Pin lint + add the verify gate (throwaway-local, no CI)

AGENTS.md

@@ -67,8 +67,13 @@ paraphrase the spec; the section numbers are stable, use them.
   honour its "out of scope" line.
 - **Stop at the verify gate.** Run the task's checks, report against its "done when", and wait. Do
   not roll straight into the next task.
-- **Per task:** a typecheck/lint pass (`tsc`, near-instant). **At the modal milestone:** run the
-  tests. **On the data-layer task:** the audit pass (the checklist in tasks.md Task 1).
+- **The gate is one command.** `npm run verify` chains typecheck + lint + test so the check is
+  mechanical, not remembered. Run it at every task gate; `npm run build` runs once before deploy.
+  There is no CI or git hook: the demo build is a throwaway local project (no GitHub repo on the day),
+  so `verify` at each gate is the enforcement.
+- **Per task:** typecheck + lint (near-instant). **On the data-layer task:** the audit pass (the
+  checklist in tasks.md Task 1). The test suite exists from Task 1's smoke test and peaks at the
+  modal milestone (Task 3).
 - Let the generated types and `tsc` catch drift. Prefer deleting and regenerating over hand-editing
   generated files.
 
@@ -79,6 +84,9 @@ paraphrase the spec; the section numbers are stable, use them.
 - The template does **not** ship a test runner. Add **Vitest + React Testing Library + jsdom**
   explicitly, wired to `npm test`. Tests mock the generated `Eppc_*Service` modules (schema §9) and
   never touch live Dataverse.
+- Lint is a named gate, but the template's ESLint setup is minimal or absent. Pin **ESLint +
+  typescript-eslint + eslint-plugin-react-hooks** on `npm run lint`; the react-hooks rule catches a
+  class of bug a fast model will produce.
 - Load `Barlow` and `Barlow Semi Condensed` from Google Fonts (contract §1.6).
 
 ## When something is ambiguous

specs/tasks.md

@@ -29,10 +29,16 @@ Entra sign-in and real data. The architect line lands here: "I didn't write this
 
 Use the scaffolded `package.json`'s actual script names. The gates assume:
 
-- **Typecheck:** `tsc` (or the project's `typecheck` script) returns clean. Run after every task.
-- **Lint:** the project's lint script returns clean.
-- **Test:** the project's test runner. Tests mock `src/generated/services/*`; they never touch live
-  Dataverse (schema §9). Run at the **Task 3 milestone**, not after every task.
+- **Verify (the gate):** `npm run verify` chains typecheck + lint + test. This is the one command run
+  at each task gate, so the check is mechanical rather than remembered. There is no CI or git hook:
+  the demo build is a throwaway local project (no GitHub repo on the day), so `verify` at each gate is
+  the enforcement.
+- **Typecheck:** `tsc` (or the project's `typecheck` script) returns clean.
+- **Lint:** `npm run lint` returns clean (ESLint + typescript-eslint + react-hooks, AGENTS.md Stack
+  notes).
+- **Test:** the project's test runner. Tests mock the generated `Eppc_*Service` modules; they never
+  touch live Dataverse (schema §9). The suite exists from Task 1's smoke test and peaks at the
+  **Task 3 milestone**.
 - **Build:** `npm run build` (`tsc -b && vite build`) succeeds. Run before deploy.
 
 ## Context discipline