[falbany]

Fixes #69 — the documented pyright src/profiles gate now works: 81 errors → 0, on top of the Tkinter removal (#112, which already cleared the ~34 gui/ errors).

Configuration

• [tool.pyright] in pyproject.toml (basic mode, .venv env, pythonVersion 3.11, extraPaths: ["src"]). Basic mode on purpose: the gate is regression insurance, not strict-mode adoption.
• hatchling>=1.26 declared in both dev lists so web/build_hook.py's import resolves — also pre-completes the hatchling declaration deptry: declare hatchling and direct transitive imports (PIL, objc, WebKit) and actually run deptry #43 calls for.

Real type fixes (no suppression)

Cluster	Fix
execution.py ×28 (Popen kwargs from dict[str, object])	explicit per-platform Popen calls — same kwargs, no dict
inheritance.py ×13 (untyped pick() closure)	typed per-shape helpers (pick_str_list, pick_row_colors, pick_match, pick_scan); resolve_configs now produces the declared list-shaped schema fields — the tests already pinned lists, pydantic was silently coercing the tuples
reader.py ×7 (schema→model drift)	explicit conversion (MatchCriteria, tuples) at the boundary instead of relying on __post_init__ coercion
actions.py ×2 (failmode: str)	FailMode Literal moved to models.py (bottom of the core graph), re-exported by workflow.py; AppConfig.launch_hook_failmode typed
columns chain ×6 (object-typed dicts)	dict[str, ColumnConfiguration] across classifier/scanner/scan route; _iter_columns workaround deleted, its pinned non-dict contract kept via isinstance (test_non_dict_columns_ignored untouched)
tk fallbacks ×3 (tk possibly unbound)	restructured into import/display try blocks, identical behavior
matcher.py, schema.py, diagnostics.py, handoff.py, __init__.py, scanner.py, server/app.py, qrcode/zxingcpp	one-liners: bool contract, cast in the before-validator, narrowed sys.excepthook params, explicit submodule imports, honest return annotations

Real bugs the gate surfaced (fixed)

1. app.py headless scan path crashed whenever machine configurations existed — it read cfg.directory, a field MachineConfiguration doesn't have (AttributeError at runtime; the tests only exercised the empty-configurations path). Now iterates cfg.scan as documented ("scan all configured directories").
2. handoff.py could hit an unbound detail (NameError) when reading the HTTPError body raised inside the suppress block.
3. matcher.py returned tuple | bool against a -> bool contract; now bool(m.path) and ....

Suppression ledger (9 lines, all commented)

• execution.py ×4 — legacy HookSpec engine reads when off WorkflowStep objects; the engine's fate is Dead code sweep (Python): legacy phase-based hook engine, tests-only helpers, unused --no-config-propose flag #39's call, suppressed with a pointer instead of redesigning it here.
• file_utils.py ×3 os.startfile, shortcut.py ctypes.windll, launcher.py objc.selector — Windows-only / stub-less third-party attributes, all runtime-guarded.
• build_hook.py ×1 — the object runtime fallback unions the base-class binding; every env that loads the hook has hatchling.

Also

• The two pylint pragmas with trailing prose (schema.py, interactions.py) moved the prose off the pragma lines — the 7 spurious unknown-option-value (W0012) warnings are gone.

Verification

• pyright src/profiles: 0 errors, 0 warnings
• ruff format --check + ruff check: clean
• pylint src/profiles: 9.88/10 (gate 8.0)
• pytest: 1490 passed, 1 skipped (pre-existing macOS Finder probe), coverage 88.61% (gate 85%)
• import profiles.app smoke: clean; pre-commit hooks green

Follow-up

#48's CI quality gate can now include uv run pyright src/profiles — that wiring is left to #48.