diff --git a/hive-c0re/src/matrix.rs b/hive-c0re/src/matrix.rs
index b2af5b27..156d50b6 100644
--- a/hive-c0re/src/matrix.rs
+++ b/hive-c0re/src/matrix.rs
@@ -1514,13 +1514,6 @@ async fn resolve_room_alias(
 /// [`crate::stats::sweep_health::SweepHealth`] to raise a debounced
 /// dashboard banner on persistent failure (this sweep re-runs every 30
 /// minutes, so a one-off blip self-heals without ever bannering).
-#[allow(
-    clippy::too_many_lines,
-    reason = "sequential provisioning sweep — admin user, per-agent user/token \
-              sync, space + chat-room membership — each step's failure handling \
-              (log + continue + flip `ok`) is inherent to the aggregate bool \
-              contract, not something to factor away just to hit a line count"
-)]
 pub async fn ensure_all() -> bool {
     if !is_present().await {
         tracing::debug!("matrix: hive-matrix container absent, skipping user sweep");
@@ -1566,7 +1559,19 @@ pub async fn ensure_all() -> bool {
         agent_names.push(name.to_owned());
     }
 
-    // Provision the hive Space and invite all agents (+ the admin account).
+    if !provision_space(&client, &agent_names).await {
+        ok = false;
+    }
+    ok
+}
+
+/// Provision the hive Space + default chat room and invite every agent
+/// (+ the admin account) to both. Split out of [`ensure_all`] purely to
+/// keep that function under the `too_many_lines` threshold — this is the
+/// tail half of the same sequential sweep and shares its aggregate-bool,
+/// log-and-continue failure handling.
+async fn provision_space(client: &reqwest::Client, agent_names: &[String]) -> bool {
+    let mut ok = true;
     // server_name is needed to form full Matrix user IDs for invites.
     let admin_token = match read_admin_token() {
         Ok(t) => t,
@@ -1576,14 +1581,14 @@ pub async fn ensure_all() -> bool {
         }
     };
     // server_name first — the agent invites need it (fully-qualified user ids).
-    let server_name = match discover_server_name(&client).await {
+    let server_name = match discover_server_name(client).await {
         Ok(s) => s,
         Err(e) => {
             tracing::warn!(error = ?e, "matrix: discover_server_name failed; skipping space provisioning");
             return false;
         }
     };
-    let room_id = match ensure_hive_space(&client, &admin_token).await {
+    let room_id = match ensure_hive_space(client, &admin_token).await {
         Ok(id) => id,
         Err(e) => {
             tracing::warn!(error = ?e, "matrix: ensure_hive_space failed");
@@ -1592,7 +1597,7 @@ pub async fn ensure_all() -> bool {
     };
     // Invite @hive admin first, then all agents.
     if let Err(e) = invite_to_room(
-        &client,
+        client,
         &admin_token,
         &room_id,
         HIVE_ADMIN_LOCALPART,
@@ -1603,8 +1608,8 @@ pub async fn ensure_all() -> bool {
         tracing::warn!(error = ?e, "matrix: invite @hive to space failed");
         ok = false;
     }
-    for name in &agent_names {
-        if let Err(e) = invite_to_room(&client, &admin_token, &room_id, name, &server_name).await {
+    for name in agent_names {
+        if let Err(e) = invite_to_room(client, &admin_token, &room_id, name, &server_name).await {
             tracing::warn!(%name, error = ?e, "matrix: invite agent to space failed");
             ok = false;
         }
@@ -1615,10 +1620,10 @@ pub async fn ensure_all() -> bool {
     // rooms to chat in (Matrix semantics — children aren't auto-joined), so
     // without this the Space is empty. The restricted join rule additionally
     // lets the operator (a Space member) join from the Space hierarchy.
-    match ensure_hive_chat_room(&client, &admin_token, &room_id, &server_name).await {
+    match ensure_hive_chat_room(client, &admin_token, &room_id, &server_name).await {
         Ok(chat_room_id) => {
             if let Err(e) = invite_to_room(
-                &client,
+                client,
                 &admin_token,
                 &chat_room_id,
                 HIVE_ADMIN_LOCALPART,
@@ -1629,9 +1634,9 @@ pub async fn ensure_all() -> bool {
                 tracing::warn!(error = ?e, "matrix: invite @hive to chat room failed");
                 ok = false;
             }
-            for name in &agent_names {
+            for name in agent_names {
                 if let Err(e) =
-                    invite_to_room(&client, &admin_token, &chat_room_id, name, &server_name).await
+                    invite_to_room(client, &admin_token, &chat_room_id, name, &server_name).await
                 {
                     tracing::warn!(%name, error = ?e, "matrix: invite agent to chat room failed");
                     ok = false;