CI-001B4C — Retire the remaining stale exhaustive-deps directives

[daliu]

Officer impact: None. This child changes four non-executable comments and the reviewed lint-debt ledger only. It does not change an officer screen, task, permission, data flow, deployment, or live behavior.

Officer documentation: None — no public, member, officer, admin, data, permission, account, provider, hosting, deployment, backup, or recovery behavior changes.

Deployment evidence: None at issue creation. Closure must distinguish source, tests, merge, website publication, Firebase deployment, provider configuration, and live behavior. A green workflow does not prove an external surface changed.

Problem

The exact-record frontend lint gate still contains four errors whose only source is a stale eslint-disable-next-line react-hooks/exhaustive-deps directive. The configured frontend ESLint environment does not define that rule, so each directive itself produces Definition for rule 'react-hooks/exhaustive-deps' was not found.

These comments hide no currently configured finding, change no hook at runtime, and leave the reviewed debt baseline noisier than the source. Deleting each entire line would shift later finding coordinates, while leaving a blank line creates a separate padded-blocks finding. The safe reduction is to replace each directive on the same physical line with an accurate ordinary comment.

Atomic outcome

Replace exactly these four stale directives with ordinary explanatory comments, preserving every executable character, effect body, dependency array, and source line count:

1. src/pages/admin/events/AdminEventRegistrations.tsx:430
2. src/pages/admin/shop/AdminOrders.tsx:85
3. src/pages/events/EventRegister.tsx:127
4. src/pages/shop/ProductDetail.tsx:51

Update the exact lint ledger and its asserted/documented counts only after an independently normalized comparison proves that those four records disappeared and no finding was added, moved, or changed.

Invariants

• No executable token, import, hook body, callback, dependency array, render output, service call, or runtime branch changes.
• Each replacement stays on the exact directive line. No later lint-record coordinate moves.
• The two reload effects keep their existing Firebase/Firestore/slug identity boundaries.
• The two email-prefill effects still run on account-identity changes and do not overwrite a local email edit merely because that local field changed.
• No lint rule, plugin, severity, configuration, checker, workflow, package, or lockfile changes.
• The reviewed baseline changes by exactly four removed records with rule ID react-hooks/exhaustive-deps, severity 2, and the fixed unknown-rule message. Zero records are added, moved, or otherwise changed.
• Pre-change truth is 111 scanned frontend files, 117 configured errors, 6 warnings, and fingerprint sha256:56b52a74434e910548d72c741ab21b634274d3cc9c36fe9983d8942b34eebddf.
• Post-change truth must be exactly 111 files, 113 errors, 6 warnings, 83 TSX errors, and fingerprint sha256:80b91bb22c70f5f0d400703f8d79cda64c7b42ba3e2a33c91f67435d7a8adf52.
• The exact-record gate remains fail closed. The baseline may not be regenerated merely to make the check green.
• Existing accepted debt remains accepted debt; this child makes no clean-lint claim.

Required tests and evidence

• Record the four exact pre-change baseline findings and source lines.
• Apply only the four comment replacements while leaving the old baseline in place; prove the checker fails closed because the exact records changed.
• Generate normalized lint output independently and compare it with the pre-change ledger: exactly four records removed, zero added, moved, or changed.
• Prove the committed baseline byte-matches the independently generated normalized ledger and the exact post-change counts/fingerprint above.
• Update EXPECTED_LINT_ERRORS from 117 to 113 and run the focused CI-workflow tests, including deliberate baseline mutation rejection.
• Run the existing Admin Orders and Admin Event Registrations reload-boundary tests and the existing registration/product form tests that cover the preserved effects.
• Run the full frontend lint/Jest/SPA/workflow/build gates, Functions lint/tests, demo-only Rules and commerce emulators, YAML validation, and git diff --check on Node 20/Java 17 where applicable.
• Review the final diff character-for-character to prove the four source hunks are comment-only and same-line.

Exact owned paths

Source comments:

1. src/pages/admin/events/AdminEventRegistrations.tsx
2. src/pages/admin/shop/AdminOrders.tsx
3. src/pages/events/EventRegister.tsx
4. src/pages/shop/ProductDetail.tsx

Lint contract:

5. .github/lint-baseline.json
6. tests/ci-workflow.test.js

Engineering documentation, only the named CI-001B4/RISK-035 count/history text:

7. SECURITY.md
8. OPERATIONS_RUNBOOK.md
9. GITHUB_ISSUES.md
10. GITHUB_ISSUE_SLICES.md

Dependencies and coordination

• Parent tracker: CI-001 — Establish trustworthy quality gates and protected deployment #105. Do not claim that tracker.
• CI-001B4/CI-001B4 — Make frontend lint non-mutating and fail closed #186 supplies the exact-record gate.
• CI-001B4A — Retire one ObfuscatedEmail lint finding #227 and CI-001B4B — Retire one stale AdminMembers lint directive #239 are prior one-record reductions; PAY-004C1 — Disable reusable paid late-registration links until one-off Checkout exists #359, WEB-UX: polish shared page hero semantics #391, and PAY-001C1B: validate merchandise checkout request and options (#389) #392 explain intervening functional/source-count changes that the root docs currently understate.
• This child may proceed from exact main 35240fa84efcda935b88eacbb0685e32aeb8ef10; no open pull request or live claim overlaps these paths at issue creation.
• Parent CI-001 — Establish trustworthy quality gates and protected deployment #105 remains open for owner/IAM work under CI-001C — Configure protected short-lived Firebase deployment identity #133/CI-001D — Prove backend-first staging and deploy the profile repair #136, branch-required-check configuration, scanning, protected authority, staging, publication, and live verification.

Explicitly out of scope

Do not add or configure eslint-plugin-react-hooks, change hook dependencies, refactor any effect, alter React behavior, clean another lint finding, change warnings, install or upgrade a dependency, modify CI/release workflows, deploy, publish, inspect production, or touch a provider.

Do not update officer documentation because no officer-visible or operational behavior changes.

Claim protocol

Creation is not a claim. Before any repository file edit, assign the issue, create and push a unique branch from exact current main, post CLAIMED by <canonical agent> at <UTC>; branch <branch>; exact base <SHA>, re-read live comments, and move status:ready to status:in-progress. Earliest valid claim wins.

[daliu]

CLAIMED by /root at 2026-07-22T11:46:27Z; branch codex/issue-449-stale-hook-directives; exact base 35240fa

[daliu]

PR #450 is open from exact source commit 9becaad after the required RED proof, complete local gates, and three independent adversarial reviews. Hosted checks are now running; no website, Firebase, provider, production, or live-behavior change is claimed.