fix(architecture): close mypy ratchet regressions

app/agent/middleware/summarization.py

@@ -3,7 +3,7 @@
 from collections.abc import Awaitable, Callable
 from importlib import import_module
 from math import ceil
-from typing import Any
+from typing import Any, cast
 
 from langchain.agents.middleware.summarization import (
     DEFAULT_SUMMARY_PROMPT,
@@ -159,6 +159,16 @@ class ContextPreservingSummarizationMiddleware(SummarizationMiddleware):
         except Exception:
             return trimmed_messages
 
+    @staticmethod
+    def _partition_messages(
+        messages: list[AnyMessage], cutoff_index: int
+    ) -> tuple[list[AnyMessage], list[AnyMessage]]:
+        """显式标注摘要分区的返回类型，避免外部中间件类型缺失扩散。"""
+        return cast(
+            tuple[list[AnyMessage], list[AnyMessage]],
+            SummarizationMiddleware._partition_messages(messages, cutoff_index),
+        )
+
     def _create_summary(self, messages_to_summarize: list[AnyMessage]) -> str:
         """同步摘要失败时保持原图状态。"""
         formatted_messages = self._prepare_summary_input(messages_to_summarize)

app/agent/tools/impl/recognize_captcha.py

@@ -45,7 +45,7 @@ class RecognizeCaptchaInput(BaseModel):
         description="Allow captcha image URLs on localhost, loopback, private, or link-local addresses.",
     )
 
-    @model_validator(mode="after")
+    @model_validator(mode="after")  # type: ignore[misc]
     def require_image_source(self) -> "RecognizeCaptchaInput":
         """确保验证码工具至少收到图片地址或原始图片字节。"""
         if not self.image_url and not self.image_data:

app/api/endpoints/site.py

@@ -421,7 +421,7 @@ def update_cookie_by_body(
     )
 
 
-@router.post(
+@router.post(  # type: ignore[misc]
     "/cookie/{site_id}/set",
     summary="直接保存站点Cookie&UA",
     response_model=_SchemaResponse[None],

app/application/security/cookie.py

@@ -204,7 +204,7 @@ class CookieLoginFormMixin:
             if not password_xpath:
                 password_xpath = f'{form_xpath}//input[@type="password"][1]'
             if not username_xpath:
-                scoped_candidates = (
+                scoped_candidates: tuple[str, ...] = (
                     f'{form_xpath}//input[@name="username"][1]',
                     f'{form_xpath}//input[@name="user"][1]',
                     f'{form_xpath}//input[@name="user_email"][1]',

app/schemas/site.py

@@ -152,7 +152,7 @@ class SiteCookieUpdate(BaseModel):
     code: Optional[str] = Field(None, description="二步验证码或密钥")
 
 
-class SiteCookieSet(BaseModel):
+class SiteCookieSet(BaseModel):  # type: ignore[misc]
     """直接保存浏览器登录后取得的站点 Cookie 与 User-Agent。"""
 
     cookie: str = Field(..., description="Site authentication Cookie header obtained from a trusted browser session.")

docs/refactor/optimization-checklist.md

@@ -102,7 +102,7 @@ ARCH-201 至 ARCH-204 均达到实现、验证、提交、推送和远端门禁
 | Event Contract | 53 | 均已有 payload model，但当前全部是 diagnostic enforcement |
 | Python 源码量 | 305,884 行 | 排除 `app/plugins/**`；61 个文件超过 1,000 行，11 个超过 2,000 行 |
 | 长方法 | 290 个超过 80 行 | AST 统计排除 `app/plugins/**`；65 个超过 150 行，21 个超过 250 行 |
-| 全量 mypy 历史债务 | 9,392 / 509 文件 | Agent API 重构后的现状基线；canonical Facade 与 endpoint 类型边界已补齐，低水位只允许继续下降 |
+| 全量 mypy 历史债务 | 9,379 / 509 文件 | Agent API 重构后的现状基线；canonical Facade 与 endpoint 类型边界已补齐，低水位只允许继续下降 |
 | Ruff 历史诊断 | 522 | 低水位门禁通过，但规则集只覆盖 `E4/E7/E9/F/I` |
 | 覆盖率固定基线 | Application 80.00%，Domain 80.00% | Chain、Runtime、Agent、Adapter、Startup 未进入包级覆盖率门禁 |
 

tests/fixtures/architecture/mypy-baseline.json

@@ -306,8 +306,7 @@
   },
   "app/agent/tools/impl/recognize_captcha.py": {
     "misc": 1,
-    "no-untyped-def": 2,
-    "override": 1
+    "no-untyped-def": 2
   },
   "app/agent/tools/impl/search_web.py": {
     "assignment": 1,
@@ -742,11 +741,10 @@
     "no-untyped-def": 1
   },
   "app/application/security/cookie.py": {
-    "arg-type": 3,
+    "arg-type": 2,
     "assignment": 2,
     "no-any-return": 1,
-    "type-arg": 3,
-    "union-attr": 11
+    "type-arg": 3
   },
   "app/application/security/otp.py": {
     "no-any-return": 3