diff --git a/crates/manager-core/src/auth_middleware.rs b/crates/manager-core/src/auth_middleware.rs
index 459bf6e..b0f1ea3 100644
--- a/crates/manager-core/src/auth_middleware.rs
+++ b/crates/manager-core/src/auth_middleware.rs
@@ -53,6 +53,11 @@ pub struct PrincipalCache {
 /// adjacent requests on a hot key.
 const PRINCIPAL_CACHE_TTL: Duration = Duration::from_secs(60);
 
+/// F-S-006: maximum candidate API keys we'll Argon2-verify per
+/// request. Hoisted to module scope so clippy::items_after_statements
+/// is happy.
+const MAX_API_KEY_CANDIDATES: usize = 16;
+
 impl PrincipalCache {
     #[must_use]
     pub fn new() -> Self {
@@ -277,7 +282,6 @@ async fn verify_api_key(state: &AuthState, rest: &str) -> Result<Option<Principa
     // many keys against one indexed prefix could amplify each public
     // bearer-tagged request into M×Argon2 verifies. Cap at MAX and
     // log the truncation so operators can spot it.
-    const MAX_API_KEY_CANDIDATES: usize = 16;
     if candidates.len() > MAX_API_KEY_CANDIDATES {
         tracing::warn!(
             prefix,
diff --git a/crates/manager-core/src/dispatcher.rs b/crates/manager-core/src/dispatcher.rs
index 6e4b29a..2f873d2 100644
--- a/crates/manager-core/src/dispatcher.rs
+++ b/crates/manager-core/src/dispatcher.rs
@@ -311,7 +311,12 @@ impl Dispatcher {
         };
         let outcome = self
             .executor
-            .execute_with_identity(identity, &script.source, exec_req, async_exec_timeout_from_env())
+            .execute_with_identity(
+                identity,
+                &script.source,
+                exec_req,
+                async_exec_timeout_from_env(),
+            )
             .await;
         drop(permit);
 
diff --git a/crates/manager-core/src/users_service.rs b/crates/manager-core/src/users_service.rs
index 62e37bc..9dca170 100644
--- a/crates/manager-core/src/users_service.rs
+++ b/crates/manager-core/src/users_service.rs
@@ -587,7 +587,10 @@ impl UsersService for UsersServiceImpl {
             .collect();
         Ok(UsersListPage {
             items,
-            next_cursor: page.next_cursor.as_ref().map(|c| c.encode()),
+            next_cursor: page
+                .next_cursor
+                .as_ref()
+                .map(crate::app_user_repo::ListCursor::encode),
         })
     }
 
diff --git a/crates/picloud/src/lib.rs b/crates/picloud/src/lib.rs
index 6aded7e..8e7ab45 100644
--- a/crates/picloud/src/lib.rs
+++ b/crates/picloud/src/lib.rs
@@ -362,8 +362,7 @@ pub async fn build_app(
     // Dispatcher — single tokio task that polls the outbox and routes
     // due rows to the executor. Shares the `ExecutionGate` with sync
     // HTTP per design notes §2 (one cap for everything).
-    let dispatcher_script_repo: Arc<dyn ScriptRepository> =
-        script_repo.clone();
+    let dispatcher_script_repo: Arc<dyn ScriptRepository> = script_repo.clone();
     let principals: Arc<dyn PrincipalResolver> =
         Arc::new(AdminPrincipalResolver::new(auth.users.clone()));
     // The InboxRegistry is constructed once and shared between the
diff --git a/crates/shared/src/crypto.rs b/crates/shared/src/crypto.rs
index cb03cce..267b330 100644
--- a/crates/shared/src/crypto.rs
+++ b/crates/shared/src/crypto.rs
@@ -207,7 +207,7 @@ impl MasterKey {
         let dev_ack = std::env::var("PICLOUD_DEV_INSECURE_KEY")
             .map(|v| v == "i-understand-this-is-insecure")
             .unwrap_or(false);
-        if dev_mode && secret.as_deref().map(str::trim).unwrap_or("").is_empty() && !dev_ack {
+        if dev_mode && secret.as_deref().map_or("", str::trim).is_empty() && !dev_ack {
             return Err(MasterKeyError::DevModeUnacknowledged);
         }
         Self::resolve(secret.as_deref(), dev_mode)