ci: restore the eslint ratchet to the count the tree actually measures

[chenmingwei23]

Problem / Motivation

Frontend Lint & Type Check pins npx eslint src/ --max-warnings 603, but the
tree measures 604 warnings, 0 errors. The job therefore fails on every open
pull request that touches website/**, on a warning none of those diffs wrote.

Why it matters

It is a false red on other people's work, and an expensive one: the author has to
measure the base tree, bisect to the owning commit, and then decide whether to
fold someone else's CI fix into their diff - before their own review can proceed.
It also trains people to read a red ratchet as noise, which is the opposite of
what a ratchet is for. One PR (#7686) has already paid that cost.

What changed (motivation -> approach -> change)

Symptom: 604 problems (0 errors, 604 warnings) against a ceiling of 603.

Root cause: 7362b6a2b ("fix: arm the move-undo bar for artifact and folder
drags (#4626)", merged as #7259) took website/src/pages/ArtifactsPage.tsx from
two react-hooks/exhaustive-deps warnings to three - const artifacts = data?.artifacts || [] at line 1161 now also feeds a new useMemo/useCallback.
Measured three ways:

tree	npx eslint src/
#7558, the commit that set the 603 ceiling	603 warnings
origin/main today (087ee4852)	604 warnings
that tree minus the ArtifactsPage delta	603 warnings

Why main itself stayed green: the frontend jobs are skipped on pushes that touch
no frontend file, and the runs that would have covered it were cancelled - exactly
the reporting gap #7511 describes. So the first red lands on an unrelated PR.

The change: the ceiling goes to the count the tree measures, and nothing else. No
source file is touched.

This IS a raise, which that ratchet's own comment tells you not to do, so the
comment now records why it happened and what retires it. The alternative - giving
the fallback a stable identity, e.g. useMemo(() => data?.artifacts ?? [], [data]) -
changes hook dependency behavior on a 1100-line component. That is a correctness
review owned by that page, not something a fleet-unblocking PR should decide, so
it is filed as #7695 and the ceiling returns to 603 in the PR that clears it.

Tests

None added; there is no code here to test. The gate itself is the assertion, and
it was run locally exactly as CI runs it:

• npx eslint src/ --max-warnings 604 -> exit 0.
• npx eslint src/ --max-warnings 603 -> exit 1, i.e. the ceiling still equals the
  measured count and admits no slack. A 605th warning would still fail the job.
• ci.yml parses (yaml.safe_load), one Lint step, command reads
  npx eslint src/ --max-warnings 604.

Manual verification

Measured on origin/main at 087ee4852 with the repo's own lockfile install: 0
errors, 604 warnings. The three react-hooks/exhaustive-deps warnings on
ArtifactsPage.tsx:1161 are visible in the per-file JSON report, and the same
file measures two at #7558.

Related Issues

Refs #7511
Refs #7695
Unblocks #7686

Pattern harvest

Rule candidate: lint
Pattern: a diff-scoped ratchet whose baseline lives in CI config, changed by a PR
whose own CI run never exercises the gate - the breach is then charged to whoever
pushes next. The general shape is a gate whose measurement and whose enforcement
run on different triggers; #7511 tracks the reporting half.

Checklist

• At most two commits (one is the norm), with a Conventional Commits title
• Existing tests pass and new tests added for new functionality - N/A, one CI
  config line; the gate was run both ways instead
• Self-review completed; code follows project style guidelines
• Documentation updated (if applicable) - the ratchet's own comment now
  records the raise and what retires it
• No secrets, credentials, or internal references in the diff

[github-actions]

Design Review (Fable 5) — ✅ PASS

Design-level review of 83ace87ac278153747322c0e8843507fa2d5fada — updated in place on each push. A BLOCK verdict blocks PR readiness; PASS/CONCERNS are advisory.

Design-Verdict: PASS

A one-count, fully reversible ratchet correction that restores CI truth; the real fix and the CI gap are both tracked (#7695, #7511) with a stated reversal plan.

[DESIGN-REVIEWED] 83ace87

[github-actions]

Opus 4.8 Review — ✅ no blocking findings

Reviewed 83ace87ac278153747322c0e8843507fa2d5fada — this comment is updated in place on each push.

Review details

No AUTOSDE rule's file-patterns match .github/workflows/ci.yml. The change is a documented one-count CI ratchet raise (603→604) — no code execution path, no security boundary, no crash/data-loss surface. No candidate survives and nothing groundable to add.

No findings.

[OPUS-REVIEWED] 83ace87

Verdict parsed from the review's SHA-scoped output markers for commit 83ace87ac278153747322c0e8843507fa2d5fada.

False positive or not applicable? A repository writer can comment:
/ai-review override fable 83ace87ac278153747322c0e8843507fa2d5fada: <one-sentence reason>

[github-actions]

First Principles Review (Fable 5) — ✅ PASS

Premise-level review of 83ace87ac278153747322c0e8843507fa2d5fada — why this exists and whether the shipped surface is the smallest honest version. Updated in place on each push. A BLOCK verdict blocks PR readiness; PASS/CONCERNS are advisory.

Verification done. The change is one hunk in ci.yml: the ratchet ceiling 603→604 plus a comment. I confirmed const artifacts = data?.artifacts || [] sits at website/src/pages/ArtifactsPage.tsx:1161 as the description claims, the ratchet exists in exactly one place (ci.yml, no baseline file or package.json ceiling that duplicates the mechanism), and the new comment names the cause, the owner issue (#7695), and the retire condition.

First-Principles-Verdict: PASS

Unwedges a fleet-wide false red at the only place it can be unwedged, declares the raise as a raise, and names what retires it.

What this change ships

Intent: stop every website/** PR failing CI on a warning none of them wrote. FIX.

1. The frontend lint gate now admits 604 warnings instead of 603 — justified; unwedges a red build, ceiling kept equal to the measured count (no slack).
2. The ratchet's comment now records the raise, its owning commit, and the return path via ArtifactsPage: the artifacts fallback breaks three hooks' memoization and pushed the eslint ratchet over #7695 — justified; lens-6 disclosure of the symptom level lives in the artifact itself, not just the PR text.

Watch

• This sits deliberately above the cause: the third exhaustive-deps warning at ArtifactsPage.tsx:1161 (verified present) stays in the tree, and the deeper cause — a gate whose measurement and enforcement run on different triggers — is deferred to ci: main's runs are cancelled before the ratchet gates report, so drift surfaces on unrelated PRs #7511. Both are named and tracked; the finding closes only when ArtifactsPage: the artifacts fallback breaks three hooks' memoization and pushed the eslint ratchet over #7695 returns the ceiling to 603, so hold that PR to it.

[FIRST-PRINCIPLES-REVIEWED] 83ace87

[chenmingwei23]

Backend Tests (Windows) (2) is red on a flake, not on this diff. This PR changes
one line of .github/workflows/ci.yml and no Python at all, so it cannot reach
test/test_job_routes.py.

The proof is that the same shard disagreed with itself over the same backend code
minutes apart: it passed on #7686 (i18n catalogs plus one frontend module, zero
Python) and failed here, on
test_get_existing_run_is_200 - PermissionError: [Errno 13] Permission denied for
the run's JSON under the pytest temp dir. 1 failed, 18626 passed; Linux shards of
the same suite are green on both PRs.

Filed as #7703 with the evidence and the likely class (a writer's handle still open
on Windows when the record is replaced). Not touching test code here - that would
be a second unrelated fix in a PR whose whole point is being one line. Re-running
just that shard was refused while the rest of the run was still in flight
(job 99976560190 cannot be rerun), so it gets re-run once the run settles.

[github-actions]

GPT 5.6 Review — ✅ no blocking findings

GPT 5.6 completed its review of 83ace87ac278153747322c0e8843507fa2d5fada and found no blocking issues.

This comment is updated in place on each push.

Review details

No findings.
[GPT-REVIEWED] 83ace87

False positive or not applicable? A repository writer can comment:
/ai-review override gpt 83ace87ac278153747322c0e8843507fa2d5fada: <one-sentence reason>

[iamwhatever]

Tier 1 auto-approve: chore/build tooling (1 file). Criteria: no conflict, no requested changes, security path denylist clean, design-doc gate clean, SAST annotations clean, security checklist all-NO, AI reviewers green. Category: CI plumbing only -- raises the eslint --max-warnings ceiling in .github/workflows/ci.yml from 603 to 604 to match what the tree actually measures after #7259 landed a third exhaustive-deps warning; no runtime code touched.

[dwu96]

Tier 1 auto-approve: chore / build tooling (1 file). Criteria: no conflict, no requested changes, security path denylist clean, design-doc gate clean, SAST annotations clean, security checklist all-NO, AI reviewers green. Category: CI-plumbing-only change to the website eslint --max-warnings ratchet in .github/workflows/ci.yml (603 -> 604) with an inline rationale comment; no runtime code, no product behaviour, single file.