[BryanFRD]

Sonar quick wins:

• typescript:S7785: top-level await instead of promise chains in the MCP entrypoint and smoke script
• typescript:S4782: drop the redundant | undefined on an optional property

Skipped:

• docker:S8431 (Dockerfile tag plus digest): the pin is deliberate, the digest gives reproducible builds and the tag keeps Renovate updates readable. Dropping either loses one of the two.

[ferrfleet-interne]

Approved. Behaviour-preserving Sonar cleanups, no findings from the code review and nothing for formal verification to prove.

Code review: no findings. The three changes:

• mcp/packages/ferrgrowth-mcp/src/api-base.ts: orgId?: string | undefined becomes orgId?: string. This is type-only. exactOptionalPropertyTypes is off, so both spellings are identical to the compiler and callers passing org_id: string | undefined still typecheck.
• mcp/packages/ferrgrowth-mcp/src/index.ts: the .catch() chain becomes top-level await in try/catch with the same error handling. Valid because the package is "type": "module", module ESNext, target ES2022, Node >=22.
• mcp/scripts/smoke.ts: same rewrite in a dev script run by tsx under a "type": "module" root. Not production code.

Formal verification: verdict nothing_to_prove. No properties, harnesses or counterexamples. It reached the same equivalence conclusions as the review for all three files.