ci(ops): fmt and clippy are enforced again

.github/workflows/source-gates.yml

@@ -77,6 +77,11 @@ jobs:
           shared-key: xtask
           save-if: ${{ github.ref == 'refs/heads/main' }}
 
+      # Free here: rustfmt needs no crate to compile, so it rides the one job
+      # that already has a toolchain and no engine build dependencies.
+      - name: cargo fmt --all --check
+        run: cargo fmt --all --check
+
       - name: cargo xtask check-all-source-gates
         run: cargo run --locked -q -p xtask -- check-all-source-gates
 

.github/workflows/test.yml

@@ -90,6 +90,25 @@ jobs:
       # cite was never pinned to a specific test; the one flake since diagnosed
       # is the pubsub subscribe race, fixed in #1873. What is known to remain is
       # a DRM-probe hang, a rare SIGABRT, and fd-capture flakes.
+      # Here rather than in source-gates.yml because clippy has to compile the
+      # workspace, and this is the job that already carries the engine's build
+      # dependencies and its warm dependency cache. Default targets only: a
+      # test's `println!` is a test's business, matching the exemption
+      # `xtask lint-logging` already makes for `tests` directories.
+      #
+      # Before this step existed no workflow ran clippy at all — `docs/logging.md`
+      # claimed it did, and an `eprintln!` in each of two adapter test helpers
+      # sat behind that claim unnoticed.
+      # `--exclude streamlib-adapter-skia`: `skia-bindings` 404s on its prebuilt
+      # download here and then needs FreeType headers to build from source, and
+      # no CI job has ever built that crate — every other cargo invocation in
+      # this repo is `-p`-scoped, so this clippy step is the first `--workspace`
+      # anything. Making CI build Skia is a real cost and its own decision; the
+      # exclusion keeps the existing coverage boundary rather than moving it
+      # silently. Consequence worth knowing: that adapter is linted by nothing.
+      - name: cargo clippy (workspace, default targets)
+        run: cargo clippy --locked --workspace --exclude streamlib-adapter-skia --no-deps
+
       - name: Run unit tests
         run: |
           cargo test --locked -p streamlib -p streamlib-macros --lib

adapters/streamlib-adapter-opengl/tests/bin/opengl_adapter_subprocess_helper.rs

@@ -37,6 +37,15 @@ struct HelperResponse {
     note: String,
 }
 
+// A test fixture the harness spawns and reads stderr from, with no tracing
+// subscriber installed — `tracing::error!` here would go nowhere, so stderr is
+// the mechanism rather than a lapse. `xtask lint-logging` already exempts this
+// file by its `tests/` path; the allow is what makes clippy agree, now that
+// clippy runs in CI.
+#[allow(
+    clippy::disallowed_macros,
+    reason = "no subscriber exists in a spawned test helper; stderr is what the harness reads"
+)]
 fn die(socket: Option<&UnixStream>, msg: String) -> ExitCode {
     eprintln!("[opengl-helper] FATAL: {msg}");
     if let Some(s) = socket {

adapters/streamlib-adapter-skia/tests/bin/skia_adapter_subprocess_helper.rs

@@ -51,6 +51,16 @@ struct HelperResponse {
     note: String,
 }
 
+// A test fixture the harness spawns and reads stderr from, with no tracing
+// subscriber installed — `tracing::error!` here would go nowhere, so stderr is
+// the mechanism rather than a lapse. `xtask lint-logging` already exempts this
+// file by its `tests/` path; the allow is what makes clippy agree, now that
+// clippy runs in CI. Scoped to the two functions that write, so a `println!`
+// added anywhere else here is still caught.
+#[allow(
+    clippy::disallowed_macros,
+    reason = "no subscriber exists in a spawned test helper; stderr is what the harness reads"
+)]
 fn die(socket: Option<&UnixStream>, msg: String) -> ExitCode {
     eprintln!("[skia-helper] FATAL: {msg}");
     if let Some(s) = socket {
@@ -168,6 +178,16 @@ fn run() -> ExitCode {
 /// in the relevant sense — the host has work in flight that the
 /// subprocess never got around to draining, and the host's per-surface
 /// state must still survive the SIGKILL that follows.
+// A test fixture the harness spawns and reads stderr from, with no tracing
+// subscriber installed — `tracing::error!` here would go nowhere, so stderr is
+// the mechanism rather than a lapse. `xtask lint-logging` already exempts this
+// file by its `tests/` path; the allow is what makes clippy agree, now that
+// clippy runs in CI. Scoped to the two functions that write, so a `println!`
+// added anywhere else here is still caught.
+#[allow(
+    clippy::disallowed_macros,
+    reason = "no subscriber exists in a spawned test helper; stderr is what the harness reads"
+)]
 fn crash_mid_skia_write(skia_ctx: &SkiaGlContext, width: u32, height: u32) -> ExitCode {
     let surface_descriptor = StreamlibSurface::new(
         HELPER_SURFACE_ID,

docs/logging.md

@@ -28,10 +28,15 @@ Use the API above instead.
    opt in via `[lints] workspace = true` in `Cargo.toml`. `cargo clippy
    --workspace` fails on any violation.
 
-2. **CI lint (Python)** — `cargo xtask lint-logging` scans
-   `sdk/streamlib-python-wheel/python/**/*.py` for banned substrings
-   (`print(`, `sys.stdout`, `sys.stderr`, `logging.basicConfig`). Exits
-   non-zero with each offending file+line on failure.
+2. **AST walk (Rust + Python)** — `cargo xtask lint-logging`. On Python it
+   scans `sdk/streamlib-python-wheel/python/**/*.py` for banned substrings
+   (`print(`, `sys.stdout`, `sys.stderr`, `logging.basicConfig`). On Rust it
+   parses rather than greps, so `#[cfg(test)]` and
+   `#[allow(clippy::disallowed_macros)]` are honoured, and it skips `tests`
+   directories outright. That last exemption is why it and clippy can disagree
+   about the same file: a `[[bin]]` whose `path` points into `tests/` is a
+   default target to clippy and an exempt path to this walk. Exits non-zero
+   with each offending file+line on failure.
 
 3. **Runtime capture** — the Rust host captures a helper process's fd2 at
    the process level for anything the static layers can't see
@@ -44,9 +49,23 @@ the grounds of redundancy.
 
 ## CI
 
-Both checks run on every PR and push to `main` via
-`.github/workflows/lint-logging.yml`. A PR is merge-blocked until both jobs
-are green.
+`cargo xtask lint-logging` runs in `source-gates.yml`, as one of the
+consolidated source-walking gates. `cargo clippy --locked --workspace
+--no-deps` runs in `test.yml`'s Linux job, which already carries the engine's
+build dependencies; default targets only, so a test's `println!` stays a test's
+business, matching layer 2's exemption. `cargo fmt --all --check` runs in
+`source-gates.yml` beside the walks.
+
+`cargo xtask run-local-ci-gates` runs the two static layers before you push.
+Layer 3 is a property of the running host, not a gate, so nothing runs it
+ahead of time.
+
+> ~~Both checks run on every PR and push to `main` via
+> `.github/workflows/lint-logging.yml`.~~ — Superseded 2026-08-16. That
+> workflow was retired when PR #1857 consolidated 13 jobs into 6, and for a
+> while afterwards nothing ran `cargo clippy` or `cargo fmt` at all: the claim
+> above described enforcement that had stopped existing, and an `eprintln!` in
+> each of two adapter test helpers sat unnoticed behind it.
 
 ## Exceptions — how to add one when you really need it
 

xtask/src/main.rs

@@ -176,6 +176,25 @@ fn run_local_ci_gates(workspace_root: &Path) -> Result<()> {
     }
 
     let shelled_out_gates: &[(&str, &str, &[&str])] = &[
+        ("rustfmt", "cargo", &["fmt", "--all", "--check"]),
+        // Default targets only. A test's `println!` is a test's business —
+        // `lint-logging` exempts `tests` directories, and `--all-targets` here
+        // would deny what that walk deliberately allows.
+        // Same exclusion as CI so this really does mirror it: `skia-bindings`
+        // cannot build on a runner, and a local gate that lints more than CI
+        // does is a gate whose result nobody can act on.
+        (
+            "clippy",
+            "cargo",
+            &[
+                "clippy",
+                "--locked",
+                "--workspace",
+                "--exclude",
+                "streamlib-adapter-skia",
+                "--no-deps",
+            ],
+        ),
         (
             "license headers",
             "bash",