diff --git a/crates/cockpit-server/src/codebook.rs b/crates/cockpit-server/src/codebook.rs
index 5bab8f929..d7f5cacfa 100644
--- a/crates/cockpit-server/src/codebook.rs
+++ b/crates/cockpit-server/src/codebook.rs
@@ -17,6 +17,10 @@ use std::hash::{Hash, Hasher};
 ///
 /// Both this crate and `lance-graph`'s thinking engine assume the same
 /// codebook width when exchanging `u16` indices. Keep in sync.
+#[allow(
+    dead_code,
+    reason = "codebook token-index surface (Cypher identifier extraction -> stable u16 index); built out but no call site wires it yet; allow not expect — used under cfg(test)/feature, so no expectation holds in every --all-targets compilation"
+)]
 pub const CODEBOOK_SIZE: usize = 4096;
 
 /// Synthetic placeholder distance table for `ThinkingEngine::new`.
@@ -31,11 +35,19 @@ pub const CODEBOOK_SIZE: usize = 4096;
 ///
 /// Cost: 4096 × 4096 × 1 byte = 16 MB. Allocated once per cockpit-server
 /// boot (per SSE connection in the current handler).
+#[expect(
+    dead_code,
+    reason = "codebook token-index surface; PHASE 2A stub distance table for ThinkingEngine::new, built out but no call site wires it yet"
+)]
 pub fn default_distance_table() -> Vec<u8> {
     vec![0u8; CODEBOOK_SIZE * CODEBOOK_SIZE]
 }
 
 /// Cypher keywords excluded from identifier extraction.
+#[allow(
+    dead_code,
+    reason = "codebook token-index surface; keyword exclusion list for extract_cypher_identifiers, built out but no call site wires it yet; allow not expect — used under cfg(test)/feature, so no expectation holds in every --all-targets compilation"
+)]
 const CYPHER_KEYWORDS: &[&str] = &[
     "MATCH", "RETURN", "WHERE", "CREATE", "MERGE", "SET", "DELETE", "AS", "AND", "OR", "NOT",
     "NULL", "TRUE", "FALSE", "OPTIONAL", "WITH", "UNWIND", "ORDER", "BY", "ASC", "DESC", "LIMIT",
@@ -43,6 +55,10 @@ const CYPHER_KEYWORDS: &[&str] = &[
 ];
 
 /// Maximum identifiers returned by [`extract_cypher_identifiers`] per call.
+#[allow(
+    dead_code,
+    reason = "codebook token-index surface; per-call cap for extract_cypher_identifiers, built out but no call site wires it yet; allow not expect — used under cfg(test)/feature, so no expectation holds in every --all-targets compilation"
+)]
 const MAX_IDENTIFIERS_PER_CALL: usize = 32;
 
 /// Map a token to a stable `u16` codebook index in `[0, CODEBOOK_SIZE)`.
@@ -51,6 +67,10 @@ const MAX_IDENTIFIERS_PER_CALL: usize = 32;
 /// deterministic within a single process run; callers must not rely on
 /// stability across Rust toolchain versions, since `DefaultHasher` is not
 /// guaranteed stable across releases.
+#[allow(
+    dead_code,
+    reason = "codebook token-index surface; stable token->u16 index mapping, built out but no call site wires it yet; allow not expect — used under cfg(test)/feature, so no expectation holds in every --all-targets compilation"
+)]
 pub fn token_to_index(token: &str) -> u16 {
     let mut hasher = DefaultHasher::new();
     token.hash(&mut hasher);
@@ -63,6 +83,10 @@ pub fn token_to_index(token: &str) -> u16 {
 /// Preserves first-occurrence order: if two distinct tokens hash to the same
 /// index, both appear once in input order, but duplicate tokens collapse to
 /// a single index in the output.
+#[allow(
+    dead_code,
+    reason = "codebook token-index surface; batch token->indices dedup helper, built out but no call site wires it yet; allow not expect — used under cfg(test)/feature, so no expectation holds in every --all-targets compilation"
+)]
 pub fn tokens_to_indices(tokens: &[&str]) -> Vec<u16> {
     let mut seen: HashSet<&str> = HashSet::with_capacity(tokens.len());
     let mut out: Vec<u16> = Vec::with_capacity(tokens.len());
@@ -80,6 +104,10 @@ pub fn tokens_to_indices(tokens: &[&str]) -> Vec<u16> {
 /// start with an ASCII letter and have length >= 2, drops Cypher keywords
 /// (case-insensitive), deduplicates while preserving first-occurrence
 /// order, and caps the output at [`MAX_IDENTIFIERS_PER_CALL`] entries.
+#[allow(
+    dead_code,
+    reason = "codebook token-index surface; Cypher identifier extraction for the scene player/shader stream, built out but no call site wires it yet; allow not expect — used under cfg(test)/feature, so no expectation holds in every --all-targets compilation"
+)]
 pub fn extract_cypher_identifiers(content: &str) -> Vec<String> {
     let mut seen: HashSet<String> = HashSet::new();
     let mut out: Vec<String> = Vec::new();
diff --git a/crates/cockpit-server/src/graph_engine.rs b/crates/cockpit-server/src/graph_engine.rs
index 811fc6e8b..0c7b9c953 100644
--- a/crates/cockpit-server/src/graph_engine.rs
+++ b/crates/cockpit-server/src/graph_engine.rs
@@ -107,10 +107,18 @@ pub struct GraphEdge {
 
 impl GraphEdge {
     /// Convenience: legacy `truth_f` accessor for in-process consumers.
+    #[expect(
+        dead_code,
+        reason = "legacy accessor for in-process consumers; the wire Serialize impl reads self.truth.frequency/.confidence directly, so nothing calls this yet"
+    )]
     pub fn truth_f(&self) -> f32 {
         self.truth.frequency
     }
     /// Convenience: legacy `truth_c` accessor for in-process consumers.
+    #[expect(
+        dead_code,
+        reason = "legacy accessor for in-process consumers; the wire Serialize impl reads self.truth.frequency/.confidence directly, so nothing calls this yet"
+    )]
     pub fn truth_c(&self) -> f32 {
         self.truth.confidence
     }
diff --git a/crates/cockpit-server/src/main.rs b/crates/cockpit-server/src/main.rs
index 927816376..249a00029 100644
--- a/crates/cockpit-server/src/main.rs
+++ b/crates/cockpit-server/src/main.rs
@@ -18,6 +18,8 @@ use std::time::Duration;
 
 use axum::extract::State;
 use axum::http::StatusCode;
+#[cfg(feature = "embed-cockpit")]
+use axum::http::header;
 use axum::response::sse::{Event, Sse};
 use axum::response::{Html, IntoResponse, Response};
 use axum::routing::{get, post};
@@ -149,6 +151,10 @@ struct SseEvent {
 
 #[derive(Debug, Deserialize)]
 struct McpRequest {
+    #[expect(
+        dead_code,
+        reason = "part of the JSON-RPC 2.0 envelope; required for serde to parse incoming requests per the wire schema, but the value itself is never consulted"
+    )]
     jsonrpc: String,
     id: serde_json::Value,
     method: String,
@@ -523,6 +529,10 @@ async fn shutdown_signal() {
 /// filename for a known slug, `None` for unknown/malformed ones. Slugs are
 /// lowercase `[a-z0-9-]` — anything else is rejected before the map lookup
 /// (no path traversal into the dist).
+#[allow(
+    dead_code,
+    reason = "Garmin terrain-scene resolution surface; only call sites are under cfg(feature = \"embed-cockpit\") and cfg(test), so a default build sees no reference; allow not expect — used under cfg(test)/feature, so no expectation holds in every --all-targets compilation"
+)]
 fn resolve_garmin_map(manifest_json: &str, map_key: &str, location: &str) -> Option<String> {
     if location.is_empty()
         || !location
@@ -535,6 +545,10 @@ fn resolve_garmin_map(manifest_json: &str, map_key: &str, location: &str) -> Opt
     v.get(map_key)?.get(location)?.as_str().map(String::from)
 }
 
+#[allow(
+    dead_code,
+    reason = "Garmin terrain-scene resolution surface; only call sites are under cfg(feature = \"embed-cockpit\") and cfg(test), so a default build sees no reference; allow not expect — used under cfg(test)/feature, so no expectation holds in every --all-targets compilation"
+)]
 fn resolve_garmin_scene(manifest_json: &str, location: &str) -> Option<String> {
     resolve_garmin_map(manifest_json, "garmin_scenes", location)
 }
@@ -542,6 +556,10 @@ fn resolve_garmin_scene(manifest_json: &str, location: &str) -> Option<String> {
 /// Resolve a `/garmin-drape/:location` slug through the manifest's `garmin_drapes`
 /// map — the DRP1 vector overlay (roads / trails / rivers) that drapes onto the
 /// `garmin_scenes` terrain of the same slug. Absent = the scene has no drape.
+#[allow(
+    dead_code,
+    reason = "Garmin terrain-scene resolution surface; only call sites are under cfg(feature = \"embed-cockpit\") and cfg(test), so a default build sees no reference; allow not expect — used under cfg(test)/feature, so no expectation holds in every --all-targets compilation"
+)]
 fn resolve_garmin_drape(manifest_json: &str, location: &str) -> Option<String> {
     resolve_garmin_map(manifest_json, "garmin_drapes", location)
 }
@@ -549,11 +567,19 @@ fn resolve_garmin_drape(manifest_json: &str, location: &str) -> Option<String> {
 /// Resolve a `/garmin-contours/:location` slug through the manifest's
 /// `garmin_contours` map — the DRP1 topo-line overlay that drapes onto the
 /// `garmin_scenes` terrain of the same slug. Absent = the scene has no contours.
+#[allow(
+    dead_code,
+    reason = "Garmin terrain-scene resolution surface; only call sites are under cfg(feature = \"embed-cockpit\") and cfg(test), so a default build sees no reference; allow not expect — used under cfg(test)/feature, so no expectation holds in every --all-targets compilation"
+)]
 fn resolve_garmin_contours(manifest_json: &str, location: &str) -> Option<String> {
     resolve_garmin_map(manifest_json, "garmin_contours", location)
 }
 
 /// List the available scene slugs (for the self-documenting 404).
+#[allow(
+    dead_code,
+    reason = "Garmin terrain-scene resolution surface; only call sites are under cfg(feature = \"embed-cockpit\") and cfg(test), so a default build sees no reference; allow not expect — used under cfg(test)/feature, so no expectation holds in every --all-targets compilation"
+)]
 fn garmin_scene_slugs(manifest_json: &str) -> Vec<String> {
     serde_json::from_str::<serde_json::Value>(manifest_json)
         .ok()
@@ -746,6 +772,10 @@ async fn static_handler(uri: axum::http::Uri) -> Response {
     (StatusCode::NOT_FOUND, "Not found").into_response()
 }
 
+#[allow(
+    dead_code,
+    reason = "MIME lookup utility; sole call site is inside the cfg(feature = \"embed-cockpit\") static_handler block; allow not expect — with that feature enabled the call exists, so no expectation holds in every configuration"
+)]
 fn mime_from_path(path: &str) -> &'static str {
     if path.ends_with(".html") {
         "text/html; charset=utf-8"
diff --git a/crates/cockpit-server/src/openai.rs b/crates/cockpit-server/src/openai.rs
index f4fed68e5..929dce2bf 100644
--- a/crates/cockpit-server/src/openai.rs
+++ b/crates/cockpit-server/src/openai.rs
@@ -59,19 +59,75 @@ struct ModelListResponse {
 #[derive(Deserialize)]
 pub struct CompletionReq {
     pub model: Option<String>,
+    #[expect(
+        dead_code,
+        reason = "OpenAI-compatible request DTO field; part of the wire schema and must deserialize, but this server does not read it"
+    )]
     pub prompt: Option<String>,
+    #[expect(
+        dead_code,
+        reason = "OpenAI-compatible request DTO field; part of the wire schema and must deserialize, but this server does not read it"
+    )]
     pub max_tokens: Option<usize>,
+    #[expect(
+        dead_code,
+        reason = "OpenAI-compatible request DTO field; part of the wire schema and must deserialize, but this server does not read it"
+    )]
     pub temperature: Option<f32>,
+    #[expect(
+        dead_code,
+        reason = "OpenAI-compatible request DTO field; part of the wire schema and must deserialize, but this server does not read it"
+    )]
     pub top_p: Option<f32>,
+    #[expect(
+        dead_code,
+        reason = "OpenAI-compatible request DTO field; part of the wire schema and must deserialize, but this server does not read it"
+    )]
     pub n: Option<usize>,
+    #[expect(
+        dead_code,
+        reason = "OpenAI-compatible request DTO field; part of the wire schema and must deserialize, but this server does not read it"
+    )]
     pub stream: Option<bool>,
+    #[expect(
+        dead_code,
+        reason = "OpenAI-compatible request DTO field; part of the wire schema and must deserialize, but this server does not read it"
+    )]
     pub logprobs: Option<usize>,
+    #[expect(
+        dead_code,
+        reason = "OpenAI-compatible request DTO field; part of the wire schema and must deserialize, but this server does not read it"
+    )]
     pub echo: Option<bool>,
+    #[expect(
+        dead_code,
+        reason = "OpenAI-compatible request DTO field; part of the wire schema and must deserialize, but this server does not read it"
+    )]
     pub stop: Option<Vec<String>>,
+    #[expect(
+        dead_code,
+        reason = "OpenAI-compatible request DTO field; part of the wire schema and must deserialize, but this server does not read it"
+    )]
     pub presence_penalty: Option<f32>,
+    #[expect(
+        dead_code,
+        reason = "OpenAI-compatible request DTO field; part of the wire schema and must deserialize, but this server does not read it"
+    )]
     pub frequency_penalty: Option<f32>,
+    #[expect(
+        dead_code,
+        reason = "OpenAI-compatible request DTO field; part of the wire schema and must deserialize, but this server does not read it"
+    )]
     pub seed: Option<u64>,
+    #[expect(
+        dead_code,
+        reason = "OpenAI-compatible request DTO field; part of the wire schema and must deserialize, but this server does not read it"
+    )]
     pub suffix: Option<String>,
+    #[expect(
+        dead_code,
+        reason = "OpenAI-compatible request DTO field; part of the wire schema and must deserialize, but this server does not read it"
+    )]
     pub user: Option<String>,
 }
 
@@ -99,18 +155,70 @@ struct CompletionChoice {
 pub struct ChatCompletionReq {
     pub model: Option<String>,
     pub messages: Vec<ChatMessageReq>,
+    #[expect(
+        dead_code,
+        reason = "OpenAI-compatible request DTO field; part of the wire schema and must deserialize, but this server does not read it"
+    )]
     pub max_tokens: Option<usize>,
+    #[expect(
+        dead_code,
+        reason = "OpenAI-compatible request DTO field; part of the wire schema and must deserialize, but this server does not read it"
+    )]
     pub temperature: Option<f32>,
+    #[expect(
+        dead_code,
+        reason = "OpenAI-compatible request DTO field; part of the wire schema and must deserialize, but this server does not read it"
+    )]
     pub top_p: Option<f32>,
+    #[expect(
+        dead_code,
+        reason = "OpenAI-compatible request DTO field; part of the wire schema and must deserialize, but this server does not read it"
+    )]
     pub n: Option<usize>,
+    #[expect(
+        dead_code,
+        reason = "OpenAI-compatible request DTO field; part of the wire schema and must deserialize, but this server does not read it"
+    )]
     pub stream: Option<bool>,
+    #[expect(
+        dead_code,
+        reason = "OpenAI-compatible request DTO field; part of the wire schema and must deserialize, but this server does not read it"
+    )]
     pub stop: Option<Vec<String>>,
+    #[expect(
+        dead_code,
+        reason = "OpenAI-compatible request DTO field; part of the wire schema and must deserialize, but this server does not read it"
+    )]
     pub presence_penalty: Option<f32>,
+    #[expect(
+        dead_code,
+        reason = "OpenAI-compatible request DTO field; part of the wire schema and must deserialize, but this server does not read it"
+    )]
     pub frequency_penalty: Option<f32>,
+    #[expect(
+        dead_code,
+        reason = "OpenAI-compatible request DTO field; part of the wire schema and must deserialize, but this server does not read it"
+    )]
     pub seed: Option<u64>,
+    #[expect(
+        dead_code,
+        reason = "OpenAI-compatible request DTO field; part of the wire schema and must deserialize, but this server does not read it"
+    )]
     pub user: Option<String>,
+    #[expect(
+        dead_code,
+        reason = "OpenAI-compatible request DTO field; part of the wire schema and must deserialize, but this server does not read it"
+    )]
     pub tools: Option<serde_json::Value>,
+    #[expect(
+        dead_code,
+        reason = "OpenAI-compatible request DTO field; part of the wire schema and must deserialize, but this server does not read it"
+    )]
     pub tool_choice: Option<String>,
+    #[expect(
+        dead_code,
+        reason = "OpenAI-compatible request DTO field; part of the wire schema and must deserialize, but this server does not read it"
+    )]
     pub response_format: Option<serde_json::Value>,
 }
 
@@ -118,8 +226,20 @@ pub struct ChatCompletionReq {
 pub struct ChatMessageReq {
     pub role: String,
     pub content: Option<String>,
+    #[expect(
+        dead_code,
+        reason = "OpenAI-compatible request DTO field; part of the wire schema and must deserialize, but this server does not read it"
+    )]
     pub name: Option<String>,
+    #[expect(
+        dead_code,
+        reason = "OpenAI-compatible request DTO field; part of the wire schema and must deserialize, but this server does not read it"
+    )]
     pub tool_calls: Option<serde_json::Value>,
+    #[expect(
+        dead_code,
+        reason = "OpenAI-compatible request DTO field; part of the wire schema and must deserialize, but this server does not read it"
+    )]
     pub tool_call_id: Option<String>,
 }
 
@@ -152,9 +272,21 @@ struct ChatMessageObj {
 #[derive(Deserialize)]
 pub struct EmbeddingReq {
     pub model: Option<String>,
+    #[expect(
+        dead_code,
+        reason = "OpenAI-compatible request DTO field; part of the wire schema and must deserialize, but this server does not read it"
+    )]
     pub input: serde_json::Value, // string, array of strings, or token IDs
+    #[expect(
+        dead_code,
+        reason = "OpenAI-compatible request DTO field; part of the wire schema and must deserialize, but this server does not read it"
+    )]
     pub encoding_format: Option<String>,
     pub dimensions: Option<usize>,
+    #[expect(
+        dead_code,
+        reason = "OpenAI-compatible request DTO field; part of the wire schema and must deserialize, but this server does not read it"
+    )]
     pub user: Option<String>,
 }
 
@@ -177,13 +309,37 @@ struct EmbeddingObj {
 
 #[derive(Deserialize)]
 pub struct ImageGenReq {
+    #[expect(
+        dead_code,
+        reason = "OpenAI-compatible request DTO field; part of the wire schema and must deserialize, but this server does not read it"
+    )]
     pub model: Option<String>,
     pub prompt: String,
     pub n: Option<usize>,
+    #[expect(
+        dead_code,
+        reason = "OpenAI-compatible request DTO field; part of the wire schema and must deserialize, but this server does not read it"
+    )]
     pub size: Option<String>,
+    #[expect(
+        dead_code,
+        reason = "OpenAI-compatible request DTO field; part of the wire schema and must deserialize, but this server does not read it"
+    )]
     pub response_format: Option<String>,
+    #[expect(
+        dead_code,
+        reason = "OpenAI-compatible request DTO field; part of the wire schema and must deserialize, but this server does not read it"
+    )]
     pub quality: Option<String>,
+    #[expect(
+        dead_code,
+        reason = "OpenAI-compatible request DTO field; part of the wire schema and must deserialize, but this server does not read it"
+    )]
     pub style: Option<String>,
+    #[expect(
+        dead_code,
+        reason = "OpenAI-compatible request DTO field; part of the wire schema and must deserialize, but this server does not read it"
+    )]
     pub user: Option<String>,
 }
 
@@ -210,11 +366,19 @@ struct UsageObj {
 }
 
 #[derive(Serialize)]
+#[expect(
+    dead_code,
+    reason = "typed OpenAI error DTO; every error path in this file builds its body ad hoc via serde_json::json! instead, so nothing constructs this type"
+)]
 struct ErrorResp {
     error: ErrorObj,
 }
 
 #[derive(Serialize)]
+#[expect(
+    dead_code,
+    reason = "typed OpenAI error DTO; every error path in this file builds its body ad hoc via serde_json::json! instead, so nothing constructs this type"
+)]
 struct ErrorObj {
     message: String,
     r#type: String,
diff --git a/crates/cockpit-server/src/osint_gotham.rs b/crates/cockpit-server/src/osint_gotham.rs
index 629a8d816..5019e94fb 100644
--- a/crates/cockpit-server/src/osint_gotham.rs
+++ b/crates/cockpit-server/src/osint_gotham.rs
@@ -562,7 +562,7 @@ fn is_version_token(tok: &str) -> bool {
 /// The deterministic basin plan: every node → an 8-bit basin byte
 /// `(theme << 4) | anchor`, plus the inverse map basin → anchor entity id (for
 /// hub labels).
-struct BasinPlan {
+pub(crate) struct BasinPlan {
     /// node id → basin byte.
     node_basin: HashMap<String, u8>,
     /// node id → theme stem (for hub labels / props).
diff --git a/crates/cockpit-server/src/osm_artifact_manager.rs b/crates/cockpit-server/src/osm_artifact_manager.rs
index 6f532a809..503df1b27 100644
--- a/crates/cockpit-server/src/osm_artifact_manager.rs
+++ b/crates/cockpit-server/src/osm_artifact_manager.rs
@@ -90,6 +90,10 @@ impl OsmArtifactManager {
     /// Atomically replace the lifecycle snapshot. A caller holding an
     /// `Arc<Lifecycle>` from a prior `current()` keeps observing the old
     /// value — this call never mutates through an existing `Arc`.
+    #[allow(
+        dead_code,
+        reason = "hydration write path for Phase C, which has not landed yet; exercised only by this module's tests today; allow not expect — used under cfg(test)/feature, so no expectation holds in every --all-targets compilation"
+    )]
     pub fn publish_lifecycle(&self, next: Lifecycle) {
         self.lifecycle.store(Arc::new(next));
     }
@@ -98,6 +102,10 @@ impl OsmArtifactManager {
     /// guarantee as `publish_lifecycle`, and `None` is a valid publication
     /// (Phase C uses it to retract content whose lifecycle moved to
     /// `absent`/`CandidateFailed` with no prior active version).
+    #[allow(
+        dead_code,
+        reason = "hydration write path for Phase C, which has not landed yet; exercised only by this module's tests today; allow not expect — used under cfg(test)/feature, so no expectation holds in every --all-targets compilation"
+    )]
     pub fn publish_artifact(&self, next: Option<Arc<ActiveArtifact>>) {
         self.artifact.store(next);
     }
@@ -127,6 +135,10 @@ pub struct CgroupMemory {
 }
 
 /// Parse `memory.current`'s content: a bare decimal integer.
+#[allow(
+    dead_code,
+    reason = "read only by `read_cgroup_memory`'s cfg(target_os = \"linux\") arm and by this module's tests; dead on every non-Linux target, so allow not expect — no single expectation holds across targets"
+)]
 #[must_use]
 pub fn parse_cgroup_current(raw: &str) -> Option<u64> {
     raw.trim().parse().ok()
@@ -136,6 +148,10 @@ pub fn parse_cgroup_current(raw: &str) -> Option<u64> {
 /// string `max` meaning "no limit" (represented here as `None`, same as an
 /// unreadable file — see [`CgroupMemory::max_bytes`] for how to tell them
 /// apart).
+#[allow(
+    dead_code,
+    reason = "read only by `read_cgroup_memory`'s cfg(target_os = \"linux\") arm and by this module's tests; dead on every non-Linux target, so allow not expect — no single expectation holds across targets"
+)]
 #[must_use]
 pub fn parse_cgroup_max(raw: &str) -> Option<u64> {
     let trimmed = raw.trim();
diff --git a/crates/cockpit-server/src/osm_features.rs b/crates/cockpit-server/src/osm_features.rs
index 4bfdb8a3a..b76624126 100644
--- a/crates/cockpit-server/src/osm_features.rs
+++ b/crates/cockpit-server/src/osm_features.rs
@@ -155,6 +155,10 @@ fn row_budget(z: u32) -> usize {
 /// Take every `stride`-th row so a decimated tile stays spatially
 /// representative. Split out from `query_tile` so the *selection* rule can be
 /// falsified at any budget, without a fixture the size of a real overview tile.
+#[allow(
+    dead_code,
+    reason = "only called from #[cfg(test)] callers; unused in a non-test build; allow not expect — used under cfg(test)/feature, so no expectation holds in every --all-targets compilation"
+)]
 fn stride_for(total: usize, budget: usize) -> usize {
     total.div_ceil(budget).max(1)
 }
@@ -1247,6 +1251,12 @@ fn simplify_cells_raw(
 ///   untouched — dots are points, geometry is the map.
 const GEOMETRY_OVERVIEW_BUDGET: usize = 12_000;
 const GEOMETRY_CITY_BUDGET: usize = CITY_ROW_CEILING;
+// Compile-time invariant: reordering these two budgets must fail the BUILD,
+// not one test. (A runtime assert! on two consts can never fire.)
+const _: () = assert!(
+    GEOMETRY_CITY_BUDGET > GEOMETRY_OVERVIEW_BUDGET,
+    "a city tile must be allowed more shapes than an overview tile"
+);
 /// Below this on-screen extent a shape has no resolvable outline, and drawing
 /// one is worse than drawing nothing.
 ///
@@ -2241,9 +2251,13 @@ mod tests {
     /// Decode `OSM1` bytes back into shapes — an independent reader for the
     /// round-trip test below, written from the format DOC, not from the
     /// encoder's code, so a shared misunderstanding can't self-certify.
-    fn decode_tile_bin(
-        buf: &[u8],
-    ) -> Option<(u32, u32, u32, u32, Vec<(u32, u8, bool, Vec<(f32, f32)>)>)> {
+    /// A decoded vertex: (x, y) in z32-cell-scaled units — never lon/lat.
+    type Point = (f32, f32);
+    /// One decoded shape record: (index, class wire code, closed, vertices).
+    type DecodedShape = (u32, u8, bool, Vec<Point>);
+    /// A fully decoded OSM1 tile: (total, sampled, count, malformed, shapes).
+    type DecodedTile = (u32, u32, u32, u32, Vec<DecodedShape>);
+    fn decode_tile_bin(buf: &[u8]) -> Option<DecodedTile> {
         let rd_u32 = |at: usize| u32::from_le_bytes(buf[at..at + 4].try_into().unwrap());
         if buf.len() < 20 || rd_u32(0) != 0x314D_534F {
             return None;
@@ -2371,10 +2385,6 @@ mod tests {
             GEOMETRY_OVERVIEW_BUDGET
         );
         assert_eq!(geometry_row_budget(CITY_ZOOM_FLOOR), GEOMETRY_CITY_BUDGET);
-        assert!(
-            GEOMETRY_CITY_BUDGET > GEOMETRY_OVERVIEW_BUDGET,
-            "a city tile must be allowed more shapes than an overview tile"
-        );
     }
 
     /// Anti-vacuity test (per the plan's Phase-1 requirement): two real,
diff --git a/crates/cockpit-server/src/osm_slab_hydrate.rs b/crates/cockpit-server/src/osm_slab_hydrate.rs
index d0d51f710..544b17a3c 100644
--- a/crates/cockpit-server/src/osm_slab_hydrate.rs
+++ b/crates/cockpit-server/src/osm_slab_hydrate.rs
@@ -729,9 +729,14 @@ static FADVISE_ATTEMPTED: std::sync::atomic::AtomicUsize = std::sync::atomic::At
 /// Advise the kernel it can drop `f`'s pages from the page cache now that
 /// we're done reading it.
 ///
-/// No portable equivalent exists for this on non-Unix targets (see
-/// `.claude/rules/cross-platform.md`), so it is a documented no-op there —
-/// this is memory hygiene, not correctness, so a silent no-op is fine.
+/// `posix_fadvise` is a **Linux/Android extension, not POSIX-universal** —
+/// Apple's libc does not declare it, so `cfg(unix)` reads as "has fadvise"
+/// and is not. Gating this on `cfg(unix)` broke the macOS build outright
+/// with "E0425: cannot find function posix_fadvise in crate libc"; see
+/// `.claude/rules/cross-platform.md`. Every other target takes the
+/// documented no-op below — this is memory hygiene, not correctness, so a
+/// silent no-op is fine. **Widen this gate only to targets whose libc
+/// actually declares the call.**
 ///
 /// Deliberately untestable via RSS or cgroup memory accounting, same as
 /// `osm_lance.rs`'s `release_after_write`: `/proc/self/statm` cannot see
@@ -743,7 +748,7 @@ static FADVISE_ATTEMPTED: std::sync::atomic::AtomicUsize = std::sync::atomic::At
 /// silently skipped or removed, which a counter catches and an RSS
 /// measurement cannot (see the falsifiability rule: a test that cannot
 /// fail when the guard is deleted is not a test of the guard).
-#[cfg(unix)]
+#[cfg(any(target_os = "linux", target_os = "android"))]
 fn advise_dontneed(f: &std::fs::File) {
     #[cfg(test)]
     FADVISE_ATTEMPTED.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
@@ -762,7 +767,7 @@ fn advise_dontneed(f: &std::fs::File) {
     }
 }
 
-#[cfg(not(unix))]
+#[cfg(not(any(target_os = "linux", target_os = "android")))]
 fn advise_dontneed(_f: &std::fs::File) {
     #[cfg(test)]
     FADVISE_ATTEMPTED.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
diff --git a/crates/cockpit-server/src/osm_tiles.rs b/crates/cockpit-server/src/osm_tiles.rs
index 17f4bdfcd..820518141 100644
--- a/crates/cockpit-server/src/osm_tiles.rs
+++ b/crates/cockpit-server/src/osm_tiles.rs
@@ -89,12 +89,20 @@ pub fn lonlat_to_tile(lon: f64, lat: f64, z: u32) -> (u32, u32) {
 /// Delegates to the substrate's `morton64`, which interleaves the full 32-bit
 /// lanes the 4-tier key needs.
 #[must_use]
+#[allow(
+    dead_code,
+    reason = "Morton interleave/deinterleave pair; only callers are under cfg(test), so a non-test build sees no reference; allow not expect — used under cfg(test)/feature, so no expectation holds in every --all-targets compilation"
+)]
 pub fn morton_interleave(x: u32, y: u32) -> u64 {
     osm_soa_bake::tms::morton64(x, y)
 }
 
 /// Inverse of [`morton_interleave`].
 #[must_use]
+#[allow(
+    dead_code,
+    reason = "Morton interleave/deinterleave pair; only callers are under cfg(test), so a non-test build sees no reference; allow not expect — used under cfg(test)/feature, so no expectation holds in every --all-targets compilation"
+)]
 pub fn morton_deinterleave(code: u64) -> (u32, u32) {
     osm_soa_bake::tms::demorton64(code)
 }
diff --git a/crates/cockpit-server/src/scene_player.rs b/crates/cockpit-server/src/scene_player.rs
index d47e2466d..7075a7517 100644
--- a/crates/cockpit-server/src/scene_player.rs
+++ b/crates/cockpit-server/src/scene_player.rs
@@ -38,8 +38,16 @@ use lance_graph::parser::parse_cypher_query;
 #[derive(Clone, Debug)]
 pub struct CypherStream {
     /// Provenance label ("AriGraph" for graph-derived perturbations).
+    #[allow(
+        dead_code,
+        reason = "provenance field carried on the DTO for downstream consumers; no reader in this crate yet; allow not expect — used under cfg(test)/feature, so no expectation holds in every --all-targets compilation"
+    )]
     pub source: &'static str,
     pub codebook_indices: Vec<u16>,
+    #[allow(
+        dead_code,
+        reason = "provenance field carried on the DTO for downstream consumers; no reader in this crate yet; allow not expect — used under cfg(test)/feature, so no expectation holds in every --all-targets compilation"
+    )]
     pub timestamp: u64,
 }
 
diff --git a/crates/pampa/tests/integration/test_treesitter_coverage.rs b/crates/pampa/tests/integration/test_treesitter_coverage.rs
index 20f7eee50..c68db0d7e 100644
--- a/crates/pampa/tests/integration/test_treesitter_coverage.rs
+++ b/crates/pampa/tests/integration/test_treesitter_coverage.rs
@@ -466,7 +466,7 @@ fn test_example_list() {
     assert!(
         matches!(&pandoc.blocks[0], Block::OrderedList(_)),
         "Expected OrderedList, got {:?}",
-        &pandoc.blocks[0]
+        pandoc.blocks[0]
     );
 
     if let Block::OrderedList(list) = &pandoc.blocks[0] {