diff --git a/.forgejo/workflows/desktop.yml b/.forgejo/workflows/desktop.yml
index d43b869..ff5cd1f 100644
--- a/.forgejo/workflows/desktop.yml
+++ b/.forgejo/workflows/desktop.yml
@@ -77,13 +77,21 @@ jobs:
       # of silently re-resolving. Everything after it in this job then compiles the
       # exact versions recorded in the lockfile, so the flag isn't repeated on the
       # bundle build (issue 2102).
+      #
+      # Run from the REPO ROOT with --workspace, not from desktop/src-tauri.
+      #
+      # These three steps used to run inside the desktop crate, which was right when
+      # it was the only Rust in the repo. After the core was extracted (M12 step 1)
+      # it silently stopped being right: cargo scoped to the desktop PACKAGE, so the
+      # core's 89 tests stopped running and nothing lints the Android uniffi shim at
+      # all. Both crates are dependencies of the desktop, so they still COMPILED —
+      # which is exactly why the gap was invisible, and why a green run kept meaning
+      # less than it looked like it meant.
       - name: Clippy
-        run: cargo clippy --locked --all-targets -- -D warnings
-        working-directory: desktop/src-tauri
+        run: cargo clippy --locked --workspace --all-targets -- -D warnings
 
       - name: Test
-        run: cargo test --locked
-        working-directory: desktop/src-tauri
+        run: cargo test --locked --workspace
 
       # Deliberately AFTER clippy + test, not before.
       #
@@ -94,8 +102,7 @@ jobs:
       # means every push reports its real problems too. Still before the ~20-40 min
       # bundle build, so a fmt failure doesn't burn that.
       - name: Rust format check
-        run: cargo fmt --check
-        working-directory: desktop/src-tauri
+        run: cargo fmt --all --check
 
       # Frontend already built above; skip the beforeBuildCommand rebuild.
       #
diff --git a/ci-requirements.md b/ci-requirements.md
index a0e4e6b..317a07e 100644
--- a/ci-requirements.md
+++ b/ci-requirements.md
@@ -85,9 +85,17 @@ backend/frontend push.
   `container.image`; `runs-on: python-ci` is only a scheduling label.
 - **Steps:** build the shared frontend (embedded by `generate_context!`) →
   `cargo tauri icon app-icon.png` (platform icon set from the committed 1024px
-  source) → `cargo fmt --check` → `cargo clippy -D warnings` → `cargo test` →
-  `cargo tauri build` (produces `.deb` + `.AppImage`) → de-bundle the AppImage's
-  graphics libs → verify the `.deb` → repackage for pacman.
+  source) → `cargo clippy --workspace -D warnings` → `cargo test --workspace` →
+  `cargo fmt --all --check` → `cargo tauri build` (produces `.deb` + `.AppImage`)
+  → de-bundle the AppImage's graphics libs → verify the `.deb` → repackage for
+  pacman.
+- **The three analyzer steps run from the REPO ROOT with `--workspace`**, not
+  from `desktop/src-tauri`. Scoping them to the desktop package was correct while
+  it was the only Rust here; after the core was extracted it silently stopped
+  being — the core's 89 tests stopped running, and a fourth crate would not be
+  linted at all. The dependency crates still COMPILE either way, which is exactly
+  why the gap is invisible from a green run. If you add a workspace member, check
+  that it appears in the `cargo test` output before believing the lane covers it.
 - **`APPIMAGE_EXTRACT_AND_RUN=1`** is set: AppImage tooling FUSE-mounts by default
   and CI containers have no `/dev/fuse`.
 - **Packaging tools used from the image** (none installed at job time, rule 5):
@@ -223,9 +231,17 @@ above, and resolution is neither a test run nor a build:
 ```
 docker run --rm --user "$(id -u):$(id -g)" -e CARGO_HOME=/tmp/cargo \
   -v "$PWD:/w" -w /w \
-  git.fabledsword.com/bvandeusen/ci-tauri:1.97 cargo generate-lockfile
+  git.fabledsword.com/bvandeusen/ci-tauri:1.97 cargo fetch
 ```
 
+**`cargo fetch`, not `cargo generate-lockfile`.** Both update the lockfile, but
+generate-lockfile re-resolves the whole graph from scratch and will happily bump
+crates that have nothing to do with your change — turning a two-line manifest
+edit into a few-hundred-line lockfile diff nobody can review. `cargo fetch`
+performs the minimal resolution: existing pins are preserved, only the new
+entries are added. Verify it stayed additive before committing (`git diff
+Cargo.lock | grep '^-'` should show nothing but re-ordered dependency lists).
+
 Resolving inside the CI image rather than against some other cargo is what keeps
 the lockfile format and the picked versions identical to what CI would have
 chosen. Commit the result in the same change as the `Cargo.toml` edit — a