ci(test): type-check Jest spec programs and gate it in CI (#1705)

* build(test): make spec tsconfigs resolve what Jest resolves

Lib spec tsconfigs used module: commonjs with node10 resolution, which cannot
see Angular's exports-only secondary entry points, and dropped global.d.ts, so
tsc reported thousands of resolution errors and no window.electron typing.
Switch them to module: preserve with bundler resolution (ts-jest still forces
CommonJS emit outside ESM mode), add global.d.ts to every spec program, type
jest.unstable_mockModule for the ESM workspace, include the ui-epg and
ui-playback specs that jest.web-esm.workspace.ts runs under the web spec
config, and drop the snack-bar stub that shadowed the real Material types.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* ci(test): gate spec type-checking with typecheck:spec

Add tools/typecheck/spec-typecheck.mjs, which runs tsc --noEmit over every
tsconfig.spec.json with a small pool and fails on any diagnostic, wire it into
the unit-and-typecheck job after typecheck:ci, and document the gate and the
spec tsconfig conventions in the validation map. Also bring the non-Tier-A
spec configs (remote-control-web, ui-remote-control, stalker-mock-server) to
the same conventions so the gate covers the whole workspace.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* test: fix the spec type errors surfaced by typecheck:spec

With the spec programs resolving modules and ambient typings correctly,
tsc reported 432 genuine errors across the Tier A projects: read-only
capability flags assigned on Partial<> doubles, signal-store values used as
types, fixtures missing required fields, index-signature property access,
partial bridge doubles cast through incompatible shapes, and deferred
resolvers narrowed to never. Type the doubles instead of casting to any:
writable mapped types for capability flags, InstanceType<typeof StalkerStore>,
typed jest.fn signatures, protectedState: false on test signal stores, and
completed fixtures. Production changes are limited to bracket access for
index-signature properties under the libs' noPropertyAccessFromIndexSignature
setting and two narrowing guards in the global favorites loader.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* test(playback): use the ESM setup's jest global in the controls fixtures

The fixture imported jest from @jest/globals, which is not a direct
dependency. Jest provides that module at runtime, so tests passed, but on a
clean pnpm install tsc cannot resolve it and typecheck:spec failed in CI.
The ESM test setup already installs import.meta.jest as the global, typed
by @types/jest, as the other ESM specs use it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* test: type the parental lock doubles merged since the gate was written

The parental lock feature (#1601) and the Stalker actor route landed on master
with spec doubles declared as zero-argument jest.fn()s that the tests then
drive with the real arguments, plus a copy of the ResizableDirective override
imported from a library that does not export it. Give the doubles the lock
service's real signatures, drop the dead override as in the sibling layout
specs, use bracket access for the actor route's personId param, and keep the
Stalker layout spec within the 1200-line limit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: 4gray <fourgray@proton.me>
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

docs/architecture/validation-map.md

@@ -27,12 +27,36 @@ using its result as evidence. Docker validation can use
 | ---------------------------------- | ----------------------------------- |
 | Angular renderer entry points      | `pnpm run typecheck:web`            |
 | Electron main process entry points | `pnpm run typecheck:backend`        |
+| Jest spec programs                 | `pnpm run typecheck:spec`           |
 | Full unit suite (all projects)     | `pnpm run test:unit:ci`             |
 | EPG data access                    | `pnpm nx test epg-data-access`      |
 | Workspace shell utilities          | `pnpm nx test workspace-shell-util` |
 | Shared SQLite schema/connection    | `pnpm nx test database`             |
 | Packaging metadata                 | `pnpm nx test packaging`            |
 
+`typecheck:spec` (`tools/typecheck/spec-typecheck.mjs`) runs `tsc --noEmit`
+over every `tsconfig.spec.json` under `apps/`, `libs/` and `tools/`, a few
+programs at a time (`--concurrency=N` or `SPEC_TYPECHECK_CONCURRENCY`; a
+positional argument filters by path), and fails on any diagnostic. ts-jest
+transpiles with `isolatedModules`, so this is the only check that catches a
+spec whose types drifted from the code it exercises. CI runs it in the
+`unit-and-typecheck` job after `typecheck:ci`. Conventions the gate relies on:
+
+- Spec tsconfigs use `module: preserve` with `moduleResolution: bundler`, the
+  same as the library's own `tsconfig.json`; ts-jest forces CommonJS emit
+  outside ESM mode, so the setting only affects type-checking, and `node10`
+  resolution cannot see Angular's `exports`-only secondary entry points.
+- Each spec program lists `global.d.ts` in `files` so `window.electron` and the
+  other ambient declarations resolve.
+- Libraries tested through `tools/testing/run-web-esm-lib-tests.mjs` are
+  type-checked by `apps/web/tsconfig.spec.json`, the config
+  `jest.web-esm.workspace.ts` hands to ts-jest; add a new ESM-tested library's
+  spec globs there. `apps/web/src/jest-esm.d.ts` types `jest.unstable_mockModule`.
+- Type test doubles instead of casting to `any`: `jest.Mocked<T>`,
+  `InstanceType<typeof SomeStore>` for signal stores, and
+  `Object.defineProperty` or a writable mapped type for read-only capability
+  flags.
+
 ## Lint
 
 ```bash
@@ -78,10 +102,10 @@ count per project (defaults: `min(3, cores - 1)` in flight and
 project's output is printed as one block when it finishes, and the run ends
 with the wall-clock total and the longest projects. Spec `tsconfig`s set
 `isolatedModules: true`, so ts-jest transpiles files one at a time instead of
-type-checking each through a language service; spec type errors therefore do
-not fail Jest (the web configs already ran with `diagnostics: false`), while
-`isolatedModules`-incompatible syntax such as a type re-export without
-`export type` still fails at load time.
+type-checking each through a language service (the web configs already ran
+with `diagnostics: false`); `isolatedModules`-incompatible syntax such as a
+type re-export without `export type` still fails at load time, and spec type
+errors are caught by `typecheck:spec` (see Unit And Type Checks).
 
 In CI, a pull request skips the Tier A suite (and the merged-coverage upload)
 when every changed file is outside Tier A test inputs:

docs/maintenance/agent-context-map.md

@@ -13,7 +13,7 @@ are not prerequisites for reading repository contracts.
 | --- | --- | --- |
 | Bootstrap, project placement, dependencies, aliases and lint configuration; root Nx config and project-local project.json files | [Nx boundaries](../architecture/nx-workspace-boundaries.md), [security overrides](../architecture/dependency-security-overrides.md) | [Nx architecture](../../.codex/skills/iptvnator-nx-architecture/SKILL.md) |
 | Angular conventions; docs and skills maintenance | [Agent workflow](../development/agent-workflow.md) | Use the area's skill below |
-| Unit, E2E, lint and coverage; `tools/coverage` | [Validation map](../architecture/validation-map.md) | Use the area's validation section |
+| Unit, E2E, lint and coverage; `tools/coverage`, `tools/typecheck` | [Validation map](../architecture/validation-map.md) | Use the area's validation section |
 | Performance journeys, counters, benchmark probes and the CI ratchet; `apps/electron-backend-e2e/src/journeys`, `apps/electron-backend-e2e/src/performance`, `tools/performance` | [Performance journeys](../architecture/performance-journeys.md) | Read the contract directly |
 | Electron entry/events/preload and CDP; `apps/electron-backend` | [Debugging and trace flags](../development/electron-debugging.md), [Electron security](../architecture/electron-security.md) | Use the available global electron skill for automation |
 | Releases, notes, screenshots, native assets, Linux manager metadata; `tools/release` | [Release pipeline](../architecture/release-pipeline.md), [note format](../../.changes/README.md) | [Release notes](../../.codex/skills/release-notes/SKILL.md), [release cut](../../.codex/skills/release-cut/SKILL.md) |