CI's anti-slop step was failing with 28 violations on changed lines. Biome was
failing too, on formatting in the anti-slop rule files themselves. Both would
have blocked the merge.
The fixes are real, not suppressions:
- Record<X, Y> annotations became satisfies, which keeps the exhaustiveness
check while preserving the literal types the annotation discarded.
- Three lookups that MISS by design became Maps: an open-git action tripwire
does not ingest, a forge with no connect builder, a rule with no audit entry.
An index signature said any key was valid; a Map says a miss is expected.
- Raw sql rows are parsed, not cast. String()/Number()/Boolean() on untyped
columns turn a wrong column into a plausible value instead of a failure.
- The degradation step output is parsed once at the boundary rather than poked
at with typeof three times.
- The http clients send a Headers object and take JsonValue, so a content-type
on a bodyless GET is a statement rather than a conditional spread.
- keep is now always a thunk, which removed the union it was branching on.
The e2e suite was also reporting code failures for CONFIGURATION. Two scenarios
assert on the fail-closed floor, and one enabled custom rule drags every run
past it, so a maintainer's own settings inverted the results. The harness now
pins the floor on and disables custom rules for the run, then restores both,
exactly as it already did for workflows and arming.
Verified: all five CI gates pass, and the live open-git suite is 3/3 green with
every borrowed setting handed back.
