[arun279]

The last batch of the retroactive cleanup of #24: "PR 4: CI config deduplication" and "PR 5: Stale configuration and comments" from the 2026-10-21 cleanup audit. They are one PR because both are configuration hygiene. Every item was re-checked against current feat/expo-native (5e17033) first. No gate, job or timeout changes, and the job-timeouts and filtered-run-list gates pass.

CI deduplication (audit PR 4)

Item	Change
iOS simulator boot, repeated in native-e2e-ios-light, ui-screenshots-ios-dark and the perf probe	.github/actions/boot-ios-simulator. Partly done, see below.
"Enable KVM" before all three uses of android-emulator	The first step of that action
Maestro CLI version and checksum repeated in four lanes, the perf probe and prepare-ios-ui.sh	.github/actions/maestro-cli over scripts/install-maestro.sh, which holds the one pin. The cache key still reads maestro-<os>-<arch>-2.10.0-<sha256>, so existing cache entries hit. The perf probe's two jobs now restore the CLI from the cache as well, instead of downloading it every run.
Concurrency comment told a story	It now states the rule
package.json aliases nothing runs (lint, check:md, check:knip, check:dup, test:coverage) and an audit script shadowed by pnpm's own audit	Deleted. check already inlines them, and audit-dependencies.sh calls pnpm audit directly.
Two suppression gates, one reading a JSON file that holds a single 0	One check-quality-budget.mjs, with a new test. It had none.

Not done: the rest of the iOS lane setup is still written out in both lanes: download and unpack the app, the runner, re-embed, the fake Trakt server. Those steps branch on needs.native-ios.result, the fingerprint output and the proof-copy input, which a composite action can't read, so each would become an action input. The step-order tests pin them line by line. The remaining duplication is about 25 lines per lane.

USER_FACING now covers the three device-lane actions and install-maestro.sh. A change to the boot or install steps still runs the device lanes, as it did when the steps were written in ci.yml.

Tests

• readWorkflowJobs(path, { withActions: true }) inlines a job's local input-less actions at its step indent, so the boot-order, accessibility, daemon, host-resource and Maestro-cache tests still assert the steps each lane runs, not the call site. A test that needs the call site reads the job as written.
• prepare-ios-ui.sh's download tests move to install-maestro.sh: cache hit and miss, plus a stop on each of curl, shasum and unzip failing.
• New assertions:
  • the iOS toolchain pin test reads the boot action's xcode-select too;
  • the Maestro runner is built from the release the CLI install pins;
  • every lane that installs the CLI restores it from the cache, keyed by that pin, first.

Stale configuration and comments (audit PR 5)

• .dependency-cruiser.cjs:
  • Dropped the node_modules/ bans for idb-keyval, radix-ui, @tanstack/react-router, @tanstack/react-virtual and lucide-react. None is in pnpm-lock.yaml, so the patterns can't match.
  • Dropped domain-no-node-builtins, which core-stays-portable-node already covers.
  • Fixed the web-era wording in four comments.
• cspell.json: removed 35 words that appear nowhere in the checked files, even as substrings, and the dev-dist, test-results, ios/** and android/** ignores.
• Ignore entries for deleted web and Capacitor directories: removed from biome.jsonc, dprint.json and the lefthook comment that named them.
• .gitignore: removed dev-dist/, .wrangler/, test-results/, design-review/ and journal/. Removed the .env.example, .env.test and .env.mock negations, which name files that no longer exist. .env* stays ignored.
• pnpm-workspace.yaml: removed the "native package is not here yet ... web app" sentence.
• tokens.test.ts: the test name no longer cites the web app's --color-border.

Mutation check

Each break was applied alone:

Break	Caught by
A domain file imports node:fs	depcruise: core-stays-portable-node
A core file imports react-dom	depcruise: core-stays-portable and domain-stays-pure
One lane loses the maestro-cli action	pinned-tools.test.ts
The Maestro cache key drops the pin	pinned-tools.test.ts, ios-maestro-readiness.test.ts
install-maestro.sh skips the checksum	ios-maestro-readiness.test.ts
The boot action stops disabling daemons	ios-accessibility.test.ts
The boot action selects another Xcode	release-paths.test.ts
The complexity budget is ignored	quality-budget.test.ts
Type suppressions are ignored	quality-budget.test.ts

Footprint

No product code or bundle changes.

Area	Added	Deleted	Net
CI and tooling (.github, scripts)	97	157	-60
Tests (new gate test, install tests, inlining helper)	153	52	+101
Configuration files			-97
Whole change	261	317	-56

The device lanes on this PR are the first run of the three actions.

pnpm check passes on Node 22.23.4.

[github-actions]

Pull request footprint

measurement	base to head
Product code lines in core/src, native/src, native/app, and native/modules	+0
Test lines in test, packages/*/{test,__tests__,e2e}, and .maestro	+92
CI and tooling lines in .github and scripts	-57
Product comment lines identified by a comment prefix	+0

User-delivered artifact sizes

measurement	base	head	delta
Expo iOS JavaScript bundle, raw file	5.44 MB	5.44 MB	0 B
Expo Android JavaScript bundle, raw file	5.48 MB	5.48 MB	0 B
Firebase tester APK, arm64-v8a and all densities	41.16 MB	41.16 MB	0 B
Play download estimate, XXXHDPI arm64-v8a English Android 15	19.83 MB	19.83 MB	0 B

Most complex product function

measurement	base	head
Cyclomatic complexity, oxlint complexity	10	10
Cognitive complexity, Biome noExcessiveCognitiveComplexity	15	15