docs(npm-to-deno): declare migration substantially complete (closeout #253, #275)

.claude/CLAUDE.md

@@ -167,7 +167,7 @@ Existing pre-2026-05-25 `.res`/`.resi` outside these carve-outs is grandfathered
 
 The hyperpolymath "npm banned" policy (2026-05-25) has the following approved exemptions on the hypatia rule `cicd_rules/nodejs_detected` (matches `package-lock.json`).
 
-In-flight migration tracked under `hyperpolymath/standards#253` (172 manifests across the estate; see `project_estate_npm_to_deno_2026_05_28.md`).
+Migration substantially complete 2026-05-31 under umbrella `hyperpolymath/standards#253` (172 manifests at campaign start; all seven STEP issues #261/#262/#265/#268/#270/#273/#275 closed; ~22 physical-migration PRs landed plus three named-bucket audits closed `SUBSTANTIALLY DONE`; per-repo follow-up trackers cover the residual longtail). See `project_estate_npm_to_deno_2026_05_28.md`. Per-repo recipe: `docs/migrations/npm-to-deno-template/MIGRATION.md`.
 
 | Path / Pattern | Class | Rationale | Unblock condition |
 |---|---|---|---|

docs/JS-RUNTIME-POLICY.adoc

@@ -1,16 +1,32 @@
 // SPDX-License-Identifier: PMPL-1.0-or-later
 = JS Runtime & Package Management Policy
-:revdate: 2026-05-19
+:revdate: 2026-05-31
 :status: ACTIVE
 :issue-67: hyperpolymath/standards#67
 :issue-68: hyperpolymath/standards#68
+:issue-253: hyperpolymath/standards#253
 
 This document is the canonical estate-wide policy for JavaScript/TypeScript
 runtimes and package management.  It is referenced by
 `governance-reusable.yml` (enforcement) and the canonical template
 `.gitignore` files (rsr-template-repo, v3-templater).
 
-See also: `scripts/purge-node-modules.sh` (remediation utility).
+See also: `scripts/purge-node-modules.sh` (remediation utility) and
+`docs/migrations/npm-to-deno-template/MIGRATION.md` (per-repo recipe).
+
+[NOTE]
+====
+*npm → Deno migration: substantially complete 2026-05-31.* Umbrella
+{issue-253} and the seven STEP issues (#261/#262/#265/#268/#270/#273/#275)
+all closed. ~22 physical-migration PRs landed in STEP 3 plus
+named-bucket audits closed `SUBSTANTIALLY DONE` for STEPS 4/5/6/7.
+Residual longtail repos (`flat-mate`, `accessibility-everywhere`,
+`kaldor-iiot`, `excel-economic-numbers-tool`, `ubicity`, a handful of
+heavier Vite/Vitest/Jest/Express stacks) are tracked as per-repo
+follow-ups rather than blocking the umbrella close. The hypatia rule
+`cicd_rules/nodejs_detected` remains armed with nine carve-out classes
+(see `.claude/CLAUDE.md §npm Exemptions`).
+====
 
 == Runtime Hierarchy
 

rhodium-standard-repositories/spec/LANGUAGE-POLICY.adoc

@@ -190,23 +190,30 @@ NOTE: For full rationale and migration guides, see the link:{source-repo}[CCCP r
 | Deno
 | Insecure by default. Detection via hypatia
   `cicd_rules/nodejs_detected` (matches `package-lock.json`) with
-  `path_allow_prefixes` covering six carve-out classes:
-  (1) `**/vscode/**` VSCode extension host-required toolchain
-  (extension toolchain runs under Node; lockfile contractually
-  required by the host);
+  `path_allow_prefixes` covering nine carve-out classes (six original
+  + three added during the migration via hypatia#405):
+  (1a) `**/vscode/**` VSCode extension host-required toolchain;
+  (1b) `vscode-` substring (extension repos/subdirs);
+  (1c) `tree-sitter-` substring (grammar npm-publish targets, Class C
+  consumer artefact with native binding);
   (2) `affinescript-deno-test/`, `affinescript-cli/` bootstrap shims;
   (3) `rescript/`, `servers/`, `repos-monorepo/`, `linguist/` upstream
   forks;
   (4) `hyperpolymath-archive/**` archived repos;
-  (5) `**/deps/**`, `**/node_modules/**` vendored package-manager
-  deps;
+  (5) `**/deps/**`, `**/node_modules/**`, `**/.lake/**` (Lean4),
+  `**/office-addin/**`, `**/bindings/{javascript,typescript}/**`
+  vendored / host-required / consumer-export deps;
   (6) `**/example/**`, `**/examples/**`, `**/test-fixtures/**`,
-  `**/fixtures/**` example/test fixtures (demonstrate npm consumer
-  without making the repo itself an npm consumer).
-  In-flight migration tracked under hyperpolymath/standards#253
-  (172 `package.json` manifests; tracker
-  `project_estate_npm_to_deno_2026_05_28.md`; STEPS
-  #261/#262/#265/#268/#270/#273/#275).
+  `**/fixtures/**` example/test fixtures.
+  *Migration substantially complete 2026-05-31* under umbrella
+  hyperpolymath/standards#253: STEPS
+  #261/#262/#265/#268/#270/#273/#275 all closed; 22+ physical-migration
+  PRs landed across STEP 3 (smallest-first), the 4/5/6 named-bucket
+  audits closed `SUBSTANTIALLY DONE` with per-repo follow-up trackers
+  for the residual longtail (`flat-mate`, `accessibility-everywhere`,
+  `kaldor-iiot`, `excel-economic-numbers-tool`, `ubicity`, and a
+  handful of heavier Vite/Vitest/Jest/Express stacks). Tracker:
+  `project_estate_npm_to_deno_2026_05_28.md`.
 
 | *npm/Bun/pnpm/yarn*
 | Deno
@@ -357,7 +364,14 @@ When encountering banned languages:
    are blocked by hypatia `cicd_rules/typescript_detected` (with
    `path_allow_prefixes` for documented carve-outs) and the
    `language-policy.yml` reusable.
-3. *Medium-term*: Replace Node/npm with Deno
+3. ✅ *Done 2026-05-31*: Replace Node/npm with Deno across the estate
+   (substantially complete under umbrella hyperpolymath/standards#253;
+   STEPS #261/#262/#265/#268/#270/#273/#275 closed; ~22 physical-migration
+   PRs in STEP 3 plus 4/5/6 named-bucket audits each closed
+   `SUBSTANTIALLY DONE`; longtail repos tracked as per-repo follow-ups
+   rather than blocking the umbrella close; Layer-1 carve-out classes
+   extended via hypatia#405 to nine; tracker
+   `project_estate_npm_to_deno_2026_05_28.md`)
 4. ✅ *Done 2026-05-28*: V-lang → Zig migration complete across the estate
    (16 admin-merged PRs; hypatia detection rule armed)
 5. *Long-term*: Rewrite Go/Python in Rust/SPARK; absorb most Ada work into