chore(types): wire or delete the unused safety analyses, and make mutable arrays invariant

Problem

Several analyses are imported only by their own tests: null_safety.zig, bounds_checking.zig, overflow_detection.zig, taint_tracking.zig, drop_safety.zig, information_flow.zig, capability_types.zig, and variance.zig (used only by typescript_types.zig). TypeInferencer is a stub. Separately, Type.isSubtype treats arrays as covariant with no mutability check (comment: "covariant for immutable"), which is the classic array-covariance hole.

Evidence (origin/main @ d4b219507)

• packages/types/src/type_system.zig:4448
• packages/types/src/type_system.zig:646-648

Scope

• For each module: call it from TypeChecker.check() with a negative test, or delete it.
• Make mutable arrays/slices invariant; keep covariance only for immutable views.

Acceptance criteria

• Every listed module is either wired (with a failing-program test) or removed.
• []Sub is not assignable to a mutable []Super.

Links

Part of #814.

Pushed the mutable-array soundness leg to main in 2585d31 (fix(types): make mutable arrays invariant (#788)).

What changed:

• bare mutable Array values are invariant
• mutable array references cannot widen element types
• immutable array views retain covariance
• checker coercion no longer widens an existing mutable array, while contextually typed array literals still use their destination element type

Verification (all memory-bounded and sequential under 3,840 MB):

• focused source checker: 2/2 pass
• full control-flow checker suite under WASI/Node: 47/47 pass
• subtype regression slice: 12/12 pass
• affected edge cases: 2/2 pass
• full native control-flow test artifact: compile-only pass

The broad full typescript_types/edge_case roots still encounter unrelated pre-existing Zig 0.17 ArrayListUnmanaged initializer errors in type_interner.zig, intersection_type.zig, and type_operators.zig. This issue remains open for the separate listed analysis-module wiring/removal work.

Pushed b406444 to main: fix(types): wire null and bounds analyses (#788).

This activates two previously test-only analyses in TypeChecker.check():

• NullSafetyTracker now records binding/parameter flow facts and rejects direct member access through a nullable binding while preserving safe-navigation access.
• BoundsTracker now records known array-literal lengths, propagates bounds through aliases, and rejects constant out-of-bounds indices while accepting valid constant indices.
• Per-function flow facts are reset without discarding accumulated diagnostics.
• The dormant null-safety module was updated to the current Zig ArrayList API and its pre-existing declaration-shadowing error was fixed.

Verification: full control-flow checker suite passes 51/51 under the guarded WASI/Node runner (peak compile footprint 565 MB; one heavy process at a time under 3,840 MB).

Remaining modules from this issue: overflow_detection, taint_tracking, drop_safety, information_flow, capability_types, variance, plus the TypeInferencer stub.

Pushed eb59946 to main: fix(types): activate overflow analysis (#788).

OverflowTracker is now part of the real TypeChecker lifecycle. Contextually typed integer arithmetic is range-analyzed through the tracker, literal and identifier ranges are propagated, provable destination overflow is rejected, and unknown ranges are left to runtime checks rather than reported speculatively. The dormant module was also moved to the current Zig ArrayList API and now frees owned diagnostics.

Verification: full control-flow checker suite passes 53/53 under the guarded WASI/Node runner; compile peak was 447 MB under the 3,840 MB ceiling.

Remaining issue modules: taint_tracking, drop_safety, information_flow, capability_types, variance, plus the TypeInferencer stub.

Pushed 33d5cf1 to main: refactor(types): enforce array variance centrally (#788).

The standalone variance module is no longer test-only: Type.isSubtype and immutable array assignment now route mutable invariance and read-only covariance through checkVariance. The callback contract is explicit, and direct assertions cover covariant, contravariant, and invariant decisions.

Verification:

• direct variance/array relation test: 1/1 pass
• source checker mutable-array cases: 2/2 pass
• guarded compile peaks: 198 MB and 506 MB

Remaining issue modules: taint_tracking, drop_safety, information_flow, capability_types, plus the TypeInferencer stub.

Pushed d4acad00c (fix(types): activate drop safety analysis (#788)) directly to main. This wires DropSafetyTracker into the real type-checker lifecycle, tracks owning function parameters and local bindings, removes moved values from pending drops, and reports post-move access through the drop-safety diagnostic path. Added a source-level regression test. Verification: guarded WASI build peaked at 627 MB and the full control-flow checker suite passed 54/54.

Pushed 9de9e7761 (fix(types): restore the real type inferencer (#788)) directly to main.

This removes the duplicate no-op TypeInferencer from type_system.zig, ports the real inference engine to the current AST and canonical types module, gives inference allocations an owned arena lifecycle, fixes duplicate quantified variables during generalization, and wires the dedicated inference suite into the repository test graph.

Guarded verification:

• dedicated inference suite: 12/12 pass, no allocator leaks
• internal mismatch/suggestion suite: 8/8 pass
• full control-flow checker regression: 54/54 pass
• peak guarded footprint: 644 MB (ceiling 3,840 MB)

The cached native zig build runner on this host froze before runtime startup in macOS _dyld_start (96 KB footprint and no compiler child); the equivalent test artifacts compiled and executed directly. Remaining #788 items are taint tracking, information flow, and capability types.

Pushed two additional direct-to-main commits under glennmichael123:

• 3a74005 — remove the isolated taint-tracking and information-flow prototypes and correct the security guide
• d5e83d6 — remove the isolated capability-type prototype and correct the security guide

These modules were reachable only from their standalone Zig tests; Home source syntax/AST metadata could not express their annotations, and there were no TypeChecker or build-graph consumers. Keeping them would have presented test-only APIs as compiler enforcement. Post-removal reference audits found no source/build imports. Both commits use conventional messages, contain 5 and 3 files respectively, and were pushed directly to origin/main.

Acceptance audit on current origin/main (d5e83d603) is complete:

• null safety and bounds checking: wired in b40644412, source-level negative tests, 51/51 checker suite
• overflow detection: wired in eb5994655, source-level negative tests, 53/53 checker suite
• variance and mutable-array invariance: enforced in 2585d31b9 and centralized in 33d5cf1e4; mutable widening rejected while immutable views remain covariant
• drop safety: wired in d4acad00c, source-level post-move regression, 54/54 checker suite
• real TypeInferencer: restored in 9de9e7761, dedicated 12/12 plus internal 8/8 tests
• taint tracking, information flow, and capability-type prototypes: removed in 3a74005da and d5e83d603 after proving they had no parser, TypeChecker, or build consumers; documentation now labels them as proposals

Current-source reference audit confirms the wired modules are consumed by the real checker/type relation and the removed modules no longer exist. Both acceptance boxes are satisfied, so this issue is complete.