safe-bash: maintained typecheck fails in legacy fixture sources

[kamilio]

Observed while validating #580 with current HEAD1a8627d40 plus the read-allocation candidate. The maintained command npm run typecheck --workspace=virtual-bash exits2 with24 source-and-tests diagnostics. None are in the four #580 changed files; those diagnostic files are untouched by that candidate. Do not treat this as a clean-HEAD reproduction until the baseline is separately checked.

Diagnostic groups:

• diff-patch-stress emptyfile-delta / gnu-revised-acceptance / gnu-safety-strip-followup import missing ../gnu-target/oracle.js.
• structured-stress/jq-42-review-fixes/evidence.test.ts has possibly-undefined selected entries and string-or-undefined assignments.
• tests/contracts/invocation-cleanup.cases.ts:55 reports true not assignable to false.
• stress/harness-timing-20260827 imports missing native-delivery.js and consequently reports unknown errors/implicit-any events.

The source build succeeds; the maintained consumer checks reported expected outcomes, but the overall typecheck is failed, not waived or reported green. Validate each diagnostic and the current-vs-historical input ownership before fixing anything. Preserve immutable evidence/receipt owners; do not invent missing oracle implementations or hide failures with blanket exclusions.

[kamilio]

Taking #605 for the maintained source-audit cleanup. The same 24 diagnostic lines are reproduced on the delivered batch; a separately introduced upstream getter diagnostic was fixed without changing the baseline. Authentic missing helper bytes were found in Git, but those execution helpers were intentionally retired in 94cf8b1, so I will not blindly restore native provisioning/qualification. Investigating an honest static-contract correction while preserving retained evidence, exact input membership and retirement policy; no exclusions or diagnostic waivers.

[kamilio]

Delivered to origin/main at 848ca91; remote SHA verified before this immediate post-push closure. The complete maintained typecheck now exits zero, with no diagnostic filtering or widened exclusions: source/tests, historical build-first consumer, three source groups, 26 current consumer groups, and the three expected negative groups all pass. Eleven current-test errors were repaired with real existence/byte/digest guards and the current exact options-key union. The remaining historical imports are checked against reviewed declaration-only caller slices, bound to six exact immutable caller edges and authenticated model bytes with recorded original/last-retired Git provenance. Retired GNU/native runtime helpers remain absent and unexecutable; successful normal output explicitly says these are compile-only models, not runtime availability or qualification. New/current/alias imports cannot acquire those models; independent review caught and TDD-fixed a backslash-reference bypass before delivery. All 36 model tests pass, including strict-diagnostic retention, root/options/noEmit preservation, hash/path/absence guards and alias negatives. Final normal npm run build, complete npm test (29,944 shared tests; 279 runner tests; 19,714 Safe Bash tests, plus remaining workspace/posttest stages), root/package/workflow lint and repeated full maintained typechecks pass. Actual output was screenshot-validated. Immutable historical caller/evidence bytes, inventories and existing exclusions are preserved. Publication monitoring follows separately; release success is not yet claimed.

[kamilio]

Release follow-up: final commit 848ca91 is verified on origin/main. SafeFS/SafeJS/Safe Bash 0.1.84 actually published successfully (run 33931398407); poe-code 14.0.39 actually published successfully (run 33931398474), with registry gitHead matching this commit. All release CI validation jobs passed. The issue was closed immediately after verified push, before waiting for these releases. The current open issue queue authored by kamilio is empty.