fix(relay): clear the changed-code casting gate on the merge commit

check-changed-code-quality.mjs lints the merge commit with current main's
rules against a merge base predating them, so every `as` in a file this PR
adds counts as new. Local oxlint stays green throughout; the gate reported 15.

Four of them were removable rather than suppressible: annotate the variable
(`const mode: { current: MobilePairingConnectionMode }`) instead of asserting
the literal. The rest carry a line-specific SAFETY rationale.

relay-origin-pool-teardown.test.ts is re-taken wholesale from #20258 at
b3783ad3e6, which already carries its three directives, so the two still
merge as identical content.

Measured: gate exit 0 (casting and SAFETY-rationale both 0 new), tc exit 0,
relay+startup 83 files / 728 tests passed.

src/main/runtime/relay/desktop-relay-service-failure-cause.test.ts

@@ -13,8 +13,10 @@ function serviceWithOfflineReason(offlineReason: RelayOfflineReason | null): {
     getLiveBroker: () => null,
     waitForLiveBrokerResult: async () => ({ broker: null, offlineReason })
   }
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: builds the instance without running the constructor, which would open a real broker.
   const service = Object.create(DesktopRelayService.prototype) as DesktopRelayService
   Object.assign(service, { coordinator })
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: requireActiveBroker is private; this suite exercises it directly and the coordinator stub is all it reads.
   return service as unknown as { requireActiveBroker: () => Promise<unknown> }
 }
 

src/main/runtime/relay/desktop-relay-service-policy-flip-cause.test.ts

@@ -33,6 +33,7 @@ function serviceWithMode(mode: { current: MobilePairingConnectionMode }): {
     demandLedger: { acquireTransient: () => release },
     refreshDemand: () => {}
   })
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: withTransientDemand is private; the fixture calls it directly and supplies only the fields it touches.
   const host = service as unknown as TransientDemandHost
   return {
     run: (operation) => host.withTransientDemand.call(service, 'pairing', 'device-1', operation),
@@ -42,7 +43,7 @@ function serviceWithMode(mode: { current: MobilePairingConnectionMode }): {
 
 describe('DesktopRelayService policy flip during an in-flight grant', () => {
   it('names the LAN flip rather than the generic control-not-active code', async () => {
-    const mode = { current: 'automatic' as MobilePairingConnectionMode }
+    const mode: { current: MobilePairingConnectionMode } = { current: 'automatic' }
     const { run, release } = serviceWithMode(mode)
 
     await expect(
@@ -56,7 +57,7 @@ describe('DesktopRelayService policy flip during an in-flight grant', () => {
   })
 
   it('does not rewrite a failure the policy had nothing to do with', async () => {
-    const mode = { current: 'automatic' as MobilePairingConnectionMode }
+    const mode: { current: MobilePairingConnectionMode } = { current: 'automatic' }
     const { run } = serviceWithMode(mode)
 
     await expect(
@@ -67,7 +68,7 @@ describe('DesktopRelayService policy flip during an in-flight grant', () => {
   })
 
   it('still refuses at the entry gate when the policy already excludes the device', async () => {
-    const mode = { current: 'local-only' as MobilePairingConnectionMode }
+    const mode: { current: MobilePairingConnectionMode } = { current: 'local-only' }
     const { run } = serviceWithMode(mode)
     const operation = vi.fn(async () => 'unreachable')
 
@@ -76,7 +77,7 @@ describe('DesktopRelayService policy flip during an in-flight grant', () => {
   })
 
   it('leaves a successful grant alone even if the policy flips under it', async () => {
-    const mode = { current: 'automatic' as MobilePairingConnectionMode }
+    const mode: { current: MobilePairingConnectionMode } = { current: 'automatic' }
     const { run } = serviceWithMode(mode)
 
     await expect(

src/main/runtime/relay/relay-origin-pool-teardown.test.ts

@@ -5,6 +5,7 @@ import type { RelayHostHelloAckMessage } from './relay-control-protocol'
 import type * as RelayHttpClientModule from './relay-http-client'
 
 const fakes = vi.hoisted(() => ({
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: an empty literal cannot infer the element type, and vi.hoisted runs before the class that fills it exists.
   controls: [] as {
     options: {
       onDrain(message: { type: 'drain'; graceMs: number; recovery: 'resolve-director' }): void
@@ -57,6 +58,7 @@ function brokerOptions(
 ): Parameters<typeof RelaySessionBroker.connect>[0] {
   const keypair = nacl.box.keyPair()
   return {
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: RelaySessionBroker.connect reads only these two endpoints off authConfig; the rest of the profile config is never reached.
     authConfig: {
       relayTokenEndpoint: 'https://auth.example.test/v1/relay-token',
       relayDirectorUrl: 'https://relay.example.test'
@@ -65,6 +67,7 @@ function brokerOptions(
     identity: { userId: 'user-1', profileId: 'profile-1', organizationId: 'org-1' },
     keypair: { ...keypair, publicKeyB64: Buffer.from(keypair.publicKey).toString('base64') },
     appVersion: '1.0.0',
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: attachTransport is the only member the broker calls, and nothing in this suite opens a mobile socket.
     mobileSocketWiring: { attachTransport: vi.fn(() => () => {}) } as never,
     isCurrent: () => true,
     refreshAccessToken: async () => null,

src/main/startup/desktop-relay-startup.test.ts

@@ -2,6 +2,7 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const fakes = vi.hoisted(() => ({
   configured: true,
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: vi.hoisted needs the widened type up front; null cannot infer the options shape assigned later.
   serviceOptions: null as null | { hostMobilePairingConnectionMode?: () => string },
   service: {
     start: vi.fn(),
@@ -13,7 +14,9 @@ const fakes = vi.hoisted(() => ({
     provisionRelay: vi.fn(),
     ensureLive: vi.fn()
   },
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: an empty literal cannot infer the listener signature, and vi.hoisted runs before any listener registers.
   settingsListeners: [] as ((updates: Record<string, unknown>) => void)[],
+  // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: undefined alone infers as undefined, closing the field to the mode strings each test assigns.
   settings: { mobilePairingConnectionMode: undefined as string | undefined }
 }))
 
@@ -60,6 +63,7 @@ describe('startDesktopRelayService (#18211 host policy wiring)', () => {
     fakes.settingsListeners.length = 0
     fakes.settings.mobilePairingConnectionMode = undefined
     mainProcessState.desktopRelayService = null
+    // oxlint-disable-next-line typescript/consistent-type-assertions -- SAFETY: setMobileRelayPairingProvider is the only member startDesktopRelayService calls on the rpc server.
     startDesktopRelayService({ setMobileRelayPairingProvider: vi.fn() } as never)
   })