[dependabot]

Includes the repaired #246 and #248 commits so their overlapping SDK lockfile edits are reconciled in one merge. Node types remain on 22.20.5, and the SDK runs Vitest 5.0.3 with two workers. Main has been merged into all three PR branches.

Migrates Biome from 1.9 to 2.5.15 so lint and commit hooks work with the new configuration schema and import organizer. Preserves tabs, 120-column formatting, existing exclusions, the recommended rule preset, and the explicit unused-import/variable and non-null assertion settings. Warnings now fail CI and hooks, preserving enforcement after severity changes in Biome 2.

Applies the new import/export ordering and formatting. Adds an accessible title to the banner SVG and removes an unused callback return in the SDK test helper. Narrow suppressions cover seven intentional Bash interpolation strings without changing test inputs. An AST comparison of the changed JavaScript/TypeScript confirmed no other logic changes and preserved side-effect import ordering.

Resolved the main merge conflicts while retaining all previously merged dependencies and the just-bash patch. pnpm lint:fix and type checking pass. A real warning fixture confirmed warnings fail the gate. Full repository/runtime verification passed before merge.

The event-loop monitor negative guard now waits for a real native histogram sample and a measured stall before flushing its logging window. Only the JavaScript interval is controlled; perf_hooks, Date, the busy loop, and timeouts remain real. The original measured-delay assertion and alert thresholds are preserved. Before the fix, isolated full verification failed with "expected 10 to be greater than or equal to 100"; the fixed test passed five consecutive focused runs. Full verification passed with this test synchronization fix.

Final validation: pnpm check, pnpm security:audit, and pnpm verify:architecture all passed sequentially on a fresh GitHub runner. Full proof and downloadable evidence. The validation branch (#255) differs only by its temporary workflow, which is excluded from this merge. Normal CI is also green.

Local verification attempts reported a distributed-lock timing failure, two 15-second worker-test timeouts, and a reader-latency assertion failure. The corresponding complete unchanged suites passed on the fresh runner. The audit passes the high-severity gate with the existing moderate sprintf-js advisory through the unchanged just-bash dependency.

Merge with a merge commit to preserve the repaired #246 and #248 heads; all three branches contain current main. No package versions or CHANGELOG.md were bumped.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 72884b3b-9c7f-436f-b20c-c34560b51a67

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[dependabot]

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

[Hazzng]

Reviewed the dependency repairs, main merges, and SDK lockfile reconciliation. Full sequential pnpm check, security audit, and expanded architecture/runtime verification passed on the final combined code: https://github.com/Hazzng/sql-fs/actions/runs/38496142358. The proof branch differs only by its temporary workflow. Node types stay on Node 22, SDK Vitest 5 uses two workers, and Biome 2 retains formatting/exclusion/rule coverage with warnings enforced. The event-loop test synchronization preserves the real stall, measured-delay assertion, and thresholds. Original PR heads are preserved for a merge commit.