Implement the inline @type cast cleanup: 273 of 357 removed or converted - #1589

Step 2 of todo/inline-type-casts.md. Eight `/** @type {Dir} */` casts sat
directly after a guard that looked like it should already have narrowed.
`Array.isArray` narrows to `any[]`, which `readonly Vec[]` is not assignable
to, so its negative branch never removes a `readonly` array from a union —
`instanceof Array` does. Swapping the eight guards that the casts depended on
makes the surrounding `assert` and `if` narrow on their own, and all eight
casts delete.

Only those guards are changed. The other `Array.isArray` calls in these files
narrow positively, where both spellings work, and `Array.isArray` is the
cross-realm-correct one — so they stay as they are, with a comment at each
swapped site explaining why it differs.

`npx tsc` and `fjs t` (2797 tests) pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQcZKuWSt2rEZrCj1jVZih

Step 3 of todo/inline-type-casts.md.

23 casts whose expression is genuinely assignable to the target type — so the
cast was pinning a type, never overriding one. Six sit at a `const`
initializer and become the declaration form AGENTS.md prefers; `fjs/effects/node`
already spelled the identical `do_('stat')` case that way two lines above the
inline one. The other 17 become `@satisfies`, which checks assignability
without discarding the inferred type.

Four `@satisfies`-capable sites were deliberately left as `@type {any}`
(`types/function/compare`, `types/rtti/parse`): `@satisfies {any}` asserts
nothing, so an `any` cast is either load-bearing or it should go — it is never
a "check".

`npx tsc` and `fjs t` (2797 tests) pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQcZKuWSt2rEZrCj1jVZih

Re-measuring after steps 1–3 found 8 more casts that `npx tsc` now passes
without. They were not redundant before: each existed only to feed a cast that
has since gone — `types/nominal/proof` is the clearest case, where removing the
outer `_SymbolIntersectionBranded` cast left an inner `any` cast with nothing
to widen for.

The two in the rtti visitors again needed one at a time against a full
type-check, for the same instantiation-depth reason as step 1.

218 of the original 357 casts are now gone; 142 remain. `npx tsc` and `fjs t`
(2797 tests) pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQcZKuWSt2rEZrCj1jVZih

Step 4 of todo/inline-type-casts.md, first half: the 17 casts outside the
`unknown`-in-proofs group. Each was a claim the compiler took on faith; each is
now checked where it is made.

- 6 nullish lookups (`bnf/ll1` dispatch map, `sul/id` point-at-infinity,
  `sul/level/hash` root and `storage.at(-1)`, `types/rtti/proof` entries) become
  `assertNotNullish`.
- 3 in `media/json/parser` were narrowing `state.top` to one arm of a
  discriminated union. `assert(top !== null && top.kind === 'object')` narrows
  the same way and checks the tag; `pushKey` grows a block body to hold it.
- 3 literal-range casts (`asn.1` class/PC bits, `Index<3>`, `Index<5>`) become
  an `assert` over the alternatives. Narrowing a number to a literal union is
  exactly what a compiler cannot verify and a check can.
- 2 in `emergent_testing/proof` become `assert(result instanceof Array)`, which
  also replaces the `Array.isArray` assertion that was not narrowing.
- 2 rtti visitors dispatch on a `'const'` tag the compiler cannot correlate with
  the payload. `Type` is `Const | Thunk` and a `Thunk` is a function, so
  `assert(typeof c !== 'function')` *is* the definition of `Const`.

`npx tsc` and `fjs t` (2797 tests) pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQcZKuWSt2rEZrCj1jVZih

Step 4 of todo/inline-type-casts.md, second half, for
`fjs/protocol/mcp/proof.f.mjs`: 33 casts down to none.

A step's response is `unknown`, and its shape is exactly what these proofs
exist to check — so each cast was assuming the thing being proved. Seven
accessors (`hasError`, `errorCode`, `errorId`, `resultOf`, `protocolVersion`,
`toolNames`, `nextCursor`, `firstText`) check their way in with `assert` and
`in`, so a malformed response now fails at the read with the offending value
attached, instead of surfacing as a confusing mismatch further along — or not
at all.

Six `unknown`-to-`Unknown` casts on the test messages went a different way:
the local `step1`/`step2`/`step3` helpers declared `msg: unknown` when every
caller passes a JSON-RPC object literal. Annotating the parameter as `Unknown`
is what the casts were compensating for.

`npx tsc` and `fjs t` (2797 tests) pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQcZKuWSt2rEZrCj1jVZih

Continues step 4 of todo/inline-type-casts.md in `fjs/cas/proof.f.mjs` (8 casts
to none) and `fjs/mcp/proof.f.mjs` (11 to one).

`cas/proof` asserted a write failed by casting the driver's `unknown` result to
`IoResult<Vec>` and reading `[0]` and `[1]` — the shape being the very claim
each of those four proofs makes. One `errorMessage` accessor checks the pair.

`mcp/proof` gains `has`, `errorCode`, `idOf` and `toolsOf`, and `item0` now
returns a `ContentItem` so `textOf` discriminates on `type` rather than casting
to `{ text: string }`.

One cast remains, in `resultOf`, and it is now the only place a response
crosses from `unknown` to a typed `ToolsCallResult`. Everything checkable is
checked around it; the final step is on trust because rtti's `parse` reads
`Unknown`, and reaching `Unknown` from `unknown` is the same problem one level
down. Concentrating it in a single documented site is the point.

`npx tsc` and `fjs t` (2797 tests) pass. 274 of the original 357 casts are gone.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQcZKuWSt2rEZrCj1jVZih

`isNotFound` and its proof read `code` off an unknown rejection; `'code' in e`
narrows without a cast and is the check the comparison already implied.

`fjs run` cast a module's `main` straight to `NodeProgram`. A module named on
the command line can export anything, so it now asserts `main` is callable and
fails with the file name rather than as `main is not a function` from inside
the effect runner. The narrowing from `Function` to `NodeProgram` still needs a
cast — that is the boundary `assert` cannot cross — but it is now reached only
after a check.

`npx tsc` and `fjs t` (2797 tests) pass. 283 of the original 357 casts are
gone; 74 remain.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQcZKuWSt2rEZrCj1jVZih

283 of the 357 casts are gone. Replaces the audit's per-site table with the 74
that remain and the reason each stays, re-measured against the current tree —
none can be deleted, and none can become a meaningful `@satisfies`, so this is
a fixed point rather than a stopping point.

The largest remaining group, 36 TS2322/TS2345 sites, is deliberately untouched:
those casts override a real mismatch, so each needs an issue against the API it
papers over rather than a different cast syntax.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQcZKuWSt2rEZrCj1jVZih

…dant

`github-code-quality` flagged two unused variables in `types/nominal/proof`.
Following that up found the removals there had deleted the proof itself, and a
declaration-emit diff against `main` found four more removals that had changed
the published API. All ten type-checked; none were safe.

The API regressions, found by emitting `.d.mts` before and after:

- `effects/node` `createServer`: `<O extends Operation>(listener:
  RequestListener<O>) => Effect<O | CreateServer, Server>` became
  `(...payload: never) => Effect<Operation, never>`
- `effects/node` `log`/`error`: `Console` became the structural type
- `cas/evo` `emptyCache`: `Cache` became `{ bySubject: {} }`
- `types/range_map`: `RangeMapArray<T>` became `[T, number][]` — a purely
  functional library publishing a mutable array type

Three are now annotated declarations; `createServer` goes back to an inline
cast, which is what do-generic-operation-signatures.md is about.

`types/nominal/proof` demonstrates, per branding strategy, whether `<` compiles
between two branded values. The casts *are* the demonstration, and a brand is
unconstructible by design, so the declaration form rejects what the inline cast
accepted — `const a = {}` compared against `const b = {}` proves nothing. In a
proof about types the annotation is the test, and "does it still compile"
cannot see it being deleted.

Also clears the 36 `@import` entries the cleanup orphaned, so
`--noUnusedLocals` reports exactly what it did on `main`, and records both new
checks in the audit's method.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQcZKuWSt2rEZrCj1jVZih

* todo: open per-API issues for the casts the cleanup deliberately left

`todo/inline-type-casts.md` ends with 36 sites where the cast overrides a real
type mismatch, and says each needs an issue against the API it papers over
rather than a different cast syntax. This opens those issues for the 20 that
share a cause, and records that the remaining one-offs do not.

- `do_` has nowhere to put a type parameter, so the three generic effect
  constructors are cast while their non-generic neighbours in the same file are
  annotated declarations.
- Six `step`/`okStep` continuations cast their way to the operation union the
  caller wants, hiding any operation the runner cannot interpret.
- `memoryOperationMap()` is not assignable to `ToAsyncOperationMap<O>`, and that
  cast is the exact hazard AGENTS.md describes: it stops each handler being
  checked against `O`.
- Keyword and operator collections typed over `string` mean `has` cannot narrow
  to a `JsToken` kind, so four token constructions are cast.
- `btree/find` casts every tuple it builds or indexes.
- `mockRun`'s operation map reaches for `Parameters<typeof mockRun<…>>[0]`,
  which is what a call that cannot infer its type arguments looks like.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQcZKuWSt2rEZrCj1jVZih

* Address review: restore ten casts that `tsc --noEmit` said were redundant

`github-code-quality` flagged two unused variables in `types/nominal/proof`.
Following that up found the removals there had deleted the proof itself, and a
declaration-emit diff against `main` found four more removals that had changed
the published API. All ten type-checked; none were safe.

The API regressions, found by emitting `.d.mts` before and after:

- `effects/node` `createServer`: `<O extends Operation>(listener:
  RequestListener<O>) => Effect<O | CreateServer, Server>` became
  `(...payload: never) => Effect<Operation, never>`
- `effects/node` `log`/`error`: `Console` became the structural type
- `cas/evo` `emptyCache`: `Cache` became `{ bySubject: {} }`
- `types/range_map`: `RangeMapArray<T>` became `[T, number][]` — a purely
  functional library publishing a mutable array type

Three are now annotated declarations; `createServer` goes back to an inline
cast, which is what do-generic-operation-signatures.md is about.

`types/nominal/proof` demonstrates, per branding strategy, whether `<` compiles
between two branded values. The casts *are* the demonstration, and a brand is
unconstructible by design, so the declaration form rejects what the inline cast
accepted — `const a = {}` compared against `const b = {}` proves nothing. In a
proof about types the annotation is the test, and "does it still compile"
cannot see it being deleted.

Also clears the 36 `@import` entries the cleanup orphaned, so
`--noUnusedLocals` reports exactly what it did on `main`, and records both new
checks in the audit's method.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQcZKuWSt2rEZrCj1jVZih

---------

Co-authored-by: Claude <noreply@anthropic.com>

# Conflicts:
#	todo/inline-type-casts.md