Merge branch 'main' into docs/typescript-exemption-table #589

	# SPDX-License-Identifier: MPL-2.0
	name: TypeScript/JavaScript Blocker
	on: [push, pull_request]

	permissions:
	contents: read

	jobs:
	check:
	runs-on: ubuntu-latest
	permissions:
	contents: read
	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	- name: Block TypeScript (zero tolerance) and new JavaScript
	run: \|
	# Zero-tolerance: NO .ts files anywhere in the tree.
	EXISTING_TS=$(find . $ -name ".ts" -o -name ".tsx" $ \| grep -v './.git/' \| grep -v node_modules \| grep -v '\.gen\.' \| grep -v '/mod\.ts$' \|\| true)
	if [ -n "$EXISTING_TS" ]; then
	echo "❌ TypeScript files found (must be zero — port to Zig or AffineScript):"
	echo " Estate-wide policy 2026-04-30: RS/TS/JS → AffineScript→typed-wasm."
	echo " For systems-level code, Zig→WASM is the alternative."
	printf '%s\n' "$EXISTING_TS"
	exit 1
	fi

	# JS: block new additions only (existing JS tracked for WASM migration).
	NEW_JS=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null \| grep -E '\.(js\|jsx)$' \| grep -v '\.res\.js$' \| grep -v '\.gen\.' \| grep -v 'node_modules' \|\| true)
	if [ -n "$NEW_JS" ]; then
	echo "❌ New .js files detected."
	echo " Estate-wide policy 2026-04-30: target language is AffineScript→typed-wasm"
	echo " for application code, Zig→WASM for systems work. ReScript is being"
	echo " phased out (only allowed as upstream-system adapter shims)."
	printf '%s\n' "$NEW_JS"
	exit 1
	fi

	echo "✅ No TS/new-JS violations"

Provide feedback