diff --git a/hive-c0re/src/forge/ci_runner.rs b/hive-c0re/src/forge/ci_runner.rs
index a58f38de..0e08eeda 100644
--- a/hive-c0re/src/forge/ci_runner.rs
+++ b/hive-c0re/src/forge/ci_runner.rs
@@ -25,7 +25,8 @@ const RUNNER_FILE: &str = "/var/lib/nixos-containers/hive-ci/var/lib/gitea-runne
 /// `services.hyperhive.forge.ci.enable` is on; absent means CI is off and
 /// there is no hive-ci container to register a runner for.
 fn ci_enabled() -> bool {
-    std::env::var("HYPERHIVE_FORGE_CI_ENABLED").is_ok_and(|v| v == "1" || v.eq_ignore_ascii_case("true"))
+    std::env::var("HYPERHIVE_FORGE_CI_ENABLED")
+        .is_ok_and(|v| v == "1" || v.eq_ignore_ascii_case("true"))
 }
 
 /// Ensure the hive-ci runner is registered against the forge. Best-effort:
diff --git a/hive-c0re/src/priv_client.rs b/hive-c0re/src/priv_client.rs
index 8dcfb441..c0b40ccc 100644
--- a/hive-c0re/src/priv_client.rs
+++ b/hive-c0re/src/priv_client.rs
@@ -327,6 +327,11 @@ pub async fn restart_matrix_daemon(agent_name: &str) -> Result<()> {
 /// `/run/hive-ci/runner-token` env-file and restarts the in-container runner.
 /// The forge admin token stays in hive-c0re; only the registration token
 /// crosses to the (host-path) env-file the container bind-mounts read-only.
+///
+/// # Errors
+/// Propagates the hive-priv call failure: the socket / IPC error, or the
+/// root-side error when the token is rejected (empty or control characters),
+/// the env-file write fails, or the runner restart exits non-zero.
 pub async fn register_ci_runner(token: &str) -> Result<()> {
     ok(call(&PrivRequest::RegisterCiRunner {
         token: token.to_owned(),