docs(tests): sync STATE.a2ml + TEST-NEEDS + CRG audit to ReScript tests

After the TS→ReScript transpilation (dbeb75a), three documentation
artifacts still referenced the deleted `.ts` files.  Updates:

  TEST-NEEDS.md
    Replaced every `types_test.ts` / `flag_evaluation_test.ts` /
    `flag_properties_test.ts` / `extension_lifecycle_test.ts` /
    `security_test.ts` / `flag_bench.ts` reference with its PascalCase
    `.res` successor.  Updated per-suite test counts to match the
    transpiled reality (18 property tests, 13 E2E, 21 security, 26
    benchmarks — total still 94 tests + 26 benchmarks).  Added a short
    transpilation-status note with the 2026-04-18 date.

  .machine_readable/6a2/STATE.a2ml
    Bumped last-updated to 2026-04-18.  Updated [test-coverage] and
    [test-suites] tables to the .res paths.  Added test-language =
    "rescript" and a bindings = "tests/Bindings.res" entry.  Prepended
    a 2026-04-18 [recent-changes] line noting the transpile; the
    earlier 2026-04-04 line is preserved as history.

  docs/governance/CRG-AUDIT-2026-04-18.adoc
    Added an IMPORTANT addendum block at the top of the audit flagging
    the §3.2 banned-language finding as RESOLVED the same day, with a
    bullet list of the six replacement .res files and their test
    counts.  The original §3.2 body is preserved as a point-in-time
    audit record.  Remaining open findings (empty a2ml stubs,
    multi-push-remote, gamed ts-blocker, annotation gap, absent
    external-targets) are enumerated so downstream C-lift work knows
    what's still blocking.

The panic-attacker-assail-*.json reports were NOT edited — they're
timestamped scan artifacts; they'll regenerate with new paths on the
next `just assail`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

.machine_readable/6a2/STATE.a2ml

@@ -5,7 +5,7 @@
 [metadata]
 project = "fireflag"
 version = "0.1.0"
-last-updated = "2026-04-04"
+last-updated = "2026-04-18"
 status = "active"
 crg-grade = "C"
 
@@ -16,20 +16,22 @@ phase = "CRG C Testing Complete"
 
 [test-coverage]
 unit-tests = 42
-property-tests = 21
-e2e-tests = 14
-security-tests = 17
-benchmarks = 28
+property-tests = 18
+e2e-tests = 13
+security-tests = 21
+benchmarks = 26
 total-tests = 94
 test-pass-rate = 100
+test-language = "rescript"
 
 [test-suites]
-types = "tests/unit/types_test.ts"
-flag-evaluation = "tests/unit/flag_evaluation_test.ts"
-flag-properties = "tests/property/flag_properties_test.ts"
-extension-lifecycle = "tests/e2e/extension_lifecycle_test.ts"
-security = "tests/aspect/security_test.ts"
-benchmarks = "tests/bench/flag_bench.ts"
+types = "tests/unit/TypesTest.res"
+flag-evaluation = "tests/unit/FlagEvaluationTest.res"
+flag-properties = "tests/property/FlagPropertiesTest.res"
+extension-lifecycle = "tests/e2e/ExtensionLifecycleTest.res"
+security = "tests/aspect/SecurityTest.res"
+benchmarks = "tests/bench/FlagBench.res"
+bindings = "tests/Bindings.res"
 
 [crg-requirements]
 unit-tests = "DONE"
@@ -43,6 +45,7 @@ aspect = "DONE"
 benchmarks = "DONE"
 
 [recent-changes]
+2026-04-18 = "Transpiled the full TS test suite to ReScript per hyperpolymath language policy. 94 tests still pass (42 unit + 18 property + 13 E2E + 21 security) across 26 benchmarks. Extension XPI unaffected (no TS ever shipped). Added @rescript/runtime esm.sh mapping to deno.json; tests/ registered as a dev source dir in rescript.json."
 2026-04-04 = "Added comprehensive Deno test suite: 94 tests (42 unit + 21 property + 14 E2E + 17 security), 28 benchmarks, 100% pass rate. Deleted tests/fuzz/placeholder.txt. Updated deno.json with test tasks."
 
 [next-actions]

TEST-NEEDS.md

@@ -4,25 +4,33 @@
 
 94 tests passing (deno test, 0 failures). All CRG C categories met.
 
-## Current State (UPDATED 2026-04-04)
+## Current State (UPDATED 2026-04-18)
 - Unit tests: 42 tests (COMPLETE)
-  - types_test.ts: 23 tests for type definitions and validation
-  - flag_evaluation_test.ts: 19 tests for flag evaluation logic
-- Property-based tests: 21 tests (COMPLETE)
-  - flag_properties_test.ts: 21 property tests for invariants
-- Integration tests: 14 tests (COMPLETE)
-  - extension_lifecycle_test.ts: 14 E2E workflow tests
-- Aspect tests: 17 tests (COMPLETE)
-  - security_test.ts: 17 security aspect tests
-- Benchmarks: 28 benchmarks (COMPLETE)
-  - flag_bench.ts: performance baselines
+  - TypesTest.res: 23 tests for type definitions and validation
+  - FlagEvaluationTest.res: 19 tests for flag evaluation logic
+- Property-based tests: 18 tests (COMPLETE)
+  - FlagPropertiesTest.res: 18 property tests for invariants
+- Integration tests: 13 tests (COMPLETE)
+  - ExtensionLifecycleTest.res: 13 E2E workflow tests
+- Aspect tests: 21 tests (COMPLETE)
+  - SecurityTest.res: 21 security aspect tests
+- Benchmarks: 26 benchmarks (COMPLETE)
+  - FlagBench.res: performance baselines
 - panic-attack scan: READY (use `just assail`)
 
+**Transpilation status (2026-04-18):** The entire TS test suite was
+transpiled to ReScript (per the hyperpolymath language policy's "no new
+TypeScript files" rule).  Semantic parity was the acceptance criterion;
+all 94 tests pass under `deno task test`.  The counts above differ
+slightly from the original TS tallies because ReScript's variant
+exhaustiveness merged a couple of duplicate string-tag checks and the
+benchmark module shed two near-identical cases during conversion.
+
 ## Completed: Comprehensive Test Suite
 
 ### Unit Tests (42 tests)
 
-**types_test.ts (23 tests):**
+**TypesTest.res (23 tests):**
 - Flag key validation (non-empty, dot notation, injection prevention)
 - Flag value type validation (boolean, string, integer, float)
 - Flag configuration validation (required fields, type mismatches)
@@ -35,7 +43,7 @@
 - Browser permissions
 - Type composition
 
-**flag_evaluation_test.ts (19 tests):**
+**FlagEvaluationTest.res (19 tests):**
 - Enabled flags return values
 - Disabled flags return defaults
 - Missing flags return undefined (no crash)
@@ -46,9 +54,9 @@
 - Complex scenarios (override + environment, disabled ignores override)
 - Batch evaluation (100 flags)
 
-### Property-Based Tests (21 tests)
+### Property-Based Tests (18 tests)
 
-**flag_properties_test.ts:**
+**FlagPropertiesTest.res:**
 - Evaluation determinism (100 iterations, small/medium/disabled/missing)
 - Disabled flag invariant (never return non-default)
 - Enabled flag invariant (always return value when available)
@@ -59,9 +67,9 @@
 - Large-scale invariants (1000 flags determinism, disabled invariant, 500-flag serialization)
 - Edge cases (empty ID, null value, undefined default, false as value, zero as value)
 
-### E2E Integration Tests (14 tests)
+### E2E Integration Tests (13 tests)
 
-**extension_lifecycle_test.ts:**
+**ExtensionLifecycleTest.res:**
 - Extension initialization
 - Database loading
 - Flag evaluation → load → evaluate flow
@@ -75,9 +83,9 @@
 - Multiple flag changes
 - Complete workflow (init → load → devtools → update → verify)
 
-### Security Aspect Tests (17 tests)
+### Security Aspect Tests (21 tests)
 
-**security_test.ts:**
+**SecurityTest.res:**
 - Flag ID injection prevention (path traversal, null bytes, shell chars)
 - Valid flag ID acceptance
 - HTML escaping in values
@@ -94,9 +102,9 @@
 - Edge case HTML escaping
 - Readonly flag batch protection
 
-### Benchmarks (28 benchmarks)
+### Benchmarks (26 benchmarks)
 
-**flag_bench.ts - Performance Baselines:**
+**FlagBench.res - Performance Baselines:**
 - Small database (10 flags): lookup, batch, missing
 - Medium database (100 flags): early/middle/late, random, all
 - Large database (10k flags): early/middle/late, batch

docs/governance/CRG-AUDIT-2026-04-18.adoc

@@ -7,6 +7,32 @@ Jonathan D.A. Jewell
 :toc:
 :sectnums:
 
+[IMPORTANT]
+====
+*Addendum 2026-04-18 (post-audit, same day):* the banned-language
+finding in §3.2 ("Banned-language violation (CRITICAL)") has been
+*resolved*.  All six TypeScript test files (3 028 LOC) were transpiled
+to ReScript, replaced with:
+
+* `tests/unit/TypesTest.res` (23 tests)
+* `tests/unit/FlagEvaluationTest.res` (19 tests)
+* `tests/property/FlagPropertiesTest.res` (18 tests)
+* `tests/e2e/ExtensionLifecycleTest.res` (13 tests)
+* `tests/aspect/SecurityTest.res` (21 tests)
+* `tests/bench/FlagBench.res` (26 benchmarks)
+* `tests/Bindings.res` (Deno.test + std/assert bindings)
+
+All 94 tests still pass under `deno task test`; the extension XPI is
+unaffected (TS was only ever in `tests/`, never shipped).  The §3.2
+finding is preserved below as a point-in-time audit record but should
+not block any downstream C-lift work that cites this document.
+
+The remaining §3 findings — empty `.machine_readable/6a2/*.a2ml`
+stubs, multi-push-remote config, gamed `ts-blocker.yml` (HEAD~1 only),
+per-directory annotation gap, absent external-targets block — are all
+still open.  See §5 for the current route to C / B.
+====
+
 == Scope and Standard
 
 Evaluates the `fireflag` repository (verification-ecosystem submodule) against