test(webui): clear 115 type errors the test files were hiding

[modacker]

What this is

Type-debt removal, plus the coverage gap that let debt accumulate unnoticed. No feature change, no behaviour change.

Baseline c16ea26 was 51 files / 958 tests. This branch is 67 files / 1349 tests, all passing, with typecheck:client, typecheck:server and typecheck:test clean, the root tsconfig.standalone.json clean, and source-inventory.mjs passing at 4681 files.

The gap that hid it

packages/webui/tsconfig.test.json — the only program that typechecks webui tests — named two of the 69 files in test/unit/. The other 67 had never been typechecked. That is how a merged PR shipped four call sites still passing two arguments to a function whose third parameter had become required: the compiler would have caught all four, but nothing compiled that file.

Building a full-coverage program over the same tree reports 123 errors before this branch, 8 after.

What was wrong in those 123

All 123 were traced to their reading site individually. Zero were real defects — every one was a fixture, stub or annotation of the wrong shape, and no assertion's expected value was wrong. But several made tests incapable of failing:

• session-activity's project fixture omitted all eight required WebuiProjectRecord fields, so the rail could have read pinned, hidden or recentAtMs wrongly and the test would still pass.
• shell asserted on pendingUser, a field that exists nowhere in src/. It could never fail. Deleted.
• plugin-market-catalogue passed onClose, which PluginManagement does not destructure and which the test never asserts. Deleted.
• transcript-retry-resend-wiring's submit fixture omitted draft while production passes draft: turn.message; if the resend path ever reads it, that fixture starts lying.
• webui-w2-effect-reducer asserted a subscription without generation in three places while the rest of the same file carried it — so a reducer dropping the field across the patch went unnoticed. Now asserted.

The build-configuration defect

vite.config.ts annotated configureServer by hand:

middlewares: { use: (handler: (...args: never[]) => void) => void };

Load-bearing — deleting it yields four implicit-any parameters, because contextual typing does not flow from the plugins: call site back into the object literal webuiRuntimePlugin() returns. But (...args: never[]) types every parameter as never rather than any, which produced thirteen Property 'statusCode' / 'setHeader' / 'end' does not exist on type 'never' errors. Replaced with Vite's own ViteDevServer, verified against node_modules/vite/dist/node/index.d.ts:2475. Emitted JavaScript is byte-identical, same sha256.

The production changes, and why they are safe

Four local-runtime files now pass a Uint8Array where a Buffer reached fetch or new Blob. This is a copy rather than a view, and it is the less elegant fix — the real cause is the bare Uint8Array in packages/shared's transport frame, which resolves to ArrayBufferLike and so admits SharedArrayBuffer. Changing that shared annotation was deliberately left out: it affects every consumer of that package, and this branch is already touching production code.

Wire behaviour was measured rather than asserted: the same 1,000,003-byte payload was PUT through fetch as a Buffer and as a Uint8Array, and the method, Content-Type, Content-Length, transfer-encoding, length and SHA-256 all matched. local-runtime tests: 753 passed / 14 skipped, identical before and after.

third_party/sandbox-runtime's single error is a cast between DOM and Node ReadableStream declarations, which are mutually non-assignable. It erases to nothing. That directory is a vendored copy of @minimax/mcode-sandbox-runtime 0.0.74 with no repository field, and this repo has modified it nine times since import, so there is no upstream to diverge from.

The two new declaration files

scripts/lib/release-metadata.d.mts and package-exports.d.mts. An earlier attempt with Record<string, unknown> return types removed one error and introduced three, so these model the real JSON keys (ExtractionMetadata, SourceInventory, PackageExportEntry), checked against all five consumers. They were then verified to be load-bearing rather than escape hatches: a positive control plus six deliberate misuses produced errors on all six.

What is deliberately not done — 8 errors remain

All eight are config-or-declaration work, recorded here rather than bundled in:

• ActivityIndicator.tsx ×3 — a bundler module setting clears them with no source change; tsc -p tsconfig.client.json is already 0, so these are an artifact of checking client files under the server chain.
• webui-w2-effect-reducer.test.ts ×2 — findLastIndex needs lib: ES2023; nothing else in the program uses any ES2023+ member.
• webui-boundary-check.test.ts ×2 — needs scripts/lib/webui-boundary.d.mts in the same style as the two above.
• activity-indicator.test.tsx ×1 — a = {} default parameter at ActivityIndicator.tsx:421 makes createElement's P fall back to {}.

I would rather land these as a separate change: the first two want a config decision and the last one edits a source file that four other tests render.

The caveat worth stating

All of this is invisible to CI today. Nothing in the three existing typecheck programs includes vite.config.ts, the test that pulls it in, or 67 of the 69 test files. This branch raises coverage but does not raise it to 69/69 — that needs a dedicated program wired into CI, which is a follow-up.