V4.6 Phase 7: drive ty check to zero and add a blocking quality gate [HIGH-06]

Baseline was 207 diagnostics. Two real bugs were hiding in the noise:

- tools/run_destructive_tests.py imported ctypes.wintypes at module scope,
  which raises on non-Windows, and called fcntl unconditionally. The Windows
  and POSIX implementations now live under a module-level sys.platform split.
- tests/ui/test_sources_page.py constructed Source(...) without document_id.

Structural fixes, not suppressions:

- New src/transcription/db/loading.py owns the SQLModel-field to
  QueryableAttribute reinterpretation via orm_attribute()/selectinload()/
  defer(). This removed 42 "# pyright: ignore[reportArgumentType]" comments
  across documents/jobs/people/sources. Its docstring records that
  selectinload(A.b, B.c) is NOT equivalent to the chained form: varargs
  applies the selectin strategy only to the last path element, which under
  lazy="raise" raises InvalidRequestError at render time.
- db/session.py transaction_scope no longer accepts or yields
  AsyncSessionTransaction. No caller ever passed one, sessionmaker.begin()
  yields an AsyncSession, and the dead branch was latently buggy because
  services call .exec(). Cleared 7 workflows.py diagnostics.
- services/registry.py RegistryService is bound by a new RegistryEntry
  Protocol instead of bare SQLModel, so the shared implementation can read
  id/label/normalized_label/is_active. Cleared 9 diagnostics.
- Column expressions in sources.py/jobs.py/test_store.py wrap in sqlmodel
  col(), the idiom already used in registry.py.
- read_source_navigation wraps its literal tuple bounds in literal().
- normalization.py narrows with isinstance(image, TiffImageFile) rather than
  comparing image.format, since tag_v2 is TIFF-only.
- linked_people.render uses @ui.refreshable_method, the NiceGUI API for bound
  methods.
- The OpenRouter capturing client re-raises ResponseNotRead when the response
  stream is not async rather than mis-wrapping it.

Tooling gate:

- New .pre-commit-config.yaml runs ruff check and ty check as blocking hooks.
  No pre-commit config previously existed. Negative-tested: injecting a type
  error fails both hooks.
- The last two "# pyright: ignore" comments (config.py) are removed; ty does
  not honor pyright directives. One "# ty: ignore" remains, in
  tests/test_prompts.py, where the test deliberately assigns to a frozen
  field to assert ValidationError.
- asyncio_default_fixture_loop_scope is pinned to "function" so
  pytest-asyncio behavior does not shift on upgrade.

Verification: ruff check clean, ty check reports 0 diagnostics, 292 passed
and 4 skipped, pre-commit passes and demonstrably fails on a regression, and
tools/run_destructive_tests.py runs on Windows.

Co-authored-by: Copilot App <[email protected]>

tools/run_destructive_tests.py

@@ -7,7 +7,6 @@ import shlex
 import shutil
 import subprocess
 import sys
-from ctypes import wintypes
 from datetime import datetime
 from pathlib import Path
 
@@ -20,67 +19,69 @@ def show_phase(title: str) -> None:
     print(f"========== {title} ==========")
 
 
-def test_file_unlocked(path: Path) -> bool:
-    if not path.exists():
+if sys.platform == "win32":
+    # `ctypes.wintypes` raises on import off Windows, and `fcntl` does not exist
+    # on Windows, so the two implementations are selected at module level where a
+    # type checker can narrow `sys.platform` and analyze only the live branch.
+    from ctypes import wintypes
+
+    def test_file_unlocked(path: Path) -> bool:
+        if not path.exists():
+            return True
+
+        generic_read = 0x80000000
+        generic_write = 0x40000000
+        open_existing = 3
+        file_attribute_normal = 0x80
+        invalid_handle_value = wintypes.HANDLE(-1).value
+
+        kernel32 = ctypes.WinDLL("kernel32", use_last_error=True)
+        kernel32.CreateFileW.argtypes = [
+            wintypes.LPCWSTR,
+            wintypes.DWORD,
+            wintypes.DWORD,
+            wintypes.LPVOID,
+            wintypes.DWORD,
+            wintypes.DWORD,
+            wintypes.HANDLE,
+        ]
+        kernel32.CreateFileW.restype = wintypes.HANDLE
+        kernel32.CloseHandle.argtypes = [wintypes.HANDLE]
+        kernel32.CloseHandle.restype = wintypes.BOOL
+
+        handle = kernel32.CreateFileW(
+            str(path),
+            generic_read | generic_write,
+            0,
+            None,
+            open_existing,
+            file_attribute_normal,
+            None,
+        )
+        if handle == invalid_handle_value:
+            return False
+
+        kernel32.CloseHandle(handle)
         return True
 
-    if os.name == "nt":
-        return _test_file_unlocked_windows(path)
-
-    return _test_file_unlocked_posix(path)
-
-
-def _test_file_unlocked_windows(path: Path) -> bool:
-    generic_read = 0x80000000
-    generic_write = 0x40000000
-    open_existing = 3
-    file_attribute_normal = 0x80
-    invalid_handle_value = wintypes.HANDLE(-1).value
-
-    kernel32 = ctypes.WinDLL("kernel32", use_last_error=True)
-    kernel32.CreateFileW.argtypes = [
-        wintypes.LPCWSTR,
-        wintypes.DWORD,
-        wintypes.DWORD,
-        wintypes.LPVOID,
-        wintypes.DWORD,
-        wintypes.DWORD,
-        wintypes.HANDLE,
-    ]
-    kernel32.CreateFileW.restype = wintypes.HANDLE
-    kernel32.CloseHandle.argtypes = [wintypes.HANDLE]
-    kernel32.CloseHandle.restype = wintypes.BOOL
-
-    handle = kernel32.CreateFileW(
-        str(path),
-        generic_read | generic_write,
-        0,
-        None,
-        open_existing,
-        file_attribute_normal,
-        None,
-    )
-    if handle == invalid_handle_value:
-        return False
-
-    kernel32.CloseHandle(handle)
-    return True
-
-
-def _test_file_unlocked_posix(path: Path) -> bool:
+else:
     import fcntl
 
-    fd = os.open(path, os.O_RDWR)
-    try:
-        try:
-            fcntl.flock(fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
-        except BlockingIOError:
-            return False
-        else:
-            fcntl.flock(fd, fcntl.LOCK_UN)
+    def test_file_unlocked(path: Path) -> bool:
+        if not path.exists():
             return True
-    finally:
-        os.close(fd)
+
+        fd = os.open(path, os.O_RDWR)
+        try:
+            try:
+                fcntl.flock(fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
+            except BlockingIOError:
+                return False
+            else:
+                fcntl.flock(fd, fcntl.LOCK_UN)
+                return True
+        finally:
+            os.close(fd)
 
 
 def wait_for_restore_preflight(db_file_path: Path) -> bool: