Make the build pass again: formatting, a lint, and two broken tests

Cargo.toml

@@ -40,3 +40,12 @@ rust-version = "1.85"
 [workspace.lints.rust]
 unsafe_code = "forbid"
 unexpected_cfgs = { level = "warn", check-cfg = ["cfg(fuzzing)"] }
+
+# makepad's own workspace carries this and we build the same crate, so without
+# it `cargo test -p makepad-script` differs from upstream's. makepad-stitch is a
+# WebAssembly interpreter; unoptimised its frames are large enough that one
+# chunk of a batched math expression (5461 points for a vec3) overflows a test
+# thread's stack, and math_aot's batch test aborts. Raising the stack does not
+# help, because the depth follows the point count.
+[profile.test.package.makepad-stitch]
+opt-level = 1

crates/octoscript-capabilities/src/durable_audits.rs

@@ -10,10 +10,10 @@ use std::collections::VecDeque;
 use std::fmt::{self, Display, Formatter};
 use std::num::{NonZeroU64, NonZeroUsize};
 
-use serde::{Deserialize, Serialize};
 use octoscript_storage::{
     AuthenticatedStore, AuthenticatedStoreError, RollbackProtectedStore, StorageRecordKey,
 };
+use serde::{Deserialize, Serialize};
 
 use crate::{
     is_valid_tool_name, AuditEvent, AuditEventBatch, AuditEventValidationError, AuditOutcome,

crates/octoscript-capabilities/src/http_endpoint_catalog.rs

@@ -17,9 +17,9 @@ use std::io::Read;
 use std::str::FromStr;
 use std::time::Duration;
 
-use serde_json::json;
 #[cfg(all(feature = "linux-network-broker", target_os = "linux"))]
 use octoscript_protocol::NetworkOriginAccess;
+use serde_json::json;
 use ureq::{
     http::{
         header::{HeaderName, HeaderValue},

crates/octoscript-capabilities/src/lib.rs

@@ -21,8 +21,6 @@ use makepad_script::{
     LiveId, ScriptHandle, ScriptHandleGc, ScriptHandleType, ScriptIp, ScriptStringSink,
     ScriptThreadId, ScriptValue, NIL,
 };
-use serde::{de::DeserializeOwned, Deserialize, Serialize};
-pub use serde_json::{json, Value as JsonValue};
 use octoscript_core::{
     decode_bounded_script_json, encode_bounded_script_json, imported_module_call_hint_report_named,
     is_canonical_identifier, vm, Evaluation, ExecutionLimits, Runtime, RuntimeError,
@@ -40,6 +38,8 @@ pub use octoscript_protocol::{
 };
 use octoscript_protocol::{EnvelopeFormat, SessionAuthorizer};
 pub use octoscript_schema::{JsonSchema, SchemaError};
+use serde::{de::DeserializeOwned, Deserialize, Serialize};
+pub use serde_json::{json, Value as JsonValue};
 
 /// Host-enforced deadline and termination wrapper for worker transports.
 ///

crates/octoscript-capabilities/src/linux_network_broker.rs

@@ -19,8 +19,8 @@ use std::sync::Arc;
 use std::thread::{self, JoinHandle};
 use std::time::Duration;
 
-use serde::{Deserialize, Serialize};
 use octoscript_protocol::{CapabilityGrant, NetworkOriginAccess, ResourceKind};
+use serde::{Deserialize, Serialize};
 
 use crate::http_endpoint_catalog::{
     HttpEndpointCatalog, HttpEndpointCatalogError, HttpEndpointSecretResolver, HttpOriginCatalog,
@@ -753,8 +753,8 @@ mod tests {
     use std::sync::mpsc;
     use std::thread;
 
-    use serde_json::json;
     use octoscript_protocol::{CapabilityManifest, ResourceSelector};
+    use serde_json::json;
 
     use super::*;
     use crate::http_endpoint_catalog::{
@@ -766,8 +766,11 @@ mod tests {
     impl TestDirectory {
         fn new() -> Self {
             static NEXT: AtomicUsize = AtomicUsize::new(0);
+            // The broker appends `.octoscript-network-<32 hex>/broker.sock`, 64
+            // bytes, and a Unix socket path cannot reach SUN_LEN (108). The old
+            // name spent 48 bytes here and the bind failed on every run.
             let path = std::env::temp_dir().join(format!(
-                "octoscript-linux-network-broker-test-{}-{}",
+                "octoscript-nb-{}-{}",
                 std::process::id(),
                 NEXT.fetch_add(1, Ordering::Relaxed)
             ));

crates/octoscript-capabilities/src/mobile.rs

@@ -16,11 +16,11 @@
 
 use std::num::NonZeroUsize;
 
-use serde::{de::DeserializeOwned, Serialize};
 use octoscript_core::{
     vm::ScriptValue, Evaluation, ExecutionLimits, RuntimeError, DEFAULT_MAX_JSON_DATA_BYTES,
     DEFAULT_MAX_JSON_DATA_DEPTH,
 };
+use serde::{de::DeserializeOwned, Serialize};
 
 use crate::{
     fixed_file_catalog::FixedFileCatalog, CapabilityCatalogLimits, CapabilityModule,

crates/octoscript-capabilities/src/platform_keyring_secret_resolver.rs

@@ -396,7 +396,8 @@ mod tests {
     #[test]
     fn entries_reject_invalid_opaque_ids_and_credential_locators() {
         assert_eq!(
-            PlatformKeyringSecretEntry::new("bad/id", "com.example.octoscript", "release").unwrap_err(),
+            PlatformKeyringSecretEntry::new("bad/id", "com.example.octoscript", "release")
+                .unwrap_err(),
             PlatformKeyringSecretEntryError::InvalidSecretIdentifier
         );
         assert_eq!(
@@ -405,8 +406,12 @@ mod tests {
             PlatformKeyringSecretEntryError::InvalidService
         );
         assert_eq!(
-            PlatformKeyringSecretEntry::new("release.auth", "com.example.octoscript", "Release User")
-                .unwrap_err(),
+            PlatformKeyringSecretEntry::new(
+                "release.auth",
+                "com.example.octoscript",
+                "Release User"
+            )
+            .unwrap_err(),
             PlatformKeyringSecretEntryError::InvalidAccount
         );
     }

crates/octoscript-core/src/lib.rs

@@ -5538,7 +5538,8 @@ mod tests {
             max_syntax_tokens: 6,
             ..ExecutionLimits::default()
         };
-        let report = check_syntax_named("boundary.octoscript", "let value = 1\nvalue", limits).unwrap();
+        let report =
+            check_syntax_named("boundary.octoscript", "let value = 1\nvalue", limits).unwrap();
 
         assert!(report.valid, "{:?}", report.diagnostics);
     }
@@ -5677,7 +5678,8 @@ mod tests {
             ..ExecutionLimits::default()
         };
         let accepted =
-            check_vm_compatibility_named("legacy.octoscript", "var value = (((42)))", limits).unwrap();
+            check_vm_compatibility_named("legacy.octoscript", "var value = (((42)))", limits)
+                .unwrap();
         assert!(accepted.valid, "{:?}", accepted.diagnostics);
 
         let rejected =
@@ -6872,17 +6874,24 @@ compute(outer, 2)
     fn canonical_profile_rejects_bare_carriage_returns_before_vm_preflight() {
         let source = "true\r[]";
 
-        let canonical =
-            check_syntax_named("line-endings.octoscript", source, ExecutionLimits::default()).unwrap();
+        let canonical = check_syntax_named(
+            "line-endings.octoscript",
+            source,
+            ExecutionLimits::default(),
+        )
+        .unwrap();
         assert!(!canonical.valid);
         assert_eq!(canonical.diagnostics.len(), 1);
         assert!(canonical.diagnostics[0]
             .message
             .contains("bare carriage returns are not supported"));
 
-        let compatibility =
-            check_vm_compatibility_named("line-endings.octoscript", source, ExecutionLimits::default())
-                .unwrap();
+        let compatibility = check_vm_compatibility_named(
+            "line-endings.octoscript",
+            source,
+            ExecutionLimits::default(),
+        )
+        .unwrap();
         assert!(!compatibility.valid);
     }
 
@@ -6905,8 +6914,12 @@ compute(outer, 2)
     #[test]
     fn canonical_profile_rejects_adjacent_numeric_field_access() {
         let source = "(5.ci)";
-        let profile =
-            check_syntax_named("numeric-field.octoscript", source, ExecutionLimits::default()).unwrap();
+        let profile = check_syntax_named(
+            "numeric-field.octoscript",
+            source,
+            ExecutionLimits::default(),
+        )
+        .unwrap();
         let compatibility = check_vm_compatibility_named(
             "numeric-field.octoscript",
             source,
@@ -7199,7 +7212,8 @@ compute(outer, 2)
         let accepted = check_syntax_named("nesting.octoscript", "let value = (0)", limits).unwrap();
         assert!(accepted.valid, "{:?}", accepted.diagnostics);
 
-        let rejected = check_syntax_named("nesting.octoscript", "let value = ((0))", limits).unwrap();
+        let rejected =
+            check_syntax_named("nesting.octoscript", "let value = ((0))", limits).unwrap();
         assert!(!rejected.valid);
         assert!(rejected.diagnostics.iter().any(|diagnostic| {
             diagnostic
@@ -9560,7 +9574,9 @@ compute(outer, 2)
     fn preserves_the_llm_workflow_language_fixture() {
         let mut runtime = Runtime::default();
         let report = runtime
-            .eval(include_str!("../tests/fixtures/workflow_language.octoscript"))
+            .eval(include_str!(
+                "../tests/fixtures/workflow_language.octoscript"
+            ))
             .unwrap();
 
         assert!(report.succeeded(), "{:?}", report.diagnostics);

crates/octoscript-core/tests/language_regressions.rs

@@ -1,6 +1,6 @@
 //! Reproductions from the September 2026 language review (#9–#18).
-use serde_json::{json, Value};
 use octoscript_core::{ExecutionLimits, Runtime, RuntimeError, RuntimeJsonError};
+use serde_json::{json, Value};
 
 fn evaluate(source: &str) -> Value {
     let mut runtime = Runtime::default();