diff --git a/ecs.php b/ecs.php
index e8514ef0..94c025c6 100644
--- a/ecs.php
+++ b/ecs.php
@@ -2,6 +2,8 @@
 
 declare(strict_types=1);
 
+use PhpCsFixer\Fixer\ClassNotation\ClassAttributesSeparationFixer;
+use PhpCsFixer\Fixer\ClassNotation\OrderedClassElementsFixer;
 use PhpCsFixer\Fixer\Import\NoUnusedImportsFixer;
 use PhpCsFixer\Fixer\PhpTag\BlankLineAfterOpeningTagFixer;
 use Symplify\CodingStandard\Fixer\Strict\BlankLineAfterStrictTypesFixer;
@@ -17,4 +19,37 @@
         BlankLineAfterStrictTypesFixer::class,
         BlankLineAfterOpeningTagFixer::class,
         NoUnusedImportsFixer::class,
-    ]);
+    ])
+    ->withConfiguredRule(
+        OrderedClassElementsFixer::class,
+        [
+            'order' => [
+                'use_trait',
+                'case',
+                'constant_public',
+                'constant_protected',
+                'constant_private',
+                'property_public',
+                'property_protected',
+                'property_private',
+                'construct',
+                'destruct',
+                'magic',
+                'phpunit',
+                'method_public',
+                'method_protected',
+                'method_private',
+            ],
+            'sort_algorithm' => 'none',
+        ],
+    )
+    ->withConfiguredRule(
+        ClassAttributesSeparationFixer::class,
+        [
+            'elements' => [
+                'const' => 'one',
+                'property' => 'one',
+                'method' => 'one',
+            ],
+        ],
+    );
diff --git a/src/FreeDSx/Ldap/ClientOptions.php b/src/FreeDSx/Ldap/ClientOptions.php
index ab3d1b0d..53f4f995 100644
--- a/src/FreeDSx/Ldap/ClientOptions.php
+++ b/src/FreeDSx/Ldap/ClientOptions.php
@@ -202,7 +202,6 @@ public function getSslCaCert(): ?string
         return $this->sslCaCert;
     }
 
-
     public function setSslCaCert(?string $sslCaCert): self
     {
         $this->sslCaCert = $sslCaCert;
diff --git a/src/FreeDSx/Ldap/Container.php b/src/FreeDSx/Ldap/Container.php
index c796e0ee..00829c7a 100644
--- a/src/FreeDSx/Ldap/Container.php
+++ b/src/FreeDSx/Ldap/Container.php
@@ -59,11 +59,6 @@
 
 class Container
 {
-    /**
-     * @var array<class-string, callable>
-     */
-    private array $instanceFactory = [];
-
     /**
      * These are classes that should never cache an instance when retrieved from the container.
      */
@@ -72,6 +67,11 @@ class Container
         ServerAuthorization::class,
     ];
 
+    /**
+     * @var array<class-string, callable>
+     */
+    private array $instanceFactory = [];
+
     /**
      * @var array<class-string, object>
      */
diff --git a/src/FreeDSx/Ldap/Control/Control.php b/src/FreeDSx/Ldap/Control/Control.php
index 6a840832..b2de37df 100644
--- a/src/FreeDSx/Ldap/Control/Control.php
+++ b/src/FreeDSx/Ldap/Control/Control.php
@@ -100,6 +100,11 @@ public function __construct(
         protected AbstractType|ProtocolElementInterface|string|null $controlValue = null,
     ) {}
 
+    public function __toString(): string
+    {
+        return $this->controlType;
+    }
+
     public function setTypeOid(string $oid): static
     {
         $this->controlType = $oid;
@@ -164,11 +169,6 @@ public function toAsn1(): SequenceType
         return $asn1;
     }
 
-    public function __toString(): string
-    {
-        return $this->controlType;
-    }
-
     /**
      * {@inheritDoc}
      *
diff --git a/src/FreeDSx/Ldap/Controls.php b/src/FreeDSx/Ldap/Controls.php
index a509374d..f4c13fd5 100644
--- a/src/FreeDSx/Ldap/Controls.php
+++ b/src/FreeDSx/Ldap/Controls.php
@@ -124,7 +124,6 @@ public static function manageDsaIt(): Control
         );
     }
 
-
     /**
      * Create a paging control with a specific size.
      */
diff --git a/src/FreeDSx/Ldap/Entry/Attribute.php b/src/FreeDSx/Ldap/Entry/Attribute.php
index e68c0857..8ab89e83 100644
--- a/src/FreeDSx/Ldap/Entry/Attribute.php
+++ b/src/FreeDSx/Ldap/Entry/Attribute.php
@@ -76,6 +76,11 @@ public function __clone()
         }
     }
 
+    public function __toString(): string
+    {
+        return implode(', ', $this->values);
+    }
+
     /**
      * @param string[] $values
      */
@@ -299,11 +304,6 @@ public function equals(
         return $nameMatches;
     }
 
-    public function __toString(): string
-    {
-        return implode(', ', $this->values);
-    }
-
     /**
      * Escape an attribute value for a filter.
      */
diff --git a/src/FreeDSx/Ldap/Entry/Dn.php b/src/FreeDSx/Ldap/Entry/Dn.php
index 473dcb6f..1521c5f4 100644
--- a/src/FreeDSx/Ldap/Entry/Dn.php
+++ b/src/FreeDSx/Ldap/Entry/Dn.php
@@ -43,6 +43,11 @@ class Dn implements IteratorAggregate, Countable, Stringable
 
     public function __construct(private readonly string $dn) {}
 
+    public function __toString(): string
+    {
+        return $this->dn;
+    }
+
     /**
      * @throws UnexpectedValueException
      */
@@ -102,11 +107,6 @@ public function count(): int
         return count((array) $this->pieces);
     }
 
-    public function __toString(): string
-    {
-        return $this->dn;
-    }
-
     /**
      * @return Rdn[]
      * @throws UnexpectedValueException
diff --git a/src/FreeDSx/Ldap/Entry/Entry.php b/src/FreeDSx/Ldap/Entry/Entry.php
index 9f115938..1325aaa0 100644
--- a/src/FreeDSx/Ldap/Entry/Entry.php
+++ b/src/FreeDSx/Ldap/Entry/Entry.php
@@ -51,6 +51,39 @@ public function __construct(
         $this->changes = new Changes();
     }
 
+    public function __toString(): string
+    {
+        return $this->dn->toString();
+    }
+
+    public function __get(string $name): ?Attribute
+    {
+        return $this->get($name);
+    }
+
+    /**
+     * @param Stringable|string|array<string|Stringable> $value
+     */
+    public function __set(
+        string $name,
+        Stringable|string|array $value,
+    ): void {
+        $this->set(
+            $name,
+            ...(is_array($value) ? $value : [(string) $value]),
+        );
+    }
+
+    public function __isset(string $name): bool
+    {
+        return $this->has($name);
+    }
+
+    public function __unset(string $name): void
+    {
+        $this->reset($name);
+    }
+
     /**
      * @internal
      * @param Attribute[] $attributes
@@ -281,39 +314,6 @@ public function count(): int
         return count($this->attributes);
     }
 
-    public function __toString(): string
-    {
-        return $this->dn->toString();
-    }
-
-    public function __get(string $name): ?Attribute
-    {
-        return $this->get($name);
-    }
-
-    /**
-     * @param Stringable|string|array<string|Stringable> $value
-     */
-    public function __set(
-        string $name,
-        Stringable|string|array $value,
-    ): void {
-        $this->set(
-            $name,
-            ...(is_array($value) ? $value : [(string) $value]),
-        );
-    }
-
-    public function __isset(string $name): bool
-    {
-        return $this->has($name);
-    }
-
-    public function __unset(string $name): void
-    {
-        $this->reset($name);
-    }
-
     /**
      * An alias of fromArray().
      *
diff --git a/src/FreeDSx/Ldap/Entry/Option.php b/src/FreeDSx/Ldap/Entry/Option.php
index f6394c73..90c42791 100644
--- a/src/FreeDSx/Ldap/Entry/Option.php
+++ b/src/FreeDSx/Ldap/Entry/Option.php
@@ -34,6 +34,11 @@ class Option implements Stringable
 
     public function __construct(private readonly string $option) {}
 
+    public function __toString(): string
+    {
+        return $this->option;
+    }
+
     public function isLanguageTag(): bool
     {
         return $this->startsWith('lang-');
@@ -115,11 +120,6 @@ public function toString(bool $lowercase = false): string
         return $this->option;
     }
 
-    public function __toString(): string
-    {
-        return $this->option;
-    }
-
     /**
      * Convenience factory method for creating a range option.
      *
diff --git a/src/FreeDSx/Ldap/Entry/Options.php b/src/FreeDSx/Ldap/Entry/Options.php
index 8f432c84..c124a819 100644
--- a/src/FreeDSx/Ldap/Entry/Options.php
+++ b/src/FreeDSx/Ldap/Entry/Options.php
@@ -42,6 +42,11 @@ public function __construct(string|Option ...$options)
         $this->set(...$options);
     }
 
+    public function __toString(): string
+    {
+        return $this->toString();
+    }
+
     public function add(string|Option ...$options): self
     {
         foreach ($options as $option) {
@@ -139,11 +144,6 @@ public function toArray(): array
         return $this->options;
     }
 
-    public function __toString(): string
-    {
-        return $this->toString();
-    }
-
     /**
      * @inheritDoc
      * @return Traversable<Option>
diff --git a/src/FreeDSx/Ldap/Entry/Rdn.php b/src/FreeDSx/Ldap/Entry/Rdn.php
index 13673bd9..653fed63 100644
--- a/src/FreeDSx/Ldap/Entry/Rdn.php
+++ b/src/FreeDSx/Ldap/Entry/Rdn.php
@@ -56,6 +56,11 @@ public function __construct(
         private readonly string $value,
     ) {}
 
+    public function __toString(): string
+    {
+        return $this->toString();
+    }
+
     public function getName(): string
     {
         return $this->name;
@@ -117,11 +122,6 @@ public function toString(): string
         return $rdn;
     }
 
-    public function __toString(): string
-    {
-        return $this->toString();
-    }
-
     /**
      * @throws InvalidArgumentException
      */
diff --git a/src/FreeDSx/Ldap/LdapClient.php b/src/FreeDSx/Ldap/LdapClient.php
index 08253ea9..5cabe9c2 100644
--- a/src/FreeDSx/Ldap/LdapClient.php
+++ b/src/FreeDSx/Ldap/LdapClient.php
@@ -74,6 +74,17 @@ public function __construct(
         ]);
     }
 
+    /**
+     * Try to clean-up if needed.
+     *
+     * @throws Exception\ConnectionException
+     * @throws OperationException
+     */
+    public function __destruct()
+    {
+        $this->unbindIfConnected();
+    }
+
     /**
      * A Simple Bind to LDAP with a username and password.
      *
@@ -488,17 +499,6 @@ public function isConnected(): bool
             ->isInstantiatedAndConnected();
     }
 
-    /**
-     * Try to clean-up if needed.
-     *
-     * @throws Exception\ConnectionException
-     * @throws OperationException
-     */
-    public function __destruct()
-    {
-        $this->unbindIfConnected();
-    }
-
     private function handler(): ClientProtocolHandler
     {
         if ($this->handler === null) {
diff --git a/src/FreeDSx/Ldap/LdapServer.php b/src/FreeDSx/Ldap/LdapServer.php
index d3f4f737..06bda7b7 100644
--- a/src/FreeDSx/Ldap/LdapServer.php
+++ b/src/FreeDSx/Ldap/LdapServer.php
@@ -93,37 +93,6 @@ public function useAccessControl(AccessControlInterface $acl): self
         return $this;
     }
 
-    private function init(): void
-    {
-        $this->options->setAccessControl($this->resolveAccessControl());
-    }
-
-    private function resolveAccessControl(): AccessControlInterface
-    {
-        if ($this->accessControl !== null) {
-            return $this->injectBackendIfNeeded($this->accessControl);
-        }
-
-        $aclRules = $this->options->getAclRules();
-
-        if ($aclRules->isEmpty()) {
-            return $this->options->getAccessControl();
-        }
-
-        return $this->injectBackendIfNeeded(new RuleBasedAccessControl($aclRules));
-    }
-
-    private function injectBackendIfNeeded(AccessControlInterface $acl): AccessControlInterface
-    {
-        $backend = $this->options->getBackend();
-
-        if ($backend !== null && $acl instanceof BackendAwareInterface) {
-            $acl->setBackend($backend);
-        }
-
-        return $acl;
-    }
-
     /**
      * Get the options currently set for the LDAP server.
      */
@@ -186,24 +155,6 @@ public function seed(
         return $this;
     }
 
-    /**
-     * @return Generator<Entry>
-     * @throws RuntimeException when the LDIF contains a non-add change record
-     * @throws LdifParseException
-     */
-    private function streamSeedEntries(LdifLoaderInterface $loader): Generator
-    {
-        foreach ((new LdifParser())->parse($loader) as $request) {
-            if (!$request instanceof AddRequest) {
-                throw new RuntimeException(
-                    'seed() only accepts content records (adds). Use applyChanges() for modify/delete/rename.',
-                );
-            }
-
-            yield $request->getEntry();
-        }
-    }
-
     /**
      * Replays an LDIF changelog against the configured backend via the live write path.
      *
@@ -256,20 +207,6 @@ public function dump(
         return $this;
     }
 
-    private function buildSchemaValidator(): ?SchemaValidator
-    {
-        $mode = $this->options->getSchemaValidationMode();
-
-        if ($mode === SchemaValidationMode::Off) {
-            return null;
-        }
-
-        return new SchemaValidator(
-            $this->options->getSchema(),
-            $mode,
-        );
-    }
-
     /**
      * Specify a backend to use for incoming LDAP requests.
      */
@@ -382,4 +319,67 @@ public static function makeProxy(
             ]),
         );
     }
+
+    private function init(): void
+    {
+        $this->options->setAccessControl($this->resolveAccessControl());
+    }
+
+    private function resolveAccessControl(): AccessControlInterface
+    {
+        if ($this->accessControl !== null) {
+            return $this->injectBackendIfNeeded($this->accessControl);
+        }
+
+        $aclRules = $this->options->getAclRules();
+
+        if ($aclRules->isEmpty()) {
+            return $this->options->getAccessControl();
+        }
+
+        return $this->injectBackendIfNeeded(new RuleBasedAccessControl($aclRules));
+    }
+
+    private function injectBackendIfNeeded(AccessControlInterface $acl): AccessControlInterface
+    {
+        $backend = $this->options->getBackend();
+
+        if ($backend !== null && $acl instanceof BackendAwareInterface) {
+            $acl->setBackend($backend);
+        }
+
+        return $acl;
+    }
+
+    /**
+     * @return Generator<Entry>
+     * @throws RuntimeException when the LDIF contains a non-add change record
+     * @throws LdifParseException
+     */
+    private function streamSeedEntries(LdifLoaderInterface $loader): Generator
+    {
+        foreach ((new LdifParser())->parse($loader) as $request) {
+            if (!$request instanceof AddRequest) {
+                throw new RuntimeException(
+                    'seed() only accepts content records (adds). Use applyChanges() for modify/delete/rename.',
+                );
+            }
+
+            yield $request->getEntry();
+        }
+    }
+
+    private function buildSchemaValidator(): ?SchemaValidator
+    {
+        $mode = $this->options->getSchemaValidationMode();
+
+        if ($mode === SchemaValidationMode::Off) {
+            return null;
+        }
+
+        return new SchemaValidator(
+            $this->options->getSchema(),
+            $mode,
+        );
+    }
 }
diff --git a/src/FreeDSx/Ldap/LdapUrl.php b/src/FreeDSx/Ldap/LdapUrl.php
index b5858976..4c49a3b6 100644
--- a/src/FreeDSx/Ldap/LdapUrl.php
+++ b/src/FreeDSx/Ldap/LdapUrl.php
@@ -78,6 +78,11 @@ public function __construct(?string $host = null)
         $this->host = $host;
     }
 
+    public function __toString(): string
+    {
+        return $this->toString();
+    }
+
     public function setDn(Dn|string|null $dn): self
     {
         $this->dn = $dn === null
@@ -218,11 +223,6 @@ public function toString(): string
             . $this->getQueryString();
     }
 
-    public function __toString(): string
-    {
-        return $this->toString();
-    }
-
     /**
      * Given a string LDAP URL, get its object representation.
      *
diff --git a/src/FreeDSx/Ldap/LdapUrlExtension.php b/src/FreeDSx/Ldap/LdapUrlExtension.php
index 1449bf7a..cc7cca35 100644
--- a/src/FreeDSx/Ldap/LdapUrlExtension.php
+++ b/src/FreeDSx/Ldap/LdapUrlExtension.php
@@ -48,6 +48,11 @@ public function __construct(
         $this->isCritical = $isCritical;
     }
 
+    public function __toString(): string
+    {
+        return $this->toString();
+    }
+
     public function getName(): string
     {
         return $this->name;
@@ -99,11 +104,6 @@ public function toString(): string
         return $ext;
     }
 
-    public function __toString(): string
-    {
-        return $this->toString();
-    }
-
     /**
      * @throws UrlParseException
      */
diff --git a/src/FreeDSx/Ldap/Ldif/Output/StringLdifOutput.php b/src/FreeDSx/Ldap/Ldif/Output/StringLdifOutput.php
index 80de5077..5f3a22a1 100644
--- a/src/FreeDSx/Ldap/Ldif/Output/StringLdifOutput.php
+++ b/src/FreeDSx/Ldap/Ldif/Output/StringLdifOutput.php
@@ -26,6 +26,11 @@ final class StringLdifOutput implements LdifOutputInterface, Stringable
 {
     private string $ldif = '';
 
+    public function __toString(): string
+    {
+        return $this->ldif;
+    }
+
     /**
      * @param iterable<string> $chunks
      */
@@ -40,9 +45,4 @@ public function getLdif(): string
     {
         return $this->ldif;
     }
-
-    public function __toString(): string
-    {
-        return $this->ldif;
-    }
 }
diff --git a/src/FreeDSx/Ldap/Ldif/Parser/LdifLineCursor.php b/src/FreeDSx/Ldap/Ldif/Parser/LdifLineCursor.php
index 27d7a23f..ae6a55cd 100644
--- a/src/FreeDSx/Ldap/Ldif/Parser/LdifLineCursor.php
+++ b/src/FreeDSx/Ldap/Ldif/Parser/LdifLineCursor.php
@@ -100,17 +100,6 @@ public function advance(): void
         $this->source->next();
     }
 
-    /**
-     * @param iterable<string> $lines
-     * @return Generator<int, string>
-     */
-    private static function toGenerator(iterable $lines): Generator
-    {
-        foreach ($lines as $line) {
-            yield $line;
-        }
-    }
-
     /**
      * Reads the directive at the cursor, consuming any folded continuation lines.
      *
@@ -211,27 +200,6 @@ public function keyOf(string $line): string
             : strtolower(substr($line, 0, $colon));
     }
 
-    /**
-     * @throws LdifParseException
-     */
-    private function decodeBase64(
-        string $raw,
-        int $line,
-        ?string $sourceLine,
-    ): string {
-        $decoded = base64_decode($raw, true);
-
-        if ($decoded === false) {
-            $this->errorAt(
-                $line,
-                $sourceLine,
-                'A base64-encoded value is not valid',
-            );
-        }
-
-        return $decoded;
-    }
-
     /**
      * @throws LdifParseException
      */
@@ -272,4 +240,36 @@ public function errorFor(
             $message,
         );
     }
+
+    /**
+     * @param iterable<string> $lines
+     * @return Generator<int, string>
+     */
+    private static function toGenerator(iterable $lines): Generator
+    {
+        foreach ($lines as $line) {
+            yield $line;
+        }
+    }
+
+    /**
+     * @throws LdifParseException
+     */
+    private function decodeBase64(
+        string $raw,
+        int $line,
+        ?string $sourceLine,
+    ): string {
+        $decoded = base64_decode($raw, true);
+
+        if ($decoded === false) {
+            $this->errorAt(
+                $line,
+                $sourceLine,
+                'A base64-encoded value is not valid',
+            );
+        }
+
+        return $decoded;
+    }
 }
diff --git a/src/FreeDSx/Ldap/Operation/Request/ExtendedRequest.php b/src/FreeDSx/Ldap/Operation/Request/ExtendedRequest.php
index d14e6233..2bab6525 100644
--- a/src/FreeDSx/Ldap/Operation/Request/ExtendedRequest.php
+++ b/src/FreeDSx/Ldap/Operation/Request/ExtendedRequest.php
@@ -38,8 +38,6 @@
  */
 class ExtendedRequest implements RequestInterface
 {
-    protected const APP_TAG = 23;
-
     /**
      * Represents a request to cancel an operation. RFC 3909.
      */
@@ -60,13 +58,15 @@ class ExtendedRequest implements RequestInterface
      */
     public const OID_PWD_MODIFY = '1.3.6.1.4.1.4203.1.11.1';
 
-    private string $requestName;
+    protected const APP_TAG = 23;
 
     /**
      * @var null|string|AbstractType<mixed>|ProtocolElementInterface
      */
     protected string|AbstractType|ProtocolElementInterface|null $requestValue;
 
+    private string $requestName;
+
     /**
      * @param null|string|AbstractType<mixed>|ProtocolElementInterface $requestValue
      */
diff --git a/src/FreeDSx/Ldap/Operation/Response/ExtendedResponse.php b/src/FreeDSx/Ldap/Operation/Response/ExtendedResponse.php
index 3e716209..ddf7f6ba 100644
--- a/src/FreeDSx/Ldap/Operation/Response/ExtendedResponse.php
+++ b/src/FreeDSx/Ldap/Operation/Response/ExtendedResponse.php
@@ -127,29 +127,6 @@ public function toAsn1(): SequenceType
         return $asn1;
     }
 
-    /**
-     * @param AbstractType<mixed> $type
-     * @return array{0: ?string, 1: ?string}
-     */
-    private static function parseExtendedResponse(AbstractType $type): array
-    {
-        $info = [0 => null, 1 => null];
-
-        foreach ($type->getChildren() as $child) {
-            $tagNumber = $child->getTagNumber();
-            if ($tagNumber !== 10 && $tagNumber !== 11) {
-                continue;
-            }
-            $value = $child->getValue();
-            if ($value !== null && !is_string($value)) {
-                continue;
-            }
-            $info[$tagNumber === 10 ? 0 : 1] = $value;
-        }
-
-        return $info;
-    }
-
     /**
      * @param AbstractType<mixed> $type
      * @throws ProtocolException
@@ -185,4 +162,27 @@ protected static function decodeEncodedValue(AbstractType $type): ?AbstractType
             ? null
             : (new LdapEncoder())->decode($value);
     }
+
+    /**
+     * @param AbstractType<mixed> $type
+     * @return array{0: ?string, 1: ?string}
+     */
+    private static function parseExtendedResponse(AbstractType $type): array
+    {
+        $info = [0 => null, 1 => null];
+
+        foreach ($type->getChildren() as $child) {
+            $tagNumber = $child->getTagNumber();
+            if ($tagNumber !== 10 && $tagNumber !== 11) {
+                continue;
+            }
+            $value = $child->getValue();
+            if ($value !== null && !is_string($value)) {
+                continue;
+            }
+            $info[$tagNumber === 10 ? 0 : 1] = $value;
+        }
+
+        return $info;
+    }
 }
diff --git a/src/FreeDSx/Ldap/Operation/Response/IntermediateResponse.php b/src/FreeDSx/Ldap/Operation/Response/IntermediateResponse.php
index 65468687..a8015431 100644
--- a/src/FreeDSx/Ldap/Operation/Response/IntermediateResponse.php
+++ b/src/FreeDSx/Ldap/Operation/Response/IntermediateResponse.php
@@ -55,14 +55,6 @@ public function __construct(
         $this->responseValue = $responseValue;
     }
 
-    /**
-     * @param AbstractType<mixed> $valueToEncode
-     */
-    protected function setResponseValueToEncode(AbstractType $valueToEncode): void
-    {
-        $this->responseValueToEncode = $valueToEncode;
-    }
-
     public function getName(): ?string
     {
         return $this->responseName;
@@ -111,24 +103,6 @@ public static function fromAsn1(AbstractType $type): IntermediateResponse
         );
     }
 
-    /**
-     * @param AbstractType<mixed> $responseName
-     */
-    private static function isNotValidResponseName(AbstractType $responseName): bool
-    {
-        return $responseName->getTagNumber() !== 0
-            || $responseName->getTagClass() !== AbstractType::TAG_CLASS_CONTEXT_SPECIFIC;
-    }
-
-    /**
-     * @param AbstractType<mixed> $responseValue
-     */
-    private static function isNotValidResponseValue(AbstractType $responseValue): bool
-    {
-        return $responseValue->getTagNumber() !== 1
-            || $responseValue->getTagClass() !== AbstractType::TAG_CLASS_CONTEXT_SPECIFIC;
-    }
-
     public function toAsn1(): SequenceType
     {
         $response = Asn1::sequence();
@@ -157,6 +131,14 @@ public function toAsn1(): SequenceType
         );
     }
 
+    /**
+     * @param AbstractType<mixed> $valueToEncode
+     */
+    protected function setResponseValueToEncode(AbstractType $valueToEncode): void
+    {
+        $this->responseValueToEncode = $valueToEncode;
+    }
+
     /**
      * @param AbstractType<mixed> $type
      * @param array<int, array<int, int>> $tagMap
@@ -212,4 +194,22 @@ protected static function decodeResponseName(AbstractType $type): string
 
         return $rawValue;
     }
+
+    /**
+     * @param AbstractType<mixed> $responseName
+     */
+    private static function isNotValidResponseName(AbstractType $responseName): bool
+    {
+        return $responseName->getTagNumber() !== 0
+            || $responseName->getTagClass() !== AbstractType::TAG_CLASS_CONTEXT_SPECIFIC;
+    }
+
+    /**
+     * @param AbstractType<mixed> $responseValue
+     */
+    private static function isNotValidResponseValue(AbstractType $responseValue): bool
+    {
+        return $responseValue->getTagNumber() !== 1
+            || $responseValue->getTagClass() !== AbstractType::TAG_CLASS_CONTEXT_SPECIFIC;
+    }
 }
diff --git a/src/FreeDSx/Ldap/Operation/Response/SyncInfo/SyncRefreshDoneTrait.php b/src/FreeDSx/Ldap/Operation/Response/SyncInfo/SyncRefreshDoneTrait.php
index 6f9fe4ac..d6364c85 100644
--- a/src/FreeDSx/Ldap/Operation/Response/SyncInfo/SyncRefreshDoneTrait.php
+++ b/src/FreeDSx/Ldap/Operation/Response/SyncInfo/SyncRefreshDoneTrait.php
@@ -30,8 +30,6 @@ trait SyncRefreshDoneTrait
 {
     private bool $refreshDone;
 
-    abstract protected static function valueTag(): int;
-
     public function __construct(
         bool $refreshDone = true,
         ?string $cookie = null,
@@ -108,4 +106,6 @@ public static function fromAsn1(AbstractType $type): IntermediateResponse
             $cookie,
         );
     }
+
+    abstract protected static function valueTag(): int;
 }
diff --git a/src/FreeDSx/Ldap/Protocol/Bind/Sasl/OptionsBuilder/RequireIdentityTrait.php b/src/FreeDSx/Ldap/Protocol/Bind/Sasl/OptionsBuilder/RequireIdentityTrait.php
index e15c163d..5adca5da 100644
--- a/src/FreeDSx/Ldap/Protocol/Bind/Sasl/OptionsBuilder/RequireIdentityTrait.php
+++ b/src/FreeDSx/Ldap/Protocol/Bind/Sasl/OptionsBuilder/RequireIdentityTrait.php
@@ -27,6 +27,11 @@ trait RequireIdentityTrait
 {
     private ?Dn $resolvedDn = null;
 
+    public function getResolvedDn(): ?Dn
+    {
+        return $this->resolvedDn;
+    }
+
     /**
      * Validates the identity, stores its resolved DN, and returns it.
      *
@@ -45,9 +50,4 @@ private function requireIdentity(?SaslIdentity $identity): SaslIdentity
 
         return $identity;
     }
-
-    public function getResolvedDn(): ?Dn
-    {
-        return $this->resolvedDn;
-    }
 }
diff --git a/src/FreeDSx/Ldap/Protocol/Bind/SimpleBind.php b/src/FreeDSx/Ldap/Protocol/Bind/SimpleBind.php
index f47ff279..5a3c49fa 100644
--- a/src/FreeDSx/Ldap/Protocol/Bind/SimpleBind.php
+++ b/src/FreeDSx/Ldap/Protocol/Bind/SimpleBind.php
@@ -89,14 +89,6 @@ public function bind(LdapMessageRequest $message): TokenInterface
         return $token;
     }
 
-    private function simpleBind(SimpleBindRequest $request): TokenInterface
-    {
-        return $this->authenticator->authenticate(
-            $request->getUsername(),
-            $request->getPassword(),
-        );
-    }
-
     /**
      * @inheritDoc
      */
@@ -104,4 +96,12 @@ public function supports(LdapMessageRequest $request): bool
     {
         return $request->getRequest() instanceof SimpleBindRequest;
     }
+
+    private function simpleBind(SimpleBindRequest $request): TokenInterface
+    {
+        return $this->authenticator->authenticate(
+            $request->getUsername(),
+            $request->getPassword(),
+        );
+    }
 }
diff --git a/src/FreeDSx/Ldap/Protocol/ClientProtocolHandler/ClientBasicHandler.php b/src/FreeDSx/Ldap/Protocol/ClientProtocolHandler/ClientBasicHandler.php
index a093b6d3..df91d7c1 100644
--- a/src/FreeDSx/Ldap/Protocol/ClientProtocolHandler/ClientBasicHandler.php
+++ b/src/FreeDSx/Ldap/Protocol/ClientProtocolHandler/ClientBasicHandler.php
@@ -35,8 +35,6 @@
  */
 class ClientBasicHandler implements RequestHandlerInterface, ResponseHandlerInterface
 {
-    public function __construct(private readonly ClientQueue $queue) {}
-
     /**
      * RFC 4511, A.1. These are considered result codes that do not indicate an error condition.
      */
@@ -49,6 +47,8 @@ public function __construct(private readonly ClientQueue $queue) {}
         ResultCode::CANCELED,
     ];
 
+    public function __construct(private readonly ClientQueue $queue) {}
+
     /**
      * @throws ProtocolException
      * @throws UnsolicitedNotificationException
diff --git a/src/FreeDSx/Ldap/Protocol/LdapQueue.php b/src/FreeDSx/Ldap/Protocol/LdapQueue.php
index b9772894..fe2e933e 100644
--- a/src/FreeDSx/Ldap/Protocol/LdapQueue.php
+++ b/src/FreeDSx/Ldap/Protocol/LdapQueue.php
@@ -107,6 +107,11 @@ public function setMessageWrapper(?MessageWrapperInterface $messageWrapper): sta
         return $this;
     }
 
+    public function isConnected(): bool
+    {
+        return $this->socket->isConnected();
+    }
+
     /**
      * {@inheritDoc}
      */
@@ -180,11 +185,6 @@ protected function onMessageEncoded(string $encoded): void {}
      */
     protected function onMessageDecoded(Message $message): void {}
 
-    public function isConnected(): bool
-    {
-        return $this->socket->isConnected();
-    }
-
     /**
      * True if data is already buffered or available on the socket without blocking.
      */
diff --git a/src/FreeDSx/Ldap/Protocol/Queue/ServerQueue.php b/src/FreeDSx/Ldap/Protocol/Queue/ServerQueue.php
index 6d76b50e..689be923 100644
--- a/src/FreeDSx/Ldap/Protocol/Queue/ServerQueue.php
+++ b/src/FreeDSx/Ldap/Protocol/Queue/ServerQueue.php
@@ -72,26 +72,6 @@ public function __construct(
         $this->interceptors = $interceptors;
     }
 
-    /**
-     * Count the LDAP bytes sent for each outgoing response.
-     */
-    protected function onMessageEncoded(string $encoded): void
-    {
-        $this->metricsRecorder->trafficObserved(new TrafficObservation(
-            bytesSent: strlen($encoded),
-        ));
-    }
-
-    /**
-     * Count the LDAP bytes received for each decoded request.
-     */
-    protected function onMessageDecoded(Message $message): void
-    {
-        $this->metricsRecorder->trafficObserved(new TrafficObservation(
-            bytesReceived: (int) $message->getLastPosition(),
-        ));
-    }
-
     /**
      * @throws ProtocolException
      * @throws UnsolicitedNotificationException
@@ -164,6 +144,44 @@ public function sendMessages(iterable $responses): self
         return $this;
     }
 
+    /**
+     * Count the LDAP bytes sent for each outgoing response.
+     */
+    protected function onMessageEncoded(string $encoded): void
+    {
+        $this->metricsRecorder->trafficObserved(new TrafficObservation(
+            bytesSent: strlen($encoded),
+        ));
+    }
+
+    /**
+     * Count the LDAP bytes received for each decoded request.
+     */
+    protected function onMessageDecoded(Message $message): void
+    {
+        $this->metricsRecorder->trafficObserved(new TrafficObservation(
+            bytesReceived: (int) $message->getLastPosition(),
+        ));
+    }
+
+    /**
+     * {@inheritDoc}
+     * @throws ProtocolException
+     * @throws EncoderException
+     * @throws PartialPduException
+     * @throws RuntimeException
+     */
+    protected function constructMessage(Message $message, ?int $id = null): LdapMessageRequest
+    {
+        $type = $message->getMessage();
+
+        if (!$type instanceof AbstractType) {
+            throw new ProtocolException('The message received is invalid.');
+        }
+
+        return LdapMessageRequest::fromAsn1($type);
+    }
+
     /**
      * Apply each interceptor to a response one message at a time, preserving lazy streaming.
      *
@@ -198,22 +216,4 @@ private function isAbandonOrCancelRequest(
         return ($request instanceof AbandonRequest || $request instanceof CancelRequest)
             && $request->getMessageId() === $inFlightMessageId;
     }
-
-    /**
-     * {@inheritDoc}
-     * @throws ProtocolException
-     * @throws EncoderException
-     * @throws PartialPduException
-     * @throws RuntimeException
-     */
-    protected function constructMessage(Message $message, ?int $id = null): LdapMessageRequest
-    {
-        $type = $message->getMessage();
-
-        if (!$type instanceof AbstractType) {
-            throw new ProtocolException('The message received is invalid.');
-        }
-
-        return LdapMessageRequest::fromAsn1($type);
-    }
 }
diff --git a/src/FreeDSx/Ldap/Schema/Definition/AttributeTypeOid.php b/src/FreeDSx/Ldap/Schema/Definition/AttributeTypeOid.php
index 73040adc..036862dc 100644
--- a/src/FreeDSx/Ldap/Schema/Definition/AttributeTypeOid.php
+++ b/src/FreeDSx/Ldap/Schema/Definition/AttributeTypeOid.php
@@ -21,201 +21,305 @@
 final class AttributeTypeOid
 {
     public const OID_OBJECT_CLASS = '2.5.4.0';
+
     public const NAME_OBJECT_CLASS = 'objectClass';
+
     public const DESC_OBJECT_CLASS = 'object classes of the entity';
 
     public const OID_ALIASED_OBJECT_NAME = '2.5.4.1';
+
     public const NAME_ALIASED_OBJECT_NAME = 'aliasedObjectName';
+
     public const ALIAS_ALIASED_OBJECT_NAME = 'aliasedEntryName';
+
     public const DESC_ALIASED_OBJECT_NAME = 'name of aliased object';
 
     public const OID_NAME = '2.5.4.41';
+
     public const NAME_NAME = 'name';
+
     public const DESC_NAME = 'common supertype of name attributes';
 
     public const OID_CN = '2.5.4.3';
+
     public const NAME_CN = 'cn';
+
     public const ALIAS_CN = 'commonName';
+
     public const DESC_CN = 'common name(s) of the object';
 
     public const OID_SN = '2.5.4.4';
+
     public const NAME_SN = 'sn';
+
     public const ALIAS_SN = 'surname';
+
     public const DESC_SN = 'last (family) name(s) for which the entity is known';
 
     public const OID_GIVEN_NAME = '2.5.4.42';
+
     public const NAME_GIVEN_NAME = 'givenName';
+
     public const DESC_GIVEN_NAME = 'first name(s) for which the entity is known';
 
     public const OID_INITIALS = '2.5.4.43';
+
     public const NAME_INITIALS = 'initials';
+
     public const DESC_INITIALS = 'initials of some or all of the names';
 
     public const OID_C = '2.5.4.6';
+
     public const NAME_C = 'c';
+
     public const ALIAS_C = 'countryName';
+
     public const DESC_C = 'two-letter ISO 3166 country code';
 
     public const OID_L = '2.5.4.7';
+
     public const NAME_L = 'l';
+
     public const ALIAS_L = 'localityName';
+
     public const DESC_L = 'locality in which the entity resides';
 
     public const OID_ST = '2.5.4.8';
+
     public const NAME_ST = 'st';
+
     public const ALIAS_ST = 'stateOrProvinceName';
+
     public const DESC_ST = 'state or province in which the entity resides';
 
     public const OID_STREET = '2.5.4.9';
+
     public const NAME_STREET = 'street';
+
     public const ALIAS_STREET = 'streetAddress';
+
     public const DESC_STREET = 'site for the local distribution of postal addresses';
 
     public const OID_O = '2.5.4.10';
+
     public const NAME_O = 'o';
+
     public const ALIAS_O = 'organizationName';
+
     public const DESC_O = 'organization(s) to which the entity belongs';
 
     public const OID_OU = '2.5.4.11';
+
     public const NAME_OU = 'ou';
+
     public const ALIAS_OU = 'organizationalUnitName';
+
     public const DESC_OU = 'organizational units of which the entity is a member';
 
     public const OID_TITLE = '2.5.4.12';
+
     public const NAME_TITLE = 'title';
+
     public const DESC_TITLE = 'title(s) held by the entity';
 
     public const OID_DESCRIPTION = '2.5.4.13';
+
     public const NAME_DESCRIPTION = 'description';
+
     public const DESC_DESCRIPTION = 'descriptive information';
 
     public const OID_POSTAL_CODE = '2.5.4.17';
+
     public const NAME_POSTAL_CODE = 'postalCode';
+
     public const DESC_POSTAL_CODE = 'codes used by a postal service';
 
     public const OID_TELEPHONE_NUMBER = '2.5.4.20';
+
     public const NAME_TELEPHONE_NUMBER = 'telephoneNumber';
+
     public const DESC_TELEPHONE_NUMBER = 'telephone numbers';
 
     public const OID_MEMBER = '2.5.4.31';
+
     public const NAME_MEMBER = 'member';
+
     public const DESC_MEMBER = 'distinguished names of objects on a list or in a group';
 
     public const OID_SEE_ALSO = '2.5.4.34';
+
     public const NAME_SEE_ALSO = 'seeAlso';
+
     public const DESC_SEE_ALSO = 'distinguished name(s) of objects related to the entity';
 
     public const OID_USER_PASSWORD = '2.5.4.35';
+
     public const NAME_USER_PASSWORD = 'userPassword';
+
     public const DESC_USER_PASSWORD = 'passwords used to authenticate the entity';
 
     public const OID_UNIQUE_MEMBER = '2.5.4.50';
+
     public const NAME_UNIQUE_MEMBER = 'uniqueMember';
+
     public const DESC_UNIQUE_MEMBER = 'distinguished names with optional unique identifiers';
 
     public const OID_UID = '0.9.2342.19200300.100.1.1';
+
     public const NAME_UID = 'uid';
+
     public const ALIAS_UID = 'userid';
+
     public const DESC_UID = 'user identifiers';
 
     public const OID_MAIL = '0.9.2342.19200300.100.1.3';
+
     public const NAME_MAIL = 'mail';
+
     public const ALIAS_MAIL = 'rfc822Mailbox';
+
     public const DESC_MAIL = 'electronic mail addresses';
 
     public const OID_DC = '0.9.2342.19200300.100.1.25';
+
     public const NAME_DC = 'dc';
+
     public const ALIAS_DC = 'domainComponent';
+
     public const DESC_DC = 'DNS label of the domain component';
 
     public const OID_JPEG_PHOTO = '0.9.2342.19200300.100.1.60';
+
     public const NAME_JPEG_PHOTO = 'jpegPhoto';
+
     public const DESC_JPEG_PHOTO = 'JPEG images';
 
     public const OID_DISPLAY_NAME = '2.16.840.1.113730.3.1.241';
+
     public const NAME_DISPLAY_NAME = 'displayName';
+
     public const DESC_DISPLAY_NAME = 'preferred name for display';
 
     public const OID_EMPLOYEE_NUMBER = '2.16.840.1.113730.3.1.3';
+
     public const NAME_EMPLOYEE_NUMBER = 'employeeNumber';
+
     public const DESC_EMPLOYEE_NUMBER = 'numerically identifies an employee within an organization';
 
     public const OID_MEMBER_OF = '1.2.840.113556.1.2.102';
+
     public const NAME_MEMBER_OF = 'memberOf';
+
     public const DESC_MEMBER_OF = 'distinguished names of groups the entity is a member of';
 
     public const OID_LABELED_URI = '1.3.6.1.4.1.250.1.57';
+
     public const NAME_LABELED_URI = 'labeledURI';
+
     public const DESC_LABELED_URI = 'URIs with optional labels';
 
     public const OID_CREATE_TIMESTAMP = '2.5.18.1';
+
     public const NAME_CREATE_TIMESTAMP = 'createTimestamp';
+
     public const DESC_CREATE_TIMESTAMP = 'time at which the object was created';
 
     public const OID_MODIFY_TIMESTAMP = '2.5.18.2';
+
     public const NAME_MODIFY_TIMESTAMP = 'modifyTimestamp';
+
     public const DESC_MODIFY_TIMESTAMP = 'time at which the object was last modified';
 
     public const OID_CREATORS_NAME = '2.5.18.3';
+
     public const NAME_CREATORS_NAME = 'creatorsName';
+
     public const DESC_CREATORS_NAME = 'name of the creator of the object';
 
     public const OID_MODIFIERS_NAME = '2.5.18.4';
+
     public const NAME_MODIFIERS_NAME = 'modifiersName';
+
     public const DESC_MODIFIERS_NAME = 'name of the last modifier of the object';
 
     public const OID_SUBSCHEMA_SUBENTRY = '2.5.18.10';
+
     public const NAME_SUBSCHEMA_SUBENTRY = 'subschemaSubentry';
+
     public const DESC_SUBSCHEMA_SUBENTRY = 'DN of the subschema entry governing the entity';
 
     public const OID_HAS_SUBORDINATES = '2.5.18.9';
+
     public const NAME_HAS_SUBORDINATES = 'hasSubordinates';
+
     public const DESC_HAS_SUBORDINATES = 'whether the entry has any subordinate entries';
 
     public const OID_STRUCTURAL_OBJECT_CLASS = '2.5.21.9';
+
     public const NAME_STRUCTURAL_OBJECT_CLASS = 'structuralObjectClass';
+
     public const DESC_STRUCTURAL_OBJECT_CLASS = 'structural object class of the entry';
 
     public const OID_ENTRY_UUID = '1.3.6.1.1.16.4';
+
     public const NAME_ENTRY_UUID = 'entryUUID';
+
     public const DESC_ENTRY_UUID = 'universally unique identifier for the entry';
 
     public const OID_ENTRY_DN = '1.3.6.1.1.20';
+
     public const NAME_ENTRY_DN = 'entryDN';
+
     public const DESC_ENTRY_DN = 'DN of the entry';
 
     // RFC 4512 subschema attributes
 
     public const OID_ATTRIBUTE_TYPES = '2.5.21.5';
+
     public const NAME_ATTRIBUTE_TYPES = 'attributeTypes';
+
     public const DESC_ATTRIBUTE_TYPES = 'attribute type descriptions';
 
     public const OID_OBJECT_CLASSES = '2.5.21.6';
+
     public const NAME_OBJECT_CLASSES = 'objectClasses';
+
     public const DESC_OBJECT_CLASSES = 'object class descriptions';
 
     public const OID_MATCHING_RULES = '2.5.21.4';
+
     public const NAME_MATCHING_RULES = 'matchingRules';
+
     public const DESC_MATCHING_RULES = 'matching rule descriptions';
 
     public const OID_MATCHING_RULE_USE = '2.5.21.8';
+
     public const NAME_MATCHING_RULE_USE = 'matchingRuleUse';
+
     public const DESC_MATCHING_RULE_USE = 'matching rule use descriptions';
 
     public const OID_LDAP_SYNTAXES = '1.3.6.1.4.1.1466.101.120.16';
+
     public const NAME_LDAP_SYNTAXES = 'ldapSyntaxes';
+
     public const DESC_LDAP_SYNTAXES = 'LDAP syntax descriptions';
 
     public const OID_DIT_STRUCTURE_RULES = '2.5.21.1';
+
     public const NAME_DIT_STRUCTURE_RULES = 'dITStructureRules';
+
     public const DESC_DIT_STRUCTURE_RULES = 'DIT structure rules';
 
     public const OID_DIT_CONTENT_RULES = '2.5.21.2';
+
     public const NAME_DIT_CONTENT_RULES = 'dITContentRules';
+
     public const DESC_DIT_CONTENT_RULES = 'DIT content rules';
 
     public const OID_NAME_FORMS = '2.5.21.7';
+
     public const NAME_NAME_FORMS = 'nameForms';
+
     public const DESC_NAME_FORMS = 'name forms';
 
     private function __construct() {}
diff --git a/src/FreeDSx/Ldap/Schema/Definition/MatchingRuleOid.php b/src/FreeDSx/Ldap/Schema/Definition/MatchingRuleOid.php
index 6635e048..c906e96c 100644
--- a/src/FreeDSx/Ldap/Schema/Definition/MatchingRuleOid.php
+++ b/src/FreeDSx/Ldap/Schema/Definition/MatchingRuleOid.php
@@ -21,63 +21,83 @@
 final class MatchingRuleOid
 {
     public const OID_OBJECT_IDENTIFIER_MATCH = '2.5.13.0';
+
     public const NAME_OBJECT_IDENTIFIER_MATCH = 'objectIdentifierMatch';
 
     public const OID_DISTINGUISHED_NAME_MATCH = '2.5.13.1';
+
     public const NAME_DISTINGUISHED_NAME_MATCH = 'distinguishedNameMatch';
 
     public const OID_CASE_IGNORE_MATCH = '2.5.13.2';
+
     public const NAME_CASE_IGNORE_MATCH = 'caseIgnoreMatch';
 
     public const OID_CASE_IGNORE_ORDERING_MATCH = '2.5.13.3';
+
     public const NAME_CASE_IGNORE_ORDERING_MATCH = 'caseIgnoreOrderingMatch';
 
     public const OID_CASE_IGNORE_SUBSTRINGS_MATCH = '2.5.13.4';
+
     public const NAME_CASE_IGNORE_SUBSTRINGS_MATCH = 'caseIgnoreSubstringsMatch';
 
     public const OID_CASE_EXACT_MATCH = '2.5.13.5';
+
     public const NAME_CASE_EXACT_MATCH = 'caseExactMatch';
 
     public const OID_CASE_EXACT_ORDERING_MATCH = '2.5.13.6';
+
     public const NAME_CASE_EXACT_ORDERING_MATCH = 'caseExactOrderingMatch';
 
     public const OID_CASE_EXACT_SUBSTRINGS_MATCH = '2.5.13.7';
+
     public const NAME_CASE_EXACT_SUBSTRINGS_MATCH = 'caseExactSubstringsMatch';
 
     public const OID_BOOLEAN_MATCH = '2.5.13.13';
+
     public const NAME_BOOLEAN_MATCH = 'booleanMatch';
 
     public const OID_INTEGER_MATCH = '2.5.13.14';
+
     public const NAME_INTEGER_MATCH = 'integerMatch';
 
     public const OID_INTEGER_ORDERING_MATCH = '2.5.13.15';
+
     public const NAME_INTEGER_ORDERING_MATCH = 'integerOrderingMatch';
 
     public const OID_OCTET_STRING_MATCH = '2.5.13.17';
+
     public const NAME_OCTET_STRING_MATCH = 'octetStringMatch';
 
     public const OID_GENERALIZED_TIME_MATCH = '2.5.13.18';
+
     public const NAME_GENERALIZED_TIME_MATCH = 'generalizedTimeMatch';
 
     public const OID_GENERALIZED_TIME_ORDERING_MATCH = '2.5.13.19';
+
     public const NAME_GENERALIZED_TIME_ORDERING_MATCH = 'generalizedTimeOrderingMatch';
 
     public const OID_TELEPHONE_NUMBER_MATCH = '2.5.13.20';
+
     public const NAME_TELEPHONE_NUMBER_MATCH = 'telephoneNumberMatch';
 
     public const OID_UNIQUE_MEMBER_MATCH = '2.5.13.23';
+
     public const NAME_UNIQUE_MEMBER_MATCH = 'uniqueMemberMatch';
 
     public const OID_CASE_EXACT_IA5_MATCH = '1.3.6.1.4.1.1466.109.114.1';
+
     public const NAME_CASE_EXACT_IA5_MATCH = 'caseExactIA5Match';
 
     public const OID_CASE_IGNORE_IA5_MATCH = '1.3.6.1.4.1.1466.109.114.2';
+
     public const NAME_CASE_IGNORE_IA5_MATCH = 'caseIgnoreIA5Match';
 
     public const OID_BIT_AND_MATCH = '1.2.840.113556.1.4.803';
+
     public const NAME_BIT_AND_MATCH = 'bitAndMatch';
 
     public const OID_BIT_OR_MATCH = '1.2.840.113556.1.4.804';
+
     public const NAME_BIT_OR_MATCH = 'bitOrMatch';
 
     private function __construct() {}
diff --git a/src/FreeDSx/Ldap/Schema/Definition/ObjectClassOid.php b/src/FreeDSx/Ldap/Schema/Definition/ObjectClassOid.php
index 77c3e798..972140f7 100644
--- a/src/FreeDSx/Ldap/Schema/Definition/ObjectClassOid.php
+++ b/src/FreeDSx/Ldap/Schema/Definition/ObjectClassOid.php
@@ -19,51 +19,75 @@
 final class ObjectClassOid
 {
     public const OID_TOP = '2.5.6.0';
+
     public const NAME_TOP = 'top';
+
     public const DESC_TOP = 'top of the class hierarchy';
 
     public const OID_PERSON = '2.5.6.6';
+
     public const NAME_PERSON = 'person';
+
     public const DESC_PERSON = 'natural persons';
 
     public const OID_ORGANIZATIONAL_PERSON = '2.5.6.7';
+
     public const NAME_ORGANIZATIONAL_PERSON = 'organizationalPerson';
+
     public const DESC_ORGANIZATIONAL_PERSON = 'people associated with an organization';
 
     public const OID_ORGANIZATIONAL_UNIT = '2.5.6.5';
+
     public const NAME_ORGANIZATIONAL_UNIT = 'organizationalUnit';
+
     public const DESC_ORGANIZATIONAL_UNIT = 'organizational units';
 
     public const OID_ORGANIZATION = '2.5.6.4';
+
     public const NAME_ORGANIZATION = 'organization';
+
     public const DESC_ORGANIZATION = 'organizations';
 
     public const OID_GROUP_OF_NAMES = '2.5.6.9';
+
     public const NAME_GROUP_OF_NAMES = 'groupOfNames';
+
     public const DESC_GROUP_OF_NAMES = 'group whose members are distinguished names';
 
     public const OID_GROUP_OF_UNIQUE_NAMES = '2.5.6.17';
+
     public const NAME_GROUP_OF_UNIQUE_NAMES = 'groupOfUniqueNames';
+
     public const DESC_GROUP_OF_UNIQUE_NAMES = 'group whose members are unique distinguished names';
 
     public const OID_INET_ORG_PERSON = '2.16.840.1.113730.3.2.2';
+
     public const NAME_INET_ORG_PERSON = 'inetOrgPerson';
+
     public const DESC_INET_ORG_PERSON = 'internet-enabled person (RFC 2798)';
 
     public const OID_DOMAIN = '0.9.2342.19200300.100.4.13';
+
     public const NAME_DOMAIN = 'domain';
+
     public const DESC_DOMAIN = 'DNS domains';
 
     public const OID_DC_OBJECT = '1.3.6.1.4.1.1466.344';
+
     public const NAME_DC_OBJECT = 'dcObject';
+
     public const DESC_DC_OBJECT = 'auxiliary class for domain component';
 
     public const OID_SUBSCHEMA = '2.5.20.1';
+
     public const NAME_SUBSCHEMA = 'subschema';
+
     public const DESC_SUBSCHEMA = 'server subschema entry';
 
     public const OID_EXTENSIBLE_OBJECT = '1.3.6.1.4.1.1466.101.120.111';
+
     public const NAME_EXTENSIBLE_OBJECT = 'extensibleObject';
+
     public const DESC_EXTENSIBLE_OBJECT = 'any attribute type allowed';
 
     private function __construct() {}
diff --git a/src/FreeDSx/Ldap/Schema/Definition/PasswordPolicyOid.php b/src/FreeDSx/Ldap/Schema/Definition/PasswordPolicyOid.php
index d1d5e3e9..427f803f 100644
--- a/src/FreeDSx/Ldap/Schema/Definition/PasswordPolicyOid.php
+++ b/src/FreeDSx/Ldap/Schema/Definition/PasswordPolicyOid.php
@@ -19,127 +19,189 @@
 final class PasswordPolicyOid
 {
     public const OID_PWD_ATTRIBUTE = '1.3.6.1.4.1.42.2.27.8.1.1';
+
     public const NAME_PWD_ATTRIBUTE = 'pwdAttribute';
+
     public const DESC_PWD_ATTRIBUTE = 'attribute to which the policy applies';
 
     public const OID_PWD_MIN_AGE = '1.3.6.1.4.1.42.2.27.8.1.2';
+
     public const NAME_PWD_MIN_AGE = 'pwdMinAge';
+
     public const DESC_PWD_MIN_AGE = 'minimum seconds between password changes';
 
     public const OID_PWD_MAX_AGE = '1.3.6.1.4.1.42.2.27.8.1.3';
+
     public const NAME_PWD_MAX_AGE = 'pwdMaxAge';
+
     public const DESC_PWD_MAX_AGE = 'maximum seconds a password remains valid';
 
     public const OID_PWD_IN_HISTORY = '1.3.6.1.4.1.42.2.27.8.1.4';
+
     public const NAME_PWD_IN_HISTORY = 'pwdInHistory';
+
     public const DESC_PWD_IN_HISTORY = 'number of prior passwords retained for history checks';
 
     public const OID_PWD_CHECK_QUALITY = '1.3.6.1.4.1.42.2.27.8.1.5';
+
     public const NAME_PWD_CHECK_QUALITY = 'pwdCheckQuality';
+
     public const DESC_PWD_CHECK_QUALITY = 'quality enforcement level (0=off, 1=lenient, 2=strict)';
 
     public const OID_PWD_MIN_LENGTH = '1.3.6.1.4.1.42.2.27.8.1.6';
+
     public const NAME_PWD_MIN_LENGTH = 'pwdMinLength';
+
     public const DESC_PWD_MIN_LENGTH = 'minimum password length in characters';
 
     public const OID_PWD_EXPIRE_WARNING = '1.3.6.1.4.1.42.2.27.8.1.7';
+
     public const NAME_PWD_EXPIRE_WARNING = 'pwdExpireWarning';
+
     public const DESC_PWD_EXPIRE_WARNING = 'seconds before expiration at which to warn the user';
 
     public const OID_PWD_GRACE_AUTHN_LIMIT = '1.3.6.1.4.1.42.2.27.8.1.8';
+
     public const NAME_PWD_GRACE_AUTHN_LIMIT = 'pwdGraceAuthNLimit';
+
     public const DESC_PWD_GRACE_AUTHN_LIMIT = 'number of grace logins permitted after expiration';
 
     public const OID_PWD_LOCKOUT = '1.3.6.1.4.1.42.2.27.8.1.9';
+
     public const NAME_PWD_LOCKOUT = 'pwdLockout';
+
     public const DESC_PWD_LOCKOUT = 'whether failed bind attempts can lock the account';
 
     public const OID_PWD_LOCKOUT_DURATION = '1.3.6.1.4.1.42.2.27.8.1.10';
+
     public const NAME_PWD_LOCKOUT_DURATION = 'pwdLockoutDuration';
+
     public const DESC_PWD_LOCKOUT_DURATION = 'seconds an account stays locked (0 = until reset)';
 
     public const OID_PWD_MAX_FAILURE = '1.3.6.1.4.1.42.2.27.8.1.11';
+
     public const NAME_PWD_MAX_FAILURE = 'pwdMaxFailure';
+
     public const DESC_PWD_MAX_FAILURE = 'failed bind threshold that triggers lockout';
 
     public const OID_PWD_FAILURE_COUNT_INTERVAL = '1.3.6.1.4.1.42.2.27.8.1.12';
+
     public const NAME_PWD_FAILURE_COUNT_INTERVAL = 'pwdFailureCountInterval';
+
     public const DESC_PWD_FAILURE_COUNT_INTERVAL = 'seconds before old failure counts are forgotten';
 
     public const OID_PWD_MUST_CHANGE = '1.3.6.1.4.1.42.2.27.8.1.13';
+
     public const NAME_PWD_MUST_CHANGE = 'pwdMustChange';
+
     public const DESC_PWD_MUST_CHANGE = 'whether the user must change password after admin reset';
 
     public const OID_PWD_ALLOW_USER_CHANGE = '1.3.6.1.4.1.42.2.27.8.1.14';
+
     public const NAME_PWD_ALLOW_USER_CHANGE = 'pwdAllowUserChange';
+
     public const DESC_PWD_ALLOW_USER_CHANGE = 'whether the user may change their own password';
 
     public const OID_PWD_SAFE_MODIFY = '1.3.6.1.4.1.42.2.27.8.1.15';
+
     public const NAME_PWD_SAFE_MODIFY = 'pwdSafeModify';
+
     public const DESC_PWD_SAFE_MODIFY = 'whether password change requires the existing password';
 
     public const OID_PWD_CHANGED_TIME = '1.3.6.1.4.1.42.2.27.8.1.16';
+
     public const NAME_PWD_CHANGED_TIME = 'pwdChangedTime';
+
     public const DESC_PWD_CHANGED_TIME = 'time the password was last changed';
 
     public const OID_PWD_ACCOUNT_LOCKED_TIME = '1.3.6.1.4.1.42.2.27.8.1.17';
+
     public const NAME_PWD_ACCOUNT_LOCKED_TIME = 'pwdAccountLockedTime';
+
     public const DESC_PWD_ACCOUNT_LOCKED_TIME = 'time the account became locked';
 
     public const OID_PWD_FAILURE_TIME = '1.3.6.1.4.1.42.2.27.8.1.19';
+
     public const NAME_PWD_FAILURE_TIME = 'pwdFailureTime';
+
     public const DESC_PWD_FAILURE_TIME = 'timestamps of recent consecutive bind failures';
 
     public const OID_PWD_HISTORY = '1.3.6.1.4.1.42.2.27.8.1.20';
+
     public const NAME_PWD_HISTORY = 'pwdHistory';
+
     public const DESC_PWD_HISTORY = 'history of prior password values';
 
     public const OID_PWD_GRACE_USE_TIME = '1.3.6.1.4.1.42.2.27.8.1.21';
+
     public const NAME_PWD_GRACE_USE_TIME = 'pwdGraceUseTime';
+
     public const DESC_PWD_GRACE_USE_TIME = 'timestamps of grace logins consumed after expiration';
 
     public const OID_PWD_RESET = '1.3.6.1.4.1.42.2.27.8.1.22';
+
     public const NAME_PWD_RESET = 'pwdReset';
+
     public const DESC_PWD_RESET = 'whether the password was reset and must be changed';
 
     public const OID_PWD_POLICY_SUBENTRY = '1.3.6.1.4.1.42.2.27.8.1.23';
+
     public const NAME_PWD_POLICY_SUBENTRY = 'pwdPolicySubentry';
+
     public const DESC_PWD_POLICY_SUBENTRY = 'DN of the pwdPolicy entry that governs this user';
 
     public const OID_PWD_MIN_DELAY = '1.3.6.1.4.1.42.2.27.8.1.24';
+
     public const NAME_PWD_MIN_DELAY = 'pwdMinDelay';
+
     public const DESC_PWD_MIN_DELAY = 'minimum seconds to delay after each failed bind';
 
     public const OID_PWD_MAX_DELAY = '1.3.6.1.4.1.42.2.27.8.1.25';
+
     public const NAME_PWD_MAX_DELAY = 'pwdMaxDelay';
+
     public const DESC_PWD_MAX_DELAY = 'maximum seconds to delay after each failed bind';
 
     public const OID_PWD_MAX_IDLE = '1.3.6.1.4.1.42.2.27.8.1.26';
+
     public const NAME_PWD_MAX_IDLE = 'pwdMaxIdle';
+
     public const DESC_PWD_MAX_IDLE = 'seconds without successful bind before lockout';
 
     public const OID_PWD_START_TIME = '1.3.6.1.4.1.42.2.27.8.1.27';
+
     public const NAME_PWD_START_TIME = 'pwdStartTime';
+
     public const DESC_PWD_START_TIME = 'time the password becomes valid for authentication';
 
     public const OID_PWD_END_TIME = '1.3.6.1.4.1.42.2.27.8.1.28';
+
     public const NAME_PWD_END_TIME = 'pwdEndTime';
+
     public const DESC_PWD_END_TIME = 'time the password stops being valid for authentication';
 
     public const OID_PWD_LAST_SUCCESS = '1.3.6.1.4.1.42.2.27.8.1.29';
+
     public const NAME_PWD_LAST_SUCCESS = 'pwdLastSuccess';
+
     public const DESC_PWD_LAST_SUCCESS = 'time of the last successful bind';
 
     public const OID_PWD_GRACE_EXPIRY = '1.3.6.1.4.1.42.2.27.8.1.30';
+
     public const NAME_PWD_GRACE_EXPIRY = 'pwdGraceExpiry';
+
     public const DESC_PWD_GRACE_EXPIRY = 'seconds after expiration during which grace logins remain valid';
 
     public const OID_PWD_MAX_LENGTH = '1.3.6.1.4.1.42.2.27.8.1.31';
+
     public const NAME_PWD_MAX_LENGTH = 'pwdMaxLength';
+
     public const DESC_PWD_MAX_LENGTH = 'maximum password length in characters';
 
     public const OID_PWD_POLICY = '1.3.6.1.4.1.42.2.27.8.2.1';
+
     public const NAME_PWD_POLICY = 'pwdPolicy';
+
     public const DESC_PWD_POLICY = 'auxiliary class for entries that define a password policy';
 
     /**
diff --git a/src/FreeDSx/Ldap/Schema/Definition/SyntaxOid.php b/src/FreeDSx/Ldap/Schema/Definition/SyntaxOid.php
index 15f12452..0f843d22 100644
--- a/src/FreeDSx/Ldap/Schema/Definition/SyntaxOid.php
+++ b/src/FreeDSx/Ldap/Schema/Definition/SyntaxOid.php
@@ -19,45 +19,59 @@
 final class SyntaxOid
 {
     public const OID_DIRECTORY_STRING = '1.3.6.1.4.1.1466.115.121.1.15';
+
     public const DESC_DIRECTORY_STRING = 'Directory String';
 
     public const OID_DISTINGUISHED_NAME = '1.3.6.1.4.1.1466.115.121.1.12';
+
     public const DESC_DISTINGUISHED_NAME = 'DN';
 
     public const OID_INTEGER = '1.3.6.1.4.1.1466.115.121.1.27';
+
     public const DESC_INTEGER = 'INTEGER';
 
     public const OID_BOOLEAN = '1.3.6.1.4.1.1466.115.121.1.7';
+
     public const DESC_BOOLEAN = 'Boolean';
 
     public const OID_GENERALIZED_TIME = '1.3.6.1.4.1.1466.115.121.1.24';
+
     public const DESC_GENERALIZED_TIME = 'Generalized Time';
 
     public const OID_OCTET_STRING = '1.3.6.1.4.1.1466.115.121.1.40';
+
     public const DESC_OCTET_STRING = 'Octet String';
 
     public const OID_TELEPHONE_NUMBER = '1.3.6.1.4.1.1466.115.121.1.50';
+
     public const DESC_TELEPHONE_NUMBER = 'Telephone Number';
 
     public const OID_IA5_STRING = '1.3.6.1.4.1.1466.115.121.1.26';
+
     public const DESC_IA5_STRING = 'IA5 String';
 
     public const OID_BIT_STRING = '1.3.6.1.4.1.1466.115.121.1.6';
+
     public const DESC_BIT_STRING = 'Bit String';
 
     public const OID_NUMERIC_STRING = '1.3.6.1.4.1.1466.115.121.1.36';
+
     public const DESC_NUMERIC_STRING = 'Numeric String';
 
     public const OID_OID = '1.3.6.1.4.1.1466.115.121.1.38';
+
     public const DESC_OID = 'OID';
 
     public const OID_PRINTABLE_STRING = '1.3.6.1.4.1.1466.115.121.1.44';
+
     public const DESC_PRINTABLE_STRING = 'Printable String';
 
     public const OID_POSTAL_ADDRESS = '1.3.6.1.4.1.1466.115.121.1.41';
+
     public const DESC_POSTAL_ADDRESS = 'Postal Address';
 
     public const OID_JPEG = '1.3.6.1.4.1.1466.115.121.1.28';
+
     public const DESC_JPEG = 'JPEG';
 
     private function __construct() {}
diff --git a/src/FreeDSx/Ldap/Schema/StandardSchemaProvider.php b/src/FreeDSx/Ldap/Schema/StandardSchemaProvider.php
index 3e73a66e..396b7e07 100644
--- a/src/FreeDSx/Ldap/Schema/StandardSchemaProvider.php
+++ b/src/FreeDSx/Ldap/Schema/StandardSchemaProvider.php
@@ -39,6 +39,8 @@
  */
 final class StandardSchemaProvider
 {
+    private function __construct() {}
+
     public static function buildCore(): Schema
     {
         $schema = new Schema();
@@ -736,6 +738,4 @@ private static function objectClasses(): array
             ),
         ];
     }
-
-    private function __construct() {}
 }
diff --git a/src/FreeDSx/Ldap/Search/Filter/FilterAttributeTrait.php b/src/FreeDSx/Ldap/Search/Filter/FilterAttributeTrait.php
index 2fdd02c2..00c9297d 100644
--- a/src/FreeDSx/Ldap/Search/Filter/FilterAttributeTrait.php
+++ b/src/FreeDSx/Ldap/Search/Filter/FilterAttributeTrait.php
@@ -24,6 +24,11 @@ trait FilterAttributeTrait
 {
     protected string $attribute;
 
+    public function __toString(): string
+    {
+        return $this->toString();
+    }
+
     public function getAttribute(): string
     {
         return $this->attribute;
@@ -38,9 +43,4 @@ public function setAttribute(string $attribute): static
 
         return $this;
     }
-
-    public function __toString(): string
-    {
-        return $this->toString();
-    }
 }
diff --git a/src/FreeDSx/Ldap/Search/Filter/FilterContainerTrait.php b/src/FreeDSx/Ldap/Search/Filter/FilterContainerTrait.php
index e1d67722..247c4543 100644
--- a/src/FreeDSx/Ldap/Search/Filter/FilterContainerTrait.php
+++ b/src/FreeDSx/Ldap/Search/Filter/FilterContainerTrait.php
@@ -44,6 +44,11 @@ public function __construct(FilterInterface ...$filters)
         $this->filters = $filters;
     }
 
+    public function __toString(): string
+    {
+        return $this->toString();
+    }
+
     public function add(FilterInterface ...$filters): self
     {
         foreach ($filters as $filter) {
@@ -129,11 +134,6 @@ public function count(): int
         return count($this->filters);
     }
 
-    public function __toString(): string
-    {
-        return $this->toString();
-    }
-
     /**
      * {@inheritDoc}
      *
diff --git a/src/FreeDSx/Ldap/Search/Filter/MatchingRuleFilter.php b/src/FreeDSx/Ldap/Search/Filter/MatchingRuleFilter.php
index b28c9e26..604e4a2e 100644
--- a/src/FreeDSx/Ldap/Search/Filter/MatchingRuleFilter.php
+++ b/src/FreeDSx/Ldap/Search/Filter/MatchingRuleFilter.php
@@ -62,6 +62,11 @@ public function __construct(
         $this->useDnAttributes = $useDnAttributes;
     }
 
+    public function __toString(): string
+    {
+        return $this->toString();
+    }
+
     public function getAttribute(): ?string
     {
         return $this->attribute;
@@ -164,11 +169,6 @@ public function toString(): string
             . self::PAREN_RIGHT;
     }
 
-    public function __toString(): string
-    {
-        return $this->toString();
-    }
-
     /**
      * {@inheritDoc}
      *
diff --git a/src/FreeDSx/Ldap/Search/Filter/NotFilter.php b/src/FreeDSx/Ldap/Search/Filter/NotFilter.php
index eae71a99..5961f97c 100644
--- a/src/FreeDSx/Ldap/Search/Filter/NotFilter.php
+++ b/src/FreeDSx/Ldap/Search/Filter/NotFilter.php
@@ -42,6 +42,11 @@ public function __construct(FilterInterface $filter)
         $this->filter = $filter;
     }
 
+    public function __toString(): string
+    {
+        return $this->toString();
+    }
+
     public function get(): FilterInterface
     {
         return $this->filter;
@@ -73,11 +78,6 @@ public function toString(): string
             . self::PAREN_RIGHT;
     }
 
-    public function __toString(): string
-    {
-        return $this->toString();
-    }
-
     /**
      * {@inheritDoc}
      *
diff --git a/src/FreeDSx/Ldap/Search/Result/EntryResult.php b/src/FreeDSx/Ldap/Search/Result/EntryResult.php
index 83add850..8712e7c8 100644
--- a/src/FreeDSx/Ldap/Search/Result/EntryResult.php
+++ b/src/FreeDSx/Ldap/Search/Result/EntryResult.php
@@ -25,6 +25,16 @@ final class EntryResult implements Stringable
 
     public function __construct(private readonly LdapMessageResponse $response) {}
 
+    /**
+     * {@inheritDoc}
+     */
+    public function __toString(): string
+    {
+        return $this->getEntry()
+            ->getDn()
+            ->toString();
+    }
+
     /**
      * The raw message response returned from the server, which contains any controls
      */
@@ -55,14 +65,4 @@ public function getEntry(): Entry
 
         return $this->entry;
     }
-
-    /**
-     * {@inheritDoc}
-     */
-    public function __toString(): string
-    {
-        return $this->getEntry()
-            ->getDn()
-            ->toString();
-    }
 }
diff --git a/src/FreeDSx/Ldap/Search/Result/ReferralResult.php b/src/FreeDSx/Ldap/Search/Result/ReferralResult.php
index 91c344c1..983e4a88 100644
--- a/src/FreeDSx/Ldap/Search/Result/ReferralResult.php
+++ b/src/FreeDSx/Ldap/Search/Result/ReferralResult.php
@@ -38,6 +38,17 @@ final class ReferralResult implements Countable, IteratorAggregate, Stringable
 
     public function __construct(private readonly LdapMessageResponse $response) {}
 
+    /**
+     * {@inheritDoc}
+     */
+    public function __toString(): string
+    {
+        return implode(
+            separator: ',',
+            array: $this->getReferrals(),
+        );
+    }
+
     /**
      * The raw message response returned from the server, which contains any controls
      */
@@ -88,15 +99,4 @@ public function getIterator(): Traversable
     {
         return new ArrayIterator($this->getReferrals());
     }
-
-    /**
-     * {@inheritDoc}
-     */
-    public function __toString(): string
-    {
-        return implode(
-            separator: ',',
-            array: $this->getReferrals(),
-        );
-    }
 }
diff --git a/src/FreeDSx/Ldap/Server/Backend/Storage/Adapter/Dialect/PdoDialectInterface.php b/src/FreeDSx/Ldap/Server/Backend/Storage/Adapter/Dialect/PdoDialectInterface.php
index 868d9628..d14dd52f 100644
--- a/src/FreeDSx/Ldap/Server/Backend/Storage/Adapter/Dialect/PdoDialectInterface.php
+++ b/src/FreeDSx/Ldap/Server/Backend/Storage/Adapter/Dialect/PdoDialectInterface.php
@@ -37,7 +37,6 @@ public function commit(PDO $pdo): void;
      */
     public function rollBack(PDO $pdo): void;
 
-
     /**
      * DDL for the `entries` table. Required columns:
      *   lc_dn         — PK, lowercased DN
diff --git a/src/FreeDSx/Ldap/Server/Backend/Storage/Adapter/Pdo/PdoStorageFactoryTrait.php b/src/FreeDSx/Ldap/Server/Backend/Storage/Adapter/Pdo/PdoStorageFactoryTrait.php
index a459a833..b09a41c4 100644
--- a/src/FreeDSx/Ldap/Server/Backend/Storage/Adapter/Pdo/PdoStorageFactoryTrait.php
+++ b/src/FreeDSx/Ldap/Server/Backend/Storage/Adapter/Pdo/PdoStorageFactoryTrait.php
@@ -25,12 +25,6 @@
  */
 trait PdoStorageFactoryTrait
 {
-    abstract protected function dialect(): PdoDialectInterface;
-
-    abstract protected function translator(): FilterTranslatorInterface;
-
-    abstract protected function openConnection(PdoDialectInterface $dialect): PDO;
-
     /**
      * @api
      */
@@ -39,6 +33,12 @@ public function create(): PdoStorage
         return $this->createShared();
     }
 
+    abstract protected function dialect(): PdoDialectInterface;
+
+    abstract protected function translator(): FilterTranslatorInterface;
+
+    abstract protected function openConnection(PdoDialectInterface $dialect): PDO;
+
     protected function createShared(): PdoStorage
     {
         $dialect = $this->dialect();
diff --git a/src/FreeDSx/Ldap/Server/Backend/Storage/Adapter/Pdo/PooledStatement.php b/src/FreeDSx/Ldap/Server/Backend/Storage/Adapter/Pdo/PooledStatement.php
index 6871d0aa..0290ed05 100644
--- a/src/FreeDSx/Ldap/Server/Backend/Storage/Adapter/Pdo/PooledStatement.php
+++ b/src/FreeDSx/Ldap/Server/Backend/Storage/Adapter/Pdo/PooledStatement.php
@@ -33,11 +33,6 @@ public function __construct(
         $this->release = $release;
     }
 
-    public function fetch(): mixed
-    {
-        return $this->statement->fetch();
-    }
-
     public function __destruct()
     {
         if ($this->release === null) {
@@ -53,4 +48,9 @@ public function __destruct()
             // Drop the statement rather than recycling a poisoned one into the pool.
         }
     }
+
+    public function fetch(): mixed
+    {
+        return $this->statement->fetch();
+    }
 }
diff --git a/src/FreeDSx/Ldap/Server/Backend/Storage/Adapter/PdoStorage.php b/src/FreeDSx/Ldap/Server/Backend/Storage/Adapter/PdoStorage.php
index 2ab48dad..d10e0e8a 100644
--- a/src/FreeDSx/Ldap/Server/Backend/Storage/Adapter/PdoStorage.php
+++ b/src/FreeDSx/Ldap/Server/Backend/Storage/Adapter/PdoStorage.php
@@ -154,25 +154,6 @@ public function list(StorageListOptions $options): EntryStream
         );
     }
 
-    /**
-     * @return Generator<Entry>
-     */
-    private function generateRows(
-        PooledStatement $stmt,
-        ?float $deadline,
-    ): Generator {
-        while (($row = $stmt->fetch()) !== false) {
-            if ($deadline !== null && microtime(true) >= $deadline) {
-                throw new TimeLimitExceededException();
-            }
-
-            $entry = $this->rowToEntry($row);
-            if ($entry !== null) {
-                yield $entry;
-            }
-        }
-    }
-
     public function store(Entry $entry): void
     {
         $normDn = $entry->getDn()->normalize();
@@ -202,6 +183,104 @@ public function store(Entry $entry): void
         });
     }
 
+    public function remove(Dn $dn): void
+    {
+        $this->prepareAndExecute(
+            $this->dialect->queryDelete(),
+            [$dn->toString()],
+        );
+    }
+
+    public function hasChildren(Dn $dn): bool
+    {
+        $stmt = $this->prepareAndExecute(
+            $this->dialect->queryHasChildren(),
+            [$dn->toString()],
+        );
+
+        return $stmt->fetch() !== false;
+    }
+
+    public function namingContexts(): array
+    {
+        $stmt = $this->prepareAndExecute($this->dialect->queryNamingContexts());
+
+        $contexts = [];
+        while (($row = $stmt->fetch()) !== false) {
+            if (!is_array($row) || !isset($row['dn']) || !is_string($row['dn'])) {
+                continue;
+            }
+            $contexts[] = (new Dn($row['dn']))->normalize();
+        }
+
+        return $contexts;
+    }
+
+    public function atomic(callable $operation): void
+    {
+        $pdo = $this->provider->get();
+        $txState = $this->provider->txState();
+
+        $depth = $txState->depth++;
+        $savepointCreated = false;
+        $transactionStarted = false;
+
+        try {
+            if ($depth === 0) {
+                $this->dialect->beginTransaction($pdo);
+                $transactionStarted = true;
+            } else {
+                $pdo->exec("SAVEPOINT {$this->savepointName($depth)}");
+                $savepointCreated = true;
+            }
+
+            $operation($this);
+
+            if ($depth === 0 && $txState->broken) {
+                $this->dialect->rollBack($pdo);
+            } elseif ($depth === 0) {
+                $this->dialect->commit($pdo);
+            } else {
+                $pdo->exec("RELEASE SAVEPOINT {$this->savepointName($depth)}");
+            }
+        } catch (Throwable $e) {
+            if ($transactionStarted) {
+                $this->dialect->rollBack($pdo);
+            } elseif ($savepointCreated) {
+                $pdo->exec("ROLLBACK TO SAVEPOINT {$this->savepointName($depth)}");
+            } elseif ($depth > 0) {
+                // Savepoint creation itself failed; the outer transaction is now in an unknown state and must not be committed.
+                $txState->broken = true;
+            }
+
+            throw $e;
+        } finally {
+            $txState->depth--;
+            if ($txState->depth === 0) {
+                $txState->broken = false;
+            }
+        }
+    }
+
+    /**
+     * @return Generator<Entry>
+     */
+    private function generateRows(
+        PooledStatement $stmt,
+        ?float $deadline,
+    ): Generator {
+        while (($row = $stmt->fetch()) !== false) {
+            if ($deadline !== null && microtime(true) >= $deadline) {
+                throw new TimeLimitExceededException();
+            }
+
+            $entry = $this->rowToEntry($row);
+            if ($entry !== null) {
+                yield $entry;
+            }
+        }
+    }
+
     private function insertSidecarRows(
         string $lcDn,
         Entry $entry,
@@ -293,85 +372,6 @@ private function assertDnFits(string $dn): void
         );
     }
 
-    public function remove(Dn $dn): void
-    {
-        $this->prepareAndExecute(
-            $this->dialect->queryDelete(),
-            [$dn->toString()],
-        );
-    }
-
-    public function hasChildren(Dn $dn): bool
-    {
-        $stmt = $this->prepareAndExecute(
-            $this->dialect->queryHasChildren(),
-            [$dn->toString()],
-        );
-
-        return $stmt->fetch() !== false;
-    }
-
-    public function namingContexts(): array
-    {
-        $stmt = $this->prepareAndExecute($this->dialect->queryNamingContexts());
-
-        $contexts = [];
-        while (($row = $stmt->fetch()) !== false) {
-            if (!is_array($row) || !isset($row['dn']) || !is_string($row['dn'])) {
-                continue;
-            }
-            $contexts[] = (new Dn($row['dn']))->normalize();
-        }
-
-        return $contexts;
-    }
-
-    public function atomic(callable $operation): void
-    {
-        $pdo = $this->provider->get();
-        $txState = $this->provider->txState();
-
-        $depth = $txState->depth++;
-        $savepointCreated = false;
-        $transactionStarted = false;
-
-        try {
-            if ($depth === 0) {
-                $this->dialect->beginTransaction($pdo);
-                $transactionStarted = true;
-            } else {
-                $pdo->exec("SAVEPOINT {$this->savepointName($depth)}");
-                $savepointCreated = true;
-            }
-
-            $operation($this);
-
-            if ($depth === 0 && $txState->broken) {
-                $this->dialect->rollBack($pdo);
-            } elseif ($depth === 0) {
-                $this->dialect->commit($pdo);
-            } else {
-                $pdo->exec("RELEASE SAVEPOINT {$this->savepointName($depth)}");
-            }
-        } catch (Throwable $e) {
-            if ($transactionStarted) {
-                $this->dialect->rollBack($pdo);
-            } elseif ($savepointCreated) {
-                $pdo->exec("ROLLBACK TO SAVEPOINT {$this->savepointName($depth)}");
-            } elseif ($depth > 0) {
-                // Savepoint creation itself failed; the outer transaction is now in an unknown state and must not be committed.
-                $txState->broken = true;
-            }
-
-            throw $e;
-        } finally {
-            $txState->depth--;
-            if ($txState->depth === 0) {
-                $txState->broken = false;
-            }
-        }
-    }
-
     private function encodeAttributes(Entry $entry): string
     {
         $attributes = [];
diff --git a/src/FreeDSx/Ldap/Server/Backend/Storage/Adapter/SqlFilter/SqlFilterTranslatorTrait.php b/src/FreeDSx/Ldap/Server/Backend/Storage/Adapter/SqlFilter/SqlFilterTranslatorTrait.php
index 1fadc38f..e2a374e5 100644
--- a/src/FreeDSx/Ldap/Server/Backend/Storage/Adapter/SqlFilter/SqlFilterTranslatorTrait.php
+++ b/src/FreeDSx/Ldap/Server/Backend/Storage/Adapter/SqlFilter/SqlFilterTranslatorTrait.php
@@ -33,21 +33,6 @@
  */
 trait SqlFilterTranslatorTrait
 {
-    /**
-     * @param string $attribute Pre-validated; safe to embed in SQL.
-     */
-    abstract private function buildPresenceCheck(string $attribute): string;
-
-    /**
-     * @param string $attribute Pre-validated; safe to embed in SQL.
-     */
-    abstract private function buildValueExists(
-        string $attribute,
-        string $innerCondition,
-    ): string;
-
-    abstract private function valueAlias(): string;
-
     public function translate(FilterInterface $filter): ?SqlFilterResult
     {
         return match (true) {
@@ -64,6 +49,21 @@ public function translate(FilterInterface $filter): ?SqlFilterResult
         };
     }
 
+    /**
+     * @param string $attribute Pre-validated; safe to embed in SQL.
+     */
+    abstract private function buildPresenceCheck(string $attribute): string;
+
+    /**
+     * @param string $attribute Pre-validated; safe to embed in SQL.
+     */
+    abstract private function buildValueExists(
+        string $attribute,
+        string $innerCondition,
+    ): string;
+
+    abstract private function valueAlias(): string;
+
     private function translatePresent(PresentFilter $filter): ?SqlFilterResult
     {
         $attribute = $this->validateAttribute($filter->getAttribute());
diff --git a/src/FreeDSx/Ldap/Server/Backend/Storage/Adapter/Support/JsonEntryBuffer.php b/src/FreeDSx/Ldap/Server/Backend/Storage/Adapter/Support/JsonEntryBuffer.php
index 6bfa6c43..6da1e900 100644
--- a/src/FreeDSx/Ldap/Server/Backend/Storage/Adapter/Support/JsonEntryBuffer.php
+++ b/src/FreeDSx/Ldap/Server/Backend/Storage/Adapter/Support/JsonEntryBuffer.php
@@ -70,30 +70,6 @@ public function list(StorageListOptions $options): EntryStream
         return new EntryStream($this->generateEntries($options));
     }
 
-    /**
-     * @return Generator<Entry>
-     */
-    private function generateEntries(StorageListOptions $options): Generator
-    {
-        $deadline = $options->timeLimit > 0
-            ? microtime(true) + $options->timeLimit
-            : null;
-
-        foreach ($this->data as $normDn => $entryData) {
-            if ($deadline !== null && microtime(true) >= $deadline) {
-                throw new TimeLimitExceededException();
-            }
-
-            $entryDn = new Dn($normDn);
-
-            if ($options->subtree && $entryDn->isDescendantOf($options->baseDn)) {
-                yield ($this->toEntry)($entryData);
-            } elseif (!$options->subtree && $entryDn->isChildOf($options->baseDn)) {
-                yield ($this->toEntry)($entryData);
-            }
-        }
-    }
-
     public function store(Entry $entry): void
     {
         $this->data[$entry->getDn()->normalize()->toString()] = ($this->fromEntry)($entry);
@@ -130,4 +106,28 @@ public function getData(): array
     {
         return $this->data;
     }
+
+    /**
+     * @return Generator<Entry>
+     */
+    private function generateEntries(StorageListOptions $options): Generator
+    {
+        $deadline = $options->timeLimit > 0
+            ? microtime(true) + $options->timeLimit
+            : null;
+
+        foreach ($this->data as $normDn => $entryData) {
+            if ($deadline !== null && microtime(true) >= $deadline) {
+                throw new TimeLimitExceededException();
+            }
+
+            $entryDn = new Dn($normDn);
+
+            if ($options->subtree && $entryDn->isDescendantOf($options->baseDn)) {
+                yield ($this->toEntry)($entryData);
+            } elseif (!$options->subtree && $entryDn->isChildOf($options->baseDn)) {
+                yield ($this->toEntry)($entryData);
+            }
+        }
+    }
 }
diff --git a/src/FreeDSx/Ldap/Server/Backend/Storage/Adapter/Writer/SwooleWriterQueue.php b/src/FreeDSx/Ldap/Server/Backend/Storage/Adapter/Writer/SwooleWriterQueue.php
index c2e5a36a..dfdd7cac 100644
--- a/src/FreeDSx/Ldap/Server/Backend/Storage/Adapter/Writer/SwooleWriterQueue.php
+++ b/src/FreeDSx/Ldap/Server/Backend/Storage/Adapter/Writer/SwooleWriterQueue.php
@@ -41,6 +41,11 @@ public function __construct(
         private readonly ?Closure $batchWrapper = null,
     ) {}
 
+    public function __destruct()
+    {
+        $this->jobs?->close();
+    }
+
     /**
      * Submit a write closure and block the caller until the writer reports completion.
      *
@@ -63,9 +68,45 @@ public function run(Closure $job): void
         }
     }
 
-    public function __destruct()
-    {
-        $this->jobs?->close();
+    /**
+     * Executes a batch under a single outer transaction, isolating per-job failures via savepoints.
+     *
+     * @internal
+     *
+     * @param list<array{Closure, Channel<mixed>}> $batch
+     * @param Closure(Closure(): void): void $batchWrapper
+     */
+    public static function executeBatch(
+        array $batch,
+        Closure $batchWrapper,
+    ): void {
+        $results = array_fill(
+            0,
+            count($batch),
+            true,
+        );
+
+        try {
+            $batchWrapper(static function () use ($batch, &$results): void {
+                foreach ($batch as $i => [$closure]) {
+                    try {
+                        $closure();
+                    } catch (Throwable $e) {
+                        $results[$i] = $e;
+                    }
+                }
+            });
+        } catch (Throwable $e) {
+            foreach ($batch as [, $reply]) {
+                $reply->push($e);
+            }
+
+            return;
+        }
+
+        foreach ($batch as $i => [, $reply]) {
+            $reply->push($results[$i]);
+        }
     }
 
     private function ensureStarted(): void
@@ -127,45 +168,4 @@ private function spawnWriter(Channel $jobs): void
             }
         });
     }
-
-    /**
-     * Executes a batch under a single outer transaction, isolating per-job failures via savepoints.
-     *
-     * @internal
-     *
-     * @param list<array{Closure, Channel<mixed>}> $batch
-     * @param Closure(Closure(): void): void $batchWrapper
-     */
-    public static function executeBatch(
-        array $batch,
-        Closure $batchWrapper,
-    ): void {
-        $results = array_fill(
-            0,
-            count($batch),
-            true,
-        );
-
-        try {
-            $batchWrapper(static function () use ($batch, &$results): void {
-                foreach ($batch as $i => [$closure]) {
-                    try {
-                        $closure();
-                    } catch (Throwable $e) {
-                        $results[$i] = $e;
-                    }
-                }
-            });
-        } catch (Throwable $e) {
-            foreach ($batch as [, $reply]) {
-                $reply->push($e);
-            }
-
-            return;
-        }
-
-        foreach ($batch as $i => [, $reply]) {
-            $reply->push($results[$i]);
-        }
-    }
 }
diff --git a/src/FreeDSx/Ldap/Server/Backend/Storage/WritableStorageBackend.php b/src/FreeDSx/Ldap/Server/Backend/Storage/WritableStorageBackend.php
index 18f3f824..de40ea74 100644
--- a/src/FreeDSx/Ldap/Server/Backend/Storage/WritableStorageBackend.php
+++ b/src/FreeDSx/Ldap/Server/Backend/Storage/WritableStorageBackend.php
@@ -338,23 +338,6 @@ public function deleteSubtree(
         }
     }
 
-    /**
-     * @return Dn[] base entry and all descendants, deepest-first so children precede their parents.
-     */
-    private function collectSubtreeDnsDeepestFirst(Dn $base): array
-    {
-        $dns = [];
-        foreach ($this->storage->list(StorageListOptions::matchAll($base, subtree: true))->entries as $entry) {
-            $dns[] = $entry->getDn()->normalize();
-        }
-        usort(
-            $dns,
-            static fn(Dn $a, Dn $b): int => $b->count() <=> $a->count(),
-        );
-
-        return $dns;
-    }
-
     /**
      * @throws OperationException
      */
@@ -379,6 +362,64 @@ public function update(
         });
     }
 
+    /**
+     * @throws OperationException
+     */
+    public function move(
+        MoveCommand $command,
+        WriteContext $context,
+    ): void {
+        $this->writeAtomic(function (EntryStorageInterface $storage) use ($command, $context): void {
+            $normOld = $command->dn->normalize();
+            $entry = $this->findOrFail($storage, $normOld);
+
+            if ($storage->hasChildren($normOld)) {
+                throw new OperationException(
+                    sprintf('Entry "%s" has subordinate entries and cannot be moved.', $command->dn->toString()),
+                    ResultCode::NOT_ALLOWED_ON_NON_LEAF,
+                );
+            }
+
+            $this->assertNotNamingContext(
+                $storage,
+                $command->dn,
+            );
+
+            $this->assertNewSuperiorExists($storage, $command);
+
+            $newEntry = $this->entryHandler->apply($entry, $command);
+            $normNew = $newEntry->getDn()->normalize();
+
+            if ($storage->exists($normNew)) {
+                $this->throwEntryAlreadyExists($newEntry->getDn());
+            }
+
+            $this->operationalAttrs->applyForModify(
+                $newEntry,
+                $context,
+            );
+            $storage->remove($normOld);
+            $storage->store($newEntry);
+        });
+    }
+
+    /**
+     * @return Dn[] base entry and all descendants, deepest-first so children precede their parents.
+     */
+    private function collectSubtreeDnsDeepestFirst(Dn $base): array
+    {
+        $dns = [];
+        foreach ($this->storage->list(StorageListOptions::matchAll($base, subtree: true))->entries as $entry) {
+            $dns[] = $entry->getDn()->normalize();
+        }
+        usort(
+            $dns,
+            static fn(Dn $a, Dn $b): int => $b->count() <=> $a->count(),
+        );
+
+        return $dns;
+    }
+
     /**
      * @throws OperationException
      */
@@ -472,47 +513,6 @@ private function dispositionFor(
             : SchemaViolationDisposition::Rejected;
     }
 
-    /**
-     * @throws OperationException
-     */
-    public function move(
-        MoveCommand $command,
-        WriteContext $context,
-    ): void {
-        $this->writeAtomic(function (EntryStorageInterface $storage) use ($command, $context): void {
-            $normOld = $command->dn->normalize();
-            $entry = $this->findOrFail($storage, $normOld);
-
-            if ($storage->hasChildren($normOld)) {
-                throw new OperationException(
-                    sprintf('Entry "%s" has subordinate entries and cannot be moved.', $command->dn->toString()),
-                    ResultCode::NOT_ALLOWED_ON_NON_LEAF,
-                );
-            }
-
-            $this->assertNotNamingContext(
-                $storage,
-                $command->dn,
-            );
-
-            $this->assertNewSuperiorExists($storage, $command);
-
-            $newEntry = $this->entryHandler->apply($entry, $command);
-            $normNew = $newEntry->getDn()->normalize();
-
-            if ($storage->exists($normNew)) {
-                $this->throwEntryAlreadyExists($newEntry->getDn());
-            }
-
-            $this->operationalAttrs->applyForModify(
-                $newEntry,
-                $context,
-            );
-            $storage->remove($normOld);
-            $storage->store($newEntry);
-        });
-    }
-
     /**
      * Runs the operation under storage->atomic() and maps storage-layer exceptions to LDAP result codes.
      *
diff --git a/src/FreeDSx/Ldap/Server/Logging/EventContext.php b/src/FreeDSx/Ldap/Server/Logging/EventContext.php
index 6d264d9b..d7074009 100644
--- a/src/FreeDSx/Ldap/Server/Logging/EventContext.php
+++ b/src/FreeDSx/Ldap/Server/Logging/EventContext.php
@@ -21,44 +21,69 @@
 final class EventContext
 {
     public const EVENT = 'event';
+
     public const MESSAGE_ID = 'message_id';
 
     // Connection scope
     public const PID = 'pid';
+
     public const CONN_ID = 'conn_id';
+
     public const REMOTE_IP = 'remote_ip';
 
     // Nested sub-array keys
     public const SUBJECT = 'subject';
+
     public const TARGET = 'target';
+
     public const AUTHORIZED_BY = 'authorized_by';
 
     // Used within `subject` (who acted) or `target` (what was acted on)
     public const USERNAME = 'username';
+
     public const DN = 'dn';
 
     // Per-event
     public const OPERATION = 'operation';
+
     public const RESULT_CODE = 'result_code';
+
     public const REASON = 'reason';
+
     public const VALIDATION_MODE = 'validation_mode';
+
     public const REASON_CODE = 'reason_code';
+
     public const REASON_MESSAGE = 'reason_message';
+
     public const MECHANISM = 'mechanism';
+
     public const VERSION = 'version';
+
     public const ATTRIBUTE = 'attribute';
+
     public const MATCH = 'match';
+
     public const CONTROL_OIDS = 'control_oids';
+
     public const AUTHZ_ID = 'authz_id';
+
     public const BASE_DN = 'base_dn';
+
     public const SCOPE = 'scope';
+
     public const ENTRIES_RETURNED = 'entries_returned';
+
     public const NEW_RDN = 'new_rdn';
+
     public const NEW_SUPERIOR_DN = 'new_superior_dn';
 
     // Set when an event was triggered by a Throwable
     public const EXCEPTION_CLASS = 'exception_class';
+
     public const EXCEPTION_MESSAGE = 'exception_message';
+
     public const EXCEPTION_ORIGIN = 'exception_origin';
+
     public const EXCEPTION_TRACE = 'exception_trace';
 }
diff --git a/src/FreeDSx/Ldap/Server/Metrics/Recorder/InMemoryMetricsRecorder.php b/src/FreeDSx/Ldap/Server/Metrics/Recorder/InMemoryMetricsRecorder.php
index 7b2e6ff9..0b8a6c05 100644
--- a/src/FreeDSx/Ldap/Server/Metrics/Recorder/InMemoryMetricsRecorder.php
+++ b/src/FreeDSx/Ldap/Server/Metrics/Recorder/InMemoryMetricsRecorder.php
@@ -213,6 +213,37 @@ public function snapshot(): MetricsSnapshot
         );
     }
 
+    public function takeDelta(): MetricsDelta
+    {
+        $delta = new MetricsDelta(
+            $this->operationMetrics(),
+            $this->trafficMetrics(),
+        );
+
+        $this->resetDelta();
+
+        return $delta;
+    }
+
+    public function resetDelta(): void
+    {
+        $this->operationCounts = [];
+        $this->operationErrors = [];
+        $this->operationDurationSeconds = [];
+        $this->resultCodeCounts = [];
+        $this->bindCounts = [];
+        $this->searchScopeCounts = [];
+        $this->bytesSent = 0;
+        $this->bytesReceived = 0;
+        $this->entriesReturned = 0;
+    }
+
+    public function mergeDelta(MetricsDelta $delta): void
+    {
+        $this->mergeOperations($delta->operations);
+        $this->mergeTraffic($delta->traffic);
+    }
+
     private function operationMetrics(): OperationMetrics
     {
         return new OperationMetrics(
@@ -256,37 +287,6 @@ private function clearInProgress(OperationType $operation): void
         $this->operationsInProgress[$key] = $remaining;
     }
 
-    public function takeDelta(): MetricsDelta
-    {
-        $delta = new MetricsDelta(
-            $this->operationMetrics(),
-            $this->trafficMetrics(),
-        );
-
-        $this->resetDelta();
-
-        return $delta;
-    }
-
-    public function resetDelta(): void
-    {
-        $this->operationCounts = [];
-        $this->operationErrors = [];
-        $this->operationDurationSeconds = [];
-        $this->resultCodeCounts = [];
-        $this->bindCounts = [];
-        $this->searchScopeCounts = [];
-        $this->bytesSent = 0;
-        $this->bytesReceived = 0;
-        $this->entriesReturned = 0;
-    }
-
-    public function mergeDelta(MetricsDelta $delta): void
-    {
-        $this->mergeOperations($delta->operations);
-        $this->mergeTraffic($delta->traffic);
-    }
-
     private function mergeOperations(OperationMetrics $delta): void
     {
         foreach ($delta->counts as $operation => $count) {
diff --git a/src/FreeDSx/Ldap/Server/PasswordPolicy/PasswordPolicyEngine.php b/src/FreeDSx/Ldap/Server/PasswordPolicy/PasswordPolicyEngine.php
index b985e483..7d463fba 100644
--- a/src/FreeDSx/Ldap/Server/PasswordPolicy/PasswordPolicyEngine.php
+++ b/src/FreeDSx/Ldap/Server/PasswordPolicy/PasswordPolicyEngine.php
@@ -51,6 +51,167 @@ public function evaluatePreBind(
                 : PasswordPolicyOutcome::allow());
     }
 
+    /**
+     * Record a failed bind: append the current time to pwdFailureTime, and trip the lockout if the retained failure count meets pwdMaxFailure.
+     *
+     * Note: pwdFailureTime accumulates regardless of pwdLockout. Only the lock transition requires pwdLockout=TRUE (draft-behera-10 §5.2.9, §5.3.2).
+     */
+    public function recordBindFailure(
+        UserPasswordState $state,
+        PasswordPolicy $policy,
+    ): RecordedOutcome {
+        $now = $this->clock->now();
+        $expired = $this->hasExpiredLock($state, $policy);
+        $priorFailures = $expired ? [] : $state->failureTimes;
+
+        $retained = $this->trimFailuresToInterval(
+            $priorFailures,
+            $policy,
+        );
+        $retained[] = $now;
+
+        $changes = [Change::replace(
+            PasswordPolicyOid::NAME_PWD_FAILURE_TIME,
+            ...self::formatTimes($retained),
+        )];
+
+        $outcome = PasswordPolicyOutcome::allow();
+
+        if ($this->shouldTripLockout($state, $policy, $retained)) {
+            $changes[] = Change::replace(
+                PasswordPolicyOid::NAME_PWD_ACCOUNT_LOCKED_TIME,
+                GeneralizedTime::format($now),
+            );
+            $outcome = self::denyLocked();
+        } elseif ($expired) {
+            $changes[] = Change::reset(PasswordPolicyOid::NAME_PWD_ACCOUNT_LOCKED_TIME);
+        }
+
+        return new RecordedOutcome(
+            $outcome,
+            OperationalChanges::of(...$changes),
+        );
+    }
+
+    /**
+     * May deny if the password is expired and no grace remains; otherwise clears failures / lockout and surfaces any
+     * warning (expiration, grace, reset).
+     */
+    public function recordBindSuccess(
+        UserPasswordState $state,
+        PasswordPolicy $policy,
+    ): RecordedOutcome {
+        $now = $this->clock->now();
+        $secondsRemaining = $this->secondsUntilExpiration(
+            $state,
+            $policy,
+        );
+        $isExpired = $secondsRemaining !== null && $secondsRemaining <= 0;
+
+        if ($isExpired && !$this->graceAvailable($state, $policy, $secondsRemaining)) {
+            return new RecordedOutcome(
+                PasswordPolicyOutcome::deny(
+                    PwdPolicyError::PASSWORD_EXPIRED,
+                    ResultCode::INVALID_CREDENTIALS,
+                    'Password has expired.',
+                ),
+                OperationalChanges::none(),
+            );
+        }
+
+        $changes = $this->buildSuccessChanges(
+            $state,
+            $now,
+            $isExpired,
+        );
+        $outcome = $this->composeSuccessOutcome(
+            $state,
+            $policy,
+            $secondsRemaining,
+            $isExpired,
+        );
+
+        return new RecordedOutcome(
+            $outcome,
+            OperationalChanges::of(...$changes),
+        );
+    }
+
+    /**
+     * Evaluate a password change against the configured constraint chain.
+     */
+    public function evaluatePasswordChange(
+        #[SensitiveParameter]
+        string $newPassword,
+        #[SensitiveParameter]
+        ?string $oldPassword,
+        UserPasswordState $state,
+        PasswordPolicy $policy,
+        bool $isSelf,
+        bool $passwordIsCleartext = true,
+    ): PasswordPolicyOutcome {
+        $attempt = new PasswordChangeAttempt(
+            newPassword: $newPassword,
+            oldPassword: $oldPassword,
+            state: $state,
+            policy: $policy,
+            isSelf: $isSelf,
+            passwordIsCleartext: $passwordIsCleartext,
+        );
+
+        return $this->changeConstraints->evaluate($attempt)
+            ?? PasswordPolicyOutcome::allow();
+    }
+
+    /**
+     * Stamp pwdChangedTime, rotate pwdHistory, set/clear pwdReset, and clear pwdFailureTime / pwdAccountLockedTime /
+     * pwdGraceUseTime.
+     *
+     * @param non-empty-list<string> $hashedNewPasswords stored values being set (newest first - one per password value)
+     */
+    public function recordPasswordChange(
+        array $hashedNewPasswords,
+        UserPasswordState $state,
+        PasswordPolicy $policy,
+        bool $isSelf = true,
+    ): OperationalChanges {
+        $now = $this->clock->now();
+        $changes = [Change::replace(
+            PasswordPolicyOid::NAME_PWD_CHANGED_TIME,
+            GeneralizedTime::format($now),
+        )];
+
+        $historyChange = $this->buildHistoryChange(
+            $hashedNewPasswords,
+            $state,
+            $policy,
+            $now,
+        );
+        if ($historyChange !== null) {
+            $changes[] = $historyChange;
+        }
+
+        $resetChange = $this->buildResetChange(
+            $state,
+            $policy,
+            $isSelf,
+        );
+        if ($resetChange !== null) {
+            $changes[] = $resetChange;
+        }
+        if ($state->failureTimes !== []) {
+            $changes[] = Change::reset(PasswordPolicyOid::NAME_PWD_FAILURE_TIME);
+        }
+        if ($state->isLocked()) {
+            $changes[] = Change::reset(PasswordPolicyOid::NAME_PWD_ACCOUNT_LOCKED_TIME);
+        }
+        if ($state->graceUseTimes !== []) {
+            $changes[] = Change::reset(PasswordPolicyOid::NAME_PWD_GRACE_USE_TIME);
+        }
+
+        return OperationalChanges::of(...$changes);
+    }
+
     /**
      * Lock an account that has had no successful bind within pwdMaxIdle seconds (draft-behera-10 §5.2.19, §5.3.x).
      */
@@ -139,48 +300,6 @@ private function hasExpiredLock(
             && !$this->isLockoutEffective($state, $policy);
     }
 
-    /**
-     * Record a failed bind: append the current time to pwdFailureTime, and trip the lockout if the retained failure count meets pwdMaxFailure.
-     *
-     * Note: pwdFailureTime accumulates regardless of pwdLockout. Only the lock transition requires pwdLockout=TRUE (draft-behera-10 §5.2.9, §5.3.2).
-     */
-    public function recordBindFailure(
-        UserPasswordState $state,
-        PasswordPolicy $policy,
-    ): RecordedOutcome {
-        $now = $this->clock->now();
-        $expired = $this->hasExpiredLock($state, $policy);
-        $priorFailures = $expired ? [] : $state->failureTimes;
-
-        $retained = $this->trimFailuresToInterval(
-            $priorFailures,
-            $policy,
-        );
-        $retained[] = $now;
-
-        $changes = [Change::replace(
-            PasswordPolicyOid::NAME_PWD_FAILURE_TIME,
-            ...self::formatTimes($retained),
-        )];
-
-        $outcome = PasswordPolicyOutcome::allow();
-
-        if ($this->shouldTripLockout($state, $policy, $retained)) {
-            $changes[] = Change::replace(
-                PasswordPolicyOid::NAME_PWD_ACCOUNT_LOCKED_TIME,
-                GeneralizedTime::format($now),
-            );
-            $outcome = self::denyLocked();
-        } elseif ($expired) {
-            $changes[] = Change::reset(PasswordPolicyOid::NAME_PWD_ACCOUNT_LOCKED_TIME);
-        }
-
-        return new RecordedOutcome(
-            $outcome,
-            OperationalChanges::of(...$changes),
-        );
-    }
-
     /**
      * @param list<DateTimeImmutable> $failures
      * @return list<DateTimeImmutable>
@@ -219,50 +338,6 @@ private function shouldTripLockout(
         };
     }
 
-    /**
-     * May deny if the password is expired and no grace remains; otherwise clears failures / lockout and surfaces any
-     * warning (expiration, grace, reset).
-     */
-    public function recordBindSuccess(
-        UserPasswordState $state,
-        PasswordPolicy $policy,
-    ): RecordedOutcome {
-        $now = $this->clock->now();
-        $secondsRemaining = $this->secondsUntilExpiration(
-            $state,
-            $policy,
-        );
-        $isExpired = $secondsRemaining !== null && $secondsRemaining <= 0;
-
-        if ($isExpired && !$this->graceAvailable($state, $policy, $secondsRemaining)) {
-            return new RecordedOutcome(
-                PasswordPolicyOutcome::deny(
-                    PwdPolicyError::PASSWORD_EXPIRED,
-                    ResultCode::INVALID_CREDENTIALS,
-                    'Password has expired.',
-                ),
-                OperationalChanges::none(),
-            );
-        }
-
-        $changes = $this->buildSuccessChanges(
-            $state,
-            $now,
-            $isExpired,
-        );
-        $outcome = $this->composeSuccessOutcome(
-            $state,
-            $policy,
-            $secondsRemaining,
-            $isExpired,
-        );
-
-        return new RecordedOutcome(
-            $outcome,
-            OperationalChanges::of(...$changes),
-        );
-    }
-
     /**
      * Seconds remaining until pwdChangedTime + pwdMaxAge; null when expiration isn't configured or pwdChangedTime is
      * missing.
@@ -391,81 +466,6 @@ private function expirationWarningSeconds(
         return $secondsRemaining;
     }
 
-    /**
-     * Evaluate a password change against the configured constraint chain.
-     */
-    public function evaluatePasswordChange(
-        #[SensitiveParameter]
-        string $newPassword,
-        #[SensitiveParameter]
-        ?string $oldPassword,
-        UserPasswordState $state,
-        PasswordPolicy $policy,
-        bool $isSelf,
-        bool $passwordIsCleartext = true,
-    ): PasswordPolicyOutcome {
-        $attempt = new PasswordChangeAttempt(
-            newPassword: $newPassword,
-            oldPassword: $oldPassword,
-            state: $state,
-            policy: $policy,
-            isSelf: $isSelf,
-            passwordIsCleartext: $passwordIsCleartext,
-        );
-
-        return $this->changeConstraints->evaluate($attempt)
-            ?? PasswordPolicyOutcome::allow();
-    }
-
-    /**
-     * Stamp pwdChangedTime, rotate pwdHistory, set/clear pwdReset, and clear pwdFailureTime / pwdAccountLockedTime /
-     * pwdGraceUseTime.
-     *
-     * @param non-empty-list<string> $hashedNewPasswords stored values being set (newest first - one per password value)
-     */
-    public function recordPasswordChange(
-        array $hashedNewPasswords,
-        UserPasswordState $state,
-        PasswordPolicy $policy,
-        bool $isSelf = true,
-    ): OperationalChanges {
-        $now = $this->clock->now();
-        $changes = [Change::replace(
-            PasswordPolicyOid::NAME_PWD_CHANGED_TIME,
-            GeneralizedTime::format($now),
-        )];
-
-        $historyChange = $this->buildHistoryChange(
-            $hashedNewPasswords,
-            $state,
-            $policy,
-            $now,
-        );
-        if ($historyChange !== null) {
-            $changes[] = $historyChange;
-        }
-
-        $resetChange = $this->buildResetChange(
-            $state,
-            $policy,
-            $isSelf,
-        );
-        if ($resetChange !== null) {
-            $changes[] = $resetChange;
-        }
-        if ($state->failureTimes !== []) {
-            $changes[] = Change::reset(PasswordPolicyOid::NAME_PWD_FAILURE_TIME);
-        }
-        if ($state->isLocked()) {
-            $changes[] = Change::reset(PasswordPolicyOid::NAME_PWD_ACCOUNT_LOCKED_TIME);
-        }
-        if ($state->graceUseTimes !== []) {
-            $changes[] = Change::reset(PasswordPolicyOid::NAME_PWD_GRACE_USE_TIME);
-        }
-
-        return OperationalChanges::of(...$changes);
-    }
-
     /**
      * An administrative reset under pwdMustChange sets pwdReset; otherwise a prior pwdReset is satisfied and cleared.
      */
diff --git a/src/FreeDSx/Ldap/Server/Proxy/ProxyProtocolFactory.php b/src/FreeDSx/Ldap/Server/Proxy/ProxyProtocolFactory.php
index 939dccc0..2ae25f54 100644
--- a/src/FreeDSx/Ldap/Server/Proxy/ProxyProtocolFactory.php
+++ b/src/FreeDSx/Ldap/Server/Proxy/ProxyProtocolFactory.php
@@ -45,11 +45,6 @@ public function __construct(
         private readonly ProxyOptions $proxyOptions,
     ) {}
 
-    protected function serverOptions(): ServerOptions
-    {
-        return $this->options;
-    }
-
     public function make(
         Socket $socket,
         ConnectionContext $context = new ConnectionContext(),
@@ -105,4 +100,9 @@ public function make(
             connectionContext: $context,
         );
     }
+
+    protected function serverOptions(): ServerOptions
+    {
+        return $this->options;
+    }
 }
diff --git a/src/FreeDSx/Ldap/Server/ServerProtocolFactory.php b/src/FreeDSx/Ldap/Server/ServerProtocolFactory.php
index b6ce0100..1ac34e8d 100644
--- a/src/FreeDSx/Ldap/Server/ServerProtocolFactory.php
+++ b/src/FreeDSx/Ldap/Server/ServerProtocolFactory.php
@@ -85,11 +85,6 @@ public function __construct(
         private readonly ?OperationRollupCoordinator $operationRollup = null,
     ) {}
 
-    protected function serverOptions(): ServerOptions
-    {
-        return $this->options;
-    }
-
     public function make(
         Socket $socket,
         ConnectionContext $context = new ConnectionContext(),
@@ -229,6 +224,11 @@ public function make(
         );
     }
 
+    protected function serverOptions(): ServerOptions
+    {
+        return $this->options;
+    }
+
     private function decoratePasswordAuthenticator(
         PasswordAuthenticatableInterface $inner,
         LdapBackendInterface $backend,
diff --git a/src/FreeDSx/Ldap/Sync/Result/SyncIdSetResult.php b/src/FreeDSx/Ldap/Sync/Result/SyncIdSetResult.php
index 9f61b17f..0c662d07 100644
--- a/src/FreeDSx/Ldap/Sync/Result/SyncIdSetResult.php
+++ b/src/FreeDSx/Ldap/Sync/Result/SyncIdSetResult.php
@@ -68,25 +68,6 @@ public function getEntryUuids(): array
             ->getEntryUuids();
     }
 
-    private function getSyncIdSet(): SyncIdSet
-    {
-        if ($this->idSet !== null) {
-            return $this->idSet;
-        }
-        $idSet = $this->message->getResponse();
-
-        if (!$idSet instanceof SyncIdSet) {
-            throw new UnexpectedValueException(sprintf(
-                'Expected an instance of "%s", but got "%s".',
-                SyncIdSet::class,
-                get_class($idSet),
-            ));
-        }
-        $this->idSet = $idSet;
-
-        return $this->idSet;
-    }
-
     /**
      * The cookie to be used following this sync set.
      */
@@ -113,4 +94,23 @@ public function getIterator(): Traversable
     {
         return new ArrayIterator($this->getEntryUuids());
     }
+
+    private function getSyncIdSet(): SyncIdSet
+    {
+        if ($this->idSet !== null) {
+            return $this->idSet;
+        }
+        $idSet = $this->message->getResponse();
+
+        if (!$idSet instanceof SyncIdSet) {
+            throw new UnexpectedValueException(sprintf(
+                'Expected an instance of "%s", but got "%s".',
+                SyncIdSet::class,
+                get_class($idSet),
+            ));
+        }
+        $this->idSet = $idSet;
+
+        return $this->idSet;
+    }
 }
diff --git a/tests/integration/Security/PasswordPolicyBindEnforcementTest.php b/tests/integration/Security/PasswordPolicyBindEnforcementTest.php
index 2f26a416..e66b0775 100644
--- a/tests/integration/Security/PasswordPolicyBindEnforcementTest.php
+++ b/tests/integration/Security/PasswordPolicyBindEnforcementTest.php
@@ -49,12 +49,17 @@
 final class PasswordPolicyBindEnforcementTest extends TestCase
 {
     private const NOW = '2026-05-20T12:00:00Z';
+
     private const USER_DN = 'cn=user,dc=foo,dc=bar';
+
     private const PASSWORD = '12345';
 
     private FrozenClock $clock;
+
     private WritableStorageBackend $backend;
+
     private PasswordPolicyContext $context;
+
     private RecordingLogger $logger;
 
     protected function setUp(): void
diff --git a/tests/integration/Security/PasswordPolicyChangeEnforcementTest.php b/tests/integration/Security/PasswordPolicyChangeEnforcementTest.php
index d2427b0c..15dde712 100644
--- a/tests/integration/Security/PasswordPolicyChangeEnforcementTest.php
+++ b/tests/integration/Security/PasswordPolicyChangeEnforcementTest.php
@@ -64,12 +64,17 @@
 final class PasswordPolicyChangeEnforcementTest extends TestCase
 {
     private const NOW = '2026-05-20T12:00:00Z';
+
     private const USER_DN = 'cn=user,dc=foo,dc=bar';
+
     private const OLD_PASSWORD = '12345';
 
     private FrozenClock $clock;
+
     private WritableStorageBackend $backend;
+
     private PasswordPolicyContext $context;
+
     private ?LdapMessageResponse $response = null;
 
     protected function setUp(): void
diff --git a/tests/integration/Security/PasswordPolicyPlainModifyEnforcementTest.php b/tests/integration/Security/PasswordPolicyPlainModifyEnforcementTest.php
index 00b058ad..b12d6539 100644
--- a/tests/integration/Security/PasswordPolicyPlainModifyEnforcementTest.php
+++ b/tests/integration/Security/PasswordPolicyPlainModifyEnforcementTest.php
@@ -62,11 +62,15 @@
 final class PasswordPolicyPlainModifyEnforcementTest extends TestCase
 {
     private const NOW = '2026-05-20T12:00:00Z';
+
     private const USER_DN = 'cn=user,dc=foo,dc=bar';
 
     private FrozenClock $clock;
+
     private WritableStorageBackend $backend;
+
     private PasswordPolicyContext $context;
+
     private ?LdapMessageResponse $response = null;
 
     protected function setUp(): void
diff --git a/tests/integration/ServerTestCase.php b/tests/integration/ServerTestCase.php
index edf9429b..704d711b 100644
--- a/tests/integration/ServerTestCase.php
+++ b/tests/integration/ServerTestCase.php
@@ -226,29 +226,6 @@ protected function ldapClient(): LdapClient
         return $this->client ?? throw new RuntimeException('The test LDAP client is not set.');
     }
 
-    /**
-     * @param list<string> $extraArgs
-     */
-    private static function launchSharedProcess(
-        string $mode,
-        string $transport,
-        array $extraArgs,
-    ): void {
-        $processArgs = [
-            'php',
-            '-dpcov.enabled=0',
-            __DIR__ . '/../bin/' . $mode . '.php',
-            '--transport=' . $transport,
-            ...$extraArgs,
-        ];
-
-        $process = new Process($processArgs);
-        $process->start();
-        self::waitForProcess($process, 'server starting...');
-
-        self::$sharedProcess = $process;
-    }
-
     protected function buildClient(string $transport): LdapClient
     {
         $useSsl = false;
@@ -272,6 +249,29 @@ protected function buildClient(string $transport): LdapClient
         );
     }
 
+    /**
+     * @param list<string> $extraArgs
+     */
+    private static function launchSharedProcess(
+        string $mode,
+        string $transport,
+        array $extraArgs,
+    ): void {
+        $processArgs = [
+            'php',
+            '-dpcov.enabled=0',
+            __DIR__ . '/../bin/' . $mode . '.php',
+            '--transport=' . $transport,
+            ...$extraArgs,
+        ];
+
+        $process = new Process($processArgs);
+        $process->start();
+        self::waitForProcess($process, 'server starting...');
+
+        self::$sharedProcess = $process;
+    }
+
     private static function waitForProcess(Process $process, string $marker): string
     {
         $deadline = microtime(true) + self::SERVER_MAX_WAIT_SECONDS;
diff --git a/tests/integration/Storage/LdapBackendStorageTest.php b/tests/integration/Storage/LdapBackendStorageTest.php
index 1e02cfbd..186628f3 100644
--- a/tests/integration/Storage/LdapBackendStorageTest.php
+++ b/tests/integration/Storage/LdapBackendStorageTest.php
@@ -40,16 +40,6 @@ public static function setUpBeforeClass(): void
         );
     }
 
-    /**
-     * Hook for subclasses to route the shared server through a different backend.
-     *
-     * @return list<string>
-     */
-    protected static function storageExtraArgs(): array
-    {
-        return [];
-    }
-
     public static function tearDownAfterClass(): void
     {
         parent::tearDownAfterClass();
@@ -63,11 +53,6 @@ public function setUp(): void
         parent::setUp();
     }
 
-    protected function authenticateUser(): void
-    {
-        $this->ldapClient()->bind('cn=user,dc=foo,dc=bar', '12345');
-    }
-
     public function testBindWithCorrectCredentials(): void
     {
         // No exception thrown — bind succeeded; verify the session is usable
@@ -533,4 +518,19 @@ public function testSortControlPlacesMissingAttributeFirstWhenDescending(): void
             $first->get('cn')?->getValues()[0],
         );
     }
+
+    /**
+     * Hook for subclasses to route the shared server through a different backend.
+     *
+     * @return list<string>
+     */
+    protected static function storageExtraArgs(): array
+    {
+        return [];
+    }
+
+    protected function authenticateUser(): void
+    {
+        $this->ldapClient()->bind('cn=user,dc=foo,dc=bar', '12345');
+    }
 }
diff --git a/tests/integration/Sync/SyncReplTest.php b/tests/integration/Sync/SyncReplTest.php
index 3eb81c6b..4d054ba5 100644
--- a/tests/integration/Sync/SyncReplTest.php
+++ b/tests/integration/Sync/SyncReplTest.php
@@ -24,6 +24,8 @@ class SyncReplTest extends ExternalLdapTestCase
 {
     private ?Process $syncWriteProcess = null;
 
+    private ?string $syncSignalFile = null;
+
     protected function setUp(): void
     {
         parent::setUp();
@@ -37,8 +39,6 @@ protected function setUp(): void
         $this->waitForServer();
     }
 
-    private ?string $syncSignalFile = null;
-
     public function tearDown(): void
     {
         $this->syncWriteProcess?->stop();
diff --git a/tests/performance/Compare/BenchCompareCommand.php b/tests/performance/Compare/BenchCompareCommand.php
index 93c61199..ab5b8686 100644
--- a/tests/performance/Compare/BenchCompareCommand.php
+++ b/tests/performance/Compare/BenchCompareCommand.php
@@ -36,10 +36,6 @@
  */
 final class BenchCompareCommand extends Command
 {
-    protected static $defaultName = 'load-compare';
-
-    protected static $defaultDescription = 'Benchmark FreeDSx vs an external LDAP target under identical workload parameters.';
-
     private const DEFAULT_TARGET_BASE_DN = 'dc=example,dc=com';
 
     private const DEFAULT_TARGET_BIND_DN = 'cn=admin,dc=example,dc=com';
@@ -48,6 +44,10 @@ final class BenchCompareCommand extends Command
 
     private const DEFAULT_FREEDSX_PORT = 10389;
 
+    protected static $defaultName = 'load-compare';
+
+    protected static $defaultDescription = 'Benchmark FreeDSx vs an external LDAP target under identical workload parameters.';
+
     protected function configure(): void
     {
         $this
diff --git a/tests/performance/Server/ServerManager.php b/tests/performance/Server/ServerManager.php
index e72d914f..6bd2ebd6 100644
--- a/tests/performance/Server/ServerManager.php
+++ b/tests/performance/Server/ServerManager.php
@@ -35,9 +35,9 @@ public function __construct(
         private readonly int $maxWaitSeconds = 10,
     ) {}
 
-    private function readyDeadlineSeconds(): int
+    public function __destruct()
     {
-        return $this->maxWaitSeconds + (int) ceil($this->config->seedEntries / 100);
+        $this->stop();
     }
 
     public function start(): void
@@ -92,6 +92,11 @@ public function stop(): void
         }
     }
 
+    private function readyDeadlineSeconds(): int
+    {
+        return $this->maxWaitSeconds + (int) ceil($this->config->seedEntries / 100);
+    }
+
     /**
      * Avoids Symfony Process::stop()'s SIGTERM/wait/SIGKILL dance, which has been observed to segfault a pcntl-runner
      * backend under tracing JIT (the JIT instability is load-related; stopping is just where it tended to surface).
@@ -119,11 +124,6 @@ private function signalAndReap(int $pid): void
         @pcntl_waitpid($pid, $status);
     }
 
-    public function __destruct()
-    {
-        $this->stop();
-    }
-
     private function awaitReady(Process $process): void
     {
         $waitSeconds = $this->readyDeadlineSeconds();
diff --git a/tests/performance/Workload/Worker.php b/tests/performance/Workload/Worker.php
index 19765114..9e1756b5 100644
--- a/tests/performance/Workload/Worker.php
+++ b/tests/performance/Workload/Worker.php
@@ -73,15 +73,6 @@ public function __construct(
         ];
     }
 
-    private function deriveMailDomain(string $baseDn): string
-    {
-        if (preg_match_all('/dc=([^,]+)/i', $baseDn, $matches) === 0) {
-            return 'example.com';
-        }
-
-        return implode('.', array_map('strtolower', $matches[1]));
-    }
-
     public function run(): void
     {
         $client = $this->buildClient();
@@ -117,6 +108,15 @@ public function run(): void
         $this->cleanup($client);
     }
 
+    private function deriveMailDomain(string $baseDn): string
+    {
+        if (preg_match_all('/dc=([^,]+)/i', $baseDn, $matches) === 0) {
+            return 'example.com';
+        }
+
+        return implode('.', array_map('strtolower', $matches[1]));
+    }
+
     private function shouldContinue(?float $deadline, int $iterations): bool
     {
         if ($deadline !== null && microtime(true) >= $deadline) {
diff --git a/tests/support/LdapBackendStorageCommand.php b/tests/support/LdapBackendStorageCommand.php
index beb0bdd4..5a551cc9 100644
--- a/tests/support/LdapBackendStorageCommand.php
+++ b/tests/support/LdapBackendStorageCommand.php
@@ -305,5 +305,4 @@ protected function execute(
 
         return Command::SUCCESS;
     }
-
 }
diff --git a/tests/unit/Control/Ad/SdFlagsControlTest.php b/tests/unit/Control/Ad/SdFlagsControlTest.php
index eb9d20a7..d7fa7db9 100644
--- a/tests/unit/Control/Ad/SdFlagsControlTest.php
+++ b/tests/unit/Control/Ad/SdFlagsControlTest.php
@@ -21,6 +21,7 @@
 class SdFlagsControlTest extends \PHPUnit\Framework\TestCase
 {
     protected SdFlagsControl $subject;
+
     protected function setUp(): void
     {
         $this->subject = new SdFlagsControl(SdFlagsControl::DACL_SECURITY_INFORMATION);
diff --git a/tests/unit/Protocol/Bind/Sasl/SaslExchangeTest.php b/tests/unit/Protocol/Bind/Sasl/SaslExchangeTest.php
index e1d568b2..58a04bd8 100644
--- a/tests/unit/Protocol/Bind/Sasl/SaslExchangeTest.php
+++ b/tests/unit/Protocol/Bind/Sasl/SaslExchangeTest.php
@@ -59,27 +59,6 @@ protected function setUp(): void
         );
     }
 
-    private function makeInput(?string $initialCredentials = null): SaslExchangeInput
-    {
-        return new SaslExchangeInput(
-            challenge: $this->mockChallenge,
-            mechName: MechanismName::from(self::MECH),
-            initialMessage: new LdapMessageRequest(1, new SaslBindRequest(self::MECH)),
-            initialCredentials: $initialCredentials,
-        );
-    }
-
-    private function makeContext(
-        bool $isComplete,
-        bool $isAuthenticated = true,
-        ?string $response = null,
-    ): SaslContext {
-        return (new SaslContext())
-            ->setIsComplete($isComplete)
-            ->setIsAuthenticated($isAuthenticated)
-            ->setResponse($response);
-    }
-
     public function test_it_breaks_immediately_on_invalid_proof(): void
     {
         // Context is complete but not authenticated (e.g. SCRAM e=invalid-proof).
@@ -233,4 +212,25 @@ public function test_it_throws_protocol_error_when_non_sasl_request_received_mid
 
         $this->subject->run($this->makeInput());
     }
+
+    private function makeInput(?string $initialCredentials = null): SaslExchangeInput
+    {
+        return new SaslExchangeInput(
+            challenge: $this->mockChallenge,
+            mechName: MechanismName::from(self::MECH),
+            initialMessage: new LdapMessageRequest(1, new SaslBindRequest(self::MECH)),
+            initialCredentials: $initialCredentials,
+        );
+    }
+
+    private function makeContext(
+        bool $isComplete,
+        bool $isAuthenticated = true,
+        ?string $response = null,
+    ): SaslContext {
+        return (new SaslContext())
+            ->setIsComplete($isComplete)
+            ->setIsAuthenticated($isAuthenticated)
+            ->setResponse($response);
+    }
 }
diff --git a/tests/unit/Protocol/ClientProtocolHandler/ClientSyncHandlerTest.php b/tests/unit/Protocol/ClientProtocolHandler/ClientSyncHandlerTest.php
index 84ab56d0..2c25f475 100644
--- a/tests/unit/Protocol/ClientProtocolHandler/ClientSyncHandlerTest.php
+++ b/tests/unit/Protocol/ClientProtocolHandler/ClientSyncHandlerTest.php
@@ -97,7 +97,6 @@ public function test_it_should_set_a_default_DN_for_a_request_that_has_none(): v
         $this->subject->handleRequest($mockMessage);
     }
 
-
     public function test_it_should_retrieve_results_until_it_receives_a_search_done_with_a_sync_done_control(): void
     {
         $messageTo = new LdapMessageRequest(
diff --git a/tests/unit/Protocol/ClientProtocolHandler/ClientUnbindHandlerTest.php b/tests/unit/Protocol/ClientProtocolHandler/ClientUnbindHandlerTest.php
index 8f606a48..daf8bbd8 100644
--- a/tests/unit/Protocol/ClientProtocolHandler/ClientUnbindHandlerTest.php
+++ b/tests/unit/Protocol/ClientProtocolHandler/ClientUnbindHandlerTest.php
@@ -25,6 +25,7 @@ final class ClientUnbindHandlerTest extends TestCase
     private ClientUnbindHandler $subject;
 
     private ClientQueue&MockObject $mockQueue;
+
     protected function setUp(): void
     {
         $this->mockQueue = $this->createMock(ClientQueue::class);
diff --git a/tests/unit/Protocol/Queue/ServerQueueTest.php b/tests/unit/Protocol/Queue/ServerQueueTest.php
index a40f6c95..25a83c1d 100644
--- a/tests/unit/Protocol/Queue/ServerQueueTest.php
+++ b/tests/unit/Protocol/Queue/ServerQueueTest.php
@@ -113,7 +113,6 @@ public function test_it_should_send_multiple_messages_with_write_and_respect_the
         );
     }
 
-
     public function test_it_records_bytes_sent_for_each_outgoing_message(): void
     {
         $recorder = new InMemoryMetricsRecorder();
diff --git a/tests/unit/Protocol/ServerProtocolHandler/ServerPagingHandlerTest.php b/tests/unit/Protocol/ServerProtocolHandler/ServerPagingHandlerTest.php
index 28ca8b12..927e7ded 100644
--- a/tests/unit/Protocol/ServerProtocolHandler/ServerPagingHandlerTest.php
+++ b/tests/unit/Protocol/ServerProtocolHandler/ServerPagingHandlerTest.php
@@ -112,41 +112,6 @@ protected function setUp(): void
         );
     }
 
-    private function makeGenerator(Entry ...$entries): Generator
-    {
-        yield from $entries;
-    }
-
-    /**
-     * @return list<LdapMessageResponse>
-     */
-    private function entryMessages(): array
-    {
-        return array_values(array_filter(
-            $this->sentMessages,
-            static fn(LdapMessageResponse $m): bool => $m->getResponse() instanceof SearchResultEntry,
-        ));
-    }
-
-    private function doneMessage(): LdapMessageResponse
-    {
-        foreach ($this->sentMessages as $message) {
-            if ($message->getResponse() instanceof SearchResultDone) {
-                return $message;
-            }
-        }
-
-        self::fail('No SearchResultDone message was sent.');
-    }
-
-    private function donePagingControl(): PagingControl
-    {
-        $paging = $this->doneMessage()->controls()->get(Control::OID_PAGING);
-        self::assertInstanceOf(PagingControl::class, $paging);
-
-        return $paging;
-    }
-
     public function test_it_should_call_the_backend_search_on_paging_start_and_return_entries(): void
     {
         $message = $this->makeSearchMessage(size: 10);
@@ -629,28 +594,6 @@ public function test_it_should_skip_entry_when_filter_no_longer_matches_after_ac
         self::assertSame([], $this->entryMessages());
     }
 
-    private function makeExistingPagingRequest(
-        int $size = 10,
-        string $cookie = 'bar',
-        string $nextCookie = 'foo',
-        ?SearchRequest $searchRequest = null,
-    ): PagingRequest {
-        $searchReq = $searchRequest ?? $this->makeSearchRequest();
-
-        $pagingReq = new PagingRequest(
-            new PagingControl($size, $cookie),
-            $searchReq,
-            new ControlBag(),
-            $nextCookie,
-        );
-
-        $pagingReq->markProcessed();
-        $this->requestHistory->pagingRequest()->add($pagingReq);
-        $this->requestHistory->storePagingGenerator($nextCookie, $this->makeGenerator());
-
-        return $pagingReq;
-    }
-
     public function test_sort_control_appends_sorting_response_control_to_done_message(): void
     {
         $message = new LdapMessageRequest(
@@ -784,6 +727,63 @@ public function test_matched_dn_is_dropped_when_access_control_hides_ancestor_on
         );
     }
 
+    private function makeGenerator(Entry ...$entries): Generator
+    {
+        yield from $entries;
+    }
+
+    /**
+     * @return list<LdapMessageResponse>
+     */
+    private function entryMessages(): array
+    {
+        return array_values(array_filter(
+            $this->sentMessages,
+            static fn(LdapMessageResponse $m): bool => $m->getResponse() instanceof SearchResultEntry,
+        ));
+    }
+
+    private function doneMessage(): LdapMessageResponse
+    {
+        foreach ($this->sentMessages as $message) {
+            if ($message->getResponse() instanceof SearchResultDone) {
+                return $message;
+            }
+        }
+
+        self::fail('No SearchResultDone message was sent.');
+    }
+
+    private function donePagingControl(): PagingControl
+    {
+        $paging = $this->doneMessage()->controls()->get(Control::OID_PAGING);
+        self::assertInstanceOf(PagingControl::class, $paging);
+
+        return $paging;
+    }
+
+    private function makeExistingPagingRequest(
+        int $size = 10,
+        string $cookie = 'bar',
+        string $nextCookie = 'foo',
+        ?SearchRequest $searchRequest = null,
+    ): PagingRequest {
+        $searchReq = $searchRequest ?? $this->makeSearchRequest();
+
+        $pagingReq = new PagingRequest(
+            new PagingControl($size, $cookie),
+            $searchReq,
+            new ControlBag(),
+            $nextCookie,
+        );
+
+        $pagingReq->markProcessed();
+        $this->requestHistory->pagingRequest()->add($pagingReq);
+        $this->requestHistory->storePagingGenerator($nextCookie, $this->makeGenerator());
+
+        return $pagingReq;
+    }
+
     private function makeSearchMessage(
         int $size = 10,
         string $cookie = '',
diff --git a/tests/unit/Protocol/ServerProtocolHandler/ServerRootDseHandlerTest.php b/tests/unit/Protocol/ServerProtocolHandler/ServerRootDseHandlerTest.php
index 2c9164bc..037f8d65 100644
--- a/tests/unit/Protocol/ServerProtocolHandler/ServerRootDseHandlerTest.php
+++ b/tests/unit/Protocol/ServerProtocolHandler/ServerRootDseHandlerTest.php
@@ -57,27 +57,6 @@ protected function setUp(): void
         $this->withBackendNamingContexts([]);
     }
 
-    /**
-     * @param list<string> $dns
-     */
-    private function withBackendNamingContexts(array $dns): void
-    {
-        $this->mockBackend = $this->createMock(LdapBackendInterface::class);
-        $this->mockBackend
-            ->method('namingContexts')
-            ->willReturn(array_map(
-                fn(string $dn): Dn => new Dn($dn),
-                $dns,
-            ));
-
-        $this->subject = new ServerRootDseHandler(
-            $this->options,
-            $this->mockQueue,
-            $this->mockBackend,
-            null,
-        );
-    }
-
     public function test_it_should_send_back_a_RootDSE(): void
     {
         $this->options->setDseVendorName('Foo');
@@ -377,4 +356,25 @@ public function test_it_should_only_return_specific_attributes_from_the_RootDSE_
             $this->mockToken,
         );
     }
+
+    /**
+     * @param list<string> $dns
+     */
+    private function withBackendNamingContexts(array $dns): void
+    {
+        $this->mockBackend = $this->createMock(LdapBackendInterface::class);
+        $this->mockBackend
+            ->method('namingContexts')
+            ->willReturn(array_map(
+                fn(string $dn): Dn => new Dn($dn),
+                $dns,
+            ));
+
+        $this->subject = new ServerRootDseHandler(
+            $this->options,
+            $this->mockQueue,
+            $this->mockBackend,
+            null,
+        );
+    }
 }
diff --git a/tests/unit/Protocol/ServerProtocolHandler/ServerSearchHandlerTest.php b/tests/unit/Protocol/ServerProtocolHandler/ServerSearchHandlerTest.php
index 80b51da9..dcbc7377 100644
--- a/tests/unit/Protocol/ServerProtocolHandler/ServerSearchHandlerTest.php
+++ b/tests/unit/Protocol/ServerProtocolHandler/ServerSearchHandlerTest.php
@@ -103,22 +103,6 @@ protected function setUp(): void
         );
     }
 
-    private function makeGenerator(Entry ...$entries): Generator
-    {
-        yield from $entries;
-    }
-
-    /**
-     * @param list<LdapMessageResponse> $expected
-     */
-    private function assertSentMessages(array $expected): void
-    {
-        self::assertEquals(
-            $expected,
-            $this->sentMessages,
-        );
-    }
-
     public function test_it_should_send_entries_from_the_backend_to_the_client(): void
     {
         $entry1 = Entry::create('dc=foo,dc=bar', ['cn' => 'foo']);
@@ -682,4 +666,20 @@ public function test_no_sort_control_does_not_append_sorting_response_control():
         self::assertInstanceOf(LdapMessageResponse::class, $done);
         self::assertNull($done->controls()->get(Control::OID_SORTING_RESPONSE));
     }
+
+    private function makeGenerator(Entry ...$entries): Generator
+    {
+        yield from $entries;
+    }
+
+    /**
+     * @param list<LdapMessageResponse> $expected
+     */
+    private function assertSentMessages(array $expected): void
+    {
+        self::assertEquals(
+            $expected,
+            $this->sentMessages,
+        );
+    }
 }
diff --git a/tests/unit/Protocol/ServerProtocolHandler/ServerSubschemaHandlerTest.php b/tests/unit/Protocol/ServerProtocolHandler/ServerSubschemaHandlerTest.php
index 3993f3a0..19cbb27c 100644
--- a/tests/unit/Protocol/ServerProtocolHandler/ServerSubschemaHandlerTest.php
+++ b/tests/unit/Protocol/ServerProtocolHandler/ServerSubschemaHandlerTest.php
@@ -51,14 +51,6 @@ protected function setUp(): void
         );
     }
 
-    private function makeMessage(): LdapMessageRequest
-    {
-        return new LdapMessageRequest(
-            1,
-            (new SearchRequest(Filters::present('objectClass')))->base('cn=Subschema')->useBaseScope(),
-        );
-    }
-
     public function test_it_returns_a_stub_subschema_entry(): void
     {
         $this->mockQueue
@@ -151,6 +143,14 @@ public function test_it_returns_non_empty_matching_rule_use(): void
         );
     }
 
+    private function makeMessage(): LdapMessageRequest
+    {
+        return new LdapMessageRequest(
+            1,
+            (new SearchRequest(Filters::present('objectClass')))->base('cn=Subschema')->useBaseScope(),
+        );
+    }
+
     private function handleAndCaptureEntry(): Entry
     {
         $captured = null;
diff --git a/tests/unit/Schema/Validation/SchemaValidatorTest.php b/tests/unit/Schema/Validation/SchemaValidatorTest.php
index f237a0d2..86cf752f 100644
--- a/tests/unit/Schema/Validation/SchemaValidatorTest.php
+++ b/tests/unit/Schema/Validation/SchemaValidatorTest.php
@@ -42,58 +42,6 @@ protected function setUp(): void
         );
     }
 
-    private function personEntry(string $dn = 'cn=Alice,dc=example,dc=com'): Entry
-    {
-        return new Entry(
-            new Dn($dn),
-            new Attribute('objectClass', 'top', 'person'),
-            new Attribute('cn', 'Alice'),
-            new Attribute('sn', 'Smith'),
-        );
-    }
-
-    private function syntaxValidator(): SchemaValidator
-    {
-        $schema = (new Schema())
-            ->addAttributeType(new AttributeType(
-                '1.5',
-                ['objectClass'],
-                syntaxOid: SyntaxOid::OID_OID,
-            ))
-            ->addAttributeType(new AttributeType(
-                '1.10',
-                ['widgetCount'],
-                syntaxOid: SyntaxOid::OID_INTEGER,
-            ))
-            ->addAttributeType(new AttributeType(
-                '1.11',
-                ['widgetOwner'],
-                syntaxOid: SyntaxOid::OID_DISTINGUISHED_NAME,
-            ))
-            ->addAttributeType(new AttributeType(
-                '1.12',
-                ['widgetSeenAt'],
-                syntaxOid: SyntaxOid::OID_GENERALIZED_TIME,
-            ))
-            ->addAttributeType(new AttributeType(
-                '1.13',
-                ['widgetActive'],
-                syntaxOid: SyntaxOid::OID_BOOLEAN,
-            ))
-            ->addObjectClass(new ObjectClass(
-                '2.10',
-                ['widget'],
-                ObjectClassType::StructuralClass,
-                must: ['objectClass'],
-                may: ['widgetCount', 'widgetOwner', 'widgetSeenAt', 'widgetActive'],
-            ));
-
-        return new SchemaValidator(
-            $schema,
-            SchemaValidationMode::Strict,
-        );
-    }
-
     public function test_mode_returns_configured_mode(): void
     {
         self::assertSame(
@@ -432,6 +380,82 @@ public function test_system_add_still_validates_value_syntax(): void
         );
     }
 
+    public function test_add_structural_chain_passes(): void
+    {
+        $entry = new Entry(
+            new Dn('cn=Thing,dc=example,dc=com'),
+            new Attribute('objectClass', 'top', 'alpha', 'alphaChild'),
+        );
+
+        $this->expectNotToPerformAssertions();
+        $this->structuralChainValidator()->validateAdd($entry);
+    }
+
+    public function test_add_two_unrelated_structural_classes_throws_object_class_violation(): void
+    {
+        $entry = new Entry(
+            new Dn('cn=Thing,dc=example,dc=com'),
+            new Attribute('objectClass', 'top', 'alpha', 'beta'),
+        );
+
+        $this->expectException(OperationException::class);
+        $this->expectExceptionCode(ResultCode::OBJECT_CLASS_VIOLATION);
+
+        $this->structuralChainValidator()->validateAdd($entry);
+    }
+
+    private function personEntry(string $dn = 'cn=Alice,dc=example,dc=com'): Entry
+    {
+        return new Entry(
+            new Dn($dn),
+            new Attribute('objectClass', 'top', 'person'),
+            new Attribute('cn', 'Alice'),
+            new Attribute('sn', 'Smith'),
+        );
+    }
+
+    private function syntaxValidator(): SchemaValidator
+    {
+        $schema = (new Schema())
+            ->addAttributeType(new AttributeType(
+                '1.5',
+                ['objectClass'],
+                syntaxOid: SyntaxOid::OID_OID,
+            ))
+            ->addAttributeType(new AttributeType(
+                '1.10',
+                ['widgetCount'],
+                syntaxOid: SyntaxOid::OID_INTEGER,
+            ))
+            ->addAttributeType(new AttributeType(
+                '1.11',
+                ['widgetOwner'],
+                syntaxOid: SyntaxOid::OID_DISTINGUISHED_NAME,
+            ))
+            ->addAttributeType(new AttributeType(
+                '1.12',
+                ['widgetSeenAt'],
+                syntaxOid: SyntaxOid::OID_GENERALIZED_TIME,
+            ))
+            ->addAttributeType(new AttributeType(
+                '1.13',
+                ['widgetActive'],
+                syntaxOid: SyntaxOid::OID_BOOLEAN,
+            ))
+            ->addObjectClass(new ObjectClass(
+                '2.10',
+                ['widget'],
+                ObjectClassType::StructuralClass,
+                must: ['objectClass'],
+                may: ['widgetCount', 'widgetOwner', 'widgetSeenAt', 'widgetActive'],
+            ));
+
+        return new SchemaValidator(
+            $schema,
+            SchemaValidationMode::Strict,
+        );
+    }
+
     private function structuralChainValidator(): SchemaValidator
     {
         $schema = (new Schema())
@@ -469,28 +493,4 @@ private function structuralChainValidator(): SchemaValidator
             SchemaValidationMode::Strict,
         );
     }
-
-    public function test_add_structural_chain_passes(): void
-    {
-        $entry = new Entry(
-            new Dn('cn=Thing,dc=example,dc=com'),
-            new Attribute('objectClass', 'top', 'alpha', 'alphaChild'),
-        );
-
-        $this->expectNotToPerformAssertions();
-        $this->structuralChainValidator()->validateAdd($entry);
-    }
-
-    public function test_add_two_unrelated_structural_classes_throws_object_class_violation(): void
-    {
-        $entry = new Entry(
-            new Dn('cn=Thing,dc=example,dc=com'),
-            new Attribute('objectClass', 'top', 'alpha', 'beta'),
-        );
-
-        $this->expectException(OperationException::class);
-        $this->expectExceptionCode(ResultCode::OBJECT_CLASS_VIOLATION);
-
-        $this->structuralChainValidator()->validateAdd($entry);
-    }
 }
diff --git a/tests/unit/Search/PagingTest.php b/tests/unit/Search/PagingTest.php
index 72ecdd54..cf487520 100644
--- a/tests/unit/Search/PagingTest.php
+++ b/tests/unit/Search/PagingTest.php
@@ -163,7 +163,6 @@ public function test_it_should_get_marked_as_ended_if_not_critical_and_no_contro
         self::assertFalse($this->subject->hasEntries());
     }
 
-
     public function test_it_should_throw_an_exception_if_marked_as_critical_and_no_control_is_received(): void
     {
         self::expectException(ProtocolException::class);
diff --git a/tests/unit/Server/Backend/Auth/NameResolver/PasswordAuthenticatorTest.php b/tests/unit/Server/Backend/Auth/NameResolver/PasswordAuthenticatorTest.php
index 3d8c72c9..94ac51e4 100644
--- a/tests/unit/Server/Backend/Auth/NameResolver/PasswordAuthenticatorTest.php
+++ b/tests/unit/Server/Backend/Auth/NameResolver/PasswordAuthenticatorTest.php
@@ -39,22 +39,6 @@ protected function setUp(): void
         $this->mockBackend = $this->createMock(LdapBackendInterface::class);
     }
 
-    private function subject(?Entry $resolvedEntry = null): PasswordAuthenticator
-    {
-        $this->mockResolver
-            ->method('resolve')
-            ->with(
-                self::isType('string'),
-                $this->mockBackend,
-            )
-            ->willReturn($resolvedEntry);
-
-        return new PasswordAuthenticator(
-            $this->mockResolver,
-            $this->mockBackend,
-        );
-    }
-
     public function test_throws_when_entry_not_found(): void
     {
         self::expectException(OperationException::class);
@@ -301,4 +285,20 @@ public function test_get_sasl_identity_uses_the_same_resolver_as_authenticate():
 
         self::assertInstanceOf(SaslIdentity::class, $identity);
     }
+
+    private function subject(?Entry $resolvedEntry = null): PasswordAuthenticator
+    {
+        $this->mockResolver
+            ->method('resolve')
+            ->with(
+                self::isType('string'),
+                $this->mockBackend,
+            )
+            ->willReturn($resolvedEntry);
+
+        return new PasswordAuthenticator(
+            $this->mockResolver,
+            $this->mockBackend,
+        );
+    }
 }
diff --git a/tests/unit/Server/Backend/Auth/PasswordPolicyAwareAuthenticatorTest.php b/tests/unit/Server/Backend/Auth/PasswordPolicyAwareAuthenticatorTest.php
index b1e74052..5f6c5a85 100644
--- a/tests/unit/Server/Backend/Auth/PasswordPolicyAwareAuthenticatorTest.php
+++ b/tests/unit/Server/Backend/Auth/PasswordPolicyAwareAuthenticatorTest.php
@@ -43,8 +43,11 @@ final class PasswordPolicyAwareAuthenticatorTest extends TestCase
     private const DN = 'cn=foo,dc=example,dc=com';
 
     private PasswordAuthenticatableInterface&MockObject $inner;
+
     private BindNameResolverInterface&MockObject $nameResolver;
+
     private RecordingWriteHandler $writeHandler;
+
     private PasswordPolicyContext $context;
 
     protected function setUp(): void
diff --git a/tests/unit/Server/Backend/Auth/SaslBindPolicyEnforcerTest.php b/tests/unit/Server/Backend/Auth/SaslBindPolicyEnforcerTest.php
index 5b190e0a..984ec294 100644
--- a/tests/unit/Server/Backend/Auth/SaslBindPolicyEnforcerTest.php
+++ b/tests/unit/Server/Backend/Auth/SaslBindPolicyEnforcerTest.php
@@ -41,10 +41,13 @@
 final class SaslBindPolicyEnforcerTest extends TestCase
 {
     private const NOW = '2026-05-20T12:00:00Z';
+
     private const USER_DN = 'cn=user,dc=foo,dc=bar';
 
     private FrozenClock $clock;
+
     private WritableStorageBackend $backend;
+
     private PasswordPolicyContext $context;
 
     protected function setUp(): void
diff --git a/tests/unit/Server/Backend/Storage/Adapter/JsonFileStorageTest.php b/tests/unit/Server/Backend/Storage/Adapter/JsonFileStorageTest.php
index 35dab2d7..68e29788 100644
--- a/tests/unit/Server/Backend/Storage/Adapter/JsonFileStorageTest.php
+++ b/tests/unit/Server/Backend/Storage/Adapter/JsonFileStorageTest.php
@@ -65,22 +65,6 @@ protected function setUp(): void
         );
     }
 
-    private function context(): WriteContext
-    {
-        return new WriteContext(
-            new AnonToken(),
-            new ControlBag(),
-        );
-    }
-
-    private function systemContext(): WriteContext
-    {
-        return WriteContext::system(
-            new AnonToken(),
-            new ControlBag(),
-        );
-    }
-
     protected function tearDown(): void
     {
         if (file_exists($this->tempFile)) {
@@ -304,4 +288,20 @@ public function test_naming_contexts_returns_top_most_entries_from_storage(): vo
             $contexts,
         );
     }
+
+    private function context(): WriteContext
+    {
+        return new WriteContext(
+            new AnonToken(),
+            new ControlBag(),
+        );
+    }
+
+    private function systemContext(): WriteContext
+    {
+        return WriteContext::system(
+            new AnonToken(),
+            new ControlBag(),
+        );
+    }
 }
diff --git a/tests/unit/Server/Backend/Storage/Adapter/Pdo/PdoListQueryBuilderTest.php b/tests/unit/Server/Backend/Storage/Adapter/Pdo/PdoListQueryBuilderTest.php
index f4296dda..6c1af114 100644
--- a/tests/unit/Server/Backend/Storage/Adapter/Pdo/PdoListQueryBuilderTest.php
+++ b/tests/unit/Server/Backend/Storage/Adapter/Pdo/PdoListQueryBuilderTest.php
@@ -22,25 +22,6 @@
 
 final class PdoListQueryBuilderTest extends TestCase
 {
-    /**
-     * @return array{0: string, 1: list<string>}
-     */
-    private function rootQuery(
-        PdoListQueryBuilder $builder,
-        ?SqlFilterResult $filter,
-        SortKey ...$sortKeys,
-    ): array {
-        $query = $builder->build(
-            '',
-            true,
-            $filter,
-            null,
-            $sortKeys,
-        );
-
-        return [$query->sql, $query->params];
-    }
-
     public function test_no_sort_keys_appends_no_order_by(): void
     {
         [$sql, $params] = $this->rootQuery(
@@ -129,4 +110,23 @@ public function test_filter_params_precede_sort_params(): void
             $params,
         );
     }
+
+    /**
+     * @return array{0: string, 1: list<string>}
+     */
+    private function rootQuery(
+        PdoListQueryBuilder $builder,
+        ?SqlFilterResult $filter,
+        SortKey ...$sortKeys,
+    ): array {
+        $query = $builder->build(
+            '',
+            true,
+            $filter,
+            null,
+            $sortKeys,
+        );
+
+        return [$query->sql, $query->params];
+    }
 }
diff --git a/tests/unit/Server/Backend/Storage/Adapter/SqliteStorageTest.php b/tests/unit/Server/Backend/Storage/Adapter/SqliteStorageTest.php
index bc9d77a8..50990926 100644
--- a/tests/unit/Server/Backend/Storage/Adapter/SqliteStorageTest.php
+++ b/tests/unit/Server/Backend/Storage/Adapter/SqliteStorageTest.php
@@ -71,22 +71,6 @@ protected function setUp(): void
         );
     }
 
-    private function context(): WriteContext
-    {
-        return new WriteContext(
-            new AnonToken(),
-            new ControlBag(),
-        );
-    }
-
-    private function systemContext(): WriteContext
-    {
-        return WriteContext::system(
-            new AnonToken(),
-            new ControlBag(),
-        );
-    }
-
     public function test_get_returns_entry_by_dn(): void
     {
         $entry = $this->subject->get(new Dn('cn=Alice,dc=example,dc=com'));
@@ -680,40 +664,6 @@ public function test_store_allows_dn_when_dialect_has_no_length_limit(): void
         self::assertNotNull($this->storage->find(new Dn($longDn)));
     }
 
-    private function createPdoStorageWithMaxDnLength(int $max): PdoStorage
-    {
-        $pdo = new PDO('sqlite::memory:');
-
-        $sqlite = new SqliteDialect();
-        $dialect = $this->createMock(PdoDialectInterface::class);
-        $dialect->method('ddlCreateTable')
-            ->willReturn($sqlite->ddlCreateTable());
-        $dialect->method('ddlCreateIndex')
-            ->willReturn($sqlite->ddlCreateIndex());
-        $dialect->method('ddlCreateSidecarTable')
-            ->willReturn($sqlite->ddlCreateSidecarTable());
-        $dialect->method('ddlCreateSidecarIndexes')
-            ->willReturn($sqlite->ddlCreateSidecarIndexes());
-        $dialect->method('queryUpsert')
-            ->willReturn($sqlite->queryUpsert());
-        $dialect->method('queryExists')
-            ->willReturn($sqlite->queryExists());
-        $dialect->method('queryFetchEntry')
-            ->willReturn($sqlite->queryFetchEntry());
-        $dialect->method('queryFetchChildren')
-            ->willReturn($sqlite->queryFetchChildren());
-        $dialect->method('maxDnLength')
-            ->willReturn($max);
-
-        PdoStorage::initialize($pdo, $dialect);
-
-        return new PdoStorage(
-            new SharedPdoConnectionProvider($pdo),
-            $this->createMock(FilterTranslatorInterface::class),
-            $dialect,
-        );
-    }
-
     public function test_nested_atomic_rolls_back_inner_on_exception(): void
     {
         $threw = false;
@@ -770,4 +720,54 @@ public function test_naming_contexts_is_empty_when_storage_is_empty(): void
             $emptyStorage->namingContexts(),
         );
     }
+
+    private function context(): WriteContext
+    {
+        return new WriteContext(
+            new AnonToken(),
+            new ControlBag(),
+        );
+    }
+
+    private function systemContext(): WriteContext
+    {
+        return WriteContext::system(
+            new AnonToken(),
+            new ControlBag(),
+        );
+    }
+
+    private function createPdoStorageWithMaxDnLength(int $max): PdoStorage
+    {
+        $pdo = new PDO('sqlite::memory:');
+
+        $sqlite = new SqliteDialect();
+        $dialect = $this->createMock(PdoDialectInterface::class);
+        $dialect->method('ddlCreateTable')
+            ->willReturn($sqlite->ddlCreateTable());
+        $dialect->method('ddlCreateIndex')
+            ->willReturn($sqlite->ddlCreateIndex());
+        $dialect->method('ddlCreateSidecarTable')
+            ->willReturn($sqlite->ddlCreateSidecarTable());
+        $dialect->method('ddlCreateSidecarIndexes')
+            ->willReturn($sqlite->ddlCreateSidecarIndexes());
+        $dialect->method('queryUpsert')
+            ->willReturn($sqlite->queryUpsert());
+        $dialect->method('queryExists')
+            ->willReturn($sqlite->queryExists());
+        $dialect->method('queryFetchEntry')
+            ->willReturn($sqlite->queryFetchEntry());
+        $dialect->method('queryFetchChildren')
+            ->willReturn($sqlite->queryFetchChildren());
+        $dialect->method('maxDnLength')
+            ->willReturn($max);
+
+        PdoStorage::initialize($pdo, $dialect);
+
+        return new PdoStorage(
+            new SharedPdoConnectionProvider($pdo),
+            $this->createMock(FilterTranslatorInterface::class),
+            $dialect,
+        );
+    }
 }
diff --git a/tests/unit/Server/Backend/Storage/Adapter/Support/SortKeyComparatorTest.php b/tests/unit/Server/Backend/Storage/Adapter/Support/SortKeyComparatorTest.php
index 98099798..71100403 100644
--- a/tests/unit/Server/Backend/Storage/Adapter/Support/SortKeyComparatorTest.php
+++ b/tests/unit/Server/Backend/Storage/Adapter/Support/SortKeyComparatorTest.php
@@ -29,28 +29,6 @@ protected function setUp(): void
         $this->subject = new SortKeyComparator();
     }
 
-    private function entry(
-        string $dn,
-        string ...$cnValues,
-    ): Entry {
-        return new Entry(
-            new Dn($dn),
-            new Attribute('cn', ...$cnValues),
-        );
-    }
-
-    /**
-     * @param list<Entry> $sorted
-     * @return list<string>
-     */
-    private function cnValues(array $sorted): array
-    {
-        return array_map(
-            static fn(Entry $e): string => $e->get('cn')?->getValues()[0] ?? '',
-            $sorted,
-        );
-    }
-
     public function test_sort_ascending_by_single_key(): void
     {
         $alice = $this->entry('cn=Alice,dc=example,dc=com', 'Alice');
@@ -229,4 +207,26 @@ public function test_sort_does_not_modify_original_array(): void
             $original[0],
         );
     }
+
+    private function entry(
+        string $dn,
+        string ...$cnValues,
+    ): Entry {
+        return new Entry(
+            new Dn($dn),
+            new Attribute('cn', ...$cnValues),
+        );
+    }
+
+    /**
+     * @param list<Entry> $sorted
+     * @return list<string>
+     */
+    private function cnValues(array $sorted): array
+    {
+        return array_map(
+            static fn(Entry $e): string => $e->get('cn')?->getValues()[0] ?? '',
+            $sorted,
+        );
+    }
 }
diff --git a/tests/unit/Server/Backend/Storage/Adapter/WritableStorageBackendTest.php b/tests/unit/Server/Backend/Storage/Adapter/WritableStorageBackendTest.php
index da8b5fea..0a27f2a1 100644
--- a/tests/unit/Server/Backend/Storage/Adapter/WritableStorageBackendTest.php
+++ b/tests/unit/Server/Backend/Storage/Adapter/WritableStorageBackendTest.php
@@ -688,31 +688,6 @@ public function test_search_converts_time_limit_exception_to_operation_exception
         iterator_to_array($subject->search($request)->entries);
     }
 
-    private function context(): WriteContext
-    {
-        return new WriteContext(
-            new AnonToken(),
-            new ControlBag(),
-        );
-    }
-
-    private function systemContext(): WriteContext
-    {
-        return WriteContext::system(
-            new AnonToken(),
-            new ControlBag(),
-        );
-    }
-
-    /**
-     * @return Generator<Entry>
-     */
-    private function makeTimeLimitStream(): Generator
-    {
-        yield new Entry(new Dn('dc=example,dc=com'));
-        throw new TimeLimitExceededException();
-    }
-
     public function test_add_converts_storage_io_exception_to_unavailable_operation_exception(): void
     {
         $ioException = new StorageIoException('Unable to publish the storage update.');
@@ -1688,6 +1663,31 @@ static function (Dn $dn): void {},
         );
     }
 
+    private function context(): WriteContext
+    {
+        return new WriteContext(
+            new AnonToken(),
+            new ControlBag(),
+        );
+    }
+
+    private function systemContext(): WriteContext
+    {
+        return WriteContext::system(
+            new AnonToken(),
+            new ControlBag(),
+        );
+    }
+
+    /**
+     * @return Generator<Entry>
+     */
+    private function makeTimeLimitStream(): Generator
+    {
+        yield new Entry(new Dn('dc=example,dc=com'));
+        throw new TimeLimitExceededException();
+    }
+
     private function subtreeBackend(): WritableStorageBackend
     {
         return new WritableStorageBackend(new InMemoryStorage([
diff --git a/tests/unit/Server/Backend/Storage/OperationalAttributeGeneratorTest.php b/tests/unit/Server/Backend/Storage/OperationalAttributeGeneratorTest.php
index e135d48b..9cab24d4 100644
--- a/tests/unit/Server/Backend/Storage/OperationalAttributeGeneratorTest.php
+++ b/tests/unit/Server/Backend/Storage/OperationalAttributeGeneratorTest.php
@@ -41,25 +41,6 @@ protected function setUp(): void
         );
     }
 
-    private function anonymousContext(): WriteContext
-    {
-        return new WriteContext(
-            new AnonToken(),
-            new ControlBag(),
-        );
-    }
-
-    private function boundContext(string $dn): WriteContext
-    {
-        return new WriteContext(
-            BindToken::fromDn(
-                $dn,
-                '',
-            ),
-            new ControlBag(),
-        );
-    }
-
     public function test_apply_for_add_sets_create_timestamp(): void
     {
         $this->subject->applyForAdd(
@@ -445,4 +426,23 @@ public function test_apply_for_bulk_load_sets_structural_object_class_with_schem
             $entry->get('structuralObjectClass')?->getValues()[0],
         );
     }
+
+    private function anonymousContext(): WriteContext
+    {
+        return new WriteContext(
+            new AnonToken(),
+            new ControlBag(),
+        );
+    }
+
+    private function boundContext(string $dn): WriteContext
+    {
+        return new WriteContext(
+            BindToken::fromDn(
+                $dn,
+                '',
+            ),
+            new ControlBag(),
+        );
+    }
 }
diff --git a/tests/unit/Server/Backend/Write/PasswordPolicyWriteHandlerTest.php b/tests/unit/Server/Backend/Write/PasswordPolicyWriteHandlerTest.php
index df1a3068..694c9a3a 100644
--- a/tests/unit/Server/Backend/Write/PasswordPolicyWriteHandlerTest.php
+++ b/tests/unit/Server/Backend/Write/PasswordPolicyWriteHandlerTest.php
@@ -54,10 +54,13 @@
 final class PasswordPolicyWriteHandlerTest extends TestCase
 {
     private const NOW = '2026-05-20T12:00:00Z';
+
     private const USER_DN = 'cn=user,dc=foo,dc=bar';
 
     private FrozenClock $clock;
+
     private WritableStorageBackend $backend;
+
     private PasswordPolicyContext $context;
 
     protected function setUp(): void
diff --git a/tests/unit/Server/Backend/Write/SystemChangeWriterTest.php b/tests/unit/Server/Backend/Write/SystemChangeWriterTest.php
index 8d23025c..ab6c3ae7 100644
--- a/tests/unit/Server/Backend/Write/SystemChangeWriterTest.php
+++ b/tests/unit/Server/Backend/Write/SystemChangeWriterTest.php
@@ -26,6 +26,7 @@
 final class SystemChangeWriterTest extends TestCase
 {
     private RecordingWriteHandler $handler;
+
     private SystemChangeWriter $subject;
 
     protected function setUp(): void
diff --git a/tests/unit/Server/Backend/Write/WriteOperationDispatcherTest.php b/tests/unit/Server/Backend/Write/WriteOperationDispatcherTest.php
index 0a1e5387..3673c898 100644
--- a/tests/unit/Server/Backend/Write/WriteOperationDispatcherTest.php
+++ b/tests/unit/Server/Backend/Write/WriteOperationDispatcherTest.php
@@ -39,14 +39,6 @@ protected function setUp(): void
         );
     }
 
-    private function handler(bool $supports): WriteHandlerInterface&MockObject
-    {
-        $handler = $this->createMock(WriteHandlerInterface::class);
-        $handler->method('supports')->willReturn($supports);
-
-        return $handler;
-    }
-
     public function test_throws_unwilling_to_perform_when_no_handlers_registered(): void
     {
         self::expectException(OperationException::class);
@@ -116,4 +108,12 @@ public function test_skips_non_supporting_handlers_before_matching(): void
             $this->context,
         );
     }
+
+    private function handler(bool $supports): WriteHandlerInterface&MockObject
+    {
+        $handler = $this->createMock(WriteHandlerInterface::class);
+        $handler->method('supports')->willReturn($supports);
+
+        return $handler;
+    }
 }
diff --git a/tests/unit/Server/PasswordPolicy/Constraint/MinAgeConstraintTest.php b/tests/unit/Server/PasswordPolicy/Constraint/MinAgeConstraintTest.php
index 440aad39..6025069e 100644
--- a/tests/unit/Server/PasswordPolicy/Constraint/MinAgeConstraintTest.php
+++ b/tests/unit/Server/PasswordPolicy/Constraint/MinAgeConstraintTest.php
@@ -29,6 +29,7 @@ final class MinAgeConstraintTest extends TestCase
     private const NOW = '2026-05-20T12:00:00Z';
 
     private FrozenClock $clock;
+
     private MinAgeConstraint $subject;
 
     protected function setUp(): void
diff --git a/tests/unit/Server/PasswordPolicy/Guard/PasswordPolicyBindGuardTest.php b/tests/unit/Server/PasswordPolicy/Guard/PasswordPolicyBindGuardTest.php
index 55775c16..08b4784d 100644
--- a/tests/unit/Server/PasswordPolicy/Guard/PasswordPolicyBindGuardTest.php
+++ b/tests/unit/Server/PasswordPolicy/Guard/PasswordPolicyBindGuardTest.php
@@ -43,12 +43,17 @@
 final class PasswordPolicyBindGuardTest extends TestCase
 {
     private const NOW = '2026-05-20T12:00:00Z';
+
     private const DN = 'cn=foo,dc=example,dc=com';
 
     private FrozenClock $clock;
+
     private RecordingWriteHandler $writeHandler;
+
     private RecordingLogger $logger;
+
     private PasswordPolicyContext $context;
+
     private PasswordPolicyBindGuard $subject;
 
     protected function setUp(): void
diff --git a/tests/unit/Server/PasswordPolicy/Guard/PasswordPolicyChangeGuardTest.php b/tests/unit/Server/PasswordPolicy/Guard/PasswordPolicyChangeGuardTest.php
index 649e44a7..a28aa7a7 100644
--- a/tests/unit/Server/PasswordPolicy/Guard/PasswordPolicyChangeGuardTest.php
+++ b/tests/unit/Server/PasswordPolicy/Guard/PasswordPolicyChangeGuardTest.php
@@ -48,10 +48,13 @@
 final class PasswordPolicyChangeGuardTest extends TestCase
 {
     private const NOW = '2026-05-20T12:00:00Z';
+
     private const DN = 'cn=user,dc=foo,dc=bar';
 
     private FrozenClock $clock;
+
     private PasswordPolicyContext $context;
+
     private RecordingLogger $logger;
 
     protected function setUp(): void
diff --git a/tests/unit/Server/PasswordPolicy/PasswordPolicyEngineTest.php b/tests/unit/Server/PasswordPolicy/PasswordPolicyEngineTest.php
index 790bfe50..477bcdfa 100644
--- a/tests/unit/Server/PasswordPolicy/PasswordPolicyEngineTest.php
+++ b/tests/unit/Server/PasswordPolicy/PasswordPolicyEngineTest.php
@@ -40,6 +40,7 @@ final class PasswordPolicyEngineTest extends TestCase
     private const NOW = '2026-05-20T12:00:00Z';
 
     private FrozenClock $clock;
+
     private PasswordPolicyEngine $subject;
 
     protected function setUp(): void
diff --git a/tests/unit/Server/PasswordPolicy/PasswordPolicyResolverTest.php b/tests/unit/Server/PasswordPolicy/PasswordPolicyResolverTest.php
index e444f3a7..ecf4a4be 100644
--- a/tests/unit/Server/PasswordPolicy/PasswordPolicyResolverTest.php
+++ b/tests/unit/Server/PasswordPolicy/PasswordPolicyResolverTest.php
@@ -24,7 +24,9 @@
 final class PasswordPolicyResolverTest extends TestCase
 {
     private const USER_DN = 'uid=alice,dc=example,dc=com';
+
     private const SUBENTRY_DN = 'cn=subentry-policy,ou=policies,dc=example,dc=com';
+
     private const DEFAULT_DN = 'cn=default,ou=policies,dc=example,dc=com';
 
     public function test_returns_null_when_no_source_configured(): void
diff --git a/tests/unit/Server/ServerProtocolFactoryTest.php b/tests/unit/Server/ServerProtocolFactoryTest.php
index bb2c4e01..b716acae 100644
--- a/tests/unit/Server/ServerProtocolFactoryTest.php
+++ b/tests/unit/Server/ServerProtocolFactoryTest.php
@@ -71,14 +71,6 @@ protected function setUp(): void
         );
     }
 
-    private function passwordPolicyEngine(): PasswordPolicyEngine
-    {
-        return new PasswordPolicyEngine(
-            new SystemClock(),
-            new PasswordChangeConstraintChain([]),
-        );
-    }
-
     public function test_it_should_make_a_ServerProtocolInstance(): void
     {
         $mockSocket = $this->createMock(Socket::class);
@@ -160,4 +152,12 @@ public function test_it_wraps_the_authenticator_when_password_policy_is_enabled(
 
         $subject->make($mockSocket);
     }
+
+    private function passwordPolicyEngine(): PasswordPolicyEngine
+    {
+        return new PasswordPolicyEngine(
+            new SystemClock(),
+            new PasswordChangeConstraintChain([]),
+        );
+    }
 }
diff --git a/tests/unit/Sync/Result/SyncEntryResultTest.php b/tests/unit/Sync/Result/SyncEntryResultTest.php
index cb937380..9530a4f8 100644
--- a/tests/unit/Sync/Result/SyncEntryResultTest.php
+++ b/tests/unit/Sync/Result/SyncEntryResultTest.php
@@ -87,7 +87,6 @@ public function test_it_should_be_able_to_check_what_the_state_is_not(): void
         );
     }
 
-
     public function test_it_should_tell_if_it_is_for_a_present_state(): void
     {
         $this->subject = new SyncEntryResult(