diff --git a/README.md b/README.md
index c642022..be92be2 100644
--- a/README.md
+++ b/README.md
@@ -11,10 +11,12 @@ migration runs on it); the WIT contract below is frozen, and design
 history lives in the [issues](../../issues). Everything is **unstable**
 (0.x), but [releases](../../releases) are **caret-honest**: within a
 minor line they stay backward-compatible, and anything breaking bumps
-the minor. Downstream consumption is pinned git dependencies — cargo
-for the crates, npm for the JS runner core (the root `package.json`
-exports `js/viewer`'s source-only modules) — pointed at a release's
-commit and bumped deliberately. How the pieces layer
+the minor. Downstream consumption: the crates are pinned cargo git
+dependencies pointed at a release's commit and bumped deliberately;
+the JS runner core is [`@polymorph/test`](https://jsr.io/@polymorph/test)
+on JSR (Deno consumers use `jsr:` specifiers, Node consumers the
+`@jsr/polymorph__test` npm-compat form), version-pinned per release.
+How the pieces layer
 together is described in [ARCHITECTURE.md](ARCHITECTURE.md). Layout:
 [`crates/`](crates/) (host-side Rust: core model, formats, results
 schema, guest SDK, CLI, host-embed runner), [`components/`](components/)
diff --git a/actions/README.md b/actions/README.md
index 7bec4d5..4c5a963 100644
--- a/actions/README.md
+++ b/actions/README.md
@@ -21,8 +21,6 @@ fails the run (branch/tag refs skip with a notice).
   id: ct
   with:
     cargo-lock: Cargo.lock
-    js-locks: |
-      conformance/driver-ct/jco/package-lock.json
     # tools: component-test-cli component-test-runner   (default)
     # install-root: target/ct-tools                     (default)
 # steps.ct.outputs.rev — the pinned revision
@@ -80,8 +78,10 @@ _ct-tools:
     target/ct-tools/bin/component-test pins --cargo-lock Cargo.lock --expect "$rev" > /dev/null
 ```
 
-(Append `--js-lock <lockfile>` for each JS lockfile the repo carries;
-drop `component-test-runner` if the runner is embedded as a library.)
+(Drop `component-test-runner` if the runner is embedded as a library.
+The JS runner core is consumed from JSR as `@polymorph/test`, pinned by
+version in the consumer's lockfiles and gated by the consumer's own
+runner-js pin check — the cargo rev is the only pin this gate holds.)
 
 ### Transpile stamps
 
diff --git a/actions/setup/action.yml b/actions/setup/action.yml
index b34e7e9..ad4486f 100644
--- a/actions/setup/action.yml
+++ b/actions/setup/action.yml
@@ -12,11 +12,6 @@ inputs:
   cargo-lock:
     description: Path to the consumer's Cargo.lock.
     default: Cargo.lock
-  js-locks:
-    description: >
-      JS lockfiles to include in the pins gate (package-lock.json /
-      pnpm-lock.yaml), one path per line. Optional.
-    default: ""
   tools:
     description: >
       Space-separated crates to install from this repository.
@@ -133,7 +128,6 @@ runs:
       shell: bash
       env:
         INPUT_CARGO_LOCK: ${{ inputs.cargo-lock }}
-        INPUT_JS_LOCKS: ${{ inputs.js-locks }}
         INPUT_INSTALL_ROOT: ${{ inputs.install-root }}
         PIN_REV: ${{ steps.pin.outputs.rev }}
       run: |
@@ -143,9 +137,4 @@ runs:
           echo "::error title=component-test setup::the pins gate needs the component-test CLI; keep component-test-cli in the tools input" >&2
           exit 1
         fi
-        args=(pins --cargo-lock "$INPUT_CARGO_LOCK" --expect "$PIN_REV")
-        while IFS= read -r line; do
-          line="${line#"${line%%[![:space:]]*}"}"
-          [ -n "$line" ] && args+=(--js-lock "$line")
-        done <<< "$INPUT_JS_LOCKS"
-        "$cli" "${args[@]}" > /dev/null
+        "$cli" pins --cargo-lock "$INPUT_CARGO_LOCK" --expect "$PIN_REV" > /dev/null
diff --git a/js/deno.json b/js/deno.json
index 7a96cf2..1f89a75 100644
--- a/js/deno.json
+++ b/js/deno.json
@@ -2,7 +2,7 @@
   "name": "@polymorph/test",
   "version": "0.1.1",
   "license": "Apache-2.0",
-  "//": "The polymorph:test stack's JS runner core on JSR — the same source-only module set the repo-root package.json exports to npm git installs (keep the two export maps in sync). Plain JS with relative and node: imports only; the browser-safe pieces (harness, context, imports, the workers) load in browsers unchanged, and the node: importers (node-runner, browser-driver) are Node/Deno-side drivers. The publish include-list IS the package: everything else under js/ is repo tooling (the deltic runner leg, selftests, the viewer app).",
+  "//": "The polymorph:test stack's JS runner core on JSR — the one consumable JS surface (the repo-root npm-git facade is retired; this export map is the only one). Plain JS with relative and node: imports only; the browser-safe pieces (harness, context, imports, the workers) load in browsers unchanged, and the node: importers (node-runner, browser-driver) are Node/Deno-side drivers. The publish include-list IS the package: everything else under js/ is repo tooling (the deltic runner leg, selftests, the viewer app).",
   "exports": {
     "./harness": "./viewer/harness.mjs",
     "./context": "./viewer/context.js",
diff --git a/package.json b/package.json
index 444c496..cd0600d 100644
--- a/package.json
+++ b/package.json
@@ -1,31 +1,5 @@
 {
-  "name": "@polymorph/component-test-js",
-  "version": "0.1.1",
-  "private": false,
+  "private": true,
   "type": "module",
-  "description": "The polymorph:test stack's JS runner core, consumable as a pinned git dependency (npm git installs cannot select subdirectories, so this facade lives at the repo root). Source-only by design: the browser-safe harness (tag inventory, mark scheduling, the case loop), the test-context provider, and the shard workers (jco- and deltic-shaped). Built artifacts (the viewer-aggregate engine) are deliberately excluded - they wait for registry publishing. Stability policy: unstable 0.x, caret-honest releases (breaking changes bump the minor); pin a release's commit and bump deliberately.",
-  "license": "Apache-2.0",
-  "repository": "github:polymorph-components/polymorph-test",
-  "files": [
-    "js/viewer/harness.mjs",
-    "js/viewer/context.js",
-    "js/viewer/imports.mjs",
-    "js/viewer/browser-worker.mjs",
-    "js/viewer/page-runner.mjs",
-    "js/node-runner.mjs",
-    "js/browser-driver.mjs",
-    "js/runner-deltic/worker-main.mjs",
-    "js/runner-deltic/browser-worker.mjs",
-    "js/runner-deltic/engine.mjs"
-  ],
-  "exports": {
-    "./harness": "./js/viewer/harness.mjs",
-    "./context": "./js/viewer/context.js",
-    "./imports": "./js/viewer/imports.mjs",
-    "./node-runner": "./js/node-runner.mjs",
-    "./browser-driver": "./js/browser-driver.mjs",
-    "./deltic-worker": "./js/runner-deltic/browser-worker.mjs",
-    "./deltic-engine": "./js/runner-deltic/engine.mjs",
-    "./deltic-worker-main": "./js/runner-deltic/worker-main.mjs"
-  }
-}
\ No newline at end of file
+  "description": "Node ESM configuration for this repository's .js modules (js/viewer/context.js loads as ESM under Node because of the type field here). Not a package: the JS runner core is consumed from JSR as @polymorph/test (js/deno.json is its manifest); the npm-git facade that used to live in this file is retired."
+}