docs: catch up TECH-DEBT, PACKAGING + STATE.a2ml with the 2026-05-20 JSR publish (#303)

INT-04 and INT-10 were both marked DONE in TECH-DEBT, but the wording
predated the actual JSR publish:

  - INT-04 line said "JSR publish authorised + dispatched (owner go
    2026-05-19)" — speculative; the real first-time publish landed
    2026-05-20 (six dispatched runs through the scope/package/trusted-
    publisher/SPDX-licence/.d.ts/cross-runtime gates).
  - INT-10 said DONE but didn't note the LSP's shim-resolution path
    only became *executable* after today's publish (code was correct
    but inert against a 404 JSR URL).

Updates
- docs/TECH-DEBT.adoc — INT-04 + INT-10 lines reflect the live publish,
  with explicit note that @hyperpolymath/affine-js + affinescript-tea
  remain dry-run-OK / not-yet-dispatched.
- docs/PACKAGING.adoc — JSR-publishable table now has 3 rows with a
  Status column; @hyperpolymath/affinescript row records the LIVE
  0.1.2 (2026-05-20) state, cross-runtime carve-out, MPL-2.0 licence
  pointer.  New "First-time JSR publish gotchas" subsection captures
  the five gates that fail one at a time (scope claim, package create,
  trusted GH repo link, SPDX licence, sibling .d.ts + triple-slash
  reference) — dry-run misses gates 2 + 3 so they cost a round-trip.
- .machine_readable/6a2/STATE.a2ml — new session-note-2026-05-20
  following the existing `session-note-YYYY-MM-DD = "…"` convention,
  capturing every landed PR (#291/#292/#293/#294/#295/#298/#299) and
  the estate macos-13 sweep (casket-ssg#8, proven#29, repos-monorepo#9),
  plus the open follow-up tickets (#297/#300, #301, #302).  This file
  is the STATE.a2ml mirror, not the lead; TECH-DEBT.adoc is the spine.

No code change.  TECH-DEBT update protocol calls for ledger + STATE
mirror in lockstep; PACKAGING is the human-facing companion.  Memory
entries (`reference_macos_13_runner_retired`,
`reference_estate_gitbot_auto_closes_on_refs`,
`reference_estate_mirror_state_2026_05_20`,
`reference_jsr_publish_recipe`) live in `~/.claude/projects/.../memory/`
and are out of repo scope.

Refs #282 (closed), #301, #302, #297, #300.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.machine_readable/6a2/STATE.a2ml

@@ -8,6 +8,7 @@ last-updated = "2026-05-03"
 status = "active"
 authoritative-status-doc = "docs/CAPABILITY-MATRIX.adoc"
 drift-flag = "STALE as of 2026-05-19: this file's [components]/[features]/[project-context] predate origin/main@dc5b817. It MIRRORS, it does not LEAD. For live readiness use docs/CAPABILITY-MATRIX.adoc; for the spine/contract/ledger use docs/ECOSYSTEM.adoc + docs/TECH-DEBT.adoc (DOC-05, issue #176). Gate baseline now 260/260, not 257."
+session-note-2026-05-20 = "INT-10 / #282 CLOSURE + JSR PUBLISH + ESTATE macos-13 SWEEP + DOC/MEMORY HARDENING. (1) ISSUE #282 ACTUALLY-DELIVERED end-to-end. PRs that landed today: #291 (partial pins.js fill for linux-x64 + macos-arm64, shim 0.1.1 — bridging before macos-x64 leg landed); #292 (release.yml: retired macos-13 GH-hosted runner → macos-15-intel — root cause of v0.1.0 macos-x64 leg sitting queued ~10h, traced to actions/runner-images#13046/#13402/#13634 'macos-13 fully unsupported since 2025-12-04'); v0.1.1 tag cut, full 3-platform release (linux-x64/macos-arm64/macos-x64) + SHA256SUMS published; #293 (delete 4 orphan .res files + the affine-res ReScript-bindings package — same precedent as packages/affine-ts/ removal 2026-05-11, fixed the recurring governance Language/anti-pattern check failure on every PR); #294 (release.yml checksums job: pass --repo \"$GITHUB_REPOSITORY\" so `gh release download` doesn't probe a missing .git — bug hidden on v0.1.0 by the macos-13 stall that pre-empted the checksums leg); #295 (final shim closure: pins.js VERSION→v0.1.1, all 3 sha256 fields filled, shim @hyperpolymath/affinescript 0.1.1→0.1.2, SHIM_SPEC bumped lock-step in tools/affinescript-lsp/src/compiler.rs); #298 (cross-runtime refactor: Deno/Bun/Node detection at module load + helper layer for hostOs/hostArch/envGet/readBytes/writeBytes/mkdirRecursive/chmodExec/spawnInherit/thisIsMain — was Deno-only — plus mod.d.ts + triple-slash reference so JSR fast-check finds the types and emits no warning; .claude/CLAUDE.md gained Runtime Exemptions section as the carve-out from the estate-wide Bun/Node ban); #299 (relicense the JSR shim package only — packages/affinescript-cli/{deno.json + 4 SPDX headers} — from PMPL-1.0-or-later to MPL-2.0 because JSR validates against the SPDX list and `PMPL-1.0-or-later` isn't on it; wider repo PMPL→MPL-2.0 deliberately deferred — #301). (2) JSR FIRST-TIME PUBLISH RECIPE walked: claim scope @hyperpolymath → create package record (jsr.io/new — dry-run won't catch this) → link trusted GitHub repo at package or scope settings (OIDC actorNotAuthorized otherwise — dry-run won't catch this either) → SPDX licence → mod.d.ts + triple-slash → cross-runtime tickbox. publish-jsr.yml workflow (manual workflow_dispatch); 6 dispatched runs today before all gates aligned (~7:33 UTC). Verified live: https://jsr.io/@hyperpolymath/affinescript 200; meta.json `latest: 0.1.2`. Real fetch+verify+exec smoke against the v0.1.1 release ran green on linux-x64 (resolveCompiler → SHA-verify → cache → exec `--version`). (3) ESTATE macos-13 SWEEP — sole non-affinescript first-party hits: `casket-ssg#8` (release.yml: `runner: macos-13` → `runner: macos-15-intel`, merged) + `proven#29` (zig-ffi.yml: `os: macos-13` → `os: macos-15-intel`, merged) + `repos-monorepo#9` (nested casket-ssg copy in boj-cartridges/polystack/poly-ssg/casket-ssg/.github/workflows/release.yml — still open as of writing, coherence-only since instant-sync.yml in each repo independently propagates). gh search code confirmed only 3 distinct first-party repo hits across the 360-repo active estate. (4) DISCOVERED — GitLab + Bitbucket mirrors NOT operating: empirical inspection of mirror.yml runs on affinescript / casket-ssg / repos-monorepo all `completed/skipped`; `GITLAB_MIRROR_ENABLED` / `BITBUCKET_MIRROR_ENABLED` repo vars unset; `GITLAB_TOKEN` / `BITBUCKET_TOKEN` secrets absent (only FARM_DISPATCH_TOKEN present); gitlab.com probes 302, bitbucket.org probes 404. repos-monorepo DOES have CODEBERG_MIRROR_ENABLED + RADICLE_MIRROR_ENABLED set → active forges are Codeberg + Radicle + whatever `.git-private-farm` fans out to. Filed as open question: #302. (5) FOLLOW-UPS: #297 (version-string drift — bin/main.ml/lib/repl.ml/lib/lsp_server.ml/lib/onnx_codegen.ml/dune-project all hardcoded `0.1.0` even on the v0.1.1 binary; fix PR #300 introduces lib/version.ml single-source-of-truth + release.yml sed-bake step on every tag); #301 (wider PMPL→MPL-2.0 estate-relicense decision needed); #302 (mirror status — intentional-off or unfinished-setup). (6) DOCUMENTATION: this file (a session-note); docs/PACKAGING.adoc (status table for all 3 JSR-publishable packages + first-publish-gotchas section); docs/TECH-DEBT.adoc (INT-04 / INT-10 lines updated to reflect actual publish). Memory: reference_macos_13_runner_retired.md, reference_estate_gitbot_auto_closes_on_refs.md, reference_estate_mirror_state_2026_05_20.md, reference_jsr_publish_recipe.md all saved + indexed in MEMORY_STANDING.md."
 session-note-2026-05-03-c = "EXTERN/VSCODE/ARRAY/PATCON BATCH. (1) `extern fn name(...) -> Ret;` and `extern type Name;` now parse — added EXTERN keyword to lexer/token/parse_driver, FnExtern to fn_body and TyExtern to type_body in AST, extern_fn_decl + extern_type_decl rules in parser.mly. Resolve registers the symbol; Typecheck.check_fn_decl special-cases FnExtern to register the polymorphic scheme without body checking; Codegen.gen_decl emits a real `(import \"env\" \"<name>\" (func ...))` for each extern fn, mirroring gen_imports's cross-module shape. Borrow + Quantity skip extern fns. lib/dune now demotes warning 8/9 from error to warning so the new variants don't require lock-step updates across all 27 codegens (any non-Wasm codegen that doesn't handle FnExtern raises Match_failure with file:line at runtime — correct signal for 'this target has no story for host-supplied implementations'). 192 tests; 0 regressions. (2) Issue #35 Phase 2: stdlib/Vscode.affine and stdlib/VscodeLanguageClient.affine ship the ~12 + 3 binding declarations from the issue's API inventory (registerCommand, getConfiguration, showInformationMessage, createTerminal, ...). packages/affine-vscode/mod.js is the JS-side adapter that translates each `extern fn` invocation into the corresponding vscode/lc API call, with a JS-side handle table for opaque host objects and a string-marshal helper that reads `[u32 length][utf-8 bytes]` out of the wasm memory. Adapter returns a namespaced object `{ Vscode: {...}, VscodeLanguageClient: {...} }` matching the WASM cross-module imports' module names. examples/vscode_extension_minimal.affine demonstrates an end-to-end VS Code extension authored in AffineScript using `use Vscode::{registerCommand, showInformationMessage, pushSubscription}` — compiles to .cjs via the Node-CJS path. (3) issues-drafts/02 closed: `[T]` array type now parses via `LBRACKET type_expr RBRACKET → TyApp (Array, [TyArg elem])` in lib/parser.mly's type_expr_primary rule. Verified for fn params, return types, struct fields, and nested `[[T]]`. Other stdlib files (Option/math/io/string) still fail with distinct issues (`fn() -> T` type syntax, `Option<T>` angle brackets) — the array fix advanced math.affine's failure point from line 349 to 354 etc. (4) PatCon sub-pattern destructuring under WasmGC: `match Mk(7, 99) { Mk(a, b) => a }` now lowers to RefCast + StructGet for the tag check + per-field RefCast HtI31 + I31GetS unboxing for each PatVar sub-pattern. Validated end-to-end: emitted .wasm instantiates in Deno and `main()` returns 7. The mixed-arity case (zero-arg + with-args in same enum, e.g. Option) errors loudly with the workaround documented (split into two matches, or use Wasm 1.0). Unifying variant rep — uniform `struct {tag, payload}` so Some+None can share — is the next destructuring milestone. 195 → 198 → 200 tests; 0 regressions throughout."
 session-note-2026-05-03-b = "FOLLOW-ON BATCH AFTER TYPED-WASM CLOSURE: variant-with-args under WasmGC, Node-target codegen Phase 1 (issue #35), stdlib Core.affine fix, cross-module for other codegens. (1) lib/codegen_gc.ml — added gen_variant_with_args helper that lowers ExprApp(ExprVariant(_), args) and bare-name `Some(42)` (via variant_tags lookup in ExprApp ExprVar) to a tagged anon-struct allocation [tag: i32, payload: anyref, ...] with i32 args boxed via ref.i31. ExprVar gained variant_tags fallback so `return Happy` works. gen_gc_function now post-processes body_code: when result_vt ≠ I32 the trailing `push_i32 0` fallback (emitted by gen_gc_block when blk_expr=None) is swapped for RefNull HtAny, which fixes 'end[0] expected type anyref, found i32' validator errors on functions that explicitly return a struct. Validated: emitted .wasm instantiates in Node 18 / V8 14, main() returns the GC struct. f64 args remain UnsupportedFeature (no i31 boxing path). (2) lib/codegen_node.ml — new module implementing issue #35 Phase 1 (Node-CJS emit). Wraps Codegen.generate_module output in a CJS shim with: inline base64-encoded wasm constant, lazy WebAssembly.instantiate on first activate/deactivate call, JS-side opaque-handle table (_registerHandle / _getHandle / _freeHandle exported for Phase 2 vscode bindings), minimal WASI fd_write so println-style codegen works, exports.activate/exports.deactivate re-exports of the wasm module's same-named exports. .cjs output extension dispatches in bin/main.ml (both JSON and non-JSON paths). Smoke-tested: real Node 18 require()s a generated .cjs and successfully calls activate(fakeContext) → 0, deactivate() → 0. Issue #35 Phases 2-4 (stdlib/Vscode.affine bindings, extension.ts → extension.affine migration, rattlescript-face sweep) remain as separate work. (3) stdlib/Core.affine — three parser-collision fixes: `pub fn const[A,B]` → `always` (const is a reserved keyword for compile-time bindings); `fn(x: A) -> C { ... }` lambdas → `|x: A|` form (the parser's actual lambda syntax); `flip` rewritten from `(A, B) -> C` to curried `A -> B -> C` to dodge tuple-arrow ambiguity. The originally-blocked tests/modules/test_simple_import.affine (use Core::{min}; min(10,20)) now compiles end-to-end. Other stdlib files (Option/math/io/string/...) still don't parse — each has distinct issues (fn() type syntax, `[T]` array type per issues-drafts/02, `Option<T>` angle brackets) that need their own passes or compiler-level fixes. (4) lib/module_loader.ml — new flatten_imports : t -> program -> program that prepends imported public TopFns into the importer's prog_decls (deduplicating against local fn names). bin/main.ml now binds [let flat_prog = Module_loader.flatten_imports loader prog in] in both compile_file paths and threads flat_prog through all 22 non-Wasm codegens (Julia, JS, C, WGSL, Faust, ONNX, OCaml, Lua, Bash, Nickel, ReScript, Rust, LLVM, Verilog, Gleam, CUDA, Metal, OpenCL, MLIR, Why3, Lean, SPIR-V) — Wasm and Wasm-GC keep the original prog because Codegen.gen_imports handles their cross-module needs natively. Smoke-tested: caller_ok.affine (use CrossCallee::{consume}) now compiles to JS / Julia / Rust / Lua with consume's body inlined. The non-JSON compile_file path also gained ~loader on its previously-loaderless Codegen.generate_module call (latent bug for cross-module wasm via this path). 188 → 190 tests; 0 regressions."
 session-note-2026-05-03 = "TYPED-WASM CROSS-MODULE CLOSURE + MCP CARTRIDGE REWIRE + WASMGC LOUD-FAIL HARDENING. (1) lib/codegen.ml — generate_module gained ?loader and a new gen_imports pass that walks prog.prog_imports, loads each referenced module via Module_loader, and emits one (import \"<modpath>\" \"<fn>\" (func ...)) entry per imported function plus a (local_alias_name → import_func_idx) entry in func_indices. ImportSimple is namespace-only (no emit), ImportList emits per item, ImportGlob enumerates public TopFns. Closes the cross-module WASM import emission gap called out in session-note-2026-04-19-a — `verify-boundary CALLEE.affine CALLER.affine` now works on user-authored AffineScript pairs, not just hand-assembled bridges. (2) lib/resolve.ml — import_resolved_symbols / import_specific_items / ImportGlob inline path now also write to dest type_ctx.name_types (not just var_types), with a new lookup_source_scheme helper that falls back from sym_id-keyed source_types to name-keyed source_name_types because resolve_and_typecheck_module's per-decl Typecheck.check_decl populates name_types but never var_types. lib/typecheck.ml — Typecheck.check_program gained ?import_types : (string, scheme) Hashtbl.t that seeds name_types after register_builtins, supplied by the resolver. bin/main.ml compile_file (JSON + non-JSON paths), compile_to_wasm_module, verify_file all updated to thread import_type_ctx.name_types through and pass ~loader to Codegen.generate_module. (3) test/e2e/fixtures/ — CrossCallee.affine + cross_caller_{ok,dup,drop}.affine, plus 3 new alcotest cases under E2E Boundary Verify exercising the full pipeline (parse → resolve_with_loader → typecheck-with-import-types → codegen-with-loader → Tw_interface.verify_cross_module). All three boundary outcomes (clean / LinearImportCalledMultiple / LinearImportDroppedOnSomePath) confirmed end-to-end. (4) boj-server/cartridges/typed-wasm-mcp — mod.js rewritten to call `affinescript` (was: nonexistent `typed-wasm` binary), with cwd set to the source's directory so Module_loader resolves relative imports correctly. cartridge.json bumped to v0.2.0 with corrected input descriptions (.affine source paths) and a new typed_wasm_verify_boundary tool exposing the cross-module verifier. README.adoc updated to match. (5) lib/codegen_gc.ml — eliminated three silent-bad-codegen fallbacks (same class as BUG-005): wildcard ExprLambda/ExprUnsafe → RefNull replaced with explicit UnsupportedFeature errors; match-arm wildcard PatTuple/PatRecord → fall-to-default replaced with UnsupportedFeature; PatLit fallback for LitFloat/LitString replaced with explicit errors. test/test_e2e.ml gained E2E WasmGC Loud-Fail suite with 2 regression markers. Bumps wasm-gc-codegen from 70% to 85% (silent-fallback gap is gone; effects/try-catch/lambda/call_ref remain genuinely deferred to upstream EH proposal or whole-program CPS). 180 → 182 tests; 0 regressions."

docs/PACKAGING.adoc

@@ -12,21 +12,28 @@ toc::[]
 
 == JSR-publishable units (Deno/JSR-first)
 
-The JS runtime packages are JSR-publishable today. `deno publish
---dry-run` succeeds for both (verified during INT-04 prep):
-
-[cols="2,2,3"]
+[cols="2,2,1,3"]
 |===
-|Package |Spec |Notes
-
-|`packages/affine-js` |`@hyperpolymath/affine-js` |Loader + marshal +
-runtime + ownership accessor. Tests excluded via `publish.exclude`.
-|`affinescript-tea` |`@hyperpolymath/affinescript-tea` |TEA runtime.
-Depends on `@hyperpolymath/affine-js/loader` (import map) — see order.
+|Package |Spec |Status |Notes
+
+|`packages/affinescript-cli` |`@hyperpolymath/affinescript` |**LIVE
+0.1.2 (2026-05-20)** |The ADR-019 compiler shim. Cross-runtime (Deno
++ Bun + Node — only repo package with a documented runtime carve-out
+from the Deno-only policy). Licensed `MPL-2.0` (SPDX-recognised; the
+only non-PMPL package — see `.claude/CLAUDE.md` Runtime/TS Exemptions
++ #301 for the wider relicense discussion).
+|`packages/affine-js` |`@hyperpolymath/affine-js` |dry-run OK; not
+yet published |Loader + marshal + runtime + ownership accessor.
+Tests excluded via `publish.exclude`.
+|`affinescript-tea` |`@hyperpolymath/affinescript-tea` |dry-run OK;
+not yet published |TEA runtime. Depends on
+`@hyperpolymath/affine-js/loader` (import map) — see order.
 |===
 
-*Publish order is load-bearing*: `affine-js` **must** publish before
-`affinescript-tea` (the latter resolves `@hyperpolymath/affine-js/loader`).
+*Publish order is load-bearing for the JS-runtime pair*: `affine-js`
+**must** publish before `affinescript-tea` (the latter resolves
+`@hyperpolymath/affine-js/loader`). `affinescript-cli` has no JSR-side
+dependencies and publishes independently of either.
 
 `affinescript-dom` is AffineScript source (`.affine`), not a JS package
 — it is consumed by the compiler, not JSR; out of scope for JSR.
@@ -79,5 +86,32 @@ JSR/npm package. The one-way-door fork (#260) was decided
   producers):* Guix/Nix fetch-derivations; an npm tail only if an
   npm-native consumer needs it.
 
-`affinescript-lsp` distribution (INT-10, #282) consumes the shim;
-unblocked once a `v*` Release is cut and `pins.js` is finalised.
+`affinescript-lsp` distribution (INT-10, #282) consumes the shim.
+End-to-end live since 2026-05-20: v0.1.1 Release published (3 binaries
++ SHA256SUMS), `pins.js` finalised, shim 0.1.2 on JSR, LSP `SHIM_SPEC`
+points at `jsr:@hyperpolymath/affinescript@0.1.2`.
+
+=== First-time JSR publish gotchas
+
+The first publish of a new `@hyperpolymath/*` package trips five
+separate gates (in this order, each failing with an unhelpful error
+the next time round):
+
+. Claim the JSR scope (`@hyperpolymath` — one-time per scope, via
+  `https://jsr.io` sign-in).
+. Create the package record on JSR — `deno publish` errors *Following
+  packages don't exist…* until done.
+. Link a trusted GitHub repository at the package or scope level
+  (`https://jsr.io/@<scope>/<package>/settings`) — without it, OIDC
+  is `actorNotAuthorized`.
+. SPDX-recognised licence in `deno.json` — custom licences need the
+  `LicenseRef-*` prefix or a switch to a standard SPDX identifier
+  (the shim went the standard route with `MPL-2.0`).
+. Optional but recommended: add a sibling `mod.d.ts` AND a
+  `/// <reference types="./mod.d.ts" />` triple-slash comment in
+  `mod.js` so JSR fast-check finds the types. The `.d.ts` alone is
+  not enough — JSR doesn't auto-detect.
+
+Dry-run only catches step 4 and step 5; steps 2 and 3 fail at real
+publish time. Subsequent version bumps after the first publish need
+only the version-string change.

docs/TECH-DEBT.adoc

@@ -196,18 +196,25 @@ tracked next slice. Real-host main-invoke = S6 (WIT export
 lifting). Next S5
 (native clocks/env/argv)**
 |INT-04 |Publish to JSR/npm |S2 |#181 packaging READY (dry-run green,
-manual workflow); JSR publish authorised + dispatched (owner go
-2026-05-19); compiler-binary distribution decided = **ADR-019**
+manual workflow); compiler-binary distribution decided = **ADR-019**
 (#260, Releases + thin Deno/JSR shim, staged S1..S4) — S1/S2/S3
-merged (#283/#284/#285); **S4 done — INT-10 closed (#282)**
+merged (#283/#284/#285); S4 done — INT-10 closed (#282).
+**First JSR publish landed 2026-05-20: `@hyperpolymath/affinescript@0.1.2`
+LIVE** (cross-runtime Deno+Bun+Node, MPL-2.0, sibling .d.ts for
+fast-check). `@hyperpolymath/affine-js` + `@hyperpolymath/affinescript-tea`
+remain dry-run-OK / not-yet-dispatched.
 |INT-07 |`affinescript-tea` runtime |S2 |#182 runtime + run loop shipped
 (TeaApp/parseTeaLayout, Linear-msg enforced); INT-01 cleared (#253)
 |INT-08 |DOM reconciler |S2 |#183 implemented + compiles; `.as`→`.affine`
 fixed; runtime blocked by #255 (wasm loop-codegen defect)
-|INT-10 |`affinescript-lsp` distribution |S2 |**DONE** (#282, ADR-019
-S4): LSP resolves the compiler via `AFFINESCRIPT_COMPILER` → `affinescript`
-on `PATH` → the `@hyperpolymath/affinescript` shim (`src/compiler.rs`);
-no bespoke bundling; locate/exec smoke + resolution unit tests green
+|INT-10 |`affinescript-lsp` distribution |S2 |**DONE end-to-end live**
+(#282, ADR-019 S4): LSP resolves the compiler via `AFFINESCRIPT_COMPILER`
+→ `affinescript` on `PATH` → the `@hyperpolymath/affinescript` shim
+(`src/compiler.rs`); no bespoke bundling; locate/exec smoke + resolution
+unit tests green. As of 2026-05-20 the shim is published on JSR
+(`@hyperpolymath/affinescript@0.1.2`) and pins all three v0.1.1
+binaries by SHA256, so the shim resolution path actually executes
+end-to-end now (was code-correct but inert before today's publish).
 |INT-05/06/09/11/12 |ledger-only; filed when blocker closes |— |planned
 |===