[joey-huckabee]

Pelorus now has a strict frontend typecheck and one bounded Linux CI gate. The existing esbuild bundle remains separate. CI requires the real Cargo-built server, all client cases passing, zero skips, and explicit passing results for both named integration tests.

Base: efb59e62dc0a2511dbae5d4bdc273646b7317d7d. Review exact head 6c8d543671edcb8b8ad63def6def9742a6372921 and its full diff. This is stabilization task 4; reviewer thr_qsvwmtnn8f and root/coordinator approval are required before an ordinary merge. No merge/release/version/tag/deployment/protection change is requested.

Gate and source fixes

• TypeScript 7.0.2, development-only and exactly pinned, with lock update. Strict/noEmit ES2022 ESM/bundler config covers normal src/**/*.ts; unused and fallthrough checks are enabled. Full declaration checking remains enabled.
• Reproduced nine baseline errors before fixes. Six project diagnostics: type-only metadata import, unused helper/parameter, Deck<MapView> generic, div container, and removal of the ignored legacy depth parameter block. Three upstream diagnostics: a non-exported texture type import and two nullable generic constraints in locked luma.gl declarations. TypeScript 5.9.3 and 7.0.2 reproduce the same baseline errors. Exact messages are preserved in docs/typecheck.md.
• Concrete frontend typing uses public deck.gl props, typed GeoJSON/layer results and tag-qualified div selection. querySelector<HTMLDivElement> is unchecked; its contract is the div#map-container selector and actual fixed <div id="map-container"> tag. The .mjs tests execute under Node but are not included in the source typecheck. The legacy depthTest: false key is ignored in the locked Deck/luma draw path; the final source removes that block entirely, preserving actual runtime defaults. No new depthCompare/depthWriteEnabled setting is activated. The DOM test stub gains the query method; no existing test/assertion is removed. No new blanket casts/any, protocol change, runtime dependency or framework is introduced.
• Official checkout/setup-node actions are pinned to verified commit SHAs (v7.0.1 / v7.1.0). Single Ubuntu 24.04 job, contents: read, no persisted checkout credentials, 20-minute timeout, stale-run cancellation, maximum two Cargo/compiler/test workers. Rust 1.99.1, Node 24.22.1.
• Rust fmt, Clippy with warnings denied, locked tests and locked build; then npm ci → explicit npm run typeprep → strict npm run typecheck → npm run test:ci → existing build. No lifecycle hooks. Server continues binding 127.0.0.1 unchanged.
• CI preflight requires a file with execute permission at PELORUS_SERVER_BIN. The test runner preserves child exit failures, enforces TAP totals (all registered tests pass; no skips, failures, cancellations or TODOs), and requires both named real-server cases to pass. There is no shell test-output pipeline to hide a failure. Proof-parser negative tests cover missing/ambiguous summaries, bad totals, failed/missing integration cases and skips.

Narrow luma.gl declaration repair — exact review required

Root/reviewer approved this approach in principle subject to the guards and identity evidence below. Explicit preparation changes only two installed .d.ts files / three expressions in existing @luma.gl/core and @luma.gl/engine 9.2.6:

1. Resolve the existing texture types through their actual relative declaration path.
2. Wrap each of two optional ShaderPropsT[P] generic arguments in NonNullable, preserving pre-existing any unchanged.

Both package versions and both input hashes are checked before any writes. Both files must be original, or both approved-after; mixed states fail without writes. All computed output hashes are checked before writes and actual hashes checked afterward. Both-after is an idempotent no-write path. There is no network access, npm postinstall/prepare hook, skipped library checking, other declaration edit or new declaration dependency.

docs/typecheck.md records the exact before/after expressions and SHA-256s, original diagnostics, compiler comparison, pinned upstream sources/runtime rationale and why augmentation does not fix the invalid original generic declarations. Upstream's optional map introduces undefined; the implementation supplies object props. The repair narrows that optional value and does not broaden the runtime API.

Executed Linux aarch64 evidence

CARGO_BUILD_JOBS=2 RUST_TEST_THREADS=2 TOKIO_WORKER_THREADS=2 GOMAXPROCS=2 \
  cargo +1.99.1 fmt --all -- --check
cargo +1.99.1 clippy --workspace --all-targets --locked -- -D warnings
cargo +1.99.1 test --workspace --locked
cargo +1.99.1 build --workspace --locked
cd client
npm ci --ignore-scripts --no-audit --no-fund
npm run typeprep
npm run typecheck
PELORUS_SERVER_BIN=../target/debug/server npm run test:ci
npm run build

The actual local shell exported the worker limits across the entire sequence. Results: 21 Rust tests passed; 42 client/proof/integration tests passed; zero skips. Both named integration cases passed. Format, warnings-denied Clippy, strict tsc, client bundle and git diff --check passed. GitHub Actions result will be checked separately after opening the draft.

Negative checks also passed:

• Unset, missing and non-executable server paths reject before tests start.
• Declaration drift in either file, a wrong version in either package, and both mixed states fail without changing either target or manifest.
• Repeated preparation changes neither bytes nor mtimes.
• A new unimported nested src file with a project type error and obsolete Deck API fails with TS2322 / TS2353; corrected ShaderInputs still rejects string props for a numeric field (TS2322).

Identity evidence (full digests and reports in docs): all 378 existing lock package records are identical, including versions, resolutions, dependency edges, integrities and flags. The 21 added records are only development TypeScript and its optional @typescript platform binaries; these are transitive dev-tool records, not product runtime dependencies. All 554 non-target files in the two affected luma packages are identical, including 114 JavaScript files. The same corrected project source produces identical bundle/map hashes before versus after declaration preparation:

app.js     45badd983f0953b7f9175eb2ea6e913cec43788639be3cf2f755be66ae8b45d7
app.js.map 21d591df3e78c557ac14a4a23a18884a85c2ebf426736f01668f53ad5657f3e2

The identity comparison isolates declaration preparation; source API corrections can change project-emitted bytes relative to the base. No Windows validation or browser/GPU/performance claim is made. Existing npm deprecation and Node module-type warnings remain. CI uses npm ci --ignore-scripts to prevent dependency lifecycle execution; explicit preparation is a separate command. Sonar rules and policy are unchanged. Local machine files/installs and other project repositories were not accessed. Existing branches and edits were preserved.

Current-head review refinements

Follow-up 6c8d543671edcb8b8ad63def6def9742a6372921 is bounded to removal of the depth block, the tag-qualified selector and honest disclosures, CI install --ignore-scripts, the three reported script readability findings, and updated preparation-only hash evidence. No new source contract, dependency, protocol or rendering design.

The prior Linux run passed, but SonarCloud correctly blocked its permissive install step. That finding is fixed directly rather than suppressed; new Linux and Sonar results must be checked on this exact head before merge. Local clean npm ci --ignore-scripts → preparation checks → strict typecheck → 42-test / zero-skip gate → build passed on the revised source. All drift/version/mixed-state/no-write, idempotence, project/API misuse and runtime/lock/bundle identity checks were rerun. The unchanged Rust sources retain their 21-test/format/Clippy/locked-build local evidence; fresh hosted CI will run those again.

Reviewer thr_qsvwmtnn8f must approve the exact revised head. Root retains ordinary merge control after all checks are green. No browser/GPU, Windows or performance claim is made.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud