diff --git a/.repository-projection.json b/.repository-projection.json
index 64f81d1..ad87d00 100644
--- a/.repository-projection.json
+++ b/.repository-projection.json
@@ -3,11 +3,11 @@
   "projection": "capobara",
   "projectionSchemaVersion": 1,
   "sourceRepository": "dx-corp/mono",
-  "sourceSha": "9a003786d7679e9029fa077557bc7ab4d00eb48f",
+  "sourceSha": "511bd2305f5a92cfbedb91208d7bc0820fda29b5",
   "destinationRepository": "dx-corp/capobara",
-  "priorProjectedBase": "21c9a0d4eb3d6d01bb19b44b6ad019026271ad43",
+  "priorProjectedBase": "01e475cef45ab0d58e52c9c54ece7ff6cff35d03",
   "definitionDigest": "7826c75cbd356dad6c867f2606ebde8b79ef4361353908cf33ada720034ec488",
-  "toolDigest": "8a4412f3a379ca0bd1cfea9bff69cc46773c6d1f",
-  "contentDigest": "1777077598eefc1c640e427b21a039aae8e35277fcee017ed834e3b7690d9da8",
+  "toolDigest": "e9fc82741fdf4a797b076d29d51e14aced32368b",
+  "contentDigest": "6966b9fe44e8b9c45addee6ee807e2fd03993de04f3763fe6b7f3d319db00f8b",
   "publicationEligible": true
 }
diff --git a/build.rs b/build.rs
index 91a3ca3..bec531b 100644
--- a/build.rs
+++ b/build.rs
@@ -32,11 +32,11 @@
 //!    CAPOBARA_TREE_ID".
 use std::process::Command;
 
-#[allow(
-    clippy::disallowed_methods,
-    reason = "build script queries git for the crate tree id"
-)]
 fn git(dir: &str, args: &[&str]) -> Option<String> {
+    #[allow(
+        clippy::disallowed_methods,
+        reason = "build script queries git for the crate tree id"
+    )]
     let output = Command::new("git")
         .arg("-C")
         .arg(dir)
diff --git a/src/git.rs b/src/git.rs
index 9aa2ed3..b16e195 100644
--- a/src/git.rs
+++ b/src/git.rs
@@ -5,11 +5,11 @@ use crate::{Error, Result};
 
 /// The reviewed process boundary for git: every other module reaches git
 /// only through this function (or the helpers below that call it).
-#[allow(
-    clippy::disallowed_methods,
-    reason = "git is the reviewed process boundary for capobara"
-)]
 fn run(root: &Path, args: &[&str]) -> Result<std::process::Output> {
+    #[allow(
+        clippy::disallowed_methods,
+        reason = "git is the reviewed process boundary for capobara"
+    )]
     Command::new("git")
         .arg("-C")
         .arg(root)
diff --git a/src/snapshot.rs b/src/snapshot.rs
index 0d11bb6..fb648df 100644
--- a/src/snapshot.rs
+++ b/src/snapshot.rs
@@ -89,11 +89,11 @@ pub fn with_snapshot<T>(
 /// closed its stdin, producing a broken pipe on our write). A write error
 /// is remembered rather than propagated immediately, so the child is
 /// always reaped and a broken pipe never shadows `tar`'s real diagnostic.
-#[allow(
-    clippy::disallowed_methods,
-    reason = "tar extraction of a git archive is a reviewed process boundary"
-)]
 fn extract_tar(archive: &[u8], dest: &Path) -> Result<()> {
+    #[allow(
+        clippy::disallowed_methods,
+        reason = "tar extraction of a git archive is a reviewed process boundary"
+    )]
     let mut tar = Command::new("tar")
         .args(["-xf", "-", "-C"])
         .arg(dest)
diff --git a/tests/catalog.rs b/tests/catalog.rs
index 1d418e1..509cfba 100644
--- a/tests/catalog.rs
+++ b/tests/catalog.rs
@@ -151,11 +151,11 @@ fn coupled_projections_share_one_source_revision_and_require_every_member_presen
     assert_eq!(err.to_string(), "Missing coupled projection: deixic-node");
 }
 
-#[allow(
-    clippy::disallowed_methods,
-    reason = "integration test executes the capobara binary"
-)]
 fn capobara() -> std::process::Command {
+    #[allow(
+        clippy::disallowed_methods,
+        reason = "integration test executes the capobara binary"
+    )]
     std::process::Command::new(env!("CARGO_BIN_EXE_capobara"))
 }
 
diff --git a/tests/project_cli.rs b/tests/project_cli.rs
index ea168dd..0478abe 100644
--- a/tests/project_cli.rs
+++ b/tests/project_cli.rs
@@ -2,11 +2,11 @@ mod support;
 use std::process::Command;
 use support::Repo;
 
-#[allow(
-    clippy::disallowed_methods,
-    reason = "integration test executes the capobara binary"
-)]
 fn capobara() -> Command {
+    #[allow(
+        clippy::disallowed_methods,
+        reason = "integration test executes the capobara binary"
+    )]
     Command::new(env!("CARGO_BIN_EXE_capobara"))
 }
 
diff --git a/tests/run_cli.rs b/tests/run_cli.rs
index 3bbf25f..23ac08b 100644
--- a/tests/run_cli.rs
+++ b/tests/run_cli.rs
@@ -120,19 +120,19 @@ fn write_recording(dir: &Path, calls: Vec<Value>) -> PathBuf {
     path
 }
 
-#[allow(
-    clippy::disallowed_methods,
-    reason = "integration test executes the capobara binary"
-)]
 fn capobara() -> Command {
+    #[allow(
+        clippy::disallowed_methods,
+        reason = "integration test executes the capobara binary"
+    )]
     Command::new(env!("CARGO_BIN_EXE_capobara"))
 }
 
-#[allow(
-    clippy::disallowed_methods,
-    reason = "integration tests drive scratch git repositories outside the support::Repo helper"
-)]
 fn run_git(path: &Path, args: &[&str]) -> String {
+    #[allow(
+        clippy::disallowed_methods,
+        reason = "integration tests drive scratch git repositories outside the support::Repo helper"
+    )]
     let out = Command::new("git")
         .arg("-C")
         .arg(path)
@@ -147,11 +147,11 @@ fn run_git(path: &Path, args: &[&str]) -> String {
     String::from_utf8(out.stdout).unwrap()
 }
 
-#[allow(
-    clippy::disallowed_methods,
-    reason = "integration test inspects a scratch bare git repository's refs"
-)]
 fn ref_sha(path: &Path, refname: &str) -> Option<String> {
+    #[allow(
+        clippy::disallowed_methods,
+        reason = "integration test inspects a scratch bare git repository's refs"
+    )]
     Command::new("git")
         .arg("-C")
         .arg(path)
diff --git a/tests/sdk_assembly.rs b/tests/sdk_assembly.rs
index 8f6c767..db732cd 100644
--- a/tests/sdk_assembly.rs
+++ b/tests/sdk_assembly.rs
@@ -426,11 +426,11 @@ fn deixic_python_definition_loads_against_the_real_sdk_assembly_policy() {
 // in the `sdk-assembly-v1` branch of `build_projection`.
 // ---------------------------------------------------------------------
 
-#[allow(
-    clippy::disallowed_methods,
-    reason = "integration test executes the capobara binary"
-)]
 fn capobara() -> Command {
+    #[allow(
+        clippy::disallowed_methods,
+        reason = "integration test executes the capobara binary"
+    )]
     Command::new(env!("CARGO_BIN_EXE_capobara"))
 }
 
diff --git a/tests/support/mod.rs b/tests/support/mod.rs
index 4cd561d..6171c4a 100644
--- a/tests/support/mod.rs
+++ b/tests/support/mod.rs
@@ -20,11 +20,11 @@ impl Repo {
     pub fn path(&self) -> &Path {
         self.dir.path()
     }
-    #[allow(
-        clippy::disallowed_methods,
-        reason = "integration tests drive a scratch git repository"
-    )]
     pub fn git(&self, args: &[&str]) -> String {
+        #[allow(
+            clippy::disallowed_methods,
+            reason = "integration tests drive a scratch git repository"
+        )]
         let out = Command::new("git")
             .arg("-C")
             .arg(self.path())
@@ -191,11 +191,11 @@ pub fn is_named_by_include(mapping: &capobara::definition::Mapping, path: &str)
 }
 
 /// `git ls-files` under `dir`, relative to `dir`.
-#[allow(
-    clippy::disallowed_methods,
-    reason = "test enumerates the crate's own git-tracked files"
-)]
 pub fn git_ls_files(dir: &Path) -> Vec<String> {
+    #[allow(
+        clippy::disallowed_methods,
+        reason = "test enumerates the crate's own git-tracked files"
+    )]
     let out = Command::new("git")
         .arg("-C")
         .arg(dir)
diff --git a/tests/transport_git.rs b/tests/transport_git.rs
index 82c0b8e..2f15688 100644
--- a/tests/transport_git.rs
+++ b/tests/transport_git.rs
@@ -138,11 +138,11 @@ fn write_report(path: &Path, report: &Report) {
     std::fs::write(path, serde_json::to_string(report).unwrap()).unwrap();
 }
 
-#[allow(
-    clippy::disallowed_methods,
-    reason = "integration test executes the capobara binary"
-)]
 fn capobara() -> Command {
+    #[allow(
+        clippy::disallowed_methods,
+        reason = "integration test executes the capobara binary"
+    )]
     Command::new(env!("CARGO_BIN_EXE_capobara"))
 }
 
@@ -184,11 +184,11 @@ fn run_capobara(
     );
 }
 
-#[allow(
-    clippy::disallowed_methods,
-    reason = "integration tests drive scratch git repositories outside the support::Repo helper"
-)]
 fn run_git(path: &Path, args: &[&str]) -> String {
+    #[allow(
+        clippy::disallowed_methods,
+        reason = "integration tests drive scratch git repositories outside the support::Repo helper"
+    )]
     let out = Command::new("git")
         .arg("-C")
         .arg(path)
@@ -203,11 +203,11 @@ fn run_git(path: &Path, args: &[&str]) -> String {
     String::from_utf8(out.stdout).unwrap()
 }
 
-#[allow(
-    clippy::disallowed_methods,
-    reason = "integration test drives a scratch git repository outside the support::Repo helper"
-)]
 fn clone_no_local(src: &Path, dest: &Path) {
+    #[allow(
+        clippy::disallowed_methods,
+        reason = "integration test drives a scratch git repository outside the support::Repo helper"
+    )]
     let out = Command::new("git")
         .args(["clone", "--quiet", "--no-local"])
         .arg(src)
@@ -221,11 +221,11 @@ fn clone_no_local(src: &Path, dest: &Path) {
     );
 }
 
-#[allow(
-    clippy::disallowed_methods,
-    reason = "integration test probes object reachability in a scratch git repository"
-)]
 fn commit_exists(path: &Path, sha: &str) -> bool {
+    #[allow(
+        clippy::disallowed_methods,
+        reason = "integration test probes object reachability in a scratch git repository"
+    )]
     Command::new("git")
         .arg("-C")
         .arg(path)
@@ -235,11 +235,11 @@ fn commit_exists(path: &Path, sha: &str) -> bool {
         .unwrap_or(false)
 }
 
-#[allow(
-    clippy::disallowed_methods,
-    reason = "integration test inspects a scratch bare git repository's refs"
-)]
 fn ref_exists(path: &Path, refname: &str) -> bool {
+    #[allow(
+        clippy::disallowed_methods,
+        reason = "integration test inspects a scratch bare git repository's refs"
+    )]
     Command::new("git")
         .arg("-C")
         .arg(path)
@@ -778,11 +778,11 @@ fn ls_remote_sha(from: &Path, remote: &Path, refname: &str) -> Option<String> {
     out.split_whitespace().next().map(str::to_owned)
 }
 
-#[allow(
-    clippy::disallowed_methods,
-    reason = "integration test re-executes its own test binary with GH_TOKEN set"
-)]
 fn self_exe() -> Command {
+    #[allow(
+        clippy::disallowed_methods,
+        reason = "integration test re-executes its own test binary with GH_TOKEN set"
+    )]
     Command::new(std::env::current_exe().unwrap())
 }