[T-Crypt]

The browser code gets type checking, and one real defect came out of it.

src/ has strict type checking. web/ did not. Running checkJs over it found 3,255 findings in 61 of its 63 files, and one of them is a bug. Fixing that bug removed two of the findings, and 3,253 remain.

What changed

• tsconfig.web.json and npm run check:web type-check web/**/*.js with the same strict settings as src/.
• scripts/check-web.mjs and scripts/web-clean.txt make it a gate for the files that are already clean. It prints every finding and exits 1 only when a finding lands on a listed file, or when tsc could not run. 29 lines, no new dependency, no count baseline. A baseline is a number someone can raise by editing it.
• web/peeks.js measured a peek tile against this.base, which Preact 11 never sets. measure() never measured, so clipped was always false. The tile now gets its own element through a callback ref.
• CI runs npm run check:web in the same job as the other checks, as the step after npm run check. Before this, the gate was decoration: nothing but a person running it by hand enforced it.

Proof

• The shipped node_modules/preact/dist/preact.mjs (the file served at /vendor/preact.mjs) has no base. A run showed this.base === undefined at mount while the callback ref got the element.
• The gate was made to fail on purpose, then re-run green:

npm run check:web            exit 0, 3,253 findings
web/themes.js + bad line     exit 1, "the gate holds these clean: web/themes.js(559,24): error TS2339"
error removed                exit 0

• The 3,253 findings sit in 61 of the 63 JS files under web/. web/peeks.js has 109 of them, which is why it is not in scripts/web-clean.txt; web/sheets/shortcuts.js and web/themes.js are clean and are.
• npm run check exit 0, npm run lint exit 0, npm run format:check clean, node --check web/peeks.js ok, node --test test/peeks-ui.test.ts 22 pass.
• npm test 630 pass, exit 0. The one flaky test this body used to name, test/visible-models-ui.test.ts, is deterministic with PR 01: CI runs the repo's checks on push and PR #11's one-line fix: 5 of 5 single-file runs pass.

Open

• 3,253 findings remain. They are annotation gaps, not defects. Fixing them means naming shapes for about 1,900 parameters across 61 files. The gate holds the two clean files clean while that work happens.
• The inline script in web/index.html:26-38 is browser code nothing checks. That needs its own ticket.
• The clipped path is unreachable. clipped is read only when wholeOnTile is true, and on that path the CSS clamp is removed, so it is false for every input before and after this fix. No user-visible change here. test/peeks-ui.test.ts recomputes clipped in the page and asserts the non-clipped case, so it cannot tell the fix from the defect. Making that state reachable is a layout change and needs its own ticket.

Ticket 02. This run's report: ~/handoffs/oh-my-pocket/2026-10-13-pr11-13-rerun/implement-02-web-typecheck.md.