chore(repo): upgrade to Biome 2.5.7 and make the catalog authoritative

[evk-soft]

What lands and why

Biome 2.5.6 → 2.5.7, completing foundation phase F2. F2 shipped TypeScript 7 alone because the
repository's own minimumReleaseAge: 4320 still rejected 2.5.7 at the time. The delay expired and the
bump is now taken.

Waiting it out was chosen over the escape hatch the policy itself offers — a reviewed
minimumReleaseAgeExclude entry — because the delay's first real encounter is when weakening it would
be least defensible.

Raising the catalog alone was not enough

The bump exposed that the catalog was not actually single-sourcing the toolchain. autoInstallPeers is
pnpm 11's default and appears in the lockfile's settings: block, not in any file this repository
wrote. Each config workspace declares its tool as a peer dependency with a wide range, so pnpm
satisfied that peer by resolving it separately from the catalog — and having already found a
satisfying version, it had no reason to move:

workspace	declared peer	what pnpm actually installed
configs/biome-config	^2.3.11	Biome 2.5.6, while the root ran 2.5.7
configs/typescript-config	^6.0.0 || ^7.0.0	TypeScript 6.0.3, while the root ran 7.0.2

The second row was already on main. F2 was titled "upgrade to TypeScript 7", yet
pnpm -C configs/typescript-config exec tsc --version answered Version 6.0.3, and 24 MB of the old
compiler sat in the virtual store. Neither workspace defines a script, so nothing executed the stale
tool — which is why it went unnoticed, and precisely the trap the first script added in either
directory would have hit.

Fixed by declaring each peer as an explicit catalog: devDependency in the same package.json, so
pnpm satisfies the peer from the catalog instead of resolving a second copy. autoInstallPeers: false
was rejected as the alternative: it changes resolution for every dependency in the workspace in order
to fix two known declarations. A devDependency is invisible to consumers of a published package, so
neither manifest changes its public contract — unlike F2's peer-range widening, which did.

packages/ai-tooling/README.md

Line 27 claimed "The workspace pins pnpm 10.28.0, TypeScript 6.0.3, Biome 2.5.6" — all three
already false. It went stale exactly because F1 and F2 were forbidden to touch packages/ai-tooling,
and no phase manifest lists the file, so no scheduled work would ever have corrected it. README.md is
in the package's files array, so a publish would have shipped the wrong claim.

Rather than restate three versions and set up the same drift again, the line now names the catalog
block as the single source and keeps only the two facts that do not drift: engines.node and this
package's own literal pins. Same reasoning F1 applied when it stripped the Biome version from twelve
$schema URLs.

This is the first deliberate change to the approved Phase 1 tree made outside a Stage 1 phase,
authorised by the owner. Safe against the gates for reasons that were checked, not assumed: the
--phase 1 --tree content digest is pinned nowhere in the repository, no test asserts README bytes
(only its presence in files and in the tarball), and the Phase 2 plan asserts nothing about it.

Plan documents

Four of the six Stage 1 plan documents change, not the six F2's Task 3 listed: the Phase 2 and Phase 4
plans never named a Biome version. Nine 2.5.6 occurrences, replaced byte-for-byte — file lengths are
unchanged and no CR was introduced.

How it was verified

Every command below exits 0 against the committed tree 5c0bd65.

pnpm install --frozen-lockfile --ignore-scripts
pnpm check                    # 121 unit/package/security + 7 integration = 128 tests, pack:check included
pnpm run check:structure      # 5 workspaces no cycle; 37 source files no boundary escape
pnpm run check:supply-chain   # 0 advisories; 86 packages 0 licence conflicts
pnpm run changelog:check      # 0 fragments valid
node packages/ai-tooling/scripts/check-stage1-artifacts.mjs --phase 1 --tree
git diff --check

Three claims were measured rather than assumed.

The delay is enforced live, not cached. pnpm install prints
Lockfile passes supply-chain policies (verified 23h ago), which invites the assumption that a recent
pass short-circuits the check — and 23 hours earlier 2.5.7 was still too young. It does not
short-circuit: raising the threshold to 5000 minutes made the very same lockfile fail with
ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION, naming all nine @biomejs/* entries and printing the
computed cutoff. That failed run left pnpm-lock.yaml byte-identical, SHA-256
85876dbc5c4d6aa630bad8bef6ebc036fc0a7ec4633b27dc2a65dcca44d4b26a.

The binding publish time is 13:28 UTC, not 13:23. The delay applies to all nine @biomejs/*
entries, not to the meta-package alone, and the last platform binary — @biomejs/cli-linux-arm64@2.5.7
— was published 2026-08-04 13:28:24 UTC.

Biome 2.5.7 rewrites nothing. Read-only first, as F2 Task 2 Step 2 requires:
biome check packages/ai-tooling configs/ai exits 0 over 56 files, and biome check --write . over
the whole repository reports No fixes applied for all 85. The only change under
packages/ai-tooling is the hand-edited README.md; nothing was formatter-driven.

Duplicate removal confirmed. pnpm install reports Packages: -3, the lockfile now holds exactly
one version of each tool, and all four probes agree — root and both configs answer Biome 2.5.7 and
tsc Version 7.0.2.

Deliberately not included

check-licenses.mjs counts orphans in the virtual store. While reconciling package counts, the
licence guard reported 89 where the lockfile implied 86. scripts/check-licenses.mjs:57 enumerates
node_modules/.pnpm — the physical virtual store — rather than the lockfile, and an incremental
pnpm install unlinked the superseded @biomejs/biome@2.5.6, @biomejs/cli-win32-x64@2.5.6 and
typescript@6.0.3 without deleting their directories. So the guard licence-checked three packages
nothing referenced. Consequences: the printed count drifts upward across incremental installs, a local
run and a CI run of the same commit disagree, and a package long gone from the lockfile can still fail
the build on its licence. A clean reinstall gives the honest figure — 86 here against 87 for main,
the difference being exactly the removed typescript@6.0.3. Recorded in PROGRESS.md and left for a
separate decision, because changing what a supply-chain guard reads is its own call.

No changelog fragment. Pure chore toolchain work with no shipped behaviour change, and the
changelog.d/ directory stays dormant until Stage 1 Phase 5 completes — no Stage 1 phase manifest
lists it.

No Stage 1 product code. The Stage 1 Phase 1 deferred items and Phase 2 are separate work.