style(dynamic): improve code readability by reformatting long lines and aligning nested structures

src/commands/scan.rs

@@ -390,7 +390,10 @@ pub(crate) fn verify_findings_for_scan(
             // rewrites the SHELL_ESCAPE bit, so FILE_IO / SQL_QUERY / etc. are
             // untouched.  Runs after the stable-hash is computed, so dedup keys
             // are unaffected.
-            if matches!(result.status, crate::dynamic::report::VerifyStatus::Confirmed) {
+            if matches!(
+                result.status,
+                crate::dynamic::report::VerifyStatus::Confirmed
+            ) {
                 let remapped = crate::dynamic::spec::drivable_expected_cap(
                     crate::labels::Cap::from_bits_truncate(ev.sink_caps),
                 );

src/dynamic/corpus/path_trav/java.rs

@@ -44,9 +44,7 @@ pub const PAYLOADS: &[CuratedPayload] = &[
         provenance: PayloadProvenance::Curated,
         since_corpus_version: 17,
         deprecated_at_corpus_version: None,
-        fixture_paths: &[
+        fixture_paths: &["tests/benchmark/corpus/java/path_traversal/PathTraversalServlet.java"],
-            "tests/benchmark/corpus/java/path_traversal/PathTraversalServlet.java",
-        ],
         oob_nonce_slot: false,
         probe_predicates: &[],
         benign_control: Some(PayloadRef {
@@ -64,9 +62,7 @@ pub const PAYLOADS: &[CuratedPayload] = &[
         provenance: PayloadProvenance::Curated,
         since_corpus_version: 17,
         deprecated_at_corpus_version: None,
-        fixture_paths: &[
+        fixture_paths: &["tests/benchmark/corpus/java/path_traversal/PathTraversalServlet.java"],
-            "tests/benchmark/corpus/java/path_traversal/PathTraversalServlet.java",
-        ],
         oob_nonce_slot: false,
         probe_predicates: &[],
         benign_control: None,

src/dynamic/lang/java.rs

@@ -3326,14 +3326,16 @@ fn invoke_for_shape(spec: &HarnessSpec, shape: JavaShape, entry_class: &str) ->
             "            String[] mainArgs = new String[] {{ payload }};\n            {entry_class}.main(mainArgs);"
         ),
         JavaShape::ServletDoGet => {
-            let slots = slot_names_java_array(&servlet_slot_names(&read_entry_source(&spec.entry_file)));
+            let slots =
+                slot_names_java_array(&servlet_slot_names(&read_entry_source(&spec.entry_file)));
             let drain = servlet_drain_response(spec);
             format!(
                 "            invokeServlet({entry_class}.class, \"doGet\", payload, \"GET\", {slots}, {drain});"
             )
         }
         JavaShape::ServletDoPost => {
-            let slots = slot_names_java_array(&servlet_slot_names(&read_entry_source(&spec.entry_file)));
+            let slots =
+                slot_names_java_array(&servlet_slot_names(&read_entry_source(&spec.entry_file)));
             let drain = servlet_drain_response(spec);
             format!(
                 "            invokeServlet({entry_class}.class, \"doPost\", payload, \"POST\", {slots}, {drain});"

src/dynamic/lang/js_shared.rs

@@ -2790,7 +2790,11 @@ console.log(JSON.stringify({
 "#;
 
     let (body, entry_subpath) = if spec.entry_is_derivable() {
-        let entry_subpath = if is_typescript { "entry.ts" } else { "entry.js" };
+        let entry_subpath = if is_typescript {
+            "entry.ts"
+        } else {
+            "entry.js"
+        };
         let entry_name = &spec.entry_name;
         let call_args = pp_entry_call_args(spec);
         // TypeScript fixtures use ES-module imports + type annotations the
@@ -2800,7 +2804,11 @@ console.log(JSON.stringify({
         // type-stripping + ESM→CJS shim so `esModuleInterop`-style fixtures
         // run as the author intended.  JS fixtures are CommonJS — require
         // them directly.
-        let loader_defs = if is_typescript { TS_ENTRY_LOADER_JS } else { "" };
+        let loader_defs = if is_typescript {
+            TS_ENTRY_LOADER_JS
+        } else {
+            ""
+        };
         let entry_load_expr = if is_typescript {
             format!("nyxLoadTsEntry('./{entry_subpath}')")
         } else {

src/dynamic/oracle.rs

@@ -2022,7 +2022,10 @@ mod tests {
             "render must be lowercase hex: {r}",
         );
         assert!(Canary::ENTROPY_BITS >= 128);
-        assert!(r.len() * 4 >= 128, "rendered canary clears the 128-bit floor");
+        assert!(
+            r.len() * 4 >= 128,
+            "rendered canary clears the 128-bit floor"
+        );
     }
 
     #[test]

src/dynamic/runner.rs

@@ -817,8 +817,7 @@ pub fn run_spec(spec: &HarnessSpec, opts: &SandboxOptions) -> Result<RunOutcome,
         let has_proven_oob = candidates
             .iter()
             .any(|(_, r)| r.verdict == DifferentialVerdict::ConfirmedProvenOob);
-        let confirmed_class =
+        let confirmed_class = has_proven_oob || matches!(aggregate, DifferentialVerdict::Confirmed);
-            has_proven_oob || matches!(aggregate, DifferentialVerdict::Confirmed);
         if confirmed_class {
             // Representative outcome: prefer the strongest (ProvenOob), else
             // the first candidate carrying a triggering verdict.  Iteration

src/dynamic/spec.rs

@@ -616,9 +616,7 @@ fn derive_from_flow_steps(
         Some(e) => (e.file, e.function),
         None => {
             let name = lang_from_path(&sink_file)
-                .and_then(|l| {
+                .and_then(|l| resolve_enclosing_function_via_ast(&sink_file, sink_line as usize, l))
-                    resolve_enclosing_function_via_ast(&sink_file, sink_line as usize, l)
-                })
                 .unwrap_or_else(|| "<unknown>".to_owned());
             (sink_file.clone(), name)
         }
@@ -2118,10 +2116,26 @@ mod tests {
         // enclosing `run` function the sink sits in so the harness can drive
         // it and the author's guard participates in the verdict.
         let cases = [
-            ("tests/dynamic_fixtures/deserialize/java/Benign.java", 36, Lang::Java),
+            (
-            ("tests/dynamic_fixtures/deserialize/java/Vuln.java", 14, Lang::Java),
+                "tests/dynamic_fixtures/deserialize/java/Benign.java",
-            ("tests/dynamic_fixtures/deserialize/ruby/benign.rb", 14, Lang::Ruby),
+                36,
-            ("tests/dynamic_fixtures/deserialize/ruby/vuln.rb", 7, Lang::Ruby),
+                Lang::Java,
+            ),
+            (
+                "tests/dynamic_fixtures/deserialize/java/Vuln.java",
+                14,
+                Lang::Java,
+            ),
+            (
+                "tests/dynamic_fixtures/deserialize/ruby/benign.rb",
+                14,
+                Lang::Ruby,
+            ),
+            (
+                "tests/dynamic_fixtures/deserialize/ruby/vuln.rb",
+                7,
+                Lang::Ruby,
+            ),
         ];
         for (path, line, lang) in cases {
             assert_eq!(

tests/oracle_canary_audit.rs

@@ -68,7 +68,9 @@ fn canary_token(p: &ProbePredicate) -> Option<&str> {
 /// Visit every `ProbePredicate` the corpus carries — both the active
 /// `Oracle::SinkProbe { predicates }` slice and the parallel
 /// `CuratedPayload::probe_predicates` slice — for every `(cap, lang)` entry.
-fn for_each_corpus_predicate(mut visit: impl FnMut(&str /*label*/, &[u8] /*bytes*/, &ProbePredicate)) {
+fn for_each_corpus_predicate(
+    mut visit: impl FnMut(&str /*label*/, &[u8] /*bytes*/, &ProbePredicate),
+) {
     for &(_cap, _lang, slice) in CORPUS.entries {
         for payload in slice {
             if let Oracle::SinkProbe { predicates } = &payload.oracle {
@@ -181,7 +183,11 @@ fn canary_is_collision_free_across_spec_hash_sweep() {
             "canary collision at spec_hash {spec_hash}",
         );
     }
-    assert_eq!(seen.len() as u32, n, "every spec_hash produced a unique canary");
+    assert_eq!(
+        seen.len() as u32,
+        n,
+        "every spec_hash produced a unique canary"
+    );
 }
 
 /// The byte output of `generate` exercises the full space: across many