ci(typecheck): warning ratchet — an undefined call no longer passes silently

[gHashTag]

Negative audit of every gate — the follow-up to the wave-65 pipefail finding: a green check means nothing until it is proven able to redden. I injection-tested each gate:

gate	injection	result
zig-exec	break a gen	✅ detected
C-exec (compile)	break a gen	✅ detected
C-exec (runtime)	failing assert	✅ detected — t27_assert is __builtin_trap, so failure is SIGILL, not exit 0
typecheck	call an undefined function	🔴 NOT detected

The hole

t27c downgrades a call to an undefined function to a warning and prints Typecheck OK (0 errors, 1 warnings) with exit 0. The gate grepped only for Typecheck OK, so the corpus could acquire undefined calls silently.

The fix: a warning ratchet

Failing on any warning isn't yet possible — 47 of 107 specs carry pre-existing warnings (788 total). So each spec's current count is pinned, and the gate fails when a count grows. A newly introduced undefined call, in any spec, now reddens the gate.

Counts were verified deterministic across repeated runs, and the baseline was generated with t27c built from t27 master — the same compiler CI uses.

It also guards the baseline itself: if the table doesn't cover every spec (a new spec that skipped it), the gate fails and names the gap — same shape as the wave-55 icarus coverage guard.

Verified three ways

• healthy corpus → exit 0 (107 specs pinned, corpus has 107)
• injected undefined_function_xyz → caught, spec named
• unpinned new spec → caught (baseline covers 107 but the corpus has 108)

Lower a pinned number whenever a spec's warnings are fixed; never raise one.

🤖 Generated with Claude Code