diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 01f141b5b..fed26934c 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -29,6 +29,10 @@ updates:
         update-types: ["version-update:semver-minor", "version-update:semver-major"]
       - dependency-name: "@anthropic-ai/sdk"
         update-types: ["version-update:semver-minor", "version-update:semver-major"]
+      # oxlint is pinned exactly and scripts/lint-baseline.json records the
+      # version that wrote it. A bump can add rules or findings, so it lands
+      # as a maintainer PR that runs bun run lint --write-baseline --oxlint-upgrade.
+      - dependency-name: "oxlint"
     open-pull-requests-limit: 5
 
   - package-ecosystem: "github-actions"
diff --git a/AGENTS.md b/AGENTS.md
index abe32fea9..6c13160b2 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -262,6 +262,7 @@ When fixing failures or preparing `/ship`, follow this order:
 bun install              # install dependencies
 bun run typecheck        # strict tsc over product code; must report zero errors
 bun run typecheck:test   # test-code type-debt ratchet (new diagnostics fail; --write-baseline locks in fixes)
+bun run lint             # oxlint correctness ratchet (new findings fail; --write-baseline only shrinks)
 bun run format:cso       # format lib/cso/*.ts (format:cso:check is the CI gate)
 bun run test:quick       # fast measured free subset for edit feedback (not acceptance)
 bun run test             # complete free suite via the strict shard runner (no API spend)
diff --git a/CLAUDE.md b/CLAUDE.md
index d425dc6e7..df10cec1f 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -7,6 +7,7 @@ bun install          # install dependencies
 bun run dev <cmd>    # run CLI in dev mode, e.g. bun run dev goto https://example.com
 bun run typecheck    # strict tsc over product code (zero errors required)
 bun run typecheck:test  # test-code type-debt ratchet
+bun run lint         # oxlint correctness ratchet
 bun run build        # gen docs + compile binaries
 bun run gen:skill-docs  # regenerate SKILL.md files from templates
 bun run skill:check  # health dashboard for all skills
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 715592905..d90605138 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -24,15 +24,21 @@ bin/dev-setup                  # activate dev mode
 bun install --frozen-lockfile
 bun run typecheck        # expect no output and exit 0 (about a second)
 bun run typecheck:test   # expect "test typecheck ratchet: N known diagnostics, none new."
+bun run lint             # expect "lint ratchet: N known findings, none new (oxlint <version>)." (under a second)
 ```
 
 `typecheck` covers product code (`browse/src`, `lib`, `scripts`, `bin`, `hosts`, and the other
 entries in `tsconfig.json`) and must stay at zero errors. `typecheck:test` holds test code to the
 committed `scripts/typecheck-test-baseline.json`: a new or repeated diagnostic fails and names
 the file, TS code and message; fixing diagnostics also fails until you lock the smaller allowance
-in with `bun run typecheck:test --write-baseline`. Editing `lib/cso/*.ts`? Run
-`bun run format:cso` before committing; CI runs `format:cso:check`. All three run in the required
-`free-tests` check.
+in with `bun run typecheck:test --write-baseline`. `lint` runs oxlint's correctness rules
+(`.oxlintrc.json`) and holds existing findings to `scripts/lint-baseline.json` the same way: a new
+or repeated finding fails with `LINT_RATCHET_NEW` and its file, line and rule, and a fixed one fails
+with `LINT_RATCHET_FIXED` until `bun run lint --write-baseline` locks it in (that flag only
+shrinks the baseline). The baseline records the oxlint version, which must match `package.json`'s
+exact pin; after bumping oxlint, run `bun run lint --write-baseline --oxlint-upgrade` in the same
+change. Editing `lib/cso/*.ts`? Run `bun run format:cso` before committing; CI runs
+`format:cso:check`. All four run in the required `free-tests` check.
 
 Now edit any `SKILL.md`, invoke it in Claude Code (e.g. `/review`), and see your changes live. When you're done developing:
 
diff --git a/changelog.d/gsta203-pr4-oxlint-ratchet.md b/changelog.d/gsta203-pr4-oxlint-ratchet.md
new file mode 100644
index 000000000..0149d3f0e
--- /dev/null
+++ b/changelog.d/gsta203-pr4-oxlint-ratchet.md
@@ -0,0 +1,9 @@
+**gstack now lints its own JavaScript and TypeScript with oxlint, held to a ratchet (GSTA-203 PR 4).** CI had no JS/TS linter, and the one real error oxlint found (a second `import * as os` in `browse/test/commands.test.ts`) slipped past the product typecheck. `bun run lint` runs oxlint's correctness rules in well under a second and fails only on findings that are new; the 971 existing ones are recorded in a baseline that can only shrink.
+
+### Added
+- **`bun run lint`** (`scripts/lint-ratchet.ts`, `.oxlintrc.json`, `scripts/lint-baseline.json`): oxlint 1.90.0, pinned exactly, with its correctness rules over the repository, skipping `design-html/vendor` and `test/fixtures`. Findings are keyed by file, rule and message, not line, so moving code does not churn the baseline. Each failure prints a stable code: `LINT_RATCHET_NEW` (file:line, rule, "Fix them; do not add them to the baseline" and a reproduce command), `LINT_RATCHET_FIXED` (run `--write-baseline`, which only shrinks), `LINT_BASELINE_INVALID` (an unreadable or malformed baseline, or one written by another oxlint version; never rewritten on its own), `OXLINT_MISSING` (run `bun install`) and `OXLINT_CRASH` (with the oxlint version and config path). After an oxlint bump, `bun run lint --write-baseline --oxlint-upgrade` rebuilds the baseline in the same change.
+- **A lint step in the required `free-tests` check**, inside the existing typecheck job.
+
+### Changed
+- **`browse/test/commands.test.ts`**: the duplicate `import * as os` is gone; the test asserts the same things. `scripts/typecheck-test-baseline.json` drops the matching TS2300 entry.
+- **Dependabot skips oxlint**, because a bump needs the baseline rebuilt by a maintainer.