chore: introduce Biome linter with CI gate (#415)

[UncertaintyDeterminesYou4ndMe]

Closes part of #415 (config + scripts + CI gate; the full-repo auto-fix is a dedicated follow-up PR per the issue's own sequencing).

What

• Install @biomejs/biome2.5.4 (exact-pinned, root devDependency).
• Add biome.jsonc: formatter matched to the existing dominant style (2-space, 100-col, single quotes, semicolons, trailing commas), linter from the recommended preset, VCS-aware file discovery (useIgnoreFile), and Tailwind CSS 4 directive parsing (the desktop renderer stylesheet uses @import/@source, which the default CSS parser rejects).
• Root scripts: npm run lint (biome lint .) and npm run format (biome format --write .).
• CI: npm run lint added to the typecheck job right after npm ci — fast-fail, needs no build.

Zero source diffs, by design

This PR touches exactly 4 files: package.json, package-lock.json, biome.jsonc, .github/workflows/ci.yml. No source file is reformatted or lint-fixed, so it can't conflict with the currently open PRs.

To make the gate pass on the current tree, 64 recommended rules with pre-existing violations are disabled, each annotated in biome.jsonc with its violation count. Top offenders: noNonNullAssertion (1274), useTemplate (137), useExhaustiveDependencies (110), noAdjacentSpacesInRegex (84), noUnusedImports (74), noUnsafeOptionalChaining (74), noExplicitAny (60). The gate still enforces everything else in the recommended preset from day one, and locks in a ratchet: new violations of the enabled rules fail CI.

biome format . (check-only) reports 1299/1555 files would be reformatted — deferred.

Follow-up (next PR, on request)

1. Run the auto-fixable disabled rules + formatter + import sorting in one mechanical commit.
2. Re-enable rules as their violation counts hit zero; hand-fix the small-count correctness rules (noDuplicateObjectKeys, noUnsafeOptionalChaining, …).

Verification

• npm run lint → exit 0 (Checked 1583 files in ~0.5s).
• npm run typecheck on this branch is unchanged from its merge-base behavior (verified by stash/rerun); the CI job builds before typechecking as before.

[Astro-Han]

The gate is wired correctly (runs on push/PR to main, after npm ci, before build), the config is valid for Biome 2.5.4, the version is pinned exactly, and the ratchet does fail CI on a new violation of an enabled rule. One thing to fix before merge, then a recommendation on the shape.

Must fix: the 9 new @biomejs/* lockfile entries resolve to registry.npmmirror.com while every other dependency uses registry.npmjs.org (main has zero npmmirror URLs). With no tracked .npmrc, CI npm ci will honor these URLs and fetch Biome from the mirror, which is slower and can be rate-limited or unreachable from GitHub runners. Regenerate just these entries against npmjs (npm install @biomejs/biome@2.5.4 --registry=https://registry.npmjs.org/) and commit the corrected lockfile.

Recommendation on the shape, worth reconsidering before this becomes the baseline. Measured against the full recommended set, the tree has ~2,300 diagnostics, but 57% is one pure-style rule (noNonNullAssertion = 1,274) and the bulk of the rest is style (useTemplate 137, useExhaustiveDependencies 110, noExplicitAny 60). The genuine correctness debt is about 76 and almost entirely in test files, and it includes one real masked bug: scripts/cu-provider-matrix.test.mjs:89 has a duplicate fixtureState key that line 91 silently overrides, so the test does not exercise its intended input. noDuplicateObjectKeys catches exactly this, and the PR disables it.

So the current shape enforces a lint gate that is green only because the bug-catchers are off, while the formatter is configured but never gated (zero consistency value). Consider inverting it:

• Lint: enforce only the correctness subset (noDuplicateObjectKeys, noUnsafeOptionalChaining, noNonNullAssertedOptionalChain, and similar). Hand-fix the ~76 (mostly tests; fix the duplicate-key bug by hand rather than autofix, which would just delete one key). Drop the pure-style rules outright instead of tracking 64 as debt. useExhaustiveDependencies is a real bug-catcher but needs per-case judgment, so leave it to a follow-up.
• Formatter: land a one-time biome format --write baseline (1,299 files, mechanical) as a standalone commit and gate it with biome format in check mode, or drop the formatter config. Configured-but-ungated buys nothing. If baselining, add the commit to .git-blame-ignore-revs and coordinate timing against the open PRs, since it touches ~1,300 files.

[UncertaintyDeterminesYou4ndMe]

Thanks for the review — both points addressed, plus measurement data that informs the formatter question.

Fixed

Lockfile registry (f34d435f): the 9 @biomejs/* entries were leakage from a local npmmirror config; regenerated against registry.npmjs.org, grep -c npmmirror package-lock.json is now 0.

Correctness-first reshape (ef9102e5), as you suggested:

• The fixtureState duplicate key in cu-provider-matrix.test.mjs is fixed by hand: the flat { blue, red, note } shape is the stale one — normalizeFixture consumes the windowId-keyed shape ({ target: {…} }) and every other test in the file uses it, so the flat entry was dead input, now removed.
• All 74 noUnsafeOptionalChaining sites + the 1 noNonNullAssertedOptionalChain site hand-fixed across 12 test files (drop ?. where presence is already asserted; extend the chain where an undefined still fails the assertion identically; non-null assertion in TS tests where presence is structural).
• noDuplicateObjectKeys, noUnsafeOptionalChaining, noNonNullAssertedOptionalChain are now enforced.
• noNonNullAssertion / useTemplate / noExplicitAny are dropped outright (commented as deliberate, not debt). The rest stay off as "deferred" with counts; useExhaustiveDependencies annotated as a real bug-catcher needing per-case judgment.

Verified locally: lint clean, test:scripts 91/91, runtime 1936 tests 0 fail, desktop 2542/2542, typecheck clean. headless is 960/963 — the 2 failures (harbor-adapter opencode stop runner) reproduce identically on the unmodified baseline and pass in isolation, so they're a local-env flake, not from this diff; CI is the arbiter there.

Formatter: measurement first, then your call

I measured auto-fix coverage on a throwaway worktree with all 64 rules re-enabled (2,441 baseline diagnostics):

pass	diagnostics cleared	files touched
lint --write (safe)	157 (6.4%), 11 rules to zero	81
+ --unsafe	764 (31.3%) cumulative, 21 rules to zero	233
format --write alone	—	1,299 (0.4s)

Two findings worth knowing before anyone runs a real fix pass:

1. Unsafe fixes shift violations: stripping ! for noNonNullAssertion pushed noNonNullAssertedOptionalChain from 1 → 12. Unsafe passes need a build+test gate, not just a lint-clean check.
2. biome lint --write --unsafe hangs indefinitely (~100% CPU) on apps/desktop — every other directory completes in ~5s, and plain format --write is fine everywhere, so it's specific to the unsafe-fix lint pass on that tree. Needs bisection before an unsafe pass runs there; I'll try to minimize it and file it upstream with Biome.

On your two options: I'd take the one-time format baseline + biome format check-mode gate, as a standalone PR you merge at a moment of your choosing (it conflicts with everything open, so timing is yours), with the commit added to .git-blame-ignore-revs. Happy to prep that PR now so it's one click when you want it — or drop the formatter config from this PR if you'd rather not carry an ungated config in the meantime. Which do you prefer?

[Astro-Han]

Thanks, the reshape is exactly right and CI is green. Two things before merge.

Formatter: let's go with (b). Drop the formatter config (and the npm run format script) from this PR so it lands as a clean correctness-lint gate. Bring the formatter back as one atomic follow-up: config plus the one-time biome format --write baseline plus a biome format check-mode CI gate plus the baseline commit in .git-blame-ignore-revs, timed when few PRs are open. Reason not to keep it here: formatter.enabled: true on main gets picked up by format-on-save in Biome-enabled editors, so the 1,299-file reformat leaks piecemeal into unrelated PRs, and with no baseline commit .git-blame-ignore-revs can't undo scattered drift. I'll take you up on the offer to prep that baseline PR for the follow-up.

Linter shape: make it an explicit allowlist rather than recommended minus the disabled rules. Set recommended: false and turn on only the three correctness rules you enforce (noDuplicateObjectKeys, noUnsafeOptionalChaining, noNonNullAssertedOptionalChain). Same green result today, but it inverts the default so nothing re-enters the gate silently, and it drops the 64-rule disabled list entirely instead of carrying it as standing debt. The thing this guards against is ruleset creep: with recommended on, someone later flips a style rule back on (the 1,274 noNonNullAssertion sites are right there) and the gate quietly turns from a correctness gate into a style gate. Add a short comment at the rules block fixing the admission bar, so future additions are a deliberate decision: a rule joins the gate only if it catches a defect rather than a style preference, and the tree is either zero-violation or hand-fixed first. Worth noting there too: skip --unsafe autofix for now, since biome lint --write --unsafe hangs on apps/desktop.

Happy to merge once the formatter config is out and the linter is on the explicit allowlist.

[UncertaintyDeterminesYou4ndMe]

Both pre-merge asks done in de4f00f1.

Formatter removed. Dropped the formatter config and the npm run format script — this PR is now purely a correctness-lint gate. Agreed on the format-on-save leakage risk; it comes back as the atomic baseline follow-up (config + one-time biome format --write + biome format check-mode gate + .git-blame-ignore-revs), which I'll prep and hand you to merge when few PRs are open.

Linter is now an explicit allowlist.preset: "none" (the non-deprecated spelling — recommended: false emits a deprecation notice in 2.5.4), turning on only the three enforced correctness rules. The 64-rule disabled list is gone entirely. Added the admission-bar comment you asked for: a rule joins only if it catches a defect rather than a style preference, and the tree must be zero-violation or hand-fixed first. Note in there too that --unsafe autofix is off the table for now given the apps/desktop hang.

Two verification notes:

• npm run lint is clean with no deprecation output (exit 0).
• Guarded against the "silent no-op gate" failure mode with a negative test: a throwaway probe file with all three violations trips all three rules (Found 3 errors), then removed. So the allowlist is genuinely active, not accidentally empty.

Net diff of this commit: biome.jsonc −99/+32, package.json −1. CI re-running.

[UncertaintyDeterminesYou4ndMe]

Closes part of #415 (config + scripts + CI gate; the full-repo auto-fix is a dedicated follow-up PR per the issue's own sequencing).

What

• Install @biomejs/biome2.5.4 (exact-pinned, root devDependency).
• Add biome.jsonc: formatter matched to the existing dominant style (2-space, 100-col, single quotes, semicolons, trailing commas), linter from the recommended preset, VCS-aware file discovery (useIgnoreFile), and Tailwind CSS 4 directive parsing (the desktop renderer stylesheet uses @import/@source, which the default CSS parser rejects).
• Root scripts: npm run lint (biome lint .) and npm run format (biome format --write .).
• CI: npm run lint added to the typecheck job right after npm ci — fast-fail, needs no build.

Zero source diffs, by design

This PR touches exactly 4 files: package.json, package-lock.json, biome.jsonc, .github/workflows/ci.yml. No source file is reformatted or lint-fixed, so it can't conflict with the currently open PRs.

To make the gate pass on the current tree, 64 recommended rules with pre-existing violations are disabled, each annotated in biome.jsonc with its violation count. Top offenders: noNonNullAssertion (1274), useTemplate (137), useExhaustiveDependencies (110), noAdjacentSpacesInRegex (84), noUnusedImports (74), noUnsafeOptionalChaining (74), noExplicitAny (60). The gate still enforces everything else in the recommended preset from day one, and locks in a ratchet: new violations of the enabled rules fail CI.

biome format . (check-only) reports 1299/1555 files would be reformatted — deferred.

Follow-up (next PR, on request)

1. Run the auto-fixable disabled rules + formatter + import sorting in one mechanical commit.
2. Re-enable rules as their violation counts hit zero; hand-fix the small-count correctness rules (noDuplicateObjectKeys, noUnsafeOptionalChaining, …).

Verification

• npm run lint → exit 0 (Checked 1583 files in ~0.5s).
• npm run typecheck on this branch is unchanged from its merge-base behavior (verified by stash/rerun); the CI job builds before typechecking as before.

[Astro-Han]

The gate is wired correctly (runs on push/PR to main, after npm ci, before build), the config is valid for Biome 2.5.4, the version is pinned exactly, and the ratchet does fail CI on a new violation of an enabled rule. One thing to fix before merge, then a recommendation on the shape.

Must fix: the 9 new @biomejs/* lockfile entries resolve to registry.npmmirror.com while every other dependency uses registry.npmjs.org (main has zero npmmirror URLs). With no tracked .npmrc, CI npm ci will honor these URLs and fetch Biome from the mirror, which is slower and can be rate-limited or unreachable from GitHub runners. Regenerate just these entries against npmjs (npm install @biomejs/biome@2.5.4 --registry=https://registry.npmjs.org/) and commit the corrected lockfile.

Recommendation on the shape, worth reconsidering before this becomes the baseline. Measured against the full recommended set, the tree has ~2,300 diagnostics, but 57% is one pure-style rule (noNonNullAssertion = 1,274) and the bulk of the rest is style (useTemplate 137, useExhaustiveDependencies 110, noExplicitAny 60). The genuine correctness debt is about 76 and almost entirely in test files, and it includes one real masked bug: scripts/cu-provider-matrix.test.mjs:89 has a duplicate fixtureState key that line 91 silently overrides, so the test does not exercise its intended input. noDuplicateObjectKeys catches exactly this, and the PR disables it.

So the current shape enforces a lint gate that is green only because the bug-catchers are off, while the formatter is configured but never gated (zero consistency value). Consider inverting it:

• Lint: enforce only the correctness subset (noDuplicateObjectKeys, noUnsafeOptionalChaining, noNonNullAssertedOptionalChain, and similar). Hand-fix the ~76 (mostly tests; fix the duplicate-key bug by hand rather than autofix, which would just delete one key). Drop the pure-style rules outright instead of tracking 64 as debt. useExhaustiveDependencies is a real bug-catcher but needs per-case judgment, so leave it to a follow-up.
• Formatter: land a one-time biome format --write baseline (1,299 files, mechanical) as a standalone commit and gate it with biome format in check mode, or drop the formatter config. Configured-but-ungated buys nothing. If baselining, add the commit to .git-blame-ignore-revs and coordinate timing against the open PRs, since it touches ~1,300 files.

[UncertaintyDeterminesYou4ndMe]

Thanks for the review — both points addressed, plus measurement data that informs the formatter question.

Fixed

Lockfile registry (f34d435f): the 9 @biomejs/* entries were leakage from a local npmmirror config; regenerated against registry.npmjs.org, grep -c npmmirror package-lock.json is now 0.

Correctness-first reshape (ef9102e5), as you suggested:

• The fixtureState duplicate key in cu-provider-matrix.test.mjs is fixed by hand: the flat { blue, red, note } shape is the stale one — normalizeFixture consumes the windowId-keyed shape ({ target: {…} }) and every other test in the file uses it, so the flat entry was dead input, now removed.
• All 74 noUnsafeOptionalChaining sites + the 1 noNonNullAssertedOptionalChain site hand-fixed across 12 test files (drop ?. where presence is already asserted; extend the chain where an undefined still fails the assertion identically; non-null assertion in TS tests where presence is structural).
• noDuplicateObjectKeys, noUnsafeOptionalChaining, noNonNullAssertedOptionalChain are now enforced.
• noNonNullAssertion / useTemplate / noExplicitAny are dropped outright (commented as deliberate, not debt). The rest stay off as "deferred" with counts; useExhaustiveDependencies annotated as a real bug-catcher needing per-case judgment.

Verified locally: lint clean, test:scripts 91/91, runtime 1936 tests 0 fail, desktop 2542/2542, typecheck clean. headless is 960/963 — the 2 failures (harbor-adapter opencode stop runner) reproduce identically on the unmodified baseline and pass in isolation, so they're a local-env flake, not from this diff; CI is the arbiter there.

Formatter: measurement first, then your call

I measured auto-fix coverage on a throwaway worktree with all 64 rules re-enabled (2,441 baseline diagnostics):

pass	diagnostics cleared	files touched
lint --write (safe)	157 (6.4%), 11 rules to zero	81
+ --unsafe	764 (31.3%) cumulative, 21 rules to zero	233
format --write alone	—	1,299 (0.4s)

Two findings worth knowing before anyone runs a real fix pass:

1. Unsafe fixes shift violations: stripping ! for noNonNullAssertion pushed noNonNullAssertedOptionalChain from 1 → 12. Unsafe passes need a build+test gate, not just a lint-clean check.
2. biome lint --write --unsafe hangs indefinitely (~100% CPU) on apps/desktop — every other directory completes in ~5s, and plain format --write is fine everywhere, so it's specific to the unsafe-fix lint pass on that tree. Needs bisection before an unsafe pass runs there; I'll try to minimize it and file it upstream with Biome.

On your two options: I'd take the one-time format baseline + biome format check-mode gate, as a standalone PR you merge at a moment of your choosing (it conflicts with everything open, so timing is yours), with the commit added to .git-blame-ignore-revs. Happy to prep that PR now so it's one click when you want it — or drop the formatter config from this PR if you'd rather not carry an ungated config in the meantime. Which do you prefer?

[Astro-Han]

Thanks, the reshape is exactly right and CI is green. Two things before merge.

Formatter: let's go with (b). Drop the formatter config (and the npm run format script) from this PR so it lands as a clean correctness-lint gate. Bring the formatter back as one atomic follow-up: config plus the one-time biome format --write baseline plus a biome format check-mode CI gate plus the baseline commit in .git-blame-ignore-revs, timed when few PRs are open. Reason not to keep it here: formatter.enabled: true on main gets picked up by format-on-save in Biome-enabled editors, so the 1,299-file reformat leaks piecemeal into unrelated PRs, and with no baseline commit .git-blame-ignore-revs can't undo scattered drift. I'll take you up on the offer to prep that baseline PR for the follow-up.

Linter shape: make it an explicit allowlist rather than recommended minus the disabled rules. Set recommended: false and turn on only the three correctness rules you enforce (noDuplicateObjectKeys, noUnsafeOptionalChaining, noNonNullAssertedOptionalChain). Same green result today, but it inverts the default so nothing re-enters the gate silently, and it drops the 64-rule disabled list entirely instead of carrying it as standing debt. The thing this guards against is ruleset creep: with recommended on, someone later flips a style rule back on (the 1,274 noNonNullAssertion sites are right there) and the gate quietly turns from a correctness gate into a style gate. Add a short comment at the rules block fixing the admission bar, so future additions are a deliberate decision: a rule joins the gate only if it catches a defect rather than a style preference, and the tree is either zero-violation or hand-fixed first. Worth noting there too: skip --unsafe autofix for now, since biome lint --write --unsafe hangs on apps/desktop.

Happy to merge once the formatter config is out and the linter is on the explicit allowlist.

[UncertaintyDeterminesYou4ndMe]

Both pre-merge asks done in de4f00f1.

Formatter removed. Dropped the formatter config and the npm run format script — this PR is now purely a correctness-lint gate. Agreed on the format-on-save leakage risk; it comes back as the atomic baseline follow-up (config + one-time biome format --write + biome format check-mode gate + .git-blame-ignore-revs), which I'll prep and hand you to merge when few PRs are open.

Linter is now an explicit allowlist.preset: "none" (the non-deprecated spelling — recommended: false emits a deprecation notice in 2.5.4), turning on only the three enforced correctness rules. The 64-rule disabled list is gone entirely. Added the admission-bar comment you asked for: a rule joins only if it catches a defect rather than a style preference, and the tree must be zero-violation or hand-fixed first. Note in there too that --unsafe autofix is off the table for now given the apps/desktop hang.

Two verification notes:

• npm run lint is clean with no deprecation output (exit 0).
• Guarded against the "silent no-op gate" failure mode with a negative test: a throwaway probe file with all three violations trips all three rules (Found 3 errors), then removed. So the allowlist is genuinely active, not accidentally empty.

Net diff of this commit: biome.jsonc −99/+32, package.json −1. CI re-running.

[UncertaintyDeterminesYou4ndMe]

Closes part of #415 (config + scripts + CI gate; the full-repo auto-fix is a dedicated follow-up PR per the issue's own sequencing).

What

• Install @biomejs/biome2.5.4 (exact-pinned, root devDependency).
• Add biome.jsonc: formatter matched to the existing dominant style (2-space, 100-col, single quotes, semicolons, trailing commas), linter from the recommended preset, VCS-aware file discovery (useIgnoreFile), and Tailwind CSS 4 directive parsing (the desktop renderer stylesheet uses @import/@source, which the default CSS parser rejects).
• Root scripts: npm run lint (biome lint .) and npm run format (biome format --write .).
• CI: npm run lint added to the typecheck job right after npm ci — fast-fail, needs no build.

Zero source diffs, by design

This PR touches exactly 4 files: package.json, package-lock.json, biome.jsonc, .github/workflows/ci.yml. No source file is reformatted or lint-fixed, so it can't conflict with the currently open PRs.

To make the gate pass on the current tree, 64 recommended rules with pre-existing violations are disabled, each annotated in biome.jsonc with its violation count. Top offenders: noNonNullAssertion (1274), useTemplate (137), useExhaustiveDependencies (110), noAdjacentSpacesInRegex (84), noUnusedImports (74), noUnsafeOptionalChaining (74), noExplicitAny (60). The gate still enforces everything else in the recommended preset from day one, and locks in a ratchet: new violations of the enabled rules fail CI.

biome format . (check-only) reports 1299/1555 files would be reformatted — deferred.

Follow-up (next PR, on request)

1. Run the auto-fixable disabled rules + formatter + import sorting in one mechanical commit.
2. Re-enable rules as their violation counts hit zero; hand-fix the small-count correctness rules (noDuplicateObjectKeys, noUnsafeOptionalChaining, …).

Verification

• npm run lint → exit 0 (Checked 1583 files in ~0.5s).
• npm run typecheck on this branch is unchanged from its merge-base behavior (verified by stash/rerun); the CI job builds before typechecking as before.

[Astro-Han]

The gate is wired correctly (runs on push/PR to main, after npm ci, before build), the config is valid for Biome 2.5.4, the version is pinned exactly, and the ratchet does fail CI on a new violation of an enabled rule. One thing to fix before merge, then a recommendation on the shape.

Must fix: the 9 new @biomejs/* lockfile entries resolve to registry.npmmirror.com while every other dependency uses registry.npmjs.org (main has zero npmmirror URLs). With no tracked .npmrc, CI npm ci will honor these URLs and fetch Biome from the mirror, which is slower and can be rate-limited or unreachable from GitHub runners. Regenerate just these entries against npmjs (npm install @biomejs/biome@2.5.4 --registry=https://registry.npmjs.org/) and commit the corrected lockfile.

Recommendation on the shape, worth reconsidering before this becomes the baseline. Measured against the full recommended set, the tree has ~2,300 diagnostics, but 57% is one pure-style rule (noNonNullAssertion = 1,274) and the bulk of the rest is style (useTemplate 137, useExhaustiveDependencies 110, noExplicitAny 60). The genuine correctness debt is about 76 and almost entirely in test files, and it includes one real masked bug: scripts/cu-provider-matrix.test.mjs:89 has a duplicate fixtureState key that line 91 silently overrides, so the test does not exercise its intended input. noDuplicateObjectKeys catches exactly this, and the PR disables it.

So the current shape enforces a lint gate that is green only because the bug-catchers are off, while the formatter is configured but never gated (zero consistency value). Consider inverting it:

• Lint: enforce only the correctness subset (noDuplicateObjectKeys, noUnsafeOptionalChaining, noNonNullAssertedOptionalChain, and similar). Hand-fix the ~76 (mostly tests; fix the duplicate-key bug by hand rather than autofix, which would just delete one key). Drop the pure-style rules outright instead of tracking 64 as debt. useExhaustiveDependencies is a real bug-catcher but needs per-case judgment, so leave it to a follow-up.
• Formatter: land a one-time biome format --write baseline (1,299 files, mechanical) as a standalone commit and gate it with biome format in check mode, or drop the formatter config. Configured-but-ungated buys nothing. If baselining, add the commit to .git-blame-ignore-revs and coordinate timing against the open PRs, since it touches ~1,300 files.

[UncertaintyDeterminesYou4ndMe]

Thanks for the review — both points addressed, plus measurement data that informs the formatter question.

Fixed

Lockfile registry (f34d435f): the 9 @biomejs/* entries were leakage from a local npmmirror config; regenerated against registry.npmjs.org, grep -c npmmirror package-lock.json is now 0.

Correctness-first reshape (ef9102e5), as you suggested:

• The fixtureState duplicate key in cu-provider-matrix.test.mjs is fixed by hand: the flat { blue, red, note } shape is the stale one — normalizeFixture consumes the windowId-keyed shape ({ target: {…} }) and every other test in the file uses it, so the flat entry was dead input, now removed.
• All 74 noUnsafeOptionalChaining sites + the 1 noNonNullAssertedOptionalChain site hand-fixed across 12 test files (drop ?. where presence is already asserted; extend the chain where an undefined still fails the assertion identically; non-null assertion in TS tests where presence is structural).
• noDuplicateObjectKeys, noUnsafeOptionalChaining, noNonNullAssertedOptionalChain are now enforced.
• noNonNullAssertion / useTemplate / noExplicitAny are dropped outright (commented as deliberate, not debt). The rest stay off as "deferred" with counts; useExhaustiveDependencies annotated as a real bug-catcher needing per-case judgment.

Verified locally: lint clean, test:scripts 91/91, runtime 1936 tests 0 fail, desktop 2542/2542, typecheck clean. headless is 960/963 — the 2 failures (harbor-adapter opencode stop runner) reproduce identically on the unmodified baseline and pass in isolation, so they're a local-env flake, not from this diff; CI is the arbiter there.

Formatter: measurement first, then your call

I measured auto-fix coverage on a throwaway worktree with all 64 rules re-enabled (2,441 baseline diagnostics):

pass	diagnostics cleared	files touched
lint --write (safe)	157 (6.4%), 11 rules to zero	81
+ --unsafe	764 (31.3%) cumulative, 21 rules to zero	233
format --write alone	—	1,299 (0.4s)

Two findings worth knowing before anyone runs a real fix pass:

1. Unsafe fixes shift violations: stripping ! for noNonNullAssertion pushed noNonNullAssertedOptionalChain from 1 → 12. Unsafe passes need a build+test gate, not just a lint-clean check.
2. biome lint --write --unsafe hangs indefinitely (~100% CPU) on apps/desktop — every other directory completes in ~5s, and plain format --write is fine everywhere, so it's specific to the unsafe-fix lint pass on that tree. Needs bisection before an unsafe pass runs there; I'll try to minimize it and file it upstream with Biome.

On your two options: I'd take the one-time format baseline + biome format check-mode gate, as a standalone PR you merge at a moment of your choosing (it conflicts with everything open, so timing is yours), with the commit added to .git-blame-ignore-revs. Happy to prep that PR now so it's one click when you want it — or drop the formatter config from this PR if you'd rather not carry an ungated config in the meantime. Which do you prefer?

[Astro-Han]

Thanks, the reshape is exactly right and CI is green. Two things before merge.

Formatter: let's go with (b). Drop the formatter config (and the npm run format script) from this PR so it lands as a clean correctness-lint gate. Bring the formatter back as one atomic follow-up: config plus the one-time biome format --write baseline plus a biome format check-mode CI gate plus the baseline commit in .git-blame-ignore-revs, timed when few PRs are open. Reason not to keep it here: formatter.enabled: true on main gets picked up by format-on-save in Biome-enabled editors, so the 1,299-file reformat leaks piecemeal into unrelated PRs, and with no baseline commit .git-blame-ignore-revs can't undo scattered drift. I'll take you up on the offer to prep that baseline PR for the follow-up.

Linter shape: make it an explicit allowlist rather than recommended minus the disabled rules. Set recommended: false and turn on only the three correctness rules you enforce (noDuplicateObjectKeys, noUnsafeOptionalChaining, noNonNullAssertedOptionalChain). Same green result today, but it inverts the default so nothing re-enters the gate silently, and it drops the 64-rule disabled list entirely instead of carrying it as standing debt. The thing this guards against is ruleset creep: with recommended on, someone later flips a style rule back on (the 1,274 noNonNullAssertion sites are right there) and the gate quietly turns from a correctness gate into a style gate. Add a short comment at the rules block fixing the admission bar, so future additions are a deliberate decision: a rule joins the gate only if it catches a defect rather than a style preference, and the tree is either zero-violation or hand-fixed first. Worth noting there too: skip --unsafe autofix for now, since biome lint --write --unsafe hangs on apps/desktop.

Happy to merge once the formatter config is out and the linter is on the explicit allowlist.

[UncertaintyDeterminesYou4ndMe]

Both pre-merge asks done in de4f00f1.

Formatter removed. Dropped the formatter config and the npm run format script — this PR is now purely a correctness-lint gate. Agreed on the format-on-save leakage risk; it comes back as the atomic baseline follow-up (config + one-time biome format --write + biome format check-mode gate + .git-blame-ignore-revs), which I'll prep and hand you to merge when few PRs are open.

Linter is now an explicit allowlist.preset: "none" (the non-deprecated spelling — recommended: false emits a deprecation notice in 2.5.4), turning on only the three enforced correctness rules. The 64-rule disabled list is gone entirely. Added the admission-bar comment you asked for: a rule joins only if it catches a defect rather than a style preference, and the tree must be zero-violation or hand-fixed first. Note in there too that --unsafe autofix is off the table for now given the apps/desktop hang.

Two verification notes:

• npm run lint is clean with no deprecation output (exit 0).
• Guarded against the "silent no-op gate" failure mode with a negative test: a throwaway probe file with all three violations trips all three rules (Found 3 errors), then removed. So the allowlist is genuinely active, not accidentally empty.

Net diff of this commit: biome.jsonc −99/+32, package.json −1. CI re-running.

[UncertaintyDeterminesYou4ndMe]

Closes part of #415 (config + scripts + CI gate; the full-repo auto-fix is a dedicated follow-up PR per the issue's own sequencing).

What

• Install @biomejs/biome2.5.4 (exact-pinned, root devDependency).
• Add biome.jsonc: formatter matched to the existing dominant style (2-space, 100-col, single quotes, semicolons, trailing commas), linter from the recommended preset, VCS-aware file discovery (useIgnoreFile), and Tailwind CSS 4 directive parsing (the desktop renderer stylesheet uses @import/@source, which the default CSS parser rejects).
• Root scripts: npm run lint (biome lint .) and npm run format (biome format --write .).
• CI: npm run lint added to the typecheck job right after npm ci — fast-fail, needs no build.

Zero source diffs, by design

This PR touches exactly 4 files: package.json, package-lock.json, biome.jsonc, .github/workflows/ci.yml. No source file is reformatted or lint-fixed, so it can't conflict with the currently open PRs.

To make the gate pass on the current tree, 64 recommended rules with pre-existing violations are disabled, each annotated in biome.jsonc with its violation count. Top offenders: noNonNullAssertion (1274), useTemplate (137), useExhaustiveDependencies (110), noAdjacentSpacesInRegex (84), noUnusedImports (74), noUnsafeOptionalChaining (74), noExplicitAny (60). The gate still enforces everything else in the recommended preset from day one, and locks in a ratchet: new violations of the enabled rules fail CI.

biome format . (check-only) reports 1299/1555 files would be reformatted — deferred.

Follow-up (next PR, on request)

1. Run the auto-fixable disabled rules + formatter + import sorting in one mechanical commit.
2. Re-enable rules as their violation counts hit zero; hand-fix the small-count correctness rules (noDuplicateObjectKeys, noUnsafeOptionalChaining, …).

Verification

• npm run lint → exit 0 (Checked 1583 files in ~0.5s).
• npm run typecheck on this branch is unchanged from its merge-base behavior (verified by stash/rerun); the CI job builds before typechecking as before.

[Astro-Han]

The gate is wired correctly (runs on push/PR to main, after npm ci, before build), the config is valid for Biome 2.5.4, the version is pinned exactly, and the ratchet does fail CI on a new violation of an enabled rule. One thing to fix before merge, then a recommendation on the shape.

Must fix: the 9 new @biomejs/* lockfile entries resolve to registry.npmmirror.com while every other dependency uses registry.npmjs.org (main has zero npmmirror URLs). With no tracked .npmrc, CI npm ci will honor these URLs and fetch Biome from the mirror, which is slower and can be rate-limited or unreachable from GitHub runners. Regenerate just these entries against npmjs (npm install @biomejs/biome@2.5.4 --registry=https://registry.npmjs.org/) and commit the corrected lockfile.

Recommendation on the shape, worth reconsidering before this becomes the baseline. Measured against the full recommended set, the tree has ~2,300 diagnostics, but 57% is one pure-style rule (noNonNullAssertion = 1,274) and the bulk of the rest is style (useTemplate 137, useExhaustiveDependencies 110, noExplicitAny 60). The genuine correctness debt is about 76 and almost entirely in test files, and it includes one real masked bug: scripts/cu-provider-matrix.test.mjs:89 has a duplicate fixtureState key that line 91 silently overrides, so the test does not exercise its intended input. noDuplicateObjectKeys catches exactly this, and the PR disables it.

So the current shape enforces a lint gate that is green only because the bug-catchers are off, while the formatter is configured but never gated (zero consistency value). Consider inverting it:

• Lint: enforce only the correctness subset (noDuplicateObjectKeys, noUnsafeOptionalChaining, noNonNullAssertedOptionalChain, and similar). Hand-fix the ~76 (mostly tests; fix the duplicate-key bug by hand rather than autofix, which would just delete one key). Drop the pure-style rules outright instead of tracking 64 as debt. useExhaustiveDependencies is a real bug-catcher but needs per-case judgment, so leave it to a follow-up.
• Formatter: land a one-time biome format --write baseline (1,299 files, mechanical) as a standalone commit and gate it with biome format in check mode, or drop the formatter config. Configured-but-ungated buys nothing. If baselining, add the commit to .git-blame-ignore-revs and coordinate timing against the open PRs, since it touches ~1,300 files.

[UncertaintyDeterminesYou4ndMe]

Thanks for the review — both points addressed, plus measurement data that informs the formatter question.

Fixed

Lockfile registry (f34d435f): the 9 @biomejs/* entries were leakage from a local npmmirror config; regenerated against registry.npmjs.org, grep -c npmmirror package-lock.json is now 0.

Correctness-first reshape (ef9102e5), as you suggested:

• The fixtureState duplicate key in cu-provider-matrix.test.mjs is fixed by hand: the flat { blue, red, note } shape is the stale one — normalizeFixture consumes the windowId-keyed shape ({ target: {…} }) and every other test in the file uses it, so the flat entry was dead input, now removed.
• All 74 noUnsafeOptionalChaining sites + the 1 noNonNullAssertedOptionalChain site hand-fixed across 12 test files (drop ?. where presence is already asserted; extend the chain where an undefined still fails the assertion identically; non-null assertion in TS tests where presence is structural).
• noDuplicateObjectKeys, noUnsafeOptionalChaining, noNonNullAssertedOptionalChain are now enforced.
• noNonNullAssertion / useTemplate / noExplicitAny are dropped outright (commented as deliberate, not debt). The rest stay off as "deferred" with counts; useExhaustiveDependencies annotated as a real bug-catcher needing per-case judgment.

Verified locally: lint clean, test:scripts 91/91, runtime 1936 tests 0 fail, desktop 2542/2542, typecheck clean. headless is 960/963 — the 2 failures (harbor-adapter opencode stop runner) reproduce identically on the unmodified baseline and pass in isolation, so they're a local-env flake, not from this diff; CI is the arbiter there.

Formatter: measurement first, then your call

I measured auto-fix coverage on a throwaway worktree with all 64 rules re-enabled (2,441 baseline diagnostics):

pass	diagnostics cleared	files touched
lint --write (safe)	157 (6.4%), 11 rules to zero	81
+ --unsafe	764 (31.3%) cumulative, 21 rules to zero	233
format --write alone	—	1,299 (0.4s)

Two findings worth knowing before anyone runs a real fix pass:

1. Unsafe fixes shift violations: stripping ! for noNonNullAssertion pushed noNonNullAssertedOptionalChain from 1 → 12. Unsafe passes need a build+test gate, not just a lint-clean check.
2. biome lint --write --unsafe hangs indefinitely (~100% CPU) on apps/desktop — every other directory completes in ~5s, and plain format --write is fine everywhere, so it's specific to the unsafe-fix lint pass on that tree. Needs bisection before an unsafe pass runs there; I'll try to minimize it and file it upstream with Biome.

On your two options: I'd take the one-time format baseline + biome format check-mode gate, as a standalone PR you merge at a moment of your choosing (it conflicts with everything open, so timing is yours), with the commit added to .git-blame-ignore-revs. Happy to prep that PR now so it's one click when you want it — or drop the formatter config from this PR if you'd rather not carry an ungated config in the meantime. Which do you prefer?

[Astro-Han]

Thanks, the reshape is exactly right and CI is green. Two things before merge.

Formatter: let's go with (b). Drop the formatter config (and the npm run format script) from this PR so it lands as a clean correctness-lint gate. Bring the formatter back as one atomic follow-up: config plus the one-time biome format --write baseline plus a biome format check-mode CI gate plus the baseline commit in .git-blame-ignore-revs, timed when few PRs are open. Reason not to keep it here: formatter.enabled: true on main gets picked up by format-on-save in Biome-enabled editors, so the 1,299-file reformat leaks piecemeal into unrelated PRs, and with no baseline commit .git-blame-ignore-revs can't undo scattered drift. I'll take you up on the offer to prep that baseline PR for the follow-up.

Linter shape: make it an explicit allowlist rather than recommended minus the disabled rules. Set recommended: false and turn on only the three correctness rules you enforce (noDuplicateObjectKeys, noUnsafeOptionalChaining, noNonNullAssertedOptionalChain). Same green result today, but it inverts the default so nothing re-enters the gate silently, and it drops the 64-rule disabled list entirely instead of carrying it as standing debt. The thing this guards against is ruleset creep: with recommended on, someone later flips a style rule back on (the 1,274 noNonNullAssertion sites are right there) and the gate quietly turns from a correctness gate into a style gate. Add a short comment at the rules block fixing the admission bar, so future additions are a deliberate decision: a rule joins the gate only if it catches a defect rather than a style preference, and the tree is either zero-violation or hand-fixed first. Worth noting there too: skip --unsafe autofix for now, since biome lint --write --unsafe hangs on apps/desktop.

Happy to merge once the formatter config is out and the linter is on the explicit allowlist.

[UncertaintyDeterminesYou4ndMe]

Both pre-merge asks done in de4f00f1.

Formatter removed. Dropped the formatter config and the npm run format script — this PR is now purely a correctness-lint gate. Agreed on the format-on-save leakage risk; it comes back as the atomic baseline follow-up (config + one-time biome format --write + biome format check-mode gate + .git-blame-ignore-revs), which I'll prep and hand you to merge when few PRs are open.

Linter is now an explicit allowlist.preset: "none" (the non-deprecated spelling — recommended: false emits a deprecation notice in 2.5.4), turning on only the three enforced correctness rules. The 64-rule disabled list is gone entirely. Added the admission-bar comment you asked for: a rule joins only if it catches a defect rather than a style preference, and the tree must be zero-violation or hand-fixed first. Note in there too that --unsafe autofix is off the table for now given the apps/desktop hang.

Two verification notes:

• npm run lint is clean with no deprecation output (exit 0).
• Guarded against the "silent no-op gate" failure mode with a negative test: a throwaway probe file with all three violations trips all three rules (Found 3 errors), then removed. So the allowlist is genuinely active, not accidentally empty.

Net diff of this commit: biome.jsonc −99/+32, package.json −1. CI re-running.

[UncertaintyDeterminesYou4ndMe]

Closes part of #415 (config + scripts + CI gate; the full-repo auto-fix is a dedicated follow-up PR per the issue's own sequencing).

What

• Install @biomejs/biome2.5.4 (exact-pinned, root devDependency).
• Add biome.jsonc: formatter matched to the existing dominant style (2-space, 100-col, single quotes, semicolons, trailing commas), linter from the recommended preset, VCS-aware file discovery (useIgnoreFile), and Tailwind CSS 4 directive parsing (the desktop renderer stylesheet uses @import/@source, which the default CSS parser rejects).
• Root scripts: npm run lint (biome lint .) and npm run format (biome format --write .).
• CI: npm run lint added to the typecheck job right after npm ci — fast-fail, needs no build.

Zero source diffs, by design

This PR touches exactly 4 files: package.json, package-lock.json, biome.jsonc, .github/workflows/ci.yml. No source file is reformatted or lint-fixed, so it can't conflict with the currently open PRs.

To make the gate pass on the current tree, 64 recommended rules with pre-existing violations are disabled, each annotated in biome.jsonc with its violation count. Top offenders: noNonNullAssertion (1274), useTemplate (137), useExhaustiveDependencies (110), noAdjacentSpacesInRegex (84), noUnusedImports (74), noUnsafeOptionalChaining (74), noExplicitAny (60). The gate still enforces everything else in the recommended preset from day one, and locks in a ratchet: new violations of the enabled rules fail CI.

biome format . (check-only) reports 1299/1555 files would be reformatted — deferred.

Follow-up (next PR, on request)

1. Run the auto-fixable disabled rules + formatter + import sorting in one mechanical commit.
2. Re-enable rules as their violation counts hit zero; hand-fix the small-count correctness rules (noDuplicateObjectKeys, noUnsafeOptionalChaining, …).

Verification

• npm run lint → exit 0 (Checked 1583 files in ~0.5s).
• npm run typecheck on this branch is unchanged from its merge-base behavior (verified by stash/rerun); the CI job builds before typechecking as before.

[Astro-Han]

The gate is wired correctly (runs on push/PR to main, after npm ci, before build), the config is valid for Biome 2.5.4, the version is pinned exactly, and the ratchet does fail CI on a new violation of an enabled rule. One thing to fix before merge, then a recommendation on the shape.

Must fix: the 9 new @biomejs/* lockfile entries resolve to registry.npmmirror.com while every other dependency uses registry.npmjs.org (main has zero npmmirror URLs). With no tracked .npmrc, CI npm ci will honor these URLs and fetch Biome from the mirror, which is slower and can be rate-limited or unreachable from GitHub runners. Regenerate just these entries against npmjs (npm install @biomejs/biome@2.5.4 --registry=https://registry.npmjs.org/) and commit the corrected lockfile.

Recommendation on the shape, worth reconsidering before this becomes the baseline. Measured against the full recommended set, the tree has ~2,300 diagnostics, but 57% is one pure-style rule (noNonNullAssertion = 1,274) and the bulk of the rest is style (useTemplate 137, useExhaustiveDependencies 110, noExplicitAny 60). The genuine correctness debt is about 76 and almost entirely in test files, and it includes one real masked bug: scripts/cu-provider-matrix.test.mjs:89 has a duplicate fixtureState key that line 91 silently overrides, so the test does not exercise its intended input. noDuplicateObjectKeys catches exactly this, and the PR disables it.

So the current shape enforces a lint gate that is green only because the bug-catchers are off, while the formatter is configured but never gated (zero consistency value). Consider inverting it:

• Lint: enforce only the correctness subset (noDuplicateObjectKeys, noUnsafeOptionalChaining, noNonNullAssertedOptionalChain, and similar). Hand-fix the ~76 (mostly tests; fix the duplicate-key bug by hand rather than autofix, which would just delete one key). Drop the pure-style rules outright instead of tracking 64 as debt. useExhaustiveDependencies is a real bug-catcher but needs per-case judgment, so leave it to a follow-up.
• Formatter: land a one-time biome format --write baseline (1,299 files, mechanical) as a standalone commit and gate it with biome format in check mode, or drop the formatter config. Configured-but-ungated buys nothing. If baselining, add the commit to .git-blame-ignore-revs and coordinate timing against the open PRs, since it touches ~1,300 files.

[UncertaintyDeterminesYou4ndMe]

Thanks for the review — both points addressed, plus measurement data that informs the formatter question.

Fixed

Lockfile registry (f34d435f): the 9 @biomejs/* entries were leakage from a local npmmirror config; regenerated against registry.npmjs.org, grep -c npmmirror package-lock.json is now 0.

Correctness-first reshape (ef9102e5), as you suggested:

• The fixtureState duplicate key in cu-provider-matrix.test.mjs is fixed by hand: the flat { blue, red, note } shape is the stale one — normalizeFixture consumes the windowId-keyed shape ({ target: {…} }) and every other test in the file uses it, so the flat entry was dead input, now removed.
• All 74 noUnsafeOptionalChaining sites + the 1 noNonNullAssertedOptionalChain site hand-fixed across 12 test files (drop ?. where presence is already asserted; extend the chain where an undefined still fails the assertion identically; non-null assertion in TS tests where presence is structural).
• noDuplicateObjectKeys, noUnsafeOptionalChaining, noNonNullAssertedOptionalChain are now enforced.
• noNonNullAssertion / useTemplate / noExplicitAny are dropped outright (commented as deliberate, not debt). The rest stay off as "deferred" with counts; useExhaustiveDependencies annotated as a real bug-catcher needing per-case judgment.

Verified locally: lint clean, test:scripts 91/91, runtime 1936 tests 0 fail, desktop 2542/2542, typecheck clean. headless is 960/963 — the 2 failures (harbor-adapter opencode stop runner) reproduce identically on the unmodified baseline and pass in isolation, so they're a local-env flake, not from this diff; CI is the arbiter there.

Formatter: measurement first, then your call

I measured auto-fix coverage on a throwaway worktree with all 64 rules re-enabled (2,441 baseline diagnostics):

pass	diagnostics cleared	files touched
lint --write (safe)	157 (6.4%), 11 rules to zero	81
+ --unsafe	764 (31.3%) cumulative, 21 rules to zero	233
format --write alone	—	1,299 (0.4s)

Two findings worth knowing before anyone runs a real fix pass:

1. Unsafe fixes shift violations: stripping ! for noNonNullAssertion pushed noNonNullAssertedOptionalChain from 1 → 12. Unsafe passes need a build+test gate, not just a lint-clean check.
2. biome lint --write --unsafe hangs indefinitely (~100% CPU) on apps/desktop — every other directory completes in ~5s, and plain format --write is fine everywhere, so it's specific to the unsafe-fix lint pass on that tree. Needs bisection before an unsafe pass runs there; I'll try to minimize it and file it upstream with Biome.

On your two options: I'd take the one-time format baseline + biome format check-mode gate, as a standalone PR you merge at a moment of your choosing (it conflicts with everything open, so timing is yours), with the commit added to .git-blame-ignore-revs. Happy to prep that PR now so it's one click when you want it — or drop the formatter config from this PR if you'd rather not carry an ungated config in the meantime. Which do you prefer?

[Astro-Han]

Thanks, the reshape is exactly right and CI is green. Two things before merge.

Formatter: let's go with (b). Drop the formatter config (and the npm run format script) from this PR so it lands as a clean correctness-lint gate. Bring the formatter back as one atomic follow-up: config plus the one-time biome format --write baseline plus a biome format check-mode CI gate plus the baseline commit in .git-blame-ignore-revs, timed when few PRs are open. Reason not to keep it here: formatter.enabled: true on main gets picked up by format-on-save in Biome-enabled editors, so the 1,299-file reformat leaks piecemeal into unrelated PRs, and with no baseline commit .git-blame-ignore-revs can't undo scattered drift. I'll take you up on the offer to prep that baseline PR for the follow-up.

Linter shape: make it an explicit allowlist rather than recommended minus the disabled rules. Set recommended: false and turn on only the three correctness rules you enforce (noDuplicateObjectKeys, noUnsafeOptionalChaining, noNonNullAssertedOptionalChain). Same green result today, but it inverts the default so nothing re-enters the gate silently, and it drops the 64-rule disabled list entirely instead of carrying it as standing debt. The thing this guards against is ruleset creep: with recommended on, someone later flips a style rule back on (the 1,274 noNonNullAssertion sites are right there) and the gate quietly turns from a correctness gate into a style gate. Add a short comment at the rules block fixing the admission bar, so future additions are a deliberate decision: a rule joins the gate only if it catches a defect rather than a style preference, and the tree is either zero-violation or hand-fixed first. Worth noting there too: skip --unsafe autofix for now, since biome lint --write --unsafe hangs on apps/desktop.

Happy to merge once the formatter config is out and the linter is on the explicit allowlist.

[UncertaintyDeterminesYou4ndMe]

Both pre-merge asks done in de4f00f1.

Formatter removed. Dropped the formatter config and the npm run format script — this PR is now purely a correctness-lint gate. Agreed on the format-on-save leakage risk; it comes back as the atomic baseline follow-up (config + one-time biome format --write + biome format check-mode gate + .git-blame-ignore-revs), which I'll prep and hand you to merge when few PRs are open.

Linter is now an explicit allowlist.preset: "none" (the non-deprecated spelling — recommended: false emits a deprecation notice in 2.5.4), turning on only the three enforced correctness rules. The 64-rule disabled list is gone entirely. Added the admission-bar comment you asked for: a rule joins only if it catches a defect rather than a style preference, and the tree must be zero-violation or hand-fixed first. Note in there too that --unsafe autofix is off the table for now given the apps/desktop hang.

Two verification notes:

• npm run lint is clean with no deprecation output (exit 0).
• Guarded against the "silent no-op gate" failure mode with a negative test: a throwaway probe file with all three violations trips all three rules (Found 3 errors), then removed. So the allowlist is genuinely active, not accidentally empty.

Net diff of this commit: biome.jsonc −99/+32, package.json −1. CI re-running.

[UncertaintyDeterminesYou4ndMe]

Closes part of #415 (config + scripts + CI gate; the full-repo auto-fix is a dedicated follow-up PR per the issue's own sequencing).

What

• Install @biomejs/biome2.5.4 (exact-pinned, root devDependency).
• Add biome.jsonc: formatter matched to the existing dominant style (2-space, 100-col, single quotes, semicolons, trailing commas), linter from the recommended preset, VCS-aware file discovery (useIgnoreFile), and Tailwind CSS 4 directive parsing (the desktop renderer stylesheet uses @import/@source, which the default CSS parser rejects).
• Root scripts: npm run lint (biome lint .) and npm run format (biome format --write .).
• CI: npm run lint added to the typecheck job right after npm ci — fast-fail, needs no build.

Zero source diffs, by design

This PR touches exactly 4 files: package.json, package-lock.json, biome.jsonc, .github/workflows/ci.yml. No source file is reformatted or lint-fixed, so it can't conflict with the currently open PRs.

To make the gate pass on the current tree, 64 recommended rules with pre-existing violations are disabled, each annotated in biome.jsonc with its violation count. Top offenders: noNonNullAssertion (1274), useTemplate (137), useExhaustiveDependencies (110), noAdjacentSpacesInRegex (84), noUnusedImports (74), noUnsafeOptionalChaining (74), noExplicitAny (60). The gate still enforces everything else in the recommended preset from day one, and locks in a ratchet: new violations of the enabled rules fail CI.

biome format . (check-only) reports 1299/1555 files would be reformatted — deferred.

Follow-up (next PR, on request)

1. Run the auto-fixable disabled rules + formatter + import sorting in one mechanical commit.
2. Re-enable rules as their violation counts hit zero; hand-fix the small-count correctness rules (noDuplicateObjectKeys, noUnsafeOptionalChaining, …).

Verification

• npm run lint → exit 0 (Checked 1583 files in ~0.5s).
• npm run typecheck on this branch is unchanged from its merge-base behavior (verified by stash/rerun); the CI job builds before typechecking as before.

[Astro-Han]

The gate is wired correctly (runs on push/PR to main, after npm ci, before build), the config is valid for Biome 2.5.4, the version is pinned exactly, and the ratchet does fail CI on a new violation of an enabled rule. One thing to fix before merge, then a recommendation on the shape.

Must fix: the 9 new @biomejs/* lockfile entries resolve to registry.npmmirror.com while every other dependency uses registry.npmjs.org (main has zero npmmirror URLs). With no tracked .npmrc, CI npm ci will honor these URLs and fetch Biome from the mirror, which is slower and can be rate-limited or unreachable from GitHub runners. Regenerate just these entries against npmjs (npm install @biomejs/biome@2.5.4 --registry=https://registry.npmjs.org/) and commit the corrected lockfile.

Recommendation on the shape, worth reconsidering before this becomes the baseline. Measured against the full recommended set, the tree has ~2,300 diagnostics, but 57% is one pure-style rule (noNonNullAssertion = 1,274) and the bulk of the rest is style (useTemplate 137, useExhaustiveDependencies 110, noExplicitAny 60). The genuine correctness debt is about 76 and almost entirely in test files, and it includes one real masked bug: scripts/cu-provider-matrix.test.mjs:89 has a duplicate fixtureState key that line 91 silently overrides, so the test does not exercise its intended input. noDuplicateObjectKeys catches exactly this, and the PR disables it.

So the current shape enforces a lint gate that is green only because the bug-catchers are off, while the formatter is configured but never gated (zero consistency value). Consider inverting it:

• Lint: enforce only the correctness subset (noDuplicateObjectKeys, noUnsafeOptionalChaining, noNonNullAssertedOptionalChain, and similar). Hand-fix the ~76 (mostly tests; fix the duplicate-key bug by hand rather than autofix, which would just delete one key). Drop the pure-style rules outright instead of tracking 64 as debt. useExhaustiveDependencies is a real bug-catcher but needs per-case judgment, so leave it to a follow-up.
• Formatter: land a one-time biome format --write baseline (1,299 files, mechanical) as a standalone commit and gate it with biome format in check mode, or drop the formatter config. Configured-but-ungated buys nothing. If baselining, add the commit to .git-blame-ignore-revs and coordinate timing against the open PRs, since it touches ~1,300 files.

[UncertaintyDeterminesYou4ndMe]

Thanks for the review — both points addressed, plus measurement data that informs the formatter question.

Fixed

Lockfile registry (f34d435f): the 9 @biomejs/* entries were leakage from a local npmmirror config; regenerated against registry.npmjs.org, grep -c npmmirror package-lock.json is now 0.

Correctness-first reshape (ef9102e5), as you suggested:

• The fixtureState duplicate key in cu-provider-matrix.test.mjs is fixed by hand: the flat { blue, red, note } shape is the stale one — normalizeFixture consumes the windowId-keyed shape ({ target: {…} }) and every other test in the file uses it, so the flat entry was dead input, now removed.
• All 74 noUnsafeOptionalChaining sites + the 1 noNonNullAssertedOptionalChain site hand-fixed across 12 test files (drop ?. where presence is already asserted; extend the chain where an undefined still fails the assertion identically; non-null assertion in TS tests where presence is structural).
• noDuplicateObjectKeys, noUnsafeOptionalChaining, noNonNullAssertedOptionalChain are now enforced.
• noNonNullAssertion / useTemplate / noExplicitAny are dropped outright (commented as deliberate, not debt). The rest stay off as "deferred" with counts; useExhaustiveDependencies annotated as a real bug-catcher needing per-case judgment.

Verified locally: lint clean, test:scripts 91/91, runtime 1936 tests 0 fail, desktop 2542/2542, typecheck clean. headless is 960/963 — the 2 failures (harbor-adapter opencode stop runner) reproduce identically on the unmodified baseline and pass in isolation, so they're a local-env flake, not from this diff; CI is the arbiter there.

Formatter: measurement first, then your call

I measured auto-fix coverage on a throwaway worktree with all 64 rules re-enabled (2,441 baseline diagnostics):

pass	diagnostics cleared	files touched
lint --write (safe)	157 (6.4%), 11 rules to zero	81
+ --unsafe	764 (31.3%) cumulative, 21 rules to zero	233
format --write alone	—	1,299 (0.4s)

Two findings worth knowing before anyone runs a real fix pass:

1. Unsafe fixes shift violations: stripping ! for noNonNullAssertion pushed noNonNullAssertedOptionalChain from 1 → 12. Unsafe passes need a build+test gate, not just a lint-clean check.
2. biome lint --write --unsafe hangs indefinitely (~100% CPU) on apps/desktop — every other directory completes in ~5s, and plain format --write is fine everywhere, so it's specific to the unsafe-fix lint pass on that tree. Needs bisection before an unsafe pass runs there; I'll try to minimize it and file it upstream with Biome.

On your two options: I'd take the one-time format baseline + biome format check-mode gate, as a standalone PR you merge at a moment of your choosing (it conflicts with everything open, so timing is yours), with the commit added to .git-blame-ignore-revs. Happy to prep that PR now so it's one click when you want it — or drop the formatter config from this PR if you'd rather not carry an ungated config in the meantime. Which do you prefer?

[Astro-Han]

Thanks, the reshape is exactly right and CI is green. Two things before merge.

Formatter: let's go with (b). Drop the formatter config (and the npm run format script) from this PR so it lands as a clean correctness-lint gate. Bring the formatter back as one atomic follow-up: config plus the one-time biome format --write baseline plus a biome format check-mode CI gate plus the baseline commit in .git-blame-ignore-revs, timed when few PRs are open. Reason not to keep it here: formatter.enabled: true on main gets picked up by format-on-save in Biome-enabled editors, so the 1,299-file reformat leaks piecemeal into unrelated PRs, and with no baseline commit .git-blame-ignore-revs can't undo scattered drift. I'll take you up on the offer to prep that baseline PR for the follow-up.

Linter shape: make it an explicit allowlist rather than recommended minus the disabled rules. Set recommended: false and turn on only the three correctness rules you enforce (noDuplicateObjectKeys, noUnsafeOptionalChaining, noNonNullAssertedOptionalChain). Same green result today, but it inverts the default so nothing re-enters the gate silently, and it drops the 64-rule disabled list entirely instead of carrying it as standing debt. The thing this guards against is ruleset creep: with recommended on, someone later flips a style rule back on (the 1,274 noNonNullAssertion sites are right there) and the gate quietly turns from a correctness gate into a style gate. Add a short comment at the rules block fixing the admission bar, so future additions are a deliberate decision: a rule joins the gate only if it catches a defect rather than a style preference, and the tree is either zero-violation or hand-fixed first. Worth noting there too: skip --unsafe autofix for now, since biome lint --write --unsafe hangs on apps/desktop.

Happy to merge once the formatter config is out and the linter is on the explicit allowlist.

[UncertaintyDeterminesYou4ndMe]

Both pre-merge asks done in de4f00f1.

Formatter removed. Dropped the formatter config and the npm run format script — this PR is now purely a correctness-lint gate. Agreed on the format-on-save leakage risk; it comes back as the atomic baseline follow-up (config + one-time biome format --write + biome format check-mode gate + .git-blame-ignore-revs), which I'll prep and hand you to merge when few PRs are open.

Linter is now an explicit allowlist.preset: "none" (the non-deprecated spelling — recommended: false emits a deprecation notice in 2.5.4), turning on only the three enforced correctness rules. The 64-rule disabled list is gone entirely. Added the admission-bar comment you asked for: a rule joins only if it catches a defect rather than a style preference, and the tree must be zero-violation or hand-fixed first. Note in there too that --unsafe autofix is off the table for now given the apps/desktop hang.

Two verification notes:

• npm run lint is clean with no deprecation output (exit 0).
• Guarded against the "silent no-op gate" failure mode with a negative test: a throwaway probe file with all three violations trips all three rules (Found 3 errors), then removed. So the allowlist is genuinely active, not accidentally empty.

Net diff of this commit: biome.jsonc −99/+32, package.json −1. CI re-running.

[UncertaintyDeterminesYou4ndMe]

Closes part of #415 (config + scripts + CI gate; the full-repo auto-fix is a dedicated follow-up PR per the issue's own sequencing).

What

• Install @biomejs/biome2.5.4 (exact-pinned, root devDependency).
• Add biome.jsonc: formatter matched to the existing dominant style (2-space, 100-col, single quotes, semicolons, trailing commas), linter from the recommended preset, VCS-aware file discovery (useIgnoreFile), and Tailwind CSS 4 directive parsing (the desktop renderer stylesheet uses @import/@source, which the default CSS parser rejects).
• Root scripts: npm run lint (biome lint .) and npm run format (biome format --write .).
• CI: npm run lint added to the typecheck job right after npm ci — fast-fail, needs no build.

Zero source diffs, by design

This PR touches exactly 4 files: package.json, package-lock.json, biome.jsonc, .github/workflows/ci.yml. No source file is reformatted or lint-fixed, so it can't conflict with the currently open PRs.

To make the gate pass on the current tree, 64 recommended rules with pre-existing violations are disabled, each annotated in biome.jsonc with its violation count. Top offenders: noNonNullAssertion (1274), useTemplate (137), useExhaustiveDependencies (110), noAdjacentSpacesInRegex (84), noUnusedImports (74), noUnsafeOptionalChaining (74), noExplicitAny (60). The gate still enforces everything else in the recommended preset from day one, and locks in a ratchet: new violations of the enabled rules fail CI.

biome format . (check-only) reports 1299/1555 files would be reformatted — deferred.

Follow-up (next PR, on request)

1. Run the auto-fixable disabled rules + formatter + import sorting in one mechanical commit.
2. Re-enable rules as their violation counts hit zero; hand-fix the small-count correctness rules (noDuplicateObjectKeys, noUnsafeOptionalChaining, …).

Verification

• npm run lint → exit 0 (Checked 1583 files in ~0.5s).
• npm run typecheck on this branch is unchanged from its merge-base behavior (verified by stash/rerun); the CI job builds before typechecking as before.

[Astro-Han]

The gate is wired correctly (runs on push/PR to main, after npm ci, before build), the config is valid for Biome 2.5.4, the version is pinned exactly, and the ratchet does fail CI on a new violation of an enabled rule. One thing to fix before merge, then a recommendation on the shape.

Must fix: the 9 new @biomejs/* lockfile entries resolve to registry.npmmirror.com while every other dependency uses registry.npmjs.org (main has zero npmmirror URLs). With no tracked .npmrc, CI npm ci will honor these URLs and fetch Biome from the mirror, which is slower and can be rate-limited or unreachable from GitHub runners. Regenerate just these entries against npmjs (npm install @biomejs/biome@2.5.4 --registry=https://registry.npmjs.org/) and commit the corrected lockfile.

Recommendation on the shape, worth reconsidering before this becomes the baseline. Measured against the full recommended set, the tree has ~2,300 diagnostics, but 57% is one pure-style rule (noNonNullAssertion = 1,274) and the bulk of the rest is style (useTemplate 137, useExhaustiveDependencies 110, noExplicitAny 60). The genuine correctness debt is about 76 and almost entirely in test files, and it includes one real masked bug: scripts/cu-provider-matrix.test.mjs:89 has a duplicate fixtureState key that line 91 silently overrides, so the test does not exercise its intended input. noDuplicateObjectKeys catches exactly this, and the PR disables it.

So the current shape enforces a lint gate that is green only because the bug-catchers are off, while the formatter is configured but never gated (zero consistency value). Consider inverting it:

• Lint: enforce only the correctness subset (noDuplicateObjectKeys, noUnsafeOptionalChaining, noNonNullAssertedOptionalChain, and similar). Hand-fix the ~76 (mostly tests; fix the duplicate-key bug by hand rather than autofix, which would just delete one key). Drop the pure-style rules outright instead of tracking 64 as debt. useExhaustiveDependencies is a real bug-catcher but needs per-case judgment, so leave it to a follow-up.
• Formatter: land a one-time biome format --write baseline (1,299 files, mechanical) as a standalone commit and gate it with biome format in check mode, or drop the formatter config. Configured-but-ungated buys nothing. If baselining, add the commit to .git-blame-ignore-revs and coordinate timing against the open PRs, since it touches ~1,300 files.

[UncertaintyDeterminesYou4ndMe]

Thanks for the review — both points addressed, plus measurement data that informs the formatter question.

Fixed

Lockfile registry (f34d435f): the 9 @biomejs/* entries were leakage from a local npmmirror config; regenerated against registry.npmjs.org, grep -c npmmirror package-lock.json is now 0.

Correctness-first reshape (ef9102e5), as you suggested:

• The fixtureState duplicate key in cu-provider-matrix.test.mjs is fixed by hand: the flat { blue, red, note } shape is the stale one — normalizeFixture consumes the windowId-keyed shape ({ target: {…} }) and every other test in the file uses it, so the flat entry was dead input, now removed.
• All 74 noUnsafeOptionalChaining sites + the 1 noNonNullAssertedOptionalChain site hand-fixed across 12 test files (drop ?. where presence is already asserted; extend the chain where an undefined still fails the assertion identically; non-null assertion in TS tests where presence is structural).
• noDuplicateObjectKeys, noUnsafeOptionalChaining, noNonNullAssertedOptionalChain are now enforced.
• noNonNullAssertion / useTemplate / noExplicitAny are dropped outright (commented as deliberate, not debt). The rest stay off as "deferred" with counts; useExhaustiveDependencies annotated as a real bug-catcher needing per-case judgment.

Verified locally: lint clean, test:scripts 91/91, runtime 1936 tests 0 fail, desktop 2542/2542, typecheck clean. headless is 960/963 — the 2 failures (harbor-adapter opencode stop runner) reproduce identically on the unmodified baseline and pass in isolation, so they're a local-env flake, not from this diff; CI is the arbiter there.

Formatter: measurement first, then your call

I measured auto-fix coverage on a throwaway worktree with all 64 rules re-enabled (2,441 baseline diagnostics):

pass	diagnostics cleared	files touched
lint --write (safe)	157 (6.4%), 11 rules to zero	81
+ --unsafe	764 (31.3%) cumulative, 21 rules to zero	233
format --write alone	—	1,299 (0.4s)

Two findings worth knowing before anyone runs a real fix pass:

1. Unsafe fixes shift violations: stripping ! for noNonNullAssertion pushed noNonNullAssertedOptionalChain from 1 → 12. Unsafe passes need a build+test gate, not just a lint-clean check.
2. biome lint --write --unsafe hangs indefinitely (~100% CPU) on apps/desktop — every other directory completes in ~5s, and plain format --write is fine everywhere, so it's specific to the unsafe-fix lint pass on that tree. Needs bisection before an unsafe pass runs there; I'll try to minimize it and file it upstream with Biome.

On your two options: I'd take the one-time format baseline + biome format check-mode gate, as a standalone PR you merge at a moment of your choosing (it conflicts with everything open, so timing is yours), with the commit added to .git-blame-ignore-revs. Happy to prep that PR now so it's one click when you want it — or drop the formatter config from this PR if you'd rather not carry an ungated config in the meantime. Which do you prefer?

[Astro-Han]

Thanks, the reshape is exactly right and CI is green. Two things before merge.

Formatter: let's go with (b). Drop the formatter config (and the npm run format script) from this PR so it lands as a clean correctness-lint gate. Bring the formatter back as one atomic follow-up: config plus the one-time biome format --write baseline plus a biome format check-mode CI gate plus the baseline commit in .git-blame-ignore-revs, timed when few PRs are open. Reason not to keep it here: formatter.enabled: true on main gets picked up by format-on-save in Biome-enabled editors, so the 1,299-file reformat leaks piecemeal into unrelated PRs, and with no baseline commit .git-blame-ignore-revs can't undo scattered drift. I'll take you up on the offer to prep that baseline PR for the follow-up.

Linter shape: make it an explicit allowlist rather than recommended minus the disabled rules. Set recommended: false and turn on only the three correctness rules you enforce (noDuplicateObjectKeys, noUnsafeOptionalChaining, noNonNullAssertedOptionalChain). Same green result today, but it inverts the default so nothing re-enters the gate silently, and it drops the 64-rule disabled list entirely instead of carrying it as standing debt. The thing this guards against is ruleset creep: with recommended on, someone later flips a style rule back on (the 1,274 noNonNullAssertion sites are right there) and the gate quietly turns from a correctness gate into a style gate. Add a short comment at the rules block fixing the admission bar, so future additions are a deliberate decision: a rule joins the gate only if it catches a defect rather than a style preference, and the tree is either zero-violation or hand-fixed first. Worth noting there too: skip --unsafe autofix for now, since biome lint --write --unsafe hangs on apps/desktop.

Happy to merge once the formatter config is out and the linter is on the explicit allowlist.

[UncertaintyDeterminesYou4ndMe]

Both pre-merge asks done in de4f00f1.

Formatter removed. Dropped the formatter config and the npm run format script — this PR is now purely a correctness-lint gate. Agreed on the format-on-save leakage risk; it comes back as the atomic baseline follow-up (config + one-time biome format --write + biome format check-mode gate + .git-blame-ignore-revs), which I'll prep and hand you to merge when few PRs are open.

Linter is now an explicit allowlist.preset: "none" (the non-deprecated spelling — recommended: false emits a deprecation notice in 2.5.4), turning on only the three enforced correctness rules. The 64-rule disabled list is gone entirely. Added the admission-bar comment you asked for: a rule joins only if it catches a defect rather than a style preference, and the tree must be zero-violation or hand-fixed first. Note in there too that --unsafe autofix is off the table for now given the apps/desktop hang.

Two verification notes:

• npm run lint is clean with no deprecation output (exit 0).
• Guarded against the "silent no-op gate" failure mode with a negative test: a throwaway probe file with all three violations trips all three rules (Found 3 errors), then removed. So the allowlist is genuinely active, not accidentally empty.

Net diff of this commit: biome.jsonc −99/+32, package.json −1. CI re-running.

[UncertaintyDeterminesYou4ndMe]

Closes part of #415 (config + scripts + CI gate; the full-repo auto-fix is a dedicated follow-up PR per the issue's own sequencing).

What

• Install @biomejs/biome2.5.4 (exact-pinned, root devDependency).
• Add biome.jsonc: formatter matched to the existing dominant style (2-space, 100-col, single quotes, semicolons, trailing commas), linter from the recommended preset, VCS-aware file discovery (useIgnoreFile), and Tailwind CSS 4 directive parsing (the desktop renderer stylesheet uses @import/@source, which the default CSS parser rejects).
• Root scripts: npm run lint (biome lint .) and npm run format (biome format --write .).
• CI: npm run lint added to the typecheck job right after npm ci — fast-fail, needs no build.

Zero source diffs, by design

This PR touches exactly 4 files: package.json, package-lock.json, biome.jsonc, .github/workflows/ci.yml. No source file is reformatted or lint-fixed, so it can't conflict with the currently open PRs.

To make the gate pass on the current tree, 64 recommended rules with pre-existing violations are disabled, each annotated in biome.jsonc with its violation count. Top offenders: noNonNullAssertion (1274), useTemplate (137), useExhaustiveDependencies (110), noAdjacentSpacesInRegex (84), noUnusedImports (74), noUnsafeOptionalChaining (74), noExplicitAny (60). The gate still enforces everything else in the recommended preset from day one, and locks in a ratchet: new violations of the enabled rules fail CI.

biome format . (check-only) reports 1299/1555 files would be reformatted — deferred.

Follow-up (next PR, on request)

1. Run the auto-fixable disabled rules + formatter + import sorting in one mechanical commit.
2. Re-enable rules as their violation counts hit zero; hand-fix the small-count correctness rules (noDuplicateObjectKeys, noUnsafeOptionalChaining, …).

Verification

• npm run lint → exit 0 (Checked 1583 files in ~0.5s).
• npm run typecheck on this branch is unchanged from its merge-base behavior (verified by stash/rerun); the CI job builds before typechecking as before.

[Astro-Han]

The gate is wired correctly (runs on push/PR to main, after npm ci, before build), the config is valid for Biome 2.5.4, the version is pinned exactly, and the ratchet does fail CI on a new violation of an enabled rule. One thing to fix before merge, then a recommendation on the shape.

Must fix: the 9 new @biomejs/* lockfile entries resolve to registry.npmmirror.com while every other dependency uses registry.npmjs.org (main has zero npmmirror URLs). With no tracked .npmrc, CI npm ci will honor these URLs and fetch Biome from the mirror, which is slower and can be rate-limited or unreachable from GitHub runners. Regenerate just these entries against npmjs (npm install @biomejs/biome@2.5.4 --registry=https://registry.npmjs.org/) and commit the corrected lockfile.

Recommendation on the shape, worth reconsidering before this becomes the baseline. Measured against the full recommended set, the tree has ~2,300 diagnostics, but 57% is one pure-style rule (noNonNullAssertion = 1,274) and the bulk of the rest is style (useTemplate 137, useExhaustiveDependencies 110, noExplicitAny 60). The genuine correctness debt is about 76 and almost entirely in test files, and it includes one real masked bug: scripts/cu-provider-matrix.test.mjs:89 has a duplicate fixtureState key that line 91 silently overrides, so the test does not exercise its intended input. noDuplicateObjectKeys catches exactly this, and the PR disables it.

So the current shape enforces a lint gate that is green only because the bug-catchers are off, while the formatter is configured but never gated (zero consistency value). Consider inverting it:

• Lint: enforce only the correctness subset (noDuplicateObjectKeys, noUnsafeOptionalChaining, noNonNullAssertedOptionalChain, and similar). Hand-fix the ~76 (mostly tests; fix the duplicate-key bug by hand rather than autofix, which would just delete one key). Drop the pure-style rules outright instead of tracking 64 as debt. useExhaustiveDependencies is a real bug-catcher but needs per-case judgment, so leave it to a follow-up.
• Formatter: land a one-time biome format --write baseline (1,299 files, mechanical) as a standalone commit and gate it with biome format in check mode, or drop the formatter config. Configured-but-ungated buys nothing. If baselining, add the commit to .git-blame-ignore-revs and coordinate timing against the open PRs, since it touches ~1,300 files.

[UncertaintyDeterminesYou4ndMe]

Thanks for the review — both points addressed, plus measurement data that informs the formatter question.

Fixed

Lockfile registry (f34d435f): the 9 @biomejs/* entries were leakage from a local npmmirror config; regenerated against registry.npmjs.org, grep -c npmmirror package-lock.json is now 0.

Correctness-first reshape (ef9102e5), as you suggested:

• The fixtureState duplicate key in cu-provider-matrix.test.mjs is fixed by hand: the flat { blue, red, note } shape is the stale one — normalizeFixture consumes the windowId-keyed shape ({ target: {…} }) and every other test in the file uses it, so the flat entry was dead input, now removed.
• All 74 noUnsafeOptionalChaining sites + the 1 noNonNullAssertedOptionalChain site hand-fixed across 12 test files (drop ?. where presence is already asserted; extend the chain where an undefined still fails the assertion identically; non-null assertion in TS tests where presence is structural).
• noDuplicateObjectKeys, noUnsafeOptionalChaining, noNonNullAssertedOptionalChain are now enforced.
• noNonNullAssertion / useTemplate / noExplicitAny are dropped outright (commented as deliberate, not debt). The rest stay off as "deferred" with counts; useExhaustiveDependencies annotated as a real bug-catcher needing per-case judgment.

Verified locally: lint clean, test:scripts 91/91, runtime 1936 tests 0 fail, desktop 2542/2542, typecheck clean. headless is 960/963 — the 2 failures (harbor-adapter opencode stop runner) reproduce identically on the unmodified baseline and pass in isolation, so they're a local-env flake, not from this diff; CI is the arbiter there.

Formatter: measurement first, then your call

I measured auto-fix coverage on a throwaway worktree with all 64 rules re-enabled (2,441 baseline diagnostics):

pass	diagnostics cleared	files touched
lint --write (safe)	157 (6.4%), 11 rules to zero	81
+ --unsafe	764 (31.3%) cumulative, 21 rules to zero	233
format --write alone	—	1,299 (0.4s)

Two findings worth knowing before anyone runs a real fix pass:

1. Unsafe fixes shift violations: stripping ! for noNonNullAssertion pushed noNonNullAssertedOptionalChain from 1 → 12. Unsafe passes need a build+test gate, not just a lint-clean check.
2. biome lint --write --unsafe hangs indefinitely (~100% CPU) on apps/desktop — every other directory completes in ~5s, and plain format --write is fine everywhere, so it's specific to the unsafe-fix lint pass on that tree. Needs bisection before an unsafe pass runs there; I'll try to minimize it and file it upstream with Biome.

On your two options: I'd take the one-time format baseline + biome format check-mode gate, as a standalone PR you merge at a moment of your choosing (it conflicts with everything open, so timing is yours), with the commit added to .git-blame-ignore-revs. Happy to prep that PR now so it's one click when you want it — or drop the formatter config from this PR if you'd rather not carry an ungated config in the meantime. Which do you prefer?

[Astro-Han]

Thanks, the reshape is exactly right and CI is green. Two things before merge.

Formatter: let's go with (b). Drop the formatter config (and the npm run format script) from this PR so it lands as a clean correctness-lint gate. Bring the formatter back as one atomic follow-up: config plus the one-time biome format --write baseline plus a biome format check-mode CI gate plus the baseline commit in .git-blame-ignore-revs, timed when few PRs are open. Reason not to keep it here: formatter.enabled: true on main gets picked up by format-on-save in Biome-enabled editors, so the 1,299-file reformat leaks piecemeal into unrelated PRs, and with no baseline commit .git-blame-ignore-revs can't undo scattered drift. I'll take you up on the offer to prep that baseline PR for the follow-up.

Linter shape: make it an explicit allowlist rather than recommended minus the disabled rules. Set recommended: false and turn on only the three correctness rules you enforce (noDuplicateObjectKeys, noUnsafeOptionalChaining, noNonNullAssertedOptionalChain). Same green result today, but it inverts the default so nothing re-enters the gate silently, and it drops the 64-rule disabled list entirely instead of carrying it as standing debt. The thing this guards against is ruleset creep: with recommended on, someone later flips a style rule back on (the 1,274 noNonNullAssertion sites are right there) and the gate quietly turns from a correctness gate into a style gate. Add a short comment at the rules block fixing the admission bar, so future additions are a deliberate decision: a rule joins the gate only if it catches a defect rather than a style preference, and the tree is either zero-violation or hand-fixed first. Worth noting there too: skip --unsafe autofix for now, since biome lint --write --unsafe hangs on apps/desktop.

Happy to merge once the formatter config is out and the linter is on the explicit allowlist.

[UncertaintyDeterminesYou4ndMe]

Both pre-merge asks done in de4f00f1.

Formatter removed. Dropped the formatter config and the npm run format script — this PR is now purely a correctness-lint gate. Agreed on the format-on-save leakage risk; it comes back as the atomic baseline follow-up (config + one-time biome format --write + biome format check-mode gate + .git-blame-ignore-revs), which I'll prep and hand you to merge when few PRs are open.

Linter is now an explicit allowlist.preset: "none" (the non-deprecated spelling — recommended: false emits a deprecation notice in 2.5.4), turning on only the three enforced correctness rules. The 64-rule disabled list is gone entirely. Added the admission-bar comment you asked for: a rule joins only if it catches a defect rather than a style preference, and the tree must be zero-violation or hand-fixed first. Note in there too that --unsafe autofix is off the table for now given the apps/desktop hang.

Two verification notes:

• npm run lint is clean with no deprecation output (exit 0).
• Guarded against the "silent no-op gate" failure mode with a negative test: a throwaway probe file with all three violations trips all three rules (Found 3 errors), then removed. So the allowlist is genuinely active, not accidentally empty.

Net diff of this commit: biome.jsonc −99/+32, package.json −1. CI re-running.