From 33900cc07b824b0633c85c94251a5a7e49e31f41 Mon Sep 17 00:00:00 2001
From: highlander <highlander@keepkey.com>
Date: Wed, 5 Aug 2026 18:26:56 -0300
Subject: [PATCH] fix(preflight): make the typecheck gate differential instead
 of unreachable
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Gate 6 demanded exactly zero type errors while the codebase carries a
636-error baseline, so 'make preflight' could never print ALL GATES
PASSED. A gate that always fails is a gate everyone learns to ignore —
which is how the stale submodule remotes survived: gate 3 was silently
comparing against frozen refs and printing green, and nobody was reading
the output anyway because gate 6 had already failed the run.

Now it compares against a committed .typecheck-baseline and fails only on
a REGRESSION, reporting how many errors a change adds. Below baseline
prints a nudge to lower the file. This matches how the errors are
actually judged in review (differential, per the known false-green from
tsc aborting on @types/minimatch).
---
 Makefile                                   | 7 +++++--
 projects/keepkey-vault/.typecheck-baseline | 1 +
 2 files changed, 6 insertions(+), 2 deletions(-)
 create mode 100644 projects/keepkey-vault/.typecheck-baseline

diff --git a/Makefile b/Makefile
index d53ee2b9..6a0a3e55 100644
--- a/Makefile
+++ b/Makefile
@@ -847,10 +847,13 @@ preflight: submodules
 	test -f modules/proto-tx-builder/dist/index.js && echo "   ✅ proto-tx-builder dist/" || { echo "   ❌ proto-tx-builder dist/ — run: make modules-build"; fail=1; }; \
 	test -f modules/device-protocol/lib/messages_pb.js && echo "   ✅ device-protocol lib/" || { echo "   ❌ device-protocol lib/ — run: cd modules/device-protocol && npm run build"; fail=1; }; \
 	echo ""; \
-	echo "6. VAULT TYPECHECK"; \
+	echo "6. VAULT TYPECHECK (differential vs baseline)"; \
 	errs=$$(cd $(PROJECT_DIR) && npx tsc --noEmit --skipLibCheck 2>&1 | grep "error TS" | grep -v "minimatch" | wc -l | tr -d ' '); \
+	base=$$(cat $(PROJECT_DIR)/.typecheck-baseline 2>/dev/null || echo 0); \
 	if [ "$$errs" = "0" ]; then echo "   ✅ clean"; \
-	else echo "   ❌ $$errs type errors"; fail=1; fi; \
+	elif [ "$$errs" -le "$$base" ]; then echo "   ✅ $$errs errors, at or below baseline $$base"; \
+		if [ "$$errs" -lt "$$base" ]; then echo "      (improved — update $(PROJECT_DIR)/.typecheck-baseline to $$errs)"; fi; \
+	else echo "   ❌ $$errs type errors — baseline is $$base, so this change ADDS $$(($$errs - $$base))"; fail=1; fi; \
 	echo ""; \
 	echo "════════════════════════════════════════════"; \
 	if [ "$$fail" = "0" ]; then echo "✅ ALL GATES PASSED — ready to cut release"; \
diff --git a/projects/keepkey-vault/.typecheck-baseline b/projects/keepkey-vault/.typecheck-baseline
new file mode 100644
index 00000000..a8f78cee
--- /dev/null
+++ b/projects/keepkey-vault/.typecheck-baseline
@@ -0,0 +1 @@
+636