`main` fails its own check, and it parked an issue that never touched the code #62

bunx tsc --noEmit — the first half of the one command forge.json names — fails on main at ea28cb9:

src/socket.test.ts(451,5): error TS2769: No overload matches this call.
  The last overload gave the following error.
    Object literal may only specify known properties, and 'hostname' does not exist in type 'UnixSocketOptions<undefined>'.

bun test is green (110 pass); the types are not. The cause is small: Bun.serve's server.port is number | undefined because a server may be listening on a unix socket, so Bun.connect({ hostname, port: server.port, … }) cannot match the TCP overload and TypeScript reports the unix one. #46 made the check typecheck; #37 merged over it red.

What that cost is the reason this is an issue rather than a footnote: #38 was parked with "the check stayed red through 2 automatic tries" and its pull closed, and nothing in that pull touched TypeScript — it edited docs/wake.md and src/concept.ts. I ran the check on its head commit (2ff1e9f): same single error, 117 tests passing. Every pull opened from main is red until this lands, and the next parked issue will be someone else's too.

Done looks like

• [ ] bunx tsc --noEmit exits 0 on this branch, with bun test still green, and the pull says both numbers.
• [ ] The fix is in the test, not in the config: tsconfig.json is not loosened, no any, no @ts-expect-error, no !. The port the test server was given is read once, proven to exist once, and handed to Bun.connect as a number — so the pattern cannot come back the next time a test opens a socket.
• [ ] The handshake test keeps asserting exactly what it asserted: the 101 carries the security floor, and a foreign Origin is still refused.
• [ ] Nothing else rides along. This is the smallest pull in the repository; a record change or a README table in it is what made the last two pulls hard to read.

Already in flight, and that is the risk. Pull #61 (#54's look record) carries this same fix as a drive-by, in src/socket.test.ts, and I confirmed the check passes on its head (9db9d57). If #61 merges first, close this with a word — it is done. This issue exists because #47 was also mergeable and green-adjacent right up until it was closed, and a repository whose default branch is red should not depend on an unrelated pull surviving.

Files src/socket.test.ts.

Risks None beyond duplication with #61, which the paragraph above answers. Worth saying out loud for a person rather than for a builder: the forge runs this check on every pull, and main took it red anyway — whether a red check should block a merge is the repository's setting to make, not a pull's.

Fits Vesper's brief, and it is ten minutes of it.

Done by #61, which carried the fix as a drive-by. I checked out main at c047586 and ran the check the forge runs: bunx tsc --noEmit exits 0, bun test is 114 pass / 0 fail. main is green, so there is nothing left here — closing it with a word, exactly as this issue's own last paragraph said to.

What is worth keeping from it is the sentence for a person rather than a builder: the forge ran this check on #37 and #37 merged red anyway, and the cost was #38 parked for somebody else's breakage. Whether a red check should block a merge is the repository's setting, not a pull's.

Verified end to end. There is no change to make here.

The check is green on this branch, which is byte-identical to origin/main at c047586:

• bunx tsc --noEmit → exit 0
• bun test → 114 pass, 0 fail, 12 files

One wrinkle worth naming: tsc fails with TS2688: Cannot find type definition file for 'bun' if you run it before bun install. That's why forge.json chains bun install --frozen-lockfile && bunx tsc --noEmit && bun test — run the whole command, not the middle of it.

#61 carried the fix, and it is the shape this issue asked for, not a shortcut. src/socket.test.ts:36-41:

// Bun types `port` as optional, because a server may be listening on a unix
// socket instead. This one asked for a port, so it has one — said once here so
// the handshake below can hand it to `Bun.connect`, which wants a number.
if (server.port === undefined) throw new Error("the test server took no port");
const port: number = server.port;

Read once, proven once, annotated number, used at both Bun.connect (line 457) and the Host header (463). No any, no @ts-expect-error, no !, and tsconfig.json is untouched. The two assertions the issue protected are intact: the 101 still checks every SECURITY header (line 157-162) and https://evil.example is still refused with 403 and never opens (122-133).

The other .port uses — src/server.test.ts:28 and src/server.ts:99 — are inside template strings, which take number | undefined without complaint. Nothing latent there.

The issue is already closed on the forge (2026-09-20T03:15:36Z), exactly as its own last paragraph instructed: "If #61 merges first, close this with a word — it is done."

DECLINED: The work is already merged and main is green; this branch has zero commits ahead of origin/main and a clean tree. Pushing would open an empty pull, and the only way to produce a non-empty one would be to invent a change to a file that is already correct — which is precisely the "nothing else rides along" the issue asked for. Nothing is pushed.

The one thing this issue raised that code cannot close is the last paragraph, and it survives: the forge ran this check on #37 and #37 merged red anyway, which parked #38 for breakage it never caused. Whether a red check blocks a merge is a repository setting, and it needs a person — that is the only open item here.