diff --git a/.github/justfile b/.github/justfile
index e4a4115..cd497f4 100644
--- a/.github/justfile
+++ b/.github/justfile
@@ -22,6 +22,7 @@ rust-checks:
 # conformance-aggregate job, where every target's results have joined.
 conformance-checks:
     @just gha::_step conformance-ct::deltic-pin-check
+    @just gha::_step conformance-ct::runner-js-pin-check
     @just gha::_step conformance-ct::all
     @just gha::_step deltic-module-check
 
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 09e49c7..e44df10 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -111,12 +111,6 @@ jobs:
         # install, and the pins gate; conformance-ct::_ct-tools
         # recognizes the stamped install and does not repeat it.
         uses: polymorph-components/polymorph-test/actions/setup@b4444a25a22106ad4128549bdc9e579552e62210
-        with:
-          js-locks: |
-            conformance/driver-ct/jco/package-lock.json
-            examples/jco-demo/package-lock.json
-            js/jco/package-lock.json
-            js/componentize/wpt/parity/package-lock.json
 
       - name: Install Node 24
         # Exact-pinned, like every engine here (Deno, the Playwright
@@ -494,12 +488,6 @@ jobs:
 
       - name: Install the component-test tools at the pinned revision
         uses: polymorph-components/polymorph-test/actions/setup@b4444a25a22106ad4128549bdc9e579552e62210
-        with:
-          js-locks: |
-            conformance/driver-ct/jco/package-lock.json
-            examples/jco-demo/package-lock.json
-            js/jco/package-lock.json
-            js/componentize/wpt/parity/package-lock.json
 
       - name: Download the ubuntu conformance results
         uses: actions/download-artifact@v4
diff --git a/AGENTS.md b/AGENTS.md
index 9e92c16..1d19131 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -370,15 +370,18 @@ absent an exceptional recorded ruling.
 Prerequisites: Rust via rustup (toolchain + wasm target pinned in
 `rust-toolchain.toml`), `wasm-tools`, `just`, Node 24+ with npm for the
 jco path. Run `./scripts/setup.sh` once (idempotent; `SKIP_NODE=1` to
-skip the npm install). The polymorph:test stack is a git dependency
-pinned by rev in the root `Cargo.toml` and enforced by `Cargo.lock`;
-cargo fetches it, and `conformance-ct::_ct-tools` cargo-installs the
-`component-test`/`ct-runner` binaries at the same locked rev. To bump
-the pin: `component-test pins bump <rev> --cargo-toml Cargo.toml
---package-json conformance/driver-ct/jco/package.json --workflow
-.github/workflows/ci.yml`, then the follow-ups it prints (`cargo
-update`, `npm install`); the `_ct-tools` pins gate and the actions'
-own ref checks fail on skew.
+skip the npm install). The polymorph:test stack arrives two ways, both
+naming one release: the crates are a git dependency pinned by rev in
+the root `Cargo.toml` (enforced by `Cargo.lock`; `conformance-ct::_ct-tools`
+cargo-installs the `component-test`/`ct-runner` binaries at the same
+locked rev), and the JS runner core is `jsr:@polymorph/test`'s
+npm-compat package as `@jsr/polymorph__test` dependencies (scoped to
+npm.jsr.io by each tree's .npmrc) in the five npm trees. To bump: `component-test pins bump <rev>
+--cargo-toml Cargo.toml --workflow .github/workflows/ci.yml` with the
+release-tag commit, then the follow-ups it prints (`cargo update`), and
+set the matching release version on each `@jsr/polymorph__test` dependency + `npm install`; the
+`_ct-tools` pins gate, `conformance-ct::runner-js-pin-check`, and the
+actions' own ref checks fail on skew.
 To develop against a local component-test checkout, add a temporary
 override to the root `Cargo.toml` (do not commit it):
 
diff --git a/Cargo.toml b/Cargo.toml
index 1e29031..726a618 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -15,16 +15,18 @@ members = [
 ]
 resolver = "2"
 
-# The polymorph:test stack, pinned by git rev (bump deliberately:
-# update the rev here, `cargo update -p component-test-sdk -p
-# component-test-runner`, `npm install --save-exact
-# github:polymorph-components/polymorph-test#<rev>` in
-# conformance/driver-ct/jco, and move the actions/aggregate refs in
-# .github/workflows/ci.yml — the pins gate and the CI ref guard fail
-# on skew; the CI tools cache and the ct/ct-runner binaries key off
-# the locked rev). To develop against a local checkout, add a `[patch]`
-# override — see AGENTS.md "Build & run". Publishing component-test
-# to a registry retires this arrangement.
+# The polymorph:test stack: the crates pinned by git rev, the JS runner
+# core from JSR (@jsr/polymorph__test, npm.jsr.io per-tree .npmrc). Both sides of a bump
+# name ONE polymorph-test release: `component-test pins bump <rev>
+# --cargo-toml Cargo.toml --workflow .github/workflows/ci.yml` with the
+# release-tag commit, `cargo update -p component-test-sdk -p
+# component-test-runner`, then set the matching release version on every
+# `@jsr/polymorph__test` dependency (conformance/driver-ct/{jco,
+# deltic}, examples/jco-demo, js/jco, js/componentize/wpt/parity) and
+# `npm install` in each — the cargo pins gate, the runner-js pin gate,
+# and the CI ref guard fail on skew; the CI tools cache and the
+# ct/ct-runner binaries key off the locked rev. To develop against a
+# local checkout, add a `[patch]` override — see AGENTS.md "Build & run".
 [workspace.dependencies]
 component-test-sdk = { git = "https://github.com/polymorph-components/polymorph-test", rev = "b4444a25a22106ad4128549bdc9e579552e62210" }
 component-test-runner = { git = "https://github.com/polymorph-components/polymorph-test", rev = "b4444a25a22106ad4128549bdc9e579552e62210" }
diff --git a/conformance/driver-ct/deltic/.npmrc b/conformance/driver-ct/deltic/.npmrc
new file mode 100644
index 0000000..41583e3
--- /dev/null
+++ b/conformance/driver-ct/deltic/.npmrc
@@ -0,0 +1 @@
+@jsr:registry=https://npm.jsr.io
diff --git a/conformance/driver-ct/deltic/browser/worker-entry.ts b/conformance/driver-ct/deltic/browser/worker-entry.ts
index 6ad3bc0..4ffc99d 100644
--- a/conformance/driver-ct/deltic/browser/worker-entry.ts
+++ b/conformance/driver-ct/deltic/browser/worker-entry.ts
@@ -6,7 +6,7 @@
 // embedder module instance — which is what keeps `instanceof ComponentException`
 // true when the host module throws across the component boundary
 // (workers resolve no import maps, so bundling is the only sound shape;
-// see @polymorph/component-test-js's runner-deltic README).
+// see @jsr/polymorph__test's runner-deltic README).
 //
 // Built by `just conformance-ct::_deltic-browser-bundle` with
 // `deno bundle --platform browser` into target/deltic-browser/, and
@@ -17,7 +17,7 @@
 // configuration, so `suiteImports` is the plain record.
 
 import * as deltic from "../browser-bundle-entry.ts";
-import { workerMain } from "@polymorph/component-test-js/deltic-worker-main";
+import { workerMain } from "@polymorph/test/deltic-worker-main";
 import { setRsaPrivateKeyPolicy, webcryptoImports } from "../../../../js/deltic/src/mod.ts";
 
 // The browser posture, matching the jco-browser rows: a browser is an
diff --git a/conformance/driver-ct/deltic/deno.json b/conformance/driver-ct/deltic/deno.json
index 508724a..0e4a935 100644
--- a/conformance/driver-ct/deltic/deno.json
+++ b/conformance/driver-ct/deltic/deno.json
@@ -6,9 +6,9 @@
     "@deltic/runtime/shim": "jsr:@deltic/runtime@0.1.0/shim",
     "@deltic/wasi": "jsr:@deltic/wasi@0.1.0",
     "@deltic/translator": "jsr:@deltic/translator@0.1.0",
-    "@polymorph/component-test-js/deltic-worker-main": "./node_modules/@polymorph/component-test-js/js/runner-deltic/worker-main.mjs"
+    "@polymorph/test/deltic-worker-main": "jsr:@polymorph/test@0.1.1/deltic-worker-main"
   },
-  "minimumDependencyAge": { "age": "P1D", "exclude": ["jsr:@deltic/*"] },
+  "minimumDependencyAge": { "age": "P1D", "exclude": ["jsr:@deltic/*", "jsr:@polymorph/*"] },
   "tasks": {
     "check": "deno check run.ts browser/worker-entry.ts browser-bundle-entry.ts"
   }
diff --git a/conformance/driver-ct/deltic/deno.lock b/conformance/driver-ct/deltic/deno.lock
index e4b0f32..3bbb8b2 100644
--- a/conformance/driver-ct/deltic/deno.lock
+++ b/conformance/driver-ct/deltic/deno.lock
@@ -6,7 +6,8 @@
     "jsr:@deltic/runtime@0.1": "0.1.0",
     "jsr:@deltic/runtime@0.1.0": "0.1.0",
     "jsr:@deltic/translator@0.1.0": "0.1.0",
-    "jsr:@deltic/wasi@0.1.0": "0.1.0"
+    "jsr:@deltic/wasi@0.1.0": "0.1.0",
+    "jsr:@polymorph/test@0.1.1": "0.1.1"
   },
   "jsr": {
     "@deltic/ct-runner@0.1.0": {
@@ -36,6 +37,9 @@
         "jsr:@deltic/protocol",
         "jsr:@deltic/runtime@0.1"
       ]
+    },
+    "@polymorph/test@0.1.1": {
+      "integrity": "50ce81310c97591c523bbfdbe74e18a806e709ae1c09f47297da98267b5be8b3"
     }
   },
   "workspace": {
@@ -43,10 +47,12 @@
       "jsr:@deltic/ct-runner@0.1.0",
       "jsr:@deltic/runtime@0.1.0",
       "jsr:@deltic/translator@0.1.0",
-      "jsr:@deltic/wasi@0.1.0"
+      "jsr:@deltic/wasi@0.1.0",
+      "jsr:@polymorph/test@0.1.1"
     ],
     "packageJson": {
       "dependencies": [
+        "npm:@jsr/polymorph__test@0.1.1",
         "npm:playwright-core@1.62.1"
       ]
     }
diff --git a/conformance/driver-ct/deltic/package-lock.json b/conformance/driver-ct/deltic/package-lock.json
index 40db403..8a764cc 100644
--- a/conformance/driver-ct/deltic/package-lock.json
+++ b/conformance/driver-ct/deltic/package-lock.json
@@ -6,15 +6,14 @@
     "": {
       "name": "@polymorph/webcrypto-conformance-deltic-browser",
       "dependencies": {
-        "@polymorph/component-test-js": "github:polymorph-components/polymorph-test#b4444a25a22106ad4128549bdc9e579552e62210",
+        "@jsr/polymorph__test": "0.1.1",
         "playwright-core": "1.62.1"
       }
     },
-    "node_modules/@polymorph/component-test-js": {
-      "version": "0.1.0",
-      "resolved": "git+ssh://git@github.com/polymorph-components/polymorph-test.git#b4444a25a22106ad4128549bdc9e579552e62210",
-      "integrity": "sha512-ILkXf8zIytf4r8Z/YlrdwpcBQ+CdBMJ+pImzQzsBoZ9iuCkK3ShtqRBeM/kHXPk9bGS8XQRmDTgkbk2KgGXBFw==",
-      "license": "Apache-2.0 WITH LLVM-exception"
+    "node_modules/@jsr/polymorph__test": {
+      "version": "0.1.1",
+      "resolved": "https://npm.jsr.io/~/11/@jsr/polymorph__test/0.1.1.tgz",
+      "integrity": "sha512-bu0jE52btthChm83f04rQo+twOLszJ/JN7nLGl/5W/66cZb8tQrlZG+Lnd4/XierTlBgy0PpW75bjbqQBY2nDg=="
     },
     "node_modules/playwright-core": {
       "version": "1.62.1",
diff --git a/conformance/driver-ct/deltic/package.json b/conformance/driver-ct/deltic/package.json
index ecceea6..829e869 100644
--- a/conformance/driver-ct/deltic/package.json
+++ b/conformance/driver-ct/deltic/package.json
@@ -4,7 +4,7 @@
   "type": "module",
   "description": "Node driver + bundled worker inputs for the deltic-browser conformance rows: both suites runtime-linked inside headless Chromium with this repo's deltic host module, through the upstream page driver and deltic worker-main.",
   "dependencies": {
-    "@polymorph/component-test-js": "github:polymorph-components/polymorph-test#b4444a25a22106ad4128549bdc9e579552e62210",
+    "@jsr/polymorph__test": "0.1.1",
     "playwright-core": "1.62.1"
   }
 }
diff --git a/conformance/driver-ct/deltic/run-browser.mjs b/conformance/driver-ct/deltic/run-browser.mjs
index dfd35d7..711f644 100644
--- a/conformance/driver-ct/deltic/run-browser.mjs
+++ b/conformance/driver-ct/deltic/run-browser.mjs
@@ -19,8 +19,8 @@ import {
   buildHarnessPage,
   findChrome,
   runPageHarness,
-} from "@polymorph/component-test-js/browser-driver";
-import { writeResultsFile } from "@polymorph/component-test-js/node-runner";
+} from "@jsr/polymorph__test/browser-driver";
+import { writeResultsFile } from "@jsr/polymorph__test/node-runner";
 
 const REPO_ROOT = fileURLToPath(new URL("../../../", import.meta.url));
 const RESULTS_DIR = fileURLToPath(new URL("../results/", import.meta.url));
diff --git a/conformance/driver-ct/jco/.npmrc b/conformance/driver-ct/jco/.npmrc
new file mode 100644
index 0000000..41583e3
--- /dev/null
+++ b/conformance/driver-ct/jco/.npmrc
@@ -0,0 +1 @@
+@jsr:registry=https://npm.jsr.io
diff --git a/conformance/driver-ct/jco/host-imports.mjs b/conformance/driver-ct/jco/host-imports.mjs
index d02ed02..35a0a6e 100644
--- a/conformance/driver-ct/jco/host-imports.mjs
+++ b/conformance/driver-ct/jco/host-imports.mjs
@@ -7,7 +7,7 @@
 // namespaces (Node or browser build). Relative specifiers only: module
 // Web Workers cannot see a page's import map.
 
-import { bindImports } from "./node_modules/@polymorph/component-test-js/js/viewer/imports.mjs";
+import { bindImports } from "./node_modules/@jsr/polymorph__test/viewer/imports.mjs";
 import * as webcrypto from "../../../js/jco/webcrypto.js";
 import { Context } from "../context.js";
 
diff --git a/conformance/driver-ct/jco/package-lock.json b/conformance/driver-ct/jco/package-lock.json
index 12c7b61..132a90e 100644
--- a/conformance/driver-ct/jco/package-lock.json
+++ b/conformance/driver-ct/jco/package-lock.json
@@ -8,7 +8,7 @@
       "dependencies": {
         "@bytecodealliance/jco-transpile": "0.7.0",
         "@bytecodealliance/preview2-shim": "0.17.9",
-        "@polymorph/component-test-js": "github:polymorph-components/polymorph-test#b4444a25a22106ad4128549bdc9e579552e62210",
+        "@jsr/polymorph__test": "0.1.1",
         "playwright-core": "1.62.1"
       }
     },
@@ -82,6 +82,11 @@
         "tslib": "^2.4.0"
       }
     },
+    "node_modules/@jsr/polymorph__test": {
+      "version": "0.1.1",
+      "resolved": "https://npm.jsr.io/~/11/@jsr/polymorph__test/0.1.1.tgz",
+      "integrity": "sha512-bu0jE52btthChm83f04rQo+twOLszJ/JN7nLGl/5W/66cZb8tQrlZG+Lnd4/XierTlBgy0PpW75bjbqQBY2nDg=="
+    },
     "node_modules/@napi-rs/wasm-runtime": {
       "version": "1.2.2",
       "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.2.2.tgz",
@@ -449,12 +454,6 @@
         "node": "^20.19.0 || >=22.12.0"
       }
     },
-    "node_modules/@polymorph/component-test-js": {
-      "version": "0.1.0",
-      "resolved": "git+ssh://git@github.com/polymorph-components/polymorph-test.git#b4444a25a22106ad4128549bdc9e579552e62210",
-      "integrity": "sha512-ILkXf8zIytf4r8Z/YlrdwpcBQ+CdBMJ+pImzQzsBoZ9iuCkK3ShtqRBeM/kHXPk9bGS8XQRmDTgkbk2KgGXBFw==",
-      "license": "Apache-2.0 WITH LLVM-exception"
-    },
     "node_modules/@tybys/wasm-util": {
       "version": "0.10.3",
       "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.3.tgz",
diff --git a/conformance/driver-ct/jco/package.json b/conformance/driver-ct/jco/package.json
index 11b0905..816b5ec 100644
--- a/conformance/driver-ct/jco/package.json
+++ b/conformance/driver-ct/jco/package.json
@@ -12,7 +12,7 @@
   "dependencies": {
     "@bytecodealliance/jco-transpile": "0.7.0",
     "@bytecodealliance/preview2-shim": "0.17.9",
-    "@polymorph/component-test-js": "github:polymorph-components/polymorph-test#b4444a25a22106ad4128549bdc9e579552e62210",
+    "@jsr/polymorph__test": "0.1.1",
     "playwright-core": "1.62.1"
   }
 }
\ No newline at end of file
diff --git a/conformance/driver-ct/jco/reuse-worker.mjs b/conformance/driver-ct/jco/reuse-worker.mjs
index 133b49c..6d5b7b8 100644
--- a/conformance/driver-ct/jco/reuse-worker.mjs
+++ b/conformance/driver-ct/jco/reuse-worker.mjs
@@ -28,8 +28,8 @@ import {
   inventoryLookup,
   resolveTestsExport,
   runCases,
-} from "/__component-test/js/viewer/harness.mjs";
-import { Context as DefaultContext } from "/__component-test/js/viewer/context.js";
+} from "/__component-test/viewer/harness.mjs";
+import { Context as DefaultContext } from "/__component-test/viewer/context.js";
 
 // A rejection escaping the awaited chain (e.g. a platform quirk
 // surfacing through the transpiled guest's async plumbing) would
diff --git a/conformance/driver-ct/jco/run-browser.mjs b/conformance/driver-ct/jco/run-browser.mjs
index 12f44ee..574982d 100644
--- a/conformance/driver-ct/jco/run-browser.mjs
+++ b/conformance/driver-ct/jco/run-browser.mjs
@@ -2,7 +2,7 @@
 // invocation (`--engine chromium|firefox|webkit`), both suites' case
 // loops running inside the headless engine via the upstream page driver
 // — page, worker pool, stall watchdog, and Chrome ladder all live in
-// @polymorph/component-test-js — and writing results/<target>.jsonl +
+// @jsr/polymorph__test — and writing results/<target>.jsonl +
 // results/<target>-signing.jsonl plus a results/<target>.meta.json
 // provenance sidecar (engine + version, consumed by the compat page).
 // This file is the frame: engine selection, core-URL enumeration,
@@ -49,8 +49,8 @@ import {
   buildHarnessPage,
   findChrome,
   runPageHarness,
-} from "@polymorph/component-test-js/browser-driver";
-import { writeResultsFile } from "@polymorph/component-test-js/node-runner";
+} from "@jsr/polymorph__test/browser-driver";
+import { writeResultsFile } from "@jsr/polymorph__test/node-runner";
 
 const REPO_ROOT = fileURLToPath(new URL("../../../", import.meta.url));
 const RESULTS_DIR = fileURLToPath(new URL("../results/", import.meta.url));
diff --git a/conformance/driver-ct/jco/runner.mjs b/conformance/driver-ct/jco/runner.mjs
index 09db82f..9b160d9 100644
--- a/conformance/driver-ct/jco/runner.mjs
+++ b/conformance/driver-ct/jco/runner.mjs
@@ -7,11 +7,11 @@
 // and the Node counterpart of the browser driver's Web Worker pool
 // (run-browser.mjs). Workers interleave, so the rows are re-sorted
 // into suite order before emission. The inventory parsing and per-case
-// loop live in the upstream runner core (@polymorph/component-test-js, the rev-pinned git dependency — one harness for every runner, per polymorph-components/polymorph-test#5).
+// loop live in the upstream runner core (@jsr/polymorph__test, the rev-pinned git dependency — one harness for every runner, per polymorph-components/polymorph-test#5).
 import { availableParallelism } from "node:os";
 import { parseArgs } from "node:util";
 import { Worker } from "node:worker_threads";
-import { envelope, mergeCounts, workerCount } from "@polymorph/component-test-js/harness";
+import { envelope, mergeCounts, workerCount } from "@jsr/polymorph__test/harness";
 
 const { values } = parseArgs({
   options: {
diff --git a/conformance/driver-ct/jco/worker-node.mjs b/conformance/driver-ct/jco/worker-node.mjs
index f2d2622..d641809 100644
--- a/conformance/driver-ct/jco/worker-node.mjs
+++ b/conformance/driver-ct/jco/worker-node.mjs
@@ -7,8 +7,8 @@
 import { fileURLToPath } from "node:url";
 import { parentPort, workerData } from "node:worker_threads";
 import { cli, clocks, io, random, filesystem } from "@bytecodealliance/preview2-shim";
-import { inventoryLookup, runCases } from "@polymorph/component-test-js/harness";
-import { loadCoreModules } from "@polymorph/component-test-js/node-runner";
+import { inventoryLookup, runCases } from "@jsr/polymorph__test/harness";
+import { loadCoreModules } from "@jsr/polymorph__test/node-runner";
 import { Context } from "../context.js";
 import { instantiateSuite } from "./host-imports.mjs";
 
diff --git a/conformance/driver-ct/justfile b/conformance/driver-ct/justfile
index 4abb6dc..3d68334 100644
--- a/conformance/driver-ct/justfile
+++ b/conformance/driver-ct/justfile
@@ -41,7 +41,7 @@ deltic-pin-check:
     set -euo pipefail
     v=$(jq -r '.jsr | keys[]' \
         {{root}}/js/deltic/deno.lock deltic/deno.lock \
-        | grep -v '^@deltic/protocol@' \
+        | grep '^@deltic/' | grep -v '^@deltic/protocol@' \
         | sed 's/.*@//' | sort -u)
     if [ "$(printf '%s\n' "$v" | wc -l)" != 1 ]; then
         echo "deltic pin drift: $v" >&2
@@ -49,6 +49,28 @@ deltic-pin-check:
     fi
     echo "deltic pin OK: $v"
 
+# The JS runner core's one-version gate: every npm tree consuming
+# @jsr/polymorph__test (jsr:@polymorph/test through JSR's npm-compat
+# registry, per each tree's .npmrc) must resolve the same
+# version — a skewed bump runs the JS harness against a Rust runner
+# from a different polymorph-test release, a subtle contract-mismatch
+# generator. Wired next to deltic-pin-check in the conformance CI job.
+runner-js-pin-check:
+    #!/usr/bin/env bash
+    set -euo pipefail
+    v=$({ jq -r '.packages["node_modules/@jsr/polymorph__test"].version' \
+        jco/package-lock.json \
+        ../../examples/jco-demo/package-lock.json \
+        ../../js/jco/package-lock.json \
+        ../../js/componentize/wpt/parity/package-lock.json; \
+        jq -r '.jsr | keys[]' deltic/deno.lock \
+        | grep '^@polymorph/test@' | sed 's/.*@//'; } | sort -u)
+    if [ "$v" = "null" ] || [ "$(printf '%s\n' "$v" | wc -l)" != 1 ]; then
+        echo "runner-js pin drift: $v" >&2
+        exit 1
+    fi
+    echo "runner-js pin OK: @jsr/polymorph__test $v"
+
 # Build both suite components (rkyv corpus). CONFORMANCE_PREBUILT=1
 # skips cargo when the artifacts are already present — set by CI on an
 # exact-source-hash cache hit (see the conformance job's "Restore
@@ -115,18 +137,13 @@ _ct-tools:
         cargo install -q --locked --root "{{ct-tools}}" --git "$url" --rev "$rev" component-test-runner
         printf '%s' "$rev" > "{{ct-tools}}/.rev"
     fi
-    # One-rev-everywhere gate: the JS runner core (@polymorph/component-test-js,
-    # a git-sourced npm dependency) must pin the SAME component-test rev
-    # as the cargo side — a skewed bump runs the JS harness against a
-    # Rust runner from a different rev, a subtle contract-mismatch
-    # generator. Bump both together: the rev in Cargo.toml + `npm
-    # install --save-exact github:polymorph-components/polymorph-test#<rev>` in jco/.
+    # Cargo-side pin gate: every component-test-* git dependency in
+    # Cargo.lock names the expected rev. The JS runner core arrives from
+    # JSR (@jsr/polymorph__test npm aliases); its one-version gate is
+    # runner-js-pin-check below, and the rev<->version pairing is the
+    # bump procedure's job (both sides name one polymorph-test release —
+    # see the root Cargo.toml's bump comment).
     "{{ct-tools}}/bin/component-test" pins --cargo-lock "{{root}}/Cargo.lock" \
-        --js-lock jco/package-lock.json \
-        --js-lock deltic/package-lock.json \
-        --js-lock ../../examples/jco-demo/package-lock.json \
-        --js-lock ../../js/jco/package-lock.json \
-        --js-lock ../../js/componentize/wpt/parity/package-lock.json \
         --expect "$rev" > /dev/null
 
 # Enumerate each suite's full case census (ct-driver instantiates the
@@ -338,7 +355,7 @@ run-composed: build build-provider _ct-tools
 
 # The jco-browser target: the same transpiles and the same host module,
 # with the case loop running inside headless Chromium (browser WebCrypto)
-# via the upstream page driver (@polymorph/component-test-js). The
+# via the upstream page driver (@jsr/polymorph__test). The
 # --missing declarations mirror targets.toml / targets-signing.toml's
 # jco-browser entries, which the aggregate cross-checks: the browser
 # cannot serve sha1-checked, and the host fails the gated RSA
diff --git a/examples/jco-demo/.npmrc b/examples/jco-demo/.npmrc
new file mode 100644
index 0000000..41583e3
--- /dev/null
+++ b/examples/jco-demo/.npmrc
@@ -0,0 +1 @@
+@jsr:registry=https://npm.jsr.io
diff --git a/examples/jco-demo/package-lock.json b/examples/jco-demo/package-lock.json
index e7bc7b1..151aa71 100644
--- a/examples/jco-demo/package-lock.json
+++ b/examples/jco-demo/package-lock.json
@@ -9,7 +9,7 @@
       "version": "0.1.0",
       "devDependencies": {
         "@bytecodealliance/jco-transpile": "0.7.0",
-        "@polymorph/component-test-js": "github:polymorph-components/polymorph-test#b4444a25a22106ad4128549bdc9e579552e62210"
+        "@jsr/polymorph__test": "0.1.1"
       }
     },
     "node_modules/@bytecodealliance/jco-transpile": {
@@ -83,6 +83,12 @@
         "tslib": "^2.4.0"
       }
     },
+    "node_modules/@jsr/polymorph__test": {
+      "version": "0.1.1",
+      "resolved": "https://npm.jsr.io/~/11/@jsr/polymorph__test/0.1.1.tgz",
+      "integrity": "sha512-bu0jE52btthChm83f04rQo+twOLszJ/JN7nLGl/5W/66cZb8tQrlZG+Lnd4/XierTlBgy0PpW75bjbqQBY2nDg==",
+      "dev": true
+    },
     "node_modules/@napi-rs/wasm-runtime": {
       "version": "1.2.2",
       "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.2.2.tgz",
@@ -471,13 +477,6 @@
         "node": "^20.19.0 || >=22.12.0"
       }
     },
-    "node_modules/@polymorph/component-test-js": {
-      "version": "0.1.0",
-      "resolved": "git+ssh://git@github.com/polymorph-components/polymorph-test.git#b4444a25a22106ad4128549bdc9e579552e62210",
-      "integrity": "sha512-ILkXf8zIytf4r8Z/YlrdwpcBQ+CdBMJ+pImzQzsBoZ9iuCkK3ShtqRBeM/kHXPk9bGS8XQRmDTgkbk2KgGXBFw==",
-      "dev": true,
-      "license": "Apache-2.0 WITH LLVM-exception"
-    },
     "node_modules/@tybys/wasm-util": {
       "version": "0.10.3",
       "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.3.tgz",
diff --git a/examples/jco-demo/package.json b/examples/jco-demo/package.json
index fe32d10..2ade71d 100644
--- a/examples/jco-demo/package.json
+++ b/examples/jco-demo/package.json
@@ -12,6 +12,6 @@
   },
   "devDependencies": {
     "@bytecodealliance/jco-transpile": "0.7.0",
-    "@polymorph/component-test-js": "github:polymorph-components/polymorph-test#b4444a25a22106ad4128549bdc9e579552e62210"
+    "@jsr/polymorph__test": "0.1.1"
   }
 }
\ No newline at end of file
diff --git a/js/componentize/wpt/parity/.npmrc b/js/componentize/wpt/parity/.npmrc
new file mode 100644
index 0000000..41583e3
--- /dev/null
+++ b/js/componentize/wpt/parity/.npmrc
@@ -0,0 +1 @@
+@jsr:registry=https://npm.jsr.io
diff --git a/js/componentize/wpt/parity/package-lock.json b/js/componentize/wpt/parity/package-lock.json
index 5521e84..950a132 100644
--- a/js/componentize/wpt/parity/package-lock.json
+++ b/js/componentize/wpt/parity/package-lock.json
@@ -10,7 +10,7 @@
       "devDependencies": {
         "@bytecodealliance/jco-transpile": "0.7.0",
         "@bytecodealliance/preview2-shim": "^0.19.0",
-        "@polymorph/component-test-js": "github:polymorph-components/polymorph-test#b4444a25a22106ad4128549bdc9e579552e62210",
+        "@jsr/polymorph__test": "0.1.1",
         "playwright-core": "^1.62.1"
       }
     },
@@ -85,6 +85,12 @@
         "tslib": "^2.4.0"
       }
     },
+    "node_modules/@jsr/polymorph__test": {
+      "version": "0.1.1",
+      "resolved": "https://npm.jsr.io/~/11/@jsr/polymorph__test/0.1.1.tgz",
+      "integrity": "sha512-bu0jE52btthChm83f04rQo+twOLszJ/JN7nLGl/5W/66cZb8tQrlZG+Lnd4/XierTlBgy0PpW75bjbqQBY2nDg==",
+      "dev": true
+    },
     "node_modules/@napi-rs/wasm-runtime": {
       "version": "1.2.2",
       "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.2.2.tgz",
@@ -473,13 +479,6 @@
         "node": "^20.19.0 || >=22.12.0"
       }
     },
-    "node_modules/@polymorph/component-test-js": {
-      "version": "0.1.0",
-      "resolved": "git+ssh://git@github.com/polymorph-components/polymorph-test.git#b4444a25a22106ad4128549bdc9e579552e62210",
-      "integrity": "sha512-ILkXf8zIytf4r8Z/YlrdwpcBQ+CdBMJ+pImzQzsBoZ9iuCkK3ShtqRBeM/kHXPk9bGS8XQRmDTgkbk2KgGXBFw==",
-      "dev": true,
-      "license": "Apache-2.0 WITH LLVM-exception"
-    },
     "node_modules/@tybys/wasm-util": {
       "version": "0.10.3",
       "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.3.tgz",
diff --git a/js/componentize/wpt/parity/package.json b/js/componentize/wpt/parity/package.json
index 18558ee..1adbf78 100644
--- a/js/componentize/wpt/parity/package.json
+++ b/js/componentize/wpt/parity/package.json
@@ -18,6 +18,6 @@
     "@bytecodealliance/jco-transpile": "0.7.0",
     "@bytecodealliance/preview2-shim": "^0.19.0",
     "playwright-core": "^1.62.1",
-    "@polymorph/component-test-js": "github:polymorph-components/polymorph-test#b4444a25a22106ad4128549bdc9e579552e62210"
+    "@jsr/polymorph__test": "0.1.1"
   }
 }
\ No newline at end of file
diff --git a/js/componentize/wpt/parity/run-browser.mjs b/js/componentize/wpt/parity/run-browser.mjs
index 7027409..cb30e8b 100644
--- a/js/componentize/wpt/parity/run-browser.mjs
+++ b/js/componentize/wpt/parity/run-browser.mjs
@@ -4,7 +4,7 @@
 // writes the two record files the comparator consumes to ../build/
 // (parity-baseline-<engine>.json, parity-roundtrip-<engine>.json).
 // The serve/launch/watchdog machinery is the shared page driver
-// (@polymorph/component-test-js/browser-driver).
+// (@jsr/polymorph__test/browser-driver).
 //
 // `--engine firefox` (default) or `--engine chromium` selects the browser:
 // always Playwright's own build (pinned by playwright-core's version, so
@@ -17,7 +17,7 @@ import { mkdir, writeFile } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
-import { runPageHarness } from "@polymorph/component-test-js/browser-driver";
+import { runPageHarness } from "@jsr/polymorph__test/browser-driver";
 
 const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..", "..", "..");
 const OUT_DIR = join(REPO_ROOT, "js", "componentize", "wpt", "build");
diff --git a/js/jco/.npmrc b/js/jco/.npmrc
new file mode 100644
index 0000000..41583e3
--- /dev/null
+++ b/js/jco/.npmrc
@@ -0,0 +1 @@
+@jsr:registry=https://npm.jsr.io
diff --git a/js/jco/package-lock.json b/js/jco/package-lock.json
index 59bc6f8..1c79700 100644
--- a/js/jco/package-lock.json
+++ b/js/jco/package-lock.json
@@ -9,7 +9,7 @@
       "version": "0.1.0",
       "devDependencies": {
         "@bytecodealliance/jco-transpile": "0.7.0",
-        "@polymorph/component-test-js": "github:polymorph-components/polymorph-test#b4444a25a22106ad4128549bdc9e579552e62210",
+        "@jsr/polymorph__test": "0.1.1",
         "typescript": "^5.9.3"
       }
     },
@@ -84,6 +84,12 @@
         "tslib": "^2.4.0"
       }
     },
+    "node_modules/@jsr/polymorph__test": {
+      "version": "0.1.1",
+      "resolved": "https://npm.jsr.io/~/11/@jsr/polymorph__test/0.1.1.tgz",
+      "integrity": "sha512-bu0jE52btthChm83f04rQo+twOLszJ/JN7nLGl/5W/66cZb8tQrlZG+Lnd4/XierTlBgy0PpW75bjbqQBY2nDg==",
+      "dev": true
+    },
     "node_modules/@napi-rs/wasm-runtime": {
       "version": "1.2.2",
       "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.2.2.tgz",
@@ -472,13 +478,6 @@
         "node": "^20.19.0 || >=22.12.0"
       }
     },
-    "node_modules/@polymorph/component-test-js": {
-      "version": "0.1.0",
-      "resolved": "git+ssh://git@github.com/polymorph-components/polymorph-test.git#b4444a25a22106ad4128549bdc9e579552e62210",
-      "integrity": "sha512-ILkXf8zIytf4r8Z/YlrdwpcBQ+CdBMJ+pImzQzsBoZ9iuCkK3ShtqRBeM/kHXPk9bGS8XQRmDTgkbk2KgGXBFw==",
-      "dev": true,
-      "license": "Apache-2.0 WITH LLVM-exception"
-    },
     "node_modules/@tybys/wasm-util": {
       "version": "0.10.3",
       "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.3.tgz",
diff --git a/js/jco/package.json b/js/jco/package.json
index 4b87cb7..e6273b8 100644
--- a/js/jco/package.json
+++ b/js/jco/package.json
@@ -13,6 +13,6 @@
   "devDependencies": {
     "@bytecodealliance/jco-transpile": "0.7.0",
     "typescript": "^5.9.3",
-    "@polymorph/component-test-js": "github:polymorph-components/polymorph-test#b4444a25a22106ad4128549bdc9e579552e62210"
+    "@jsr/polymorph__test": "0.1.1"
   }
 }
\ No newline at end of file