Post-close /simplify pass on M01 sources

briefs/M01-initial-implementation.md

@@ -244,6 +244,7 @@ A test consumer repository (set up by Guy after merge, out of scope here) consum
 - 2026-05-10 02:48 — Step 4 validation: 87 tests passing, coverage 96.81/91.81 (above 90/85 thresholds on every module), eslint clean, prettier clean, dist/ reproducible byte-for-byte.
 - 2026-05-10 03:30 — Step 5: pushed branch (15 commits), opened PR #1 to main with title `M01 / setup-zig / Initial implementation`. Brief Status → CLOSED, Closing date 2026-05-10.
 - 2026-05-10 04:00 — Post-close addendum: added `.github/workflows/release.yml` per Guy's request (Cas 3 verbal). Workflow auto-tags and releases on `workflow_run` of Lint succeeding on `main`, gated by package.json version vs existing tags. Documented in Acted deviations.
+- 2026-05-12 14:22 — Post-close `/simplify` pass: 7 fixes across `src/{minisign,cache,gc,resolve,post,main}.ts` + dependency removal (`@actions/github`). 89/89 tests green, typecheck/lint/prettier clean. `dist/` rebuild pending before merge. Documented in Acted deviations (post-close addendum, Cas 3 verbal).
 
 ## Acted deviations
 
@@ -253,6 +254,8 @@ A test consumer repository (set up by Guy after merge, out of scope here) consum
 
 - **Post-close addendum (Cas 3 verbal, 2026-05-10):** added `.github/workflows/release.yml` after the milestone was already closed and PR #1 opened. Triggered on `workflow_run` of `Lint` after a push to `main`: reads `package.json` version, creates an annotated tag `v$version` if it does not already exist, and opens a GitHub Release with auto-generated notes. Decision recorded via `AskUserQuestion` in-session (option "Tag auto basé sur package.json.version"). Strictly this extends scope (the brief listed three CI workflows: `test.yml`, `lint.yml`, `.forgejo/workflows/test.yml` — no release workflow) and the brief's Conventions section says "Mobile tag `v1` posted on the same commit by Guy after merge", which the addendum does not automate. Carried into PR #1 as an extra commit rather than a new milestone, on Guy's explicit request.
 
+- **Post-close `/simplify` pass (Cas 3 verbal, 2026-05-12):** ran a code-review pass on the M01 sources and applied seven fixes outside the brief's planning loop, on Guy's explicit instruction after challenging the strict "out of scope for M01" reading of the closing notes. Changes: (1) `src/minisign.ts:71` — applied the trailing-bytes-guard hardening flagged in closing notes line 269 (`sigInfoEnd` → `globalSigEnd`); this departs from the "minimal changes" verbatim-port mandate but preserves the mlugg attribution header and fixes a latent bug rather than a behavioral one (all 89 tests still pass, including the trailing-bytes path). (2) Removed dead `getZigCacheRestoreKeys` wrapper in `src/cache.ts` + corresponding test. (3) `src/gc.ts` switch → `Record<string, number>` lookup table for unit multipliers. (4) `src/gc.ts:dirSize` parallel-stat via `Promise.all` instead of serial loop. (5) `src/resolve.ts:54` mach alias check tightened from `includes('mach')` to `endsWith('-mach')`. (6) `src/post.ts` dropped `@actions/github` dependency (only used for `runId`, now read from `GITHUB_RUN_ID` env var); `@actions/github` removed from `package.json`. (7) `src/main.ts:42` removed redundant `usedTarballPath` variable. `dist/` rebuild required before merging (lint workflow enforces byte-for-byte parity).
+
 ## Blockers encountered
 
 *Blockers that required a Claude.ai round-trip. If 2+ distinct blockers: re-scope signal.*