diff --git a/.github/workflows/ci-typecheck.yml b/.github/workflows/ci-typecheck.yml
index dd0fe1929..dbcc1bb3f 100644
--- a/.github/workflows/ci-typecheck.yml
+++ b/.github/workflows/ci-typecheck.yml
@@ -2,11 +2,13 @@
 # 🔍 CI · Typecheck
 # ----------------------------------------------------------------------------
 # Purpose : TypeScript type checking across all packages (bun typecheck)
+#           plus oxlint warning ratchet (bun run lint, --max-warnings gate)
 # Trigger : Push to `main`/`dev`, PRs targeting `main`/`dev`, manual dispatch
-# Jobs    : typecheck — single Linux runner, `bun typecheck`
+# Jobs    : typecheck — single Linux runner, `bun run lint` + `bun typecheck`
 # Gate    : Required status check on BOTH `dev` and `main` rulesets — it is
 #           the fast gate for feat/fix → dev PRs (full test suite only gates
-#           dev → main, see ci-test.yml).
+#           dev → main, see ci-test.yml). Lint lives inside this job so it
+#           blocks merges without editing the rulesets' required checks.
 # Notes   : No push trigger on feat/* or fix/* (frequent changes); PRs cover
 #           them.
 # ============================================================================
@@ -35,5 +37,8 @@ jobs:
       - name: Setup Bun
         uses: ./.github/actions/setup-bun
 
+      - name: Run lint
+        run: bun run lint
+
       - name: Run typecheck
         run: bun typecheck
diff --git a/.husky/pre-commit b/.husky/pre-commit
index ce93ce383..87bb38b5e 100644
--- a/.husky/pre-commit
+++ b/.husky/pre-commit
@@ -1,3 +1,4 @@
 #!/bin/sh
 set -e
+sh .husky/run-lint
 sh .husky/run-typecheck
diff --git a/.husky/run-lint b/.husky/run-lint
new file mode 100644
index 000000000..e446b685f
--- /dev/null
+++ b/.husky/run-lint
@@ -0,0 +1,23 @@
+#!/bin/sh
+# Shared lint runner for husky hooks.
+#
+# `bun run lint` is the primary path. Same environment defect as
+# run-typecheck: bun's workspace discovery walks ancestor directories and
+# dies with CouldntReadCurrentDirectory in sandboxed checkouts whose parents
+# are unreadable. In exactly that case, fall back to executing the root lint
+# script directly via node_modules/.bin (oxlint itself does not walk
+# ancestors). Real lint failures still fail on either path.
+set -e
+
+out=$(bun run lint 2>&1) && { printf '%s\n' "$out"; exit 0; }
+printf '%s\n' "$out"
+case "$out" in
+  *CouldntReadCurrentDirectory*) ;;
+  *) exit 1 ;;
+esac
+
+echo "bun workspace discovery unavailable — falling back to direct oxlint"
+# Reuse the root lint script verbatim so the --max-warnings ratchet stays in
+# one place (package.json).
+script=$(sed -n 's/.*"lint":[[:space:]]*"\([^"]*\)".*/\1/p' package.json | head -1)
+PATH="$(pwd)/node_modules/.bin:$PATH" sh -c "$script"
diff --git a/.oxlintrc.json b/.oxlintrc.json
index f1ca1ff46..1f499cf49 100644
--- a/.oxlintrc.json
+++ b/.oxlintrc.json
@@ -1,5 +1,8 @@
 {
   "$schema": "https://raw.githubusercontent.com/nicolo-ribaudo/oxc-project.github.io/refs/heads/json-schema/src/public/.oxlintrc.schema.json",
+  // Enforced in CI (ci-typecheck.yml) and pre-commit via the root `lint`
+  // script's --max-warnings ratchet: new warnings fail the gate. When fixing
+  // existing warnings, lower the threshold in package.json to match.
   "options": {
     "typeAware": true
   },
diff --git a/package.json b/package.json
index 35cc6dbab..23bc37274 100644
--- a/package.json
+++ b/package.json
@@ -12,7 +12,7 @@
     "dev:console": "ulimit -n 10240 2>/dev/null; bun run --cwd packages/console/app dev",
     "dev:stats": "bun sst shell --stage=production -- bun run --cwd packages/stats/app dev",
     "dev:storybook": "bun --cwd packages/storybook storybook",
-    "lint": "oxlint",
+    "lint": "oxlint --max-warnings=4704",
     "typecheck": "bun turbo typecheck",
     "upgrade-opentui": "bun run script/upgrade-opentui.ts",
     "postinstall": "bun run --cwd packages/core fix-node-pty",