CI-001B4B — Retire one stale AdminMembers lint directive

[daliu]

Officer impact: None. This child removes one stale lint-suppression comment and updates the exact lint-debt ledger. It changes no public wording, member flow, admin task, permission, collected data, or provider behavior.

Officer documentation: None — no officer procedure or public/admin behavior changes.

Deployment evidence: None at issue creation. Closure must distinguish source/tests/merge from website publication, Firebase/provider action, production data, and live behavior.

Parent and problem

Atomic lint-debt child of CI-001 #105 and the merged fail-closed lint gate CI-001B4 #186.

On exact main 139c762a4bc38d2ee2b60298631cbc88889180fe, the deterministic frontend ledger scans 106 files and records 124 configured errors plus 7 warnings. Exactly one error is the stale // eslint-disable-next-line react-hooks/exhaustive-deps directive in src/pages/admin/members/AdminMembers.tsx: the repository does not define that rule, so the suppression comment itself is the normalized finding.

Atomic outcome and invariant

Remove only that one stale suppression comment. Preserve every executable statement, the effect dependency array [services, isReady], reload behavior, Firebase calls, rendering, authorization behavior, and runtime behavior. Build artifacts may change mechanically and are not asserted byte-identical.

Recompute the ledger through the committed non-mutating checker, then review the exact delta:

• scanned files remain 106;
• configured errors become 123;
• warnings remain 7;
• TSX configured errors become 93;
• exactly the one AdminMembers unknown-rule directive finding disappears;
• fingerprint becomes sha256:199771a215cc460da8b2d37433a69027d0d459658b07869ed61dbff0bc44525d;
• no other finding, file record, rule, message, severity, lint configuration, checker, or workflow changes.

The workflow guard expected error count must match 123. Existing CI-001B4 engineering paragraphs must report 106/123/7 and identify this child without changing any PAY/C4B or other issue section.

There is no schema, migration, compatibility, provider, or production-data impact.

Acceptance criteria

• Red proof records the exact current AdminMembers unknown-rule directive finding.
• Only the stale suppression comment is removed from executable-source context; effect logic and dependencies remain byte-identical.
• The generated baseline differs by exactly one removed finding plus mechanically derived counts and fingerprint.
• tests/ci-workflow.test.js changes only EXPECTED_LINT_ERRORS from 124 to 123.
• Direct lint verifies 106 files / 123 configured errors / 7 warnings and the exact expected fingerprint.
• Focused workflow tests, full frontend tests, SPA tests, Functions lint/tests, applicable emulator suites, diagnostic build, and hosted CI pass.
• Exact-diff review confirms no runtime behavior, lint rule/configuration, checker, workflow, package, or unrelated documentation change.
• Closure reports every deployment/provider/data surface separately and releases all exact hunks.

Exact owned paths and hunks

1. src/pages/admin/members/AdminMembers.tsx — remove only the stale hook-rule suppression comment
2. .github/lint-baseline.json — exact generated one-finding removal and derived metadata only
3. tests/ci-workflow.test.js — EXPECTED_LINT_ERRORS only
4. SECURITY.md — named RISK-035 and source-ledger CI-001B4 frontend-lint count/status text only
5. OPERATIONS_RUNBOOK.md — named frontend-lint paragraph count/status text only
6. GITHUB_ISSUES.md — named CI-001B4 status/description text only
7. GITHUB_ISSUE_SLICES.md — named CI-001B4 row only

Dependencies and coordination

• CI-001B4 — Make frontend lint non-mutating and fail closed #186/CI-001B4D — Reconcile merged lint-gate evidence in root docs #190 are complete; this child reduces their explicitly retained debt without weakening the gate.
• CI-001B4A — Retire one ObfuscatedEmail lint finding #227 released the same ledger/test/root-doc paths at main 35ca312.
• PAY-002B2C4A — Bind the immutable authorized attempt-2 Stripe provider plan #232 released its exact commerce paths and C4A hunks at main 6202802.
• OAUTH-001B1 — Redact Strava disconnect failure logs #235 released its exact two Strava paths at main 139c762.
• Active PAY-002B2C4B — Persist attempt-2 Checkout Session pre-send evidence #238 explicitly permits this concurrent child only in the separately named AdminMembers/lint/RISK-035/CI-001B4 hunks. Every C4B/PAY/Checkout Session hunk and all PAY-002B2C4B — Persist attempt-2 Checkout Session pre-send evidence #238 code/test paths are immutable. The later PR must refresh and preserve the earlier merged truth.

Explicitly excluded

Lint checker or workflow changes; lint rules/configuration; packages/locks; any other component or finding; SYSTEM_DESIGN; STRIPE_COMMERCE_DESIGN; IMPLEMENTATION_PLAN; all PAY/C4B/Checkout Session sections; Functions; Rules; Firebase; Stripe/Strava/outside providers; production data; migration; deployment; officer procedures.

Claim protocol

Creation is not a claim. Before editing, re-read live comments/open PRs, create an isolated branch from the exact base, move status:ready to status:in-progress, and post CLAIMED by <canonical agent> at <UTC>; branch <branch>; exact base <SHA>. Stop and coordinate on any overlap.

[daliu]

CLAIMED by /root at 2026-07-14T06:29:04Z; branch codex/issue-239-adminmembers-lint; exact base 139c762a4bc38d2ee2b60298631cbc88889180fe.

Live issue/comment/title/body and open-PR audit found no competing CI-001B4B, AdminMembers, or exhaustive-deps claim or PR. #232 is closed/released. Active #238 explicitly permits these separately named AdminMembers/lint/RISK-035/CI-001B4 hunks and excludes the lint paths from its C4B claim.

Invariant: remove exactly one stale unknown-rule suppression finding without changing executable effect logic, dependency order, runtime behavior, lint rule/configuration, checker, or workflow. Expected reviewed ledger is exactly 106 scanned files, 123 configured errors, 7 warnings, TSX errors 93, and fingerprint sha256:199771a215cc460da8b2d37433a69027d0d459658b07869ed61dbff0bc44525d.

Exact ownership is limited to the seven paths and named hunks in the issue body. Every #238 C4B/PAY/Checkout Session hunk and code/test path is immutable.

[daliu]

CI-001B4B is COMPLETE and the exact seven-path claim is RELEASED.

PR #241 squash-merged reviewed head 9219e4ed41add6f8504b7e0047c920c9ecf35d47 as exact main 4dc69d4e96c00afe3f9f20855b05b35d880c7416.

Outcome:

• Removed only the stale AdminMembers unknown-rule suppression comment.
• Preserved every executable statement, effect dependency, Firebase call, and runtime behavior.
• Removed exactly one normalized lint finding and added zero.
• Final ledger is exactly 106 files / 123 configured errors / 7 warnings, with 93 TSX errors.
• Final fingerprint is sha256:199771a215cc460da8b2d37433a69027d0d459658b07869ed61dbff0bc44525d.

Verification:

• Pre-change proof identified exactly the one AdminMembers record.
• With only the comment removed, the old ledger failed closed with the fixed diagnostic.
• Regenerated baseline matched the committed JSON byte-for-byte.
• Node 20 direct lint passed.
• Workflow/artifact safety: 29/29.
• Frontend: 240/240.
• SPA navigation: 11/11.
• Functions lint passed; Functions tests: 1,512 passed with 53 conditional/emulator skips.
• Firestore Rules: 372/372 under Java 17 and demo project demo-rules-test.
• Commerce journal emulator: 52/52 under demo project demo-pay002b2-test.
• Optimized diagnostic build and diff check passed.
• Two independent exact-diff reviews passed with no actionable findings.
• PR CI 29312147946 and post-merge CI 29312273002 each passed all five required jobs.
• Final main diff contains only the seven claimed paths.

Coordination: active #238 was told to refresh onto 4dc69d4 and preserve the exact 106/123/7 RISK-035 wording while adding only its separately owned C4B commerce suffix.

Officer impact: None. No public wording, member flow, admin task, permission, collected data, or provider behavior changed.
Officer documentation: None — no officer procedure or public/admin behavior changed.
Deployment evidence: only CI ran for the merge SHA and GitHub deployment records are empty. No release workflow, website publication, Firebase deployment, Stripe/Strava/provider action, production-data action, migration, or live behavior verification occurred. Netlify production remains ready on older commit e86a0f702cff6495f50630c5de3337290db8b8cb, not this merge.