Ratchet checks for agent-created type-checker suppressions
Teams letting coding agents edit production code can add a ratchet check for suppressions such as # pyrefly: ignore. The check keeps the current count as the ceiling, fails when an agent adds a new instance, and leaves any increase to a planning agent or human reviewer with broader context.
This is a cheap guardrail because it avoids long style prompts and does not require an LLM judge. It fits places where a quick suppression may be valid in rare cases, yet harmful when used as the default path. A small trial can start with one rule in CI, report the current count, and block only new instances on agent-written branches.