diff --git a/.opencode/agents/cmake-expert.md b/.opencode/agents/cmake-expert.md
index fe4d136..b616652 100644
--- a/.opencode/agents/cmake-expert.md
+++ b/.opencode/agents/cmake-expert.md
@@ -31,6 +31,8 @@ if(SANITIZER STREQUAL "address")
 elseif(SANITIZER STREQUAL "thread")
   add_compile_options(-fsanitize=thread -fno-omit-frame-pointer -g)
   add_link_options(-fsanitize=thread)
+elseif(NOT SANITIZER STREQUAL "none")
+  message(FATAL_ERROR "Unknown sanitizer: ${SANITIZER}. Supported values: address, thread, none")
 endif()
 
 option(STRICT_WARNINGS "Enable strict warnings" OFF)
@@ -47,7 +49,7 @@ find_package(Threads REQUIRED)
 
 find_library(ZSTD_LIBRARY zstd)
 if(NOT ZSTD_LIBRARY)
-  message(FATAL_ERROR "zstd library not found")
+  message(FATAL_ERROR "zstd library not found. Ensure it is in your nix-shell!")
 endif()
 find_package(OpenSSL REQUIRED)
 
@@ -80,13 +82,15 @@ tests/         — test sources (globbed as TEST_SRCS)
 ### Dependencies
 - **zstd** — found via `find_library(ZSTD_LIBRARY zstd)`
 - **pthreads** — found via `find_package(Threads REQUIRED)`
+- **OpenSSL** — found via `find_package(OpenSSL REQUIRED)`
+- **xxhash** — fetched via `FetchContent` from GitHub (v0.8.3)
 - **C11 standard** — required
 - **CMake 3.22+** — minimum version
 
 ## Conventions
 
 - Use `file(GLOB ...)` for source collection (existing pattern).
-- All targets link `Threads::Threads` and `${ZSTD_LIBRARY}`.
+- All targets link `Threads::Threads`, `${ZSTD_LIBRARY}`, `OpenSSL::SSL`, `OpenSSL::Crypto`, and `xxhash`.
 - Include directories: `src/shared`, `src/server`, `src/client`, `tests` (for test target).
 - Sanitizer support: pass `-DSANITIZER=address` or `-DSANITIZER=thread` to cmake (live option in CMakeLists.txt).
 - Build with `cmake -B build -S . && cmake --build build -j$(nproc)`.
@@ -104,23 +108,16 @@ tests/         — test sources (globbed as TEST_SRCS)
 
 ## Sanitizer Configurations
 
-### AddressSanitizer (memory errors)
+Use the project's built-in `-DSANITIZER=` option (matching the CI matrix):
 ```bash
-cmake -B build -S . \
-  -DCMAKE_C_FLAGS="-fsanitize=address -fno-omit-frame-pointer -g" \
-  -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address"
+cmake -B build -S . -DSANITIZER=address   # AddressSanitizer (memory errors)
+cmake --build build -j$(nproc)
+
+cmake -B build -S . -DSANITIZER=thread    # ThreadSanitizer (race conditions)
 cmake --build build -j$(nproc)
 ```
 
-### ThreadSanitizer (race conditions)
-```bash
-cmake -B build -S . \
-  -DCMAKE_C_FLAGS="-fsanitize=thread -g" \
-  -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=thread"
-cmake --build build -j$(nproc)
-```
-
-### UndefinedBehaviorSanitizer
+For UndefinedBehaviorSanitizer (no `-DSANITIZER=undefined` option in CMakeLists.txt yet), use the manual flag approach:
 ```bash
 cmake -B build -S . \
   -DCMAKE_C_FLAGS="-fsanitize=undefined -fno-omit-frame-pointer -g" \
@@ -128,14 +125,6 @@ cmake -B build -S . \
 cmake --build build -j$(nproc)
 ```
 
-### Combined Sanitizers
-```bash
-cmake -B build -S . \
-  -DCMAKE_C_FLAGS="-fsanitize=address,undefined -fno-omit-frame-pointer -g" \
-  -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address,undefined"
-cmake --build build -j$(nproc)
-```
-
 ### Using ccache (faster rebuilds)
 ```bash
 cmake -B build -S . -DCMAKE_C_COMPILER_LAUNCHER=ccache
diff --git a/AGENTS.md b/AGENTS.md
index 1cada86..402297b 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -14,6 +14,8 @@ docker pull gitea.tap-tap.win/taptap/fastsync-ci:v7
 docker tag gitea.tap-tap.win/taptap/fastsync-ci:v7 fastsync-ci:local
 
 # Or build the image from the repo-root Dockerfile
+# (Note: the prebuilt :v7 image reflects the previous Dockerfile state;
+#  rebuild from source to pick up any newly added packages like lcov/valgrind.)
 docker build -t fastsync-ci:local .
 
 # Build, run unit tests, and run integration tests inside the container
@@ -39,7 +41,7 @@ cmake -B build -S . -DSANITIZER=address           # AddressSanitizer (ASan)
 cmake -B build -S . -DSANITIZER=thread            # ThreadSanitizer (TSan)
 ```
 
-The CI workflow (`.gitea/workflows/ci.yaml`) runs lint (clang-format, cppcheck), build + test (unit + integration), and sanitizer jobs sequentially.
+The CI workflow (`.gitea/workflows/ci.yaml`) runs lint (clang-format, cppcheck), build + test (unit + integration), and sanitizer (currently only `address`) jobs sequentially.
 
 ## Build