8 files changed, 179 insertions, 89 deletions

diff --git a/docs/how-to/production-sync-testing.md b/docs/archive/2026-01-relay-ngit-dev-migration/production-sync-testing.md
index 3a273a7..3a273a7 100644
--- a/docs/how-to/production-sync-testing.md
+++ b/docs/archive/2026-01-relay-ngit-dev-migration/production-sync-testing.md
diff --git a/src/config.rs b/src/config.rs
index df7a7ef..dd7b1e3 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -109,22 +109,25 @@ impl WhitelistEntry {
 }
 
 /// GRASP-05 Archive mode configuration
-#[derive(Debug, Clone, Serialize, Deserialize)]
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
 pub struct ArchiveConfig {
     /// Accept all repository announcements (no filtering)
     ///
     /// WARNING: Setting this to true allows anyone to mirror any repository
     /// to this relay, potentially causing storage/bandwidth exhaustion.
+    #[serde(default)]
     pub archive_all: bool,
 
     /// Whitelist entries for selective archiving
     ///
     /// If empty and archive_all is false, GRASP-05 is disabled (GRASP-01 strict mode).
+    #[serde(default)]
     pub whitelist: Vec<WhitelistEntry>,
 
     /// GRASP server domains to archive (archive all repositories from these domains)
     ///
     /// If non-empty, archives all repositories from the specified GRASP server domains.
+    #[serde(default)]
     pub grasp_services: Vec<String>,
 
     /// Read-only archive mode: relay is a read-only sync of archived repositories
@@ -132,6 +135,7 @@ pub struct ArchiveConfig {
     /// When true, the relay ONLY accepts announcements matching the archive whitelist/all.
     /// Announcements listing the relay but not in the whitelist are rejected.
     /// When false, the relay operates in GRASP-01 mode for unwhitelisted repos.
+    #[serde(default)]
     pub read_only: bool,
 }
 
@@ -146,6 +150,7 @@ impl ArchiveConfig {
     /// Returns true if:
     /// - archive_all is true, OR
     /// - announcement matches any whitelist entry
+    ///
     /// Note: grasp_services matching is handled via matches_grasp_services()
     pub fn matches(&self, npub: &str, identifier: &str) -> bool {
         if self.archive_all {
@@ -171,23 +176,13 @@ impl ArchiveConfig {
     }
 }
 
-impl Default for ArchiveConfig {
-    fn default() -> Self {
-        Self {
-            archive_all: false,
-            whitelist: Vec::new(),
-            grasp_services: Vec::new(),
-            read_only: false,
-        }
-    }
-}
-
 /// Repository whitelist configuration
-#[derive(Debug, Clone, Serialize, Deserialize)]
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
 pub struct RepositoryConfig {
     /// Whitelist entries for selective repository acceptance
     ///
     /// If empty, all repositories listing the service are accepted (GRASP-01 mode).
+    #[serde(default)]
     pub whitelist: Vec<WhitelistEntry>,
 }
 
@@ -207,21 +202,14 @@ impl RepositoryConfig {
     }
 }
 
-impl Default for RepositoryConfig {
-    fn default() -> Self {
-        Self {
-            whitelist: Vec::new(),
-        }
-    }
-}
-
 /// Repository blacklist configuration
-#[derive(Debug, Clone, Serialize, Deserialize)]
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
 pub struct BlacklistConfig {
     /// Blacklist entries for blocking specific repositories
     ///
     /// If empty, no repositories are blacklisted.
     /// Blacklist takes precedence over both archive and repository whitelists.
+    #[serde(default)]
     pub blacklist: Vec<WhitelistEntry>,
 }
 
@@ -256,21 +244,14 @@ impl BlacklistConfig {
     }
 }
 
-impl Default for BlacklistConfig {
-    fn default() -> Self {
-        Self {
-            blacklist: Vec::new(),
-        }
-    }
-}
-
 /// Event blacklist configuration for blocking events by author npub
-#[derive(Debug, Clone, Serialize, Deserialize)]
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
 pub struct EventBlacklistConfig {
     /// Blacklisted npubs - events from these authors are rejected
     ///
     /// If empty, no events are blacklisted by author.
     /// Applies to ALL event types, preventing events from reaching both the relay and purgatory.
+    #[serde(default)]
     pub blacklisted_npubs: Vec<String>,
 }
 
@@ -292,14 +273,6 @@ impl EventBlacklistConfig {
     }
 }
 
-impl Default for EventBlacklistConfig {
-    fn default() -> Self {
-        Self {
-            blacklisted_npubs: Vec::new(),
-        }
-    }
-}
-
 /// Database backend type for the relay
 #[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq, Default, ValueEnum)]
 #[serde(rename_all = "lowercase")]
@@ -1108,14 +1081,14 @@ mod tests {
     fn test_archive_read_only_defaults() {
         // Default: false when no archive mode
         let config = Config::for_testing();
-        assert_eq!(config.archive_config().read_only, false);
+        assert!(!config.archive_config().read_only);
 
         // Default: true when archive_all is set
         let config = Config {
             archive_all: true,
             ..Config::for_testing()
         };
-        assert_eq!(config.archive_config().read_only, true);
+        assert!(config.archive_config().read_only);
 
         // Default: true when archive_whitelist is set
         let keys = Keys::generate();
@@ -1124,7 +1097,7 @@ mod tests {
             archive_whitelist: test_npub,
             ..Config::for_testing()
         };
-        assert_eq!(config.archive_config().read_only, true);
+        assert!(config.archive_config().read_only);
     }
 
     #[test]
@@ -1135,7 +1108,7 @@ mod tests {
             archive_read_only: Some(true),
             ..Config::for_testing()
         };
-        assert_eq!(config.archive_config().read_only, true);
+        assert!(config.archive_config().read_only);
 
         // Explicit false with archive_all (unusual but allowed)
         let config = Config {
@@ -1143,14 +1116,14 @@ mod tests {
             archive_read_only: Some(false),
             ..Config::for_testing()
         };
-        assert_eq!(config.archive_config().read_only, false);
+        assert!(!config.archive_config().read_only);
 
         // Explicit false without archive mode
         let config = Config {
             archive_read_only: Some(false),
             ..Config::for_testing()
         };
-        assert_eq!(config.archive_config().read_only, false);
+        assert!(!config.archive_config().read_only);
     }
 
     #[test]
@@ -1553,7 +1526,7 @@ mod tests {
         };
         let archive_config = config.archive_config();
         assert!(archive_config.enabled());
-        assert_eq!(archive_config.read_only, true); // Default to true
+        assert!(archive_config.read_only); // Default to true
     }
 
     #[test]
@@ -1563,7 +1536,7 @@ mod tests {
             archive_grasp_services: "git.example.com".to_string(),
             ..Config::for_testing()
         };
-        assert_eq!(config.archive_config().read_only, true);
+        assert!(config.archive_config().read_only);
     }
 
     #[test]
@@ -1574,7 +1547,7 @@ mod tests {
             archive_read_only: Some(false),
             ..Config::for_testing()
         };
-        assert_eq!(config.archive_config().read_only, false);
+        assert!(!config.archive_config().read_only);
     }
 
     #[test]
diff --git a/src/nostr/builder.rs b/src/nostr/builder.rs
index 9211972..3baa2ff 100644
--- a/src/nostr/builder.rs
+++ b/src/nostr/builder.rs
@@ -185,7 +185,10 @@ impl Nip34WritePolicy {
                         WritePolicyResult::Accept
                     }
                     Err(e) => {
-                        let npub = event.pubkey.to_bech32().unwrap_or_else(|_| event.pubkey.to_hex());
+                        let npub = event
+                            .pubkey
+                            .to_bech32()
+                            .unwrap_or_else(|_| event.pubkey.to_hex());
                         let event_id_short = &event.id.to_hex()[..12];
                         // Try to extract repo identifier from 'd' tag even if parsing failed
                         let repo = Self::extract_identifier_from_event(event);
@@ -221,7 +224,10 @@ impl Nip34WritePolicy {
                         WritePolicyResult::Accept
                     }
                     Err(e) => {
-                        let npub = event.pubkey.to_bech32().unwrap_or_else(|_| event.pubkey.to_hex());
+                        let npub = event
+                            .pubkey
+                            .to_bech32()
+                            .unwrap_or_else(|_| event.pubkey.to_hex());
                         let event_id_short = &event.id.to_hex()[..12];
                         // Try to extract repo identifier from 'd' tag even if parsing failed
                         let repo = Self::extract_identifier_from_event(event);
@@ -265,7 +271,10 @@ impl Nip34WritePolicy {
                 {
                     Ok(poilicy_result) => poilicy_result,
                     Err(e) => {
-                        let npub = event.pubkey.to_bech32().unwrap_or_else(|_| event.pubkey.to_hex());
+                        let npub = event
+                            .pubkey
+                            .to_bech32()
+                            .unwrap_or_else(|_| event.pubkey.to_hex());
                         let event_id_short = &event.id.to_hex()[..12];
                         // Try to extract repo identifier from 'd' tag even if parsing failed
                         let repo = Self::extract_identifier_from_event(event);
@@ -287,7 +296,10 @@ impl Nip34WritePolicy {
                 }
             }
             StateResult::Reject(reason) => {
-                let npub = event.pubkey.to_bech32().unwrap_or_else(|_| event.pubkey.to_hex());
+                let npub = event
+                    .pubkey
+                    .to_bech32()
+                    .unwrap_or_else(|_| event.pubkey.to_hex());
                 let event_id_short = &event.id.to_hex()[..12];
                 // Try to extract repo identifier from 'd' tag even if parsing failed
                 let repo = Self::extract_identifier_from_event(event);
@@ -397,9 +409,12 @@ impl Nip34WritePolicy {
                 );
 
                 // Add to purgatory
-                self.ctx
-                    .purgatory
-                    .add_pr(event.clone(), event.id.to_hex(), commit.clone(), is_synced);
+                self.ctx.purgatory.add_pr(
+                    event.clone(),
+                    event.id.to_hex(),
+                    commit.clone(),
+                    is_synced,
+                );
 
                 WritePolicyResult::Reject {
                     status: true, // Client sees OK
@@ -417,7 +432,10 @@ impl Nip34WritePolicy {
             }
             Err(e) => {
                 // Error checking git data - reject event
-                let npub = event.pubkey.to_bech32().unwrap_or_else(|_| event.pubkey.to_hex());
+                let npub = event
+                    .pubkey
+                    .to_bech32()
+                    .unwrap_or_else(|_| event.pubkey.to_hex());
                 let event_id_short = &event.id.to_hex()[..12];
                 // Extract ALL repo identifiers from 'a' tags for PR events
                 // (PR events can reference multiple repos when there are multiple maintainers)
diff --git a/src/nostr/events.rs b/src/nostr/events.rs
index 718633e..a441742 100644
--- a/src/nostr/events.rs
+++ b/src/nostr/events.rs
@@ -419,14 +419,14 @@ pub fn validate_announcement(
     // GRASP-01: Normal mode - accept if announcement lists our service AND matches repository whitelist (if enabled)
     if lists_service && !archive_config.read_only {
         // Check repository whitelist if enabled
-        if repository_config.enabled() {
-            if !repository_config.matches(&npub, &announcement.identifier) {
-                return AnnouncementResult::Reject(format!(
-                    "Announcement lists service but does not match repository whitelist. \
-                     Repository {}/{} not in whitelist",
-                    npub, announcement.identifier
-                ));
-            }
+        if repository_config.enabled()
+            && !repository_config.matches(&npub, &announcement.identifier)
+        {
+            return AnnouncementResult::Reject(format!(
+                "Announcement lists service but does not match repository whitelist. \
+                 Repository {}/{} not in whitelist",
+                npub, announcement.identifier
+            ));
         }
         return AnnouncementResult::Accept;
     }
diff --git a/src/nostr/policy/state.rs b/src/nostr/policy/state.rs
index 52f0483..3411077 100644
--- a/src/nostr/policy/state.rs
+++ b/src/nostr/policy/state.rs
@@ -205,9 +205,12 @@ impl StatePolicy {
 
             // If no git data - add to purgatory
             // (add_state automatically enqueues for background sync)
-            self.ctx
-                .purgatory
-                .add_state(event.clone(), state.identifier.clone(), event.pubkey, is_synced);
+            self.ctx.purgatory.add_state(
+                event.clone(),
+                state.identifier.clone(),
+                event.pubkey,
+                is_synced,
+            );
 
             tracing::info!(
                 "state event added to purgatory: eventid: {}, identifier: {}",
diff --git a/src/purgatory/mod.rs b/src/purgatory/mod.rs
index d442ad8..8094450 100644
--- a/src/purgatory/mod.rs
+++ b/src/purgatory/mod.rs
@@ -740,7 +740,10 @@ impl Purgatory {
         for (event_id_str, event_opt, commit, source) in expired_prs {
             // Log structured entry for PR events (not placeholders)
             if let Some(ref event) = event_opt {
-                let npub = event.pubkey.to_bech32().unwrap_or_else(|_| event.pubkey.to_hex());
+                let npub = event
+                    .pubkey
+                    .to_bech32()
+                    .unwrap_or_else(|_| event.pubkey.to_hex());
                 let event_id_short = &event.id.to_hex()[..12];
                 let source_str = if source.is_direct() { "direct" } else { "sync" };
 
@@ -751,7 +754,10 @@ impl Purgatory {
                     .iter()
                     .filter_map(|tag| {
                         let tag_vec = tag.clone().to_vec();
-                        if tag_vec.len() >= 2 && tag_vec[0] == "a" && tag_vec[1].starts_with("30617:") {
+                        if tag_vec.len() >= 2
+                            && tag_vec[0] == "a"
+                            && tag_vec[1].starts_with("30617:")
+                        {
                             // Format: 30617:<owner_pubkey>:<identifier>
                             let parts: Vec<&str> = tag_vec[1].split(':').collect();
                             if parts.len() >= 3 {
@@ -1171,8 +1177,18 @@ mod tests {
             .sign_with_keys(&keys)
             .unwrap();
 
-        purgatory.add_state(event.clone(), "test-repo".to_string(), keys.public_key(), false);
-        purgatory.add_pr(event, "test-event-id".to_string(), "abc123".to_string(), false);
+        purgatory.add_state(
+            event.clone(),
+            "test-repo".to_string(),
+            keys.public_key(),
+            false,
+        );
+        purgatory.add_pr(
+            event,
+            "test-event-id".to_string(),
+            "abc123".to_string(),
+            false,
+        );
 
         let (state_count, pr_count) = purgatory.count();
         assert_eq!(state_count, 1);
@@ -1253,7 +1269,12 @@ mod tests {
             .sign_with_keys(&keys)
             .unwrap();
 
-        purgatory.add_pr(event, "pr-event-id".to_string(), "commit123".to_string(), false);
+        purgatory.add_pr(
+            event,
+            "pr-event-id".to_string(),
+            "commit123".to_string(),
+            false,
+        );
 
         // Now should have pending events for test-repo
         assert!(purgatory.has_pending_events("test-repo"));
@@ -1377,7 +1398,12 @@ fn test_cleanup_removes_expired_entries() {
         keys.public_key(),
         false,
     );
-    purgatory.add_pr(pr_event, "pr-123".to_string(), "commit-abc".to_string(), false);
+    purgatory.add_pr(
+        pr_event,
+        "pr-123".to_string(),
+        "commit-abc".to_string(),
+        false,
+    );
     purgatory.add_pr_placeholder("pr-456".to_string(), "commit-def".to_string());
 
     // Verify entries are there
@@ -1424,8 +1450,18 @@ fn test_cleanup_preserves_non_expired_entries() {
         .unwrap();
 
     // Add fresh entries
-    purgatory.add_state(state_event, "test-repo".to_string(), keys.public_key(), false);
-    purgatory.add_pr(pr_event, "pr-123".to_string(), "commit-abc".to_string(), false);
+    purgatory.add_state(
+        state_event,
+        "test-repo".to_string(),
+        keys.public_key(),
+        false,
+    );
+    purgatory.add_pr(
+        pr_event,
+        "pr-123".to_string(),
+        "commit-abc".to_string(),
+        false,
+    );
 
     // Run cleanup
     let (state_removed, pr_removed) = purgatory.cleanup();
@@ -1757,8 +1793,18 @@ async fn test_save_and_restore_state_events() {
     let event1_id = event1.id;
     let event2_id = event2.id;
 
-    purgatory.add_state(event1.clone(), "test-repo".to_string(), keys.public_key(), false);
-    purgatory.add_state(event2.clone(), "test-repo".to_string(), keys.public_key(), false);
+    purgatory.add_state(
+        event1.clone(),
+        "test-repo".to_string(),
+        keys.public_key(),
+        false,
+    );
+    purgatory.add_state(
+        event2.clone(),
+        "test-repo".to_string(),
+        keys.public_key(),
+        false,
+    );
 
     // Save to disk
     purgatory.save_to_disk(&state_file).unwrap();
@@ -2283,8 +2329,18 @@ async fn test_comprehensive_roundtrip() {
         .sign_with_keys(&keys2)
         .unwrap();
 
-    purgatory.add_state(state1.clone(), "repo1".to_string(), keys1.public_key(), false);
-    purgatory.add_state(state2.clone(), "repo2".to_string(), keys2.public_key(), false);
+    purgatory.add_state(
+        state1.clone(),
+        "repo1".to_string(),
+        keys1.public_key(),
+        false,
+    );
+    purgatory.add_state(
+        state2.clone(),
+        "repo2".to_string(),
+        keys2.public_key(),
+        false,
+    );
 
     // Add PR event
     let tags = vec![Tag::custom(
@@ -2295,7 +2351,12 @@ async fn test_comprehensive_roundtrip() {
         .tags(tags)
         .sign_with_keys(&keys1)
         .unwrap();
-    purgatory.add_pr(pr_event.clone(), "pr-1".to_string(), "commit-1".to_string(), false);
+    purgatory.add_pr(
+        pr_event.clone(),
+        "pr-1".to_string(),
+        "commit-1".to_string(),
+        false,
+    );
 
     // Add PR placeholder
     purgatory.add_pr_placeholder("pr-2".to_string(), "commit-2".to_string());
@@ -2305,7 +2366,12 @@ async fn test_comprehensive_roundtrip() {
         .sign_with_keys(&keys1)
         .unwrap();
     let expired_id = expired_event.id;
-    purgatory.add_state(expired_event, "repo3".to_string(), keys1.public_key(), false);
+    purgatory.add_state(
+        expired_event,
+        "repo3".to_string(),
+        keys1.public_key(),
+        false,
+    );
     if let Some(mut entries) = purgatory.state_events.get_mut("repo3") {
         for entry in entries.iter_mut() {
             entry.expires_at = Instant::now() - Duration::from_secs(1);
diff --git a/src/sync/mod.rs b/src/sync/mod.rs
index a0dfa59..d6634ff 100644
--- a/src/sync/mod.rs
+++ b/src/sync/mod.rs
@@ -584,6 +584,7 @@ impl SyncManager {
     /// * `config` - Configuration for sync settings
     /// * `data_path` - Path to git data directory (for persistence)
     /// * `sync_metrics` - Optional pre-registered SyncMetrics (passed from Metrics if metrics are enabled)
+    #[allow(clippy::too_many_arguments)]
     pub fn new(
         bootstrap_relay_url: Option<String>,
         service_domain: String,
diff --git a/tests/purgatory_persistence.rs b/tests/purgatory_persistence.rs
index fe37c33..4dc5e94 100644
--- a/tests/purgatory_persistence.rs
+++ b/tests/purgatory_persistence.rs
@@ -94,11 +94,13 @@ async fn test_full_purgatory_save_restore_cycle() {
         state_event1.clone(),
         "repo1".to_string(),
         keys1.public_key(),
+        false,
     );
     purgatory.add_state(
         state_event2.clone(),
         "repo2".to_string(),
         keys2.public_key(),
+        false,
     );
 
     // Add PR events to purgatory
@@ -106,11 +108,13 @@ async fn test_full_purgatory_save_restore_cycle() {
         pr_event1.clone(),
         pr_event1.id.to_hex(),
         "commit-abc".to_string(),
+        false,
     );
     purgatory.add_pr(
         pr_event2.clone(),
         pr_event2.id.to_hex(),
         "commit-def".to_string(),
+        false,
     );
 
     // Add a PR placeholder (git-data-first scenario)
@@ -262,7 +266,12 @@ async fn test_purgatory_downtime_adjustment() {
 
     let state_event = create_state_event_with_refs(&keys, "repo1", &[("main", "abc123")]).unwrap();
 
-    purgatory.add_state(state_event.clone(), "repo1".to_string(), keys.public_key());
+    purgatory.add_state(
+        state_event.clone(),
+        "repo1".to_string(),
+        keys.public_key(),
+        false,
+    );
 
     // Save to disk
     purgatory.save_to_disk(&state_path).unwrap();
@@ -340,7 +349,7 @@ async fn test_purgatory_file_cleanup_after_restore() {
 
     let state_event = create_state_event_with_refs(&keys, "repo1", &[("main", "abc123")]).unwrap();
 
-    purgatory.add_state(state_event, "repo1".to_string(), keys.public_key());
+    purgatory.add_state(state_event, "repo1".to_string(), keys.public_key(), false);
 
     // Save to disk
     purgatory.save_to_disk(&state_path).unwrap();
@@ -408,7 +417,7 @@ async fn test_purgatory_restore_missing_file() {
     // Should be able to add events normally
     let keys = Keys::generate();
     let event = create_test_event(&keys, "test").await;
-    purgatory.add_state(event, "repo1".to_string(), keys.public_key());
+    purgatory.add_state(event, "repo1".to_string(), keys.public_key(), false);
 
     let (state_count, _) = purgatory.count();
     assert_eq!(state_count, 1);
@@ -547,8 +556,18 @@ async fn test_purgatory_multiple_state_events_same_identifier() {
     let event1 = create_state_event_with_refs(&keys1, "repo1", &[("main", "abc123")]).unwrap();
     let event2 = create_state_event_with_refs(&keys2, "repo1", &[("main", "def456")]).unwrap();
 
-    purgatory.add_state(event1.clone(), "repo1".to_string(), keys1.public_key());
-    purgatory.add_state(event2.clone(), "repo1".to_string(), keys2.public_key());
+    purgatory.add_state(
+        event1.clone(),
+        "repo1".to_string(),
+        keys1.public_key(),
+        false,
+    );
+    purgatory.add_state(
+        event2.clone(),
+        "repo1".to_string(),
+        keys2.public_key(),
+        false,
+    );
 
     // Save and restore
     purgatory.save_to_disk(&state_path).unwrap();
@@ -577,7 +596,12 @@ async fn test_purgatory_continues_working_after_restore() {
 
     let event1 = create_state_event_with_refs(&keys, "repo1", &[("main", "abc123")]).unwrap();
 
-    purgatory.add_state(event1.clone(), "repo1".to_string(), keys.public_key());
+    purgatory.add_state(
+        event1.clone(),
+        "repo1".to_string(),
+        keys.public_key(),
+        false,
+    );
 
     // Save and restore
     purgatory.save_to_disk(&state_path).unwrap();
@@ -588,7 +612,12 @@ async fn test_purgatory_continues_working_after_restore() {
     // Add new events after restore
     let event2 = create_state_event_with_refs(&keys, "repo2", &[("main", "xyz789")]).unwrap();
 
-    purgatory2.add_state(event2.clone(), "repo2".to_string(), keys.public_key());
+    purgatory2.add_state(
+        event2.clone(),
+        "repo2".to_string(),
+        keys.public_key(),
+        false,
+    );
 
     // Verify both old and new events work
     let (state_count, _) = purgatory2.count();
@@ -669,7 +698,7 @@ async fn test_purgatory_entries_expired_during_downtime() {
 
     let event = create_state_event_with_refs(&keys, "repo1", &[("main", "abc123")]).unwrap();
 
-    purgatory.add_state(event.clone(), "repo1".to_string(), keys.public_key());
+    purgatory.add_state(event.clone(), "repo1".to_string(), keys.public_key(), false);
 
     // Save to disk
     purgatory.save_to_disk(&state_path).unwrap();