feat: follow the 2026-10-14 JS runtime ruling; re-sync the provisioning engine 0.6.0

.clinerules

@@ -24,13 +24,15 @@
 # Lean: sorry
 # Rust: transmute (unless FFI with // SAFETY: comment)
 
-# JS RUNTIME — Bun (standards/3-practice/LANGUAGE-POLICY.adoc section 1)
-# 1. Bun    the JavaScript runtime: package.json + bun.lock, run with bun / bunx
-# 2. pnpm   only where an upstream toolchain needs a node_modules layout
-# 3. npm    last resort; permitted, never preferred — a noted decision
-# Deno is RETIRED, not grandfathered (owner ruling 2026-08-26, standards#655):
-# existing Deno projects migrate to Bun. TypeScript and ReScript are banned
-# too; they migrate to AffineScript. Use plain JavaScript where JS is needed.
+# JS RUNTIME — Bun first (standards/3-practice/LANGUAGE-POLICY.adoc sections 1.3-1.4)
+# 1. Bun    tier 1: package.json + bun.lock, run with bun / bunx
+# 2. Deno   tier 2: permitted; runs the same package.json scripts (deno task)
+# 3. pnpm   tier 3
+# 4. npm    last resort; permitted, never preferred; keeps no lock
+# One package.json carries every runtime's lock (bun.lock, deno.lock,
+# pnpm-lock.yaml); `js-runtimes regen` writes all three (owner ruling
+# 2026-10-14). TypeScript and ReScript are banned; they migrate to
+# AffineScript. Use plain JavaScript where JS is needed.
 
 # BANNED LANGUAGES
 # Go -> Rust

.cursorrules

@@ -22,13 +22,15 @@
 # Lean: sorry
 # Rust: transmute (unless FFI with // SAFETY: comment)
 
-# JS RUNTIME — Bun (standards/3-practice/LANGUAGE-POLICY.adoc section 1)
-# 1. Bun    the JavaScript runtime: package.json + bun.lock, run with bun / bunx
-# 2. pnpm   only where an upstream toolchain needs a node_modules layout
-# 3. npm    last resort; permitted, never preferred — a noted decision
-# Deno is RETIRED, not grandfathered (owner ruling 2026-08-26, standards#655):
-# existing Deno projects migrate to Bun. TypeScript and ReScript are banned
-# too; they migrate to AffineScript. Use plain JavaScript where JS is needed.
+# JS RUNTIME — Bun first (standards/3-practice/LANGUAGE-POLICY.adoc sections 1.3-1.4)
+# 1. Bun    tier 1: package.json + bun.lock, run with bun / bunx
+# 2. Deno   tier 2: permitted; runs the same package.json scripts (deno task)
+# 3. pnpm   tier 3
+# 4. npm    last resort; permitted, never preferred; keeps no lock
+# One package.json carries every runtime's lock (bun.lock, deno.lock,
+# pnpm-lock.yaml); `js-runtimes regen` writes all three (owner ruling
+# 2026-10-14). TypeScript and ReScript are banned; they migrate to
+# AffineScript. Use plain JavaScript where JS is needed.
 
 # BANNED LANGUAGES
 # Go -> use Rust

.github/copilot-instructions.md

@@ -43,13 +43,17 @@ that can do the job:
 1. **Bun** — default for all new work. Runs compiled ESM/JS directly, no bundler
    step. Uses an npm-compatible `package.json` plus `bun.lock`; both are
    expected, not anti-patterns.
-2. **pnpm** — only where an upstream toolchain requires `node_modules`.
-3. **npm** — last resort. Permitted, never preferred; a deliberate, noted choice.
-
-**Deno is being removed**, not grandfathered. Owner ruling 2026-08-26: *"deno is
-to go and bun is the way we are going, put it first everywhere unless not
-possible and explain why if not."* Existing Deno projects migrate to Bun; where
-Bun genuinely cannot be used, document the reason in the repo.
+2. **Deno** — permitted (tier 2). Deno 2 reads the same `package.json` and runs
+   its scripts with `deno task`.
+3. **pnpm** — tier 3.
+4. **npm** — last resort. Permitted, never preferred; it keeps no lock
+   (`package-lock.json` stays refused).
+
+**One manifest, every runtime** (owner ruling 2026-10-14, `LANGUAGE-POLICY.adoc`
+§1.3–§1.4). `package.json` is the only manifest and carries every runtime's lock:
+`bun.lock`, `deno.lock` and `pnpm-lock.yaml`. `js-runtimes regen` is the only
+writer; run it after every `bun add`. Governance checks each runtime against its
+lock. The ruling supersedes the 2026-08-26 one that removed Deno.
 
 **TypeScript is not the language for new application code — AffineScript is.**
 `LANGUAGE-POLICY.adoc` §1.2, ruled 2026-08-25, separates two questions the older
@@ -64,7 +68,6 @@ migration destination is AffineScript.
 - No Go (use Rust)
 - No Python (use Julia or Rust)
 - No Nix (use Guix)
-- No Deno for new work — being removed estate-wide; use Bun (owner ruling 2026-08-26)
 - No ReScript (`LANGUAGE-POLICY.adoc` §3) — migrate to AffineScript
 
 ## Containers

.github/pull_request_template.md

@@ -21,7 +21,7 @@ Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
 - [ ] Tests pass (`just test` or equivalent)
 - [ ] Code is formatted (`just fmt` or equivalent)
 - [ ] Linter is clean (no new warnings or errors)
-- [ ] No banned language patterns (no Python, Go, TypeScript, Deno or ReScript; JavaScript runs on Bun)
+- [ ] No banned language patterns (no Python, Go, TypeScript or ReScript; JavaScript runs Bun > Deno > pnpm > npm)
 - [ ] No `unsafe` blocks without `// SAFETY:` comments
 - [ ] No banned functions (`believe_me`, `unsafeCoerce`, `Obj.magic`, `Admitted`, `sorry`)
 - [ ] SPDX license headers present on all new/modified source files

.github/workflows/actions.lock

@@ -1,4 +1,4 @@
 # This file is machine-generated by `gh actions-lock`.
 # Do not edit by hand; run `gh actions-lock` to update.
 # Docs: https://gh.io/actions-lockfile
 version: 'v0.0.3'
@@ -31,13 +31,13 @@
     '.github/workflows/estate-rules.yml':
         - 'actions/checkout@v7.0.1'
     '.github/workflows/governance.yml':
-        - 'hyperpolymath/standards@ae36881b5ff4b469fb904b66542ac226a15107f3'
+        - 'hyperpolymath/standards@934b879f6068295e42dac20d80e010d555ebec82'
     '.github/workflows/groove-check.yml':
         - 'actions/checkout@v7.0.1'
     '.github/workflows/guix-policy.yml':
         - 'actions/checkout@v7.0.1'
     '.github/workflows/hypatia-scan.yml':
-        - 'hyperpolymath/standards@ae36881b5ff4b469fb904b66542ac226a15107f3'
+        - 'hyperpolymath/standards@934b879f6068295e42dac20d80e010d555ebec82'
     '.github/workflows/k9-validate.yml':
         - 'actions/checkout@v7.0.1'
         - 'hyperpolymath/k9-ecosystem@main'
@@ -47,7 +47,7 @@
     '.github/workflows/main-estate-audit.yml':
         - 'hyperpolymath/cicd-suite@55556cf5ba71ba744695861503c13148d3915a5d'
     '.github/workflows/mirror.yml':
-        - 'hyperpolymath/standards@ae36881b5ff4b469fb904b66542ac226a15107f3'
+        - 'hyperpolymath/standards@934b879f6068295e42dac20d80e010d555ebec82'
     '.github/workflows/ossf-best-practices.yml':
         - 'actions/checkout@v7.0.1'
     '.github/workflows/pages.yml':
@@ -72,11 +72,11 @@
     '.github/workflows/runtime-policy.yml':
         - 'actions/checkout@v7.0.1'
     '.github/workflows/rust-ci.yml':
-        - 'hyperpolymath/standards@ae36881b5ff4b469fb904b66542ac226a15107f3'
+        - 'hyperpolymath/standards@934b879f6068295e42dac20d80e010d555ebec82'
     '.github/workflows/scorecard.yml':
-        - 'hyperpolymath/standards@ae36881b5ff4b469fb904b66542ac226a15107f3'
+        - 'hyperpolymath/standards@934b879f6068295e42dac20d80e010d555ebec82'
     '.github/workflows/secret-scanner.yml':
-        - 'hyperpolymath/standards@ae36881b5ff4b469fb904b66542ac226a15107f3'
+        - 'hyperpolymath/standards@934b879f6068295e42dac20d80e010d555ebec82'
     '.github/workflows/security-policy.yml':
         - 'actions/checkout@v7.0.1'
     '.github/workflows/sonarqube.yml':
@@ -160,6 +160,11 @@
         repo_id: 496012378
         uses:
             - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
+    'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed':
+        ref: '22d081ff2d3a40755e97629de92e3bcbfa7cf2ed'
+        commit: 'sha1-22d081ff2d3a40755e97629de92e3bcbfa7cf2ed'
+        owner_id: 42048915
+        repo_id: 356423100
     'dependabot/fetch-metadata@v3.1.0':
         ref: 'v3.1.0'
         commit: 'sha1-25dd0e34f4fe68f24cc83900b1fe3fe149efef98'
@@ -238,28 +243,35 @@
         commit: 'sha1-c1c9fa07992a02c1fd3d67a0dc1b08cccb852aef'
         owner_id: 6759885
         repo_id: 1352485172
-    'hyperpolymath/standards@ae36881b5ff4b469fb904b66542ac226a15107f3':
-        ref: 'ae36881b5ff4b469fb904b66542ac226a15107f3'
-        commit: 'sha1-ae36881b5ff4b469fb904b66542ac226a15107f3'
+    'hyperpolymath/standards@934b879f6068295e42dac20d80e010d555ebec82':
+        ref: '934b879f6068295e42dac20d80e010d555ebec82'
+        commit: 'sha1-934b879f6068295e42dac20d80e010d555ebec82'
         owner_id: 6759885
         repo_id: 1116521501
         uses:
             - 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
             - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
             - 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9'
+            - 'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed'
             - 'dtolnay/rust-toolchain@e2a55d2ffb04f378e9626c28d38b36d230d1e12f'
             - 'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393'
             - 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124'
             - 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63'
             - 'goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406'
             - 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc'
+            - 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6'
             - 'swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6'
             - 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555'
     'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc':
         ref: '2d1146689b8cda280b9bc96326124645441f03bc'
         commit: 'sha1-2d1146689b8cda280b9bc96326124645441f03bc'
         owner_id: 67707773
         repo_id: 421101922
+    'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6':
+        ref: '0c5077e51419868618aeaa5fe8019c62421857d6'
+        commit: 'sha1-0c5077e51419868618aeaa5fe8019c62421857d6'
+        owner_id: 108928776
+        repo_id: 512644635
     'oven-sh/setup-bun@v2.2.0':
         ref: 'v2.2.0'
         commit: 'sha1-0c5077e51419868618aeaa5fe8019c62421857d6'

.github/workflows/governance.yml

@@ -18,4 +18,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@ae36881b5ff4b469fb904b66542ac226a15107f3
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@934b879f6068295e42dac20d80e010d555ebec82

.github/workflows/hypatia-scan.yml

@@ -27,4 +27,4 @@ permissions:
 
 jobs:
   hypatia:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@ae36881b5ff4b469fb904b66542ac226a15107f3
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@934b879f6068295e42dac20d80e010d555ebec82

.github/workflows/mirror.yml

@@ -13,7 +13,7 @@ permissions:
   contents: read
 jobs:
   mirror:
-    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@ae36881b5ff4b469fb904b66542ac226a15107f3
+    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@934b879f6068295e42dac20d80e010d555ebec82
     # Explicit secrets map — no `secrets: inherit` (Hypatia WH008, alert #131).
     # All seven are the callee's complete optional contract (standards
     # mirror-reusable.yml@da2c748); behaviour is unchanged, future secrets

.github/workflows/runtime-policy.yml

@@ -2,20 +2,27 @@
 # SPDX-License-Identifier: MPL-2.0
 # Runtime and package-manager policy check.
 #
-# Authority: hyperpolymath/standards LANGUAGE-POLICY.adoc §1.
-# Ordering:  Bun (1st) > pnpm (2nd) > npm (last resort). Deno is RETIRED, not a tier.
+# Authority: hyperpolymath/standards LANGUAGE-POLICY.adoc §1.3–§1.4 (owner ruling
+# 2026-10-14). Ordering: Bun (1st) > Deno (2nd) > pnpm (3rd) > npm (last resort).
+#
+# One manifest, every runtime: package.json is the only manifest, and
+# `js-runtimes regen` writes bun.lock, deno.lock and pnpm-lock.yaml from it. Those
+# three locks are ONE dependency graph locked three ways, not three toolchains;
+# governance's "JS runtimes" jobs check each one against package.json.
 #
 # REPLACES npm-bun-blocker.yml, which failed any build carrying `bun.lockb` with
 # the message "npm/bun artifacts detected. Use Deno instead." That gate blocked
 # what is now the FIRST-choice runtime and mandated the second. It was present in
 # 55 repositories.
 #
 # What this fails on, deliberately:
-#   MIXED TOOLCHAINS -- two different package managers' lockfiles in one repo.
+#   MIXED TOOLCHAINS -- an npm package-lock.json next to the js-runtimes locks.
 #   That is real, actionable drift: two dependency graphs that can disagree.
 # What it does NOT fail on:
-#   Using bun, pnpm or npm. Deno is RETIRED (2026-08-26). npm is LAST but PERMITTED; the check reports
-#   the tier in use so drift is visible without blocking legitimate work.
+#   The js-runtimes locks together, or any one runtime alone. npm is LAST but
+#   PERMITTED; a deno.json is a notice (Deno is tier 2, LANGUAGE-POLICY §1.3).
+#   The check reports the tiers in use so drift is visible without blocking
+#   legitimate work.
 name: Runtime Policy
 on:
   push:
@@ -43,30 +50,33 @@ jobs:
         run: |
           set -euo pipefail
 
-          bun=0; deno=0; pnpm=0; npm=0
+          bun=0; deno=0; pnpm=0; npm=0; deno_cfg=0
           [ -f bun.lockb ] || [ -f bun.lock ]                 && bun=1  || true
-          [ -f deno.lock ] || [ -f deno.json ] || [ -f deno.jsonc ] && deno=1 || true
+          [ -f deno.lock ]                                    && deno=1 || true
+          [ -f deno.json ] || [ -f deno.jsonc ]               && deno_cfg=1 || true
           [ -f pnpm-lock.yaml ]                               && pnpm=1 || true
           [ -f package-lock.json ]                            && npm=1  || true
 
-          total=$((bun + deno + pnpm + npm))
+          # bun, deno and pnpm locks are the one graph js-runtimes regen writes.
+          regen=$((bun + deno + pnpm))
 
-          if [ "$total" -eq 0 ]; then
-            echo "::notice::No JS/TS package manager in use — nothing to check."
+          if [ $((regen + npm + deno_cfg)) -eq 0 ]; then
+            echo "::notice::No JS package manager in use — nothing to check."
             exit 0
           fi
 
-          # Report the tier actually in use (LANGUAGE-POLICY.adoc §1).
+          # Report the tiers actually in use (LANGUAGE-POLICY.adoc §1).
           [ "$bun"  -eq 1 ] && echo "Bun   — tier 1 (preferred)"
-          [ "$deno" -eq 1 ] && echo "::warning::Deno lockfile/config present. Deno is BEING REMOVED, not grandfathered (owner ruling 2026-08-26, canon standards#655). Migrate to Bun — package.json + bun.lock. This is a warning rather than an error only while the estate migration is in flight; it escalates to an error when that completes."
+          [ "$deno" -eq 1 ] && echo "Deno  — tier 2"
+          [ "$deno_cfg" -eq 1 ] && echo "::notice::A deno.json is authored for Deno (tier 2, permitted; notice only, LANGUAGE-POLICY.adoc §1.3). Keep scripts in package.json so Bun runs them too."
           [ "$pnpm" -eq 1 ] && echo "pnpm  — tier 3"
-          [ "$npm"  -eq 1 ] && echo "::warning::npm lockfile present. npm is tier 4, the last resort — permitted, never preferred. See LANGUAGE-POLICY.adoc §1."
+          [ "$npm"  -eq 1 ] && echo "::warning::npm lockfile present. npm is tier 4, the last resort — permitted, never preferred, and it keeps no lock: package-lock.json is refused (standards#67). See LANGUAGE-POLICY.adoc §1.4."
 
-          if [ "$total" -gt 1 ]; then
-            echo "::error::Mixed toolchains: $total package managers have lockfiles in this repository."
-            echo "Two dependency graphs that can disagree is real drift. Pick one — preferring the"
-            echo "highest tier present — and delete the others' lockfiles."
+          if [ "$npm" -eq 1 ] && [ "$regen" -gt 0 ]; then
+            echo "::error::Mixed toolchains: package-lock.json sits next to the js-runtimes locks."
+            echo "Two dependency graphs that can disagree is real drift. Delete package-lock.json"
+            echo "and let 'js-runtimes regen' write bun.lock, deno.lock and pnpm-lock.yaml."
             exit 1
           fi
 
-          echo "✅ Single package manager in use."
+          echo "✅ One dependency graph in use."

.github/workflows/rust-ci.yml

@@ -16,4 +16,4 @@ permissions:
   contents: read
 jobs:
   rust-ci:
-    uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@ae36881b5ff4b469fb904b66542ac226a15107f3
+    uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@934b879f6068295e42dac20d80e010d555ebec82

.github/workflows/scorecard.yml

@@ -16,7 +16,7 @@ permissions:
 
 jobs:
   scorecard:
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@ae36881b5ff4b469fb904b66542ac226a15107f3
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@934b879f6068295e42dac20d80e010d555ebec82
     # Reusable called-workflow permissions are CAPPED by the caller's grants;
     # without security-events: write here the scorecard SARIF upload fails with
     # startup_failure (hypatia WF018). id-token: write enables OIDC publish.

.github/workflows/secret-scanner.yml

@@ -26,4 +26,4 @@ jobs:
     # is therefore the cap GitHub applies to the called workflow.
     permissions:
       contents: read
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@ae36881b5ff4b469fb904b66542ac226a15107f3
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@934b879f6068295e42dac20d80e010d555ebec82

.github/workflows/workflow-linter.yml

@@ -67,7 +67,7 @@ jobs:
           echo "All workflows have permissions declared"
 
       # Bun is the estate's first-choice runtime (LANGUAGE-POLICY.adoc §1:
-      # Bun > pnpm > npm; Deno retired). Tag form
+      # Bun > Deno > pnpm > npm). Tag form
       # matches every other ref in this repo and is resolved by actions.lock.
       - name: Set up Bun
         uses: oven-sh/setup-bun@v2.2.0

.machine_readable/arrival-pack/arrival-pack.ncl

@@ -69,8 +69,8 @@ The descriptive family (working name *descriptiles*) describes what-is; the **co
 - **Before you invent, rename, or consolidate anything: STOP and check the map + IS-NOT.**
 
 ## Estate language policy (overridable per-repo via AGENTIC)
-Deny: **Nix, Python, Go, TypeScript, Deno, ReScript, AGPL**. (Guix, not Nix.)
-JavaScript runtime: **Bun** (package.json + bun.lock) > pnpm > npm (last resort, permitted). Deno is retired, not grandfathered (owner ruling 2026-08-26, standards#655): existing Deno projects migrate to Bun.
+Deny: **Nix, Python, Go, TypeScript, ReScript, AGPL**. (Guix, not Nix.)
+JavaScript runtime: **Bun** > Deno > pnpm > npm (last resort, permitted), from one `package.json` that carries every runtime's lock (`bun.lock`, `deno.lock`, `pnpm-lock.yaml`), all written by `js-runtimes regen` (owner ruling 2026-10-14, standards LANGUAGE-POLICY §1.3–§1.4). Deno is permitted again; `package-lock.json` stays refused.
 Use plain JavaScript when this tooling is needed. TypeScript and ReScript migrate to AffineScript.
 
 ## Asking the owner

.windsurfrules

@@ -24,13 +24,15 @@
 # Lean: sorry
 # Rust: transmute (unless FFI with // SAFETY: comment)
 
-# JS RUNTIME — Bun (standards/3-practice/LANGUAGE-POLICY.adoc section 1)
-# 1. Bun    the JavaScript runtime: package.json + bun.lock, run with bun / bunx
-# 2. pnpm   only where an upstream toolchain needs a node_modules layout
-# 3. npm    last resort; permitted, never preferred — a noted decision
-# Deno is RETIRED, not grandfathered (owner ruling 2026-08-26, standards#655):
-# existing Deno projects migrate to Bun. TypeScript and ReScript are banned
-# too; they migrate to AffineScript. Use plain JavaScript where JS is needed.
+# JS RUNTIME — Bun first (standards/3-practice/LANGUAGE-POLICY.adoc sections 1.3-1.4)
+# 1. Bun    tier 1: package.json + bun.lock, run with bun / bunx
+# 2. Deno   tier 2: permitted; runs the same package.json scripts (deno task)
+# 3. pnpm   tier 3
+# 4. npm    last resort; permitted, never preferred; keeps no lock
+# One package.json carries every runtime's lock (bun.lock, deno.lock,
+# pnpm-lock.yaml); `js-runtimes regen` writes all three (owner ruling
+# 2026-10-14). TypeScript and ReScript are banned; they migrate to
+# AffineScript. Use plain JavaScript where JS is needed.
 
 # BANNED LANGUAGES
 # Go -> Rust