fix(info): handle missing deps field without unsigned indexOf wrap

.omo/evidence/task-27-tofu-core.log

@@ -42,3 +42,27 @@ step 13: cleanup... PASS
 === smoketest complete ===
 PASS: 16 checks passed
 All checks passed.
+
+=== FIX (task 27): info.d unsigned indexOf wrap ===
+Bug: src/tofu/commands/info.d:93 — `size_t pos = content.indexOf("deps")`.
+indexOf returns ptrdiff_t (-1 for not found); unsigned size_t wraps -1 to
+SIZE_MAX, making `if (pos < 0)` a no-op → ArrayIndexError on recipes
+without a deps field (uncaught D Error, crashed -Si).
+
+Fix applied:
+  1. scanDepsArray: size_t pos → ptrdiff_t pos (+ explanatory comment).
+  2. Added regression unittest (Test 4): cached recipe WITHOUT deps field
+     (name/ver/summary/build_system only) → infoCommand returns 0.
+     Recipe written via existing writeRecipe helper, mirrors Test 3 pattern.
+
+Audit of same pattern elsewhere (checked, NOT bugs):
+  - info.d:36  auto kp = ...indexOf(key)          → auto infers ptrdiff_t ✓
+  - recipeparse.d:52,112 auto idx = indexOf(...)  → ptrdiff_t ✓
+  - fetch.d:82  auto idx = indexOf(...)           → ptrdiff_t ✓
+  - search.d / remove.d / install.d               → inline >= 0 / == -1 ✓
+  No other unsigned indexOf assignment found.
+
+Verification:
+  dub build  → Linking tofu (pass)
+  dub test   → 23 modules passed unittests
+  smoketest  → PASS: 16 checks passed, All checks passed.

.omo/notepads/tofu-core/learnings.md

@@ -1399,3 +1399,22 @@ The sandbox test (test 2) creates a sentinel file, serves an index containing `o
 - `-S nonexistent --noconfirm` → exit 2 (package not found in index)
 - No-args → exit 1, `--help` → exit 0
 
+
+## Task 27 — `std.string.indexOf` unsigned-wrap trap (info.d fix)
+
+- **`std.string.indexOf` returns `ptrdiff_t`** — `-1` means "not found". Assigning it to
+  an unsigned type (`size_t`/`uint`) silently wraps `-1` to `SIZE_MAX`, and a following
+  `if (pos < 0)` guard becomes a compile-time-legal but always-false no-op. Downstream
+  `content[pos .. $]` then throws `ArrayIndexError` — a D `Error` (NOT an `Exception`),
+  so `catch (Exception)` blocks do not trap it and the process aborts.
+- **`auto` is the safe default**: `auto idx = content.indexOf(key)` infers `ptrdiff_t`,
+  so `if (idx < 0)` works. Only explicit unsigned typing (`size_t pos = ...`) is broken.
+  Audit rule: when declaring a named variable for an `indexOf`/`indexOfSlice` result,
+  always use `ptrdiff_t` (or `auto`).
+- **D `Error` vs `Exception`**: out-of-bounds slice indexing throws `ArrayIndexError`
+  which derives from `Error`, bypassing `catch (Exception)`. A whole-program crash
+  (uncaught Error) is a strong smell of this class of bug — the run-time failure mode
+  is a naked `core.exception.ArrayIndexError` on stderr.
+- **Escape in unit tests**: all 8 pre-existing info.d tests used recipes WITH a `deps`
+  field, so the absent-deps path was never exercised. Regression tests must cover the
+  *negative* field, not just happy paths.

.omo/notepads/tofu-core/problems.md

@@ -23,3 +23,16 @@ _Auto-scaffolded by /start-work. Append new entries below - never overwrite._
 
 **Workaround in smoketest:** Recipe includes `deps = {}` to avoid triggering this bug.
 
+---
+
+## RESOLVED (task 27)
+
+**Fixed:** `scanDepsArray` in `src/tofu/commands/info.d` — `size_t pos` → `ptrdiff_t pos`
+so the `pos < 0` guard fires on `indexOf` returning -1. Added a regression unittest
+(recipe without deps → infoCommand returns 0). Audit of the same pattern across
+`info.d` (line 36), `recipeparse.d` (52, 112), `fetch.d` (82), `search.d`, `remove.d`,
+`install.d` found no other unsigned indexOf assignment (`auto` infers `ptrdiff_t`
+everywhere else).
+
+Verified: `dub build` ✓, `dub test` — 23 modules passed ✓, smoketest — 16 checks PASS ✓.
+