diff --git a/src/cli/bundle.zig b/src/cli/bundle.zig
index ddd036b..42d8121 100644
--- a/src/cli/bundle.zig
+++ b/src/cli/bundle.zig
@@ -113,8 +113,8 @@ pub fn execute(ctx: *const AppCtx, allocator: std.mem.Allocator, args: []const [
     if (std.mem.eql(u8, sub, "install")) return cmdInstall(ctx, allocator, rest);
     if (std.mem.eql(u8, sub, "cleanup")) return cmdCleanup(ctx, allocator, rest);
     if (std.mem.eql(u8, sub, "create")) return cmdCreate(ctx, allocator, rest);
-    if (std.mem.eql(u8, sub, "list")) return cmdList(ctx, allocator);
-    if (std.mem.eql(u8, sub, "remove")) return cmdRemove(ctx, allocator, rest);
+    if (std.mem.eql(u8, sub, "list")) return cmdList(ctx);
+    if (std.mem.eql(u8, sub, "remove")) return cmdRemove(ctx, rest);
     if (std.mem.eql(u8, sub, "export")) return cmdExport(ctx, allocator, rest);
     if (std.mem.eql(u8, sub, "import")) return cmdImport(ctx, allocator, rest);
 
@@ -279,8 +279,7 @@ fn cmdCleanup(ctx: *const AppCtx, allocator: std.mem.Allocator, rest: []const []
     output.success("bundle cleanup complete", .{});
 }
 
-fn cmdList(ctx: *const AppCtx, allocator: std.mem.Allocator) !void {
-    _ = allocator;
+fn cmdList(ctx: *const AppCtx) !void {
     var db = try openDb(ctx);
     defer db.close();
 
@@ -298,8 +297,7 @@ fn cmdList(ctx: *const AppCtx, allocator: std.mem.Allocator) !void {
     if (!any) output.info("no bundles registered", .{});
 }
 
-fn cmdRemove(ctx: *const AppCtx, allocator: std.mem.Allocator, rest: []const []const u8) !void {
-    _ = allocator;
+fn cmdRemove(ctx: *const AppCtx, rest: []const []const u8) !void {
     if (rest.len != 1) {
         output.err("bundle remove: expected <name>", .{});
         return BundleError.InvalidArgs;
@@ -337,7 +335,7 @@ fn cmdCreate(ctx: *const AppCtx, allocator: std.mem.Allocator, rest: []const []c
     var manifest = manifest_mod.Manifest.init(allocator);
     defer manifest.deinit();
     try populateFromInstalled(&manifest, &db);
-    try writeManifest(ctx, allocator, manifest, out_path, format);
+    try writeManifest(ctx, manifest, out_path, format);
     output.success("wrote {s}", .{out_path});
 }
 
@@ -469,12 +467,10 @@ fn readManifest(
 
 fn writeManifest(
     ctx: *const AppCtx,
-    allocator: std.mem.Allocator,
     manifest: manifest_mod.Manifest,
     path: []const u8,
     format: Format,
 ) !void {
-    _ = allocator;
     const file = if (std.fs.path.isAbsolute(path))
         std.Io.Dir.createFileAbsolute(ctx.io, path, .{ .truncate = true }) catch return BundleError.WriteFailed
     else
diff --git a/src/cli/completions.zig b/src/cli/completions.zig
index a019a9b..71b8f48 100644
--- a/src/cli/completions.zig
+++ b/src/cli/completions.zig
@@ -24,8 +24,7 @@ pub fn scriptFor(shell: Shell) []const u8 {
     };
 }
 
-pub fn execute(ctx: *const AppCtx, allocator: std.mem.Allocator, args: []const []const u8) !void {
-    _ = allocator;
+pub fn execute(ctx: *const AppCtx, args: []const []const u8) !void {
     if (help.showIfRequested(ctx, args, "completions")) return;
 
     if (args.len == 0) {
diff --git a/src/cli/doctor.zig b/src/cli/doctor.zig
index e82d7e9..fc923a4 100644
--- a/src/cli/doctor.zig
+++ b/src/cli/doctor.zig
@@ -562,7 +562,7 @@ fn checkLocalSources(ctx: CheckCtx, name: []const u8) CheckResult {
     };
     defer db.close();
 
-    const missing = countMissingLocalSources(ctx.io, ctx.allocator, &db);
+    const missing = countMissingLocalSources(ctx.io, &db);
     if (missing.total == 0 or missing.stale == 0) {
         printCheck(name, .ok, null);
         return .ok;
@@ -655,10 +655,8 @@ pub const LocalSourceCensus = struct {
 /// reported by the separate SQLite-integrity check above.
 pub fn countMissingLocalSources(
     io: std.Io,
-    allocator: std.mem.Allocator,
     db: *sqlite.Database,
 ) LocalSourceCensus {
-    _ = allocator;
     var census: LocalSourceCensus = .{ .total = 0, .stale = 0 };
     var stmt = db.prepare("SELECT full_name FROM kegs WHERE tap = 'local';") catch return census;
     defer stmt.finalize();
diff --git a/src/cli/info.zig b/src/cli/info.zig
index ddfde58..5dc9868 100644
--- a/src/cli/info.zig
+++ b/src/cli/info.zig
@@ -64,8 +64,8 @@ pub fn execute(ctx: *const AppCtx, allocator: std.mem.Allocator, args: []const [
     if (db_opt) |*db| {
         // Schema is idempotent; info's API fallback handles a broken DB gracefully.
         schema.initSchema(db) catch {};
-        if (!force_cask and try emitInstalledFormula(allocator, db, name, prefix, stdout, json_mode, colorize)) return;
-        if (!force_formula and try emitInstalledCask(allocator, db, name, stdout, json_mode, colorize)) return;
+        if (!force_cask and try emitInstalledFormula(db, name, prefix, stdout, json_mode, colorize)) return;
+        if (!force_formula and try emitInstalledCask(db, name, stdout, json_mode, colorize)) return;
     }
 
     // Not locally installed — fall back to Homebrew API metadata so
@@ -75,14 +75,13 @@ pub fn execute(ctx: *const AppCtx, allocator: std.mem.Allocator, args: []const [
     // missed or the DB was absent entirely.
     if (try emitApiMetadata(ctx, allocator, name, stdout, json_mode, colorize, force_cask, force_formula)) return;
 
-    try emitNotFound(allocator, name, stdout, json_mode);
+    try emitNotFound(name, stdout, json_mode);
 }
 
 /// If `name` is an installed formula, write its info row and return
 /// true (caller stops). Returns false when the lookup misses so the
 /// caller can try the cask path.
 fn emitInstalledFormula(
-    allocator: std.mem.Allocator,
     db: *sqlite.Database,
     name: []const u8,
     prefix: []const u8,
@@ -100,7 +99,7 @@ fn emitInstalledFormula(
     if (!installed) return false;
 
     if (json_mode) {
-        try writeJsonInfo(allocator, db, name, true, &stmt, stdout);
+        try writeJsonInfo(name, true, &stmt, stdout);
     } else {
         try writeHumanInfo(name, true, &stmt, prefix, stdout, colorize);
     }
@@ -109,7 +108,6 @@ fn emitInstalledFormula(
 
 /// Cask counterpart to `emitInstalledFormula`.
 fn emitInstalledCask(
-    allocator: std.mem.Allocator,
     db: *sqlite.Database,
     name: []const u8,
     stdout: *std.Io.Writer,
@@ -118,7 +116,7 @@ fn emitInstalledCask(
 ) !bool {
     if (cask_mod.lookupInstalled(db, name) == null) return false;
     if (json_mode) {
-        try writeJsonCaskInfo(allocator, db, name, stdout);
+        try writeJsonCaskInfo(db, name, stdout);
     } else {
         try writeHumanCaskInfo(db, name, stdout, colorize);
     }
@@ -128,13 +126,12 @@ fn emitInstalledCask(
 /// Terminal output for a package the user asked about that is
 /// neither installed locally nor known to the Homebrew API.
 fn emitNotFound(
-    allocator: std.mem.Allocator,
     name: []const u8,
     stdout: *std.Io.Writer,
     json_mode: bool,
 ) !void {
     if (json_mode) {
-        try writeJsonNotInstalled(allocator, name, stdout);
+        try writeJsonNotInstalled(name, stdout);
         return;
     }
     var buf: [4096]u8 = undefined;
@@ -187,7 +184,7 @@ fn emitApiFormula(
     var f = formula_mod.parseFormula(allocator, body) catch return false;
     defer f.deinit();
 
-    if (json_mode) try writeApiFormulaJson(allocator, &f, stdout) else try writeApiFormulaHuman(&f, stdout, colorize);
+    if (json_mode) try writeApiFormulaJson(&f, stdout) else try writeApiFormulaHuman(&f, stdout, colorize);
     return true;
 }
 
@@ -205,7 +202,7 @@ fn emitApiCask(
     var c = cask_mod.parseCask(allocator, body) catch return false;
     defer c.deinit();
 
-    if (json_mode) try writeApiCaskJson(allocator, &c, stdout) else try writeApiCaskHuman(&c, stdout, colorize);
+    if (json_mode) try writeApiCaskJson(&c, stdout) else try writeApiCaskHuman(&c, stdout, colorize);
     return true;
 }
 
@@ -220,20 +217,16 @@ fn writeApiCaskHuman(c: *const cask_mod.Cask, stdout: *std.Io.Writer, colorize:
 }
 
 fn writeApiFormulaJson(
-    allocator: std.mem.Allocator,
     f: *const formula_mod.Formula,
     stdout: *std.Io.Writer,
 ) !void {
-    _ = allocator;
     try encodeApiFormulaJson(stdout, f);
 }
 
 fn writeApiCaskJson(
-    allocator: std.mem.Allocator,
     c: *const cask_mod.Cask,
     stdout: *std.Io.Writer,
 ) !void {
-    _ = allocator;
     try encodeApiCaskJson(stdout, c);
 }
 
@@ -402,11 +395,9 @@ pub fn openDb(prefix: []const u8) ?sqlite.Database {
 /// sqlite statement — used when the DB is missing or the package has
 /// simply never been installed.
 fn writeJsonNotInstalled(
-    allocator: std.mem.Allocator,
     name: []const u8,
     stdout: *std.Io.Writer,
 ) !void {
-    _ = allocator;
     try stdout.writeAll("{\"name\":");
     try output.jsonStr(stdout, name);
     try stdout.writeAll(",\"type\":\"formula\",\"installed\":false}\n");
@@ -450,16 +441,11 @@ fn writeHumanInfo(
 }
 
 fn writeJsonInfo(
-    allocator: std.mem.Allocator,
-    db: *sqlite.Database,
     name: []const u8,
     installed: bool,
     stmt: *sqlite.Statement,
     stdout: *std.Io.Writer,
 ) !void {
-    _ = db;
-    _ = allocator;
-
     try stdout.writeAll("{\"name\":");
     try output.jsonStr(stdout, name);
     try stdout.writeAll(",\"type\":\"formula\",\"installed\":");
@@ -520,7 +506,6 @@ fn writeHumanCaskInfo(
 }
 
 fn writeJsonCaskInfo(
-    allocator: std.mem.Allocator,
     db: *sqlite.Database,
     name: []const u8,
     stdout: *std.Io.Writer,
@@ -534,8 +519,6 @@ fn writeJsonCaskInfo(
     const found = stmt.step() catch false;
     if (!found) return;
 
-    _ = allocator;
-
     const token = if (stmt.columnText(0)) |t| std.mem.sliceTo(t, 0) else name;
     const cask_name = if (stmt.columnText(1)) |n| std.mem.sliceTo(n, 0) else name;
     const ver = if (stmt.columnText(2)) |v| std.mem.sliceTo(v, 0) else "";
diff --git a/src/cli/install.zig b/src/cli/install.zig
index 55f7a13..f7d555c 100644
--- a/src/cli/install.zig
+++ b/src/cli/install.zig
@@ -302,7 +302,7 @@ fn executeWithOpts(
             output.info("{s} is already installed", .{pkg});
             // Fast-path skips the protocol; positive signal so consumers
             // can tell idempotent success from "command never ran".
-            output.emitNdjsonEvent(allocator, .already_installed, pkg, null);
+            output.emitNdjsonEvent(.already_installed, pkg, null);
         }
         return;
     }
@@ -339,12 +339,12 @@ fn executeWithOpts(
             output.err("Another mt process is running. Wait or run mt doctor.", .{});
             return InstallError.LockError;
         };
-        output.emitNdjsonEvent(allocator, .lock_acquired, "", null);
+        output.emitNdjsonEvent(.lock_acquired, "", null);
     }
     defer if (lk) |*l| l.release();
     // LIFO: install_complete must precede release in the deferred chain,
     // and the outer holder owns the matching pair when we skipped here.
-    defer if (lk != null and output.isNdjson()) output.emitNdjsonEvent(allocator, .install_complete, "", null);
+    defer if (lk != null and output.isNdjson()) output.emitNdjsonEvent(.install_complete, "", null);
 
     // Main-thread HTTP client; workers borrow from `http_pool` instead.
     var http = client_mod.HttpClient.init(ctx.io, ctx.environ, allocator);
@@ -449,7 +449,7 @@ fn executeWithOpts(
                 output.err("Failed to resolve {s}: {s}", .{ pkg_name, @errorName(e) });
                 continue;
             };
-            output.emitNdjsonEvent(allocator, .resolved, pkg_name, null);
+            output.emitNdjsonEvent(.resolved, pkg_name, null);
         } else {
             installCask(ctx, allocator, pkg_name, &db, &api, dry_run) catch |e| {
                 output.err("Failed to install {s}: {s}", .{ pkg_name, @errorName(e) });
@@ -470,7 +470,7 @@ fn executeWithOpts(
             const tag: []const u8 = if (job.is_dep) " (dependency)" else "";
             output.info("  {s} {s}{s}", .{ job.name, job.version_str, tag });
             // No transition outcome to report on a plan-only run.
-            output.emitNdjsonEvent(allocator, .would_install, job.name, null);
+            output.emitNdjsonEvent(.would_install, job.name, null);
         }
         return;
     }
@@ -586,9 +586,9 @@ fn executeWithOpts(
     if (output.isNdjson()) {
         for (all_jobs.items) |job| {
             if (!job.succeeded) continue;
-            output.emitNdjsonEvent(allocator, .downloaded, job.name, "ok");
-            output.emitNdjsonEvent(allocator, .extracted, job.name, "ok");
-            output.emitNdjsonEvent(allocator, .stored, job.name, "ok");
+            output.emitNdjsonEvent(.downloaded, job.name, "ok");
+            output.emitNdjsonEvent(.extracted, job.name, "ok");
+            output.emitNdjsonEvent(.stored, job.name, "ok");
         }
     }
 
@@ -677,12 +677,12 @@ fn executeWithOpts(
                 "Failed to materialize {s}: {s} ({s})",
                 .{ job.name, @errorName(err), cellar_mod.describeError(err) },
             );
-            output.emitNdjsonEvent(allocator, .materialized, job.name, "failed");
+            output.emitNdjsonEvent(.materialized, job.name, "failed");
             try failed_kegs.put(job.name, {});
             failed_count += 1;
             continue;
         }
-        output.emitNdjsonEvent(allocator, .materialized, job.name, "ok");
+        output.emitNdjsonEvent(.materialized, job.name, "ok");
 
         // Failed-dep → skip: installing on a broken graph yields a dyld-unresolvable
         // keg. Remove the already-materialised keg so orphans don't linger.
@@ -770,7 +770,7 @@ fn linkAndRecord(
 
         linker.link(keg_path, job.name, keg_id) catch |err| {
             output.err("Failed to link {s}: {s}", .{ job.name, @errorName(err) });
-            output.emitNdjsonEvent(allocator, .linked, job.name, "failed");
+            output.emitNdjsonEvent(.linked, job.name, "failed");
             // Rollback: unlink what was partially created + remove DB record + cellar.
             linker.unlink(keg_id) catch {};
             deleteKeg(db, keg_id);
@@ -779,8 +779,8 @@ fn linkAndRecord(
         };
         // `recorded` after both succeed — link rollback undoes the keg
         // row, so an early emit would lie if `linked:failed` follows.
-        output.emitNdjsonEvent(allocator, .linked, job.name, "ok");
-        output.emitNdjsonEvent(allocator, .recorded, job.name, "ok");
+        output.emitNdjsonEvent(.linked, job.name, "ok");
+        output.emitNdjsonEvent(.recorded, job.name, "ok");
         linker.linkOpt(job.name, job.version_str) catch {};
         recordDeps(db, keg_id, formula);
     } else {
@@ -790,7 +790,7 @@ fn linkAndRecord(
             return InstallError.RecordFailed;
         };
         // keg-only has no public link phase to roll back.
-        output.emitNdjsonEvent(allocator, .recorded, job.name, "ok");
+        output.emitNdjsonEvent(.recorded, job.name, "ok");
         linker.linkOpt(job.name, job.version_str) catch {};
         recordDeps(db, keg_id, formula);
     }
diff --git a/src/cli/install/download.zig b/src/cli/install/download.zig
index 1e10023..66ecd03 100644
--- a/src/cli/install/download.zig
+++ b/src/cli/install/download.zig
@@ -427,7 +427,7 @@ pub fn collectFormulaJobs(
         defer if (!dep_json_consumed) allocator.free(dep_json);
 
         const dep_formula = cache.getOrParse(dep.name, dep_json) catch continue;
-        const dep_bottle = formula_mod.resolveBottle(allocator, dep_formula) catch continue;
+        const dep_bottle = formula_mod.resolveBottle(dep_formula) catch continue;
 
         // Check for duplicate (another top-level pkg may share a dep)
         var is_dup = false;
@@ -468,7 +468,7 @@ pub fn collectFormulaJobs(
     }
 
     // Add main formula
-    const bottle = formula_mod.resolveBottle(allocator, formula) catch {
+    const bottle = formula_mod.resolveBottle(formula) catch {
         output.err("No bottle available for {s} on this platform", .{formula.name});
         return InstallError.NoBottle;
     };
diff --git a/src/cli/list.zig b/src/cli/list.zig
index 42a261d..49b1271 100644
--- a/src/cli/list.zig
+++ b/src/cli/list.zig
@@ -10,7 +10,7 @@ const output = @import("../ui/output.zig");
 const color = @import("../ui/color.zig");
 const help = @import("help.zig");
 
-pub fn execute(ctx: *const AppCtx, allocator: std.mem.Allocator, args: []const []const u8) !void {
+pub fn execute(ctx: *const AppCtx, args: []const []const u8) !void {
     if (help.showIfRequested(ctx, args, "list")) return;
 
     // Parse per-command flags. `--json`, `--quiet`/`-q`, `--verbose`/`-v`,
@@ -59,7 +59,7 @@ pub fn execute(ctx: *const AppCtx, allocator: std.mem.Allocator, args: []const [
     defer stdout.flush() catch {};
 
     if (json_mode) {
-        try writeJsonOutput(ctx, allocator, &db, show_formula, show_cask, show_pinned, stdout);
+        try writeJsonOutput(ctx, &db, show_formula, show_cask, show_pinned, stdout);
     } else {
         try writeHumanOutput(&db, show_formula, show_cask, show_versions, show_pinned, stdout);
     }
@@ -229,14 +229,12 @@ fn writeStyledSpan(
 
 fn writeJsonOutput(
     ctx: *const AppCtx,
-    allocator: std.mem.Allocator,
     db: *sqlite.Database,
     show_formula: bool,
     show_cask: bool,
     show_pinned: bool,
     stdout: *std.Io.Writer,
 ) !void {
-    _ = allocator;
     const start_ts = std.Io.Clock.real.now(ctx.io).toMilliseconds();
     try buildListJson(db, stdout, show_formula, show_cask, show_pinned, start_ts);
 }
diff --git a/src/cli/migrate.zig b/src/cli/migrate.zig
index ef12d1f..81d68ff 100644
--- a/src/cli/migrate.zig
+++ b/src/cli/migrate.zig
@@ -195,7 +195,7 @@ pub fn execute(ctx: *const AppCtx, allocator: std.mem.Allocator, args: []const [
         // human/--json blob to pre-flight a migration.
         if (output.isNdjson()) {
             for (keg_names.items) |kn| {
-                output.emitNdjsonEvent(allocator, .would_install, kn, null);
+                output.emitNdjsonEvent(.would_install, kn, null);
             }
         }
         return;
@@ -229,8 +229,8 @@ pub fn execute(ctx: *const AppCtx, allocator: std.mem.Allocator, args: []const [
     defer lk.release();
     // LIFO: install_complete fires before lk.release. Inline gate keeps
     // the deferred call out of the default paths.
-    defer if (output.isNdjson()) output.emitNdjsonEvent(allocator, .install_complete, "", null);
-    output.emitNdjsonEvent(allocator, .lock_acquired, "", null);
+    defer if (output.isNdjson()) output.emitNdjsonEvent(.install_complete, "", null);
+    output.emitNdjsonEvent(.lock_acquired, "", null);
 
     // Set up HTTP + API + GHCR + store + linker
     var http = client_mod.HttpClient.init(ctx.io, ctx.environ, allocator);
diff --git a/src/cli/migrate/keg.zig b/src/cli/migrate/keg.zig
index 28c62de..7f4909c 100644
--- a/src/cli/migrate/keg.zig
+++ b/src/cli/migrate/keg.zig
@@ -126,11 +126,11 @@ pub fn migrateKeg(
     };
     defer formula.deinit();
 
-    const bottle = formula_mod.resolveBottle(allocator, &formula) catch {
+    const bottle = formula_mod.resolveBottle(&formula) catch {
         output.warn("  {s}: no bottle available for this platform", .{keg_name});
         return .skipped_no_bottle;
     };
-    output.emitNdjsonEvent(allocator, .resolved, keg_name, null);
+    output.emitNdjsonEvent(.resolved, keg_name, null);
 
     if (!has_bar) output.info("  Migrating {s} {s}...", .{ formula.name, formula.version });
 
@@ -142,9 +142,9 @@ pub fn migrateKeg(
         output.info("    {s} (cached in store)", .{keg_name});
     }
     if (output.isNdjson()) {
-        output.emitNdjsonEvent(allocator, .downloaded, keg_name, "ok");
-        output.emitNdjsonEvent(allocator, .extracted, keg_name, "ok");
-        output.emitNdjsonEvent(allocator, .stored, keg_name, "ok");
+        output.emitNdjsonEvent(.downloaded, keg_name, "ok");
+        output.emitNdjsonEvent(.extracted, keg_name, "ok");
+        output.emitNdjsonEvent(.stored, keg_name, "ok");
     }
 
     deps.store.incrementRef(bottle.sha256) catch |e| {
@@ -160,10 +160,10 @@ pub fn migrateKeg(
         formula.pkg_version,
     ) catch {
         output.err("    {s}: failed to materialize", .{keg_name});
-        output.emitNdjsonEvent(allocator, .materialized, keg_name, "failed");
+        output.emitNdjsonEvent(.materialized, keg_name, "failed");
         return .failed_install;
     };
-    output.emitNdjsonEvent(allocator, .materialized, keg_name, "ok");
+    output.emitNdjsonEvent(.materialized, keg_name, "ok");
 
     // Workers serialise on `db_mu` so transactions can't interleave;
     // serial callers leave `db_mu` null and pay no lock cost. The
@@ -183,7 +183,7 @@ pub fn migrateKeg(
 
         deps.linker.link(keg.path, formula.name, keg_id) catch {
             output.warn("    {s}: some links could not be created", .{keg_name});
-            output.emitNdjsonEvent(allocator, .linked, keg_name, "failed");
+            output.emitNdjsonEvent(.linked, keg_name, "failed");
             // Rollback: unlink partial links and delete keg row; user already warned above.
             deps.linker.unlink(keg_id) catch {};
             deleteKeg(deps.db, keg_id) catch {};
@@ -192,8 +192,8 @@ pub fn migrateKeg(
         };
         // `recorded` after both succeed — link rollback above undoes
         // the keg row, so an early emit would lie if link fails.
-        output.emitNdjsonEvent(allocator, .linked, keg_name, "ok");
-        output.emitNdjsonEvent(allocator, .recorded, keg_name, "ok");
+        output.emitNdjsonEvent(.linked, keg_name, "ok");
+        output.emitNdjsonEvent(.recorded, keg_name, "ok");
         deps.linker.linkOpt(formula.name, formula.pkg_version) catch {};
         recordDeps(deps.db, keg_id, &formula);
     } else {
@@ -201,7 +201,7 @@ pub fn migrateKeg(
             cellar_mod.remove(ctx.io, deps.prefix, formula.name, formula.pkg_version) catch {};
             return .failed_install;
         };
-        output.emitNdjsonEvent(allocator, .recorded, keg_name, "ok");
+        output.emitNdjsonEvent(.recorded, keg_name, "ok");
         deps.linker.linkOpt(formula.name, formula.pkg_version) catch {};
         recordDeps(deps.db, keg_id, &formula);
     }
diff --git a/src/cli/purge.zig b/src/cli/purge.zig
index 6e7ca1f..08196b3 100644
--- a/src/cli/purge.zig
+++ b/src/cli/purge.zig
@@ -198,8 +198,8 @@ pub fn execute(ctx: *const AppCtx, allocator: std.mem.Allocator, args: []const [
             r = try switch (k) {
                 .unused_deps => scopes_mod.runUnusedDeps(ctx, allocator, prefix, dry_run),
                 .store_orphans => scopes_mod.runStoreOrphans(ctx, allocator, prefix, dry_run),
-                .cache => scopes_mod.runCache(ctx, allocator, cache_dir, opts.cache_days, dry_run),
-                .downloads => scopes_mod.runDownloads(ctx, allocator, cache_dir, dry_run),
+                .cache => scopes_mod.runCache(ctx, cache_dir, opts.cache_days, dry_run),
+                .downloads => scopes_mod.runDownloads(ctx, cache_dir, dry_run),
                 .stale_casks => scopes_mod.runStaleCasks(ctx, allocator, prefix, dry_run),
                 .old_versions => scopes_mod.runOldVersions(ctx, allocator, prefix, dry_run),
             };
diff --git a/src/cli/purge/scopes.zig b/src/cli/purge/scopes.zig
index 17060f6..11b192d 100644
--- a/src/cli/purge/scopes.zig
+++ b/src/cli/purge/scopes.zig
@@ -190,8 +190,7 @@ pub fn runUnusedDeps(ctx: *const AppCtx, allocator: std.mem.Allocator, prefix: [
 
 // ── Tier: --cache[=DAYS] (was `cleanup --prune=`) ───────────────────────────
 
-pub fn runCache(ctx: *const AppCtx, allocator: std.mem.Allocator, cache_dir: []const u8, max_age_days: i64, dry_run: bool) !TierResult {
-    _ = allocator;
+pub fn runCache(ctx: *const AppCtx, cache_dir: []const u8, max_age_days: i64, dry_run: bool) !TierResult {
     var result: TierResult = .{};
 
     var rep = report.Reporter.init("cache", dry_run);
@@ -237,8 +236,7 @@ fn pruneCacheRecursive(io: std.Io, cache_dir: []const u8, max_age_days: i64, dry
 
 // ── Tier: --downloads (was `cleanup -s`) ────────────────────────────────────
 
-pub fn runDownloads(ctx: *const AppCtx, allocator: std.mem.Allocator, cache_dir: []const u8, dry_run: bool) !TierResult {
-    _ = allocator;
+pub fn runDownloads(ctx: *const AppCtx, cache_dir: []const u8, dry_run: bool) !TierResult {
     var result: TierResult = .{};
     const io = ctx.io;
 
diff --git a/src/cli/run.zig b/src/cli/run.zig
index 655a7c8..26a581d 100644
--- a/src/cli/run.zig
+++ b/src/cli/run.zig
@@ -142,7 +142,7 @@ fn ephemeralRun(
     };
     defer formula.deinit();
 
-    const bottle = formula_mod.resolveBottle(allocator, &formula) catch {
+    const bottle = formula_mod.resolveBottle(&formula) catch {
         output.err("No bottle available for {s} on this platform", .{pkg_name});
         return error.Aborted;
     };
diff --git a/src/cli/search.zig b/src/cli/search.zig
index 604a28f..6bc0d56 100644
--- a/src/cli/search.zig
+++ b/src/cli/search.zig
@@ -113,7 +113,7 @@ pub fn execute(ctx: *const AppCtx, allocator: std.mem.Allocator, args: []const [
     // Flush on teardown; stdout closed by a broken pipe is normal shell usage.
     defer stdout.flush() catch {};
     if (json_mode) {
-        try emitJson(allocator, stdout, search_formula, search_cask, formula, cask, search_query);
+        try emitJson(stdout, search_formula, search_cask, formula, cask, search_query);
     } else {
         emitHuman(stdout, formula, cask, search_query);
     }
@@ -193,7 +193,6 @@ fn writeHuman(
 }
 
 fn emitJson(
-    allocator: std.mem.Allocator,
     stdout: *std.Io.Writer,
     search_formula: bool,
     search_cask: bool,
@@ -201,7 +200,6 @@ fn emitJson(
     cask: KindResults,
     query: []const u8,
 ) !void {
-    _ = allocator;
     try stdout.writeAll("{");
     if (search_formula) {
         try stdout.writeAll("\"formulae\":[");
diff --git a/src/cli/uninstall.zig b/src/cli/uninstall.zig
index 916b7dc..94fc26e 100644
--- a/src/cli/uninstall.zig
+++ b/src/cli/uninstall.zig
@@ -260,7 +260,7 @@ fn uninstallCask(ctx: *const AppCtx, allocator: std.mem.Allocator, token: []cons
     // Check if running (unless --force)
     if (!force) {
         if (info.appPath()) |app_path| {
-            if (cask_mod.CaskInstaller.isAppRunningPub(ctx.io, allocator, app_path)) {
+            if (cask_mod.CaskInstaller.isAppRunningPub(ctx.io, app_path)) {
                 output.err("{s} appears to be running. Quit the app first, or use --force.", .{token});
                 return error.Aborted;
             }
diff --git a/src/cli/upgrade.zig b/src/cli/upgrade.zig
index 4ad81ad..1eb5673 100644
--- a/src/cli/upgrade.zig
+++ b/src/cli/upgrade.zig
@@ -97,8 +97,8 @@ pub fn execute(ctx: *const AppCtx, allocator: std.mem.Allocator, args: []const [
     defer lk.release();
     // LIFO: install_complete fires before lk.release. Inline gate keeps
     // the deferred call out of the default paths.
-    defer if (output.isNdjson()) output.emitNdjsonEvent(allocator, .install_complete, "", null);
-    output.emitNdjsonEvent(allocator, .lock_acquired, "", null);
+    defer if (output.isNdjson()) output.emitNdjsonEvent(.install_complete, "", null);
+    output.emitNdjsonEvent(.lock_acquired, "", null);
 
     var db_path_buf: [512]u8 = undefined;
     const db_path = std.fmt.bufPrintSentinel(&db_path_buf, "{s}/db/malt.db", .{prefix}, 0) catch return;
@@ -186,7 +186,7 @@ fn upgradeFormula(
     if (pinSkip(db, name, force, audit_mode)) {
         output.dim("{s} is pinned, skipped", .{name});
         // Distinguishes "skipped by policy" from "command never ran".
-        output.emitNdjsonEvent(allocator, .pinned, name, null);
+        output.emitNdjsonEvent(.pinned, name, null);
         return;
     }
 
@@ -245,19 +245,19 @@ fn upgradeFormula(
     // Compare versions
     if (std.mem.eql(u8, old_pkg_version, formula.pkg_version)) {
         output.skip("{s} is already at latest version {s}", .{ name, formula.pkg_version });
-        output.emitNdjsonEvent(allocator, .up_to_date, name, null);
+        output.emitNdjsonEvent(.up_to_date, name, null);
         return;
     }
 
     if (dry_run) {
         output.info("Dry run: would upgrade {s} {s} -> {s}", .{ name, old_version, formula.pkg_version });
         // Same vocabulary across install/upgrade/migrate — one parser fits all.
-        output.emitNdjsonEvent(allocator, .would_install, name, null);
+        output.emitNdjsonEvent(.would_install, name, null);
         return;
     }
 
     output.info("Upgrading {s} {s} -> {s}...", .{ name, old_version, formula.pkg_version });
-    output.emitNdjsonEvent(allocator, .resolved, name, null);
+    output.emitNdjsonEvent(.resolved, name, null);
 
     // Bottles bake LC_LOAD_DYLIB paths against their own dep set, so a
     // dep introduced after the previously-installed version must be
@@ -291,7 +291,7 @@ fn upgradeFormula(
     }
 
     // Step 3: Resolve bottle for new version
-    const bottle = formula_mod.resolveBottle(allocator, &formula) catch {
+    const bottle = formula_mod.resolveBottle(&formula) catch {
         output.err("No bottle available for {s} on this platform", .{name});
         return error.Aborted;
     };
@@ -346,9 +346,9 @@ fn upgradeFormula(
     }
     // Emit even on warm-cache so the cold/warm event sequence matches.
     if (output.isNdjson()) {
-        output.emitNdjsonEvent(allocator, .downloaded, name, "ok");
-        output.emitNdjsonEvent(allocator, .extracted, name, "ok");
-        output.emitNdjsonEvent(allocator, .stored, name, "ok");
+        output.emitNdjsonEvent(.downloaded, name, "ok");
+        output.emitNdjsonEvent(.extracted, name, "ok");
+        output.emitNdjsonEvent(.stored, name, "ok");
     }
 
     // Step 5: Materialize new version to Cellar
@@ -362,10 +362,10 @@ fn upgradeFormula(
         formula.pkg_version,
     ) catch {
         output.err("Failed to materialize {s}", .{name});
-        output.emitNdjsonEvent(allocator, .materialized, name, "failed");
+        output.emitNdjsonEvent(.materialized, name, "failed");
         return error.Aborted;
     };
-    output.emitNdjsonEvent(allocator, .materialized, name, "ok");
+    output.emitNdjsonEvent(.materialized, name, "ok");
 
     // Step 6: Unlink old symlinks
     var linker = linker_mod.Linker.init(ctx.io, allocator, db, prefix);
@@ -385,7 +385,7 @@ fn upgradeFormula(
 
     linker.link(new_keg.path, formula.name, new_keg_id) catch {
         output.err("Failed to link new version of {s}", .{name});
-        output.emitNdjsonEvent(allocator, .linked, name, "failed");
+        output.emitNdjsonEvent(.linked, name, "failed");
         // Rollback: remove partial new links, restore old
         // partial link cleanup in a rollback path.
         linker.unlink(new_keg_id) catch {};
@@ -397,8 +397,8 @@ fn upgradeFormula(
     };
     // `recorded` after both succeed — link rollback above undoes the
     // keg row, so an early emit would lie if `linked:failed` follows.
-    output.emitNdjsonEvent(allocator, .linked, name, "ok");
-    output.emitNdjsonEvent(allocator, .recorded, name, "ok");
+    output.emitNdjsonEvent(.linked, name, "ok");
+    output.emitNdjsonEvent(.recorded, name, "ok");
 
     // opt symlink is convenience; install is already functional via versioned link.
     linker.linkOpt(formula.name, formula.pkg_version) catch {};
@@ -446,7 +446,7 @@ fn upgradeTapFormula(
 ) !void {
     if (pinSkip(db, name, force, audit_mode)) {
         output.dim("{s} is pinned, skipped", .{name});
-        output.emitNdjsonEvent(allocator, .pinned, name, null);
+        output.emitNdjsonEvent(.pinned, name, null);
         return;
     }
 
@@ -475,14 +475,14 @@ fn upgradeTapFormula(
 
     if (!force and same_commit) {
         output.skip("{s} is already at latest tap commit", .{name});
-        output.emitNdjsonEvent(allocator, .up_to_date, name, null);
+        output.emitNdjsonEvent(.up_to_date, name, null);
         return;
     }
 
     if (dry_run) {
         const short_len = @min(@as(usize, 8), fresh_sha.len);
         output.info("Dry run: would refresh tap {s} to {s} for {s}", .{ tap_label, fresh_sha[0..short_len], name });
-        output.emitNdjsonEvent(allocator, .would_install, name, null);
+        output.emitNdjsonEvent(.would_install, name, null);
         return;
     }
 
@@ -717,7 +717,7 @@ fn upgradeAllFormulas(
 fn upgradeCask(ctx: *const AppCtx, allocator: std.mem.Allocator, token: []const u8, db: *sqlite.Database, api: *api_mod.BrewApi, prefix: [:0]const u8, dry_run: bool, force: bool, audit_mode: bool) !void {
     if (pinSkip(db, token, force, audit_mode)) {
         output.dim("{s} is pinned, skipped", .{token});
-        output.emitNdjsonEvent(allocator, .pinned, token, null);
+        output.emitNdjsonEvent(.pinned, token, null);
         return;
     }
 
@@ -745,13 +745,13 @@ fn upgradeCask(ctx: *const AppCtx, allocator: std.mem.Allocator, token: []const
     const installed_version = installed.version();
     if (std.mem.eql(u8, installed_version, parsed_cask.version)) {
         output.skip("{s} is already at latest version {s}", .{ token, parsed_cask.version });
-        output.emitNdjsonEvent(allocator, .up_to_date, token, null);
+        output.emitNdjsonEvent(.up_to_date, token, null);
         return;
     }
 
     if (dry_run) {
         output.info("Dry run: would upgrade cask {s} {s} -> {s}", .{ token, installed_version, parsed_cask.version });
-        output.emitNdjsonEvent(allocator, .would_install, token, null);
+        output.emitNdjsonEvent(.would_install, token, null);
         return;
     }
 
diff --git a/src/cli/uses.zig b/src/cli/uses.zig
index 78c6ca4..753f975 100644
--- a/src/cli/uses.zig
+++ b/src/cli/uses.zig
@@ -57,7 +57,7 @@ pub fn execute(ctx: *const AppCtx, allocator: std.mem.Allocator, args: []const [
     }
 
     if (json_mode) {
-        try writeJson(allocator, stdout, name, dependents);
+        try writeJson(stdout, name, dependents);
     } else {
         try writeHuman(stdout, name, dependents);
     }
@@ -164,12 +164,10 @@ pub fn writeHuman(stdout: *std.Io.Writer, target: []const u8, dependents: [][]co
 }
 
 pub fn writeJson(
-    allocator: std.mem.Allocator,
     stdout: *std.Io.Writer,
     target: []const u8,
     dependents: [][]const u8,
 ) !void {
-    _ = allocator;
     try encodeJson(stdout, target, dependents);
 }
 
diff --git a/src/cli/version_update.zig b/src/cli/version_update.zig
index 9157cb2..76ffd05 100644
--- a/src/cli/version_update.zig
+++ b/src/cli/version_update.zig
@@ -218,7 +218,7 @@ pub fn execute(ctx: *const AppCtx, allocator: std.mem.Allocator, args: []const [
     }
 
     output.info("Replacing {s}...", .{self_exe});
-    const mode_after_self = replaceBinary(ctx, allocator, new_binary, self_exe, .user) catch |e| switch (e) {
+    const mode_after_self = replaceBinary(ctx, new_binary, self_exe, .user) catch |e| switch (e) {
         error.SudoSpawnFailed, error.SudoFailed => {
             output.err("sudo elevation failed for {s}.", .{self_exe});
             output.info("Manual update: sudo install -m 0755 -b -B .old {s} {s}", .{ new_binary, self_exe });
@@ -245,7 +245,7 @@ pub fn execute(ctx: *const AppCtx, allocator: std.mem.Allocator, args: []const [
         output.info("Replacing {s}...", .{tp});
         // Pass the post-self mode so the twin re-uses the elevation
         // decision instead of paying a second sudo prompt.
-        _ = replaceBinary(ctx, allocator, new_binary, tp, mode_after_self) catch |e| {
+        _ = replaceBinary(ctx, new_binary, tp, mode_after_self) catch |e| {
             // Don't roll back self: one updated binary beats a forced
             // downgrade on the one the user just invoked. Surface the
             // manual fix so they can close the gap.
@@ -283,19 +283,18 @@ pub const ReplaceMode = enum { user, sudo };
 /// can short-circuit a known-unwritable directory after the first prompt.
 fn replaceBinary(
     ctx: *const AppCtx,
-    allocator: std.mem.Allocator,
     new_binary: []const u8,
     target: []const u8,
     mode: ReplaceMode,
 ) !ReplaceMode {
     if (mode == .sudo) {
-        try installBinaryViaSudo(ctx, allocator, new_binary, target);
+        try installBinaryViaSudo(ctx, new_binary, target);
         return .sudo;
     }
     swap.atomicReplace(ctx.io, target, new_binary) catch |e| switch (e) {
         error.PermissionDenied => {
             output.warn("Cannot write to {s}; escalating with sudo.", .{std.fs.path.dirname(target) orelse target});
-            try installBinaryViaSudo(ctx, allocator, new_binary, target);
+            try installBinaryViaSudo(ctx, new_binary, target);
             return .sudo;
         },
         else => return e,
@@ -313,8 +312,7 @@ pub fn buildSudoInstallArgv(new_binary: []const u8, target: []const u8) [9][]con
 
 /// Spawn `sudo install` with the user's TTY inherited. Sudo prompts for
 /// the password on its own; we just propagate the exit status.
-fn installBinaryViaSudo(ctx: *const AppCtx, allocator: std.mem.Allocator, new_binary: []const u8, target: []const u8) !void {
-    _ = allocator;
+fn installBinaryViaSudo(ctx: *const AppCtx, new_binary: []const u8, target: []const u8) !void {
     const argv = buildSudoInstallArgv(new_binary, target);
     var child = std.process.spawn(ctx.io, .{ .argv = &argv }) catch return error.SudoSpawnFailed;
     const term = child.wait(ctx.io) catch return error.SudoSpawnFailed;
diff --git a/src/core/bundle/runner.zig b/src/core/bundle/runner.zig
index ec6c978..bcf9671 100644
--- a/src/core/bundle/runner.zig
+++ b/src/core/bundle/runner.zig
@@ -168,7 +168,7 @@ pub fn run(
     var db_record_error: ?[]const u8 = null;
     // 5. Record bundle and members in DB (even on partial failure). Skipped
     //    in dry-run so the preview path stays read-only.
-    if (!opts.dry_run) recordBundle(io, allocator, db, manifest) catch |e| {
+    if (!opts.dry_run) recordBundle(io, db, manifest) catch |e| {
         db_record_error = @errorName(e);
     };
 
@@ -283,11 +283,9 @@ fn runSubprocess(io: std.Io, allocator: std.mem.Allocator, bin: []const u8, call
 
 fn recordBundle(
     io: std.Io,
-    allocator: std.mem.Allocator,
     db: *sqlite.Database,
     manifest: manifest_mod.Manifest,
 ) !void {
-    _ = allocator;
     try schema.migrate(db);
 
     try db.beginTransaction();
diff --git a/src/core/cask.zig b/src/core/cask.zig
index ff0e847..56575c4 100644
--- a/src/core/cask.zig
+++ b/src/core/cask.zig
@@ -349,7 +349,7 @@ pub const CaskInstaller = struct {
             const app_path = std.mem.sliceTo(p, 0);
 
             // Check if the app is running (best-effort)
-            if (isAppRunning(self.io, self.allocator, app_path)) return CaskError.UninstallFailed;
+            if (isAppRunning(self.io, app_path)) return CaskError.UninstallFailed;
 
             // app may already be gone (manual delete); continue to DB cleanup.
             std.Io.Dir.cwd().deleteTree(self.io, app_path) catch {};
@@ -633,8 +633,8 @@ pub const CaskInstaller = struct {
     }
 
     /// Public wrapper for isAppRunning (used by uninstall.zig).
-    pub fn isAppRunningPub(io: std.Io, allocator: std.mem.Allocator, app_path: []const u8) bool {
-        return isAppRunning(io, allocator, app_path);
+    pub fn isAppRunningPub(io: std.Io, app_path: []const u8) bool {
+        return isAppRunning(io, app_path);
     }
 
     fn recordCaskroom(self: *CaskInstaller, cask: *const Cask) !void {
@@ -713,8 +713,7 @@ pub fn verifyFileSha256(io: std.Io, file_path: []const u8, expected: ?[]const u8
 }
 
 /// Check if an application is currently running by its path.
-fn isAppRunning(io: std.Io, allocator: std.mem.Allocator, app_path: []const u8) bool {
-    _ = allocator;
+fn isAppRunning(io: std.Io, app_path: []const u8) bool {
     const argv = [_][]const u8{ "pgrep", "-f", app_path };
     var child = std.process.spawn(io, .{
         .argv = &argv,
diff --git a/src/core/formula.zig b/src/core/formula.zig
index 63d522a..666bf0e 100644
--- a/src/core/formula.zig
+++ b/src/core/formula.zig
@@ -328,9 +328,7 @@ const macos_x86_platforms = [_][]const u8{
 };
 
 /// Select the best matching bottle for the current platform.
-pub fn resolveBottle(allocator: std.mem.Allocator, formula: *const Formula) !BottleFile {
-    _ = allocator;
-
+pub fn resolveBottle(formula: *const Formula) !BottleFile {
     const files = formula.bottle_files orelse return FormulaError.NoBottleAvailable;
 
     const candidates: []const []const u8 = switch (builtin.cpu.arch) {
diff --git a/src/main.zig b/src/main.zig
index 836cac1..fef5f1e 100644
--- a/src/main.zig
+++ b/src/main.zig
@@ -437,7 +437,7 @@ fn dispatch(allocator: std.mem.Allocator, ctx: *const AppCtx, cmd: Command, cmd_
         .upgrade => try upgrade.execute(ctx, allocator, cmd_args),
         .update => try update.execute(ctx, allocator, cmd_args),
         .outdated => try outdated.execute(ctx, allocator, cmd_args),
-        .list => try list.execute(ctx, allocator, cmd_args),
+        .list => try list.execute(ctx, cmd_args),
         .info => try info.execute(ctx, allocator, cmd_args),
         .search => try search.execute(ctx, allocator, cmd_args),
         .doctor => try doctor.execute(ctx, allocator, cmd_args),
@@ -450,7 +450,7 @@ fn dispatch(allocator: std.mem.Allocator, ctx: *const AppCtx, cmd: Command, cmd_
         .pin => try pin_cmd.execute(ctx, allocator, cmd_args),
         .unpin => try pin_cmd.executeUnpin(ctx, allocator, cmd_args),
         .run => try run_cmd.execute(ctx, allocator, cmd_args),
-        .completions => try completions.execute(ctx, allocator, cmd_args),
+        .completions => try completions.execute(ctx, cmd_args),
         .shellenv => try shellenv.execute(ctx, allocator, cmd_args),
         .backup => try backup.execute(ctx, allocator, cmd_args),
         .restore => try restore.execute(ctx, allocator, cmd_args),
diff --git a/src/ui/output.zig b/src/ui/output.zig
index 7fb419a..5b487d1 100644
--- a/src/ui/output.zig
+++ b/src/ui/output.zig
@@ -560,14 +560,11 @@ pub const NdjsonEvent = enum {
 /// `name` is omitted when empty (lock_acquired et al. are command-level);
 /// `status` is omitted when null so consumers skip a `null` vs `missing`
 /// branch. Overflowing events drop silently rather than fail the install.
-/// `allocator` is unused — kept for parity with the other JSON helpers.
 pub fn emitNdjsonEvent(
-    allocator: std.mem.Allocator,
     event: NdjsonEvent,
     name: []const u8,
     status: ?[]const u8,
 ) void {
-    _ = allocator;
     if (!ndjson) return;
     // Worst-case adversarial-escape name still fits in 1 KiB.
     var buf: [1024]u8 = undefined;
diff --git a/src/update/verify.zig b/src/update/verify.zig
index c6dffb3..5014601 100644
--- a/src/update/verify.zig
+++ b/src/update/verify.zig
@@ -102,7 +102,7 @@ pub const VerifyInputs = struct {
 /// Pure file I/O + subprocess — the caller is responsible for placing
 /// the three input files on disk. Testable without HTTP.
 pub fn verifyAll(io: std.Io, allocator: std.mem.Allocator, in: VerifyInputs) VerifyError!void {
-    verifyCosignBlob(io, allocator, .{
+    verifyCosignBlob(io, .{
         .cosign_bin = in.cosign_bin,
         .blob_path = in.checksums_path,
         .bundle_path = in.sigstore_path,
@@ -126,8 +126,7 @@ pub fn verifyAll(io: std.Io, allocator: std.mem.Allocator, in: VerifyInputs) Ver
 
 /// Shell out to `cosign verify-blob` with the same flags `install.sh` uses.
 /// Exit 0 = verified. Any other outcome maps to a CosignError.
-pub fn verifyCosignBlob(io: std.Io, allocator: std.mem.Allocator, args: CosignBlob) CosignError!void {
-    _ = allocator;
+pub fn verifyCosignBlob(io: std.Io, args: CosignBlob) CosignError!void {
     const argv = [_][]const u8{
         args.cosign_bin,
         "verify-blob",
diff --git a/tests/cask_extra_test.zig b/tests/cask_extra_test.zig
index ad20afd..f3982fb 100644
--- a/tests/cask_extra_test.zig
+++ b/tests/cask_extra_test.zig
@@ -23,7 +23,7 @@ test "isAppRunningPub returns false for a path no pgrep match can cover" {
     // exits non-zero and the wrapper returns false.
     var threaded: std.Io.Threaded = .init(testing.allocator, .{ .environ = testEnviron() });
     defer threaded.deinit();
-    try testing.expect(!cask.CaskInstaller.isAppRunningPub(threaded.io(), testing.allocator, "/nonexistent/Sentinel-path-never-running.app"));
+    try testing.expect(!cask.CaskInstaller.isAppRunningPub(threaded.io(), "/nonexistent/Sentinel-path-never-running.app"));
 }
 
 test "CaskInstaller.uninstall on a missing token returns UninstallFailed" {
diff --git a/tests/doctor_dispatch_test.zig b/tests/doctor_dispatch_test.zig
index 0ea0734..cb4c117 100644
--- a/tests/doctor_dispatch_test.zig
+++ b/tests/doctor_dispatch_test.zig
@@ -223,7 +223,7 @@ test "countMissingLocalSources tallies missing source paths against tap='local'
         _ = try stmt.step();
     }
 
-    const census = doctor.countMissingLocalSources(std.Options.debug_io, testing.allocator, &db);
+    const census = doctor.countMissingLocalSources(std.Options.debug_io, &db);
     try testing.expectEqual(@as(u32, 2), census.total);
     try testing.expectEqual(@as(u32, 1), census.stale);
 }
diff --git a/tests/doctor_render_test.zig b/tests/doctor_render_test.zig
index 1f3b015..35882e9 100644
--- a/tests/doctor_render_test.zig
+++ b/tests/doctor_render_test.zig
@@ -207,7 +207,7 @@ test "countMissingLocalSources ignores non-local kegs" {
     defer threaded.deinit();
     const io = threaded.io();
 
-    const got = doctor.countMissingLocalSources(io, testing.allocator, &db);
+    const got = doctor.countMissingLocalSources(io, &db);
     try testing.expectEqual(@as(u32, 0), got.total);
     try testing.expectEqual(@as(u32, 0), got.stale);
 }
@@ -223,7 +223,7 @@ test "countMissingLocalSources flags kegs whose .rb no longer exists" {
     defer threaded.deinit();
     const io = threaded.io();
 
-    const got = doctor.countMissingLocalSources(io, testing.allocator, &db);
+    const got = doctor.countMissingLocalSources(io, &db);
     try testing.expectEqual(@as(u32, 1), got.total);
     try testing.expectEqual(@as(u32, 1), got.stale);
 }
@@ -247,7 +247,7 @@ test "countMissingLocalSources does not flag kegs whose .rb still exists" {
     defer threaded.deinit();
     const io = threaded.io();
 
-    const got = doctor.countMissingLocalSources(io, testing.allocator, &db);
+    const got = doctor.countMissingLocalSources(io, &db);
     try testing.expectEqual(@as(u32, 1), got.total);
     try testing.expectEqual(@as(u32, 0), got.stale);
 }
@@ -271,7 +271,7 @@ test "countMissingLocalSources mixes stale and present rows correctly" {
     defer threaded.deinit();
     const io = threaded.io();
 
-    const got = doctor.countMissingLocalSources(io, testing.allocator, &db);
+    const got = doctor.countMissingLocalSources(io, &db);
     try testing.expectEqual(@as(u32, 3), got.total);
     try testing.expectEqual(@as(u32, 2), got.stale);
 }
diff --git a/tests/formula_test.zig b/tests/formula_test.zig
index 0fce1b9..3142ad0 100644
--- a/tests/formula_test.zig
+++ b/tests/formula_test.zig
@@ -65,7 +65,7 @@ test "resolve bottle for current platform" {
     var formula = try formula_mod.parseFormula(alloc, minimal_json);
     defer formula.deinit();
 
-    const bottle = try formula_mod.resolveBottle(alloc, &formula);
+    const bottle = try formula_mod.resolveBottle(&formula);
     try testing.expect(bottle.sha256.len > 0);
     try testing.expect(bottle.url.len > 0);
 }
@@ -112,7 +112,7 @@ test "handle missing bottle for platform" {
     var formula = try formula_mod.parseFormula(alloc, json);
     defer formula.deinit();
 
-    const result = formula_mod.resolveBottle(alloc, &formula);
+    const result = formula_mod.resolveBottle(&formula);
     try testing.expectError(formula_mod.FormulaError.NoBottleAvailable, result);
 }
 
@@ -153,7 +153,7 @@ test "resolveBottle prefers tahoe over sequoia on current arch" {
     var formula = try formula_mod.parseFormula(alloc, json);
     defer formula.deinit();
 
-    const bottle = try formula_mod.resolveBottle(alloc, &formula);
+    const bottle = try formula_mod.resolveBottle(&formula);
 
     const expected_sha = switch (builtin.cpu.arch) {
         .aarch64 => "arm64_tahoe_sha",
diff --git a/tests/list_cli_test.zig b/tests/list_cli_test.zig
index 231781c..d7908a1 100644
--- a/tests/list_cli_test.zig
+++ b/tests/list_cli_test.zig
@@ -91,7 +91,7 @@ test "execute --help short-circuits" {
     defer s.deinit(testing.allocator);
     quiet();
     defer unquiet();
-    try list.execute(&malt.app_ctx.debug_ctx, testing.allocator, &.{"--help"});
+    try list.execute(&malt.app_ctx.debug_ctx, &.{"--help"});
 }
 
 test "execute on a fresh prefix with no db is a clean no-op" {
@@ -105,7 +105,7 @@ test "execute on a fresh prefix with no db is a clean no-op" {
 
     quiet();
     defer unquiet();
-    try list.execute(&malt.app_ctx.debug_ctx, testing.allocator, &.{});
+    try list.execute(&malt.app_ctx.debug_ctx, &.{});
 }
 
 // --- happy paths ------------------------------------------------------
@@ -118,7 +118,7 @@ test "execute with no flags lists both kegs and casks" {
     const ctx = ctxWithSink();
     quiet();
     defer unquiet();
-    try list.execute(&ctx, testing.allocator, &.{});
+    try list.execute(&ctx, &.{});
 }
 
 test "execute --formula scopes the dump to kegs only" {
@@ -129,7 +129,7 @@ test "execute --formula scopes the dump to kegs only" {
     const ctx = ctxWithSink();
     quiet();
     defer unquiet();
-    try list.execute(&ctx, testing.allocator, &.{"--formula"});
+    try list.execute(&ctx, &.{"--formula"});
 }
 
 test "execute --cask scopes the dump to casks only" {
@@ -140,7 +140,7 @@ test "execute --cask scopes the dump to casks only" {
     const ctx = ctxWithSink();
     quiet();
     defer unquiet();
-    try list.execute(&ctx, testing.allocator, &.{"--cask"});
+    try list.execute(&ctx, &.{"--cask"});
 }
 
 test "execute --versions includes version strings in the human dump" {
@@ -151,7 +151,7 @@ test "execute --versions includes version strings in the human dump" {
     const ctx = ctxWithSink();
     quiet();
     defer unquiet();
-    try list.execute(&ctx, testing.allocator, &.{"--versions"});
+    try list.execute(&ctx, &.{"--versions"});
 }
 
 test "execute --pinned scopes the dump to pinned rows only" {
@@ -162,7 +162,7 @@ test "execute --pinned scopes the dump to pinned rows only" {
     const ctx = ctxWithSink();
     quiet();
     defer unquiet();
-    try list.execute(&ctx, testing.allocator, &.{"--pinned"});
+    try list.execute(&ctx, &.{"--pinned"});
 }
 
 test "execute --json emits a JSON dump" {
@@ -178,5 +178,5 @@ test "execute --json emits a JSON dump" {
         unquiet();
     }
     const ctx = ctxWithSink();
-    try list.execute(&ctx, testing.allocator, &.{});
+    try list.execute(&ctx, &.{});
 }
diff --git a/tests/ndjson_test.zig b/tests/ndjson_test.zig
index d28d949..4790ce4 100644
--- a/tests/ndjson_test.zig
+++ b/tests/ndjson_test.zig
@@ -66,15 +66,15 @@ test "9-step install protocol emits one ndjson line per step" {
 
     // Drive each protocol step through the same helper the real
     // commands use so the line shape is the one consumers will see.
-    output.emitNdjsonEvent(testing.allocator, .lock_acquired, "", null);
-    output.emitNdjsonEvent(testing.allocator, .resolved, "wget", null);
-    output.emitNdjsonEvent(testing.allocator, .downloaded, "wget", "ok");
-    output.emitNdjsonEvent(testing.allocator, .extracted, "wget", "ok");
-    output.emitNdjsonEvent(testing.allocator, .stored, "wget", "ok");
-    output.emitNdjsonEvent(testing.allocator, .materialized, "wget", "ok");
-    output.emitNdjsonEvent(testing.allocator, .linked, "wget", "ok");
-    output.emitNdjsonEvent(testing.allocator, .recorded, "wget", "ok");
-    output.emitNdjsonEvent(testing.allocator, .install_complete, "", null);
+    output.emitNdjsonEvent(.lock_acquired, "", null);
+    output.emitNdjsonEvent(.resolved, "wget", null);
+    output.emitNdjsonEvent(.downloaded, "wget", "ok");
+    output.emitNdjsonEvent(.extracted, "wget", "ok");
+    output.emitNdjsonEvent(.stored, "wget", "ok");
+    output.emitNdjsonEvent(.materialized, "wget", "ok");
+    output.emitNdjsonEvent(.linked, "wget", "ok");
+    output.emitNdjsonEvent(.recorded, "wget", "ok");
+    output.emitNdjsonEvent(.install_complete, "", null);
 
     // Exactly one line per step — no fan-out, no dropped events.
     try testing.expectEqual(install_step_events.len, std.mem.count(u8, buf.items, "\n"));
@@ -103,7 +103,7 @@ test "ndjson off emits zero events for the same call sequence" {
     defer io_mod.endStdoutCapture();
 
     for (install_step_events) |ev| {
-        output.emitNdjsonEvent(testing.allocator, ev, "wget", "ok");
+        output.emitNdjsonEvent(ev, "wget", "ok");
     }
     try testing.expectEqualStrings("", buf.items);
 }
@@ -120,7 +120,7 @@ test "every NdjsonEvent variant emits a parser-clean line" {
     defer io_mod.endStdoutCapture();
 
     inline for (std.meta.tags(output.NdjsonEvent)) |ev| {
-        output.emitNdjsonEvent(testing.allocator, ev, "wget", null);
+        output.emitNdjsonEvent(ev, "wget", null);
     }
 
     const total: usize = std.meta.tags(output.NdjsonEvent).len;
@@ -145,7 +145,7 @@ test "no-op skip event names are stable across mutating commands" {
     io_mod.beginStdoutCapture(testing.allocator, &buf);
     defer io_mod.endStdoutCapture();
 
-    for (skip_events) |ev| output.emitNdjsonEvent(testing.allocator, ev, "wget", null);
+    for (skip_events) |ev| output.emitNdjsonEvent(ev, "wget", null);
 
     try testing.expectEqual(skip_events.len, std.mem.count(u8, buf.items, "\n"));
     // No status field on any of them — these are no-transition events.
@@ -171,8 +171,8 @@ test "would_install and already_installed are stable side-channel event names" {
     io_mod.beginStdoutCapture(testing.allocator, &buf);
     defer io_mod.endStdoutCapture();
 
-    output.emitNdjsonEvent(testing.allocator, .would_install, "wget", null);
-    output.emitNdjsonEvent(testing.allocator, .already_installed, "tree", null);
+    output.emitNdjsonEvent(.would_install, "wget", null);
+    output.emitNdjsonEvent(.already_installed, "tree", null);
 
     try testing.expectEqual(@as(usize, 2), std.mem.count(u8, buf.items, "\n"));
     try testing.expect(std.mem.indexOf(u8, buf.items, "\"event\":\"would_install\"") != null);
diff --git a/tests/output_test.zig b/tests/output_test.zig
index 6de9854..548e3c6 100644
--- a/tests/output_test.zig
+++ b/tests/output_test.zig
@@ -429,7 +429,7 @@ test "emitNdjsonEvent writes nothing when ndjson is off" {
     const cap = NdjsonCapture.init(&buf, false);
     defer cap.deinit();
 
-    output.emitNdjsonEvent(testing.allocator, .downloaded, "wget", null);
+    output.emitNdjsonEvent(.downloaded, "wget", null);
     try testing.expectEqualStrings("", buf.items);
 }
 
@@ -439,7 +439,7 @@ test "emitNdjsonEvent writes one parser-clean line when ndjson is on" {
     const cap = NdjsonCapture.init(&buf, true);
     defer cap.deinit();
 
-    output.emitNdjsonEvent(testing.allocator, .downloaded, "wget", "ok");
+    output.emitNdjsonEvent(.downloaded, "wget", "ok");
     try testing.expect(std.mem.endsWith(u8, buf.items, "\n"));
     // Single line, no embedded newlines except the trailing one.
     try testing.expectEqual(@as(usize, 1), std.mem.count(u8, buf.items, "\n"));
@@ -458,7 +458,7 @@ test "emitNdjsonEvent omits status field when null" {
     const cap = NdjsonCapture.init(&buf, true);
     defer cap.deinit();
 
-    output.emitNdjsonEvent(testing.allocator, .lock_acquired, "", null);
+    output.emitNdjsonEvent(.lock_acquired, "", null);
     try testing.expect(std.mem.indexOf(u8, buf.items, "\"status\"") == null);
     try testing.expect(std.mem.indexOf(u8, buf.items, "\"event\":\"lock_acquired\"") != null);
 }
@@ -469,7 +469,7 @@ test "emitNdjsonEvent escapes adversarial name and status fields" {
     const cap = NdjsonCapture.init(&buf, true);
     defer cap.deinit();
 
-    output.emitNdjsonEvent(testing.allocator, .linked, "needs\"quote", "fa\nil");
+    output.emitNdjsonEvent(.linked, "needs\"quote", "fa\nil");
 
     const trimmed = std.mem.trimEnd(u8, buf.items, "\n");
     const parsed = try std.json.parseFromSlice(std.json.Value, testing.allocator, trimmed, .{});
@@ -490,7 +490,7 @@ test "emitNdjsonEvent silently drops events that overflow the stack buffer" {
 
     var huge: [4096]u8 = undefined;
     @memset(&huge, 'x');
-    output.emitNdjsonEvent(testing.allocator, .downloaded, &huge, "ok");
+    output.emitNdjsonEvent(.downloaded, &huge, "ok");
 
     // No partial bytes; either the full line landed or nothing did.
     if (buf.items.len > 0) {
@@ -511,6 +511,6 @@ test "emitNdjsonEvent fires under ndjson regardless of --json mode" {
     const cap = NdjsonCapture.init(&buf, true);
     defer cap.deinit();
 
-    output.emitNdjsonEvent(testing.allocator, .resolved, "tree", null);
+    output.emitNdjsonEvent(.resolved, "tree", null);
     try testing.expect(std.mem.indexOf(u8, buf.items, "\"event\":\"resolved\"") != null);
 }
diff --git a/tests/verify_test.zig b/tests/verify_test.zig
index a745d00..ace5434 100644
--- a/tests/verify_test.zig
+++ b/tests/verify_test.zig
@@ -135,7 +135,7 @@ test "verifyCosignBlob returns CosignNotFound when the binary is missing" {
     defer lio.deinit();
     var args = fake_args;
     args.cosign_bin = "/tmp/malt_nonexistent_cosign_xyz_99";
-    try testing.expectError(error.CosignNotFound, verify.verifyCosignBlob(lio.io(), testing.allocator, args));
+    try testing.expectError(error.CosignNotFound, verify.verifyCosignBlob(lio.io(), args));
 }
 
 test "verifyCosignBlob accepts a cosign that exits 0" {
@@ -147,7 +147,7 @@ test "verifyCosignBlob accepts a cosign that exits 0" {
 
     var args = fake_args;
     args.cosign_bin = path;
-    try verify.verifyCosignBlob(lio.io(), testing.allocator, args);
+    try verify.verifyCosignBlob(lio.io(), args);
 }
 
 // libc env mutators: Zig 0.16 has no std wrapper for these and the
@@ -186,7 +186,7 @@ test "verifyCosignBlob finds a bare 'cosign' via PATH (regression: gh#151)" {
     args.cosign_bin = "cosign";
     var lio = LiveIo.init();
     defer lio.deinit();
-    try verify.verifyCosignBlob(lio.io(), testing.allocator, args);
+    try verify.verifyCosignBlob(lio.io(), args);
 }
 
 // --- verifyAll (end-to-end, local fixtures) ------------------------------
@@ -450,5 +450,5 @@ test "verifyCosignBlob errors when cosign exits non-zero" {
 
     var args = fake_args;
     args.cosign_bin = path;
-    try testing.expectError(error.CosignVerifyFailed, verify.verifyCosignBlob(lio.io(), testing.allocator, args));
+    try testing.expectError(error.CosignVerifyFailed, verify.verifyCosignBlob(lio.io(), args));
 }