fix(ci): repair the prepush gate after the 260730 GUI stack

dev was red on both lint:gui (13 errors) and the suite (3 failures) before this
commit. All four reproduce on a pristine origin/dev worktree, so none of them
came from the blocker fixes stacked underneath; the 260730 GUI PRs landed them.

Tests, where the assertion had gone stale rather than the code being wrong:

- cli-help: ee3eaa2 added a real `repair` subcommand plus repairService(), so
  the expectation was the stale side. The full usage string is still pinned, so
  the `remove` alias this test exists for still fails if it disappears.
- provider-workspace-auth: c4c98c0 renamed setToast to showActionFeedback. The
  replacement also requires the literal `true` second argument, so the error-tone
  contract is pinned slightly tighter than before.
- windows-scheduler: the new UTF-16LE test hardcoded an absolute wscript path,
  but buildWindowsTaskXml resolves <Command> through windowsWscript(), which
  falls back to a bare "wscript.exe" wherever System32 does not exist. It could
  never have passed off Windows. Pinned <Command> the way the sibling describe
  block in the same file already does; the decoder itself is still exercised,
  including the sanity check that a UTF-8 mis-decode stays unhealthy.

Lint. Five were false positives fixed in the allowlist rather than by inventing
i18n keys for things that must not be translated: GiB is an IEC unit, and three
curl samples resume after `${...}` interpolation as `\ -H ...`, which the bare
`^-H` rule cannot see. Four were mechanically equivalent and got real fixes —
a redundant tooltip coordinate reset, a redundant delete-confirm reset, a
ref read during render that `loading` already encodes, and the Logs surface
filter moved into its own module so the page exports components only.

Three kept their behavior and got a narrow suppression instead, because
"fix the lint" is not worth silently changing UX in code that landed hours ago:
ProviderAuthPanel's quota reservation is a TIMED state machine whose four-second
expiry stops a stalled enrichment from pinning skeleton rows forever; Models'
default collapse stays an effect so cached groups collapse on first paint even
when revalidation is slow or fails; CodexPoolStrategySetting's load() reaches an
await before any setter, so it never synchronously cascades. Each comment states
the contract it preserves.

Gates now: typecheck, lint:gui, privacy:scan, doctor:gui:if-changed all clean,
and the suite is 6074 pass / 0 fail across 437 files. The gui/ test suite has 14
pre-existing failures that are identical before and after this commit and are
not part of the prepush set.

Author: lidge-jun

gui/.eslint/i18n-allowlist.ts

@@ -46,6 +46,8 @@ const TECHNICAL_UNITS = new Set([
   "Mo",
   "Mi",
   "Fr",
+  // IEC binary unit rendered next to a formatted number; a unit symbol, not UI prose.
+  "GiB",
 ]);
 
 /** Non-UI technical strings (API paths, CSS, shell, headers, debug fields). */
@@ -87,6 +89,11 @@ export function isTechnicalLiteral(value: string): boolean {
   if (/^curl\b/i.test(trimmed)) return true;
   if (/^-H\b/.test(trimmed)) return true;
   if (/^-d\b/.test(trimmed)) return true;
+  // Line-continuation fragment: a multi-line curl sample split by `${...}` interpolation
+  // resumes with the escaped backslash and a newline before the next flag, so the bare
+  // `^-H` rule above never sees it. Still a shell sample, still not translatable. The
+  // leading run is one-or-more because the raw template text keeps the escape.
+  if (/^\\+\s+-(?:H|d)\b/.test(trimmed)) return true;
   if (/^ocx\b/i.test(trimmed)) return true;
   if (/^codex\b/i.test(trimmed)) return true;
 

gui/src/components/CodexPoolStrategySetting.tsx

@@ -143,6 +143,9 @@ export default function CodexPoolStrategySetting({
   // Standalone fallback when no shared controller observer is wired (keeps tests without observer green).
   useEffect(() => {
     if (subscribeLoadObserver) return;
+    // Not a synchronous cascade: load() reaches `await fetch(...)` before it touches any
+    // setter, so state never updates during this effect's own render pass.
+    // eslint-disable-next-line react-hooks/set-state-in-effect
     void load();
   }, [load, subscribeLoadObserver]);
 

gui/src/components/apikeys-workspace/ApiKeysWorkspace.tsx

@@ -95,10 +95,9 @@ export default function ApiKeysWorkspace({
   };
 
   useEffect(() => {
-    if (!confirmDelete) {
-      setConfirmArmed(false);
-      return;
-    }
+    // Every path that closes confirmation goes through clearDeleteConfirm(), which
+    // already resets confirmArmed, so resetting again here was a redundant cascade.
+    if (!confirmDelete) return;
     const timer = window.setTimeout(() => setConfirmArmed(true), 300);
     return () => window.clearTimeout(timer);
   }, [confirmDelete]);

gui/src/components/provider-workspace/ProviderAuthPanel.tsx

@@ -60,8 +60,14 @@ export default function ProviderAuthPanel({
 
   // Soft &quota=1 enrichment lands after the local account list. Reserve stacked
   // bar height briefly so bars don't shove rows when WHAM returns.
+  //
+  // Deliberately a timed state machine, not a derived value: the reservation must EXPIRE
+  // after QUOTA_ENRICH_RESERVE_MS so a stalled enrichment cannot leave skeleton rows up
+  // forever. A plain `accounts.some(...)` boolean would drop that bound, so the rule is
+  // suppressed here rather than refactored away.
   useEffect(() => {
     if (accounts.length === 0) {
+      // eslint-disable-next-line react-hooks/set-state-in-effect
       setReserveQuotaSlots(false);
       return;
     }

gui/src/pages/Combos.tsx

@@ -235,8 +235,10 @@ export default function Combos({ apiBase }: { apiBase: string }) {
     }
   };
 
-  // Cold start only — cached empty lists paint the workspace immediately.
-  if (loading && !hasCacheRef.current) {
+  // Cold start only — cached empty lists paint the workspace immediately. `loading`
+  // already encodes that: it initializes to !seedCombos(cacheKey) and a refresh only
+  // sets it when the cache is empty, so reading the ref during render was redundant.
+  if (loading) {
     return (
       <div className="combos-workspace-shell">
         {status && (

gui/src/pages/Logs.tsx

@@ -13,6 +13,8 @@ import Debug from "./Debug";
 import type { LogsTab } from "./logs-tab-keydown";
 import { logsTabKeyDown, readTabFromHash, selectLogsTab } from "./logs-tab-keydown";
 import { speedLabel } from "./logs-speed-label";
+import type { LogSurface, LogSurfaceFilter } from "./logs-surface-filter";
+import { logMatchesSurface } from "./logs-surface-filter";
 
 function logsCacheKey(apiBase: string): string {
   return `ocx.logs.list.v1:${apiBase}`;
@@ -101,17 +103,6 @@ interface LogAttempt {
   displayMetrics?: LogDisplayMetrics;
 }
 
-type LogSurface = "claude" | "claude-desktop" | "grok";
-type LogSurfaceFilter = "all" | "claude" | "codex" | "grok";
-
-/** Match Usage surface buckets: Claude includes Desktop; Codex is untagged. */
-export function logMatchesSurface(log: { surface?: LogSurface }, filter: LogSurfaceFilter): boolean {
-  if (filter === "all") return true;
-  if (filter === "claude") return log.surface === "claude" || log.surface === "claude-desktop";
-  if (filter === "grok") return log.surface === "grok";
-  return log.surface === undefined;
-}
-
 export interface LogEntry {
   requestId?: string;
   timestamp: number;

gui/src/pages/Models.tsx

@@ -271,11 +271,16 @@ export default function Models({ apiBase }: { apiBase: string }) {
     [models, providers],
   );
 
+  // One-shot default collapse. It stays an effect on `groups` so CACHED groups collapse
+  // immediately on first paint, even when revalidation is slow or fails; moving it into
+  // the load() success path would render cached providers expanded and leave them
+  // expanded whenever the refresh errors.
   useEffect(() => {
     if (!needsDefaultCollapseRef.current) return;
     if (groups.length === 0) return;
     needsDefaultCollapseRef.current = false;
     const all = new Set(groups.map(group => group.provider));
+    // eslint-disable-next-line react-hooks/set-state-in-effect
     setCollapsed(all);
     writeCollapsedProviders(all);
   }, [groups]);

gui/src/pages/api-keys-panels.tsx

@@ -54,10 +54,10 @@ function CopyOnClickTip({
   }, []);
 
   useLayoutEffect(() => {
-    if (!showTip) {
-      setCoords(null);
-      return;
-    }
+    // No reset on close: the portal and aria-describedby are already gated on showTip,
+    // and reopening remeasures in this same layout effect before paint. Clearing here
+    // only forced a second render.
+    if (!showTip) return;
     const update = () => {
       const el = anchorRef.current;
       if (!el) return;

gui/src/pages/logs-surface-filter.ts

@@ -0,0 +1,15 @@
+/**
+ * Surface bucketing for the Logs page, kept out of Logs.tsx so that module exports
+ * components only — a page module that also exports helpers breaks Fast Refresh
+ * (react-refresh/only-export-components).
+ */
+export type LogSurface = "claude" | "claude-desktop" | "grok";
+export type LogSurfaceFilter = "all" | "claude" | "codex" | "grok";
+
+/** Match Usage surface buckets: Claude includes Desktop; Codex is untagged. */
+export function logMatchesSurface(log: { surface?: LogSurface }, filter: LogSurfaceFilter): boolean {
+  if (filter === "all") return true;
+  if (filter === "claude") return log.surface === "claude" || log.surface === "claude-desktop";
+  if (filter === "grok") return log.surface === "grok";
+  return log.surface === undefined;
+}

gui/tests/logs-surface-filter.test.ts

@@ -1,5 +1,5 @@
 import { expect, test } from "bun:test";
-import { logMatchesSurface } from "../src/pages/Logs";
+import { logMatchesSurface } from "../src/pages/logs-surface-filter";
 
 test("Logs surface filter matches Usage buckets including Grok", () => {
   expect(logMatchesSurface({}, "all")).toBe(true);