fix: correct provenance moved-value and get_array_ids syntax + fmt auto-fix

.github/workflows/actions.lock

@@ -7,6 +7,10 @@ workflows:
         - 'actions/checkout@v7.0.1'
         - 'dtolnay/rust-toolchain@v1'
         - 'swatinem/rust-cache@v2.9.2'
+    '.github/workflows/fmt.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'dtolnay/rust-toolchain@v1'
+        - 'Swatinem/rust-cache@v2.9.2'
     '.github/workflows/boj-build.yml':
         - 'actions/checkout@v7.0.1'
     '.github/workflows/casket-pages.yml':
@@ -50,7 +54,10 @@ workflows:
         - 'dtolnay/rust-toolchain@v1'
         - 'softprops/action-gh-release@v3.0.3'
         - 'swatinem/rust-cache@v2.9.2'
-    '.github/workflows/rust-ci.yml': []
+    '.github/workflows/rust-ci.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'dtolnay/rust-toolchain@v1'
+        - 'Swatinem/rust-cache@v2.9.2'
     '.github/workflows/scorecard.yml': []
     '.github/workflows/secret-scanner.yml': []
     '.github/workflows/security.yml':

.github/workflows/ci.yml

@@ -69,6 +69,8 @@ jobs:
             fi
             return $code
           }
+          # Auto-format before checking so PRs don't fail on fmt alone (D189 follow-up)
+          cargo fmt --all || true
           run_logged check cargo check --workspace --all-targets || true
           run_logged test cargo test -p presswerk-core -p presswerk-security -p presswerk-document -p presswerk-print || true
           run_logged clippy cargo clippy --workspace --all-targets -- -D warnings || true

.github/workflows/fmt.yml

@@ -0,0 +1,38 @@
+# SPDX-License-Identifier: MPL-2.0
+# Auto-fix cargo fmt (temporary — remove after D189 lands)
+# Uses only actions already in actions.lock to avoid lock churn.
+
+name: fmt
+
+on:
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  fmt:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7.0.1
+        with:
+          ref: ${{ github.head_ref }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+      - uses: dtolnay/rust-toolchain@v1
+        with:
+          toolchain: stable
+          components: rustfmt
+      - uses: Swatinem/rust-cache@v2.9.2
+      - run: cargo fmt --all
+      - run: |
+          git config user.name "github-actions"
+          git config user.email "github-actions@github.com"
+          if ! git diff --quiet; then
+            git add -A
+            git commit -m "fmt: cargo fmt --all"
+            git push
+          else
+            echo "no fmt changes"
+          fi

.github/workflows/rust-ci.yml

@@ -17,5 +17,32 @@ permissions:
   contents: read
 
 jobs:
+  # Auto-format before the reusable Rust CI so PRs don't fail on fmt alone.
+  fmt:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v7.0.1
+        with:
+          ref: ${{ github.head_ref }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+      - uses: dtolnay/rust-toolchain@v1
+        with:
+          toolchain: stable
+          components: rustfmt
+      - uses: Swatinem/rust-cache@v2.9.2
+      - run: cargo fmt --all
+      - run: |
+          git config user.name "github-actions"
+          git config user.email "github-actions@github.com"
+          if ! git diff --quiet; then
+            git add -A
+            git commit -m "fmt: cargo fmt --all"
+            git push
+          else
+            echo "no fmt changes"
+          fi
   rust-ci:
+    needs: fmt
     uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a # re-pinned 2026-07-01: toolchain-required-input fix (standards#439)

Justfile

@@ -65,7 +65,8 @@ ffp-conformance:
         exit 1
     fi
     cargo build --bin ffp-classify -p presswerk-document
-    FFP_DETECTOR="./target/debug/ffp-classify" bash "$STANDARDS/1-formats/sub-specs/form-fill-provenance/spec/conformance/run-conformance.sh"
+    TARGET_DIR="${CARGO_TARGET_DIR:-./target}"
+    FFP_DETECTOR="$TARGET_DIR/debug/ffp-classify" bash "$STANDARDS/1-formats/sub-specs/form-fill-provenance/spec/conformance/run-conformance.sh"
 
 # Full CI check (test + lint + fmt)
 ci: test-libs lint fmt-check

crates/presswerk-app/src/services/app_services.rs

@@ -16,8 +16,8 @@ use presswerk_core::AppConfig;
 use presswerk_core::error::{PresswerkError, Result};
 use presswerk_core::provenance::FfpClassification;
 use presswerk_core::types::{
-    DiscoveredPrinter, DocumentType, JobId, JobSource, JobStatus, PrintJob,
-    PrintSettings, ServerStatus,
+    DiscoveredPrinter, DocumentType, JobId, JobSource, JobStatus, PrintJob, PrintSettings,
+    ServerStatus,
 };
 use presswerk_document::classify_for_print;
 use presswerk_print::discovery::PrinterDiscovery;
@@ -341,7 +341,12 @@ impl AppServices {
             queue.update_status(job_id, JobStatus::Pending, None)?;
         }
 
-        self.audit("job_released", &job.document_hash, true, Some(&job.document_name));
+        self.audit(
+            "job_released",
+            &job.document_hash,
+            true,
+            Some(&job.document_name),
+        );
 
         self.spawn_send(
             *job_id,
@@ -430,7 +435,10 @@ impl AppServices {
     /// (issue #118, ruling D189).
     pub fn machine_filled_jobs(&self) -> Result<Vec<PrintJob>> {
         let queue = acquire_lock(&self.job_queue);
-        queue.get_jobs_with_form_origin(FfpClassification::MachineFilled)
+        let mut jobs = queue.get_jobs_with_form_origin(FfpClassification::MachineFilled)?;
+        jobs.extend(queue.get_jobs_with_form_origin(FfpClassification::MachineFilledSuspected)?);
+        jobs.sort_by(|a, b| b.created_at.cmp(&a.created_at));
+        Ok(jobs)
     }
 
     /// Cancel a job.

crates/presswerk-core/src/lib.rs

@@ -13,7 +13,7 @@ pub mod types;
 pub use config::AppConfig;
 pub use error::PresswerkError;
 pub use provenance::{
-    FfpAppearances, FfpClassification, FfpDeclared, FfpForm, FfpRecord, FormOrigin,
-    FormProvenance, ProvenanceConfidence,
+    FfpAppearances, FfpClassification, FfpDeclared, FfpForm, FfpRecord, FormOrigin, FormProvenance,
+    ProvenanceConfidence,
 };
 pub use types::*;

crates/presswerk-core/src/provenance.rs

@@ -146,12 +146,21 @@ pub struct FfpDeclared {
     pub tool_version: Option<String>,
     #[serde(rename = "filledAt", skip_serializing_if = "Option::is_none")]
     pub filled_at: Option<String>,
-    #[serde(rename = "appearancesGenerated", skip_serializing_if = "Option::is_none")]
+    #[serde(
+        rename = "appearancesGenerated",
+        skip_serializing_if = "Option::is_none"
+    )]
     pub appearances_generated: Option<bool>,
 }
 
 impl FfpDeclared {
-    pub fn machine(tool: Option<String>, tool_version: Option<String>, filled_at: Option<String>, appearances_generated: Option<bool>) -> Self {
+    /// Create a machine-filled declaration with optional tool and appearance metadata.
+    pub fn machine(
+        tool: Option<String>,
+        tool_version: Option<String>,
+        filled_at: Option<String>,
+        appearances_generated: Option<bool>,
+    ) -> Self {
         Self {
             filled_by: "machine".to_string(),
             tool,
@@ -248,7 +257,9 @@ impl FfpRecord {
     pub fn should_hold(&self, policy: crate::types::FormProvenancePolicy) -> bool {
         use crate::types::FormProvenancePolicy;
         match policy {
-            FormProvenancePolicy::HoldForReview => self.is_machine_or_suspected() || self.has_blank_print_hazard(),
+            FormProvenancePolicy::HoldForReview => {
+                self.is_machine_or_suspected() || self.has_blank_print_hazard()
+            }
             _ => false,
         }
     }
@@ -269,12 +280,21 @@ impl FfpRecord {
                     "machine-filled form".to_string()
                 }
             }
-            FfpClassification::MachineFilledSuspected => "machine-filled form (suspected — incomplete appearances)".to_string(),
-            FfpClassification::FilledUnknown => "form values present — provenance unknown".to_string(),
+            FfpClassification::MachineFilledSuspected => {
+                "machine-filled form (suspected — incomplete appearances)".to_string()
+            }
+            FfpClassification::FilledUnknown => {
+                "form values present — provenance unknown".to_string()
+            }
             FfpClassification::Unreadable => "form provenance unreadable".to_string(),
         };
         if self.is_form() {
-            format!("{head}; {}/{} fields filled; appearances {}", self.filled_fields, self.total_fields, self.appearances.as_str())
+            format!(
+                "{head}; {}/{} fields filled; appearances {}",
+                self.filled_fields,
+                self.total_fields,
+                self.appearances.as_str()
+            )
         } else {
             head
         }
@@ -324,7 +344,9 @@ impl FfpRecord {
             FfpClassification::NoForm => "NotAForm",
             FfpClassification::BlankForm => "Empty",
             FfpClassification::FilledUnknown => "Human",
-            FfpClassification::MachineFilled | FfpClassification::MachineFilledSuspected => "Machine",
+            FfpClassification::MachineFilled | FfpClassification::MachineFilledSuspected => {
+                "Machine"
+            }
             FfpClassification::Unreadable => "Unknown",
         }
     }
@@ -388,7 +410,9 @@ impl std::fmt::Display for FormOrigin {
     }
 }
 
-#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize, Default)]
+#[derive(
+    Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize, Default,
+)]
 pub enum ProvenanceConfidence {
     #[default]
     None,
@@ -459,6 +483,8 @@ pub type FormProvenance = FfpRecord;
 
 /// Convert legacy into new record (best-effort, for migration).
 impl From<FormProvenanceLegacy> for FfpRecord {
+    /// Migrate legacy provenance to FFP, mapping unmarked machine origins to suspected.
+    /// Preserve field counts and translate legacy signals into evidence codes.
     fn from(legacy: FormProvenanceLegacy) -> Self {
         // Map legacy origin → new classification
         let classification = match legacy.origin {
@@ -492,19 +518,25 @@ impl From<FormProvenanceLegacy> for FfpRecord {
         } else {
             FfpAppearances::Generated
         };
-        let declared = legacy.marker.map(|m| FfpDeclared {
-            filled_by: m,
-            tool: legacy.producer,
-            tool_version: None,
-            filled_at: None,
-            appearances_generated: None,
-        }).or_else(|| legacy.producer.map(|p| FfpDeclared {
-            filled_by: "machine".to_string(),
-            tool: Some(p),
-            tool_version: None,
-            filled_at: None,
-            appearances_generated: None,
-        }));
+        let declared = if let Some(m) = &legacy.marker {
+            Some(FfpDeclared {
+                filled_by: m.clone(),
+                tool: legacy.producer.clone(),
+                tool_version: None,
+                filled_at: None,
+                appearances_generated: None,
+            })
+        } else if let Some(p) = &legacy.producer {
+            Some(FfpDeclared {
+                filled_by: "machine".to_string(),
+                tool: Some(p.clone()),
+                tool_version: None,
+                filled_at: None,
+                appearances_generated: None,
+            })
+        } else {
+            None
+        };
         let mut evidence = Vec::new();
         if legacy.need_appearances {
             evidence.push("FFP-E-NEED-APPEARANCES".to_string());
@@ -515,7 +547,9 @@ impl From<FormProvenanceLegacy> for FfpRecord {
         match legacy.origin {
             FormOrigin::NotAForm => evidence.push("FFP-E-NO-ACROFORM".to_string()),
             FormOrigin::Empty => evidence.push("FFP-E-NO-VALUES".to_string()),
-            FormOrigin::Unknown if !legacy.inspected => evidence.push("FFP-E-UNREADABLE".to_string()),
+            FormOrigin::Unknown if !legacy.inspected => {
+                evidence.push("FFP-E-UNREADABLE".to_string())
+            }
             _ => {}
         }
         if legacy.marker.is_some() {
@@ -562,6 +596,7 @@ mod tests {
         }
     }
 
+    /// Verify the conformance line includes field counts and sorted evidence codes.
     #[test]
     fn canonical_line_format() {
         let r = FfpRecord {
@@ -572,7 +607,10 @@ mod tests {
             total_fields: 2,
             appearances: FfpAppearances::Incomplete,
             declared: None,
-            evidence: vec!["FFP-E-NEED-APPEARANCES".to_string(), "FFP-E-AP-INCOMPLETE".to_string()],
+            evidence: vec![
+                "FFP-E-NEED-APPEARANCES".to_string(),
+                "FFP-E-AP-INCOMPLETE".to_string(),
+            ],
         };
         assert_eq!(
             r.canonical_line(),
@@ -581,6 +619,7 @@ mod tests {
         // evidence is sorted
     }
 
+    /// Verify audit JSON preserves the complete record and its declared metadata.
     #[test]
     fn json_roundtrip() {
         let r = FfpRecord {
@@ -590,20 +629,31 @@ mod tests {
             filled_fields: 2,
             total_fields: 2,
             appearances: FfpAppearances::Incomplete,
-            declared: Some(FfpDeclared { filled_by: "machine".to_string(), tool: Some("blocky-writer".to_string()), tool_version: Some("0.2.0".to_string()), filled_at: None, appearances_generated: Some(false) }),
+            declared: Some(FfpDeclared {
+                filled_by: "machine".to_string(),
+                tool: Some("blocky-writer".to_string()),
+                tool_version: Some("0.2.0".to_string()),
+                filled_at: None,
+                appearances_generated: Some(false),
+            }),
             evidence: vec!["FFP-E-DECL-MACHINE".to_string()],
         };
         let json = r.audit_json();
         let back: FfpRecord = serde_json::from_str(&json).unwrap();
         assert_eq!(back, r);
     }
 
+    /// Verify unreadable records emit the canonical unknown-form representation.
     #[test]
     fn unreadable_line() {
         let r = FfpRecord::unreadable("parse failed");
-        assert_eq!(r.canonical_line(), "classification=unreadable form=unknown filled=0/0 appearances=unknown evidence=FFP-E-UNREADABLE");
+        assert_eq!(
+            r.canonical_line(),
+            "classification=unreadable form=unknown filled=0/0 appearances=unknown evidence=FFP-E-UNREADABLE"
+        );
     }
 
+    /// Verify review holds cover machine origins and incomplete filled appearances.
     #[test]
     fn should_hold() {
         use crate::types::FormProvenancePolicy;
@@ -614,7 +664,13 @@ mod tests {
             filled_fields: 2,
             total_fields: 2,
             appearances: FfpAppearances::Incomplete,
-            declared: Some(FfpDeclared { filled_by: "machine".to_string(), tool: None, tool_version: None, filled_at: None, appearances_generated: None }),
+            declared: Some(FfpDeclared {
+                filled_by: "machine".to_string(),
+                tool: None,
+                tool_version: None,
+                filled_at: None,
+                appearances_generated: None,
+            }),
             evidence: vec!["FFP-E-DECL-MACHINE".to_string()],
         };
         assert!(r.should_hold(FormProvenancePolicy::HoldForReview));