fix(typing): drain 21 modules off the mypy exempt list (64 -> 43)

[stranske]

Batch one of the mypy campaign.

	before	after
exempt modules	64	43
findings	455	430
modules checked	35 of 99	56 of 99

Targeted the modules with 1–3 findings on purpose. Fixing 50 errors spread across dispatcher (65) and capability_propensity (51) would move the exempt list by zero — and the exempt list is the number the gate reads. The cheap tail is where the leverage is.

Four of the first findings were mine

The Any annotations I added in the previous commit referenced an unimported name in backlog, judge_reliability, watch, features — and later capability_admission, capability_advisor. No runtime impact (all carry from __future__ import annotations, so annotations are never evaluated), but real mypy errors the exempt list was hiding. That's the argument for shrinking the list rather than trusting it.

Real fixes, not casts to quiet a checker

• consumer_sync_shadow — no-redef was pointing at a genuine hazard: two different targets in one function, a str in the entries loop and an optional in the removals loop. My first attempt renamed only the binding and left four later uses resolving to the other loop's stale value — a bug I introduced, which the tests caught. All five uses now renamed together.
• ux_review — procs declared its middle element as object, which is what made every out.write/flush/close unreachable to the checker. Typed as TextIO; the # type: ignore probe I used along the way was removed, not left in.
• redirect_apply — lambda *a, **k: spent.append(a) or {} is a deliberate record-then-yield idiom that reads as a bug, since append returns None so the or branch always wins. Same behaviour as a named function that says so.
• gh_capacity — the ledger row builder returns None when headers carry no rate-limit data, and that None was being appended. Skipped, rather than widening the ledger's type.
• partitioned_review — a missing assertion_key was appended as None. Detection is preserved (the very next line already flags "not in the adjudication queue"); what goes away is a spurious duplicate report when two decisions both lacked the key.
• synthesis_promotion — one branch coerced merged with bool() and its sibling six lines up did not. Matched.
• evidence_acquisition — the parameter is a mapping of env vars, and os.environ is a Mapping[str, str] not a dict; typing it as what the function actually accepts removed both findings.

The report can now see its own subject

With the exempt list in place, scripts/ci_lint_baseline.py reported typecheck-mypy 0 errors — true at the gate and useless for tracking a drain, because the 430 behind the list vanished from the only report that counts them. That's the "green while checking nothing" shape at the reporting layer.

It now measures a second time against a copy of pyproject.toml with the override stripped — a copy, so a crash mid-measure can't leave the real gate config edited — and prints both:

typecheck-mypy: 0 at the gate, but 430 finding(s) remain behind 43 per-module
`ignore_errors` exemption(s).
  That list may only SHRINK — `mypy_exempt_max` in .verify-floor.json fails if it grows.

mypy_exempt_max lowered 64 → 43. Lowering it is the drain; it may never be raised without naming the module and why.

Test gate

python3 src/verify.py — 442 passed, 0 failed, 0 skipped, 85/85 selftests, 43/43 can-fire, 5/5 gates. ruff check . and black --check --line-length 100 clean. Every touched module re-imported and its selftest run; test_partitioned_review and test_consumer_sync_shadow run specifically, since those two fixes touched validation semantics.

What's left

430 findings across 43 modules, dominated by arg-type (109) and index (104), concentrated in dispatcher (65), capability_propensity (51), runtime_ac_gate (34), capabilities (32). Those are per-module campaigns rather than a tail — next batches should take one big module at a time so each one leaves the list.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

Next included review available in 14 minutes.

View limit details

Limit details: You’ve used the included review currently available. Your 73 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: a7d62622-edbf-444a-9660-cc86cd616995

📥 Commits

Reviewing files that changed from the base of the PR and between dd9486d and fd1e2a0.

📒 Files selected for processing (29)

• .verify-floor.json
• pyproject.toml
• scripts/ci_lint_baseline.py
• src/adversarial.py
• src/backlog.py
• src/cadence_registry.py
• src/capability_admission.py
• src/capability_advisor.py
• src/capability_targets.py
• src/consumer_sync_shadow.py
• src/epic_lane.py
• src/evidence_acquisition.py
• src/execution_profiles.py
• src/exploration_evidence_plan.py
• src/exploration_review.py
• src/features.py
• src/gh_capacity.py
• src/human_calibration.py
• src/issue_quality.py
• src/judge_reliability.py
• src/keepalive_shadow.py
• src/ledger_reconcile.py
• src/partitioned_review.py
• src/redirect_apply.py
• src/redirect_shadow.py
• src/strategy_experiment.py
• src/synthesis_promotion.py
• src/ux_review.py
• src/watch.py

---

_{Comment @coderabbitai help to get the list of available commands.}

[agents-workflows-bot]

Workflow source needed

PR #93 needs either a linked GitHub issue or one valid non-issue Workflow Source before PR metadata automation can manage it safely.

Please do one of:

• Add <!-- meta:issue:123 --> or a normal Closes #123 / Related to #123 line.
• Check one Workflow Source option in the PR body.
• Add a hidden marker such as <!-- workflow-source:local_request -->, <!-- workflow-source:manual_remote -->, <!-- workflow-source:review_followup -->, <!-- workflow-source:sync_campaign -->, or <!-- workflow-source:dependabot -->.
• Add a workflow source label such as workflow:source-direct-pr, workflow:source-local-request, workflow:source-review-followup, workflow:source-sync, or workflow:no-automation.

Once a valid source is present, this warning will not be reposted.