types: 119 casts exist because shared src/ is typed against ONE Worker's ambient Env

[JSONbored]

Asked to find where the codebase casts instead of using its generated types. The
gates say the obvious places are clean — validate:boundary-casts is at 0,
validate:untyped-db-reads reports none, and every lakehouse read is already
parsed against LAKEHOUSE_ROW_SCHEMAS. The casts are somewhere else, and they
have one cause.

The measurement

330 as unknown as in src/ + workers/, and they are not scattered:

119  as unknown as Parameters<typeof f>[n]
 77  as unknown as Record<…>
 34  as unknown as Array<…>
 12  as unknown as Row          (the documented boundary cast; not a violation)
 11  as unknown as Env

Concentrated in six files: entities.ts 62, api.ts 37, graphql.ts 34,
mcp-server.ts 31, analytics.ts 30, data-api.ts 24.

Why the biggest category exists

Every one of the 119 looks like this:

await loadSubnetWeightsColdTier(
  env as unknown as Parameters<typeof loadSubnetWeightsColdTier>[0],
  …
)

and the loader declares:

export async function loadSubnetWeightsColdTier(env: Parameters<R2SqlReader>[0], …)
//                                                   ^ resolves to `Env | null | undefined`

src/r2-sql.ts imports no Env. It uses the ambient global one, which is
generated per Worker:

workers/data-api.worker-configuration.d.ts        16 bindings
workers/registry-sync-api.worker-configuration.d.ts
workers/wss-lb.worker-configuration.d.ts           7 bindings

Three Workers, three different Env shapes, one shared src/. So shared code is
typed against whichever ambient Env wins, every Worker whose bindings differ
fails to satisfy it structurally, and the call site forces it. There is at least
one triple cast from the same cause —
readStore(env, …) as never as unknown as Parameters<…> in entities.ts:7787.

What the cast actually costs

It is not cosmetic. as unknown as is the one form that survives BOTH sides
changing: if a loader starts reading a binding the calling Worker does not have,
nothing fails to compile and the read gets undefined at runtime. That is the
#436 class — a knob that looks wired and is not — reachable at 119 sites.

The shape of the fix

The same one #11207 used for StatementClientLike: shared code should declare
the MINIMAL binding surface it needs, not the ambient Env. r2SqlQuery reads
one binding. A loader that says

env: { R2_SQL_TOKEN?: string; … } | null | undefined

is satisfied structurally by every Worker's Env, and the cast at each call site
disappears rather than being suppressed.

Worth doing per-family rather than in one change — the Parameters<R2SqlReader>[0]
indirection alone appears in 13 loaders, and those share one contract.

Not in scope

The 77 Record<…> and 34 Array<…> casts are a separate question and some are
legitimate (reading an untyped JSON body). They should be counted again once the
Parameters family is gone, because that is where the noise is now.

Found while surveying for #11207-style drift; related: #11194 (cast vs parse at
real boundaries), #11182 S5.

[linear-code]

JSO-8306

[JSONbored]

Done, across #11358, #11361, #11368 and #11374. Verified against main at 622dbe1 — each claim in the issue, re-measured:

330 as unknown as in src/ + workers/ → 0. Counted with the gate's own AST scanner, which skips comments and strings:

production src+workers: 0 | in .test.ts files: 7

A plain grep still reports ~50, and all of them are prose about the removed casts (workers/do-state.ts:8, src/neon-write-buffer.ts:69, …). That is why the gate is an AST walk: a text scan of this repo now matches its own documentation.

119 as unknown as Parameters<typeof f>[n] → 0. All six remaining textual matches are comments explaining what used to be there.

The triple cast → gone. readStore(env, …) as never as unknown as Parameters<…> in entities.ts:7787 no longer exists.

The root cause → fixed, not worked around. wrangler types now runs with --env-interface per config, so the three Workers generate DataApiEnv, RegistrySyncApiEnv and WssLbWorkerEnv instead of three interface Env blocks that TypeScript merged into their union. validate:worker-types-parity gained an envInterfaceErrors() check so a config added without one fails CI.

Proving the diagnosis was right, empirically: POSTHOG_TRACES_SAMPLE_RATE had merged to string | undefined, which meant validate:worker-types-parity was already blind to any variable that differed between configs.

Beyond the issue's scope

The sweep continued until every area was at zero and gated there:

src 0/0 · workers 0/0 · schemas-src 0/0 · packages 0/0 · scripts 0/0 · apps/ui 0/0

validate:double-assertions enforces it per area, and a budget ABOVE the real count fails too — a ceiling nobody is holding is not a ceiling.

apps/ui was invisible to the gate until #11368: the file walk filtered on .endsWith(".ts") and every route and component there is .tsx, so the area with the most assertions in the repo was the one never counted. It is git ls-files now.

Defects the casts were hiding

• The head poller wedged silently and permanently on a non-numeric cursor: heightsToEmit does lastSeen + 1, which concatenates for a string, so the loop started past the head and never ran. Nothing emitted → nothing written back → the bad cursor never repaired. Measured: heightsToEmit("14", 16) and ("14", 99) both return [].
• A subnet with no netuid collided with every other one in the changelog diff — all keyed under undefined.
• All three MCP Durable Object doubles were missing waitUntil, so validate:mcp emitted no telemetry at all and reported success; the firehose double had no storage whatsoever.
• /subnets/$netuid dropped the compare drawer's ?compare= param — its validateSearch replaces the search object and never listed it. Proven: validateSearch({compare: 5, tab: "overview"}) → {"tab":"overview"}.
• wallet-auth guarded if (!kv?.get) then called kv.delete — a binding with one and not the other threw after the nonce was consumed.

And in apps/ui, ~64 of the assertions turned out to be one dependency: @tanstack/zod-adapter declares zod ^3.23.8 while the repo runs zod 4, so its fallback() returned any — and one any property collapses the whole object type, which is why every route's search type was {}. Removed in #11374.