Merge branch 'maint'

# Conflicts:
#	src/bin/fips.rs
#	src/bin/fipstop/app.rs
#	src/config/mod.rs
#	src/config/node.rs
#	src/config/transport.rs
#	src/mmp/receiver.rs
#	src/mmp/sender.rs
#	src/node/handlers/handshake.rs
#	src/node/handlers/rekey.rs
#	src/node/lifecycle.rs
#	src/node/mod.rs
#	src/transport/ethernet/socket.rs
#	src/transport/mod.rs
#	src/upper/tun.rs

src/node/bloom.rs

@@ -3,9 +3,9 @@
 //! Handles building, sending, and receiving FilterAnnounce messages,
 //! including debounced propagation to peers.
 
+use crate::NodeAddr;
 use crate::bloom::BloomFilter;
 use crate::protocol::FilterAnnounce;
-use crate::NodeAddr;
 
 use super::{Node, NodeError};
 use std::collections::HashMap;

src/node/discovery_rate_limit.rs

@@ -81,11 +81,7 @@ impl DiscoveryBackoff {
     /// window using exponential backoff.
     pub fn record_failure(&mut self, target: &NodeAddr) {
         let now = Instant::now();
-        let failures = self
-            .entries
-            .get(target)
-            .map_or(0, |e| e.failures)
-            + 1;
+        let failures = self.entries.get(target).map_or(0, |e| e.failures) + 1;
 
         let backoff_secs = self
             .base
@@ -345,8 +341,7 @@ mod tests {
 
     #[test]
     fn test_forward_allowed_after_interval() {
-        let mut limiter =
-            DiscoveryForwardRateLimiter::with_interval(Duration::from_millis(100));
+        let mut limiter = DiscoveryForwardRateLimiter::with_interval(Duration::from_millis(100));
         assert!(limiter.should_forward(&addr(1)));
 
         thread::sleep(Duration::from_millis(110));

src/node/handlers/discovery.rs

@@ -20,11 +20,7 @@ impl Node {
     /// 4. Lazy purge expired entries
     /// 5. If we're the target, generate and send response
     /// 6. If TTL > 0, forward to tree peers whose bloom filter matches
-    pub(in crate::node) async fn handle_lookup_request(
-        &mut self,
-        from: &NodeAddr,
-        payload: &[u8],
-    ) {
+    pub(in crate::node) async fn handle_lookup_request(&mut self, from: &NodeAddr, payload: &[u8]) {
         self.stats_mut().discovery.req_received += 1;
 
         let request = match LookupRequest::decode(payload) {
@@ -52,10 +48,8 @@ impl Node {
         }
 
         // Record for reverse-path forwarding and dedup
-        self.recent_requests.insert(
-            request.request_id,
-            RecentRequest::new(*from, now_ms),
-        );
+        self.recent_requests
+            .insert(request.request_id, RecentRequest::new(*from, now_ms));
 
         // Lazy purge expired entries
         self.purge_expired_requests(now_ms);
@@ -76,7 +70,10 @@ impl Node {
         if request.can_forward() {
             // Transit-side rate limit: collapse rapid-fire lookups for the
             // same target from misbehaving nodes generating fresh request_ids.
-            if !self.discovery_forward_limiter.should_forward(&request.target) {
+            if !self
+                .discovery_forward_limiter
+                .should_forward(&request.target)
+            {
                 self.stats_mut().discovery.req_forward_rate_limited += 1;
                 debug!(
                     request_id = request.request_id,
@@ -192,11 +189,8 @@ impl Node {
             // Verify the proof signature
             let (xonly, _parity) = target_pubkey.x_only_public_key();
             let peer_id = PeerIdentity::from_pubkey(xonly);
-            let proof_data = LookupResponse::proof_bytes(
-                response.request_id,
-                &target,
-                &response.target_coords,
-            );
+            let proof_data =
+                LookupResponse::proof_bytes(response.request_id, &target, &response.target_coords);
             if !peer_id.verify(&proof_data, &response.proof) {
                 self.stats_mut().discovery.resp_proof_failed += 1;
                 warn!(
@@ -220,12 +214,8 @@ impl Node {
                 "Discovery succeeded, proof verified, route cached"
             );
 
-            self.coord_cache.insert_with_path_mtu(
-                target,
-                response.target_coords,
-                now_ms,
-                path_mtu,
-            );
+            self.coord_cache
+                .insert_with_path_mtu(target, response.target_coords, now_ms, path_mtu);
 
             // Clean up pending lookup tracking
             self.pending_lookups.remove(&target);
@@ -262,15 +252,11 @@ impl Node {
         let our_coords = self.tree_state().my_coords().clone();
 
         // Sign proof: Identity::sign hashes with SHA-256 internally
-        let proof_data = LookupResponse::proof_bytes(request.request_id, &request.target, &our_coords);
+        let proof_data =
+            LookupResponse::proof_bytes(request.request_id, &request.target, &our_coords);
         let proof = self.identity().sign(&proof_data);
 
-        let response = LookupResponse::new(
-            request.request_id,
-            request.target,
-            our_coords,
-            proof,
-        );
+        let response = LookupResponse::new(request.request_id, request.target, our_coords, proof);
 
         // Route toward origin via reverse path.
         let next_hop_addr = if let Some(recent) = self.recent_requests.get(&request.request_id) {
@@ -297,7 +283,10 @@ impl Node {
         );
 
         let encoded = response.encode();
-        if let Err(e) = self.send_encrypted_link_message(&next_hop_addr, &encoded).await {
+        if let Err(e) = self
+            .send_encrypted_link_message(&next_hop_addr, &encoded)
+            .await
+        {
             debug!(
                 next_hop = %self.peer_display_name(&next_hop_addr),
                 error = %e,
@@ -324,9 +313,7 @@ impl Node {
         let forward_to: Vec<NodeAddr> = self
             .peers
             .iter()
-            .filter(|(addr, peer)| {
-                self.is_tree_peer(addr) && peer.may_reach(&request.target)
-            })
+            .filter(|(addr, peer)| self.is_tree_peer(addr) && peer.may_reach(&request.target))
             .map(|(addr, _)| *addr)
             .collect();
 
@@ -335,9 +322,7 @@ impl Node {
             let fallback: Vec<NodeAddr> = self
                 .peers
                 .iter()
-                .filter(|(addr, peer)| {
-                    !self.is_tree_peer(addr) && peer.may_reach(&request.target)
-                })
+                .filter(|(addr, peer)| !self.is_tree_peer(addr) && peer.may_reach(&request.target))
                 .map(|(addr, _)| *addr)
                 .collect();
             if fallback.is_empty() {
@@ -402,9 +387,7 @@ impl Node {
         let peer_addrs: Vec<NodeAddr> = self
             .peers
             .iter()
-            .filter(|(addr, peer)| {
-                self.is_tree_peer(addr) && peer.may_reach(target)
-            })
+            .filter(|(addr, peer)| self.is_tree_peer(addr) && peer.may_reach(target))
             .map(|(addr, _)| *addr)
             .collect();
 
@@ -488,7 +471,8 @@ impl Node {
             return;
         }
 
-        self.pending_lookups.insert(*dest, PendingLookup::new(now_ms));
+        self.pending_lookups
+            .insert(*dest, PendingLookup::new(now_ms));
         let ttl = self.config.node.discovery.ttl;
         let sent = self.initiate_lookup(dest, ttl).await;
 

src/node/handlers/dispatch.rs

@@ -1,14 +1,19 @@
 //! Link message dispatch and peer removal.
 
-use crate::node::Node;
 use crate::NodeAddr;
+use crate::node::Node;
 use tracing::{debug, info, trace};
 
 impl Node {
     /// Dispatch a decrypted link message to the appropriate handler.
     ///
     /// Link messages are protocol messages exchanged between authenticated peers.
-    pub(in crate::node) async fn dispatch_link_message(&mut self, from: &NodeAddr, plaintext: &[u8], ce_flag: bool) {
+    pub(in crate::node) async fn dispatch_link_message(
+        &mut self,
+        from: &NodeAddr,
+        plaintext: &[u8],
+        ce_flag: bool,
+    ) {
         if plaintext.is_empty() {
             return;
         }
@@ -109,7 +114,9 @@ impl Node {
         }
 
         // MMP teardown log (before we drop the peer)
-        let peer_name = self.peer_aliases.get(node_addr)
+        let peer_name = self
+            .peer_aliases
+            .get(node_addr)
             .cloned()
             .unwrap_or_else(|| peer.identity().short_npub());
         if let Some(mmp) = peer.mmp() {

src/node/handlers/encrypted.rs

@@ -1,8 +1,8 @@
 //! Encrypted frame handling (hot path).
 
-use crate::noise::NoiseError;
 use crate::node::Node;
-use crate::node::wire::{EncryptedHeader, strip_inner_header, FLAG_CE, FLAG_KEY_EPOCH, FLAG_SP};
+use crate::node::wire::{EncryptedHeader, FLAG_CE, FLAG_KEY_EPOCH, FLAG_SP, strip_inner_header};
+use crate::noise::NoiseError;
 use crate::transport::ReceivedPacket;
 use std::time::Instant;
 use tracing::{debug, info, trace, warn};
@@ -53,8 +53,8 @@ impl Node {
         // Check and perform cutover in a scoped borrow.
         {
             let peer = self.peers.get(&node_addr).unwrap();
-            let k_bit_flipped = received_k_bit != peer.current_k_bit()
-                && peer.pending_new_session().is_some();
+            let k_bit_flipped =
+                received_k_bit != peer.current_k_bit() && peer.pending_new_session().is_some();
 
             if k_bit_flipped {
                 let display_name = self.peer_display_name(&node_addr);
@@ -70,9 +70,10 @@ impl Node {
                     debug_assert!(
                         peer.transport_id().is_some()
                             && peer.our_index().is_some()
-                            && self.peers_by_index.contains_key(
-                                &(peer.transport_id().unwrap(), peer.our_index().unwrap().as_u32())
-                            ),
+                            && self.peers_by_index.contains_key(&(
+                                peer.transport_id().unwrap(),
+                                peer.our_index().unwrap().as_u32()
+                            )),
                         "peers_by_index should contain pre-registered new index after K-bit flip"
                     );
                 }
@@ -162,12 +163,14 @@ impl Node {
                 let _spin_rtt = mmp.spin_bit.rx_observe(sp_flag, header.counter, now);
             }
             peer.set_current_addr(packet.transport_id, packet.remote_addr.clone());
-            peer.link_stats_mut().record_recv(packet.data.len(), packet.timestamp_ms);
+            peer.link_stats_mut()
+                .record_recv(packet.data.len(), packet.timestamp_ms);
             peer.touch(packet.timestamp_ms);
         }
 
         // Dispatch to link message handler
-        self.dispatch_link_message(&node_addr, link_message, ce_flag).await;
+        self.dispatch_link_message(&node_addr, link_message, ce_flag)
+            .await;
     }
 
     /// Log a decryption failure with replay suppression.

src/node/handlers/forwarding.rs

@@ -5,15 +5,15 @@
 //! plaintext session-layer headers, routes to the next hop or delivers
 //! locally, and generates error signals on routing failure.
 
-use crate::node::{Node, NodeError};
+use crate::NodeAddr;
 use crate::node::session_wire::{
-    parse_encrypted_coords, FspCommonPrefix, FSP_COMMON_PREFIX_SIZE, FSP_HEADER_SIZE,
-    FSP_PHASE_ESTABLISHED, FSP_PHASE_MSG1, FSP_PHASE_MSG2,
+    FSP_COMMON_PREFIX_SIZE, FSP_HEADER_SIZE, FSP_PHASE_ESTABLISHED, FSP_PHASE_MSG1, FSP_PHASE_MSG2,
+    FspCommonPrefix, parse_encrypted_coords,
 };
+use crate::node::{Node, NodeError};
 use crate::protocol::{
     CoordsRequired, MtuExceeded, PathBroken, SessionAck, SessionDatagram, SessionSetup,
 };
-use crate::NodeAddr;
 use std::time::{Duration, Instant};
 use tracing::{debug, warn};
 
@@ -22,13 +22,20 @@ impl Node {
     ///
     /// Called by `dispatch_link_message` for msg_type 0x00. The payload
     /// has already had its msg_type byte stripped by dispatch.
-    pub(in crate::node) async fn handle_session_datagram(&mut self, _from: &NodeAddr, payload: &[u8], incoming_ce: bool) {
+    pub(in crate::node) async fn handle_session_datagram(
+        &mut self,
+        _from: &NodeAddr,
+        payload: &[u8],
+        incoming_ce: bool,
+    ) {
         self.stats_mut().forwarding.record_received(payload.len());
 
         let mut datagram = match SessionDatagram::decode(payload) {
             Ok(dg) => dg,
             Err(e) => {
-                self.stats_mut().forwarding.record_decode_error(payload.len());
+                self.stats_mut()
+                    .forwarding
+                    .record_decode_error(payload.len());
                 debug!(error = %e, "Malformed SessionDatagram");
                 return;
             }
@@ -36,7 +43,9 @@ impl Node {
 
         // TTL enforcement: decrement and drop if exhausted
         if !datagram.decrement_ttl() {
-            self.stats_mut().forwarding.record_ttl_exhausted(payload.len());
+            self.stats_mut()
+                .forwarding
+                .record_ttl_exhausted(payload.len());
             debug!(
                 src = %datagram.src_addr,
                 dest = %datagram.dest_addr,
@@ -51,8 +60,13 @@ impl Node {
         // Local delivery: dispatch to session layer handlers
         if datagram.dest_addr == *self.node_addr() {
             self.stats_mut().forwarding.record_delivered(payload.len());
-            self.handle_session_payload(&datagram.src_addr, &datagram.payload, datagram.path_mtu, incoming_ce)
-                .await;
+            self.handle_session_payload(
+                &datagram.src_addr,
+                &datagram.payload,
+                datagram.path_mtu,
+                incoming_ce,
+            )
+            .await;
             return;
         }
 
@@ -60,7 +74,9 @@ impl Node {
         let next_hop_addr = match self.find_next_hop(&datagram.dest_addr) {
             Some(peer) => *peer.node_addr(),
             None => {
-                self.stats_mut().forwarding.record_drop_no_route(payload.len());
+                self.stats_mut()
+                    .forwarding
+                    .record_drop_no_route(payload.len());
                 self.send_routing_error(&datagram).await;
                 return;
             }
@@ -84,7 +100,8 @@ impl Node {
         if local_congestion {
             self.stats_mut().congestion.record_congestion_detected();
             let now = Instant::now();
-            let should_log = self.last_congestion_log
+            let should_log = self
+                .last_congestion_log
                 .map(|t| now.duration_since(t) >= Duration::from_secs(5))
                 .unwrap_or(true);
             if should_log {
@@ -101,11 +118,15 @@ impl Node {
         {
             match e {
                 NodeError::MtuExceeded { mtu, .. } => {
-                    self.stats_mut().forwarding.record_drop_mtu_exceeded(payload.len());
+                    self.stats_mut()
+                        .forwarding
+                        .record_drop_mtu_exceeded(payload.len());
                     self.send_mtu_exceeded_error(&datagram, mtu).await;
                 }
                 _ => {
-                    self.stats_mut().forwarding.record_drop_send_error(payload.len());
+                    self.stats_mut()
+                        .forwarding
+                        .record_drop_send_error(payload.len());
                     debug!(
                         next_hop = %next_hop_addr,
                         dest = %datagram.dest_addr,
@@ -146,54 +167,38 @@ impl Node {
             .unwrap_or(0);
 
         match prefix.phase {
-            FSP_PHASE_MSG1 => {
-                match SessionSetup::decode(inner) {
-                    Ok(setup) => {
-                        self.coord_cache_mut().insert(
-                            datagram.src_addr,
-                            setup.src_coords,
-                            now_ms,
-                        );
-                        self.coord_cache_mut().insert(
-                            datagram.dest_addr,
-                            setup.dest_coords,
-                            now_ms,
-                        );
-                        debug!(
-                            src = %datagram.src_addr,
-                            dest = %datagram.dest_addr,
-                            "Cached coords from SessionSetup"
-                        );
-                    }
-                    Err(e) => {
-                        debug!(error = %e, "Failed to decode SessionSetup for cache warming");
-                    }
+            FSP_PHASE_MSG1 => match SessionSetup::decode(inner) {
+                Ok(setup) => {
+                    self.coord_cache_mut()
+                        .insert(datagram.src_addr, setup.src_coords, now_ms);
+                    self.coord_cache_mut()
+                        .insert(datagram.dest_addr, setup.dest_coords, now_ms);
+                    debug!(
+                        src = %datagram.src_addr,
+                        dest = %datagram.dest_addr,
+                        "Cached coords from SessionSetup"
+                    );
                 }
-            }
-            FSP_PHASE_MSG2 => {
-                match SessionAck::decode(inner) {
-                    Ok(ack) => {
-                        self.coord_cache_mut().insert(
-                            datagram.src_addr,
-                            ack.src_coords,
-                            now_ms,
-                        );
-                        self.coord_cache_mut().insert(
-                            datagram.dest_addr,
-                            ack.dest_coords,
-                            now_ms,
-                        );
-                        debug!(
-                            src = %datagram.src_addr,
-                            dest = %datagram.dest_addr,
-                            "Cached coords from SessionAck"
-                        );
-                    }
-                    Err(e) => {
-                        debug!(error = %e, "Failed to decode SessionAck for cache warming");
-                    }
+                Err(e) => {
+                    debug!(error = %e, "Failed to decode SessionSetup for cache warming");
                 }
-            }
+            },
+            FSP_PHASE_MSG2 => match SessionAck::decode(inner) {
+                Ok(ack) => {
+                    self.coord_cache_mut()
+                        .insert(datagram.src_addr, ack.src_coords, now_ms);
+                    self.coord_cache_mut()
+                        .insert(datagram.dest_addr, ack.dest_coords, now_ms);
+                    debug!(
+                        src = %datagram.src_addr,
+                        dest = %datagram.dest_addr,
+                        "Cached coords from SessionAck"
+                    );
+                }
+                Err(e) => {
+                    debug!(error = %e, "Failed to decode SessionAck for cache warming");
+                }
+            },
             FSP_PHASE_ESTABLISHED if prefix.has_coords() => {
                 // CP flag set: coords in cleartext between header and ciphertext.
                 // Parse coords from the cleartext section after the 12-byte header.
@@ -203,18 +208,12 @@ impl Node {
                 match parse_encrypted_coords(coord_data) {
                     Ok((src_coords, dest_coords, _bytes_consumed)) => {
                         if let Some(coords) = src_coords {
-                            self.coord_cache_mut().insert(
-                                datagram.src_addr,
-                                coords,
-                                now_ms,
-                            );
+                            self.coord_cache_mut()
+                                .insert(datagram.src_addr, coords, now_ms);
                         }
                         if let Some(coords) = dest_coords {
-                            self.coord_cache_mut().insert(
-                                datagram.dest_addr,
-                                coords,
-                                now_ms,
-                            );
+                            self.coord_cache_mut()
+                                .insert(datagram.dest_addr, coords, now_ms);
                         }
                         debug!(
                             src = %datagram.src_addr,
@@ -243,7 +242,10 @@ impl Node {
     /// No cascading errors.
     async fn send_routing_error(&mut self, original: &SessionDatagram) {
         // Rate limit: one error signal per destination per 100ms
-        if !self.routing_error_rate_limiter.should_send(&original.dest_addr) {
+        if !self
+            .routing_error_rate_limiter
+            .should_send(&original.dest_addr)
+        {
             return;
         }
 
@@ -303,23 +305,18 @@ impl Node {
     /// Called when `send_encrypted_link_message()` fails with
     /// `NodeError::MtuExceeded` during forwarding. The signal tells the
     /// source the bottleneck MTU so it can immediately reduce its path MTU.
-    async fn send_mtu_exceeded_error(
-        &mut self,
-        original: &SessionDatagram,
-        bottleneck_mtu: u16,
-    ) {
+    async fn send_mtu_exceeded_error(&mut self, original: &SessionDatagram, bottleneck_mtu: u16) {
         // Rate limit: reuse routing_error_rate_limiter keyed on dest_addr
-        if !self.routing_error_rate_limiter.should_send(&original.dest_addr) {
+        if !self
+            .routing_error_rate_limiter
+            .should_send(&original.dest_addr)
+        {
             return;
         }
 
         let my_addr = *self.node_addr();
 
-        let error_payload = MtuExceeded::new(
-            original.dest_addr,
-            my_addr,
-            bottleneck_mtu,
-        ).encode();
+        let error_payload = MtuExceeded::new(original.dest_addr, my_addr, bottleneck_mtu).encode();
 
         let error_dg = SessionDatagram::new(my_addr, original.src_addr, error_payload)
             .with_ttl(self.config.node.session.default_ttl);
@@ -403,7 +400,10 @@ impl Node {
         }
         for tid in new_drop_events {
             self.stats_mut().congestion.record_kernel_drop_event();
-            warn!(transport_id = tid.as_u32(), "Kernel recv drops first observed on transport");
+            warn!(
+                transport_id = tid.as_u32(),
+                "Kernel recv drops first observed on transport"
+            );
         }
     }
 }

src/node/handlers/mmp.rs

@@ -4,6 +4,7 @@
 //! periodic report generation on the tick timer, and emits periodic
 //! and teardown metric logs.
 
+use crate::NodeAddr;
 use crate::mmp::MmpMode;
 use crate::mmp::MmpSessionState;
 use crate::mmp::report::{ReceiverReport, SenderReport};
@@ -12,7 +13,6 @@ use crate::protocol::{
     LinkMessageType, PathMtuNotification, SessionMessageType, SessionReceiverReport,
     SessionSenderReport,
 };
-use crate::NodeAddr;
 use std::time::{Duration, Instant};
 use tracing::{debug, info, trace, warn};
 
@@ -72,7 +72,11 @@ impl Node {
     ///
     /// The peer is telling us about what they received from us. We feed
     /// this to our metrics to compute RTT, loss rate, and trend indicators.
-    pub(in crate::node) async fn handle_receiver_report(&mut self, from: &NodeAddr, payload: &[u8]) {
+    pub(in crate::node) async fn handle_receiver_report(
+        &mut self,
+        from: &NodeAddr,
+        payload: &[u8],
+    ) {
         let rr = match ReceiverReport::decode(payload) {
             Ok(rr) => rr,
             Err(e) => {
@@ -101,7 +105,9 @@ impl Node {
         // Process the report: computes RTT from timestamp echo, updates
         // loss rate, goodput rate, jitter trend, and ETX.
         let now = Instant::now();
-        let first_rtt = mmp.metrics.process_receiver_report(&rr, our_timestamp_ms, now);
+        let first_rtt = mmp
+            .metrics
+            .process_receiver_report(&rr, our_timestamp_ms, now);
 
         // Feed SRTT back to sender/receiver report interval tuning
         if let Some(srtt_ms) = mmp.metrics.srtt_ms() {
@@ -114,7 +120,8 @@ impl Node {
         // (what fraction of peer's frames we received), using per-interval deltas.
         let our_recv_packets = mmp.receiver.cumulative_packets_recv();
         let peer_highest = mmp.receiver.highest_counter();
-        mmp.metrics.update_reverse_delivery(our_recv_packets, peer_highest);
+        mmp.metrics
+            .update_reverse_delivery(our_recv_packets, peer_highest);
 
         trace!(
             from = %peer_name,
@@ -128,7 +135,9 @@ impl Node {
         // Trigger re-evaluation so the node doesn't wait for the next
         // periodic tick or TreeAnnounce.
         if first_rtt {
-            let peer_costs: std::collections::HashMap<crate::NodeAddr, f64> = self.peers.iter()
+            let peer_costs: std::collections::HashMap<crate::NodeAddr, f64> = self
+                .peers
+                .iter()
                 .filter(|(_, p)| p.has_srtt())
                 .map(|(a, p)| (*a, p.link_cost()))
                 .collect();
@@ -179,7 +188,9 @@ impl Node {
 
         for (node_addr, peer) in self.peers.iter_mut() {
             // Compute display name before taking mutable MMP borrow
-            let peer_name = self.peer_aliases.get(node_addr)
+            let peer_name = self
+                .peer_aliases
+                .get(node_addr)
                 .cloned()
                 .unwrap_or_else(|| peer.identity().short_npub());
 
@@ -261,7 +272,7 @@ impl Node {
 
         let rtt_str = match m.srtt_ms() {
             Some(rtt) => format!("{:.1}ms", rtt),
-            None => "n/a".to_string()
+            None => "n/a".to_string(),
         };
         let loss_str = format!("{:.1}%", m.loss_rate() * 100.0);
 
@@ -294,7 +305,9 @@ impl Node {
 
         for (dest_addr, entry) in self.sessions.iter_mut() {
             // Compute display name before taking mutable MMP borrow
-            let session_name = self.peer_aliases.get(dest_addr)
+            let session_name = self
+                .peer_aliases
+                .get(dest_addr)
                 .cloned()
                 .unwrap_or_else(|| {
                     let (xonly, _) = entry.remote_pubkey().x_only_public_key();
@@ -362,7 +375,9 @@ impl Node {
                 }
                 Err(e) => {
                     // Peek at current failure count for log suppression
-                    let failures = self.sessions.get(&dest_addr)
+                    let failures = self
+                        .sessions
+                        .get(&dest_addr)
                         .and_then(|entry| entry.mmp())
                         .map(|mmp| mmp.sender.consecutive_send_failures())
                         .unwrap_or(0);
@@ -541,7 +556,10 @@ impl Node {
             if let Some(peer) = self.peers.get_mut(&addr) {
                 peer.mark_heartbeat_sent(now);
             }
-            if let Err(e) = self.send_encrypted_link_message(&addr, &heartbeat_msg).await {
+            if let Err(e) = self
+                .send_encrypted_link_message(&addr, &heartbeat_msg)
+                .await
+            {
                 trace!(peer = %self.peer_display_name(&addr), error = %e, "Failed to send heartbeat");
             }
         }

src/node/handlers/rx_loop.rs

@@ -1,10 +1,12 @@
 //! RX event loop and packet dispatch.
 
-use crate::control::{commands, ControlSocket};
 use crate::control::queries;
+use crate::control::{ControlSocket, commands};
+use crate::node::wire::{
+    COMMON_PREFIX_SIZE, CommonPrefix, FMP_VERSION, PHASE_ESTABLISHED, PHASE_MSG1, PHASE_MSG2,
+};
 use crate::node::{Node, NodeError};
 use crate::transport::ReceivedPacket;
-use crate::node::wire::{CommonPrefix, PHASE_ESTABLISHED, PHASE_MSG1, PHASE_MSG2, FMP_VERSION, COMMON_PREFIX_SIZE};
 use std::time::Duration;
 use tracing::{debug, info, warn};
 
@@ -29,8 +31,7 @@ impl Node {
     /// This method takes ownership of the packet_rx channel and runs
     /// until the channel is closed (typically when stop() is called).
     pub async fn run_rx_loop(&mut self) -> Result<(), NodeError> {
-        let mut packet_rx = self.packet_rx.take()
-            .ok_or(NodeError::NotStarted)?;
+        let mut packet_rx = self.packet_rx.take().ok_or(NodeError::NotStarted)?;
 
         // Take the TUN outbound receiver, or create a dummy channel that never
         // produces messages (when TUN is disabled). Holding the sender prevents
@@ -53,12 +54,12 @@ impl Node {
             }
         };
 
-        let mut tick = tokio::time::interval(Duration::from_secs(self.config.node.tick_interval_secs));
+        let mut tick =
+            tokio::time::interval(Duration::from_secs(self.config.node.tick_interval_secs));
 
         // Set up control socket channel
-        let (control_tx, mut control_rx) = tokio::sync::mpsc::channel::<
-            crate::control::ControlMessage,
-        >(32);
+        let (control_tx, mut control_rx) =
+            tokio::sync::mpsc::channel::<crate::control::ControlMessage>(32);
 
         if self.config.node.control.enabled {
             let config = self.config.node.control.clone();

src/node/handlers/session.rs

@@ -5,25 +5,27 @@
 //! SessionSetup (Noise XK msg1), SessionAck (msg2), SessionMsg3 (msg3),
 //! encrypted data, and error signals (CoordsRequired, PathBroken).
 
-use crate::node::session::{EndToEndState, SessionEntry};
-use crate::node::session_wire::{
-    build_fsp_header, fsp_prepend_inner_header, fsp_strip_inner_header,
-    parse_encrypted_coords, FspCommonPrefix, FspEncryptedHeader, FSP_COMMON_PREFIX_SIZE,
-    FSP_FLAG_CP, FSP_FLAG_K, FSP_HEADER_SIZE, FSP_PHASE_ESTABLISHED, FSP_PHASE_MSG1,
-    FSP_PHASE_MSG2, FSP_PHASE_MSG3, FSP_PORT_HEADER_SIZE, FSP_PORT_IPV6_SHIM,
-};
-use crate::protocol::{coords_wire_size, encode_coords};
-use crate::upper::icmp::FIPS_OVERHEAD;
-use crate::node::{Node, NodeError};
-use crate::noise::{HandshakeState, XK_HANDSHAKE_MSG1_SIZE, XK_HANDSHAKE_MSG2_SIZE, XK_HANDSHAKE_MSG3_SIZE};
+use crate::NodeAddr;
 use crate::mmp::report::ReceiverReport;
 use crate::mmp::{MAX_SESSION_REPORT_INTERVAL_MS, MIN_SESSION_REPORT_INTERVAL_MS};
+use crate::node::session::{EndToEndState, SessionEntry};
+use crate::node::session_wire::{
+    FSP_COMMON_PREFIX_SIZE, FSP_FLAG_CP, FSP_FLAG_K, FSP_HEADER_SIZE, FSP_PHASE_ESTABLISHED,
+    FSP_PHASE_MSG1, FSP_PHASE_MSG2, FSP_PHASE_MSG3, FSP_PORT_HEADER_SIZE, FSP_PORT_IPV6_SHIM,
+    FspCommonPrefix, FspEncryptedHeader, build_fsp_header, fsp_prepend_inner_header,
+    fsp_strip_inner_header, parse_encrypted_coords,
+};
+use crate::node::{Node, NodeError};
+use crate::noise::{
+    HandshakeState, XK_HANDSHAKE_MSG1_SIZE, XK_HANDSHAKE_MSG2_SIZE, XK_HANDSHAKE_MSG3_SIZE,
+};
 use crate::protocol::{
     CoordsRequired, FspInnerFlags, MtuExceeded, PathBroken, PathMtuNotification, SessionAck,
     SessionDatagram, SessionMessageType, SessionMsg3, SessionReceiverReport, SessionSenderReport,
     SessionSetup,
 };
-use crate::NodeAddr;
+use crate::protocol::{coords_wire_size, encode_coords};
+use crate::upper::icmp::FIPS_OVERHEAD;
 use secp256k1::PublicKey;
 use tracing::{debug, info, trace};
 
@@ -48,7 +50,10 @@ impl Node {
         let prefix = match FspCommonPrefix::parse(payload) {
             Some(p) => p,
             None => {
-                debug!(len = payload.len(), "Session payload too short for FSP prefix");
+                debug!(
+                    len = payload.len(),
+                    "Session payload too short for FSP prefix"
+                );
                 return;
             }
         };
@@ -89,7 +94,8 @@ impl Node {
                 }
             }
             FSP_PHASE_ESTABLISHED => {
-                self.handle_encrypted_session_msg(src_addr, payload, path_mtu, ce_flag).await;
+                self.handle_encrypted_session_msg(src_addr, payload, path_mtu, ce_flag)
+                    .await;
             }
             _ => {
                 debug!(phase = prefix.phase, "Unknown FSP phase");
@@ -106,12 +112,21 @@ impl Node {
     /// 4. AEAD decrypt with AAD = header_bytes
     /// 5. Strip FSP inner header → timestamp, msg_type, inner_flags
     /// 6. Dispatch by msg_type
-    async fn handle_encrypted_session_msg(&mut self, src_addr: &NodeAddr, payload: &[u8], path_mtu: u16, ce_flag: bool) {
+    async fn handle_encrypted_session_msg(
+        &mut self,
+        src_addr: &NodeAddr,
+        payload: &[u8],
+        path_mtu: u16,
+        ce_flag: bool,
+    ) {
         // Parse the 12-byte encrypted header (includes the 4-byte prefix)
         let header = match FspEncryptedHeader::parse(payload) {
             Some(h) => h,
             None => {
-                debug!(len = payload.len(), "Encrypted session message too short for FSP header");
+                debug!(
+                    len = payload.len(),
+                    "Encrypted session message too short for FSP header"
+                );
                 return;
             }
         };
@@ -166,8 +181,8 @@ impl Node {
         let received_k_bit = header.flags & FSP_FLAG_K != 0;
         {
             let entry = self.sessions.get(src_addr).unwrap();
-            let k_bit_flipped = received_k_bit != entry.current_k_bit()
-                && entry.pending_new_session().is_some();
+            let k_bit_flipped =
+                received_k_bit != entry.current_k_bit() && entry.pending_new_session().is_some();
 
             if k_bit_flipped {
                 let display_name = self.peer_display_name(src_addr);
@@ -234,7 +249,8 @@ impl Node {
         self.sessions.insert(*src_addr, entry);
 
         // Strip FSP inner header (6 bytes)
-        let (timestamp, msg_type, inner_flags_byte, rest) = match fsp_strip_inner_header(&plaintext) {
+        let (timestamp, msg_type, inner_flags_byte, rest) = match fsp_strip_inner_header(&plaintext)
+        {
             Some(parts) => parts,
             None => {
                 debug!(src = %self.peer_display_name(src_addr), "Decrypted payload too short for FSP inner header");
@@ -247,16 +263,15 @@ impl Node {
             && let Some(mmp) = entry.mmp_mut()
         {
             let now = std::time::Instant::now();
-            mmp.receiver.record_recv(
-                header.counter, timestamp, plaintext.len(), ce_flag, now,
-            );
+            mmp.receiver
+                .record_recv(header.counter, timestamp, plaintext.len(), ce_flag, now);
             // Spin bit: advance state machine for correct TX reflection.
             // RTT samples not fed into SRTT — timestamp-echo provides
             // accurate RTT; spin bit includes variable inter-frame delays.
             let inner_flags = FspInnerFlags::from_byte(inner_flags_byte);
-            let _spin_rtt = mmp.spin_bit.rx_observe(
-                inner_flags.spin_bit, header.counter, now,
-            );
+            let _spin_rtt = mmp
+                .spin_bit
+                .rx_observe(inner_flags.spin_bit, header.counter, now);
         }
 
         // Feed path_mtu from datagram envelope to MMP path MTU tracking.
@@ -283,9 +298,15 @@ impl Node {
                     FSP_PORT_IPV6_SHIM => {
                         use crate::FipsAddress;
                         let src_ipv6 = FipsAddress::from_node_addr(src_addr).to_ipv6().octets();
-                        let dst_ipv6 = FipsAddress::from_node_addr(self.node_addr()).to_ipv6().octets();
+                        let dst_ipv6 = FipsAddress::from_node_addr(self.node_addr())
+                            .to_ipv6()
+                            .octets();
 
-                        match crate::upper::ipv6_shim::decompress_ipv6(service_payload, src_ipv6, dst_ipv6) {
+                        match crate::upper::ipv6_shim::decompress_ipv6(
+                            service_payload,
+                            src_ipv6,
+                            dst_ipv6,
+                        ) {
                             Some(mut packet) => {
                                 if ce_flag {
                                     mark_ipv6_ecn_ce(&mut packet);
@@ -533,7 +554,13 @@ impl Node {
         let placeholder_pubkey = self.identity.keypair().public_key();
         let now_ms = Self::now_ms();
         let resend_interval = self.config.node.rate_limit.handshake_resend_interval_ms;
-        let mut entry = SessionEntry::new(*src_addr, placeholder_pubkey, EndToEndState::AwaitingMsg3(handshake), now_ms, false);
+        let mut entry = SessionEntry::new(
+            *src_addr,
+            placeholder_pubkey,
+            EndToEndState::AwaitingMsg3(handshake),
+            now_ms,
+            false,
+        );
         entry.set_handshake_payload(ack_payload, now_ms + resend_interval);
         self.sessions.insert(*src_addr, entry);
 
@@ -809,7 +836,13 @@ impl Node {
 
         let now_ms = Self::now_ms();
         // Replace the placeholder pubkey with the real one
-        let mut new_entry = SessionEntry::new(*src_addr, remote_pubkey, EndToEndState::Established(session), now_ms, false);
+        let mut new_entry = SessionEntry::new(
+            *src_addr,
+            remote_pubkey,
+            EndToEndState::Established(session),
+            now_ms,
+            false,
+        );
         new_entry.set_coords_warmup_remaining(self.config.node.session.coords_warmup_packets);
         new_entry.mark_established(now_ms);
         new_entry.init_mmp(&self.config.node.session_mmp);
@@ -878,7 +911,8 @@ impl Node {
         };
 
         let now = std::time::Instant::now();
-        mmp.metrics.process_receiver_report(&rr, our_timestamp_ms, now);
+        mmp.metrics
+            .process_receiver_report(&rr, our_timestamp_ms, now);
 
         // Feed SRTT back to sender/receiver report interval tuning (session-layer bounds)
         if let Some(srtt_ms) = mmp.metrics.srtt_ms() {
@@ -900,7 +934,8 @@ impl Node {
         // Update reverse delivery ratio from our own receiver state, using per-interval deltas.
         let our_recv_packets = mmp.receiver.cumulative_packets_recv();
         let peer_highest = mmp.receiver.highest_counter();
-        mmp.metrics.update_reverse_delivery(our_recv_packets, peer_highest);
+        mmp.metrics
+            .update_reverse_delivery(our_recv_packets, peer_highest);
 
         trace!(
             src = %peer_name,
@@ -975,7 +1010,10 @@ impl Node {
         );
 
         // Send standalone CoordsWarmup immediately (rate-limited)
-        if self.coords_response_rate_limiter.should_send(&msg.dest_addr) {
+        if self
+            .coords_response_rate_limiter
+            .should_send(&msg.dest_addr)
+        {
             if let Some(entry) = self.sessions.get(&msg.dest_addr)
                 && entry.is_established()
                 && let Err(e) = self.send_coords_warmup(&msg.dest_addr).await
@@ -1033,7 +1071,10 @@ impl Node {
         );
 
         // Send standalone CoordsWarmup immediately (rate-limited)
-        if self.coords_response_rate_limiter.should_send(&msg.dest_addr) {
+        if self
+            .coords_response_rate_limiter
+            .should_send(&msg.dest_addr)
+        {
             if let Some(entry) = self.sessions.get(&msg.dest_addr)
                 && entry.is_established()
                 && let Err(e) = self.send_coords_warmup(&msg.dest_addr).await
@@ -1139,16 +1180,17 @@ impl Node {
         let our_keypair = self.identity.keypair();
         let mut handshake = HandshakeState::new_xk_initiator(our_keypair, dest_pubkey);
         handshake.set_local_epoch(self.startup_epoch);
-        let msg1 = handshake.write_xk_message_1().map_err(|e| NodeError::SendFailed {
-            node_addr: dest_addr,
-            reason: format!("Noise XK msg1 generation failed: {}", e),
-        })?;
+        let msg1 = handshake
+            .write_xk_message_1()
+            .map_err(|e| NodeError::SendFailed {
+                node_addr: dest_addr,
+                reason: format!("Noise XK msg1 generation failed: {}", e),
+            })?;
 
         // Build SessionSetup with coordinates
         let our_coords = self.tree_state.my_coords().clone();
         let dest_coords = self.get_dest_coords(&dest_addr);
-        let setup = SessionSetup::new(our_coords, dest_coords)
-            .with_handshake(msg1);
+        let setup = SessionSetup::new(our_coords, dest_coords).with_handshake(msg1);
         let setup_payload = setup.encode();
 
         // Wrap in SessionDatagram
@@ -1165,7 +1207,13 @@ impl Node {
         // Store session entry with handshake payload for potential resend
         let now_ms = Self::now_ms();
         let resend_interval = self.config.node.rate_limit.handshake_resend_interval_ms;
-        let mut entry = SessionEntry::new(dest_addr, dest_pubkey, EndToEndState::Initiating(handshake), now_ms, true);
+        let mut entry = SessionEntry::new(
+            dest_addr,
+            dest_pubkey,
+            EndToEndState::Initiating(handshake),
+            now_ms,
+            true,
+        );
         entry.set_handshake_payload(setup_payload, now_ms + resend_interval);
         self.sessions.insert(dest_addr, entry);
 
@@ -1192,10 +1240,13 @@ impl Node {
         let now_ms = Self::now_ms();
 
         // First borrow: read session metadata (NLL releases before coord decision)
-        let entry = self.sessions.get(dest_addr).ok_or_else(|| NodeError::SendFailed {
-            node_addr: *dest_addr,
-            reason: "no session".into(),
-        })?;
+        let entry = self
+            .sessions
+            .get(dest_addr)
+            .ok_or_else(|| NodeError::SendFailed {
+                node_addr: *dest_addr,
+                reason: "no session".into(),
+            })?;
         let wants_coords = entry.coords_warmup_remaining() > 0;
         let timestamp = entry.session_timestamp(now_ms);
         let spin_bit = entry.mmp().is_some_and(|m| m.spin_bit.tx_bit());
@@ -1215,7 +1266,8 @@ impl Node {
         // Build inner plaintext (doesn't depend on counter)
         let msg_type = SessionMessageType::DataPacket.to_byte(); // 0x10
         let inner_flags = FspInnerFlags { spin_bit }.to_byte();
-        let inner_plaintext = fsp_prepend_inner_header(timestamp, msg_type, inner_flags, &port_payload);
+        let inner_plaintext =
+            fsp_prepend_inner_header(timestamp, msg_type, inner_flags, &port_payload);
 
         // Determine whether coords fit within transport MTU.
         // If not, send standalone CoordsWarmup before the data packet.
@@ -1223,7 +1275,8 @@ impl Node {
             let src = self.tree_state.my_coords().clone();
             let dst = self.get_dest_coords(dest_addr);
             let coords_size = coords_wire_size(&src) + coords_wire_size(&dst);
-            let total_wire = FIPS_OVERHEAD as usize + FSP_PORT_HEADER_SIZE + coords_size + payload.len();
+            let total_wire =
+                FIPS_OVERHEAD as usize + FSP_PORT_HEADER_SIZE + coords_size + payload.len();
             if total_wire <= self.transport_mtu() as usize {
                 (true, Some(src), Some(dst))
             } else {
@@ -1239,9 +1292,7 @@ impl Node {
         };
 
         // Decrement warmup counter if we sent coords (piggybacked or standalone)
-        if wants_coords
-            && let Some(entry) = self.sessions.get_mut(dest_addr)
-        {
+        if wants_coords && let Some(entry) = self.sessions.get_mut(dest_addr) {
             entry.set_coords_warmup_remaining(entry.coords_warmup_remaining() - 1);
         }
 
@@ -1254,10 +1305,13 @@ impl Node {
         }
 
         // Borrow session for counter + encryption (after potential standalone send)
-        let entry = self.sessions.get_mut(dest_addr).ok_or_else(|| NodeError::SendFailed {
-            node_addr: *dest_addr,
-            reason: "no session".into(),
-        })?;
+        let entry = self
+            .sessions
+            .get_mut(dest_addr)
+            .ok_or_else(|| NodeError::SendFailed {
+                node_addr: *dest_addr,
+                reason: "no session".into(),
+            })?;
         let session = match entry.state_mut() {
             EndToEndState::Established(s) => s,
             _ => {
@@ -1274,12 +1328,12 @@ impl Node {
         let header = build_fsp_header(counter, flags, payload_len);
 
         // Encrypt with AAD binding to the FSP header
-        let ciphertext = session.encrypt_with_aad(&inner_plaintext, &header).map_err(|e| {
-            NodeError::SendFailed {
+        let ciphertext = session
+            .encrypt_with_aad(&inner_plaintext, &header)
+            .map_err(|e| NodeError::SendFailed {
                 node_addr: *dest_addr,
                 reason: format!("session encrypt failed: {}", e),
-            }
-        })?;
+            })?;
 
         // Assemble: header(12) + [coords] + ciphertext
         let mut fsp_payload = Vec::with_capacity(FSP_HEADER_SIZE + ciphertext.len() + 200);
@@ -1317,13 +1371,19 @@ impl Node {
         dest_addr: &NodeAddr,
         ipv6_packet: &[u8],
     ) -> Result<(), NodeError> {
-        let compressed = crate::upper::ipv6_shim::compress_ipv6(ipv6_packet)
-            .ok_or_else(|| NodeError::SendFailed {
+        let compressed = crate::upper::ipv6_shim::compress_ipv6(ipv6_packet).ok_or_else(|| {
+            NodeError::SendFailed {
                 node_addr: *dest_addr,
                 reason: "IPv6 header compression failed".into(),
-            })?;
-        self.send_session_data(dest_addr, FSP_PORT_IPV6_SHIM, FSP_PORT_IPV6_SHIM, &compressed)
-            .await
+            }
+        })?;
+        self.send_session_data(
+            dest_addr,
+            FSP_PORT_IPV6_SHIM,
+            FSP_PORT_IPV6_SHIM,
+            &compressed,
+        )
+        .await
     }
 
     /// Send a non-data session message (reports, notifications) over an established session.
@@ -1342,10 +1402,13 @@ impl Node {
         let now_ms = Self::now_ms();
 
         // Read spin bit and session timestamp from entry
-        let entry = self.sessions.get(dest_addr).ok_or_else(|| NodeError::SendFailed {
-            node_addr: *dest_addr,
-            reason: "no session".into(),
-        })?;
+        let entry = self
+            .sessions
+            .get(dest_addr)
+            .ok_or_else(|| NodeError::SendFailed {
+                node_addr: *dest_addr,
+                reason: "no session".into(),
+            })?;
         let timestamp = entry.session_timestamp(now_ms);
         let spin_bit = entry.mmp().is_some_and(|m| m.spin_bit.tx_bit());
 
@@ -1353,10 +1416,13 @@ impl Node {
         let inner_flags = FspInnerFlags { spin_bit }.to_byte();
 
         // Get mutable access for encryption
-        let entry = self.sessions.get_mut(dest_addr).ok_or_else(|| NodeError::SendFailed {
-            node_addr: *dest_addr,
-            reason: "no session".into(),
-        })?;
+        let entry = self
+            .sessions
+            .get_mut(dest_addr)
+            .ok_or_else(|| NodeError::SendFailed {
+                node_addr: *dest_addr,
+                reason: "no session".into(),
+            })?;
 
         // Read K-bit before mutable borrow of session state
         let k_flags = if entry.current_k_bit() { FSP_FLAG_K } else { 0 };
@@ -1381,12 +1447,12 @@ impl Node {
         let header = build_fsp_header(counter, k_flags, payload_len);
 
         // Encrypt with AAD
-        let ciphertext = session.encrypt_with_aad(&inner_plaintext, &header).map_err(|e| {
-            NodeError::SendFailed {
+        let ciphertext = session
+            .encrypt_with_aad(&inner_plaintext, &header)
+            .map_err(|e| NodeError::SendFailed {
                 node_addr: *dest_addr,
                 reason: format!("session encrypt failed: {}", e),
-            }
-        })?;
+            })?;
 
         // Assemble: header(12) + ciphertext (no coords)
         let mut fsp_payload = Vec::with_capacity(FSP_HEADER_SIZE + ciphertext.len());
@@ -1416,28 +1482,31 @@ impl Node {
     /// coordinates via `try_warm_coord_cache()` (same as CP-flagged data
     /// packets). The encrypted inner payload is the 6-byte inner header
     /// with no application data.
-    async fn send_coords_warmup(
-        &mut self,
-        dest_addr: &NodeAddr,
-    ) -> Result<(), NodeError> {
+    async fn send_coords_warmup(&mut self, dest_addr: &NodeAddr) -> Result<(), NodeError> {
         let now_ms = Self::now_ms();
 
         let my_coords = self.tree_state.my_coords().clone();
         let dest_coords = self.get_dest_coords(dest_addr);
 
         // Read session metadata
-        let entry = self.sessions.get(dest_addr).ok_or_else(|| NodeError::SendFailed {
-            node_addr: *dest_addr,
-            reason: "no session".into(),
-        })?;
+        let entry = self
+            .sessions
+            .get(dest_addr)
+            .ok_or_else(|| NodeError::SendFailed {
+                node_addr: *dest_addr,
+                reason: "no session".into(),
+            })?;
         let timestamp = entry.session_timestamp(now_ms);
         let spin_bit = entry.mmp().is_some_and(|m| m.spin_bit.tx_bit());
 
         // Get mutable access for encryption
-        let entry = self.sessions.get_mut(dest_addr).ok_or_else(|| NodeError::SendFailed {
-            node_addr: *dest_addr,
-            reason: "no session".into(),
-        })?;
+        let entry = self
+            .sessions
+            .get_mut(dest_addr)
+            .ok_or_else(|| NodeError::SendFailed {
+                node_addr: *dest_addr,
+                reason: "no session".into(),
+            })?;
         let session = match entry.state_mut() {
             EndToEndState::Established(s) => s,
             _ => {
@@ -1460,12 +1529,12 @@ impl Node {
         let header = build_fsp_header(counter, FSP_FLAG_CP, payload_len);
 
         // Encrypt with AAD
-        let ciphertext = session.encrypt_with_aad(&inner_plaintext, &header).map_err(|e| {
-            NodeError::SendFailed {
+        let ciphertext = session
+            .encrypt_with_aad(&inner_plaintext, &header)
+            .map_err(|e| NodeError::SendFailed {
                 node_addr: *dest_addr,
                 reason: format!("session encrypt failed: {}", e),
-            }
-        })?;
+            })?;
 
         // Assemble: header(12) + coords + ciphertext
         let coords_size = coords_wire_size(&my_coords) + coords_wire_size(&dest_coords);
@@ -1532,7 +1601,8 @@ impl Node {
         }
 
         let encoded = datagram.encode();
-        self.send_encrypted_link_message(&next_hop_addr, &encoded).await?;
+        self.send_encrypted_link_message(&next_hop_addr, &encoded)
+            .await?;
         self.stats_mut().forwarding.record_originated(encoded.len());
         Ok(())
     }
@@ -1639,19 +1709,20 @@ impl Node {
 
     /// Send ICMPv6 Destination Unreachable back through TUN.
     pub(in crate::node) fn send_icmpv6_dest_unreachable(&self, original_packet: &[u8]) {
-        use crate::upper::icmp::{build_dest_unreachable, should_send_icmp_error, DestUnreachableCode};
         use crate::FipsAddress;
+        use crate::upper::icmp::{
+            DestUnreachableCode, build_dest_unreachable, should_send_icmp_error,
+        };
 
         if !should_send_icmp_error(original_packet) {
             return;
         }
 
         let our_ipv6 = FipsAddress::from_node_addr(self.node_addr()).to_ipv6();
-        if let Some(response) = build_dest_unreachable(
-            original_packet,
-            DestUnreachableCode::NoRoute,
-            our_ipv6,
-        ) && let Some(tun_tx) = &self.tun_tx {
+        if let Some(response) =
+            build_dest_unreachable(original_packet, DestUnreachableCode::NoRoute, our_ipv6)
+            && let Some(tun_tx) = &self.tun_tx
+        {
             let _ = tun_tx.send(response);
         }
     }
@@ -1708,10 +1779,7 @@ impl Node {
             return;
         }
 
-        let queue = self
-            .pending_tun_packets
-            .entry(dest_addr)
-            .or_default();
+        let queue = self.pending_tun_packets.entry(dest_addr).or_default();
         if queue.len() >= self.config.node.session.pending_packets_per_dest {
             queue.pop_front(); // Drop oldest
         }

src/node/handlers/timeout.rs

@@ -22,7 +22,9 @@ impl Node {
             .unwrap_or(0);
         let timeout_ms = self.config.node.rate_limit.handshake_timeout_secs * 1000;
 
-        let stale: Vec<LinkId> = self.connections.iter()
+        let stale: Vec<LinkId> = self
+            .connections
+            .iter()
             .filter(|(_, conn)| conn.is_timed_out(now_ms, timeout_ms) || conn.is_failed())
             .map(|(link_id, _)| *link_id)
             .collect();
@@ -96,7 +98,9 @@ impl Node {
 
         // Collect resend candidates: outbound, in SentMsg1, with stored msg1,
         // under max resends, and past the scheduled time.
-        let candidates: Vec<(LinkId, Vec<u8>)> = self.connections.iter()
+        let candidates: Vec<(LinkId, Vec<u8>)> = self
+            .connections
+            .iter()
             .filter(|(_, conn)| {
                 conn.is_outbound()
                     && conn.handshake_state() == HandshakeState::SentMsg1
@@ -136,9 +140,7 @@ impl Node {
                 false
             };
 
-            if sent
-                && let Some(conn) = self.connections.get_mut(&link_id)
-            {
+            if sent && let Some(conn) = self.connections.get_mut(&link_id) {
                 let count = conn.resend_count() + 1;
                 let next = now_ms + (interval_ms as f64 * backoff.powi(count as i32)) as u64;
                 conn.record_resend(next);
@@ -169,10 +171,11 @@ impl Node {
         let ttl = self.config.node.session.default_ttl;
 
         // First pass: find timed-out sessions to remove
-        let timed_out: Vec<crate::NodeAddr> = self.sessions.iter()
+        let timed_out: Vec<crate::NodeAddr> = self
+            .sessions
+            .iter()
             .filter(|(_, entry)| {
-                !entry.is_established()
-                    && now_ms.saturating_sub(entry.last_activity()) > timeout_ms
+                !entry.is_established() && now_ms.saturating_sub(entry.last_activity()) > timeout_ms
             })
             .map(|(addr, _)| *addr)
             .collect();
@@ -186,7 +189,9 @@ impl Node {
 
         // Second pass: collect resend candidates
         let my_addr = *self.node_addr();
-        let candidates: Vec<(crate::NodeAddr, Vec<u8>)> = self.sessions.iter()
+        let candidates: Vec<(crate::NodeAddr, Vec<u8>)> = self
+            .sessions
+            .iter()
             .filter(|(_, entry)| {
                 !entry.is_established()
                     && entry.handshake_payload().is_some()
@@ -200,8 +205,7 @@ impl Node {
         for (dest_addr, payload) in candidates {
             use crate::protocol::SessionDatagram;
 
-            let mut datagram = SessionDatagram::new(my_addr, dest_addr, payload)
-                .with_ttl(ttl);
+            let mut datagram = SessionDatagram::new(my_addr, dest_addr, payload).with_ttl(ttl);
             let sent = match self.send_session_datagram(&mut datagram).await {
                 Ok(_) => true,
                 Err(e) => {
@@ -214,9 +218,7 @@ impl Node {
                 }
             };
 
-            if sent
-                && let Some(entry) = self.sessions.get_mut(&dest_addr)
-            {
+            if sent && let Some(entry) = self.sessions.get_mut(&dest_addr) {
                 let count = entry.resend_count() + 1;
                 let next = now_ms + (interval_ms as f64 * backoff.powi(count as i32)) as u64;
                 entry.record_resend(next);
@@ -239,10 +241,11 @@ impl Node {
             return; // disabled
         }
 
-        let idle: Vec<_> = self.sessions.iter()
+        let idle: Vec<_> = self
+            .sessions
+            .iter()
             .filter(|(_, entry)| {
-                entry.is_established()
-                    && now_ms.saturating_sub(entry.last_activity()) > timeout_ms
+                entry.is_established() && now_ms.saturating_sub(entry.last_activity()) > timeout_ms
             })
             .map(|(addr, _)| *addr)
             .collect();

src/node/rate_limit.rs

@@ -237,7 +237,6 @@ impl HandshakeRateLimiter {
     }
 }
 
-
 #[cfg(test)]
 mod tests {
     use super::*;

src/node/retry.rs

@@ -5,9 +5,9 @@
 //! (not PeerConnection) because each retry creates a fresh connection.
 
 use super::Node;
+use crate::PeerIdentity;
 use crate::config::PeerConfig;
 use crate::identity::NodeAddr;
-use crate::PeerIdentity;
 use tracing::{debug, info, warn};
 
 // MAX_BACKOFF_MS is now derived from config: node.retry.max_backoff_secs * 1000
@@ -44,7 +44,9 @@ impl RetryState {
     /// capped at `MAX_BACKOFF_MS`.
     pub fn backoff_ms(&self, base_interval_ms: u64, max_backoff_ms: u64) -> u64 {
         let multiplier = 1u64.checked_shl(self.retry_count).unwrap_or(u64::MAX);
-        base_interval_ms.saturating_mul(multiplier).min(max_backoff_ms)
+        base_interval_ms
+            .saturating_mul(multiplier)
+            .min(max_backoff_ms)
     }
 }
 
@@ -55,11 +57,7 @@ impl Node {
     /// have not been exhausted (unless `reconnect` is true, which retries
     /// indefinitely). Does nothing if the peer is already connected or has
     /// a connection in progress.
-    pub(super) fn schedule_retry(
-        &mut self,
-        node_addr: NodeAddr,
-        now_ms: u64,
-    ) {
+    pub(super) fn schedule_retry(&mut self, node_addr: NodeAddr, now_ms: u64) {
         let retry_cfg = &self.config.node.retry;
         let max_retries = retry_cfg.max_retries;
         if max_retries == 0 {
@@ -240,8 +238,7 @@ impl Node {
                     // succeeds, promote_connection() clears retry_pending. If
                     // it times out, check_timeouts() calls schedule_retry()
                     // which bumps the counter and applies proper backoff.
-                    let hs_timeout_ms =
-                        self.config.node.rate_limit.handshake_timeout_secs * 1000;
+                    let hs_timeout_ms = self.config.node.rate_limit.handshake_timeout_secs * 1000;
                     if let Some(state) = self.retry_pending.get_mut(&node_addr) {
                         state.retry_after_ms = now_ms + hs_timeout_ms;
                     }
@@ -317,7 +314,10 @@ mod tests {
             retry_after_ms: 0,
             reconnect: false,
         };
-        assert_eq!(state.backoff_ms(5000, TEST_MAX_BACKOFF_MS), TEST_MAX_BACKOFF_MS);
+        assert_eq!(
+            state.backoff_ms(5000, TEST_MAX_BACKOFF_MS),
+            TEST_MAX_BACKOFF_MS
+        );
     }
 
     #[test]

src/node/routing_error_rate_limit.rs

@@ -70,7 +70,6 @@ impl RoutingErrorRateLimiter {
     pub fn len(&self) -> usize {
         self.last_sent.len()
     }
-
 }
 
 impl Default for RoutingErrorRateLimiter {

src/node/session.rs

@@ -7,10 +7,10 @@
 
 use std::time::Instant;
 
+use crate::NodeAddr;
 use crate::config::SessionMmpConfig;
 use crate::mmp::MmpSessionState;
 use crate::noise::{HandshakeState, NoiseSession};
-use crate::NodeAddr;
 use secp256k1::PublicKey;
 
 /// State machine for an end-to-end session.
@@ -159,12 +159,16 @@ impl SessionEntry {
     /// Get the current session state.
     #[cfg(test)]
     pub(crate) fn state(&self) -> &EndToEndState {
-        self.state.as_ref().expect("session state taken but not restored")
+        self.state
+            .as_ref()
+            .expect("session state taken but not restored")
     }
 
     /// Get mutable access to the session state.
     pub(crate) fn state_mut(&mut self) -> &mut EndToEndState {
-        self.state.as_mut().expect("session state taken but not restored")
+        self.state
+            .as_mut()
+            .expect("session state taken but not restored")
     }
 
     /// Replace the session state.
@@ -278,7 +282,12 @@ impl SessionEntry {
 
     /// Get traffic counters: (packets_sent, packets_recv, bytes_sent, bytes_recv).
     pub(crate) fn traffic_counters(&self) -> (u64, u64, u64, u64) {
-        (self.packets_sent, self.packets_recv, self.bytes_sent, self.bytes_recv)
+        (
+            self.packets_sent,
+            self.packets_recv,
+            self.bytes_sent,
+            self.bytes_recv,
+        )
     }
 
     // === Handshake Resend ===

src/node/session_wire.rs

@@ -208,8 +208,7 @@ impl FspEncryptedHeader {
 
         let payload_len = u16::from_le_bytes([data[2], data[3]]);
         let counter = u64::from_le_bytes([
-            data[4], data[5], data[6], data[7],
-            data[8], data[9], data[10], data[11],
+            data[4], data[5], data[6], data[7], data[8], data[9], data[10], data[11],
         ]);
 
         let mut header_bytes = [0u8; FSP_HEADER_SIZE];
@@ -242,11 +241,7 @@ impl FspEncryptedHeader {
 /// Build the 12-byte cleartext header for an encrypted FSP message.
 ///
 /// Returns the header bytes for use as AEAD AAD.
-pub fn build_fsp_header(
-    counter: u64,
-    flags: u8,
-    payload_len: u16,
-) -> [u8; FSP_HEADER_SIZE] {
+pub fn build_fsp_header(counter: u64, flags: u8, payload_len: u16) -> [u8; FSP_HEADER_SIZE] {
     let mut header = [0u8; FSP_HEADER_SIZE];
     header[0] = FspCommonPrefix::ver_phase_byte(FSP_VERSION, FSP_PHASE_ESTABLISHED);
     header[1] = flags;
@@ -323,12 +318,15 @@ pub fn fsp_strip_inner_header(plaintext: &[u8]) -> Option<(u32, u8, u8, &[u8])>
     if plaintext.len() < FSP_INNER_HEADER_SIZE {
         return None;
     }
-    let timestamp = u32::from_le_bytes([
-        plaintext[0], plaintext[1], plaintext[2], plaintext[3],
-    ]);
+    let timestamp = u32::from_le_bytes([plaintext[0], plaintext[1], plaintext[2], plaintext[3]]);
     let msg_type = plaintext[4];
     let inner_flags = plaintext[5];
-    Some((timestamp, msg_type, inner_flags, &plaintext[FSP_INNER_HEADER_SIZE..]))
+    Some((
+        timestamp,
+        msg_type,
+        inner_flags,
+        &plaintext[FSP_INNER_HEADER_SIZE..],
+    ))
 }
 
 // ============================================================================
@@ -465,8 +463,8 @@ mod tests {
         assert_eq!(u16::from_le_bytes([header[2], header[3]]), 200);
         assert_eq!(
             u64::from_le_bytes([
-                header[4], header[5], header[6], header[7],
-                header[8], header[9], header[10], header[11],
+                header[4], header[5], header[6], header[7], header[8], header[9], header[10],
+                header[11],
             ]),
             1000
         );

src/node/tests/bloom.rs

@@ -16,10 +16,7 @@ fn get_tree_edges(nodes: &[TestNode]) -> Vec<(usize, usize)> {
         let ts = tn.node.tree_state();
         if !ts.is_root() {
             let parent_addr = ts.my_declaration().parent_id();
-            if let Some(j) = nodes
-                .iter()
-                .position(|n| n.node.node_addr() == parent_addr)
-            {
+            if let Some(j) = nodes.iter().position(|n| n.node.node_addr() == parent_addr) {
                 edges.push((i, j));
             }
         }
@@ -174,8 +171,7 @@ async fn test_bloom_filter_star() {
 /// entries, and so on. Both endpoints should see all other nodes.
 #[tokio::test]
 async fn test_bloom_filter_chain_propagation() {
-    let edges: Vec<(usize, usize)> =
-        vec![(0, 1), (1, 2), (2, 3), (3, 4), (4, 5), (5, 6), (6, 7)];
+    let edges: Vec<(usize, usize)> = vec![(0, 1), (1, 2), (2, 3), (3, 4), (4, 5), (5, 6), (6, 7)];
     let mut nodes = run_tree_test(8, &edges, false).await;
     verify_tree_convergence(&nodes);
     verify_filter_exchange(&nodes, &edges);
@@ -315,8 +311,7 @@ fn collect_subtree(
 #[tokio::test]
 async fn test_bloom_filter_split_horizon() {
     // Pure tree: 7 nodes, 6 edges
-    let edges: Vec<(usize, usize)> =
-        vec![(0, 1), (0, 2), (1, 3), (1, 4), (2, 5), (5, 6)];
+    let edges: Vec<(usize, usize)> = vec![(0, 1), (0, 2), (1, 3), (1, 4), (2, 5), (5, 6)];
     let mut nodes = run_tree_test(7, &edges, false).await;
     verify_tree_convergence(&nodes);
     verify_filter_exchange(&nodes, &edges);
@@ -340,9 +335,7 @@ async fn test_bloom_filter_split_horizon() {
     // - parent's filter to child contains the complement only
     for &(child_idx, parent_idx) in &tree_edges {
         let child_subtree = collect_subtree(child_idx, Some(parent_idx), &tree_adj);
-        let complement: Vec<usize> = (0..n)
-            .filter(|i| !child_subtree.contains(i))
-            .collect();
+        let complement: Vec<usize> = (0..n).filter(|i| !child_subtree.contains(i)).collect();
 
         // --- Upward filter: child → parent ---
         // This is stored as parent's inbound filter from child
@@ -358,7 +351,9 @@ async fn test_bloom_filter_split_horizon() {
             assert!(
                 filter_up.contains(&addrs[idx]),
                 "Upward filter (n{}→n{}): should contain subtree member n{} but doesn't",
-                child_idx, parent_idx, idx
+                child_idx,
+                parent_idx,
+                idx
             );
         }
 
@@ -367,7 +362,9 @@ async fn test_bloom_filter_split_horizon() {
             assert!(
                 !filter_up.contains(&addrs[idx]),
                 "Upward filter (n{}→n{}): should NOT contain complement member n{} but does",
-                child_idx, parent_idx, idx
+                child_idx,
+                parent_idx,
+                idx
             );
         }
 
@@ -376,7 +373,10 @@ async fn test_bloom_filter_split_horizon() {
         assert!(
             (up_est - child_subtree.len() as f64).abs() < 1.5,
             "Upward filter (n{}→n{}): expected ~{} entries, got {:.1}",
-            child_idx, parent_idx, child_subtree.len(), up_est
+            child_idx,
+            parent_idx,
+            child_subtree.len(),
+            up_est
         );
 
         // --- Downward filter: parent → child ---
@@ -393,7 +393,9 @@ async fn test_bloom_filter_split_horizon() {
             assert!(
                 filter_down.contains(&addrs[idx]),
                 "Downward filter (n{}→n{}): should contain complement member n{} but doesn't",
-                parent_idx, child_idx, idx
+                parent_idx,
+                child_idx,
+                idx
             );
         }
 
@@ -405,7 +407,9 @@ async fn test_bloom_filter_split_horizon() {
             assert!(
                 !filter_down.contains(&addrs[idx]),
                 "Downward filter (n{}→n{}): should NOT contain subtree member n{} but does",
-                parent_idx, child_idx, idx
+                parent_idx,
+                child_idx,
+                idx
             );
         }
 
@@ -414,7 +418,10 @@ async fn test_bloom_filter_split_horizon() {
         assert!(
             (down_est - complement.len() as f64).abs() < 1.5,
             "Downward filter (n{}→n{}): expected ~{} entries, got {:.1}",
-            parent_idx, child_idx, complement.len(), down_est
+            parent_idx,
+            child_idx,
+            complement.len(),
+            down_est
         );
 
         // Together, subtree + complement = all nodes

src/node/tests/disconnect.rs

@@ -258,10 +258,8 @@ async fn test_disconnect_clears_session() {
     {
         let our_identity = nodes[1].node.identity();
 
-        let mut initiator = HandshakeState::new_initiator(
-            our_identity.keypair(),
-            remote_identity.pubkey_full(),
-        );
+        let mut initiator =
+            HandshakeState::new_initiator(our_identity.keypair(), remote_identity.pubkey_full());
         let mut responder = HandshakeState::new_responder(remote_identity.keypair());
         let mut init_epoch = [0u8; 8];
         rand::Rng::fill_bytes(&mut rand::rng(), &mut init_epoch);
@@ -285,8 +283,16 @@ async fn test_disconnect_clears_session() {
         nodes[1].node.sessions.insert(node0_addr, entry);
     }
 
-    assert_eq!(nodes[1].node.session_count(), 1, "Session should exist before disconnect");
-    assert_eq!(nodes[1].node.peer_count(), 1, "Peer should exist before disconnect");
+    assert_eq!(
+        nodes[1].node.session_count(),
+        1,
+        "Session should exist before disconnect"
+    );
+    assert_eq!(
+        nodes[1].node.peer_count(),
+        1,
+        "Peer should exist before disconnect"
+    );
 
     // Node 0 sends Disconnect to node 1.
     let disconnect = crate::protocol::Disconnect::new(DisconnectReason::Shutdown);
@@ -301,7 +307,8 @@ async fn test_disconnect_clears_session() {
 
     // Peer must be gone.
     assert_eq!(
-        nodes[1].node.peer_count(), 0,
+        nodes[1].node.peer_count(),
+        0,
         "Peer should be removed after disconnect"
     );
 
@@ -309,7 +316,8 @@ async fn test_disconnect_clears_session() {
     // Before the fix, session_count() would still be 1 here because
     // remove_active_peer didn't remove self.sessions[node0_addr].
     assert_eq!(
-        nodes[1].node.session_count(), 0,
+        nodes[1].node.session_count(),
+        0,
         "Session must be cleaned up when peer is removed (regression: issue #5)"
     );
 

src/node/tests/discovery.rs

@@ -149,10 +149,8 @@ async fn test_response_transit_needs_recent_request() {
         .duration_since(std::time::UNIX_EPOCH)
         .unwrap()
         .as_millis() as u64;
-    node.recent_requests.insert(
-        444,
-        RecentRequest::new(make_node_addr(0xDD), now_ms),
-    );
+    node.recent_requests
+        .insert(444, RecentRequest::new(make_node_addr(0xDD), now_ms));
 
     // Handle response — should try to reverse-path forward to 0xDD
     // (will fail silently since 0xDD is not an actual peer)
@@ -282,11 +280,7 @@ async fn test_response_coord_substitution_detected() {
     let target = *target_identity.node_addr();
     let root = make_node_addr(0xF0);
     let real_coords = TreeCoordinate::from_addrs(vec![target, root]).unwrap();
-    let fake_coords = TreeCoordinate::from_addrs(vec![
-        target,
-        make_node_addr(0xEE),
-        root,
-    ]).unwrap();
+    let fake_coords = TreeCoordinate::from_addrs(vec![target, make_node_addr(0xEE), root]).unwrap();
 
     // Register target in identity_cache
     node.register_identity(target, target_identity.pubkey_full());
@@ -325,16 +319,12 @@ async fn test_recent_request_expiry() {
         .as_millis() as u64;
 
     // Insert an old request (11 seconds ago)
-    node.recent_requests.insert(
-        123,
-        RecentRequest::new(make_node_addr(1), now_ms - 11_000),
-    );
+    node.recent_requests
+        .insert(123, RecentRequest::new(make_node_addr(1), now_ms - 11_000));
 
     // Insert a recent request
-    node.recent_requests.insert(
-        456,
-        RecentRequest::new(make_node_addr(2), now_ms),
-    );
+    node.recent_requests
+        .insert(456, RecentRequest::new(make_node_addr(2), now_ms));
 
     assert_eq!(node.recent_requests.len(), 2);
 
@@ -344,7 +334,8 @@ async fn test_recent_request_expiry() {
     let coords = TreeCoordinate::from_addrs(vec![origin, make_node_addr(0)]).unwrap();
     let request = LookupRequest::new(789, target, origin, coords, 3, 0);
     let payload = &request.encode()[1..];
-    node.handle_lookup_request(&make_node_addr(0xAA), payload).await;
+    node.handle_lookup_request(&make_node_addr(0xAA), payload)
+        .await;
 
     // Old entry (123) should be purged, recent entry (456) and new entry (789) kept
     assert!(!node.recent_requests.contains_key(&123));
@@ -381,7 +372,10 @@ async fn test_request_forwarding_two_node() {
     // Process packets — node1 should receive the forwarded request
     tokio::time::sleep(Duration::from_millis(50)).await;
     let count = process_available_packets(&mut nodes).await;
-    assert!(count > 0, "Expected forwarded LookupRequest to arrive at node 1");
+    assert!(
+        count > 0,
+        "Expected forwarded LookupRequest to arrive at node 1"
+    );
 
     // Node1 should have recorded the request
     assert!(
@@ -546,10 +540,7 @@ async fn test_discovery_100_nodes() {
     }
 
     // Collect all node addresses and public keys for lookup targets
-    let all_addrs: Vec<NodeAddr> = nodes
-        .iter()
-        .map(|tn| *tn.node.node_addr())
-        .collect();
+    let all_addrs: Vec<NodeAddr> = nodes.iter().map(|tn| *tn.node.node_addr()).collect();
     let all_pubkeys: Vec<secp256k1::PublicKey> = nodes
         .iter()
         .map(|tn| tn.node.identity().pubkey_full())
@@ -563,7 +554,8 @@ async fn test_discovery_100_nodes() {
             if src == dst {
                 continue;
             }
-            node.node.register_identity(all_addrs[dst], all_pubkeys[dst]);
+            node.node
+                .register_identity(all_addrs[dst], all_pubkeys[dst]);
         }
     }
 
@@ -588,10 +580,7 @@ async fn test_discovery_100_nodes() {
         let mut initiated = false;
         for &(s, dst) in &lookup_pairs {
             if s == src {
-                nodes[src]
-                    .node
-                    .initiate_lookup(&all_addrs[dst], TTL)
-                    .await;
+                nodes[src].node.initiate_lookup(&all_addrs[dst], TTL).await;
                 initiated = true;
             }
         }
@@ -628,7 +617,11 @@ async fn test_discovery_100_nodes() {
     let mut failed_pairs: Vec<(usize, usize)> = Vec::new();
 
     for &(src, dst) in &lookup_pairs {
-        if nodes[src].node.coord_cache().contains(&all_addrs[dst], now_ms) {
+        if nodes[src]
+            .node
+            .coord_cache()
+            .contains(&all_addrs[dst], now_ms)
+        {
             resolved += 1;
         } else {
             failed += 1;
@@ -638,9 +631,7 @@ async fn test_discovery_100_nodes() {
         }
     }
 
-    eprintln!(
-        "\n  === Discovery 100-Node Test ===",
-    );
+    eprintln!("\n  === Discovery 100-Node Test ===",);
     eprintln!(
         "  Lookups: {} | Resolved: {} | Failed: {} | Success rate: {:.1}%",
         total_lookups,
@@ -651,8 +642,16 @@ async fn test_discovery_100_nodes() {
 
     // Report coord_cache stats across all nodes
     let total_cached: usize = nodes.iter().map(|tn| tn.node.coord_cache().len()).sum();
-    let min_cached = nodes.iter().map(|tn| tn.node.coord_cache().len()).min().unwrap();
-    let max_cached = nodes.iter().map(|tn| tn.node.coord_cache().len()).max().unwrap();
+    let min_cached = nodes
+        .iter()
+        .map(|tn| tn.node.coord_cache().len())
+        .min()
+        .unwrap();
+    let max_cached = nodes
+        .iter()
+        .map(|tn| tn.node.coord_cache().len())
+        .max()
+        .unwrap();
     eprintln!(
         "  Coord cache entries: total={} min={} max={} avg={:.1}",
         total_cached,
@@ -663,21 +662,32 @@ async fn test_discovery_100_nodes() {
 
     // Detailed diagnostics for failures (to aid future debugging)
     if !failed_pairs.is_empty() {
-        eprintln!("  --- Failure Diagnostics ({} failures) ---", failed_pairs.len());
+        eprintln!(
+            "  --- Failure Diagnostics ({} failures) ---",
+            failed_pairs.len()
+        );
         for &(src, dst) in &failed_pairs {
             let src_coords = nodes[src].node.tree_state().my_coords().clone();
             let dst_coords = nodes[dst].node.tree_state().my_coords().clone();
             let tree_dist = src_coords.distance_to(&dst_coords);
-            let reverse_cached = nodes[dst].node.coord_cache().contains(&all_addrs[src], now_ms);
+            let reverse_cached = nodes[dst]
+                .node
+                .coord_cache()
+                .contains(&all_addrs[src], now_ms);
             let src_peers = nodes[src].node.peers.len();
             let dst_peers = nodes[dst].node.peers.len();
 
             eprintln!(
                 "    node {} -> node {}: tree_dist={} src_depth={} dst_depth={} \
                  src_peers={} dst_peers={} reverse_cached={}",
-                src, dst, tree_dist,
-                src_coords.depth(), dst_coords.depth(),
-                src_peers, dst_peers, reverse_cached
+                src,
+                dst,
+                tree_dist,
+                src_coords.depth(),
+                dst_coords.depth(),
+                src_peers,
+                dst_peers,
+                reverse_cached
             );
         }
     }
@@ -730,7 +740,9 @@ async fn test_response_path_mtu_two_node() {
 
     // Check that path_mtu was stored in the cache entry
     let entry = nodes[0].node.coord_cache().get_entry(&node1_addr).unwrap();
-    let path_mtu = entry.path_mtu().expect("path_mtu should be set from discovery");
+    let path_mtu = entry
+        .path_mtu()
+        .expect("path_mtu should be set from discovery");
     // In a 2-node setup, no transit node applies the min() so path_mtu stays u16::MAX
     assert_eq!(
         path_mtu,
@@ -774,7 +786,9 @@ async fn test_response_path_mtu_three_node_chain() {
 
     // Node1 is transit and applies min(u16::MAX, 1280) = 1280
     let entry = nodes[0].node.coord_cache().get_entry(&node2_addr).unwrap();
-    let path_mtu = entry.path_mtu().expect("path_mtu should be set from discovery");
+    let path_mtu = entry
+        .path_mtu()
+        .expect("path_mtu should be set from discovery");
     assert_eq!(
         path_mtu, 1280,
         "Three-node chain path_mtu should reflect transit node's transport MTU (1280)"
@@ -796,12 +810,8 @@ async fn test_cache_entry_path_mtu_stored() {
     let coords = TreeCoordinate::from_addrs(vec![target, make_node_addr(0)]).unwrap();
 
     let now_ms = 1000u64;
-    node.coord_cache_mut().insert_with_path_mtu(
-        target,
-        coords,
-        now_ms,
-        1280,
-    );
+    node.coord_cache_mut()
+        .insert_with_path_mtu(target, coords, now_ms, 1280);
 
     let entry = node.coord_cache().get_entry(&target).unwrap();
     assert_eq!(entry.path_mtu(), Some(1280));

src/node/tests/ethernet.rs

@@ -6,8 +6,8 @@
 use super::*;
 use crate::config::EthernetConfig;
 use crate::transport::ethernet::EthernetTransport;
-use crate::transport::{packet_channel, TransportAddr, TransportHandle, TransportId};
-use spanning_tree::{cleanup_nodes, drain_all_packets, initiate_handshake, TestNode};
+use crate::transport::{TransportAddr, TransportHandle, TransportId, packet_channel};
+use spanning_tree::{TestNode, cleanup_nodes, drain_all_packets, initiate_handshake};
 
 use std::process::Command;
 use std::sync::atomic::{AtomicU32, Ordering};
@@ -40,7 +40,9 @@ impl VethPair {
 
         // Create veth pair
         let status = Command::new("ip")
-            .args(["link", "add", &name_a, "type", "veth", "peer", "name", &name_b])
+            .args([
+                "link", "add", &name_a, "type", "veth", "peer", "name", &name_b,
+            ])
             .status()
             .expect("failed to run 'ip link add'");
         assert!(status.success(), "failed to create veth pair");
@@ -91,7 +93,9 @@ async fn make_test_node_ethernet(interface: &str) -> TestNode {
     let mut transport = EthernetTransport::new(transport_id, None, config, packet_tx);
     transport.start_async().await.unwrap();
 
-    let mac = transport.local_mac().expect("transport should have MAC after start");
+    let mac = transport
+        .local_mac()
+        .expect("transport should have MAC after start");
     let addr = TransportAddr::from_bytes(&mac);
 
     node.transports

src/node/tests/forwarding.rs

@@ -5,12 +5,11 @@
 //! multi-hop forwarding through live node topologies.
 
 use super::*;
-use crate::node::session_wire::{build_fsp_header, FSP_FLAG_CP};
+use crate::node::session_wire::{FSP_FLAG_CP, build_fsp_header};
 use crate::protocol::{SessionAck, SessionDatagram, SessionSetup, encode_coords};
 use crate::tree::TreeCoordinate;
 use spanning_tree::{
-    cleanup_nodes, process_available_packets, run_tree_test, verify_tree_convergence,
-    TestNode,
+    TestNode, cleanup_nodes, process_available_packets, run_tree_test, verify_tree_convergence,
 };
 
 // ============================================================================
@@ -35,11 +34,11 @@ async fn test_forwarding_hop_limit_exhausted() {
     let from = make_node_addr(0xAA);
     let src = make_node_addr(0x01);
     let dest = make_node_addr(0x02);
-    let dg = SessionDatagram::new(src, dest, vec![0x10, 0x00, 0x00, 0x00])
-        .with_ttl(0);
+    let dg = SessionDatagram::new(src, dest, vec![0x10, 0x00, 0x00, 0x00]).with_ttl(0);
     let encoded = dg.encode();
     // Dispatch with payload after msg_type byte
-    node.handle_session_datagram(&from, &encoded[1..], false).await;
+    node.handle_session_datagram(&from, &encoded[1..], false)
+        .await;
     // No panic, no send (node has no peers)
 }
 
@@ -52,11 +51,11 @@ async fn test_forwarding_hop_limit_one_drops_at_transit() {
     let from = make_node_addr(0xAA);
     let my_addr = *node.node_addr();
     let src = make_node_addr(0x01);
-    let dg = SessionDatagram::new(src, my_addr, vec![0x10, 0x00, 0x00, 0x00])
-        .with_ttl(1);
+    let dg = SessionDatagram::new(src, my_addr, vec![0x10, 0x00, 0x00, 0x00]).with_ttl(1);
     let encoded = dg.encode();
     // Should succeed — ttl=1 decrements to 0 but packet is still processed
-    node.handle_session_datagram(&from, &encoded[1..], false).await;
+    node.handle_session_datagram(&from, &encoded[1..], false)
+        .await;
 }
 
 // --- Local delivery ---
@@ -69,7 +68,8 @@ async fn test_forwarding_local_delivery() {
     let dg = SessionDatagram::new(from, my_addr, vec![0x10, 0x00, 0x00, 0x00]);
     let encoded = dg.encode();
     // Should detect local delivery and return without forwarding
-    node.handle_session_datagram(&from, &encoded[1..], false).await;
+    node.handle_session_datagram(&from, &encoded[1..], false)
+        .await;
 }
 
 // --- Direct peer forwarding ---
@@ -135,7 +135,8 @@ async fn test_coord_cache_warming_session_setup() {
 
     // Handle the datagram (will be local delivery or no-route, but cache warming
     // happens before routing decision)
-    node.handle_session_datagram(&from, &encoded[1..], false).await;
+    node.handle_session_datagram(&from, &encoded[1..], false)
+        .await;
 
     // After: both src and dest coords should be cached
     let cached_src = node.coord_cache().get(&src_addr, now_ms);
@@ -175,15 +176,22 @@ async fn test_coord_cache_warming_session_ack() {
     assert!(node.coord_cache().get(&src_addr, now_ms).is_none());
     assert!(node.coord_cache().get(&dest_addr, now_ms).is_none());
 
-    node.handle_session_datagram(&from, &encoded[1..], false).await;
+    node.handle_session_datagram(&from, &encoded[1..], false)
+        .await;
 
     // SessionAck caches both src_coords and dest_coords
     let cached_src = node.coord_cache().get(&src_addr, now_ms);
-    assert!(cached_src.is_some(), "src_addr coords not cached from SessionAck");
+    assert!(
+        cached_src.is_some(),
+        "src_addr coords not cached from SessionAck"
+    );
     assert_eq!(cached_src.unwrap().root_id(), &root_addr);
 
     let cached_dest = node.coord_cache().get(&dest_addr, now_ms);
-    assert!(cached_dest.is_some(), "dest_addr coords not cached from SessionAck");
+    assert!(
+        cached_dest.is_some(),
+        "dest_addr coords not cached from SessionAck"
+    );
     assert_eq!(cached_dest.unwrap().root_id(), &root_addr);
 }
 
@@ -217,7 +225,8 @@ async fn test_coord_cache_warming_encrypted_msg_with_coords() {
     assert!(node.coord_cache().get(&src_addr, now_ms).is_none());
     assert!(node.coord_cache().get(&dest_addr, now_ms).is_none());
 
-    node.handle_session_datagram(&from, &encoded[1..], false).await;
+    node.handle_session_datagram(&from, &encoded[1..], false)
+        .await;
 
     assert!(
         node.coord_cache().get(&src_addr, now_ms).is_some(),
@@ -250,7 +259,8 @@ async fn test_coord_cache_warming_encrypted_msg_no_coords() {
         .unwrap()
         .as_millis() as u64;
 
-    node.handle_session_datagram(&from, &encoded[1..], false).await;
+    node.handle_session_datagram(&from, &encoded[1..], false)
+        .await;
 
     assert!(
         node.coord_cache().get(&src_addr, now_ms).is_none(),
@@ -512,8 +522,16 @@ async fn test_forwarding_with_cache_warming_enables_routing() {
                 // Give each node coords for its direct peers only
                 let j_addr = *nodes[j].node.node_addr();
                 if nodes[i].node.get_peer(&j_addr).is_some() {
-                    let coords = all_coords.iter().find(|(a, _)| a == &j_addr).unwrap().1.clone();
-                    nodes[i].node.coord_cache_mut().insert(j_addr, coords, now_ms);
+                    let coords = all_coords
+                        .iter()
+                        .find(|(a, _)| a == &j_addr)
+                        .unwrap()
+                        .1
+                        .clone();
+                    nodes[i]
+                        .node
+                        .coord_cache_mut()
+                        .insert(j_addr, coords, now_ms);
                 }
             }
         }
@@ -572,8 +590,8 @@ async fn test_forwarding_with_cache_warming_enables_routing() {
 // ECN Tests
 // ============================================================================
 
-use crate::node::handlers::session::mark_ipv6_ecn_ce;
 use crate::node::TransportDropState;
+use crate::node::handlers::session::mark_ipv6_ecn_ce;
 use crate::transport::TransportId;
 
 /// Build a minimal IPv6 header (40 bytes) with specified ECN bits.
@@ -721,10 +739,13 @@ fn test_detect_congestion_with_transport_drops() {
 
     // Simulate transport kernel drops
     let tid = TransportId::new(1);
-    node.transport_drops.insert(tid, TransportDropState {
-        prev_drops: 100,
-        dropping: true,
-    });
+    node.transport_drops.insert(
+        tid,
+        TransportDropState {
+            prev_drops: 100,
+            dropping: true,
+        },
+    );
 
     // Now detect_congestion should return true (local transport congestion)
     assert!(node.detect_congestion(&fake_addr));
@@ -741,10 +762,13 @@ fn test_detect_congestion_disabled_ecn() {
 
     // Even with transport drops, disabled ECN should return false
     let tid = TransportId::new(1);
-    node.transport_drops.insert(tid, TransportDropState {
-        prev_drops: 50,
-        dropping: true,
-    });
+    node.transport_drops.insert(
+        tid,
+        TransportDropState {
+            prev_drops: 50,
+            dropping: true,
+        },
+    );
 
     let fake_addr = NodeAddr::from_bytes([1; 16]);
     assert!(!node.detect_congestion(&fake_addr));
@@ -756,10 +780,13 @@ fn test_sample_transport_congestion() {
 
     // Insert a transport drop state with a baseline
     let tid = TransportId::new(1);
-    node.transport_drops.insert(tid, TransportDropState {
-        prev_drops: 0,
-        dropping: false,
-    });
+    node.transport_drops.insert(
+        tid,
+        TransportDropState {
+            prev_drops: 0,
+            dropping: false,
+        },
+    );
 
     // No transports registered — sample_transport_congestion is a no-op
     // (transport_drops entry stays unchanged)

src/node/tests/handshake.rs

@@ -5,9 +5,11 @@ use super::*;
 #[tokio::test]
 async fn test_two_node_handshake_udp() {
     use crate::config::UdpConfig;
+    use crate::node::wire::{
+        build_encrypted, build_established_header, build_msg1, prepend_inner_header,
+    };
     use crate::transport::udp::UdpTransport;
-    use crate::node::wire::{build_encrypted, build_established_header, build_msg1, prepend_inner_header};
-    use tokio::time::{timeout, Duration};
+    use tokio::time::{Duration, timeout};
 
     // === Setup: Two nodes with UDP transports on localhost ===
 
@@ -26,10 +28,8 @@ async fn test_two_node_handshake_udp() {
     let (packet_tx_a, mut packet_rx_a) = packet_channel(64);
     let (packet_tx_b, mut packet_rx_b) = packet_channel(64);
 
-    let mut transport_a =
-        UdpTransport::new(transport_id_a, None, udp_config.clone(), packet_tx_a);
-    let mut transport_b =
-        UdpTransport::new(transport_id_b, None, udp_config, packet_tx_b);
+    let mut transport_a = UdpTransport::new(transport_id_a, None, udp_config.clone(), packet_tx_a);
+    let mut transport_b = UdpTransport::new(transport_id_b, None, udp_config, packet_tx_b);
 
     transport_a.start_async().await.unwrap();
     transport_b.start_async().await.unwrap();
@@ -49,23 +49,20 @@ async fn test_two_node_handshake_udp() {
     // === Phase 1: Node A initiates handshake to Node B ===
 
     // Create peer identity for B (must use full key for ECDH parity)
-    let peer_b_identity =
-        PeerIdentity::from_pubkey_full(node_b.identity.pubkey_full());
+    let peer_b_identity = PeerIdentity::from_pubkey_full(node_b.identity.pubkey_full());
     let peer_b_node_addr = *peer_b_identity.node_addr();
 
     let link_id_a = node_a.allocate_link_id();
-    let mut conn_a = PeerConnection::outbound(
-        link_id_a,
-        peer_b_identity,
-        1000,
-    );
+    let mut conn_a = PeerConnection::outbound(link_id_a, peer_b_identity, 1000);
 
     // Allocate session index for A's outbound
     let our_index_a = node_a.index_allocator.allocate().unwrap();
 
     // Start handshake (generates Noise IK msg1)
     let our_keypair_a = node_a.identity.keypair();
-    let noise_msg1 = conn_a.start_handshake(our_keypair_a, node_a.startup_epoch, 1000).unwrap();
+    let noise_msg1 = conn_a
+        .start_handshake(our_keypair_a, node_a.startup_epoch, 1000)
+        .unwrap();
     conn_a.set_our_index(our_index_a);
     conn_a.set_transport_id(transport_id_a);
     conn_a.set_source_addr(remote_addr_b.clone());
@@ -82,10 +79,9 @@ async fn test_two_node_handshake_udp() {
     );
     node_a.links.insert(link_id_a, link_a);
     node_a.connections.insert(link_id_a, conn_a);
-    node_a.pending_outbound.insert(
-        (transport_id_a, our_index_a.as_u32()),
-        link_id_a,
-    );
+    node_a
+        .pending_outbound
+        .insert((transport_id_a, our_index_a.as_u32()), link_id_a);
 
     // Send msg1 from A to B over UDP
     let transport = node_a.transports.get(&transport_id_a).unwrap();
@@ -104,11 +100,13 @@ async fn test_two_node_handshake_udp() {
     node_b.handle_msg1(packet_b).await;
 
     // Verify B promoted the inbound connection
-    let peer_a_node_addr = *PeerIdentity::from_pubkey_full(
-        node_a.identity.pubkey_full(),
-    )
-    .node_addr();
-    assert_eq!(node_b.peer_count(), 1, "Node B should have 1 peer after msg1");
+    let peer_a_node_addr =
+        *PeerIdentity::from_pubkey_full(node_a.identity.pubkey_full()).node_addr();
+    assert_eq!(
+        node_b.peer_count(),
+        1,
+        "Node B should have 1 peer after msg1"
+    );
     let peer_a_on_b = node_b
         .get_peer(&peer_a_node_addr)
         .expect("Node B should have peer A");
@@ -134,7 +132,11 @@ async fn test_two_node_handshake_udp() {
     node_a.handle_msg2(packet_a).await;
 
     // Verify A promoted the outbound connection
-    assert_eq!(node_a.peer_count(), 1, "Node A should have 1 peer after msg2");
+    assert_eq!(
+        node_a.peer_count(),
+        1,
+        "Node A should have 1 peer after msg2"
+    );
     let peer_b_on_a = node_a
         .get_peer(&peer_b_node_addr)
         .expect("Node A should have peer B");
@@ -241,8 +243,8 @@ async fn test_two_node_handshake_udp() {
 #[tokio::test]
 async fn test_run_rx_loop_handshake() {
     use crate::config::UdpConfig;
-    use crate::transport::udp::UdpTransport;
     use crate::node::wire::build_msg1;
+    use crate::transport::udp::UdpTransport;
     use tokio::time::Duration;
 
     // === Setup: Two nodes with UDP transports on localhost ===
@@ -262,10 +264,8 @@ async fn test_run_rx_loop_handshake() {
     let (packet_tx_a, packet_rx_a) = packet_channel(64);
     let (packet_tx_b, packet_rx_b) = packet_channel(64);
 
-    let mut transport_a =
-        UdpTransport::new(transport_id_a, None, udp_config.clone(), packet_tx_a);
-    let mut transport_b =
-        UdpTransport::new(transport_id_b, None, udp_config, packet_tx_b);
+    let mut transport_a = UdpTransport::new(transport_id_a, None, udp_config.clone(), packet_tx_a);
+    let mut transport_b = UdpTransport::new(transport_id_b, None, udp_config, packet_tx_b);
 
     transport_a.start_async().await.unwrap();
     transport_b.start_async().await.unwrap();
@@ -290,20 +290,17 @@ async fn test_run_rx_loop_handshake() {
 
     // === Phase 1: Node A initiates handshake to Node B ===
 
-    let peer_b_identity =
-        PeerIdentity::from_pubkey_full(node_b.identity.pubkey_full());
+    let peer_b_identity = PeerIdentity::from_pubkey_full(node_b.identity.pubkey_full());
     let peer_b_node_addr = *peer_b_identity.node_addr();
 
     let link_id_a = node_a.allocate_link_id();
-    let mut conn_a = PeerConnection::outbound(
-        link_id_a,
-        peer_b_identity,
-        1000,
-    );
+    let mut conn_a = PeerConnection::outbound(link_id_a, peer_b_identity, 1000);
 
     let our_index_a = node_a.index_allocator.allocate().unwrap();
     let our_keypair_a = node_a.identity.keypair();
-    let noise_msg1 = conn_a.start_handshake(our_keypair_a, node_a.startup_epoch, 1000).unwrap();
+    let noise_msg1 = conn_a
+        .start_handshake(our_keypair_a, node_a.startup_epoch, 1000)
+        .unwrap();
     conn_a.set_our_index(our_index_a);
     conn_a.set_transport_id(transport_id_a);
     conn_a.set_source_addr(remote_addr_b.clone());
@@ -319,10 +316,9 @@ async fn test_run_rx_loop_handshake() {
     );
     node_a.links.insert(link_id_a, link_a);
     node_a.connections.insert(link_id_a, conn_a);
-    node_a.pending_outbound.insert(
-        (transport_id_a, our_index_a.as_u32()),
-        link_id_a,
-    );
+    node_a
+        .pending_outbound
+        .insert((transport_id_a, our_index_a.as_u32()), link_id_a);
 
     // Send msg1 from A to B over real UDP
     let transport = node_a.transports.get(&transport_id_a).unwrap();
@@ -350,12 +346,14 @@ async fn test_run_rx_loop_handshake() {
     }
 
     // Verify Node B promoted the inbound connection via rx loop dispatch
-    let peer_a_node_addr = *PeerIdentity::from_pubkey_full(
-        node_a.identity.pubkey_full(),
-    )
-    .node_addr();
+    let peer_a_node_addr =
+        *PeerIdentity::from_pubkey_full(node_a.identity.pubkey_full()).node_addr();
 
-    assert_eq!(node_b.peer_count(), 1, "Node B should have 1 peer after rx loop processed msg1");
+    assert_eq!(
+        node_b.peer_count(),
+        1,
+        "Node B should have 1 peer after rx loop processed msg1"
+    );
     let peer_a_on_b = node_b
         .get_peer(&peer_a_node_addr)
         .expect("Node B should have peer A");
@@ -390,7 +388,11 @@ async fn test_run_rx_loop_handshake() {
     }
 
     // Verify Node A promoted the outbound connection via rx loop dispatch
-    assert_eq!(node_a.peer_count(), 1, "Node A should have 1 peer after rx loop processed msg2");
+    assert_eq!(
+        node_a.peer_count(),
+        1,
+        "Node A should have 1 peer after rx loop processed msg2"
+    );
     let peer_b_on_a = node_a
         .get_peer(&peer_b_node_addr)
         .expect("Node A should have peer B");
@@ -432,9 +434,9 @@ async fn test_run_rx_loop_handshake() {
 #[tokio::test]
 async fn test_cross_connection_both_initiate() {
     use crate::config::UdpConfig;
-    use crate::transport::udp::UdpTransport;
     use crate::node::wire::build_msg1;
-    use tokio::time::{timeout, Duration};
+    use crate::transport::udp::UdpTransport;
+    use tokio::time::{Duration, timeout};
 
     // === Setup: Two nodes with UDP transports on localhost ===
 
@@ -453,10 +455,8 @@ async fn test_cross_connection_both_initiate() {
     let (packet_tx_a, mut packet_rx_a) = packet_channel(64);
     let (packet_tx_b, mut packet_rx_b) = packet_channel(64);
 
-    let mut transport_a =
-        UdpTransport::new(transport_id_a, None, udp_config.clone(), packet_tx_a);
-    let mut transport_b =
-        UdpTransport::new(transport_id_b, None, udp_config, packet_tx_b);
+    let mut transport_a = UdpTransport::new(transport_id_a, None, udp_config.clone(), packet_tx_a);
+    let mut transport_b = UdpTransport::new(transport_id_b, None, udp_config, packet_tx_b);
 
     transport_a.start_async().await.unwrap();
     transport_b.start_async().await.unwrap();
@@ -474,11 +474,9 @@ async fn test_cross_connection_both_initiate() {
         .insert(transport_id_b, TransportHandle::Udp(transport_b));
 
     // Peer identities (must use full key for ECDH parity)
-    let peer_b_identity =
-        PeerIdentity::from_pubkey_full(node_b.identity.pubkey_full());
+    let peer_b_identity = PeerIdentity::from_pubkey_full(node_b.identity.pubkey_full());
     let peer_b_node_addr = *peer_b_identity.node_addr();
-    let peer_a_identity =
-        PeerIdentity::from_pubkey_full(node_a.identity.pubkey_full());
+    let peer_a_identity = PeerIdentity::from_pubkey_full(node_a.identity.pubkey_full());
     let peer_a_node_addr = *peer_a_identity.node_addr();
 
     // === Phase 1: Both nodes initiate handshakes (simulate auto_connect) ===
@@ -488,7 +486,9 @@ async fn test_cross_connection_both_initiate() {
     let mut conn_a = PeerConnection::outbound(link_id_a_out, peer_b_identity, 1000);
     let our_index_a = node_a.index_allocator.allocate().unwrap();
     let our_keypair_a = node_a.identity.keypair();
-    let noise_msg1_a = conn_a.start_handshake(our_keypair_a, node_a.startup_epoch, 1000).unwrap();
+    let noise_msg1_a = conn_a
+        .start_handshake(our_keypair_a, node_a.startup_epoch, 1000)
+        .unwrap();
     conn_a.set_our_index(our_index_a);
     conn_a.set_transport_id(transport_id_a);
     conn_a.set_source_addr(remote_addr_b.clone());
@@ -496,20 +496,29 @@ async fn test_cross_connection_both_initiate() {
     let wire_msg1_a = build_msg1(our_index_a, &noise_msg1_a);
 
     let link_a_out = Link::connectionless(
-        link_id_a_out, transport_id_a, remote_addr_b.clone(),
-        LinkDirection::Outbound, Duration::from_millis(100),
+        link_id_a_out,
+        transport_id_a,
+        remote_addr_b.clone(),
+        LinkDirection::Outbound,
+        Duration::from_millis(100),
     );
     node_a.links.insert(link_id_a_out, link_a_out);
-    node_a.addr_to_link.insert((transport_id_a, remote_addr_b.clone()), link_id_a_out);
+    node_a
+        .addr_to_link
+        .insert((transport_id_a, remote_addr_b.clone()), link_id_a_out);
     node_a.connections.insert(link_id_a_out, conn_a);
-    node_a.pending_outbound.insert((transport_id_a, our_index_a.as_u32()), link_id_a_out);
+    node_a
+        .pending_outbound
+        .insert((transport_id_a, our_index_a.as_u32()), link_id_a_out);
 
     // Node B initiates to Node A
     let link_id_b_out = node_b.allocate_link_id();
     let mut conn_b = PeerConnection::outbound(link_id_b_out, peer_a_identity, 1000);
     let our_index_b = node_b.index_allocator.allocate().unwrap();
     let our_keypair_b = node_b.identity.keypair();
-    let noise_msg1_b = conn_b.start_handshake(our_keypair_b, node_b.startup_epoch, 1000).unwrap();
+    let noise_msg1_b = conn_b
+        .start_handshake(our_keypair_b, node_b.startup_epoch, 1000)
+        .unwrap();
     conn_b.set_our_index(our_index_b);
     conn_b.set_transport_id(transport_id_b);
     conn_b.set_source_addr(remote_addr_a.clone());
@@ -517,20 +526,33 @@ async fn test_cross_connection_both_initiate() {
     let wire_msg1_b = build_msg1(our_index_b, &noise_msg1_b);
 
     let link_b_out = Link::connectionless(
-        link_id_b_out, transport_id_b, remote_addr_a.clone(),
-        LinkDirection::Outbound, Duration::from_millis(100),
+        link_id_b_out,
+        transport_id_b,
+        remote_addr_a.clone(),
+        LinkDirection::Outbound,
+        Duration::from_millis(100),
     );
     node_b.links.insert(link_id_b_out, link_b_out);
-    node_b.addr_to_link.insert((transport_id_b, remote_addr_a.clone()), link_id_b_out);
+    node_b
+        .addr_to_link
+        .insert((transport_id_b, remote_addr_a.clone()), link_id_b_out);
     node_b.connections.insert(link_id_b_out, conn_b);
-    node_b.pending_outbound.insert((transport_id_b, our_index_b.as_u32()), link_id_b_out);
+    node_b
+        .pending_outbound
+        .insert((transport_id_b, our_index_b.as_u32()), link_id_b_out);
 
     // Both send msg1 over UDP
     let transport = node_a.transports.get(&transport_id_a).unwrap();
-    transport.send(&remote_addr_b, &wire_msg1_a).await.expect("A send msg1");
+    transport
+        .send(&remote_addr_b, &wire_msg1_a)
+        .await
+        .expect("A send msg1");
 
     let transport = node_b.transports.get(&transport_id_b).unwrap();
-    transport.send(&remote_addr_a, &wire_msg1_b).await.expect("B send msg1");
+    transport
+        .send(&remote_addr_a, &wire_msg1_b)
+        .await
+        .expect("B send msg1");
 
     // === Phase 2: Both nodes receive the other's msg1 ===
     // Before the fix, addr_to_link would reject these because outbound links
@@ -538,21 +560,39 @@ async fn test_cross_connection_both_initiate() {
 
     // B receives A's msg1
     let packet_at_b = timeout(Duration::from_secs(1), packet_rx_b.recv())
-        .await.expect("Timeout").expect("Channel closed");
+        .await
+        .expect("Timeout")
+        .expect("Channel closed");
     node_b.handle_msg1(packet_at_b).await;
 
     // B should have promoted the inbound connection
-    assert_eq!(node_b.peer_count(), 1, "Node B should have 1 peer after processing A's msg1");
-    assert!(node_b.get_peer(&peer_a_node_addr).is_some(), "Node B should have peer A");
+    assert_eq!(
+        node_b.peer_count(),
+        1,
+        "Node B should have 1 peer after processing A's msg1"
+    );
+    assert!(
+        node_b.get_peer(&peer_a_node_addr).is_some(),
+        "Node B should have peer A"
+    );
 
     // A receives B's msg1
     let packet_at_a = timeout(Duration::from_secs(1), packet_rx_a.recv())
-        .await.expect("Timeout").expect("Channel closed");
+        .await
+        .expect("Timeout")
+        .expect("Channel closed");
     node_a.handle_msg1(packet_at_a).await;
 
     // A should have promoted the inbound connection
-    assert_eq!(node_a.peer_count(), 1, "Node A should have 1 peer after processing B's msg1");
-    assert!(node_a.get_peer(&peer_b_node_addr).is_some(), "Node A should have peer B");
+    assert_eq!(
+        node_a.peer_count(),
+        1,
+        "Node A should have 1 peer after processing B's msg1"
+    );
+    assert!(
+        node_a.get_peer(&peer_b_node_addr).is_some(),
+        "Node A should have peer B"
+    );
 
     // === Phase 3: Both nodes receive msg2 responses ===
     // The msg2 was sent during handle_msg1 processing. When handle_msg2
@@ -560,21 +600,37 @@ async fn test_cross_connection_both_initiate() {
 
     // A receives B's msg2 (response to A's original msg1)
     let msg2_at_a = timeout(Duration::from_secs(1), packet_rx_a.recv())
-        .await.expect("Timeout waiting for msg2 at A").expect("Channel closed");
+        .await
+        .expect("Timeout waiting for msg2 at A")
+        .expect("Channel closed");
     node_a.handle_msg2(msg2_at_a).await;
 
     // B receives A's msg2 (response to B's original msg1)
     let msg2_at_b = timeout(Duration::from_secs(1), packet_rx_b.recv())
-        .await.expect("Timeout waiting for msg2 at B").expect("Channel closed");
+        .await
+        .expect("Timeout waiting for msg2 at B")
+        .expect("Channel closed");
     node_b.handle_msg2(msg2_at_b).await;
 
     // === Verification ===
     // Both nodes should have exactly 1 peer each after cross-connection resolution
-    assert_eq!(node_a.peer_count(), 1, "Node A should have exactly 1 peer after cross-connection");
-    assert_eq!(node_b.peer_count(), 1, "Node B should have exactly 1 peer after cross-connection");
+    assert_eq!(
+        node_a.peer_count(),
+        1,
+        "Node A should have exactly 1 peer after cross-connection"
+    );
+    assert_eq!(
+        node_b.peer_count(),
+        1,
+        "Node B should have exactly 1 peer after cross-connection"
+    );
 
-    let peer_b_on_a = node_a.get_peer(&peer_b_node_addr).expect("A should have peer B");
-    let peer_a_on_b = node_b.get_peer(&peer_a_node_addr).expect("B should have peer A");
+    let peer_b_on_a = node_a
+        .get_peer(&peer_b_node_addr)
+        .expect("A should have peer B");
+    let peer_a_on_b = node_b
+        .get_peer(&peer_a_node_addr)
+        .expect("B should have peer A");
 
     assert!(peer_b_on_a.has_session(), "Peer B on A should have session");
     assert!(peer_a_on_b.has_session(), "Peer A on B should have session");
@@ -611,25 +667,35 @@ async fn test_stale_connection_cleanup() {
     // Allocate session index and set transport info
     let our_index = node.index_allocator.allocate().unwrap();
     let our_keypair = node.identity.keypair();
-    let _noise_msg1 = conn.start_handshake(our_keypair, node.startup_epoch, past_time_ms).unwrap();
+    let _noise_msg1 = conn
+        .start_handshake(our_keypair, node.startup_epoch, past_time_ms)
+        .unwrap();
     conn.set_our_index(our_index);
     conn.set_transport_id(transport_id);
     conn.set_source_addr(remote_addr.clone());
 
     // Set up all the state that initiate_peer_connection would create
     let link = Link::connectionless(
-        link_id, transport_id, remote_addr.clone(),
-        LinkDirection::Outbound, Duration::from_millis(100),
+        link_id,
+        transport_id,
+        remote_addr.clone(),
+        LinkDirection::Outbound,
+        Duration::from_millis(100),
     );
     node.links.insert(link_id, link);
-    node.addr_to_link.insert((transport_id, remote_addr.clone()), link_id);
+    node.addr_to_link
+        .insert((transport_id, remote_addr.clone()), link_id);
     node.connections.insert(link_id, conn);
-    node.pending_outbound.insert((transport_id, our_index.as_u32()), link_id);
+    node.pending_outbound
+        .insert((transport_id, our_index.as_u32()), link_id);
 
     // Verify state before timeout check
     assert_eq!(node.connection_count(), 1);
     assert_eq!(node.link_count(), 1);
-    assert!(node.pending_outbound.contains_key(&(transport_id, our_index.as_u32())));
+    assert!(
+        node.pending_outbound
+            .contains_key(&(transport_id, our_index.as_u32()))
+    );
     assert_eq!(node.index_allocator.count(), 1);
 
     // Connection was created at time 1000ms. check_timeouts uses SystemTime::now(),
@@ -637,13 +703,27 @@ async fn test_stale_connection_cleanup() {
     node.check_timeouts();
 
     // Verify everything was cleaned up
-    assert_eq!(node.connection_count(), 0, "Stale connection should be removed");
+    assert_eq!(
+        node.connection_count(),
+        0,
+        "Stale connection should be removed"
+    );
     assert_eq!(node.link_count(), 0, "Stale link should be removed");
-    assert!(!node.pending_outbound.contains_key(&(transport_id, our_index.as_u32())),
-        "pending_outbound should be cleaned up");
-    assert_eq!(node.index_allocator.count(), 0, "Session index should be freed");
-    assert!(!node.addr_to_link.contains_key(&(transport_id, remote_addr)),
-        "addr_to_link should be cleaned up");
+    assert!(
+        !node
+            .pending_outbound
+            .contains_key(&(transport_id, our_index.as_u32())),
+        "pending_outbound should be cleaned up"
+    );
+    assert_eq!(
+        node.index_allocator.count(),
+        0,
+        "Session index should be freed"
+    );
+    assert!(
+        !node.addr_to_link.contains_key(&(transport_id, remote_addr)),
+        "addr_to_link should be cleaned up"
+    );
 }
 
 /// Test that failed connections are cleaned up by check_timeouts().
@@ -665,29 +745,44 @@ async fn test_failed_connection_cleanup() {
 
     let our_index = node.index_allocator.allocate().unwrap();
     let our_keypair = node.identity.keypair();
-    let _noise_msg1 = conn.start_handshake(our_keypair, node.startup_epoch, now_ms).unwrap();
+    let _noise_msg1 = conn
+        .start_handshake(our_keypair, node.startup_epoch, now_ms)
+        .unwrap();
     conn.set_our_index(our_index);
     conn.set_transport_id(transport_id);
     conn.set_source_addr(remote_addr.clone());
     conn.mark_failed(); // Simulate send failure
 
     let link = Link::connectionless(
-        link_id, transport_id, remote_addr.clone(),
-        LinkDirection::Outbound, Duration::from_millis(100),
+        link_id,
+        transport_id,
+        remote_addr.clone(),
+        LinkDirection::Outbound,
+        Duration::from_millis(100),
     );
     node.links.insert(link_id, link);
-    node.addr_to_link.insert((transport_id, remote_addr.clone()), link_id);
+    node.addr_to_link
+        .insert((transport_id, remote_addr.clone()), link_id);
     node.connections.insert(link_id, conn);
-    node.pending_outbound.insert((transport_id, our_index.as_u32()), link_id);
+    node.pending_outbound
+        .insert((transport_id, our_index.as_u32()), link_id);
 
     assert_eq!(node.connection_count(), 1);
 
     // Failed connections should be cleaned up immediately regardless of age
     node.check_timeouts();
 
-    assert_eq!(node.connection_count(), 0, "Failed connection should be removed");
+    assert_eq!(
+        node.connection_count(),
+        0,
+        "Failed connection should be removed"
+    );
     assert_eq!(node.link_count(), 0, "Failed link should be removed");
-    assert_eq!(node.index_allocator.count(), 0, "Session index should be freed");
+    assert_eq!(
+        node.index_allocator.count(),
+        0,
+        "Session index should be freed"
+    );
 }
 
 /// Test that msg1 bytes are stored on connection for resend.
@@ -710,7 +805,9 @@ async fn test_msg1_stored_for_resend() {
 
     let our_index = node.index_allocator.allocate().unwrap();
     let our_keypair = node.identity.keypair();
-    let noise_msg1 = conn.start_handshake(our_keypair, node.startup_epoch, now_ms).unwrap();
+    let noise_msg1 = conn
+        .start_handshake(our_keypair, node.startup_epoch, now_ms)
+        .unwrap();
     conn.set_our_index(our_index);
     conn.set_transport_id(transport_id);
     conn.set_source_addr(remote_addr.clone());
@@ -741,7 +838,9 @@ async fn test_resend_scheduling() {
 
     let our_index = node.index_allocator.allocate().unwrap();
     let our_keypair = node.identity.keypair();
-    let noise_msg1 = conn.start_handshake(our_keypair, node.startup_epoch, now_ms).unwrap();
+    let noise_msg1 = conn
+        .start_handshake(our_keypair, node.startup_epoch, now_ms)
+        .unwrap();
     conn.set_our_index(our_index);
     conn.set_transport_id(transport_id);
     conn.set_source_addr(remote_addr.clone());
@@ -751,12 +850,17 @@ async fn test_resend_scheduling() {
     conn.set_handshake_msg1(wire_msg1, now_ms + 1000);
 
     let link = Link::connectionless(
-        link_id, transport_id, remote_addr.clone(),
-        LinkDirection::Outbound, Duration::from_millis(100),
+        link_id,
+        transport_id,
+        remote_addr.clone(),
+        LinkDirection::Outbound,
+        Duration::from_millis(100),
     );
     node.links.insert(link_id, link);
-    node.addr_to_link.insert((transport_id, remote_addr), link_id);
-    node.pending_outbound.insert((transport_id, our_index.as_u32()), link_id);
+    node.addr_to_link
+        .insert((transport_id, remote_addr), link_id);
+    node.pending_outbound
+        .insert((transport_id, our_index.as_u32()), link_id);
     node.connections.insert(link_id, conn);
 
     // Before resend time: nothing should happen (no transport = can't send,
@@ -772,7 +876,11 @@ async fn test_resend_scheduling() {
     // No transport registered, so send fails — count stays 0.
     // That's the expected behavior (transport absence is a transient condition).
     let conn = node.connections.get(&link_id).unwrap();
-    assert_eq!(conn.resend_count(), 0, "No transport means no resend recorded");
+    assert_eq!(
+        conn.resend_count(),
+        0,
+        "No transport means no resend recorded"
+    );
 }
 
 /// Test that msg2 is stored on PeerConnection for responder resend.

src/node/tests/mod.rs

@@ -1,7 +1,7 @@
 use super::*;
-use crate::utils::index::SessionIndex;
-use crate::transport::{packet_channel, LinkDirection, TransportAddr};
 use crate::PeerIdentity;
+use crate::transport::{LinkDirection, TransportAddr, packet_channel};
+use crate::utils::index::SessionIndex;
 use std::time::Duration;
 
 mod bloom;
@@ -54,7 +54,9 @@ pub(super) fn make_completed_connection(
 
     // Run initiator side of handshake
     let our_keypair = node.identity.keypair();
-    let msg1 = conn.start_handshake(our_keypair, node.startup_epoch, current_time_ms).unwrap();
+    let msg1 = conn
+        .start_handshake(our_keypair, node.startup_epoch, current_time_ms)
+        .unwrap();
 
     // Run responder side to generate msg2
     let mut resp_conn = PeerConnection::inbound(LinkId::new(999), current_time_ms);

src/node/tests/routing.rs

@@ -7,8 +7,8 @@ use super::*;
 use crate::bloom::BloomFilter;
 use crate::tree::{ParentDeclaration, TreeCoordinate};
 use spanning_tree::{
-    cleanup_nodes, drain_all_packets, generate_random_edges, initiate_handshake, make_test_node,
-    run_tree_test, verify_tree_convergence, TestNode,
+    TestNode, cleanup_nodes, drain_all_packets, generate_random_edges, initiate_handshake,
+    make_test_node, run_tree_test, verify_tree_convergence,
 };
 use std::collections::HashSet;
 
@@ -83,8 +83,7 @@ fn test_routing_bloom_filter_hit() {
 
     // Destination not directly connected — placed under peer1 in the tree
     let dest = make_node_addr(99);
-    let dest_coords =
-        TreeCoordinate::from_addrs(vec![dest, peer1_addr, my_addr]).unwrap();
+    let dest_coords = TreeCoordinate::from_addrs(vec![dest, peer1_addr, my_addr]).unwrap();
     let now_ms = std::time::SystemTime::now()
         .duration_since(std::time::UNIX_EPOCH)
         .map(|d| d.as_millis() as u64)
@@ -126,17 +125,14 @@ fn test_routing_bloom_filter_multiple_hits_tiebreak() {
     // Set up tree: we are root, all peers are our children (equidistant)
     for &addr in &peer_addrs {
         let coords = TreeCoordinate::from_addrs(vec![addr, my_addr]).unwrap();
-        node.tree_state_mut().update_peer(
-            ParentDeclaration::new(addr, my_addr, 1, 1000),
-            coords,
-        );
+        node.tree_state_mut()
+            .update_peer(ParentDeclaration::new(addr, my_addr, 1, 1000), coords);
     }
 
     // Destination placed under the first peer (arbitrary — all peers are
     // equidistant from dest since dest is 2 hops from root via any child)
     let dest = make_node_addr(99);
-    let dest_coords =
-        TreeCoordinate::from_addrs(vec![dest, peer_addrs[0], my_addr]).unwrap();
+    let dest_coords = TreeCoordinate::from_addrs(vec![dest, peer_addrs[0], my_addr]).unwrap();
     let now_ms = std::time::SystemTime::now()
         .duration_since(std::time::UNIX_EPOCH)
         .map(|d| d.as_millis() as u64)
@@ -187,8 +183,7 @@ fn test_routing_tree_fallback() {
 
     // Destination: a node under our peer in the tree
     let dest = make_node_addr(99);
-    let dest_coords =
-        TreeCoordinate::from_addrs(vec![dest, peer_addr, my_addr]).unwrap();
+    let dest_coords = TreeCoordinate::from_addrs(vec![dest, peer_addr, my_addr]).unwrap();
 
     // Put dest coords in the cache
     let now_ms = std::time::SystemTime::now()
@@ -239,8 +234,7 @@ fn test_routing_refreshes_coord_cache_ttl() {
 
     // Set up tree coordinates
     let dest = make_node_addr(99);
-    let dest_coords =
-        TreeCoordinate::from_addrs(vec![dest, peer_addr, my_addr]).unwrap();
+    let dest_coords = TreeCoordinate::from_addrs(vec![dest, peer_addr, my_addr]).unwrap();
     node.tree_state_mut().update_peer(
         ParentDeclaration::new(peer_addr, my_addr, 1, 1000),
         TreeCoordinate::from_addrs(vec![peer_addr, my_addr]).unwrap(),
@@ -252,7 +246,8 @@ fn test_routing_refreshes_coord_cache_ttl() {
         .map(|d| d.as_millis() as u64)
         .unwrap_or(0);
     let short_ttl = 10_000; // 10 seconds
-    node.coord_cache_mut().insert_with_ttl(dest, dest_coords, now_ms, short_ttl);
+    node.coord_cache_mut()
+        .insert_with_ttl(dest, dest_coords, now_ms, short_ttl);
     let original_expiry = node.coord_cache().get_entry(&dest).unwrap().expires_at();
 
     // find_next_hop should succeed and refresh TTL to now + default_ttl (300s)
@@ -263,7 +258,8 @@ fn test_routing_refreshes_coord_cache_ttl() {
     assert!(
         new_expiry > original_expiry,
         "find_next_hop should refresh the coord_cache TTL: original={}, new={}",
-        original_expiry, new_expiry,
+        original_expiry,
+        new_expiry,
     );
 }
 
@@ -384,11 +380,7 @@ async fn test_routing_chain_topology() {
     // Verify tree convergence
     let root = nodes.iter().map(|n| *n.node.node_addr()).min().unwrap();
     for tn in &nodes {
-        assert_eq!(
-            *tn.node.tree_state().root(),
-            root,
-            "Tree not converged"
-        );
+        assert_eq!(*tn.node.tree_state().root(), root, "Tree not converged");
     }
 
     // Populate coord caches: each node caches the far-end node's coords
@@ -453,8 +445,13 @@ async fn test_routing_bloom_preferred_over_tree() {
     // filter routing selects peer2 (strictly closer to dest than us).
     let dest = make_node_addr(99);
     let peer2_addr = *nodes[2].node.node_addr();
-    let mut dest_path: Vec<NodeAddr> =
-        nodes[2].node.tree_state().my_coords().node_addrs().copied().collect();
+    let mut dest_path: Vec<NodeAddr> = nodes[2]
+        .node
+        .tree_state()
+        .my_coords()
+        .node_addrs()
+        .copied()
+        .collect();
     dest_path.insert(0, dest);
     let dest_coords = TreeCoordinate::from_addrs(dest_path).unwrap();
     let now_ms = std::time::SystemTime::now()
@@ -602,13 +599,20 @@ async fn test_routing_reachability_100_nodes() {
     // Collect all (addr, coords) pairs first to avoid borrow issues
     let all_coords: Vec<(NodeAddr, TreeCoordinate)> = nodes
         .iter()
-        .map(|tn| (*tn.node.node_addr(), tn.node.tree_state().my_coords().clone()))
+        .map(|tn| {
+            (
+                *tn.node.node_addr(),
+                tn.node.tree_state().my_coords().clone(),
+            )
+        })
         .collect();
 
     for node in &mut nodes {
         for (addr, coords) in &all_coords {
             if addr != node.node.node_addr() {
-                node.node.coord_cache_mut().insert(*addr, coords.clone(), now_ms);
+                node.node
+                    .coord_cache_mut()
+                    .insert(*addr, coords.clone(), now_ms);
             }
         }
     }
@@ -654,10 +658,7 @@ async fn test_routing_reachability_100_nodes() {
         0.0
     };
 
-    eprintln!(
-        "\n  === Routing Reachability ({} nodes) ===",
-        NUM_NODES
-    );
+    eprintln!("\n  === Routing Reachability ({} nodes) ===", NUM_NODES);
     eprintln!(
         "  Pairs tested: {} | Delivered: {} | Failed: {} | Loops: {}",
         total_pairs,
@@ -665,10 +666,7 @@ async fn test_routing_reachability_100_nodes() {
         failures.len(),
         loops.len()
     );
-    eprintln!(
-        "  Hops: avg={:.1} max={}",
-        avg_hops, max_hops
-    );
+    eprintln!("  Hops: avg={:.1} max={}", avg_hops, max_hops);
 
     if !failures.is_empty() {
         let show = failures.len().min(10);
@@ -736,13 +734,20 @@ async fn test_routing_stops_after_peer_removal() {
 
     let all_coords: Vec<(NodeAddr, crate::tree::TreeCoordinate)> = nodes
         .iter()
-        .map(|tn| (*tn.node.node_addr(), tn.node.tree_state().my_coords().clone()))
+        .map(|tn| {
+            (
+                *tn.node.node_addr(),
+                tn.node.tree_state().my_coords().clone(),
+            )
+        })
         .collect();
 
     for node in &mut nodes {
         for (addr, coords) in &all_coords {
             if addr != node.node.node_addr() {
-                node.node.coord_cache_mut().insert(*addr, coords.clone(), now_ms);
+                node.node
+                    .coord_cache_mut()
+                    .insert(*addr, coords.clone(), now_ms);
             }
         }
     }
@@ -792,9 +797,12 @@ async fn test_routing_stops_after_peer_removal() {
     // matters is that delivery does NOT succeed.
     match simulate_forwarding(&mut nodes, &addr_index, 0, 3) {
         ForwardResult::NoRoute { .. } => {} // Expected: can't reach node 3
-        ForwardResult::Loop { .. } => {} // Also acceptable: stale coords cause loop detection
+        ForwardResult::Loop { .. } => {}    // Also acceptable: stale coords cause loop detection
         ForwardResult::Delivered(hops) => {
-            panic!("Should NOT deliver after partition, but got delivery in {} hops", hops);
+            panic!(
+                "Should NOT deliver after partition, but got delivery in {} hops",
+                hops
+            );
         }
     }
 
@@ -905,7 +913,12 @@ async fn test_routing_source_only_coords_100_nodes() {
     // Collect all coords for injection
     let all_coords: Vec<(NodeAddr, crate::tree::TreeCoordinate)> = nodes
         .iter()
-        .map(|tn| (*tn.node.node_addr(), tn.node.tree_state().my_coords().clone()))
+        .map(|tn| {
+            (
+                *tn.node.node_addr(),
+                tn.node.tree_state().my_coords().clone(),
+            )
+        })
         .collect();
 
     let addr_index = build_addr_index(&nodes);
@@ -946,7 +959,10 @@ async fn test_routing_source_only_coords_100_nodes() {
             ForwardResult::Delivered(_) => source_only_delivered += 1,
             ForwardResult::NoRoute { .. } => source_only_failed += 1,
             ForwardResult::Loop { .. } => {
-                panic!("Routing loop detected with source-only coords: {} -> {}", src, dst);
+                panic!(
+                    "Routing loop detected with source-only coords: {} -> {}",
+                    src, dst
+                );
             }
         }
     }
@@ -977,7 +993,9 @@ async fn test_routing_source_only_coords_100_nodes() {
     for node in &mut nodes {
         for (addr, coords) in &all_coords {
             if addr != node.node.node_addr() {
-                node.node.coord_cache_mut().insert(*addr, coords.clone(), now_ms);
+                node.node
+                    .coord_cache_mut()
+                    .insert(*addr, coords.clone(), now_ms);
             }
         }
     }
@@ -996,4 +1014,3 @@ async fn test_routing_source_only_coords_100_nodes() {
 
     cleanup_nodes(&mut nodes).await;
 }
-

src/node/tests/session.rs

@@ -3,8 +3,8 @@
 use super::*;
 use crate::node::session::EndToEndState;
 use crate::node::tests::spanning_tree::{
-    cleanup_nodes, generate_random_edges, process_available_packets, run_tree_test,
-    run_tree_test_with_mtus, verify_tree_convergence, TestNode,
+    TestNode, cleanup_nodes, generate_random_edges, process_available_packets, run_tree_test,
+    run_tree_test_with_mtus, verify_tree_convergence,
 };
 use crate::protocol::{SessionAck, SessionDatagram};
 
@@ -50,10 +50,7 @@ fn test_session_entry_new_initiating() {
     let identity_a = Identity::generate();
     let identity_b = Identity::generate();
 
-    let handshake = HandshakeState::new_initiator(
-        identity_a.keypair(),
-        identity_b.pubkey_full(),
-    );
+    let handshake = HandshakeState::new_initiator(identity_a.keypair(), identity_b.pubkey_full());
 
     let entry = crate::node::session::SessionEntry::new(
         *identity_b.node_addr(),
@@ -77,10 +74,7 @@ fn test_session_entry_touch() {
     let identity_a = Identity::generate();
     let identity_b = Identity::generate();
 
-    let handshake = HandshakeState::new_initiator(
-        identity_a.keypair(),
-        identity_b.pubkey_full(),
-    );
+    let handshake = HandshakeState::new_initiator(identity_a.keypair(), identity_b.pubkey_full());
 
     let mut entry = crate::node::session::SessionEntry::new(
         *identity_b.node_addr(),
@@ -102,10 +96,8 @@ fn test_session_table_operations() {
     let mut node = make_node();
     let identity_b = Identity::generate();
 
-    let handshake = HandshakeState::new_initiator(
-        node.identity().keypair(),
-        identity_b.pubkey_full(),
-    );
+    let handshake =
+        HandshakeState::new_initiator(node.identity().keypair(), identity_b.pubkey_full());
 
     let dest_addr = *identity_b.node_addr();
     let entry = crate::node::session::SessionEntry::new(
@@ -151,12 +143,14 @@ async fn test_session_direct_peer_handshake() {
 
     // Node 0 should have a session in Initiating state
     assert_eq!(nodes[0].node.session_count(), 1);
-    assert!(nodes[0]
-        .node
-        .get_session(&node1_addr)
-        .unwrap()
-        .state()
-        .is_initiating());
+    assert!(
+        nodes[0]
+            .node
+            .get_session(&node1_addr)
+            .unwrap()
+            .state()
+            .is_initiating()
+    );
 
     // Process packets: SessionSetup arrives at Node 1
     tokio::time::sleep(Duration::from_millis(20)).await;
@@ -165,12 +159,14 @@ async fn test_session_direct_peer_handshake() {
 
     // Node 1 should now have a session in AwaitingMsg3 state (XK: identity not yet known)
     assert_eq!(nodes[1].node.session_count(), 1);
-    assert!(nodes[1]
-        .node
-        .get_session(&node0_addr)
-        .unwrap()
-        .state()
-        .is_awaiting_msg3());
+    assert!(
+        nodes[1]
+            .node
+            .get_session(&node0_addr)
+            .unwrap()
+            .state()
+            .is_awaiting_msg3()
+    );
 
     // Process packets: SessionAck arrives at Node 0, Node 0 sends SessionMsg3
     tokio::time::sleep(Duration::from_millis(20)).await;
@@ -178,12 +174,14 @@ async fn test_session_direct_peer_handshake() {
     assert!(count > 0, "Expected SessionAck packet to arrive");
 
     // Node 0 should now be Established (transitions after sending msg3)
-    assert!(nodes[0]
-        .node
-        .get_session(&node1_addr)
-        .unwrap()
-        .state()
-        .is_established());
+    assert!(
+        nodes[0]
+            .node
+            .get_session(&node1_addr)
+            .unwrap()
+            .state()
+            .is_established()
+    );
 
     // Process packets: SessionMsg3 arrives at Node 1
     tokio::time::sleep(Duration::from_millis(20)).await;
@@ -191,12 +189,14 @@ async fn test_session_direct_peer_handshake() {
     assert!(count > 0, "Expected SessionMsg3 packet to arrive");
 
     // Node 1 should now be Established (transitions after processing msg3)
-    assert!(nodes[1]
-        .node
-        .get_session(&node0_addr)
-        .unwrap()
-        .state()
-        .is_established());
+    assert!(
+        nodes[1]
+            .node
+            .get_session(&node0_addr)
+            .unwrap()
+            .state()
+            .is_established()
+    );
 
     cleanup_nodes(&mut nodes).await;
 }
@@ -226,18 +226,22 @@ async fn test_session_direct_peer_data_transfer() {
     tokio::time::sleep(Duration::from_millis(20)).await;
     process_available_packets(&mut nodes).await; // Msg3 → Node 1
 
-    assert!(nodes[0]
-        .node
-        .get_session(&node1_addr)
-        .unwrap()
-        .state()
-        .is_established());
-    assert!(nodes[1]
-        .node
-        .get_session(&node0_addr)
-        .unwrap()
-        .state()
-        .is_established());
+    assert!(
+        nodes[0]
+            .node
+            .get_session(&node1_addr)
+            .unwrap()
+            .state()
+            .is_established()
+    );
+    assert!(
+        nodes[1]
+            .node
+            .get_session(&node0_addr)
+            .unwrap()
+            .state()
+            .is_established()
+    );
 
     // Send data from Node 0 to Node 1
     let test_data = b"Hello, FIPS session!";
@@ -291,12 +295,14 @@ async fn test_session_3node_forwarded_handshake() {
         nodes[2].node.get_session(&node0_addr).is_some(),
         "Node 2 should have a session entry for Node 0"
     );
-    assert!(nodes[2]
-        .node
-        .get_session(&node0_addr)
-        .unwrap()
-        .state()
-        .is_awaiting_msg3());
+    assert!(
+        nodes[2]
+            .node
+            .get_session(&node0_addr)
+            .unwrap()
+            .state()
+            .is_awaiting_msg3()
+    );
 
     // Process: SessionAck: 2→1 (forwarded by transit B)
     tokio::time::sleep(Duration::from_millis(20)).await;
@@ -307,12 +313,14 @@ async fn test_session_3node_forwarded_handshake() {
     process_available_packets(&mut nodes).await;
 
     // Node 0 should now be Established (transitions after sending msg3)
-    assert!(nodes[0]
-        .node
-        .get_session(&node2_addr)
-        .unwrap()
-        .state()
-        .is_established());
+    assert!(
+        nodes[0]
+            .node
+            .get_session(&node2_addr)
+            .unwrap()
+            .state()
+            .is_established()
+    );
 
     // Process: SessionMsg3: 0→1 (forwarded by transit B)
     tokio::time::sleep(Duration::from_millis(20)).await;
@@ -323,12 +331,14 @@ async fn test_session_3node_forwarded_handshake() {
     process_available_packets(&mut nodes).await;
 
     // Node 2 should now be Established (transitions after processing msg3)
-    assert!(nodes[2]
-        .node
-        .get_session(&node0_addr)
-        .unwrap()
-        .state()
-        .is_established());
+    assert!(
+        nodes[2]
+            .node
+            .get_session(&node0_addr)
+            .unwrap()
+            .state()
+            .is_established()
+    );
 
     // Transit node B should NOT have a session
     assert_eq!(
@@ -389,12 +399,14 @@ async fn test_session_3node_forwarded_data() {
     }
 
     // Node 2 should be Established (transitioned during XK handshake msg3)
-    assert!(nodes[2]
-        .node
-        .get_session(&node0_addr)
-        .unwrap()
-        .state()
-        .is_established());
+    assert!(
+        nodes[2]
+            .node
+            .get_session(&node0_addr)
+            .unwrap()
+            .state()
+            .is_established()
+    );
 
     cleanup_nodes(&mut nodes).await;
 }
@@ -520,12 +532,7 @@ async fn test_session_100_nodes() {
     // Collect identities: (node_addr, pubkey) for all nodes
     let all_info: Vec<(NodeAddr, secp256k1::PublicKey)> = nodes
         .iter()
-        .map(|tn| {
-            (
-                *tn.node.node_addr(),
-                tn.node.identity().pubkey_full(),
-            )
-        })
+        .map(|tn| (*tn.node.node_addr(), tn.node.identity().pubkey_full()))
         .collect();
 
     // Each node picks one random target for its outbound session.
@@ -640,11 +647,7 @@ async fn test_session_100_nodes() {
         // (Responder should already be Established after XK msg3)
         let rev_payload = format!("rev-{}", pair_idx).into_bytes();
         let rev_ipv6 = build_ipv6_packet(&dst_fips, &src_fips, &rev_payload);
-        match nodes[dst]
-            .node
-            .send_ipv6_packet(&src_addr, &rev_ipv6)
-            .await
-        {
+        match nodes[dst].node.send_ipv6_packet(&src_addr, &rev_ipv6).await {
             Ok(()) => send_reverse_ok += 1,
             Err(_) => send_reverse_err += 1,
         }
@@ -723,10 +726,7 @@ async fn test_session_100_nodes() {
         }
     }
 
-    let session_counts: Vec<usize> = nodes
-        .iter()
-        .map(|tn| tn.node.session_count())
-        .collect();
+    let session_counts: Vec<usize> = nodes.iter().map(|tn| tn.node.session_count()).collect();
     let total_sessions: usize = session_counts.iter().sum();
     let min_sessions = *session_counts.iter().min().unwrap();
     let max_sessions = *session_counts.iter().max().unwrap();
@@ -770,10 +770,8 @@ async fn test_session_100_nodes() {
     };
 
     // Coord cache stats
-    let coord_cache_sizes: Vec<usize> = nodes
-        .iter()
-        .map(|tn| tn.node.coord_cache().len())
-        .collect();
+    let coord_cache_sizes: Vec<usize> =
+        nodes.iter().map(|tn| tn.node.coord_cache().len()).collect();
     let total_coord_entries: usize = coord_cache_sizes.iter().sum();
     let min_coord = *coord_cache_sizes.iter().min().unwrap();
     let max_coord = *coord_cache_sizes.iter().max().unwrap();
@@ -884,10 +882,7 @@ async fn test_session_100_nodes() {
 
     // === Assertions ===
 
-    assert_eq!(
-        send_forward_err, 0,
-        "All forward sends should succeed"
-    );
+    assert_eq!(send_forward_err, 0, "All forward sends should succeed");
     assert_eq!(
         send_reverse_err, 0,
         "All reverse sends should succeed (responder Established after XK msg3)"
@@ -915,7 +910,11 @@ async fn test_session_100_nodes() {
 // ============================================================================
 
 /// Build a minimal valid IPv6 packet with given source and destination addresses.
-fn build_ipv6_packet(src: &crate::FipsAddress, dst: &crate::FipsAddress, payload: &[u8]) -> Vec<u8> {
+fn build_ipv6_packet(
+    src: &crate::FipsAddress,
+    dst: &crate::FipsAddress,
+    payload: &[u8],
+) -> Vec<u8> {
     let payload_len = payload.len() as u16;
     let mut packet = vec![0u8; 40 + payload.len()];
     // Version (6) + traffic class high nibble
@@ -944,17 +943,14 @@ fn test_identity_cache_populated_on_promote() {
     let transport_id = TransportId::new(1);
     let link_id = LinkId::new(1);
 
-    let (conn, peer_identity) = make_completed_connection(
-        &mut node,
-        link_id,
-        transport_id,
-        1000,
-    );
+    let (conn, peer_identity) = make_completed_connection(&mut node, link_id, transport_id, 1000);
 
     node.add_connection(conn).unwrap();
 
     // Promote
-    let result = node.promote_connection(link_id, peer_identity, 2000).unwrap();
+    let result = node
+        .promote_connection(link_id, peer_identity, 2000)
+        .unwrap();
     assert!(matches!(result, PromotionResult::Promoted(_)));
 
     // Identity cache should contain the peer
@@ -962,7 +958,10 @@ fn test_identity_cache_populated_on_promote() {
     let mut prefix = [0u8; 15];
     prefix.copy_from_slice(&peer_addr.as_bytes()[0..15]);
     let cached = node.lookup_by_fips_prefix(&prefix);
-    assert!(cached.is_some(), "Identity cache should contain promoted peer");
+    assert!(
+        cached.is_some(),
+        "Identity cache should contain promoted peer"
+    );
     let (cached_addr, cached_pk) = cached.unwrap();
     assert_eq!(cached_addr, peer_addr);
     assert_eq!(cached_pk, peer_identity.pubkey_full());
@@ -986,7 +985,11 @@ async fn test_tun_outbound_established_session() {
     let dst_fips = crate::FipsAddress::from_node_addr(&node1_addr);
 
     // Establish session (XK: 3 messages — Setup, Ack, Msg3)
-    nodes[0].node.initiate_session(node1_addr, node1_pubkey).await.unwrap();
+    nodes[0]
+        .node
+        .initiate_session(node1_addr, node1_pubkey)
+        .await
+        .unwrap();
     tokio::time::sleep(Duration::from_millis(20)).await;
     process_available_packets(&mut nodes).await; // Setup → Node 1
     tokio::time::sleep(Duration::from_millis(20)).await;
@@ -994,7 +997,14 @@ async fn test_tun_outbound_established_session() {
     tokio::time::sleep(Duration::from_millis(20)).await;
     process_available_packets(&mut nodes).await; // Msg3 → Node 1
 
-    assert!(nodes[0].node.get_session(&node1_addr).unwrap().state().is_established());
+    assert!(
+        nodes[0]
+            .node
+            .get_session(&node1_addr)
+            .unwrap()
+            .state()
+            .is_established()
+    );
 
     // Install TUN receiver on Node 1
     let (tun_tx, tun_rx) = std::sync::mpsc::channel();
@@ -1013,7 +1023,10 @@ async fn test_tun_outbound_established_session() {
     // Verify plaintext arrived at Node 1's TUN
     let delivered: Vec<Vec<u8>> = std::iter::from_fn(|| tun_rx.try_recv().ok()).collect();
     assert_eq!(delivered.len(), 1, "Exactly one packet should be delivered");
-    assert_eq!(delivered[0], ipv6_packet, "Delivered packet should match original");
+    assert_eq!(
+        delivered[0], ipv6_packet,
+        "Delivered packet should match original"
+    );
 
     cleanup_nodes(&mut nodes).await;
 }
@@ -1049,17 +1062,35 @@ async fn test_tun_outbound_triggers_session_initiation() {
 
     // Session should now be initiating
     assert_eq!(nodes[0].node.session_count(), 1);
-    assert!(nodes[0].node.get_session(&node1_addr).unwrap().state().is_initiating());
+    assert!(
+        nodes[0]
+            .node
+            .get_session(&node1_addr)
+            .unwrap()
+            .state()
+            .is_initiating()
+    );
 
     // Drain packets until session established and queued packet delivered
     drain_to_quiescence(&mut nodes).await;
 
     // Session should be established on Node 0
-    assert!(nodes[0].node.get_session(&node1_addr).unwrap().state().is_established());
+    assert!(
+        nodes[0]
+            .node
+            .get_session(&node1_addr)
+            .unwrap()
+            .state()
+            .is_established()
+    );
 
     // Verify the queued packet was delivered to Node 1
     let delivered: Vec<Vec<u8>> = std::iter::from_fn(|| tun_rx.try_recv().ok()).collect();
-    assert_eq!(delivered.len(), 1, "Queued packet should be delivered after handshake");
+    assert_eq!(
+        delivered.len(),
+        1,
+        "Queued packet should be delivered after handshake"
+    );
     assert_eq!(delivered[0], ipv6_packet);
 
     cleanup_nodes(&mut nodes).await;
@@ -1087,12 +1118,19 @@ async fn test_tun_outbound_unknown_destination() {
 
     // Should receive ICMPv6 Destination Unreachable back on TUN
     let delivered: Vec<Vec<u8>> = std::iter::from_fn(|| tun_rx.try_recv().ok()).collect();
-    assert_eq!(delivered.len(), 1, "Should receive ICMPv6 Destination Unreachable");
+    assert_eq!(
+        delivered.len(),
+        1,
+        "Should receive ICMPv6 Destination Unreachable"
+    );
     // Verify it's an ICMPv6 Destination Unreachable (type 1, code 0)
     // ICMPv6 header starts at byte 40, type at byte 40, code at byte 41
     assert!(delivered[0].len() >= 48, "ICMPv6 response too short");
     assert_eq!(delivered[0][6], 58, "Next header should be ICMPv6 (58)");
-    assert_eq!(delivered[0][40], 1, "ICMPv6 type should be Destination Unreachable (1)");
+    assert_eq!(
+        delivered[0][40], 1,
+        "ICMPv6 type should be Destination Unreachable (1)"
+    );
     assert_eq!(delivered[0][41], 0, "ICMPv6 code should be No Route (0)");
 
     cleanup_nodes(&mut nodes).await;
@@ -1131,7 +1169,14 @@ async fn test_tun_outbound_3node_forwarded() {
     drain_to_quiescence(&mut nodes).await;
 
     // Session should be established
-    assert!(nodes[0].node.get_session(&node2_addr).unwrap().state().is_established());
+    assert!(
+        nodes[0]
+            .node
+            .get_session(&node2_addr)
+            .unwrap()
+            .state()
+            .is_established()
+    );
 
     // Verify packet delivered to Node 2
     let delivered: Vec<Vec<u8>> = std::iter::from_fn(|| tun_rx.try_recv().ok()).collect();
@@ -1170,16 +1215,34 @@ async fn test_tun_outbound_pending_queue_flush() {
 
     // First packet triggers session initiation, rest are queued
     assert_eq!(nodes[0].node.session_count(), 1);
-    assert!(nodes[0].node.get_session(&node1_addr).unwrap().state().is_initiating());
+    assert!(
+        nodes[0]
+            .node
+            .get_session(&node1_addr)
+            .unwrap()
+            .state()
+            .is_initiating()
+    );
 
     // Drain until session established and queued packets flushed
     drain_to_quiescence(&mut nodes).await;
 
-    assert!(nodes[0].node.get_session(&node1_addr).unwrap().state().is_established());
+    assert!(
+        nodes[0]
+            .node
+            .get_session(&node1_addr)
+            .unwrap()
+            .state()
+            .is_established()
+    );
 
     // All 5 packets should have been delivered
     let delivered: Vec<Vec<u8>> = std::iter::from_fn(|| tun_rx.try_recv().ok()).collect();
-    assert_eq!(delivered.len(), 5, "All 5 queued packets should be delivered");
+    assert_eq!(
+        delivered.len(),
+        5,
+        "All 5 queued packets should be delivered"
+    );
     for (i, pkt) in delivered.iter().enumerate() {
         assert_eq!(*pkt, packets[i], "Packet {} should match", i);
     }
@@ -1198,10 +1261,8 @@ fn make_noise_session(
 ) -> crate::noise::NoiseSession {
     use crate::noise::HandshakeState;
 
-    let mut initiator = HandshakeState::new_initiator(
-        our_identity.keypair(),
-        remote_identity.pubkey_full(),
-    );
+    let mut initiator =
+        HandshakeState::new_initiator(our_identity.keypair(), remote_identity.pubkey_full());
     let mut responder = HandshakeState::new_responder(remote_identity.keypair());
 
     // Set epochs for both sides (required for handshake message encryption)
@@ -1270,7 +1331,11 @@ fn test_purge_idle_sessions_keeps_active() {
     let now_ms = 92_000;
     node.purge_idle_sessions(now_ms);
 
-    assert_eq!(node.session_count(), 1, "Active session should survive purge");
+    assert_eq!(
+        node.session_count(),
+        1,
+        "Active session should survive purge"
+    );
 }
 
 #[test]
@@ -1281,10 +1346,7 @@ fn test_purge_idle_sessions_ignores_initiating() {
     let remote = Identity::generate();
     let remote_addr = *remote.node_addr();
 
-    let handshake = HandshakeState::new_initiator(
-        node.identity().keypair(),
-        remote.pubkey_full(),
-    );
+    let handshake = HandshakeState::new_initiator(node.identity().keypair(), remote.pubkey_full());
     let entry = crate::node::session::SessionEntry::new(
         remote_addr,
         remote.pubkey_full(),
@@ -1299,7 +1361,11 @@ fn test_purge_idle_sessions_ignores_initiating() {
     let now_ms = 1000 + 200_000;
     node.purge_idle_sessions(now_ms);
 
-    assert_eq!(node.session_count(), 1, "Initiating session should not be purged by idle timeout");
+    assert_eq!(
+        node.session_count(),
+        1,
+        "Initiating session should not be purged by idle timeout"
+    );
 }
 
 #[test]
@@ -1330,8 +1396,10 @@ fn test_purge_idle_sessions_cleans_pending_packets() {
     node.purge_idle_sessions(now_ms);
 
     assert_eq!(node.session_count(), 0);
-    assert!(!node.pending_tun_packets.contains_key(&remote_addr),
-        "Pending packets should be cleaned up with idle session");
+    assert!(
+        !node.pending_tun_packets.contains_key(&remote_addr),
+        "Pending packets should be cleaned up with idle session"
+    );
 }
 
 #[test]
@@ -1357,7 +1425,11 @@ fn test_purge_idle_sessions_disabled_when_zero() {
     let now_ms = 1000 + 1_000_000;
     node.purge_idle_sessions(now_ms);
 
-    assert_eq!(node.session_count(), 1, "Sessions should not be purged when idle timeout is disabled");
+    assert_eq!(
+        node.session_count(),
+        1,
+        "Sessions should not be purged when idle timeout is disabled"
+    );
 }
 
 #[test]
@@ -1386,8 +1458,11 @@ fn test_purge_idle_sessions_mmp_activity_does_not_prevent_purge() {
     let now_ms = 92_000;
     node.purge_idle_sessions(now_ms);
 
-    assert_eq!(node.session_count(), 0,
-        "Session with MMP-only activity should be purged");
+    assert_eq!(
+        node.session_count(),
+        0,
+        "Session with MMP-only activity should be purged"
+    );
 }
 
 // ============================================================================
@@ -1401,10 +1476,7 @@ fn test_coords_warmup_counter_default_zero_on_new() {
     let identity_a = Identity::generate();
     let identity_b = Identity::generate();
 
-    let handshake = HandshakeState::new_initiator(
-        identity_a.keypair(),
-        identity_b.pubkey_full(),
-    );
+    let handshake = HandshakeState::new_initiator(identity_a.keypair(), identity_b.pubkey_full());
 
     let entry = crate::node::session::SessionEntry::new(
         *identity_b.node_addr(),
@@ -1414,8 +1486,11 @@ fn test_coords_warmup_counter_default_zero_on_new() {
         true,
     );
 
-    assert_eq!(entry.coords_warmup_remaining(), 0,
-        "Counter should be 0 for non-Established sessions");
+    assert_eq!(
+        entry.coords_warmup_remaining(),
+        0,
+        "Counter should be 0 for non-Established sessions"
+    );
 }
 
 #[test]
@@ -1466,15 +1541,20 @@ fn test_coords_warmup_counter_decrement() {
         assert_eq!(entry.coords_warmup_remaining(), expected);
     }
 
-    assert_eq!(entry.coords_warmup_remaining(), 0,
-        "Counter should reach 0 after N decrements");
+    assert_eq!(
+        entry.coords_warmup_remaining(),
+        0,
+        "Counter should reach 0 after N decrements"
+    );
 }
 
 #[test]
 fn test_coords_warmup_config_default() {
     let config = crate::config::Config::new();
-    assert_eq!(config.node.session.coords_warmup_packets, 5,
-        "Default coords_warmup_packets should be 5");
+    assert_eq!(
+        config.node.session.coords_warmup_packets, 5,
+        "Default coords_warmup_packets should be 5"
+    );
 }
 
 // ============================================================================
@@ -1493,11 +1573,13 @@ fn test_identity_cache_lru_eviction() {
     // Insert first two with explicit timestamps to ensure deterministic ordering
     let mut prefix1 = [0u8; 15];
     prefix1.copy_from_slice(&id1.node_addr().as_bytes()[0..15]);
-    node.identity_cache.insert(prefix1, (*id1.node_addr(), id1.pubkey_full(), 1000));
+    node.identity_cache
+        .insert(prefix1, (*id1.node_addr(), id1.pubkey_full(), 1000));
 
     let mut prefix2 = [0u8; 15];
     prefix2.copy_from_slice(&id2.node_addr().as_bytes()[0..15]);
-    node.identity_cache.insert(prefix2, (*id2.node_addr(), id2.pubkey_full(), 2000));
+    node.identity_cache
+        .insert(prefix2, (*id2.node_addr(), id2.pubkey_full(), 2000));
 
     assert_eq!(node.identity_cache_len(), 2);
 
@@ -1505,13 +1587,17 @@ fn test_identity_cache_lru_eviction() {
     node.register_identity(*id3.node_addr(), id3.pubkey_full());
     assert_eq!(node.identity_cache_len(), 2);
 
-    assert!(node.lookup_by_fips_prefix(&prefix1).is_none(),
-        "Oldest entry should have been evicted");
+    assert!(
+        node.lookup_by_fips_prefix(&prefix1).is_none(),
+        "Oldest entry should have been evicted"
+    );
 
     let mut prefix3 = [0u8; 15];
     prefix3.copy_from_slice(&id3.node_addr().as_bytes()[0..15]);
-    assert!(node.lookup_by_fips_prefix(&prefix3).is_some(),
-        "Newest entry should be present");
+    assert!(
+        node.lookup_by_fips_prefix(&prefix3).is_some(),
+        "Newest entry should be present"
+    );
 }
 
 #[test]
@@ -1546,10 +1632,7 @@ fn test_session_entry_handshake_payload_storage() {
     let identity_a = Identity::generate();
     let identity_b = Identity::generate();
 
-    let handshake = HandshakeState::new_initiator(
-        identity_a.keypair(),
-        identity_b.pubkey_full(),
-    );
+    let handshake = HandshakeState::new_initiator(identity_a.keypair(), identity_b.pubkey_full());
 
     let mut entry = crate::node::session::SessionEntry::new(
         *identity_b.node_addr(),
@@ -1581,10 +1664,7 @@ fn test_session_entry_resend_tracking() {
     let identity_a = Identity::generate();
     let identity_b = Identity::generate();
 
-    let handshake = HandshakeState::new_initiator(
-        identity_a.keypair(),
-        identity_b.pubkey_full(),
-    );
+    let handshake = HandshakeState::new_initiator(identity_a.keypair(), identity_b.pubkey_full());
 
     let mut entry = crate::node::session::SessionEntry::new(
         *identity_b.node_addr(),
@@ -1615,10 +1695,7 @@ fn test_session_entry_clear_handshake_payload() {
     let identity_a = Identity::generate();
     let identity_b = Identity::generate();
 
-    let handshake = HandshakeState::new_initiator(
-        identity_a.keypair(),
-        identity_b.pubkey_full(),
-    );
+    let handshake = HandshakeState::new_initiator(identity_a.keypair(), identity_b.pubkey_full());
 
     let mut entry = crate::node::session::SessionEntry::new(
         *identity_b.node_addr(),
@@ -1649,10 +1726,8 @@ async fn test_session_handshake_timeout() {
     let mut node = make_node();
 
     let identity_b = Identity::generate();
-    let handshake = HandshakeState::new_initiator(
-        node.identity.keypair(),
-        identity_b.pubkey_full(),
-    );
+    let handshake =
+        HandshakeState::new_initiator(node.identity.keypair(), identity_b.pubkey_full());
 
     let dest_addr = *identity_b.node_addr();
 
@@ -1672,12 +1747,18 @@ async fn test_session_handshake_timeout() {
     let timeout_secs = node.config.node.rate_limit.handshake_timeout_secs;
     let before_timeout = 1000 + timeout_secs * 1000 - 1;
     node.resend_pending_session_handshakes(before_timeout).await;
-    assert!(node.sessions.contains_key(&dest_addr), "Session should survive before timeout");
+    assert!(
+        node.sessions.contains_key(&dest_addr),
+        "Session should survive before timeout"
+    );
 
     // After timeout: session should be removed
     let after_timeout = 1000 + timeout_secs * 1000 + 1;
     node.resend_pending_session_handshakes(after_timeout).await;
-    assert!(!node.sessions.contains_key(&dest_addr), "Timed-out session should be removed");
+    assert!(
+        !node.sessions.contains_key(&dest_addr),
+        "Timed-out session should be removed"
+    );
 }
 
 /// Test that session handshake timeout removes stale AwaitingMsg3 sessions.
@@ -1690,9 +1771,7 @@ async fn test_session_awaiting_msg3_timeout() {
     let identity_a = Identity::generate();
     let identity_b = Identity::generate();
 
-    let handshake = HandshakeState::new_xk_responder(
-        identity_b.keypair(),
-    );
+    let handshake = HandshakeState::new_xk_responder(identity_b.keypair());
 
     let src_addr = *identity_a.node_addr();
 
@@ -1712,7 +1791,10 @@ async fn test_session_awaiting_msg3_timeout() {
     let timeout_secs = node.config.node.rate_limit.handshake_timeout_secs;
     let after_timeout = 1000 + timeout_secs * 1000 + 1;
     node.resend_pending_session_handshakes(after_timeout).await;
-    assert!(!node.sessions.contains_key(&src_addr), "Timed-out AwaitingMsg3 session should be removed");
+    assert!(
+        !node.sessions.contains_key(&src_addr),
+        "Timed-out AwaitingMsg3 session should be removed"
+    );
 }
 
 #[tokio::test]
@@ -1734,7 +1816,11 @@ async fn test_tun_outbound_path_mtu_generates_ptb() {
     let dst_fips = crate::FipsAddress::from_node_addr(&node1_addr);
 
     // Establish session (XK: 3 messages — Setup, Ack, Msg3)
-    nodes[0].node.initiate_session(node1_addr, node1_pubkey).await.unwrap();
+    nodes[0]
+        .node
+        .initiate_session(node1_addr, node1_pubkey)
+        .await
+        .unwrap();
     tokio::time::sleep(Duration::from_millis(20)).await;
     process_available_packets(&mut nodes).await;
     tokio::time::sleep(Duration::from_millis(20)).await;
@@ -1742,7 +1828,14 @@ async fn test_tun_outbound_path_mtu_generates_ptb() {
     tokio::time::sleep(Duration::from_millis(20)).await;
     process_available_packets(&mut nodes).await;
 
-    assert!(nodes[0].node.get_session(&node1_addr).unwrap().state().is_established());
+    assert!(
+        nodes[0]
+            .node
+            .get_session(&node1_addr)
+            .unwrap()
+            .state()
+            .is_established()
+    );
 
     // Simulate receipt of MtuExceeded by reducing PathMtuState to a value
     // lower than the local transport MTU.
@@ -1751,7 +1844,8 @@ async fn test_tun_outbound_path_mtu_generates_ptb() {
     {
         let entry = nodes[0].node.get_session_mut(&node1_addr).unwrap();
         let mmp = entry.mmp_mut().unwrap();
-        mmp.path_mtu.apply_notification(reduced_mtu, std::time::Instant::now());
+        mmp.path_mtu
+            .apply_notification(reduced_mtu, std::time::Instant::now());
         assert_eq!(mmp.path_mtu.current_mtu(), reduced_mtu);
     }
 
@@ -1764,14 +1858,24 @@ async fn test_tun_outbound_path_mtu_generates_ptb() {
     let local_ipv6_mtu = nodes[0].node.effective_ipv6_mtu() as usize;
     let oversized_payload = vec![0u8; reduced_ipv6_mtu - 39]; // 40-byte hdr + payload > reduced MTU
     let ipv6_packet = build_ipv6_packet(&src_fips, &dst_fips, &oversized_payload);
-    assert!(ipv6_packet.len() > reduced_ipv6_mtu, "packet must exceed path MTU");
-    assert!(ipv6_packet.len() <= local_ipv6_mtu, "packet must fit local MTU");
+    assert!(
+        ipv6_packet.len() > reduced_ipv6_mtu,
+        "packet must exceed path MTU"
+    );
+    assert!(
+        ipv6_packet.len() <= local_ipv6_mtu,
+        "packet must fit local MTU"
+    );
 
     nodes[0].node.handle_tun_outbound(ipv6_packet).await;
 
     // Verify ICMPv6 Packet Too Big was generated
     let ptb_messages: Vec<Vec<u8>> = std::iter::from_fn(|| tun_rx.try_recv().ok()).collect();
-    assert_eq!(ptb_messages.len(), 1, "Should generate exactly one ICMPv6 PTB");
+    assert_eq!(
+        ptb_messages.len(),
+        1,
+        "Should generate exactly one ICMPv6 PTB"
+    );
 
     let ptb = &ptb_messages[0];
     assert_eq!(ptb[0] >> 4, 6, "Should be IPv6");
@@ -1784,12 +1888,23 @@ async fn test_tun_outbound_path_mtu_generates_ptb() {
     // address, causing a PMTUD blackhole.
     let ptb_src = std::net::Ipv6Addr::from(<[u8; 16]>::try_from(&ptb[8..24]).unwrap());
     let ptb_dst = std::net::Ipv6Addr::from(<[u8; 16]>::try_from(&ptb[24..40]).unwrap());
-    assert_eq!(ptb_src, dst_fips.to_ipv6(), "PTB source must be remote peer (original dst), not local node");
-    assert_eq!(ptb_dst, src_fips.to_ipv6(), "PTB destination must be local node (original src)");
+    assert_eq!(
+        ptb_src,
+        dst_fips.to_ipv6(),
+        "PTB source must be remote peer (original dst), not local node"
+    );
+    assert_eq!(
+        ptb_dst,
+        src_fips.to_ipv6(),
+        "PTB destination must be local node (original src)"
+    );
 
     // Verify reported MTU (32-bit field at ICMPv6 header bytes 4-7)
     let reported_mtu = u32::from_be_bytes([ptb[44], ptb[45], ptb[46], ptb[47]]);
-    assert_eq!(reported_mtu, reduced_ipv6_mtu as u32, "Reported MTU should match path IPv6 MTU");
+    assert_eq!(
+        reported_mtu, reduced_ipv6_mtu as u32,
+        "Reported MTU should match path IPv6 MTU"
+    );
 
     // Verify a packet that fits within path MTU passes through (no PTB)
     let (tun_tx2, tun_rx2) = std::sync::mpsc::channel();
@@ -1802,7 +1917,11 @@ async fn test_tun_outbound_path_mtu_generates_ptb() {
 
     // No PTB should be generated for a fitting packet
     let ptb_messages2: Vec<Vec<u8>> = std::iter::from_fn(|| tun_rx2.try_recv().ok()).collect();
-    assert_eq!(ptb_messages2.len(), 0, "Should not generate PTB for fitting packet");
+    assert_eq!(
+        ptb_messages2.len(),
+        0,
+        "Should not generate PTB for fitting packet"
+    );
 
     cleanup_nodes(&mut nodes).await;
 }
@@ -1845,10 +1964,19 @@ async fn test_multihop_pmtud_heterogeneous_mtu() {
     nodes[0].node.register_identity(node2_addr, node2_pubkey);
 
     // Establish session A→C via B (triggers routing through tree)
-    nodes[0].node.initiate_session(node2_addr, node2_pubkey).await.unwrap();
+    nodes[0]
+        .node
+        .initiate_session(node2_addr, node2_pubkey)
+        .await
+        .unwrap();
     drain_to_quiescence(&mut nodes).await;
     assert!(
-        nodes[0].node.get_session(&node2_addr).unwrap().state().is_established(),
+        nodes[0]
+            .node
+            .get_session(&node2_addr)
+            .unwrap()
+            .state()
+            .is_established(),
         "Session A→C should be established"
     );
 
@@ -1858,7 +1986,11 @@ async fn test_multihop_pmtud_heterogeneous_mtu() {
     // With coords (~66 extra), the wire could exceed B's recv buffer.
     for _ in 0..5 {
         let small = build_ipv6_packet(&src_fips, &dst_fips, &[0u8; 10]);
-        nodes[0].node.send_ipv6_packet(&node2_addr, &small).await.unwrap();
+        nodes[0]
+            .node
+            .send_ipv6_packet(&node2_addr, &small)
+            .await
+            .unwrap();
     }
     drain_to_quiescence(&mut nodes).await;
 
@@ -1872,12 +2004,17 @@ async fn test_multihop_pmtud_heterogeneous_mtu() {
     assert!(
         ipv6_packet.len() <= local_effective_mtu,
         "packet ({}) must fit A's local MTU ({})",
-        ipv6_packet.len(), local_effective_mtu
+        ipv6_packet.len(),
+        local_effective_mtu
     );
 
     // Send the oversized packet — B should fail to forward and send
     // MtuExceeded signal back.
-    nodes[0].node.send_ipv6_packet(&node2_addr, &ipv6_packet).await.unwrap();
+    nodes[0]
+        .node
+        .send_ipv6_packet(&node2_addr, &ipv6_packet)
+        .await
+        .unwrap();
     drain_to_quiescence(&mut nodes).await;
 
     // Verify PathMtuState was updated on A
@@ -1902,7 +2039,8 @@ async fn test_multihop_pmtud_heterogeneous_mtu() {
 
     let ptb_messages: Vec<Vec<u8>> = std::iter::from_fn(|| tun_rx2.try_recv().ok()).collect();
     assert_eq!(
-        ptb_messages.len(), 1,
+        ptb_messages.len(),
+        1,
         "Should generate ICMPv6 PTB for oversized packet after PathMtuState update"
     );
 
@@ -1917,8 +2055,16 @@ async fn test_multihop_pmtud_heterogeneous_mtu() {
     // address, causing a PMTUD blackhole.
     let ptb_src = std::net::Ipv6Addr::from(<[u8; 16]>::try_from(&ptb[8..24]).unwrap());
     let ptb_dst = std::net::Ipv6Addr::from(<[u8; 16]>::try_from(&ptb[24..40]).unwrap());
-    assert_eq!(ptb_src, dst_fips.to_ipv6(), "PTB source must be remote peer (original dst), not local node");
-    assert_eq!(ptb_dst, src_fips.to_ipv6(), "PTB destination must be local node (original src)");
+    assert_eq!(
+        ptb_src,
+        dst_fips.to_ipv6(),
+        "PTB source must be remote peer (original dst), not local node"
+    );
+    assert_eq!(
+        ptb_dst,
+        src_fips.to_ipv6(),
+        "PTB destination must be local node (original src)"
+    );
 
     // Verify reported MTU is the path MTU (not local MTU)
     let reported_mtu = u32::from_be_bytes([ptb[44], ptb[45], ptb[46], ptb[47]]);
@@ -1941,7 +2087,8 @@ async fn test_multihop_pmtud_heterogeneous_mtu() {
 
     let ptb_messages3: Vec<Vec<u8>> = std::iter::from_fn(|| tun_rx3.try_recv().ok()).collect();
     assert_eq!(
-        ptb_messages3.len(), 0,
+        ptb_messages3.len(),
+        0,
         "Should not generate PTB for packet fitting within path MTU"
     );
 

src/node/tests/spanning_tree.rs

@@ -69,7 +69,9 @@ pub(super) async fn initiate_handshake(nodes: &mut [TestNode], i: usize, j: usiz
 
     let our_index = initiator.node.index_allocator.allocate().unwrap();
     let our_keypair = initiator.node.identity().keypair();
-    let noise_msg1 = conn.start_handshake(our_keypair, initiator.node.startup_epoch, 1000).unwrap();
+    let noise_msg1 = conn
+        .start_handshake(our_keypair, initiator.node.startup_epoch, 1000)
+        .unwrap();
     conn.set_our_index(our_index);
     conn.set_transport_id(transport_id);
     conn.set_source_addr(responder_addr.clone());
@@ -184,7 +186,12 @@ pub(super) fn print_tree_snapshot(label: &str, nodes: &[TestNode]) {
                 .count();
             eprintln!(
                 "  node[{}] root=node[{}] depth={} parent=node[{}] peers={} pending={}",
-                i, root_idx, ts.my_coords().depth(), parent_idx, tn.node.peer_count(), pending,
+                i,
+                root_idx,
+                ts.my_coords().depth(),
+                parent_idx,
+                tn.node.peer_count(),
+                pending,
             );
         }
     } else if correct_root_count < nodes.len() {
@@ -209,7 +216,9 @@ pub(super) fn print_tree_snapshot(label: &str, nodes: &[TestNode]) {
 ///
 /// Returns the number of packets processed.
 pub(super) async fn process_available_packets(nodes: &mut [TestNode]) -> usize {
-    use crate::node::wire::{CommonPrefix, FMP_VERSION, PHASE_ESTABLISHED, PHASE_MSG1, PHASE_MSG2, COMMON_PREFIX_SIZE};
+    use crate::node::wire::{
+        COMMON_PREFIX_SIZE, CommonPrefix, FMP_VERSION, PHASE_ESTABLISHED, PHASE_MSG1, PHASE_MSG2,
+    };
 
     let mut count = 0;
     for node in nodes.iter_mut() {
@@ -224,9 +233,7 @@ pub(super) async fn process_available_packets(nodes: &mut [TestNode]) -> usize {
                 match prefix.phase {
                     PHASE_MSG1 => node.node.handle_msg1(packet).await,
                     PHASE_MSG2 => node.node.handle_msg2(packet).await,
-                    PHASE_ESTABLISHED => {
-                        node.node.handle_encrypted_frame(packet).await
-                    }
+                    PHASE_ESTABLISHED => node.node.handle_encrypted_frame(packet).await,
                     _ => {}
                 }
                 count += 1;
@@ -319,7 +326,11 @@ pub(super) async fn drain_all_packets(nodes: &mut [TestNode], verbose: bool) ->
 ///
 /// First builds a random spanning tree to ensure connectivity,
 /// then adds extra edges up to the target count.
-pub(super) fn generate_random_edges(n: usize, target_edges: usize, seed: u64) -> Vec<(usize, usize)> {
+pub(super) fn generate_random_edges(
+    n: usize,
+    target_edges: usize,
+    seed: u64,
+) -> Vec<(usize, usize)> {
     use rand::rngs::StdRng;
     use rand::{RngExt, SeedableRng};
 
@@ -373,11 +384,7 @@ pub(super) fn verify_tree_convergence(nodes: &[TestNode]) {
     assert!(n > 0);
 
     // Find the expected root (smallest NodeAddr across all nodes)
-    let expected_root = nodes
-        .iter()
-        .map(|tn| *tn.node.node_addr())
-        .min()
-        .unwrap();
+    let expected_root = nodes.iter().map(|tn| *tn.node.node_addr()).min().unwrap();
 
     // All nodes should agree on the root
     for (i, tn) in nodes.iter().enumerate() {
@@ -627,12 +634,16 @@ pub(super) async fn run_tree_test_with_mtus(
         assert!(
             nodes[i].node.get_peer(&j_addr).is_some(),
             "Node {} should have peer {} (node {})",
-            i, j_addr, j
+            i,
+            j_addr,
+            j
         );
         assert!(
             nodes[j].node.get_peer(&i_addr).is_some(),
             "Node {} should have peer {} (node {})",
-            j, i_addr, i
+            j,
+            i_addr,
+            i
         );
     }
 

src/node/tests/tcp.rs

@@ -8,9 +8,9 @@
 use super::*;
 use crate::config::TcpConfig;
 use crate::transport::tcp::TcpTransport;
-use crate::transport::{packet_channel, TransportAddr, TransportHandle, TransportId};
+use crate::transport::{TransportAddr, TransportHandle, TransportId, packet_channel};
 use spanning_tree::{
-    cleanup_nodes, drain_all_packets, initiate_handshake, verify_tree_convergence, TestNode,
+    TestNode, cleanup_nodes, drain_all_packets, initiate_handshake, verify_tree_convergence,
 };
 use std::time::Duration;
 

src/node/tests/unit.rs

@@ -96,7 +96,10 @@ fn test_node_link_management() {
     assert_eq!(node.link_count(), 0);
 
     // Lookup should be gone
-    assert!(node.find_link_by_addr(TransportId::new(1), &TransportAddr::from_string("test")).is_none());
+    assert!(
+        node.find_link_by_addr(TransportId::new(1), &TransportAddr::from_string("test"))
+            .is_none()
+    );
 }
 
 #[test]
@@ -183,8 +186,14 @@ fn test_node_promote_connection() {
     let peer = node.get_peer(&node_addr).unwrap();
     assert_eq!(peer.authenticated_at(), 2000);
     assert!(peer.has_session(), "Promoted peer should have NoiseSession");
-    assert!(peer.our_index().is_some(), "Promoted peer should have our_index");
-    assert!(peer.their_index().is_some(), "Promoted peer should have their_index");
+    assert!(
+        peer.our_index().is_some(),
+        "Promoted peer should have our_index"
+    );
+    assert!(
+        peer.their_index().is_some(),
+        "Promoted peer should have their_index"
+    );
 
     // Verify peers_by_index is populated
     let our_index = peer.our_index().unwrap();
@@ -201,8 +210,7 @@ fn test_node_cross_connection_resolution() {
 
     // First connection and promotion (becomes active peer)
     let link_id1 = LinkId::new(1);
-    let (conn1, identity) =
-        make_completed_connection(&mut node, link_id1, transport_id, 1000);
+    let (conn1, identity) = make_completed_connection(&mut node, link_id1, transport_id, 1000);
     let node_addr = *identity.node_addr();
 
     node.add_connection(conn1).unwrap();
@@ -236,8 +244,7 @@ fn test_node_peer_limit() {
     // Add two peers via promotion
     for i in 0..2 {
         let link_id = LinkId::new(i as u64 + 1);
-        let (conn, identity) =
-            make_completed_connection(&mut node, link_id, transport_id, 1000);
+        let (conn, identity) = make_completed_connection(&mut node, link_id, transport_id, 1000);
         node.add_connection(conn).unwrap();
         node.promote_connection(link_id, identity, 2000).unwrap();
     }
@@ -246,8 +253,7 @@ fn test_node_peer_limit() {
 
     // Third should fail
     let link_id = LinkId::new(3);
-    let (conn, identity) =
-        make_completed_connection(&mut node, link_id, transport_id, 3000);
+    let (conn, identity) = make_completed_connection(&mut node, link_id, transport_id, 3000);
     node.add_connection(conn).unwrap();
 
     let result = node.promote_connection(link_id, identity, 4000);
@@ -296,23 +302,20 @@ fn test_node_sendable_peers() {
 
     // Add a healthy peer
     let link_id1 = LinkId::new(1);
-    let (conn1, identity1) =
-        make_completed_connection(&mut node, link_id1, transport_id, 1000);
+    let (conn1, identity1) = make_completed_connection(&mut node, link_id1, transport_id, 1000);
     let node_addr1 = *identity1.node_addr();
     node.add_connection(conn1).unwrap();
     node.promote_connection(link_id1, identity1, 2000).unwrap();
 
     // Add another peer and mark it stale (still sendable)
     let link_id2 = LinkId::new(2);
-    let (conn2, identity2) =
-        make_completed_connection(&mut node, link_id2, transport_id, 1000);
+    let (conn2, identity2) = make_completed_connection(&mut node, link_id2, transport_id, 1000);
     node.add_connection(conn2).unwrap();
     node.promote_connection(link_id2, identity2, 2000).unwrap();
 
     // Add a third peer and mark it disconnected (not sendable)
     let link_id3 = LinkId::new(3);
-    let (conn3, identity3) =
-        make_completed_connection(&mut node, link_id3, transport_id, 1000);
+    let (conn3, identity3) = make_completed_connection(&mut node, link_id3, transport_id, 1000);
     let node_addr3 = *identity3.node_addr();
     node.add_connection(conn3).unwrap();
     node.promote_connection(link_id3, identity3, 2000).unwrap();
@@ -345,14 +348,16 @@ fn test_node_pending_outbound_tracking() {
     let index = node.index_allocator.allocate().unwrap();
 
     // Track in pending_outbound
-    node.pending_outbound.insert((transport_id, index.as_u32()), link_id);
+    node.pending_outbound
+        .insert((transport_id, index.as_u32()), link_id);
 
     // Verify we can look it up
     let found = node.pending_outbound.get(&(transport_id, index.as_u32()));
     assert_eq!(found, Some(&link_id));
 
     // Clean up
-    node.pending_outbound.remove(&(transport_id, index.as_u32()));
+    node.pending_outbound
+        .remove(&(transport_id, index.as_u32()));
     let _ = node.index_allocator.free(index);
 
     assert_eq!(node.index_allocator.count(), 0);
@@ -369,7 +374,8 @@ fn test_node_peers_by_index_tracking() {
     let index = node.index_allocator.allocate().unwrap();
 
     // Track in peers_by_index
-    node.peers_by_index.insert((transport_id, index.as_u32()), node_addr);
+    node.peers_by_index
+        .insert((transport_id, index.as_u32()), node_addr);
 
     // Verify lookup
     let found = node.peers_by_index.get(&(transport_id, index.as_u32()));
@@ -450,7 +456,9 @@ fn test_promote_cleans_up_pending_outbound_to_same_peer() {
         PeerConnection::outbound(pending_link_id, peer_b_identity, pending_time_ms);
 
     let our_keypair = node.identity.keypair();
-    let _msg1 = pending_conn.start_handshake(our_keypair, node.startup_epoch, pending_time_ms).unwrap();
+    let _msg1 = pending_conn
+        .start_handshake(our_keypair, node.startup_epoch, pending_time_ms)
+        .unwrap();
 
     let pending_index = node.index_allocator.allocate().unwrap();
     pending_conn.set_our_index(pending_index);
@@ -483,11 +491,8 @@ fn test_promote_cleans_up_pending_outbound_to_same_peer() {
     let completing_link_id = LinkId::new(2);
     let completing_time_ms = 2000;
 
-    let mut completing_conn = PeerConnection::outbound(
-        completing_link_id,
-        peer_b_identity,
-        completing_time_ms,
-    );
+    let mut completing_conn =
+        PeerConnection::outbound(completing_link_id, peer_b_identity, completing_time_ms);
 
     let our_keypair = node.identity.keypair();
     let msg1 = completing_conn
@@ -573,7 +578,10 @@ fn test_schedule_retry_creates_entry() {
     assert_eq!(node.retry_pending.len(), 1);
     let state = node.retry_pending.get(&peer_node_addr).unwrap();
     assert_eq!(state.retry_count, 1);
-    assert!(state.reconnect, "Auto-connect peers always get reconnect=true");
+    assert!(
+        state.reconnect,
+        "Auto-connect peers always get reconnect=true"
+    );
     // Default base = 5s, 2^1 = 10s, but first retry is 2^0... let me check:
     // retry_count is set to 1, backoff_ms(5000) = 5000 * 2^1 = 10000
     assert_eq!(state.retry_after_ms, 1000 + 10_000);
@@ -597,7 +605,10 @@ fn test_schedule_retry_increments() {
 
     // First failure
     node.schedule_retry(peer_node_addr, 1000);
-    assert_eq!(node.retry_pending.get(&peer_node_addr).unwrap().retry_count, 1);
+    assert_eq!(
+        node.retry_pending.get(&peer_node_addr).unwrap().retry_count,
+        1
+    );
 
     // Second failure
     node.schedule_retry(peer_node_addr, 11_000);
@@ -637,7 +648,10 @@ fn test_schedule_retry_auto_connect_never_exhausts() {
         node.retry_pending.contains_key(&peer_node_addr),
         "Auto-connect peers should never exhaust retries"
     );
-    assert_eq!(node.retry_pending.get(&peer_node_addr).unwrap().retry_count, 3);
+    assert_eq!(
+        node.retry_pending.get(&peer_node_addr).unwrap().retry_count,
+        3
+    );
 }
 
 /// Test that schedule_retry does nothing when max_retries is 0.
@@ -725,7 +739,7 @@ fn test_schedule_reconnect_preserves_backoff() {
     let mut node = Node::new(config).unwrap();
 
     // Simulate two stale handshake timeouts incrementing the retry count.
-    node.schedule_retry(peer_node_addr, 1_000);  // count=1, delay=10s
+    node.schedule_retry(peer_node_addr, 1_000); // count=1, delay=10s
     node.schedule_retry(peer_node_addr, 11_000); // count=2, delay=20s
     {
         let state = node.retry_pending.get(&peer_node_addr).unwrap();
@@ -738,10 +752,7 @@ fn test_schedule_reconnect_preserves_backoff() {
     node.schedule_reconnect(peer_node_addr, 31_000);
 
     let state = node.retry_pending.get(&peer_node_addr).unwrap();
-    assert!(
-        state.reconnect,
-        "Entry should be marked as reconnect"
-    );
+    assert!(state.reconnect, "Entry should be marked as reconnect");
     assert_eq!(
         state.retry_count, 3,
         "schedule_reconnect should increment existing count (was 2), not reset to 0 (regression: issue #5)"
@@ -752,7 +763,8 @@ fn test_schedule_reconnect_preserves_backoff() {
     let max_ms = node.config.node.retry.max_backoff_secs * 1000;
     let expected_delay = state.backoff_ms(base_ms, max_ms);
     assert_eq!(
-        state.retry_after_ms, 31_000 + expected_delay,
+        state.retry_after_ms,
+        31_000 + expected_delay,
         "retry_after_ms should reflect count=3 backoff"
     );
 }
@@ -778,7 +790,10 @@ fn test_schedule_reconnect_fresh_state() {
 
     let state = node.retry_pending.get(&peer_node_addr).unwrap();
     assert!(state.reconnect, "Entry should be marked as reconnect");
-    assert_eq!(state.retry_count, 0, "Fresh reconnect should start at count=0");
+    assert_eq!(
+        state.retry_count, 0,
+        "Fresh reconnect should start at count=0"
+    );
     // Base delay: 5s * 2^0 = 5s
     let base_ms = node.config.node.retry.base_interval_secs * 1000;
     let max_ms = node.config.node.retry.max_backoff_secs * 1000;

src/node/tree.rs

@@ -5,8 +5,8 @@
 
 use std::collections::HashMap;
 
-use crate::protocol::TreeAnnounce;
 use crate::NodeAddr;
+use crate::protocol::TreeAnnounce;
 
 use super::{Node, NodeError};
 use tracing::{debug, info, trace, warn};
@@ -105,7 +105,9 @@ impl Node {
         let ready: Vec<NodeAddr> = self
             .peers
             .iter()
-            .filter(|(_, peer)| peer.has_pending_tree_announce() && peer.can_send_tree_announce(now_ms))
+            .filter(|(_, peer)| {
+                peer.has_pending_tree_announce() && peer.can_send_tree_announce(now_ms)
+            })
             .map(|(addr, _)| *addr)
             .collect();
 
@@ -185,10 +187,9 @@ impl Node {
         }
 
         // Update in TreeState
-        let updated = self.tree_state.update_peer(
-            announce.declaration.clone(),
-            announce.ancestry.clone(),
-        );
+        let updated = self
+            .tree_state
+            .update_peer(announce.declaration.clone(), announce.ancestry.clone());
 
         if !updated {
             self.stats_mut().tree.stale += 1;
@@ -214,7 +215,9 @@ impl Node {
         // Re-evaluate parent selection with current link costs.
         // Exclude peers without MMP RTT data — they are not yet eligible
         // as parent candidates (prevents oscillation from optimistic defaults).
-        let peer_costs: HashMap<NodeAddr, f64> = self.peers.iter()
+        let peer_costs: HashMap<NodeAddr, f64> = self
+            .peers
+            .iter()
             .filter(|(_, peer)| peer.has_srtt())
             .map(|(addr, peer)| (*addr, peer.link_cost()))
             .collect();
@@ -266,7 +269,9 @@ impl Node {
                     parent = %self.peer_display_name(from),
                     "Parent ancestry contains us — loop detected, dropping parent"
                 );
-                let peer_costs: HashMap<NodeAddr, f64> = self.peers.iter()
+                let peer_costs: HashMap<NodeAddr, f64> = self
+                    .peers
+                    .iter()
                     .filter(|(_, peer)| peer.has_srtt())
                     .map(|(addr, peer)| (*addr, peer.link_cost()))
                     .collect();
@@ -276,7 +281,7 @@ impl Node {
                         return;
                     }
                     self.coord_cache.clear();
-            self.reset_discovery_backoff();
+                    self.reset_discovery_backoff();
                     self.send_tree_announce_to_all().await;
                 }
                 return;
@@ -360,7 +365,9 @@ impl Node {
 
         self.last_parent_reeval = Some(now);
 
-        let peer_costs: HashMap<NodeAddr, f64> = self.peers.iter()
+        let peer_costs: HashMap<NodeAddr, f64> = self
+            .peers
+            .iter()
             .filter(|(_, peer)| peer.has_srtt())
             .map(|(addr, peer)| (*addr, peer.link_cost()))
             .collect();
@@ -411,14 +418,16 @@ impl Node {
     ///
     /// Returns `true` if our tree state changed (caller should announce).
     pub(super) fn handle_peer_removal_tree_cleanup(&mut self, node_addr: &NodeAddr) -> bool {
-        let was_parent = !self.tree_state.is_root()
-            && self.tree_state.my_declaration().parent_id() == node_addr;
+        let was_parent =
+            !self.tree_state.is_root() && self.tree_state.my_declaration().parent_id() == node_addr;
 
         self.tree_state.remove_peer(node_addr);
 
         if was_parent {
             self.stats_mut().tree.parent_losses += 1;
-            let peer_costs: HashMap<NodeAddr, f64> = self.peers.iter()
+            let peer_costs: HashMap<NodeAddr, f64> = self
+                .peers
+                .iter()
                 .filter(|(_, peer)| peer.has_srtt())
                 .map(|(addr, peer)| (*addr, peer.link_cost()))
                 .collect();

src/node/wire.rs

@@ -17,8 +17,8 @@
 //! | 0x1   | Noise IK msg1   | 114 bytes  | Handshake initiation           |
 //! | 0x2   | Noise IK msg2   | 69 bytes   | Handshake response             |
 
-use crate::utils::index::SessionIndex;
 use crate::noise::{HANDSHAKE_MSG1_SIZE, HANDSHAKE_MSG2_SIZE, TAG_SIZE};
+use crate::utils::index::SessionIndex;
 
 // ============================================================================
 // Constants
@@ -164,8 +164,7 @@ impl EncryptedHeader {
         let payload_len = u16::from_le_bytes([data[2], data[3]]);
         let receiver_idx = SessionIndex::from_le_bytes([data[4], data[5], data[6], data[7]]);
         let counter = u64::from_le_bytes([
-            data[8], data[9], data[10], data[11],
-            data[12], data[13], data[14], data[15],
+            data[8], data[9], data[10], data[11], data[12], data[13], data[14], data[15],
         ]);
 
         let mut header_bytes = [0u8; ESTABLISHED_HEADER_SIZE];
@@ -328,7 +327,11 @@ pub fn build_msg1(sender_idx: SessionIndex, noise_msg1: &[u8]) -> Vec<u8> {
 /// Build a wire-format msg2 packet.
 ///
 /// Format: `[0x02][0x00][payload_len:2 LE][sender_idx:4 LE][receiver_idx:4 LE][noise_msg2:57]`
-pub fn build_msg2(sender_idx: SessionIndex, receiver_idx: SessionIndex, noise_msg2: &[u8]) -> Vec<u8> {
+pub fn build_msg2(
+    sender_idx: SessionIndex,
+    receiver_idx: SessionIndex,
+    noise_msg2: &[u8],
+) -> Vec<u8> {
     debug_assert_eq!(noise_msg2.len(), HANDSHAKE_MSG2_SIZE);
 
     let payload_len = (4 + 4 + noise_msg2.len()) as u16; // sender + receiver + noise
@@ -542,8 +545,8 @@ mod tests {
 
     #[test]
     fn test_wire_sizes() {
-        assert_eq!(MSG1_WIRE_SIZE, 114);  // 4 + 4 + 106
-        assert_eq!(MSG2_WIRE_SIZE, 69);   // 4 + 4 + 4 + 57
+        assert_eq!(MSG1_WIRE_SIZE, 114); // 4 + 4 + 106
+        assert_eq!(MSG2_WIRE_SIZE, 69); // 4 + 4 + 4 + 57
         assert_eq!(ENCRYPTED_MIN_SIZE, 32); // 16 + 16
         assert_eq!(COMMON_PREFIX_SIZE, 4);
         assert_eq!(ESTABLISHED_HEADER_SIZE, 16);
@@ -585,22 +588,17 @@ mod tests {
 
     #[test]
     fn test_flags_byte() {
-        let header = build_established_header(
-            SessionIndex::new(1),
-            0,
-            FLAG_KEY_EPOCH | FLAG_SP,
-            100,
-        );
+        let header =
+            build_established_header(SessionIndex::new(1), 0, FLAG_KEY_EPOCH | FLAG_SP, 100);
         assert_eq!(header[1], 0x05); // bits 0 and 2 set
 
         let parsed = EncryptedHeader::parse(&[
-            header[0], header[1], header[2], header[3],
-            header[4], header[5], header[6], header[7],
-            header[8], header[9], header[10], header[11],
-            header[12], header[13], header[14], header[15],
-            // minimum: TAG_SIZE bytes of ciphertext
+            header[0], header[1], header[2], header[3], header[4], header[5], header[6], header[7],
+            header[8], header[9], header[10], header[11], header[12], header[13], header[14],
+            header[15], // minimum: TAG_SIZE bytes of ciphertext
             0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-        ]).unwrap();
+        ])
+        .unwrap();
         assert_eq!(parsed.flags & FLAG_KEY_EPOCH, FLAG_KEY_EPOCH);
         assert_eq!(parsed.flags & FLAG_CE, 0);
         assert_eq!(parsed.flags & FLAG_SP, FLAG_SP);