preflight: frontend eslint no-undef gate — would have caught #1318 (undefined variable in renamed function caller)

[Kpa-clawbot]

Summary

PR #923 (clickable path overlay) changed drawAnimatedLine's signature, updated one caller, missed the OTHER caller in the same file — left it referencing the undefined hash variable. Landed on master. Reported by user as #1318. Fixed by community PR #1325.

This is the LITERAL most basic class of JavaScript bug. eslint --rule no-undef catches it instantly. We have ZERO frontend lint in CI.

What CI currently runs on public/*.js

• Playwright E2E (covers happy paths only)
• Custom CSS-var check (check-css-vars)
• node -c <file> syntax check (catches parse errors, NOT undef vars)

Total: parse-validity only. No real static analysis.

What we should add (in priority order)

1. eslint --no-eslintrc --rule '{no-undef: error}' --rule '{no-unused-vars: warn}' public/*.js — minimal config, catches the bug: Live Playback as of commit 5cc733258367bc2edc70b57b0152cbcfcade66f4 is broken due to variable name #1318 class of bug. Runs in <5s.
2. eslint --rule '{no-undef: error}' for the inline <script> blocks in public/*.html — same class of bug can land there too.
3. Per-PR delta-coverage gate: fail PR if frontend coverage drops vs merge-base. Forces tests-with-PR.
4. pr-preflight grep: scan PR diff for function fooBar( definitions; grep rest of file for fooBar( callers; flag arg-count mismatch.

Out of scope

• Full TypeScript migration
• Strict-mode lint rules (just no-undef + no-unused-vars for now)
• Webpack/bundler integration (we're vanilla JS, no build step)

Acceptance

• eslint installed in CI (npm install only at CI runtime, no committed node_modules)
• .eslintrc.json at repo root with minimal config (no-undef + no-unused-vars, both as errors after a grace period)
• CI step "Frontend lint" runs in deploy.yml before Playwright
• Fail-fast: any no-undef error blocks merge
• PR description guidelines updated to mention the gate
• Test on a synthetic bad PR (reintroduce the bug: Live Playback as of commit 5cc733258367bc2edc70b57b0152cbcfcade66f4 is broken due to variable name #1318 bug) → CI fails red before Playwright runs
• Mutation: revert the lint step → CI passes again, gate confirmed working

Why this should ship NOW

The #1318 class of bug has shipped at least once and probably more times historically. It's the cheapest possible regression to gate against. Every PR review that misses an undef-var is a process failure that no amount of "more reviewers" fixes — automate the gate.

References

• feat(live): clickable path overlay — packet info popup (closes #771 M2) #923 (PR that introduced the bug)
• bug: Live Playback as of commit 5cc733258367bc2edc70b57b0152cbcfcade66f4 is broken due to variable name #1318 (issue reporting the bug — 2 days open)
• fix(live): pass pktMeta.hash to drawAnimatedLine — merge artifact from #923 broke line animation #1325 (community fix)
• public/live.js line 2960 (the call site that the lint would have caught)