Static analysis at level 10, and the four errors that stayed

Level 10 treats every unspecified type as mixed rather than as a wildcard, which is the last real step and finds a specific class of gap.

the run: 188 errors at level 10, from 0 at level 9.

  142  a third-party interface returning array with no
       shape. annotated locally with a stub file.
   38  our own code passing mixed through a boundary.
       fixed, and two of them were bugs.
    4  a genuinely dynamic path — a plugin registry
       keyed by string, dispatching to unknown
       callables.

the four are in the baseline with a comment saying why,
which is the only kind of baseline entry worth having.

The two bugs were both a nullable value passed into something that assumed a string, on a path exercised only by an admin action. Level 10 is where the remaining findings are about boundaries rather than about the code, and the stub files for third-party interfaces are the ongoing cost — a dependency upgrade can invalidate one silently.