[mforce]

Why

These are two fixes from the retro on the TOTP slice (#1277). UI PRs posted more screenshots than anyone reads: #1395 posted 28. And the Back-button race that #1395 fixed had no check to stop it coming back.

What changes

1. The verify skill asks for fewer frames. tools/verify/SKILL.md asked for 1280x800 and 390x844 in both light and dark. Now a PR posts one frame per distinct state at 1280 light. It adds a 390 or dark frame only where the layout or theme visibly differs. Within the before frames, and separately within the after frames, it skips frames that differ only in text. A changed existing screen always keeps its before and after pair, as AGENTS.md requires, even when only its text changed. The target is about 12 frames or fewer. The 1:1, viewport-only and rebuilt-at-head rules stay. capture.sh still captures all four frames so they can be compared, and the skill now says to post only the frames the rule keeps.

2. A lint for a flag cleared in a useEffect cleanup. In #1395, useDialogSession cleared mounted.current in a useEffect cleanup. React can run that cleanup a task after the commit that removes the screen, so a step-up grant that landed in between still sent its write. A no-restricted-syntax selector in web/lint/eslint.config.js now flags x.current = false inside a function that a useEffect returns. That covers a return () => … that belongs to the effect callback (a conditional return included, a return inside a helper defined in the effect excluded) and the () => () => … form. The message points to useLayoutEffect. It applies to all of web/src, and AGENTS.md's Enforced rules table has a new row for it.

It found one site on main: web/src/components/Dialog.tsx:321, the mount-once cleanup that pays back the open-dialog count. It gets an inline eslint-disable-next-line with its reason, as useLatestLoad.ts:36 does for the #1190 rule. reportUnusedDisableDirectives fails lint once that line stops violating. The frozen-suppressions file cannot hold this entry: check-suppressions.mjs --base keys by rule id, and no-restricted-syntax already applied to that file. Candidate for a later look: async code reads entered through anyDialogOpen(), so the same one-task delay could apply. No race has been shown, and this PR does not change product code.

Dropped

The retro also asked the agent git guard to stop refusing harmless commands whose quoted arguments mention a git write. This branch tried a data-only exemption for scripts and then dropped it. Three review rounds each found a bypass: command runners that ship with the toolchain (npm exec -c, pdb -c), a symlink plus .. that made the guard read a different file than Node ran, and a step that swaps the script before running it. tools/agent-guard/ is unchanged from main. The false blocks stay, and decision logging keeps its two-step workaround.

Proof

Each mutation broke the new code, and a committed check then ran against it. Every row went red.

Mutation	Check	Result
useDialogSession.ts reverted to useEffect	npm run lint	useDialogSession.ts 64:20 with the new message
The inline directive removed from Dialog.tsx	npm run lint	Dialog.tsx 321:7
The effect-ownership check dropped from the selector	web/lint/cleanup-selector.test.mjs	nestedFactory and immediateFactory fail

web/lint/cleanup-selector.test.mjs holds the selector's cases. It lints ten in-memory effects with the real config and compares each against an expected count. It expects a diagnostic for a block return, a conditional return, the concise form, a function expression and React.useEffect. It expects none for a timer callback, a layout effect, or a helper defined or invoked inside the effect. CI's Lint step runs it with node --test. It is not part of npm run lint, so npm run lint -- --prune-suppressions still passes its arguments to ESLint.

Runs at the head: npm run lint, npm run typecheck, check-suppressions.mjs --base and the selector test pass. The guard's own tests (git_guard_test.py, git_hooks_test.py, pi_extension_test.mjs) pass on the restored guard. The guards that walk every tracked file (the two image-pin tests, TenancyDocsFreshnessTests, FileSizeLimitTests) pass with the new test file tracked.

Review guide

• web/lint/eslint.config.js: the two selectors and ownReturn. The second config block repeats them because its no-restricted-syntax replaces the first block's for routes and components.
• web/lint/cleanup-selector.test.mjs and one line in .github/workflows/ci.yml's Lint step that runs it.
• web/src/components/Dialog.tsx: one comment line, the inline disable.
• tools/verify/SKILL.md: rule 5 is new. The old rule 5 is now rule 6.
• AGENTS.md: one Enforced rules row.
• The branch history holds the dropped guard commits and their revert. The squash merge carries only the net diff.