policy: hand-written code in any language but t27 may only shrink -- check_budget denies a net gain #8227

Owner rule, 2026-10-09 (translated): "Strictly forbid hand-written code in the repository in any language other than t27!!" Also: "t27b must be generated entirely from .t27 specs".

Problem. The #7371 budget (40 added lines per file, 80 per PR) caps growth but does not stop it. During 2026-10-08/09 the hand-written cli/t27b/src grew from 16,075 to 16,571 lines, in 20-60-line glue steps that each fit the cap.

Change (owner-only gate files).

• specs/policy/own_language.t27 check_budget() gains a third rule: over the whole diff, the counted foreign files may not gain more lines than they lose.
• Glue (a #[path] mount of generated code) is allowed only when the same diff deletes at least as much hand-written foreign code, by porting it to .t27.
• Lines moved between foreign files net to zero. Deleting specs or generated code offsets nothing.
• No exception and no label lifts it. The 40/80 caps stay.
• gen/c/policy/own_language.c is regenerated with t27c gen-c.

Verified on the t27c lab with master's t27c:

• t27c test-report passes 33/33 with 0 vacuous passes, including the new test foreign_code_only_shrinks and the rewritten budget tests.
• master's own_language.c equals gen-c of master's spec byte for byte, so the regenerated C carries only this change.
• Against real PR diffs:
  • denied: t27b: an untyped list local that the code indexes lowers as a tuple, from a t27 plan (Closes #8050) #8055 (+62), t27b: an anytype parameter the body never reads is void, and a compile-time argument passes for it, from a t27 plan (Closes #7876) #8028, t27b: / and % of two integer constants fold at compile time, as Zig folds them (Closes #7812) #8027, t27b: @intCast as an array index or a slice bound takes Zig's usize, from int_cast_plan.t27 (Closes #7902) #7905, t27b: std.math.pow of an f32 calls a t27 port of Zig's pow.zig, and gf16.t27 passes (Closes #7823) #8167, t27b: a local bound to an array repeat [v; n] and passed as [N]T is that array, as gen-zig prints .{ v } ** n (Closes #7909) #7912 and t27b: ledger rows carry the host-free verdict key; bless rewrites only rows that moved (Closes #8186) #8218;
  • allowed: the port t27b: eval::arith, the reference interpreter's exact arithmetic, moves to specs/tri/t27b/eval_arith.t27 (Closes #8057) #8086 (-47) and t27b lab: only a master run moves /ddc/latest.receipt.json (Closes #7955) #7956 (6/6, net 0).

Agents may not commit gate files, so the owner applies this patch.

User Scenarios

• Given a PR diff that adds 62 net lines to hand-written foreign files (e.g., t27b: an untyped list local that the code indexes lowers as a tuple, from a t27 plan (Closes #8050) #8055), when check_budget runs, then it denies the PR because foreign code grew.
• Given a PR diff that ports 47 lines from hand-written foreign code to .t27 specs (e.g., t27b: eval::arith, the reference interpreter's exact arithmetic, moves to specs/tri/t27b/eval_arith.t27 (Closes #8057) #8086), when check_budget runs, then it allows the PR because foreign code shrank.
• Given a PR diff that moves lines between foreign files with net zero change (e.g., t27b lab: only a master run moves /ddc/latest.receipt.json (Closes #7955) #7956), when check_budget runs, then it allows the PR because foreign code did not grow.

Requirements

• FR-001: specs/policy/own_language.t27 check_budget() MUST enforce a third rule: over the whole diff, the counted foreign files may not gain more lines than they lose.
• FR-002: Glue code via #[path] MUST be allowed only when the same diff deletes at least as much hand-written foreign code by porting it to .t27.
• FR-003: Lines moved between foreign files MUST net to zero for budget accounting.
• FR-004: Deleting specs or generated code MUST NOT offset foreign code growth.
• FR-005: The existing 40-line-per-file and 80-line-per-PR caps MUST remain in effect.
• FR-006: gen/c/policy/own_language.c MUST be regenerated by running t27c gen-c after the spec change.

Success Criteria

• t27c test-report passes 33/33 with 0 vacuous passes, including the new test foreign_code_only_shrinks and rewritten budget tests.
• gen/c/policy/own_language.c equals t27c gen-c output of specs/policy/own_language.t27 byte for byte.
• Against the cited real PR diffs: t27b: an untyped list local that the code indexes lowers as a tuple, from a t27 plan (Closes #8050) #8055, t27b: an anytype parameter the body never reads is void, and a compile-time argument passes for it, from a t27 plan (Closes #7876) #8028, t27b: / and % of two integer constants fold at compile time, as Zig folds them (Closes #7812) #8027, t27b: @intCast as an array index or a slice bound takes Zig's usize, from int_cast_plan.t27 (Closes #7902) #7905, t27b: std.math.pow of an f32 calls a t27 port of Zig's pow.zig, and gf16.t27 passes (Closes #7823) #8167, t27b: a local bound to an array repeat [v; n] and passed as [N]T is that array, as gen-zig prints .{ v } ** n (Closes #7909) #7912, t27b: ledger rows carry the host-free verdict key; bless rewrites only rows that moved (Closes #8186) #8218 are denied; t27b: eval::arith, the reference interpreter's exact arithmetic, moves to specs/tri/t27b/eval_arith.t27 (Closes #8057) #8086 and t27b lab: only a master run moves /ddc/latest.receipt.json (Closes #7955) #7956 are allowed.

Boundary

• specs/policy/own_language.t27
• gen/c/policy/own_language.c