policy: Bun is tier 1, Deno is being removed (#367)

Bun becomes the tier 1 JS runtime and package manager; Deno is removed rather
than grandfathered, per the owner ruling of 2026-08-26.

Two static-analysis findings were addressed before merge:
  - ReScript was absent from the BANNED table although canon bans it
    (destination AffineScript), so the table read as permitting it.
  - Enforcement Rule 3 said `bun install --production` with no
    `--frozen-lockfile`, so a lockfile mismatch silently re-resolved instead of
    failing, defeating the point of committing bun.lock.

Enforcement Rule 1 is deliberately untouched: standards#655 records that
collision as not resolvable unilaterally.

Verified before merge: the failing checks on these PRs are repo-specific CI
(cargo/clippy, shell lint, K9 contract and A2ML manifest validators, build) that
a Markdown policy file cannot reach, and they fail on main independently.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: hyperpolymath

.claude/CLAUDE.md

@@ -108,7 +108,7 @@ package definitions (not metadata files) and must NOT be deleted.
 | **Guile Scheme** | Guix package definitions (`guix.scm`, `manifests/*.scm`) | `.scm` metadata files are deprecated — see below |
 | **Bash/POSIX Shell** | Build scripts, CI glue | Keep minimal |
 | **AffineScript** | UI components (TEA architecture, compiled to typed-wasm / wasm, served via Deno) | Replaces AffineScript per `docs/ROADMAP.md`; migration in progress at `src/affinescript/` |
-| **Deno** | Runtime for compiled AffineScript-TEA UI | Replaces Node/npm/bun |
+| **Bun** | Runtime for compiled AffineScript-TEA UI | Replaces Node/npm/Deno |
 | **JavaScript** | Build tooling only (Tailwind config, test harness) | Not for business logic |
 | **OCaml** | AffineScript compiler host | Decision locked — AffineScript selected for UI |
 | **Nickel** | Configuration language | Used across `configs/`, `echidna-playground/contractiles/k9/`, `.machine_readable/`, `echidnabot/config/` (11+ `.ncl` files) |
@@ -118,17 +118,18 @@ package definitions (not metadata files) and must NOT be deleted.
 | Banned | Replacement |
 |--------|-------------|
 | TypeScript | AffineScript |
-| AffineScript | AffineScript |
-| Node.js | Deno |
-| npm / Bun / pnpm / yarn | Deno |
+| ReScript | AffineScript |
+| Deno | Bun |
+| Node.js | Bun |
+| npm / pnpm / yarn | Bun |
 | Go | Rust |
 | Python | Julia / Rust |
 
 ### Enforcement Rules
 
-1. **No new TypeScript or AffineScript files** - Use AffineScript-TEA; migrate existing `src/affinescript/` to AffineScript per `docs/ROADMAP.md`
-2. **No package.json for runtime deps** - Use deno.json imports
-3. **No node_modules in production** - Deno caches deps automatically
+1. **No new TypeScript or ReScript files** - Use AffineScript-TEA; migrate existing `src/affinescript/` to AffineScript per `docs/ROADMAP.md`
+2. **Use `package.json` + `bun.lock` for JS runtime deps** - Bun is npm-compatible; a manifest is REQUIRED
+3. **`bun install --production --frozen-lockfile` for production deps** - resolved from `package.json` and pinned via `bun.lock`; `--frozen-lockfile` makes a lockfile mismatch a build failure rather than a silent re-resolve
 4. **No Go code** - Use Rust instead
 5. **No Python anywhere** - Use Julia for data/batch, Rust for systems
 
@@ -141,7 +142,7 @@ package definitions (not metadata files) and must NOT be deleted.
   (guix deprecated estate-wide; do NOT add `flake.guix`/`flake.lock` back).
   A second packager is permitted only where it is the sole source of a
   specific named dependency, documented as such.
-- **JS deps**: Deno (deno.json imports)
+- **JS deps**: Bun (`package.json` + `bun.lock`). Declare tooling as a devDependency and run `bunx --no-install --bun <tool>` — a bare `bunx <tool>` can fetch an unpinned package and may start Node via its shebang.
 
 ### Security Requirements
 

echidna-playground/.claude/CLAUDE.md

@@ -7,13 +7,13 @@
 | Language/Tool | Use Case | Notes |
 |---------------|----------|-------|
 | **AffineScript** | Primary application code | Compiles to JS, type-safe |
-| **Deno** | Runtime & package management | Replaces Node/npm/bun |
+| **Bun** | JS runtime & package management (tier 1) | Default for all new work. Runs compiled ESM/JS directly — no bundler step. Uses an npm-compatible `package.json` plus `bun.lock` — both are expected, not anti-patterns. |
 | **Rust** | Performance-critical, systems, WASM | Preferred for CLI tools |
 | **Tauri 2.0+** | Mobile apps (iOS/Android) | Rust backend + web UI |
 | **Dioxus** | Mobile apps (native UI) | Pure Rust, React-like |
 | **Gleam** | Backend services | Runs on BEAM or compiles to JS |
 | **Bash/POSIX Shell** | Scripts, automation | Keep minimal |
-| **JavaScript** | Only where AffineScript cannot | MCP protocol glue, Deno APIs |
+| **JavaScript** | Only where AffineScript cannot | MCP protocol glue, Bun APIs |
 | **Nickel** | Configuration language | For complex configs |
 | **Guile Scheme** | State/meta files | STATE.scm, META.scm, ECOSYSTEM.scm |
 | **Julia** | Batch scripts, data processing | Per RSR |
@@ -25,10 +25,10 @@
 | Banned | Replacement |
 |--------|-------------|
 | TypeScript | AffineScript |
-| Node.js | Deno |
-| npm | Deno |
-| Bun | Deno |
-| pnpm/yarn | Deno |
+| Deno | Bun |
+| Node.js | Bun |
+| npm | Bun |
+| pnpm/yarn | Bun |
 | Go | Rust |
 | Python | Julia/Rust/AffineScript |
 | Java/Kotlin | Rust/Tauri/Dioxus |
@@ -48,8 +48,8 @@ Both are FOSS with independent governance (no Big Tech).
 ### Enforcement Rules
 
 1. **No new TypeScript files** - Convert existing TS to AffineScript
-2. **No package.json for runtime deps** - Use deno.json imports
-3. **No node_modules in production** - Deno caches deps automatically
+2. **Use `package.json` + `bun.lock` for JS runtime deps** - Bun is npm-compatible; a manifest is REQUIRED
+3. **`bun install --production` for production deps** - resolved from `package.json`, pinned via `bun.lock`
 4. **No Go code** - Use Rust instead
 5. **No Python anywhere** - Use Julia for data/batch, Rust for systems, AffineScript for apps
 6. **No Kotlin/Swift for mobile** - Use Tauri 2.0+ or Dioxus
@@ -58,7 +58,7 @@ Both are FOSS with independent governance (no Big Tech).
 
 - **Sole primary**: Guix (guix.scm) — guix is deprecated estate-wide
   2026-06-01; do NOT add flake.guix/flake.lock back
-- **JS deps**: Deno (deno.json imports)
+- **JS deps**: Bun (`package.json` + `bun.lock`). Declare tooling as a devDependency and run `bunx --no-install --bun <tool>` — a bare `bunx <tool>` can fetch an unpinned package and may start Node via its shebang.
 
 ### Security Requirements