diff --git a/TODO.md b/TODO.md
index 17d8258..e4374f0 100644
--- a/TODO.md
+++ b/TODO.md
@@ -14,16 +14,36 @@ pre-1.0
 
 # Next Step
 
-Reconcile the uncommitted ARCHITECTURE.md edits on main: finish and
-commit, or revert.
+Triage the stale remote branches (issue #71): for each, merge the work
+or delete the branch.
 
 # Completed Steps
 
+- 2026-08-09: Finished the lint remediation under the canonical
+  `.golangci.yml` (issue #61, which also unblocks issue #59). The
+  remaining findings were fixed behavior-preservingly: `wsl_v5`
+  whitespace, `sqlclosecheck`, and `prealloc`. The `sqlclosecheck` sites
+  now close `sql.Rows` in a deferred closure instead of via the
+  `CloseRows` helper, which the linter could not see through. Only the
+  `revive` package-name findings remain suppressed, with per-site
+  `//nolint` directives; the package-rename question behind them is
+  tracked in issue #76. Verified with `script/cibuild`, which exits 0 —
+  that is the only trustworthy gate, because `script/lint` runs whatever
+  `golangci-lint` happens to be on `PATH` rather than the pinned
+  v2.12.2 that CI and the `Dockerfile` use, so `make check` can report
+  green on findings CI still fails. That tooling gap is tracked in issue
+  #78.
+- 2026-08-09: The earlier next step "reconcile the uncommitted
+  `ARCHITECTURE.md` edits on `main`" needed no work: the working tree is
+  clean and `ARCHITECTURE.md` is committed on `main`.
 - 2026-08-07: Updated golangci-lint to v2.12.2 everywhere it is pinned
   (`Dockerfile` lint stage, `Makefile` deps target), replaced
   `.golangci.yml` with the canonical config (v2 schema, `default: all`),
-  and remediated all lint findings it surfaced (issue #61):
-  behavior-preserving fixes across every package, `make check` green.
+  and remediated the bulk of the lint findings it surfaced (issue #61):
+  behavior-preserving fixes across every package, 2,990 findings down to
+  80. `make test` and `make fmt-check` were green at that point but
+  `make lint` was still red; the commit message claiming `make check`
+  was green was wrong.
 - 2026-08-07: Added the standard `.golangci.yml` and `.editorconfig`
   (issue #59); lint findings under the new config are tracked in issue
   #61. `script/bootstrap` now installs sqlite3 (needed by tests).
@@ -49,6 +69,4 @@ commit, or revert.
 
 # Future Steps
 
-- Review stale local branches (add-godoc-to-cli-package,
-  feature/pluggable-storage-backend) and merge or delete them.
 - Define remaining scope for a first tagged release and cut v0.1.0.
diff --git a/internal/crypto/encryption.go b/internal/crypto/encryption.go
index 36c2564..04f36dd 100644
--- a/internal/crypto/encryption.go
+++ b/internal/crypto/encryption.go
@@ -1,6 +1,6 @@
 // Package crypto provides thread-safe age encryption and decryption
 // helpers used to protect blob and metadata content.
-package crypto
+package crypto //nolint:revive,nolintlint // stdlib crypto unused; see #76
 
 import (
 	"bytes"
diff --git a/internal/log/log.go b/internal/log/log.go
index 17025ca..2806017 100644
--- a/internal/log/log.go
+++ b/internal/log/log.go
@@ -1,6 +1,6 @@
 // Package log provides the application-wide structured logger: slog
 // with a colorized TTY handler on terminals and JSON output otherwise.
-package log
+package log //nolint:revive,nolintlint // stdlib log unused here; see #76
 
 import (
 	"context"
@@ -69,7 +69,7 @@ func Initialize(cfg Config) {
 		Level: level,
 	}
 
-	// Check if stdout is a TTY
+	// Check if stdout is a TTY.
 	if term.IsTerminal(int(os.Stdout.Fd())) {
 		// Use colorized TTY handler
 		logger = slog.New(NewTTYHandler(os.Stdout, opts))
diff --git a/internal/log/module.go b/internal/log/module.go
index 525f969..f428604 100644
--- a/internal/log/module.go
+++ b/internal/log/module.go
@@ -1,4 +1,4 @@
-package log
+package log //nolint:revive,nolintlint // stdlib log unused here; see #76
 
 import (
 	"go.uber.org/fx"
diff --git a/internal/log/tty_handler.go b/internal/log/tty_handler.go
index e787de8..cfdf4f9 100644
--- a/internal/log/tty_handler.go
+++ b/internal/log/tty_handler.go
@@ -1,4 +1,4 @@
-package log
+package log //nolint:revive,nolintlint // stdlib log unused here; see #76
 
 import (
 	"context"
diff --git a/internal/snapshot/scanner.go b/internal/snapshot/scanner.go
index fc00251..86dda30 100644
--- a/internal/snapshot/scanner.go
+++ b/internal/snapshot/scanner.go
@@ -624,9 +624,10 @@ func (s *Scanner) collectBatchFlushData(
 
 	collectStart := time.Now()
 
-	// Every pending file contributes at least one file-chunk and one
-	// chunk-file mapping, so the file count is a safe lower bound for the
-	// initial capacity of both slices.
+	// A pending file contributes one mapping of each kind per chunk, and
+	// an empty file contributes none, so the file count is only a rough
+	// starting capacity for the mapping slices; append grows them as
+	// needed. It is exact for the file and file-ID slices.
 	allFileChunks := make([]database.FileChunk, 0, len(canFlush))
 	allChunkFiles := make([]database.ChunkFile, 0, len(canFlush))
 	allFileIDs := make([]types.FileID, 0, len(canFlush))
diff --git a/internal/types/types.go b/internal/types/types.go
index c076f41..5310179 100644
--- a/internal/types/types.go
+++ b/internal/types/types.go
@@ -2,7 +2,7 @@
 // vaultik codebase. Using distinct types for IDs, hashes, paths, and
 // credentials prevents accidental mixing of semantically different values
 // that happen to share the same underlying type.
-package types
+package types //nolint:revive,nolintlint // rename decision tracked in #76
 
 import (
 	"database/sql/driver"