Triage ReScript deprecated API findings as a language-migration bucket

[hyperpolymath]

Failure type

echidna has a large migration_rules/deprecated_api alert bucket for ReScript migration work.

Evidence

On 2026-06-06, echidna has 73 open Hypatia alerts under hypatia/migration_rules/deprecated_api.

Examples from local source include ReScript files using older or policy-sensitive APIs/patterns:

• src/rescript/src/Main.res
• src/rescript/src/state/Store.res
• src/rescript/src/api/Client.res
• src/rescript/src/components/*.res
• src/provers/clients/*.res
• echidna-playground/src/*.res

Expected behavior

This should be handled as a language-migration bucket, not as 73 independent security bugs.

Route

Suggested route: rhodibot PR-only, with ReScript/AffineScript migration context. If the policy is now AffineScript-first, the issue should decide whether echidna keeps ReScript as legacy source, migrates it, or adds documented scoped suppressions for deliberate compatibility surfaces.

Safety notes

Do not auto-rewrite all .res files without build verification. This should be batched by module, with before/after compile checks and no semantic no-op masking.

Acceptance criteria

• Findings are grouped by API/pattern and source subtree.
• Intentional externals/FFI bindings are documented or suppressed with local rationale.
• Real migration changes are made in reviewable PRs.
• Hypatia output names this as language-migration, not generic deprecated API noise.