docs(no-js): record gossamer blocking flip in rollout status

https://claude.ai/code/session_01CS2BLBL22WTTjmc1UmEGa2

Author: claude

docs/NO-JAVASCRIPT-SOURCE-POLICY.adoc

@@ -60,15 +60,20 @@ The following are out of scope and MUST NOT be treated as violations:
 | `no-js-scan.yml` (this rollout — WARN-FIRST)
 | NON-BLOCKING companion. On any push / PR touching JS or TS it reports the full
   count and list of hand-authored JS/TS to the run summary, so each repo's
-  migration surface is visible. It never fails the build. It excludes only the
+  migration surface is visible. It does not fail the build while a repo's surface
+  is non-zero (once a repo reaches zero it flips to a blocking gate, e.g.
+  `gossamer`). It excludes only the
   generated / vendored / declaration files listed above. By owner decision a
   repo flips from warn to block once its surface reaches zero.
 |===
 
 == Rollout status (2026-06-02)
 
-Warn-first `no-js-scan.yml` added to: `standards`, `burble`, `gossamer`.
-`gossamer` is already at zero hand-authored JS/TS. `paint-type` joins when write
-access is available — its `src/ui/app.js` is the increment-0 MVP UI, slated to
-move into Rust/wasm per that repo's ADR-0002. Other estate repos adopt via
-template propagation.
+* `gossamer` — surface is zero, so `no-js-scan` runs as a **blocking gate**: any
+  newly introduced hand-authored JS/TS fails CI.
+* `standards` (29) and `burble` (14) — **warn-first** (non-blocking) while their
+  surfaces migrate; each flips to blocking once it reaches zero.
+* `paint-type` — joins when write access is available; its `src/ui/app.js` is the
+  increment-0 MVP UI, slated to move into Rust/wasm per that repo's ADR-0002.
+
+Other estate repos adopt via template propagation.