cmd.*`
+(per command form) and `hint.err.*` (per runtime error class). The
+inventory and authoritative syntax sources:
+
+- **`hint.cmd.<form>`** — for each, cross-check the example against the
+  matching `parse.usage.<form>` template **and** the form's ADR, and run
+  it. Highest-risk (extrapolated, verify first): **DDL** — `create_table`
+  (known wrong), `add_column`, `add_index`, `add_constraint`,
+  `change_column`, `drop_*`, `create_m2n`; **advanced-SQL** — confirm
+  each is in the supported SQL subset (`select`, `with` CTE,
+  `sql_insert/update/delete`, `sql_create_table`, `sql_alter_table`,
+  `sql_create_index/drop_index/drop_table`, `explain_sql`); **DML** —
+  `seed` forms, `explain`, `show_*`, `update`/`delete` (`--all-rows` /
+  required-WHERE wording). App commands are lower-risk (reference-style).
+- **`hint.err.<class>`** — verify the fix recipe in `example` is actually
+  the right remedy and `concept` matches the engine's real behaviour
+  (FK sides, `on delete` actions, check/not_null/unique semantics).
+- Relevant ADRs: 0005 (types + compound PK), 0009 (DSL syntax), 0011 (FK
+  type compat), 0013 (relationships/rebuild), 0014 (data ops +
+  required-WHERE), 0025 (indexes), 0028/0039 (explain), 0030–0036 (SQL
+  subset), 0048 (seed). `docs/requirements.md` for scope.
+
+**Suggested method:** drive the app (`/run` or a small PTY/Tier-3 harness)
+and actually execute each example; or add a test that parses+runs every
+`hint.cmd.*` example and asserts success. The latter would also be a
+durable regression guard — consider adding it as part of the pass (it
+upgrades the comprehensiveness coverage test from "a block exists" to
+"the example actually works").
+
+## §5. Immediate fix ready to apply
+
+`create_table` is diagnosed (§2). The corrected block should make the
+example a PK-only `create table` and move the regular columns to a
+follow-up `add column`, e.g.:
+
+```
+What:    Create a new table with its primary key.
+Example: create table Customers with pk id(serial)
+Concept: A table is a set of rows sharing the same columns. `with pk`
+         declares the primary key (one column, or several for a compound
+         key); add the other columns afterwards with `add column`.
+```
+
+Apply this (and re-check `create_m2n` / `add_*` while there), but only as
+part of the systematic pass — a one-off fix risks leaving siblings wrong.
+
+## §6. How to take over
+
+1. Read handoffs 70 → 71, `CLAUDE.md`.
+2. Confirm green: `cargo test` (2499 / 1 ignored), `cargo clippy
+   --all-targets`.
+3. Do the §4 pass (consider the run-every-example test in §4). Test-first,
+   `/runda` before commit, confirm the commit message with the user.
+4. Pedagogy wins — these are teaching strings; correctness and clarity
+   over cleverness.
@@ -0,0 +1,113 @@
+# Session handoff — 2026-06-15 (72)
+
+Short, focused handover. Continues from handoff-71, which asked the next
+session to run a **systematic semantic verification pass over every
+`hint` block** (handoff-70 shipped H2 / ADR-0053, but a user smoke-test
+found a wrong hint and implicated the whole corpus). **That pass is now
+done.** Four content errors fixed, a durable parse-guard added, two stale
+docs corrected. Commit `5a37437`.
+
+## §1. State
+
+**Branch:** `main`, clean, all committed (local; **push pending** — your
+step). **2500 pass / 0 fail / 1 ignored** (the long-standing `friendly`
+doctest), **clippy clean** (nursery, all targets). The +1 vs handoff-71's
+2499 is the new guard test. Open Gitea issues unchanged: **#35–#38**.
+
+## §2. The verification pass (commit `5a37437`)
+
+Method: cross-checked every `hint.cmd.*` example against its
+`parse.usage.*` template, ground-truthed every concept claim against the
+authoritative ADR **and a named existing test** (not grep+extrapolation —
+the trap handoff-71 §3 warned about), and parse-validated all 49 command
+examples via a new guard.
+
+### Four content errors fixed (`src/friendly/strings/en-US.yaml`)
+
+| Block | Bug | Fix |
+|---|---|---|
+| `cmd.create_table` | Example `with pk id(serial), name(text), email(text)` declares a **3-column compound PK**, not a PK + regular columns. Every `with pk` column is a key member — confirmed by the grammar test comment *"Every `create table` column is a primary-key column"* (`ddl.rs`), ADR-0005. | Single-column PK + `add column` for the rest; `what`/`concept` aligned. |
+| `cmd.save` | `save as my-shop` **does not parse** — `build_save` yields `AppCommand::SaveAs` with **no inline name**; `save as` opens a path-entry modal (`iteration4b` tests). | Example → `save as`; `what` de-implied; added an accurate temp-vs-named-auto-save `concept`. |
+| `cmd.import` | Target `shop-copy` **does not parse** — the `as <target>` slot is an `IdentSource::NewName` ident that tokenises only up to the hyphen. (The zip path is a BarePath and *does* accept hyphens, hence `export my-shop.zip` is fine.) | → `shop_copy`. |
+| `err.foreign_key.child_side.concept` | Offered `on delete set null/cascade` as the remedy — but `error_hint_class` maps child_side to **insert/update** violations; `on delete` governs the **parent** direction. The tier-1 hint (line 64) correctly omits it. | Corrected: parent must exist first; clarified `on delete` is the *other* direction. |
+
+### Durable guard added
+
+`every_cmd_hint_example_parses_in_its_mode` (`src/dsl/grammar/mod.rs`,
+in the `hint_key_tests` module). **Catalog-driven** — it iterates
+`catalog().keys()` for `hint.cmd.*.example` rather than the REGISTRY, so
+an orphaned/mis-keyed block can't slip past; floor-asserts ≥49 examples.
+Each parses in its taught mode (advanced for the SQL surface, simple
+otherwise). It caught the `save` and `import` errors **test-first** (red
+before the YAML fix). Registered the new `hint.cmd.save.concept` key in
+`keys.rs` (the `keys_validate_against_catalog` test requires every catalog
+key be declared).
+
+### Verified correct (not changed)
+
+All other `cmd`/`err` blocks. Notably the guard-*concept* claims were each
+confirmed against a named runtime test, not assumed:
+`drop_column_refuses_primary_key` / `…_column_in_a_relationship`,
+`drop_table_with_inbound_relationship_errors`,
+`add_not_null_column_without_default_to_populated_table_is_refused`. The
+corrected `create_table` story stays coherent with the `Customers`-
+referencing examples (id serial PK → `add column` name/email → `insert`
+skips the auto id).
+
+## §3. Docs corrected (same commit)
+
+Discovered while verifying `create_m2n` (which **is** implemented —
+`db.rs::do_create_m2n_relationship` + `tests/it/m2n.rs`):
+
+- **CLAUDE.md** carried two **stale "deferred" claims**, both already
+  implemented. Removed/updated: (a) the at-a-glance project-format line
+  said export/import (Iter 5) + `--resume`/input-history/migration (Iter
+  6) were "pending" — all `[x]` in `requirements.md` (ADR-0015); (b) the
+  "Things deliberately deferred" list still had the **m:n convenience
+  (C4)** bullet and the same project-storage bullet. `requirements.md`
+  was already correct (C4 done 2026-06-10, ADR-0045), so only a
+  verification-pass note was appended to its **H2** entry.
+
+## §4. Scope note — what the guard does *not* do
+
+The bug class here is **semantic** (an example that parses and runs but
+misrepresents the prose — e.g. `create_table`). The guard enforces only
+the **syntactic floor**: examples parse in their mode. It backstops
+future typos/clause-drift but cannot police meaning. Semantic correctness
+of the current corpus rests on this session's review (recorded in the
+commit + requirements.md H2). A stronger-but-brittler option was offered
+to the user and **not built pending their call**: per-form assertions
+that each example resolves to the *expected command shape* (e.g.
+create_table → single-column PK). `hint.err.*` examples are fix-recipe
+prose, not runnable, so they're verified by review only — inherent.
+
+## §5. Next session — start here
+
+The hint corpus is now trustworthy. Open roadmap (verify against the CI
+merge first, per handoff-70 §5):
+
+1. **Push** (your step) — this commit + the still-unpushed backlog from
+   handoffs 70/71 (the CI merge + all of H2).
+2. **#35 (cargo fmt gate)** — the natural pairing with the merged CI; the
+   user wanted it done once, before first publication. The tree is **not**
+   fmt-clean (~1800 pre-existing diffs).
+3. Other `requirements.md` open items: **TT4** PTY tier-4 (unwired),
+   **I1** multi-line input, **I5/B3** in-flight cancellation, **V4**
+   session journal (own ADR), **TU1** tutorial system (own ADR).
+4. Hint follow-ups if wanted: **#37** clause-concept hints, **#38**
+   diagnostic route + `diagnostic.*` blocks, **#36** `help` advanced-SQL.
+
+## §6. How to take over
+
+1. Read handoffs 70 → 71 → 72, `CLAUDE.md`, `docs/requirements.md`.
+2. Confirm green: `cargo test` (**2500 / 1 ignored**) + `cargo clippy
+   --all-targets` (clean).
+3. For anything in the `hint` area, read **ADR-0053** first. For the
+   corpus, `src/friendly/strings/en-US.yaml` (`hint.cmd.*` / `hint.err.*`)
+   is the content; the guard in `src/dsl/grammar/mod.rs` is the regression
+   net.
+4. Workflow unchanged: phased, test-first, `/runda` + DA before commits,
+   ADR amendment + README index-upkeep for decided-area changes, confirm
+   commit messages with the user.
+5. Consider a `cargo sweep` at this milestone (`target/` grows; see
+   CLAUDE.md "Build hygiene").
@@ -0,0 +1,112 @@
+# Session handoff — 2026-06-16 (73)
+
+Short, focused handover. Continues from handoff-72 (which completed the
+H2 hint-corpus verification pass). This session shipped one small
+feature — a **`Ctrl-G` demo-mode alias for F1** — plus follow-on doc
+hygiene. Commit `4016c3e`.
+
+## §1. State
+
+**Branch:** `main`, clean, all committed (local; **push pending** — your
+step; the backlog now spans the CI merge, H2, the hint-corpus fixes,
+handoffs 71/72/73, and this Ctrl-G commit). **2503 pass / 0 fail / 1
+ignored** (the long-standing `friendly` doctest), **clippy clean**
+(nursery, all targets). Open Gitea issues unchanged: **#35–#38**.
+
+## §2. Why Ctrl-G (the problem)
+
+Casts are recorded with **`autocast`** (ADR-0047 demo mode: `--demo` /
+`RDBMS_PLAYGROUND_DEMO`). The contextual hint overlay (ADR-0053 / H2)
+opens on **F1** — but F1 reaches the app only as a terminal **escape
+sequence** (`\eOP` / `\e[11~`), and **autocast cannot emit escape
+sequences**. So the single most teaching-relevant overlay was
+unreachable in recordings (and in presenter/teacher sessions, which also
+run `--demo`). Same wall that pushed step-captions onto `Ctrl+]` (a
+single control byte) rather than `Ctrl+!`.
+
+### Chord choice — why Ctrl-G, why not Ctrl-1
+
+The user's first instinct was `Ctrl-1` (mnemonic, near F1). **Not
+possible:** in a legacy terminal `Ctrl`+digit has no control byte —
+`Ctrl-1` arrives as a bare `1` (would type "1" into the buffer). The
+kitty keyboard protocol *would* encode it, but only as an escape
+sequence (the very thing autocast can't send), and this app deliberately
+does **not** push `KeyboardEnhancementFlags` (`runtime.rs` does only
+`enable_raw_mode` + `EnterAlternateScreen`). So the usable space is
+exactly **`Ctrl`+letter** (single legacy control bytes). After excluding
+taken chords (`Ctrl-C` quit, `Ctrl-O` nav, `Ctrl+]` caption,
+`Ctrl-A/E/W/K/U` readline per ADR-0049), byte-collisions
+(`Ctrl-H/I/J/M/[`), flow-control (`Ctrl-S/Q`), and likely-future
+(`Ctrl-R/P/N/Y/L/V`), **`Ctrl-G`** is the clean survivor (BEL/"abort" in
+line editors — nothing destructive to shadow).
+
+## §3. What shipped (commit `4016c3e`)
+
+ADR-0047 **Amendment 1**. **In demo mode only**, `Ctrl-G` aliases F1:
+
+- Runs the *exact* F1 hint logic (`hint_key` guard in
+  `App::handle_key`, `src/app.rs` ~line 1226 — `key.code == F(1) ||
+  (self.demo_mode && Ctrl-G)`), so live-input → form hint, empty input →
+  recent-error / getting-started.
+- **Badges as `[F1]`** (not `[CTRL-G]`): `demo_badge_label` maps
+  `Ctrl-G → Some("[F1]")` (consulted only in demo mode — the caller
+  gates). So a recorded cast is **visually identical to a real F1
+  press**.
+- **Demo-gated:** the shipped keymap stays F1-only. Outside demo mode
+  `Ctrl-G` falls through to the inert catch-all (the `Char(c)` insert arm
+  excludes CONTROL, so no `g` is typed).
+- The keybinding strip (ADR-0051) is **not** changed — F1 stays the
+  advertised key; `Ctrl-G` is a recorder aid and the badge already reads
+  `[F1]`.
+
+**Tests (test-first, `src/app.rs` Tier-1):** `ctrl_g_in_demo_mode_-
+aliases_f1_on_input`, `…_on_empty_input`, `ctrl_g_outside_demo_mode_-
+is_inert`, plus a `Ctrl-G → [F1]` assertion added to
+`demo_badge_label_maps_the_invisible_keys`. All confirmed red→green; the
+"inert" test passed on the pre-change code, proving the demo-gate.
+
+### Using it in a cast
+With `--demo` active, send **`Ctrl-G`** in the autocast script wherever
+you want the hint overlay to appear; the viewer sees the `[F1]` badge.
+
+## §4. Doc hygiene done alongside (same commit)
+
+- **ADR-0047 file:** removed two stray `</content>` / `</invoke>` lines
+  (tool-call residue accidentally committed when the ADR was authored).
+- **CLAUDE.md "Things deliberately deferred":** dropped three **stale**
+  entries — **I1b** readline shortcuts (done, ADR-0049), **I3** tab
+  completion, and **I4** syntax highlighting (both done; requirements.md
+  even carries a 2026-06-07 reconciliation note that I3/I4 were
+  "shipped but marked not yet"). Only **I1** (multi-line input) remains —
+  it is genuinely still open (`[ ]` in requirements.md). *(This follows
+  the handoff-72 cleanup that removed the equally-stale m:n/C4 +
+  project-storage entries.)*
+
+## §5. Open / next (unchanged from handoff-72 §5)
+
+The hint corpus is trustworthy and the cast-F1 gap is closed. Roadmap:
+
+1. **Push** (your step).
+2. **#35 (cargo fmt gate)** — precondition (CI merged) is met; the user
+   wants it done once, before first publication. Needs a `rustfmt.toml`-
+   vs-defaults decision first; tree is ~1800 hunks dirty.
+3. Other open `requirements.md` items: **I1** multi-line input, **I5/B3**
+   in-flight cancellation, **TT4** PTY tier-4 (unwired), **DOC1**/**E2**
+   user docs (partial), **TT5** Windows-execution + Tier-4-in-CI, **D3**
+   packaging manifests. Design-first (`[~]`): **V4** session journal,
+   **TU1** tutorial, **C3a**, **V3**.
+4. Hint follow-ups if wanted: **#36** `help` advanced-SQL, **#37** hint
+   clause-concepts, **#38** hint diagnostic route.
+
+## §6. How to take over
+
+1. Read handoffs 71 → 72 → 73, `CLAUDE.md`, `docs/requirements.md`.
+2. Confirm green: `cargo test` (**2503 / 1 ignored**) + `cargo clippy
+   --all-targets` (clean).
+3. For demo-mode / casting, read **ADR-0047** (+ its Amendment 1); for
+   the hint overlay it aliases, **ADR-0053**.
+4. Workflow unchanged: phased, test-first, `/runda` + DA before commits,
+   ADR amendment + README index-upkeep for decided-area changes, confirm
+   commit messages with the user.
+5. Consider a `cargo sweep` at this milestone (`target/` grows; see
+   CLAUDE.md "Build hygiene").
@@ -0,0 +1,193 @@
+# Plan — road to public availability (versioning + install + packaging)
+
+Status: **planning** (2026-06-16). Captures the decisions taken in
+discussion plus the open questions, so the work can proceed in steps.
+The versioning piece is being implemented first and is recorded as a
+decision in **ADR-0054**; the install-script and package-manager pieces
+are roadmap items here until each is built.
+
+Scope note: this repo lives on the self-hosted Gitea at
+`git.lazyeval.net` (`oli/rdbms-playground`); releases publish there
+(ADR-ci-001/003). Publication branding uses the company name **Lazy
+Evaluation Ltd → `lazyeval`**, not the personal `oli` username, for
+anything user-facing (taps, buckets).
+
+---
+
+## 1. Versioning + version surfaces — DECIDED (→ ADR-0054, building now)
+
+- **`Cargo.toml` `version` is the single source of truth.** `--version`
+  reads `env!("CARGO_PKG_VERSION")` (compile-time, no deps).
+- **Two surfaces:** a `--version` / `-V` CLI flag (prints + exits, like
+  `--help`), and an in-app **`version`** app command.
+- **CI discipline:** `release.yaml` gains a guard that asserts the pushed
+  tag `vX.Y.Z` equals `CARGO_PKG_VERSION`, and **fails the release on
+  mismatch** — so the binary's self-reported version, the release name,
+  and the downloaded asset always agree.
+- **Release ritual:** bump `Cargo.toml` → commit → tag `v<that number>`
+  → push tag. (The guard enforces it.)
+- Optional enrichment (not decided): a `build.rs` baking a git short-hash
+  + build date so non-tagged dev builds read `0.2.0 (a1b2c3d)`. Good for
+  bug reports; can be added later.
+
+---
+
+## 2. `install.sh` (curl | sh) — DONE 2026-06-17 (ADR-0055)
+
+**Shipped** `scripts/install.sh` (POSIX sh, shellcheck-clean). Verified
+end-to-end against the live public `v0.1.0` release: platform mappings
+(Linux/macOS × x86_64/aarch64; Windows + unknown arch error cleanly),
+pinned (`RDBMS_VERSION`) and latest (`releases/latest`) paths, SHA-256
+verification (incl. a tamper-rejection check), install to
+`~/.local/bin`, PATH hint. **`install.ps1` (Windows) added 2026-06-17**
+(user chose both a one-liner *and* Scoop/winget; ADR-0055 Amendment 1):
+`irm | iex`, maps host CPU → our `*-windows-gnu`/`-gnullvm` `.exe`,
+SHA-256-verifies, installs to `%LOCALAPPDATA%\Programs\…` + user PATH —
+**written but untested from this env** (no PowerShell; validate on
+Windows). The website copy that references these commands is the
+**website branch's** job (separate agent), later.
+A **shellcheck CI gate** for `scripts/` is a recommended follow-up (not
+added — shellcheck isn't in the flake yet; touches ADR-ci-002).
+
+Original decided shape (for reference):
+
+- **Hosted from the Gitea repo URL** on `git.lazyeval.net` (simplest):
+  `curl -fsSL https://git.lazyeval.net/oli/rdbms-playground/raw/branch/main/scripts/install.sh | sh`
+  (exact raw-URL form to confirm against the Gitea version).
+- **Behaviour:** POSIX `sh`; detect `uname` OS+arch → target triple
+  (Linux → the **musl static** build, our universal Linux artifact);
+  query the latest release via the Gitea API
+  (`/repos/oli/rdbms-playground/releases/latest`) → tag → deterministic
+  asset name `rdbms-playground-<tag>-<target>`; download + **verify the
+  `.sha256`**; install to `~/.local/bin` (fallback `/usr/local/bin` with
+  a sudo prompt); `chmod +x`; print a PATH hint if needed.
+- **macOS:** binaries are signed (see §4 signing note); a `curl`
+  download does **not** apply the Gatekeeper quarantine xattr, so the
+  installed binary runs without `xattr` faff.
+- **Windows:** not `curl | sh` — provide a PowerShell `install.ps1`
+  (`irm … | iex`) and/or steer to Scoop/winget (§3).
+- **Security posture:** HTTPS only; in-script checksum verification;
+  document the download-inspect-run alternative (`curl|sh` is a trust
+  tradeoff).
+- **Deliverables we own now:** `scripts/install.sh` (+ later
+  `install.ps1`); confirm releases are **publicly downloadable**; decide
+  whether to also upload `install.sh` as a release asset for a stable
+  link. Website copy referencing the command is the **website branch's**
+  job (separate agent), later.
+
+---
+
+## 3. D3 — package managers (roadmap; each layers on the release assets)
+
+Common thread: a manifest pointing at our checksummed assets + a
+per-release step to bump it. Ordered cheapest → most gatekept.
+
+### 3a. `cargo binstall` + crates.io — PREPARED 2026-06-17 (ADR-0056)
+
+**Done (prep):** crate made publish-ready (dropped `publish = false`;
+added `homepage`/`keywords`/`categories`/`exclude`; authored `README.md`
+ `LICENSE-MIT`); `[package.metadata.binstall]` added with per-target
+overrides (linux-gnu→musl, windows-msvc→gnu/gnullvm; macOS direct);
+`cargo publish --dry-run` clean (913 KiB compressed). Dual license kept;
+`LICENSE-MIT` + `LICENSE-APACHE` (© Lazy Evaluation Ltd) + `CONTRIBUTING.md`
+(inbound=outbound) all in place. **Gated / remaining:** the actual `cargo
+publish` (token, irreversible) at a **new tagged release** (not 0.1.0); a
+real `cargo binstall` validation.
+
+- **Bootstrapping matters (user-flagged):** `binstall` is **not** a
+  built-in cargo subcommand — users must install **`cargo-binstall`**
+  first (its own `curl|sh`/PowerShell installer, or
+  `cargo install cargo-binstall`). **Our instructions must say this.**
+- Add `[package.metadata.binstall]` to `Cargo.toml` (pkg-url template →
+  our Gitea release assets; our naming already fits).
+- **DECIDED (2026-06-17): publish to crates.io** — so the frictionless
+  `cargo binstall rdbms-playground` resolves the crate, and the project
+  is discoverable there. (A crates.io publish is its own small task:
+  metadata completeness — description/license/repository/keywords/readme
+  — and `cargo publish`; the `[package.metadata.binstall]` URL template
+  points binstall at our Gitea release assets.) *(Verify current
+  cargo-binstall behaviour when wiring.)*
+
+### 3b. Scoop (Windows)
+- A **bucket** repo under `lazyeval` on Gitea with a JSON manifest
+  (`.exe` URL + hash + `autoupdate`). Release job commits the bump.
+- Users: `scoop bucket add lazyeval <gitea-url>; scoop install rdbms-playground`.
+
+### 3c. Homebrew (macOS/Linux)
+- A **company-branded tap** — `lazyeval/homebrew-tap` (on Gitea) — with a
+  Ruby formula (per-arch `url` + `sha256`). Release job commits the bump.
+- Users: `brew tap lazyeval/tap https://git.lazyeval.net/lazyeval/homebrew-tap`
+  then `brew install lazyeval/tap/rdbms-playground` (the explicit-URL tap
+  form, since the `user/repo` shorthand assumes GitHub).
+- *"Notability bars"* = the acceptance criteria for the default
+  **homebrew-core** tap (must be sufficiently popular/maintained). Our
+  own `lazyeval` tap sidesteps that entirely — no review gate.
+
+### 3d. winget (Windows)
+- Manifests are YAML PR'd to `microsoft/winget-pkgs` (reviewed by MS).
+- **`wingetcreate` is Windows-only** (.NET) — no good without a Windows
+  runner. **Automatic path to evaluate first: `komac`** — a
+  cross-platform (Rust) winget manifest creator/submitter that runs on
+  our **Linux** CI. *(Verify komac's current capabilities/auth model.)*
+- **Fallback:** a manual YAML PR per release — acceptable given releases
+  are infrequent (user-confirmed).
+
+### Cross-cutting (3a–3d)
+- Two extra repos (tap + bucket) under `lazyeval`, with CI push
+  credentials — setup TBD (user: "we'll figure that out").
+- **`cargo-dist`/"dist"** automates installers + Homebrew + CI, but is
+  **GitHub-Actions/Releases-centric**; on self-hosted Gitea it won't drop
+  in cleanly (installer-script generation might be reusable). Likely
+  hand-roll the manifests + a small "update on release" job instead.
+  *(Verify cargo-dist's current Gitea support before fully ruling out.)*
+
+---
+
+## Open decisions
+
+1. **crates.io:** **RESOLVED 2026-06-17 — yes, publish.** (See §3a.)
+2. **Tracking:** **RESOLVED 2026-06-17 — doc + ADR only, no Gitea
+   issues.**
+3. **Release downloads public:** **CONFIRMED 2026-06-17** — the Gitea
+   releases are publicly downloadable (no auth); `install.sh` relies on
+   it and was verified against the live `v0.1.0`.
+
+### Still open / postponed
+
+- **macOS signing — CONFIRMED BUG (2026-06-16), POSTPONED by the user
+  (2026-06-17)** pending the correct signing ID. Details:
+  - `release-macos.yaml` does `codesign --force --sign -` (ad-hoc) and has
+    **no signing scaffolding at all** (no keychain import, no secrets) —
+    so a downloaded binary is *not* properly signed (user-verified).
+  - **The credential the user has is the wrong type:** `Apple Development:
+    Oliver Sturm (W687M898E4)` is a *development* cert (Gatekeeper won't
+    trust it for distribution). Distribution needs a **`Developer ID
+    Application`** cert (same format, different type). Signing under the
+    company name *"Lazy Evaluation Ltd"* would need an **Organization**
+    Apple Developer account; a personal account signs as "Oliver Sturm".
+  - **Notarization** (required with Developer ID for non-quarantined trust
+    on browser downloads): after signing, `xcrun notarytool submit`. Creds
+    = an **App Store Connect API key** (Issuer ID + Key ID + `.p8`,
+    recommended for CI) *or* Apple ID + app-specific password + Team ID.
+    A bare CLI binary can't be *stapled* (only bundles/dmg/pkg) — Gatekeeper
+    does an online check instead.
+  - **Urgency caveat:** the `curl|sh` path doesn't need any of this (curl
+    downloads aren't quarantined); signing matters for browser downloads
+    from the releases page. Fix when the right cert + creds exist; corrects
+    the ad-hoc docs once landed.
+
+## Sequencing
+
+1. ✅ **Version discipline** (ADR-0054) — `--version`/`-V` + `version`
+   command + CI tag-match guard + tests.
+2. ✅ **`scripts/install.sh`** (ADR-0055) — built + verified against the
+   live public release.
+3. Package managers, cheapest first:
+   - ✅ **`cargo binstall` + crates.io** — *prepared* (ADR-0056);
+     publish gated on a new tagged release + the token.
+   - **← next:** Scoop (`lazyeval` bucket) → Homebrew (`lazyeval` tap) →
+     winget (komac / manual). Two `lazyeval` repos (tap + bucket) + CI
+     push creds to set up.
+4. **Cut a release at a new version** — bump `Cargo.toml` (0.1.0 →
+   0.1.1/0.2.0; the ADR-0054 guard checks the tag), tag, push; the four
+   Linux/Windows targets build immediately. (macOS leg awaits signing.)
@@ -61,11 +61,35 @@ since ADR-0027.)

 ## Distribution and install

- [ ] **D1** Cross-platform binaries: Linux, macOS, Windows on
+- [x] **D1** Cross-platform binaries: Linux, macOS, Windows on
  x86_64 and aarch64.
- [ ] **D2** Single static binary, no runtime dependencies.
+  *(Done 2026-06-15 — CI produces all six. The four non-macOS
+  targets (Linux musl + Windows gnu/gnullvm × x86_64/aarch64) are
+  cross-built from the Linux runner with `cargo-zigbuild` on a `v*`
+  tag (`release.yaml`); the two `*-apple-darwin` targets build
+  natively on a Tart Apple-Silicon runner via the dispatched
+  `release-macos.yaml`. All uploaded to the Gitea release with a
+  `.sha256` each. Decisions in `docs/ci/adr/` (ADR-ci-001/002/003).
+  Runtime-verified by the user: Linux x86_64, Windows aarch64, and both
+  macOS targets (the `release-macos.yaml` dispatch — now triggerable
+  since CI is on `main` — was run end-to-end and the binaries launch);
+  Linux aarch64 + Windows x86_64 remain link-clean / valid-format
+  only.)*
+- [x] **D2** Single static binary, no runtime dependencies.
+  *(Done 2026-06-15, per platform: **Linux** is fully static (musl +
+  `crt-static`); **Windows** is a standalone `.exe` (Zig statically
+  links libc — no mingw runtime DLLs); **macOS** links only system
+  libraries (`libSystem` + the AppKit/Foundation frameworks —
+  inherent on every Mac, never user-installed; the build rewrites the
+  one nix-store `libiconv` path to `/usr/lib` and re-signs ad-hoc).
+  No target requires anything the user must install. ADR-ci-003.)*
 - [ ] **D3** Released via prebuilt binaries plus Homebrew, Scoop,
  `winget`, and `cargo binstall`.
+  *(Prebuilt binaries + checksums now published to Gitea releases
+  (D1); the package-manager manifests (Homebrew / Scoop / winget /
+  `cargo binstall`) remain to do. The asset naming
+  `rdbms-playground-<tag>-<target>` is already binstall-friendly.
+  Tracked under ADR-ci-003 "Deferred".)*

 ## TUI shell

@@ -250,16 +274,13 @@ since ADR-0027.)

 ## App-level commands (per ADR-0003)

- [/] **A1** All canonical app-level commands implemented and
+- [x] **A1** All canonical app-level commands implemented and
  available in both modes: `save`, `save as`, `load`, `new`,
  `rebuild`, `export`, `import`, `seed`, `replay`, `undo`,
  `redo`, `mode`, `help`, `hint`, `quit`.
-  *(Partial: **14 of 15** implemented and available in both modes —
-  `quit`/`q`, `mode simple|advanced`, `help`, `save`, `save as`,
-  `load`, `new`, `rebuild`, `export`, `import`, `replay`, `undo`,
-  `redo`, and now **`seed`** (ADR-0048 / SD1, done 2026-06-11).
-  **Only `hint`** (tracked as H2) remains unregistered. A1 closes
-  when H2 lands.)*
+  *(Done 2026-06-15: the last command, **`hint`**, landed with H2
+  (ADR-0053). All 15 canonical app commands are now registered and
+  available in both modes.)*

 ## DSL data commands

@@ -793,8 +814,21 @@ since ADR-0027.)
  `returning `) still shows the raw expression first-set —
  typing-time completion already offers the right candidates
  there, so the payoff is small.
- [ ] **H2** `hint` provides contextual help for the current
+- [x] **H2** `hint` provides contextual help for the current
  input or the most recent error.
+  *(Done 2026-06-15, ADR-0053: an **F1** keybinding gives a tier-3
+  teaching hint for the live partial input (read-only overlay), and a
+  submitted **`hint`** command expands on the most recent runtime error.
+  A new `hint.cmd.<form>` / `hint.err.<class>` catalogue tier
+  (`what`/`example`/`concept`) covers every command form + the 9 runtime
+  error classes, enforced by a comprehensiveness coverage test. Deferred:
+  the pre-submit-diagnostic route + `diagnostic.*` blocks (#38),
+  clause-concept hints (#37). **Content verified 2026-06-15 (handoff-71):**
+  a semantic pass over every `hint.cmd.*`/`hint.err.*` block fixed four
+  errors — `create_table` (compound-PK misread), `save` (no inline name),
+  `import` (hyphen-rejecting target), and `foreign_key.child_side` (wrong
+  `on delete` remedy) — and added a catalogue-driven guard test that parses
+  every command example in its taught mode.)*
 - [x] **H3** `help` provides general reference and per-command
  help.
  *(Done 2026-06-07: the **general reference** is `help` (no arg) —
@@ -857,7 +891,10 @@ since ADR-0027.)
  exists (~55 lines, covers the WHERE-expression and
  table-creation boundaries). **Missing:** a DSL
  command-surface reference and a standalone type-system
-  reference under `docs/`.)*
+  reference under `docs/`. **Note (2026-06-16):** the **canonical**
+  user docs now live on the **website** (ADR-website-001, deployed) —
+  it covers the full feature set; the in-repo `docs/` reference pieces
+  named here remain the outstanding part of DOC1.)*

 ## Testing (per ADR-0008)

@@ -878,8 +915,18 @@ since ADR-0027.)
  PTY. Correcting a stale `CLAUDE.md` line that read "Tier 4 is
  wired only for the listed critical flows" — it was not wired at
  all. Genuinely deferred.)*
- [ ] **TT5** CI runs all tiers on Linux, macOS, and Windows on
+- [/] **TT5** CI runs all tiers on Linux, macOS, and Windows on
  stable Rust.
+  *(Partial, 2026-06-15. **CI is live** on the self-hosted Gitea
+  Actions (`docs/ci/adr/`): the gate runs `clippy -D warnings` +
+  `cargo test` (Tiers 1–3) on the **Linux** runner for every branch
+  push / PR, and `release-macos` runs the suite natively on the
+  **macOS** runner. **Windows is build-only** — cross-compiled, not
+  executed (no Windows runner). **Tier 4** (PTY, TT4) is still
+  unwired, so "all tiers" is not yet fully met. "Stable Rust" is
+  satisfied by the flake's pinned `1.95.0` (a stable release, not
+  nightly). Remaining for full TT5: a Windows execution runner and
+  Tier-4 PTY in CI.)*

 ## Cross-cutting

@@ -0,0 +1,146 @@
+# ADR-website-001: Public website and documentation site
+
+## Status
+
+Accepted (2026-06-04). Implementation plan:
+[`docs/website/plans/20260604-website-implementation-plan.md`](../plans/20260604-website-implementation-plan.md).
+
+> History: drafted as ADR-0042, renamed to ADR-0044 (each collided with a
+> number `main` had independently assigned — H1a took 0042, compound-PK FK
+> took 0043, then relationship-visualization took 0044). Moved to the
+> website ADR namespace (`docs/website/adr/`, id **ADR-website-001**) on
+> 2026-06-10 to end the recurring cross-branch number collision: website
+> decision records now draw from their own dated sequence and never the
+> main global ADR pool (see ADR-0000 "Numbering discipline"). Content is
+> unchanged from the original draft.
+
+## Context
+
+RDBMS Playground is nearing its first public release and needs a public
+website that does two jobs: **attract** — a landing page that shows the
+playground in action — and **document** — a thorough, canonical reference
+for everything the playground can do.
+
+The documentation-heavy surface is already implemented and verified (full
+simple- and advanced-mode command set, the ten-type vocabulary,
+relationships, constraints, indexes, EXPLAIN, undo/history/replay, projects,
+export/import, the teaching echo, clipboard, friendly errors, tab completion
+and syntax highlighting; 2151 tests passing at the time of writing). The
+site is therefore largely a presentation-and-writing effort, not a
+wait-for-features one. A grounded inventory of what is shippable now lives
+in the implementation plan.
+
+Several choices here had no canonical default; they were settled during a
+planning + `/runda` pass with the user and are recorded below.
+
+## Decision
+
+1. **Stack — Astro 6 + Starlight + Tailwind v4.** Astro's content-first,
+   zero-JS-by-default model with the Starlight docs theme fits a
+   marketing-landing-plus-heavy-docs site better than the alternative
+   considered, SvelteKit + Tailwind (the usual go-to here). Interactive
+   pieces are added as Astro islands (Svelte or vanilla), so Svelte is still
+   available where it earns its place. Tailwind v4 is wired via the official
+   `@tailwindcss/vite` plugin; the `@astrojs/starlight-tailwind` plugin
+   bridges Tailwind with Starlight's theming.
+
+2. **Demo medium — asciinema.** Showcase sequences are recorded as
+   asciinema `.cast` files (text-based, small, faithful to the full
+   alternate-screen render) and embedded with `asciinema-player`. The same
+   casts are reused inline in the docs — one recording format serves both
+   the landing page and documentation enrichment. Recordings are produced by
+   a **scripted-input driver** that types commands into a real PTY with
+   viewer-friendly pacing; the app's own `history.log` **replay** (ADR-0034)
+   re-executes commands without typing animation or pacing and is therefore
+   suitable only for state-deterministic docs snippets, not the hero demo.
+
+3. **In-page WASM playground — deferred** (OOS: **deferred**, not rejected).
+   A live, type-it-yourself playground compiled from the Rust app to
+   WebAssembly is desirable but is a multi-week sub-project, so it does not
+   block the site. The demo section is designed with a stable seam (a single
+   `Demo` component contract) so a WASM playground island can replace the
+   asciinema player later with no change to call sites. Recorded boundary
+   for that future work:
+   - **Portable core (runs on `wasm32-unknown-unknown` largely as-is):**
+     `src/dsl/*` (parser, types, grammar, walker), the pure `App::update()`,
+     `ui.rs`, `theme.rs`, `friendly/*`, output rendering; an in-memory DB
+     path already exists (`Connection::open_in_memory()`). `rusqlite`
+     compiles to the browser target via its `ffi-sqlite-wasm-rs` feature.
+   - **Native edge needing `cfg`-gated browser replacements:** the
+     multi-thread Tokio runtime + the dedicated DB **worker thread**
+     (ADR-0010) → current-thread/in-line async; `crossterm` terminal +
+     event-stream → a browser backend (e.g. Ratzilla's DOM/Canvas) + DOM
+     events; `arboard`, `zip`, file persistence (ADR-0015), file logging;
+     and the rusqlite **backup-API** undo (ADR-0006) → a SQL dump/restore.
+   When taken up, this becomes its own ADR + iteration plan.
+
+4. **Hosting — portable static build; Cloudflare is the target (decided
+   2026-06-11).** Astro 6 builds to static HTML/CSS with no adapter, so the
+   output deploys equally to Cloudflare, Vercel, Netlify, or GitHub Pages — we
+   stay uncoupled from any one host. **Planned pipeline: Gitea Actions →
+   Cloudflare.** Cloudflare now steers new projects to **Workers (static
+   assets)** over Pages; either serves the static `dist/` and needs no Astro
+   adapter (the `@astrojs/cloudflare` adapter is only for SSR, which the site
+   does not use). The future in-page WASM playground (§3), if it needs
+   COOP/COEP headers, can get them from Cloudflare `_headers`. **CI implemented
+   2026-06-15** (`.gitea/workflows/website.yaml`): a push touching `website/**`
+   builds the static site with pnpm and deploys `dist/` to the Cloudflare Pages
+   project **`relplay`** via `wrangler` (Direct Upload — no Git integration).
+   The `--branch` label selects environment against the project's production
+   branch (`main`): **`main` → production (`relplay.org`)**, **`website` →
+   preview (`website.relplay.pages.dev`)**, with `staging.relplay.org` attachable
+   to the `website` branch alias. The crate's CI gate (`ci.yaml`) skips
+   website-only pushes; the build is pure-Node (the `.cast` files are committed,
+   so no cargo). Secrets: `CLOUDFLARE_API_TOKEN` + `CLOUDFLARE_ACCOUNT_ID`.
+
+5. **Repo topology — monorepo.** The site lives under `website/` in the
+   playground repo; the crate stays at the repo root. The repo as a whole
+   moves to its public home later; site and crate travel together.
+
+6. **Canonical docs home — the website.** User-facing documentation lives on
+   the site. In-repo `docs/` keeps ADRs, handoffs, and development notes;
+   `docs/simple-mode-limitations.md` (requirement DOC1) was a development aid
+   and now *feeds* the site's content rather than competing with it. The
+   sharing recipes promised by requirement E2 become a docs page.
+
+7. **Documentation scope and conventions.** Document the **full supported
+   feature set**. Any capability not yet fully implemented (a small minority
+   — e.g. multi-line input, query cancellation, `seed`, `m:n` convenience,
+   ER-diagram export, the `show tables`/`relationships`/`indexes` family) is
+   either omitted or carries a clear **"planned / not yet available"**
+   callout — never presented as shipped. Two wording rules bind all
+   user-facing copy:
+   - **No engine name** (SQLite/STRICT/rusqlite/PRAGMA) — continues the
+     user-facing posture of ADR-0002; copy says "the database"/"the engine".
+   - **No "DSL"** — it is internal jargon. The two input modes are **simple
+     mode** (the playground's keyword command language) and **advanced
+     mode** (SQL).
+
+8. **Install documentation — two mechanisms.** The install page documents
+   **prebuilt release binaries** (self-hosted download — not GitHub
+   Releases, since the repo will move) and **package managers**. Both can be
+   written now against the planned mechanisms; concrete download URLs slot in
+   at release. (Distribution items D1–D3 in `requirements.md` remain the
+   tracking home for the release tooling itself.)
+
+## Consequences
+
+- The site can ship on the strength of already-implemented features; it is
+  gated on writing and recording, not on finishing the app.
+- One recording format (asciinema `.cast`) serves both marketing and docs,
+  and is reusable as the app evolves (re-run the script, re-record).
+- The WASM playground is preserved as a real future option without holding
+  up launch; the demo seam keeps the upgrade cheap.
+- A single canonical docs home removes the divergence risk of maintaining
+  user docs in two places.
+- Website build choices (Decisions 1, 2, 4, 5) are recorded here for
+  traceability but do not, by themselves, warrant further ADRs; only
+  app-architecture decisions (notably the future WASM port) will.
+
+## Out of scope
+
+- **In-page WASM playground** — *deferred* (see Decision 3); revisit as its
+  own ADR + iteration plan.
+- **Hosted/SaaS playground or a server-backed doc CMS** — *rejected*: a
+  static site fully satisfies the need, consistent with ADR-0007's
+  no-hosted-publishing stance. Revisit only if real demand emerges.
@@ -0,0 +1,19 @@
+# Website Architecture Decision Records
+
+Decision records for the **public website + documentation site** subproject
+(the Astro/Starlight site under `website/`). These are kept in their own
+namespace, separate from the project-wide ADRs in
+[`docs/adr/`](../../adr/README.md), so website decisions never compete with
+the main global ADR sequence for numbers — see
+[ADR-0000 "Numbering discipline"](../../adr/0000-record-architecture-decisions.md).
+
+**Numbering.** Files are named `<date>-adr-website-<NNN>.md` and referenced
+in prose as `ADR-website-NNN`. The `<date>` (the ADR's accepted/created day,
+`YYYYMMDD`) plus the `website` segment keeps the namespace disjoint from
+`main`'s integers. Assign the next free `NNN` from this index. Every ADR
+change updates this index in the same edit (the ADR-0000 index-upkeep rule
+applies here too).
+
+## Index
+
+- [ADR-website-001 — Public website and documentation site](20260604-adr-website-001.md) — **Accepted 2026-06-04** (formerly ADR-0044 in the main index; moved here 2026-06-10 to end recurring cross-branch number collisions). The first public website: a marketing landing page plus the **canonical** user docs. Stack **Astro 6 + Starlight + Tailwind v4** (chosen over SvelteKit + Tailwind for a docs-heavy + marketing site; interactive bits as Astro islands). Showcase demos are **asciinema** `.cast` recordings (scripted-input driver for paced, re-recordable sessions — *not* `history.log` replay), reused inline in docs. The **in-page WASM playground is deferred** (OOS: deferred) behind a stable `Demo` seam, with the portable-core vs native-edge boundary recorded for a future ADR + iteration plan. Portable **static build** (**Cloudflare** target via **Gitea Actions**, host-agnostic); **monorepo** (`website/`). **§4 update (CI implemented):** the static→Cloudflare Pages deploy now runs via Gitea Actions (`.gitea/workflows/website.yaml`; the crate gate is skipped for website-only changes); both `website` and `main` are merged and the site is **deployed**. Docs cover the **full supported feature set** with "planned" callouts for the unshipped minority; two wording rules bind user-facing copy — **no engine name** (continues ADR-0002) and **no "DSL"** ("simple mode" / "advanced mode"). Install docs cover **prebuilt binaries + package managers** (D1–D3 track the release tooling). Plan: [`docs/website/plans/20260604-website-implementation-plan.md`](../plans/20260604-website-implementation-plan.md)
@@ -0,0 +1,198 @@
+# Plan: public website and documentation site
+
+**Date:** 2026-06-04 · **Status:** ready to build
+
+Decisions for this work are recorded in
+[ADR-website-001](../adr/20260604-adr-website-001.md): Astro 6 +
+Starlight + Tailwind v4; asciinema demos reusable in docs; the in-page WASM
+playground deferred behind a stable demo seam; portable static hosting
+(Vercel target); monorepo (`website/`); website is the canonical docs home;
+full-feature-set docs with "planned" callouts; install docs cover prebuilt
+binaries + package managers. This plan is the *how*.
+
+## Repository layout
+
+The site lives under `website/` in this repo; the crate stays at the root.
+
+```
+website/
+├── package.json              # pnpm; astro, @astrojs/starlight, tailwind v4
+├── astro.config.mjs          # Starlight integration + sidebar nav
+├── src/
+│   ├── pages/index.astro     # marketing landing (custom, not Starlight)
+│   ├── components/
+│   │   ├── Demo.astro        # demo SLOT — the WASM-playground seam
+│   │   └── Cast.astro        # asciinema-player island wrapper
+│   ├── content/docs/         # Starlight MDX docs (the bulk of the work)
+│   └── styles/               # shared Tailwind + Starlight theme tokens
+├── public/casts/             # recorded *.cast asciinema files
+├── README.md                 # local dev + recording recipe
+└── STYLE.md                   # living documentation style guide
+```
+
+Root `.gitignore` gains `website/node_modules`, `website/dist`,
+`website/.astro`.
+
+## Documentation inventory (grounded — drives Phase D scope)
+
+Built from `docs/handoff/55–59`, `docs/adr/*`, the command REGISTRY
+(`src/dsl/grammar/mod.rs:603`, which also auto-assembles in-app `help`), the
+`Command` enum (`src/dsl/command.rs:149`), and
+`src/friendly/strings/en-US.yaml` — **not** the coarse `requirements.md`
+checkboxes (handoff-59 found those ~46% mis-marked; they now use a `[/]`
+"partial" legend — trust the code, not the marker). Refreshed **2026-06-09
+after merging `main`**, which added the show-list/detail, `help <command>`,
+and compound-PK FK surface (see the dedicated bullet below). Test state:
+**2193 passing, 0 failing, 1 ignored.**
+
+**SHIPPED — document as-is (the doc core):**
+- Input modes: simple, advanced (SQL), `:` one-shot escape, `mode` command,
+  per-project mode restore (ADR-0003/0015/0037).
+- Full simple-mode command surface: create/drop table; add/drop/rename/
+  change column; add/drop 1:n relationship (named, ON DELETE/UPDATE
+  CASCADE/SET NULL/RESTRICT, `--create-fk`); add/drop index; insert/update/
+  delete (required WHERE + `--all-rows`; complex WHERE: AND/OR/NOT, LIKE,
+  IS NULL, IN, BETWEEN); show table/data (where/limit); add/drop constraint;
+  explain (ADR-0009/0013/0014/0025/0026/0028/0029).
+- Full advanced-mode SQL: CREATE/DROP/ALTER TABLE (cols, constraints, inline
+  + table FKs, rename, alter-column-type), CREATE [UNIQUE]/DROP INDEX; SELECT
+  (joins, GROUP BY/HAVING, ORDER BY, LIMIT/OFFSET, UNION/INTERSECT/EXCEPT,
+  WITH [RECURSIVE] CTEs); INSERT (multi-row, ON CONFLICT, RETURNING)/UPDATE/
+  DELETE; full expression grammar incl. CASE, CAST, curated functions;
+  EXPLAIN over SQL (ADR-0030–0039).
+- Types: all ten, advanced-mode SQL aliases, serial/shortid auto-fill
+  (ADR-0005/0011/0017/0018). Constraints: PK incl. compound, NOT NULL,
+  UNIQUE, CHECK, DEFAULT, FK (ADR-0029/0013/0035).
+- Undo/redo, history.log journal, replay, `--resume`, `--no-undo`
+  (ADR-0006/0034). Projects & storage: project.yaml + CSV + history.log,
+  save/save as/load/new/rebuild, temp projects, `--data-dir`
+  (ADR-0004/0015). Export/import (zip), clipboard copy/copy all/copy last
+  (ADR-0007/0041).
+- Friendly errors (all five categories) + validity indicator
+  (ADR-0019/0027), DSL→SQL teaching echo (ADR-0038), EXPLAIN plan tree
+  (ADR-0028), box-drawing tables (ADR-0016), tab completion + syntax
+  highlighting + in-line editing (ADR-0022).
+- **Added by the `main` merge (2026-06-09):** schema-inspection commands
+  `show tables` / `show relationships` / `show indexes` and the singular
+  `show relationship <name>` / `show index <name>` detail views (V5/V5a);
+  `help [<command>]` per-command detail + `help types` + general reference
+  (H3); **compound-primary-key foreign-key references** — DSL
+  `from <P>.(a, b) to <C>.(x, y)` and SQL `FOREIGN KEY (a, b) REFERENCES
+  P(x, y)` (single-column form unchanged) (ADR-0043, T3); friendlier
+  parse-error near-miss messaging (H1a, ADR-0042). These need coverage: a
+  schema-inspection page (the `show` family) and compound-FK examples on the
+  Relationships page.
+
+**DOCUMENT WITH CAVEAT:** `add unique index` is advanced-only; simple-mode
+table rename is intentionally absent (rename is `ALTER TABLE … RENAME TO`);
+`hint` (H2) is still partial; a compound-FK *violation* message names only
+the first column pair (enforcement is correct — a messaging-only residual).
+
+**OMIT or MARK "planned":** multi-line input (I1), readline shortcuts (I1b),
+in-flight cancellation / query timeout (I5/B3), `seed` (SD1), `m:n`
+convenience (C4), one-step modify relationship (C3a), relationship line-art
+(V1), ER-diagram export (V3), session-log + Markdown export (V4).
+
+**Mine verbatim for docs:** `en-US.yaml` `help.app.*`, `help.ddl.*`,
+`help.data.*`, `help.types_reference`, `parse.usage.*` (one-line syntax
+templates), `hint.*` — keeps docs and in-app help consistent.
+
+## Phases
+
+### A — Scaffold
+`pnpm create astro@latest` (Starlight template) in `website/`; `astro add
+tailwind` (Tailwind v4 via `@tailwindcss/vite`); add
+`@astrojs/starlight-tailwind`. Confirm `pnpm dev` serves and `pnpm build`
+emits a static `dist/`. Echo build steps for traceability.
+
+### B — Landing page
+Custom `src/pages/index.astro` (Starlight owns `/docs/*`). Hero + value prop
+("learn relational databases by doing"), feature highlights from the
+inventory, an embedded demo cast above the fold. Use the `frontend-design`
+skill to avoid generic AI aesthetics; honour NFR-4/5/7 (distinctive design,
+meaningful colour, light/dark).
+
+### C — asciinema recording workflow
+Record real `rdbms-playground` sessions to `public/casts/*.cast` using a
+**scripted-input driver** (e.g. `asciinema-automation`/autocast, or an
+expect/doitlive script) for paced, re-recordable demos. Record at a fixed
+sensible cols×rows; provide light + dark player themes. `Cast.astro` wraps
+`asciinema-player` as a `client:visible` island; the same component embeds
+casts inline in docs. Document the recipe in `website/README.md`.
+(`asciinema` 2.4.0 is installed.)
+
+### D — Documentation (the bulk)
+**Five** top-level sidebar sections (autogenerated per directory). The key
+split: *Using the playground* = the application you drive; *Reference* = the
+database language you build with.
+- **Getting started** — install (prebuilt binaries + package managers),
+  first project, simple vs. advanced mode, the example library.
+- **Using the playground** — command-line options; the assistive editor
+  (completion, syntax highlighting, the `[ERR]`/`[WRN]` validity indicator,
+  hints, in-line editing); the output pane (PageUp/PageDown scrolling — the
+  fuller V4 session-log / Markdown export is *planned*, mark it); projects
+  (save / load / new / rebuild); undo, redo & history (+ replay); export &
+  import (E2 recipes); copy to clipboard; getting help (`help` /
+  `help <command>` / `hint`). (ADR-0003 "app-level commands" + ADR-0022/0027
+  typing assistance + the CLI.)
+- **Guides** — task walkthroughs.
+- **Reference** — the database language: Tables, Columns, Relationships,
+  Indexes, Constraints, Inserting & editing data, Querying & inspecting
+  (`show` / `select`), Types, Query plans (EXPLAIN), Errors explained, the
+  simple-command → SQL teaching echo.
+- **Concepts** — the *why*: projects & storage model, the derived database,
+  how undo works.
+
+**Surface the assistive editor prominently** — it is a differentiator and
+most helps beginners: a landing-page card + a Getting-started mention, both
+linking into *Using the playground*. It is prime asciinema-cast material
+(completion / validity indicator are motion a still code block can't show).
+
+Build order: Tier 1 simple-mode reference + types + constraints + input
+modes + mined help/usage strings → Tier 2 advanced SQL + relationships +
+project lifecycle + undo/history → Tier 3 teaching echo + EXPLAIN + errors +
+completion/highlighting → Tier 4 clipboard + hints + editing.
+
+Conventions live in the **living style guide** `website/STYLE.md` (binding
+rules from ADR-website-001 §7 — no engine name, **no "DSL"**, "planned" callouts —
+plus finer conventions and an open-decisions log for depth/splitting/example
+dataset/etc. as they settle). Sources to mine: `src/dsl/command.rs`,
+`src/dsl/grammar/*`, the REGISTRY, `en-US.yaml`, `docs/adr/*`,
+`docs/simple-mode-limitations.md`.
+
+### E — Hosting & portability
+Keep the default static build (no adapter); `dist/` deploys to Vercel or any
+static host. `website/README.md` notes the Vercel preset (root dir
+`website/`) and the one-line `@astrojs/vercel` switch if SSR is ever needed.
+
+## Demo seam (WASM hook)
+
+`Demo.astro` exposes a stable contract (`{ src, title, height, autoplay }`).
+At launch it renders `Cast.astro`; later a `Playground.astro` WASM island
+swaps in behind the same props on the landing page and in docs, with zero
+call-site changes. Boundary details are in ADR-website-001 §3.
+
+## Verification
+
+- `pnpm dev` renders landing + docs; `pnpm build` emits a clean static
+  `dist/` with no errors/warnings.
+- Landing shows at least one playing `.cast`; the same component renders a
+  cast inline in a docs page (proves reuse).
+- Starlight link-check passes (broken internal links fail the build).
+- Docs grep clean of forbidden terms: **no "DSL"**, no engine name.
+- A `dist/` static deploy works on Vercel (manual import) — confirms
+  portability. (No CI gate yet, per ADR-website-001 §4.)
+
+## Notes / recommendations (non-blocking)
+
+- **Doc drift:** consider generating the command reference from source (the
+  `help` REGISTRY / `en-US.yaml`) rather than hand-writing all of it.
+- **Accessibility/SEO:** pair each hero `.cast` with a text transcript or the
+  equivalent docs snippet.
+- **Branding/domain & analytics** unspecified — assume none until decided;
+  no third-party trackers without consent.
+- Tailwind v4 + Starlight have occasional theme-token friction; the
+  `@astrojs/starlight-tailwind` plugin is the supported bridge.
+- Starlight ships local search (Pagefind) by default.
+- No `README.md` exists at the repo root yet — wanted for the destination
+  repo; out of this plan's core scope but flagged.
@@ -0,0 +1,94 @@
+<#
+.SYNOPSIS
+    Download and install a prebuilt rdbms-playground binary (Windows).
+
+.DESCRIPTION
+    The Windows counterpart of scripts/install.sh. Detects the CPU
+    architecture, downloads the matching release .exe from the Gitea
+    releases, verifies its SHA-256 checksum, installs it to
+    %LOCALAPPDATA%\Programs\rdbms-playground, and adds that directory to
+    your user PATH.
+
+    Quick start:
+        irm https://git.lazyeval.net/oli/rdbms-playground/raw/branch/main/scripts/install.ps1 | iex
+
+    We ship gnu / gnullvm Windows builds (x86_64 / aarch64); this maps the
+    host architecture to the right asset.
+
+.PARAMETER Version
+    Install a specific tag (e.g. v0.2.0) instead of the latest release.
+    Defaults to $env:RDBMS_VERSION, else the latest release.
+
+.PARAMETER InstallDir
+    Install directory. Defaults to $env:RDBMS_INSTALL_DIR, else
+    %LOCALAPPDATA%\Programs\rdbms-playground.
+
+.NOTES
+    Written but NOT tested on Windows from this environment (no PowerShell
+    here) — validate on a real Windows host. The verified sibling is
+    install.sh (Linux/macOS).
+#>
+[CmdletBinding()]
+param(
+    [string]$Version = $env:RDBMS_VERSION,
+    [string]$InstallDir = $(if ($env:RDBMS_INSTALL_DIR) { $env:RDBMS_INSTALL_DIR } else { "$env:LOCALAPPDATA\Programs\rdbms-playground" })
+)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+$Repo = 'https://git.lazyeval.net/oli/rdbms-playground'
+$Api = 'https://git.lazyeval.net/api/v1/repos/oli/rdbms-playground'
+$Bin = 'rdbms-playground'
+
+# Map the host CPU to the target triple we publish for Windows.
+$osArch = [System.Runtime.InteropServices.RuntimeInformation]::OSArchitecture
+switch ($osArch) {
+    'X64' { $target = 'x86_64-pc-windows-gnu' }
+    'Arm64' { $target = 'aarch64-pc-windows-gnullvm' }
+    default { throw "install: unsupported CPU architecture: $osArch" }
+}
+
+# Resolve the release tag (explicit -Version, else the latest release).
+if (-not $Version) {
+    $Version = (Invoke-RestMethod -Uri "$Api/releases/latest").tag_name
+    if (-not $Version) { throw 'install: could not determine the latest release tag' }
+}
+
+$asset = "$Bin-$Version-$target.exe"
+$url = "$Repo/releases/download/$Version/$asset"
+
+$tmp = Join-Path $env:TEMP ([System.Guid]::NewGuid().ToString())
+New-Item -ItemType Directory -Path $tmp -Force | Out-Null
+try {
+    $exe = Join-Path $tmp "$Bin.exe"
+    $shaFile = "$exe.sha256"
+
+    Write-Host "downloading $asset ..."
+    Invoke-WebRequest -Uri $url -OutFile $exe
+    Invoke-WebRequest -Uri "$url.sha256" -OutFile $shaFile
+
+    # The sidecar is "<hash>  <name>"; compare just the hash.
+    $expected = ((Get-Content -Raw $shaFile) -split '\s+')[0].ToLower()
+    $actual = (Get-FileHash -Algorithm SHA256 -Path $exe).Hash.ToLower()
+    if ($expected -ne $actual) {
+        throw "install: checksum mismatch (expected $expected, got $actual) — refusing to install"
+    }
+
+    New-Item -ItemType Directory -Path $InstallDir -Force | Out-Null
+    $dest = Join-Path $InstallDir "$Bin.exe"
+    Move-Item -Path $exe -Destination $dest -Force
+    Write-Host "installed $Bin $Version -> $dest"
+
+    # Add the install dir to the user PATH (persistent) if it's not there.
+    $userPath = [Environment]::GetEnvironmentVariable('Path', 'User')
+    if (-not $userPath) { $userPath = '' }
+    if (($userPath -split ';') -notcontains $InstallDir) {
+        $newPath = if ($userPath) { "$userPath;$InstallDir" } else { $InstallDir }
+        [Environment]::SetEnvironmentVariable('Path', $newPath, 'User')
+        Write-Host "added $InstallDir to your user PATH — restart your shell to pick it up"
+    }
+}
+finally {
+    Remove-Item -Path $tmp -Recurse -Force -ErrorAction SilentlyContinue
+}
@@ -0,0 +1,166 @@
+#!/bin/sh
+# install.sh — download and install a prebuilt rdbms-playground binary.
+#
+# Quick start (Linux / macOS):
+#   curl -fsSL https://git.lazyeval.net/oli/rdbms-playground/raw/branch/main/scripts/install.sh | sh
+#
+# What it does: detects your OS + CPU, downloads the matching release binary
+# from the Gitea releases (Linux uses the fully-static musl build), verifies
+# its SHA-256 checksum, and installs it to ~/.local/bin.
+#
+# Environment overrides:
+#   RDBMS_VERSION      install a specific tag (e.g. v0.2.0) instead of the latest
+#   RDBMS_INSTALL_DIR  install directory (default: $HOME/.local/bin)
+#   RDBMS_OS           force the OS (testing): Linux | Darwin
+#   RDBMS_ARCH         force the CPU (testing): x86_64 | aarch64
+#
+# Flags:
+#   --print-target   print the resolved target triple and exit (no download)
+#   -h, --help       print this help and exit
+#
+# Notes:
+#   * Windows is not installable via this script (the binary is a .exe) —
+#     use Scoop/winget (planned) or download the .exe from the releases page.
+#   * macOS: a curl download is not quarantined by Gatekeeper, so the binary
+#     runs without extra steps. (Developer-ID signing + notarization is a
+#     separate, planned improvement for browser downloads.)
+#
+# POSIX sh — no bashisms, so it runs under the `sh` of `curl | sh`.
+
+set -eu
+
+REPO_BASE="https://git.lazyeval.net/oli/rdbms-playground"
+API_BASE="https://git.lazyeval.net/api/v1/repos/oli/rdbms-playground"
+BIN_NAME="rdbms-playground"
+PRINT_TARGET=0
+
+err() {
+	printf 'install: %s\n' "$1" >&2
+	exit 1
+}
+info() { printf '%s\n' "$1" >&2; }
+
+usage() {
+	# Lines 2..(first blank) of this file are the human-readable header.
+	sed -n '2,/^$/p' "$0" | sed 's/^# \{0,1\}//'
+}
+
+# Resolve the Rust target triple for the current (or forced) platform.
+# Linux  -> <arch>-unknown-linux-musl   (the fully-static build)
+# macOS  -> <arch>-apple-darwin
+detect_target() {
+	os="${RDBMS_OS:-$(uname -s)}"
+	arch="${RDBMS_ARCH:-$(uname -m)}"
+	case "$os" in
+	Linux | linux) os_part="unknown-linux-musl" ;;
+	Darwin | darwin | macos | macOS) os_part="apple-darwin" ;;
+	MINGW* | MSYS* | CYGWIN* | *Windows* | *windows*)
+		err "Windows is not supported by this installer — use Scoop/winget (planned) or download the .exe from $REPO_BASE/releases" ;;
+	*) err "unsupported operating system: $os" ;;
+	esac
+	case "$arch" in
+	x86_64 | amd64) arch_part="x86_64" ;;
+	aarch64 | arm64) arch_part="aarch64" ;;
+	*) err "unsupported CPU architecture: $arch" ;;
+	esac
+	printf '%s-%s' "$arch_part" "$os_part"
+}
+
+# Download $1 to file $2 (curl or wget).
+download() {
+	if command -v curl >/dev/null 2>&1; then
+		curl -fsSL "$1" -o "$2"
+	elif command -v wget >/dev/null 2>&1; then
+		wget -qO "$2" "$1"
+	else
+		err "need either curl or wget on PATH"
+	fi
+}
+
+# Fetch $1 to stdout (curl or wget).
+fetch() {
+	if command -v curl >/dev/null 2>&1; then
+		curl -fsSL "$1"
+	elif command -v wget >/dev/null 2>&1; then
+		wget -qO- "$1"
+	else
+		err "need either curl or wget on PATH"
+	fi
+}
+
+# The release tag to install: $RDBMS_VERSION if set, else the latest release.
+resolve_version() {
+	if [ -n "${RDBMS_VERSION:-}" ]; then
+		printf '%s' "$RDBMS_VERSION"
+		return
+	fi
+	json=$(fetch "$API_BASE/releases/latest") ||
+		err "could not query the latest release from $API_BASE"
+	# Portable JSON scrape (no jq): the latest-release object carries exactly
+	# one "tag_name": "<tag>" field.
+	tag=$(printf '%s' "$json" |
+		grep -o '"tag_name"[[:space:]]*:[[:space:]]*"[^"]*"' |
+		head -1 | sed 's/.*"\([^"]*\)"$/\1/')
+	[ -n "$tag" ] || err "could not parse the latest release tag"
+	printf '%s' "$tag"
+}
+
+# Verify file $1 against sha256 sidecar $2 (format: "<hash>  <name>").
+verify_checksum() {
+	expected=$(awk '{print $1; exit}' "$2")
+	if command -v sha256sum >/dev/null 2>&1; then
+		actual=$(sha256sum "$1" | awk '{print $1}')
+	elif command -v shasum >/dev/null 2>&1; then
+		actual=$(shasum -a 256 "$1" | awk '{print $1}')
+	else
+		info "warning: no sha256 tool found — skipping checksum verification"
+		return 0
+	fi
+	[ "$expected" = "$actual" ] ||
+		err "checksum mismatch (expected $expected, got $actual) — refusing to install"
+}
+
+main() {
+	while [ $# -gt 0 ]; do
+		case "$1" in
+		--print-target) PRINT_TARGET=1 ;;
+		-h | --help)
+			usage
+			exit 0
+			;;
+		*) err "unknown argument: $1 (try --help)" ;;
+		esac
+		shift
+	done
+
+	target=$(detect_target)
+	if [ "$PRINT_TARGET" = "1" ]; then
+		printf '%s\n' "$target"
+		exit 0
+	fi
+
+	version=$(resolve_version)
+	asset="$BIN_NAME-$version-$target"
+	url="$REPO_BASE/releases/download/$version/$asset"
+	dir="${RDBMS_INSTALL_DIR:-$HOME/.local/bin}"
+
+	tmp=$(mktemp -d 2>/dev/null) || err "could not create a temporary directory"
+	trap 'rm -rf "$tmp"' EXIT INT TERM
+
+	info "downloading $asset ..."
+	download "$url" "$tmp/$BIN_NAME" || err "download failed: $url"
+	download "$url.sha256" "$tmp/$BIN_NAME.sha256" || err "checksum download failed: $url.sha256"
+	verify_checksum "$tmp/$BIN_NAME" "$tmp/$BIN_NAME.sha256"
+
+	mkdir -p "$dir" || err "could not create install directory: $dir"
+	chmod +x "$tmp/$BIN_NAME"
+	mv "$tmp/$BIN_NAME" "$dir/$BIN_NAME" || err "could not install to $dir"
+	info "installed $BIN_NAME $version -> $dir/$BIN_NAME"
+
+	case ":${PATH:-}:" in
+	*":$dir:"*) ;;
+	*) info "note: $dir is not on your PATH. Add it, e.g.:  export PATH=\"$dir:\$PATH\"" ;;
+	esac
+}
+
+main "$@"
@@ -30,9 +30,7 @@ use std::path::{Component, Path, PathBuf};
 use tracing::{debug, info};
 use zip::{CompressionMethod, ZipArchive, ZipWriter, write::SimpleFileOptions};

-use crate::project::{
-    HISTORY_LOG, PLAYGROUND_DB, PROJECT_YAML, naming::today_local,
-};
+use crate::project::{HISTORY_LOG, PLAYGROUND_DB, PROJECT_YAML, naming::today_local};

 /// File names excluded from `export` zips. These are either
 /// derived (`playground.db`), per-process (`.lock`),
@@ -118,20 +116,14 @@ impl std::fmt::Display for ArchiveError {
                    limit = format_args!("{limit:02}"),
                ))
            }
-            Self::InvalidZip(detail) => f.write_str(&crate::t!(
-                "archive.invalid_zip",
-                detail = detail,
-            )),
-            Self::NotAProjectArchive => {
-                f.write_str(&crate::t!("archive.not_a_project_archive"))
+            Self::InvalidZip(detail) => {
+                f.write_str(&crate::t!("archive.invalid_zip", detail = detail,))
            }
-            Self::MultipleTopFolders => {
-                f.write_str(&crate::t!("archive.multiple_top_folders"))
+            Self::NotAProjectArchive => f.write_str(&crate::t!("archive.not_a_project_archive")),
+            Self::MultipleTopFolders => f.write_str(&crate::t!("archive.multiple_top_folders")),
+            Self::UnsafeEntry(entry) => {
+                f.write_str(&crate::t!("archive.unsafe_entry", entry = entry,))
            }
-            Self::UnsafeEntry(entry) => f.write_str(&crate::t!(
-                "archive.unsafe_entry",
-                entry = entry,
-            )),
        }
    }
 }
@@ -216,13 +208,7 @@ pub fn export_project(
        .unix_permissions(0o644);

    add_directory_entry(&mut writer, project_name, dst_zip)?;
-    add_directory_recursive(
-        &mut writer,
-        project_path,
-        project_name,
-        &options,
-        dst_zip,
-    )?;
+    add_directory_recursive(&mut writer, project_path, project_name, &options, dst_zip)?;

    writer.finish().map_err(|e| ArchiveError::Zip {
        path: dst_zip.to_path_buf(),
@@ -392,10 +378,7 @@ pub struct ZipInspection {
 ///
 /// Returns the resolved target path and the suffix that was
 /// applied (0 if the original name was free, 2..=99 otherwise).
-pub fn resolve_import_target(
-    parent: &Path,
-    name: &str,
-) -> Result<(PathBuf, u32), ArchiveError> {
+pub fn resolve_import_target(parent: &Path, name: &str) -> Result<(PathBuf, u32), ArchiveError> {
    let direct = parent.join(name);
    if !direct.exists() {
        return Ok((direct, 0));
@@ -495,10 +478,12 @@ pub fn extract_into(
                source,
            })?;
            let mut buf = Vec::with_capacity(entry.size() as usize);
-            entry.read_to_end(&mut buf).map_err(|source| ArchiveError::Io {
-                path: dst_path.clone(),
-                source,
-            })?;
+            entry
+                .read_to_end(&mut buf)
+                .map_err(|source| ArchiveError::Io {
+                    path: dst_path.clone(),
+                    source,
+                })?;
            out.write_all(&buf).map_err(|source| ArchiveError::Io {
                path: dst_path.clone(),
                source,
@@ -523,7 +508,11 @@ mod tests {
        fs::write(p.join(PROJECT_YAML), "version: 1\nproject:\n  created_at: 2026-01-01T00:00:00Z\ntables: []\nrelationships: []\n").unwrap();
        fs::create_dir_all(p.join("data")).unwrap();
        fs::write(p.join("data/Customers.csv"), "Name\nAlice\nBob\n").unwrap();
-        fs::write(p.join(HISTORY_LOG), "T|ok|create table Customers with pk id(serial)\n").unwrap();
+        fs::write(
+            p.join(HISTORY_LOG),
+            "T|ok|create table Customers with pk id(serial)\n",
+        )
+        .unwrap();
        fs::write(p.join(PLAYGROUND_DB), [0u8; 32]).unwrap();
        fs::write(p.join(GITIGNORE), "/playground.db\n").unwrap();
        // Stray atomic-write staging file — must be excluded.
@@ -536,7 +525,9 @@ mod tests {
        )
        .unwrap();
        fs::write(
-            p.join(crate::undo::SNAPSHOTS_DIR).join("0").join(PLAYGROUND_DB),
+            p.join(crate::undo::SNAPSHOTS_DIR)
+                .join("0")
+                .join(PLAYGROUND_DB),
            [0u8; 16],
        )
        .unwrap();
@@ -618,11 +609,15 @@ mod tests {
        let zip_path = tmp.path().join("notaproject.zip");
        let f = fs::File::create(&zip_path).unwrap();
        let mut w = ZipWriter::new(f);
-        w.start_file("foo/bar.txt", SimpleFileOptions::default()).unwrap();
+        w.start_file("foo/bar.txt", SimpleFileOptions::default())
+            .unwrap();
        w.write_all(b"hi").unwrap();
        w.finish().unwrap();
        let err = inspect_zip(&zip_path).expect_err("must refuse");
-        assert!(matches!(err, ArchiveError::NotAProjectArchive), "got: {err:?}");
+        assert!(
+            matches!(err, ArchiveError::NotAProjectArchive),
+            "got: {err:?}"
+        );
    }

    #[test]
@@ -631,13 +626,18 @@ mod tests {
        let zip_path = tmp.path().join("multi.zip");
        let f = fs::File::create(&zip_path).unwrap();
        let mut w = ZipWriter::new(f);
-        w.start_file("a/project.yaml", SimpleFileOptions::default()).unwrap();
+        w.start_file("a/project.yaml", SimpleFileOptions::default())
+            .unwrap();
        w.write_all(b"x").unwrap();
-        w.start_file("b/project.yaml", SimpleFileOptions::default()).unwrap();
+        w.start_file("b/project.yaml", SimpleFileOptions::default())
+            .unwrap();
        w.write_all(b"x").unwrap();
        w.finish().unwrap();
        let err = inspect_zip(&zip_path).expect_err("must refuse");
-        assert!(matches!(err, ArchiveError::MultipleTopFolders), "got: {err:?}");
+        assert!(
+            matches!(err, ArchiveError::MultipleTopFolders),
+            "got: {err:?}"
+        );
    }

    #[test]
@@ -30,6 +30,10 @@ pub struct Args {
    /// `--help` / `-h`: print usage to stdout and exit. The
    /// runtime checks this flag before doing any other work.
    pub help: bool,
+    /// `--version` / `-V`: print the version (`CARGO_PKG_VERSION`,
+    /// the single source of truth — ADR-0054) and exit. Checked
+    /// alongside `--help` before any other work.
+    pub version: bool,
    /// `--no-undo`: disable the auto-snapshot / undo machinery for
    /// this run (ADR-0006 Amendment 1). When set, no snapshots are
    /// taken — zero per-command overhead — and `undo` / `redo`
@@ -62,6 +66,17 @@ pub fn help_text() -> String {
    crate::t!("help.cli_banner")
 }

+/// Version line printed by `--version` / `-V` and the in-app `version`
+/// command (ADR-0054).
+///
+/// `CARGO_PKG_VERSION` is the single source of truth — it equals the `v*`
+/// release tag (the release CI guards that), so what the binary reports
+/// always matches the downloaded artifact.
+#[must_use]
+pub fn version_text() -> String {
+    crate::t!("cli.version_line", version = env!("CARGO_PKG_VERSION"))
+}
+
 #[derive(Debug)]
 pub enum ArgsError {
    MissingValue(&'static str),
@@ -81,10 +96,7 @@ pub enum ArgsError {
 impl std::fmt::Display for ArgsError {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        match self {
-            Self::MissingValue(flag) => f.write_str(&crate::t!(
-                "cli.missing_value",
-                flag = flag,
-            )),
+            Self::MissingValue(flag) => f.write_str(&crate::t!("cli.missing_value", flag = flag,)),
            Self::InvalidValue {
                flag,
                value,
@@ -95,10 +107,7 @@ impl std::fmt::Display for ArgsError {
                value = value,
                expected = expected,
            )),
-            Self::Unknown(arg) => f.write_str(&crate::t!(
-                "cli.unknown_argument",
-                arg = arg,
-            )),
+            Self::Unknown(arg) => f.write_str(&crate::t!("cli.unknown_argument", arg = arg,)),
            Self::MultiplePaths { first, second } => f.write_str(&crate::t!(
                "cli.multiple_paths",
                first = first,
@@ -129,6 +138,7 @@ impl Args {
        let mut project_path: Option<PathBuf> = None;
        let mut resume = false;
        let mut help = false;
+        let mut version = false;
        let mut no_undo = false;
        let mut mode: Option<Mode> = None;
        // Demonstration mode (ADR-0047): the env var is the default,
@@ -143,6 +153,9 @@ impl Args {
                "--help" | "-h" => {
                    help = true;
                }
+                "--version" | "-V" => {
+                    version = true;
+                }
                "--resume" => {
                    resume = true;
                }
@@ -208,6 +221,7 @@ impl Args {
            project_path,
            resume,
            help,
+            version,
            no_undo,
            mode,
            demo,
@@ -241,7 +255,11 @@ fn default_theme() -> Theme {
        // Standard convention: 0..=6 and 8 are dark backgrounds,
        // 7 and 9..=15 are light. ITerm emits 15 for white-ish.
        let is_dark = matches!(code, 0..=6 | 8);
-        return if is_dark { Theme::dark() } else { Theme::light() };
+        return if is_dark {
+            Theme::dark()
+        } else {
+            Theme::light()
+        };
    }
    Theme::default()
 }
@@ -294,10 +312,19 @@ mod tests {

    #[test]
    fn mode_flag_simple_and_advanced() {
-        assert_eq!(Args::parse(["--mode", "simple"]).unwrap().mode, Some(Mode::Simple));
-        assert_eq!(Args::parse(["--mode", "advanced"]).unwrap().mode, Some(Mode::Advanced));
+        assert_eq!(
+            Args::parse(["--mode", "simple"]).unwrap().mode,
+            Some(Mode::Simple)
+        );
+        assert_eq!(
+            Args::parse(["--mode", "advanced"]).unwrap().mode,
+            Some(Mode::Advanced)
+        );
        // Case-insensitive, like the `mode` command.
-        assert_eq!(Args::parse(["--mode", "ADVANCED"]).unwrap().mode, Some(Mode::Advanced));
+        assert_eq!(
+            Args::parse(["--mode", "ADVANCED"]).unwrap().mode,
+            Some(Mode::Advanced)
+        );
    }

    #[test]
@@ -330,7 +357,10 @@ mod tests {
    #[test]
    fn data_dir_flag_parses() {
        let args = Args::parse(["--data-dir", "/tmp/playground-data"]).unwrap();
-        assert_eq!(args.data_dir.as_deref(), Some(std::path::Path::new("/tmp/playground-data")));
+        assert_eq!(
+            args.data_dir.as_deref(),
+            Some(std::path::Path::new("/tmp/playground-data"))
+        );
    }

    #[test]
@@ -350,13 +380,11 @@ mod tests {

    #[test]
    fn data_dir_and_positional_can_coexist() {
-        let args = Args::parse([
-            "--data-dir",
-            "/tmp/data",
-            "/home/me/MyProject",
-        ])
-        .unwrap();
-        assert_eq!(args.data_dir.as_deref(), Some(std::path::Path::new("/tmp/data")));
+        let args = Args::parse(["--data-dir", "/tmp/data", "/home/me/MyProject"]).unwrap();
+        assert_eq!(
+            args.data_dir.as_deref(),
+            Some(std::path::Path::new("/tmp/data"))
+        );
        assert_eq!(
            args.project_path.as_deref(),
            Some(std::path::Path::new("/home/me/MyProject"))
@@ -366,7 +394,10 @@ mod tests {
    #[test]
    fn two_positional_paths_error() {
        let err = Args::parse(["/a", "/b"]).unwrap_err();
-        assert!(matches!(err, ArgsError::MultiplePaths { .. }), "got: {err:?}");
+        assert!(
+            matches!(err, ArgsError::MultiplePaths { .. }),
+            "got: {err:?}"
+        );
    }

    #[test]
@@ -435,7 +466,10 @@ mod tests {
        // Absent `--demo` (and absent env var in the test runner),
        // demo mode is off — zero footprint for real users.
        let args = Args::parse(std::iter::empty::<&str>()).unwrap();
-        assert!(!args.demo, "demo is off unless --demo or the env var is given");
+        assert!(
+            !args.demo,
+            "demo is off unless --demo or the env var is given"
+        );
    }

    #[test]
@@ -464,7 +498,10 @@ mod tests {
        }
        // Disabling values.
        for v in ["", "  ", "0", "false", "False", "no", "off", "OFF"] {
-            assert!(!demo_value_is_truthy(v), "{v:?} should not enable demo mode");
+            assert!(
+                !demo_value_is_truthy(v),
+                "{v:?} should not enable demo mode"
+            );
        }
    }

@@ -473,6 +510,38 @@ mod tests {
        // Make sure the path-vs-flag distinction is robust:
        // unknown flags don't get silently swallowed as paths.
        let err = Args::parse(["--bogus", "/some/path"]).unwrap_err();
-        assert!(matches!(&err, ArgsError::Unknown(s) if s == "--bogus"), "got: {err:?}");
+        assert!(
+            matches!(&err, ArgsError::Unknown(s) if s == "--bogus"),
+            "got: {err:?}"
+        );
+    }
+
+    // ---- ADR-0054: --version / -V ----
+
+    #[test]
+    fn version_long_flag_parses() {
+        assert!(Args::parse(["--version"]).unwrap().version);
+    }
+
+    #[test]
+    fn version_short_flag_parses() {
+        assert!(Args::parse(["-V"]).unwrap().version);
+    }
+
+    #[test]
+    fn version_defaults_off() {
+        assert!(!Args::parse(std::iter::empty::<&str>()).unwrap().version);
+    }
+
+    #[test]
+    fn version_text_carries_the_cargo_version() {
+        // The binary's self-reported version IS Cargo.toml's (the
+        // single source of truth, ADR-0054) — and the release CI guards
+        // that the `v*` tag equals it.
+        let text = version_text();
+        assert!(
+            text.contains(env!("CARGO_PKG_VERSION")),
+            "version line should embed CARGO_PKG_VERSION; got {text:?}"
+        );
    }
 }
@@ -15,10 +15,10 @@
 //! `app.rs`; this module owns the candidate computation.

 use crate::dsl::grammar::IdentSource;
+use crate::dsl::parser::parse_command_with_schema_in_mode;
 use crate::dsl::types::Type;
 use crate::dsl::walker::outcome::Expectation;
 use crate::dsl::{ParseError, parse_command};
-use crate::dsl::parser::parse_command_with_schema_in_mode;
 use crate::mode::Mode;

 /// Composite literal candidates whose lexed shape is more than
@@ -275,11 +275,7 @@ pub struct Completion {
 /// (case-insensitive starts-with), combined, sorted, and
 /// deduplicated.
 #[must_use]
-pub fn candidates_at_cursor(
-    input: &str,
-    cursor: usize,
-    cache: &SchemaCache,
-) -> Option<Completion> {
+pub fn candidates_at_cursor(input: &str, cursor: usize, cache: &SchemaCache) -> Option<Completion> {
    candidates_at_cursor_in_mode(input, cursor, cache, Mode::Advanced)
 }

@@ -358,7 +354,11 @@ pub fn candidates_at_cursor_with_in_mode(
        let word_boundary = run == 0 || bytes[run - 1].is_ascii_whitespace();
        if run < cursor && bytes[run] == b'-' && word_boundary && run < start {
            let pre = crate::dsl::walker::completion_probe_in_mode(&input[..run], cache, mode);
-            if pre.expected.iter().any(|e| matches!(e, Expectation::Flag(_))) {
+            if pre
+                .expected
+                .iter()
+                .any(|e| matches!(e, Expectation::Flag(_)))
+            {
                start = run;
            }
        }
@@ -473,22 +473,19 @@ pub fn candidates_at_cursor_with_in_mode(
    // walk's `current_table_columns`; fall back to "the union of
    // the look-ahead from_scope's bindings' columns" when leading
    // produced no in-scope columns. Phase-1 DSL paths unaffected.
-    let lookahead_union_columns: Vec<TableColumn> =
-        if probe.current_table_columns.is_none() {
-            let mut out: Vec<TableColumn> = Vec::new();
-            for binding in resolution_from_scope {
-                for col in &binding.columns {
-                    if !out.iter().any(|c| {
-                        c.name.eq_ignore_ascii_case(&col.name)
-                    }) {
-                        out.push(col.clone());
-                    }
+    let lookahead_union_columns: Vec<TableColumn> = if probe.current_table_columns.is_none() {
+        let mut out: Vec<TableColumn> = Vec::new();
+        for binding in resolution_from_scope {
+            for col in &binding.columns {
+                if !out.iter().any(|c| c.name.eq_ignore_ascii_case(&col.name)) {
+                    out.push(col.clone());
                }
            }
-            out
-        } else {
-            Vec::new()
-        };
+        }
+        out
+    } else {
+        Vec::new()
+    };
    let lookahead_slice: Option<&[TableColumn]> = if lookahead_union_columns.is_empty() {
        None
    } else {
@@ -507,30 +504,23 @@ pub fn candidates_at_cursor_with_in_mode(
    // column list (the structural error path surfaces the
    // unresolved-prefix message).
    let prefix_qualifier = peek_back_qualifier(input, start);
-    let qualified_columns: Option<Vec<String>> = prefix_qualifier
-        .as_ref()
-        .map(|q| {
-            // ADR-0033 §9: `excluded.|` inside an `INSERT … ON
-            // CONFLICT … DO UPDATE` completes to the target table's
-            // columns — `excluded` mirrors the would-be-inserted row.
-            // The target's columns are the INSERT's
-            // `current_table_columns` (set by the target-table slot).
-            // The diagnostic pass enforces the strict DO-UPDATE
-            // byte-range; completion is the softer surface and offers
-            // the columns whenever the INSERT target is in hand.
-            if q.eq_ignore_ascii_case("excluded")
-                && let Some(cols) = current_table_columns
-            {
-                cols.iter().map(|c| c.name.clone()).collect()
-            } else {
-                resolve_qualifier_columns_in(
-                    q,
-                    resolution_from_scope,
-                    resolution_cte_bindings,
-                    cache,
-                )
-            }
-        });
+    let qualified_columns: Option<Vec<String>> = prefix_qualifier.as_ref().map(|q| {
+        // ADR-0033 §9: `excluded.|` inside an `INSERT … ON
+        // CONFLICT … DO UPDATE` completes to the target table's
+        // columns — `excluded` mirrors the would-be-inserted row.
+        // The target's columns are the INSERT's
+        // `current_table_columns` (set by the target-table slot).
+        // The diagnostic pass enforces the strict DO-UPDATE
+        // byte-range; completion is the softer surface and offers
+        // the columns whenever the INSERT target is in hand.
+        if q.eq_ignore_ascii_case("excluded")
+            && let Some(cols) = current_table_columns
+        {
+            cols.iter().map(|c| c.name.clone()).collect()
+        } else {
+            resolve_qualifier_columns_in(q, resolution_from_scope, resolution_cte_bindings, cache)
+        }
+    });

    let expected = if probe.expected.is_empty() {
        expected_at(leading, mode)
@@ -574,8 +564,7 @@ pub fn candidates_at_cursor_with_in_mode(
        Some(crate::dsl::grammar::HintMode::ProseOnly(_))
    );
    if partial_prefix.is_empty()
-        && (prose_only_slot
-            || (is_value_literal_signature(&expected) && !has_schema_ident))
+        && (prose_only_slot || (is_value_literal_signature(&expected) && !has_schema_ident))
    {
        return None;
    }
@@ -646,7 +635,13 @@ pub fn candidates_at_cursor_with_in_mode(
    // shortid). The walker surfaces this as
    // `Expectation::Ident { source: Types }`.
    let type_names: Vec<String> = if expected.iter().any(|e| {
-        matches!(e, Expectation::Ident { source: IdentSource::Types, .. })
+        matches!(
+            e,
+            Expectation::Ident {
+                source: IdentSource::Types,
+                ..
+            }
+        )
    }) {
        Type::all()
            .iter()
@@ -725,7 +720,13 @@ pub fn candidates_at_cursor_with_in_mode(
    // filtered like every other source; empty prefix offers the whole
    // set. Tagged `CandidateKind::Function` for its own colour.
    let has_sql_expr_slot = expected.iter().any(|e| {
-        matches!(e, Expectation::Ident { role: "sql_expr_ident", .. })
+        matches!(
+            e,
+            Expectation::Ident {
+                role: "sql_expr_ident",
+                ..
+            }
+        )
    });
    let mut functions: Vec<String> = if has_sql_expr_slot {
        crate::dsl::sql_functions::KNOWN_SQL_FUNCTIONS
@@ -741,9 +742,15 @@ pub fn candidates_at_cursor_with_in_mode(
    // curated vocabulary is offered so a learner can discover `email` /
    // `product` / … by Tab. Same `Function` kind / `tok_function` colour
    // as SQL functions (no new theme colour — ADR-0048 §Grammar).
-    let has_generator_slot = expected
-        .iter()
-        .any(|e| matches!(e, Expectation::Ident { source: IdentSource::Generators, .. }));
+    let has_generator_slot = expected.iter().any(|e| {
+        matches!(
+            e,
+            Expectation::Ident {
+                source: IdentSource::Generators,
+                ..
+            }
+        )
+    });
    if has_generator_slot {
        functions.extend(
            crate::seed::KNOWN_GENERATORS
@@ -765,38 +772,36 @@ pub fn candidates_at_cursor_with_in_mode(
    // (the `typing_over_diag` path) — keeps the alias from flashing as
    // a bogus "unknown column" while typing. Mixed into `identifiers`
    // so it sorts/dedups/colours uniformly with column candidates.
-    let alias_candidates: Vec<String> =
-        if has_sql_expr_slot && prefix_qualifier.is_none() {
-            // Once the partial *exactly* matches an in-scope qualifier,
-            // discoverability is served — the learner has a whole alias
-            // in hand and now needs the "add `.column`" hint
-            // (`diagnostic.alias_used_as_column`), not sibling aliases
-            // that merely share the prefix. Offering them would also let
-            // the `typing_over_diag` path suppress that very hint. So in
-            // the exact-match case we emit no alias candidates and let
-            // the targeted diagnostic surface.
-            let partial_is_exact_alias = resolution_from_scope.iter().any(|b| {
-                let q = b.alias.as_deref().unwrap_or(b.table.as_str());
-                q.eq_ignore_ascii_case(&partial_prefix)
-            });
-            if partial_is_exact_alias {
-                Vec::new()
-            } else {
-                let mut out: Vec<String> = Vec::new();
-                for binding in resolution_from_scope {
-                    let qualifier =
-                        binding.alias.as_deref().unwrap_or(binding.table.as_str());
-                    if matches_prefix(qualifier)
-                        && !out.iter().any(|q| q.eq_ignore_ascii_case(qualifier))
-                    {
-                        out.push(qualifier.to_string());
-                    }
-                }
-                out
-            }
-        } else {
+    let alias_candidates: Vec<String> = if has_sql_expr_slot && prefix_qualifier.is_none() {
+        // Once the partial *exactly* matches an in-scope qualifier,
+        // discoverability is served — the learner has a whole alias
+        // in hand and now needs the "add `.column`" hint
+        // (`diagnostic.alias_used_as_column`), not sibling aliases
+        // that merely share the prefix. Offering them would also let
+        // the `typing_over_diag` path suppress that very hint. So in
+        // the exact-match case we emit no alias candidates and let
+        // the targeted diagnostic surface.
+        let partial_is_exact_alias = resolution_from_scope.iter().any(|b| {
+            let q = b.alias.as_deref().unwrap_or(b.table.as_str());
+            q.eq_ignore_ascii_case(&partial_prefix)
+        });
+        if partial_is_exact_alias {
            Vec::new()
-        };
+        } else {
+            let mut out: Vec<String> = Vec::new();
+            for binding in resolution_from_scope {
+                let qualifier = binding.alias.as_deref().unwrap_or(binding.table.as_str());
+                if matches_prefix(qualifier)
+                    && !out.iter().any(|q| q.eq_ignore_ascii_case(qualifier))
+                {
+                    out.push(qualifier.to_string());
+                }
+            }
+            out
+        }
+    } else {
+        Vec::new()
+    };

    // Source 2: schema identifiers — accumulated across every
    // matching schema-listable `Ident { source }` expectation.
@@ -811,9 +816,7 @@ pub fn candidates_at_cursor_with_in_mode(
    let mut identifiers: Vec<String> = expected
        .iter()
        .filter_map(|e| match e {
-            Expectation::Ident { source, .. } if source.completes_from_schema() => {
-                Some(*source)
-            }
+            Expectation::Ident { source, .. } if source.completes_from_schema() => Some(*source),
            _ => None,
        })
        .flat_map(|source| {
@@ -1007,11 +1010,7 @@ fn resolve_qualifier_columns_in(
            .iter()
            .find(|c| c.name.eq_ignore_ascii_case(&binding.table))
        {
-            return cte
-                .columns
-                .iter()
-                .filter_map(|c| c.name.clone())
-                .collect();
+            return cte.columns.iter().filter_map(|c| c.name.clone()).collect();
        }
    }
    // Second: table-name match in the active from_scope.
@@ -1026,11 +1025,7 @@ fn resolve_qualifier_columns_in(
            .iter()
            .find(|c| c.name.eq_ignore_ascii_case(&binding.table))
        {
-            return cte
-                .columns
-                .iter()
-                .filter_map(|c| c.name.clone())
-                .collect();
+            return cte.columns.iter().filter_map(|c| c.name.clone()).collect();
        }
    }
    // Third: direct cte_bindings match (cte_alias.|).
@@ -1038,11 +1033,7 @@ fn resolve_qualifier_columns_in(
        .iter()
        .find(|c| c.name.eq_ignore_ascii_case(qualifier))
    {
-        return cte
-            .columns
-            .iter()
-            .filter_map(|c| c.name.clone())
-            .collect();
+        return cte.columns.iter().filter_map(|c| c.name.clone()).collect();
    }
    // Fourth: a bare table name from the schema cache — DSL
    // paths reach this for `from <Table>.<col>` shapes where
@@ -1287,7 +1278,13 @@ pub fn invalid_ident_at_cursor_in_mode(
    // column. So `select Agx` warns at typing time again, while
    // `select sum` does not.
    let has_sql_expr_slot = expected.iter().any(|e| {
-        matches!(e, Expectation::Ident { role: "sql_expr_ident", .. })
+        matches!(
+            e,
+            Expectation::Ident {
+                role: "sql_expr_ident",
+                ..
+            }
+        )
    });
    if has_sql_expr_slot && crate::dsl::sql_functions::is_known_function_prefix(partial) {
        return None;
@@ -1318,9 +1315,15 @@ pub fn invalid_ident_at_cursor_in_mode(
    // schema-column check below would never see it. A partial that
    // prefix-matches a known generator is an in-progress name; anything
    // else is an unknown generator → flag it `[ERR]` while typing.
-    let has_generator_slot = expected
-        .iter()
-        .any(|e| matches!(e, Expectation::Ident { source: IdentSource::Generators, .. }));
+    let has_generator_slot = expected.iter().any(|e| {
+        matches!(
+            e,
+            Expectation::Ident {
+                source: IdentSource::Generators,
+                ..
+            }
+        )
+    });
    if has_generator_slot {
        if crate::seed::is_known_generator_prefix(partial) {
            return None;
@@ -1335,9 +1338,7 @@ pub fn invalid_ident_at_cursor_in_mode(
    let sources: Vec<IdentSource> = expected
        .iter()
        .filter_map(|e| match e {
-            Expectation::Ident { source, .. } if source.completes_from_schema() => {
-                Some(*source)
-            }
+            Expectation::Ident { source, .. } if source.completes_from_schema() => Some(*source),
            _ => None,
        })
        .collect();
@@ -1412,13 +1413,15 @@ mod tests {
    use pretty_assertions::assert_eq;

    fn cands(input: &str, cursor: usize) -> Vec<String> {
-        candidates_at_cursor(input, cursor, &SchemaCache::default())
-            .map_or_else(Vec::new, |c| c.candidates.into_iter().map(|c| c.text).collect())
+        candidates_at_cursor(input, cursor, &SchemaCache::default()).map_or_else(Vec::new, |c| {
+            c.candidates.into_iter().map(|c| c.text).collect()
+        })
    }

    fn cands_with(input: &str, cursor: usize, cache: &SchemaCache) -> Vec<String> {
-        candidates_at_cursor(input, cursor, cache)
-            .map_or_else(Vec::new, |c| c.candidates.into_iter().map(|c| c.text).collect())
+        candidates_at_cursor(input, cursor, cache).map_or_else(Vec::new, |c| {
+            c.candidates.into_iter().map(|c| c.text).collect()
+        })
    }

    /// Simple-mode completion candidates — the DSL surface
@@ -1429,7 +1432,9 @@ mod tests {
    /// Advanced mode surfaces the SQL grammar's completions instead.
    fn cands_simple(input: &str, cursor: usize) -> Vec<String> {
        candidates_at_cursor_in_mode(input, cursor, &SchemaCache::default(), Mode::Simple)
-            .map_or_else(Vec::new, |c| c.candidates.into_iter().map(|c| c.text).collect())
+            .map_or_else(Vec::new, |c| {
+                c.candidates.into_iter().map(|c| c.text).collect()
+            })
    }

    fn cand_kinds_with(
@@ -1438,10 +1443,7 @@ mod tests {
        cache: &SchemaCache,
    ) -> Vec<(String, CandidateKind)> {
        candidates_at_cursor(input, cursor, cache).map_or_else(Vec::new, |c| {
-            c.candidates
-                .into_iter()
-                .map(|c| (c.text, c.kind))
-                .collect()
+            c.candidates.into_iter().map(|c| (c.text, c.kind)).collect()
        })
    }

@@ -1503,12 +1505,21 @@ mod tests {
        // Simple-only (column, relationship, constraint).
        let cs = cands("drop ", 5);
        for kw in ["table", "index", "column", "relationship", "constraint"] {
-            assert!(cs.contains(&kw.to_string()), "`drop ` should offer `{kw}`; got {cs:?}");
+            assert!(
+                cs.contains(&kw.to_string()),
+                "`drop ` should offer `{kw}`; got {cs:?}"
+            );
        }
        // Both-mode continuations block before the simple-only ones.
        let pos = |k: &str| cs.iter().position(|c| c == k).unwrap();
-        assert!(pos("table") < pos("column"), "Both block precedes Simple block: {cs:?}");
-        assert!(pos("index") < pos("relationship"), "Both block precedes Simple block: {cs:?}");
+        assert!(
+            pos("table") < pos("column"),
+            "Both block precedes Simple block: {cs:?}"
+        );
+        assert!(
+            pos("index") < pos("relationship"),
+            "Both block precedes Simple block: {cs:?}"
+        );
    }

    #[test]
@@ -1631,8 +1642,14 @@ mod tests {
        let c = candidates_at_cursor(input, input.len(), &SchemaCache::default())
            .expect("a `-` at a flag position offers candidates");
        let texts: Vec<&str> = c.candidates.iter().map(|x| x.text.as_str()).collect();
-        assert!(texts.contains(&"--create-fk"), "should offer --create-fk: {texts:?}");
-        assert!(!texts.contains(&"on"), "must NOT offer `on` after a dash: {texts:?}");
+        assert!(
+            texts.contains(&"--create-fk"),
+            "should offer --create-fk: {texts:?}"
+        );
+        assert!(
+            !texts.contains(&"on"),
+            "must NOT offer `on` after a dash: {texts:?}"
+        );
        assert_eq!(
            c.replaced_range,
            (input.len() - 1, input.len()),
@@ -1643,13 +1660,9 @@ mod tests {
    #[test]
    fn double_dash_replaces_both_dashes_on_accept() {
        let input = "delete from T --";
-        let c = candidates_at_cursor_in_mode(
-            input,
-            input.len(),
-            &SchemaCache::default(),
-            Mode::Simple,
-        )
-        .expect("`--` offers the flag");
+        let c =
+            candidates_at_cursor_in_mode(input, input.len(), &SchemaCache::default(), Mode::Simple)
+                .expect("`--` offers the flag");
        assert!(c.candidates.iter().any(|x| x.text == "--all-rows"));
        assert_eq!(
            c.replaced_range,
@@ -1668,9 +1681,7 @@ mod tests {
        s.tables.push("T".into());
        s.columns.push("x".into());
        let input = "show data T where x = -5";
-        if let Some(c) =
-            candidates_at_cursor_in_mode(input, input.len(), &s, Mode::Simple)
-        {
+        if let Some(c) = candidates_at_cursor_in_mode(input, input.len(), &s, Mode::Simple) {
            assert!(
                !c.candidates.iter().any(|x| x.text.starts_with("--")),
                "no flags at a value position: {:?}",
@@ -1715,8 +1726,8 @@ mod tests {
        // App-lifecycle commands now appear alongside DSL
        // commands in the entry-keyword set.
        for expected in &[
-            "quit", "help", "rebuild", "save", "new", "load", "export",
-            "import", "mode", "messages", "undo", "redo", "copy",
+            "quit", "help", "rebuild", "save", "new", "load", "export", "import", "mode",
+            "messages", "undo", "redo", "copy",
        ] {
            assert!(
                cs.contains(&expected.to_string()),
@@ -1943,7 +1954,10 @@ mod tests {
        // opening a sub-shape) becomes a Tab candidate.
        let input = "add column to table T";
        let cs = cands(input, input.len());
-        assert!(cs.is_empty(), "trailing-content punct should not surface: {cs:?}");
+        assert!(
+            cs.is_empty(),
+            "trailing-content punct should not surface: {cs:?}"
+        );
    }

    #[test]
@@ -1957,10 +1971,7 @@ mod tests {
        assert!(cs.contains(&"(".to_string()), "got {cs:?}");
    }

-    fn schema_with_table(
-        table: &str,
-        columns: &[(&str, crate::dsl::types::Type)],
-    ) -> SchemaCache {
+    fn schema_with_table(table: &str, columns: &[(&str, crate::dsl::types::Type)]) -> SchemaCache {
        let mut cache = SchemaCache::default();
        cache.tables.push(table.to_string());
        let cols: Vec<TableColumn> = columns
@@ -2002,8 +2013,14 @@ mod tests {
        let cache = two_table_alias_cache();
        let input = "select a.id from a o join b z on o.id = z.id group by ";
        let cs = cands_with(input, input.len(), &cache);
-        assert!(cs.contains(&"o".to_string()), "alias `o` must be offered; got {cs:?}");
-        assert!(cs.contains(&"z".to_string()), "alias `z` must be offered; got {cs:?}");
+        assert!(
+            cs.contains(&"o".to_string()),
+            "alias `o` must be offered; got {cs:?}"
+        );
+        assert!(
+            cs.contains(&"z".to_string()),
+            "alias `z` must be offered; got {cs:?}"
+        );
    }

    #[test]
@@ -2015,8 +2032,14 @@ mod tests {
        let cache = two_table_alias_cache();
        let input = "select a.id from a aa join b ab on aa.id = ab.id group by a";
        let cs = cands_with(input, input.len(), &cache);
-        assert!(cs.contains(&"aa".to_string()), "alias `aa` must be offered; got {cs:?}");
-        assert!(cs.contains(&"ab".to_string()), "alias `ab` must be offered; got {cs:?}");
+        assert!(
+            cs.contains(&"aa".to_string()),
+            "alias `aa` must be offered; got {cs:?}"
+        );
+        assert!(
+            cs.contains(&"ab".to_string()),
+            "alias `ab` must be offered; got {cs:?}"
+        );

        // Exact-alias partial: the alias source steps aside.
        let exact = "select aa.id from a aa join b ab on aa.id = ab.id group by aa";
@@ -2046,19 +2069,20 @@ mod tests {
        // SchemaCache.columns has columns from many tables, but
        // at `update Customers set ` only Customers' columns
        // should appear.
-        let mut cache = schema_with_table(
-            "Customers",
-            &[("id", Type::Int), ("Email", Type::Text)],
-        );
+        let mut cache = schema_with_table("Customers", &[("id", Type::Int), ("Email", Type::Text)]);
        // Pretend the global flat list has columns from a second
        // table that aren't in Customers.
        cache.columns.push("OrderTotal".to_string());
        cache.columns.push("Stock".to_string());
-        cache
-            .table_columns
-            .insert("Orders".to_string(), vec![
-                TableColumn { name: "OrderTotal".to_string(), user_type: Type::Real, not_null: false, has_default: false },
-            ]);
+        cache.table_columns.insert(
+            "Orders".to_string(),
+            vec![TableColumn {
+                name: "OrderTotal".to_string(),
+                user_type: Type::Real,
+                not_null: false,
+                has_default: false,
+            }],
+        );
        cache.tables.push("Orders".to_string());
        let cs = cands_with("update Customers set ", 21, &cache);
        // Customers's columns should appear:
@@ -2079,10 +2103,7 @@ mod tests {
        // *before* ORDER BY (the FROM's JOIN options, WHERE /
        // GROUP BY / HAVING, set-ops). Those used to shove the
        // columns off-screen.
-        let cache = schema_with_table(
-            "Things",
-            &[("Name", Type::Text), ("Qty", Type::Int)],
-        );
+        let cache = schema_with_table("Things", &[("Name", Type::Text), ("Qty", Type::Int)]);
        let input = "select Name from Things order by ";
        let cs = cands_with(input, input.len(), &cache);
        // The columns the user wants are offered:
@@ -2090,8 +2111,19 @@ mod tests {
        assert!(cs.contains(&"Qty".to_string()), "got {cs:?}");
        // Preceding-clause keywords must not leak in:
        for kw in [
-            "where", "group", "having", "join", "union", "intersect",
-            "except", "left", "right", "full", "cross", "inner", "as",
+            "where",
+            "group",
+            "having",
+            "join",
+            "union",
+            "intersect",
+            "except",
+            "left",
+            "right",
+            "full",
+            "cross",
+            "inner",
+            "as",
        ] {
            assert!(
                !cs.contains(&kw.to_string()),
@@ -2108,10 +2140,7 @@ mod tests {
        // sort item the direction keywords surface as
        // continuations (previously discarded at the Repeated
        // boundary, so completion offered neither).
-        let cache = schema_with_table(
-            "Things",
-            &[("Name", Type::Text), ("Qty", Type::Int)],
-        );
+        let cache = schema_with_table("Things", &[("Name", Type::Text), ("Qty", Type::Int)]);
        let input = "select Name from Things order by Name ";
        let cs = cands_with(input, input.len(), &cache);
        assert!(cs.contains(&"asc".to_string()), "got {cs:?}");
@@ -2123,10 +2152,7 @@ mod tests {
        use crate::dsl::types::Type;
        // walk_repeated trailing-optional fix: after a complete
        // projection item the `as` alias keyword surfaces.
-        let cache = schema_with_table(
-            "Things",
-            &[("Name", Type::Text), ("Qty", Type::Int)],
-        );
+        let cache = schema_with_table("Things", &[("Name", Type::Text), ("Qty", Type::Int)]);
        let input = "select Name ";
        let cs = cands_with(input, input.len(), &cache);
        assert!(cs.contains(&"as".to_string()), "got {cs:?}");
@@ -2153,16 +2179,13 @@ mod tests {
        // ADR-0022 Amendment 2: at an expression position offering
        // both column names and keywords, every column precedes
        // every keyword so the names stay visible by default.
-        let cache = schema_with_table(
-            "Things",
-            &[("Name", Type::Text), ("Qty", Type::Int)],
-        );
+        let cache = schema_with_table("Things", &[("Name", Type::Text), ("Qty", Type::Int)]);
        let input = "select * from Things where ";
        let cs = cands_with(input, input.len(), &cache);
        let pos = |needle: &str| {
-            cs.iter().position(|c| c == needle).unwrap_or_else(|| {
-                panic!("{needle:?} not in candidates: {cs:?}")
-            })
+            cs.iter()
+                .position(|c| c == needle)
+                .unwrap_or_else(|| panic!("{needle:?} not in candidates: {cs:?}"))
        };
        // Both columns come before any expression-start keyword.
        let last_ident = pos("Name").max(pos("Qty"));
@@ -2176,13 +2199,9 @@ mod tests {
    #[test]
    fn update_where_offers_only_current_table_columns() {
        use crate::dsl::types::Type;
-        let mut cache = schema_with_table(
-            "Customers",
-            &[("id", Type::Int), ("Email", Type::Text)],
-        );
+        let mut cache = schema_with_table("Customers", &[("id", Type::Int), ("Email", Type::Text)]);
        cache.columns.push("OrderTotal".to_string());
-        let cs =
-            cands_with("update Customers set Email='x' where ", 37, &cache);
+        let cs = cands_with("update Customers set Email='x' where ", 37, &cache);
        assert!(cs.contains(&"id".to_string()), "got {cs:?}");
        assert!(cs.contains(&"Email".to_string()), "got {cs:?}");
        assert!(!cs.contains(&"OrderTotal".to_string()), "got {cs:?}");
@@ -2208,7 +2227,11 @@ mod tests {
        use crate::dsl::types::Type;
        let cache = schema_with_table(
            "Customers",
-            &[("id", Type::Int), ("Email", Type::Text), ("Name", Type::Text)],
+            &[
+                ("id", Type::Int),
+                ("Email", Type::Text),
+                ("Name", Type::Text),
+            ],
        );
        let cs = cands_with("insert into Customers (", 23, &cache);
        // The user is at Form A's column-list position. All
@@ -2222,10 +2245,7 @@ mod tests {
    #[test]
    fn insert_into_open_paren_does_not_offer_unrelated_columns() {
        use crate::dsl::types::Type;
-        let mut cache = schema_with_table(
-            "Customers",
-            &[("id", Type::Int), ("Email", Type::Text)],
-        );
+        let mut cache = schema_with_table("Customers", &[("id", Type::Int), ("Email", Type::Text)]);
        cache.columns.push("OrderTotal".to_string());
        let cs = cands_with("insert into Customers (", 23, &cache);
        assert!(!cs.contains(&"OrderTotal".to_string()), "got {cs:?}");
@@ -2239,13 +2259,9 @@ mod tests {
        // table's columns. `OrderTotal` belongs to no table in
        // this cache's `table_columns`, so it must not leak.
        use crate::dsl::types::Type;
-        let mut cache = schema_with_table(
-            "Customers",
-            &[("id", Type::Int), ("Email", Type::Text)],
-        );
+        let mut cache = schema_with_table("Customers", &[("id", Type::Int), ("Email", Type::Text)]);
        cache.columns.push("OrderTotal".to_string());
-        let cs =
-            cands_with("drop column from Customers: ", 28, &cache);
+        let cs = cands_with("drop column from Customers: ", 28, &cache);
        assert!(cs.contains(&"Email".to_string()), "got {cs:?}");
        assert!(cs.contains(&"id".to_string()), "got {cs:?}");
        assert!(
@@ -2271,8 +2287,8 @@ mod tests {

    #[test]
    fn cursor_mid_keyword_replaces_only_the_partial_prefix() {
-        let comp = candidates_at_cursor("cre", 3, &SchemaCache::default())
-            .expect("some completion");
+        let comp =
+            candidates_at_cursor("cre", 3, &SchemaCache::default()).expect("some completion");
        assert_eq!(comp.replaced_range, (0, 3));
        assert_eq!(comp.partial_prefix, "cre");
        assert_eq!(comp.candidates.len(), 1);
@@ -2282,8 +2298,8 @@ mod tests {

    #[test]
    fn cursor_at_word_boundary_has_empty_partial_prefix() {
-        let comp = candidates_at_cursor("create ", 7, &SchemaCache::default())
-            .expect("some completion");
+        let comp =
+            candidates_at_cursor("create ", 7, &SchemaCache::default()).expect("some completion");
        assert_eq!(comp.replaced_range, (7, 7));
        assert_eq!(comp.partial_prefix, "");
    }
@@ -2517,8 +2533,8 @@ mod tests {
        // inside `Name`, and substituting any name there
        // produces a complete command. No useful "next after
        // name" hint.
-        let t = typing_name_at_cursor("add column to table T: Name (text)", 27)
-            .expect("should fire");
+        let t =
+            typing_name_at_cursor("add column to table T: Name (text)", 27).expect("should fire");
        assert_eq!(t.next_after_name, None);
    }

@@ -2534,8 +2550,8 @@ mod tests {
        assert!(invalid_ident_at_cursor("show data Cust", 14, &cache).is_none());
        // `show data Cust` plus a typo: `show data Custp`. No
        // table starts with "Custp" → invalid.
-        let invalid = invalid_ident_at_cursor("show data Custp", 15, &cache)
-            .expect("should be invalid");
+        let invalid =
+            invalid_ident_at_cursor("show data Custp", 15, &cache).expect("should be invalid");
        assert_eq!(invalid.range, (10, 15));
        assert_eq!(invalid.found, "Custp");
        assert_eq!(invalid.source, IdentSource::Tables);
@@ -2600,7 +2616,11 @@ mod tests {
            !cs.iter().any(|c| c == "Existing" || c == "AlsoExisting"),
            "NewName slot must not surface schema candidates; got {cs:?}"
        );
-        assert_eq!(cs, vec!["if".to_string()], "only the advanced IF NOT EXISTS keyword");
+        assert_eq!(
+            cs,
+            vec!["if".to_string()],
+            "only the advanced IF NOT EXISTS keyword"
+        );
    }

    fn keyword_cand(text: &str) -> Candidate {
@@ -2791,8 +2811,10 @@ mod tests {
        let cands = candidates_at_cursor(input, input.len(), &cache)
            .expect("some completion")
            .candidates;
-        let count_entries: Vec<_> =
-            cands.iter().filter(|c| c.text.eq_ignore_ascii_case("count")).collect();
+        let count_entries: Vec<_> = cands
+            .iter()
+            .filter(|c| c.text.eq_ignore_ascii_case("count"))
+            .collect();
        assert_eq!(
            count_entries.len(),
            1,
@@ -2805,7 +2827,9 @@ mod tests {
        );
        // A non-colliding function at the same slot is unaffected.
        assert!(
-            cands.iter().any(|c| c.text == "coalesce" && c.kind == CandidateKind::Function),
+            cands
+                .iter()
+                .any(|c| c.text == "coalesce" && c.kind == CandidateKind::Function),
            "non-colliding functions still surface; got {cands:?}",
        );
    }
@@ -2875,8 +2899,10 @@ mod tests {
        let mut s = SchemaCache::default();
        s.tables.push("OrderLines".into());
        s.columns.push("count".into());
-        s.table_columns
-            .insert("OrderLines".into(), vec![TableColumn::new("count", Type::Int)]);
+        s.table_columns.insert(
+            "OrderLines".into(),
+            vec![TableColumn::new("count", Type::Int)],
+        );
        let input = "select sum(ol.count) from OrderLines ol";
        let cursor = input.find("ol.count").unwrap() + 2; // right after `ol`
        assert!(
@@ -2938,15 +2964,35 @@ mod tests {
        s.table_columns.insert(
            "a".to_string(),
            vec![
-                TableColumn { name: "id".to_string(), user_type: Type::Int, not_null: false, has_default: false },
-                TableColumn { name: "name".to_string(), user_type: Type::Text, not_null: false, has_default: false },
+                TableColumn {
+                    name: "id".to_string(),
+                    user_type: Type::Int,
+                    not_null: false,
+                    has_default: false,
+                },
+                TableColumn {
+                    name: "name".to_string(),
+                    user_type: Type::Text,
+                    not_null: false,
+                    has_default: false,
+                },
            ],
        );
        s.table_columns.insert(
            "b".to_string(),
            vec![
-                TableColumn { name: "id".to_string(), user_type: Type::Int, not_null: false, has_default: false },
-                TableColumn { name: "total".to_string(), user_type: Type::Real, not_null: false, has_default: false },
+                TableColumn {
+                    name: "id".to_string(),
+                    user_type: Type::Int,
+                    not_null: false,
+                    has_default: false,
+                },
+                TableColumn {
+                    name: "total".to_string(),
+                    user_type: Type::Real,
+                    not_null: false,
+                    has_default: false,
+                },
            ],
        );
        s
@@ -3191,5 +3237,3 @@ mod tests {
        assert!(candidates_at_cursor_with("create ", 7, &cache, empty_ranker).is_none());
    }
 }
-
-
@@ -549,14 +549,16 @@ pub enum AppCommand {
    /// word like `insert` / `create` / `show`, or `types`), the
    /// focused detail for that command (or command group sharing
    /// the entry word).
-    Help {
-        topic: Option<String>,
-    },
+    Help { topic: Option<String> },
    /// Show a contextual tier-3 hint (H2 / ADR-0053). No argument:
    /// when submitted, it expands on the most recent runtime error
    /// (the buffer is empty post-submit). The live-input surface is
    /// the F1 keybinding, handled in `App::handle_key`, not here.
    Hint,
+    /// Print the application version (ADR-0054): the in-app twin of the
+    /// `--version` / `-V` CLI flag. Emits `CARGO_PKG_VERSION` — the same
+    /// single source of truth — into the output panel.
+    Version,
    /// Rebuild `playground.db` from `project.yaml` + data/, with
    /// confirmation modal.
    Rebuild,
@@ -576,7 +578,10 @@ pub enum AppCommand {
    /// Unpack a zip into a new project and switch to it.
    /// `target` overrides the project name (default: taken from
    /// the zip).
-    Import { path: String, target: Option<String> },
+    Import {
+        path: String,
+        target: Option<String>,
+    },
    /// Switch the persistent input mode.
    Mode { value: ModeValue },
    /// Show or set the messages verbosity.
@@ -787,9 +792,7 @@ impl PartialEq for Operand {
    fn eq(&self, other: &Self) -> bool {
        match (self, other) {
            (Self::Column { name: a, .. }, Self::Column { name: b, .. }) => a == b,
-            (Self::Literal { value: a, .. }, Self::Literal { value: b, .. }) => {
-                a == b
-            }
+            (Self::Literal { value: a, .. }, Self::Literal { value: b, .. }) => a == b,
            _ => false,
        }
    }
@@ -813,7 +816,9 @@ pub enum CompareOp {
 /// a single row in the metadata table.
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub enum RelationshipSelector {
-    Named { name: String },
+    Named {
+        name: String,
+    },
    Endpoints {
        parent_table: String,
        parent_column: String,
@@ -1019,6 +1024,7 @@ impl Command {
                AppCommand::Quit => "quit",
                AppCommand::Help { .. } => "help",
                AppCommand::Hint => "hint",
+                AppCommand::Version => "version",
                AppCommand::Rebuild => "rebuild",
                AppCommand::Save => "save",
                AppCommand::SaveAs => "save as",
@@ -1151,9 +1157,7 @@ impl Command {
                    parent_column,
                    child_table,
                    child_column,
-                } => format!(
-                    "from {parent_table}.{parent_column} to {child_table}.{child_column}"
-                ),
+                } => format!("from {parent_table}.{parent_column} to {child_table}.{child_column}"),
            },
            // A constraint command's subject is the dotted
            // `<table>.<column>` it acts on (ADR-0029 §2.2).
@@ -9,8 +9,7 @@

 use crate::dsl::command::{AppCommand, Command, CopyScope, MessagesValue, ModeValue};
 use crate::dsl::grammar::{
-    CommandNode, HintMode, IdentSource, IdentValidator, Node, ValidationError,
-    Word,
+    CommandNode, HintMode, IdentSource, IdentValidator, Node, ValidationError, Word,
 };
 use crate::dsl::walker::outcome::{MatchedKind, MatchedPath};

@@ -60,19 +59,16 @@ const IMPORT_TARGET_IDENT: Node = Node::Ident {
    writes_table: false,
    writes_column: false,
    writes_user_listed_column: false,
-writes_table_alias: false,
-writes_cte_name: false,
-writes_projection_alias: false,
+    writes_table_alias: false,
+    writes_cte_name: false,
+    writes_projection_alias: false,
 };
 const IMPORT_TARGET: Node = Node::Hinted {
    mode: HintMode::ForceProse("hint.ambient_typing_name"),
    inner: &IMPORT_TARGET_IDENT,
 };

-const IMPORT_AS_TARGET: Node = Node::Seq(&[
-    Node::Word(Word::keyword("as")),
-    IMPORT_TARGET,
-]);
+const IMPORT_AS_TARGET: Node = Node::Seq(&[Node::Word(Word::keyword("as")), IMPORT_TARGET]);
 const IMPORT_AS_TARGET_OPT: Node = Node::Optional(&IMPORT_AS_TARGET);

 const IMPORT_PATH_AND_TARGET: Node = Node::Seq(&[Node::BarePath, IMPORT_AS_TARGET_OPT]);
@@ -101,9 +97,9 @@ const MODE_CHOICES: &[Node] = &[
        writes_table: false,
        writes_column: false,
        writes_user_listed_column: false,
-    writes_table_alias: false,
-    writes_cte_name: false,
-    writes_projection_alias: false,
+        writes_table_alias: false,
+        writes_cte_name: false,
+        writes_projection_alias: false,
    },
 ];
 const MODE_VALUE: Node = Node::Choice(MODE_CHOICES);
@@ -119,9 +115,9 @@ const MESSAGES_CHOICES: &[Node] = &[
        writes_table: false,
        writes_column: false,
        writes_user_listed_column: false,
-    writes_table_alias: false,
-    writes_cte_name: false,
-    writes_projection_alias: false,
+        writes_table_alias: false,
+        writes_cte_name: false,
+        writes_projection_alias: false,
    },
 ];
 const MESSAGES_VALUE: Node = Node::Choice(MESSAGES_CHOICES);
@@ -174,6 +170,10 @@ const fn build_rebuild(_path: &MatchedPath, _source: &str) -> Result<Command, Va
    Ok(Command::App(AppCommand::Rebuild))
 }

+const fn build_version(_path: &MatchedPath, _source: &str) -> Result<Command, ValidationError> {
+    Ok(Command::App(AppCommand::Version))
+}
+
 const fn build_undo(_path: &MatchedPath, _source: &str) -> Result<Command, ValidationError> {
    Ok(Command::App(AppCommand::Undo))
 }
@@ -267,7 +267,8 @@ pub static QUIT: CommandNode = CommandNode {
    ast_builder: build_quit,
    help_id: Some("app.quit"),
    hint_ids: &["quit"],
-    usage_ids: &["parse.usage.quit"],};
+    usage_ids: &["parse.usage.quit"],
+};

 pub static HELP: CommandNode = CommandNode {
    entry: Word::keyword("help"),
@@ -275,7 +276,8 @@ pub static HELP: CommandNode = CommandNode {
    ast_builder: build_help,
    help_id: Some("app.help"),
    hint_ids: &["help"],
-    usage_ids: &["parse.usage.help"],};
+    usage_ids: &["parse.usage.help"],
+};

 pub static HINT: CommandNode = CommandNode {
    entry: Word::keyword("hint"),
@@ -284,7 +286,8 @@ pub static HINT: CommandNode = CommandNode {
    help_id: Some("app.hint"),
    // hint_id assigned in Phase C with the tier-3 corpus (ADR-0053).
    hint_ids: &["hint"],
-    usage_ids: &["parse.usage.hint"],};
+    usage_ids: &["parse.usage.hint"],
+};

 pub static REBUILD: CommandNode = CommandNode {
    entry: Word::keyword("rebuild"),
@@ -292,7 +295,17 @@ pub static REBUILD: CommandNode = CommandNode {
    ast_builder: build_rebuild,
    help_id: Some("app.rebuild"),
    hint_ids: &["rebuild"],
-    usage_ids: &["parse.usage.rebuild"],};
+    usage_ids: &["parse.usage.rebuild"],
+};
+
+pub static VERSION: CommandNode = CommandNode {
+    entry: Word::keyword("version"),
+    shape: EMPTY_SEQ,
+    ast_builder: build_version,
+    help_id: Some("app.version"),
+    hint_ids: &["version"],
+    usage_ids: &["parse.usage.version"],
+};

 pub static SAVE: CommandNode = CommandNode {
    entry: Word::keyword("save"),
@@ -300,7 +313,8 @@ pub static SAVE: CommandNode = CommandNode {
    ast_builder: build_save,
    help_id: Some("app.save"),
    hint_ids: &["save"],
-    usage_ids: &["parse.usage.save"],};
+    usage_ids: &["parse.usage.save"],
+};

 pub static NEW: CommandNode = CommandNode {
    entry: Word::keyword("new"),
@@ -308,7 +322,8 @@ pub static NEW: CommandNode = CommandNode {
    ast_builder: build_new,
    help_id: Some("app.new"),
    hint_ids: &["new"],
-    usage_ids: &["parse.usage.new"],};
+    usage_ids: &["parse.usage.new"],
+};

 pub static LOAD: CommandNode = CommandNode {
    entry: Word::keyword("load"),
@@ -316,7 +331,8 @@ pub static LOAD: CommandNode = CommandNode {
    ast_builder: build_load,
    help_id: Some("app.load"),
    hint_ids: &["load"],
-    usage_ids: &["parse.usage.load"],};
+    usage_ids: &["parse.usage.load"],
+};

 pub static EXPORT: CommandNode = CommandNode {
    entry: Word::keyword("export"),
@@ -324,7 +340,8 @@ pub static EXPORT: CommandNode = CommandNode {
    ast_builder: build_export,
    help_id: Some("app.export"),
    hint_ids: &["export"],
-    usage_ids: &["parse.usage.export"],};
+    usage_ids: &["parse.usage.export"],
+};

 pub static IMPORT: CommandNode = CommandNode {
    entry: Word::keyword("import"),
@@ -332,7 +349,8 @@ pub static IMPORT: CommandNode = CommandNode {
    ast_builder: build_import,
    help_id: Some("app.import"),
    hint_ids: &["import"],
-    usage_ids: &["parse.usage.import"],};
+    usage_ids: &["parse.usage.import"],
+};

 pub static MODE: CommandNode = CommandNode {
    entry: Word::keyword("mode"),
@@ -340,7 +358,8 @@ pub static MODE: CommandNode = CommandNode {
    ast_builder: build_mode,
    help_id: Some("app.mode"),
    hint_ids: &["mode"],
-    usage_ids: &["parse.usage.mode"],};
+    usage_ids: &["parse.usage.mode"],
+};

 pub static MESSAGES: CommandNode = CommandNode {
    entry: Word::keyword("messages"),
@@ -348,7 +367,8 @@ pub static MESSAGES: CommandNode = CommandNode {
    ast_builder: build_messages,
    help_id: Some("app.messages"),
    hint_ids: &["messages"],
-    usage_ids: &["parse.usage.messages"],};
+    usage_ids: &["parse.usage.messages"],
+};

 pub static UNDO: CommandNode = CommandNode {
    entry: Word::keyword("undo"),
@@ -356,7 +376,8 @@ pub static UNDO: CommandNode = CommandNode {
    ast_builder: build_undo,
    help_id: Some("app.undo"),
    hint_ids: &["undo"],
-    usage_ids: &["parse.usage.undo"],};
+    usage_ids: &["parse.usage.undo"],
+};

 pub static REDO: CommandNode = CommandNode {
    entry: Word::keyword("redo"),
@@ -364,7 +385,8 @@ pub static REDO: CommandNode = CommandNode {
    ast_builder: build_redo,
    help_id: Some("app.redo"),
    hint_ids: &["redo"],
-    usage_ids: &["parse.usage.redo"],};
+    usage_ids: &["parse.usage.redo"],
+};

 pub static COPY: CommandNode = CommandNode {
    entry: Word::keyword("copy"),
@@ -372,4 +394,5 @@ pub static COPY: CommandNode = CommandNode {
    ast_builder: build_copy,
    help_id: Some("app.copy"),
    hint_ids: &["copy"],
-    usage_ids: &["parse.usage.copy"],};
+    usage_ids: &["parse.usage.copy"],
+};
@@ -24,19 +24,17 @@
 //! later swap that capture for the same typed slots used here, adding
 //! live hints/highlighting.

-use crate::dsl::command::{
-    Command, Expr, RowFilter, SeedOverride, SeedOverrideKind, ShowListKind,
-};
+use crate::dsl::command::{Command, Expr, RowFilter, SeedOverride, SeedOverrideKind, ShowListKind};
 use crate::dsl::grammar::{
    CommandNode, IdentSource, Node, NumberValidator, ValidationError, Word, expr,
    shared::{
-        FALLBACK_VALUE_LIST, column_value_list, count_tuple_values,
-        current_column_value, insert_target_columns,
+        FALLBACK_VALUE_LIST, column_value_list, count_tuple_values, current_column_value,
+        insert_target_columns,
    },
    sql_delete, sql_insert, sql_select, sql_update,
 };
-use crate::dsl::walker::context::WalkContext;
 use crate::dsl::value::Value;
+use crate::dsl::walker::context::WalkContext;
 use crate::dsl::walker::outcome::{MatchedItem, MatchedKind, MatchedPath};

 // =================================================================
@@ -56,10 +54,10 @@ const TABLE_NAME_EXISTING: Node = Node::Ident {
    highlight_override: None,
    writes_table: false,
    writes_column: false,
-        writes_user_listed_column: false,
-writes_table_alias: false,
-writes_cte_name: false,
-writes_projection_alias: false,
+    writes_user_listed_column: false,
+    writes_table_alias: false,
+    writes_cte_name: false,
+    writes_projection_alias: false,
 };

 /// Table-name slot variant that populates
@@ -75,10 +73,10 @@ const TABLE_NAME_INSERT: Node = Node::Ident {
    highlight_override: None,
    writes_table: true,
    writes_column: false,
-        writes_user_listed_column: false,
-writes_table_alias: false,
-writes_cte_name: false,
-writes_projection_alias: false,
+    writes_user_listed_column: false,
+    writes_table_alias: false,
+    writes_cte_name: false,
+    writes_projection_alias: false,
 };

 // =================================================================
@@ -95,10 +93,7 @@ const SHOW_DATA_NODES: &[Node] = &[
 ];
 const SHOW_DATA: Node = Node::Seq(SHOW_DATA_NODES);

-const SHOW_TABLE_NODES: &[Node] = &[
-    Node::Word(Word::keyword("table")),
-    TABLE_NAME_EXISTING,
-];
+const SHOW_TABLE_NODES: &[Node] = &[Node::Word(Word::keyword("table")), TABLE_NAME_EXISTING];
 const SHOW_TABLE: Node = Node::Seq(SHOW_TABLE_NODES);

 // `show tables` / `show relationships` / `show indexes` — the
@@ -144,8 +139,7 @@ const SHOW_INDEX_NAME: Node = Node::Ident {
    writes_cte_name: false,
    writes_projection_alias: false,
 };
-const SHOW_INDEX_NODES: &[Node] =
-    &[Node::Word(Word::keyword("index")), SHOW_INDEX_NAME];
+const SHOW_INDEX_NODES: &[Node] = &[Node::Word(Word::keyword("index")), SHOW_INDEX_NAME];
 const SHOW_INDEX: Node = Node::Seq(SHOW_INDEX_NODES);

 const SHOW_CHOICES: &[Node] = &[
@@ -192,9 +186,9 @@ static FORM_A_COLUMN: Node = Node::Ident {
    writes_table: false,
    writes_column: false,
    writes_user_listed_column: true,
-writes_table_alias: false,
-writes_cte_name: false,
-writes_projection_alias: false,
+    writes_table_alias: false,
+    writes_cte_name: false,
+    writes_projection_alias: false,
 };
 static INSERT_COMMA: Node = Node::Punct(',');

@@ -224,8 +218,7 @@ fn insert_first_paren(ctx: &WalkContext, source: &str, pos: usize) -> Node {
 /// or an identifier-shaped token (a column name) returns false.
 fn first_paren_item_is_value_literal(source: &str, pos: usize) -> bool {
    use crate::dsl::walker::lex_helpers::{
-        consume_ident, consume_number_literal, consume_string_literal,
-        skip_whitespace,
+        consume_ident, consume_number_literal, consume_string_literal, skip_whitespace,
    };
    let p = skip_whitespace(source, pos);
    if p >= source.len() {
@@ -281,7 +274,11 @@ fn dsl_insert_value_list(ctx: &WalkContext, source: &str, pos: usize) -> Node {
        return FALLBACK_VALUE_LIST;
    };
    let (count, closed) = count_tuple_values(source, pos);
-    let arity_ok = if closed { count == cols.len() } else { count <= cols.len() };
+    let arity_ok = if closed {
+        count == cols.len()
+    } else {
+        count <= cols.len()
+    };
    if arity_ok {
        Node::DynamicSubgrammar(column_value_list)
    } else {
@@ -320,8 +317,7 @@ const INSERT_VALUES_KEYWORD_FIRST_NODES: &[Node] = &[
 ];
 const INSERT_VALUES_KEYWORD_FIRST: Node = Node::Seq(INSERT_VALUES_KEYWORD_FIRST_NODES);

-const INSERT_AFTER_TABLE_CHOICES: &[Node] =
-    &[INSERT_VALUES_KEYWORD_FIRST, INSERT_PAREN_FIRST];
+const INSERT_AFTER_TABLE_CHOICES: &[Node] = &[INSERT_VALUES_KEYWORD_FIRST, INSERT_PAREN_FIRST];
 const INSERT_AFTER_TABLE: Node = Node::Choice(INSERT_AFTER_TABLE_CHOICES);

 const INSERT_NODES: &[Node] = &[
@@ -349,10 +345,10 @@ const TABLE_NAME_WRITES: Node = Node::Ident {
    highlight_override: None,
    writes_table: true,
    writes_column: false,
-        writes_user_listed_column: false,
-writes_table_alias: false,
-writes_cte_name: false,
-writes_projection_alias: false,
+    writes_user_listed_column: false,
+    writes_table_alias: false,
+    writes_cte_name: false,
+    writes_projection_alias: false,
 };

 /// Column-name slot in `set col = …` — resolves the column's
@@ -366,9 +362,9 @@ const SET_COLUMN: Node = Node::Ident {
    writes_table: false,
    writes_column: true,
    writes_user_listed_column: false,
-writes_table_alias: false,
-writes_cte_name: false,
-writes_projection_alias: false,
+    writes_table_alias: false,
+    writes_cte_name: false,
+    writes_projection_alias: false,
 };

 /// Value slot resolved at walk time from
@@ -376,11 +372,7 @@ writes_projection_alias: false,
 /// value-literal choice when no current_column is bound.
 const PER_COLUMN_VALUE: Node = Node::DynamicSubgrammar(current_column_value);

-const UPDATE_ASSIGNMENT_NODES: &[Node] = &[
-    SET_COLUMN,
-    Node::Punct('='),
-    PER_COLUMN_VALUE,
-];
+const UPDATE_ASSIGNMENT_NODES: &[Node] = &[SET_COLUMN, Node::Punct('='), PER_COLUMN_VALUE];
 const UPDATE_ASSIGNMENT: Node = Node::Seq(UPDATE_ASSIGNMENT_NODES);
 const UPDATE_ASSIGNMENTS: Node = Node::Repeated {
    inner: &UPDATE_ASSIGNMENT,
@@ -568,8 +560,7 @@ const SEED_OVERRIDES: Node = Node::Repeated {
    separator: Some(&Node::Punct(',')),
    min: 1,
 };
-const SEED_SET_CLAUSE_NODES: &[Node] =
-    &[Node::Word(Word::keyword("set")), SEED_OVERRIDES];
+const SEED_SET_CLAUSE_NODES: &[Node] = &[Node::Word(Word::keyword("set")), SEED_OVERRIDES];
 const SEED_SET_CLAUSE: Node = Node::Seq(SEED_SET_CLAUSE_NODES);

 const SEED_NODES: &[Node] = &[
@@ -980,7 +971,10 @@ fn parse_seed_override_tail(
        MatchedKind::Word("in") => {
            *i += 1; // `in`
            // `(`
-            if matches!(region.get(*i).map(|t| &t.kind), Some(MatchedKind::Punct('('))) {
+            if matches!(
+                region.get(*i).map(|t| &t.kind),
+                Some(MatchedKind::Punct('('))
+            ) {
                *i += 1;
            }
            let mut values = Vec::new();
@@ -1001,7 +995,10 @@ fn parse_seed_override_tail(
        MatchedKind::Word("between") => {
            *i += 1; // `between`
            let low = seed_take_value(region, i, column)?;
-            if matches!(region.get(*i).map(|t| &t.kind), Some(MatchedKind::Word("and"))) {
+            if matches!(
+                region.get(*i).map(|t| &t.kind),
+                Some(MatchedKind::Word("and"))
+            ) {
                *i += 1;
            }
            let high = seed_take_value(region, i, column)?;
@@ -1011,7 +1008,15 @@ fn parse_seed_override_tail(
            *i += 1; // `as`
            let gen_item = region
                .get(*i)
-                .filter(|t| matches!(t.kind, MatchedKind::Ident { role: "seed_generator", .. }))
+                .filter(|t| {
+                    matches!(
+                        t.kind,
+                        MatchedKind::Ident {
+                            role: "seed_generator",
+                            ..
+                        }
+                    )
+                })
                .ok_or_else(|| seed_set_error(column))?;
            *i += 1;
            Ok(SeedOverrideKind::Generator(gen_item.text.clone()))
@@ -1085,7 +1090,15 @@ fn build_insert(path: &MatchedPath, _source: &str) -> Result<Command, Validation
    let table_idx = path
        .items
        .iter()
-        .position(|i| matches!(&i.kind, MatchedKind::Ident { role: "table_name", .. }))
+        .position(|i| {
+            matches!(
+                &i.kind,
+                MatchedKind::Ident {
+                    role: "table_name",
+                    ..
+                }
+            )
+        })
        .ok_or_else(|| ValidationError {
            message_key: "parse.error_wrapper",
            args: vec![("detail", "missing table".to_string())],
@@ -1141,7 +1154,10 @@ fn build_insert(path: &MatchedPath, _source: &str) -> Result<Command, Validation
        if columns.is_empty() {
            return Err(ValidationError {
                message_key: "parse.error_wrapper",
-                args: vec![("detail", "expected column names in `insert into T (…)`".to_string())],
+                args: vec![(
+                    "detail",
+                    "expected column names in `insert into T (…)`".to_string(),
+                )],
            });
        }
        // Find the `values` keyword and the next `(` — the values
@@ -1247,9 +1263,7 @@ fn build_update(path: &MatchedPath, _source: &str) -> Result<Command, Validation
    })
 }

-fn collect_assignments(
-    path: &MatchedPath,
-) -> Result<Vec<(String, Value)>, ValidationError> {
+fn collect_assignments(path: &MatchedPath) -> Result<Vec<(String, Value)>, ValidationError> {
    let mut out = Vec::new();
    let mut iter = path.items.iter();
    while let Some(item) = iter.next() {
@@ -1495,9 +1509,7 @@ fn build_sql_insert(path: &MatchedPath, source: &str) -> Result<Command, Validat
    let row_source = path
        .items
        .iter()
-        .find(|item| {
-            matches!(item.kind, MatchedKind::Word("values" | "select" | "with"))
-        })
+        .find(|item| matches!(item.kind, MatchedKind::Word("values" | "select" | "with")))
        .map(|item| {
            let end = tail_start.unwrap_or(source.len());
            source[item.span.0..end]
@@ -1790,7 +1802,13 @@ pub static SHOW: CommandNode = CommandNode {
    shape: SHOW_SHAPE,
    ast_builder: build_show,
    help_id: Some("data.show"),
-    hint_ids: &[],
+    hint_ids: &[
+        "show_data",
+        "show_table",
+        "show_tables",
+        "show_relationships",
+        "show_indexes",
+    ],
    usage_ids: &[
        "parse.usage.show_data",
        "parse.usage.show_table",
@@ -1799,14 +1817,15 @@ pub static SHOW: CommandNode = CommandNode {
        "parse.usage.show_indexes",
        "parse.usage.show_relationship",
        "parse.usage.show_index",
-    ],};
+    ],
+};

 pub static SEED: CommandNode = CommandNode {
    entry: Word::keyword("seed"),
    shape: SEED_SHAPE,
    ast_builder: build_seed,
    help_id: Some("data.seed"),
-    hint_ids: &[],
+    hint_ids: &["seed"],
    usage_ids: &["parse.usage.seed"],
 };

@@ -1817,39 +1836,44 @@ pub static INSERT: CommandNode = CommandNode {
    help_id: Some("data.insert"),
    // ADR-0053 Phase-B exemplar.
    hint_ids: &["insert"],
-    usage_ids: &["parse.usage.insert"],};
+    usage_ids: &["parse.usage.insert"],
+};

 pub static UPDATE: CommandNode = CommandNode {
    entry: Word::keyword("update"),
    shape: UPDATE_SHAPE,
    ast_builder: build_update,
    help_id: Some("data.update"),
-    hint_ids: &[],
-    usage_ids: &["parse.usage.update"],};
+    hint_ids: &["update"],
+    usage_ids: &["parse.usage.update"],
+};

 pub static DELETE: CommandNode = CommandNode {
    entry: Word::keyword("delete"),
    shape: DELETE_SHAPE,
    ast_builder: build_delete,
    help_id: Some("data.delete"),
-    hint_ids: &[],
-    usage_ids: &["parse.usage.delete"],};
+    hint_ids: &["delete"],
+    usage_ids: &["parse.usage.delete"],
+};

 pub static REPLAY: CommandNode = CommandNode {
    entry: Word::keyword("replay"),
    shape: REPLAY_PATH,
    ast_builder: build_replay,
    help_id: Some("data.replay"),
-    hint_ids: &[],
-    usage_ids: &["parse.usage.replay"],};
+    hint_ids: &["replay"],
+    usage_ids: &["parse.usage.replay"],
+};

 pub static EXPLAIN: CommandNode = CommandNode {
    entry: Word::keyword("explain"),
    shape: EXPLAIN_SHAPE,
    ast_builder: build_explain,
    help_id: Some("data.explain"),
-    hint_ids: &[],
-    usage_ids: &["parse.usage.explain"],};
+    hint_ids: &["explain"],
+    usage_ids: &["parse.usage.explain"],
+};

 /// `explain` over advanced-mode SQL (ADR-0039).
 ///
@@ -1868,8 +1892,9 @@ pub static EXPLAIN_SQL: CommandNode = CommandNode {
    // too). Mirrors the `SQL_INSERT`/`SQL_UPDATE`/`SQL_DELETE`
    // precedent; otherwise `note_help` would print `explain` twice.
    help_id: None,
-    hint_ids: &[],
-    usage_ids: &[],};
+    hint_ids: &["explain_sql"],
+    usage_ids: &[],
+};

 /// SQL `SELECT` (ADR-0030 §6, ADR-0031, ADR-0032).
 ///
@@ -1884,8 +1909,9 @@ pub static SELECT: CommandNode = CommandNode {
    shape: Node::Subgrammar(&sql_select::SQL_SELECT_TAIL),
    ast_builder: build_select,
    help_id: None,
-    hint_ids: &[],
-    usage_ids: &["parse.usage.select"],};
+    hint_ids: &["select"],
+    usage_ids: &["parse.usage.select"],
+};

 /// `WITH …` top-level statement (ADR-0032 §4 / sub-phase 2c).
 ///
@@ -1899,8 +1925,9 @@ pub static WITH: CommandNode = CommandNode {
    shape: Node::Subgrammar(&sql_select::SQL_WITH_TAIL),
    ast_builder: build_select,
    help_id: None,
-    hint_ids: &[],
-    usage_ids: &["parse.usage.with"],};
+    hint_ids: &["with"],
+    usage_ids: &["parse.usage.with"],
+};

 /// SQL `INSERT` — the `Advanced`-category node of the shared
 /// `insert` entry word (ADR-0033 §2, Amendment 1, sub-phase 3j).
@@ -1917,7 +1944,7 @@ pub static SQL_INSERT: CommandNode = CommandNode {
    shape: Node::Subgrammar(&sql_insert::SQL_INSERT_SHAPE),
    ast_builder: build_sql_insert,
    help_id: None,
-    hint_ids: &[],
+    hint_ids: &["sql_insert"],
    usage_ids: &[],
 };

@@ -1931,7 +1958,7 @@ pub static SQL_UPDATE: CommandNode = CommandNode {
    shape: Node::Subgrammar(&sql_update::SQL_UPDATE_SHAPE),
    ast_builder: build_sql_update,
    help_id: None,
-    hint_ids: &[],
+    hint_ids: &["sql_update"],
    usage_ids: &[],
 };

@@ -1947,7 +1974,7 @@ pub static SQL_DELETE: CommandNode = CommandNode {
    shape: Node::Subgrammar(&sql_delete::SQL_DELETE_SHAPE),
    ast_builder: build_sql_delete,
    help_id: None,
-    hint_ids: &[],
+    hint_ids: &["sql_delete"],
    usage_ids: &[],
 };

@@ -1987,7 +2014,11 @@ mod explain_tests {
    #[test]
    fn explain_show_data_carries_where_and_limit_through() {
        match explain_inner("explain show data Customers where id = 1 limit 5") {
-            Command::ShowData { name, filter, limit } => {
+            Command::ShowData {
+                name,
+                filter,
+                limit,
+            } => {
                assert_eq!(name, "Customers");
                assert!(filter.is_some(), "where clause should survive");
                assert_eq!(limit, Some(5));
@@ -2046,9 +2077,7 @@ mod explain_tests {

    /// Advanced-mode counterpart of `explain_inner`.
    fn explain_inner_adv(input: &str) -> Command {
-        match parse_command_in_mode(input, Mode::Advanced)
-            .expect("advanced explain should parse")
-        {
+        match parse_command_in_mode(input, Mode::Advanced).expect("advanced explain should parse") {
            Command::Explain { query } => *query,
            other => panic!("expected Command::Explain, got {other:?}"),
        }
@@ -2079,7 +2108,9 @@ mod explain_tests {
    #[test]
    fn explain_sql_insert_wraps_a_sql_insert() {
        match explain_inner_adv("explain insert into Customers values (1, 'Bo')") {
-            Command::SqlInsert { sql, target_table, .. } => {
+            Command::SqlInsert {
+                sql, target_table, ..
+            } => {
                assert_eq!(target_table, "Customers");
                assert_eq!(sql, "insert into Customers values (1, 'Bo')");
            }
@@ -2090,7 +2121,9 @@ mod explain_tests {
    #[test]
    fn explain_sql_update_wraps_a_sql_update_with_clean_sql() {
        match explain_inner_adv("explain update Customers set Name = 'Bo' where id = 1") {
-            Command::SqlUpdate { sql, target_table, .. } => {
+            Command::SqlUpdate {
+                sql, target_table, ..
+            } => {
                assert_eq!(target_table, "Customers");
                assert_eq!(sql, "update Customers set Name = 'Bo' where id = 1");
            }
@@ -2101,7 +2134,9 @@ mod explain_tests {
    #[test]
    fn explain_sql_delete_wraps_a_sql_delete() {
        match explain_inner_adv("explain delete from Customers where id = 1") {
-            Command::SqlDelete { sql, target_table, .. } => {
+            Command::SqlDelete {
+                sql, target_table, ..
+            } => {
                assert_eq!(target_table, "Customers");
                assert_eq!(sql, "delete from Customers where id = 1");
            }
@@ -2142,11 +2177,7 @@ mod explain_tests {
    fn explain_does_not_cover_ddl() {
        // EXPLAIN QUERY PLAN applies to DML/queries only (ADR-0039
        // out of scope); there is no SQL DDL branch under explain.
-        assert!(parse_command_in_mode(
-            "explain create table T (id int)",
-            Mode::Advanced,
-        )
-        .is_err());
+        assert!(parse_command_in_mode("explain create table T (id int)", Mode::Advanced,).is_err());
    }

    #[test]
@@ -2159,9 +2190,8 @@ mod explain_tests {
        use crate::completion::candidates_at_cursor_in_mode;
        let schema = crate::completion::SchemaCache::default();
        let input = "explain ";
-        let completion =
-            candidates_at_cursor_in_mode(input, input.len(), &schema, Mode::Advanced)
-                .expect("explain offers candidates");
+        let completion = candidates_at_cursor_in_mode(input, input.len(), &schema, Mode::Advanced)
+            .expect("explain offers candidates");
        let names: Vec<&str> = completion
            .candidates
            .iter()
@@ -2172,4 +2202,3 @@ mod explain_tests {
        }
    }
 }
-
@@ -16,11 +16,11 @@ use crate::dsl::command::{
    AlterTableAction, ChangeColumnMode, ColumnSpec, Command, Constraint, ConstraintKind, Expr,
    IndexSelector, RelationshipSelector, SqlForeignKey, TableConstraint,
 };
-use crate::dsl::value::Value;
 use crate::dsl::grammar::{
    CommandNode, HighlightClass, HintMode, IdentSource, Node, ValidationError, Word,
    shared::{REFERENTIAL_CLAUSES, TYPE_SLOT, TYPE_VALIDATOR},
 };
+use crate::dsl::value::Value;

 /// `HintMode` annotation shared by every `NewName` ident slot:
 /// the user is inventing a name, so the hint panel forces the
@@ -39,12 +39,12 @@ const TABLE_NAME_NEW_IDENT: Node = Node::Ident {
    role: "table_name",
    validator: None,
    highlight_override: None,
-        writes_table: false,
-        writes_column: false,
-        writes_user_listed_column: false,
-writes_table_alias: false,
-writes_cte_name: false,
-writes_projection_alias: false,
+    writes_table: false,
+    writes_column: false,
+    writes_user_listed_column: false,
+    writes_table_alias: false,
+    writes_cte_name: false,
+    writes_projection_alias: false,
 };
 const TABLE_NAME_NEW: Node = Node::Hinted {
    mode: NEW_NAME_HINT,
@@ -63,12 +63,12 @@ const TABLE_NAME_EXISTING: Node = Node::Ident {
    role: "table_name",
    validator: None,
    highlight_override: None,
-        writes_table: true,
-        writes_column: false,
-        writes_user_listed_column: false,
-writes_table_alias: false,
-writes_cte_name: false,
-writes_projection_alias: false,
+    writes_table: true,
+    writes_column: false,
+    writes_user_listed_column: false,
+    writes_table_alias: false,
+    writes_cte_name: false,
+    writes_projection_alias: false,
 };

 const COLUMN_NAME: Node = Node::Ident {
@@ -76,12 +76,12 @@ const COLUMN_NAME: Node = Node::Ident {
    role: "column_name",
    validator: None,
    highlight_override: None,
-        writes_table: false,
-        writes_column: false,
-        writes_user_listed_column: false,
-writes_table_alias: false,
-writes_cte_name: false,
-writes_projection_alias: false,
+    writes_table: false,
+    writes_column: false,
+    writes_user_listed_column: false,
+    writes_table_alias: false,
+    writes_cte_name: false,
+    writes_projection_alias: false,
 };

 const COLUMN_NAME_NEW_IDENT: Node = Node::Ident {
@@ -89,12 +89,12 @@ const COLUMN_NAME_NEW_IDENT: Node = Node::Ident {
    role: "column_name",
    validator: None,
    highlight_override: None,
-        writes_table: false,
-        writes_column: false,
-        writes_user_listed_column: false,
-writes_table_alias: false,
-writes_cte_name: false,
-writes_projection_alias: false,
+    writes_table: false,
+    writes_column: false,
+    writes_user_listed_column: false,
+    writes_table_alias: false,
+    writes_cte_name: false,
+    writes_projection_alias: false,
 };
 const COLUMN_NAME_NEW: Node = Node::Hinted {
    mode: NEW_NAME_HINT,
@@ -106,12 +106,12 @@ const RELATIONSHIP_NAME: Node = Node::Ident {
    role: "relationship_name",
    validator: None,
    highlight_override: None,
-        writes_table: false,
-        writes_column: false,
-        writes_user_listed_column: false,
-writes_table_alias: false,
-writes_cte_name: false,
-writes_projection_alias: false,
+    writes_table: false,
+    writes_column: false,
+    writes_user_listed_column: false,
+    writes_table_alias: false,
+    writes_cte_name: false,
+    writes_projection_alias: false,
 };

 const RELATIONSHIP_NAME_NEW_IDENT: Node = Node::Ident {
@@ -119,12 +119,12 @@ const RELATIONSHIP_NAME_NEW_IDENT: Node = Node::Ident {
    role: "relationship_name",
    validator: None,
    highlight_override: None,
-        writes_table: false,
-        writes_column: false,
-        writes_user_listed_column: false,
-writes_table_alias: false,
-writes_cte_name: false,
-writes_projection_alias: false,
+    writes_table: false,
+    writes_column: false,
+    writes_user_listed_column: false,
+    writes_table_alias: false,
+    writes_cte_name: false,
+    writes_projection_alias: false,
 };
 const RELATIONSHIP_NAME_NEW: Node = Node::Hinted {
    mode: NEW_NAME_HINT,
@@ -139,9 +139,9 @@ const INDEX_NAME_EXISTING: Node = Node::Ident {
    writes_table: false,
    writes_column: false,
    writes_user_listed_column: false,
-writes_table_alias: false,
-writes_cte_name: false,
-writes_projection_alias: false,
+    writes_table_alias: false,
+    writes_cte_name: false,
+    writes_projection_alias: false,
 };

 const INDEX_NAME_NEW_IDENT: Node = Node::Ident {
@@ -152,9 +152,9 @@ const INDEX_NAME_NEW_IDENT: Node = Node::Ident {
    writes_table: false,
    writes_column: false,
    writes_user_listed_column: false,
-writes_table_alias: false,
-writes_cte_name: false,
-writes_projection_alias: false,
+    writes_table_alias: false,
+    writes_cte_name: false,
+    writes_projection_alias: false,
 };
 const INDEX_NAME_NEW: Node = Node::Hinted {
    mode: NEW_NAME_HINT,
@@ -181,10 +181,7 @@ const TABLE_OPT: Node = Node::Optional(&Node::Word(Word::keyword("table")));
 // drop_table — `drop table <T>`
 // =================================================================

-const DROP_TABLE_NODES: &[Node] = &[
-    Node::Word(Word::keyword("table")),
-    TABLE_NAME_EXISTING,
-];
+const DROP_TABLE_NODES: &[Node] = &[Node::Word(Word::keyword("table")), TABLE_NAME_EXISTING];
 const DROP_TABLE: Node = Node::Seq(DROP_TABLE_NODES);

 // Advanced-mode SQL `DROP TABLE [IF EXISTS] <name> [;]` (ADR-0035 §4,
@@ -192,8 +189,10 @@ const DROP_TABLE: Node = Node::Seq(DROP_TABLE_NODES);
 // plus the optional `IF EXISTS` no-op-with-note. The leading concrete
 // `table` keyword (not the Optional) keeps the element/dispatch
 // matching honest.
-static SQL_DROP_IF_EXISTS_NODES: &[Node] =
-    &[Node::Word(Word::keyword("if")), Node::Word(Word::keyword("exists"))];
+static SQL_DROP_IF_EXISTS_NODES: &[Node] = &[
+    Node::Word(Word::keyword("if")),
+    Node::Word(Word::keyword("exists")),
+];
 const SQL_DROP_IF_EXISTS_OPT: Node = Node::Optional(&Node::Seq(SQL_DROP_IF_EXISTS_NODES));
 static SQL_DROP_TABLE_SHAPE_NODES: &[Node] = &[
    Node::Word(Word::keyword("table")),
@@ -257,9 +256,9 @@ const DR_PARENT_NODES: &[Node] = &[
        writes_table: true,
        writes_column: false,
        writes_user_listed_column: false,
-    writes_table_alias: false,
-    writes_cte_name: false,
-    writes_projection_alias: false,
+        writes_table_alias: false,
+        writes_cte_name: false,
+        writes_projection_alias: false,
    },
    Node::Punct('.'),
    Node::Ident {
@@ -270,9 +269,9 @@ const DR_PARENT_NODES: &[Node] = &[
        writes_table: false,
        writes_column: false,
        writes_user_listed_column: false,
-    writes_table_alias: false,
-    writes_cte_name: false,
-    writes_projection_alias: false,
+        writes_table_alias: false,
+        writes_cte_name: false,
+        writes_projection_alias: false,
    },
 ];
 const DR_PARENT: Node = Node::Seq(DR_PARENT_NODES);
@@ -286,9 +285,9 @@ const DR_CHILD_NODES: &[Node] = &[
        writes_table: true,
        writes_column: false,
        writes_user_listed_column: false,
-    writes_table_alias: false,
-    writes_cte_name: false,
-    writes_projection_alias: false,
+        writes_table_alias: false,
+        writes_cte_name: false,
+        writes_projection_alias: false,
    },
    Node::Punct('.'),
    Node::Ident {
@@ -299,9 +298,9 @@ const DR_CHILD_NODES: &[Node] = &[
        writes_table: false,
        writes_column: false,
        writes_user_listed_column: false,
-    writes_table_alias: false,
-    writes_cte_name: false,
-    writes_projection_alias: false,
+        writes_table_alias: false,
+        writes_cte_name: false,
+        writes_projection_alias: false,
    },
 ];
 const DR_CHILD: Node = Node::Seq(DR_CHILD_NODES);
@@ -317,10 +316,7 @@ const DR_ENDPOINTS: Node = Node::Seq(DR_ENDPOINTS_NODES);
 const DR_SELECTOR_CHOICES: &[Node] = &[DR_ENDPOINTS, RELATIONSHIP_NAME];
 const DR_SELECTOR: Node = Node::Choice(DR_SELECTOR_CHOICES);

-const DROP_RELATIONSHIP_NODES: &[Node] = &[
-    Node::Word(Word::keyword("relationship")),
-    DR_SELECTOR,
-];
+const DROP_RELATIONSHIP_NODES: &[Node] = &[Node::Word(Word::keyword("relationship")), DR_SELECTOR];
 const DROP_RELATIONSHIP: Node = Node::Seq(DROP_RELATIONSHIP_NODES);

 // =================================================================
@@ -341,18 +337,20 @@ const DI_POSITIONAL: Node = Node::Seq(DI_POSITIONAL_NODES);
 const DI_SELECTOR_CHOICES: &[Node] = &[DI_POSITIONAL, INDEX_NAME_EXISTING];
 const DI_SELECTOR: Node = Node::Choice(DI_SELECTOR_CHOICES);

-const DROP_INDEX_NODES: &[Node] = &[
-    Node::Word(Word::keyword("index")),
-    DI_SELECTOR,
-];
+const DROP_INDEX_NODES: &[Node] = &[Node::Word(Word::keyword("index")), DI_SELECTOR];
 const DROP_INDEX: Node = Node::Seq(DROP_INDEX_NODES);

 // =================================================================
 // drop entry — `drop (table|column|relationship|index) ...`
 // =================================================================

-const DROP_CHOICES: &[Node] =
-    &[DROP_COLUMN, DROP_RELATIONSHIP, DROP_TABLE, DROP_INDEX, DROP_CONSTRAINT];
+const DROP_CHOICES: &[Node] = &[
+    DROP_COLUMN,
+    DROP_RELATIONSHIP,
+    DROP_TABLE,
+    DROP_INDEX,
+    DROP_CONSTRAINT,
+];
 const DROP_SHAPE: Node = Node::Choice(DROP_CHOICES);

 // =================================================================
@@ -450,8 +448,7 @@ const AR_CHILD_COL_LIST: Node = Node::Repeated {
    separator: Some(&Node::Punct(',')),
    min: 1,
 };
-const AR_CHILD_COLS_PAREN_NODES: &[Node] =
-    &[Node::Punct('('), AR_CHILD_COL_LIST, Node::Punct(')')];
+const AR_CHILD_COLS_PAREN_NODES: &[Node] = &[Node::Punct('('), AR_CHILD_COL_LIST, Node::Punct(')')];
 const AR_CHILD_COLS_PAREN: Node = Node::Seq(AR_CHILD_COLS_PAREN_NODES);
 const AR_CHILD_COLS_CHOICES: &[Node] = &[AR_CHILD_COLS_PAREN, AR_CHILD_COL];
 const AR_CHILD_COLS: Node = Node::Choice(AR_CHILD_COLS_CHOICES);
@@ -474,10 +471,7 @@ const AR_CHILD_NODES: &[Node] = &[
 ];
 const AR_CHILD: Node = Node::Seq(AR_CHILD_NODES);

-const AR_AS_NAME_NODES: &[Node] = &[
-    Node::Word(Word::keyword("as")),
-    RELATIONSHIP_NAME_NEW,
-];
+const AR_AS_NAME_NODES: &[Node] = &[Node::Word(Word::keyword("as")), RELATIONSHIP_NAME_NEW];
 const AR_AS_NAME_OPT: Node = Node::Optional(&Node::Seq(AR_AS_NAME_NODES));

 const AR_CREATE_FK_OPT: Node = Node::Optional(&Node::Flag("create-fk"));
@@ -501,10 +495,7 @@ const ADD_RELATIONSHIP: Node = Node::Seq(ADD_RELATIONSHIP_NODES);
 // add_index — `add index [as <name>] on <T> (<col>, …)`
 // =================================================================

-const AI_AS_NAME_NODES: &[Node] = &[
-    Node::Word(Word::keyword("as")),
-    INDEX_NAME_NEW,
-];
+const AI_AS_NAME_NODES: &[Node] = &[Node::Word(Word::keyword("as")), INDEX_NAME_NEW];
 const AI_AS_NAME_OPT: Node = Node::Optional(&Node::Seq(AI_AS_NAME_NODES));

 const ADD_INDEX_NODES: &[Node] = &[
@@ -537,9 +528,9 @@ const NEW_COLUMN_NAME_IDENT: Node = Node::Ident {
    writes_table: false,
    writes_column: false,
    writes_user_listed_column: false,
-writes_table_alias: false,
-writes_cte_name: false,
-writes_projection_alias: false,
+    writes_table_alias: false,
+    writes_cte_name: false,
+    writes_projection_alias: false,
 };
 const NEW_COLUMN_NAME: Node = Node::Hinted {
    mode: NEW_NAME_HINT,
@@ -563,10 +554,7 @@ const RENAME_COLUMN: Node = Node::Seq(RENAME_COLUMN_NODES);
 //                  ( <type> ) [--force-conversion | --dont-convert]`
 // =================================================================

-const CHANGE_FLAG_CHOICES: &[Node] = &[
-    Node::Flag("force-conversion"),
-    Node::Flag("dont-convert"),
-];
+const CHANGE_FLAG_CHOICES: &[Node] = &[Node::Flag("force-conversion"), Node::Flag("dont-convert")];
 const CHANGE_FLAG_OPT: Node = Node::Repeated {
    inner: &Node::Choice(CHANGE_FLAG_CHOICES),
    separator: None,
@@ -732,8 +720,7 @@ fn build_add(path: &MatchedPath, _source: &str) -> Result<Command, ValidationErr
                    message_key: "parse.error_wrapper",
                    args: vec![("detail", "unknown type".to_string())],
                })?;
-            let (not_null, unique, default, check) =
-                collect_column_constraints(path)?;
+            let (not_null, unique, default, check) = collect_column_constraints(path)?;
            Ok(Command::AddColumn {
                table: require_ident(path, "table_name")?,
                column: require_ident(path, "column_name")?,
@@ -949,7 +936,10 @@ fn build_drop_constraint(path: &MatchedPath, _source: &str) -> Result<Command, V
    } else {
        return Err(ValidationError {
            message_key: "parse.error_wrapper",
-            args: vec![("detail", "drop constraint needs a constraint kind".to_string())],
+            args: vec![(
+                "detail",
+                "drop constraint needs a constraint kind".to_string(),
+            )],
        });
    };
    Ok(Command::DropConstraint {
@@ -981,7 +971,8 @@ pub static DROP: CommandNode = CommandNode {
        "parse.usage.drop_relationship",
        "parse.usage.drop_index",
        "parse.usage.drop_constraint",
-    ],};
+    ],
+};

 pub static ADD: CommandNode = CommandNode {
    entry: Word::keyword("add"),
@@ -1003,7 +994,8 @@ pub static ADD: CommandNode = CommandNode {
        "parse.usage.add_relationship",
        "parse.usage.add_index",
        "parse.usage.add_constraint",
-    ],};
+    ],
+};

 pub static RENAME: CommandNode = CommandNode {
    entry: Word::keyword("rename"),
@@ -1011,7 +1003,8 @@ pub static RENAME: CommandNode = CommandNode {
    ast_builder: build_rename_column,
    help_id: Some("ddl.rename"),
    hint_ids: &["rename_column"],
-    usage_ids: &["parse.usage.rename_column"],};
+    usage_ids: &["parse.usage.rename_column"],
+};

 pub static CHANGE: CommandNode = CommandNode {
    entry: Word::keyword("change"),
@@ -1019,7 +1012,8 @@ pub static CHANGE: CommandNode = CommandNode {
    ast_builder: build_change_column,
    help_id: Some("ddl.change"),
    hint_ids: &["change_column"],
-    usage_ids: &["parse.usage.change_column"],};
+    usage_ids: &["parse.usage.change_column"],
+};

 // =================================================================
 // create_table — `create table <Name> [with pk [<col>(<type>)[, ...]]]`
@@ -1034,9 +1028,9 @@ const COL_NAME_IDENT: Node = Node::Ident {
    writes_table: false,
    writes_column: false,
    writes_user_listed_column: false,
-writes_table_alias: false,
-writes_cte_name: false,
-writes_projection_alias: false,
+    writes_table_alias: false,
+    writes_cte_name: false,
+    writes_projection_alias: false,
 };
 const COL_NAME: Node = Node::Hinted {
    mode: NEW_NAME_HINT,
@@ -1074,8 +1068,12 @@ const CHECK_CONSTRAINT_NODES: &[Node] = &[
 ];
 const CHECK_CONSTRAINT: Node = Node::Seq(CHECK_CONSTRAINT_NODES);

-const COLUMN_CONSTRAINT_CHOICES: &[Node] =
-    &[NOT_NULL_CONSTRAINT, UNIQUE_CONSTRAINT, DEFAULT_CONSTRAINT, CHECK_CONSTRAINT];
+const COLUMN_CONSTRAINT_CHOICES: &[Node] = &[
+    NOT_NULL_CONSTRAINT,
+    UNIQUE_CONSTRAINT,
+    DEFAULT_CONSTRAINT,
+    CHECK_CONSTRAINT,
+];
 const COLUMN_CONSTRAINT: Node = Node::Choice(COLUMN_CONSTRAINT_CHOICES);

 /// Zero-or-more constraints — the suffix after a column's
@@ -1114,8 +1112,7 @@ const DROP_CONSTRAINT_KIND: Node = Node::Choice(DROP_CONSTRAINT_KIND_CHOICES);
 // `writes_table: true` on the table ident (via `TABLE_NAME_
 // EXISTING`) narrows the `.<column>` slot's completion
 // candidates to that table's columns.
-const CONSTRAINT_TARGET_NODES: &[Node] =
-    &[TABLE_NAME_EXISTING, Node::Punct('.'), COLUMN_NAME];
+const CONSTRAINT_TARGET_NODES: &[Node] = &[TABLE_NAME_EXISTING, Node::Punct('.'), COLUMN_NAME];
 const CONSTRAINT_TARGET: Node = Node::Seq(CONSTRAINT_TARGET_NODES);

 const ADD_CONSTRAINT_NODES: &[Node] = &[
@@ -1145,9 +1142,9 @@ const COL_SPEC_NODES: &[Node] = &[
        writes_table: false,
        writes_column: false,
        writes_user_listed_column: false,
-    writes_table_alias: false,
-    writes_cte_name: false,
-    writes_projection_alias: false,
+        writes_table_alias: false,
+        writes_cte_name: false,
+        writes_projection_alias: false,
    },
    Node::Punct(')'),
    COLUMN_CONSTRAINT_SUFFIX,
@@ -1275,10 +1272,14 @@ fn build_create_table(path: &MatchedPath, _source: &str) -> Result<Command, Vali
    let mut items = path.items.iter().peekable();
    while let Some(item) = items.next() {
        match &item.kind {
-            MatchedKind::Ident { role: "col_name", .. } => {
+            MatchedKind::Ident {
+                role: "col_name", ..
+            } => {
                pending_name = Some(item.text.clone());
            }
-            MatchedKind::Ident { role: "col_type", .. } => {
+            MatchedKind::Ident {
+                role: "col_type", ..
+            } => {
                let ty = item.text.parse::<Type>().map_err(|_| ValidationError {
                    message_key: "parse.error_wrapper",
                    args: vec![("detail", "unknown type".to_string())],
@@ -1380,7 +1381,8 @@ pub static CREATE: CommandNode = CommandNode {
    ast_builder: build_create_table,
    help_id: Some("ddl.create"),
    hint_ids: &["create_table"],
-    usage_ids: &["parse.usage.create_table"],};
+    usage_ids: &["parse.usage.create_table"],
+};

 // =================================================================
 // create_m2n — `create m:n relationship from <T1> to <T2> [as <name>]`
@@ -1506,11 +1508,15 @@ fn build_sql_create_table(path: &MatchedPath, source: &str) -> Result<Command, V
    while let Some(item) = items.next() {
        match &item.kind {
            // A column name stashes until its type finalises the spec.
-            MatchedKind::Ident { role: "col_name", .. } => {
+            MatchedKind::Ident {
+                role: "col_name", ..
+            } => {
                pending_name = Some(item.text.clone());
            }
            // Single-word type — resolve through the SQL alias map.
-            MatchedKind::Ident { role: "col_type", .. } => {
+            MatchedKind::Ident {
+                role: "col_type", ..
+            } => {
                let ty = Type::from_sql_name(&item.text).ok_or_else(|| ValidationError {
                    message_key: "parse.error_wrapper",
                    args: vec![("detail", "unknown type".to_string())],
@@ -1533,7 +1539,9 @@ fn build_sql_create_table(path: &MatchedPath, source: &str) -> Result<Command, V
                column_open = true;
            }
            // A table-level `PRIMARY KEY (col, …)` column reference.
-            MatchedKind::Ident { role: "pk_column", .. } => {
+            MatchedKind::Ident {
+                role: "pk_column", ..
+            } => {
                primary_key.push(item.text.clone());
            }
            // `not null` column constraint (only once a column exists;
@@ -1557,7 +1565,10 @@ fn build_sql_create_table(path: &MatchedPath, source: &str) -> Result<Command, V
                    let mut cols: Vec<String> = Vec::new();
                    while let Some(it) = items.peek() {
                        match &it.kind {
-                            MatchedKind::Ident { role: "unique_column", .. } => {
+                            MatchedKind::Ident {
+                                role: "unique_column",
+                                ..
+                            } => {
                                cols.push(it.text.clone());
                                items.next();
                            }
@@ -1575,7 +1586,10 @@ fn build_sql_create_table(path: &MatchedPath, source: &str) -> Result<Command, V
                    // column's flag (round-trips via the single-column
                    // path); composite (or a name not among the
                    // columns) becomes a constraint.
-                    match columns.iter_mut().find(|c| cols.len() == 1 && c.name == cols[0]) {
+                    match columns
+                        .iter_mut()
+                        .find(|c| cols.len() == 1 && c.name == cols[0])
+                    {
                        Some(c) => c.unique = true,
                        None if !cols.is_empty() => unique_constraints.push(cols),
                        None => {}
@@ -1588,16 +1602,17 @@ fn build_sql_create_table(path: &MatchedPath, source: &str) -> Result<Command, V
            // the most recent column) or the table-level clause (whose
            // `pk_column` idents follow and are collected above).
            MatchedKind::Word("primary") => {
-                if matches!(items.peek().map(|i| &i.kind), Some(MatchedKind::Word("key"))) {
+                if matches!(
+                    items.peek().map(|i| &i.kind),
+                    Some(MatchedKind::Word("key"))
+                ) {
                    items.next();
                    // Table-level `PRIMARY KEY (…)` is followed by `(`
                    // (then `pk_column` idents, collected above);
                    // column-level `PRIMARY KEY` is not, and marks the
                    // most-recent column.
-                    let table_level = matches!(
-                        items.peek().map(|i| &i.kind),
-                        Some(MatchedKind::Punct('('))
-                    );
+                    let table_level =
+                        matches!(items.peek().map(|i| &i.kind), Some(MatchedKind::Punct('(')));
                    if !table_level && let Some(last) = columns.last() {
                        primary_key.push(last.name.clone());
                    }
@@ -1647,12 +1662,20 @@ fn build_sql_create_table(path: &MatchedPath, source: &str) -> Result<Command, V
                // Inline FK is single-column (the column it sits on);
                // a compound FK uses the table-level form (ADR-0043 D4).
                let child_column = columns.last().map_or_else(String::new, |c| c.name.clone());
-                foreign_keys.push(consume_fk_reference(&mut items, None, vec![child_column], true));
+                foreign_keys.push(consume_fk_reference(
+                    &mut items,
+                    None,
+                    vec![child_column],
+                    true,
+                ));
            }
            // Table-level `[constraint <name>] foreign key (<col>)
            // references <parent> [(<col>)] [on …]` (ADR-0035 §5, 4b).
            MatchedKind::Word("foreign") => {
-                if matches!(items.peek().map(|i| &i.kind), Some(MatchedKind::Word("key"))) {
+                if matches!(
+                    items.peek().map(|i| &i.kind),
+                    Some(MatchedKind::Word("key"))
+                ) {
                    items.next(); // `key`
                }
                // `( <child column> [, <child column>]* )` — a compound
@@ -1674,7 +1697,10 @@ fn build_sql_create_table(path: &MatchedPath, source: &str) -> Result<Command, V
                    items.next();
                }
                // `references <parent> …`
-                if matches!(items.peek().map(|i| &i.kind), Some(MatchedKind::Word("references"))) {
+                if matches!(
+                    items.peek().map(|i| &i.kind),
+                    Some(MatchedKind::Word("references"))
+                ) {
                    items.next();
                }
                let fk =
@@ -1859,13 +1885,19 @@ where
        Some(MatchedKind::Word("cascade")) => ReferentialAction::Cascade,
        Some(MatchedKind::Word("restrict")) => ReferentialAction::Restrict,
        Some(MatchedKind::Word("set")) => {
-            if matches!(items.peek().map(|i| &i.kind), Some(MatchedKind::Word("null"))) {
+            if matches!(
+                items.peek().map(|i| &i.kind),
+                Some(MatchedKind::Word("null"))
+            ) {
                items.next();
            }
            ReferentialAction::SetNull
        }
        Some(MatchedKind::Word("no")) => {
-            if matches!(items.peek().map(|i| &i.kind), Some(MatchedKind::Word("action"))) {
+            if matches!(
+                items.peek().map(|i| &i.kind),
+                Some(MatchedKind::Word("action"))
+            ) {
                items.next();
            }
            ReferentialAction::NoAction
@@ -1879,7 +1911,7 @@ pub static SQL_CREATE_TABLE: CommandNode = CommandNode {
    shape: Node::Subgrammar(&super::sql_create_table::SQL_CREATE_TABLE_SHAPE),
    ast_builder: build_sql_create_table,
    help_id: Some("ddl.sql_create_table"),
-    hint_ids: &[],
+    hint_ids: &["sql_create_table"],
    usage_ids: &["parse.usage.sql_create_table"],
 };

@@ -1899,7 +1931,7 @@ pub static SQL_DROP_TABLE: CommandNode = CommandNode {
    shape: SQL_DROP_TABLE_SHAPE,
    ast_builder: build_sql_drop_table,
    help_id: Some("ddl.sql_drop_table"),
-    hint_ids: &[],
+    hint_ids: &["sql_drop_table"],
    usage_ids: &["parse.usage.sql_drop_table"],
 };

@@ -1919,7 +1951,7 @@ pub static SQL_DROP_INDEX: CommandNode = CommandNode {
    shape: SQL_DROP_INDEX_SHAPE,
    ast_builder: build_sql_drop_index,
    help_id: Some("ddl.sql_drop_index"),
-    hint_ids: &[],
+    hint_ids: &["sql_drop_index"],
    usage_ids: &["parse.usage.sql_drop_index"],
 };

@@ -1933,11 +1965,12 @@ pub static SQL_DROP_INDEX: CommandNode = CommandNode {
 // concrete keyword (`unique index` | `index`) — the trap-safe form (the
 // §3 rule forbids a leading *Optional*, not a leading `Choice`). The
 // builder reads `unique` presence via `contains_word("unique")`.
-static SQL_CI_UNIQUE_INDEX_NODES: &[Node] =
-    &[Node::Word(Word::keyword("unique")), Node::Word(Word::keyword("index"))];
+static SQL_CI_UNIQUE_INDEX_NODES: &[Node] = &[
+    Node::Word(Word::keyword("unique")),
+    Node::Word(Word::keyword("index")),
+];
 const SQL_CI_UNIQUE_INDEX: Node = Node::Seq(SQL_CI_UNIQUE_INDEX_NODES);
-static SQL_CI_LEAD_CHOICES: &[Node] =
-    &[SQL_CI_UNIQUE_INDEX, Node::Word(Word::keyword("index"))];
+static SQL_CI_LEAD_CHOICES: &[Node] = &[SQL_CI_UNIQUE_INDEX, Node::Word(Word::keyword("index"))];
 const SQL_CI_LEAD: Node = Node::Choice(SQL_CI_LEAD_CHOICES);

 static SQL_CI_IF_NOT_EXISTS_NODES: &[Node] = &[
@@ -2001,7 +2034,7 @@ pub static SQL_CREATE_INDEX: CommandNode = CommandNode {
    shape: SQL_CREATE_INDEX_SHAPE,
    ast_builder: build_sql_create_index,
    help_id: Some("ddl.sql_create_index"),
-    hint_ids: &[],
+    hint_ids: &["sql_create_index"],
    usage_ids: &["parse.usage.sql_create_index"],
 };

@@ -2104,8 +2137,7 @@ static AT_RENAME_COLUMN_TAIL_NODES: &[Node] = &[
    NEW_COLUMN_NAME,
 ];
 const AT_RENAME_COLUMN_TAIL: Node = Node::Seq(AT_RENAME_COLUMN_TAIL_NODES);
-static AT_RENAME_TABLE_TAIL_NODES: &[Node] =
-    &[Node::Word(Word::keyword("to")), NEW_TABLE_NAME];
+static AT_RENAME_TABLE_TAIL_NODES: &[Node] = &[Node::Word(Word::keyword("to")), NEW_TABLE_NAME];
 const AT_RENAME_TABLE_TAIL: Node = Node::Seq(AT_RENAME_TABLE_TAIL_NODES);
 static AT_RENAME_TAIL_CHOICES: &[Node] = &[AT_RENAME_COLUMN_TAIL, AT_RENAME_TABLE_TAIL];
 const AT_RENAME_TAIL: Node = Node::Choice(AT_RENAME_TAIL_CHOICES);
@@ -2132,8 +2164,10 @@ static AT_AC_TYPE_NODES: &[Node] = &[
    super::sql_create_table::SQL_TYPE,
 ];
 const AT_AC_TYPE: Node = Node::Seq(AT_AC_TYPE_NODES);
-static AT_AC_NOT_NULL_NODES: &[Node] =
-    &[Node::Word(Word::keyword("not")), Node::Word(Word::keyword("null"))];
+static AT_AC_NOT_NULL_NODES: &[Node] = &[
+    Node::Word(Word::keyword("not")),
+    Node::Word(Word::keyword("null")),
+];
 const AT_AC_NOT_NULL: Node = Node::Seq(AT_AC_NOT_NULL_NODES);
 static AT_AC_SET_DATA_TYPE_NODES: &[Node] = &[
    Node::Word(Word::keyword("data")),
@@ -2149,8 +2183,7 @@ static AT_AC_SET_TAIL_CHOICES: &[Node] = &[
 const AT_AC_SET_TAIL: Node = Node::Choice(AT_AC_SET_TAIL_CHOICES);
 static AT_AC_SET_NODES: &[Node] = &[Node::Word(Word::keyword("set")), AT_AC_SET_TAIL];
 const AT_AC_SET: Node = Node::Seq(AT_AC_SET_NODES);
-static AT_AC_DROP_TAIL_CHOICES: &[Node] =
-    &[AT_AC_NOT_NULL, Node::Word(Word::keyword("default"))];
+static AT_AC_DROP_TAIL_CHOICES: &[Node] = &[AT_AC_NOT_NULL, Node::Word(Word::keyword("default"))];
 const AT_AC_DROP_TAIL: Node = Node::Choice(AT_AC_DROP_TAIL_CHOICES);
 static AT_AC_DROP_NODES: &[Node] = &[Node::Word(Word::keyword("drop")), AT_AC_DROP_TAIL];
 const AT_AC_DROP: Node = Node::Seq(AT_AC_DROP_NODES);
@@ -2258,10 +2291,14 @@ fn build_alter_add_column_spec(
    let mut items = path.items.iter().peekable();
    while let Some(item) = items.next() {
        match &item.kind {
-            MatchedKind::Ident { role: "col_name", .. } => {
+            MatchedKind::Ident {
+                role: "col_name", ..
+            } => {
                pending_name = Some(item.text.clone());
            }
-            MatchedKind::Ident { role: "col_type", .. } => {
+            MatchedKind::Ident {
+                role: "col_type", ..
+            } => {
                let ty = Type::from_sql_name(&item.text).ok_or_else(|| ValidationError {
                    message_key: "parse.error_wrapper",
                    args: vec![("detail", "unknown type".to_string())],
@@ -2280,7 +2317,10 @@ fn build_alter_add_column_spec(
                spec = Some(ColumnSpec::new(name, Type::Real));
            }
            MatchedKind::Word("not") => {
-                if matches!(items.peek().map(|i| &i.kind), Some(MatchedKind::Word("null"))) {
+                if matches!(
+                    items.peek().map(|i| &i.kind),
+                    Some(MatchedKind::Word("null"))
+                ) {
                    items.next();
                    if let Some(s) = spec.as_mut() {
                        s.not_null = true;
@@ -2326,11 +2366,15 @@ fn build_alter_column_type(path: &MatchedPath) -> Result<AlterTableAction, Valid
    let mut items = path.items.iter().peekable();
    while let Some(item) = items.next() {
        match &item.kind {
-            MatchedKind::Ident { role: "col_type", .. } => {
-                ty = Some(Type::from_sql_name(&item.text).ok_or_else(|| ValidationError {
-                    message_key: "parse.error_wrapper",
-                    args: vec![("detail", "unknown type".to_string())],
-                })?);
+            MatchedKind::Ident {
+                role: "col_type", ..
+            } => {
+                ty = Some(
+                    Type::from_sql_name(&item.text).ok_or_else(|| ValidationError {
+                        message_key: "parse.error_wrapper",
+                        args: vec![("detail", "unknown type".to_string())],
+                    })?,
+                );
            }
            MatchedKind::Word("double") => {
                if matches!(
@@ -2379,7 +2423,10 @@ fn build_alter_column_attr(
                message_key: "parse.error_wrapper",
                args: vec![("detail", "set default needs a value".to_string())],
            })?;
-            AlterTableAction::SetColumnDefault { column, default_sql }
+            AlterTableAction::SetColumnDefault {
+                column,
+                default_sql,
+            }
        }
        (false, true) => AlterTableAction::DropColumnDefault { column },
        (true, false) => AlterTableAction::SetColumnNotNull { column },
@@ -2495,10 +2542,7 @@ fn build_alter_add_table_constraint(
 /// Capture the raw SQL text of an `ADD … CHECK (<expr>)` (ADR-0035 §4g).
 /// `sql_expr` is validate-only, so the expression is captured by byte
 /// span — the 4a.2 / 4e mechanism.
-fn capture_table_check_sql(
-    path: &MatchedPath,
-    source: &str,
-) -> Result<String, ValidationError> {
+fn capture_table_check_sql(path: &MatchedPath, source: &str) -> Result<String, ValidationError> {
    let mut items = path.items.iter().peekable();
    while let Some(item) = items.next() {
        if matches!(item.kind, MatchedKind::Word("check"))
@@ -2528,7 +2572,10 @@ fn build_alter_fk(path: &MatchedPath) -> SqlForeignKey {
        items.next();
    }
    items.next(); // `foreign`
-    if matches!(items.peek().map(|i| &i.kind), Some(MatchedKind::Word("key"))) {
+    if matches!(
+        items.peek().map(|i| &i.kind),
+        Some(MatchedKind::Word("key"))
+    ) {
        items.next();
    }
    if matches!(items.peek().map(|i| &i.kind), Some(MatchedKind::Punct('('))) {
@@ -2548,7 +2595,10 @@ fn build_alter_fk(path: &MatchedPath) -> SqlForeignKey {
    if matches!(items.peek().map(|i| &i.kind), Some(MatchedKind::Punct(')'))) {
        items.next();
    }
-    if matches!(items.peek().map(|i| &i.kind), Some(MatchedKind::Word("references"))) {
+    if matches!(
+        items.peek().map(|i| &i.kind),
+        Some(MatchedKind::Word("references"))
+    ) {
        items.next();
    }
    // `ALTER TABLE … ADD FOREIGN KEY (…)` is the table-level form.
@@ -2560,7 +2610,7 @@ pub static SQL_ALTER_TABLE: CommandNode = CommandNode {
    shape: SQL_ALTER_TABLE_SHAPE,
    ast_builder: build_sql_alter_table,
    help_id: Some("ddl.sql_alter_table"),
-    hint_ids: &[],
+    hint_ids: &["sql_alter_table"],
    usage_ids: &["parse.usage.sql_alter_table"],
 };

@@ -2626,7 +2676,10 @@ mod constraint_tests {
    fn an_unconstrained_create_table_still_parses() {
        let cols = create_columns("create table T with pk id(serial), name(text)");
        assert_eq!(cols.len(), 2);
-        assert!(cols.iter().all(|c| !c.not_null && !c.unique && c.default.is_none()));
+        assert!(
+            cols.iter()
+                .all(|c| !c.not_null && !c.unique && c.default.is_none())
+        );
    }

    #[test]
@@ -2651,7 +2704,9 @@ mod constraint_tests {
    #[test]
    fn add_column_parses_a_unique_constraint() {
        match parse_command("add column to T: email (text) unique").expect("parse") {
-            Command::AddColumn { unique, not_null, .. } => {
+            Command::AddColumn {
+                unique, not_null, ..
+            } => {
                assert!(unique);
                assert!(!not_null);
            }
@@ -2682,9 +2737,7 @@ mod constraint_tests {
    fn check_with_a_parenthesised_sub_expression_parses() {
        // The check's own parens plus a nested group — the
        // builder's paren-depth scan must pair them correctly.
-        let cols = create_columns(
-            "create table T with pk n(int) check ((n > 0) or (n < -10))",
-        );
+        let cols = create_columns("create table T with pk n(int) check ((n > 0) or (n < -10))");
        assert!(cols[0].check.is_some());
    }

@@ -2731,8 +2784,7 @@ mod constraint_tests {

    #[test]
    fn add_constraint_check_parses() {
-        match parse_command("add constraint check (age >= 0) to Users.age").expect("parse")
-        {
+        match parse_command("add constraint check (age >= 0) to Users.age").expect("parse") {
            Command::AddConstraint {
                column, constraint, ..
            } => {
@@ -2826,8 +2878,11 @@ mod sql_drop_table_tests {
            Command::DropColumn { .. }
        ));
        assert!(matches!(
-            parse_command_in_mode("drop relationship Customers_id_to_Orders_CustId", Mode::Advanced)
-                .expect("parses"),
+            parse_command_in_mode(
+                "drop relationship Customers_id_to_Orders_CustId",
+                Mode::Advanced
+            )
+            .expect("parses"),
            Command::DropRelationship { .. }
        ));
    }
@@ -2932,7 +2987,13 @@ mod sql_create_index_tests {
                columns,
                unique,
                if_not_exists,
-            } => Ci { name, table, columns, unique, if_not_exists },
+            } => Ci {
+                name,
+                table,
+                columns,
+                unique,
+                if_not_exists,
+            },
            other => panic!("expected SqlCreateIndex, got {other:?}"),
        }
    }
@@ -3134,7 +3195,9 @@ mod sql_alter_table_tests {
        // The target slot carries the `reject_internal_table` validator
        // (mirroring CREATE TABLE), so an `__rdbms_*` target is refused
        // before submit — engine-neutral, not a raw engine error.
-        assert!(parse_command_in_mode("alter table T rename to __rdbms_evil", Mode::Advanced).is_err());
+        assert!(
+            parse_command_in_mode("alter table T rename to __rdbms_evil", Mode::Advanced).is_err()
+        );
    }

    #[test]
@@ -3213,7 +3276,10 @@ mod sql_alter_table_tests {
        // alias map still applies through the synonym
        assert!(matches!(
            alter("alter table T alter column n set data type double precision").1,
-            AlterTableAction::AlterColumnType { ty: crate::dsl::types::Type::Real, .. }
+            AlterTableAction::AlterColumnType {
+                ty: crate::dsl::types::Type::Real,
+                ..
+            }
        ));
    }

@@ -3238,7 +3304,10 @@ mod sql_alter_table_tests {
    #[test]
    fn alter_column_set_default_captures_raw_expr() {
        match alter("alter table T alter column qty set default 0").1 {
-            AlterTableAction::SetColumnDefault { column, default_sql } => {
+            AlterTableAction::SetColumnDefault {
+                column,
+                default_sql,
+            } => {
                assert_eq!(column, "qty");
                assert_eq!(default_sql, "0");
            }
@@ -3317,7 +3386,9 @@ mod sql_alter_table_tests {
        match alter("alter table T add check (a < b)").1 {
            AlterTableAction::AddTableConstraint { name, constraint } => {
                assert_eq!(name, None);
-                assert!(matches!(*constraint, TableConstraint::Check { ref expr_sql } if expr_sql == "a < b"));
+                assert!(
+                    matches!(*constraint, TableConstraint::Check { ref expr_sql } if expr_sql == "a < b")
+                );
            }
            other => panic!("expected AddTableConstraint/Check, got {other:?}"),
        }
@@ -3335,7 +3406,9 @@ mod sql_alter_table_tests {
        match alter("alter table T add unique (a, b)").1 {
            AlterTableAction::AddTableConstraint { name, constraint } => {
                assert_eq!(name, None);
-                assert!(matches!(*constraint, TableConstraint::Unique { ref columns } if columns == &["a".to_string(), "b".to_string()]));
+                assert!(
+                    matches!(*constraint, TableConstraint::Unique { ref columns } if columns == &["a".to_string(), "b".to_string()])
+                );
            }
            other => panic!("expected AddTableConstraint/Unique, got {other:?}"),
        }
@@ -3352,7 +3425,9 @@ mod sql_alter_table_tests {
        )
        .expect_err("a named UNIQUE constraint is refused");
        assert!(
-            err.to_string().to_lowercase().contains("unique constraint cannot be named"),
+            err.to_string()
+                .to_lowercase()
+                .contains("unique constraint cannot be named"),
            "expected the builder's named-UNIQUE refusal, got: {err}"
        );
    }
@@ -3364,7 +3439,9 @@ mod sql_alter_table_tests {
        let err = parse_command_in_mode("alter table T add primary key (id)", Mode::Advanced)
            .expect_err("ADD PRIMARY KEY is refused");
        assert!(
-            err.to_string().to_lowercase().contains("primary key is fixed at creation"),
+            err.to_string()
+                .to_lowercase()
+                .contains("primary key is fixed at creation"),
            "expected the builder's ADD-PRIMARY-KEY refusal, got: {err}"
        );
    }
@@ -3392,7 +3469,10 @@ mod sql_alter_table_tests {
                assert_eq!(name.as_deref(), Some("fk_p"));
                match *constraint {
                    TableConstraint::ForeignKey(fk) => {
-                        assert_eq!(fk.parent_columns, None, "bare reference resolves at execution");
+                        assert_eq!(
+                            fk.parent_columns, None,
+                            "bare reference resolves at execution"
+                        );
                    }
                    other => panic!("expected ForeignKey, got {other:?}"),
                }
@@ -79,9 +79,9 @@ const EXPR_COLUMN: Node = Node::Ident {
    writes_table: false,
    writes_column: true,
    writes_user_listed_column: false,
-writes_table_alias: false,
-writes_cte_name: false,
-writes_projection_alias: false,
+    writes_table_alias: false,
+    writes_cte_name: false,
+    writes_projection_alias: false,
 };

 /// Operand alternatives. The literal keywords (`null` / `true`
@@ -126,8 +126,7 @@ fn where_rhs_operand(ctx: &WalkContext) -> Node {
            // the leak is per distinct column (the walker
            // memoizes `DynamicSubgrammar` resolution on
            // `current_column`), not per keystroke.
-            let leaked: &'static str =
-                Box::leak(col.name.clone().into_boxed_str());
+            let leaked: &'static str = Box::leak(col.name.clone().into_boxed_str());
            Node::TypedValueSlot {
                ty: col.user_type,
                column_name: Some(leaked),
@@ -260,10 +259,8 @@ static PAREN_GROUP_NODES: &[Node] = &[
    Node::Subgrammar(&OR_EXPR),
    Node::Punct(')'),
 ];
-static BOOL_PRIMARY_CHOICES: &[Node] = &[
-    Node::Seq(PAREN_GROUP_NODES),
-    Node::Subgrammar(&PREDICATE),
-];
+static BOOL_PRIMARY_CHOICES: &[Node] =
+    &[Node::Seq(PAREN_GROUP_NODES), Node::Subgrammar(&PREDICATE)];
 static BOOL_PRIMARY: Node = Node::Choice(BOOL_PRIMARY_CHOICES);

 /// `not_expr := NOT not_expr | bool_primary`.
@@ -271,10 +268,7 @@ static NOT_FORM_NODES: &[Node] = &[
    Node::Word(Word::keyword("not")),
    Node::Subgrammar(&NOT_EXPR),
 ];
-static NOT_EXPR_CHOICES: &[Node] = &[
-    Node::Seq(NOT_FORM_NODES),
-    Node::Subgrammar(&BOOL_PRIMARY),
-];
+static NOT_EXPR_CHOICES: &[Node] = &[Node::Seq(NOT_FORM_NODES), Node::Subgrammar(&BOOL_PRIMARY)];
 static NOT_EXPR: Node = Node::Choice(NOT_EXPR_CHOICES);

 /// `and_expr := not_expr ( AND not_expr )*`.
@@ -296,10 +290,7 @@ static AND_EXPR: Node = Node::Seq(AND_EXPR_NODES);
 /// `or_expr := and_expr ( OR and_expr )*` — the fragment entry
 /// point. `update` / `delete` / `show data` reference this
 /// through `Node::Subgrammar(&OR_EXPR)`.
-static OR_TAIL_NODES: &[Node] = &[
-    Node::Word(Word::keyword("or")),
-    Node::Subgrammar(&AND_EXPR),
-];
+static OR_TAIL_NODES: &[Node] = &[Node::Word(Word::keyword("or")), Node::Subgrammar(&AND_EXPR)];
 static OR_TAIL: Node = Node::Seq(OR_TAIL_NODES);
 static OR_EXPR_NODES: &[Node] = &[
    Node::Subgrammar(&AND_EXPR),
@@ -534,18 +525,18 @@ impl<'a> ExprParser<'a> {
        let span = item.span;
        let literal = |value: Value| Operand::Literal { value, span };
        match &item.kind {
-            MatchedKind::Ident { role: "expr_column", .. } => {
-                Ok(Operand::Column { name: item.text.clone(), span })
-            }
+            MatchedKind::Ident {
+                role: "expr_column",
+                ..
+            } => Ok(Operand::Column {
+                name: item.text.clone(),
+                span,
+            }),
            MatchedKind::Word("null") => Ok(literal(Value::Null)),
            MatchedKind::Word("true") => Ok(literal(Value::Bool(true))),
            MatchedKind::Word("false") => Ok(literal(Value::Bool(false))),
-            MatchedKind::NumberLit => {
-                Ok(literal(Value::Number(item.text.clone())))
-            }
-            MatchedKind::StringLit => {
-                Ok(literal(Value::Text(item.text.clone())))
-            }
+            MatchedKind::NumberLit => Ok(literal(Value::Number(item.text.clone()))),
+            MatchedKind::StringLit => Ok(literal(Value::Text(item.text.clone()))),
            _ => Err(drift_error("expected a column or literal operand")),
        }
    }
@@ -591,8 +582,7 @@ mod tests {
        let mut ctx = WalkContext::new();
        let mut path = MatchedPath::new();
        let mut per_byte = Vec::new();
-        let result =
-            walk_node(input, 0, &OR_EXPR, &mut ctx, &mut path, &mut per_byte);
+        let result = walk_node(input, 0, &OR_EXPR, &mut ctx, &mut path, &mut per_byte);
        match result {
            NodeWalkResult::Matched { end, .. } => {
                assert!(
@@ -730,8 +720,7 @@ mod tests {
                negated: false,
            }),
        );
-        let Expr::Predicate(Predicate::Like { negated, .. }) =
-            parse_expr("Name not like 'A%'")
+        let Expr::Predicate(Predicate::Like { negated, .. }) = parse_expr("Name not like 'A%'")
        else {
            panic!("expected a negated Like");
        };
@@ -794,16 +783,16 @@ mod tests {
    fn nested_parentheses_round_trip() {
        // Exercises the Subgrammar recursion a few levels deep.
        let expr = parse_expr("((a = 1 and b = 2) or (c = 3))");
-        assert!(matches!(expr, Expr::Or(_) | Expr::And(_) | Expr::Predicate(_)));
+        assert!(matches!(
+            expr,
+            Expr::Or(_) | Expr::And(_) | Expr::Predicate(_)
+        ));
    }

    #[test]
    fn case_insensitive_keywords() {
        // Keywords fold case; the built tree is identical.
-        assert_eq!(
-            parse_expr("a = 1 AND b = 2"),
-            parse_expr("a = 1 and b = 2"),
-        );
+        assert_eq!(parse_expr("a = 1 AND b = 2"), parse_expr("a = 1 and b = 2"),);
        assert_eq!(
            parse_expr("Email IS NOT NULL"),
            parse_expr("Email is not null"),
@@ -27,9 +27,9 @@ pub mod data;
 pub mod ddl;
 pub mod expr;
 pub mod shared;
-pub mod sql_expr;
 pub mod sql_create_table;
 pub mod sql_delete;
+pub mod sql_expr;
 pub mod sql_insert;
 pub mod sql_select;
 pub mod sql_update;
@@ -328,9 +328,7 @@ pub enum Node {
    /// A number literal. The optional `validator` runs against
    /// the matched text (used by Phase D value slots to enforce
    /// per-type integer/decimal rules).
-    NumberLit {
-        validator: Option<NumberValidator>,
-    },
+    NumberLit { validator: Option<NumberValidator> },
    /// A literal byte sequence at this position — matches
    /// bytes verbatim (whitespace-skipped) with a lookahead so
    /// `1` doesn't half-match `12` and `n` doesn't half-match
@@ -616,10 +614,13 @@ pub fn usage_keys_for_input_in_mode(
 /// form has no tier-3 block yet (the caller falls back to tier-2).
 #[must_use]
 pub fn hint_key_for_input_in_mode(source: &str, mode: crate::mode::Mode) -> Option<&'static str> {
+    use crate::dsl::walker::lex_helpers::{consume_ident, skip_whitespace};
    let nodes = selected_nodes_for_input_in_mode(source, mode);
    if nodes.is_empty() {
        return None;
    }
+    // Mode-ordered union (advanced-primary first in advanced mode), so a
+    // shared entry word resolves to the surface the user is in.
    let mut keys: Vec<&'static str> = Vec::new();
    for (_, node, _) in &nodes {
        for k in node.hint_ids {
@@ -628,7 +629,25 @@ pub fn hint_key_for_input_in_mode(source: &str, mode: crate::mode::Mode) -> Opti
            }
        }
    }
-    pick_form_key(source, &keys)
+    if keys.is_empty() {
+        return None;
+    }
+    if keys.len() == 1 {
+        return Some(keys[0]);
+    }
+    // A bare multi-form entry word (no form word yet — `add`⏎) has no
+    // chosen form: defer to tier-2, which lists the choices.
+    let start = skip_whitespace(source, 0);
+    if let Some((_, entry_end)) = consume_ident(source, start)
+        && skip_whitespace(source, entry_end) >= source.len()
+    {
+        return None;
+    }
+    // A form word picks the form (`drop column` → `drop_column`); when
+    // the second token isn't a form word (`insert into …`, `update …
+    // set`), fall back to the mode-primary key — in advanced mode the
+    // SQL form, in simple mode the DSL form.
+    pick_form_key(source, &keys).or_else(|| keys.first().copied())
 }

 /// Shared mode-aware command-form selection for the entry word at the
@@ -680,7 +699,11 @@ fn selected_nodes_for_input_in_mode(
                .filter(|(_, _, c)| *c == CommandCategory::Simple)
                .collect()
        };
-    if selected.is_empty() { candidates } else { selected }
+    if selected.is_empty() {
+        candidates
+    } else {
+        selected
+    }
 }

 /// The single usage template most relevant to `source`, when
@@ -703,10 +726,7 @@ pub fn usage_key_for_input(source: &str) -> Option<&'static str> {
 /// disambiguates the single most-relevant usage key from the
 /// mode-selected key set.
 #[must_use]
-pub fn usage_key_for_input_in_mode(
-    source: &str,
-    mode: crate::mode::Mode,
-) -> Option<&'static str> {
+pub fn usage_key_for_input_in_mode(source: &str, mode: crate::mode::Mode) -> Option<&'static str> {
    let (_entry, keys) = usage_keys_for_input_in_mode(source, mode)?;
    pick_form_key(source, &keys)
 }
@@ -734,7 +754,10 @@ fn pick_form_key<'a>(source: &str, keys: &[&'a str]) -> Option<&'a str> {
    }
    // The `create m:n relationship` form (ADR-0045) opens with `m:n`
    // — a letter, so the digit branch misses it; its key ends `…m2n`.
-    if source[after..].get(..3).is_some_and(|s| s.eq_ignore_ascii_case("m:n")) {
+    if source[after..]
+        .get(..3)
+        .is_some_and(|s| s.eq_ignore_ascii_case("m:n"))
+    {
        return keys.iter().copied().find(|k| k.ends_with("m2n"));
    }
    // Otherwise the form word is an identifier — `column`, `index`,
@@ -749,8 +772,7 @@ fn pick_form_key<'a>(source: &str, keys: &[&'a str]) -> Option<&'a str> {
 /// which read the same data through the legacy `usage::REGISTRY`.
 #[must_use]
 pub fn entry_words_alphabetised() -> Vec<&'static str> {
-    let mut words: Vec<&'static str> =
-        REGISTRY.iter().map(|(c, _)| c.entry.primary).collect();
+    let mut words: Vec<&'static str> = REGISTRY.iter().map(|(c, _)| c.entry.primary).collect();
    words.sort_unstable();
    words.dedup();
    words
@@ -770,6 +792,7 @@ pub static REGISTRY: &[(&CommandNode, CommandCategory)] = &[
    (&app::QUIT, CommandCategory::Simple),
    (&app::HELP, CommandCategory::Simple),
    (&app::HINT, CommandCategory::Simple),
+    (&app::VERSION, CommandCategory::Simple),
    (&app::REBUILD, CommandCategory::Simple),
    (&app::SAVE, CommandCategory::Simple),
    (&app::NEW, CommandCategory::Simple),
@@ -883,9 +906,7 @@ pub fn command_for_entry_word(word: &str) -> Option<(usize, &'static CommandNode
 /// returns its `Simple` DSL node and `Advanced` SQL node. The
 /// dispatcher picks among them by the active input mode.
 #[must_use]
-pub fn commands_for_entry_word(
-    word: &str,
-) -> Vec<(usize, &'static CommandNode, CommandCategory)> {
+pub fn commands_for_entry_word(word: &str) -> Vec<(usize, &'static CommandNode, CommandCategory)> {
    REGISTRY
        .iter()
        .enumerate()
@@ -922,9 +943,147 @@ mod hint_key_tests {
            hint_key_for_input_in_mode("drop table T", Mode::Simple),
            Some("drop_table")
        );
+        // Mode picks the surface for a shared entry word whose second
+        // token isn't a form word: SQL form in advanced, DSL in simple.
+        assert_eq!(
+            hint_key_for_input_in_mode("insert into T values (1)", Mode::Advanced),
+            Some("sql_insert")
+        );
+        assert_eq!(
+            hint_key_for_input_in_mode("insert into T values (1)", Mode::Simple),
+            Some("insert")
+        );
+        // `create table` shares a form word — advanced-first ordering
+        // resolves it to the SQL form in advanced mode.
+        assert_eq!(
+            hint_key_for_input_in_mode("create table T (id int)", Mode::Advanced),
+            Some("sql_create_table")
+        );
        // Unknown entry word → None (tier-2 fallback).
        assert_eq!(hint_key_for_input_in_mode("zzz", Mode::Simple), None);
    }
+
+    /// Comprehensiveness gate (ADR-0053 D6): every command form in the
+    /// REGISTRY carries at least one `hint_id`, and each resolves to a
+    /// tier-3 `hint.cmd.<id>` block. `keys.rs` checks referenced keys
+    /// resolve; this checks every command *has* one.
+    #[test]
+    fn every_command_form_has_a_tier3_block() {
+        let cat = crate::friendly::catalog();
+        for (node, _category) in super::REGISTRY {
+            assert!(
+                !node.hint_ids.is_empty(),
+                "command `{}` has no hint_ids (ADR-0053 D6)",
+                node.entry.primary
+            );
+            for id in node.hint_ids {
+                let key = format!("hint.cmd.{id}.what");
+                assert!(
+                    cat.get(&key).is_some(),
+                    "missing tier-3 block `{key}` for command `{}`",
+                    node.entry.primary
+                );
+            }
+        }
+    }
+
+    /// Comprehensiveness gate (ADR-0053 D6): every runtime error class
+    /// `friendly::error_hint_class` can return resolves to a tier-3
+    /// `hint.err.<class>` block. Keep this list in sync with
+    /// `error_hint_class` (its own unit tests pin the outputs).
+    /// Diagnostic classes are deferred (issue #38), so not checked here.
+    #[test]
+    fn every_runtime_error_class_has_a_tier3_block() {
+        let cat = crate::friendly::catalog();
+        let classes = [
+            "unique",
+            "foreign_key.child_side",
+            "foreign_key.parent_side",
+            "not_null",
+            "check",
+            "type_mismatch",
+            "not_found",
+            "already_exists",
+            "generic",
+            "invalid_value",
+        ];
+        for c in classes {
+            let key = format!("hint.err.{c}.what");
+            assert!(
+                cat.get(&key).is_some(),
+                "missing tier-3 error block `{key}`"
+            );
+        }
+    }
+
+    /// Semantic-verification guard (handoff-71): every `hint.cmd.<form>`
+    /// **example** must parse in the mode the form is taught for. This
+    /// backstops the bug class found in the H2 corpus pass — an example
+    /// that drifts out of the real grammar (a typo, a removed clause, or
+    /// an argument the command never accepted, e.g. an inline name on
+    /// `save as` which opens a modal instead). It cannot police the
+    /// *semantics* of an example that happens to parse (that is the
+    /// manual pass), but it locks the syntactic floor so future edits
+    /// can't ship an unparseable teaching line.
+    ///
+    /// The mode per form mirrors `hint_key_for_input_in_mode`: the
+    /// advanced-SQL forms are taught in advanced mode; everything else
+    /// (DSL + app commands) in simple mode.
+    #[test]
+    fn every_cmd_hint_example_parses_in_its_mode() {
+        use crate::dsl::parser::parse_command_in_mode;
+        use crate::mode::Mode;
+
+        // Advanced-mode forms — the SQL surface (ADR-0030–0039). Every
+        // other form (DSL + app commands) is taught in simple mode. This
+        // mirrors the mode split `hint_key_for_input_in_mode` resolves.
+        const ADVANCED: &[&str] = &[
+            "sql_create_table",
+            "sql_alter_table",
+            "sql_create_index",
+            "sql_drop_index",
+            "sql_drop_table",
+            "sql_insert",
+            "sql_update",
+            "sql_delete",
+            "select",
+            "with",
+            "explain_sql",
+        ];
+
+        // Iterate the *catalog* (the corpus is the source of truth), not the
+        // REGISTRY: this reaches every `hint.cmd.<id>` block including any
+        // not owned by a command node, so an orphaned or mis-keyed example
+        // can't slip past the guard.
+        let cat = crate::friendly::catalog();
+        let mut checked = 0usize;
+        for key in cat.keys() {
+            let Some(id) = key
+                .strip_prefix("hint.cmd.")
+                .and_then(|rest| rest.strip_suffix(".example"))
+            else {
+                continue;
+            };
+            let example = cat.get(key).expect("key came from the catalog");
+            let mode = if ADVANCED.contains(&id) {
+                Mode::Advanced
+            } else {
+                Mode::Simple
+            };
+            assert!(
+                parse_command_in_mode(example, mode).is_ok(),
+                "hint.cmd.{id}.example does not parse in {mode:?} mode: {example:?}",
+            );
+            checked += 1;
+        }
+        // Floor guard: the corpus had 49 command forms at the time of
+        // writing (ADR-0053). If this drops, a block (and its example
+        // coverage) silently vanished.
+        assert!(
+            checked >= 49,
+            "expected at least 49 hint.cmd.* examples, checked {checked}",
+        );
+    }
 }

 #[cfg(test)]
@@ -941,10 +1100,7 @@ mod usage_key_tests {
        let cases = [
            ("add column to T: c (int)", "parse.usage.add_column"),
            ("add index on T (c)", "parse.usage.add_index"),
-            (
-                "add constraint unique to T.c",
-                "parse.usage.add_constraint",
-            ),
+            ("add constraint unique to T.c", "parse.usage.add_constraint"),
            (
                "drop constraint check from T.c",
                "parse.usage.drop_constraint",
@@ -961,10 +1117,7 @@ mod usage_key_tests {
            ("drop table T", "parse.usage.drop_table"),
            ("drop column from table T: c", "parse.usage.drop_column"),
            ("drop index i", "parse.usage.drop_index"),
-            (
-                "drop relationship r",
-                "parse.usage.drop_relationship",
-            ),
+            ("drop relationship r", "parse.usage.drop_relationship"),
            ("show data T", "parse.usage.show_data"),
            ("show table T", "parse.usage.show_table"),
            // `create` is multi-form (table vs m:n, ADR-0045): each typed
@@ -7,8 +7,8 @@

 use crate::completion::TableColumn;
 use crate::dsl::grammar::{
-    HighlightClass, HintMode, IdentSource, IdentValidator, Node,
-    NumberValidator, ValidationError, Word,
+    HighlightClass, HintMode, IdentSource, IdentValidator, Node, NumberValidator, ValidationError,
+    Word,
 };
 use crate::dsl::types::Type;
 use crate::dsl::walker::context::WalkContext;
@@ -32,10 +32,7 @@ pub fn validate_type_name(value: &str) -> Result<(), ValidationError> {
            .join(", ");
        Err(ValidationError {
            message_key: "parse.custom.unknown_type",
-            args: vec![
-                ("found", value.to_string()),
-                ("expected", expected),
-            ],
+            args: vec![("found", value.to_string()), ("expected", expected)],
        })
    }
 }
@@ -51,12 +48,12 @@ pub const TYPE_SLOT: Node = Node::Ident {
    role: "type",
    validator: Some(TYPE_VALIDATOR),
    highlight_override: Some(HighlightClass::Type),
-        writes_table: false,
-        writes_column: false,
-        writes_user_listed_column: false,
-writes_table_alias: false,
-writes_cte_name: false,
-writes_projection_alias: false,
+    writes_table: false,
+    writes_column: false,
+    writes_user_listed_column: false,
+    writes_table_alias: false,
+    writes_cte_name: false,
+    writes_projection_alias: false,
 };

 // --- Qualified column reference (`<Table>.<Column>`) --------------
@@ -70,9 +67,9 @@ const QUALIFIED_COLUMN_NODES: &[Node] = &[
        writes_table: false,
        writes_column: false,
        writes_user_listed_column: false,
-    writes_table_alias: false,
-    writes_cte_name: false,
-    writes_projection_alias: false,
+        writes_table_alias: false,
+        writes_cte_name: false,
+        writes_projection_alias: false,
    },
    Node::Punct('.'),
    Node::Ident {
@@ -83,9 +80,9 @@ const QUALIFIED_COLUMN_NODES: &[Node] = &[
        writes_table: false,
        writes_column: false,
        writes_user_listed_column: false,
-    writes_table_alias: false,
-    writes_cte_name: false,
-    writes_projection_alias: false,
+        writes_table_alias: false,
+        writes_cte_name: false,
+        writes_projection_alias: false,
    },
 ];
 pub const QUALIFIED_COLUMN: Node = Node::Seq(QUALIFIED_COLUMN_NODES);
@@ -313,9 +310,7 @@ const fn slot_inner_for_type(ty: Type) -> &'static Node {
        Type::Real => &REAL_SLOT_INNER,
        Type::Decimal => &DECIMAL_SLOT_INNER,
        Type::Bool => &BOOL_SLOT_INNER,
-        Type::Text | Type::Date | Type::DateTime | Type::Blob | Type::ShortId => {
-            &TEXT_SLOT_INNER
-        }
+        Type::Text | Type::Date | Type::DateTime | Type::Blob | Type::ShortId => &TEXT_SLOT_INNER,
    }
 }

@@ -397,9 +392,7 @@ pub(crate) const FALLBACK_VALUE_LIST: Node = Node::Repeated {
 /// This is the single source of truth shared by [`column_value_list`]
 /// (which builds the typed slots) and the `data.rs` arity gate (which
 /// counts them) so the two never disagree (issue #17).
-pub fn insert_target_columns<'c>(
-    ctx: &'c WalkContext<'_>,
-) -> Option<Vec<&'c TableColumn>> {
+pub fn insert_target_columns<'c>(ctx: &'c WalkContext<'_>) -> Option<Vec<&'c TableColumn>> {
    let table_cols = ctx.current_table_columns.as_ref()?;
    if table_cols.is_empty() {
        return None;
@@ -405,8 +405,14 @@ const TABLE_FK_NAMED: Node = Node::Seq(TABLE_FK_NAMED_NODES);
 // / `foreign`) that disambiguates it from a column name. (A column
 // literally named with one of those keywords is therefore unavailable,
 // the same trade real SQL makes with its reserved words.)
-static ELEMENT_CHOICES: &[Node] =
-    &[TABLE_PK, TABLE_UNIQUE, TABLE_CHECK, TABLE_FK_NAMED, TABLE_FK, COLUMN_DEF];
+static ELEMENT_CHOICES: &[Node] = &[
+    TABLE_PK,
+    TABLE_UNIQUE,
+    TABLE_CHECK,
+    TABLE_FK_NAMED,
+    TABLE_FK,
+    COLUMN_DEF,
+];
 const ELEMENT_INNER: Node = Node::Choice(ELEMENT_CHOICES);
 // Issue #4: wrap the element slot in `IntroProse` so a fresh element
 // position (`create table T (` and after every `,`) surfaces a prose
@@ -495,18 +501,31 @@ mod tests {
        let mut ctx = WalkContext::new();
        let mut path = MatchedPath::new();
        let mut per_byte = Vec::new();
-        match walk_node(input, 0, &SQL_CREATE_TABLE_SHAPE, &mut ctx, &mut path, &mut per_byte) {
+        match walk_node(
+            input,
+            0,
+            &SQL_CREATE_TABLE_SHAPE,
+            &mut ctx,
+            &mut path,
+            &mut per_byte,
+        ) {
            NodeWalkResult::Matched { end, .. } => input[end..].trim().is_empty(),
            _ => false,
        }
    }

    fn good(input: &str) {
-        assert!(walks(input), "{input:?} should be a valid CREATE TABLE tail");
+        assert!(
+            walks(input),
+            "{input:?} should be a valid CREATE TABLE tail"
+        );
    }

    fn bad(input: &str) {
-        assert!(!walks(input), "{input:?} should NOT walk as a complete CREATE TABLE tail");
+        assert!(
+            !walks(input),
+            "{input:?} should NOT walk as a complete CREATE TABLE tail"
+        );
    }

    #[test]
@@ -638,7 +657,9 @@ mod tests {
        good("table t (id int, ref int references other(id))");
        good("table t (id int, ref int references other)"); // bare ref
        good("table t (id int, ref int references other(id) on delete cascade)");
-        good("table t (id int, ref int references other(id) on update set null on delete restrict)");
+        good(
+            "table t (id int, ref int references other(id) on update set null on delete restrict)",
+        );
        good("table t (id int, ref int, foreign key (ref) references other(id))");
        good("table t (id int, ref int, constraint fk_x foreign key (ref) references other(id))");
        good(
@@ -691,7 +712,10 @@ mod builder_tests {
        assert_eq!(name, "t");
        assert_eq!(
            cols,
-            vec![("id".to_string(), Type::Int), ("name".to_string(), Type::Text)]
+            vec![
+                ("id".to_string(), Type::Int),
+                ("name".to_string(), Type::Text)
+            ]
        );
        assert!(pk.is_empty(), "no PK declared");
        assert!(!ine);
@@ -740,7 +764,10 @@ mod builder_tests {
        let (_, cols, _, _) = sct("create table t (a varchar(255), b numeric(10, 2))");
        assert_eq!(
            cols,
-            vec![("a".to_string(), Type::Text), ("b".to_string(), Type::Decimal)]
+            vec![
+                ("a".to_string(), Type::Text),
+                ("b".to_string(), Type::Decimal)
+            ]
        );
    }

@@ -780,8 +807,7 @@ mod builder_tests {
    fn redundant_constraints_deduped_off_sole_pk_column() {
        // ADR-0035 §6.5: advanced mode accepts the redundant spelling
        // and silently drops the flags off the sole PK column.
-        match parse_command("create table t (id int primary key not null unique)")
-            .expect("parses")
+        match parse_command("create table t (id int primary key not null unique)").expect("parses")
        {
            Command::SqlCreateTable {
                columns,
@@ -944,8 +970,7 @@ mod builder_tests {
        // depth 2, not an element boundary, so the following `check`
        // is still column-level. A naive "reset on any comma" would
        // misclassify it as table-level (the §4.2 probe).
-        let (cols, checks) =
-            parse_sct_checks("create table t (n numeric(10, 2) check (n > 0))");
+        let (cols, checks) = parse_sct_checks("create table t (n numeric(10, 2) check (n > 0))");
        assert_eq!(col(&cols, "n").check_sql.as_deref(), Some("n > 0"));
        assert!(checks.is_empty(), "no table-level CHECK was produced");
    }
@@ -977,8 +1002,7 @@ mod builder_tests {
    fn table_check_before_a_later_column_is_table_level() {
        // A CHECK element that appears between columns (not after a
        // column's type) is table-level even though more columns follow.
-        let (cols, checks) =
-            parse_sct_checks("create table t (a int, check (a > 0), b int)");
+        let (cols, checks) = parse_sct_checks("create table t (a int, check (a > 0), b int)");
        assert_eq!(checks, vec!["a > 0".to_string()]);
        assert!(col(&cols, "a").check_sql.is_none() && col(&cols, "b").check_sql.is_none());
    }
@@ -1004,7 +1028,10 @@ mod builder_tests {
        assert_eq!(fk.parent_columns, Some(vec!["id".to_string()]));
        assert_eq!(fk.on_delete, ReferentialAction::NoAction);
        assert_eq!(fk.on_update, ReferentialAction::NoAction);
-        assert!(fk.inline, "a column-level `references` is an inline FK (ADR-0043 D4)");
+        assert!(
+            fk.inline,
+            "a column-level `references` is an inline FK (ADR-0043 D4)"
+        );
    }

    #[test]
@@ -1012,14 +1039,19 @@ mod builder_tests {
        // The table-level `FOREIGN KEY (...)` form is not inline, so it can
        // carry a multi-column reference and never triggers the inline
        // "use the table-level form" hint (ADR-0043 D4).
-        let fks = parse_sct_fks("create table t (id int, pid int, foreign key (pid) references parent(id))");
+        let fks = parse_sct_fks(
+            "create table t (id int, pid int, foreign key (pid) references parent(id))",
+        );
        assert!(!fks[0].inline, "table-level FOREIGN KEY is not inline");
    }

    #[test]
    fn bare_inline_reference_has_no_parent_column() {
        let fks = parse_sct_fks("create table t (id int, pid int references parent)");
-        assert_eq!(fks[0].parent_columns, None, "bare REFERENCES — resolved at execution");
+        assert_eq!(
+            fks[0].parent_columns, None,
+            "bare REFERENCES — resolved at execution"
+        );
        assert_eq!(fks[0].parent_table, "parent");
        assert_eq!(fks[0].child_columns, vec!["pid".to_string()]);
    }
@@ -1047,8 +1079,9 @@ mod builder_tests {

    #[test]
    fn table_level_foreign_key_captured() {
-        let fks =
-            parse_sct_fks("create table t (id int, pid int, foreign key (pid) references parent(id))");
+        let fks = parse_sct_fks(
+            "create table t (id int, pid int, foreign key (pid) references parent(id))",
+        );
        assert_eq!(fks.len(), 1);
        assert_eq!(fks[0].name, None);
        assert_eq!(fks[0].child_columns, vec!["pid".to_string()]);
@@ -1073,8 +1106,20 @@ mod builder_tests {
             foreign key (a) references p(id), foreign key (b) references q(id))",
        );
        assert_eq!(fks.len(), 2);
-        assert_eq!((fks[0].child_columns[0].as_str(), fks[0].parent_table.as_str()), ("a", "p"));
-        assert_eq!((fks[1].child_columns[0].as_str(), fks[1].parent_table.as_str()), ("b", "q"));
+        assert_eq!(
+            (
+                fks[0].child_columns[0].as_str(),
+                fks[0].parent_table.as_str()
+            ),
+            ("a", "p")
+        );
+        assert_eq!(
+            (
+                fks[1].child_columns[0].as_str(),
+                fks[1].parent_table.as_str()
+            ),
+            ("b", "q")
+        );
    }

    #[test]
@@ -1108,7 +1153,12 @@ mod builder_tests {
                assert_eq!(foreign_keys[0].child_columns, vec!["pid".to_string()]);
                // the column-level CHECK still attaches to `pid`
                assert_eq!(
-                    columns.iter().find(|c| c.name == "pid").unwrap().check_sql.as_deref(),
+                    columns
+                        .iter()
+                        .find(|c| c.name == "pid")
+                        .unwrap()
+                        .check_sql
+                        .as_deref(),
                    Some("pid > 0")
                );
                // the table-level CHECK is captured separately
@@ -82,7 +82,14 @@ mod tests {
        let mut ctx = WalkContext::new();
        let mut path = MatchedPath::new();
        let mut per_byte = Vec::new();
-        match walk_node(input, 0, &SQL_DELETE_SHAPE, &mut ctx, &mut path, &mut per_byte) {
+        match walk_node(
+            input,
+            0,
+            &SQL_DELETE_SHAPE,
+            &mut ctx,
+            &mut path,
+            &mut per_byte,
+        ) {
            NodeWalkResult::Matched { end, .. } => input[end..].trim().is_empty(),
            _ => false,
        }
@@ -93,7 +100,10 @@ mod tests {
    }

    fn bad(input: &str) {
-        assert!(!walks(input), "{input:?} should NOT walk as a complete DELETE tail");
+        assert!(
+            !walks(input),
+            "{input:?} should NOT walk as a complete DELETE tail"
+        );
    }

    #[test]
@@ -82,19 +82,16 @@ const EXPR_IDENT: Node = Node::Ident {
    writes_table: false,
    writes_column: false,
    writes_user_listed_column: false,
-writes_table_alias: false,
-writes_cte_name: false,
-writes_projection_alias: false,
+    writes_table_alias: false,
+    writes_cte_name: false,
+    writes_projection_alias: false,
 };

 // =================================================================
 // or_expr := and_expr ( OR and_expr )*  — the fragment entry point
 // =================================================================

-static OR_TAIL_NODES: &[Node] = &[
-    Node::Word(Word::keyword("or")),
-    Node::Subgrammar(&AND_EXPR),
-];
+static OR_TAIL_NODES: &[Node] = &[Node::Word(Word::keyword("or")), Node::Subgrammar(&AND_EXPR)];
 static OR_TAIL: Node = Node::Seq(OR_TAIL_NODES);
 static SQL_OR_EXPR_NODES: &[Node] = &[
    Node::Subgrammar(&AND_EXPR),
@@ -140,10 +137,7 @@ static NOT_FORM_NODES: &[Node] = &[
    Node::Word(Word::keyword("not")),
    Node::Subgrammar(&NOT_EXPR),
 ];
-static NOT_EXPR_CHOICES: &[Node] = &[
-    Node::Seq(NOT_FORM_NODES),
-    Node::Subgrammar(&PREDICATE),
-];
+static NOT_EXPR_CHOICES: &[Node] = &[Node::Seq(NOT_FORM_NODES), Node::Subgrammar(&PREDICATE)];
 static NOT_EXPR: Node = Node::Choice(NOT_EXPR_CHOICES);

 // =================================================================
@@ -156,10 +150,7 @@ static NOT_EXPR: Node = Node::Choice(NOT_EXPR_CHOICES);
 // needs. ADR-0026's DSL grammar made the tail mandatory because it
 // forbade a bare column as a boolean; SQL does not.

-static PREDICATE_NODES: &[Node] = &[
-    Node::Subgrammar(&ADDITIVE),
-    Node::Optional(&PREDICATE_TAIL),
-];
+static PREDICATE_NODES: &[Node] = &[Node::Subgrammar(&ADDITIVE), Node::Optional(&PREDICATE_TAIL)];
 static PREDICATE: Node = Node::Seq(PREDICATE_NODES);

 // ---- cmp_op := <= | <> | >= | != | < | > | = --------------------
@@ -181,10 +172,7 @@ static CMP_OP_CHOICES: &[Node] = &[
 // ---- predicate_tail branches ------------------------------------

 /// `cmp_op additive`.
-static COMPARE_FORM_NODES: &[Node] = &[
-    Node::Choice(CMP_OP_CHOICES),
-    Node::Subgrammar(&ADDITIVE),
-];
+static COMPARE_FORM_NODES: &[Node] = &[Node::Choice(CMP_OP_CHOICES), Node::Subgrammar(&ADDITIVE)];

 /// `IS [NOT] NULL`.
 static IS_NULL_NODES: &[Node] = &[
@@ -265,11 +253,7 @@ static PREDICATE_TAIL: Node = Node::Choice(PREDICATE_TAIL_CHOICES);
 // additive := multiplicative ( ( + | - | || ) multiplicative )*
 // =================================================================

-static ADD_OP_CHOICES: &[Node] = &[
-    Node::Punct('+'),
-    Node::Punct('-'),
-    Node::Literal("||"),
-];
+static ADD_OP_CHOICES: &[Node] = &[Node::Punct('+'), Node::Punct('-'), Node::Literal("||")];
 static ADD_TAIL_NODES: &[Node] = &[
    Node::Choice(ADD_OP_CHOICES),
    Node::Subgrammar(&MULTIPLICATIVE),
@@ -289,15 +273,8 @@ static ADDITIVE: Node = Node::Seq(ADDITIVE_NODES);
 // multiplicative := unary ( ( * | / | % ) unary )*
 // =================================================================

-static MUL_OP_CHOICES: &[Node] = &[
-    Node::Punct('*'),
-    Node::Punct('/'),
-    Node::Punct('%'),
-];
-static MUL_TAIL_NODES: &[Node] = &[
-    Node::Choice(MUL_OP_CHOICES),
-    Node::Subgrammar(&UNARY),
-];
+static MUL_OP_CHOICES: &[Node] = &[Node::Punct('*'), Node::Punct('/'), Node::Punct('%')];
+static MUL_TAIL_NODES: &[Node] = &[Node::Choice(MUL_OP_CHOICES), Node::Subgrammar(&UNARY)];
 static MUL_TAIL: Node = Node::Seq(MUL_TAIL_NODES);
 static MULTIPLICATIVE_NODES: &[Node] = &[
    Node::Subgrammar(&UNARY),
@@ -314,14 +291,8 @@ static MULTIPLICATIVE: Node = Node::Seq(MULTIPLICATIVE_NODES);
 // =================================================================

 static SIGN_CHOICES: &[Node] = &[Node::Punct('-'), Node::Punct('+')];
-static UNARY_SIGN_NODES: &[Node] = &[
-    Node::Choice(SIGN_CHOICES),
-    Node::Subgrammar(&UNARY),
-];
-static UNARY_CHOICES: &[Node] = &[
-    Node::Seq(UNARY_SIGN_NODES),
-    Node::Subgrammar(&PRIMARY),
-];
+static UNARY_SIGN_NODES: &[Node] = &[Node::Choice(SIGN_CHOICES), Node::Subgrammar(&UNARY)];
+static UNARY_CHOICES: &[Node] = &[Node::Seq(UNARY_SIGN_NODES), Node::Subgrammar(&PRIMARY)];
 static UNARY: Node = Node::Choice(UNARY_CHOICES);

 // =================================================================
@@ -402,10 +373,7 @@ static SIMPLE_CASE_NODES: &[Node] = &[
    Node::Optional(&ELSE_CLAUSE),
    Node::Word(Word::keyword("end")),
 ];
-static CASE_BODY_CHOICES: &[Node] = &[
-    Node::Seq(SEARCHED_CASE_NODES),
-    Node::Seq(SIMPLE_CASE_NODES),
-];
+static CASE_BODY_CHOICES: &[Node] = &[Node::Seq(SEARCHED_CASE_NODES), Node::Seq(SIMPLE_CASE_NODES)];
 static CASE_NODES: &[Node] = &[
    Node::Word(Word::keyword("case")),
    Node::Choice(CASE_BODY_CHOICES),
@@ -467,14 +435,11 @@ const QUALIFIED_REF_IDENT: Node = Node::Ident {
    writes_table: false,
    writes_column: false,
    writes_user_listed_column: false,
-writes_table_alias: false,
-writes_cte_name: false,
-writes_projection_alias: false,
+    writes_table_alias: false,
+    writes_cte_name: false,
+    writes_projection_alias: false,
 };
-static QUALIFIED_REF_TAIL_NODES: &[Node] = &[
-    Node::Punct('.'),
-    QUALIFIED_REF_IDENT,
-];
+static QUALIFIED_REF_TAIL_NODES: &[Node] = &[Node::Punct('.'), QUALIFIED_REF_IDENT];

 static NAME_OR_CALL_TAIL_CHOICES: &[Node] = &[
    Node::Seq(QUALIFIED_REF_TAIL_NODES),
@@ -531,7 +496,10 @@ mod tests {

    /// Assert `input` is *not* a complete SQL expression.
    fn bad(input: &str) {
-        assert!(!walks(input), "{input:?} should NOT walk as a complete expression");
+        assert!(
+            !walks(input),
+            "{input:?} should NOT walk as a complete expression"
+        );
    }

    #[test]
@@ -643,13 +611,13 @@ mod tests {

    #[test]
    fn malformed_expressions_do_not_walk() {
-        bad("a +");          // dangling operator
-        bad("a in b");       // IN requires a parenthesised list
-        bad("= 1");          // no left operand
-        bad("a = ");         // no right operand
-        bad("case a end");   // CASE with no WHEN clause
-        bad("and b");        // leading connective
-        bad("upper(");       // unclosed call
+        bad("a +"); // dangling operator
+        bad("a in b"); // IN requires a parenthesised list
+        bad("= 1"); // no left operand
+        bad("a = "); // no right operand
+        bad("case a end"); // CASE with no WHEN clause
+        bad("and b"); // leading connective
+        bad("upper("); // unclosed call
    }

    #[test]
@@ -680,9 +648,9 @@ mod tests {
        // The optional tail dispatches `.identifier` (qualified
        // ref) vs `(args)` (function call) by first token — a
        // bare ident remains a column ref.
-        good("foo(x)");      // function call
-        good("foo.bar");     // qualified ref
-        good("foo");         // bare ref
+        good("foo(x)"); // function call
+        good("foo.bar"); // qualified ref
+        good("foo"); // bare ref
    }

    #[test]
@@ -120,7 +120,10 @@ fn target_value_columns(ctx: &WalkContext) -> Vec<TableColumn> {
            listed
                .iter()
                .filter_map(|name| {
-                    table_cols.iter().find(|c| c.name.eq_ignore_ascii_case(name)).cloned()
+                    table_cols
+                        .iter()
+                        .find(|c| c.name.eq_ignore_ascii_case(name))
+                        .cloned()
                })
                .collect()
        },
@@ -148,7 +151,11 @@ fn target_value_columns(ctx: &WalkContext) -> Vec<TableColumn> {
 fn tuple_value_list(ctx: &WalkContext, source: &str, pos: usize) -> Node {
    let cols = target_value_columns(ctx);
    let (count, closed) = count_tuple_values(source, pos);
-    let arity_ok = if closed { count == cols.len() } else { count <= cols.len() };
+    let arity_ok = if closed {
+        count == cols.len()
+    } else {
+        count <= cols.len()
+    };
    if !cols.is_empty() && arity_ok {
        Node::DynamicSubgrammar(sql_value_list)
    } else {
@@ -304,8 +311,10 @@ static DO_UPDATE_NODES: &[Node] = &[
 /// the enclosing Seq, each branch's FIRST token (`nothing` vs
 /// `update`) disambiguates, so a non-match of branch 0 is a clean
 /// `NoMatch` that falls through to branch 1.
-static DO_ACTION_CHOICES: &[Node] =
-    &[Node::Word(Word::keyword("nothing")), Node::Seq(DO_UPDATE_NODES)];
+static DO_ACTION_CHOICES: &[Node] = &[
+    Node::Word(Word::keyword("nothing")),
+    Node::Seq(DO_UPDATE_NODES),
+];
 // `const` — used by value in `ON_CONFLICT_CLAUSE_NODES`.
 const DO_ACTION: Node = Node::Choice(DO_ACTION_CHOICES);

@@ -361,7 +370,14 @@ mod tests {
        let mut ctx = WalkContext::new();
        let mut path = MatchedPath::new();
        let mut per_byte = Vec::new();
-        match walk_node(input, 0, &SQL_INSERT_SHAPE, &mut ctx, &mut path, &mut per_byte) {
+        match walk_node(
+            input,
+            0,
+            &SQL_INSERT_SHAPE,
+            &mut ctx,
+            &mut path,
+            &mut per_byte,
+        ) {
            NodeWalkResult::Matched { end, .. } => input[end..].trim().is_empty(),
            _ => false,
        }
@@ -372,7 +388,10 @@ mod tests {
    }

    fn bad(input: &str) {
-        assert!(!walks(input), "{input:?} should NOT walk as a complete INSERT tail");
+        assert!(
+            !walks(input),
+            "{input:?} should NOT walk as a complete INSERT tail"
+        );
    }

    #[test]
@@ -418,8 +437,12 @@ mod tests {
        // 3h: ON CONFLICT … DO NOTHING / DO UPDATE (ADR-0033 §9).
        good("into t (id, name) values (1, 'x') on conflict (id) do nothing");
        good("into t (id, name) values (1, 'x') on conflict do nothing");
-        good("into t (id, name) values (1, 'x') on conflict (id) do update set name = excluded.name");
-        good("into t (id, name) values (1, 'x') on conflict (id) do update set name = 'y' where id > 0");
+        good(
+            "into t (id, name) values (1, 'x') on conflict (id) do update set name = excluded.name",
+        );
+        good(
+            "into t (id, name) values (1, 'x') on conflict (id) do update set name = 'y' where id > 0",
+        );
        // Multi-column conflict target + multi-assignment DO UPDATE.
        good("into t (a, b) values (1, 2) on conflict (a, b) do update set b = excluded.b, a = 9");
        // ON CONFLICT composes with RETURNING (order: row source,
@@ -141,8 +141,15 @@ static EMPTY_NOMATCH: Node = Node::Choice(&[]);
 /// suffix keywords. `as` is not listed — the AS-form alias is a
 /// separate `Choice` branch that fires before the lookahead.
 const PROJECTION_FOLLOW_SET: &[&str] = &[
-    "from", "where", "group", "order", "having", "limit",
-    "union", "intersect", "except",
+    "from",
+    "where",
+    "group",
+    "order",
+    "having",
+    "limit",
+    "union",
+    "intersect",
+    "except",
    // `returning` belongs to an enclosing DML statement
    // (`INSERT … SELECT … RETURNING …`, ADR-0033 §5), never to a
    // projection item's bare alias — so a no-FROM SELECT row source
@@ -158,9 +165,21 @@ const PROJECTION_FOLLOW_SET: &[&str] = &[
 /// only when `b` has no alias — `on` is not a base-table name a
 /// learner would type as an alias.
 const TABLE_SOURCE_FOLLOW_SET: &[&str] = &[
-    "where", "group", "order", "having", "limit",
-    "union", "intersect", "except",
-    "inner", "left", "right", "full", "cross", "join", "on",
+    "where",
+    "group",
+    "order",
+    "having",
+    "limit",
+    "union",
+    "intersect",
+    "except",
+    "inner",
+    "left",
+    "right",
+    "full",
+    "cross",
+    "join",
+    "on",
    // `returning` belongs to an enclosing DML statement
    // (`INSERT … SELECT … FROM t RETURNING …`, ADR-0033 §5), so the
    // SELECT row source must not read it as table `t`'s bare alias.
@@ -172,15 +191,9 @@ fn peek_next_ident_lower(source: &str, pos: usize) -> Option<String> {
    consume_ident(source, p).map(|(s, e)| source[s..e].to_ascii_lowercase())
 }

-fn projection_bare_alias_factory(
-    _: &WalkContext,
-    source: &str,
-    pos: usize,
-) -> Node {
+fn projection_bare_alias_factory(_: &WalkContext, source: &str, pos: usize) -> Node {
    match peek_next_ident_lower(source, pos) {
-        Some(word)
-            if PROJECTION_FOLLOW_SET.iter().any(|k| *k == word) =>
-        {
+        Some(word) if PROJECTION_FOLLOW_SET.iter().any(|k| *k == word) => {
            Node::Subgrammar(&EMPTY_NOMATCH)
        }
        Some(_) => PROJECTION_BARE_ALIAS_IDENT,
@@ -188,15 +201,9 @@ fn projection_bare_alias_factory(
    }
 }

-fn table_source_bare_alias_factory(
-    _: &WalkContext,
-    source: &str,
-    pos: usize,
-) -> Node {
+fn table_source_bare_alias_factory(_: &WalkContext, source: &str, pos: usize) -> Node {
    match peek_next_ident_lower(source, pos) {
-        Some(word)
-            if TABLE_SOURCE_FOLLOW_SET.iter().any(|k| *k == word) =>
-        {
+        Some(word) if TABLE_SOURCE_FOLLOW_SET.iter().any(|k| *k == word) => {
            Node::Subgrammar(&EMPTY_NOMATCH)
        }
        Some(_) => TABLE_SOURCE_BARE_ALIAS_IDENT,
@@ -237,14 +244,12 @@ const TABLE_SOURCE_BARE_ALIAS_IDENT: Node = Node::Ident {
    writes_column: false,
    writes_user_listed_column: false,
    writes_table_alias: true,
-writes_cte_name: false,
-writes_projection_alias: false,
+    writes_cte_name: false,
+    writes_projection_alias: false,
 };

-static PROJECTION_AS_ALIAS_NODES: &[Node] = &[
-    Node::Word(Word::keyword("as")),
-    PROJECTION_BARE_ALIAS_IDENT,
-];
+static PROJECTION_AS_ALIAS_NODES: &[Node] =
+    &[Node::Word(Word::keyword("as")), PROJECTION_BARE_ALIAS_IDENT];
 static PROJECTION_AS_ALIAS: Node = Node::Seq(PROJECTION_AS_ALIAS_NODES);

 static TABLE_SOURCE_AS_ALIAS_NODES: &[Node] = &[
@@ -258,17 +263,14 @@ static PROJECTION_ALIAS_CHOICES: &[Node] = &[
    Node::Lookahead(projection_bare_alias_factory),
 ];
 static PROJECTION_ALIAS_CHOICE: Node = Node::Choice(PROJECTION_ALIAS_CHOICES);
-static PROJECTION_ALIAS_OPTIONAL: Node =
-    Node::Optional(&PROJECTION_ALIAS_CHOICE);
+static PROJECTION_ALIAS_OPTIONAL: Node = Node::Optional(&PROJECTION_ALIAS_CHOICE);

 static TABLE_SOURCE_ALIAS_CHOICES: &[Node] = &[
    Node::Subgrammar(&TABLE_SOURCE_AS_ALIAS),
    Node::Lookahead(table_source_bare_alias_factory),
 ];
-static TABLE_SOURCE_ALIAS_CHOICE: Node =
-    Node::Choice(TABLE_SOURCE_ALIAS_CHOICES);
-static TABLE_SOURCE_ALIAS_OPTIONAL: Node =
-    Node::Optional(&TABLE_SOURCE_ALIAS_CHOICE);
+static TABLE_SOURCE_ALIAS_CHOICE: Node = Node::Choice(TABLE_SOURCE_ALIAS_CHOICES);
+static TABLE_SOURCE_ALIAS_OPTIONAL: Node = Node::Optional(&TABLE_SOURCE_ALIAS_CHOICE);

 // =================================================================
 // Projection item
@@ -282,16 +284,13 @@ const QUALIFIED_STAR_QUALIFIER: Node = Node::Ident {
    writes_table: false,
    writes_column: false,
    writes_user_listed_column: false,
-writes_table_alias: false,
-writes_cte_name: false,
-writes_projection_alias: false,
+    writes_table_alias: false,
+    writes_cte_name: false,
+    writes_projection_alias: false,
 };

-static QUALIFIED_STAR_NODES: &[Node] = &[
-    QUALIFIED_STAR_QUALIFIER,
-    Node::Punct('.'),
-    Node::Punct('*'),
-];
+static QUALIFIED_STAR_NODES: &[Node] =
+    &[QUALIFIED_STAR_QUALIFIER, Node::Punct('.'), Node::Punct('*')];
 static QUALIFIED_STAR: Node = Node::Seq(QUALIFIED_STAR_NODES);

 static PROJECTION_EXPR_ITEM_NODES: &[Node] = &[
@@ -310,11 +309,7 @@ static PROJECTION_EXPR_ITEM: Node = Node::Seq(PROJECTION_EXPR_ITEM_NODES);
 /// ambiguity between `t.*` and `sql_expr` (which can match a
 /// bare `t`), since the walker's `Choice` doesn't backtrack on
 /// a committed match.
-fn projection_item_factory(
-    _: &WalkContext,
-    source: &str,
-    pos: usize,
-) -> Node {
+fn projection_item_factory(_: &WalkContext, source: &str, pos: usize) -> Node {
    let p = skip_whitespace(source, pos);
    let bytes = source.as_bytes();
    if bytes.get(p) == Some(&b'*') {
@@ -363,8 +358,7 @@ static DISTINCT_OR_ALL_CHOICES: &[Node] = &[
    Node::Word(Word::keyword("all")),
 ];
 static DISTINCT_OR_ALL_CHOICE: Node = Node::Choice(DISTINCT_OR_ALL_CHOICES);
-static DISTINCT_OR_ALL_OPTIONAL: Node =
-    Node::Optional(&DISTINCT_OR_ALL_CHOICE);
+static DISTINCT_OR_ALL_OPTIONAL: Node = Node::Optional(&DISTINCT_OR_ALL_CHOICE);

 // =================================================================
 // Table source (FROM / JOIN target)
@@ -379,8 +373,8 @@ const TABLE_NAME_IDENT: Node = Node::Ident {
    writes_column: false,
    writes_user_listed_column: false,
    writes_table_alias: false,
-writes_cte_name: false,
-writes_projection_alias: false,
+    writes_cte_name: false,
+    writes_projection_alias: false,
 };

 static TABLE_SOURCE_NODES: &[Node] = &[
@@ -395,8 +389,7 @@ static TABLE_SOURCE: Node = Node::Seq(TABLE_SOURCE_NODES);

 const JOIN_WORD: Node = Node::Word(Word::keyword("join"));
 const ON_WORD: Node = Node::Word(Word::keyword("on"));
-static OUTER_OPTIONAL: Node =
-    Node::Optional(&Node::Word(Word::keyword("outer")));
+static OUTER_OPTIONAL: Node = Node::Optional(&Node::Word(Word::keyword("outer")));

 // `INNER JOIN` and bare `JOIN` are split into two Choice
 // branches so each branch has a distinct leading keyword
@@ -585,8 +578,7 @@ static SET_OP_CHOICES: &[Node] = &[
 ];
 static SET_OP: Node = Node::Choice(SET_OP_CHOICES);

-static SET_OP_TAIL_NODES: &[Node] =
-    &[Node::Subgrammar(&SET_OP), Node::Subgrammar(&SELECT_CORE)];
+static SET_OP_TAIL_NODES: &[Node] = &[Node::Subgrammar(&SET_OP), Node::Subgrammar(&SELECT_CORE)];
 static SET_OP_TAIL: Node = Node::Seq(SET_OP_TAIL_NODES);

 static PLAIN_COMPOUND_NODES: &[Node] = &[
@@ -619,8 +611,7 @@ static WITH_PREFIXED_COMPOUND_NODES: &[Node] = &[
    Node::Subgrammar(&WITH_CLAUSE),
    Node::Subgrammar(&PLAIN_COMPOUND),
 ];
-static WITH_PREFIXED_COMPOUND: Node =
-    Node::Seq(WITH_PREFIXED_COMPOUND_NODES);
+static WITH_PREFIXED_COMPOUND: Node = Node::Seq(WITH_PREFIXED_COMPOUND_NODES);

 static COMPOUND_CHOICES: &[Node] = &[
    Node::Subgrammar(&WITH_PREFIXED_COMPOUND),
@@ -659,9 +650,9 @@ const CTE_COLUMN_IDENT: Node = Node::Ident {
    writes_table: false,
    writes_column: false,
    writes_user_listed_column: false,
-writes_table_alias: false,
-writes_cte_name: false,
-writes_projection_alias: false,
+    writes_table_alias: false,
+    writes_cte_name: false,
+    writes_projection_alias: false,
 };

 static CTE_COLUMN_LIST_NODES: &[Node] = &[
@@ -674,18 +665,13 @@ static CTE_COLUMN_LIST_NODES: &[Node] = &[
    RPAREN,
 ];
 static CTE_COLUMN_LIST_SEQ: Node = Node::Seq(CTE_COLUMN_LIST_NODES);
-static CTE_COLUMN_LIST_OPTIONAL: Node =
-    Node::Optional(&CTE_COLUMN_LIST_SEQ);
+static CTE_COLUMN_LIST_OPTIONAL: Node = Node::Optional(&CTE_COLUMN_LIST_SEQ);

 // CTE body recursion pushes a fresh lexical scope frame (ADR-
 // 0032 §4 / §10.2). Subqueries in `sql_expr.rs` do the same;
 // the top-level statement's own COMPOUND embedding does not
 // (it shares the implicit bottom frame).
-static CTE_BODY_NODES: &[Node] = &[
-    LPAREN,
-    Node::ScopedSubgrammar(&SQL_SELECT_COMPOUND),
-    RPAREN,
-];
+static CTE_BODY_NODES: &[Node] = &[LPAREN, Node::ScopedSubgrammar(&SQL_SELECT_COMPOUND), RPAREN];
 static CTE_BODY: Node = Node::Seq(CTE_BODY_NODES);

 static CTE_DEF_NODES: &[Node] = &[
@@ -807,9 +793,7 @@ mod tests {
        let mut path = MatchedPath::new();
        let mut per_byte = Vec::new();
        match walk_node(input, 0, fragment, &mut ctx, &mut path, &mut per_byte) {
-            NodeWalkResult::Matched { end, .. } => {
-                input[end..].trim().is_empty()
-            }
+            NodeWalkResult::Matched { end, .. } => input[end..].trim().is_empty(),
            _ => false,
        }
    }
@@ -819,10 +803,7 @@ mod tests {
    }

    fn good(input: &str) {
-        assert!(
-            walks(input),
-            "{input:?} should be a valid SELECT statement"
-        );
+        assert!(walks(input), "{input:?} should be a valid SELECT statement");
    }

    fn bad(input: &str) {
@@ -1051,16 +1032,12 @@ mod tests {

    #[test]
    fn set_op_chain() {
-        good(
-            "select a from t union select b from u intersect select c from v",
-        );
+        good("select a from t union select b from u intersect select c from v");
    }

    #[test]
    fn set_op_with_outer_order_by_and_limit() {
-        good(
-            "select a from t union select b from u order by a limit 10",
-        );
+        good("select a from t union select b from u order by a limit 10");
    }

    // ----- ORDER BY / LIMIT / OFFSET -----
@@ -1126,16 +1103,12 @@ mod tests {

    #[test]
    fn recursive_cte() {
-        good(
-            "with recursive r as (select 1 union all select 2) select * from r",
-        );
+        good("with recursive r as (select 1 union all select 2) select * from r");
    }

    #[test]
    fn multiple_ctes() {
-        good(
-            "with a as (select 1), b as (select 2) select * from a union select * from b",
-        );
+        good("with a as (select 1), b as (select 2) select * from a union select * from b");
    }

    // ----- subquery shapes (recursion through SQL_SELECT_COMPOUND) -----
@@ -1147,9 +1120,7 @@ mod tests {

    #[test]
    fn nested_cte_body_with_union() {
-        good(
-            "with x as (select 1 union select 2) select * from x",
-        );
+        good("with x as (select 1 union select 2) select * from x");
    }

    // ----- case insensitivity / spacing -----
@@ -1363,9 +1334,7 @@ mod tests {
    #[test]
    fn in_subquery_in_where_clause() {
        good("select * from t where id in (select user_id from orders)");
-        good(
-            "select * from customers where id not in (select customer_id from blocklist)",
-        );
+        good("select * from customers where id not in (select customer_id from blocklist)");
    }

    #[test]
@@ -1378,9 +1347,7 @@ mod tests {

    #[test]
    fn nested_subqueries() {
-        good(
-            "select * from t where x in (select y from u where y in (select z from v))",
-        );
+        good("select * from t where x in (select y from u where y in (select z from v))");
    }

    #[test]
@@ -1393,8 +1360,6 @@ mod tests {

    #[test]
    fn cte_body_references_qualified_columns() {
-        good(
-            "with x as (select t.name, t.age from t) select x.name from x",
-        );
+        good("with x as (select t.name, t.age from t) select x.name from x");
    }
 }
@@ -119,7 +119,14 @@ mod tests {
        let mut ctx = WalkContext::new();
        let mut path = MatchedPath::new();
        let mut per_byte = Vec::new();
-        match walk_node(input, 0, &SQL_UPDATE_SHAPE, &mut ctx, &mut path, &mut per_byte) {
+        match walk_node(
+            input,
+            0,
+            &SQL_UPDATE_SHAPE,
+            &mut ctx,
+            &mut path,
+            &mut per_byte,
+        ) {
            NodeWalkResult::Matched { end, .. } => input[end..].trim().is_empty(),
            _ => false,
        }
@@ -130,7 +137,10 @@ mod tests {
    }

    fn bad(input: &str) {
-        assert!(!walks(input), "{input:?} should NOT walk as a complete UPDATE tail");
+        assert!(
+            !walks(input),
+            "{input:?} should NOT walk as a complete UPDATE tail"
+        );
    }

    #[test]
@@ -21,9 +21,9 @@ pub mod walker;

 pub use action::ReferentialAction;
 pub use command::{
-    AlterTableAction, AppCommand, ChangeColumnMode, ColumnSpec, Command, CompareOp, CopyScope, Expr,
-    IndexSelector, MessagesValue, ModeValue, Operand, Predicate, RelationshipSelector, RowFilter,
-    ShowListKind, SqlForeignKey,
+    AlterTableAction, AppCommand, ChangeColumnMode, ColumnSpec, Command, CompareOp, CopyScope,
+    Expr, IndexSelector, MessagesValue, ModeValue, Operand, Predicate, RelationshipSelector,
+    RowFilter, ShowListKind, SqlForeignKey,
 };
 pub use parser::{ParseError, parse_command};
 pub use types::Type;
@@ -55,10 +55,9 @@ pub enum ParseError {
 impl std::fmt::Display for ParseError {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        match self {
-            Self::Invalid { message, .. } => f.write_str(&crate::t!(
-                "parse.error_wrapper",
-                detail = message,
-            )),
+            Self::Invalid { message, .. } => {
+                f.write_str(&crate::t!("parse.error_wrapper", detail = message,))
+            }
            Self::Empty => f.write_str(&crate::t!("parse.empty")),
        }
    }
@@ -125,10 +124,7 @@ pub fn parse_command_with_schema(
 /// Schemaless, mode-aware parse (ADR-0030 §2). In `Mode::Simple`
 /// the walker gates SQL-only commands and produces the
 /// "this is SQL" hint instead of executing them.
-pub fn parse_command_in_mode(
-    input: &str,
-    mode: Mode,
-) -> Result<Command, ParseError> {
+pub fn parse_command_in_mode(input: &str, mode: Mode) -> Result<Command, ParseError> {
    parse_command_inner(input, None, mode)
 }

@@ -185,10 +181,8 @@ fn unknown_command_error(source: &str) -> ParseError {
        .collect();
    let joined = oxford_join(&entries);
    let start = skip_whitespace(source, 0);
-    let (position, found_word) = consume_ident(source, start).map_or_else(
-        || (start, None),
-        |(s, e)| (s, Some(&source[s..e])),
-    );
+    let (position, found_word) = consume_ident(source, start)
+        .map_or_else(|| (start, None), |(s, e)| (s, Some(&source[s..e])));
    let message = found_word.map_or_else(
        || format!("expected one of {joined}"),
        |w| format!("expected one of {joined}, found `{w}`"),
@@ -1034,19 +1028,22 @@ mod tests {
            false,
        );
        assert_eq!(
-            ok("add 1:n relationship from Customers.Id to Orders.CustId on delete cascade on update set null"),
+            ok(
+                "add 1:n relationship from Customers.Id to Orders.CustId on delete cascade on update set null"
+            ),
            expected
        );
        assert_eq!(
-            ok("add 1:n relationship from Customers.Id to Orders.CustId on update set null on delete cascade"),
+            ok(
+                "add 1:n relationship from Customers.Id to Orders.CustId on update set null on delete cascade"
+            ),
            expected
        );
    }

    #[test]
    fn add_relationship_repeated_clause_errors() {
-        let e =
-            err("add 1:n relationship from C.id to O.cid on delete cascade on delete restrict");
+        let e = err("add 1:n relationship from C.id to O.cid on delete cascade on delete restrict");
        match e {
            ParseError::Invalid { message, .. } => {
                assert!(message.contains("specified twice"), "{message}");
@@ -1073,7 +1070,9 @@ mod tests {
    #[test]
    fn add_relationship_with_name_actions_and_flag() {
        assert_eq!(
-            ok("add 1:n relationship as cust_orders from Customers.Id to Orders.CustId on delete cascade on update no action --create-fk"),
+            ok(
+                "add 1:n relationship as cust_orders from Customers.Id to Orders.CustId on delete cascade on update no action --create-fk"
+            ),
            rel(
                Some("cust_orders"),
                ("Customers", "Id"),
@@ -1300,10 +1299,7 @@ mod tests {
    #[test]
    fn advanced_ambiguous_update_routes_to_sql() {
        assert!(matches!(
-            parse_command_in_mode(
-                "update Orders set total = 0 where id = 1",
-                Mode::Advanced,
-            ),
+            parse_command_in_mode("update Orders set total = 0 where id = 1", Mode::Advanced,),
            Ok(Command::SqlUpdate { .. })
        ));
    }
@@ -1399,10 +1395,7 @@ mod tests {
        // in advanced mode)" pointer is added at the hint layer
        // (input_render), not in the parsed command/error here.
        assert!(matches!(
-            parse_command_in_mode(
-                "delete from Orders where id = 1 returning *",
-                Mode::Simple,
-            ),
+            parse_command_in_mode("delete from Orders where id = 1 returning *", Mode::Simple,),
            Err(ParseError::Invalid { .. })
        ));
    }
@@ -9,8 +9,7 @@ use rand::RngExt;

 /// Base58 alphabet — Bitcoin-style. 0 / O / I / l are excluded
 /// because they are easily confused in print.
-const ALPHABET: &[u8; 58] =
-    b"123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+const ALPHABET: &[u8; 58] = b"123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";

 const DEFAULT_LEN: usize = 10;

@@ -43,29 +43,9 @@
 /// - **Broader scalars:** `date`, `datetime`, `hex`, `ifnull`,
 ///   `instr`, `nullif`, `random`, `replace`, `strftime`, `typeof`.
 pub const KNOWN_SQL_FUNCTIONS: &[&str] = &[
-    "abs",
-    "avg",
-    "coalesce",
-    "count",
-    "date",
-    "datetime",
-    "hex",
-    "ifnull",
-    "instr",
-    "length",
-    "lower",
-    "max",
-    "min",
-    "nullif",
-    "random",
-    "replace",
-    "round",
-    "strftime",
-    "substr",
-    "sum",
-    "trim",
-    "typeof",
-    "upper",
+    "abs", "avg", "coalesce", "count", "date", "datetime", "hex", "ifnull", "instr", "length",
+    "lower", "max", "min", "nullif", "random", "replace", "round", "strftime", "substr", "sum",
+    "trim", "typeof", "upper",
 ];

 /// Whether `partial` is a case-insensitive prefix of at least one
@@ -80,9 +60,7 @@ pub const KNOWN_SQL_FUNCTIONS: &[&str] = &[
 #[must_use]
 pub fn is_known_function_prefix(partial: &str) -> bool {
    let lowered = partial.to_lowercase();
-    KNOWN_SQL_FUNCTIONS
-        .iter()
-        .any(|f| f.starts_with(&lowered))
+    KNOWN_SQL_FUNCTIONS.iter().any(|f| f.starts_with(&lowered))
 }

 #[cfg(test)]
@@ -59,11 +59,7 @@ impl Type {
    #[must_use]
    pub const fn sqlite_strict_type(self) -> &'static str {
        match self {
-            Self::Text
-            | Self::ShortId
-            | Self::Decimal
-            | Self::Date
-            | Self::DateTime => "TEXT",
+            Self::Text | Self::ShortId | Self::Decimal | Self::Date | Self::DateTime => "TEXT",
            Self::Int | Self::Serial | Self::Bool => "INTEGER",
            Self::Real => "REAL",
            Self::Blob => "BLOB",
@@ -107,10 +103,7 @@ impl Type {
    /// match against a numeric column (ADR-0027, Amendment 1).
    #[must_use]
    pub const fn is_numeric(self) -> bool {
-        matches!(
-            self,
-            Self::Int | Self::Real | Self::Decimal | Self::Serial
-        )
+        matches!(self, Self::Int | Self::Real | Self::Decimal | Self::Serial)
    }

    /// The user-facing type that an FK column should use to
@@ -129,13 +129,14 @@ impl Value {

    fn bind_int(&self, column: &str, ty: Type) -> Result<Bound, ValueError> {
        match self {
-            Self::Number(n) => n
-                .parse::<i64>()
-                .map(Bound::Integer)
-                .map_err(|_| ValueError::Format {
-                    column: column.to_string(),
-                    message: format!("`{n}` is not a valid {ty} (whole number expected)"),
-                }),
+            Self::Number(n) => {
+                n.parse::<i64>()
+                    .map(Bound::Integer)
+                    .map_err(|_| ValueError::Format {
+                        column: column.to_string(),
+                        message: format!("`{n}` is not a valid {ty} (whole number expected)"),
+                    })
+            }
            other => Err(ValueError::TypeMismatch {
                column: column.to_string(),
                expected_human: format!("a whole number for `{ty}`"),
@@ -241,9 +242,7 @@ pub(crate) fn validate_date(s: &str) -> Result<(), String> {
    // Expect YYYY-MM-DD: 10 chars, two dashes at fixed positions.
    let bytes = s.as_bytes();
    if bytes.len() != 10 || bytes[4] != b'-' || bytes[7] != b'-' {
-        return Err(format!(
-            "`{s}` is not a date in `YYYY-MM-DD` form"
-        ));
+        return Err(format!("`{s}` is not a date in `YYYY-MM-DD` form"));
    }
    let year = parse_digits(&s[0..4]).ok_or_else(|| format!("`{s}`: invalid year"))?;
    let month = parse_digits(&s[5..7]).ok_or_else(|| format!("`{s}`: invalid month"))?;
@@ -272,7 +271,9 @@ pub(crate) fn validate_datetime(s: &str) -> Result<(), String> {
    validate_date(date_part)?;
    let bytes = s.as_bytes();
    if bytes[10] != b'T' {
-        return Err(format!("`{s}`: missing `T` separator between date and time"));
+        return Err(format!(
+            "`{s}`: missing `T` separator between date and time"
+        ));
    }
    if bytes[13] != b':' || bytes[16] != b':' {
        return Err(format!("`{s}`: time portion must be `HH:MM:SS`"));
@@ -326,8 +327,14 @@ mod tests {

    #[test]
    fn integer_for_int_column() {
-        assert_eq!(n("42").bind_for_column("c", Type::Int).unwrap(), Bound::Integer(42));
-        assert_eq!(n("-7").bind_for_column("c", Type::Int).unwrap(), Bound::Integer(-7));
+        assert_eq!(
+            n("42").bind_for_column("c", Type::Int).unwrap(),
+            Bound::Integer(42)
+        );
+        assert_eq!(
+            n("-7").bind_for_column("c", Type::Int).unwrap(),
+            Bound::Integer(-7)
+        );
    }

    #[test]
@@ -355,7 +362,9 @@ mod tests {

    #[test]
    fn shortid_validation_runs_on_text_for_shortid_column() {
-        let err = t("toolong_xyz_more").bind_for_column("c", Type::ShortId).unwrap_err();
+        let err = t("toolong_xyz_more")
+            .bind_for_column("c", Type::ShortId)
+            .unwrap_err();
        assert!(matches!(err, ValueError::Format { .. }));

        // Well-formed shortid binds fine.
@@ -367,8 +376,14 @@ mod tests {

    #[test]
    fn bool_for_bool_column_maps_to_zero_or_one() {
-        assert_eq!(Value::Bool(true).bind_for_column("c", Type::Bool).unwrap(), Bound::Integer(1));
-        assert_eq!(Value::Bool(false).bind_for_column("c", Type::Bool).unwrap(), Bound::Integer(0));
+        assert_eq!(
+            Value::Bool(true).bind_for_column("c", Type::Bool).unwrap(),
+            Bound::Integer(1)
+        );
+        assert_eq!(
+            Value::Bool(false).bind_for_column("c", Type::Bool).unwrap(),
+            Bound::Integer(0)
+        );
    }

    #[test]
@@ -377,13 +392,17 @@ mod tests {
            t("2025-01-15").bind_for_column("c", Type::Date).unwrap(),
            Bound::Text("2025-01-15".to_string())
        );
-        let err = t("2025/01/15").bind_for_column("c", Type::Date).unwrap_err();
+        let err = t("2025/01/15")
+            .bind_for_column("c", Type::Date)
+            .unwrap_err();
        assert!(matches!(err, ValueError::Format { .. }));
    }

    #[test]
    fn date_range_check() {
-        let err = t("2025-13-01").bind_for_column("c", Type::Date).unwrap_err();
+        let err = t("2025-13-01")
+            .bind_for_column("c", Type::Date)
+            .unwrap_err();
        assert!(matches!(err, ValueError::Format { message, .. } if message.contains("month")));
    }

@@ -28,12 +28,10 @@ use crate::completion::TableColumn;
 use crate::dsl::grammar::{HighlightClass, Node, ValidationError};
 use crate::dsl::walker::context::WalkContext;
 use crate::dsl::walker::lex_helpers::{
-    consume_bare_path, consume_flag, consume_ident, consume_number_literal,
-    consume_string_literal, skip_whitespace,
-};
-use crate::dsl::walker::outcome::{
-    ByteClass, Expectation, MatchedItem, MatchedKind, MatchedPath,
+    consume_bare_path, consume_flag, consume_ident, consume_number_literal, consume_string_literal,
+    skip_whitespace,
 };
+use crate::dsl::walker::outcome::{ByteClass, Expectation, MatchedItem, MatchedKind, MatchedPath};

 /// Maximum nesting of `Node::Subgrammar` frames (ADR-0026 §1).
 ///
@@ -77,10 +75,7 @@ static DYNAMIC_CACHE: LazyLock<Mutex<HashMap<DynamicKey, &'static Node>>> =
 /// Resolve a `DynamicSubgrammar` factory to a `&'static Node`,
 /// reusing a previously-leaked Node when the factory's inputs
 /// match a cached entry.
-fn resolve_dynamic(
-    factory: fn(&WalkContext) -> Node,
-    ctx: &WalkContext,
-) -> &'static Node {
+fn resolve_dynamic(factory: fn(&WalkContext) -> Node, ctx: &WalkContext) -> &'static Node {
    let key = DynamicKey {
        factory: factory as usize,
        current_table_columns: ctx.current_table_columns.clone(),
@@ -123,10 +118,7 @@ pub enum NodeWalkResult {
        expected: Vec<Expectation>,
    },
    /// Committed and hit a hard mismatch or validator failure.
-    Failed {
-        position: usize,
-        kind: FailureKind,
-    },
+    Failed { position: usize, kind: FailureKind },
 }

 const fn matched(end: usize) -> NodeWalkResult {
@@ -218,9 +210,7 @@ fn walk_node_inner(
                kind: FailureKind::Mismatch { expected: vec![] },
            }
        }
-        Node::Subgrammar(inner) => {
-            walk_subgrammar(source, pos, inner, ctx, path, per_byte)
-        }
+        Node::Subgrammar(inner) => walk_subgrammar(source, pos, inner, ctx, path, per_byte),
        Node::ScopedSubgrammar(inner) => {
            walk_scoped_subgrammar(source, pos, inner, ctx, path, per_byte)
        }
@@ -247,8 +237,7 @@ fn walk_node_inner(
            // DynamicSubgrammar wrapper that delegates to the
            // memoized `column_value_list`), so the per-walk
            // leak is a few bytes, not a whole typed tree.
-            let resolved: &'static Node =
-                Box::leak(Box::new(factory(ctx, source, pos)));
+            let resolved: &'static Node = Box::leak(Box::new(factory(ctx, source, pos)));
            walk_node(source, pos, resolved, ctx, path, per_byte)
        }
        Node::SetColumn(col) => {
@@ -262,7 +251,10 @@ fn walk_node_inner(
            let col: &crate::completion::TableColumn = col;
            ctx.current_column = Some(col.clone());
            ctx.pending_value_column = Some(col.name.clone());
-            NodeWalkResult::Matched { end: pos, skipped: Vec::new() }
+            NodeWalkResult::Matched {
+                end: pos,
+                skipped: Vec::new(),
+            }
        }
        Node::TypedValueSlot {
            ty,
@@ -342,7 +334,10 @@ fn walk_word(
            // Amendment 4). Plain keywords leave it `None`.
            class: word.highlight_override.unwrap_or(HighlightClass::Keyword),
        });
-        NodeWalkResult::Matched { end, skipped: Vec::new() }
+        NodeWalkResult::Matched {
+            end,
+            skipped: Vec::new(),
+        }
    } else {
        NodeWalkResult::NoMatch {
            position,
@@ -477,9 +472,7 @@ fn walk_ident(
    // ScopedSubgrammar (which is structurally guaranteed to be
    // the CTE body — no intervening scoped subgrammar in CTE
    // syntax) runs the harvest at body-frame exit.
-    if writes_cte_name
-        && let Some(frame) = ctx.from_scope_stack.last_mut()
-    {
+    if writes_cte_name && let Some(frame) = ctx.from_scope_stack.last_mut() {
        frame
            .cte_bindings
            .push(crate::dsl::walker::context::CteBinding {
@@ -487,13 +480,12 @@ fn walk_ident(
                columns: Vec::new(),
            });
        let placeholder_index = frame.cte_bindings.len() - 1;
-        ctx.pending_cte_harvest =
-            Some(crate::dsl::walker::context::PendingCteHarvest {
-                placeholder_index,
-                col_list: Vec::new(),
-                cte_name: text.clone(),
-                cte_name_span: (start, end),
-            });
+        ctx.pending_cte_harvest = Some(crate::dsl::walker::context::PendingCteHarvest {
+            placeholder_index,
+            col_list: Vec::new(),
+            cte_name: text.clone(),
+            cte_name_span: (start, end),
+        });
    }
    // ADR-0032 §10.3: the optional `(c1, c2, …)` rename list
    // between the cte name and `AS`. Each `cte_column` ident
@@ -507,9 +499,7 @@ fn walk_ident(
    }
    // ADR-0032 §10.4: projection-list alias accumulator for
    // ORDER BY completion candidates.
-    if writes_projection_alias
-        && let Some(frame) = ctx.from_scope_stack.last_mut()
-    {
+    if writes_projection_alias && let Some(frame) = ctx.from_scope_stack.last_mut() {
        frame.projection_aliases.push(text.clone());
    }
    if writes_column && matches!(src, crate::dsl::grammar::IdentSource::Columns) {
@@ -529,9 +519,7 @@ fn walk_ident(
            .map(|c| c.name.clone())
            .or_else(|| Some(text.clone()));
    }
-    if writes_user_listed_column
-        && matches!(src, crate::dsl::grammar::IdentSource::Columns)
-    {
+    if writes_user_listed_column && matches!(src, crate::dsl::grammar::IdentSource::Columns) {
        // Form A: `insert into <T> (col1, col2, …)`. Append the
        // matched column name to user_listed_columns so the
        // inner `values (…)` slot list mirrors the user's
@@ -564,7 +552,10 @@ fn walk_ident(
        // (issue #8 / ADR-0022 Amendment 4).
        class: highlight_override.unwrap_or(HighlightClass::Identifier),
    });
-    NodeWalkResult::Matched { end, skipped: Vec::new() }
+    NodeWalkResult::Matched {
+        end,
+        skipped: Vec::new(),
+    }
 }

 fn walk_string_lit(
@@ -648,7 +639,10 @@ fn walk_literal(
        end,
        class,
    });
-    NodeWalkResult::Matched { end, skipped: Vec::new() }
+    NodeWalkResult::Matched {
+        end,
+        skipped: Vec::new(),
+    }
 }

 fn walk_number_lit(
@@ -683,7 +677,10 @@ fn walk_number_lit(
        end,
        class: HighlightClass::Number,
    });
-    NodeWalkResult::Matched { end, skipped: Vec::new() }
+    NodeWalkResult::Matched {
+        end,
+        skipped: Vec::new(),
+    }
 }

 fn walk_flag(
@@ -717,7 +714,10 @@ fn walk_flag(
        end,
        class: HighlightClass::Flag,
    });
-    NodeWalkResult::Matched { end, skipped: Vec::new() }
+    NodeWalkResult::Matched {
+        end,
+        skipped: Vec::new(),
+    }
 }

 #[allow(clippy::too_many_arguments)]
@@ -784,7 +784,10 @@ fn walk_repeated(
                count += 1;
                last_item_skipped = skipped;
            }
-            NodeWalkResult::NoMatch { expected, position: inner_pos } => {
+            NodeWalkResult::NoMatch {
+                expected,
+                position: inner_pos,
+            } => {
                // Mid-typing-the-next-item recovery: if the
                // separator just consumed and the inner failed
                // at EOF, the user is partway through typing the
@@ -860,7 +863,10 @@ fn walk_bare_path(
        end,
        class: HighlightClass::String,
    });
-    NodeWalkResult::Matched { end, skipped: Vec::new() }
+    NodeWalkResult::Matched {
+        end,
+        skipped: Vec::new(),
+    }
 }

 fn walk_choice(
@@ -1031,7 +1037,10 @@ fn walk_optional(
                skipped: expected,
            }
        }
-        NodeWalkResult::Incomplete { position: p, expected } if !inner_committed => {
+        NodeWalkResult::Incomplete {
+            position: p,
+            expected,
+        } if !inner_committed => {
            // Inner reported Incomplete without consuming
            // anything — same as NoMatch from the user's
            // perspective. Roll back and skip.
@@ -1156,9 +1165,7 @@ fn walk_scoped_subgrammar(
    // walks that NoMatch / Incomplete / Fail leave the placeholder
    // empty (the outer-frame state is also discarded in the
    // speculative path, so this is correct).
-    if let (Some(req), NodeWalkResult::Matched { end, .. }) =
-        (pending_cte, &result)
-    {
+    if let (Some(req), NodeWalkResult::Matched { end, .. }) = (pending_cte, &result) {
        run_cte_harvest(ctx, path, source, pos, *end, &req);
    }

@@ -1240,9 +1247,8 @@ fn run_cte_harvest(
                select_idx = Some(i + 1); // start of projection list
            }
            MatchedKind::Word(
-                "from" | "where" | "group" | "having" | "order"
-                | "limit" | "offset" | "union" | "intersect"
-                | "except",
+                "from" | "where" | "group" | "having" | "order" | "limit" | "offset" | "union"
+                | "intersect" | "except",
            ) if select_idx.is_some() => {
                end_idx = i;
                break;
@@ -1281,12 +1287,7 @@ fn run_cte_harvest(
    // Classify each projection item per ADR-0032 §10.3.
    let mut derived: Vec<CteColumn> = Vec::new();
    for slice in item_slices {
-        classify_projection_item(
-            slice,
-            body_frame,
-            &ctx.from_scope_stack,
-            &mut derived,
-        );
+        classify_projection_item(slice, body_frame, &ctx.from_scope_stack, &mut derived);
    }

    // Apply (c1, c2, …) positional rename if provided. Types
@@ -1339,8 +1340,7 @@ fn run_cte_harvest(
    let stack_len = ctx.from_scope_stack.len();
    if stack_len >= 2
        && let Some(outer) = ctx.from_scope_stack.get_mut(stack_len - 2)
-        && let Some(placeholder) =
-            outer.cte_bindings.get_mut(req.placeholder_index)
+        && let Some(placeholder) = outer.cte_bindings.get_mut(req.placeholder_index)
    {
        placeholder.columns = derived;
    }
@@ -1368,9 +1368,7 @@ fn classify_projection_item(
    // empty because it wasn't a base-table lookup), resolve
    // through to the in-scope CteBinding so nested CTEs project
    // correctly.
-    if expr_slice.len() == 1
-        && matches!(expr_slice[0].kind, MatchedKind::Punct('*'))
-    {
+    if expr_slice.len() == 1 && matches!(expr_slice[0].kind, MatchedKind::Punct('*')) {
        for binding in &body_frame.from_scope {
            for col in expand_binding(binding, scope_stack) {
                out.push(col);
@@ -1383,7 +1381,10 @@ fn classify_projection_item(
    if expr_slice.len() == 3
        && matches!(
            expr_slice[0].kind,
-            MatchedKind::Ident { role: "qualified_star_qualifier", .. }
+            MatchedKind::Ident {
+                role: "qualified_star_qualifier",
+                ..
+            }
        )
        && matches!(expr_slice[1].kind, MatchedKind::Punct('.'))
        && matches!(expr_slice[2].kind, MatchedKind::Punct('*'))
@@ -1413,11 +1414,7 @@ fn classify_projection_item(
        )
    {
        let col_text = &expr_slice[0].text;
-        let resolved_type = resolve_bare_column_type_in_frame(
-            body_frame,
-            scope_stack,
-            col_text,
-        );
+        let resolved_type = resolve_bare_column_type_in_frame(body_frame, scope_stack, col_text);
        let name = alias.unwrap_or_else(|| col_text.clone());
        out.push(CteColumn {
            name: Some(name),
@@ -1447,12 +1444,7 @@ fn classify_projection_item(
    {
        let qual = &expr_slice[0].text;
        let col_text = &expr_slice[2].text;
-        let resolved_type = resolve_qualified_column_type(
-            body_frame,
-            scope_stack,
-            qual,
-            col_text,
-        );
+        let resolved_type = resolve_qualified_column_type(body_frame, scope_stack, qual, col_text);
        let name = alias.unwrap_or_else(|| col_text.clone());
        out.push(CteColumn {
            name: Some(name),
@@ -1493,16 +1485,8 @@ fn strip_trailing_alias<'a>(
        }
    ) {
        // Optional preceding `AS` keyword.
-        if slice.len() >= 2
-            && matches!(
-                slice[slice.len() - 2].kind,
-                MatchedKind::Word("as")
-            )
-        {
-            return (
-                &slice[..slice.len() - 2],
-                Some(last.text.clone()),
-            );
+        if slice.len() >= 2 && matches!(slice[slice.len() - 2].kind, MatchedKind::Word("as")) {
+            return (&slice[..slice.len() - 2], Some(last.text.clone()));
        }
        return (&slice[..slice.len() - 1], Some(last.text.clone()));
    }
@@ -1613,8 +1597,8 @@ fn merge_expected(dst: &mut Vec<Expectation>, src: Vec<Expectation>) {
 #[cfg(test)]
 mod tests {
    use super::{
-        DYNAMIC_CACHE, FailureKind, MAX_SUBGRAMMAR_DEPTH, NodeWalkResult,
-        resolve_dynamic, walk_node,
+        DYNAMIC_CACHE, FailureKind, MAX_SUBGRAMMAR_DEPTH, NodeWalkResult, resolve_dynamic,
+        walk_node,
    };
    use crate::dsl::grammar::{Node, Word};
    use crate::dsl::walker::context::WalkContext;
@@ -1629,18 +1613,14 @@ mod tests {
        Node::Subgrammar(&NESTED),
        Node::Punct(')'),
    ];
-    static NESTED_CHOICES: &[Node] = &[
-        Node::Seq(NESTED_GROUP),
-        Node::Word(Word::keyword("x")),
-    ];
+    static NESTED_CHOICES: &[Node] = &[Node::Seq(NESTED_GROUP), Node::Word(Word::keyword("x"))];
    static NESTED: Node = Node::Choice(NESTED_CHOICES);

    fn walk_nested(input: &str) -> NodeWalkResult {
        let mut ctx = WalkContext::new();
        let mut path = MatchedPath::new();
        let mut per_byte = Vec::new();
-        let result =
-            walk_node(input, 0, &NESTED, &mut ctx, &mut path, &mut per_byte);
+        let result = walk_node(input, 0, &NESTED, &mut ctx, &mut path, &mut per_byte);
        assert_eq!(
            ctx.subgrammar_depth, 0,
            "subgrammar_depth must be restored to 0 after the walk",
@@ -1726,14 +1706,8 @@ mod tests {
    fn resolve_dynamic_cache_is_populated() {
        let ctx = WalkContext::new();
        let _ = resolve_dynamic(const_factory, &ctx);
-        let populated = !DYNAMIC_CACHE
-            .lock()
-            .expect("cache lock")
-            .is_empty();
-        assert!(
-            populated,
-            "resolve_dynamic should populate the memo cache",
-        );
+        let populated = !DYNAMIC_CACHE.lock().expect("cache lock").is_empty();
+        assert!(populated, "resolve_dynamic should populate the memo cache",);
    }

    // ---- ScopedSubgrammar (ADR-0032 §10.2) -----------------------
@@ -1758,14 +1732,7 @@ mod tests {
        let mut path = MatchedPath::new();
        let mut per_byte = Vec::new();
        let baseline_frames = ctx.from_scope_stack.len();
-        let result = walk_node(
-            input,
-            0,
-            &SCOPED_NESTED,
-            &mut ctx,
-            &mut path,
-            &mut per_byte,
-        );
+        let result = walk_node(input, 0, &SCOPED_NESTED, &mut ctx, &mut path, &mut per_byte);
        assert_eq!(
            ctx.subgrammar_depth, 0,
            "subgrammar_depth must be restored to 0 after the walk",
@@ -1801,9 +1768,9 @@ mod tests {
                kind: FailureKind::Validation(err),
                ..
            } => assert_eq!(err.message_key, "parse.custom.expression_too_deep"),
-            other => panic!(
-                "expected expression_too_deep on pathological scoped nesting, got {other:?}",
-            ),
+            other => {
+                panic!("expected expression_too_deep on pathological scoped nesting, got {other:?}",)
+            }
        }
    }

@@ -1822,9 +1789,7 @@ mod tests {
    /// Walk a top-level SQL SELECT and return the bottom frame's
    /// `from_scope` after the walk completes. Used to verify that
    /// `writes_table` / `writes_table_alias` populate bindings.
-    fn from_scope_after_walk(
-        input: &str,
-    ) -> Vec<crate::dsl::walker::context::TableBinding> {
+    fn from_scope_after_walk(input: &str) -> Vec<crate::dsl::walker::context::TableBinding> {
        let mut ctx = WalkContext::new();
        let mut path = MatchedPath::new();
        let mut per_byte = Vec::new();
@@ -1871,9 +1836,7 @@ mod tests {

    #[test]
    fn join_pushes_a_second_binding() {
-        let bindings = from_scope_after_walk(
-            "select * from a join b on x = y",
-        );
+        let bindings = from_scope_after_walk("select * from a join b on x = y");
        assert_eq!(bindings.len(), 2);
        assert_eq!(bindings[0].table, "a");
        assert_eq!(bindings[1].table, "b");
@@ -1881,9 +1844,7 @@ mod tests {

    #[test]
    fn join_with_aliases() {
-        let bindings = from_scope_after_walk(
-            "select * from a as x join b as y on x.id = y.id",
-        );
+        let bindings = from_scope_after_walk("select * from a as x join b as y on x.id = y.id");
        assert_eq!(bindings.len(), 2);
        assert_eq!(bindings[0].table, "a");
        assert_eq!(bindings[0].alias, Some("x".to_string()));
@@ -1893,9 +1854,8 @@ mod tests {

    #[test]
    fn three_way_join_pushes_three_bindings() {
-        let bindings = from_scope_after_walk(
-            "select * from a join b on x = y left join c on y = z",
-        );
+        let bindings =
+            from_scope_after_walk("select * from a join b on x = y left join c on y = z");
        assert_eq!(bindings.len(), 3);
        assert_eq!(bindings[0].table, "a");
        assert_eq!(bindings[1].table, "b");
@@ -1908,9 +1868,8 @@ mod tests {
        // binding into the inner scope frame; on exit, the frame
        // pops and the inner binding is gone. The outer scope's
        // from_scope still contains only `outer_t`.
-        let bindings = from_scope_after_walk(
-            "select * from outer_t where id in (select id from inner_t)",
-        );
+        let bindings =
+            from_scope_after_walk("select * from outer_t where id in (select id from inner_t)");
        assert_eq!(bindings.len(), 1);
        assert_eq!(bindings[0].table, "outer_t");
    }
@@ -1921,9 +1880,8 @@ mod tests {
        // body's scope frame; on body-frame exit, the inner
        // binding goes away. The outer scope contains only
        // the CTE-name reference `cte_x`.
-        let bindings = from_scope_after_walk(
-            "with cte_x as (select * from base_table) select * from cte_x",
-        );
+        let bindings =
+            from_scope_after_walk("with cte_x as (select * from base_table) select * from cte_x");
        assert_eq!(bindings.len(), 1);
        assert_eq!(bindings[0].table, "cte_x");
    }
@@ -1940,10 +1898,7 @@ mod tests {
    /// `cte_bindings` and `projection_aliases` after the walk.
    fn frame_state_after_walk(
        input: &str,
-    ) -> (
-        Vec<crate::dsl::walker::context::CteBinding>,
-        Vec<String>,
-    ) {
+    ) -> (Vec<crate::dsl::walker::context::CteBinding>, Vec<String>) {
        let mut ctx = WalkContext::new();
        let mut path = MatchedPath::new();
        let mut per_byte = Vec::new();
@@ -1968,9 +1923,7 @@ mod tests {

    #[test]
    fn cte_name_pushes_placeholder_binding() {
-        let (ctes, _) = frame_state_after_walk(
-            "with cte_x as (select 1) select * from cte_x",
-        );
+        let (ctes, _) = frame_state_after_walk("with cte_x as (select 1) select * from cte_x");
        assert_eq!(ctes.len(), 1);
        assert_eq!(ctes[0].name, "cte_x");
        // §10.3 stage-2 harvest produces one CteColumn per
@@ -1984,9 +1937,8 @@ mod tests {

    #[test]
    fn multiple_ctes_push_in_order() {
-        let (ctes, _) = frame_state_after_walk(
-            "with a as (select 1), b as (select 2) select * from b",
-        );
+        let (ctes, _) =
+            frame_state_after_walk("with a as (select 1), b as (select 2) select * from b");
        assert_eq!(ctes.len(), 2);
        assert_eq!(ctes[0].name, "a");
        assert_eq!(ctes[1].name, "b");
@@ -2006,25 +1958,20 @@ mod tests {

    #[test]
    fn projection_aliases_captured_via_as_form() {
-        let (_, aliases) = frame_state_after_walk(
-            "select a as alpha, b as beta from t",
-        );
+        let (_, aliases) = frame_state_after_walk("select a as alpha, b as beta from t");
        assert_eq!(aliases, vec!["alpha".to_string(), "beta".to_string()]);
    }

    #[test]
    fn projection_aliases_captured_via_bare_form() {
-        let (_, aliases) = frame_state_after_walk(
-            "select a alpha, b beta from t",
-        );
+        let (_, aliases) = frame_state_after_walk("select a alpha, b beta from t");
        assert_eq!(aliases, vec!["alpha".to_string(), "beta".to_string()]);
    }

    #[test]
    fn projection_aliases_mixed_forms() {
-        let (_, aliases) = frame_state_after_walk(
-            "select a as alpha, b beta, c, d as delta from t",
-        );
+        let (_, aliases) =
+            frame_state_after_walk("select a as alpha, b beta, c, d as delta from t");
        assert_eq!(
            aliases,
            vec!["alpha".to_string(), "beta".to_string(), "delta".to_string()]
@@ -2033,8 +1980,7 @@ mod tests {

    #[test]
    fn projection_aliases_empty_when_no_aliases() {
-        let (_, aliases) =
-            frame_state_after_walk("select a, b from t");
+        let (_, aliases) = frame_state_after_walk("select a, b from t");
        assert!(aliases.is_empty());
    }

@@ -2088,9 +2034,24 @@ mod tests {
        s.table_columns.insert(
            "users".to_string(),
            vec![
-                TableColumn { name: "id".to_string(), user_type: Type::Int, not_null: false, has_default: false },
-                TableColumn { name: "name".to_string(), user_type: Type::Text, not_null: false, has_default: false },
-                TableColumn { name: "age".to_string(), user_type: Type::Int, not_null: false, has_default: false },
+                TableColumn {
+                    name: "id".to_string(),
+                    user_type: Type::Int,
+                    not_null: false,
+                    has_default: false,
+                },
+                TableColumn {
+                    name: "name".to_string(),
+                    user_type: Type::Text,
+                    not_null: false,
+                    has_default: false,
+                },
+                TableColumn {
+                    name: "age".to_string(),
+                    user_type: Type::Int,
+                    not_null: false,
+                    has_default: false,
+                },
            ],
        );
        s
@@ -2108,10 +2069,7 @@ mod tests {
        assert_eq!(ctes.len(), 1);
        assert_eq!(ctes[0].columns.len(), 3);
        assert_eq!(ctes[0].columns[0].name.as_deref(), Some("id"));
-        assert_eq!(
-            ctes[0].columns[0].type_,
-            Some(crate::dsl::types::Type::Int),
-        );
+        assert_eq!(ctes[0].columns[0].type_, Some(crate::dsl::types::Type::Int),);
        assert_eq!(ctes[0].columns[1].name.as_deref(), Some("name"));
        assert_eq!(
            ctes[0].columns[1].type_,
@@ -2161,10 +2119,7 @@ mod tests {
        );
        assert_eq!(ctes[0].columns.len(), 1);
        assert_eq!(ctes[0].columns[0].name.as_deref(), Some("age"));
-        assert_eq!(
-            ctes[0].columns[0].type_,
-            Some(crate::dsl::types::Type::Int),
-        );
+        assert_eq!(ctes[0].columns[0].type_, Some(crate::dsl::types::Type::Int),);
    }

    #[test]
@@ -2259,15 +2214,9 @@ mod tests {
            .expect("outer_cte binding");
        assert_eq!(outer.columns.len(), 2);
        assert_eq!(outer.columns[0].name.as_deref(), Some("id"));
-        assert_eq!(
-            outer.columns[0].type_,
-            Some(crate::dsl::types::Type::Int),
-        );
+        assert_eq!(outer.columns[0].type_, Some(crate::dsl::types::Type::Int),);
        assert_eq!(outer.columns[1].name.as_deref(), Some("name"));
-        assert_eq!(
-            outer.columns[1].type_,
-            Some(crate::dsl::types::Type::Text),
-        );
+        assert_eq!(outer.columns[1].type_, Some(crate::dsl::types::Type::Text),);
    }

    #[test]
@@ -2287,15 +2236,9 @@ mod tests {
        let b = ctes.iter().find(|c| c.name == "b").expect("b binding");
        assert_eq!(b.columns.len(), 2);
        assert_eq!(b.columns[0].name.as_deref(), Some("id"));
-        assert_eq!(
-            b.columns[0].type_,
-            Some(crate::dsl::types::Type::Int),
-        );
+        assert_eq!(b.columns[0].type_, Some(crate::dsl::types::Type::Int),);
        assert_eq!(b.columns[1].name.as_deref(), Some("name"));
-        assert_eq!(
-            b.columns[1].type_,
-            Some(crate::dsl::types::Type::Text),
-        );
+        assert_eq!(b.columns[1].type_, Some(crate::dsl::types::Type::Text),);
    }

    #[test]
@@ -2310,10 +2253,7 @@ mod tests {
        );
        assert_eq!(ctes[0].columns.len(), 3);
        assert_eq!(ctes[0].columns[0].name.as_deref(), Some("a"));
-        assert_eq!(
-            ctes[0].columns[0].type_,
-            Some(crate::dsl::types::Type::Int),
-        );
+        assert_eq!(ctes[0].columns[0].type_, Some(crate::dsl::types::Type::Int),);
        assert_eq!(ctes[0].columns[1].name.as_deref(), Some("b"));
        assert_eq!(
            ctes[0].columns[1].type_,
@@ -24,8 +24,8 @@
 use crate::dsl::grammar::HighlightClass;
 use crate::dsl::walker::context::WalkContext;
 use crate::dsl::walker::lex_helpers::{
-    consume_bare_path, consume_flag, consume_ident, consume_number_literal,
-    consume_string_literal, skip_whitespace,
+    consume_bare_path, consume_flag, consume_ident, consume_number_literal, consume_string_literal,
+    skip_whitespace,
 };
 use crate::dsl::walker::outcome::{ByteClass, WalkBound};

@@ -47,16 +47,11 @@ pub fn highlight_runs(source: &str) -> Vec<ByteClass> {
 /// token, producing the keyword classes the renderer needs to
 /// colour `select` / `from` / `where` / `union` / `case` / etc.
 #[must_use]
-pub fn highlight_runs_in_mode(
-    source: &str,
-    mode: crate::mode::Mode,
-) -> Vec<ByteClass> {
+pub fn highlight_runs_in_mode(source: &str, mode: crate::mode::Mode) -> Vec<ByteClass> {
    let mut ctx = WalkContext::new();
    ctx.mode = mode;
    let (result, _cmd) = super::walk(source, WalkBound::EndOfInput, &mut ctx);
-    let mut classes: Vec<ByteClass> = result
-        .map(|r| r.per_byte_class)
-        .unwrap_or_default();
+    let mut classes: Vec<ByteClass> = result.map(|r| r.per_byte_class).unwrap_or_default();

    let scan_start = classes.last().map_or(0, |c| c.end);
    scan_remainder(source, scan_start, &mut classes);
@@ -133,9 +128,7 @@ fn scan_remainder(source: &str, start: usize, classes: &mut Vec<ByteClass>) {
                    .get(pos + 1)
                    .copied()
                    .is_some_and(|c| c.is_ascii_digit()));
-        if looks_like_number
-            && let Some((s, e)) = consume_number_literal(source, pos)
-        {
+        if looks_like_number && let Some((s, e)) = consume_number_literal(source, pos) {
            classes.push(ByteClass {
                start: s,
                end: e,
@@ -222,8 +215,14 @@ mod tests {
            "no Error highlight on a valid m:n line: {runs:?}"
        );
        let kinds: Vec<HighlightClass> = runs.iter().map(|(_, _, c)| *c).collect();
-        assert!(kinds.contains(&HighlightClass::Keyword), "keywords highlighted: {runs:?}");
-        assert!(kinds.contains(&HighlightClass::Identifier), "table names highlighted: {runs:?}");
+        assert!(
+            kinds.contains(&HighlightClass::Keyword),
+            "keywords highlighted: {runs:?}"
+        );
+        assert!(
+            kinds.contains(&HighlightClass::Identifier),
+            "table names highlighted: {runs:?}"
+        );
    }

    #[test]
@@ -276,10 +275,7 @@ mod tests {
    #[test]
    fn flag_classified_via_fallback() {
        // Walker doesn't engage for a bare `--all-rows`.
-        assert_eq!(
-            run("--all-rows"),
-            vec![(0, 10, HighlightClass::Flag)],
-        );
+        assert_eq!(run("--all-rows"), vec![(0, 10, HighlightClass::Flag)],);
    }

    #[test]
@@ -445,15 +441,13 @@ mod tests {
        // dispatcher, so only the entry word would highlight).
        let runs = run_advanced("select * from t");
        assert!(
-            runs.iter().any(|(s, e, c)| {
-                *c == HighlightClass::Keyword && (*s, *e) == (0, 6)
-            }),
+            runs.iter()
+                .any(|(s, e, c)| { *c == HighlightClass::Keyword && (*s, *e) == (0, 6) }),
            "expected `select` keyword span 0..6; got {runs:?}",
        );
        assert!(
-            runs.iter().any(|(s, e, c)| {
-                *c == HighlightClass::Keyword && (*s, *e) == (9, 13)
-            }),
+            runs.iter()
+                .any(|(s, e, c)| { *c == HighlightClass::Keyword && (*s, *e) == (9, 13) }),
            "expected `from` keyword span 9..13; got {runs:?}",
        );
    }
@@ -514,18 +508,37 @@ mod tests {
        let insert = keywords_of(
            "insert into t (a) values (1) on conflict (a) do update set a = excluded.a returning a",
        );
-        for kw in ["insert", "into", "values", "on", "conflict", "do", "update", "set", "returning"] {
-            assert!(insert.contains(&kw), "INSERT/UPSERT: missing `{kw}`; got {insert:?}");
+        for kw in [
+            "insert",
+            "into",
+            "values",
+            "on",
+            "conflict",
+            "do",
+            "update",
+            "set",
+            "returning",
+        ] {
+            assert!(
+                insert.contains(&kw),
+                "INSERT/UPSERT: missing `{kw}`; got {insert:?}"
+            );
        }

        let update = keywords_of("update t set a = 1 where id = 2 returning a");
        for kw in ["update", "set", "where", "returning"] {
-            assert!(update.contains(&kw), "UPDATE: missing `{kw}`; got {update:?}");
+            assert!(
+                update.contains(&kw),
+                "UPDATE: missing `{kw}`; got {update:?}"
+            );
        }

        let delete = keywords_of("delete from t where id = 1 returning *");
        for kw in ["delete", "from", "where", "returning"] {
-            assert!(delete.contains(&kw), "DELETE: missing `{kw}`; got {delete:?}");
+            assert!(
+                delete.contains(&kw),
+                "DELETE: missing `{kw}`; got {delete:?}"
+            );
        }
    }
 }
@@ -110,9 +110,7 @@ pub fn consume_number_literal(source: &str, start: usize) -> Option<(usize, usiz
        return None;
    }
    let mut i = start;
-    let leading_minus = bytes[i] == b'-'
-        && i + 1 < bytes.len()
-        && bytes[i + 1].is_ascii_digit();
+    let leading_minus = bytes[i] == b'-' && i + 1 < bytes.len() && bytes[i + 1].is_ascii_digit();
    if leading_minus {
        i += 1;
    }
@@ -14,12 +14,12 @@
 //! advanced effective mode (ADR-0037).

 use crate::app::EffectiveMode;
-use crate::dsl::ReferentialAction;
-use crate::dsl::types::Type;
 use crate::dsl::Command;
+use crate::dsl::ReferentialAction;
 use crate::dsl::command::{
    ColumnSpec, CompareOp, Constraint, ConstraintKind, Expr, Operand, Predicate, RowFilter,
 };
+use crate::dsl::types::Type;
 use crate::dsl::value::Value;

 /// The dimmed `Executing SQL:` prefix on a teaching-echo line
@@ -79,7 +79,12 @@ pub fn echo_for_query(
            name,
            filter,
            limit,
-        } => Some(vec![render_show_data(name, filter.as_ref(), *limit, primary_key)]),
+        } => Some(vec![render_show_data(
+            name,
+            filter.as_ref(),
+            *limit,
+            primary_key,
+        )]),
        _ => None,
    }
 }
@@ -150,12 +155,12 @@ pub fn command_to_sql(command: &Command) -> Option<String> {
            column,
            kind,
        } => match kind {
-            ConstraintKind::NotNull => {
-                Some(format!("ALTER TABLE {table} ALTER COLUMN {column} DROP NOT NULL"))
-            }
-            ConstraintKind::Default => {
-                Some(format!("ALTER TABLE {table} ALTER COLUMN {column} DROP DEFAULT"))
-            }
+            ConstraintKind::NotNull => Some(format!(
+                "ALTER TABLE {table} ALTER COLUMN {column} DROP NOT NULL"
+            )),
+            ConstraintKind::Default => Some(format!(
+                "ALTER TABLE {table} ALTER COLUMN {column} DROP DEFAULT"
+            )),
            // A column-level UNIQUE / CHECK is anonymous in our model —
            // no portable name to DROP CONSTRAINT by, so no echo (Bucket C,
            // ADR-0035 Amendment 2 residual gap / ADR-0038 §7).
@@ -169,7 +174,10 @@ pub fn command_to_sql(command: &Command) -> Option<String> {
            table,
            assignments,
            filter: RowFilter::AllRows,
-        } => Some(format!("UPDATE {table} SET {}", render_assignments(assignments))),
+        } => Some(format!(
+            "UPDATE {table} SET {}",
+            render_assignments(assignments)
+        )),
        Command::Delete {
            table,
            filter: RowFilter::AllRows,
@@ -199,7 +207,13 @@ fn render_create_table(name: &str, columns: &[ColumnSpec], primary_key: &[String
            // The same column-constraint suffix `add column` emits (ADR-0029):
            // simple-mode `create table` can carry `default` / `check` too, so
            // the echo must render them or it is not equivalent (§1 contract).
-            append_constraints(&mut s, c.not_null, c.unique, c.default.as_ref(), c.check.as_ref());
+            append_constraints(
+                &mut s,
+                c.not_null,
+                c.unique,
+                c.default.as_ref(),
+                c.check.as_ref(),
+            );
            s
        })
        .collect();
@@ -299,8 +313,10 @@ pub(crate) fn render_create_m2n(
    primary_key: &[String],
    foreign_keys: &[(Vec<String>, String, Vec<String>)],
 ) -> String {
-    let mut parts: Vec<String> =
-        columns.iter().map(|(n, ty)| format!("{n} {}", ty.keyword())).collect();
+    let mut parts: Vec<String> = columns
+        .iter()
+        .map(|(n, ty)| format!("{n} {}", ty.keyword()))
+        .collect();
    parts.push(format!("PRIMARY KEY ({})", primary_key.join(", ")));
    for (child_columns, parent_table, parent_columns) in foreign_keys {
        parts.push(format!(
@@ -368,7 +384,12 @@ pub(crate) fn render_add_relationship_create_fk(
 ) -> Vec<String> {
    let mut lines: Vec<String> = new_columns
        .iter()
-        .map(|(col, ty)| format!("ALTER TABLE {child_table} ADD COLUMN {col} {}", ty.keyword()))
+        .map(|(col, ty)| {
+            format!(
+                "ALTER TABLE {child_table} ADD COLUMN {col} {}",
+                ty.keyword()
+            )
+        })
        .collect();
    lines.push(render_add_relationship(
        name,
@@ -461,7 +482,11 @@ fn predicate_to_sql(predicate: &Predicate) -> String {
            negated,
        } => {
            let not = if *negated { "NOT " } else { "" };
-            format!("{} {not}LIKE {}", operand_to_sql(target), operand_to_sql(pattern))
+            format!(
+                "{} {not}LIKE {}",
+                operand_to_sql(target),
+                operand_to_sql(pattern)
+            )
        }
        Predicate::Between {
            target,
@@ -484,7 +509,11 @@ fn predicate_to_sql(predicate: &Predicate) -> String {
        } => {
            let not = if *negated { "NOT " } else { "" };
            let rendered: Vec<String> = items.iter().map(operand_to_sql).collect();
-            format!("{} {not}IN ({})", operand_to_sql(target), rendered.join(", "))
+            format!(
+                "{} {not}IN ({})",
+                operand_to_sql(target),
+                rendered.join(", ")
+            )
        }
        Predicate::IsNull { target, negated } => {
            let not = if *negated { "NOT " } else { "" };
@@ -562,7 +591,10 @@ mod tests {
    fn create_table_compound_pk_renders_table_level() {
        let cmd = create_table(
            "T",
-            vec![ColumnSpec::new("a", Type::Int), ColumnSpec::new("b", Type::Int)],
+            vec![
+                ColumnSpec::new("a", Type::Int),
+                ColumnSpec::new("b", Type::Int),
+            ],
            &["a", "b"],
        );
        assert_eq!(
@@ -594,7 +626,11 @@ mod tests {
            default: Some(Value::Text("A".to_string())),
            ..ColumnSpec::new("grade", Type::Text)
        };
-        let cmd = create_table("T", vec![ColumnSpec::new("id", Type::Serial), age, grade], &["id"]);
+        let cmd = create_table(
+            "T",
+            vec![ColumnSpec::new("id", Type::Serial), age, grade],
+            &["id"],
+        );
        let sql = command_to_sql(&cmd).expect("echo");
        assert_eq!(
            sql,
@@ -625,11 +661,11 @@ mod tests {
            check: None,
        };
        let sql = command_to_sql(&cmd).expect("echo");
-        assert_eq!(sql, "ALTER TABLE T ADD COLUMN note text NOT NULL DEFAULT 'n/a'");
-        assert!(matches!(
-            reparse(&sql),
-            Ok(Command::SqlAlterTable { .. })
-        ));
+        assert_eq!(
+            sql,
+            "ALTER TABLE T ADD COLUMN note text NOT NULL DEFAULT 'n/a'"
+        );
+        assert!(matches!(reparse(&sql), Ok(Command::SqlAlterTable { .. })));
    }

    #[test]
@@ -657,7 +693,10 @@ mod tests {
            })),
        };
        let sql = command_to_sql(&cmd).expect("echo");
-        assert_eq!(sql, "ALTER TABLE T ADD COLUMN score int UNIQUE CHECK (score >= 0)");
+        assert_eq!(
+            sql,
+            "ALTER TABLE T ADD COLUMN score int UNIQUE CHECK (score >= 0)"
+        );
        assert!(matches!(reparse(&sql), Ok(Command::SqlAlterTable { .. })));
    }

@@ -1031,7 +1070,10 @@ mod tests {
        let lines = render_drop_column_cascade(
            "Orders",
            "CustId",
-            &["Orders_CustId_idx".to_string(), "Orders_CustId_Day_idx".to_string()],
+            &[
+                "Orders_CustId_idx".to_string(),
+                "Orders_CustId_Day_idx".to_string(),
+            ],
        );
        assert_eq!(
            lines.as_slice(),
@@ -1043,9 +1085,18 @@ mod tests {
        );
        // Each line is itself runnable advanced-mode SQL (the §1 contract
        // holds per line for category 2).
-        assert!(matches!(reparse(&lines[0]), Ok(Command::SqlDropIndex { .. })));
-        assert!(matches!(reparse(&lines[1]), Ok(Command::SqlDropIndex { .. })));
-        assert!(matches!(reparse(&lines[2]), Ok(Command::SqlAlterTable { .. })));
+        assert!(matches!(
+            reparse(&lines[0]),
+            Ok(Command::SqlDropIndex { .. })
+        ));
+        assert!(matches!(
+            reparse(&lines[1]),
+            Ok(Command::SqlDropIndex { .. })
+        ));
+        assert!(matches!(
+            reparse(&lines[2]),
+            Ok(Command::SqlAlterTable { .. })
+        ));
    }

    #[test]
@@ -1054,7 +1105,10 @@ mod tests {
        // plain `DROP COLUMN` — still semantically equivalent.
        let lines = render_drop_column_cascade("T", "c", &[]);
        assert_eq!(lines.as_slice(), &["ALTER TABLE T DROP COLUMN c"]);
-        assert!(matches!(reparse(&lines[0]), Ok(Command::SqlAlterTable { .. })));
+        assert!(matches!(
+            reparse(&lines[0]),
+            Ok(Command::SqlAlterTable { .. })
+        ));
    }

    #[test]
@@ -1078,8 +1132,14 @@ mod tests {
                "ALTER TABLE Orders ADD CONSTRAINT Customers_id_to_Orders_CustId FOREIGN KEY (CustId) REFERENCES Customers (id) ON DELETE CASCADE",
            ]
        );
-        assert!(matches!(reparse(&lines[0]), Ok(Command::SqlAlterTable { .. })));
-        assert!(matches!(reparse(&lines[1]), Ok(Command::SqlAlterTable { .. })));
+        assert!(matches!(
+            reparse(&lines[0]),
+            Ok(Command::SqlAlterTable { .. })
+        ));
+        assert!(matches!(
+            reparse(&lines[1]),
+            Ok(Command::SqlAlterTable { .. })
+        ));
    }

    #[test]
@@ -1116,8 +1176,16 @@ mod tests {
            ],
            &["Students_id".to_string(), "Courses_id".to_string()],
            &[
-                (vec!["Students_id".to_string()], "Students".to_string(), vec!["id".to_string()]),
-                (vec!["Courses_id".to_string()], "Courses".to_string(), vec!["id".to_string()]),
+                (
+                    vec!["Students_id".to_string()],
+                    "Students".to_string(),
+                    vec!["id".to_string()],
+                ),
+                (
+                    vec!["Courses_id".to_string()],
+                    "Courses".to_string(),
+                    vec!["id".to_string()],
+                ),
            ],
        );
        assert_eq!(
@@ -1172,8 +1240,14 @@ mod tests {
    #[test]
    fn value_literal_renders_null_uppercase_and_quotes_text() {
        assert_eq!(value_to_sql_literal(&Value::Null), "NULL");
-        assert_eq!(value_to_sql_literal(&Value::Text("O'Hara".to_string())), "'O''Hara'");
-        assert_eq!(value_to_sql_literal(&Value::Number("3.14".to_string())), "3.14");
+        assert_eq!(
+            value_to_sql_literal(&Value::Text("O'Hara".to_string())),
+            "'O''Hara'"
+        );
+        assert_eq!(
+            value_to_sql_literal(&Value::Number("3.14".to_string())),
+            "3.14"
+        );
        assert_eq!(value_to_sql_literal(&Value::Bool(false)), "false");
    }

@@ -1258,9 +1332,7 @@ mod tests {
                "Command::App({app:?}) is Bucket C — no echo"
            );
            // Also confirm echo_for gates the same in advanced mode.
-            assert!(
-                echo_for(&Command::App(app), EffectiveMode::AdvancedPersistent).is_none(),
-            );
+            assert!(echo_for(&Command::App(app), EffectiveMode::AdvancedPersistent).is_none(),);
        }
    }

@@ -8,9 +8,8 @@
 use crossterm::event::KeyEvent;

 use crate::db::{
-    AddColumnResult, ChangeColumnTypeResult, DataResult, DbError, DeleteResult,
-    DropColumnResult, InsertResult, QueryPlan, RelationshipDiagramData, TableDescription,
-    UpdateResult,
+    AddColumnResult, ChangeColumnTypeResult, DataResult, DbError, DeleteResult, DropColumnResult,
+    InsertResult, QueryPlan, RelationshipDiagramData, TableDescription, UpdateResult,
 };
 use crate::dsl::Command;

@@ -73,10 +72,16 @@ pub enum AppEvent {
    },
    /// An `explain …` command succeeded (ADR-0028). `plan`
    /// carries the captured query plan; nothing was executed.
-    DslExplainSucceeded { command: Command, plan: QueryPlan },
+    DslExplainSucceeded {
+        command: Command,
+        plan: QueryPlan,
+    },
    /// A `show <kind>` list command (V5) — carries pre-formatted
    /// display lines (tables / relationships / indexes).
-    DslShowListSucceeded { command: Command, lines: Vec<String> },
+    DslShowListSucceeded {
+        command: Command,
+        lines: Vec<String>,
+    },
    /// `show relationship <name>` (ADR-0044) — structured data for the
    /// diagram, rendered App-side; `None` when no such relationship.
    DslShowRelationshipSucceeded {
@@ -43,17 +43,11 @@ impl Catalog {
    }
 }

-fn flatten(
-    value: &serde_norway::Value,
-    prefix: String,
-    out: &mut HashMap<String, String>,
-) {
+fn flatten(value: &serde_norway::Value, prefix: String, out: &mut HashMap<String, String>) {
    match value {
        serde_norway::Value::Mapping(map) => {
            for (k, v) in map {
-                let k_str = k
-                    .as_str()
-                    .expect("catalog keys must be strings");
+                let k_str = k.as_str().expect("catalog keys must be strings");
                let next = if prefix.is_empty() {
                    k_str.to_string()
                } else {
@@ -85,9 +79,7 @@ pub fn catalog() -> &'static Catalog {
 /// See module docs for failure modes.
 pub fn translate(key: &str, args: &[(&str, &dyn Display)]) -> String {
    let template = catalog().get(key).unwrap_or_else(|| {
-        panic!(
-            "missing catalog key: `{key}` (the validator should have caught this)"
-        );
+        panic!("missing catalog key: `{key}` (the validator should have caught this)");
    });
    substitute(template, args, key)
 }
@@ -41,8 +41,14 @@ pub const KEYS_AND_PLACEHOLDERS: &[(&str, &[&str])] = &[
    ("diagnostic.alias_used_as_column", &["name"]),
    ("diagnostic.ambiguous_column", &["column", "qualifiers"]),
    ("diagnostic.auto_column_overridden", &["column", "type"]),
-    ("diagnostic.compound_arity_mismatch", &["op", "left_n", "right_n"]),
-    ("diagnostic.cte_arity_mismatch", &["cte", "declared", "actual"]),
+    (
+        "diagnostic.compound_arity_mismatch",
+        &["op", "left_n", "right_n"],
+    ),
+    (
+        "diagnostic.cte_arity_mismatch",
+        &["cte", "declared", "actual"],
+    ),
    ("diagnostic.duplicate_cte", &["name"]),
    ("diagnostic.eq_null", &[]),
    ("diagnostic.insert_arity_mismatch", &["expected", "actual"]),
@@ -63,7 +69,10 @@ pub const KEYS_AND_PLACEHOLDERS: &[(&str, &[&str])] = &[
    ),
    ("diagnostic.not_null_missing", &["column"]),
    ("diagnostic.like_numeric", &["column", "type"]),
-    ("diagnostic.projection_alias_misplaced", &["alias", "clause"]),
+    (
+        "diagnostic.projection_alias_misplaced",
+        &["alias", "clause"],
+    ),
    ("diagnostic.table_used_as_column", &["name"]),
    ("diagnostic.type_mismatch", &["column", "type"]),
    ("diagnostic.unknown_column", &["name", "table"]),
@@ -149,10 +158,7 @@ pub const KEYS_AND_PLACEHOLDERS: &[(&str, &[&str])] = &[
        "error.type_mismatch.change_column.headline",
        &["table", "column", "src_type", "target_type"],
    ),
-    (
-        "error.type_mismatch.change_column.hint",
-        &["target_type"],
-    ),
+    ("error.type_mismatch.change_column.hint", &["target_type"]),
    (
        "error.type_mismatch.insert.headline",
        &["value", "expected_type"],
@@ -181,6 +187,7 @@ pub const KEYS_AND_PLACEHOLDERS: &[(&str, &[&str])] = &[
    ("help.app.quit", &[]),
    ("help.app.help", &[]),
    ("help.app.hint", &[]),
+    ("help.app.version", &[]),
    ("help.app.rebuild", &[]),
    ("help.app.save", &[]),
    ("help.app.new", &[]),
@@ -218,12 +225,13 @@ pub const KEYS_AND_PLACEHOLDERS: &[(&str, &[&str])] = &[
    ("help.data.explain", &[]),
    // ---- Hint panel ambient typing assistance (ADR-0022 §6) ----
    ("hint.ambient_complete", &[]),
-    (
-        "hint.ambient_error_with_usage",
-        &["message", "usage"],
-    ),
+    ("hint.ambient_error_with_usage", &["message", "usage"]),
    ("hint.ambient_expected", &["expected"]),
    ("hint.getting_started", &[]),
+    ("hint.block.heading", &[]),
+    ("hint.block.what", &[]),
+    ("hint.block.example", &[]),
+    ("hint.block.concept", &[]),
    // Tier-3 teaching blocks (ADR-0053 D3) — Phase-B exemplars.
    ("hint.cmd.insert.what", &[]),
    ("hint.cmd.insert.example", &[]),
@@ -234,6 +242,32 @@ pub const KEYS_AND_PLACEHOLDERS: &[(&str, &[&str])] = &[
    ("hint.err.foreign_key.child_side.what", &[]),
    ("hint.err.foreign_key.child_side.example", &[]),
    ("hint.err.foreign_key.child_side.concept", &[]),
+    // Phase C batch 5 — runtime error-class hints.
+    ("hint.err.foreign_key.parent_side.what", &[]),
+    ("hint.err.foreign_key.parent_side.example", &[]),
+    ("hint.err.foreign_key.parent_side.concept", &[]),
+    ("hint.err.unique.what", &[]),
+    ("hint.err.unique.example", &[]),
+    ("hint.err.unique.concept", &[]),
+    ("hint.err.not_null.what", &[]),
+    ("hint.err.not_null.example", &[]),
+    ("hint.err.not_null.concept", &[]),
+    ("hint.err.check.what", &[]),
+    ("hint.err.check.example", &[]),
+    ("hint.err.check.concept", &[]),
+    ("hint.err.type_mismatch.what", &[]),
+    ("hint.err.type_mismatch.example", &[]),
+    ("hint.err.type_mismatch.concept", &[]),
+    ("hint.err.not_found.what", &[]),
+    ("hint.err.not_found.example", &[]),
+    ("hint.err.not_found.concept", &[]),
+    ("hint.err.already_exists.what", &[]),
+    ("hint.err.already_exists.example", &[]),
+    ("hint.err.already_exists.concept", &[]),
+    ("hint.err.generic.what", &[]),
+    ("hint.err.generic.example", &[]),
+    ("hint.err.invalid_value.what", &[]),
+    ("hint.err.invalid_value.example", &[]),
    // Phase C batch 1 — app-lifecycle command hints.
    ("hint.cmd.quit.what", &[]),
    ("hint.cmd.quit.example", &[]),
@@ -242,11 +276,14 @@ pub const KEYS_AND_PLACEHOLDERS: &[(&str, &[&str])] = &[
    ("hint.cmd.help.concept", &[]),
    ("hint.cmd.hint.what", &[]),
    ("hint.cmd.hint.example", &[]),
+    ("hint.cmd.version.what", &[]),
+    ("hint.cmd.version.example", &[]),
    ("hint.cmd.rebuild.what", &[]),
    ("hint.cmd.rebuild.example", &[]),
    ("hint.cmd.rebuild.concept", &[]),
    ("hint.cmd.save.what", &[]),
    ("hint.cmd.save.example", &[]),
+    ("hint.cmd.save.concept", &[]),
    ("hint.cmd.new.what", &[]),
    ("hint.cmd.new.example", &[]),
    ("hint.cmd.load.what", &[]),
@@ -306,10 +343,71 @@ pub const KEYS_AND_PLACEHOLDERS: &[(&str, &[&str])] = &[
    ("hint.cmd.change_column.what", &[]),
    ("hint.cmd.change_column.example", &[]),
    ("hint.cmd.change_column.concept", &[]),
-    (
-        "hint.ambient_invalid_ident",
-        &["kind", "found"],
-    ),
+    // Phase C batch 3 — DML command hints.
+    ("hint.cmd.update.what", &[]),
+    ("hint.cmd.update.example", &[]),
+    ("hint.cmd.update.concept", &[]),
+    ("hint.cmd.delete.what", &[]),
+    ("hint.cmd.delete.example", &[]),
+    ("hint.cmd.delete.concept", &[]),
+    ("hint.cmd.show_data.what", &[]),
+    ("hint.cmd.show_data.example", &[]),
+    ("hint.cmd.show_data.concept", &[]),
+    ("hint.cmd.show_table.what", &[]),
+    ("hint.cmd.show_table.example", &[]),
+    ("hint.cmd.show_table.concept", &[]),
+    ("hint.cmd.show_tables.what", &[]),
+    ("hint.cmd.show_tables.example", &[]),
+    ("hint.cmd.show_relationships.what", &[]),
+    ("hint.cmd.show_relationships.example", &[]),
+    ("hint.cmd.show_relationships.concept", &[]),
+    ("hint.cmd.show_indexes.what", &[]),
+    ("hint.cmd.show_indexes.example", &[]),
+    ("hint.cmd.show_indexes.concept", &[]),
+    ("hint.cmd.seed.what", &[]),
+    ("hint.cmd.seed.example", &[]),
+    ("hint.cmd.seed.concept", &[]),
+    ("hint.cmd.explain.what", &[]),
+    ("hint.cmd.explain.example", &[]),
+    ("hint.cmd.explain.concept", &[]),
+    ("hint.cmd.replay.what", &[]),
+    ("hint.cmd.replay.example", &[]),
+    ("hint.cmd.replay.concept", &[]),
+    // Phase C batch 4 — advanced-mode SQL command hints.
+    ("hint.cmd.sql_create_table.what", &[]),
+    ("hint.cmd.sql_create_table.example", &[]),
+    ("hint.cmd.sql_create_table.concept", &[]),
+    ("hint.cmd.sql_alter_table.what", &[]),
+    ("hint.cmd.sql_alter_table.example", &[]),
+    ("hint.cmd.sql_alter_table.concept", &[]),
+    ("hint.cmd.sql_create_index.what", &[]),
+    ("hint.cmd.sql_create_index.example", &[]),
+    ("hint.cmd.sql_create_index.concept", &[]),
+    ("hint.cmd.sql_drop_index.what", &[]),
+    ("hint.cmd.sql_drop_index.example", &[]),
+    ("hint.cmd.sql_drop_index.concept", &[]),
+    ("hint.cmd.sql_drop_table.what", &[]),
+    ("hint.cmd.sql_drop_table.example", &[]),
+    ("hint.cmd.sql_drop_table.concept", &[]),
+    ("hint.cmd.sql_insert.what", &[]),
+    ("hint.cmd.sql_insert.example", &[]),
+    ("hint.cmd.sql_insert.concept", &[]),
+    ("hint.cmd.sql_update.what", &[]),
+    ("hint.cmd.sql_update.example", &[]),
+    ("hint.cmd.sql_update.concept", &[]),
+    ("hint.cmd.sql_delete.what", &[]),
+    ("hint.cmd.sql_delete.example", &[]),
+    ("hint.cmd.sql_delete.concept", &[]),
+    ("hint.cmd.select.what", &[]),
+    ("hint.cmd.select.example", &[]),
+    ("hint.cmd.select.concept", &[]),
+    ("hint.cmd.with.what", &[]),
+    ("hint.cmd.with.example", &[]),
+    ("hint.cmd.with.concept", &[]),
+    ("hint.cmd.explain_sql.what", &[]),
+    ("hint.cmd.explain_sql.example", &[]),
+    ("hint.cmd.explain_sql.concept", &[]),
+    ("hint.ambient_invalid_ident", &["kind", "found"]),
    ("hint.ambient_typing_name", &[]),
    // Issue #4: introduce the advanced-mode CREATE TABLE element
    // slot (`create table T (`) so the otherwise-invisible
@@ -317,10 +415,7 @@ pub const KEYS_AND_PLACEHOLDERS: &[(&str, &[&str])] = &[
    ("hint.create_table_element", &[]),
    ("hint.seed_count", &[]),
    ("hint.value_literal_slot", &[]),
-    (
-        "hint.ambient_typing_name_then",
-        &["next"],
-    ),
+    ("hint.ambient_typing_name_then", &["next"]),
    // Per-column-type value-slot hints (ADR-0024 §Phase D).
    ("hint.value_slot_blob", &[]),
    ("hint.value_slot_bool", &[]),
@@ -343,7 +438,10 @@ pub const KEYS_AND_PLACEHOLDERS: &[(&str, &[&str])] = &[
    ("parse.custom.alter_named_unique", &[]),
    ("parse.custom.bind_type_mismatch", &["found", "expected"]),
    ("parse.custom.change_column_flags_exclusive", &[]),
-    ("parse.custom.constraint_redundant_on_pk", &["column", "constraint"]),
+    (
+        "parse.custom.constraint_redundant_on_pk",
+        &["column", "constraint"],
+    ),
    ("parse.custom.create_table_needs_pk", &[]),
    ("parse.custom.expression_too_deep", &[]),
    ("parse.custom.insert_form_a_missing_values", &["columns"]),
@@ -391,6 +489,7 @@ pub const KEYS_AND_PLACEHOLDERS: &[(&str, &[&str])] = &[
    ("parse.usage.mode", &[]),
    ("parse.usage.new", &[]),
    ("parse.usage.quit", &[]),
+    ("parse.usage.version", &[]),
    ("parse.usage.rebuild", &[]),
    ("parse.usage.redo", &[]),
    ("parse.usage.replay", &[]),
@@ -477,14 +576,12 @@ pub const KEYS_AND_PLACEHOLDERS: &[(&str, &[&str])] = &[
        &["table", "col_count", "col_list", "supplied", "non_auto_csv"],
    ),
    ("select.internal_table", &["table"]),
-    (
-        "cli.invalid_value",
-        &["flag", "value", "expected"],
-    ),
+    ("cli.invalid_value", &["flag", "value", "expected"]),
    ("cli.missing_value", &["flag"]),
    ("cli.multiple_paths", &["first", "second"]),
    ("cli.resume_with_path", &[]),
    ("cli.unknown_argument", &["arg"]),
+    ("cli.version_line", &["version"]),
    (
        "archive.export_sequence_exhausted",
        &["project", "target_dir", "limit"],
@@ -557,6 +654,7 @@ pub const KEYS_AND_PLACEHOLDERS: &[(&str, &[&str])] = &[
    ("shortcut.confirm", &[]),
    ("shortcut.cycle", &[]),
    ("shortcut.del_word", &[]),
+    ("shortcut.hint", &[]),
    ("shortcut.history", &[]),
    ("shortcut.home_end", &[]),
    ("shortcut.load", &[]),
@@ -766,8 +864,7 @@ mod tests {
            }
        }

-        let declared: HashSet<&str> =
-            KEYS_AND_PLACEHOLDERS.iter().map(|(k, _)| *k).collect();
+        let declared: HashSet<&str> = KEYS_AND_PLACEHOLDERS.iter().map(|(k, _)| *k).collect();
        for key in cat.keys() {
            if key.starts_with("_test.") {
                continue;
@@ -789,9 +886,8 @@ mod tests {
    /// Mirror of `tests/engine_vocabulary_audit.rs::FORBIDDEN`,
    /// duplicated here so the catalog validator is self-contained
    /// (no dependency on the integration-test binary).
-    const FORBIDDEN_ENGINE_VOCABULARY: &[&str] = &[
-        "SQLite", "sqlite", "rusqlite", "STRICT", "PRAGMA",
-    ];
+    const FORBIDDEN_ENGINE_VOCABULARY: &[&str] =
+        &["SQLite", "sqlite", "rusqlite", "STRICT", "PRAGMA"];

    /// Detect a `{name:...}` format-specifier placeholder.
    /// Doubled braces `{{` / `}}` are escapes — must skip them.
@@ -34,8 +34,8 @@ pub mod keys;
 pub mod translate;

 pub use error::{DiagnosticTable, FriendlyError};
-pub use format::{catalog, Catalog};
-pub use translate::{error_hint_class, FailureContext, Operation, TranslateContext, Verbosity};
+pub use format::{Catalog, catalog};
+pub use translate::{FailureContext, Operation, TranslateContext, Verbosity, error_hint_class};

 // `translate::translate` and `format::translate` are different
 // callables — the former is the structured DbError → FriendlyError
@@ -162,6 +162,10 @@ error:
 # ---- Help text (CLI banner + in-app `help` command) ------------------
 # ---- CLI argument-parsing errors (stderr before TUI starts) ---------
 cli:
+  # Version line for `--version` / `-V` and the in-app `version` command
+  # (ADR-0054). `{version}` is `CARGO_PKG_VERSION` — the single source of
+  # truth, equal to the `v*` release tag (release CI guards the match).
+  version_line: "rdbms-playground {version}"
  missing_value: "missing value for --{flag}"
  invalid_value: "invalid value for --{flag}: {value} (expected one of: {expected})"
  unknown_argument: "unknown argument: {arg}"
@@ -186,6 +190,7 @@ help:

    Options:
        -h, --help               Print this help and exit.
+        -V, --version            Print the version and exit.
            --theme <light|dark> Override theme (default: auto-detect).
            --data-dir <PATH>    Use PATH as the data root instead of
                                 the OS-standard location for this run.
@@ -210,6 +215,7 @@ help:

    App-level commands (typed inside the app, available in both modes):
        quit                     Exit cleanly.
+        version                  Print the application version.
        mode simple|advanced     Switch input mode.
        help                     Show this list of commands in-app.
        save                     Save the current temp project under a
@@ -258,6 +264,8 @@ help:
        help <command>             — detailed help for one command (e.g. `help insert`)
    hint: |-
        hint                       — explain the most recent error (press F1 for a hint on what you're typing)
+    version: |-
+        version                    — print the application version (same as the `--version` command-line flag)
    rebuild: |-
        rebuild                    — rebuild the project database from project.yaml + data/ (with confirmation)
    save: |-
@@ -391,6 +399,13 @@ hint:
  # H2 / ADR-0053: shown by `hint` / F1 when there is nothing specific
  # to expand on (no recent error, empty input).
  getting_started: "Start typing a command and press F1 for a hint, or type `help` for the full command list."
+  # Tier-3 block scaffolding (ADR-0053 D4): the heading + the labels the
+  # `what` / `example` / `concept` parts render under.
+  block:
+    heading: "Hint"
+    what: "What"
+    example: "Example"
+    concept: "Concept"
  # ── Tier-3 teaching blocks (ADR-0053 D3) ──────────────────────────
  # Per-form command hints (`hint.cmd.<form>`) and per-class error
  # hints (`hint.err.<class>`), each a `what` (1–2 sentences) / `example`
@@ -418,13 +433,17 @@ hint:
    hint:
      what: "Explain the most recent error — or, pressing F1 while typing, the command you're building."
      example: "hint"
+    version:
+      what: "Print the application version."
+      example: "version"
    rebuild:
      what: "Rebuild the project database from its saved text files."
      example: "rebuild"
      concept: "The text files (project.yaml + the data folder) are the source of truth; the database is derived and can always be rebuilt from them."
    save:
-      what: "Save the current project under a name; `save as` copies it to a new one."
-      example: "save as my-shop"
+      what: "Save the current project; `save as` copies it to a new name or location."
+      example: "save as"
+      concept: "On a temporary project, `save` opens a prompt to give it a permanent name; a named project auto-saves as you work, so `save` on one is already done. `save as` always prompts for a new name or path — use it to copy a project."
    new:
      what: "Close the current project and start a fresh temporary one."
      example: "new"
@@ -437,7 +456,7 @@ hint:
      concept: "The zip carries the schema and data as text, so anyone can rebuild the very same database from it."
    import:
      what: "Unpack a project zip into a new project and switch to it."
-      example: "import my-shop.zip as shop-copy"
+      example: "import my-shop.zip as shop_copy"
    mode:
      what: "Switch between simple mode (the guided teaching commands) and advanced mode (raw SQL)."
      example: "mode advanced"
@@ -458,9 +477,9 @@ hint:
      example: "copy last"
    # DDL — schema-shaping commands (Phase C batch 2).
    create_table:
-      what: "Create a new table — its columns, their types, and a primary key."
-      example: "create table Customers with pk id(serial), name(text), email(text)"
-      concept: "A table is a set of rows that share the same columns. The primary key uniquely identifies each row; a `serial` key numbers the rows for you."
+      what: "Create a new table and declare its primary key."
+      example: "create table Customers with pk id(serial)"
+      concept: "A table is a set of rows sharing the same columns. `with pk` declares the primary key — one column, or several for a compound key; add the other columns afterwards with `add column`. A `serial` key numbers the rows for you."
    create_m2n:
      what: "Create a junction table linking two tables many-to-many."
      example: "create m:n relationship from Students to Courses"
@@ -505,12 +524,135 @@ hint:
      what: "Change a column's type, converting the existing values."
      example: "change column Customers: status (int)"
      concept: "The database converts each stored value to the new type; if a value can't convert it refuses the change, so you don't silently lose data. Flags let you force or skip the conversion."
+    # DML — querying and changing data (Phase C batch 3).
+    update:
+      what: "Change values in the rows that match a condition."
+      example: "update Customers set email = 'new@example.io' where id = 1"
+      concept: "The `where` clause picks which rows change, and it's required — pass `--all-rows` to change the whole table on purpose — so you never update more than you meant to."
+    delete:
+      what: "Remove the rows that match a condition."
+      example: "delete from Orders where status = 'cancelled'"
+      concept: "A `where` is required (use `--all-rows` to clear the table on purpose). Rows a relationship points at may be blocked or cascade-deleted, per its `on delete` action."
+    show_data:
+      what: "Show the rows stored in a table."
+      example: "show data Customers"
+      concept: "This reads the data and never changes it. Add a `where` to show only matching rows."
+    show_table:
+      what: "Show a table's structure — its columns, types, keys, and relationships."
+      example: "show table Customers"
+      concept: "Structure, not data: the column definitions and how this table links to others. Use `show data` to see the rows themselves."
+    show_tables:
+      what: "List all the tables in the project."
+      example: "show tables"
+    show_relationships:
+      what: "List all the relationships between tables."
+      example: "show relationships"
+      concept: "Each relationship is a foreign-key link from a child column to a parent's key, with an `on delete` / `on update` rule."
+    show_indexes:
+      what: "List all the indexes in the project."
+      example: "show indexes"
+      concept: "Indexes speed up lookups; this shows which columns each one covers and whether it enforces uniqueness."
+    seed:
+      what: "Fill a table with generated sample rows, or fill one column on existing rows."
+      example: "seed Customers 50"
+      concept: "Seeding invents realistic-looking data so you have something to query. Pin a value with `set col = …`, choose a generator with `as`, or give a numeric range with `between`."
+    explain:
+      what: "Show how the database will run a query — without running it."
+      example: "explain show data Customers where email = 'a@example.io'"
+      concept: "The plan reveals whether the database scans the whole table or jumps straight to rows through an index — the payoff of `add index`. `explain` never executes, so it's safe even on a delete."
+    replay:
+      what: "Re-run the commands recorded in a history file."
+      example: "replay session.log"
+      concept: "Every successful command is journalled, so replaying re-applies them in order to reproduce a project's state — handy for scripting or redoing a sequence."
+    # Advanced-mode SQL forms (Phase C batch 4). Examples are SQL, the
+    # advanced surface — distinct from their simple-mode siblings.
+    sql_create_table:
+      what: "Create a table using SQL syntax (advanced mode)."
+      example: "create table Customers (id int primary key, name text, email text)"
+      concept: "Advanced mode speaks SQL: constraints go inline (`primary key`, `not null`, `unique`, `check`). This is the raw form of simple mode's `create table … with pk …`."
+    sql_alter_table:
+      what: "Change a table's structure with SQL `alter table` (advanced mode)."
+      example: "alter table Customers add column phone text"
+      concept: "`alter table` adds or drops columns, renames, and adds constraints — the SQL equivalent of simple mode's `add column` / `drop column` / `change column`."
+    sql_create_index:
+      what: "Create an index with SQL (advanced mode)."
+      example: "create index ix_email on Customers (email)"
+      concept: "Add `unique` to also forbid duplicate values. The simple-mode equivalent is `add index`."
+    sql_drop_index:
+      what: "Remove an index with SQL (advanced mode)."
+      example: "drop index ix_email"
+      concept: "Only the lookup shortcut goes; the data is untouched. Add `if exists` to ignore a missing index."
+    sql_drop_table:
+      what: "Remove a table with SQL (advanced mode)."
+      example: "drop table Customers"
+      concept: "Add `if exists` to avoid an error when the table might not be there. Relationships pointing at it may block the drop."
+    sql_insert:
+      what: "Insert rows with SQL (advanced mode)."
+      example: "insert into Customers (name, email) values ('Ann', 'ann@example.io')"
+      concept: "Naming the columns lets you supply them in any order and skip ones that have a default — the SQL form of simple mode's `insert`."
+    sql_update:
+      what: "Update rows with SQL (advanced mode)."
+      example: "update Customers set email = 'new@example.io' where id = 1"
+      concept: "`set` lists the new values; `where` picks which rows change. The SQL form of simple mode's `update`."
+    sql_delete:
+      what: "Delete rows with SQL (advanced mode)."
+      example: "delete from Orders where status = 'cancelled'"
+      concept: "`where` picks the rows to remove; foreign-key rules still apply. The SQL form of simple mode's `delete`."
+    select:
+      what: "Query rows with SQL `select` (advanced mode)."
+      example: "select name, email from Customers where id = 1"
+      concept: "`select` is read-only: choose columns (or `*`), filter with `where`, sort with `order by`, cap with `limit`. This is the heart of SQL — and the reason advanced mode exists."
+    with:
+      what: "Name a sub-query (a CTE) and read from it in a `select` (advanced mode)."
+      example: "with recent as (select * from Orders where id > 100) select * from recent"
+      concept: "A `with` clause (Common Table Expression) names a query so the main `select` can use it like a temporary table — handy for breaking a complex query into readable steps."
+    explain_sql:
+      what: "Show how the database will run a SQL query, without running it (advanced mode)."
+      example: "explain select * from Customers where email = 'a@example.io'"
+      concept: "Like simple mode's `explain`, but wraps a raw SQL statement. It reveals whether an index is used, and never executes."
  err:
+    # Runtime error classes (Phase C batch 5), keyed by
+    # friendly::error_hint_class. `example` is a fix recipe rather than a
+    # runnable line; `concept` is the relational idea behind the rule.
    foreign_key:
      child_side:
        what: "The value you gave for the child column doesn't match any parent row, so the foreign key has nothing to point at."
        example: "First insert the parent (insert into Customers …), then the child that references it."
-        concept: "A foreign key is a promise that every child points at a real parent, so the parent must exist first. To allow orphans on delete instead, set the relationship's `on delete` to `set null` or `cascade`."
+        concept: "A foreign key is a promise that every child points at a real parent, so the parent must exist before a child can reference it. (`on delete` actions like `cascade` or `set null` govern the other direction — what happens to children when their parent is removed — not this one.)"
+      parent_side:
+        what: "You're deleting or changing a row that other rows point at, which would orphan those children."
+        example: "Delete the child rows first, or set the relationship's `on delete` to `cascade` (remove them too) or `set null` (keep them, unlinked)."
+        concept: "A foreign key guarantees every child has a real parent, so the database won't remove a parent out from under its children unless the relationship says what should happen to them."
+    unique:
+      what: "A value you're inserting — or updating to — already exists in a column that must be unique."
+      example: "Pick a different value, or update the existing row instead of inserting a new one."
+      concept: "A unique constraint (and every primary key) forbids duplicates, so each value identifies at most one row."
+    not_null:
+      what: "You left a column empty that is required to have a value."
+      example: "Supply a value for the column, or give it a default so new rows fill it automatically."
+      concept: "A `not null` constraint means every row must have a value there — it's how you mark a fact as mandatory."
+    check:
+      what: "A value broke a `check` rule defined on the column."
+      example: "Use a value the rule allows — for example a positive number, or one of the permitted options."
+      concept: "A `check` constraint is a condition every row must satisfy, so the database enforces business rules like \"price ≥ 0\" for you."
+    type_mismatch:
+      what: "A value doesn't fit the column's type — for instance text where a number is expected."
+      example: "Give a value of the right type: a number for `int`/`real`, a quoted string for `text`, true/false for `bool`."
+      concept: "Every column has a type, and the database rejects values that don't fit, so a column's data stays consistent and comparable."
+    not_found:
+      what: "You named a table or column that doesn't exist."
+      example: "Check the spelling, or run `show tables` (or `show table <name>`) to see what's there."
+      concept: "A command can only refer to tables and columns that already exist — create them first if you need them."
+    already_exists:
+      what: "You tried to create a table, column, relationship, or index whose name is already taken."
+      example: "Pick a different name, or drop the existing one first if you meant to replace it."
+      concept: "Names must be unique within their kind so a command is never ambiguous about what it refers to."
+    generic:
+      what: "The database refused the command for the reason shown above."
+      example: "Read that message for the specifics, adjust the command, and try again."
+    invalid_value:
+      what: "A value or option in the command wasn't valid for where it was used."
+      example: "Check the value against the column's type and the command's accepted options."
  # Invalid identifier in a schema slot (ADR-0022 stage 8e
  # + the user's #5). Voice mirrors ADR-0019's "no such
  # {kind}" wording for consistency with engine errors.
@@ -743,6 +885,7 @@ parse:
    quit: "quit"
    help: "help [<command>]"
    hint: "hint"
+    version: "version"
    rebuild: "rebuild"
    save: "save  |  save as"
    new: "new"
@@ -1042,6 +1185,7 @@ shortcut:
  browse: "browse"
  clear: "clear"
  complete: "complete"
+  hint: "hint"
  history: "history"
  home_end: "home/end"
  del_word: "del word"
@@ -201,11 +201,7 @@ impl TranslateContext {
    /// Combine schema-resolved facts with operation and
    /// verbosity to build the full translator input.
    #[must_use]
-    pub fn from_facts(
-        operation: Operation,
-        verbosity: Verbosity,
-        facts: FailureContext,
-    ) -> Self {
+    pub fn from_facts(operation: Operation, verbosity: Verbosity, facts: FailureContext) -> Self {
        Self {
            operation: Some(operation),
            table: facts.table,
@@ -234,15 +230,15 @@ pub fn translate(error: &DbError, ctx: &TranslateContext) -> FriendlyError {
        // refusal sites). Catalog entries exist for the typed
        // invalid-value cases but the migration sweep
        // (ADR-0019 §9) is what wires them. For now, passthrough.
-        DbError::Unsupported(message) | DbError::InvalidValue(message) => {
-            passthrough(message)
-        }
+        DbError::Unsupported(message) | DbError::InvalidValue(message) => passthrough(message),
        DbError::PersistenceFatal { message, .. }
-        | DbError::RebuildRowFailed { detail: message, .. }
+        | DbError::RebuildRowFailed {
+            detail: message, ..
+        }
        | DbError::Io(message) => passthrough(message),
-        DbError::WorkerGone => passthrough(
-            "the database worker is no longer available — the application must restart",
-        ),
+        DbError::WorkerGone => {
+            passthrough("the database worker is no longer available — the application must restart")
+        }
    };
    // Attach the row pinpoint when the runtime resolved one.
    // The translator never builds the table itself — it only
@@ -320,11 +316,7 @@ const fn fk_hint_class(ctx: &TranslateContext) -> &'static str {
    }
 }

-fn translate_sqlite(
-    message: &str,
-    kind: SqliteErrorKind,
-    ctx: &TranslateContext,
-) -> FriendlyError {
+fn translate_sqlite(message: &str, kind: SqliteErrorKind, ctx: &TranslateContext) -> FriendlyError {
    // `change column ... --dont-convert` lets the engine
    // accept or refuse each cell. Whatever the engine returns
    // (constraint, datatype mismatch, …) means "the new type
@@ -392,8 +384,8 @@ fn translate_constraint(message: &str, ctx: &TranslateContext) -> FriendlyError
 // ---- UNIQUE -----------------------------------------------------

 fn translate_unique(message: &str, ctx: &TranslateContext) -> FriendlyError {
-    let (table, column) = parse_qualified_target(message)
-        .unwrap_or_else(|| (ctx_table(ctx), ctx_column(ctx)));
+    let (table, column) =
+        parse_qualified_target(message).unwrap_or_else(|| (ctx_table(ctx), ctx_column(ctx)));
    let value = ctx_value(ctx);
    match ctx.operation {
        Some(Operation::Update) => fe(
@@ -405,11 +397,7 @@ fn translate_unique(message: &str, ctx: &TranslateContext) -> FriendlyError {
            ),
            verbose_hint(
                ctx,
-                t!(
-                    "error.unique.update.hint",
-                    table = table,
-                    column = column
-                ),
+                t!("error.unique.update.hint", table = table, column = column),
            ),
        ),
        // Default to the INSERT variant — it's the most common
@@ -425,11 +413,7 @@ fn translate_unique(message: &str, ctx: &TranslateContext) -> FriendlyError {
            ),
            verbose_hint(
                ctx,
-                t!(
-                    "error.unique.insert.hint",
-                    table = table,
-                    column = column
-                ),
+                t!("error.unique.insert.hint", table = table, column = column),
            ),
        ),
    }
@@ -542,8 +526,8 @@ fn fk_parent_side_update(ctx: &TranslateContext) -> FriendlyError {
 // ---- NOT NULL --------------------------------------------------

 fn translate_not_null(message: &str, ctx: &TranslateContext) -> FriendlyError {
-    let (table, column) = parse_qualified_target(message)
-        .unwrap_or_else(|| (ctx_table(ctx), ctx_column(ctx)));
+    let (table, column) =
+        parse_qualified_target(message).unwrap_or_else(|| (ctx_table(ctx), ctx_column(ctx)));
    match ctx.operation {
        Some(Operation::Update) => fe(
            t!(
@@ -576,9 +560,17 @@ fn translate_check(_message: &str, ctx: &TranslateContext) -> FriendlyError {
    let column = ctx_column(ctx);
    let is_update = matches!(ctx.operation, Some(Operation::Update));
    let headline = if is_update {
-        t!("error.check.update.headline", table = table, column = column)
+        t!(
+            "error.check.update.headline",
+            table = table,
+            column = column
+        )
    } else {
-        t!("error.check.insert.headline", table = table, column = column)
+        t!(
+            "error.check.insert.headline",
+            table = table,
+            column = column
+        )
    };
    let hint = ctx.check_rule.as_ref().map_or_else(
        || {
@@ -613,8 +605,7 @@ fn translate_check(_message: &str, ctx: &TranslateContext) -> FriendlyError {
 // ---- not_found / already_exists --------------------------------

 fn translate_not_found_table(message: &str, ctx: &TranslateContext) -> FriendlyError {
-    let name = parse_after_colon(message)
-        .map_or_else(|| ctx_table(ctx), str::to_string);
+    let name = parse_after_colon(message).map_or_else(|| ctx_table(ctx), str::to_string);
    headline_only(t!("error.not_found.table.headline", name = name))
 }

@@ -656,17 +647,11 @@ fn translate_already_exists(message: &str, ctx: &TranslateContext) -> FriendlyEr
                column = column
            ));
        }
-        return headline_only(t!(
-            "error.already_exists.table.headline",
-            name = name
-        ));
+        return headline_only(t!("error.already_exists.table.headline", name = name));
    }
    // No backticks — engine-style "table T already exists".
    if let Some(name) = parse_after_word(message, "table") {
-        return headline_only(t!(
-            "error.already_exists.table.headline",
-            name = name
-        ));
+        return headline_only(t!("error.already_exists.table.headline", name = name));
    }
    if let Some(name) = parse_after_word(message, "relationship") {
        return headline_only(t!(
@@ -696,36 +681,25 @@ fn translate_generic(message: &str, ctx: &TranslateContext) -> FriendlyError {
    if lower.contains("misuse of aggregate") {
        return headline_only(t!("engine.aggregate_misuse", name = "?"));
    }
-    if lower.contains("group by")
-        || lower.contains("must appear in")
-    {
+    if lower.contains("group by") || lower.contains("must appear in") {
        return headline_only(t!("engine.group_by_required"));
    }
-    if (lower.contains("union")
-        || lower.contains("intersect")
-        || lower.contains("except"))
+    if (lower.contains("union") || lower.contains("intersect") || lower.contains("except"))
        && lower.contains("result columns")
    {
        // Last-resort safety net — the pre-flight pass in 2d.1
        // catches this in most cases; if the engine surfaces it
        // anyway, route it through the engine-neutral key.
-        return headline_only(t!(
-            "engine.compound_arity_mismatch",
-            op = "set operator"
-        ));
+        return headline_only(t!("engine.compound_arity_mismatch", op = "set operator"));
    }
    if lower.contains("scalar subquery") || lower.contains("more than one row") {
        return headline_only(t!("engine.scalar_subquery_too_many_rows"));
    }
-    if lower.contains("recursive")
-        && (lower.contains("cte") || lower.contains("union"))
-    {
+    if lower.contains("recursive") && (lower.contains("cte") || lower.contains("union")) {
        return headline_only(t!("engine.recursive_cte_malformed"));
    }

-    let operation = ctx
-        .operation
-        .map_or("operation", Operation::keyword);
+    let operation = ctx.operation.map_or("operation", Operation::keyword);
    // F2 (ADR-0035 Amendment 1): when no table is in context, use the
    // table-less hint so a contextless `friendly_message()` (replay, undo,
    // rebuild, export) never renders a literal `{table}` placeholder.
@@ -789,23 +763,33 @@ fn ctx_table(ctx: &TranslateContext) -> String {
 }

 fn ctx_column(ctx: &TranslateContext) -> String {
-    ctx.column.clone().unwrap_or_else(|| "the column".to_string())
+    ctx.column
+        .clone()
+        .unwrap_or_else(|| "the column".to_string())
 }

 fn ctx_value(ctx: &TranslateContext) -> String {
-    ctx.value.clone().unwrap_or_else(|| "that value".to_string())
+    ctx.value
+        .clone()
+        .unwrap_or_else(|| "that value".to_string())
 }

 fn ctx_parent_table(ctx: &TranslateContext) -> String {
-    ctx.parent_table.clone().unwrap_or_else(|| "the referenced table".to_string())
+    ctx.parent_table
+        .clone()
+        .unwrap_or_else(|| "the referenced table".to_string())
 }

 fn ctx_parent_column(ctx: &TranslateContext) -> String {
-    ctx.parent_column.clone().unwrap_or_else(|| "the referenced column".to_string())
+    ctx.parent_column
+        .clone()
+        .unwrap_or_else(|| "the referenced column".to_string())
 }

 fn ctx_child_table(ctx: &TranslateContext) -> String {
-    ctx.child_table.clone().unwrap_or_else(|| "the referencing table".to_string())
+    ctx.child_table
+        .clone()
+        .unwrap_or_else(|| "the referencing table".to_string())
 }

 /// Extract `T.col` from a message like
@@ -847,11 +831,7 @@ fn parse_after_word<'a>(message: &'a str, keyword: &str) -> Option<&'a str> {
    let rest = message[pos..].trim_start();
    let token_end = rest.find(|c: char| c.is_whitespace()).unwrap_or(rest.len());
    let token = rest[..token_end].trim_matches(|c: char| c == '`' || c == '\'');
-    if token.is_empty() {
-        None
-    } else {
-        Some(token)
-    }
+    if token.is_empty() { None } else { Some(token) }
 }

 #[cfg(test)]
@@ -876,15 +856,24 @@ mod tests {
        };
        let d = TranslateContext::default;
        assert_eq!(
-            error_hint_class(&sqlite(SqliteErrorKind::NoSuchTable, "no such table: X"), &d()),
+            error_hint_class(
+                &sqlite(SqliteErrorKind::NoSuchTable, "no such table: X"),
+                &d()
+            ),
            Some("not_found")
        );
        assert_eq!(
-            error_hint_class(&sqlite(SqliteErrorKind::NoSuchColumn, "no such column: X"), &d()),
+            error_hint_class(
+                &sqlite(SqliteErrorKind::NoSuchColumn, "no such column: X"),
+                &d()
+            ),
            Some("not_found")
        );
        assert_eq!(
-            error_hint_class(&sqlite(SqliteErrorKind::AlreadyExists, "already exists"), &d()),
+            error_hint_class(
+                &sqlite(SqliteErrorKind::AlreadyExists, "already exists"),
+                &d()
+            ),
            Some("already_exists")
        );
        assert_eq!(
@@ -933,13 +922,19 @@ mod tests {
            parent_table: Some("Parent".to_string()),
            ..TranslateContext::default()
        };
-        assert_eq!(error_hint_class(&fk(), &ctx), Some("foreign_key.child_side"));
+        assert_eq!(
+            error_hint_class(&fk(), &ctx),
+            Some("foreign_key.child_side")
+        );
        // child_table populated → parent-side.
        let ctx = TranslateContext {
            child_table: Some("Child".to_string()),
            ..TranslateContext::default()
        };
-        assert_eq!(error_hint_class(&fk(), &ctx), Some("foreign_key.parent_side"));
+        assert_eq!(
+            error_hint_class(&fk(), &ctx),
+            Some("foreign_key.parent_side")
+        );
        // No enrichment: operation is the tiebreaker.
        assert_eq!(
            error_hint_class(&fk(), &ctx_with(Operation::Delete)),
@@ -1049,14 +1044,22 @@ mod tests {
        ctx.parent_column = Some("country, code".to_string());
        ctx.value = Some("7, 8".to_string());
        let f = translate(&err, &ctx);
-        assert!(f.headline.contains("no parent row"), "child-side: {}", f.headline);
+        assert!(
+            f.headline.contains("no parent row"),
+            "child-side: {}",
+            f.headline
+        );
        assert!(f.headline.contains("Region"));
        assert!(
            f.headline.contains("country, code"),
            "both parent columns must appear: {}",
            f.headline
        );
-        assert!(f.headline.contains("`7, 8`"), "joined value: {}", f.headline);
+        assert!(
+            f.headline.contains("`7, 8`"),
+            "joined value: {}",
+            f.headline
+        );
    }

    #[test]
@@ -25,9 +25,9 @@
 use ratatui::style::{Color, Modifier, Style};

 use crate::dsl::parser::{parse_command_with_schema, parse_command_with_schema_in_mode};
-use crate::mode::Mode;
 use crate::dsl::walker;
 use crate::dsl::{ParseError, parse_command};
+use crate::mode::Mode;
 use crate::theme::Theme;

 /// A run of text with its byte range in the source and the
@@ -85,7 +85,16 @@ pub fn render_input_runs_in_mode(
    mode: Mode,
 ) -> Vec<StyledRun> {
    // Identity feedback view — highlight/overlay the whole input.
-    render_input_runs_feedback(input, cursor_byte, theme, cache, mode, input, cursor_byte, 0)
+    render_input_runs_feedback(
+        input,
+        cursor_byte,
+        theme,
+        cache,
+        mode,
+        input,
+        cursor_byte,
+        0,
+    )
 }

 /// [`render_input_runs_in_mode`] with a separate **feedback view** for
@@ -121,12 +130,14 @@ pub fn render_input_runs_feedback(
            byte_range: (0, offset),
            style: ratatui::style::Style::default().fg(theme.fg),
        }];
-        r.extend(lex_to_runs_in_mode(view, theme, mode).into_iter().map(|run| {
-            StyledRun {
-                byte_range: (run.byte_range.0 + offset, run.byte_range.1 + offset),
-                ..run
-            }
-        }));
+        r.extend(
+            lex_to_runs_in_mode(view, theme, mode)
+                .into_iter()
+                .map(|run| StyledRun {
+                    byte_range: (run.byte_range.0 + offset, run.byte_range.1 + offset),
+                    ..run
+                }),
+        );
        r
    };
    if let InputState::DefiniteErrorAt(pos) =
@@ -150,7 +161,11 @@ pub fn render_input_runs_feedback(
            walker::Severity::Error => theme.tok_error,
            walker::Severity::Warning => theme.warning,
        };
-        overlay_span(&mut runs, (diag.span.0 + offset, diag.span.1 + offset), colour);
+        overlay_span(
+            &mut runs,
+            (diag.span.0 + offset, diag.span.1 + offset),
+            colour,
+        );
    }
    inject_cursor(&mut runs, input, cursor_byte, theme);
    runs
@@ -234,9 +249,7 @@ pub fn classify_input_with_schema_in_mode(
    ))
 }

-fn classify_parse_result(
-    result: Result<crate::dsl::Command, ParseError>,
-) -> InputState {
+fn classify_parse_result(result: Result<crate::dsl::Command, ParseError>) -> InputState {
    match result {
        Ok(_) => InputState::Valid,
        Err(ParseError::Empty) => InputState::Empty,
@@ -372,8 +385,7 @@ pub fn advanced_alternative_note(
    // carries a blocking ERROR diagnostic such as a value-count
    // mismatch. Incomplete input (still being typed) and empty input are
    // excluded so the pointer doesn't flicker mid-keystroke.
-    let definite_dsl_error = match classify_input_with_schema_in_mode(input, cache, Mode::Simple)
-    {
+    let definite_dsl_error = match classify_input_with_schema_in_mode(input, cache, Mode::Simple) {
        InputState::DefiniteErrorAt(_) => true,
        InputState::Valid => {
            crate::dsl::walker::input_verdict_in_mode(input, Some(cache), Mode::Simple)
@@ -386,8 +398,7 @@ pub fn advanced_alternative_note(
    }
    // The validity-verdict-driven gate (ADR-0033 Amendment 5): the
    // line must be fully valid (verdict `None`) in advanced mode.
-    if crate::dsl::walker::input_verdict_in_mode(input, Some(cache), Mode::Advanced).is_some()
-    {
+    if crate::dsl::walker::input_verdict_in_mode(input, Some(cache), Mode::Advanced).is_some() {
        return None;
    }
    Some(crate::t!("advanced_mode.also_valid_sql"))
@@ -714,8 +725,7 @@ fn ambient_hint_core_in_mode(
    // narrows column candidates to the active table and runs the
    // §10.6 look-ahead, so it is the authoritative "what can go
    // here" set.
-    let completion =
-        crate::completion::candidates_at_cursor_in_mode(input, cursor, cache, mode);
+    let completion = crate::completion::candidates_at_cursor_in_mode(input, cursor, cache, mode);

    // Schema-aware diagnostics (ADR-0027 §2). `input_diagnostics`
    // is non-empty only for a command that *structurally parses*
@@ -834,7 +844,9 @@ fn ambient_hint_core_in_mode(
            // keyword set.
            return Some(AmbientHint::Prose(crate::friendly::translate(key, &[])));
        }
-        Some(crate::dsl::grammar::HintMode::SuppressProse | crate::dsl::grammar::HintMode::Default)
+        Some(
+            crate::dsl::grammar::HintMode::SuppressProse | crate::dsl::grammar::HintMode::Default,
+        )
        | None => {}
    }

@@ -855,7 +867,8 @@ fn ambient_hint_core_in_mode(
    // Invalid identifier: cursor sits in a known-set slot but
    // the typed prefix matches nothing in the schema. (Stage
    // 8e / the user's #5.)
-    if let Some(inv) = crate::completion::invalid_ident_at_cursor_in_mode(input, cursor, cache, mode)
+    if let Some(inv) =
+        crate::completion::invalid_ident_at_cursor_in_mode(input, cursor, cache, mode)
    {
        let kind = match inv.source {
            crate::dsl::grammar::IdentSource::Tables => "table",
@@ -1036,11 +1049,7 @@ pub fn lex_to_runs(input: &str, theme: &Theme) -> Vec<StyledRun> {
 /// with `Mode::Advanced` so SQL keywords past the entry word
 /// match and get highlighted (ADR-0030 §8).
 #[must_use]
-pub fn lex_to_runs_in_mode(
-    input: &str,
-    theme: &Theme,
-    mode: Mode,
-) -> Vec<StyledRun> {
+pub fn lex_to_runs_in_mode(input: &str, theme: &Theme, mode: Mode) -> Vec<StyledRun> {
    base_runs(input, theme, mode)
 }

@@ -1076,12 +1085,7 @@ fn base_runs(input: &str, theme: &Theme, mode: Mode) -> Vec<StyledRun> {
    runs
 }

-fn inject_cursor(
-    runs: &mut Vec<StyledRun>,
-    input: &str,
-    cursor_byte: usize,
-    theme: &Theme,
-) {
+fn inject_cursor(runs: &mut Vec<StyledRun>, input: &str, cursor_byte: usize, theme: &Theme) {
    let cursor_byte = cursor_byte.min(input.len());

    // End-of-input cursor: append the empty-range sentinel.
@@ -1164,9 +1168,10 @@ mod tests {
        let mut cache = SchemaCache::default();
        cache.tables.push("Customers".into());
        cache.columns.push("name".into());
-        cache
-            .table_columns
-            .insert("Customers".into(), vec![TableColumn::new("name", Type::Text)]);
+        cache.table_columns.insert(
+            "Customers".into(),
+            vec![TableColumn::new("name", Type::Text)],
+        );
        let input = ": select name from Customers";
        let view = "select name from Customers";
        let offset = 2; // ": "
@@ -1362,9 +1367,10 @@ mod tests {
        let mut cache = crate::completion::SchemaCache::default();
        cache.tables.push("users".to_string());
        cache.columns.push("email".to_string());
-        cache
-            .table_columns
-            .insert("users".to_string(), vec![TableColumn::new("email", Type::Text)]);
+        cache.table_columns.insert(
+            "users".to_string(),
+            vec![TableColumn::new("email", Type::Text)],
+        );
        cache
    }

@@ -1392,7 +1398,10 @@ mod tests {
        }
        // Tab candidates remain available (completion is independent).
        let comp = crate::completion::candidates_at_cursor_in_mode(
-            input, input.len(), &cache, Mode::Simple,
+            input,
+            input.len(),
+            &cache,
+            Mode::Simple,
        )
        .expect("completion remains available");
        let texts: Vec<&str> = comp.candidates.iter().map(|c| c.text.as_str()).collect();
@@ -1424,7 +1433,10 @@ mod tests {
                &hint,
                Some(AmbientHint::Prose(p)) if p.contains("row count")
            );
-            assert!(!is_count_prose, "count hint must not show for {input:?}; got {hint:?}");
+            assert!(
+                !is_count_prose,
+                "count hint must not show for {input:?}; got {hint:?}"
+            );
        }
    }

@@ -1502,14 +1514,12 @@ mod tests {
        use crate::dsl::types::Type;
        let mut cache = SchemaCache::default();
        cache.tables.push("Customers".to_string());
-        let tc = vec![
-            TableColumn {
-                name: "Age".to_string(),
-                user_type: Type::Int,
-                not_null: false,
-                has_default: false,
-            },
-        ];
+        let tc = vec![TableColumn {
+            name: "Age".to_string(),
+            user_type: Type::Int,
+            not_null: false,
+            has_default: false,
+        }];
        for c in &tc {
            cache.columns.push(c.name.clone());
        }
@@ -1551,9 +1561,7 @@ mod tests {
                p.contains("No such") && p.contains("Agx"),
                "a genuine column typo before FROM must warn at typing time; got: {p:?}",
            ),
-            other => panic!(
-                "`select Agx` must surface a typing-time typo hint; got: {other:?}",
-            ),
+            other => panic!("`select Agx` must surface a typing-time typo hint; got: {other:?}",),
        }
    }

@@ -1652,8 +1660,7 @@ mod tests {
        // ADR-0022 Amendment 1: advanced-mode ambient assistance
        // surfaces SQL completion candidates (here the FROM-slot
        // table) instead of the simple-mode "this is SQL" gate.
-        let cache =
-            schema_with_columns("Customers", &[("id", crate::dsl::types::Type::Int)]);
+        let cache = schema_with_columns("Customers", &[("id", crate::dsl::types::Type::Int)]);
        let input = "select * from ";
        match ambient_hint_in_mode(
            input,
@@ -1678,10 +1685,7 @@ mod tests {
        // `INSERT … (` column list. (The simple-mode DSL value-slot
        // prose is a separate surface; this pins the §8 advanced claim.)
        use crate::dsl::types::Type;
-        let cache = schema_with_columns(
-            "Customers",
-            &[("id", Type::Int), ("Name", Type::Text)],
-        );
+        let cache = schema_with_columns("Customers", &[("id", Type::Int), ("Name", Type::Text)]);

        let set_slot = "update Customers set ";
        match ambient_hint_in_mode(set_slot, set_slot.len(), None, &cache, Mode::Advanced) {
@@ -1706,16 +1710,10 @@ mod tests {
    fn simple_mode_ambient_does_not_surface_sql_candidates() {
        // The simple-mode entry point keeps gating SQL — advanced
        // assistance is opt-in via mode, never leaked into simple.
-        let cache =
-            schema_with_columns("Customers", &[("id", crate::dsl::types::Type::Int)]);
+        let cache = schema_with_columns("Customers", &[("id", crate::dsl::types::Type::Int)]);
        let input = "select * from ";
-        let hint = ambient_hint_in_mode(
-            input,
-            input.len(),
-            None,
-            &cache,
-            crate::mode::Mode::Simple,
-        );
+        let hint =
+            ambient_hint_in_mode(input, input.len(), None, &cache, crate::mode::Mode::Simple);
        let offers_table = matches!(
            &hint,
            Some(AmbientHint::Candidates { items, .. })
@@ -1733,8 +1731,7 @@ mod tests {
    fn f1_mid_typed_table_prefix_shows_completion_not_error() {
        // "select * from c" — `c` prefix-matches `Customers`. The
        // hint must offer the completion, not "no such table c".
-        let cache =
-            schema_with_columns("Customers", &[("id", crate::dsl::types::Type::Int)]);
+        let cache = schema_with_columns("Customers", &[("id", crate::dsl::types::Type::Int)]);
        match ambient_hint_in_mode(
            "select * from c",
            "select * from c".len(),
@@ -1753,8 +1750,7 @@ mod tests {
    #[test]
    fn f1_genuinely_unknown_table_still_shows_error() {
        // "zzz" matches no table prefix — the error must still show.
-        let cache =
-            schema_with_columns("Customers", &[("id", crate::dsl::types::Type::Int)]);
+        let cache = schema_with_columns("Customers", &[("id", crate::dsl::types::Type::Int)]);
        match ambient_hint_in_mode(
            "select * from zzz",
            "select * from zzz".len(),
@@ -1773,8 +1769,7 @@ mod tests {
    fn f1_simple_mode_dsl_mid_typed_table_completes() {
        // The same shadowing affects DSL commands in simple mode:
        // "show data c" must offer Customers, not "no such table c".
-        let cache =
-            schema_with_columns("Customers", &[("id", crate::dsl::types::Type::Int)]);
+        let cache = schema_with_columns("Customers", &[("id", crate::dsl::types::Type::Int)]);
        match ambient_hint_in_mode(
            "show data c",
            "show data c".len(),
@@ -1804,7 +1799,12 @@ mod tests {
        cache.columns.push("order_col".to_string());
        cache.table_columns.insert(
            "Orders".to_string(),
-            vec![TableColumn { name: "order_col".to_string(), user_type: Type::Int, not_null: false, has_default: false }],
+            vec![TableColumn {
+                name: "order_col".to_string(),
+                user_type: Type::Int,
+                not_null: false,
+                has_default: false,
+            }],
        );

        let comp = crate::completion::candidates_at_cursor_in_mode(
@@ -1846,9 +1846,7 @@ mod tests {
        for c in &columns {
            cache.columns.push(c.name.clone());
        }
-        cache
-            .table_columns
-            .insert(table.to_string(), columns);
+        cache.table_columns.insert(table.to_string(), columns);
        cache
    }

@@ -1860,7 +1858,11 @@ mod tests {
            ("Customers", &[("id", Type::Serial), ("name", Type::Text)]),
            (
                "Products",
-                &[("id", Type::Serial), ("name", Type::Text), ("price", Type::Decimal)],
+                &[
+                    ("id", Type::Serial),
+                    ("name", Type::Text),
+                    ("price", Type::Decimal),
+                ],
            ),
            (
                "OrderLines",
@@ -1873,13 +1875,19 @@ mod tests {
            ),
            (
                "Orders",
-                &[("id", Type::Serial), ("customer_id", Type::Int), ("date", Type::Date)],
+                &[
+                    ("id", Type::Serial),
+                    ("customer_id", Type::Int),
+                    ("date", Type::Date),
+                ],
            ),
        ];
        for (t, cols) in tables {
            cache.tables.push((*t).to_string());
-            let tc: Vec<TableColumn> =
-                cols.iter().map(|(n, ty)| TableColumn::new(*n, *ty)).collect();
+            let tc: Vec<TableColumn> = cols
+                .iter()
+                .map(|(n, ty)| TableColumn::new(*n, *ty))
+                .collect();
            for c in &tc {
                cache.columns.push(c.name.clone());
            }
@@ -1914,17 +1922,11 @@ mod tests {
    #[test]
    fn ambient_hint_at_insert_first_value_shows_int_prose() {
        use crate::dsl::types::Type;
-        let cache = schema_with_columns(
-            "Customers",
-            &[("id", Type::Int), ("Name", Type::Text)],
-        );
+        let cache = schema_with_columns("Customers", &[("id", Type::Int), ("Name", Type::Text)]);
        let input = "insert into Customers values (";
        match ambient_hint(input, input.len(), None, &cache) {
            Some(AmbientHint::Prose(p)) => {
-                assert!(
-                    p.contains("integer"),
-                    "expected int-slot prose, got: {p:?}",
-                );
+                assert!(p.contains("integer"), "expected int-slot prose, got: {p:?}",);
            }
            other => panic!("expected Prose, got {other:?}"),
        }
@@ -1942,7 +1944,11 @@ mod tests {
        use crate::dsl::types::Type;
        let cache = schema_with_columns(
            "Customers",
-            &[("id", Type::Serial), ("Name", Type::Text), ("Email", Type::Text)],
+            &[
+                ("id", Type::Serial),
+                ("Name", Type::Text),
+                ("Email", Type::Text),
+            ],
        );
        let input = "insert into Customers values (1, 'Alice', 'a@b.c')";
        match ambient_hint(input, input.len(), None, &cache) {
@@ -1966,10 +1972,7 @@ mod tests {
        // A valid simple-mode DSL command gets no advanced pointer —
        // it isn't an error, and there is nothing to switch modes for.
        use crate::dsl::types::Type;
-        let cache = schema_with_columns(
-            "Customers",
-            &[("id", Type::Serial), ("Name", Type::Text)],
-        );
+        let cache = schema_with_columns("Customers", &[("id", Type::Serial), ("Name", Type::Text)]);
        let input = "insert into Customers values ('Alice')";
        if let Some(AmbientHint::Prose(p)) = ambient_hint(input, input.len(), None, &cache) {
            assert!(
@@ -2010,10 +2013,7 @@ mod tests {
    #[test]
    fn ambient_hint_at_insert_second_value_shows_text_prose() {
        use crate::dsl::types::Type;
-        let cache = schema_with_columns(
-            "Customers",
-            &[("id", Type::Int), ("Name", Type::Text)],
-        );
+        let cache = schema_with_columns("Customers", &[("id", Type::Int), ("Name", Type::Text)]);
        let input = "insert into Customers values (1, ";
        match ambient_hint(input, input.len(), None, &cache) {
            Some(AmbientHint::Prose(p)) => {
@@ -2029,10 +2029,8 @@ mod tests {
    #[test]
    fn ambient_hint_at_update_set_shows_per_column_prose() {
        use crate::dsl::types::Type;
-        let cache = schema_with_columns(
-            "Customers",
-            &[("id", Type::Int), ("Birthday", Type::Date)],
-        );
+        let cache =
+            schema_with_columns("Customers", &[("id", Type::Int), ("Birthday", Type::Date)]);
        let input = "update Customers set Birthday=";
        match ambient_hint(input, input.len(), None, &cache) {
            Some(AmbientHint::Prose(p)) => {
@@ -2057,9 +2055,7 @@ mod tests {
        // hasn't committed), the Optional propagates Incomplete
        // and the user sees no error overlay until they submit.
        assert_eq!(
-            classify_input(
-                "insert into Orders (id, CustId, Total) values (42, 89, 17.59"
-            ),
+            classify_input("insert into Orders (id, CustId, Total) values (42, 89, 17.59"),
            InputState::IncompleteAtEof,
        );
        assert_eq!(
@@ -2071,18 +2067,12 @@ mod tests {
    #[test]
    fn ambient_hint_at_insert_first_value_mentions_column_name() {
        use crate::dsl::types::Type;
-        let cache = schema_with_columns(
-            "Customers",
-            &[("id", Type::Int), ("Name", Type::Text)],
-        );
+        let cache = schema_with_columns("Customers", &[("id", Type::Int), ("Name", Type::Text)]);
        let input = "insert into Customers values (";
        match ambient_hint(input, input.len(), None, &cache) {
            Some(AmbientHint::Prose(p)) => {
                assert!(p.contains("id"), "expected column name `id`, got {p:?}");
-                assert!(
-                    p.contains("integer"),
-                    "expected int prose, got {p:?}",
-                );
+                assert!(p.contains("integer"), "expected int prose, got {p:?}",);
            }
            other => panic!("expected Prose, got {other:?}"),
        }
@@ -2091,10 +2081,7 @@ mod tests {
    #[test]
    fn ambient_hint_at_update_set_mentions_column_name() {
        use crate::dsl::types::Type;
-        let cache = schema_with_columns(
-            "Customers",
-            &[("id", Type::Int), ("Email", Type::Text)],
-        );
+        let cache = schema_with_columns("Customers", &[("id", Type::Int), ("Email", Type::Text)]);
        let input = "update Customers set Email=";
        match ambient_hint(input, input.len(), None, &cache) {
            Some(AmbientHint::Prose(p)) => {
@@ -2131,10 +2118,7 @@ mod tests {
    #[test]
    fn ambient_hint_at_second_insert_value_mentions_second_column() {
        use crate::dsl::types::Type;
-        let cache = schema_with_columns(
-            "Customers",
-            &[("id", Type::Int), ("Name", Type::Text)],
-        );
+        let cache = schema_with_columns("Customers", &[("id", Type::Int), ("Name", Type::Text)]);
        let input = "insert into Customers values (1, ";
        match ambient_hint(input, input.len(), None, &cache) {
            Some(AmbientHint::Prose(p)) => {
@@ -2165,14 +2149,20 @@ mod tests {
        use crate::dsl::types::Type;
        let cases: &[(&[(&str, Type)], &str)] = &[
            // string first value (the report's case): first col text.
-            (&[("Name", Type::Text), ("Age", Type::Int)],
-             "insert into Customers values ('Oli'"),
+            (
+                &[("Name", Type::Text), ("Age", Type::Int)],
+                "insert into Customers values ('Oli'",
+            ),
            // integer first value: first col int.
-            (&[("Age", Type::Int), ("Name", Type::Text)],
-             "insert into Customers values (42"),
+            (
+                &[("Age", Type::Int), ("Name", Type::Text)],
+                "insert into Customers values (42",
+            ),
            // real first value: first col real.
-            (&[("Score", Type::Real), ("Name", Type::Text)],
-             "insert into Customers values (3.5"),
+            (
+                &[("Score", Type::Real), ("Name", Type::Text)],
+                "insert into Customers values (3.5",
+            ),
        ];
        for (cols, input) in cases {
            let cache = schema_with_columns("Customers", cols);
@@ -2232,10 +2222,7 @@ mod tests {
        // is nothing left to fill. Guards against over-correcting the
        // fix into never suggesting the close paren.
        use crate::dsl::types::Type;
-        let cache = schema_with_columns(
-            "Customers",
-            &[("Name", Type::Text), ("Age", Type::Int)],
-        );
+        let cache = schema_with_columns("Customers", &[("Name", Type::Text), ("Age", Type::Int)]);
        let input = "insert into Customers values ('Oli', 52";
        match ambient_hint(input, input.len(), None, &cache) {
            Some(AmbientHint::Prose(p)) => {
@@ -2384,10 +2371,7 @@ mod tests {
        match ambient_hint("show data Missing", 17, None, &cache) {
            Some(AmbientHint::Prose(p)) => {
                assert!(p.contains("Missing"), "got {p:?}");
-                assert!(
-                    p.to_lowercase().contains("no such table"),
-                    "got {p:?}",
-                );
+                assert!(p.to_lowercase().contains("no such table"), "got {p:?}",);
            }
            other => panic!("expected Prose, got {other:?}"),
        }
@@ -2440,8 +2424,7 @@ mod tests {
        use crate::dsl::types::Type;
        // Two type-mismatch WARNINGs; the hint names the column
        // whose offending literal the cursor sits in.
-        let cache =
-            schema_with_columns("Events", &[("a", Type::Int), ("b", Type::Int)]);
+        let cache = schema_with_columns("Events", &[("a", Type::Int), ("b", Type::Int)]);
        let input = "delete from Events where a = 'x' or b = 'y'";
        let on_x = input.find("'x'").expect("'x' literal") + 1;
        let on_y = input.find("'y'").expect("'y' literal") + 1;
@@ -2460,8 +2443,16 @@ mod tests {
            inserted_range: (5, 5),
            original_text: String::new(),
            candidates: vec![
-                Candidate { text: "data".to_string(), kind: CandidateKind::Keyword, mode: crate::completion::ModeClass::Both },
-                Candidate { text: "table".to_string(), kind: CandidateKind::Keyword, mode: crate::completion::ModeClass::Both },
+                Candidate {
+                    text: "data".to_string(),
+                    kind: CandidateKind::Keyword,
+                    mode: crate::completion::ModeClass::Both,
+                },
+                Candidate {
+                    text: "table".to_string(),
+                    kind: CandidateKind::Keyword,
+                    mode: crate::completion::ModeClass::Both,
+                },
            ],
            selection_idx: 1,
        };
@@ -2494,8 +2485,16 @@ mod tests {
            // produce — proves the memo's list is being used,
            // not a recomputed one.
            candidates: vec![
-                Candidate { text: "data".to_string(), kind: CandidateKind::Keyword, mode: crate::completion::ModeClass::Both },
-                Candidate { text: "table".to_string(), kind: CandidateKind::Keyword, mode: crate::completion::ModeClass::Both },
+                Candidate {
+                    text: "data".to_string(),
+                    kind: CandidateKind::Keyword,
+                    mode: crate::completion::ModeClass::Both,
+                },
+                Candidate {
+                    text: "table".to_string(),
+                    kind: CandidateKind::Keyword,
+                    mode: crate::completion::ModeClass::Both,
+                },
            ],
            selection_idx: 1,
        };
@@ -2564,10 +2563,7 @@ mod tests {
    fn classify_trailing_whitespace_does_not_create_definite_error() {
        // Trailing whitespace alone shouldn't promote an
        // incomplete-at-EOF state into a definite error.
-        assert_eq!(
-            classify_input("create   "),
-            InputState::IncompleteAtEof,
-        );
+        assert_eq!(classify_input("create   "), InputState::IncompleteAtEof,);
    }

    #[test]
@@ -60,8 +60,8 @@ pub fn init(path: Option<&Path>) -> Result<PathBuf> {
            .with_context(|| format!("create log directory {}", parent.display()))?;
    }
    let file = open_log_file(&chosen)?;
-    let filter = EnvFilter::try_from_env("RDBMS_PLAYGROUND_LOG")
-        .unwrap_or_else(|_| EnvFilter::new("info"));
+    let filter =
+        EnvFilter::try_from_env("RDBMS_PLAYGROUND_LOG").unwrap_or_else(|_| EnvFilter::new("info"));
    let layer = fmt::layer()
        .with_writer(file)
        .with_ansi(false)
@@ -95,8 +95,7 @@ fn home_dir() -> Option<PathBuf> {
    if let Some(p) = std::env::var_os("HOME") {
        return Some(PathBuf::from(p));
    }
-    if let (Some(drive), Some(path)) =
-        (std::env::var_os("HOMEDRIVE"), std::env::var_os("HOMEPATH"))
+    if let (Some(drive), Some(path)) = (std::env::var_os("HOMEDRIVE"), std::env::var_os("HOMEPATH"))
    {
        let mut combined = PathBuf::from(drive);
        combined.push(path);
@@ -1,6 +1,6 @@
 use std::process::ExitCode;

-use rdbms_playground::cli::{help_text, Args};
+use rdbms_playground::cli::{Args, help_text, version_text};
 use rdbms_playground::{logging, runtime};

 fn main() -> ExitCode {
@@ -22,6 +22,11 @@ fn main() -> ExitCode {
        }
    };

+    if args.version {
+        println!("{}", version_text());
+        return ExitCode::SUCCESS;
+    }
+
    if args.help {
        print!("{}", help_text());
        return ExitCode::SUCCESS;
@@ -172,7 +172,10 @@ fn constraint_lines(desc: &TableDescription) -> Vec<String> {
 /// A `detail` matching no marker renders neutral — the engine's
 /// plan vocabulary may grow (ADR-0028 §4).
 const PLAN_TAXONOMY: &[(&str, OutputStyleClass)] = &[
-    ("USING AUTOMATIC COVERING INDEX", OutputStyleClass::AutomaticIndex),
+    (
+        "USING AUTOMATIC COVERING INDEX",
+        OutputStyleClass::AutomaticIndex,
+    ),
    ("USING AUTOMATIC INDEX", OutputStyleClass::AutomaticIndex),
    ("USING COVERING INDEX", OutputStyleClass::Efficient),
    ("USING INTEGER PRIMARY KEY", OutputStyleClass::Efficient),
@@ -225,8 +228,7 @@ fn render_plan_subtree(
    emitted: &mut HashSet<i64>,
    mode: Mode,
 ) {
-    let children: Vec<&ExplainRow> =
-        rows.iter().filter(|r| r.parent == parent).collect();
+    let children: Vec<&ExplainRow> = rows.iter().filter(|r| r.parent == parent).collect();
    let last_idx = children.len().saturating_sub(1);
    for (idx, row) in children.iter().enumerate() {
        if !emitted.insert(row.id) {
@@ -235,8 +237,7 @@ fn render_plan_subtree(
        let is_last = idx == last_idx;
        let connector = if is_last { "└─ " } else { "├─ " };
        out.push(plan_node_line(prefix, connector, &row.detail, mode));
-        let child_prefix =
-            format!("{prefix}{}", if is_last { "   " } else { "│  " });
+        let child_prefix = format!("{prefix}{}", if is_last { "   " } else { "│  " });
        render_plan_subtree(rows, row.id, &child_prefix, out, emitted, mode);
    }
 }
@@ -343,13 +344,8 @@ pub fn render_diagnostic_table(
 const fn alignment_for(ty: Option<Type>) -> Alignment {
    match ty {
        Some(Type::Int | Type::Real | Type::Decimal | Type::Serial) => Alignment::Right,
-        Some(Type::Text)
-        | Some(Type::Bool)
-        | Some(Type::Date)
-        | Some(Type::DateTime)
-        | Some(Type::Blob)
-        | Some(Type::ShortId)
-        | None => Alignment::Left,
+        Some(Type::Text) | Some(Type::Bool) | Some(Type::Date) | Some(Type::DateTime)
+        | Some(Type::Blob) | Some(Type::ShortId) | None => Alignment::Left,
    }
 }

@@ -406,11 +402,7 @@ fn cell_width(s: &str) -> usize {
 /// Render a single bordered table given header cells, body
 /// rows, and per-column alignment. Outer frame +
 /// header-underline only.
-fn render_table(
-    headers: &[String],
-    body: &[Vec<String>],
-    alignments: &[Alignment],
-) -> Vec<String> {
+fn render_table(headers: &[String], body: &[Vec<String>], alignments: &[Alignment]) -> Vec<String> {
    debug_assert_eq!(headers.len(), alignments.len());

    // Compute column widths: max(header, all body cells).
@@ -792,13 +784,12 @@ fn gutter_seg(i: usize, child_rows: &[usize], parent_rows: &[usize], w: usize) -
    }

    // The vertical bus spans the full range of endpoint rows.
-    let bounds = child_rows
-        .iter()
-        .chain(parent_rows)
-        .copied()
-        .fold(None, |acc: Option<(usize, usize)>, r| {
+    let bounds = child_rows.iter().chain(parent_rows).copied().fold(
+        None,
+        |acc: Option<(usize, usize)>, r| {
            Some(acc.map_or((r, r), |(lo, hi)| (lo.min(r), hi.max(r))))
-        });
+        },
+    );
    if let Some((top, bot)) = bounds
        && i >= top
        && i <= bot
@@ -1138,7 +1129,10 @@ mod tests {
        assert!(out.contains("customer_id ●"), "FK marker:\n{out}");
        assert!(out.contains("id (PK) ●"), "parent endpoint marker:\n{out}");
        assert!(out.contains('▶'), "arrowhead:\n{out}");
-        assert!(out.contains('n') && out.contains('1'), "cardinality:\n{out}");
+        assert!(
+            out.contains('n') && out.contains('1'),
+            "cardinality:\n{out}"
+        );
        assert!(
            out.contains("on delete cascade · on update no action"),
            "actions:\n{out}"
@@ -1237,7 +1231,10 @@ mod tests {
        let (r_out, r_in) = blank_rels();
        let region = TableDescription {
            name: "Region".to_string(),
-            columns: vec![col("country", Type::Int, true, false), col("code", Type::Int, true, false)],
+            columns: vec![
+                col("country", Type::Int, true, false),
+                col("code", Type::Int, true, false),
+            ],
            outbound_relationships: r_out,
            inbound_relationships: r_in,
            indexes: Vec::new(),
@@ -1277,7 +1274,10 @@ mod tests {
            .collect::<Vec<_>>()
            .join("\n");
        assert!(text.contains("region_code ●"), "child endpoint 2:\n{text}");
-        assert!(text.contains("(PK) ●"), "parent endpoint is PK + marked:\n{text}");
+        assert!(
+            text.contains("(PK) ●"),
+            "parent endpoint is PK + marked:\n{text}"
+        );
        assert!(
            text.contains("(country, region_code) ▶ Region.(country, code)"),
            "pairing line:\n{text}",
@@ -1412,11 +1412,7 @@ mod tests {
        let data = DataResult {
            table_name: "Customers".to_string(),
            columns: vec!["id".to_string(), "Name".to_string(), "Email".to_string()],
-            column_types: vec![
-                Some(Type::Serial),
-                Some(Type::Text),
-                Some(Type::Text),
-            ],
+            column_types: vec![Some(Type::Serial), Some(Type::Text), Some(Type::Text)],
            rows: vec![
                vec![
                    Some("1".to_string()),
@@ -1634,7 +1630,10 @@ mod tests {
        assert!(out.contains("Indexes:"), "got:\n{out}");
        assert!(out.contains("idx_email (Email)"), "got:\n{out}");
        // A plain index carries no uniqueness marker.
-        assert!(!out.contains("[unique]"), "plain index unmarked; got:\n{out}");
+        assert!(
+            !out.contains("[unique]"),
+            "plain index unmarked; got:\n{out}"
+        );
    }

    #[test]
@@ -1677,7 +1676,10 @@ mod tests {
            indexes: Vec::new(),
            unique_constraints: vec![vec!["a".to_string(), "b".to_string()]],
            check_constraints: vec![
-                crate::persistence::TableCheck { name: None, expr: "a < b".to_string() },
+                crate::persistence::TableCheck {
+                    name: None,
+                    expr: "a < b".to_string(),
+                },
                crate::persistence::TableCheck {
                    name: Some("a_lt_b".to_string()),
                    expr: "a <> b".to_string(),
@@ -1691,7 +1693,10 @@ mod tests {
        // (ADR-0035 Amendment 1) so the user can `drop constraint <name>`.
        assert!(out.contains("unique_a_b: unique (a, b)"), "got:\n{out}");
        assert!(out.contains("check (a < b)"), "unnamed check; got:\n{out}");
-        assert!(out.contains("check a_lt_b (a <> b)"), "named check shows its name; got:\n{out}");
+        assert!(
+            out.contains("check a_lt_b (a <> b)"),
+            "named check shows its name; got:\n{out}"
+        );
    }

    #[test]
@@ -1732,17 +1737,37 @@ mod tests {
        let plan = QueryPlan {
            display_sql: "SELECT 1".to_string(),
            rows: vec![
-                ExplainRow { id: 1, parent: 0, detail: "root".to_string() },
-                ExplainRow { id: 2, parent: 1, detail: "child-a".to_string() },
-                ExplainRow { id: 3, parent: 1, detail: "child-b".to_string() },
+                ExplainRow {
+                    id: 1,
+                    parent: 0,
+                    detail: "root".to_string(),
+                },
+                ExplainRow {
+                    id: 2,
+                    parent: 1,
+                    detail: "child-a".to_string(),
+                },
+                ExplainRow {
+                    id: 3,
+                    parent: 1,
+                    detail: "child-b".to_string(),
+                },
            ],
        };
        let lines = render_explain_plan(&plan, Mode::Simple);
        // display SQL + 3 plan nodes.
        assert_eq!(lines.len(), 4);
        assert!(lines[1].text.contains("root"));
-        assert!(lines[2].text.contains("├─ child-a"), "got {:?}", lines[2].text);
-        assert!(lines[3].text.contains("└─ child-b"), "got {:?}", lines[3].text);
+        assert!(
+            lines[2].text.contains("├─ child-a"),
+            "got {:?}",
+            lines[2].text
+        );
+        assert!(
+            lines[3].text.contains("└─ child-b"),
+            "got {:?}",
+            lines[3].text
+        );
        // The single root uses `└─`; its children are indented
        // by three spaces (no `│` spine, the root being last).
        assert!(lines[1].text.starts_with("└─ root"));
@@ -1775,7 +1800,10 @@ mod tests {
    fn render_explain_plan_colours_a_full_scan_expensive() {
        let plan = one_node_plan("SCAN Customers");
        let lines = render_explain_plan(&plan, Mode::Simple);
-        assert_eq!(span_class_for(&lines[1], "SCAN"), OutputStyleClass::Expensive);
+        assert_eq!(
+            span_class_for(&lines[1], "SCAN"),
+            OutputStyleClass::Expensive
+        );
        // The table name stays neutral (ADR-0028 §6).
        assert_eq!(
            span_class_for(&lines[1], "Customers"),
@@ -1801,8 +1829,7 @@ mod tests {

    #[test]
    fn render_explain_plan_flags_an_automatic_index() {
-        let plan =
-            one_node_plan("SEARCH Orders USING AUTOMATIC COVERING INDEX (CustId=?)");
+        let plan = one_node_plan("SEARCH Orders USING AUTOMATIC COVERING INDEX (CustId=?)");
        let lines = render_explain_plan(&plan, Mode::Simple);
        assert_eq!(
            span_class_for(&lines[1], "USING AUTOMATIC COVERING INDEX"),
@@ -150,7 +150,9 @@ fn encode_cell(ty: Type, value: &CellValue) -> Result<Cell, String> {
            other => Err(format!("expected date/datetime (text), got {other:?}")),
        },
        Type::Blob => match value {
-            CellValue::Blob(bytes) => Ok(Cell::Plain(base64::engine::general_purpose::STANDARD.encode(bytes))),
+            CellValue::Blob(bytes) => Ok(Cell::Plain(
+                base64::engine::general_purpose::STANDARD.encode(bytes),
+            )),
            other => Err(format!("expected blob, got {other:?}")),
        },
        Type::Serial => match value {
@@ -169,7 +171,11 @@ fn format_real(f: f64) -> String {
    if f.is_nan() {
        "nan".to_string()
    } else if f.is_infinite() {
-        if f > 0.0 { "inf".to_string() } else { "-inf".to_string() }
+        if f > 0.0 {
+            "inf".to_string()
+        } else {
+            "-inf".to_string()
+        }
    } else {
        // Default `{}` formatting on f64 emits a shortest
        // round-tripping decimal — exactly what the ADR asks
@@ -318,8 +324,7 @@ fn parse_field(bytes: &[u8]) -> Result<(RawCell, usize), CsvError> {
                _ => i += 1,
            }
        }
-        let content =
-            String::from_utf8(bytes[..i].to_vec()).map_err(|_| CsvError::InvalidUtf8)?;
+        let content = String::from_utf8(bytes[..i].to_vec()).map_err(|_| CsvError::InvalidUtf8)?;
        Ok((
            RawCell {
                content,
@@ -435,7 +440,10 @@ mod tests {
            name: "T".to_string(),
            columns: vec![col("n", Type::Int), col("r", Type::Real)],
            rows: vec![
-                vec![CellValue::Integer(42), CellValue::Real(std::f64::consts::PI)],
+                vec![
+                    CellValue::Integer(42),
+                    CellValue::Real(std::f64::consts::PI),
+                ],
                vec![CellValue::Integer(-7), CellValue::Real(0.0)],
            ],
        })
@@ -452,10 +460,7 @@ mod tests {
        let body = serialize_table(&TableSnapshot {
            name: "T".to_string(),
            columns: vec![col("b", Type::Bool)],
-            rows: vec![
-                vec![CellValue::Integer(1)],
-                vec![CellValue::Integer(0)],
-            ],
+            rows: vec![vec![CellValue::Integer(1)], vec![CellValue::Integer(0)]],
        })
        .unwrap();
        let s = String::from_utf8(body).unwrap();
@@ -555,13 +560,21 @@ mod tests {
        let body = serialize_table(&table).unwrap();
        let parsed = parse_csv(std::str::from_utf8(&body).unwrap()).unwrap();
        let row = &parsed.rows[0];
-        assert!(matches!(decode_cell(Type::Int, &row[0]).unwrap(), CellValue::Integer(42)));
+        assert!(matches!(
+            decode_cell(Type::Int, &row[0]).unwrap(),
+            CellValue::Integer(42)
+        ));
        match decode_cell(Type::Real, &row[1]).unwrap() {
            CellValue::Real(f) => assert!((f - std::f64::consts::PI).abs() < 1e-12),
            other => panic!("got {other:?}"),
        }
-        assert!(matches!(decode_cell(Type::Bool, &row[2]).unwrap(), CellValue::Integer(1)));
-        assert!(matches!(decode_cell(Type::Blob, &row[3]).unwrap(), CellValue::Blob(b) if b == b"hi"));
+        assert!(matches!(
+            decode_cell(Type::Bool, &row[2]).unwrap(),
+            CellValue::Integer(1)
+        ));
+        assert!(
+            matches!(decode_cell(Type::Blob, &row[3]).unwrap(), CellValue::Blob(b) if b == b"hi")
+        );
    }

    #[test]
@@ -572,7 +585,10 @@ mod tests {

    #[test]
    fn decode_cell_reports_friendly_error_for_bad_int() {
-        let cell = RawCell { content: "abc".to_string(), was_quoted: false };
+        let cell = RawCell {
+            content: "abc".to_string(),
+            was_quoted: false,
+        };
        let err = decode_cell(Type::Int, &cell).expect_err("must error");
        assert!(err.contains("integer"));
        assert!(err.contains("abc"));
@@ -108,10 +108,7 @@ pub(super) fn read_recent_sources(
            });
        }
    };
-    let mut sources: Vec<String> = body
-        .lines()
-        .filter_map(parse_record_source)
-        .collect();
+    let mut sources: Vec<String> = body.lines().filter_map(parse_record_source).collect();
    if sources.len() > max_n {
        let skip = sources.len() - max_n;
        sources.drain(0..skip);
@@ -187,12 +184,26 @@ fn looks_like_iso8601(s: &str) -> bool {
        return false;
    }
    let digit = |i: usize| b[i].is_ascii_digit();
-    digit(0) && digit(1) && digit(2) && digit(3) && b[4] == b'-'
-        && digit(5) && digit(6) && b[7] == b'-'
-        && digit(8) && digit(9) && b[10] == b'T'
-        && digit(11) && digit(12) && b[13] == b':'
-        && digit(14) && digit(15) && b[16] == b':'
-        && digit(17) && digit(18) && b[19] == b'Z'
+    digit(0)
+        && digit(1)
+        && digit(2)
+        && digit(3)
+        && b[4] == b'-'
+        && digit(5)
+        && digit(6)
+        && b[7] == b'-'
+        && digit(8)
+        && digit(9)
+        && b[10] == b'T'
+        && digit(11)
+        && digit(12)
+        && b[13] == b':'
+        && digit(14)
+        && digit(15)
+        && b[16] == b':'
+        && digit(17)
+        && digit(18)
+        && b[19] == b'Z'
 }

 fn unescape_command(s: &str) -> String {
@@ -321,10 +332,8 @@ mod tests {

    #[test]
    fn parse_journal_record_ok_extracts_unescaped_source() {
-        let rec = parse_journal_record(
-            "2026-05-24T10:00:00Z|ok|create table T with pk id(int)",
-        )
-        .expect("valid ok journal record");
+        let rec = parse_journal_record("2026-05-24T10:00:00Z|ok|create table T with pk id(int)")
+            .expect("valid ok journal record");
        assert!(rec.status_is_ok);
        assert_eq!(rec.source, "create table T with pk id(int)");
    }
@@ -370,8 +379,8 @@ mod tests {
    fn parse_journal_record_preserves_pipe_in_source() {
        // `|` is not escaped by the writer (it's a valid SQL char);
        // `splitn(3, '|')` keeps everything after the second `|`.
-        let rec = parse_journal_record("2026-05-24T10:00:00Z|ok|select 'a|b' from t")
-            .expect("ok record");
+        let rec =
+            parse_journal_record("2026-05-24T10:00:00Z|ok|select 'a|b' from t").expect("ok record");
        assert_eq!(rec.source, "select 'a|b' from t");
    }

@@ -406,7 +415,10 @@ mod tests {
    #[test]
    fn iso8601_known_seconds() {
        assert_eq!(iso8601_from_unix_secs(0), "1970-01-01T00:00:00Z");
-        assert_eq!(iso8601_from_unix_secs(1_778_112_000), "2026-05-07T00:00:00Z");
+        assert_eq!(
+            iso8601_from_unix_secs(1_778_112_000),
+            "2026-05-07T00:00:00Z"
+        );
    }

    #[test]
@@ -437,7 +449,10 @@ mod tests {
            .collect();
        std::fs::write(&path, body).unwrap();
        let got = read_recent_sources(&path, 3).unwrap();
-        assert_eq!(got, vec!["cmd7".to_string(), "cmd8".to_string(), "cmd9".to_string()]);
+        assert_eq!(
+            got,
+            vec!["cmd7".to_string(), "cmd8".to_string(), "cmd9".to_string()]
+        );
    }

    #[test]
@@ -82,7 +82,10 @@ impl Default for MigratorRegistry {
 #[derive(Debug)]
 pub enum MigrateError {
    VersionParse(String),
-    NewerThanSupported { file: u32, latest: u32 },
+    NewerThanSupported {
+        file: u32,
+        latest: u32,
+    },
    NoMigratorForVersion(u32),
    StepFailed {
        from: u32,
@@ -108,10 +111,9 @@ impl std::fmt::Display for MigrateError {
                file = file,
                latest = latest,
            )),
-            Self::NoMigratorForVersion(v) => f.write_str(&crate::t!(
-                "persistence.migrate.no_migrator",
-                version = v,
-            )),
+            Self::NoMigratorForVersion(v) => {
+                f.write_str(&crate::t!("persistence.migrate.no_migrator", version = v,))
+            }
            Self::StepFailed { from, to, source } => f.write_str(&crate::t!(
                "persistence.migrate.step_failed",
                from = from,
@@ -192,8 +194,11 @@ pub fn migrate_to_latest(

    // Write the .bak before any transformation runs so a
    // mid-migration crash leaves the original recoverable.
-    let bak_path =
-        project_path.join(format!("{}.v{}.bak", crate::project::PROJECT_YAML, file_version));
+    let bak_path = project_path.join(format!(
+        "{}.v{}.bak",
+        crate::project::PROJECT_YAML,
+        file_version
+    ));
    std::fs::write(&bak_path, body).map_err(|source| MigrateError::Io {
        path: bak_path.clone(),
        source,
@@ -214,8 +219,8 @@ pub fn migrate_to_latest(
        // Sanity: the new body must declare the next version.
        // If a migrator forgets to bump, we'd loop endlessly
        // through the chain — catch it here.
-        let advertised = read_version(&next_body)
-            .map_err(|e| MigrateError::BadOutput(e.to_string()))?;
+        let advertised =
+            read_version(&next_body).map_err(|e| MigrateError::BadOutput(e.to_string()))?;
        if advertised != v + 1 {
            return Err(MigrateError::BadOutput(format!(
                "v{v}→v{} migrator left version field at {advertised}",
@@ -281,9 +286,8 @@ fn read_version(body: &str) -> Result<u32, MigrateError> {
    struct VersionOnly {
        version: u32,
    }
-    let v: VersionOnly = serde_norway::from_str(body).map_err(|e| {
-        MigrateError::VersionParse(e.to_string())
-    })?;
+    let v: VersionOnly =
+        serde_norway::from_str(body).map_err(|e| MigrateError::VersionParse(e.to_string()))?;
    Ok(v.version)
 }

@@ -309,12 +313,8 @@ mod tests {
    #[test]
    fn no_migration_runs_when_body_already_latest() {
        let tmp = tempdir();
-        let outcome = migrate_to_latest(
-            &v1_body(),
-            &MigratorRegistry::production(),
-            tmp.path(),
-        )
-        .unwrap();
+        let outcome =
+            migrate_to_latest(&v1_body(), &MigratorRegistry::production(), tmp.path()).unwrap();
        assert_eq!(outcome.body, v1_body());
        assert_eq!(outcome.migrated_from, None);
        // No .bak written when nothing migrated.
@@ -328,7 +328,13 @@ mod tests {
        let err = migrate_to_latest(body, &MigratorRegistry::production(), Path::new("/tmp"))
            .expect_err("must reject");
        assert!(
-            matches!(err, MigrateError::NewerThanSupported { file: 99, latest: 1 }),
+            matches!(
+                err,
+                MigrateError::NewerThanSupported {
+                    file: 99,
+                    latest: 1
+                }
+            ),
            "got: {err:?}",
        );
    }
@@ -366,12 +372,7 @@ mod tests {
    #[test]
    fn migrate_runs_chain_and_writes_bak() {
        let tmp = tempdir();
-        let outcome = migrate_to_latest(
-            &v1_body(),
-            &registry_with_v1_to_v2(),
-            tmp.path(),
-        )
-        .unwrap();
+        let outcome = migrate_to_latest(&v1_body(), &registry_with_v1_to_v2(), tmp.path()).unwrap();
        assert_eq!(outcome.migrated_from, Some(1));
        assert!(outcome.body.contains("version: 2"));
        let bak = tmp.path().join("project.yaml.v1.bak");
@@ -396,11 +397,8 @@ mod tests {
        let tmp = tempdir();
        let yaml_path = tmp.path().join("project.yaml");
        std::fs::write(&yaml_path, v1_body()).unwrap();
-        let outcome = ensure_project_yaml_migrated(
-            tmp.path(),
-            &MigratorRegistry::production(),
-        )
-        .unwrap();
+        let outcome =
+            ensure_project_yaml_migrated(tmp.path(), &MigratorRegistry::production()).unwrap();
        assert_eq!(outcome.migrated_from, None);
        // File unchanged.
        let on_disk = std::fs::read_to_string(&yaml_path).unwrap();
@@ -413,36 +411,32 @@ mod tests {
        let tmp = tempdir();
        let yaml_path = tmp.path().join("project.yaml");
        std::fs::write(&yaml_path, v1_body()).unwrap();
-        let outcome = ensure_project_yaml_migrated(
-            tmp.path(),
-            &registry_with_v1_to_v2(),
-        )
-        .unwrap();
+        let outcome = ensure_project_yaml_migrated(tmp.path(), &registry_with_v1_to_v2()).unwrap();
        assert_eq!(outcome.migrated_from, Some(1));
        let on_disk = std::fs::read_to_string(&yaml_path).unwrap();
        assert!(on_disk.contains("version: 2"), "got: {on_disk}");
        let bak = tmp.path().join("project.yaml.v1.bak");
        assert!(bak.exists());
-        assert!(std::fs::read_to_string(&bak).unwrap().contains("version: 1"));
+        assert!(
+            std::fs::read_to_string(&bak)
+                .unwrap()
+                .contains("version: 1")
+        );
    }

    #[test]
    fn ensure_yaml_migrated_handles_missing_yaml() {
        let tmp = tempdir();
        // No project.yaml exists.
-        let outcome = ensure_project_yaml_migrated(
-            tmp.path(),
-            &MigratorRegistry::production(),
-        )
-        .unwrap();
+        let outcome =
+            ensure_project_yaml_migrated(tmp.path(), &MigratorRegistry::production()).unwrap();
        assert_eq!(outcome.migrated_from, None);
        assert!(outcome.body.is_empty());
    }

    #[test]
    fn migrator_that_returns_internal_error_propagates() {
-        let bad: MigrateFn =
-            |_| Err(MigrateError::VersionParse("simulated".to_string()));
+        let bad: MigrateFn = |_| Err(MigrateError::VersionParse("simulated".to_string()));
        let registry = MigratorRegistry {
            migrators: vec![bad],
        };
@@ -368,12 +368,11 @@ impl Persistence {
            path: data_dir.clone(),
            source,
        })?;
-        let body =
-            csv_io::serialize_table(table).map_err(|message| PersistenceError::Encode {
-                kind: "CSV",
-                path: data_dir.join(format!("{}.csv", table.name)),
-                message,
-            })?;
+        let body = csv_io::serialize_table(table).map_err(|message| PersistenceError::Encode {
+            kind: "CSV",
+            path: data_dir.join(format!("{}.csv", table.name)),
+            message,
+        })?;
        atomic_write(&data_dir.join(format!("{}.csv", table.name)), &body)
    }

@@ -406,11 +405,8 @@ impl Persistence {
    ) -> Result<(), PersistenceError> {
        let path = self.project_path.join(HISTORY_LOG);
        let status = history::status_token(history::STATUS_OK, advanced);
-        let line = history::format_record_with_status(
-            command_text,
-            history::utc_iso8601_now(),
-            &status,
-        );
+        let line =
+            history::format_record_with_status(command_text, history::utc_iso8601_now(), &status);
        debug!(
            len = command_text.len(),
            advanced, "persist: append ok record to history.log"
@@ -432,11 +428,8 @@ impl Persistence {
    ) -> Result<(), PersistenceError> {
        let path = self.project_path.join(HISTORY_LOG);
        let status = history::status_token(history::STATUS_ERR, advanced);
-        let line = history::format_record_with_status(
-            command_text,
-            history::utc_iso8601_now(),
-            &status,
-        );
+        let line =
+            history::format_record_with_status(command_text, history::utc_iso8601_now(), &status);
        debug!(
            len = command_text.len(),
            advanced, "persist: append err record to history.log"
@@ -531,8 +524,14 @@ mod tests {

    #[test]
    fn extension_with_tmp_appends_to_existing_extension() {
-        assert_eq!(extension_with_tmp(Path::new("a/b/project.yaml")), "yaml.tmp");
-        assert_eq!(extension_with_tmp(Path::new("a/b/Customers.csv")), "csv.tmp");
+        assert_eq!(
+            extension_with_tmp(Path::new("a/b/project.yaml")),
+            "yaml.tmp"
+        );
+        assert_eq!(
+            extension_with_tmp(Path::new("a/b/Customers.csv")),
+            "csv.tmp"
+        );
        assert_eq!(extension_with_tmp(Path::new("a/b/lockfile")), "tmp");
    }

@@ -600,7 +599,8 @@ mod tests {
    fn append_history_creates_and_appends() {
        let dir = tempdir();
        let p = Persistence::new(dir.path().to_path_buf());
-        p.append_history("create table Foo with pk id(serial)", false).unwrap();
+        p.append_history("create table Foo with pk id(serial)", false)
+            .unwrap();
        p.append_history("insert into Foo (1)", false).unwrap();
        let body = fs::read_to_string(dir.path().join(HISTORY_LOG)).unwrap();
        let lines: Vec<&str> = body.trim_end().lines().collect();
@@ -261,7 +261,10 @@ fn needs_quoting(s: &str) -> bool {
    }
    // Scalar text that looks like a YAML keyword needs quoting
    // even if every character is safe.
-    if matches!(s, "true" | "false" | "null" | "~" | "yes" | "no" | "on" | "off") {
+    if matches!(
+        s,
+        "true" | "false" | "null" | "~" | "yes" | "no" | "on" | "off"
+    ) {
        return true;
    }
    s.chars().any(|c| !is_safe_yaml_char(c))
@@ -287,13 +290,14 @@ pub(crate) fn parse_schema(body: &str) -> Result<SchemaSnapshot, YamlError> {
    for t in raw.tables {
        let mut columns: Vec<ColumnSchema> = Vec::with_capacity(t.columns.len());
        for c in t.columns {
-            let user_type = c.user_type.parse::<Type>().map_err(|_| {
-                YamlError::UnknownType {
+            let user_type = c
+                .user_type
+                .parse::<Type>()
+                .map_err(|_| YamlError::UnknownType {
                    table: t.name.clone(),
                    column: c.name.clone(),
                    raw: c.user_type.clone(),
-                }
-            })?;
+                })?;
            columns.push(ColumnSchema {
                name: c.name,
                user_type,
@@ -308,7 +312,11 @@ pub(crate) fn parse_schema(body: &str) -> Result<SchemaSnapshot, YamlError> {
            primary_key: t.primary_key,
            columns,
            unique_constraints: t.unique_constraints,
-            check_constraints: t.check_constraints.into_iter().map(TableCheck::from).collect(),
+            check_constraints: t
+                .check_constraints
+                .into_iter()
+                .map(TableCheck::from)
+                .collect(),
        });
    }
    let mut relationships: Vec<RelationshipSchema> = Vec::with_capacity(raw.relationships.len());
@@ -381,10 +389,7 @@ pub(crate) enum YamlError {
 impl std::fmt::Display for YamlError {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        match self {
-            Self::Syntax(msg) => f.write_str(&crate::t!(
-                "persistence.yaml.syntax",
-                detail = msg,
-            )),
+            Self::Syntax(msg) => f.write_str(&crate::t!("persistence.yaml.syntax", detail = msg,)),
            Self::UnsupportedVersion(v) => f.write_str(&crate::t!(
                "persistence.yaml.unsupported_version",
                version = v,
@@ -395,10 +400,9 @@ impl std::fmt::Display for YamlError {
                column = column,
                raw = raw,
            )),
-            Self::UnknownAction(raw) => f.write_str(&crate::t!(
-                "persistence.yaml.unknown_action",
-                raw = raw,
-            )),
+            Self::UnknownAction(raw) => {
+                f.write_str(&crate::t!("persistence.yaml.unknown_action", raw = raw,))
+            }
        }
    }
 }
@@ -545,8 +549,22 @@ mod tests {
                    name: "Customers".to_string(),
                    primary_key: vec!["id".to_string()],
                    columns: vec![
-                        ColumnSchema { name: "id".to_string(), user_type: Type::Serial, unique: false, not_null: false, default: None, check: None },
-                        ColumnSchema { name: "Name".to_string(), user_type: Type::Text, unique: false, not_null: false, default: None, check: None },
+                        ColumnSchema {
+                            name: "id".to_string(),
+                            user_type: Type::Serial,
+                            unique: false,
+                            not_null: false,
+                            default: None,
+                            check: None,
+                        },
+                        ColumnSchema {
+                            name: "Name".to_string(),
+                            user_type: Type::Text,
+                            unique: false,
+                            not_null: false,
+                            default: None,
+                            check: None,
+                        },
                    ],
                    unique_constraints: Vec::new(),
                    check_constraints: Vec::new(),
@@ -555,8 +573,22 @@ mod tests {
                    name: "Orders".to_string(),
                    primary_key: vec!["id".to_string()],
                    columns: vec![
-                        ColumnSchema { name: "id".to_string(), user_type: Type::Serial, unique: false, not_null: false, default: None, check: None },
-                        ColumnSchema { name: "CustId".to_string(), user_type: Type::Int, unique: false, not_null: false, default: None, check: None },
+                        ColumnSchema {
+                            name: "id".to_string(),
+                            user_type: Type::Serial,
+                            unique: false,
+                            not_null: false,
+                            default: None,
+                            check: None,
+                        },
+                        ColumnSchema {
+                            name: "CustId".to_string(),
+                            user_type: Type::Int,
+                            unique: false,
+                            not_null: false,
+                            default: None,
+                            check: None,
+                        },
                    ],
                    unique_constraints: Vec::new(),
                    check_constraints: Vec::new(),
@@ -798,15 +830,33 @@ indexes:
                name: "T".to_string(),
                primary_key: vec![],
                columns: vec![
-                    ColumnSchema { name: "a".to_string(), user_type: Type::Int, unique: false, not_null: false, default: None, check: None },
-                    ColumnSchema { name: "b".to_string(), user_type: Type::Int, unique: false, not_null: false, default: None, check: None },
-                    ColumnSchema { name: "c".to_string(), user_type: Type::Int, unique: false, not_null: false, default: None, check: None },
+                    ColumnSchema {
+                        name: "a".to_string(),
+                        user_type: Type::Int,
+                        unique: false,
+                        not_null: false,
+                        default: None,
+                        check: None,
+                    },
+                    ColumnSchema {
+                        name: "b".to_string(),
+                        user_type: Type::Int,
+                        unique: false,
+                        not_null: false,
+                        default: None,
+                        check: None,
+                    },
+                    ColumnSchema {
+                        name: "c".to_string(),
+                        user_type: Type::Int,
+                        unique: false,
+                        not_null: false,
+                        default: None,
+                        check: None,
+                    },
                ],
                unique_constraints: vec![vec!["a".to_string(), "b".to_string()]],
-                check_constraints: vec![
-                    TableCheck::unnamed("a < b"),
-                    TableCheck::unnamed("b < c"),
-                ],
+                check_constraints: vec![TableCheck::unnamed("a < b"), TableCheck::unnamed("b < c")],
            }],
            relationships: vec![],
            indexes: vec![],
@@ -830,12 +880,29 @@ indexes:
                name: "T".to_string(),
                primary_key: vec!["id".to_string()],
                columns: vec![
-                    ColumnSchema { name: "id".to_string(), user_type: Type::Int, unique: false, not_null: false, default: None, check: None },
-                    ColumnSchema { name: "qty".to_string(), user_type: Type::Int, unique: false, not_null: false, default: None, check: None },
+                    ColumnSchema {
+                        name: "id".to_string(),
+                        user_type: Type::Int,
+                        unique: false,
+                        not_null: false,
+                        default: None,
+                        check: None,
+                    },
+                    ColumnSchema {
+                        name: "qty".to_string(),
+                        user_type: Type::Int,
+                        unique: false,
+                        not_null: false,
+                        default: None,
+                        check: None,
+                    },
                ],
                unique_constraints: vec![],
                check_constraints: vec![
-                    TableCheck { name: Some("qty_positive".to_string()), expr: "qty >= 0".to_string() },
+                    TableCheck {
+                        name: Some("qty_positive".to_string()),
+                        expr: "qty >= 0".to_string(),
+                    },
                    TableCheck::unnamed("qty < 1000"),
                ],
            }],
@@ -844,7 +911,10 @@ indexes:
        };
        let body = serialize_schema(&snap);
        let parsed = parse_schema(&body).expect("parse schema");
-        assert_eq!(parsed, snap, "named + unnamed table-CHECKs survive the yaml round-trip");
+        assert_eq!(
+            parsed, snap,
+            "named + unnamed table-CHECKs survive the yaml round-trip"
+        );
    }

    #[test]
@@ -968,8 +1038,22 @@ relationships:
                name: "Items".to_string(),
                primary_key: vec!["a".to_string(), "b".to_string()],
                columns: vec![
-                    ColumnSchema { name: "a".to_string(), user_type: Type::Int, unique: false, not_null: false, default: None, check: None },
-                    ColumnSchema { name: "b".to_string(), user_type: Type::Int, unique: false, not_null: false, default: None, check: None },
+                    ColumnSchema {
+                        name: "a".to_string(),
+                        user_type: Type::Int,
+                        unique: false,
+                        not_null: false,
+                        default: None,
+                        check: None,
+                    },
+                    ColumnSchema {
+                        name: "b".to_string(),
+                        user_type: Type::Int,
+                        unique: false,
+                        not_null: false,
+                        default: None,
+                        check: None,
+                    },
                ],
                unique_constraints: Vec::new(),
                check_constraints: Vec::new(),
@@ -1019,12 +1103,10 @@ relationships:
        let absent = "version: 1\nproject:\n  created_at: x\ntables: []\n";
        assert_eq!(parse_stored_mode(absent), None);

-        let explicit_simple =
-            "version: 1\nproject:\n  created_at: x\n  mode: simple\ntables: []\n";
+        let explicit_simple = "version: 1\nproject:\n  created_at: x\n  mode: simple\ntables: []\n";
        assert_eq!(parse_stored_mode(explicit_simple), Some(Mode::Simple));

-        let advanced =
-            "version: 1\nproject:\n  created_at: x\n  mode: advanced\ntables: []\n";
+        let advanced = "version: 1\nproject:\n  created_at: x\n  mode: advanced\ntables: []\n";
        assert_eq!(parse_stored_mode(advanced), Some(Mode::Advanced));
    }

@@ -170,7 +170,10 @@ fn local_hostname() -> String {
 /// Uses `sysinfo` to query the OS process table.
 fn pid_is_alive(pid: u32) -> bool {
    let mut sys = System::new();
-    sys.refresh_processes(sysinfo::ProcessesToUpdate::Some(&[Pid::from_u32(pid)]), true);
+    sys.refresh_processes(
+        sysinfo::ProcessesToUpdate::Some(&[Pid::from_u32(pid)]),
+        true,
+    );
    sys.process(Pid::from_u32(pid)).is_some()
 }

@@ -211,7 +214,10 @@ mod tests {
        // The first lock writes our own PID; a second attempt
        // should refuse because the PID is alive on this host.
        let err = Lock::acquire(dir.path()).expect_err("should refuse second acquisition");
-        assert!(matches!(err, LockError::AlreadyHeld { .. }), "unexpected: {err:?}");
+        assert!(
+            matches!(err, LockError::AlreadyHeld { .. }),
+            "unexpected: {err:?}"
+        );
    }

    #[test]
@@ -78,10 +78,7 @@ pub fn read_last_project(data_root: &Path) -> std::io::Result<Option<PathBuf>> {
 /// a moved/deleted directory is the kind of error `--resume`
 /// is supposed to surface clearly, not paper over by
 /// resolving symlinks at write time.
-pub fn write_last_project(
-    data_root: &Path,
-    project_path: &Path,
-) -> std::io::Result<()> {
+pub fn write_last_project(data_root: &Path, project_path: &Path) -> std::io::Result<()> {
    fs::create_dir_all(data_root)?;
    let final_path = data_root.join(LAST_PROJECT_FILE);
    let tmp_path = data_root.join(format!("{LAST_PROJECT_FILE}.tmp"));
@@ -108,9 +105,8 @@ pub fn resolve_data_root(override_dir: Option<&Path>) -> Result<PathBuf, Project
    if let Some(p) = override_dir {
        return Ok(p.to_path_buf());
    }
-    let dirs = ProjectDirs::from("", "", "rdbms-playground").ok_or(
-        ProjectError::DataRootUnavailable,
-    )?;
+    let dirs =
+        ProjectDirs::from("", "", "rdbms-playground").ok_or(ProjectError::DataRootUnavailable)?;
    Ok(dirs.data_dir().to_path_buf())
 }

@@ -255,21 +251,16 @@ pub enum ProjectError {
 impl std::fmt::Display for ProjectError {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        match self {
-            Self::DataRootUnavailable => {
-                f.write_str(&crate::t!("project.data_root_unavailable"))
+            Self::DataRootUnavailable => f.write_str(&crate::t!("project.data_root_unavailable")),
+            Self::PathNotFound(p) => {
+                f.write_str(&crate::t!("project.path_not_found", path = p.display(),))
+            }
+            Self::NotAProject(p) => {
+                f.write_str(&crate::t!("project.not_a_project", path = p.display(),))
+            }
+            Self::AlreadyExists(p) => {
+                f.write_str(&crate::t!("project.already_exists", path = p.display(),))
            }
-            Self::PathNotFound(p) => f.write_str(&crate::t!(
-                "project.path_not_found",
-                path = p.display(),
-            )),
-            Self::NotAProject(p) => f.write_str(&crate::t!(
-                "project.not_a_project",
-                path = p.display(),
-            )),
-            Self::AlreadyExists(p) => f.write_str(&crate::t!(
-                "project.already_exists",
-                path = p.display(),
-            )),
            Self::Io { path, source } => f.write_str(&crate::t!(
                "project.io",
                path = path.display(),
@@ -609,11 +600,10 @@ pub fn safely_delete_temp_project(
    // 2. Canonicalize for the containment check. We do this
    //    only after the symlink-at-top check so we can't be
    //    tricked by a top-level symlink.
-    let project_canon =
-        fs::canonicalize(project_path).map_err(|source| SafeDeleteError::Io {
-            path: project_path.to_path_buf(),
-            source,
-        })?;
+    let project_canon = fs::canonicalize(project_path).map_err(|source| SafeDeleteError::Io {
+        path: project_path.to_path_buf(),
+        source,
+    })?;

    // 3. Containment: canonical path must be inside the
    //    canonical data-root projects dir.
@@ -848,7 +838,10 @@ mod tests {
        assert!(gi.contains("/playground.db"));
        assert!(gi.contains("/.rdbms-playground.lock"));
        assert!(gi.contains("/.snapshots/"), "undo ring should be ignored");
-        assert!(!gi.contains("history.log"), "history.log should NOT be ignored");
+        assert!(
+            !gi.contains("history.log"),
+            "history.log should NOT be ignored"
+        );
    }

    #[test]
@@ -890,7 +883,10 @@ mod tests {
        let target = tmp.path().join("MyProject");
        fs::create_dir(&target).unwrap();
        let err = Project::create_named(&target).expect_err("must refuse");
-        assert!(matches!(err, ProjectError::AlreadyExists(_)), "got: {err:?}");
+        assert!(
+            matches!(err, ProjectError::AlreadyExists(_)),
+            "got: {err:?}"
+        );
    }

    #[test]
@@ -962,7 +958,10 @@ mod tests {
        )
        .unwrap();
        let read_back = read_last_project(tmp.path()).unwrap();
-        assert_eq!(read_back, Some(std::path::PathBuf::from("/tmp/some/project")));
+        assert_eq!(
+            read_back,
+            Some(std::path::PathBuf::from("/tmp/some/project"))
+        );
    }

    #[test]
@@ -17,8 +17,8 @@

 use std::path::Path;

-use rand::seq::IndexedRandom;
 use rand::Rng;
+use rand::seq::IndexedRandom;

 const WORDLIST: &str = include_str!("wordlist.txt");
 const MAX_COLLISION_RETRIES: usize = 100;
@@ -41,10 +41,9 @@ pub enum NamingError {
 impl std::fmt::Display for NamingError {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        match self {
-            Self::WordlistTooSmall(n) => f.write_str(&crate::t!(
-                "project.naming.wordlist_too_small",
-                count = n,
-            )),
+            Self::WordlistTooSmall(n) => {
+                f.write_str(&crate::t!("project.naming.wordlist_too_small", count = n,))
+            }
            Self::TooManyCollisions(n) => f.write_str(&crate::t!(
                "project.naming.too_many_collisions",
                attempts = n,
@@ -189,10 +188,9 @@ impl std::fmt::Display for UserNameError {
        match self {
            Self::Empty => f.write_str(&crate::t!("project.user_name.empty")),
            Self::LeadingDot => f.write_str(&crate::t!("project.user_name.leading_dot")),
-            Self::InvalidChar(c) => f.write_str(&crate::t!(
-                "project.user_name.invalid_char",
-                ch = c,
-            )),
+            Self::InvalidChar(c) => {
+                f.write_str(&crate::t!("project.user_name.invalid_char", ch = c,))
+            }
        }
    }
 }
@@ -209,14 +207,22 @@ mod tests {
    #[test]
    fn wordlist_has_enough_entries() {
        let pool = words();
-        assert!(pool.len() >= 100, "wordlist suspiciously small: {} entries", pool.len());
+        assert!(
+            pool.len() >= 100,
+            "wordlist suspiciously small: {} entries",
+            pool.len()
+        );
    }

    #[test]
    fn wordlist_has_no_duplicates() {
        let pool = words();
        let unique: std::collections::HashSet<_> = pool.iter().collect();
-        assert_eq!(unique.len(), pool.len(), "wordlist contains duplicate entries");
+        assert_eq!(
+            unique.len(),
+            pool.len(),
+            "wordlist contains duplicate entries"
+        );
    }

    #[test]
@@ -290,7 +296,7 @@ mod tests {
        assert!(!is_temp_dirname("MyOrders"));
        assert!(!is_temp_dirname("term_planner"));
        assert!(!is_temp_dirname("20260507-water-buffalo-skating")); // no marker
-        assert!(!is_temp_dirname("temp-project"));                   // no brackets
+        assert!(!is_temp_dirname("temp-project")); // no brackets
    }

    #[test]
@@ -301,9 +307,18 @@ mod tests {
        assert!(validate_user_name("project.v2").is_ok());

        assert_eq!(validate_user_name(""), Err(UserNameError::Empty));
-        assert_eq!(validate_user_name(".hidden"), Err(UserNameError::LeadingDot));
-        assert!(matches!(validate_user_name("a/b"), Err(UserNameError::InvalidChar('/'))));
-        assert!(matches!(validate_user_name("a b"), Err(UserNameError::InvalidChar(' '))));
+        assert_eq!(
+            validate_user_name(".hidden"),
+            Err(UserNameError::LeadingDot)
+        );
+        assert!(matches!(
+            validate_user_name("a/b"),
+            Err(UserNameError::InvalidChar('/'))
+        ));
+        assert!(matches!(
+            validate_user_name("a b"),
+            Err(UserNameError::InvalidChar(' '))
+        ));
    }

    fn tempdir() -> tempfile::TempDir {
@@ -129,7 +129,10 @@ mod tests {

    #[test]
    fn strips_date_prefix_from_temp_project_names() {
-        assert_eq!(prettify("20260507-water-buffalo-skating"), "Water Buffalo Skating");
+        assert_eq!(
+            prettify("20260507-water-buffalo-skating"),
+            "Water Buffalo Skating"
+        );
    }

    #[test]
@@ -205,6 +208,9 @@ mod tests {

    #[test]
    fn handles_mixed_separators_and_case() {
-        assert_eq!(prettify("MyTeam_lessonPlan-2026"), "My Team Lesson Plan 2026");
+        assert_eq!(
+            prettify("MyTeam_lessonPlan-2026"),
+            "My Team Lesson Plan 2026"
+        );
    }
 }
@@ -36,8 +36,8 @@ use crate::db::{
 use crate::dsl::command::{
    Constraint, ConstraintKind, IndexSelector, RelationshipSelector, TableConstraint,
 };
-use crate::dsl::{AlterTableAction, ChangeColumnMode, Command, ColumnSpec};
 use crate::dsl::walker::Severity;
+use crate::dsl::{AlterTableAction, ChangeColumnMode, ColumnSpec, Command};
 use crate::event::AppEvent;
 use crate::project::{
    Project, ProjectKind, copy_project, list_projects, open_or_create, projects_dir,
@@ -130,8 +130,7 @@ pub async fn run(args: Args) -> Result<()> {
    // to it for `new` (creates a temp) and `load` (lists
    // projects). We can't easily recover this from the
    // Project alone, so we keep it ourselves.
-    let data_root = resolve_data_root(args.data_dir.as_deref())
-        .context("resolve data root")?;
+    let data_root = resolve_data_root(args.data_dir.as_deref()).context("resolve data root")?;

    // Resolve the initial project path: --resume reads it from
    // <data-root>/last_project; otherwise an explicit positional
@@ -143,17 +142,12 @@ pub async fn run(args: Args) -> Result<()> {
    // terminal so the message lands directly in the user's
    // shell.
    let initial_path: Option<PathBuf> = if args.resume {
-        match read_last_project(&data_root)
-            .context("read last_project")?
-        {
+        match read_last_project(&data_root).context("read last_project")? {
            Some(p) if p.exists() => Some(p),
            Some(p) => {
                eprintln!(
                    "rdbms-playground: {}",
-                    crate::t!(
-                        "project.resume_recorded_missing",
-                        path = p.display(),
-                    ),
+                    crate::t!("project.resume_recorded_missing", path = p.display(),),
                );
                return Ok(());
            }
@@ -488,19 +482,15 @@ async fn run_loop(
                    // Best-effort — a failure to record a failure must
                    // never escalate a user error into a fatal, so the
                    // result is logged and ignored.
-                    if let Err(e) = crate::persistence::Persistence::new(
-                        session.project().path().to_path_buf(),
-                    )
-                    .append_history_failure(&source, advanced)
+                    if let Err(e) =
+                        crate::persistence::Persistence::new(session.project().path().to_path_buf())
+                            .append_history_failure(&source, advanced)
                    {
                        tracing::warn!(error = %e, "failed to journal err record (ignored)");
                    }
                }
                Action::PrepareRebuild => {
-                    spawn_prepare_rebuild(
-                        session.project().path().to_path_buf(),
-                        event_tx.clone(),
-                    );
+                    spawn_prepare_rebuild(session.project().path().to_path_buf(), event_tx.clone());
                }
                Action::Rebuild { source } => {
                    spawn_rebuild(
@@ -671,8 +661,8 @@ async fn run_loop(
    // mutually exclusive (one needs an unmodified temp, the
    // other anything else).
    let project_at_quit = session.project.as_ref();
-    let cleanup_on_quit: Option<std::path::PathBuf> = project_at_quit
-        .and_then(|p| p.is_unmodified_temp().then(|| p.path().to_path_buf()));
+    let cleanup_on_quit: Option<std::path::PathBuf> =
+        project_at_quit.and_then(|p| p.is_unmodified_temp().then(|| p.path().to_path_buf()));
    let resume_target_on_quit: Option<std::path::PathBuf> = project_at_quit
        .filter(|p| !p.is_unmodified_temp())
        .map(|p| p.path().to_path_buf());
@@ -831,7 +821,10 @@ async fn perform_switch(
            Some(p)
        }
        SwitchRequest::NewTemp => None,
-        SwitchRequest::Import { zip_path, as_target } => {
+        SwitchRequest::Import {
+            zip_path,
+            as_target,
+        } => {
            if !zip_path.exists() {
                return Err(crate::t!(
                    "project.import_zip_missing",
@@ -840,8 +833,7 @@ async fn perform_switch(
            }
            // Validate the zip up front so we don't drop the
            // current project for an unimportable file.
-            let inspection = crate::archive::inspect_zip(zip_path)
-                .map_err(|e| e.to_string())?;
+            let inspection = crate::archive::inspect_zip(zip_path).map_err(|e| e.to_string())?;
            let resolved = resolve_import_destination(
                as_target.as_deref(),
                &inspection.top_folder,
@@ -856,16 +848,19 @@ async fn perform_switch(
    // state matches the in-memory db).
    if let SwitchRequest::SaveAs { .. } = &req {
        let src = session.project().path().to_path_buf();
-        let dst = resolved_target.as_ref().expect("SaveAs has resolved target");
+        let dst = resolved_target
+            .as_ref()
+            .expect("SaveAs has resolved target");
        copy_project(&src, dst).map_err(|e| e.to_string())?;
    }
    // For Import: extract the zip into the resolved target.
    // We do this *before* dropping the current project so
    // a failure here leaves the user where they were.
    if let SwitchRequest::Import { zip_path, .. } = &req {
-        let dst = resolved_target.as_ref().expect("Import has resolved target");
-        let inspection = crate::archive::inspect_zip(zip_path)
-            .map_err(|e| e.to_string())?;
+        let dst = resolved_target
+            .as_ref()
+            .expect("Import has resolved target");
+        let inspection = crate::archive::inspect_zip(zip_path).map_err(|e| e.to_string())?;
        crate::archive::extract_into(zip_path, dst, &inspection.top_folder)
            .map_err(|e| e.to_string())?;
    }
@@ -874,10 +869,10 @@ async fn perform_switch(
    // we drop it: if it was an unmodified empty temp, we
    // delete its directory after the switch so the data dir
    // doesn't accumulate empty scratch projects.
-    let outgoing_cleanup_path: Option<std::path::PathBuf> =
-        session.project.as_ref().and_then(|p| {
-            p.is_unmodified_temp().then(|| p.path().to_path_buf())
-        });
+    let outgoing_cleanup_path: Option<std::path::PathBuf> = session
+        .project
+        .as_ref()
+        .and_then(|p| p.is_unmodified_temp().then(|| p.path().to_path_buf()));

    // Drop current project + database BEFORE opening the new
    // ones, releasing the old lock and stopping the old
@@ -954,9 +949,7 @@ async fn perform_switch(
    let new_database =
        Database::open_with_persistence_and_undo(&db_path, persistence, undo_enabled)
            .map_err(|e| e.to_string())?;
-    if !db_existed
-        && let Err(e) = new_database.rebuild_from_text(new_path.clone(), None).await
-    {
+    if !db_existed && let Err(e) = new_database.rebuild_from_text(new_path.clone(), None).await {
        return Err(e.friendly_message());
    }

@@ -982,9 +975,7 @@ async fn perform_switch(
    // fresh empty temp (a `new` command), which must not be
    // recorded (see the gate in `run()`). Write failures are
    // non-fatal.
-    if new_worth_recording
-        && let Err(e) = write_last_project(&session.data_root, &new_path)
-    {
+    if new_worth_recording && let Err(e) = write_last_project(&session.data_root, &new_path) {
        tracing::warn!(error = %e, "could not update last_project after switch");
    }

@@ -1045,8 +1036,8 @@ fn spawn_export(
    event_tx: mpsc::Sender<AppEvent>,
 ) {
    // `export` app command: journalled simple (ADR-0052).
-    let _ = crate::persistence::Persistence::new(project_path.clone())
-        .append_history(&source, false);
+    let _ =
+        crate::persistence::Persistence::new(project_path.clone()).append_history(&source, false);
    tokio::spawn(async move {
        let outcome = tokio::task::spawn_blocking(move || {
            do_export(&project_path, &project_name, &data_root, target.as_deref())
@@ -1081,9 +1072,8 @@ fn do_export(
        }
        None => {
            std::fs::create_dir_all(data_root).map_err(|e| e.to_string())?;
-            let (filename, _) =
-                crate::archive::next_export_sequence(data_root, project_name)
-                    .map_err(|e| e.to_string())?;
+            let (filename, _) = crate::archive::next_export_sequence(data_root, project_name)
+                .map_err(|e| e.to_string())?;
            data_root.join(filename)
        }
    };
@@ -1143,10 +1133,7 @@ async fn seed_initial_tables(database: &Database, event_tx: &mpsc::Sender<AppEve
 /// no completion. Called wherever `TablesRefreshed` is sent
 /// today; the schema cache lives on the App and feeds Tab
 /// completion for identifier slots.
-async fn refresh_schema_cache(
-    database: &Database,
-    event_tx: &mpsc::Sender<AppEvent>,
-) {
+async fn refresh_schema_cache(database: &Database, event_tx: &mpsc::Sender<AppEvent>) {
    let cache = build_schema_cache(database).await;
    let _ = event_tx.send(AppEvent::SchemaCacheRefreshed(cache)).await;
    // ADR-0046 DB2: full relationship records for the sidebar panel.
@@ -1234,10 +1221,7 @@ async fn build_schema_cache(database: &Database) -> crate::completion::SchemaCac
 /// summary that the confirmation modal shows. Runs off the
 /// event loop so the brief I/O doesn't stall input handling
 /// even on slow filesystems.
-fn spawn_prepare_rebuild(
-    project_path: std::path::PathBuf,
-    event_tx: mpsc::Sender<AppEvent>,
-) {
+fn spawn_prepare_rebuild(project_path: std::path::PathBuf, event_tx: mpsc::Sender<AppEvent>) {
    tokio::spawn(async move {
        let summary = match summarize_project(&project_path) {
            Ok(s) => s,
@@ -1317,9 +1301,7 @@ fn spawn_rebuild(
                }
                let summary = summarize_project(&project_path)
                    .unwrap_or_else(|_| "rebuild complete".to_string());
-                let _ = event_tx
-                    .send(AppEvent::RebuildSucceeded { summary })
-                    .await;
+                let _ = event_tx.send(AppEvent::RebuildSucceeded { summary }).await;
                // Refresh the table list so the items panel
                // reflects whatever the rebuild produced.
                if let Ok(tables) = database.list_tables().await {
@@ -1462,12 +1444,8 @@ fn spawn_dsl_dispatch(
        }
        let event = match outcome {
            Ok(CommandOutcome::Schema(description)) => {
-                let schema_echo = build_schema_echo(
-                    &command,
-                    submission_mode,
-                    description.as_ref(),
-                    &lookups,
-                );
+                let schema_echo =
+                    build_schema_echo(&command, submission_mode, description.as_ref(), &lookups);
                AppEvent::DslSucceeded {
                    command: command.clone(),
                    description,
@@ -1484,12 +1462,10 @@ fn spawn_dsl_dispatch(
            Ok(CommandOutcome::SchemaDropIndexSkipped) => AppEvent::DslDropIndexSkipped {
                command: command.clone(),
            },
-            Ok(CommandOutcome::SchemaCreateIndexSkipped(name)) => {
-                AppEvent::DslCreateIndexSkipped {
-                    command: command.clone(),
-                    name,
-                }
-            }
+            Ok(CommandOutcome::SchemaCreateIndexSkipped(name)) => AppEvent::DslCreateIndexSkipped {
+                command: command.clone(),
+                name,
+            },
            Ok(CommandOutcome::Query(data)) => {
                // ADR-0038: `show data` is the only DSL-form query that
                // echoes; its limited form orders by the table's primary
@@ -1507,12 +1483,10 @@ fn spawn_dsl_dispatch(
                command: command.clone(),
                lines,
            },
-            Ok(CommandOutcome::ShowRelationship(data)) => {
-                AppEvent::DslShowRelationshipSucceeded {
-                    command: command.clone(),
-                    data: data.map(|b| *b),
-                }
-            }
+            Ok(CommandOutcome::ShowRelationship(data)) => AppEvent::DslShowRelationshipSucceeded {
+                command: command.clone(),
+                data: data.map(|b| *b),
+            },
            Ok(CommandOutcome::QueryPlan(plan)) => AppEvent::DslExplainSucceeded {
                command: command.clone(),
                plan,
@@ -1568,11 +1542,8 @@ fn spawn_dsl_dispatch(
                // the covering indexes the rebuild removed — Bucket B
                // category 2, ADR-0038 §7 Slice 2b). Non-cascade falls
                // through to the pre-execution `echo` from `echo_for`.
-                let cascade_echo = build_drop_column_cascade_echo(
-                    &command,
-                    submission_mode,
-                    &result,
-                );
+                let cascade_echo =
+                    build_drop_column_cascade_echo(&command, submission_mode, &result);
                AppEvent::DslDropColumnSucceeded {
                    command: command.clone(),
                    result,
@@ -1931,12 +1902,14 @@ fn build_schema_echo(
                )])
            }
        }
-        Command::DropRelationship { .. } => lookups
-            .drop_relationship
-            .as_ref()
-            .map(|(name, child_table)| {
-                vec![crate::echo::render_drop_relationship(name, child_table)]
-            }),
+        Command::DropRelationship { .. } => {
+            lookups
+                .drop_relationship
+                .as_ref()
+                .map(|(name, child_table)| {
+                    vec![crate::echo::render_drop_relationship(name, child_table)]
+                })
+        }
        // `create m:n relationship` (ADR-0045): the resolved junction
        // columns/FKs only exist on the post-exec description, so the
        // teaching echo is rendered from it (not `command_to_sql`).
@@ -1946,14 +1919,29 @@ fn build_schema_echo(
                .iter()
                .filter_map(|c| c.user_type.map(|ty| (c.name.clone(), ty)))
                .collect();
-            let primary_key: Vec<String> =
-                desc.columns.iter().filter(|c| c.primary_key).map(|c| c.name.clone()).collect();
+            let primary_key: Vec<String> = desc
+                .columns
+                .iter()
+                .filter(|c| c.primary_key)
+                .map(|c| c.name.clone())
+                .collect();
            let foreign_keys: Vec<(Vec<String>, String, Vec<String>)> = desc
                .outbound_relationships
                .iter()
-                .map(|r| (r.local_columns.clone(), r.other_table.clone(), r.other_columns.clone()))
+                .map(|r| {
+                    (
+                        r.local_columns.clone(),
+                        r.other_table.clone(),
+                        r.other_columns.clone(),
+                    )
+                })
                .collect();
-            vec![crate::echo::render_create_m2n(&desc.name, &columns, &primary_key, &foreign_keys)]
+            vec![crate::echo::render_create_m2n(
+                &desc.name,
+                &columns,
+                &primary_key,
+                &foreign_keys,
+            )]
        }),
        // Everything else (Bucket A pure-Command, plus the no-echo Bucket C
        // variants like `Sql*` / `ShowTable`) routes through the existing
@@ -2103,10 +2091,7 @@ async fn enrich_unique_violation(
    facts
 }

-fn enrich_not_null_violation(
-    command: &Command,
-    message: &str,
-) -> crate::friendly::FailureContext {
+fn enrich_not_null_violation(command: &Command, message: &str) -> crate::friendly::FailureContext {
    let mut facts = crate::friendly::FailureContext::default();
    let Some((table, column)) = parse_qualified_target(message) else {
        return facts;
@@ -2133,9 +2118,7 @@ async fn enrich_fk_violation(
            // schema-aware lookup so natural-order multi-value
            // INSERT (which `user_value_for_column` alone can't
            // resolve) gets handled too.
-            let Ok((outbound, _)) =
-                database.read_relationships(table.clone()).await
-            else {
+            let Ok((outbound, _)) = database.read_relationships(table.clone()).await else {
                return facts;
            };
            facts.table = Some(table.clone());
@@ -2173,8 +2156,7 @@ async fn enrich_fk_violation(
            // children reference). Check inbound as a fallback.
            if facts.parent_table.is_none()
                && matches!(command, Command::Update { .. })
-                && let Ok((_, inbound)) =
-                    database.read_relationships(table.clone()).await
+                && let Ok((_, inbound)) = database.read_relationships(table.clone()).await
                && let Some(rel) = inbound.first()
            {
                facts.child_table = Some(rel.other_table.clone());
@@ -2184,9 +2166,7 @@ async fn enrich_fk_violation(
            // Parent-side: inbound FK lookup. Surface a child
            // table that still references the row(s) being
            // deleted.
-            let Ok((_, inbound)) =
-                database.read_relationships(table.clone()).await
-            else {
+            let Ok((_, inbound)) = database.read_relationships(table.clone()).await else {
                return facts;
            };
            facts.table = Some(table.clone());
@@ -2271,10 +2251,7 @@ async fn user_value_for_column_with_schema(
        ..
    } = command
    {
-        let desc = database
-            .describe_table(table.to_string())
-            .await
-            .ok()?;
+        let desc = database.describe_table(table.to_string()).await.ok()?;
        // Build the natural-order column list the same way
        // `do_insert` does: filter out serial / shortid columns
        // because the engine auto-fills them and the user's
@@ -2285,8 +2262,7 @@ async fn user_value_for_column_with_schema(
            .filter(|c| {
                !matches!(
                    c.user_type,
-                    Some(crate::dsl::Type::Serial)
-                        | Some(crate::dsl::Type::ShortId)
+                    Some(crate::dsl::Type::Serial) | Some(crate::dsl::Type::ShortId)
                )
            })
            .map(|c| c.name.as_str())
@@ -2310,10 +2286,7 @@ async fn user_value_for_column_with_schema(
        && listed_columns.is_empty()
        && literal_rows.len() == 1
    {
-        let desc = database
-            .describe_table(table.to_string())
-            .await
-            .ok()?;
+        let desc = database.describe_table(table.to_string()).await.ok()?;
        let idx = desc.columns.iter().position(|c| c.name == column)?;
        return literal_rows[0].get(idx).cloned().flatten();
    }
@@ -2323,16 +2296,12 @@ async fn user_value_for_column_with_schema(
 /// Render a `DataResult` as a `DiagnosticTable` for the
 /// friendly-error layer's bordered renderer (ADR-0019 §7,
 /// reusing ADR-0017 §7's renderer).
-fn diagnostic_from_data_result(
-    data: &DataResult,
-) -> crate::friendly::DiagnosticTable {
-    use crate::output_render::{numeric_alignment_for, Alignment};
+fn diagnostic_from_data_result(data: &DataResult) -> crate::friendly::DiagnosticTable {
+    use crate::output_render::{Alignment, numeric_alignment_for};
    let alignments: Vec<Alignment> = data
        .column_types
        .iter()
-        .map(|t| {
-            t.map_or(Alignment::Left, numeric_alignment_for)
-        })
+        .map(|t| t.map_or(Alignment::Left, numeric_alignment_for))
        .collect();
    let rows: Vec<Vec<String>> = data
        .rows
@@ -2543,9 +2512,7 @@ pub async fn run_replay(
        // command, which was skipped above) — report it with the line
        // number and stop.
        let schema = build_schema_cache(database).await;
-        let command = match crate::dsl::parser::parse_command_with_schema(
-            &command_text, &schema,
-        ) {
+        let command = match crate::dsl::parser::parse_command_with_schema(&command_text, &schema) {
            Ok(c) => c,
            Err(e) => {
                events.push(AppEvent::ReplayFailed {
@@ -2566,8 +2533,7 @@ pub async fn run_replay(
        // Retain a clone for failure enrichment (the command is moved into
        // dispatch). ADR-0035 Amendment 1, F2 follow-up.
        let command_for_ctx = command.clone();
-        let outcome =
-            execute_command_typed(database, command, command_text.clone()).await;
+        let outcome = execute_command_typed(database, command, command_text.clone()).await;
        match outcome {
            Ok(_) => {
                // ADR-0052: journal the replayed line at the dispatch
@@ -2873,7 +2839,10 @@ async fn execute_command_typed(
                .drop_constraint(table, column, ConstraintKind::NotNull, src)
                .await
                .map(|d| CommandOutcome::Schema(Some(d))),
-            AlterTableAction::SetColumnDefault { column, default_sql } => database
+            AlterTableAction::SetColumnDefault {
+                column,
+                default_sql,
+            } => database
                .set_column_default(table, column, default_sql, src)
                .await
                .map(|d| CommandOutcome::Schema(Some(d))),
@@ -2989,10 +2958,7 @@ async fn execute_command_typed(
        // A SQL `SELECT` (advanced mode; ADR-0030 §6, ADR-0031).
        // The grammar walker has already validated `sql` is in
        // the supported subset; the worker runs it as text.
-        Command::Select { sql } => database
-            .run_select(sql)
-            .await
-            .map(CommandOutcome::Query),
+        Command::Select { sql } => database.run_select(sql).await.map(CommandOutcome::Query),
        // A SQL `INSERT` (advanced mode; ADR-0033 §1). Grammar-as-
        // text: the worker runs the validated `sql` and re-persists
        // the parsed `target_table`'s CSV. Reuses the DSL insert
@@ -3112,12 +3078,9 @@ fn setup_terminal() -> Result<Terminal<CrosstermBackend<io::Stdout>>> {
    Ok(terminal)
 }

-fn teardown_terminal(
-    terminal: &mut Terminal<CrosstermBackend<io::Stdout>>,
-) -> Result<()> {
+fn teardown_terminal(terminal: &mut Terminal<CrosstermBackend<io::Stdout>>) -> Result<()> {
    disable_raw_mode().context("disable raw mode")?;
-    execute!(terminal.backend_mut(), LeaveAlternateScreen)
-        .context("leave alternate screen")?;
+    execute!(terminal.backend_mut(), LeaveAlternateScreen).context("leave alternate screen")?;
    terminal.show_cursor().context("show cursor")?;
    Ok(())
 }
@@ -3257,7 +3220,9 @@ mod tests {
        // Limited → ORDER BY the resolved primary key.
        assert_eq!(
            super::build_show_data_echo(&db, &limited, EffectiveMode::AdvancedPersistent).await,
-            Some(vec!["SELECT * FROM Customers ORDER BY id LIMIT 5".to_string()]),
+            Some(vec![
+                "SELECT * FROM Customers ORDER BY id LIMIT 5".to_string()
+            ]),
        );
        // Simple mode → silent, gated before any lookup.
        assert_eq!(
@@ -3288,10 +3253,10 @@ mod tests {
    async fn bucket_b_resolved_name_echoes_against_real_worker() {
        use crate::app::EffectiveMode;
        use crate::db::Database;
+        use crate::dsl::Command;
        use crate::dsl::ReferentialAction;
        use crate::dsl::command::{ColumnSpec, IndexSelector, RelationshipSelector};
        use crate::dsl::types::Type;
-        use crate::dsl::Command;

        let db = Database::open(":memory:").expect("open in-memory");
        db.create_table(
@@ -3319,7 +3284,12 @@ mod tests {

        // --- add index (auto-named) ----------------------------------
        let desc_after_add_index = db
-            .add_index(None, "Customers".to_string(), vec!["Email".to_string()], None)
+            .add_index(
+                None,
+                "Customers".to_string(),
+                vec!["Email".to_string()],
+                None,
+            )
            .await
            .expect("add index");
        let add_idx_cmd = Command::AddIndex {
@@ -3439,7 +3409,10 @@ mod tests {
        .await;
        assert_eq!(
            endpoints_lookups.drop_relationship,
-            Some(("Customers_id_to_Orders_CustId".to_string(), "Orders".to_string())),
+            Some((
+                "Customers_id_to_Orders_CustId".to_string(),
+                "Orders".to_string()
+            )),
            "endpoints selector resolves name via child describe",
        );

@@ -3454,7 +3427,10 @@ mod tests {
                .await;
        assert_eq!(
            named_lookups.drop_relationship,
-            Some(("Customers_id_to_Orders_CustId".to_string(), "Orders".to_string())),
+            Some((
+                "Customers_id_to_Orders_CustId".to_string(),
+                "Orders".to_string()
+            )),
            "named selector scans user tables to find the child",
        );

@@ -3487,10 +3463,10 @@ mod tests {
    async fn bucket_b_multi_statement_echoes_against_real_worker() {
        use crate::app::EffectiveMode;
        use crate::db::Database;
+        use crate::dsl::Command;
        use crate::dsl::ReferentialAction;
        use crate::dsl::command::ColumnSpec;
        use crate::dsl::types::Type;
-        use crate::dsl::Command;

        // --- drop column --cascade -----------------------------------
        let db = Database::open(":memory:").expect("open in-memory");
@@ -3505,9 +3481,14 @@ mod tests {
        )
        .await
        .expect("create Customers");
-        db.add_index(None, "Customers".to_string(), vec!["Email".to_string()], None)
-            .await
-            .expect("index Email");
+        db.add_index(
+            None,
+            "Customers".to_string(),
+            vec!["Email".to_string()],
+            None,
+        )
+        .await
+        .expect("index Email");

        let drop_cmd = Command::DropColumn {
            table: "Customers".to_string(),
@@ -3531,12 +3512,8 @@ mod tests {
        );
        // Simple mode → silent.
        assert!(
-            super::build_drop_column_cascade_echo(
-                &drop_cmd,
-                EffectiveMode::Simple,
-                &drop_result,
-            )
-            .is_none(),
+            super::build_drop_column_cascade_echo(&drop_cmd, EffectiveMode::Simple, &drop_result,)
+                .is_none(),
        );

        // --- add relationship --create-fk (column newly created) ----
@@ -3673,11 +3650,11 @@ mod tests {
        // switch (an unmodified temp would be cleaned up, taking its
        // project.yaml with it). Without the unload persist the
        // outgoing skeleton carries no `mode:` → `None`.
-        use super::{handle_project_switch, Session, SwitchRequest};
+        use super::{Session, SwitchRequest, handle_project_switch};
        use crate::db::Database;
        use crate::mode::Mode;
        use crate::persistence::Persistence;
-        use crate::project::{projects_dir, Project};
+        use crate::project::{Project, projects_dir};
        use tokio::sync::mpsc;

        let data_root = tempfile::tempdir().unwrap();
@@ -3686,8 +3663,7 @@ mod tests {
        let outgoing_path = projects.join("Outgoing");
        let outgoing = Project::create_named(&outgoing_path).unwrap();
        let db_path = outgoing.db_path();
-        let persistence =
-            Persistence::new(outgoing.path().to_path_buf()).with_mode(Mode::Advanced);
+        let persistence = Persistence::new(outgoing.path().to_path_buf()).with_mode(Mode::Advanced);
        let database =
            Database::open_with_persistence_and_undo(&db_path, persistence, true).unwrap();
        let mut session = Session {
@@ -18,7 +18,11 @@ pub fn parse_in_check_values(check: &str, column: &str) -> Option<Vec<String>> {
        return None;
    }
    let values = extract_quoted_list(&check[paren_open..])?;
-    if values.is_empty() { None } else { Some(values) }
+    if values.is_empty() {
+        None
+    } else {
+        Some(values)
+    }
 }

 const fn is_ident_byte(b: u8) -> bool {
@@ -45,8 +49,8 @@ fn find_in_paren(check: &str) -> Option<(usize, usize)> {
            i += 1;
            continue;
        }
-        let is_in = (b == b'i' || b == b'I')
-            && bytes.get(i + 1).is_some_and(|n| *n == b'n' || *n == b'N');
+        let is_in =
+            (b == b'i' || b == b'I') && bytes.get(i + 1).is_some_and(|n| *n == b'n' || *n == b'N');
        if is_in {
            let before_ok = i == 0 || !is_ident_byte(bytes[i - 1]);
            let after = i + 2;
@@ -81,17 +81,22 @@ pub fn generate_value(generator: &Generator, ty: Type, rng: &mut SeedRng) -> Val
        Generator::CurrencyAmount => currency_amount(ty, rng),
        Generator::Age => Value::Number(rng.random_range(18..=80).to_string()),
        Generator::SmallInt => Value::Number(rng.random_range(1..=100).to_string()),
-        Generator::YearRecent => {
-            Value::Number(rng.random_range((REF_YEAR - YEAR_RECENT_SPAN)..=REF_YEAR).to_string())
-        }
+        Generator::YearRecent => Value::Number(
+            rng.random_range((REF_YEAR - YEAR_RECENT_SPAN)..=REF_YEAR)
+                .to_string(),
+        ),
        Generator::YearBirth => Value::Number(
            rng.random_range((REF_YEAR - YEAR_BIRTH_MAX_AGE)..=(REF_YEAR - YEAR_BIRTH_MIN_AGE))
                .to_string(),
        ),
-        Generator::DateRecent => Value::Text(format_date(random_past_date(rng, 0, RECENT_WINDOW_DAYS))),
-        Generator::DateAdult => {
-            Value::Text(format_date(random_past_date(rng, ADULT_MIN_DAYS, ADULT_MAX_DAYS)))
+        Generator::DateRecent => {
+            Value::Text(format_date(random_past_date(rng, 0, RECENT_WINDOW_DAYS)))
        }
+        Generator::DateAdult => Value::Text(format_date(random_past_date(
+            rng,
+            ADULT_MIN_DAYS,
+            ADULT_MAX_DAYS,
+        ))),
        Generator::DateTimeRecent => Value::Text(random_recent_datetime(rng)),
        Generator::Boolean => Value::Bool(rng.random_range(0..2) == 1),
        Generator::PickFrom(values) if !values.is_empty() => {
@@ -232,8 +237,7 @@ fn random_datetime_between(
    } else {
        rng.random_range(hi_s..=lo_s)
    };
-    let dt = chrono::DateTime::from_timestamp(secs, 0)
-        .map_or(lo, |d| d.naive_utc());
+    let dt = chrono::DateTime::from_timestamp(secs, 0).map_or(lo, |d| d.naive_utc());
    dt.format("%Y-%m-%dT%H:%M:%S").to_string()
 }

@@ -294,20 +298,35 @@ fn currency_amount(ty: Type, rng: &mut SeedRng) -> Value {
 // — the hand-rolled `product` generator (D9) —

 const PRODUCT_ADJECTIVES: &[&str] = &[
-    "Sleek", "Rustic", "Ergonomic", "Handcrafted", "Refined", "Modern",
-    "Vintage", "Compact", "Premium", "Lightweight", "Durable", "Elegant",
-    "Sturdy", "Smooth", "Gorgeous", "Intelligent", "Practical", "Awesome",
-    "Incredible", "Recycled",
+    "Sleek",
+    "Rustic",
+    "Ergonomic",
+    "Handcrafted",
+    "Refined",
+    "Modern",
+    "Vintage",
+    "Compact",
+    "Premium",
+    "Lightweight",
+    "Durable",
+    "Elegant",
+    "Sturdy",
+    "Smooth",
+    "Gorgeous",
+    "Intelligent",
+    "Practical",
+    "Awesome",
+    "Incredible",
+    "Recycled",
 ];
 const PRODUCT_MATERIALS: &[&str] = &[
-    "Wooden", "Copper", "Granite", "Cotton", "Steel", "Leather", "Bamboo",
-    "Plastic", "Ceramic", "Glass", "Concrete", "Rubber", "Bronze", "Marble",
-    "Linen", "Silk", "Aluminum", "Wool", "Gold", "Carbon",
+    "Wooden", "Copper", "Granite", "Cotton", "Steel", "Leather", "Bamboo", "Plastic", "Ceramic",
+    "Glass", "Concrete", "Rubber", "Bronze", "Marble", "Linen", "Silk", "Aluminum", "Wool", "Gold",
+    "Carbon",
 ];
 const PRODUCT_NOUNS: &[&str] = &[
-    "Chair", "Lamp", "Table", "Bottle", "Backpack", "Keyboard", "Mug",
-    "Shoes", "Jacket", "Watch", "Wallet", "Bench", "Hat", "Gloves",
-    "Towel", "Ball", "Bike", "Knife", "Pillow", "Blanket",
+    "Chair", "Lamp", "Table", "Bottle", "Backpack", "Keyboard", "Mug", "Shoes", "Jacket", "Watch",
+    "Wallet", "Bench", "Hat", "Gloves", "Towel", "Ball", "Bike", "Knife", "Pillow", "Blanket",
 ];

 fn product_name(rng: &mut SeedRng) -> String {
@@ -396,7 +415,9 @@ mod tests {
        ] {
            let v = gen_once(&generator, Type::Text, 3);
            match v {
-                Value::Text(s) => assert!(!s.trim().is_empty(), "{generator:?} produced empty text"),
+                Value::Text(s) => {
+                    assert!(!s.trim().is_empty(), "{generator:?} produced empty text")
+                }
                other => panic!("{generator:?} produced non-text {other:?}"),
            }
        }
@@ -405,18 +426,25 @@ mod tests {
    #[test]
    fn email_looks_like_an_email() {
        let v = gen_once(&Generator::Email, Type::Text, 11);
-        let Value::Text(s) = v else { panic!("not text") };
+        let Value::Text(s) = v else {
+            panic!("not text")
+        };
        assert!(s.contains('@'), "email should contain @: {s}");
    }

    #[test]
    fn product_name_is_three_capitalised_words() {
        let v = gen_once(&Generator::ProductName, Type::Text, 99);
-        let Value::Text(s) = v else { panic!("not text") };
+        let Value::Text(s) = v else {
+            panic!("not text")
+        };
        let words: Vec<&str> = s.split(' ').collect();
        assert_eq!(words.len(), 3, "product name should be 3 words: {s}");
        for w in words {
-            assert!(w.chars().next().unwrap().is_ascii_uppercase(), "word `{w}` not capitalised");
+            assert!(
+                w.chars().next().unwrap().is_ascii_uppercase(),
+                "word `{w}` not capitalised"
+            );
        }
    }

@@ -429,9 +457,14 @@ mod tests {
        let latest = reference_date();
        for _ in 0..200 {
            let v = generate_value(&Generator::DateRecent, Type::Date, &mut rng);
-            let Value::Text(s) = v else { panic!("date not text") };
+            let Value::Text(s) = v else {
+                panic!("date not text")
+            };
            let d = NaiveDate::parse_from_str(&s, "%Y-%m-%d").expect("valid ISO date");
-            assert!(d >= earliest && d <= latest, "date {d} outside recent window");
+            assert!(
+                d >= earliest && d <= latest,
+                "date {d} outside recent window"
+            );
        }
    }

@@ -446,7 +479,9 @@ mod tests {
            .unwrap();
        for _ in 0..200 {
            let v = generate_value(&Generator::DateAdult, Type::Date, &mut rng);
-            let Value::Text(s) = v else { panic!("date not text") };
+            let Value::Text(s) = v else {
+                panic!("date not text")
+            };
            let d = NaiveDate::parse_from_str(&s, "%Y-%m-%d").expect("valid ISO date");
            assert!(d >= earliest && d <= latest, "dob {d} outside adult window");
        }
@@ -455,7 +490,9 @@ mod tests {
    #[test]
    fn datetime_is_iso_shaped() {
        let v = gen_once(&Generator::DateTimeRecent, Type::DateTime, 5);
-        let Value::Text(s) = v else { panic!("not text") };
+        let Value::Text(s) = v else {
+            panic!("not text")
+        };
        assert!(s.contains('T'), "datetime needs a T separator: {s}");
        // Parses as a naive datetime.
        chrono::NaiveDateTime::parse_from_str(&s, "%Y-%m-%dT%H:%M:%S")
@@ -467,11 +504,17 @@ mod tests {
        let Value::Number(int_amt) = gen_once(&Generator::CurrencyAmount, Type::Int, 4) else {
            panic!("not a number")
        };
-        assert!(!int_amt.contains('.'), "int currency should be whole: {int_amt}");
+        assert!(
+            !int_amt.contains('.'),
+            "int currency should be whole: {int_amt}"
+        );
        let Value::Number(dec_amt) = gen_once(&Generator::CurrencyAmount, Type::Decimal, 4) else {
            panic!("not a number")
        };
-        assert!(dec_amt.contains('.'), "decimal currency should have cents: {dec_amt}");
+        assert!(
+            dec_amt.contains('.'),
+            "decimal currency should have cents: {dec_amt}"
+        );
    }

    #[test]
@@ -494,7 +537,10 @@ mod tests {
            let Value::Text(s) = generate_value(&generator, Type::Text, &mut rng) else {
                panic!("not text")
            };
-            assert!(matches!(s.as_str(), "active" | "closed"), "unexpected pick {s}");
+            assert!(
+                matches!(s.as_str(), "active" | "closed"),
+                "unexpected pick {s}"
+            );
        }
    }

@@ -503,7 +549,10 @@ mod tests {
        let generator = Generator::PickFrom(vec!["1".into(), "2".into(), "3".into()]);
        let mut rng = make_rng(Some(6));
        let v = generate_value(&generator, Type::Int, &mut rng);
-        assert!(matches!(v, Value::Number(_)), "numeric pick should be a Number: {v:?}");
+        assert!(
+            matches!(v, Value::Number(_)),
+            "numeric pick should be a Number: {v:?}"
+        );
    }

    #[test]
@@ -517,7 +566,10 @@ mod tests {
                panic!("YearRecent must be a Number")
            };
            let n: i32 = s.parse().unwrap();
-            assert!((1950..=2025).contains(&n), "YearRecent {n} out of [1950,2025]");
+            assert!(
+                (1950..=2025).contains(&n),
+                "YearRecent {n} out of [1950,2025]"
+            );
        }
        for _ in 0..300 {
            let Value::Number(s) = generate_value(&Generator::YearBirth, Type::Int, &mut rng)
@@ -525,7 +577,10 @@ mod tests {
                panic!("YearBirth must be a Number")
            };
            let n: i32 = s.parse().unwrap();
-            assert!((1945..=2007).contains(&n), "YearBirth {n} out of [1945,2007]");
+            assert!(
+                (1945..=2007).contains(&n),
+                "YearBirth {n} out of [1945,2007]"
+            );
        }
    }

@@ -543,7 +598,10 @@ mod tests {

    #[test]
    fn int_range_stays_within_inclusive_bounds() {
-        let g = Generator::Range { low: "10".into(), high: "20".into() };
+        let g = Generator::Range {
+            low: "10".into(),
+            high: "20".into(),
+        };
        let mut rng = make_rng(Some(5));
        for _ in 0..200 {
            let Value::Number(s) = generate_value(&g, Type::Int, &mut rng) else {
@@ -556,7 +614,10 @@ mod tests {

    #[test]
    fn real_range_stays_within_bounds_and_has_cents() {
-        let g = Generator::Range { low: "1.0".into(), high: "9.0".into() };
+        let g = Generator::Range {
+            low: "1.0".into(),
+            high: "9.0".into(),
+        };
        let mut rng = make_rng(Some(5));
        for _ in 0..200 {
            let Value::Number(s) = generate_value(&g, Type::Real, &mut rng) else {
@@ -588,13 +649,19 @@ mod tests {

    #[test]
    fn reversed_bounds_are_tolerated() {
-        let g = Generator::Range { low: "20".into(), high: "10".into() };
+        let g = Generator::Range {
+            low: "20".into(),
+            high: "10".into(),
+        };
        let mut rng = make_rng(Some(1));
        let Value::Number(s) = generate_value(&g, Type::Int, &mut rng) else {
            panic!("number")
        };
        let n: i64 = s.parse().unwrap();
-        assert!((10..=20).contains(&n), "reversed bounds still produce in-range: {n}");
+        assert!(
+            (10..=20).contains(&n),
+            "reversed bounds still produce in-range: {n}"
+        );
    }

    #[test]
@@ -603,7 +670,10 @@ mod tests {
        assert!(range_bounds_reason(Type::Int, "1", "10").is_none());
        assert!(range_bounds_reason(Type::Real, "1.5", "9.9").is_none());
        assert!(range_bounds_reason(Type::Date, "2023-01-01", "2024-01-01").is_none());
-        assert!(range_bounds_reason(Type::DateTime, "2023-01-01T00:00:00", "2024-01-01T00:00:00").is_none());
+        assert!(
+            range_bounds_reason(Type::DateTime, "2023-01-01T00:00:00", "2024-01-01T00:00:00")
+                .is_none()
+        );
        // Non-numeric bound on a numeric column.
        assert!(range_bounds_reason(Type::Int, "abc", "10").is_some());
        // A range on a text column is meaningless.
@@ -623,14 +693,29 @@ mod tests {
    #[test]
    fn generic_fallback_matches_each_type() {
        let mut rng = make_rng(Some(0));
-        assert!(matches!(generate_value(&Generator::Generic, Type::Text, &mut rng), Value::Text(_)));
-        assert!(matches!(generate_value(&Generator::Generic, Type::Int, &mut rng), Value::Number(_)));
-        assert!(matches!(generate_value(&Generator::Generic, Type::Bool, &mut rng), Value::Bool(_)));
-        assert!(matches!(generate_value(&Generator::Generic, Type::Blob, &mut rng), Value::Null));
+        assert!(matches!(
+            generate_value(&Generator::Generic, Type::Text, &mut rng),
+            Value::Text(_)
+        ));
+        assert!(matches!(
+            generate_value(&Generator::Generic, Type::Int, &mut rng),
+            Value::Number(_)
+        ));
+        assert!(matches!(
+            generate_value(&Generator::Generic, Type::Bool, &mut rng),
+            Value::Bool(_)
+        ));
+        assert!(matches!(
+            generate_value(&Generator::Generic, Type::Blob, &mut rng),
+            Value::Null
+        ));
        // shortid fallback is a valid base58 id.
        let Value::Text(sid) = generate_value(&Generator::Generic, Type::ShortId, &mut rng) else {
            panic!("shortid not text")
        };
-        assert!(crate::dsl::shortid::validate(&sid).is_ok(), "invalid shortid {sid}");
+        assert!(
+            crate::dsl::shortid::validate(&sid).is_ok(),
+            "invalid shortid {sid}"
+        );
    }
 }
@@ -63,8 +63,7 @@ pub fn is_enum_ish(name: &str) -> bool {
    // `rating` / `stars` were never here. `status` stays — it is
    // deliberately left to the advisory (no built-in set).
    const ENUM_TOKENS: &[&str] = &[
-        "role", "status", "state", "type", "kind", "category", "level",
-        "tier", "stage", "gender",
+        "role", "status", "state", "type", "kind", "category", "level", "tier", "stage", "gender",
    ];
    let toks = tokens(name);
    toks.iter().any(|t| ENUM_TOKENS.contains(&t.as_str()))
@@ -81,9 +80,7 @@ fn match_name_generator(table: &str, toks: &[String], ty: Type) -> Option<Genera
    if text && (has_any(toks, &["fname", "firstname"]) || has_seq(toks, "first", "name")) {
        return Some(Generator::FirstName);
    }
-    if text
-        && (has_any(toks, &["lname", "lastname", "surname"]) || has_seq(toks, "last", "name"))
-    {
+    if text && (has_any(toks, &["lname", "lastname", "surname"]) || has_seq(toks, "last", "name")) {
        return Some(Generator::LastName);
    }
    if text && (has_any(toks, &["username", "login", "handle"]) || has_seq(toks, "user", "name")) {
@@ -116,7 +113,10 @@ fn match_name_generator(table: &str, toks: &[String], ty: Type) -> Option<Genera
    // `province` / explicit `state_name`/`state_abbr` → a real state name.
    // Bare `state` is left to enum-ish (it usually means status), so we
    // require `province` or a `state` token paired with name/abbr.
-    if text && (has_token(toks, "province") || (has_token(toks, "state") && has_any(toks, &["name", "abbr"]))) {
+    if text
+        && (has_token(toks, "province")
+            || (has_token(toks, "state") && has_any(toks, &["name", "abbr"])))
+    {
        return Some(Generator::StateName);
    }
    if text && has_any(toks, &["street", "address", "addr"]) {
@@ -127,7 +127,12 @@ fn match_name_generator(table: &str, toks: &[String], ty: Type) -> Option<Genera
    }

    // — Organisation / job —
-    if text && has_any(toks, &["company", "employer", "org", "organization", "organisation"]) {
+    if text
+        && has_any(
+            toks,
+            &["company", "employer", "org", "organization", "organisation"],
+        )
+    {
        return Some(Generator::Company);
    }
    if text && has_any(toks, &["job", "position", "profession", "occupation"]) {
@@ -135,7 +140,21 @@ fn match_name_generator(table: &str, toks: &[String], ty: Type) -> Option<Genera
    }

    // — Free text —
-    if text && has_any(toks, &["description", "bio", "notes", "note", "summary", "comment", "comments", "about"]) {
+    if text
+        && has_any(
+            toks,
+            &[
+                "description",
+                "bio",
+                "notes",
+                "note",
+                "summary",
+                "comment",
+                "comments",
+                "about",
+            ],
+        )
+    {
        return Some(Generator::Sentence);
    }
    if text && has_any(toks, &["url", "website", "homepage", "link"]) {
@@ -146,7 +165,14 @@ fn match_name_generator(table: &str, toks: &[String], ty: Type) -> Option<Genera
    }

    // — Numeric —
-    if numeric && has_any(toks, &["price", "amount", "cost", "salary", "balance", "total", "fee", "revenue"]) {
+    if numeric
+        && has_any(
+            toks,
+            &[
+                "price", "amount", "cost", "salary", "balance", "total", "fee", "revenue",
+            ],
+        )
+    {
        return Some(Generator::CurrencyAmount);
    }
    if numeric && has_token(toks, "age") {
@@ -233,18 +259,50 @@ fn match_name_generator(table: &str, toks: &[String], ty: Type) -> Option<Genera
 fn name_by_table_context(table: &str) -> Generator {
    let toks = tokens(table);
    const PRODUCTY: &[&str] = &[
-        "product", "products", "item", "items", "good", "goods",
-        "merchandise", "catalog", "catalogue", "inventory", "sku", "skus",
+        "product",
+        "products",
+        "item",
+        "items",
+        "good",
+        "goods",
+        "merchandise",
+        "catalog",
+        "catalogue",
+        "inventory",
+        "sku",
+        "skus",
    ];
    const COMPANYISH: &[&str] = &[
-        "company", "companies", "vendor", "vendors", "supplier",
-        "suppliers", "manufacturer", "manufacturers", "brand", "brands",
-        "organization", "organisation",
+        "company",
+        "companies",
+        "vendor",
+        "vendors",
+        "supplier",
+        "suppliers",
+        "manufacturer",
+        "manufacturers",
+        "brand",
+        "brands",
+        "organization",
+        "organisation",
    ];
    const PERSONISH: &[&str] = &[
-        "user", "users", "customer", "customers", "person", "people",
-        "employee", "employees", "member", "members", "contact",
-        "contacts", "author", "authors", "student", "students",
+        "user",
+        "users",
+        "customer",
+        "customers",
+        "person",
+        "people",
+        "employee",
+        "employees",
+        "member",
+        "members",
+        "contact",
+        "contacts",
+        "author",
+        "authors",
+        "student",
+        "students",
    ];
    if has_any(&toks, PRODUCTY) {
        Generator::ProductName
@@ -264,9 +322,8 @@ fn name_by_table_context(table: &str) -> Generator {
 /// before this guard; this catches structural names.
 fn is_name_false_positive(toks: &[String]) -> bool {
    const NON_PERSON: &[&str] = &[
-        "file", "table", "host", "domain", "field", "class", "tag",
-        "event", "path", "col", "column", "db", "schema", "index", "key",
-        "page", "node", "type",
+        "file", "table", "host", "domain", "field", "class", "tag", "event", "path", "col",
+        "column", "db", "schema", "index", "key", "page", "node", "type",
    ];
    has_any(toks, NON_PERSON) && has_any(toks, &["name", "title"])
 }
@@ -357,9 +414,18 @@ mod tests {

    #[test]
    fn person_name_fields_map_to_name_generators() {
-        assert_eq!(choose("users", "first_name", Type::Text), Generator::FirstName);
-        assert_eq!(choose("users", "firstName", Type::Text), Generator::FirstName);
-        assert_eq!(choose("users", "last_name", Type::Text), Generator::LastName);
+        assert_eq!(
+            choose("users", "first_name", Type::Text),
+            Generator::FirstName
+        );
+        assert_eq!(
+            choose("users", "firstName", Type::Text),
+            Generator::FirstName
+        );
+        assert_eq!(
+            choose("users", "last_name", Type::Text),
+            Generator::LastName
+        );
        assert_eq!(choose("users", "surname", Type::Text), Generator::LastName);
    }

@@ -368,9 +434,15 @@ mod tests {
        assert_eq!(choose("users", "email", Type::Text), Generator::Email);
        assert_eq!(choose("users", "work_email", Type::Text), Generator::Email);
        assert_eq!(choose("users", "username", Type::Text), Generator::Username);
-        assert_eq!(choose("users", "user_name", Type::Text), Generator::Username);
+        assert_eq!(
+            choose("users", "user_name", Type::Text),
+            Generator::Username
+        );
        assert_eq!(choose("users", "phone", Type::Text), Generator::Phone);
-        assert_eq!(choose("accounts", "password", Type::Text), Generator::Password);
+        assert_eq!(
+            choose("accounts", "password", Type::Text),
+            Generator::Password
+        );
    }

    #[test]
@@ -386,7 +458,10 @@ mod tests {
    #[test]
    fn bare_name_uses_table_context() {
        // D11 — the same column name resolves differently by table.
-        assert_eq!(choose("products", "name", Type::Text), Generator::ProductName);
+        assert_eq!(
+            choose("products", "name", Type::Text),
+            Generator::ProductName
+        );
        assert_eq!(choose("items", "title", Type::Text), Generator::ProductName);
        assert_eq!(choose("users", "name", Type::Text), Generator::FullName);
        assert_eq!(choose("customers", "name", Type::Text), Generator::FullName);
@@ -399,7 +474,10 @@ mod tests {
    fn name_false_positives_do_not_become_person_names() {
        // These must NOT resolve to a person/product name.
        assert_ne!(choose("files", "filename", Type::Text), Generator::FullName);
-        assert_ne!(choose("meta", "table_name", Type::Text), Generator::FullName);
+        assert_ne!(
+            choose("meta", "table_name", Type::Text),
+            Generator::FullName
+        );
        // They fall through to a generic / non-person generator.
        assert_eq!(choose("files", "filename", Type::Text), Generator::Generic);
    }
@@ -408,7 +486,10 @@ mod tests {
    fn numeric_name_heuristics_are_type_gated() {
        // `price` on a numeric column → currency; on text → falls through.
        assert_eq!(choose("p", "price", Type::Int), Generator::CurrencyAmount);
-        assert_eq!(choose("p", "price", Type::Decimal), Generator::CurrencyAmount);
+        assert_eq!(
+            choose("p", "price", Type::Decimal),
+            Generator::CurrencyAmount
+        );
        assert_eq!(choose("p", "price", Type::Text), Generator::Generic);
        assert_eq!(choose("u", "age", Type::Int), Generator::Age);
        assert_eq!(choose("o", "quantity", Type::Int), Generator::SmallInt);
@@ -425,8 +506,14 @@ mod tests {
    fn temporal_fields_are_bounded_and_type_gated() {
        assert_eq!(choose("u", "dob", Type::Date), Generator::DateAdult);
        assert_eq!(choose("o", "order_date", Type::Date), Generator::DateRecent);
-        assert_eq!(choose("o", "created_at", Type::DateTime), Generator::DateTimeRecent);
-        assert_eq!(choose("o", "timestamp", Type::DateTime), Generator::DateTimeRecent);
+        assert_eq!(
+            choose("o", "created_at", Type::DateTime),
+            Generator::DateTimeRecent
+        );
+        assert_eq!(
+            choose("o", "timestamp", Type::DateTime),
+            Generator::DateTimeRecent
+        );
        // Wrong type → not a date generator.
        assert_eq!(choose("o", "order_date", Type::Int), Generator::Generic);
    }
@@ -440,17 +527,32 @@ mod tests {

    #[test]
    fn identifier_family_is_unique_sequential() {
-        assert_eq!(choose("t", "code", Type::Text), Generator::IdentitySequential);
-        assert_eq!(choose("t", "sku", Type::Text), Generator::IdentitySequential);
-        assert_eq!(choose("t", "order_number", Type::Int), Generator::IdentitySequential);
-        assert_eq!(choose("t", "external_id", Type::Int), Generator::IdentitySequential);
+        assert_eq!(
+            choose("t", "code", Type::Text),
+            Generator::IdentitySequential
+        );
+        assert_eq!(
+            choose("t", "sku", Type::Text),
+            Generator::IdentitySequential
+        );
+        assert_eq!(
+            choose("t", "order_number", Type::Int),
+            Generator::IdentitySequential
+        );
+        assert_eq!(
+            choose("t", "external_id", Type::Int),
+            Generator::IdentitySequential
+        );
    }

    #[test]
    fn foreign_key_columns_defer_to_executor() {
        let mut spec = ColumnSpec::plain("user_id", Type::Int);
        spec.is_foreign_key = true;
-        assert_eq!(choose_generator("orders", &spec), Generator::ForeignKeySample);
+        assert_eq!(
+            choose_generator("orders", &spec),
+            Generator::ForeignKeySample
+        );
    }

    #[test]
@@ -481,13 +583,28 @@ mod tests {
    fn year_like_int_columns_map_to_bounded_years() {
        // Issue #33: `int`-gated year heuristics. `birth`/`born`/`dob`
        // years pick the birth window; the rest a recent window.
-        assert_eq!(choose("authors", "birth_year", Type::Int), Generator::YearBirth);
-        assert_eq!(choose("authors", "birthYear", Type::Int), Generator::YearBirth);
+        assert_eq!(
+            choose("authors", "birth_year", Type::Int),
+            Generator::YearBirth
+        );
+        assert_eq!(
+            choose("authors", "birthYear", Type::Int),
+            Generator::YearBirth
+        );
        assert_eq!(choose("u", "year_born", Type::Int), Generator::YearBirth);
        assert_eq!(choose("books", "year", Type::Int), Generator::YearRecent);
-        assert_eq!(choose("films", "release_year", Type::Int), Generator::YearRecent);
-        assert_eq!(choose("books", "published", Type::Int), Generator::YearRecent);
-        assert_eq!(choose("companies", "founded", Type::Int), Generator::YearRecent);
+        assert_eq!(
+            choose("films", "release_year", Type::Int),
+            Generator::YearRecent
+        );
+        assert_eq!(
+            choose("books", "published", Type::Int),
+            Generator::YearRecent
+        );
+        assert_eq!(
+            choose("companies", "founded", Type::Int),
+            Generator::YearRecent
+        );
        // Type-gated: a text `year` is not a bounded-year int.
        assert_eq!(choose("books", "year", Type::Text), Generator::Generic);
        // `year_count` is a count, not a year — the quantity rule wins.
@@ -507,7 +624,12 @@ mod tests {
        );
        assert_eq!(
            choose("bugs", "severity", Type::Text),
-            Generator::PickFrom(vec!["low".into(), "medium".into(), "high".into(), "critical".into()]),
+            Generator::PickFrom(vec![
+                "low".into(),
+                "medium".into(),
+                "high".into(),
+                "critical".into()
+            ]),
        );
        assert_eq!(
            choose("bugs", "severity", Type::Int),
@@ -515,11 +637,23 @@ mod tests {
        );
        assert_eq!(
            choose("reviews", "rating", Type::Int),
-            Generator::PickFrom(vec!["1".into(), "2".into(), "3".into(), "4".into(), "5".into()]),
+            Generator::PickFrom(vec![
+                "1".into(),
+                "2".into(),
+                "3".into(),
+                "4".into(),
+                "5".into()
+            ]),
        );
        assert_eq!(
            choose("reviews", "stars", Type::Int),
-            Generator::PickFrom(vec!["1".into(), "2".into(), "3".into(), "4".into(), "5".into()]),
+            Generator::PickFrom(vec![
+                "1".into(),
+                "2".into(),
+                "3".into(),
+                "4".into(),
+                "5".into()
+            ]),
        );
    }

@@ -552,7 +686,10 @@ mod tests {

    #[test]
    fn unmatched_columns_use_type_based_fallback() {
-        assert_eq!(choose("t", "some_freeform_field", Type::Text), Generator::Generic);
+        assert_eq!(
+            choose("t", "some_freeform_field", Type::Text),
+            Generator::Generic
+        );
    }

    #[test]
@@ -32,7 +32,7 @@ mod vocabulary;
 pub use check::parse_in_check_values;
 pub use generators::{generate_value, range_bounds_reason};
 pub use heuristics::{choose_generator, is_enum_ish};
-pub use vocabulary::{generator_for_name, is_known_generator_prefix, KNOWN_GENERATORS};
+pub use vocabulary::{KNOWN_GENERATORS, generator_for_name, is_known_generator_prefix};

 use rand::rngs::StdRng;
 use rand::{RngExt, SeedableRng};
@@ -183,7 +183,10 @@ pub enum Generator {
    /// does not parse for the column type is a friendly error), so
    /// [`generate_value`] only ever sees parseable bounds; a defensive
    /// parse failure falls back to type-based generation.
-    Range { low: String, high: String },
+    Range {
+        low: String,
+        high: String,
+    },
    /// Type-based fallback (D8) when no name heuristic matches.
    Generic,
 }
@@ -0,0 +1,9 @@
+---
+source: src/app.rs
+assertion_line: 5844
+expression: block
+---
+Hint
+  What:    Add one or more rows to a table.
+  Example: insert into Customers values ('Ann', 'ann@example.io')
+  Concept: A row is one record; each value lines up with a column, in order. Columns typed `serial`/`shortid` fill themselves — leave them out.
@@ -1,6 +1,6 @@
 ---
 source: src/ui.rs
-assertion_line: 2836
+assertion_line: 2839
 expression: snapshot
 ---
 ╭ Output ──────────────────────────────────────────────────────────────────────╮
@@ -26,4 +26,4 @@ expression: snapshot
 │                                                                              │
 ╰──────────────────────────────────────────────────────────────────────────────╯
 Project: Term Planner                                                           
-Ctrl-O sidebar  ·  Tab complete  ·  ↑ history  ·  Enter run
+Ctrl-O sidebar  ·  Tab complete  ·  ↑ history  ·  F1 hint  ·  Enter run
@@ -1,6 +1,6 @@
 ---
 source: src/ui.rs
-assertion_line: 2819
+assertion_line: 2822
 expression: snapshot
 ---
 ╭ Output ──────────────────────────────────────────────────────────────────────╮
@@ -26,4 +26,4 @@ expression: snapshot
 │for SQL                                                                       │
 ╰──────────────────────────────────────────────────────────────────────────────╯
 Project: Term Planner                                                           
-Ctrl-O sidebar  ·  Tab complete  ·  ↑ history  ·  Enter run
+Ctrl-O sidebar  ·  Tab complete  ·  ↑ history  ·  F1 hint  ·  Enter run
@@ -1,6 +1,6 @@
 ---
 source: src/ui.rs
-assertion_line: 2827
+assertion_line: 2830
 expression: snapshot
 ---
 ╭ Output ──────────────────────────────────────────────────────────────────────╮
@@ -26,4 +26,4 @@ expression: snapshot
 │for SQL                                                                       │
 ╰──────────────────────────────────────────────────────────────────────────────╯
 Project: Term Planner                                                           
-Ctrl-O sidebar  ·  Tab complete  ·  ↑ history  ·  Enter run
+Ctrl-O sidebar  ·  Tab complete  ·  ↑ history  ·  F1 hint  ·  Enter run
@@ -1,6 +1,6 @@
 ---
 source: src/ui.rs
-assertion_line: 3442
+assertion_line: 3445
 expression: snapshot
 ---
 ╭ Output ────────────────────────────────────────────────────────────────────────────────╮
@@ -28,4 +28,4 @@ expression: snapshot
 │                                                                                        │
 ╰────────────────────────────────────────────────────────────────────────────────────────╯
 Project: Term Planner                                                                     
-Ctrl-O sidebar  ·  Tab complete  ·  ↑ history  ·  Enter run
+Ctrl-O sidebar  ·  Tab complete  ·  ↑ history  ·  F1 hint  ·  Enter run
@@ -1,6 +1,6 @@
 ---
 source: src/ui.rs
-assertion_line: 3388
+assertion_line: 3391
 expression: snapshot
 ---
 ╭ Output ────────────────────────────────────────────────────────────────────────────────╮
@@ -28,4 +28,4 @@ expression: snapshot
 │                                                                                        │
 ╰────────────────────────────────────────────────────────────────────────────────────────╯
 Project: Term Planner                                                                     
-Ctrl-O sidebar  ·  Tab complete  ·  ↑ history  ·  Enter run
+Ctrl-O sidebar  ·  Tab complete  ·  ↑ history  ·  F1 hint  ·  Enter run
@@ -1,6 +1,6 @@
 ---
 source: src/ui.rs
-assertion_line: 3378
+assertion_line: 3381
 expression: snapshot
 ---
 ╭ Output ────────────────────────────────────────────────────────────────────────────────╮
@@ -28,4 +28,4 @@ expression: snapshot
 │                                                                                        │
 ╰────────────────────────────────────────────────────────────────────────────────────────╯
 Project: Term Planner                                                                     
-Ctrl-O sidebar  ·  Tab complete  ·  ↑ history  ·  Enter run
+Ctrl-O sidebar  ·  Tab complete  ·  ↑ history  ·  F1 hint  ·  Enter run
@@ -1,6 +1,6 @@
 ---
 source: src/ui.rs
-assertion_line: 3431
+assertion_line: 3434
 expression: snapshot
 ---
 ╭ Output ────────────────────────────────────────────────────────────────────────────────╮
@@ -28,4 +28,4 @@ expression: snapshot
 │                                                                                        │
 ╰────────────────────────────────────────────────────────────────────────────────────────╯
 Project: Term Planner                                                                     
-Ctrl-O sidebar  ·  Tab complete  ·  ↑ history  ·  Enter run
+Ctrl-O sidebar  ·  Tab complete  ·  ↑ history  ·  F1 hint  ·  Enter run
@@ -1,6 +1,6 @@
 ---
 source: src/ui.rs
-assertion_line: 3457
+assertion_line: 3460
 expression: snapshot
 ---
 ╭ Output ────────────────────────────────────────────────────────────────────────────────╮
@@ -28,4 +28,4 @@ expression: snapshot
 │                                                                                        │
 ╰────────────────────────────────────────────────────────────────────────────────────────╯
 Project: Term Planner                                                                     
-Ctrl-O sidebar  ·  Tab complete  ·  ↑ history  ·  Enter run
+Ctrl-O sidebar  ·  Tab complete  ·  ↑ history  ·  F1 hint  ·  Enter run
@@ -1,6 +1,6 @@
 ---
 source: src/ui.rs
-assertion_line: 2880
+assertion_line: 2882
 expression: snapshot
 ---
 ╭ Output ──────────────────────────────────────────────────────────────────────╮
@@ -26,4 +26,4 @@ expression: snapshot
 │insert into <Table> [(<col>[, ...])] [values] (<value>[, ...])                │
 ╰──────────────────────────────────────────────────────────────────────────────╯
 Project: Term Planner                                                           
-Esc clear  ·  Ctrl-A/E home/end  ·  Ctrl-W del word  ·  Enter run
+F1 hint  ·  Esc clear  ·  Ctrl-A/E home/end  ·  Ctrl-W del word  ·  Enter run
--- a/Show More
+++ b/Show More