diff --git a/apps/website/README.md b/apps/website/README.md
index 1f7ec8a8bd..73d595b745 100644
--- a/apps/website/README.md
+++ b/apps/website/README.md
@@ -236,6 +236,16 @@ npm run check:discovery                                                 # кон
 коммитит свои числа. Публикация на t27.ai остаётся за `deploy-site.yml` — вручную,
 по правилу «контент утверждается до выхода».
 
+### T27F graph view (`/t27f/graph/`)
+
+A static page, `public/t27f/graph/`, that draws the T27F graph of a `.t27` spec: one box per node,
+one line per edge, labelled with kind, name, source lines and inference label. The graph comes from
+`specs/t27f/spec_graph_export.t27` and the layout from `specs/t27f/spec_graph_view.t27`, both
+compiled to `t27f.wasm`; `graph.js` is only the glue (loads the wasm, feeds the bytes, emits SVG).
+A spec over the graph's cap (192 nodes, 254 edges) is refused with the verdict, never truncated.
+`PROVENANCE.txt` in that directory records the t27 commit, the compiler, the checksums and how to
+rebuild. To add a spec to the picker, copy it from t27 into `specs/` there and add an `<option>`.
+
 ### Проверки
 
 ```bash
diff --git a/apps/website/public/t27f/graph/PROVENANCE.txt b/apps/website/public/t27f/graph/PROVENANCE.txt
new file mode 100644
index 0000000000..b9ce341dd8
--- /dev/null
+++ b/apps/website/public/t27f/graph/PROVENANCE.txt
@@ -0,0 +1,46 @@
+/t27f/graph/ -- where every byte on the page comes from
+=======================================================
+
+The T27F graph view (epic gHashTag/trinity#1648, RFC gHashTag/trinity#1649). The page draws one
+box per node and one line per edge of a .t27 spec. It holds no graph, no layout and no verdict
+of its own:
+
+  spec_graph_export.t27   reads the spec's bytes into the graph (exact nodes and edges only;
+                          at most 192 nodes and 254 edges; over that it refuses, never truncates)
+  spec_graph_view.t27     places, sizes and colours every box and line
+  spec_graph.t27          the graph IR both of them share
+
+Both run as t27f.wasm. graph.js (39 lines, comments included) is the whole of the hand-written
+JavaScript: it loads the wasm, writes the spec's bytes in, loops over nodes and edges and emits
+SVG. The one number it computes is how many characters of "kind name" fit in a box's first line
+(font size x 0.6); the full text is in the box's tooltip.
+
+Source
+  gHashTag/t27 master 290ff17df, specs/t27f/ and specs/tutorial/08_modules_and_arrays.t27
+  (specs/*.t27 here are byte-identical to that commit)
+Compiler
+  t27c 0.5.2 (built from gHashTag/t27 90fc25b3b), zig 0.16.0, on the Railway lab
+Built in
+  gHashTag/t27-mcp wasm/ (export.zig is the hand glue: byte buffers and getters, no spec
+  knowledge), PR gHashTag/t27-mcp#13, commit 72ecc84. wasm/BUILD there has the full recipe.
+
+Checksums (sha256)
+  t27f.wasm              eaa97ac361cb2b7ebadacf0c7a33f6daaabf7b547df1f00353900dfd3e7c44e1
+  spec_graph_view.mjs    739118fa01cf501bdb3eab925ef9404873230a82907faf5e6e44c006e206c962
+  generated Zig the wasm is built from, not vendored:
+    spec_graph_view.zig    191d55d9bb54d57017943a1903790e4661dfd237dfe507804cef3fcdfab33c19
+    spec_graph_export.zig  5297308f1d54c2688801995d56db402809fc794a7dbe5f28ad119c5b3593ede7
+  specs/spec_graph.t27         a3dbe0ec5110c48183ebea101109598e8542bb0ffdf9e061c672162d7da03fe7
+  specs/spec_graph_view.t27    22579bc98aecb3c4405991eef8b5060eb4151b17b200dfbae07a75d8b1e8547a
+  specs/spec_graph_export.t27  ef4ee24d5debc51be4a10835947c86a0211b867dd6ca97890a15198daa744728
+  specs/ui_plan.t27            383fdfb78aa13f2e48172a20e9863d91aa5147b63b1685be8e3a40667243a3f1
+
+Reproduced on the Railway lab on 2026-10-18 from these vendored specs:
+  t27c gen-js spec_graph_view.t27 gives spec_graph_view.mjs byte for byte;
+  t27c gen spec_graph_view.t27 and spec_graph_export.t27 give the two .zig above;
+  zig build-exe export.zig -target wasm32-freestanding -fno-entry -rdynamic -O ReleaseSmall
+  -femit-bin=t27f.wasm gives t27f.wasm byte for byte.
+(Generate from a directory laid out as specs/t27f/, so that the `use t27f::...` lines resolve.)
+
+Not here yet: derived edges (calls inferred beyond what the exporter reads exactly). Every edge
+on the page is exact, and the page says so.
diff --git a/apps/website/public/t27f/graph/graph.js b/apps/website/public/t27f/graph/graph.js
new file mode 100644
index 0000000000..1eac7aec68
--- /dev/null
+++ b/apps/website/public/t27f/graph/graph.js
@@ -0,0 +1,39 @@
+// Thin glue for /t27f/graph/. The exporter and the layout run in t27f.wasm (specs/t27f/spec_graph_export.t27
+// and spec_graph_view.t27); this file moves a spec's bytes in, reads boxes and lines out and emits SVG. It
+// decides no node, edge, span, position, size, colour or verdict. See PROVENANCE.txt.
+import * as G from './spec_graph_view.mjs'
+const $ = (id) => document.getElementById(id), hex = (c) => `#${c.toString(16).padStart(6, '0')}`
+const nm = (p, v) => Object.keys(G).find((c) => c.startsWith(p) && !c.endsWith('KINDS') && G[c] === v)?.slice(p.length).toLowerCase() ?? String(v)
+const R = (await WebAssembly.instantiateStreaming(fetch('./t27f.wasm'), {})).instance.exports
+const dec = new TextDecoder(), enc = new TextEncoder()
+const name = (i) => dec.decode(new Uint8Array(R.memory.buffer, R.gx_node_name_ptr(i), R.gx_node_name_len(i)))
+const el = (tag, a, ...kids) => { const e = document.createElementNS('http://www.w3.org/2000/svg', tag); for (const k in a) e.setAttribute(k, a[k]); e.append(...kids); return e }
+const dash = (d) => (d ? { 'stroke-dasharray': d } : {})
+
+async function show(path, file) {
+  const out = $('graph'), status = $('status'), body = enc.encode(await (await fetch(`./specs/${file}`)).text()), p = enc.encode(path)
+  out.replaceChildren(); status.className = ''
+  if (!R.gx_set_len(body.length) || !R.gx_set_path_len(p.length)) return (status.textContent = `${path}: too large for the exporter's buffers; nothing drawn.`, status.className = 'refused')
+  new Uint8Array(R.memory.buffer).set(body, R.gx_src_ptr()); new Uint8Array(R.memory.buffer).set(p, R.gx_path_ptr())
+  const v = R.gx_load()
+  if (v !== G.GRAPH_OK) { // refused, never truncated
+    const why = v === G.ERR_TOO_MANY_NODES ? `${R.gx_node_count()} nodes found, at most ${G.MAX_NODES}` : v === G.ERR_TOO_MANY_EDGES ? `${R.gx_edge_count()} edges found, at most ${G.MAX_EDGES}` : `verdict ${v}`
+    return (status.textContent = `${path}: refused, ${nm('ERR_', v).replace(/_/g, ' ')} (${why}). No graph is drawn and none is truncated.`, status.className = 'refused')
+  }
+  if (R.gx_view_verdict() !== G.VIEW_OK) return (status.textContent = `${path}: the view refuses it, verdict ${R.gx_view_verdict()}.`, status.className = 'refused')
+  const W = R.gx_view_width(), H = R.gx_view_height(), svg = el('svg', { viewBox: `0 0 ${W} ${H}`, width: W, height: H, 'font-family': 'system-ui,sans-serif' }, el('rect', { width: W, height: H, fill: hex(G.VIEW_BACKDROP) }))
+  for (let j = 0; j < R.gx_edge_count(); j++)
+    svg.append(el('line', { x1: R.gx_view_edge_x1(j), y1: R.gx_view_edge_y1(j), x2: R.gx_view_edge_x2(j), y2: R.gx_view_edge_y2(j), stroke: hex(R.gx_view_edge_stroke(j)), 'stroke-width': 1.5, ...dash(R.gx_view_edge_dash(j)) },
+      el('title', {}, `${nm('EDGE_', R.gx_edge_kind(j))}: ${name(R.gx_edge_from(j))} -> ${name(R.gx_edge_to(j))}, line ${R.gx_edge_line(j)}`)))
+  for (let i = 0; i < R.gx_node_count(); i++) {
+    const x = R.gx_view_node_x(i), y = R.gx_view_node_y(i), w = R.gx_view_node_w(i), a = R.gx_line_start(i), b = R.gx_line_end(i), px = G.VIEW_FONT_PX
+    const l1 = `${nm('NODE_', R.gx_node_kind(i))} ${name(i)}`, l2 = `${nm('LABEL_', R.gx_node_label(i))} - L${a}${b > a ? `-${b}` : ''}`, fit = Math.floor((w - 16) / (px * 0.6))
+    const t = (dy, s) => el('text', { x: x + 8, y: y + dy, 'font-size': px, fill: hex(G.VIEW_TEXT) }, s)
+    svg.append(el('rect', { x, y, width: w, height: R.gx_view_node_h(i), rx: 6, fill: hex(R.gx_view_node_fill(i)), stroke: hex(R.gx_view_node_stroke(i)), 'stroke-width': 1.5, ...dash(R.gx_view_node_dash(i)) }),
+      t(px + 2, l1.length > fit ? `${l1.slice(0, fit - 1)}...` : l1), t(2 * px + 5, l2), el('title', {}, `${l1} - ${l2}`))
+  }
+  out.append(svg)
+  status.textContent = `${path}: ${R.gx_line_count()} lines, ${R.gx_node_count()} nodes, ${R.gx_edge_count()} edges, ${W}x${H}. Exact only: no derived or suggested edges.`
+}
+const pick = $('spec'), go = () => show(pick.selectedOptions[0].dataset.path, pick.value)
+pick.addEventListener('change', go); go()
diff --git a/apps/website/public/t27f/graph/index.html b/apps/website/public/t27f/graph/index.html
new file mode 100644
index 0000000000..8dd3b5b509
--- /dev/null
+++ b/apps/website/public/t27f/graph/index.html
@@ -0,0 +1,33 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>T27F graph view of a .t27 spec &middot; Trinity S&sup3;AI</title>
+<meta name="description" content="The T27F graph view: a box per node and a line per edge of a .t27 spec, placed and coloured by specs/t27f/spec_graph_view.t27, running as WebAssembly in your browser.">
+<link rel="canonical" href="https://t27.ai/t27f/graph/">
+<link rel="icon" href="../../favicon.svg" type="image/svg+xml">
+<style>body{margin:0;font:15px/1.5 system-ui,sans-serif;background:#fff;color:#1a1a1a}main{padding:1rem 1.25rem}h1{font-size:1.3rem;margin:0 0 .25rem}p{max-width:62rem;margin:.25rem 0 .75rem}select{font:inherit;padding:.2rem}#status{margin:.75rem 0;font-weight:600}#status.refused{color:#a02020}#graph{overflow:auto;border:1px solid #ccc}a{color:#2459a8}</style>
+</head>
+<body>
+<main>
+<h1>T27F graph view</h1>
+<p>One box per node, one line per edge of a <code>.t27</code> spec. The graph is read from the spec's bytes by <code>spec_graph_export.t27</code>; the placement, size and colour of every box come from <code>spec_graph_view.t27</code>. Both run here as WebAssembly. A box shows its kind, name, inference label (exact, derived, suggested, unknown) and source lines; dashed outlines mark labels weaker than exact. A spec over the graph's cap is refused, never drawn truncated. See <a href="./PROVENANCE.txt">PROVENANCE.txt</a> for the exact sources, compiler and checksums.</p>
+<label>Spec <select id="spec">
+<option value="08_modules_and_arrays.t27" data-path="specs/tutorial/08_modules_and_arrays.t27">tutorial 08: modules and arrays</option>
+<option value="quest.t27" data-path="specs/t27f/quest.t27">t27f: quest</option>
+<option value="reel_gf16_nmse.t27" data-path="specs/t27f/reel_gf16_nmse.t27">t27f: reel_gf16_nmse</option>
+<option value="ui_plan.t27" data-path="specs/t27f/ui_plan.t27">t27f: ui_plan (251 of 254 edges)</option>
+<option value="reel_t27_basics.t27" data-path="specs/t27f/reel_t27_basics.t27">t27f: reel_t27_basics</option>
+<option value="topic_reel.t27" data-path="specs/t27f/topic_reel.t27">t27f: topic_reel</option>
+<option value="spec_graph.t27" data-path="specs/t27f/spec_graph.t27">t27f: spec_graph (over the cap: refused)</option>
+<option value="spec_graph_view.t27" data-path="specs/t27f/spec_graph_view.t27">t27f: spec_graph_view (over the cap: refused)</option>
+<option value="spec_graph_export.t27" data-path="specs/t27f/spec_graph_export.t27">t27f: spec_graph_export (over the cap: refused)</option>
+</select></label>
+<div id="status" role="status">Loading the T27F wasm&hellip;</div>
+<div id="graph"></div>
+<noscript><p>This page runs WebAssembly and needs JavaScript.</p></noscript>
+</main>
+<script type="module" src="./graph.js"></script>
+</body>
+</html>
diff --git a/apps/website/public/t27f/graph/spec_graph_view.mjs b/apps/website/public/t27f/graph/spec_graph_view.mjs
new file mode 100644
index 0000000000..dac7fe8cc8
--- /dev/null
+++ b/apps/website/public/t27f/graph/spec_graph_view.mjs
@@ -0,0 +1,182 @@
+// Generated by `t27c gen-js` from spec_graph_view.t27. Do not edit.
+//
+// Every name and every value here comes from that spec. Change the spec and
+// regenerate; an edit made here is lost the next time anyone builds.
+
+export const VIEW_OK = 0;
+export const VIEW_ERR_EDGE_NO_LINE = 19;
+export const VIEW_KIND_ORDER = [0, 2, 3, 4, 5, 6, 1, 7];
+export const VIEW_MARGIN = 40;
+export const VIEW_COL_W = 220;
+export const VIEW_COL_STEP = 260;
+export const VIEW_ROW_STEP = 64;
+export const VIEW_BAND_GAP = 48;
+export const VIEW_LABEL_W = [220, 220, 200, 200];
+export const VIEW_LABEL_H = [44, 44, 36, 36];
+export const VIEW_LABEL_INDENT = [0, 0, 10, 10];
+export const VIEW_LABEL_FILL = [0xDCEFE0, 0xDDE8F7, 0xFFF1D0, 0xECECEC];
+export const VIEW_LABEL_STROKE = [0x1B7F3B, 0x2459A8, 0xB7791F, 0x8A8A8A];
+export const VIEW_LABEL_DASH = [0, 6, 3, 2];
+export const VIEW_TEXT = 0x1A1A1A;
+export const VIEW_BACKDROP = 0xFFFFFF;
+export const VIEW_FONT_PX = 13;
+export const VIEW_LANE_STEP = 4;
+export const VIEW_LANE_HALF = 8;
+// t27c gen-js: fn view_is_unknown was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_style was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_kind_present was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_column was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_column_count was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_node_column was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_row was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_known_depth was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_band_top was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_node_x was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_node_y was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_node_w was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_node_h was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_node_fill was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_node_stroke was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_node_dash was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_node_widget was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_width was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_height was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_edge_line was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_verdict was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_edge_x1 was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_edge_x2 was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_lane_y was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_edge_y1 was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_edge_y2 was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_edge_stroke was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_edge_dash was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_overlap was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_overlap_count was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_point_in was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_ends_on was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_edges_attach was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_alone_below was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_fx was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_verdict was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_node_count was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_edge_count was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_width was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_height was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_node_kind was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_node_label was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_node_line_start was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_node_line_end was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_node_x was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_node_y was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_node_w was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_node_h was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_node_fill was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_node_stroke was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_node_dash was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_node_widget was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_edge_kind was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_edge_label was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_edge_line was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_edge_x1 was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_edge_y1 was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_edge_x2 was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_edge_y2 was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_edge_stroke was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_edge_dash was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: a TestBlock was not emitted -- it is checked by the compiler, not by the artifact.
+// t27c gen-js: a TestBlock was not emitted -- it is checked by the compiler, not by the artifact.
+// t27c gen-js: a TestBlock was not emitted -- it is checked by the compiler, not by the artifact.
+// t27c gen-js: a TestBlock was not emitted -- it is checked by the compiler, not by the artifact.
+// t27c gen-js: a TestBlock was not emitted -- it is checked by the compiler, not by the artifact.
+// t27c gen-js: a TestBlock was not emitted -- it is checked by the compiler, not by the artifact.
+// t27c gen-js: a TestBlock was not emitted -- it is checked by the compiler, not by the artifact.
+// t27c gen-js: a TestBlock was not emitted -- it is checked by the compiler, not by the artifact.
+// t27c gen-js: a TestBlock was not emitted -- it is checked by the compiler, not by the artifact.
+// t27c gen-js: a InvariantBlock was not emitted -- it is checked by the compiler, not by the artifact.
+// t27c gen-js: a InvariantBlock was not emitted -- it is checked by the compiler, not by the artifact.
+// t27c gen-js: a InvariantBlock was not emitted -- it is checked by the compiler, not by the artifact.
+// t27c gen-js: a InvariantBlock was not emitted -- it is checked by the compiler, not by the artifact.
+export const EDGE_CALLS = 0;
+export const EDGE_CONSTRAINS = 3;
+export const EDGE_DATA_FLOW = 4;
+export const EDGE_FROM_KINDS = [60, 61, 4, 16, 198];
+export const EDGE_KINDS = 5;
+export const EDGE_TESTED_BY = 2;
+export const EDGE_TO_KINDS = [4, 66, 56, 6, 188];
+export const EDGE_USES = 1;
+export const ERR_DUPLICATE_EDGE = 18;
+export const ERR_EDGE_DANGLING = 13;
+export const ERR_EDGE_ENDPOINT_KIND = 14;
+export const ERR_EDGE_KIND = 12;
+export const ERR_EDGE_LABEL = 16;
+export const ERR_EDGE_LINE = 17;
+export const ERR_EDGE_UNKNOWN_NODE = 15;
+export const ERR_GRAPH_VERSION = 1;
+export const ERR_LABEL = 7;
+export const ERR_MODULE = 5;
+export const ERR_NODE_KIND = 6;
+export const ERR_NODE_NAME = 8;
+export const ERR_SPAN_MISSING = 11;
+export const ERR_SPAN_ORDER = 9;
+export const ERR_SPAN_OUTSIDE = 10;
+export const ERR_SPEC_PATH = 2;
+export const ERR_TOO_MANY_EDGES = 4;
+export const ERR_TOO_MANY_NODES = 3;
+export const GRAPH_IR_VERSION = 1;
+export const GRAPH_OK = 0;
+export const LABEL_DERIVED = 1;
+export const LABEL_EXACT = 0;
+export const LABEL_KINDS = 4;
+export const LABEL_SUGGESTED = 2;
+export const LABEL_UNKNOWN = 3;
+export const MAX_EDGES = 254;
+export const MAX_NODES = 192;
+export const NODE_BENCH = 5;
+export const NODE_CONST = 1;
+export const NODE_FN = 2;
+export const NODE_INVARIANT = 4;
+export const NODE_KINDS = 8;
+export const NODE_MODULE = 0;
+export const NODE_OPAQUE = 7;
+export const NODE_TEST = 3;
+export const NODE_USE = 6;
+export const NO_INDEX = 255;
+export const NO_LINE = 0;
+export const SpecGraph = Object.freeze({ __struct__: "SpecGraph", fields: [["ir_version", "u32"], ["spec_path", "str"], ["line_count", "u32"], ["node_count", "u32"], ["node_kind", "[192]u8"], ["node_label", "[192]u8"], ["node_name", "[192]str"], ["line_start", "[192]u32"], ["line_end", "[192]u32"], ["edge_count", "u32"], ["edge_kind", "[254]u8"], ["edge_from", "[254]u8"], ["edge_to", "[254]u8"], ["edge_label", "[254]u8"], ["edge_line", "[254]u32"]] });
+export const VERDICT_KINDS = 19;
+// t27c gen-js: fn blank_graph was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn kind_bit was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn node_widget was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn span_holds was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn tutorial_08_graph was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn valid_edge_kind was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn valid_label was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn valid_node_kind was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn validate_edge was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn validate_graph was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn validate_graph_header was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn validate_node was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn with_edge was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn with_node was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn with_suggestion was not emitted -- this backend lowers declarations, not bodies.
+export const WIDGET_FORMULA_VIEW = 2;
+export const WIDGET_HONEYCOMB_CARD = 1;
+export const WIDGET_METRICS_TABLE = 3;
+export const WIDGET_RUN_BUTTON = 4;
+export const WIDGET_TEXT_BLOCK = 5;
+
+// Declaration order, which the spec's own laws depend on.
+export const __STRUCT_ORDER__ = ["SpecGraph"];
+export const __DECL_ORDER__ = ["VIEW_OK", "VIEW_ERR_EDGE_NO_LINE", "VIEW_KIND_ORDER", "VIEW_MARGIN", "VIEW_COL_W", "VIEW_COL_STEP", "VIEW_ROW_STEP", "VIEW_BAND_GAP", "VIEW_LABEL_W", "VIEW_LABEL_H", "VIEW_LABEL_INDENT", "VIEW_LABEL_FILL", "VIEW_LABEL_STROKE", "VIEW_LABEL_DASH", "VIEW_TEXT", "VIEW_BACKDROP", "VIEW_FONT_PX", "VIEW_LANE_STEP", "VIEW_LANE_HALF", "EDGE_CALLS", "EDGE_CONSTRAINS", "EDGE_DATA_FLOW", "EDGE_FROM_KINDS", "EDGE_KINDS", "EDGE_TESTED_BY", "EDGE_TO_KINDS", "EDGE_USES", "ERR_DUPLICATE_EDGE", "ERR_EDGE_DANGLING", "ERR_EDGE_ENDPOINT_KIND", "ERR_EDGE_KIND", "ERR_EDGE_LABEL", "ERR_EDGE_LINE", "ERR_EDGE_UNKNOWN_NODE", "ERR_GRAPH_VERSION", "ERR_LABEL", "ERR_MODULE", "ERR_NODE_KIND", "ERR_NODE_NAME", "ERR_SPAN_MISSING", "ERR_SPAN_ORDER", "ERR_SPAN_OUTSIDE", "ERR_SPEC_PATH", "ERR_TOO_MANY_EDGES", "ERR_TOO_MANY_NODES", "GRAPH_IR_VERSION", "GRAPH_OK", "LABEL_DERIVED", "LABEL_EXACT", "LABEL_KINDS", "LABEL_SUGGESTED", "LABEL_UNKNOWN", "MAX_EDGES", "MAX_NODES", "NODE_BENCH", "NODE_CONST", "NODE_FN", "NODE_INVARIANT", "NODE_KINDS", "NODE_MODULE", "NODE_OPAQUE", "NODE_TEST", "NODE_USE", "NO_INDEX", "NO_LINE", "SpecGraph", "VERDICT_KINDS", "WIDGET_FORMULA_VIEW", "WIDGET_HONEYCOMB_CARD", "WIDGET_METRICS_TABLE", "WIDGET_RUN_BUTTON", "WIDGET_TEXT_BLOCK"];
+
+// What this spec holds and this backend did not print. Empty is the whole
+// story most of the time; an entry here is a promise the artifact does not
+// keep, and reading it is how a tool tells a partial module from a complete
+// one without parsing comments.
+//
+// A LIST, not a map keyed by name. `specs/numeric/formats.t27` declares four
+// separate consts called `result`, one per test block, and under an object
+// literal three of the four omissions vanished into the fourth -- a record of
+// what went missing that itself went missing. A spec is free to reuse a
+// name; this file is not free to lose the second one.
+export const __NOT_EMITTED__ = Object.freeze([]);
diff --git a/apps/website/public/t27f/graph/specs/08_modules_and_arrays.t27 b/apps/website/public/t27f/graph/specs/08_modules_and_arrays.t27
new file mode 100644
index 0000000000..935144a539
--- /dev/null
+++ b/apps/website/public/t27f/graph/specs/08_modules_and_arrays.t27
@@ -0,0 +1,93 @@
+// SPDX-License-Identifier: Apache-2.0
+; 08 -- Modules, visibility and arrays
+; Lesson 8, the last one. How a spec names itself, what it exposes, how it
+; pulls in another spec, and the array/index syntax used by every lookup table
+; in the corpus.
+; .
+; After this, open specs/numeric/gf16.t27 -- it is a real spec built entirely
+; out of what these eight lessons cover.
+; phi^2 + 1/phi^2 = 3 | TRINITY
+
+module tutorial-08-modules;
+
+// ============================================================================
+// use
+//
+//   use path::to::spec;
+//
+// Pulls in another spec. Paths are `::`-separated and rooted at the corpus,
+// not at the filesystem.
+// ============================================================================
+
+use base::types;
+
+// ============================================================================
+// pub
+//
+// `pub` makes a name part of this spec's surface. Without it the name is
+// internal: usable here, invisible elsewhere. Default to leaving things
+// private -- a spec's exported surface is a promise to whoever imports it.
+// ============================================================================
+
+pub const EXPORTED_WIDTH : u8 = 16;
+
+// No `pub`: an implementation detail of this module.
+const INTERNAL_SCALE : u8 = 4;
+
+pub fn scaled_width() u8 {
+    return EXPORTED_WIDTH / INTERNAL_SCALE;
+}
+
+// ============================================================================
+// Arrays
+//
+//   pub const NAME : [N]TYPE = [a, b, c];
+//
+// The length and the element type are part of the declared type, written out
+// like every other width in this language. Fixed tables like this are how the
+// numeric specs carry their constants.
+//
+// The Zig-style `[_]TYPE{ a, b, c }` parses, but it lowers to an untyped tuple:
+// indexing one with a runtime value does not compile. Write the type.
+// ============================================================================
+
+pub const TRIT_VALUES : [3]i8 = [-1, 0, 1];
+
+pub const POWERS_OF_TWO : [8]u16 = [1, 2, 4, 8, 16, 32, 64, 128];
+
+pub const EXPONENT_BIAS : [4]u8 = [15, 31, 63, 127];
+
+// ============================================================================
+// Indexing
+//
+// `array[i]`, zero-based.
+// ============================================================================
+
+pub fn power_of_two(index: u8) u16 {
+    return POWERS_OF_TWO[index];
+}
+
+pub fn bias_for_width(index: u8) u8 {
+    return EXPONENT_BIAS[index];
+}
+
+// ============================================================================
+// Tests
+// ============================================================================
+
+test "the power table matches its own definition" {
+    try std.testing.expectEqual(@as(u16, 1), power_of_two(0));
+    try std.testing.expectEqual(@as(u16, 128), power_of_two(7));
+}
+
+test "bias table carries the four standard widths" {
+    try std.testing.expectEqual(@as(u8, 15), bias_for_width(0));
+    try std.testing.expectEqual(@as(u8, 127), bias_for_width(3));
+}
+
+test "a private constant is still usable inside its own module" {
+    try std.testing.expectEqual(@as(u8, 4), scaled_width());
+}
+
+invariant exported_width_is_a_power_of_two
+    assert EXPORTED_WIDTH == 16
diff --git a/apps/website/public/t27f/graph/specs/quest.t27 b/apps/website/public/t27f/graph/specs/quest.t27
new file mode 100644
index 0000000000..1c82062c14
--- /dev/null
+++ b/apps/website/public/t27f/graph/specs/quest.t27
@@ -0,0 +1,360 @@
+// SPDX-License-Identifier: Apache-2.0
+; specs/t27f/quest.t27 -- one quest turn on a topic map: the Queen picks one cell and one relevant bee,
+; the bee's evidence goes through the engine's gates, a progression event fires once, and anything
+; high-impact waits for a human (gHashTag/t27#10030).
+; This is an application built on T27F, like the topic map it walks (gHashTag/trinity#1677). It is
+; not T27F: T27F is the visual spec of a .t27 file; the definition lives in
+; .claude/skills/t27f/SKILL.md, "What T27F is".
+; Every gate is read from specs/t27f/topic_engine.t27 with `use`; nothing here restates a constant,
+; a bee list or a status rule. What this file adds is the turn around those gates:
+;   - quest_target(): the one cell a turn works on -- the first OPEN cell, else the first GAP, else
+;     none -- decided by the engine's bee_target();
+;   - bee_fits() / dispatch(): a bee is dispatched only while dispatch_allowed() holds and only if its
+;     name is on the domain's *_BEES list (kw_in_list, the engine's own reader); a GAP takes GAP_BEE;
+;   - review_counts(): a review is evidence only when the reviewer is not the author;
+;   - quest_evidence(): one piece of evidence through verify(), refusing a self-review;
+;   - progression_event(): true exactly when counts_as_progress() flips from false to true, worth
+;     POINTS_PER_VERIFIED_LESSON and never money;
+;   - quest_action(): the engine's approval gate, unchanged; a bee never publishes on its own;
+;   - board_state(): the cell's column on the Queen's board, as specs/queen/tasks.t27 TS_* codes.
+; Pilot: step 16 of the GF16 vs bfloat16 NMSE research map (specs/t27f/reel_gf16_nmse.t27, cell 15,
+; "The sealed run", DELIVER stage, research domain). The pilot starts from the cell as a GAP, its
+; state when that map was measured; it does not read the map's STATUS row, which is grounded
+; separately. The five-step timeline below is a worked rule check, not a record of a run.
+; Not claimed: no runtime dispatches a bee from this file yet, and no board shows a quest.
+; ASCII only (L3).
+; phi^2 + 1/phi^2 = 3 | TRINITY
+
+module t27f_quest;
+
+use t27f::reel::CELL_COUNT;
+use t27f::topic_engine::STATUS_GAP;
+use t27f::topic_engine::STATUS_LOCKED;
+use t27f::topic_engine::STATUS_OPEN;
+use t27f::topic_engine::STATUS_DRAFT;
+use t27f::topic_engine::STATUS_VERIFIED;
+use t27f::topic_engine::STATUS_PUBLISHED;
+use t27f::topic_engine::STAGE_DELIVER;
+use t27f::topic_engine::DOMAIN_GENERAL;
+use t27f::topic_engine::DOMAIN_CONTENT;
+use t27f::topic_engine::DOMAIN_ENGINEERING;
+use t27f::topic_engine::DOMAIN_RESEARCH;
+use t27f::topic_engine::DOMAIN_SALES;
+use t27f::topic_engine::GENERAL_BEES;
+use t27f::topic_engine::CONTENT_BEES;
+use t27f::topic_engine::ENGINEERING_BEES;
+use t27f::topic_engine::RESEARCH_BEES;
+use t27f::topic_engine::SALES_BEES;
+use t27f::topic_engine::GAP_BEE;
+use t27f::topic_engine::MAX_ACTIVE_BEES;
+use t27f::topic_engine::TARGET_OPEN_LESSON;
+use t27f::topic_engine::EVIDENCE_NONE;
+use t27f::topic_engine::EVIDENCE_SOURCE_LINK;
+use t27f::topic_engine::EVIDENCE_TEST_PASS;
+use t27f::topic_engine::EVIDENCE_REVIEW;
+use t27f::topic_engine::ACTION_DRAFT_ONLY;
+use t27f::topic_engine::ACTION_PUBLISH;
+use t27f::topic_engine::ACTION_DESTRUCTIVE;
+use t27f::topic_engine::POINTS_PER_VERIFIED_LESSON;
+use t27f::topic_engine::REWARD_IS_MONEY;
+use t27f::topic_engine::step_stage;
+use t27f::topic_engine::kw_in_list;
+use t27f::topic_engine::dispatch_allowed;
+use t27f::topic_engine::bee_target;
+use t27f::topic_engine::verify;
+use t27f::topic_engine::counts_as_progress;
+use t27f::topic_engine::needs_human_approval;
+use t27f::topic_engine::action_allowed;
+use t27f::topic_engine::after_action;
+use t27f::topic_engine::earned_status;
+use t27f::reel_gf16_nmse::DOMAIN;
+use t27f::reel_gf16_nmse::TITLES;
+use queen::tasks::TS_BACKLOG;
+use queen::tasks::TS_BLOCKED;
+use queen::tasks::TS_RUNNING;
+use queen::tasks::TS_REVIEW;
+use queen::tasks::TS_DONE;
+
+/// No cell to work on: every cell is past OPEN and none is a GAP.
+pub const QUEST_NONE : i32 = -1;
+
+/// The pilot: step 16 of the NMSE research map is cell 15.
+pub const PILOT_CELL : u8 = 15;
+pub const PILOT_STEP_NUMBER : u8 = 16;
+
+/// The pilot's two bees, by id, and their names as the bee lists spell them.
+pub const BEE_RESEARCHER : u8 = 1;
+pub const BEE_REVIEWER : u8 = 2;
+pub const RESEARCHER_NAME : str = "researcher";
+pub const REVIEWER_NAME : str = "reviewer";
+pub const CODER_NAME : str = "coder";
+pub const WRITER_NAME : str = "writer";
+
+/// The five steps of the pilot timeline, in order.
+pub const TIMELINE_STEPS : u8 = 5;
+pub const TIMELINE_NAMES : [5]str = ["run", "schema check", "self-review", "independent review", "publish"];
+
+/// Fixtures for quest_target: a map with two gaps, the same map with one OPEN cell, a finished map.
+pub const MAP_TWO_GAPS : [27]u8 = [5, 5, 5, 5, 5, 5, 3, 3, 3, 5, 5, 5, 5, 5, 5, 0, 0, 1, 5, 4, 5, 5, 3, 3, 1, 1, 3];
+pub const MAP_ONE_OPEN : [27]u8 = [5, 5, 5, 5, 5, 5, 3, 3, 3, 5, 5, 5, 5, 5, 5, 0, 0, 1, 5, 4, 2, 5, 3, 3, 1, 1, 3];
+pub const MAP_DONE : [27]u8 = [5, 5, 5, 5, 5, 5, 4, 4, 4, 5, 5, 5, 5, 5, 5, 4, 4, 4, 5, 4, 5, 5, 4, 4, 4, 4, 4];
+
+/// How many cells hold one status, as the u8 bee_target() takes.
+pub fn count_with(status: [27]u8, s: u8) -> u8 {
+    var n : u8 = 0;
+    var c : i32 = 0;
+    while (c < CELL_COUNT) {
+        if (status[@intCast(c)] == s) {
+            n = n + 1;
+        }
+        c = c + 1;
+    }
+    return n;
+}
+
+/// The first cell holding one status, or QUEST_NONE.
+pub fn first_with(status: [27]u8, s: u8) -> i32 {
+    var c : i32 = 0;
+    while (c < CELL_COUNT) {
+        if (status[@intCast(c)] == s) {
+            return c;
+        }
+        c = c + 1;
+    }
+    return QUEST_NONE;
+}
+
+/// The one cell a quest turn works on: the engine's bee_target() decides between the first OPEN
+/// cell and the first GAP; a map with neither has no target.
+pub fn quest_target(status: [27]u8) -> i32 {
+    if (bee_target(count_with(status, STATUS_OPEN)) == TARGET_OPEN_LESSON) {
+        return first_with(status, STATUS_OPEN);
+    }
+    return first_with(status, STATUS_GAP);
+}
+
+/// Whether a bee name is on the domain's list, read with the engine's own list reader.
+pub fn bee_on_list(domain: u8, name: []const u8, n: usize) -> bool {
+    if (domain == DOMAIN_CONTENT) {
+        return kw_in_list(name, 0, n, CONTENT_BEES, CONTENT_BEES.len);
+    }
+    if (domain == DOMAIN_ENGINEERING) {
+        return kw_in_list(name, 0, n, ENGINEERING_BEES, ENGINEERING_BEES.len);
+    }
+    if (domain == DOMAIN_RESEARCH) {
+        return kw_in_list(name, 0, n, RESEARCH_BEES, RESEARCH_BEES.len);
+    }
+    if (domain == DOMAIN_SALES) {
+        return kw_in_list(name, 0, n, SALES_BEES, SALES_BEES.len);
+    }
+    return kw_in_list(name, 0, n, GENERAL_BEES, GENERAL_BEES.len);
+}
+
+/// A bee fits a cell when it is on the domain's list; a GAP takes GAP_BEE, whose task is a source.
+pub fn bee_fits(status: u8, domain: u8, name: []const u8, n: usize) -> bool {
+    if (bee_on_list(domain, name, n) == false) {
+        return false;
+    }
+    if (status == STATUS_GAP) {
+        return kw_in_list(name, 0, n, GAP_BEE, GAP_BEE.len);
+    }
+    return status == STATUS_OPEN;
+}
+
+/// The Queen dispatches one bee only while the cap allows it and only a bee that fits the cell.
+pub fn dispatch(active_bees: u8, status: u8, domain: u8, name: []const u8, n: usize) -> bool {
+    return dispatch_allowed(active_bees) && bee_fits(status, domain, name, n);
+}
+
+/// A review is evidence only from someone other than the author.
+pub fn review_counts(author: u8, reviewer: u8) -> bool {
+    return author != reviewer;
+}
+
+/// One piece of evidence for a cell, through verify(); a self-review changes nothing.
+pub fn quest_evidence(status: u8, step: u8, domain: u8, evidence: u8, author: u8, reviewer: u8) -> u8 {
+    if (evidence == EVIDENCE_REVIEW && review_counts(author, reviewer) == false) {
+        return status;
+    }
+    return verify(status, step_stage(step), domain, evidence);
+}
+
+/// The progression event: a cell starts to count as progress. It fires once per cell.
+pub fn progression_event(before: u8, after: u8) -> bool {
+    return counts_as_progress(before) == false && counts_as_progress(after);
+}
+
+/// The points a status change earns: one event's worth or nothing. Points are never money.
+pub fn event_points(before: u8, after: u8) -> u32 {
+    if (progression_event(before, after)) {
+        return POINTS_PER_VERIFIED_LESSON;
+    }
+    return 0;
+}
+
+/// An action on a cell, through the engine's approval gate; `approved` is a human's yes.
+pub fn quest_action(status: u8, action: u8, approved: bool) -> u8 {
+    return after_action(status, action, approved);
+}
+
+/// The cell's column on the Queen's board (specs/queen/tasks.t27). A working bee means RUNNING; a
+/// draft waits in REVIEW for its evidence; a counted cell is DONE.
+pub fn board_state(status: u8, bee_working: bool) -> u8 {
+    if (bee_working) {
+        return TS_RUNNING;
+    }
+    if (status == STATUS_LOCKED) {
+        return TS_BLOCKED;
+    }
+    if (status == STATUS_DRAFT) {
+        return TS_REVIEW;
+    }
+    if (counts_as_progress(status)) {
+        return TS_DONE;
+    }
+    return TS_BACKLOG;
+}
+
+test the_target_is_first_open_else_first_gap {
+    assert quest_target(MAP_TWO_GAPS) == 15;
+    assert quest_target(MAP_ONE_OPEN) == 20;
+    assert quest_target(MAP_DONE) == QUEST_NONE;
+    assert count_with(MAP_TWO_GAPS, STATUS_OPEN) == 0;
+    assert count_with(MAP_ONE_OPEN, STATUS_OPEN) == 1;
+    assert count_with(MAP_TWO_GAPS, STATUS_GAP) == 2;
+}
+
+test only_a_listed_bee_is_dispatched {
+    // research lists researcher, analyst, reviewer; coder is engineering's
+    assert bee_on_list(DOMAIN_RESEARCH, REVIEWER_NAME, REVIEWER_NAME.len);
+    assert bee_on_list(DOMAIN_RESEARCH, CODER_NAME, CODER_NAME.len) == false;
+    assert bee_on_list(DOMAIN_ENGINEERING, CODER_NAME, CODER_NAME.len);
+    assert bee_on_list(DOMAIN_GENERAL, WRITER_NAME, WRITER_NAME.len);
+    assert bee_on_list(DOMAIN_SALES, WRITER_NAME, WRITER_NAME.len) == false;
+    // a gap takes the gap bee only
+    assert bee_fits(STATUS_GAP, DOMAIN_RESEARCH, RESEARCHER_NAME, RESEARCHER_NAME.len);
+    assert bee_fits(STATUS_GAP, DOMAIN_RESEARCH, REVIEWER_NAME, REVIEWER_NAME.len) == false;
+    assert bee_fits(STATUS_OPEN, DOMAIN_RESEARCH, REVIEWER_NAME, REVIEWER_NAME.len);
+    // a cell past OPEN is not a dispatch target
+    assert bee_fits(STATUS_DRAFT, DOMAIN_RESEARCH, REVIEWER_NAME, REVIEWER_NAME.len) == false;
+    assert bee_fits(STATUS_LOCKED, DOMAIN_RESEARCH, RESEARCHER_NAME, RESEARCHER_NAME.len) == false;
+}
+
+test the_cap_holds_before_relevance {
+    assert dispatch(0, STATUS_GAP, DOMAIN_RESEARCH, RESEARCHER_NAME, RESEARCHER_NAME.len);
+    assert dispatch(MAX_ACTIVE_BEES - 1, STATUS_GAP, DOMAIN_RESEARCH, RESEARCHER_NAME, RESEARCHER_NAME.len);
+    assert dispatch(MAX_ACTIVE_BEES, STATUS_GAP, DOMAIN_RESEARCH, RESEARCHER_NAME, RESEARCHER_NAME.len) == false;
+    assert dispatch(0, STATUS_GAP, DOMAIN_RESEARCH, CODER_NAME, CODER_NAME.len) == false;
+}
+
+test a_self_review_is_not_evidence {
+    assert review_counts(BEE_RESEARCHER, BEE_REVIEWER);
+    assert review_counts(BEE_RESEARCHER, BEE_RESEARCHER) == false;
+    assert quest_evidence(STATUS_DRAFT, PILOT_CELL, DOMAIN_RESEARCH, EVIDENCE_REVIEW, BEE_RESEARCHER, BEE_RESEARCHER) == STATUS_DRAFT;
+    assert quest_evidence(STATUS_DRAFT, PILOT_CELL, DOMAIN_RESEARCH, EVIDENCE_REVIEW, BEE_RESEARCHER, BEE_REVIEWER) == STATUS_VERIFIED;
+    assert quest_evidence(STATUS_DRAFT, PILOT_CELL, DOMAIN_RESEARCH, EVIDENCE_NONE, BEE_RESEARCHER, BEE_REVIEWER) == STATUS_DRAFT;
+}
+
+test the_event_fires_exactly_on_the_flip {
+    var b : u8 = STATUS_GAP;
+    while (b <= STATUS_PUBLISHED) {
+        var a : u8 = STATUS_GAP;
+        while (a <= STATUS_PUBLISHED) {
+            const want : bool = counts_as_progress(b) == false && counts_as_progress(a);
+            assert progression_event(b, a) == want;
+            if (want) {
+                assert event_points(b, a) == POINTS_PER_VERIFIED_LESSON;
+            } else {
+                assert event_points(b, a) == 0;
+            }
+            a = a + 1;
+        }
+        b = b + 1;
+    }
+    assert progression_event(STATUS_DRAFT, STATUS_VERIFIED);
+    assert progression_event(STATUS_VERIFIED, STATUS_PUBLISHED) == false;
+    assert progression_event(STATUS_DRAFT, STATUS_PUBLISHED);
+}
+
+test no_high_impact_action_without_a_yes {
+    var s : u8 = STATUS_GAP;
+    while (s <= STATUS_PUBLISHED) {
+        var act : u8 = ACTION_PUBLISH;
+        while (act <= ACTION_DESTRUCTIVE) {
+            assert needs_human_approval(act);
+            assert action_allowed(s, act, false) == false;
+            assert quest_action(s, act, false) == s;
+            act = act + 1;
+        }
+        s = s + 1;
+    }
+    assert needs_human_approval(ACTION_DRAFT_ONLY) == false;
+}
+
+test the_board_reads_the_status {
+    assert board_state(STATUS_GAP, false) == TS_BACKLOG;
+    assert board_state(STATUS_OPEN, false) == TS_BACKLOG;
+    assert board_state(STATUS_LOCKED, false) == TS_BLOCKED;
+    assert board_state(STATUS_GAP, true) == TS_RUNNING;
+    assert board_state(STATUS_DRAFT, false) == TS_REVIEW;
+    assert board_state(STATUS_VERIFIED, false) == TS_DONE;
+    assert board_state(STATUS_PUBLISHED, false) == TS_DONE;
+}
+
+test the_pilot_is_step_16_of_the_nmse_map {
+    assert PILOT_CELL + 1 == PILOT_STEP_NUMBER;
+    assert DOMAIN == DOMAIN_RESEARCH;
+    assert step_stage(PILOT_CELL) == STAGE_DELIVER;
+    assert TITLES[15].len > 0;
+    // at the start the cell is a GAP, so the turn's bee is the gap bee and its job is a source
+    assert dispatch(0, STATUS_GAP, DOMAIN, RESEARCHER_NAME, RESEARCHER_NAME.len);
+    assert dispatch(0, STATUS_GAP, DOMAIN, REVIEWER_NAME, REVIEWER_NAME.len) == false;
+}
+
+test the_pilot_timeline {
+    // 1. run: the bee's sealed manifest grounds the cell; a DELIVER step in research wants a review
+    const s0 : u8 = STATUS_GAP;
+    const s1 : u8 = earned_status(PILOT_CELL, DOMAIN, true, false, false, false);
+    assert s1 == STATUS_DRAFT;
+    assert quest_evidence(STATUS_DRAFT, PILOT_CELL, DOMAIN, EVIDENCE_SOURCE_LINK, BEE_RESEARCHER, BEE_RESEARCHER) == s1;
+    assert board_state(s1, false) == TS_REVIEW;
+    // 2. schema check passes: a passing test clears PRACTICE, not DELIVER
+    const s2 : u8 = earned_status(PILOT_CELL, DOMAIN, true, true, false, false);
+    assert s2 == STATUS_DRAFT;
+    assert quest_evidence(s1, PILOT_CELL, DOMAIN, EVIDENCE_TEST_PASS, BEE_RESEARCHER, BEE_RESEARCHER) == s2;
+    // 3. the author reviews its own run: refused
+    const s3 : u8 = earned_status(PILOT_CELL, DOMAIN, true, true, review_counts(BEE_RESEARCHER, BEE_RESEARCHER), false);
+    assert s3 == STATUS_DRAFT;
+    assert quest_evidence(s2, PILOT_CELL, DOMAIN, EVIDENCE_REVIEW, BEE_RESEARCHER, BEE_RESEARCHER) == s3;
+    // 4. an independent reviewer: VERIFIED, the one progression event
+    const s4 : u8 = earned_status(PILOT_CELL, DOMAIN, true, true, review_counts(BEE_RESEARCHER, BEE_REVIEWER), false);
+    assert s4 == STATUS_VERIFIED;
+    assert quest_evidence(s3, PILOT_CELL, DOMAIN, EVIDENCE_REVIEW, BEE_RESEARCHER, BEE_REVIEWER) == s4;
+    assert board_state(s4, false) == TS_DONE;
+    // 5. publish: a bee alone is refused; after a human's yes the cell is PUBLISHED
+    assert quest_action(s4, ACTION_PUBLISH, false) == STATUS_VERIFIED;
+    const s5 : u8 = quest_action(s4, ACTION_PUBLISH, true);
+    assert s5 == STATUS_PUBLISHED;
+    assert s5 == earned_status(PILOT_CELL, DOMAIN, true, true, true, true);
+    // exactly one event, worth one point, across the five steps
+    const points : u32 = event_points(s0, s1) + event_points(s1, s2) + event_points(s2, s3) + event_points(s3, s4) + event_points(s4, s5);
+    assert points == POINTS_PER_VERIFIED_LESSON;
+    assert progression_event(s3, s4);
+    assert TIMELINE_NAMES[4].len > 0;
+    assert TIMELINE_STEPS == 5;
+}
+
+invariant points_are_not_money {
+    assert REWARD_IS_MONEY == false;
+    assert POINTS_PER_VERIFIED_LESSON == 1;
+}
+
+invariant one_turn_one_bee_under_the_cap {
+    assert MAX_ACTIVE_BEES >= 1;
+    assert dispatch_allowed(MAX_ACTIVE_BEES) == false;
+}
+
+invariant publish_needs_a_human {
+    assert needs_human_approval(ACTION_PUBLISH);
+    assert quest_action(STATUS_VERIFIED, ACTION_PUBLISH, false) == STATUS_VERIFIED;
+}
diff --git a/apps/website/public/t27f/graph/specs/reel_gf16_nmse.t27 b/apps/website/public/t27f/graph/specs/reel_gf16_nmse.t27
new file mode 100644
index 0000000000..b00d95892a
--- /dev/null
+++ b/apps/website/public/t27f/graph/specs/reel_gf16_nmse.t27
@@ -0,0 +1,349 @@
+// SPDX-License-Identifier: Apache-2.0
+; specs/t27f/reel_gf16_nmse.t27 -- the second real T27F reel, and the first in another domain:
+; research, "how close does GF16 come to bfloat16", as the project's own NMSE protocol asks it.
+; gHashTag/trinity#1677 wants at least two very different domains on one widget and one workflow,
+; and a 27-step map that is source-grounded with its gaps named. The first reel
+; (reel_t27_basics.t27) is a course, routed to engineering; this one is a benchmark, routed to
+; research, and both go through the same code: topic_engine.t27 decides, topic_reel.t27 checks,
+; reel.t27 and deck.t27 draw. Nothing below is a rule of this file's own.
+
+; SOURCE: gHashTag/t27 at SOURCE_COMMIT, measured on MEASURED_ON. The protocol spec
+; specs/benchmarks/gf16_bfloat16_nmse.t27 and its mirror docs/GF16_BFLOAT16_NMSE_PROTOCOL.md, the
+; manifest schema schemas/nmse-protocol-v1.json, the roadmap docs/SCIENTIFIC_IMPROVEMENT_PLAN.md
+; (PUB-01, PUB-02), the PUB-02 run harness specs/benchmarks/gf16_bfloat16_nmse_run.t27 and the
+; manifest it wrote, RUN_MANIFEST (#10021), and what the repo already holds about GF16. Every cell
+; names its source in SOURCES; a cell with none is a gap and says in MISSING what would ground it.
+
+; BRIEF is the first three sentences of the protocol spec's header, verbatim. route_brief
+; counts gf16 twice and benchmark once, no other list is hit, so the domain is DOMAIN_RESEARCH.
+
+; LENSES: one row per lens. Steps 1-9 are the formats and why they compare at all; 10-18 the protocol
+; and the one run it asks for; 19-27 what may be said and what the repo has said so far.
+
+; MEASURED on 2026-10-18:
+;   - grounded: the source is in the repo at SOURCE_COMMIT (path and section in SOURCES).
+;   - test: t27c test-report and t27b test --check on the Railway lab passed all 7 tests of the
+;     protocol spec; a planted GF16_MANT_BITS = 8 turned 2 of them red under both, so they are real.
+;     The harness's own tests check its procedure, not the committed manifest, so no step of the
+;     run (16, 17, 25) is marked as tested; on a DELIVER step a test would not count anyway.
+;   - review: the PRs that wrote the protocol (#1399), the spec rewrite (#5947) and the run (#10021)
+;     have 0 reviews.
+;   - live: GET https://t27.ai/t27/files/<path> returned 200 for the protocol spec and the schema,
+;     and 404 for the doc, FORMAT-SPEC-001.json, gf16_bench_results.json, the crosswalk, the paper
+;     draft, the harness and the manifest; a made-up path returned 404, so 200 is not a catch-all.
+; The engine asks a research LEARN step for a source link, a PRACTICE step for a review or a passing
+; test, and a DELIVER step for a review. So: 15 published (sourced, earned, and live), 1 verified
+; (reporting rules: sourced, not live), 9 drafts (practice or deliver steps with neither a test nor a
+; review, three of them the run's own cells) and 2 gaps.
+
+; THE RUN. PUB-02 asks for one sealed bench/results/nmse-*.json. Until #10021 the repo held none, and
+; steps 16, 17 and 25 (the run, its schema check, the ratio per distribution) were gaps. They now cite
+; RUN_HARNESS and RUN_MANIFEST, and they are DRAFTS, not verified: each is a DELIVER step, a research
+; DELIVER step is verified by a review, and the run has none. The manifest is a software run on the
+; Railway lab (runner.host_arch x86_64), not a silicon measurement.
+; THE GAPS that remain: the chip repo's manifest, gHashTag/tt-trinity-gamma
+; tests/vectors/nmse_gf16_bf16.golden.json at GAMMA_COMMIT, pins the seeds but says measured_silicon
+; false and harness_committed false; and the paper draft has no Delta_dB yet (PUB-02 allowed one only
+; after the manifest, and attaching the manifest to the draft is still open). The older GF16/BF16
+; numbers, conformance/gf16_bench_results.json (2026-04-05, no seed, no seal), are drawn as a draft
+; that the protocol itself says does not count.
+
+; Not claimed: this reel quotes no NMSE value, no ratio and no winner; the manifest holds the numbers
+; and is the only place to read them. Nothing here is silicon. No GIF or MP4; stills only, for the chat.
+; phi^2 + 1/phi^2 = 3 | TRINITY
+
+module reel_gf16_nmse;
+
+use t27f::reel::CELL_COUNT;
+use t27f::reel::DEMO_COUNT;
+use t27f::reel::DEMO_CELL;
+use t27f::reel::DEMO_LENS;
+use t27f::topic_engine::STATUS_GAP;
+use t27f::topic_engine::STATUS_DRAFT;
+use t27f::topic_engine::STATUS_VERIFIED;
+use t27f::topic_engine::STATUS_PUBLISHED;
+use t27f::topic_engine::STAGE_DELIVER;
+use t27f::topic_engine::STAGE_PRACTICE;
+use t27f::topic_engine::DOMAIN_RESEARCH;
+use t27f::topic_engine::CONTENT_WORDS;
+use t27f::topic_engine::ENGINEERING_WORDS;
+use t27f::topic_engine::RESEARCH_WORDS;
+use t27f::topic_engine::SALES_WORDS;
+use t27f::topic_engine::keyword_hits;
+use t27f::topic_engine::route_brief;
+use t27f::topic_engine::step_stage;
+use t27f::topic_engine::earned_status;
+use t27f::topic_reel::count_status;
+use t27f::topic_reel::count_true;
+use t27f::topic_reel::statuses_earned;
+use t27f::topic_reel::gaps_are_named;
+use t27f::topic_reel::slides_fit;
+use t27f::topic_reel::stage_slides_bare;
+
+pub const TOPIC_ID : str = "gf16-nmse";
+pub const SOURCE_REPO : str = "gHashTag/t27";
+pub const SOURCE_SPEC : str = "specs/benchmarks/gf16_bfloat16_nmse.t27";
+pub const SOURCE_COMMIT : str = "cc80a305dd5fef1cd21f930e1394ae47cbdacbfc";
+pub const GAMMA_REPO : str = "gHashTag/tt-trinity-gamma";
+pub const GAMMA_COMMIT : str = "de484c4ff249356624ec508127fcbab880ee25fc";
+pub const LIVE_BASE : str = "https://t27.ai/t27/files/";
+pub const MEASURED_ON : str = "2026-10-18";
+/// The PUB-02 run (#10021): the harness that wrote the manifest, and the manifest.
+pub const RUN_HARNESS : str = "specs/benchmarks/gf16_bfloat16_nmse_run.t27";
+pub const RUN_MANIFEST : str = "bench/results/nmse-railway-x86_64-0x2545F4914F6CDD1D-2026-10-17.json";
+
+pub const BRIEF : str = "GF16 against bfloat16 NMSE protocol (TRI-NET benchmark 0). The standard comparison of GoldenFloat GF16 and bfloat16 numeric fidelity, as normalised mean squared error over named reference distributions. Protocol only: no silicon number is asserted.";
+/// The domain route_brief gives that brief (see the_domain_is_routed_not_chosen).
+pub const DOMAIN : u8 = 3;
+
+pub const LENS_TITLES : [3]str = ["formats", "protocol", "claims"];
+
+pub const TITLES : [27]str = [
+    "NMSE, the measure",
+    "GF16: 1 | 6 | 9, bias 31",
+    "bfloat16: 1 | 8 | 7, bias 127",
+    "Both are 16 bits",
+    "Each bias is half the exponent range",
+    "GF16 trades exponent for mantissa",
+    "Why the same width makes it fair",
+    "Where P3109 places both",
+    "GF16 in the numeric SSOT",
+    "Five reference distributions",
+    "Check phi before any NMSE",
+    "What a manifest holds",
+    "The witness holds in f64",
+    "D_DEEP weights sum to one",
+    "NMSE is never negative",
+    "The sealed run, 5 x 10M samples",
+    "A manifest checked against its schema",
+    "The chip repo's manifest",
+    "Reading the ratio",
+    "Reporting rules",
+    "What is not claimed",
+    "Which way the ratio points",
+    "The old numbers, 2026-04-05",
+    "Why they do not count",
+    "The ratio per distribution",
+    "Delta_dB in the paper",
+    "The paper draft"
+];
+
+/// Where each cell's text comes from in SOURCE_REPO at SOURCE_COMMIT; "" is a gap.
+pub const SOURCES : [27]str = [
+    "specs/benchmarks/gf16_bfloat16_nmse.t27 header, NMSE(F)",
+    "specs/benchmarks/gf16_bfloat16_nmse.t27 GF16_*",
+    "specs/benchmarks/gf16_bfloat16_nmse.t27 BF16_*",
+    "specs/benchmarks/gf16_bfloat16_nmse.t27 test both_layouts_are_sixteen_bits",
+    "specs/benchmarks/gf16_bfloat16_nmse.t27 test biases_are_half_the_exponent_range",
+    "specs/benchmarks/gf16_bfloat16_nmse.t27 test gf16_trades_exponent_for_mantissa",
+    "docs/GF16_BFLOAT16_NMSE_PROTOCOL.md section 3.3",
+    "docs/P3109_CROSSWALK_4PARAM.md rows bf16 and gf16",
+    "conformance/FORMAT-SPEC-001.json",
+    "specs/benchmarks/gf16_bfloat16_nmse.t27 DISTRIBUTIONS",
+    "specs/benchmarks/gf16_bfloat16_nmse.t27 WITNESS_TOLERANCE",
+    "schemas/nmse-protocol-v1.json",
+    "specs/benchmarks/gf16_bfloat16_nmse.t27 test identity_witnesses_hold_in_f64",
+    "specs/benchmarks/gf16_bfloat16_nmse.t27 test d_deep_mixture_weights_sum_to_one",
+    "specs/benchmarks/gf16_bfloat16_nmse.t27 test nmse_non_negative_and_zero_baseline_undefined",
+    "specs/benchmarks/gf16_bfloat16_nmse_run.t27 nmse_manifest; bench/results/nmse-railway-x86_64-0x2545F4914F6CDD1D-2026-10-17.json samples_per_distribution, seal_hash",
+    "bench/results/nmse-railway-x86_64-0x2545F4914F6CDD1D-2026-10-17.json schema_version, under schemas/nmse-protocol-v1.json",
+    "",
+    "specs/benchmarks/gf16_bfloat16_nmse.t27 header, the ratio",
+    "docs/GF16_BFLOAT16_NMSE_PROTOCOL.md section 8",
+    "specs/benchmarks/gf16_bfloat16_nmse.t27 NON_CLAIMS",
+    "specs/benchmarks/gf16_bfloat16_nmse.t27 test ratio_direction",
+    "conformance/gf16_bench_results.json",
+    "docs/GF16_BFLOAT16_NMSE_PROTOCOL.md section 6",
+    "bench/results/nmse-railway-x86_64-0x2545F4914F6CDD1D-2026-10-17.json results.*.ratio, from specs/benchmarks/gf16_bfloat16_nmse_run.t27",
+    "",
+    "docs/WHITEPAPER/gf_paper_v3_imrad_draft.md (PUB-01)"
+];
+
+/// What would ground each gap; "" for a cell that has its source.
+pub const MISSING : [27]str = [
+    "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "",
+    "tt-trinity-gamma nmse_gf16_bf16.golden.json pins seeds only: measured_silicon false, harness_committed false",
+    "", "", "", "", "", "", "",
+    "a Delta_dB figure in the paper draft: the manifest is not attached to it yet",
+    ""
+];
+
+/// The measurements per cell (see the header for how each was taken).
+pub const GROUNDED : [27]bool = [true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, false, true, true, true, true, true, true, true, false, true];
+pub const TEST_PASS : [27]bool = [false, false, false, true, true, true, false, false, false, false, false, false, true, true, true, false, false, false, false, false, false, true, false, false, false, false, false];
+pub const REVIEWED : [27]bool = [false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false];
+pub const LIVE : [27]bool = [true, true, true, true, true, true, false, false, false, true, true, true, true, true, true, false, false, false, true, false, true, true, false, false, false, false, false];
+
+/// What a host passes the viewer, per cell: the status code and the step number as a label.
+pub const STATUS : [27]u8 = [5, 5, 5, 5, 5, 5, 3, 3, 3, 5, 5, 5, 5, 5, 5, 3, 3, 0, 5, 4, 5, 5, 3, 3, 3, 0, 3];
+pub const LABELS : [27]str = ["1", "2", "3", "4", "5", "6", "7", "8", "9", "10", "11", "12", "13", "14", "15", "16", "17", "18", "19", "20", "21", "22", "23", "24", "25", "26", "27"];
+
+/// Slide text per demo scene, checked by topic_reel.t27 slides_fit (index scene*4+row).
+pub const HEAD : [5]str = [
+    "GF16 vs bfloat16 NMSE",
+    "Steps 1-9: formats",
+    "Witness first",
+    "Evidence",
+    "The sealed run"
+];
+pub const ROWS : [20]str = [
+    "", "", "", "",
+    "", "", "", "",
+    "Step 11 of 27: check phi before NMSE",
+    "phi^2 + 1/phi^2 = 3 within 1e-15",
+    "A failed witness aborts the run",
+    "No manifest is written after a failure",
+    "7 of 7 protocol tests pass on the lab",
+    "15 published, 1 verified, 9 drafts",
+    "2 gaps: chip run, paper Delta_dB",
+    "Measured 2026-10-18",
+    "PUB-02: one sealed NMSE manifest",
+    "5 distributions, 10M samples each",
+    "A software run, not silicon",
+    "Draft until someone reviews it"
+];
+
+/// The protocol spec's own test count, which the evidence slide quotes.
+pub const PROTOCOL_TESTS : i32 = 7;
+
+pub fn step_number(cell: i32) -> i32 {
+    return cell + 1;
+}
+
+/// Whether a SOURCES entry names a path: `path` occurs in `src` byte for byte.
+pub fn cites(src: []const u8, n: usize, path: []const u8, m: usize) -> bool {
+    if (m == 0 || m > n) {
+        return false;
+    }
+    var i : usize = 0;
+    while (i + m <= n) {
+        var j : usize = 0;
+        var same : bool = true;
+        while (j < m && same) {
+            if (src[i + j] != path[j]) {
+                same = false;
+            }
+            j += 1;
+        }
+        if (same) {
+            return true;
+        }
+        i += 1;
+    }
+    return false;
+}
+
+test the_domain_is_routed_not_chosen {
+    assert DOMAIN == DOMAIN_RESEARCH;
+    // gf16, gf16, benchmark; "bfloat16" is not "gf16", and no other list is hit
+    assert keyword_hits(BRIEF, BRIEF.len, RESEARCH_WORDS, RESEARCH_WORDS.len) == 3;
+    assert keyword_hits(BRIEF, BRIEF.len, CONTENT_WORDS, CONTENT_WORDS.len) == 0;
+    assert keyword_hits(BRIEF, BRIEF.len, ENGINEERING_WORDS, ENGINEERING_WORDS.len) == 0;
+    assert keyword_hits(BRIEF, BRIEF.len, SALES_WORDS, SALES_WORDS.len) == 0;
+    assert route_brief(BRIEF, BRIEF.len) == DOMAIN;
+}
+
+test every_step_is_a_cell {
+    assert CELL_COUNT == 27;
+    var c : i32 = 0;
+    while (c < CELL_COUNT) {
+        const i : usize = @intCast(c);
+        assert TITLES[i].len > 0;
+        var want : i32 = 1;
+        if (step_number(c) >= 10) {
+            want = 2;
+        }
+        const len : i32 = @intCast(LABELS[i].len);
+        assert len == want;
+        c = c + 1;
+    }
+    assert LENS_TITLES[2].len > 0;
+}
+
+test a_gap_is_named_not_filled {
+    assert gaps_are_named(SOURCES, MISSING, GROUNDED);
+    assert count_true(GROUNDED) == 25;
+    // a gap is drawn as a gap, and only a gap is
+    var c : i32 = 0;
+    while (c < CELL_COUNT) {
+        const i : usize = @intCast(c);
+        assert (STATUS[i] == STATUS_GAP) == (GROUNDED[i] == false);
+        c = c + 1;
+    }
+    // the two gaps left are DELIVER steps: the chip repo's run and the paper's Delta_dB
+    assert STATUS[17] == STATUS_GAP;
+    assert STATUS[25] == STATUS_GAP;
+    assert step_stage(17) == STAGE_DELIVER;
+    assert step_stage(25) == STAGE_DELIVER;
+    // the run's own cells cite the run, by both paths
+    assert MISSING[15].len == 0;
+    assert MISSING[16].len == 0;
+    assert MISSING[24].len == 0;
+    assert cites(SOURCES[15], SOURCES[15].len, RUN_HARNESS, RUN_HARNESS.len);
+    assert cites(SOURCES[15], SOURCES[15].len, RUN_MANIFEST, RUN_MANIFEST.len);
+    assert cites(SOURCES[16], SOURCES[16].len, RUN_MANIFEST, RUN_MANIFEST.len);
+    assert cites(SOURCES[24], SOURCES[24].len, RUN_MANIFEST, RUN_MANIFEST.len);
+    assert cites(SOURCES[24], SOURCES[24].len, RUN_HARNESS, RUN_HARNESS.len);
+    // and cites is not a yes-machine: the protocol's own cells do not name the run
+    assert cites(SOURCES[0], SOURCES[0].len, RUN_MANIFEST, RUN_MANIFEST.len) == false;
+    assert cites(SOURCES[16], SOURCES[16].len, RUN_HARNESS, RUN_HARNESS.len) == false;
+}
+
+test a_status_is_earned_not_chosen {
+    assert statuses_earned(STATUS, DOMAIN, GROUNDED, TEST_PASS, REVIEWED, LIVE);
+    // the evidence slide's "15 published, 1 verified, 9 drafts" and "2 gaps"
+    assert count_status(STATUS, STATUS_PUBLISHED) == 15;
+    assert count_status(STATUS, STATUS_VERIFIED) == 1;
+    assert count_status(STATUS, STATUS_DRAFT) == 9;
+    assert count_status(STATUS, STATUS_GAP) == 2;
+    assert count_true(REVIEWED) == 0;
+    // every passing test is one of the protocol's own tests, on a PRACTICE step
+    assert count_true(TEST_PASS) == PROTOCOL_TESTS;
+    var c : i32 = 0;
+    while (c < CELL_COUNT) {
+        const i : usize = @intCast(c);
+        if (TEST_PASS[i]) {
+            assert step_stage(@intCast(c)) == STAGE_PRACTICE;
+        }
+        c = c + 1;
+    }
+    // the old numbers have a source but no seed, seal, test or review: a draft, never published
+    assert STATUS[22] == STATUS_DRAFT;
+}
+
+test the_run_is_a_draft_until_reviewed {
+    // steps 16, 17 and 25 now have the run as their source, and are DELIVER steps
+    assert STATUS[15] == STATUS_DRAFT;
+    assert STATUS[16] == STATUS_DRAFT;
+    assert STATUS[24] == STATUS_DRAFT;
+    assert step_stage(15) == STAGE_DELIVER;
+    assert step_stage(16) == STAGE_DELIVER;
+    assert step_stage(24) == STAGE_DELIVER;
+    assert REVIEWED[15] == false;
+    assert REVIEWED[16] == false;
+    assert REVIEWED[24] == false;
+    // a passing test and a live page do not lift a research DELIVER step: only a review does
+    assert earned_status(15, DOMAIN, true, true, false, true) == STATUS_DRAFT;
+    assert earned_status(15, DOMAIN, true, false, true, false) == STATUS_VERIFIED;
+    assert earned_status(15, DOMAIN, true, false, true, true) == STATUS_PUBLISHED;
+}
+
+test the_camera_is_the_demo_camera {
+    assert DEMO_COUNT == 5;
+    // scene 1 shows lens 0, the row HEAD[1] calls "Steps 1-9"
+    assert DEMO_LENS[1] == 0;
+    // scenes 2 and 3 focus cell 10, which the focus slide calls "Step 11": the witness
+    assert DEMO_CELL[2] == 10;
+    assert DEMO_CELL[3] == 10;
+    assert step_number(DEMO_CELL[2]) == 11;
+    assert STATUS[10] == STATUS_PUBLISHED;
+}
+
+test every_slide_fits_every_preset {
+    assert slides_fit(HEAD, ROWS);
+    assert stage_slides_bare(ROWS);
+}
+
+invariant twenty_seven_steps {
+    assert CELL_COUNT == 27;
+}
diff --git a/apps/website/public/t27f/graph/specs/reel_t27_basics.t27 b/apps/website/public/t27f/graph/specs/reel_t27_basics.t27
new file mode 100644
index 0000000000..e034f749e6
--- /dev/null
+++ b/apps/website/public/t27f/graph/specs/reel_t27_basics.t27
@@ -0,0 +1,212 @@
+// SPDX-License-Identifier: Apache-2.0
+; specs/t27f/reel_t27_basics.t27 -- the first real T27F reel: course 0, "t27 basics", 27 lessons.
+; trinity#1677 (Topic-to-Value Engine) asks for a 27-step map that is source-grounded, with gaps shown
+; instead of filler. This file is that map for one real topic, drawn with the reel camera
+; (specs/t27f/reel.t27) and the deck look (specs/t27f/deck.t27).
+
+; SOURCE: gHashTag/trinity apps/website/specs/course/t27-basics.t27 at commit SOURCE_COMMIT. Its 27
+; lessons, in order, are the 27 cells; nothing here is new teaching text. The slide rows quote or
+; shorten that file's lesson 11 text and task, its SAY_PRIVATE line, and courses.t27's order.
+
+; LENSES: the reel draws one row per lens, nine cells per row. The course has 9 modules of 3 lessons,
+; so each row is three whole modules: lessons 1-9 (a spec file, values and types, arrays and trits),
+; 10-18 (tests and functions, inside a function, your own types), 19-27 (modules and rules, the
+; compiler and tri, errors and what next). The test lenses_are_whole_modules holds that.
+
+; WORKFLOW: this file is data. The checks it runs on that data are the shared ones in
+; specs/t27f/topic_reel.t27 (statuses_earned, slides_fit, stage_slides_bare), which the research
+; reel reel_gf16_nmse.t27 runs too; only the checks about this course stay here.
+
+; STATUS is earned through the topic engine (specs/t27f/topic_engine.t27, earned_status), not
+; chosen here. The engine routes BRIEF (the source's TITLE and DESCRIPTION at SOURCE_COMMIT) with
+; route_brief, which counts the KEYWORD_MATCH hits itself: spec, compiler, fpga are 3 engineering
+; hits and no other list is hit, so the domain is DOMAIN_ENGINEERING. Until 2026-10-17 the hits were
+; counted by hand and written down here. What was measured, per lesson, on 2026-10-17:
+;   - grounded: every lesson has its text in the source spec, so every one has a source link.
+;   - spec: t27c test-report on the Railway lab passed every test of all 27 lesson specs
+;     (apps/website/public/t27/files/specs/basics/*.t27 at SOURCE_COMMIT). 23 of them report their
+;     passes as vacuous because every assert is on constants and is checked when compiled; planting
+;     a wrong one (lesson 11, HOURS == 25) turned that test red, so the checks are real.
+;   - review: neither trinity PR that wrote the course (#1463, #1472) has a review, so no lesson does.
+;   - page: GET https://t27.ai/learn/<lesson-id>/ returned 200 with the title "<lesson>: t27 basics
+;     course, lesson N of 27" for all 27; a made-up id returned 404, so 200 is not a catch-all.
+; The engine asks a LEARN step for a source link and an engineering PRACTICE step for a passing test,
+; so lessons in those stages are VERIFIED, and their live pages make them PUBLISHED: 18 of 27. An
+; engineering DELIVER step asks for a review, which no lesson has, and a live page does not stand in
+; for one: lessons 7-9, 16-18 and 25-27 stay DRAFT although their pages are live. Until 2026-10-17
+; this file used its own rule (live page and passing spec -> published) and drew all 27 as published.
+
+; SCENES: the t27f_view host draws the reel.t27 demo camera (overview, lens 0, focus on cell 10,
+; evidence, call), so this reel uses that camera; the test the_camera_is_the_demo_camera holds it.
+; The slide text below is checked against deck.t27 for every preset, so the host never has to
+; refuse it as "does not fit one slide".
+
+; TWO COMPILERS: this file, reel.t27 and deck.t27 run under t27c (the Zig backend) and under t27b
+; (t27's own AArch64 backend, `t27b test --check`, qemu-aarch64 on the lab). On 2026-10-17 the two
+; agreed on every test, and each planted fault failed the same test in both (see the PRs).
+; t27b also refused the first draft of this file: it compared a str's u64 `.len` with an i32, which
+; t27c accepted; every length is now cast to i32 before it is compared.
+
+; Not claimed: no GIF or MP4 is rendered or posted; stills only, for the chat.
+; phi^2 + 1/phi^2 = 3 | TRINITY
+
+module reel_t27_basics;
+
+use t27f::reel::CELL_COUNT;
+use t27f::reel::COLS;
+use t27f::reel::DEMO_COUNT;
+use t27f::reel::DEMO_CELL;
+use t27f::reel::DEMO_LENS;
+use t27f::reel::STYLE_PUBLISHED;
+use t27f::reel::cell_row;
+use t27f::reel::cell_style;
+use t27f::topic_engine::STATUS_DRAFT;
+use t27f::topic_engine::STATUS_PUBLISHED;
+use t27f::topic_engine::STAGE_DELIVER;
+use t27f::topic_engine::DOMAIN_ENGINEERING;
+use t27f::topic_engine::ENGINEERING_WORDS;
+use t27f::topic_engine::keyword_hits;
+use t27f::topic_engine::route_brief;
+use t27f::topic_engine::step_stage;
+use t27f::topic_reel::count_status;
+use t27f::topic_reel::count_true;
+use t27f::topic_reel::statuses_earned;
+use t27f::topic_reel::slides_fit;
+use t27f::topic_reel::stage_slides_bare;
+
+pub const TOPIC_ID : str = "t27-basics";
+pub const SOURCE_REPO : str = "gHashTag/trinity";
+pub const SOURCE_SPEC : str = "apps/website/specs/course/t27-basics.t27";
+pub const SOURCE_COMMIT : str = "ee512359254bcd7438bb6a79c8a4a7f8b554b620";
+pub const LESSON_PAGE_BASE : str = "https://t27.ai/learn/";
+pub const MEASURED_ON : str = "2026-10-17";
+
+pub const LESSONS_PER_MODULE : i32 = 3;
+pub const MODULES_PER_LENS : i32 = 3;
+
+/// The brief the engine routes: the source's TITLE, a space, and its DESCRIPTION, verbatim.
+pub const BRIEF : str = "t27 basics: the language in 27 lessons Course 0, 27 lessons, one infographic and one t27 spec each: a module, constants and types, functions and tests, then the compiler's stages and the 7 languages it writes. It comes before the FPGA course.";
+/// The domain route_brief gives that brief (see the_domain_is_routed_not_chosen).
+pub const DOMAIN : u8 = 2;
+
+/// The measurements per lesson, in lesson order (see the header for how each was taken).
+pub const GROUNDED : [27]bool = [true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true];
+pub const PAGE_LIVE : [27]bool = [true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true];
+pub const SPEC_PASSES : [27]bool = [true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true];
+pub const REVIEWED : [27]bool = [false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false];
+
+/// What a host passes the viewer, per cell: the status code and the lesson number as a label.
+pub const STATUS : [27]u8 = [5, 5, 5, 5, 5, 5, 3, 3, 3, 5, 5, 5, 5, 5, 5, 3, 3, 3, 5, 5, 5, 5, 5, 5, 3, 3, 3];
+pub const LABELS : [27]str = ["1", "2", "3", "4", "5", "6", "7", "8", "9", "10", "11", "12", "13", "14", "15", "16", "17", "18", "19", "20", "21", "22", "23", "24", "25", "26", "27"];
+
+pub const LENS_TITLES : [3]str = ["values", "logic", "tools"];
+
+/// Slide text per demo scene. HEAD is the headline, one line; ROWS holds four card rows per scene
+/// (index scene*4+row; an empty row is no row). topic_reel.t27 slides_fit says why and checks it.
+pub const HEAD : [5]str = [
+    "t27 basics: 27 lessons",
+    "Lessons 1-9: values",
+    "Many small tests",
+    "Evidence",
+    "Start lesson 1"
+];
+pub const ROWS : [20]str = [
+    "", "", "", "",
+    "", "", "", "",
+    "Lesson 11 of 27: one test, one idea",
+    "A test's name says which idea broke",
+    "The lesson spec: 3 tests, 5 asserts",
+    "Try: break one, the other two still pass",
+    "27 of 27 lesson pages live on t27.ai",
+    "27 of 27 lesson specs pass on the lab",
+    "18 published; 9 wait for a review",
+    "Measured 2026-10-17",
+    "t27.ai/learn/what-a-spec-is/",
+    "Progress stays in this browser",
+    "Next: the FPGA course",
+    ""
+];
+
+pub fn lesson_number(cell: i32) -> i32 {
+    return cell + 1;
+}
+
+pub fn module_of(cell: i32) -> i32 {
+    return @divTrunc(cell, LESSONS_PER_MODULE);
+}
+
+test every_lesson_is_a_cell {
+    assert CELL_COUNT == 27;
+    assert lesson_number(0) == 1;
+    assert lesson_number(CELL_COUNT - 1) == 27;
+    assert LABELS[0].len == 1;
+    assert LABELS[26].len == 2;
+    var c : i32 = 0;
+    while (c < CELL_COUNT) {
+        const n : i32 = lesson_number(c);
+        var want : i32 = 1;
+        if (n >= 10) {
+            want = 2;
+        }
+        const len : i32 = @intCast(LABELS[@intCast(c)].len);
+        assert len == want;
+        c = c + 1;
+    }
+}
+
+test lenses_are_whole_modules {
+    assert COLS == LESSONS_PER_MODULE * MODULES_PER_LENS;
+    var c : i32 = 0;
+    while (c < CELL_COUNT) {
+        // the row a cell is drawn in is the lens of its module: three whole modules per row
+        assert cell_row(c) == @divTrunc(module_of(c), MODULES_PER_LENS);
+        c = c + 1;
+    }
+    assert LENS_TITLES[2].len > 0;
+}
+
+test a_status_is_earned_not_chosen {
+    assert statuses_earned(STATUS, DOMAIN, GROUNDED, SPEC_PASSES, REVIEWED, PAGE_LIVE);
+    assert count_true(GROUNDED) == 27;
+    assert count_true(PAGE_LIVE) == 27;
+    assert count_true(SPEC_PASSES) == 27;
+    assert count_true(REVIEWED) == 0;
+    // the evidence slide's "18 published; 9 wait for a review"
+    assert count_status(STATUS, STATUS_PUBLISHED) == 18;
+    assert count_status(STATUS, STATUS_DRAFT) == 9;
+    // the drafts are exactly the DELIVER lessons, whose pages are live all the same
+    var d : i32 = 0;
+    while (d < CELL_COUNT) {
+        const deliver : bool = step_stage(@intCast(d)) == STAGE_DELIVER;
+        assert (STATUS[@intCast(d)] == STATUS_DRAFT) == deliver;
+        d = d + 1;
+    }
+    // a published cell wears the published style, never a gap or a draft
+    assert cell_style(STATUS[0]) == STYLE_PUBLISHED;
+}
+
+test the_domain_is_routed_not_chosen {
+    assert DOMAIN == DOMAIN_ENGINEERING;
+    // spec, compiler, fpga: "tests" is not "test", and no other list is hit
+    assert keyword_hits(BRIEF, BRIEF.len, ENGINEERING_WORDS, ENGINEERING_WORDS.len) == 3;
+    assert route_brief(BRIEF, BRIEF.len) == DOMAIN;
+}
+
+test the_camera_is_the_demo_camera {
+    assert DEMO_COUNT == 5;
+    // scene 1 shows lens 0, the row HEAD[1] calls "Lessons 1-9"
+    assert DEMO_LENS[1] == 0;
+    // scenes 2 and 3 focus cell 10, which the focus slide calls "Lesson 11"
+    assert DEMO_CELL[2] == 10;
+    assert DEMO_CELL[3] == 10;
+    assert lesson_number(DEMO_CELL[2]) == 11;
+}
+
+test every_slide_fits_every_preset {
+    assert slides_fit(HEAD, ROWS);
+    assert stage_slides_bare(ROWS);
+}
+
+invariant one_lens_per_row {
+    assert CELL_COUNT == 3 * COLS;
+}
diff --git a/apps/website/public/t27f/graph/specs/spec_graph.t27 b/apps/website/public/t27f/graph/specs/spec_graph.t27
new file mode 100644
index 0000000000..0158c8e01d
--- /dev/null
+++ b/apps/website/public/t27f/graph/specs/spec_graph.t27
@@ -0,0 +1,1072 @@
+// SPDX-License-Identifier: Apache-2.0
+; specs/t27f/spec_graph.t27 -- the T27F spec graph IR: what a .t27 file becomes before T27F draws
+; it (RFC gHashTag/trinity#1649, epic gHashTag/trinity#1648, tracked in gHashTag/t27#10020).
+; T27F is the visual spec of .t27; the definition lives in .claude/skills/t27f/SKILL.md, "What T27F
+; is". This file is its core: one spec -> one graph -> many views. Every view (architecture, data
+; flow, dependencies, tests) is a projection of the same graph, and the graph is read from the
+; spec's source, never drawn by hand.
+; What this file decides, deterministically and without a language model:
+;   - the vocabulary: node kinds, edge kinds and inference labels, as u8 codes with name tables;
+;   - the records: a node carries kind, label, name and a source span; an edge carries kind,
+;     endpoints, label and the source line it was read from;
+;   - validation: validate_graph() returns GRAPH_OK or the first rule a graph breaks, and
+;     first_bad_node() / first_bad_edge() name the record that broke it;
+;   - source mapping both ways: a node has a span, and node_at_line() finds the node of a line;
+;   - which ui_plan widget (specs/t27f/ui_plan.t27) draws a node, so a renderer never picks one.
+; Inference labels, from strongest to weakest (RFC #1649, "Parsing and inference levels"):
+;   EXACT     present in the spec's source as written (a declaration, a call, a `use`);
+;   DERIVED   computed from EXACT facts by a rule stated here (tested_by is calls read backwards);
+;   SUGGESTED a model's explanation; drawn as plain text, always with the source lines it explains;
+;   UNKNOWN   cannot be read from the source; drawn alone, with no edge into or out of it.
+; Not claimed here: t27c has no graph export yet, so no graph is generated from a spec; the fixture
+; below is read by hand. No renderer draws a graph, there is no graph diff, and node kinds finer
+; than a top-level declaration (steps, branches, operators, parameters) are not in IR version 1.
+; phi^2 + 1/phi^2 = 3 | TRINITY
+
+module t27f_spec_graph;
+
+use t27f::ui_plan::UiPlan;
+use t27f::ui_plan::blank_plan;
+use t27f::ui_plan::validate_plan;
+use t27f::ui_plan::first_bad_slot;
+use t27f::ui_plan::catalog_widget;
+use t27f::ui_plan::bit;
+use t27f::ui_plan::PLAN_OK;
+use t27f::ui_plan::ERR_BINDING_KIND;
+use t27f::ui_plan::WIDGET_HONEYCOMB_CARD;
+use t27f::ui_plan::WIDGET_FORMULA_VIEW;
+use t27f::ui_plan::WIDGET_METRICS_TABLE;
+use t27f::ui_plan::WIDGET_RUN_BUTTON;
+use t27f::ui_plan::WIDGET_TEXT_BLOCK;
+use t27f::ui_plan::WIDGET_SOURCE;
+use t27f::ui_plan::SOURCE_NONE;
+use t27f::ui_plan::SOURCE_SPEC;
+use t27f::ui_plan::SOURCE_FORMULA;
+use t27f::ui_plan::SOURCE_METRICS;
+use t27f::ui_plan::PROP_TITLE;
+use t27f::ui_plan::PROP_SPEC_PATH;
+use t27f::ui_plan::PROP_FORMULA_ID;
+use t27f::ui_plan::PROP_CAPTION;
+use t27f::ui_plan::ACTION_NONE;
+use t27f::ui_plan::ACTION_OPEN_SPEC;
+use t27f::ui_plan::ACTION_RUN_TESTS;
+use t27f::ui_plan::CAP_READ_SPECS;
+use t27f::ui_plan::CAP_RUN_LAB;
+
+/// The IR version a graph names. Any other version is refused.
+pub const GRAPH_IR_VERSION : u32 = 1;
+
+/// Node kinds. IR version 1 has one node per top-level declaration, plus OPAQUE for a region the
+/// source names but this IR cannot read into.
+pub const NODE_MODULE : u8 = 0;
+pub const NODE_CONST : u8 = 1;
+pub const NODE_FN : u8 = 2;
+pub const NODE_TEST : u8 = 3;
+pub const NODE_INVARIANT : u8 = 4;
+pub const NODE_BENCH : u8 = 5;
+pub const NODE_USE : u8 = 6;
+pub const NODE_OPAQUE : u8 = 7;
+pub const NODE_KINDS : u8 = 8;
+pub const NODE_KIND_NAMES : [8]str = ["module", "const", "fn", "test", "invariant", "bench", "use", "opaque"];
+
+/// Edge kinds, read from -> to:
+///   CALLS      from a fn, test, invariant or bench to the fn it calls;
+///   USES       from a module or a body to the const or `use` it names (module -> use is the
+///              `use` statement itself);
+///   TESTED_BY  from a fn to the test, invariant or bench that calls it; DERIVED from CALLS;
+///   CONSTRAINS from an invariant to the const or fn its asserts are about;
+///   DATA_FLOW  from a value (const, fn result, import, opaque region) to a body whose result it
+///              reaches.
+pub const EDGE_CALLS : u8 = 0;
+pub const EDGE_USES : u8 = 1;
+pub const EDGE_TESTED_BY : u8 = 2;
+pub const EDGE_CONSTRAINS : u8 = 3;
+pub const EDGE_DATA_FLOW : u8 = 4;
+pub const EDGE_KINDS : u8 = 5;
+pub const EDGE_KIND_NAMES : [5]str = ["calls", "uses", "tested_by", "constrains", "data_flow"];
+
+/// Inference labels. A smaller code is a stronger claim; an edge is never stronger than either
+/// of its endpoints.
+pub const LABEL_EXACT : u8 = 0;
+pub const LABEL_DERIVED : u8 = 1;
+pub const LABEL_SUGGESTED : u8 = 2;
+pub const LABEL_UNKNOWN : u8 = 3;
+pub const LABEL_KINDS : u8 = 4;
+pub const LABEL_NAMES : [4]str = ["exact", "derived", "suggested", "unknown"];
+
+/// The code a name lookup returns for a name that is not in its table.
+pub const NO_CODE : u8 = 255;
+
+/// Which node kinds each edge kind may start and end at, as masks of node-kind bits, indexed by
+/// edge kind. The invariant edge_masks_are_spelled_right rebuilds each one from the named kinds.
+/// From: calls fn+test+invariant+bench; uses module+fn+test+invariant+bench; tested_by fn;
+/// constrains invariant; data_flow const+fn+use+opaque.
+pub const EDGE_FROM_KINDS : [5]u32 = [60, 61, 4, 16, 198];
+/// To: calls fn; uses const+use; tested_by test+invariant+bench; constrains const+fn;
+/// data_flow fn+test+invariant+bench+opaque.
+pub const EDGE_TO_KINDS : [5]u32 = [4, 66, 56, 6, 188];
+
+/// Capacity. Line 0 means "no source line": a span with line_start 0 is no span.
+/// Measured 2026-10-18 on the Railway lab, over the 2204 specs/**/*.t27 files of gHashTag/t27
+/// master (t27#10173 tree): top-level declarations per spec (nodes) p50 20, p90 66, p95 96,
+/// p98 183, p99 436, max 678. Call/use/constrain edges, read through the exporter on an 86-spec
+/// stratified sample: p50 at most 12, p95 at most 128 (82 of 86 specs), 85 of 86 at most 192, the
+/// largest between 193 and 256. The caps cover the node p98 and the edge p95. Node and edge
+/// endpoints are u8 and NO_INDEX is 255, so both caps must stay below 255; MAX_EDGES is the
+/// largest edge count that does, MAX_NODES is the 192 that covers p98 under the same
+/// limit. A larger graph is refused, never truncated (validate_graph).
+pub const MAX_NODES : u32 = 192;
+pub const MAX_EDGES : u32 = 254;
+pub const MEASURED_NODES_P95 : u32 = 96;
+pub const MEASURED_EDGES_P95 : u32 = 128;
+pub const NO_LINE : u32 = 0;
+pub const NO_INDEX : u32 = 255;
+
+/// Validation verdicts. validate_graph checks graph-level rules in this order, then each node in
+/// index order, then each edge in index order, and returns the first rule broken.
+pub const GRAPH_OK : u8 = 0;
+pub const ERR_GRAPH_VERSION : u8 = 1;
+pub const ERR_SPEC_PATH : u8 = 2;
+pub const ERR_TOO_MANY_NODES : u8 = 3;
+pub const ERR_TOO_MANY_EDGES : u8 = 4;
+pub const ERR_MODULE : u8 = 5;
+pub const ERR_NODE_KIND : u8 = 6;
+pub const ERR_LABEL : u8 = 7;
+pub const ERR_NODE_NAME : u8 = 8;
+pub const ERR_SPAN_ORDER : u8 = 9;
+pub const ERR_SPAN_OUTSIDE : u8 = 10;
+pub const ERR_SPAN_MISSING : u8 = 11;
+pub const ERR_EDGE_KIND : u8 = 12;
+pub const ERR_EDGE_DANGLING : u8 = 13;
+pub const ERR_EDGE_ENDPOINT_KIND : u8 = 14;
+pub const ERR_EDGE_UNKNOWN_NODE : u8 = 15;
+pub const ERR_EDGE_LABEL : u8 = 16;
+pub const ERR_EDGE_LINE : u8 = 17;
+pub const ERR_DUPLICATE_EDGE : u8 = 18;
+pub const VERDICT_KINDS : u8 = 19;
+
+/// One spec graph. Node arrays are indexed by node number, edge arrays by edge number; entries at
+/// or past node_count / edge_count are not read. Node 0 is the module and spans the whole file.
+/// Spans are 1-based, inclusive source lines of the file at spec_path.
+pub struct SpecGraph {
+    ir_version: u32,
+    spec_path: str,
+    line_count: u32,
+    node_count: u32,
+    node_kind: [192]u8,
+    node_label: [192]u8,
+    node_name: [192]str,
+    line_start: [192]u32,
+    line_end: [192]u32,
+    edge_count: u32,
+    edge_kind: [254]u8,
+    edge_from: [254]u8,
+    edge_to: [254]u8,
+    edge_label: [254]u8,
+    edge_line: [254]u32,
+}
+
+/// One node read out of a graph: the record a node inspector shows.
+pub struct SpecGraphNode {
+    kind: u8,
+    label: u8,
+    name: str,
+    line_start: u32,
+    line_end: u32,
+}
+
+pub fn kind_bit(k: u8) -> u32 {
+    return (1 as u32) << (k as u32);
+}
+
+pub fn valid_node_kind(k: u8) -> bool {
+    return k < NODE_KINDS;
+}
+
+pub fn valid_edge_kind(k: u8) -> bool {
+    return k < EDGE_KINDS;
+}
+
+pub fn valid_label(l: u8) -> bool {
+    return l < LABEL_KINDS;
+}
+
+/// The code of a node kind asked for by name, or NO_CODE.
+pub fn node_kind_id(name: str) -> u8 {
+    var i : u32 = 0;
+    while (i < (NODE_KINDS as u32)) {
+        if (NODE_KIND_NAMES[i as usize] == name) { return i as u8; }
+        i = i + 1;
+    }
+    return NO_CODE;
+}
+
+pub fn edge_kind_id(name: str) -> u8 {
+    var i : u32 = 0;
+    while (i < (EDGE_KINDS as u32)) {
+        if (EDGE_KIND_NAMES[i as usize] == name) { return i as u8; }
+        i = i + 1;
+    }
+    return NO_CODE;
+}
+
+pub fn label_id(name: str) -> u8 {
+    var i : u32 = 0;
+    while (i < (LABEL_KINDS as u32)) {
+        if (LABEL_NAMES[i as usize] == name) { return i as u8; }
+        i = i + 1;
+    }
+    return NO_CODE;
+}
+
+/// Every name in the three tables maps back to its own code.
+pub fn name_tables_round_trip() -> bool {
+    var k : u32 = 0;
+    while (k < (NODE_KINDS as u32)) {
+        if (node_kind_id(NODE_KIND_NAMES[k as usize]) != (k as u8)) { return false; }
+        k = k + 1;
+    }
+    var e : u32 = 0;
+    while (e < (EDGE_KINDS as u32)) {
+        if (edge_kind_id(EDGE_KIND_NAMES[e as usize]) != (e as u8)) { return false; }
+        e = e + 1;
+    }
+    var l : u32 = 0;
+    while (l < (LABEL_KINDS as u32)) {
+        if (label_id(LABEL_NAMES[l as usize]) != (l as u8)) { return false; }
+        l = l + 1;
+    }
+    return true;
+}
+
+/// Node n has a span and the span holds `line`.
+pub fn span_holds(g: SpecGraph, n: u32, line: u32) -> bool {
+    let k : usize = n as usize;
+    if (g.line_start[k] == NO_LINE) { return false; }
+    return g.line_start[k] <= line and line <= g.line_end[k];
+}
+
+/// The rules one node must meet, in order: a known kind, a known label, a name, an ordered span
+/// inside the file, a span when it is EXACT or SUGGESTED, and only node 0 may be the module.
+pub fn validate_node(g: SpecGraph, n: u32) -> u8 {
+    let k : usize = n as usize;
+    if (valid_node_kind(g.node_kind[k]) == false) { return ERR_NODE_KIND; }
+    if (valid_label(g.node_label[k]) == false) { return ERR_LABEL; }
+    if (g.node_name[k] == "") { return ERR_NODE_NAME; }
+    let s : u32 = g.line_start[k];
+    let e : u32 = g.line_end[k];
+    if (s > e) { return ERR_SPAN_ORDER; }
+    if (s == NO_LINE and e != NO_LINE) { return ERR_SPAN_ORDER; }
+    if (e > g.line_count) { return ERR_SPAN_OUTSIDE; }
+    let l : u8 = g.node_label[k];
+    if (s == NO_LINE and (l == LABEL_EXACT or l == LABEL_SUGGESTED)) { return ERR_SPAN_MISSING; }
+    if (n > 0 and g.node_kind[k] == NODE_MODULE) { return ERR_MODULE; }
+    return GRAPH_OK;
+}
+
+/// The rules one edge must meet, in order: a known kind; both endpoints exist; their kinds are
+/// allowed for the edge kind; neither is UNKNOWN; a label that is not UNKNOWN and no stronger than
+/// either endpoint; a source line inside an endpoint's span (required unless the edge is
+/// DERIVED); and no earlier edge with the same kind and endpoints.
+pub fn validate_edge(g: SpecGraph, j: u32) -> u8 {
+    let k : usize = j as usize;
+    let ek : u8 = g.edge_kind[k];
+    if (valid_edge_kind(ek) == false) { return ERR_EDGE_KIND; }
+    let f : u32 = g.edge_from[k] as u32;
+    let t : u32 = g.edge_to[k] as u32;
+    if (f >= g.node_count or t >= g.node_count) { return ERR_EDGE_DANGLING; }
+    let fk : u8 = g.node_kind[f as usize];
+    let tk : u8 = g.node_kind[t as usize];
+    if ((EDGE_FROM_KINDS[ek as usize] & kind_bit(fk)) == 0) { return ERR_EDGE_ENDPOINT_KIND; }
+    if ((EDGE_TO_KINDS[ek as usize] & kind_bit(tk)) == 0) { return ERR_EDGE_ENDPOINT_KIND; }
+    let fl : u8 = g.node_label[f as usize];
+    let tl : u8 = g.node_label[t as usize];
+    if (fl == LABEL_UNKNOWN or tl == LABEL_UNKNOWN) { return ERR_EDGE_UNKNOWN_NODE; }
+    let el : u8 = g.edge_label[k];
+    if (el >= LABEL_UNKNOWN) { return ERR_EDGE_LABEL; }
+    if (el < fl or el < tl) { return ERR_EDGE_LABEL; }
+    let line : u32 = g.edge_line[k];
+    if (line == NO_LINE) {
+        if (el != LABEL_DERIVED) { return ERR_EDGE_LINE; }
+    } else {
+        if (span_holds(g, f, line) == false and span_holds(g, t, line) == false) { return ERR_EDGE_LINE; }
+    }
+    var i : u32 = 0;
+    while (i < j) {
+        let m : usize = i as usize;
+        if (g.edge_kind[m] == ek and g.edge_from[m] == g.edge_from[k] and g.edge_to[m] == g.edge_to[k]) { return ERR_DUPLICATE_EDGE; }
+        i = i + 1;
+    }
+    return GRAPH_OK;
+}
+
+/// Graph-level rules, before any node is read: version, a spec path and a line count, capacity,
+/// and a module at node 0 whose span is the whole file.
+pub fn validate_graph_header(g: SpecGraph) -> u8 {
+    if (g.ir_version != GRAPH_IR_VERSION) { return ERR_GRAPH_VERSION; }
+    if (g.spec_path == "" or g.line_count == 0) { return ERR_SPEC_PATH; }
+    if (g.node_count > MAX_NODES) { return ERR_TOO_MANY_NODES; }
+    if (g.edge_count > MAX_EDGES) { return ERR_TOO_MANY_EDGES; }
+    if (g.node_count == 0) { return ERR_MODULE; }
+    if (g.node_kind[0] != NODE_MODULE) { return ERR_MODULE; }
+    if (g.line_start[0] != 1 or g.line_end[0] != g.line_count) { return ERR_MODULE; }
+    return GRAPH_OK;
+}
+
+/// GRAPH_OK, or the first rule the graph breaks.
+pub fn validate_graph(g: SpecGraph) -> u8 {
+    let h : u8 = validate_graph_header(g);
+    if (h != GRAPH_OK) { return h; }
+    var n : u32 = 0;
+    while (n < g.node_count) {
+        let v : u8 = validate_node(g, n);
+        if (v != GRAPH_OK) { return v; }
+        n = n + 1;
+    }
+    var j : u32 = 0;
+    while (j < g.edge_count) {
+        let w : u8 = validate_edge(g, j);
+        if (w != GRAPH_OK) { return w; }
+        j = j + 1;
+    }
+    return GRAPH_OK;
+}
+
+/// The first node that breaks a rule, or NO_INDEX when the header fails or no node does.
+pub fn first_bad_node(g: SpecGraph) -> u32 {
+    if (validate_graph_header(g) != GRAPH_OK) { return NO_INDEX; }
+    var n : u32 = 0;
+    while (n < g.node_count) {
+        if (validate_node(g, n) != GRAPH_OK) { return n; }
+        n = n + 1;
+    }
+    return NO_INDEX;
+}
+
+/// The first edge that breaks a rule, or NO_INDEX when the header or a node fails or no edge does.
+pub fn first_bad_edge(g: SpecGraph) -> u32 {
+    if (validate_graph_header(g) != GRAPH_OK) { return NO_INDEX; }
+    if (first_bad_node(g) != NO_INDEX) { return NO_INDEX; }
+    var j : u32 = 0;
+    while (j < g.edge_count) {
+        if (validate_edge(g, j) != GRAPH_OK) { return j; }
+        j = j + 1;
+    }
+    return NO_INDEX;
+}
+
+/// Node -> source: the record of node n, span included.
+pub fn node_at(g: SpecGraph, n: u32) -> SpecGraphNode {
+    let k : usize = n as usize;
+    return SpecGraphNode { kind: g.node_kind[k], label: g.node_label[k], name: g.node_name[k], line_start: g.line_start[k], line_end: g.line_end[k] };
+}
+
+/// Source -> node: the innermost node whose span holds `line` (the shortest span; on a tie, the
+/// lower node number), or NO_INDEX when no node does. A comment line inside the file belongs to
+/// the module.
+pub fn node_at_line(g: SpecGraph, line: u32) -> u32 {
+    var best : u32 = NO_INDEX;
+    var best_len : u32 = 0;
+    var n : u32 = 0;
+    while (n < g.node_count) {
+        if (span_holds(g, n, line)) {
+            let len : u32 = g.line_end[n as usize] - g.line_start[n as usize];
+            if (best == NO_INDEX or len < best_len) {
+                best = n;
+                best_len = len;
+            }
+        }
+        n = n + 1;
+    }
+    return best;
+}
+
+pub fn count_node_kind(g: SpecGraph, k: u8) -> u32 {
+    var c : u32 = 0;
+    var n : u32 = 0;
+    while (n < g.node_count) {
+        if (g.node_kind[n as usize] == k) { c = c + 1; }
+        n = n + 1;
+    }
+    return c;
+}
+
+pub fn count_node_label(g: SpecGraph, l: u8) -> u32 {
+    var c : u32 = 0;
+    var n : u32 = 0;
+    while (n < g.node_count) {
+        if (g.node_label[n as usize] == l) { c = c + 1; }
+        n = n + 1;
+    }
+    return c;
+}
+
+pub fn count_edge_kind(g: SpecGraph, k: u8) -> u32 {
+    var c : u32 = 0;
+    var j : u32 = 0;
+    while (j < g.edge_count) {
+        if (g.edge_kind[j as usize] == k) { c = c + 1; }
+        j = j + 1;
+    }
+    return c;
+}
+
+pub fn count_edge_label(g: SpecGraph, l: u8) -> u32 {
+    var c : u32 = 0;
+    var j : u32 = 0;
+    while (j < g.edge_count) {
+        if (g.edge_label[j as usize] == l) { c = c + 1; }
+        j = j + 1;
+    }
+    return c;
+}
+
+/// There is an edge of kind k from f to t.
+pub fn has_edge(g: SpecGraph, k: u8, f: u32, t: u32) -> bool {
+    var j : u32 = 0;
+    while (j < g.edge_count) {
+        let m : usize = j as usize;
+        if (g.edge_kind[m] == k and (g.edge_from[m] as u32) == f and (g.edge_to[m] as u32) == t) { return true; }
+        j = j + 1;
+    }
+    return false;
+}
+
+/// How many tests, invariants and benches exercise node n (its TESTED_BY edges).
+pub fn tests_of(g: SpecGraph, n: u32) -> u32 {
+    var c : u32 = 0;
+    var j : u32 = 0;
+    while (j < g.edge_count) {
+        let m : usize = j as usize;
+        if (g.edge_kind[m] == EDGE_TESTED_BY and (g.edge_from[m] as u32) == n) { c = c + 1; }
+        j = j + 1;
+    }
+    return c;
+}
+
+/// The DERIVED rule for TESTED_BY: fn f is tested by t exactly when t is a test, invariant or
+/// bench that CALLS f. True when the graph's TESTED_BY edges are that set and nothing else.
+pub fn tested_by_matches_calls(g: SpecGraph) -> bool {
+    let checkers : u32 = kind_bit(NODE_TEST) | kind_bit(NODE_INVARIANT) | kind_bit(NODE_BENCH);
+    var j : u32 = 0;
+    while (j < g.edge_count) {
+        let m : usize = j as usize;
+        let f : u32 = g.edge_from[m] as u32;
+        let t : u32 = g.edge_to[m] as u32;
+        if (g.edge_kind[m] == EDGE_TESTED_BY) {
+            if (has_edge(g, EDGE_CALLS, t, f) == false) { return false; }
+        }
+        if (g.edge_kind[m] == EDGE_CALLS and (kind_bit(g.node_kind[f as usize]) & checkers) != 0) {
+            if (has_edge(g, EDGE_TESTED_BY, t, f) == false) { return false; }
+        }
+        j = j + 1;
+    }
+    return true;
+}
+
+/// The fns no test, invariant or bench exercises.
+pub fn untested_fns(g: SpecGraph) -> u32 {
+    var c : u32 = 0;
+    var n : u32 = 0;
+    while (n < g.node_count) {
+        if (g.node_kind[n as usize] == NODE_FN and tests_of(g, n) == 0) { c = c + 1; }
+        n = n + 1;
+    }
+    return c;
+}
+
+/// The ui_plan widget that draws a node. A SUGGESTED or UNKNOWN node is drawn as plain text, never
+/// as a widget that presents a verified property (a formula, a run button, a metrics table): ui_plan
+/// IR version 1 has no way to badge a widget as a guess, so a guess gets no such widget.
+pub fn node_widget(kind: u8, label: u8) -> u8 {
+    if (valid_label(label) == false or label == LABEL_SUGGESTED or label == LABEL_UNKNOWN) { return WIDGET_TEXT_BLOCK; }
+    if (kind == NODE_MODULE or kind == NODE_USE) { return WIDGET_HONEYCOMB_CARD; }
+    if (kind == NODE_CONST or kind == NODE_FN) { return WIDGET_FORMULA_VIEW; }
+    if (kind == NODE_TEST or kind == NODE_INVARIANT) { return WIDGET_RUN_BUTTON; }
+    if (kind == NODE_BENCH) { return WIDGET_METRICS_TABLE; }
+    return WIDGET_TEXT_BLOCK;
+}
+
+/// The ui_plan source kind a node's widget binds to, read from the ui_plan catalog. Source refs:
+/// SOURCE_SPEC is the spec path (for a `use`, the imported spec); SOURCE_FORMULA is
+/// "<spec path>#<node name>", the form ui_plan's own fixture uses; SOURCE_METRICS is a results
+/// file the host declares, which the graph does not name.
+pub fn node_source_kind(kind: u8, label: u8) -> u8 {
+    return WIDGET_SOURCE[node_widget(kind, label) as usize];
+}
+
+/// Every (kind, label) pair, including out-of-range ones, binds to a catalog widget.
+pub fn all_bindings_trusted() -> bool {
+    var k : u32 = 0;
+    while (k <= (NODE_KINDS as u32)) {
+        var l : u32 = 0;
+        while (l <= (LABEL_KINDS as u32)) {
+            if (catalog_widget(node_widget(k as u8, l as u8)) == false) { return false; }
+            l = l + 1;
+        }
+        k = k + 1;
+    }
+    return true;
+}
+
+/// An empty graph of the current version: no path, no nodes, no edges.
+pub fn blank_graph() -> SpecGraph {
+    return SpecGraph {
+        ir_version: GRAPH_IR_VERSION, spec_path: "", line_count: 0, node_count: 0,
+        node_kind: [0; 192], node_label: [0; 192],
+        node_name: [
+            "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "",
+            "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "",
+            "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "",
+            "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "",
+            "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "",
+            "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "",
+            "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "",
+            "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "",
+            "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "",
+            "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "",
+            "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "",
+            "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", ""
+        ],
+        line_start: [0; 192], line_end: [0; 192],
+        edge_count: 0, edge_kind: [0; 254], edge_from: [0; 254], edge_to: [0; 254], edge_label: [0; 254], edge_line: [0; 254]
+    };
+}
+
+/// g with one more node. Past MAX_NODES the node is dropped and node_count still counts it, so
+/// validate_graph_header refuses the graph instead of silently losing a node.
+pub fn with_node(g: SpecGraph, kind: u8, label: u8, name: str, s: u32, e: u32) -> SpecGraph {
+    var h : SpecGraph = g;
+    if (h.node_count < MAX_NODES) {
+        let k : usize = h.node_count as usize;
+        h.node_kind[k] = kind;
+        h.node_label[k] = label;
+        h.node_name[k] = name;
+        h.line_start[k] = s;
+        h.line_end[k] = e;
+    }
+    h.node_count = h.node_count + 1;
+    return h;
+}
+
+/// g with one more edge, under the same capacity rule as with_node.
+pub fn with_edge(g: SpecGraph, kind: u8, f: u8, t: u8, label: u8, line: u32) -> SpecGraph {
+    var h : SpecGraph = g;
+    if (h.edge_count < MAX_EDGES) {
+        let k : usize = h.edge_count as usize;
+        h.edge_kind[k] = kind;
+        h.edge_from[k] = f;
+        h.edge_to[k] = t;
+        h.edge_label[k] = label;
+        h.edge_line[k] = line;
+    }
+    h.edge_count = h.edge_count + 1;
+    return h;
+}
+
+/// The fixture: the graph of specs/tutorial/08_modules_and_arrays.t27 at gHashTag/t27 commit
+/// 2f395025f (93 lines, sha256 c291e925d9dabef8b72b5a64aef153a2126c0b0b43d67bc08b1b2d7eaa98039a),
+/// read by hand. Every top-level declaration is a node; every span and edge line is a line of
+/// that file. Node numbers: 0 module, 1 use, 2-3 consts, 4 scaled_width, 5-7 consts,
+/// 8 power_of_two, 9 bias_for_width, 10-12 tests, 13 invariant, 14 std.testing.
+pub fn tutorial_08_graph() -> SpecGraph {
+    var g : SpecGraph = blank_graph();
+    g.spec_path = "specs/tutorial/08_modules_and_arrays.t27";
+    g.line_count = 93;
+    // `module tutorial-08-modules;` is line 11; the module node spans the file.
+    g = with_node(g, NODE_MODULE, LABEL_EXACT, "tutorial-08-modules", 1, 93);
+    g = with_node(g, NODE_USE, LABEL_EXACT, "base::types", 22, 22);
+    g = with_node(g, NODE_CONST, LABEL_EXACT, "EXPORTED_WIDTH", 32, 32);
+    g = with_node(g, NODE_CONST, LABEL_EXACT, "INTERNAL_SCALE", 35, 35);
+    g = with_node(g, NODE_FN, LABEL_EXACT, "scaled_width", 37, 39);
+    g = with_node(g, NODE_CONST, LABEL_EXACT, "TRIT_VALUES", 54, 54);
+    g = with_node(g, NODE_CONST, LABEL_EXACT, "POWERS_OF_TWO", 56, 56);
+    g = with_node(g, NODE_CONST, LABEL_EXACT, "EXPONENT_BIAS", 58, 58);
+    g = with_node(g, NODE_FN, LABEL_EXACT, "power_of_two", 66, 68);
+    g = with_node(g, NODE_FN, LABEL_EXACT, "bias_for_width", 70, 72);
+    g = with_node(g, NODE_TEST, LABEL_EXACT, "the power table matches its own definition", 78, 81);
+    g = with_node(g, NODE_TEST, LABEL_EXACT, "bias table carries the four standard widths", 83, 86);
+    g = with_node(g, NODE_TEST, LABEL_EXACT, "a private constant is still usable inside its own module", 88, 90);
+    g = with_node(g, NODE_INVARIANT, LABEL_EXACT, "exported_width_is_a_power_of_two", 92, 93);
+    // The tests call std.testing.expectEqual (lines 79-89). No `use` in the file declares std and
+    // it is not a corpus spec, so what it is cannot be read from this source.
+    g = with_node(g, NODE_OPAQUE, LABEL_UNKNOWN, "std.testing", 79, 89);
+    // The `use` statement (line 22).
+    g = with_edge(g, EDGE_USES, 0, 1, LABEL_EXACT, 22);
+    // Names in function bodies (lines 38, 67, 71).
+    g = with_edge(g, EDGE_USES, 4, 2, LABEL_EXACT, 38);
+    g = with_edge(g, EDGE_USES, 4, 3, LABEL_EXACT, 38);
+    g = with_edge(g, EDGE_USES, 8, 6, LABEL_EXACT, 67);
+    g = with_edge(g, EDGE_USES, 9, 7, LABEL_EXACT, 71);
+    // The named values are operands of each return expression, so they reach the result.
+    g = with_edge(g, EDGE_DATA_FLOW, 2, 4, LABEL_DERIVED, 38);
+    g = with_edge(g, EDGE_DATA_FLOW, 3, 4, LABEL_DERIVED, 38);
+    g = with_edge(g, EDGE_DATA_FLOW, 6, 8, LABEL_DERIVED, 67);
+    g = with_edge(g, EDGE_DATA_FLOW, 7, 9, LABEL_DERIVED, 71);
+    // Calls from test bodies (first call lines 79, 84, 89).
+    g = with_edge(g, EDGE_CALLS, 10, 8, LABEL_EXACT, 79);
+    g = with_edge(g, EDGE_CALLS, 11, 9, LABEL_EXACT, 84);
+    g = with_edge(g, EDGE_CALLS, 12, 4, LABEL_EXACT, 89);
+    // TESTED_BY is the calls above read backwards; it has no line of its own.
+    g = with_edge(g, EDGE_TESTED_BY, 8, 10, LABEL_DERIVED, NO_LINE);
+    g = with_edge(g, EDGE_TESTED_BY, 9, 11, LABEL_DERIVED, NO_LINE);
+    g = with_edge(g, EDGE_TESTED_BY, 4, 12, LABEL_DERIVED, NO_LINE);
+    // `assert EXPORTED_WIDTH == 16` (line 93).
+    g = with_edge(g, EDGE_CONSTRAINS, 13, 2, LABEL_EXACT, 93);
+    return g;
+}
+
+/// The fixture with a model's explanation added: node 15, "table lookup step", over the two
+/// indexing functions (lines 66-72), and the suggested flow of POWERS_OF_TWO into it (line 67).
+pub fn with_suggestion() -> SpecGraph {
+    var g : SpecGraph = tutorial_08_graph();
+    g = with_node(g, NODE_OPAQUE, LABEL_SUGGESTED, "table lookup step", 66, 72);
+    g = with_edge(g, EDGE_DATA_FLOW, 6, 15, LABEL_SUGGESTED, 67);
+    return g;
+}
+
+/// A UI plan for the fixture, every widget picked by node_widget: the module card (node 0), the
+/// formula view of power_of_two (node 8) and the run button of its test (node 10).
+pub fn tutorial_08_plan() -> UiPlan {
+    let g : SpecGraph = tutorial_08_graph();
+    var p : UiPlan = blank_plan();
+    p.intent = "Show the graph of tutorial lesson 08";
+    p.title = "Tutorial 08 spec graph";
+    p.granted = bit(CAP_READ_SPECS) | bit(CAP_RUN_LAB);
+    p.source_count = 2;
+    p.source_kind[0] = SOURCE_SPEC;
+    p.source_ref[0] = g.spec_path;
+    p.source_kind[1] = SOURCE_FORMULA;
+    p.source_ref[1] = "specs/tutorial/08_modules_and_arrays.t27#power_of_two";
+    p.widget_count = 3;
+    p.widget[0] = node_widget(g.node_kind[0], g.node_label[0]);
+    p.props[0] = bit(PROP_TITLE) | bit(PROP_SPEC_PATH);
+    p.binding[0] = 1;
+    p.action[0] = ACTION_OPEN_SPEC;
+    p.span[0] = 6;
+    p.label[0] = g.node_name[0];
+    p.widget[1] = node_widget(g.node_kind[8], g.node_label[8]);
+    p.props[1] = bit(PROP_TITLE) | bit(PROP_FORMULA_ID);
+    p.binding[1] = 2;
+    p.action[1] = ACTION_NONE;
+    p.col[1] = 6;
+    p.span[1] = 6;
+    p.label[1] = g.node_name[8];
+    p.widget[2] = node_widget(g.node_kind[10], g.node_label[10]);
+    p.props[2] = bit(PROP_TITLE) | bit(PROP_SPEC_PATH);
+    p.binding[2] = 1;
+    p.action[2] = ACTION_RUN_TESTS;
+    p.row[2] = 1;
+    p.span[2] = 4;
+    p.label[2] = g.node_name[10];
+    return p;
+}
+
+test name_tables_map_names_to_codes {
+    assert node_kind_id("module") == NODE_MODULE;
+    assert node_kind_id("fn") == NODE_FN;
+    assert node_kind_id("opaque") == NODE_OPAQUE;
+    assert edge_kind_id("tested_by") == EDGE_TESTED_BY;
+    assert edge_kind_id("data_flow") == EDGE_DATA_FLOW;
+    assert label_id("suggested") == LABEL_SUGGESTED;
+    assert label_id("unknown") == LABEL_UNKNOWN;
+    // names outside the tables, and a different spelling, are not codes
+    assert node_kind_id("step") == NO_CODE;
+    assert node_kind_id("Fn") == NO_CODE;
+    assert edge_kind_id("control_flow") == NO_CODE;
+    assert label_id("verified") == NO_CODE;
+    assert name_tables_round_trip();
+    assert valid_node_kind(NODE_OPAQUE);
+    assert valid_node_kind(NODE_KINDS) == false;
+    assert valid_edge_kind(EDGE_KINDS) == false;
+    assert valid_label(LABEL_UNKNOWN);
+    assert valid_label(LABEL_KINDS) == false;
+}
+
+test fixture_graph_is_valid {
+    let g : SpecGraph = tutorial_08_graph();
+    assert validate_graph(g) == GRAPH_OK;
+    assert first_bad_node(g) == NO_INDEX;
+    assert first_bad_edge(g) == NO_INDEX;
+    assert g.node_count == 15;
+    assert g.edge_count == 16;
+    // one node per top-level declaration of the file, plus the opaque region
+    assert count_node_kind(g, NODE_MODULE) == 1;
+    assert count_node_kind(g, NODE_USE) == 1;
+    assert count_node_kind(g, NODE_CONST) == 5;
+    assert count_node_kind(g, NODE_FN) == 3;
+    assert count_node_kind(g, NODE_TEST) == 3;
+    assert count_node_kind(g, NODE_INVARIANT) == 1;
+    assert count_node_kind(g, NODE_BENCH) == 0;
+    assert count_node_kind(g, NODE_OPAQUE) == 1;
+    assert count_node_label(g, LABEL_EXACT) == 14;
+    assert count_node_label(g, LABEL_UNKNOWN) == 1;
+    assert count_edge_kind(g, EDGE_USES) == 5;
+    assert count_edge_kind(g, EDGE_DATA_FLOW) == 4;
+    assert count_edge_kind(g, EDGE_CALLS) == 3;
+    assert count_edge_kind(g, EDGE_TESTED_BY) == 3;
+    assert count_edge_kind(g, EDGE_CONSTRAINS) == 1;
+    assert count_edge_label(g, LABEL_EXACT) == 9;
+    assert count_edge_label(g, LABEL_DERIVED) == 7;
+    assert count_edge_label(g, LABEL_SUGGESTED) == 0;
+}
+
+test header_rules_come_first {
+    var v : SpecGraph = tutorial_08_graph();
+    v.ir_version = GRAPH_IR_VERSION + 1;
+    assert validate_graph(v) == ERR_GRAPH_VERSION;
+    var p : SpecGraph = tutorial_08_graph();
+    p.spec_path = "";
+    assert validate_graph(p) == ERR_SPEC_PATH;
+    var c : SpecGraph = tutorial_08_graph();
+    c.line_count = 0;
+    assert validate_graph(c) == ERR_SPEC_PATH;
+    assert validate_graph(blank_graph()) == ERR_SPEC_PATH;
+    var e : SpecGraph = blank_graph();
+    e.spec_path = "specs/x.t27";
+    e.line_count = 1;
+    assert validate_graph(e) == ERR_MODULE;
+    // node 0 must be the module, and its span must be the whole file
+    var m : SpecGraph = tutorial_08_graph();
+    m.node_kind[0] = NODE_CONST;
+    assert validate_graph(m) == ERR_MODULE;
+    var s : SpecGraph = tutorial_08_graph();
+    s.line_start[0] = 11;
+    assert validate_graph(s) == ERR_MODULE;
+    assert first_bad_node(s) == NO_INDEX;
+    var f : SpecGraph = tutorial_08_graph();
+    f.line_count = 94;
+    assert validate_graph(f) == ERR_MODULE;
+    // a second module is a node rule, reported at that node
+    var d : SpecGraph = tutorial_08_graph();
+    d.node_kind[5] = NODE_MODULE;
+    assert validate_graph(d) == ERR_MODULE;
+    assert first_bad_node(d) == 5;
+}
+
+test capacity_is_refused_not_truncated {
+    var g : SpecGraph = tutorial_08_graph();
+    while (g.node_count < MAX_NODES + 1) {
+        g = with_node(g, NODE_CONST, LABEL_DERIVED, "extra", NO_LINE, NO_LINE);
+    }
+    // MAX_NODES + 1 nodes declared, MAX_NODES stored: the graph is refused, not cut short
+    assert g.node_count == MAX_NODES + 1;
+    assert validate_graph(g) == ERR_TOO_MANY_NODES;
+    var h : SpecGraph = tutorial_08_graph();
+    while (h.edge_count < MAX_EDGES + 1) {
+        h = with_edge(h, EDGE_TESTED_BY, 9, 13, LABEL_DERIVED, NO_LINE);
+    }
+    assert h.edge_count == MAX_EDGES + 1;
+    assert validate_graph(h) == ERR_TOO_MANY_EDGES;
+}
+
+test a_graph_exactly_at_capacity_is_valid {
+    // 16 fns and 16 tests after the fixture's 15 nodes, then consts up to MAX_NODES; every
+    // test calls every fn, so the CALLS edges are distinct (a repeated edge is a duplicate)
+    var g : SpecGraph = tutorial_08_graph();
+    var a : u32 = 0;
+    while (a < 16) {
+        g = with_node(g, NODE_FN, LABEL_EXACT, "f", 1, 1);
+        a = a + 1;
+    }
+    a = 0;
+    while (a < 16) {
+        g = with_node(g, NODE_TEST, LABEL_EXACT, "t", 1, 1);
+        a = a + 1;
+    }
+    while (g.node_count < MAX_NODES) {
+        g = with_node(g, NODE_CONST, LABEL_EXACT, "extra", 1, 1);
+    }
+    var t : u32 = 0;
+    while (t < 16) {
+        var f : u32 = 0;
+        while (f < 16) {
+            if (g.edge_count < MAX_EDGES) {
+                g = with_edge(g, EDGE_CALLS, (31 + t) as u8, (15 + f) as u8, LABEL_EXACT, 1);
+            }
+            f = f + 1;
+        }
+        t = t + 1;
+    }
+    assert g.node_count == MAX_NODES;
+    assert g.edge_count == MAX_EDGES;
+    assert validate_graph(g) == GRAPH_OK;
+    // the last stored node and edge are real cells, not clipped
+    assert g.node_kind[MAX_NODES as usize - 1] == NODE_CONST;
+    assert g.edge_kind[MAX_EDGES as usize - 1] == EDGE_CALLS;
+    // negative control: one more edge or node makes the same graph refused
+    assert validate_graph(with_edge(g, EDGE_CALLS, 31, 15, LABEL_EXACT, 1)) == ERR_TOO_MANY_EDGES;
+    assert validate_graph(with_node(g, NODE_CONST, LABEL_EXACT, "extra", 1, 1)) == ERR_TOO_MANY_NODES;
+}
+
+test node_rules {
+    var k : SpecGraph = tutorial_08_graph();
+    k.node_kind[3] = NODE_KINDS;
+    assert validate_graph(k) == ERR_NODE_KIND;
+    assert first_bad_node(k) == 3;
+    var l : SpecGraph = tutorial_08_graph();
+    l.node_label[7] = LABEL_KINDS;
+    assert validate_graph(l) == ERR_LABEL;
+    assert first_bad_node(l) == 7;
+    var n : SpecGraph = tutorial_08_graph();
+    n.node_name[9] = "";
+    assert validate_graph(n) == ERR_NODE_NAME;
+    // span order: start after end, or an end with no start
+    var o : SpecGraph = tutorial_08_graph();
+    o.line_start[4] = 40;
+    assert validate_graph(o) == ERR_SPAN_ORDER;
+    assert first_bad_node(o) == 4;
+    var z : SpecGraph = tutorial_08_graph();
+    z.line_start[4] = NO_LINE;
+    assert validate_graph(z) == ERR_SPAN_ORDER;
+    var x : SpecGraph = tutorial_08_graph();
+    x.line_end[13] = 94;
+    assert validate_graph(x) == ERR_SPAN_OUTSIDE;
+    assert first_bad_node(x) == 13;
+    // an EXACT node is in the source, so it has a span
+    var m : SpecGraph = tutorial_08_graph();
+    m.line_start[5] = NO_LINE;
+    m.line_end[5] = NO_LINE;
+    assert validate_graph(m) == ERR_SPAN_MISSING;
+    assert first_bad_node(m) == 5;
+    // a DERIVED or UNKNOWN node may have none
+    m.node_label[5] = LABEL_DERIVED;
+    assert validate_graph(m) == GRAPH_OK;
+    var u : SpecGraph = tutorial_08_graph();
+    u.line_start[14] = NO_LINE;
+    u.line_end[14] = NO_LINE;
+    assert validate_graph(u) == GRAPH_OK;
+}
+
+test suggested_node_needs_a_span {
+    let g : SpecGraph = with_suggestion();
+    assert validate_graph(g) == GRAPH_OK;
+    assert count_node_label(g, LABEL_SUGGESTED) == 1;
+    assert count_edge_label(g, LABEL_SUGGESTED) == 1;
+    // without the lines it explains, a guess is refused
+    var s : SpecGraph = with_suggestion();
+    s.line_start[15] = NO_LINE;
+    s.line_end[15] = NO_LINE;
+    assert validate_graph(s) == ERR_SPAN_MISSING;
+    assert first_bad_node(s) == 15;
+    // an edge into a guess is a guess: it may not be labelled EXACT or DERIVED
+    var e : SpecGraph = with_suggestion();
+    e.edge_label[16] = LABEL_EXACT;
+    assert validate_graph(e) == ERR_EDGE_LABEL;
+    assert first_bad_edge(e) == 16;
+    e.edge_label[16] = LABEL_DERIVED;
+    assert validate_graph(e) == ERR_EDGE_LABEL;
+    // and a suggested edge carries its source line too
+    var l : SpecGraph = with_suggestion();
+    l.edge_line[16] = NO_LINE;
+    assert validate_graph(l) == ERR_EDGE_LINE;
+}
+
+test unknown_node_draws_no_edges {
+    let g : SpecGraph = tutorial_08_graph();
+    var a : SpecGraph = with_edge(g, EDGE_DATA_FLOW, 14, 10, LABEL_DERIVED, 79);
+    assert validate_graph(a) == ERR_EDGE_UNKNOWN_NODE;
+    assert first_bad_edge(a) == 16;
+    var b : SpecGraph = with_edge(g, EDGE_DATA_FLOW, 6, 14, LABEL_SUGGESTED, 79);
+    assert validate_graph(b) == ERR_EDGE_UNKNOWN_NODE;
+    // the rule is about the label: the same edge from a DERIVED region is drawn
+    a.node_label[14] = LABEL_DERIVED;
+    assert validate_graph(a) == GRAPH_OK;
+}
+
+test edge_endpoints_must_exist_and_fit {
+    let g : SpecGraph = tutorial_08_graph();
+    assert validate_graph(with_edge(g, EDGE_CALLS, 10, 15, LABEL_EXACT, 79)) == ERR_EDGE_DANGLING;
+    assert validate_graph(with_edge(g, EDGE_CALLS, 255, 8, LABEL_EXACT, 79)) == ERR_EDGE_DANGLING;
+    assert validate_graph(with_edge(g, EDGE_KINDS, 10, 8, LABEL_EXACT, 79)) == ERR_EDGE_KIND;
+    // calls end at a fn, never at a const
+    assert validate_graph(with_edge(g, EDGE_CALLS, 10, 6, LABEL_EXACT, 79)) == ERR_EDGE_ENDPOINT_KIND;
+    // tested_by starts at a fn; constrains starts at an invariant
+    assert validate_graph(with_edge(g, EDGE_TESTED_BY, 10, 8, LABEL_DERIVED, NO_LINE)) == ERR_EDGE_ENDPOINT_KIND;
+    assert validate_graph(with_edge(g, EDGE_CONSTRAINS, 10, 6, LABEL_EXACT, 79)) == ERR_EDGE_ENDPOINT_KIND;
+    // a module uses an import, but does not call it
+    assert validate_graph(with_edge(g, EDGE_CALLS, 0, 1, LABEL_EXACT, 22)) == ERR_EDGE_ENDPOINT_KIND;
+    var w : SpecGraph = tutorial_08_graph();
+    w.edge_to[9] = 7;
+    assert validate_graph(w) == ERR_EDGE_ENDPOINT_KIND;
+    assert first_bad_edge(w) == 9;
+}
+
+test edge_labels_lines_and_duplicates {
+    let g : SpecGraph = tutorial_08_graph();
+    // an edge is drawn or it is not: UNKNOWN is not an edge label
+    var u : SpecGraph = tutorial_08_graph();
+    u.edge_label[0] = LABEL_UNKNOWN;
+    assert validate_graph(u) == ERR_EDGE_LABEL;
+    assert first_bad_edge(u) == 0;
+    // an EXACT edge is read from a line, so it names one
+    var t : SpecGraph = tutorial_08_graph();
+    t.edge_label[12] = LABEL_EXACT;
+    assert validate_graph(t) == ERR_EDGE_LINE;
+    assert first_bad_edge(t) == 12;
+    // that line lies in one of its endpoints: line 50 is a comment between them
+    var o : SpecGraph = tutorial_08_graph();
+    o.edge_line[1] = 50;
+    assert validate_graph(o) == ERR_EDGE_LINE;
+    // a line in the target's span counts (data_flow 2 -> 4 is read at line 38, inside node 4)
+    assert span_holds(g, 2, 38) == false;
+    assert span_holds(g, 4, 38);
+    // an EXACT edge may not touch a DERIVED node
+    var d : SpecGraph = tutorial_08_graph();
+    d.node_label[6] = LABEL_DERIVED;
+    assert validate_graph(d) == ERR_EDGE_LABEL;
+    assert first_bad_edge(d) == 3;
+    // the same kind and endpoints twice is one edge drawn twice
+    assert validate_graph(with_edge(g, EDGE_USES, 4, 2, LABEL_EXACT, 38)) == ERR_DUPLICATE_EDGE;
+    // the same endpoints under another kind is a different edge
+    assert has_edge(g, EDGE_USES, 4, 2);
+    assert has_edge(g, EDGE_DATA_FLOW, 2, 4);
+    assert has_edge(g, EDGE_DATA_FLOW, 4, 2) == false;
+}
+
+test source_mapping_goes_both_ways {
+    let g : SpecGraph = tutorial_08_graph();
+    // line -> node: the innermost span wins
+    assert node_at_line(g, 67) == 8;
+    assert node_at_line(g, 93) == 13;
+    assert node_at_line(g, 22) == 1;
+    // line 79 is in test 10 (78-81) and in std.testing (79-89); the shorter span wins
+    assert node_at_line(g, 79) == 10;
+    assert node_at_line(g, 87) == 14;
+    // a comment line belongs to the module; no line 0, nothing past the file
+    assert node_at_line(g, 50) == 0;
+    assert node_at_line(g, 0) == NO_INDEX;
+    assert node_at_line(g, 94) == NO_INDEX;
+    // node -> line, and back to the same node, for every declaration
+    var n : u32 = 1;
+    var back : u32 = 0;
+    while (n < 14) {
+        let r : SpecGraphNode = node_at(g, n);
+        if (node_at_line(g, r.line_start) == n and node_at_line(g, r.line_end) == n) { back = back + 1; }
+        n = n + 1;
+    }
+    assert back == 13;
+    let p : SpecGraphNode = node_at(g, 8);
+    assert p.kind == NODE_FN;
+    assert p.label == LABEL_EXACT;
+    assert p.name == "power_of_two";
+    assert p.line_start == 66;
+    assert p.line_end == 68;
+}
+
+test tested_by_is_derived_from_calls {
+    let g : SpecGraph = tutorial_08_graph();
+    assert tested_by_matches_calls(g);
+    assert tests_of(g, 8) == 1;
+    assert tests_of(g, 4) == 1;
+    // TRIT_VALUES is declared and never read: no edge, no test
+    assert tests_of(g, 5) == 0;
+    assert untested_fns(g) == 0;
+    // drop one TESTED_BY edge: the derivation no longer holds and a fn is untested
+    var m : SpecGraph = tutorial_08_graph();
+    m.edge_count = 15;
+    m.edge_kind[14] = EDGE_CONSTRAINS;
+    m.edge_from[14] = 13;
+    m.edge_to[14] = 2;
+    m.edge_label[14] = LABEL_EXACT;
+    m.edge_line[14] = 93;
+    assert tested_by_matches_calls(m) == false;
+    assert untested_fns(m) == 1;
+    // a TESTED_BY edge with no call behind it is not derived either
+    var x : SpecGraph = with_edge(g, EDGE_TESTED_BY, 9, 10, LABEL_DERIVED, NO_LINE);
+    assert validate_graph(x) == GRAPH_OK;
+    assert tested_by_matches_calls(x) == false;
+}
+
+test nodes_bind_to_trusted_widgets {
+    assert node_widget(NODE_MODULE, LABEL_EXACT) == WIDGET_HONEYCOMB_CARD;
+    assert node_widget(NODE_USE, LABEL_DERIVED) == WIDGET_HONEYCOMB_CARD;
+    assert node_widget(NODE_FN, LABEL_EXACT) == WIDGET_FORMULA_VIEW;
+    assert node_widget(NODE_CONST, LABEL_EXACT) == WIDGET_FORMULA_VIEW;
+    assert node_widget(NODE_TEST, LABEL_EXACT) == WIDGET_RUN_BUTTON;
+    assert node_widget(NODE_INVARIANT, LABEL_EXACT) == WIDGET_RUN_BUTTON;
+    assert node_widget(NODE_BENCH, LABEL_EXACT) == WIDGET_METRICS_TABLE;
+    assert node_widget(NODE_OPAQUE, LABEL_EXACT) == WIDGET_TEXT_BLOCK;
+    // a guess and an unknown are drawn as text, whatever their kind
+    assert node_widget(NODE_FN, LABEL_SUGGESTED) == WIDGET_TEXT_BLOCK;
+    assert node_widget(NODE_TEST, LABEL_UNKNOWN) == WIDGET_TEXT_BLOCK;
+    assert node_widget(NODE_KINDS, LABEL_EXACT) == WIDGET_TEXT_BLOCK;
+    assert node_source_kind(NODE_FN, LABEL_EXACT) == SOURCE_FORMULA;
+    assert node_source_kind(NODE_TEST, LABEL_EXACT) == SOURCE_SPEC;
+    assert node_source_kind(NODE_BENCH, LABEL_EXACT) == SOURCE_METRICS;
+    assert node_source_kind(NODE_FN, LABEL_SUGGESTED) == SOURCE_NONE;
+    // a plan whose widgets were picked from the fixture passes ui_plan's own gate
+    let p : UiPlan = tutorial_08_plan();
+    assert validate_plan(p) == PLAN_OK;
+    assert p.widget[1] == WIDGET_FORMULA_VIEW;
+    assert p.source_kind[(p.binding[1] - 1) as usize] == node_source_kind(NODE_FN, LABEL_EXACT);
+    // if node 8 were a guess, its widget would be text, and text takes no binding
+    var q : UiPlan = tutorial_08_plan();
+    q.widget[1] = node_widget(NODE_FN, LABEL_SUGGESTED);
+    q.props[1] = bit(PROP_CAPTION);
+    assert validate_plan(q) == ERR_BINDING_KIND;
+    assert first_bad_slot(q) == 1;
+    q.binding[1] = 0;
+    assert validate_plan(q) == PLAN_OK;
+}
+
+test first_broken_rule_is_reported {
+    // a node defect and an edge defect: the node is reported, and no edge is named
+    var g : SpecGraph = tutorial_08_graph();
+    g.edge_line[1] = 50;
+    g.node_name[12] = "";
+    assert validate_graph(g) == ERR_NODE_NAME;
+    assert first_bad_node(g) == 12;
+    assert first_bad_edge(g) == NO_INDEX;
+    // fix the node: the edge comes next
+    g.node_name[12] = "a private constant is still usable inside its own module";
+    assert validate_graph(g) == ERR_EDGE_LINE;
+    assert first_bad_edge(g) == 1;
+    // a header defect hides both
+    g.ir_version = 0;
+    assert validate_graph(g) == ERR_GRAPH_VERSION;
+    assert first_bad_node(g) == NO_INDEX;
+    assert first_bad_edge(g) == NO_INDEX;
+}
+
+invariant name_tables_cover_every_code {
+    assert name_tables_round_trip();
+    assert node_kind_id(NODE_KIND_NAMES[NODE_OPAQUE as usize]) == NODE_OPAQUE;
+    assert edge_kind_id(EDGE_KIND_NAMES[EDGE_DATA_FLOW as usize]) == EDGE_DATA_FLOW;
+}
+
+invariant edge_masks_are_spelled_right {
+    let bodies : u32 = kind_bit(NODE_FN) | kind_bit(NODE_TEST) | kind_bit(NODE_INVARIANT) | kind_bit(NODE_BENCH);
+    assert EDGE_FROM_KINDS[EDGE_CALLS as usize] == bodies;
+    assert EDGE_TO_KINDS[EDGE_CALLS as usize] == kind_bit(NODE_FN);
+    assert EDGE_FROM_KINDS[EDGE_USES as usize] == kind_bit(NODE_MODULE) | bodies;
+    assert EDGE_TO_KINDS[EDGE_USES as usize] == kind_bit(NODE_CONST) | kind_bit(NODE_USE);
+    assert EDGE_FROM_KINDS[EDGE_TESTED_BY as usize] == kind_bit(NODE_FN);
+    assert EDGE_TO_KINDS[EDGE_TESTED_BY as usize] == kind_bit(NODE_TEST) | kind_bit(NODE_INVARIANT) | kind_bit(NODE_BENCH);
+    assert EDGE_FROM_KINDS[EDGE_CONSTRAINS as usize] == kind_bit(NODE_INVARIANT);
+    assert EDGE_TO_KINDS[EDGE_CONSTRAINS as usize] == kind_bit(NODE_CONST) | kind_bit(NODE_FN);
+    assert EDGE_FROM_KINDS[EDGE_DATA_FLOW as usize] == kind_bit(NODE_CONST) | kind_bit(NODE_FN) | kind_bit(NODE_USE) | kind_bit(NODE_OPAQUE);
+    assert EDGE_TO_KINDS[EDGE_DATA_FLOW as usize] == bodies | kind_bit(NODE_OPAQUE);
+}
+
+invariant every_node_binds_to_a_catalog_widget {
+    assert all_bindings_trusted();
+}
+
+invariant the_fixture_stays_valid {
+    assert validate_graph(tutorial_08_graph()) == GRAPH_OK;
+    assert validate_graph(with_suggestion()) == GRAPH_OK;
+    assert tested_by_matches_calls(tutorial_08_graph());
+}
+
+invariant reserved_codes_stay_outside {
+    assert NO_CODE >= NODE_KINDS;
+    assert NO_CODE >= EDGE_KINDS;
+    assert NO_CODE >= LABEL_KINDS;
+    assert MAX_NODES < NO_INDEX;
+    assert MAX_EDGES < NO_INDEX;
+    assert MAX_NODES >= MEASURED_NODES_P95;
+    assert MAX_EDGES >= MEASURED_EDGES_P95;
+    assert (NODE_KINDS as u32) < 32;
+    assert ERR_DUPLICATE_EDGE + 1 == VERDICT_KINDS;
+}
diff --git a/apps/website/public/t27f/graph/specs/spec_graph_export.t27 b/apps/website/public/t27f/graph/specs/spec_graph_export.t27
new file mode 100644
index 0000000000..03a9d8c804
--- /dev/null
+++ b/apps/website/public/t27f/graph/specs/spec_graph_export.t27
@@ -0,0 +1,971 @@
+// SPDX-License-Identifier: Apache-2.0
+; specs/t27f/spec_graph_export.t27 -- the T27F exporter: spec source bytes -> SpecGraph
+; (RFC gHashTag/trinity#1649, epic gHashTag/trinity#1648, tracked in gHashTag/t27#10162).
+; specs/t27f/spec_graph.t27 defines the graph IR and holds one graph, read by hand. This file reads
+; a graph out of real source instead: export_graph(path, src) is a deterministic byte scanner, with
+; no language model and no heuristic beyond the rules below. It reuses spec_graph's builders, codes
+; and validate_graph through `use`; it restates none of them.
+; What it decides:
+;   - Nodes. Each top-level declaration line, with an optional leading `pub `, is one node: module,
+;     use, const, fn, test, invariant and bench map to their NODE_* kind; node 0 is the module and
+;     spans the file. struct, enum, var, spec and endmodule are NODE_OPAQUE with LABEL_EXACT (read,
+;     but no finer kind in IR version 1). Any other word at the head of a declaration, or a known
+;     keyword with no readable name, is NODE_OPAQUE with LABEL_UNKNOWN. A file with no module line
+;     gets node 0 named "(no module)", LABEL_UNKNOWN, and no edge out of it.
+;   - Spans. A node runs from its declaration line to the line of the brace that closes it, counting
+;     braces outside strings, character literals and comments. A declaration with no brace ends at
+;     the line whose code ends in `;` or `}`, or at its last indented continuation line.
+;   - Labels. Everything read directly is LABEL_EXACT. The scanner never emits DERIVED or SUGGESTED.
+;   - Edges, all EXACT, each with the line of its first use: CALLS to a declared fn when a body
+;     names it followed by `(`; USES to a declared const or an imported name (the last segment of a
+;     `use` path) when a body names it; CONSTRAINS from an invariant to a const it names; USES from
+;     the module to each `use` line. fn, test, invariant and bench bodies are read, and a fn's own
+;     name on its declaration is not a call. Duplicates are dropped.
+;   - Capacity. More than MAX_NODES nodes or MAX_EDGES edges keeps counting, so validate_graph
+;     answers ERR_TOO_MANY_NODES or ERR_TOO_MANY_EDGES; the graph is refused, never truncated.
+; Compared with the hand-read fixture tutorial_08_graph(): the 14 declaration nodes and the 9 EXACT
+; edges are identical (kind, label, name, span, endpoints, line). The fixture also holds what a
+; scanner must not invent: node 14 (std.testing, an UNKNOWN region inferred from call targets),
+; four DATA_FLOW edges and three TESTED_BY edges, all DERIVED. The test
+; tutorial_08_exports_the_fixture_exactly_except_what_is_derived states that boundary.
+; Not claimed here:
+;   - Names are matched as text, not resolved: a local variable or parameter named like a const
+;     or an import counts as a use of it, and one named like a fn counts only when followed by `(`.
+;   - Only the top level is read: no node for a statement, branch or parameter; nothing inside a
+;     struct or enum body; no `use` of a name from another spec is followed to that spec.
+;   - A `;` as the first non-blank character of a line is always a comment, and only `//` ends a
+;     line of code; there are no block comments. An opening brace that is not on the declaration
+;     line or an indented continuation line starts a node of its own. A block-form module is not
+;     descended as a unit: its declarations are read as top-level ones and its closing brace is
+;     skipped.
+;   - Capacity is the IR's: 192 nodes and 254 edges (measured, see spec_graph.t27), which holds about
+;     98 of 100 specs in specs/; the larger ones are refused.
+;   - The scanner takes the source as a byte slice; tutorial 08 is embedded below as a snapshot
+;     (sha256 c291e925d9dabef8b72b5a64aef153a2126c0b0b43d67bc08b1b2d7eaa98039a) and the test
+;     compares the snapshot, not the live file.
+; phi^2 + 1/phi^2 = 3 | TRINITY
+
+module t27f_spec_graph_export;
+
+use t27f::spec_graph::SpecGraph;
+use t27f::spec_graph::blank_graph;
+use t27f::spec_graph::with_node;
+use t27f::spec_graph::with_edge;
+use t27f::spec_graph::validate_graph;
+use t27f::spec_graph::tutorial_08_graph;
+use t27f::spec_graph::has_edge;
+use t27f::spec_graph::count_node_kind;
+use t27f::spec_graph::count_node_label;
+use t27f::spec_graph::count_edge_kind;
+use t27f::spec_graph::count_edge_label;
+use t27f::spec_graph::NODE_MODULE;
+use t27f::spec_graph::NODE_CONST;
+use t27f::spec_graph::NODE_FN;
+use t27f::spec_graph::NODE_TEST;
+use t27f::spec_graph::NODE_INVARIANT;
+use t27f::spec_graph::NODE_BENCH;
+use t27f::spec_graph::NODE_USE;
+use t27f::spec_graph::NODE_OPAQUE;
+use t27f::spec_graph::EDGE_CALLS;
+use t27f::spec_graph::EDGE_USES;
+use t27f::spec_graph::EDGE_TESTED_BY;
+use t27f::spec_graph::EDGE_CONSTRAINS;
+use t27f::spec_graph::EDGE_DATA_FLOW;
+use t27f::spec_graph::LABEL_EXACT;
+use t27f::spec_graph::LABEL_DERIVED;
+use t27f::spec_graph::LABEL_SUGGESTED;
+use t27f::spec_graph::LABEL_UNKNOWN;
+use t27f::spec_graph::MAX_NODES;
+use t27f::spec_graph::MAX_EDGES;
+use t27f::spec_graph::GRAPH_OK;
+use t27f::spec_graph::ERR_SPEC_PATH;
+use t27f::spec_graph::ERR_TOO_MANY_NODES;
+use t27f::spec_graph::ERR_TOO_MANY_EDGES;
+
+/// Node 0's name when the source has no module line.
+pub const NO_MODULE_NAME : str = "(no module)";
+
+/// Tutorial lesson 08 as a snapshot of specs/tutorial/08_modules_and_arrays.t27 at gHashTag/t27
+/// commit 2f395025f: 93 lines, sha256 c291e925d9dabef8b72b5a64aef153a2126c0b0b43d67bc08b1b2d7eaa98039a.
+pub const TUTORIAL_08_SRC : []const u8 = "// SPDX-License-Identifier: Apache-2.0\n; 08 -- Modules, visibility and arrays\n; Lesson 8, the last one. How a spec names itself, what it exposes, how it\n; pulls in another spec, and the array/index syntax used by every lookup table\n; in the corpus.\n; .\n; After this, open specs/numeric/gf16.t27 -- it is a real spec built entirely\n; out of what these eight lessons cover.\n; phi^2 + 1/phi^2 = 3 | TRINITY\n\nmodule tutorial-08-modules;\n\n// ============================================================================\n// use\n//\n//   use path::to::spec;\n//\n// Pulls in another spec. Paths are `::`-separated and rooted at the corpus,\n// not at the filesystem.\n// ============================================================================\n\nuse base::types;\n\n// ============================================================================\n// pub\n//\n// `pub` makes a name part of this spec's surface. Without it the name is\n// internal: usable here, invisible elsewhere. Default to leaving things\n// private -- a spec's exported surface is a promise to whoever imports it.\n// ============================================================================\n\npub const EXPORTED_WIDTH : u8 = 16;\n\n// No `pub`: an implementation detail of this module.\nconst INTERNAL_SCALE : u8 = 4;\n\npub fn scaled_width() u8 {\n    return EXPORTED_WIDTH / INTERNAL_SCALE;\n}\n\n// ============================================================================\n// Arrays\n//\n//   pub const NAME : [N]TYPE = [a, b, c];\n//\n// The length and the element type are part of the declared type, written out\n// like every other width in this language. Fixed tables like this are how the\n// numeric specs carry their constants.\n//\n// The Zig-style `[_]TYPE{ a, b, c }` parses, but it lowers to an untyped tuple:\n// indexing one with a runtime value does not compile. Write the type.\n// ============================================================================\n\npub const TRIT_VALUES : [3]i8 = [-1, 0, 1];\n\npub const POWERS_OF_TWO : [8]u16 = [1, 2, 4, 8, 16, 32, 64, 128];\n\npub const EXPONENT_BIAS : [4]u8 = [15, 31, 63, 127];\n\n// ============================================================================\n// Indexing\n//\n// `array[i]`, zero-based.\n// ============================================================================\n\npub fn power_of_two(index: u8) u16 {\n    return POWERS_OF_TWO[index];\n}\n\npub fn bias_for_width(index: u8) u8 {\n    return EXPONENT_BIAS[index];\n}\n\n// ============================================================================\n// Tests\n// ============================================================================\n\ntest \"the power table matches its own definition\" {\n    try std.testing.expectEqual(@as(u16, 1), power_of_two(0));\n    try std.testing.expectEqual(@as(u16, 128), power_of_two(7));\n}\n\ntest \"bias table carries the four standard widths\" {\n    try std.testing.expectEqual(@as(u8, 15), bias_for_width(0));\n    try std.testing.expectEqual(@as(u8, 127), bias_for_width(3));\n}\n\ntest \"a private constant is still usable inside its own module\" {\n    try std.testing.expectEqual(@as(u8, 4), scaled_width());\n}\n\ninvariant exported_width_is_a_power_of_two\n    assert EXPORTED_WIDTH == 16\n";
+
+/// One classified declaration line: node kind and label, the name's byte range, the byte range an
+/// identifier must equal to refer to the node (the whole name, or a `use` path's last segment),
+/// and whether it is a module line.
+pub struct Decl {
+    kind: u8,
+    label: u8,
+    na: usize,
+    nb: usize,
+    sa: usize,
+    sb: usize,
+    is_module: bool,
+}
+
+/// What reading one line of code leaves: the brace depth after it and its last code byte (0 when
+/// the line holds no code, only blanks or a comment).
+pub struct LineScan {
+    depth: u32,
+    tail: u8,
+}
+
+/// Per node: where its name matches and where its first line starts, as byte offsets into the
+/// source. Entries at or past node_count are not read.
+pub struct NameSpans {
+    ma: [192]usize,
+    mb: [192]usize,
+    ia: [192]usize,
+}
+
+pub fn ex_space(c: u8) -> bool {
+    return c == ' ' or c == '\t' or c == '\r';
+}
+
+/// A name byte: letter, digit or '_'.
+pub fn ex_word(c: u8) -> bool {
+    if (c >= '0' and c <= '9') { return true; }
+    if (c >= 'a' and c <= 'z') { return true; }
+    if (c >= 'A' and c <= 'Z') { return true; }
+    return c == '_';
+}
+
+pub fn skip_space(src: []const u8, i: usize, b: usize) -> usize {
+    var k : usize = i;
+    while (k < b and ex_space(src[k])) { k += 1; }
+    return k;
+}
+
+/// The end of the run of name bytes that starts at src[i], within the line that ends at b.
+pub fn word_end(src: []const u8, i: usize, b: usize) -> usize {
+    var k : usize = i;
+    while (k < b and ex_word(src[k])) { k += 1; }
+    return k;
+}
+
+/// The end of the token that starts at src[i]: up to a blank, `;` or `{`.
+pub fn token_end(src: []const u8, i: usize, b: usize) -> usize {
+    var k : usize = i;
+    while (k < b and ex_space(src[k]) == false and src[k] != ';' and src[k] != '{') { k += 1; }
+    return k;
+}
+
+/// The index of the newline that ends the line starting at a, or the length of src.
+pub fn line_end_at(src: []const u8, a: usize) -> usize {
+    var k : usize = a;
+    while (k < src.len and src[k] != '\n') { k += 1; }
+    return k;
+}
+
+/// The number of lines of src: its newlines, plus one for a last line with no newline.
+pub fn count_lines(src: []const u8) -> u32 {
+    var c : u32 = 0;
+    var k : usize = 0;
+    while (k < src.len) {
+        if (src[k] == '\n') { c += 1; }
+        k += 1;
+    }
+    if (src.len > 0 and src[src.len - 1] != '\n') { c += 1; }
+    return c;
+}
+
+/// If a string or character literal starts at src[i], the index just past it (a string that does
+/// not close stops at the line end b); otherwise i.
+pub fn skip_lit(src: []const u8, b: usize, i: usize) -> usize {
+    const c : u8 = src[i];
+    if (c == '"') {
+        var j : usize = i + 1;
+        while (j < b and src[j] != '"') {
+            if (src[j] == '\\') { j += 1; }
+            j += 1;
+        }
+        if (j >= b) { return b; }
+        return j + 1;
+    }
+    if (c == '\'') {
+        if (i + 2 < b and src[i + 1] != '\\' and src[i + 2] == '\'') { return i + 3; }
+        if (i + 3 < b and src[i + 1] == '\\' and src[i + 3] == '\'') { return i + 4; }
+    }
+    return i;
+}
+
+/// The index of the quote that closes the string whose first byte is src[i], or b.
+pub fn closing_quote(src: []const u8, i: usize, b: usize) -> usize {
+    var j : usize = i;
+    while (j < b and src[j] != '"') {
+        if (src[j] == '\\') { j += 1; }
+        j += 1;
+    }
+    if (j > b) { return b; }
+    return j;
+}
+
+/// Read the line src[a..b] (b is the newline or the end) starting at brace depth `depth_in`. A
+/// line whose first non-blank byte is `;` is a comment. Braces inside literals and after `//` do
+/// not count, and a `}` at depth 0 is dropped.
+pub fn scan_line(src: []const u8, a: usize, b: usize, depth_in: u32) -> LineScan {
+    var depth : u32 = depth_in;
+    var tail : u8 = 0;
+    var i : usize = skip_space(src, a, b);
+    if (i < b and src[i] == ';') { return LineScan { depth: depth, tail: 0 }; }
+    var stop : bool = false;
+    while (i < b and stop == false) {
+        const c : u8 = src[i];
+        if (c == '/' and i + 1 < b and src[i + 1] == '/') {
+            stop = true;
+        } else {
+            const j : usize = skip_lit(src, b, i);
+            if (j != i) {
+                tail = '"';
+                i = j;
+            } else {
+                if (c == '{') { depth += 1; }
+                if (c == '}') {
+                    if (depth > 0) { depth -= 1; }
+                }
+                if (ex_space(c) == false) { tail = c; }
+                i += 1;
+            }
+        }
+    }
+    return LineScan { depth: depth, tail: tail };
+}
+
+/// Keywords that declare something the IR has no finer kind for.
+pub fn opaque_keyword(kw: str) -> bool {
+    return kw == "struct" or kw == "enum" or kw == "var" or kw == "spec" or kw == "endmodule";
+}
+
+/// Classify the declaration line src[a..b] (it holds code). The node name is src[na .. nb].
+pub fn classify(src: []const u8, a: usize, b: usize) -> Decl {
+    const i0 : usize = skip_space(src, a, b);
+    const j0 : usize = word_end(src, i0, b);
+    var i : usize = i0;
+    var j : usize = j0;
+    var kw : str = src[i0 .. j0];
+    if (kw == "pub") {
+        const i1 : usize = skip_space(src, j0, b);
+        const j1 : usize = word_end(src, i1, b);
+        if (j1 > i1) {
+            i = i1;
+            j = j1;
+            kw = src[i1 .. j1];
+        }
+    }
+    // the fallback: the head word, or the one byte that is not a word, as an UNKNOWN opaque node
+    var d : Decl = Decl { kind: NODE_OPAQUE, label: LABEL_UNKNOWN, na: i, nb: j, sa: i, sb: j, is_module: false };
+    if (j == i) {
+        d.nb = i + 1;
+        d.sb = i + 1;
+        return d;
+    }
+    const k : usize = skip_space(src, j, b);
+    if (kw == "module") {
+        const e : usize = token_end(src, k, b);
+        if (e == k) { return d; }
+        return Decl { kind: NODE_MODULE, label: LABEL_EXACT, na: k, nb: e, sa: k, sb: e, is_module: true };
+    }
+    if (kw == "use") {
+        const e : usize = token_end(src, k, b);
+        if (e == k) { return d; }
+        var s : usize = e;
+        while (s > k and src[s - 1] != ':') { s -= 1; }
+        return Decl { kind: NODE_USE, label: LABEL_EXACT, na: k, nb: e, sa: s, sb: e, is_module: false };
+    }
+    if (kw == "const" or kw == "fn") {
+        const e : usize = word_end(src, k, b);
+        if (e == k) { return d; }
+        var kind : u8 = NODE_CONST;
+        if (kw == "fn") { kind = NODE_FN; }
+        return Decl { kind: kind, label: LABEL_EXACT, na: k, nb: e, sa: k, sb: e, is_module: false };
+    }
+    if (kw == "test" or kw == "invariant" or kw == "bench") {
+        var kind : u8 = NODE_TEST;
+        if (kw == "invariant") { kind = NODE_INVARIANT; }
+        if (kw == "bench") { kind = NODE_BENCH; }
+        if (k < b and src[k] == '"') {
+            const q : usize = closing_quote(src, k + 1, b);
+            if (q == k + 1) { return d; }
+            return Decl { kind: kind, label: LABEL_EXACT, na: k + 1, nb: q, sa: k + 1, sb: q, is_module: false };
+        }
+        const e : usize = word_end(src, k, b);
+        if (e == k) { return d; }
+        return Decl { kind: kind, label: LABEL_EXACT, na: k, nb: e, sa: k, sb: e, is_module: false };
+    }
+    if (opaque_keyword(kw)) {
+        const e : usize = word_end(src, k, b);
+        if (e == k) {
+            return Decl { kind: NODE_OPAQUE, label: LABEL_EXACT, na: i, nb: j, sa: i, sb: j, is_module: false };
+        }
+        return Decl { kind: NODE_OPAQUE, label: LABEL_EXACT, na: k, nb: e, sa: k, sb: e, is_module: false };
+    }
+    return d;
+}
+
+/// Is there already an edge of this kind between these nodes? Reads only stored edges, so it is
+/// safe on a graph that has gone past capacity.
+pub fn edge_seen(g: SpecGraph, ek: u8, f: u32, t: u32) -> bool {
+    var j : u32 = 0;
+    while (j < g.edge_count and j < MAX_EDGES) {
+        const m : usize = j as usize;
+        if (g.edge_kind[m] == ek and (g.edge_from[m] as u32) == f and (g.edge_to[m] as u32) == t) { return true; }
+        j += 1;
+    }
+    return false;
+}
+
+/// The edges one name token makes: it is src[i .. e], read in node k on `line`, whose source line
+/// ends at b. The first declared fn, const or import it equals is the target; nothing else is.
+pub fn token_edges(g0: SpecGraph, src: []const u8, sp: NameSpans, k: u32, i: usize, e: usize, b: usize, line: u32) -> SpecGraph {
+    var g : SpecGraph = g0;
+    const tok : str = src[i .. e];
+    const ks : usize = k as usize;
+    var t : u32 = 1;
+    var found : bool = false;
+    while (t < g.node_count and found == false) {
+        const ts : usize = t as usize;
+        const tk : u8 = g.node_kind[ts];
+        if (tk == NODE_FN or tk == NODE_CONST or tk == NODE_USE) {
+            const cand : str = src[sp.ma[ts] .. sp.mb[ts]];
+            if (tok == cand) {
+                found = true;
+                const own : bool = t == k and i >= sp.ma[ks] and i < sp.mb[ks];
+                if (own == false) {
+                    var ek : u8 = EDGE_USES;
+                    var emit : bool = true;
+                    if (tk == NODE_FN) {
+                        ek = EDGE_CALLS;
+                        const p : usize = skip_space(src, e, b);
+                        emit = p < b and src[p] == '(';
+                    }
+                    if (tk == NODE_CONST and g.node_kind[ks] == NODE_INVARIANT) { ek = EDGE_CONSTRAINS; }
+                    if (emit and edge_seen(g, ek, k, t) == false) {
+                        g = with_edge(g, ek, k as u8, t as u8, LABEL_EXACT, line);
+                    }
+                }
+            }
+        }
+        t += 1;
+    }
+    return g;
+}
+
+/// The edges read from one source line src[p..b] of node k: every name token outside strings,
+/// character literals and comments.
+pub fn line_edges(g0: SpecGraph, src: []const u8, sp: NameSpans, k: u32, p: usize, b: usize, line: u32) -> SpecGraph {
+    var g : SpecGraph = g0;
+    var i : usize = skip_space(src, p, b);
+    if (i < b and src[i] == ';') { return g; }
+    while (i < b) {
+        const c : u8 = src[i];
+        if (c == '/' and i + 1 < b and src[i + 1] == '/') {
+            i = b;
+        } else {
+            const j : usize = skip_lit(src, b, i);
+            if (j != i) {
+                i = j;
+            } else {
+                if (ex_word(c)) {
+                    const e : usize = word_end(src, i, b);
+                    if (c < '0' or c > '9') { g = token_edges(g, src, sp, k, i, e, b, line); }
+                    i = e;
+                } else {
+                    i += 1;
+                }
+            }
+        }
+    }
+    return g;
+}
+
+/// The edges read from the whole body of node k, line by line from its first to its last line.
+pub fn body_edges(g0: SpecGraph, src: []const u8, sp: NameSpans, k: u32) -> SpecGraph {
+    var g : SpecGraph = g0;
+    const ks : usize = k as usize;
+    const last : u32 = g.line_end[ks];
+    var line : u32 = g.line_start[ks];
+    var p : usize = sp.ia[ks];
+    while (line <= last and p < src.len) {
+        const b : usize = line_end_at(src, p);
+        g = line_edges(g, src, sp, k, p, b, line);
+        p = b + 1;
+        line += 1;
+    }
+    return g;
+}
+
+/// All edges: the module's USES of each `use` line, then the edges read from each fn, test,
+/// invariant and bench body in node order. Called only when every node is stored.
+pub fn read_edges(g0: SpecGraph, src: []const u8, sp: NameSpans) -> SpecGraph {
+    var g : SpecGraph = g0;
+    var k : u32 = 1;
+    if (g.node_label[0] == LABEL_EXACT) {
+        while (k < g.node_count) {
+            if (g.node_kind[k as usize] == NODE_USE) {
+                g = with_edge(g, EDGE_USES, 0, k as u8, LABEL_EXACT, g.line_start[k as usize]);
+            }
+            k += 1;
+        }
+    }
+    k = 1;
+    while (k < g.node_count) {
+        const kind : u8 = g.node_kind[k as usize];
+        if (kind == NODE_FN or kind == NODE_TEST or kind == NODE_INVARIANT or kind == NODE_BENCH) {
+            g = body_edges(g, src, sp, k);
+        }
+        k += 1;
+    }
+    return g;
+}
+
+/// The graph of the spec whose source is `src` and whose path is `path`. Pass 1 reads the nodes
+/// and spans line by line; pass 2 reads the edges. The result is always a SpecGraph;
+/// validate_graph says whether it is a valid one (empty source, no path, more than MAX_NODES nodes
+/// or MAX_EDGES edges are refused there).
+pub fn export_graph(path: str, src: []const u8) -> SpecGraph {
+    const n : usize = src.len;
+    var g : SpecGraph = blank_graph();
+    g.spec_path = path;
+    g.line_count = count_lines(src);
+    g = with_node(g, NODE_MODULE, LABEL_UNKNOWN, NO_MODULE_NAME, 1, g.line_count);
+    var sp : NameSpans = NameSpans { ma: [0; 192], mb: [0; 192], ia: [0; 192] };
+    var pos : usize = 0;
+    var line : u32 = 0;
+    var depth : u32 = 0;
+    var live : bool = false;
+    var closed : bool = true;
+    var cur : u32 = 0;
+    var mod_seen : bool = false;
+    while (pos < n) {
+        const b : usize = line_end_at(src, pos);
+        line += 1;
+        const sc : LineScan = scan_line(src, pos, b, depth);
+        if (depth > 0) {
+            // inside a body: this line belongs to the open node, up to the brace that closes it
+            if (live and cur < MAX_NODES) { g.line_end[cur as usize] = line; }
+            depth = sc.depth;
+            if (depth == 0) { closed = true; }
+        } else {
+            if (sc.tail != 0) {
+                const indented : bool = src[pos] == ' ' or src[pos] == '\t';
+                const first : usize = skip_space(src, pos, b);
+                if (live and closed == false and indented) {
+                    // a continuation line of a declaration that has no brace yet
+                    if (cur < MAX_NODES) { g.line_end[cur as usize] = line; }
+                    depth = sc.depth;
+                    if (depth == 0 and (sc.tail == ';' or sc.tail == '}')) { closed = true; }
+                } else {
+                    if (src[first] == '}') {
+                        // a stray closing brace, or the end of a block-form module
+                        depth = 0;
+                    } else {
+                        const d : Decl = classify(src, pos, b);
+                        if (d.is_module and mod_seen == false) {
+                            mod_seen = true;
+                            g.node_name[0] = src[d.na .. d.nb];
+                            g.node_label[0] = LABEL_EXACT;
+                            live = false;
+                            depth = 0;
+                        } else {
+                            var kind : u8 = d.kind;
+                            if (kind == NODE_MODULE) { kind = NODE_OPAQUE; }
+                            cur = g.node_count;
+                            g = with_node(g, kind, d.label, src[d.na .. d.nb], line, line);
+                            if (cur < MAX_NODES) {
+                                sp.ma[cur as usize] = d.sa;
+                                sp.mb[cur as usize] = d.sb;
+                                sp.ia[cur as usize] = pos;
+                            }
+                            live = true;
+                            depth = sc.depth;
+                            closed = depth == 0 and (sc.tail == ';' or sc.tail == '}');
+                        }
+                    }
+                }
+            }
+        }
+        pos = b + 1;
+    }
+    if (g.node_count <= MAX_NODES) { g = read_edges(g, src, sp); }
+    return g;
+}
+
+/// validate_graph of the export: GRAPH_OK, or the first rule the exported graph breaks.
+pub fn export_verdict(path: str, src: []const u8) -> u8 {
+    return validate_graph(export_graph(path, src));
+}
+
+/// Do node i of e and node i of f agree on kind, label, name and span? Both must hold node i.
+pub fn node_matches(e: SpecGraph, f: SpecGraph, i: u32) -> bool {
+    const k : usize = i as usize;
+    if (e.node_kind[k] != f.node_kind[k]) { return false; }
+    if (e.node_label[k] != f.node_label[k]) { return false; }
+    const en : str = e.node_name[k];
+    const fn_ : str = f.node_name[k];
+    if ((en == fn_) == false) { return false; }
+    if (e.line_start[k] != f.line_start[k]) { return false; }
+    return e.line_end[k] == f.line_end[k];
+}
+
+/// How many nodes, by index, the two graphs share.
+pub fn nodes_in_common(e: SpecGraph, f: SpecGraph) -> u32 {
+    var c : u32 = 0;
+    var i : u32 = 0;
+    while (i < e.node_count and i < f.node_count and i < MAX_NODES) {
+        if (node_matches(e, f, i)) { c += 1; }
+        i += 1;
+    }
+    return c;
+}
+
+/// Does g hold an edge with exactly these kind, endpoints, label and line?
+pub fn edge_in(g: SpecGraph, ek: u8, f: u8, t: u8, l: u8, line: u32) -> bool {
+    var j : u32 = 0;
+    while (j < g.edge_count and j < MAX_EDGES) {
+        const m : usize = j as usize;
+        if (g.edge_kind[m] == ek and g.edge_from[m] == f and g.edge_to[m] == t and g.edge_label[m] == l and g.edge_line[m] == line) { return true; }
+        j += 1;
+    }
+    return false;
+}
+
+/// How many edges of a are also edges of b, compared on every field.
+pub fn edges_shared(a: SpecGraph, b: SpecGraph) -> u32 {
+    var c : u32 = 0;
+    var j : u32 = 0;
+    while (j < a.edge_count and j < MAX_EDGES) {
+        const m : usize = j as usize;
+        if (edge_in(b, a.edge_kind[m], a.edge_from[m], a.edge_to[m], a.edge_label[m], a.edge_line[m])) { c += 1; }
+        j += 1;
+    }
+    return c;
+}
+
+test line_counts_follow_the_newlines {
+    assert count_lines("") == 0;
+    assert count_lines("a") == 1;
+    assert count_lines("a\n") == 1;
+    assert count_lines("a\nb") == 2;
+    assert count_lines("a\n\n") == 2;
+    assert count_lines("\n") == 1;
+    // negative controls: not one more for a trailing newline, not one fewer for a missing one
+    assert count_lines("a\n") != 2;
+    assert count_lines("a\nb") != 1;
+    assert count_lines(TUTORIAL_08_SRC) == 93;
+}
+
+test the_module_line_names_node_zero {
+    const g : SpecGraph = export_graph("specs/x.t27", "module m_one;\n");
+    assert g.node_count == 1;
+    assert g.node_kind[0] == NODE_MODULE;
+    assert g.node_label[0] == LABEL_EXACT;
+    assert g.node_name[0] == "m_one";
+    assert g.line_start[0] == 1;
+    assert g.line_end[0] == 1;
+    assert g.spec_path == "specs/x.t27";
+    assert validate_graph(g) == GRAPH_OK;
+    // a hyphenated module name is read whole, as tutorial 08 writes it
+    assert export_graph("specs/x.t27", "module a-b-c;\n").node_name[0] == "a-b-c";
+    // negative control: no module line means an UNKNOWN node 0, never an invented name
+    const h : SpecGraph = export_graph("specs/x.t27", "const A : u8 = 1;\n");
+    assert h.node_label[0] == LABEL_UNKNOWN;
+    assert h.node_name[0] == NO_MODULE_NAME;
+    assert (h.node_name[0] == "m_one") == false;
+    assert h.node_count == 2;
+    assert validate_graph(h) == GRAPH_OK;
+}
+
+test every_declaration_kind_reads_as_its_node_kind {
+    const src : []const u8 = "module m;\nuse p::q::Thing;\npub const A : u8 = 1;\nconst B : u8 = 2;\npub fn f() u8 { return A; }\nfn g() u8 { return B; }\ntest \"t one\" { assert f() == 1; }\ninvariant inv_one assert A == 1;\nbench bench_one { f(); }\n";
+    const g : SpecGraph = export_graph("specs/x.t27", src);
+    assert validate_graph(g) == GRAPH_OK;
+    assert g.node_count == 9;
+    assert g.line_count == 9;
+    assert g.node_kind[0] == NODE_MODULE;
+    assert g.node_kind[1] == NODE_USE;
+    assert g.node_kind[2] == NODE_CONST;
+    assert g.node_kind[3] == NODE_CONST;
+    assert g.node_kind[4] == NODE_FN;
+    assert g.node_kind[5] == NODE_FN;
+    assert g.node_kind[6] == NODE_TEST;
+    assert g.node_kind[7] == NODE_INVARIANT;
+    assert g.node_kind[8] == NODE_BENCH;
+    assert g.node_name[1] == "p::q::Thing";
+    assert g.node_name[2] == "A";
+    assert g.node_name[4] == "f";
+    assert g.node_name[6] == "t one";
+    assert g.node_name[7] == "inv_one";
+    assert g.node_name[8] == "bench_one";
+    // each is on its own line; a single-line declaration has start == end
+    assert g.line_start[1] == 2 and g.line_end[1] == 2;
+    assert g.line_start[4] == 5 and g.line_end[4] == 5;
+    assert g.line_start[6] == 7 and g.line_end[6] == 7;
+    assert g.line_start[8] == 9 and g.line_end[8] == 9;
+    // `pub` changes nothing about the kind: A is pub, B is not, both are consts
+    assert count_node_kind(g, NODE_CONST) == 2;
+    assert count_node_kind(g, NODE_FN) == 2;
+    // everything read directly is EXACT; negative control: nothing is UNKNOWN here
+    assert count_node_label(g, LABEL_EXACT) == 9;
+    assert count_node_label(g, LABEL_UNKNOWN) == 0;
+    // the six edges this source holds
+    assert g.edge_count == 6;
+    assert has_edge(g, EDGE_USES, 0, 1);
+    assert has_edge(g, EDGE_USES, 4, 2);
+    assert has_edge(g, EDGE_USES, 5, 3);
+    assert has_edge(g, EDGE_CALLS, 6, 4);
+    assert has_edge(g, EDGE_CONSTRAINS, 7, 2);
+    assert has_edge(g, EDGE_CALLS, 8, 4);
+    // negative controls: the invariant constrains A, it does not merely use it; nothing reads backwards
+    assert has_edge(g, EDGE_USES, 7, 2) == false;
+    assert has_edge(g, EDGE_CALLS, 4, 6) == false;
+    assert has_edge(g, EDGE_USES, 5, 2) == false;
+}
+
+test other_declarations_are_opaque {
+    const src : []const u8 = "module m;\nstruct S {\n    x: u8,\n}\nenum E { A, B }\nwhat is this;\n";
+    const g : SpecGraph = export_graph("specs/x.t27", src);
+    assert validate_graph(g) == GRAPH_OK;
+    assert g.node_count == 4;
+    // a known keyword is read: OPAQUE and EXACT, named, with its brace-closed span
+    assert g.node_kind[1] == NODE_OPAQUE;
+    assert g.node_label[1] == LABEL_EXACT;
+    assert g.node_name[1] == "S";
+    assert g.line_start[1] == 2 and g.line_end[1] == 4;
+    assert g.node_kind[2] == NODE_OPAQUE;
+    assert g.node_label[2] == LABEL_EXACT;
+    assert g.node_name[2] == "E";
+    assert g.line_start[2] == 5 and g.line_end[2] == 5;
+    // negative control: a word the scanner does not know is UNKNOWN, not guessed at
+    assert g.node_kind[3] == NODE_OPAQUE;
+    assert g.node_label[3] == LABEL_UNKNOWN;
+    assert g.node_name[3] == "what";
+    assert g.node_label[3] != LABEL_EXACT;
+    assert count_node_label(g, LABEL_UNKNOWN) == 1;
+}
+
+test a_declaration_with_no_readable_name_is_unknown {
+    const nameless_fn : SpecGraph = export_graph("specs/x.t27", "module m;\nfn () u8 { return 1; }\n");
+    assert validate_graph(nameless_fn) == GRAPH_OK;
+    assert nameless_fn.node_kind[1] == NODE_OPAQUE;
+    assert nameless_fn.node_label[1] == LABEL_UNKNOWN;
+    assert nameless_fn.node_name[1] == "fn";
+    const nameless_const : SpecGraph = export_graph("specs/x.t27", "module m;\nconst : u8 = 1;\n");
+    assert nameless_const.node_kind[1] == NODE_OPAQUE;
+    assert nameless_const.node_label[1] == LABEL_UNKNOWN;
+    const nameless_test : SpecGraph = export_graph("specs/x.t27", "module m;\ntest {\n}\n");
+    assert nameless_test.node_label[1] == LABEL_UNKNOWN;
+    const empty_title : SpecGraph = export_graph("specs/x.t27", "module m;\ntest \"\" { }\n");
+    assert empty_title.node_label[1] == LABEL_UNKNOWN;
+    const pub_alone : SpecGraph = export_graph("specs/x.t27", "module m;\npub\n");
+    assert pub_alone.node_label[1] == LABEL_UNKNOWN;
+    assert pub_alone.node_name[1] == "pub";
+    // positive controls: with a name, the same lines are fn, const and test nodes
+    assert export_graph("specs/x.t27", "module m;\nfn a() u8 { return 1; }\n").node_kind[1] == NODE_FN;
+    assert export_graph("specs/x.t27", "module m;\nconst A : u8 = 1;\n").node_kind[1] == NODE_CONST;
+    assert export_graph("specs/x.t27", "module m;\ntest \"t\" { }\n").node_kind[1] == NODE_TEST;
+}
+
+test a_span_runs_to_the_matching_closing_brace {
+    const src : []const u8 = "module m;\nfn f() u8 {\n    if (x) {\n        y();\n    }\n    return 1;\n}\nconst C : u8 = 1;\n";
+    const g : SpecGraph = export_graph("specs/x.t27", src);
+    assert validate_graph(g) == GRAPH_OK;
+    assert g.node_count == 3;
+    // nested braces: the fn closes on line 7, not on the inner brace at line 5
+    assert g.line_start[1] == 2;
+    assert g.line_end[1] == 7;
+    assert g.line_end[1] != 5;
+    // the next declaration starts after it, on its own line
+    assert g.node_kind[2] == NODE_CONST;
+    assert g.line_start[2] == 8 and g.line_end[2] == 8;
+    // a body that never closes runs to the end of the file, and the graph is still valid
+    const open_body : SpecGraph = export_graph("specs/x.t27", "module m;\nfn f() u8 {\n    return 1;\n");
+    assert open_body.line_end[1] == 3;
+    assert validate_graph(open_body) == GRAPH_OK;
+    // a closing brace on the declaration line gives a one-line span; negative control: it is not 2 lines
+    const one_line : SpecGraph = export_graph("specs/x.t27", "module m;\nfn f() u8 { return 1; }\nfn g() u8 { return 2; }\n");
+    assert one_line.line_start[1] == 2 and one_line.line_end[1] == 2;
+    assert one_line.line_start[2] == 3 and one_line.line_end[2] == 3;
+}
+
+test braces_in_strings_comments_and_characters_do_not_count {
+    // a closing brace in a string, a line comment, a character literal and a `;` comment line:
+    // none of them closes the fn, which still runs to its real brace on line 8
+    const closing : []const u8 = "module m;\nfn f() u8 {\n    let s = \"}\";\n    // }\n    let c = '}';\n    ; }\n    return 1;\n}\nconst C : u8 = 1;\n";
+    const g : SpecGraph = export_graph("specs/x.t27", closing);
+    assert validate_graph(g) == GRAPH_OK;
+    assert g.node_count == 3;
+    assert g.line_start[1] == 2 and g.line_end[1] == 8;
+    assert g.line_start[2] == 9 and g.line_end[2] == 9;
+    // an opening brace in the same places does not open anything: the fn closes on line 8
+    const opening : []const u8 = "module m;\nfn f() u8 {\n    let s = \"{\";\n    // {\n    let c = '{';\n    ; {\n    return 1;\n}\nconst C : u8 = 1;\n";
+    const h : SpecGraph = export_graph("specs/x.t27", opening);
+    assert h.node_count == 3;
+    assert h.line_end[1] == 8;
+    assert h.line_start[2] == 9;
+    // an escaped quote does not end the string, so the brace after it is still inside it
+    const escaped : []const u8 = "module m;\nfn f() u8 {\n    let s = \"a\\\"}\";\n}\nconst C : u8 = 1;\n";
+    const k : SpecGraph = export_graph("specs/x.t27", escaped);
+    assert k.node_count == 3;
+    assert k.line_end[1] == 4;
+    assert k.line_start[2] == 5;
+    // negative control: a real brace outside any literal does count
+    const real : []const u8 = "module m;\nfn f() u8 {\n    let s = 1;\n}\nconst C : u8 = 1;\n";
+    assert export_graph("specs/x.t27", real).line_end[1] == 4;
+    assert export_graph("specs/x.t27", real).line_end[1] != 3;
+}
+
+test a_declaration_with_no_brace_ends_at_its_last_continuation_line {
+    const src : []const u8 = "module m;\ninvariant big_one\n    assert A == 1\n    and B == 2\nconst A : u8 =\n    1;\nconst B : u8 = 2;\ninvariant after\nassert 1 == 1\n";
+    const g : SpecGraph = export_graph("specs/x.t27", src);
+    assert validate_graph(g) == GRAPH_OK;
+    assert g.node_count == 6;
+    // the invariant runs over its two indented lines
+    assert g.node_kind[1] == NODE_INVARIANT;
+    assert g.line_start[1] == 2 and g.line_end[1] == 4;
+    // a const split over two lines ends at the line with its `;`
+    assert g.node_kind[2] == NODE_CONST;
+    assert g.line_start[2] == 5 and g.line_end[2] == 6;
+    assert g.line_start[3] == 7 and g.line_end[3] == 7;
+    // negative control: an unindented line is not a continuation; it starts a node of its own
+    assert g.node_kind[4] == NODE_INVARIANT;
+    assert g.line_end[4] == 8;
+    assert g.node_kind[5] == NODE_OPAQUE;
+    assert g.node_label[5] == LABEL_UNKNOWN;
+    assert g.line_start[5] == 9;
+    // the continuation lines name A and B, so the invariant constrains both, on the lines it names them
+    assert g.edge_count == 2;
+    assert edge_in(g, EDGE_CONSTRAINS, 1, 2, LABEL_EXACT, 3);
+    assert edge_in(g, EDGE_CONSTRAINS, 1, 3, LABEL_EXACT, 4);
+}
+
+test blank_lines_and_comments_between_declarations_belong_to_none {
+    const src : []const u8 = "// header\n; prose\n\nmodule m;\n\n// about A\nconst A : u8 = 1;\n\n; about f\nfn f() u8 {\n\n    return A;\n\n}\n\n// trailing\n";
+    const g : SpecGraph = export_graph("specs/x.t27", src);
+    assert validate_graph(g) == GRAPH_OK;
+    assert g.node_count == 3;
+    assert g.line_count == 16;
+    assert g.line_start[1] == 7 and g.line_end[1] == 7;
+    // the fn runs from its declaration to its closing brace, blank lines included, and not into the trailing comment
+    assert g.line_start[2] == 10 and g.line_end[2] == 14;
+    assert g.line_end[2] != 16;
+    assert has_edge(g, EDGE_USES, 2, 1);
+}
+
+test a_block_form_module_still_exports_its_declarations {
+    const src : []const u8 = "module m {\n    const A : u8 = 1;\n    fn f() u8 { return A; }\n}\n";
+    const g : SpecGraph = export_graph("specs/x.t27", src);
+    assert validate_graph(g) == GRAPH_OK;
+    assert g.node_name[0] == "m";
+    assert g.node_label[0] == LABEL_EXACT;
+    assert g.node_count == 3;
+    assert g.node_kind[1] == NODE_CONST;
+    assert g.line_start[1] == 2;
+    assert g.node_kind[2] == NODE_FN;
+    assert has_edge(g, EDGE_USES, 2, 1);
+    // negative control: the module's closing brace is not a node
+    assert g.node_count != 4;
+    assert g.line_end[2] == 3;
+}
+
+test a_second_module_line_is_opaque_not_a_second_module {
+    const g : SpecGraph = export_graph("specs/x.t27", "module a;\nmodule b;\n");
+    assert validate_graph(g) == GRAPH_OK;
+    assert count_node_kind(g, NODE_MODULE) == 1;
+    assert g.node_name[0] == "a";
+    assert g.node_kind[1] == NODE_OPAQUE;
+    assert g.node_label[1] == LABEL_EXACT;
+    assert g.node_name[1] == "b";
+    assert (g.node_name[0] == "b") == false;
+}
+
+test edges_follow_the_direction_rules_and_carry_their_line {
+    const src : []const u8 = "module m;\nuse x::imp;\nconst K : u8 = 1;\nfn leaf() u8 { return K; }\nfn mid() u8 {\n    let a = leaf();\n    let b = leaf();\n    return a + b + imp();\n}\nfn rec(n: u8) u8 { return rec(n); }\nfn plain() u8 { let v = leaf; return v; }\nfn quiet() u8 { let s = \"leaf() K imp()\"; return 0; } // leaf() K\n";
+    const g : SpecGraph = export_graph("specs/x.t27", src);
+    assert validate_graph(g) == GRAPH_OK;
+    assert g.node_count == 8;
+    assert g.edge_count == 5;
+    // the module uses its import, on the `use` line
+    assert edge_in(g, EDGE_USES, 0, 1, LABEL_EXACT, 2);
+    // a fn naming a const uses it, on the line of the use
+    assert edge_in(g, EDGE_USES, 3, 2, LABEL_EXACT, 4);
+    // a call is a CALLS edge on the line of the first call; the second call, line 7, adds nothing
+    assert edge_in(g, EDGE_CALLS, 4, 3, LABEL_EXACT, 6);
+    assert edge_in(g, EDGE_CALLS, 4, 3, LABEL_EXACT, 7) == false;
+    assert count_edge_kind(g, EDGE_CALLS) == 2;
+    // an imported name is the last segment of its `use` path
+    assert edge_in(g, EDGE_USES, 4, 1, LABEL_EXACT, 8);
+    // recursion is a call; the fn's own name on its declaration is not
+    assert edge_in(g, EDGE_CALLS, 5, 5, LABEL_EXACT, 10);
+    assert g.edge_line[4] == 10;
+    // negative controls: a name with no `(` is not a call, and a name inside a string or after
+    // `//` is not a use, so plain and quiet have no edge out
+    assert has_edge(g, EDGE_CALLS, 6, 3) == false;
+    assert has_edge(g, EDGE_USES, 7, 2) == false;
+    assert has_edge(g, EDGE_USES, 7, 1) == false;
+    assert has_edge(g, EDGE_CALLS, 7, 3) == false;
+    // no const reads back into a fn, no fn is used (only called)
+    assert has_edge(g, EDGE_USES, 4, 3) == false;
+    assert has_edge(g, EDGE_CALLS, 3, 3) == false;
+}
+
+test a_test_that_calls_a_fn_calls_it_and_the_scanner_does_not_read_it_backwards {
+    const src : []const u8 = "module m;\nfn f() u8 { return 1; }\ntest \"calls f\" {\n    assert f() == 1;\n    assert f() == 1;\n}\n";
+    const g : SpecGraph = export_graph("specs/x.t27", src);
+    assert validate_graph(g) == GRAPH_OK;
+    assert g.edge_count == 1;
+    assert edge_in(g, EDGE_CALLS, 2, 1, LABEL_EXACT, 4);
+    // TESTED_BY is the call read backwards, so it is DERIVED by definition and not the scanner's
+    assert count_edge_kind(g, EDGE_TESTED_BY) == 0;
+    assert has_edge(g, EDGE_TESTED_BY, 1, 2) == false;
+}
+
+test a_name_in_a_non_body_position_makes_no_edge {
+    // const and use lines are not bodies; the module's only edge is its USES of the import
+    const g : SpecGraph = export_graph("specs/x.t27", "module m;\nuse a::K;\nconst K : u8 = 1;\nconst L : u8 = K;\n");
+    assert validate_graph(g) == GRAPH_OK;
+    assert g.edge_count == 1;
+    assert has_edge(g, EDGE_USES, 0, 1);
+    // negative control: the same const used from a fn body is an edge
+    const h : SpecGraph = export_graph("specs/x.t27", "module m;\nconst K : u8 = 1;\nfn f() u8 { return K; }\n");
+    assert has_edge(h, EDGE_USES, 2, 1);
+    // an unknown module has no edge out: UNKNOWN endpoints are refused by the IR
+    const n : SpecGraph = export_graph("specs/x.t27", "use a::K;\n");
+    assert n.edge_count == 0;
+    assert validate_graph(n) == GRAPH_OK;
+    const y : SpecGraph = export_graph("specs/x.t27", "module m;\nuse a::K;\n");
+    assert y.edge_count == 1;
+}
+
+test the_scanner_never_emits_derived_or_suggested {
+    const g : SpecGraph = export_graph("specs/tutorial/08_modules_and_arrays.t27", TUTORIAL_08_SRC);
+    assert count_node_label(g, LABEL_DERIVED) == 0;
+    assert count_node_label(g, LABEL_SUGGESTED) == 0;
+    assert count_edge_label(g, LABEL_DERIVED) == 0;
+    assert count_edge_label(g, LABEL_SUGGESTED) == 0;
+    assert count_edge_kind(g, EDGE_TESTED_BY) == 0;
+    assert count_edge_kind(g, EDGE_DATA_FLOW) == 0;
+    // negative control: the check can fail, because the hand-read fixture does hold such labels
+    const f : SpecGraph = tutorial_08_graph();
+    assert count_edge_label(f, LABEL_DERIVED) == 7;
+    assert count_edge_kind(f, EDGE_TESTED_BY) == 3;
+}
+
+test more_nodes_than_the_ir_holds_is_refused_not_truncated {
+    // module + 191 consts = 192 nodes: exactly at capacity, valid
+    const at_cap : []const u8 = "module m;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\n";
+    const a : SpecGraph = export_graph("specs/x.t27", at_cap);
+    assert a.node_count == MAX_NODES;
+    assert validate_graph(a) == GRAPH_OK;
+    // module + 192 consts = 193 nodes: one over, and the count says so
+    const over : []const u8 = "module m;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\n";
+    const g : SpecGraph = export_graph("specs/x.t27", over);
+    assert g.node_count == MAX_NODES + 1;
+    assert validate_graph(g) == ERR_TOO_MANY_NODES;
+    assert export_verdict("specs/x.t27", over) == ERR_TOO_MANY_NODES;
+    // negative controls: the verdict is the capacity one, and it is not OK
+    assert export_verdict("specs/x.t27", over) != GRAPH_OK;
+    assert export_verdict("specs/x.t27", over) != ERR_TOO_MANY_EDGES;
+    assert export_verdict("specs/x.t27", at_cap) == GRAPH_OK;
+}
+
+test more_edges_than_the_ir_holds_is_refused_not_truncated {
+    // 2 fns and 127 tests that each call both: 254 edges, exactly at capacity
+    const at_cap : []const u8 = "module m;\nfn a() u8 { return 1; }\nfn b() u8 { return 1; }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\n";
+    const a : SpecGraph = export_graph("specs/x.t27", at_cap);
+    assert a.node_count == 130;
+    assert a.edge_count == MAX_EDGES;
+    assert validate_graph(a) == GRAPH_OK;
+    // a 128th test makes 256: over, and the count says so
+    const over : []const u8 = "module m;\nfn a() u8 { return 1; }\nfn b() u8 { return 1; }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\n";
+    const g : SpecGraph = export_graph("specs/x.t27", over);
+    assert g.node_count == 131;
+    assert g.edge_count == MAX_EDGES + 2;
+    assert validate_graph(g) == ERR_TOO_MANY_EDGES;
+    // negative controls: it is the edge verdict, not the node one, and it is not OK
+    assert export_verdict("specs/x.t27", over) == ERR_TOO_MANY_EDGES;
+    assert export_verdict("specs/x.t27", over) != ERR_TOO_MANY_NODES;
+    assert export_verdict("specs/x.t27", at_cap) == GRAPH_OK;
+}
+
+test an_empty_source_or_a_missing_path_is_refused {
+    assert export_verdict("specs/x.t27", "") == ERR_SPEC_PATH;
+    assert export_verdict("", "module m;\n") == ERR_SPEC_PATH;
+    // negative control: a path and a line make a valid graph
+    assert export_verdict("specs/x.t27", "module m;\n") == GRAPH_OK;
+    assert export_verdict("specs/x.t27", "\n") == GRAPH_OK;
+    assert export_graph("specs/x.t27", "").node_count == 1;
+}
+
+test tutorial_08_export_is_a_valid_graph_of_the_lesson {
+    const g : SpecGraph = export_graph("specs/tutorial/08_modules_and_arrays.t27", TUTORIAL_08_SRC);
+    assert validate_graph(g) == GRAPH_OK;
+    assert g.spec_path == "specs/tutorial/08_modules_and_arrays.t27";
+    assert g.line_count == 93;
+    assert g.node_count == 14;
+    assert g.edge_count == 9;
+    assert g.node_name[0] == "tutorial-08-modules";
+    assert g.line_start[0] == 1 and g.line_end[0] == 93;
+    assert count_node_kind(g, NODE_USE) == 1;
+    assert count_node_kind(g, NODE_CONST) == 5;
+    assert count_node_kind(g, NODE_FN) == 3;
+    assert count_node_kind(g, NODE_TEST) == 3;
+    assert count_node_kind(g, NODE_INVARIANT) == 1;
+    assert count_node_kind(g, NODE_OPAQUE) == 0;
+    // negative control: the same lesson with a line cut off is a different graph
+    const cut : SpecGraph = export_graph("specs/tutorial/08_modules_and_arrays.t27", "module tutorial-08-modules;\nuse base::types;\n");
+    assert cut.node_count == 2;
+    assert cut.node_count != g.node_count;
+}
+
+test tutorial_08_exports_the_fixture_exactly_except_what_is_derived {
+    const e : SpecGraph = export_graph("specs/tutorial/08_modules_and_arrays.t27", TUTORIAL_08_SRC);
+    const f : SpecGraph = tutorial_08_graph();
+    assert validate_graph(e) == GRAPH_OK;
+    assert validate_graph(f) == GRAPH_OK;
+    assert e.spec_path == f.spec_path;
+    assert e.line_count == f.line_count;
+    // the 14 declaration nodes are identical, node by node: kind, label, name and span
+    assert nodes_in_common(e, f) == 14;
+    assert node_matches(e, f, 0);
+    assert node_matches(e, f, 4);
+    assert node_matches(e, f, 10);
+    assert node_matches(e, f, 13);
+    // difference 1: the fixture's node 14 (std.testing, UNKNOWN) is inferred from call targets,
+    // not declared in the file, so the scanner does not produce it
+    assert f.node_count == 15;
+    assert e.node_count == 14;
+    assert f.node_label[14] == LABEL_UNKNOWN;
+    // every edge the scanner reads is in the fixture, with the same kind, endpoints, label and line
+    assert e.edge_count == 9;
+    assert edges_shared(e, f) == 9;
+    // every EXACT edge of the fixture is one the scanner reads
+    assert count_edge_label(f, LABEL_EXACT) == 9;
+    assert edges_shared(f, e) == 9;
+    // difference 2: the fixture's other 7 edges are DERIVED (4 data flow, 3 tested_by), and the scanner never derives
+    assert f.edge_count == 16;
+    assert f.edge_count - edges_shared(f, e) == 7;
+    assert count_edge_label(f, LABEL_DERIVED) == 7;
+    assert count_edge_kind(f, EDGE_DATA_FLOW) == 4;
+    assert count_edge_kind(f, EDGE_TESTED_BY) == 3;
+    assert count_edge_kind(e, EDGE_DATA_FLOW) == 0;
+    assert count_edge_kind(e, EDGE_TESTED_BY) == 0;
+    // the nine, by name: USES 0->1 22, 4->2 38, 4->3 38, 8->6 67, 9->7 71; CALLS 10->8 79, 11->9 84, 12->4 89; CONSTRAINS 13->2 93
+    assert edge_in(e, EDGE_USES, 0, 1, LABEL_EXACT, 22);
+    assert edge_in(e, EDGE_USES, 4, 2, LABEL_EXACT, 38);
+    assert edge_in(e, EDGE_USES, 4, 3, LABEL_EXACT, 38);
+    assert edge_in(e, EDGE_USES, 8, 6, LABEL_EXACT, 67);
+    assert edge_in(e, EDGE_USES, 9, 7, LABEL_EXACT, 71);
+    assert edge_in(e, EDGE_CALLS, 10, 8, LABEL_EXACT, 79);
+    assert edge_in(e, EDGE_CALLS, 11, 9, LABEL_EXACT, 84);
+    assert edge_in(e, EDGE_CALLS, 12, 4, LABEL_EXACT, 89);
+    assert edge_in(e, EDGE_CONSTRAINS, 13, 2, LABEL_EXACT, 93);
+    // negative controls: the comparison can fail. A fixture with one span moved is not matched,
+    // and one with an edge line moved shares one fewer edge.
+    var moved : SpecGraph = tutorial_08_graph();
+    moved.line_end[4] = 40;
+    assert node_matches(e, moved, 4) == false;
+    assert nodes_in_common(e, moved) == 13;
+    var shifted : SpecGraph = tutorial_08_graph();
+    shifted.edge_line[1] = 37;
+    assert edges_shared(e, shifted) == 8;
+    assert edges_shared(e, shifted) != edges_shared(e, f);
+}
diff --git a/apps/website/public/t27f/graph/specs/spec_graph_view.t27 b/apps/website/public/t27f/graph/specs/spec_graph_view.t27
new file mode 100644
index 0000000000..d469b1b440
--- /dev/null
+++ b/apps/website/public/t27f/graph/specs/spec_graph_view.t27
@@ -0,0 +1,800 @@
+// SPDX-License-Identifier: Apache-2.0
+; specs/t27f/spec_graph_view.t27 -- the T27F graph view: a deterministic layout of a spec graph
+; (gHashTag/t27#10034; epic gHashTag/trinity#1648, RFC gHashTag/trinity#1649). T27F is the visual
+; spec of .t27 (.claude/skills/t27f/SKILL.md, "What T27F is"): one spec -> one graph -> many views.
+; The graph is specs/t27f/spec_graph.t27; this file is its first view, the one that shows the graph
+; itself, not a topic map. It turns a SpecGraph into numbers a host draws, as specs/t27f/reel.t27
+; does for a reel frame: a box per node, a line per edge, colours as 0xRRGGBB. Nothing here draws
+; pixels or writes markup.
+; Rules the layout holds, each with a test below:
+;   - one column per node kind present, in a fixed kind order, and no empty column;
+;   - a node's row order, size, fill, stroke and dash come from its inference label, so a fact, a
+;     derivation and a guess look different before any text is read;
+;   - an UNKNOWN node is drawn alone: in a band below every known node, and no edge ends at it;
+;   - every edge line carries a source line of the spec: its own, or for a DERIVED tested_by edge the
+;     line of the call it is read back from; an edge with no line makes the view refuse the graph;
+;   - each node's widget is spec_graph's node_widget, never a rule of this file;
+;   - a graph validate_graph refuses is refused here with the same code, and is not laid out.
+; Not claimed: t27c has no graph exporter yet, so the only graphs laid out are spec_graph's
+; hand-read fixtures; there is no edge routing around boxes, and no host draws this yet.
+; phi^2 + 1/phi^2 = 3 | TRINITY
+
+module t27f_spec_graph_view;
+
+use t27f::spec_graph::SpecGraph;
+use t27f::spec_graph::validate_graph;
+use t27f::spec_graph::valid_label;
+use t27f::spec_graph::node_widget;
+use t27f::spec_graph::tutorial_08_graph;
+use t27f::spec_graph::with_suggestion;
+use t27f::spec_graph::with_edge;
+use t27f::spec_graph::with_node;
+use t27f::spec_graph::MAX_NODES;
+use t27f::spec_graph::blank_graph;
+use t27f::spec_graph::GRAPH_OK;
+use t27f::spec_graph::VERDICT_KINDS;
+use t27f::spec_graph::ERR_EDGE_UNKNOWN_NODE;
+use t27f::spec_graph::ERR_SPEC_PATH;
+use t27f::spec_graph::NODE_KINDS;
+use t27f::spec_graph::NODE_MODULE;
+use t27f::spec_graph::NODE_CONST;
+use t27f::spec_graph::NODE_FN;
+use t27f::spec_graph::NODE_TEST;
+use t27f::spec_graph::NODE_INVARIANT;
+use t27f::spec_graph::NODE_BENCH;
+use t27f::spec_graph::NODE_USE;
+use t27f::spec_graph::NODE_OPAQUE;
+use t27f::spec_graph::EDGE_CALLS;
+use t27f::spec_graph::EDGE_TESTED_BY;
+use t27f::spec_graph::EDGE_DATA_FLOW;
+use t27f::spec_graph::EDGE_KINDS;
+use t27f::spec_graph::LABEL_EXACT;
+use t27f::spec_graph::LABEL_DERIVED;
+use t27f::spec_graph::LABEL_SUGGESTED;
+use t27f::spec_graph::LABEL_UNKNOWN;
+use t27f::spec_graph::LABEL_KINDS;
+use t27f::spec_graph::NO_LINE;
+use t27f::spec_graph::NO_INDEX;
+use t27f::ui_plan::WIDGET_HONEYCOMB_CARD;
+use t27f::ui_plan::WIDGET_FORMULA_VIEW;
+use t27f::ui_plan::WIDGET_RUN_BUTTON;
+use t27f::ui_plan::WIDGET_TEXT_BLOCK;
+
+/// Verdicts. VIEW_OK is GRAPH_OK; a graph validate_graph refuses keeps that code; the view adds one
+/// code of its own, the first after spec_graph's.
+pub const VIEW_OK : u8 = 0;
+pub const VIEW_ERR_EDGE_NO_LINE : u8 = 19;
+
+/// Column order by node kind code (module, const, fn, test, invariant, bench, use, opaque): the
+/// module, its imports, then constants, functions and what checks them, and opaque regions last.
+pub const VIEW_KIND_ORDER : [8]u8 = [0, 2, 3, 4, 5, 6, 1, 7];
+
+/// Geometry in pixels. A column is VIEW_COL_W wide and starts every VIEW_COL_STEP; a row starts
+/// every VIEW_ROW_STEP. The UNKNOWN band starts VIEW_BAND_GAP below the last known row.
+pub const VIEW_MARGIN : u32 = 40;
+pub const VIEW_COL_W : u32 = 220;
+pub const VIEW_COL_STEP : u32 = 260;
+pub const VIEW_ROW_STEP : u32 = 64;
+pub const VIEW_BAND_GAP : u32 = 48;
+
+/// Style by inference label (exact, derived, suggested, unknown). A guess and an unknown are
+/// narrower and lower than a fact and sit centred in the column (indent * 2 + width = VIEW_COL_W);
+/// only EXACT is drawn solid. Dash is the dash length in pixels, 0 for a solid line.
+pub const VIEW_LABEL_W : [4]u32 = [220, 220, 200, 200];
+pub const VIEW_LABEL_H : [4]u32 = [44, 44, 36, 36];
+pub const VIEW_LABEL_INDENT : [4]u32 = [0, 0, 10, 10];
+pub const VIEW_LABEL_FILL : [4]u32 = [0xDCEFE0, 0xDDE8F7, 0xFFF1D0, 0xECECEC];
+pub const VIEW_LABEL_STROKE : [4]u32 = [0x1B7F3B, 0x2459A8, 0xB7791F, 0x8A8A8A];
+pub const VIEW_LABEL_DASH : [4]u32 = [0, 6, 3, 2];
+
+/// Text and page colours, and the text size a host uses inside a box.
+pub const VIEW_TEXT : u32 = 0x1A1A1A;
+pub const VIEW_BACKDROP : u32 = 0xFFFFFF;
+pub const VIEW_FONT_PX : u32 = 13;
+
+/// Two edges between the same pair of nodes (uses and data_flow, calls and tested_by) would lie on
+/// one line; each edge kind is shifted by its own lane, VIEW_LANE_STEP * kind - VIEW_LANE_HALF.
+pub const VIEW_LANE_STEP : u32 = 4;
+pub const VIEW_LANE_HALF : u32 = 8;
+
+/// A label this file cannot read is drawn as UNKNOWN, never as a fact.
+pub fn view_is_unknown(label: u8) -> bool {
+    return label == LABEL_UNKNOWN or valid_label(label) == false;
+}
+
+/// The style row a label is drawn with.
+pub fn view_style(label: u8) -> u8 {
+    if (view_is_unknown(label)) { return LABEL_UNKNOWN; }
+    return label;
+}
+
+pub fn view_kind_present(g: SpecGraph, k: u8) -> bool {
+    var n : u32 = 0;
+    while (n < g.node_count) {
+        if (g.node_kind[n as usize] == k) { return true; }
+        n = n + 1;
+    }
+    return false;
+}
+
+/// The column of node kind k: how many kinds present come before it in VIEW_KIND_ORDER. A kind
+/// outside the vocabulary has no column.
+pub fn view_column(g: SpecGraph, k: u8) -> u32 {
+    if (k >= NODE_KINDS) { return NO_INDEX; }
+    var c : u32 = 0;
+    var kk : u32 = 0;
+    while (kk < (NODE_KINDS as u32)) {
+        if (view_kind_present(g, kk as u8) and VIEW_KIND_ORDER[kk as usize] < VIEW_KIND_ORDER[k as usize]) { c = c + 1; }
+        kk = kk + 1;
+    }
+    return c;
+}
+
+pub fn view_column_count(g: SpecGraph) -> u32 {
+    var c : u32 = 0;
+    var kk : u32 = 0;
+    while (kk < (NODE_KINDS as u32)) {
+        if (view_kind_present(g, kk as u8)) { c = c + 1; }
+        kk = kk + 1;
+    }
+    return c;
+}
+
+pub fn view_node_column(g: SpecGraph, n: u32) -> u32 {
+    return view_column(g, g.node_kind[n as usize]);
+}
+
+/// The row of node n inside its column. Known nodes are ordered by label (exact, derived,
+/// suggested), then by node number; UNKNOWN nodes are counted apart, by node number, in the band.
+pub fn view_row(g: SpecGraph, n: u32) -> u32 {
+    let k : usize = n as usize;
+    let ln : u8 = g.node_label[k];
+    let unk : bool = view_is_unknown(ln);
+    var r : u32 = 0;
+    var m : u32 = 0;
+    while (m < g.node_count) {
+        let q : usize = m as usize;
+        let lm : u8 = g.node_label[q];
+        if (m != n and g.node_kind[q] == g.node_kind[k] and view_is_unknown(lm) == unk) {
+            if (unk) {
+                if (m < n) { r = r + 1; }
+            } else {
+                if (lm < ln or (lm == ln and m < n)) { r = r + 1; }
+            }
+        }
+        m = m + 1;
+    }
+    return r;
+}
+
+/// The deepest column of known nodes, in rows.
+pub fn view_known_depth(g: SpecGraph) -> u32 {
+    var d : u32 = 0;
+    var n : u32 = 0;
+    while (n < g.node_count) {
+        if (view_is_unknown(g.node_label[n as usize]) == false) {
+            let r : u32 = view_row(g, n) + 1;
+            if (r > d) { d = r; }
+        }
+        n = n + 1;
+    }
+    return d;
+}
+
+/// The top of the UNKNOWN band.
+pub fn view_band_top(g: SpecGraph) -> u32 {
+    return VIEW_MARGIN + view_known_depth(g) * VIEW_ROW_STEP + VIEW_BAND_GAP;
+}
+
+pub fn view_node_x(g: SpecGraph, n: u32) -> u32 {
+    let s : u8 = view_style(g.node_label[n as usize]);
+    return VIEW_MARGIN + view_node_column(g, n) * VIEW_COL_STEP + VIEW_LABEL_INDENT[s as usize];
+}
+
+pub fn view_node_y(g: SpecGraph, n: u32) -> u32 {
+    if (view_is_unknown(g.node_label[n as usize])) { return view_band_top(g) + view_row(g, n) * VIEW_ROW_STEP; }
+    return VIEW_MARGIN + view_row(g, n) * VIEW_ROW_STEP;
+}
+
+pub fn view_node_w(g: SpecGraph, n: u32) -> u32 {
+    return VIEW_LABEL_W[view_style(g.node_label[n as usize]) as usize];
+}
+
+pub fn view_node_h(g: SpecGraph, n: u32) -> u32 {
+    return VIEW_LABEL_H[view_style(g.node_label[n as usize]) as usize];
+}
+
+pub fn view_node_fill(g: SpecGraph, n: u32) -> u32 {
+    return VIEW_LABEL_FILL[view_style(g.node_label[n as usize]) as usize];
+}
+
+pub fn view_node_stroke(g: SpecGraph, n: u32) -> u32 {
+    return VIEW_LABEL_STROKE[view_style(g.node_label[n as usize]) as usize];
+}
+
+pub fn view_node_dash(g: SpecGraph, n: u32) -> u32 {
+    return VIEW_LABEL_DASH[view_style(g.node_label[n as usize]) as usize];
+}
+
+/// The ui_plan widget of node n: spec_graph's binding, unchanged.
+pub fn view_node_widget(g: SpecGraph, n: u32) -> u8 {
+    let k : usize = n as usize;
+    return node_widget(g.node_kind[k], g.node_label[k]);
+}
+
+/// The canvas: every column, and the lowest box plus a margin.
+pub fn view_width(g: SpecGraph) -> u32 {
+    let c : u32 = view_column_count(g);
+    if (c == 0) { return 2 * VIEW_MARGIN; }
+    return 2 * VIEW_MARGIN + (c - 1) * VIEW_COL_STEP + VIEW_COL_W;
+}
+
+pub fn view_height(g: SpecGraph) -> u32 {
+    var bottom : u32 = VIEW_MARGIN;
+    var n : u32 = 0;
+    while (n < g.node_count) {
+        let b : u32 = view_node_y(g, n) + view_node_h(g, n);
+        if (b > bottom) { bottom = b; }
+        n = n + 1;
+    }
+    return bottom + VIEW_MARGIN;
+}
+
+/// The source line an edge points at: its own line, or for a tested_by edge with none, the line
+/// of the call it is read back from (spec_graph's DERIVED rule). NO_LINE when there is neither.
+pub fn view_edge_line(g: SpecGraph, j: u32) -> u32 {
+    let k : usize = j as usize;
+    if (g.edge_line[k] != NO_LINE) { return g.edge_line[k]; }
+    if (g.edge_kind[k] != EDGE_TESTED_BY) { return NO_LINE; }
+    var i : u32 = 0;
+    while (i < g.edge_count) {
+        let m : usize = i as usize;
+        if (g.edge_kind[m] == EDGE_CALLS and g.edge_from[m] == g.edge_to[k] and g.edge_to[m] == g.edge_from[k]) { return g.edge_line[m]; }
+        i = i + 1;
+    }
+    return NO_LINE;
+}
+
+/// VIEW_OK, or why the graph is not drawn: the validate_graph code, or VIEW_ERR_EDGE_NO_LINE.
+pub fn view_verdict(g: SpecGraph) -> u8 {
+    let v : u8 = validate_graph(g);
+    if (v != GRAPH_OK) { return v; }
+    var j : u32 = 0;
+    while (j < g.edge_count) {
+        if (view_edge_line(g, j) == NO_LINE) { return VIEW_ERR_EDGE_NO_LINE; }
+        j = j + 1;
+    }
+    return VIEW_OK;
+}
+
+/// Edge end points. A line leaves the side of the from-box that faces the to-box and enters the
+/// facing side of the to-box; inside one column both ends are on the right side.
+pub fn view_edge_x1(g: SpecGraph, j: u32) -> u32 {
+    let f : u32 = g.edge_from[j as usize] as u32;
+    let t : u32 = g.edge_to[j as usize] as u32;
+    if (view_node_column(g, f) > view_node_column(g, t)) { return view_node_x(g, f); }
+    return view_node_x(g, f) + view_node_w(g, f);
+}
+
+pub fn view_edge_x2(g: SpecGraph, j: u32) -> u32 {
+    let f : u32 = g.edge_from[j as usize] as u32;
+    let t : u32 = g.edge_to[j as usize] as u32;
+    if (view_node_column(g, f) < view_node_column(g, t)) { return view_node_x(g, t); }
+    return view_node_x(g, t) + view_node_w(g, t);
+}
+
+/// The vertical centre of node n, shifted to the lane of an edge of kind ek.
+pub fn view_lane_y(g: SpecGraph, n: u32, ek: u8) -> u32 {
+    return view_node_y(g, n) + view_node_h(g, n) / 2 + VIEW_LANE_STEP * (ek as u32) - VIEW_LANE_HALF;
+}
+
+pub fn view_edge_y1(g: SpecGraph, j: u32) -> u32 {
+    return view_lane_y(g, g.edge_from[j as usize] as u32, g.edge_kind[j as usize]);
+}
+
+pub fn view_edge_y2(g: SpecGraph, j: u32) -> u32 {
+    return view_lane_y(g, g.edge_to[j as usize] as u32, g.edge_kind[j as usize]);
+}
+
+pub fn view_edge_stroke(g: SpecGraph, j: u32) -> u32 {
+    return VIEW_LABEL_STROKE[view_style(g.edge_label[j as usize]) as usize];
+}
+
+pub fn view_edge_dash(g: SpecGraph, j: u32) -> u32 {
+    return VIEW_LABEL_DASH[view_style(g.edge_label[j as usize]) as usize];
+}
+
+/// Boxes a and b share at least one pixel.
+pub fn view_overlap(g: SpecGraph, a: u32, b: u32) -> bool {
+    let ax : u32 = view_node_x(g, a);
+    let ay : u32 = view_node_y(g, a);
+    let bx : u32 = view_node_x(g, b);
+    let by : u32 = view_node_y(g, b);
+    return ax < bx + view_node_w(g, b) and bx < ax + view_node_w(g, a) and ay < by + view_node_h(g, b) and by < ay + view_node_h(g, a);
+}
+
+pub fn view_overlap_count(g: SpecGraph) -> u32 {
+    var c : u32 = 0;
+    var a : u32 = 0;
+    while (a < g.node_count) {
+        var b : u32 = a + 1;
+        while (b < g.node_count) {
+            if (view_overlap(g, a, b)) { c = c + 1; }
+            b = b + 1;
+        }
+        a = a + 1;
+    }
+    return c;
+}
+
+/// The point (x, y) lies on or inside the box of node n.
+pub fn view_point_in(g: SpecGraph, n: u32, x: u32, y: u32) -> bool {
+    let nx : u32 = view_node_x(g, n);
+    let ny : u32 = view_node_y(g, n);
+    return nx <= x and x <= nx + view_node_w(g, n) and ny <= y and y <= ny + view_node_h(g, n);
+}
+
+/// Edge ends that land on node n's box, counting both ends of every edge.
+pub fn view_ends_on(g: SpecGraph, n: u32) -> u32 {
+    var c : u32 = 0;
+    var j : u32 = 0;
+    while (j < g.edge_count) {
+        if (view_point_in(g, n, view_edge_x1(g, j), view_edge_y1(g, j))) { c = c + 1; }
+        if (view_point_in(g, n, view_edge_x2(g, j), view_edge_y2(g, j))) { c = c + 1; }
+        j = j + 1;
+    }
+    return c;
+}
+
+/// Every edge end lands on the box of its own endpoint.
+pub fn view_edges_attach(g: SpecGraph) -> bool {
+    var j : u32 = 0;
+    while (j < g.edge_count) {
+        let f : u32 = g.edge_from[j as usize] as u32;
+        let t : u32 = g.edge_to[j as usize] as u32;
+        if (view_point_in(g, f, view_edge_x1(g, j), view_edge_y1(g, j)) == false) { return false; }
+        if (view_point_in(g, t, view_edge_x2(g, j), view_edge_y2(g, j)) == false) { return false; }
+        j = j + 1;
+    }
+    return true;
+}
+
+/// The lowest edge of every known box, plus VIEW_BAND_GAP, is above node n.
+pub fn view_alone_below(g: SpecGraph, n: u32) -> bool {
+    let y : u32 = view_node_y(g, n);
+    var m : u32 = 0;
+    while (m < g.node_count) {
+        if (view_is_unknown(g.node_label[m as usize]) == false) {
+            if (view_node_y(g, m) + view_node_h(g, m) + VIEW_BAND_GAP > y) { return false; }
+        }
+        m = m + 1;
+    }
+    return true;
+}
+
+/// --- host entry points ---
+
+/// A wasm export carries scalars only, so these name a fixture instead of taking a graph: 0 is
+/// spec_graph's tutorial_08_graph, 1 the same graph with its suggestion; any other number is the
+/// blank graph, which the view refuses. An index past the graph returns 0.
+pub fn view_fx(which: u32) -> SpecGraph {
+    if (which == 0) { return tutorial_08_graph(); }
+    if (which == 1) { return with_suggestion(); }
+    return blank_graph();
+}
+
+pub fn fx_verdict(which: u32) -> u8 {
+    return view_verdict(view_fx(which));
+}
+
+pub fn fx_node_count(which: u32) -> u32 {
+    return view_fx(which).node_count;
+}
+
+pub fn fx_edge_count(which: u32) -> u32 {
+    return view_fx(which).edge_count;
+}
+
+pub fn fx_width(which: u32) -> u32 {
+    return view_width(view_fx(which));
+}
+
+pub fn fx_height(which: u32) -> u32 {
+    return view_height(view_fx(which));
+}
+
+pub fn fx_node_kind(which: u32, n: u32) -> u8 {
+    let g : SpecGraph = view_fx(which);
+    if (n >= g.node_count) { return 0; }
+    return g.node_kind[n as usize];
+}
+
+pub fn fx_node_label(which: u32, n: u32) -> u8 {
+    let g : SpecGraph = view_fx(which);
+    if (n >= g.node_count) { return 0; }
+    return g.node_label[n as usize];
+}
+
+pub fn fx_node_line_start(which: u32, n: u32) -> u32 {
+    let g : SpecGraph = view_fx(which);
+    if (n >= g.node_count) { return 0; }
+    return g.line_start[n as usize];
+}
+
+pub fn fx_node_line_end(which: u32, n: u32) -> u32 {
+    let g : SpecGraph = view_fx(which);
+    if (n >= g.node_count) { return 0; }
+    return g.line_end[n as usize];
+}
+
+pub fn fx_node_x(which: u32, n: u32) -> u32 {
+    let g : SpecGraph = view_fx(which);
+    if (n >= g.node_count) { return 0; }
+    return view_node_x(g, n);
+}
+
+pub fn fx_node_y(which: u32, n: u32) -> u32 {
+    let g : SpecGraph = view_fx(which);
+    if (n >= g.node_count) { return 0; }
+    return view_node_y(g, n);
+}
+
+pub fn fx_node_w(which: u32, n: u32) -> u32 {
+    let g : SpecGraph = view_fx(which);
+    if (n >= g.node_count) { return 0; }
+    return view_node_w(g, n);
+}
+
+pub fn fx_node_h(which: u32, n: u32) -> u32 {
+    let g : SpecGraph = view_fx(which);
+    if (n >= g.node_count) { return 0; }
+    return view_node_h(g, n);
+}
+
+pub fn fx_node_fill(which: u32, n: u32) -> u32 {
+    let g : SpecGraph = view_fx(which);
+    if (n >= g.node_count) { return 0; }
+    return view_node_fill(g, n);
+}
+
+pub fn fx_node_stroke(which: u32, n: u32) -> u32 {
+    let g : SpecGraph = view_fx(which);
+    if (n >= g.node_count) { return 0; }
+    return view_node_stroke(g, n);
+}
+
+pub fn fx_node_dash(which: u32, n: u32) -> u32 {
+    let g : SpecGraph = view_fx(which);
+    if (n >= g.node_count) { return 0; }
+    return view_node_dash(g, n);
+}
+
+pub fn fx_node_widget(which: u32, n: u32) -> u8 {
+    let g : SpecGraph = view_fx(which);
+    if (n >= g.node_count) { return 0; }
+    return view_node_widget(g, n);
+}
+
+pub fn fx_edge_kind(which: u32, j: u32) -> u8 {
+    let g : SpecGraph = view_fx(which);
+    if (j >= g.edge_count) { return 0; }
+    return g.edge_kind[j as usize];
+}
+
+pub fn fx_edge_label(which: u32, j: u32) -> u8 {
+    let g : SpecGraph = view_fx(which);
+    if (j >= g.edge_count) { return 0; }
+    return g.edge_label[j as usize];
+}
+
+pub fn fx_edge_line(which: u32, j: u32) -> u32 {
+    let g : SpecGraph = view_fx(which);
+    if (j >= g.edge_count) { return 0; }
+    return view_edge_line(g, j);
+}
+
+pub fn fx_edge_x1(which: u32, j: u32) -> u32 {
+    let g : SpecGraph = view_fx(which);
+    if (j >= g.edge_count) { return 0; }
+    return view_edge_x1(g, j);
+}
+
+pub fn fx_edge_y1(which: u32, j: u32) -> u32 {
+    let g : SpecGraph = view_fx(which);
+    if (j >= g.edge_count) { return 0; }
+    return view_edge_y1(g, j);
+}
+
+pub fn fx_edge_x2(which: u32, j: u32) -> u32 {
+    let g : SpecGraph = view_fx(which);
+    if (j >= g.edge_count) { return 0; }
+    return view_edge_x2(g, j);
+}
+
+pub fn fx_edge_y2(which: u32, j: u32) -> u32 {
+    let g : SpecGraph = view_fx(which);
+    if (j >= g.edge_count) { return 0; }
+    return view_edge_y2(g, j);
+}
+
+pub fn fx_edge_stroke(which: u32, j: u32) -> u32 {
+    let g : SpecGraph = view_fx(which);
+    if (j >= g.edge_count) { return 0; }
+    return view_edge_stroke(g, j);
+}
+
+pub fn fx_edge_dash(which: u32, j: u32) -> u32 {
+    let g : SpecGraph = view_fx(which);
+    if (j >= g.edge_count) { return 0; }
+    return view_edge_dash(g, j);
+}
+
+/// --- tests ---
+
+test fixture_is_drawn {
+    let g : SpecGraph = tutorial_08_graph();
+    assert view_verdict(g) == VIEW_OK;
+    // seven kinds are present (no bench), so seven columns
+    assert view_column_count(g) == 7;
+    assert view_width(g) == 1860;
+    assert view_height(g) == 484;
+    assert view_known_depth(g) == 5;
+    // module (node 0), the first const (node 2), power_of_two (node 8), the invariant (node 13)
+    assert view_node_x(g, 0) == 40;
+    assert view_node_y(g, 0) == 40;
+    assert view_node_x(g, 2) == 560;
+    assert view_node_x(g, 8) == 820;
+    assert view_node_y(g, 8) == 104;
+    assert view_node_x(g, 13) == 1340;
+    assert view_node_w(g, 8) == 220;
+    assert view_node_h(g, 8) == 44;
+    // the last const is the deepest known box
+    assert view_node_y(g, 7) == 296;
+    assert view_overlap_count(g) == 0;
+    assert view_edges_attach(g);
+}
+
+test one_column_per_kind {
+    let g : SpecGraph = tutorial_08_graph();
+    assert view_column(g, NODE_MODULE) == 0;
+    assert view_column(g, NODE_USE) == 1;
+    assert view_column(g, NODE_CONST) == 2;
+    assert view_column(g, NODE_FN) == 3;
+    assert view_column(g, NODE_TEST) == 4;
+    assert view_column(g, NODE_INVARIANT) == 5;
+    assert view_column(g, NODE_OPAQUE) == 6;
+    assert view_kind_present(g, NODE_BENCH) == false;
+    assert view_column(g, NODE_KINDS) == NO_INDEX;
+    // nodes share a column exactly when they share a kind
+    var same : u32 = 0;
+    var a : u32 = 0;
+    while (a < g.node_count) {
+        var b : u32 = 0;
+        while (b < g.node_count) {
+            let sk : bool = g.node_kind[a as usize] == g.node_kind[b as usize];
+            let sc : bool = view_node_column(g, a) == view_node_column(g, b);
+            if (sk == sc) { same = same + 1; }
+            b = b + 1;
+        }
+        a = a + 1;
+    }
+    assert same == 225;
+}
+
+test label_sets_size_colour_and_order {
+    // the suggestion (node 15) is an opaque region: same column as std.testing, drawn as a guess
+    let s : SpecGraph = with_suggestion();
+    assert view_verdict(s) == VIEW_OK;
+    assert view_node_x(s, 15) == 1610;
+    assert view_node_y(s, 15) == 40;
+    assert view_node_w(s, 15) == 200;
+    assert view_node_h(s, 15) == 36;
+    assert view_node_fill(s, 15) == 0xFFF1D0;
+    assert view_node_dash(s, 15) == 3;
+    assert view_overlap_count(s) == 0;
+    // its edge is a guess too, and points at line 67
+    assert view_edge_stroke(s, 16) == VIEW_LABEL_STROKE[LABEL_SUGGESTED as usize];
+    assert view_edge_line(s, 16) == 67;
+    assert view_edge_x1(s, 16) == 780;
+    assert view_edge_y1(s, 16) == 262;
+    assert view_edge_x2(s, 16) == 1610;
+    assert view_edge_y2(s, 16) == 66;
+    // a derived const moves below the exact ones of its column and changes style
+    var d : SpecGraph = tutorial_08_graph();
+    d.node_label[5] = LABEL_DERIVED;
+    assert view_verdict(d) == VIEW_OK;
+    assert view_node_y(d, 5) == 296;
+    assert view_node_y(d, 6) == 168;
+    assert view_node_fill(d, 5) == 0xDDE8F7;
+    assert view_node_dash(d, 5) == 6;
+    // the name moves nothing: the layout reads kind, label and node number only
+    var r : SpecGraph = tutorial_08_graph();
+    r.node_name[4] = "renamed";
+    assert view_node_x(r, 4) == 820;
+    assert view_node_y(r, 4) == 40;
+}
+
+test unknown_node_is_drawn_alone {
+    let g : SpecGraph = tutorial_08_graph();
+    // std.testing (node 14): in its kind's column, in the band below every known box
+    assert view_node_x(g, 14) == 1610;
+    assert view_band_top(g) == 408;
+    assert view_node_y(g, 14) == 408;
+    assert view_node_fill(g, 14) == 0xECECEC;
+    assert view_node_widget(g, 14) == WIDGET_TEXT_BLOCK;
+    assert view_alone_below(g, 14);
+    // no edge end lands on it, while power_of_two (node 8) takes four
+    assert view_ends_on(g, 14) == 0;
+    assert view_ends_on(g, 8) == 4;
+    // relabelled DERIVED it is no longer unknown, so it leaves the band and the canvas shrinks
+    var d : SpecGraph = tutorial_08_graph();
+    d.node_label[14] = LABEL_DERIVED;
+    assert view_verdict(d) == VIEW_OK;
+    assert view_node_y(d, 14) == 40;
+    assert view_alone_below(d, 14) == false;
+    assert view_height(d) == 380;
+    // a label this file cannot read is drawn unknown
+    assert view_style(LABEL_KINDS) == LABEL_UNKNOWN;
+    assert view_is_unknown(LABEL_SUGGESTED) == false;
+}
+
+test every_edge_points_at_a_source_line {
+    let g : SpecGraph = tutorial_08_graph();
+    var lined : u32 = 0;
+    var j : u32 = 0;
+    while (j < g.edge_count) {
+        let l : u32 = view_edge_line(g, j);
+        if (l != NO_LINE and l <= g.line_count) { lined = lined + 1; }
+        j = j + 1;
+    }
+    assert lined == 16;
+    // the uses edge of the `use` statement
+    assert view_edge_line(g, 0) == 22;
+    assert view_edge_x1(g, 0) == 260;
+    assert view_edge_y1(g, 0) == 58;
+    assert view_edge_x2(g, 0) == 300;
+    // tested_by power_of_two -> its test has no line of its own: it points at the call, line 79
+    assert g.edge_line[12] == NO_LINE;
+    assert view_edge_line(g, 12) == 79;
+    assert view_edge_line(g, 14) == 89;
+    assert view_edge_dash(g, 12) == 6;
+    // the call and the tested_by between the same two nodes are drawn on different lanes
+    assert view_edge_y2(g, 9) == 118;
+    assert view_edge_y1(g, 12) == 126;
+    // constrains runs right to left: the invariant's left side to the const's right side
+    assert view_edge_x1(g, 15) == 1340;
+    assert view_edge_x2(g, 15) == 780;
+}
+
+test refused_graphs_are_not_drawn {
+    let g : SpecGraph = tutorial_08_graph();
+    // negative control: an edge into the unknown node is refused with spec_graph's own code
+    assert view_verdict(with_edge(g, EDGE_DATA_FLOW, 14, 10, LABEL_DERIVED, 79)) == ERR_EDGE_UNKNOWN_NODE;
+    // negative control: a tested_by edge with no call behind it passes validate_graph, but has no
+    // line to point at, so the view refuses it
+    let x : SpecGraph = with_edge(g, EDGE_TESTED_BY, 9, 10, LABEL_DERIVED, NO_LINE);
+    assert validate_graph(x) == GRAPH_OK;
+    assert view_edge_line(x, 16) == NO_LINE;
+    assert view_verdict(x) == VIEW_ERR_EDGE_NO_LINE;
+    assert view_verdict(blank_graph()) == ERR_SPEC_PATH;
+}
+
+test a_graph_at_node_capacity_is_drawn_in_a_tall_canvas {
+    let base : SpecGraph = tutorial_08_graph();
+    var g : SpecGraph = base;
+    while (g.node_count < MAX_NODES) {
+        g = with_node(g, NODE_CONST, LABEL_EXACT, "extra", 1, 1);
+    }
+    assert g.node_count == MAX_NODES;
+    assert view_verdict(g) == VIEW_OK;
+    // one column per kind is unchanged by more nodes of a kind already present
+    assert view_column_count(g) == view_column_count(base);
+    assert view_width(g) == view_width(base);
+    // the const column holds at least 177 more rows, so the canvas grows in height only
+    assert view_known_depth(g) >= 177;
+    assert view_height(g) > 11000;
+    assert view_height(g) > view_height(base);
+    // the last two extra nodes share a column on different rows: boxes do not overlap
+    let last : u32 = MAX_NODES - 1;
+    assert view_node_column(g, last) == view_node_column(g, last - 1);
+    assert view_node_y(g, last) == view_node_y(g, last - 1) + VIEW_ROW_STEP;
+    assert view_overlap(g, last, last - 1) == false;
+    // negative control: the same node drawn on top of itself overlaps
+    assert view_overlap(g, last, last);
+}
+
+test nodes_bind_through_spec_graph {
+    let g : SpecGraph = tutorial_08_graph();
+    assert view_node_widget(g, 0) == WIDGET_HONEYCOMB_CARD;
+    assert view_node_widget(g, 8) == WIDGET_FORMULA_VIEW;
+    assert view_node_widget(g, 10) == WIDGET_RUN_BUTTON;
+    var same : u32 = 0;
+    var n : u32 = 0;
+    while (n < g.node_count) {
+        if (view_node_widget(g, n) == node_widget(g.node_kind[n as usize], g.node_label[n as usize])) { same = same + 1; }
+        n = n + 1;
+    }
+    assert same == 15;
+    assert view_node_widget(with_suggestion(), 15) == WIDGET_TEXT_BLOCK;
+}
+
+test host_entry_points_match_the_layout {
+    let g : SpecGraph = tutorial_08_graph();
+    assert fx_verdict(0) == VIEW_OK;
+    assert fx_verdict(1) == VIEW_OK;
+    assert fx_verdict(2) == ERR_SPEC_PATH;
+    assert fx_node_count(0) == 15;
+    assert fx_node_count(1) == 16;
+    assert fx_edge_count(1) == 17;
+    assert fx_width(0) == view_width(g);
+    assert fx_height(0) == view_height(g);
+    assert fx_node_x(0, 14) == 1610;
+    assert fx_node_y(0, 14) == 408;
+    assert fx_node_label(0, 14) == LABEL_UNKNOWN;
+    assert fx_node_kind(0, 14) == NODE_OPAQUE;
+    assert fx_node_line_start(0, 8) == 66;
+    assert fx_node_line_end(0, 8) == 68;
+    assert fx_node_widget(0, 8) == WIDGET_FORMULA_VIEW;
+    assert fx_node_fill(1, 15) == 0xFFF1D0;
+    assert fx_node_stroke(0, 0) == 0x1B7F3B;
+    assert fx_node_dash(0, 0) == 0;
+    assert fx_node_w(0, 14) == 200;
+    assert fx_node_h(0, 0) == 44;
+    assert fx_edge_line(0, 12) == 79;
+    assert fx_edge_kind(0, 12) == EDGE_TESTED_BY;
+    assert fx_edge_label(0, 12) == LABEL_DERIVED;
+    assert fx_edge_x1(0, 15) == 1340;
+    assert fx_edge_y1(0, 0) == 58;
+    assert fx_edge_x2(0, 0) == 300;
+    assert fx_edge_y2(1, 16) == 66;
+    assert fx_edge_stroke(0, 12) == 0x2459A8;
+    assert fx_edge_dash(1, 16) == 3;
+    // past the graph, a host gets 0, not a neighbour's numbers
+    assert fx_node_x(0, 15) == 0;
+    assert fx_edge_x1(0, 16) == 0;
+}
+
+invariant label_styles_are_distinct_and_centred {
+    var l : u32 = 0;
+    while (l < (LABEL_KINDS as u32)) {
+        let k : usize = l as usize;
+        assert VIEW_LABEL_INDENT[k] * 2 + VIEW_LABEL_W[k] == VIEW_COL_W;
+        assert VIEW_LABEL_H[k] < VIEW_ROW_STEP;
+        var m : u32 = l + 1;
+        while (m < (LABEL_KINDS as u32)) {
+            assert VIEW_LABEL_FILL[k] != VIEW_LABEL_FILL[m as usize];
+            assert VIEW_LABEL_STROKE[k] != VIEW_LABEL_STROKE[m as usize];
+            assert VIEW_LABEL_DASH[k] != VIEW_LABEL_DASH[m as usize];
+            m = m + 1;
+        }
+        l = l + 1;
+    }
+    // only a fact is drawn solid, and a guess is never larger than a fact
+    assert VIEW_LABEL_DASH[LABEL_EXACT as usize] == 0;
+    assert VIEW_LABEL_W[LABEL_SUGGESTED as usize] < VIEW_LABEL_W[LABEL_EXACT as usize];
+    assert VIEW_LABEL_W[LABEL_UNKNOWN as usize] < VIEW_LABEL_W[LABEL_DERIVED as usize];
+}
+
+invariant kind_order_is_a_permutation {
+    var seen : u32 = 0;
+    var k : u32 = 0;
+    while (k < (NODE_KINDS as u32)) {
+        seen = seen | ((1 as u32) << (VIEW_KIND_ORDER[k as usize] as u32));
+        k = k + 1;
+    }
+    assert seen == 255;
+    assert VIEW_COL_W < VIEW_COL_STEP;
+}
+
+invariant view_codes_follow_spec_graph {
+    assert VIEW_OK == GRAPH_OK;
+    assert VIEW_ERR_EDGE_NO_LINE == VERDICT_KINDS;
+    // the lowest lane stays inside the shortest box, the highest too
+    assert VIEW_LANE_HALF < VIEW_LABEL_H[LABEL_UNKNOWN as usize] / 2;
+    assert VIEW_LANE_STEP * ((EDGE_KINDS as u32) - 1) - VIEW_LANE_HALF < VIEW_LABEL_H[LABEL_UNKNOWN as usize] / 2;
+}
+
+invariant the_fixtures_are_drawn {
+    assert view_verdict(tutorial_08_graph()) == VIEW_OK;
+    assert view_verdict(with_suggestion()) == VIEW_OK;
+}
diff --git a/apps/website/public/t27f/graph/specs/topic_reel.t27 b/apps/website/public/t27f/graph/specs/topic_reel.t27
new file mode 100644
index 0000000000..a5b074dab9
--- /dev/null
+++ b/apps/website/public/t27f/graph/specs/topic_reel.t27
@@ -0,0 +1,241 @@
+// SPDX-License-Identifier: Apache-2.0
+; specs/t27f/topic_reel.t27 -- the one workflow every T27F topic reel goes through.
+; gHashTag/trinity#1677 asks that two very different domains use the same widget and workflow
+; "without duplicated orchestration code". A topic reel (reel_t27_basics.t27, reel_gf16_nmse.t27)
+; is data: a brief, 27 cells with their measurements, and the slide text. Everything a reel decides
+; or checks with that data lives here, once:
+;   - the domain is route_brief of the brief's own text (topic_engine.t27, KEYWORD_MATCH);
+;   - every cell's STATUS is earned_status of its four measurements (statuses_earned);
+;   - a gap is a cell with no source, and it names what is missing (gaps_are_named);
+;   - every slide's text fits every preset as the host breaks it (slides_fit, stage_slides_bare).
+; A reel calls these from its tests and keeps only the checks that are about its own topic.
+; Before 2026-10-17 the first reel carried its own copy of the counting and slide-fit functions; a
+; second reel would have copied them again, which is the duplication #1677 rules out.
+; phi^2 + 1/phi^2 = 3 | TRINITY
+
+module topic_reel;
+
+use t27f::reel::CELL_COUNT;
+use t27f::reel::DEMO_COUNT;
+use t27f::reel::DEMO_KIND;
+use t27f::reel::PRESET_COUNT;
+use t27f::deck::LAYOUT_SPLIT;
+use t27f::deck::LAYOUT_STAGE;
+use t27f::deck::REGION_TITLE;
+use t27f::deck::HEADLINE_PX;
+use t27f::deck::BODY_PX;
+use t27f::deck::HEADLINE_EM_PERMILLE;
+use t27f::deck::BODY_EM_PERMILLE;
+use t27f::deck::MAX_ROWS;
+use t27f::deck::layout_for;
+use t27f::deck::text_fits;
+use t27f::deck::chars_per_line;
+use t27f::deck::card_inner_w;
+use t27f::deck::region_w;
+use t27f::topic_engine::STATUS_GAP;
+use t27f::topic_engine::STATUS_DRAFT;
+use t27f::topic_engine::STATUS_VERIFIED;
+use t27f::topic_engine::DOMAIN_RESEARCH;
+use t27f::topic_engine::earned_status;
+
+/// Slide rows per demo scene: a reel's ROWS holds DEMO_COUNT * ROWS_PER_SCENE entries, scene-major.
+pub const ROWS_PER_SCENE : i32 = 4;
+
+pub fn count_status(status: [27]u8, s: u8) -> i32 {
+    var n : i32 = 0;
+    var c : i32 = 0;
+    while (c < CELL_COUNT) {
+        if (status[@intCast(c)] == s) {
+            n = n + 1;
+        }
+        c = c + 1;
+    }
+    return n;
+}
+
+pub fn count_true(xs: [27]bool) -> i32 {
+    var n : i32 = 0;
+    var c : i32 = 0;
+    while (c < CELL_COUNT) {
+        if (xs[@intCast(c)]) {
+            n = n + 1;
+        }
+        c = c + 1;
+    }
+    return n;
+}
+
+/// The first cell whose drawn status is not the one the engine says its measurements earned, or -1.
+pub fn first_unearned(status: [27]u8, domain: u8, grounded: [27]bool, test_pass: [27]bool, reviewed: [27]bool, live: [27]bool) -> i32 {
+    var c : i32 = 0;
+    while (c < CELL_COUNT) {
+        const i : usize = @intCast(c);
+        if (status[i] != earned_status(@intCast(c), domain, grounded[i], test_pass[i], reviewed[i], live[i])) {
+            return c;
+        }
+        c = c + 1;
+    }
+    return -1;
+}
+
+pub fn statuses_earned(status: [27]u8, domain: u8, grounded: [27]bool, test_pass: [27]bool, reviewed: [27]bool, live: [27]bool) -> bool {
+    return first_unearned(status, domain, grounded, test_pass, reviewed, live) == -1;
+}
+
+/// A gap is named, not blank: a cell is grounded exactly when it has a source, and a cell with no
+/// source says what is missing instead.
+pub fn gaps_are_named(sources: [27]str, missing: [27]str, grounded: [27]bool) -> bool {
+    var c : i32 = 0;
+    while (c < CELL_COUNT) {
+        const i : usize = @intCast(c);
+        const has_source : bool = sources[i].len > 0;
+        const has_missing : bool = missing[i].len > 0;
+        if (grounded[i] != has_source) {
+            return false;
+        }
+        if (has_missing == has_source) {
+            return false;
+        }
+        c = c + 1;
+    }
+    return true;
+}
+
+pub fn row_count(rows: [20]str, scene: i32) -> i32 {
+    var n : i32 = 0;
+    var j : i32 = 0;
+    while (j < MAX_ROWS) {
+        if (rows[@intCast(scene * ROWS_PER_SCENE + j)].len > 0) {
+            n = n + 1;
+        }
+        j = j + 1;
+    }
+    return n;
+}
+
+/// Characters a headline line may hold on this scene's slide, as the host breaks it.
+pub fn head_chars(layout: u8, preset: u8) -> i32 {
+    if (layout == LAYOUT_SPLIT) {
+        return chars_per_line(card_inner_w(preset), HEADLINE_PX[preset], HEADLINE_EM_PERMILLE);
+    }
+    return chars_per_line(region_w(layout, preset, REGION_TITLE), HEADLINE_PX[preset], HEADLINE_EM_PERMILLE);
+}
+
+pub fn row_chars(preset: u8) -> i32 {
+    return chars_per_line(card_inner_w(preset), BODY_PX[preset], BODY_EM_PERMILLE);
+}
+
+/// Every demo slide fits every preset: one headline line the host never breaks, and card rows it
+/// never breaks either. A headline must be one line because the host wraps a title greedily by
+/// words, and only a one-line headline is drawn the same on every preset.
+pub fn slides_fit(head: [5]str, rows: [20]str) -> bool {
+    var s : i32 = 0;
+    while (s < DEMO_COUNT) {
+        const layout : u8 = layout_for(DEMO_KIND[@intCast(s)]);
+        if (head[@intCast(s)].len == 0) {
+            return false;
+        }
+        var p : u8 = 0;
+        while (p < PRESET_COUNT) {
+            if (text_fits(1, row_count(rows, s), layout, p) == false) {
+                return false;
+            }
+            const head_len : i32 = @intCast(head[@intCast(s)].len);
+            if (head_len > head_chars(layout, p)) {
+                return false;
+            }
+            var j : i32 = 0;
+            while (j < MAX_ROWS) {
+                const row_len : i32 = @intCast(rows[@intCast(s * ROWS_PER_SCENE + j)].len);
+                if (row_len > row_chars(p)) {
+                    return false;
+                }
+                j = j + 1;
+            }
+            p = p + 1;
+        }
+        s = s + 1;
+    }
+    return true;
+}
+
+/// A stage slide (title or overview) carries its headline on the strip and no card rows.
+pub fn stage_slides_bare(rows: [20]str) -> bool {
+    var s : i32 = 0;
+    while (s < DEMO_COUNT) {
+        if (layout_for(DEMO_KIND[@intCast(s)]) == LAYOUT_STAGE and row_count(rows, s) > 0) {
+            return false;
+        }
+        s = s + 1;
+    }
+    return true;
+}
+
+/// Fixture: a research map with every cell grounded and nothing else measured. LEARN steps have
+/// their source link and are VERIFIED; PRACTICE and DELIVER ask for a test or a review and stay DRAFT.
+pub const FIX_STATUS : [27]u8 = [4, 4, 4, 3, 3, 3, 3, 3, 3, 4, 4, 4, 3, 3, 3, 3, 3, 3, 4, 4, 4, 3, 3, 3, 3, 3, 3];
+pub const ALL : [27]bool = [true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true];
+pub const NONE : [27]bool = [false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false];
+pub const FIX_HEAD : [5]str = ["Title", "Lens", "Focus", "Evidence", "Next"];
+pub const FIX_ROWS : [20]str = ["", "", "", "", "", "", "", "", "a row", "", "", "", "a row", "a row", "", "", "a row", "", "", ""];
+pub const FIX_LONG : [20]str = ["", "", "", "", "", "", "", "", "a row far too long to sit on one line of the card on any preset at all", "", "", "", "", "", "", "", "", "", "", ""];
+pub const FIX_STAGE_ROW : [20]str = ["a row on the title strip", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", ""];
+
+test counts_are_counts {
+    assert count_true(ALL) == 27;
+    assert count_true(NONE) == 0;
+    assert count_status(FIX_STATUS, STATUS_VERIFIED) == 9;
+    assert count_status(FIX_STATUS, STATUS_DRAFT) == 18;
+    assert count_status(FIX_STATUS, STATUS_GAP) == 0;
+}
+
+test a_drawn_status_must_be_the_earned_one {
+    assert statuses_earned(FIX_STATUS, DOMAIN_RESEARCH, ALL, NONE, NONE, NONE);
+    // one cell drawn better than its measurements: caught, and at that cell
+    var wrong : [27]u8 = FIX_STATUS;
+    wrong[3] = STATUS_VERIFIED;
+    assert statuses_earned(wrong, DOMAIN_RESEARCH, ALL, NONE, NONE, NONE) == false;
+    assert first_unearned(wrong, DOMAIN_RESEARCH, ALL, NONE, NONE, NONE) == 3;
+    // the same drawing is right once a test passes for every cell: PRACTICE turns VERIFIED too
+    assert first_unearned(FIX_STATUS, DOMAIN_RESEARCH, ALL, ALL, NONE, NONE) == 3;
+    // no source anywhere: every cell is a gap, so the fixture is wrong from cell 0
+    assert first_unearned(FIX_STATUS, DOMAIN_RESEARCH, NONE, NONE, NONE, NONE) == 0;
+}
+
+test a_gap_names_what_is_missing {
+    var sources : [27]str = ["s", "s", "s", "s", "s", "s", "s", "s", "s", "s", "s", "s", "s", "s", "s", "s", "s", "s", "s", "s", "s", "s", "s", "s", "s", "s", "s"];
+    var missing : [27]str = ["", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", ""];
+    assert gaps_are_named(sources, missing, ALL);
+    var grounded : [27]bool = ALL;
+    // a gap with nothing said about it is refused
+    sources[5] = "";
+    grounded[5] = false;
+    assert gaps_are_named(sources, missing, grounded) == false;
+    missing[5] = "the run that would ground it";
+    assert gaps_are_named(sources, missing, grounded);
+    // a grounded cell may not also claim to be missing something, nor a sourceless one be grounded
+    missing[6] = "x";
+    assert gaps_are_named(sources, missing, grounded) == false;
+    missing[6] = "";
+    assert gaps_are_named(sources, missing, ALL) == false;
+}
+
+test slide_text_fits_or_is_refused {
+    assert row_count(FIX_ROWS, 2) == 1;
+    assert row_count(FIX_ROWS, 3) == 2;
+    assert slides_fit(FIX_HEAD, FIX_ROWS);
+    assert slides_fit(FIX_HEAD, FIX_LONG) == false;
+    var long_head : [5]str = FIX_HEAD;
+    long_head[0] = "A headline much too long to stay on one line of the title strip";
+    assert slides_fit(long_head, FIX_ROWS) == false;
+    var no_head : [5]str = FIX_HEAD;
+    no_head[4] = "";
+    assert slides_fit(no_head, FIX_ROWS) == false;
+}
+
+test stage_slides_carry_no_card_text {
+    // why a headline is one line: on the wide frame a second stage line would not fit the strip
+    assert text_fits(2, 0, LAYOUT_STAGE, 0) == false;
+    assert stage_slides_bare(FIX_ROWS);
+    assert stage_slides_bare(FIX_STAGE_ROW) == false;
+}
diff --git a/apps/website/public/t27f/graph/specs/ui_plan.t27 b/apps/website/public/t27f/graph/specs/ui_plan.t27
new file mode 100644
index 0000000000..14c1f4566c
--- /dev/null
+++ b/apps/website/public/t27f/graph/specs/ui_plan.t27
@@ -0,0 +1,638 @@
+// SPDX-License-Identifier: Apache-2.0
+; specs/t27f/ui_plan.t27 -- the T27F UI plan: a renderer-neutral IR and the trusted widget catalog
+; it may name (gHashTag/trinity#1648, MVP gHashTag/trinity#1652, tracked in gHashTag/t27#9962).
+; The T27F path is intent -> versioned system description -> solver -> UI plan (this file) ->
+; trusted renderer -> verification loop. A plan is data: widget ids from an allowlist, prop and
+; action ids, data bindings, a grid layout, a theme, accessibility labels and provenance. No field
+; of a plan holds code, markup or a script, so a renderer never evaluates anything a model wrote.
+; Labels, titles and source refs are plain text, drawn as text.
+; What this file decides, deterministically and without a language model:
+;   - the catalog: which widgets exist, which props and actions each accepts, which capabilities
+;     each needs, and which data source kind each binds to;
+;   - validation: validate_plan() returns PLAN_OK or the first rule a plan breaks, and
+;     first_bad_slot() names the widget that broke it;
+;   - that a plan proposed by a model (SOLVER_MODEL) is judged by exactly the same rules as one
+;     built by rules (SOLVER_RULES).
+; Not claimed here: no renderer draws a plan yet (React is the first target), nothing streams, no
+; solver turns an intent into a plan, and nothing is measured against other generative-UI stacks.
+; phi^2 + 1/phi^2 = 3 | TRINITY
+
+module t27f_ui_plan;
+
+/// Versions. A plan names the IR and catalog it was solved against; any other version is refused.
+pub const IR_VERSION : u32 = 1;
+pub const CATALOG_VERSION : u32 = 1;
+
+/// The widget catalog, an allowlist. Id 0 is an empty slot; 1..WIDGET_KINDS-1 are the trusted
+/// widgets a renderer implements. Every other id, and every name not listed, is unknown.
+pub const WIDGET_EMPTY : u8 = 0;
+pub const WIDGET_HONEYCOMB_CARD : u8 = 1;
+pub const WIDGET_FORMULA_VIEW : u8 = 2;
+pub const WIDGET_METRICS_TABLE : u8 = 3;
+pub const WIDGET_RUN_BUTTON : u8 = 4;
+pub const WIDGET_TEXT_BLOCK : u8 = 5;
+pub const WIDGET_KINDS : u8 = 6;
+pub const WIDGET_UNKNOWN : u8 = 255;
+pub const WIDGET_NAMES : [6]str = ["empty", "honeycomb_card", "formula_view", "metrics_table", "run_button", "text_block"];
+
+/// Names a planner may ask for that no trusted renderer implements, ever: each one would run or
+/// inject code the model wrote. The catalog must never contain them (invariant below).
+pub const FORBIDDEN_NAMES : [6]str = ["script", "eval", "html", "iframe", "raw_js", "function"];
+
+/// Props, as bit positions in a widget's prop mask.
+pub const PROP_TITLE : u8 = 0;
+pub const PROP_SPEC_PATH : u8 = 1;
+pub const PROP_FORMULA_ID : u8 = 2;
+pub const PROP_COLUMNS : u8 = 3;
+pub const PROP_UNITS : u8 = 4;
+pub const PROP_CAPTION : u8 = 5;
+pub const PROP_KINDS : u8 = 6;
+
+/// Actions. ACTION_NONE is always allowed; every other action must be in the widget's action mask
+/// and needs its capability granted. RUN_TESTS runs the bound spec's own tests on the lab through
+/// t27c; it never runs text the model wrote.
+pub const ACTION_NONE : u8 = 0;
+pub const ACTION_OPEN_SPEC : u8 = 1;
+pub const ACTION_RUN_TESTS : u8 = 2;
+pub const ACTION_EXPORT_CSV : u8 = 3;
+pub const ACTION_COPY_FORMULA : u8 = 4;
+pub const ACTION_KINDS : u8 = 5;
+
+/// Capabilities, as bit positions in a mask the host grants for one session.
+pub const CAP_READ_SPECS : u8 = 0;
+pub const CAP_READ_METRICS : u8 = 1;
+pub const CAP_RUN_LAB : u8 = 2;
+pub const CAP_EXPORT_LOCAL : u8 = 3;
+pub const CAP_CLIPBOARD : u8 = 4;
+pub const CAP_KINDS : u8 = 5;
+
+/// Data source kinds a plan may declare. A widget binds to one source of its own kind.
+pub const SOURCE_NONE : u8 = 0;
+pub const SOURCE_SPEC : u8 = 1;
+pub const SOURCE_FORMULA : u8 = 2;
+pub const SOURCE_METRICS : u8 = 3;
+pub const SOURCE_KINDS : u8 = 4;
+
+/// Catalog tables, indexed by widget id. Masks are spelled as numbers; the invariant
+/// catalog_masks_are_spelled_right rebuilds each one from the named bits.
+/// Props: card title+spec_path, formula title+formula_id+caption, table title+columns+units+caption,
+/// button title+spec_path, text title+caption.
+pub const WIDGET_PROPS : [6]u32 = [0, 3, 37, 57, 3, 33];
+/// Actions: card open_spec, formula copy_formula, table export_csv, button run_tests, text none.
+pub const WIDGET_ACTIONS : [6]u32 = [0, 2, 16, 8, 4, 0];
+/// Capabilities to show the widget at all: card, formula and button read specs, table reads metrics.
+pub const WIDGET_CAPS : [6]u32 = [0, 1, 1, 2, 1, 0];
+/// The source kind each widget binds to; SOURCE_NONE means it takes no binding.
+pub const WIDGET_SOURCE : [6]u8 = [SOURCE_NONE, SOURCE_SPEC, SOURCE_FORMULA, SOURCE_METRICS, SOURCE_SPEC, SOURCE_NONE];
+/// Capability each action needs, indexed by action id: none, read_specs, run_lab, export_local,
+/// clipboard.
+pub const ACTION_CAPS : [5]u32 = [0, 1, 4, 8, 16];
+
+/// Who produced the plan. Both kinds pass through validate_plan; neither is trusted on its own.
+pub const SOLVER_RULES : u8 = 0;
+pub const SOLVER_MODEL : u8 = 1;
+pub const SOLVER_KINDS : u8 = 2;
+
+pub const THEME_LIGHT : u8 = 0;
+pub const THEME_DARK : u8 = 1;
+pub const THEME_HIGH_CONTRAST : u8 = 2;
+pub const THEME_KINDS : u8 = 3;
+
+/// Layout: a grid of GRID_COLUMNS columns and at most GRID_ROWS rows.
+pub const GRID_COLUMNS : u8 = 12;
+pub const GRID_ROWS : u8 = 8;
+
+/// Plan capacity. Binding 0 means "no binding"; binding k names declared source k (1-based).
+pub const MAX_WIDGETS : u32 = 8;
+pub const MAX_SOURCES : u32 = 4;
+pub const BINDING_NONE : u8 = 0;
+pub const NO_SLOT : u32 = 255;
+
+/// Validation verdicts. validate_plan checks plan-level rules in this order, then each widget slot
+/// in slot order, and returns the first rule broken.
+pub const PLAN_OK : u8 = 0;
+pub const ERR_IR_VERSION : u8 = 1;
+pub const ERR_CATALOG_VERSION : u8 = 2;
+pub const ERR_PROVENANCE : u8 = 3;
+pub const ERR_THEME : u8 = 4;
+pub const ERR_SOURCE : u8 = 5;
+pub const ERR_EMPTY_PLAN : u8 = 6;
+pub const ERR_TOO_MANY_WIDGETS : u8 = 7;
+pub const ERR_UNKNOWN_WIDGET : u8 = 8;
+pub const ERR_PROP_NOT_ALLOWED : u8 = 9;
+pub const ERR_BINDING_MISSING : u8 = 10;
+pub const ERR_BINDING_DANGLING : u8 = 11;
+pub const ERR_BINDING_KIND : u8 = 12;
+pub const ERR_ACTION_NOT_ALLOWED : u8 = 13;
+pub const ERR_CAPABILITY_NOT_GRANTED : u8 = 14;
+pub const ERR_A11Y_LABEL_MISSING : u8 = 15;
+pub const ERR_LAYOUT : u8 = 16;
+
+/// One UI plan. Arrays are indexed by slot (widgets) or by source number minus one (sources); slots
+/// at or past widget_count, and sources at or past source_count, are not read.
+pub struct UiPlan {
+    ir_version: u32,
+    catalog_version: u32,
+    intent: str,
+    solver: u8,
+    theme: u8,
+    title: str,
+    granted: u32,
+    source_count: u32,
+    source_kind: [4]u8,
+    source_ref: [4]str,
+    widget_count: u32,
+    widget: [8]u8,
+    props: [8]u32,
+    binding: [8]u8,
+    action: [8]u8,
+    row: [8]u8,
+    col: [8]u8,
+    span: [8]u8,
+    label: [8]str,
+}
+
+pub fn bit(b: u8) -> u32 {
+    return (1 as u32) << (b as u32);
+}
+
+pub fn has_bit(mask: u32, b: u8) -> bool {
+    return ((mask >> (b as u32)) & 1) == 1;
+}
+
+/// A trusted widget a renderer can draw: in the catalog and not the empty slot.
+pub fn catalog_widget(w: u8) -> bool {
+    return w > WIDGET_EMPTY and w < WIDGET_KINDS;
+}
+
+/// The id of a widget asked for by name, or WIDGET_UNKNOWN. The empty slot cannot be asked for.
+pub fn widget_id(name: str) -> u8 {
+    var i : u32 = 1;
+    while (i < (WIDGET_KINDS as u32)) {
+        if (WIDGET_NAMES[i as usize] == name) { return i as u8; }
+        i = i + 1;
+    }
+    return WIDGET_UNKNOWN;
+}
+
+/// How many forbidden names resolve to a catalog widget. Zero, by invariant.
+pub fn forbidden_in_catalog() -> u32 {
+    var n : u32 = 0;
+    var j : u32 = 0;
+    while (j < 6) {
+        if (widget_id(FORBIDDEN_NAMES[j as usize]) != WIDGET_UNKNOWN) { n = n + 1; }
+        j = j + 1;
+    }
+    return n;
+}
+
+/// A widget is interactive when the catalog gives it any action; it then needs an accessible label.
+pub fn is_interactive(w: u8) -> bool {
+    if (catalog_widget(w) == false) { return false; }
+    return WIDGET_ACTIONS[w as usize] != 0;
+}
+
+/// Every set prop bit is one the widget allows.
+pub fn props_allowed(w: u8, props: u32) -> bool {
+    return (props & WIDGET_PROPS[w as usize]) == props;
+}
+
+pub fn action_in_catalog(w: u8, a: u8) -> bool {
+    if (a == ACTION_NONE) { return true; }
+    if (a >= ACTION_KINDS) { return false; }
+    return has_bit(WIDGET_ACTIONS[w as usize], a);
+}
+
+/// Every capability in `need` is in `granted`.
+pub fn caps_granted(granted: u32, need: u32) -> bool {
+    return (need & granted) == need;
+}
+
+/// Two spans [c1, c1 + s1) and [c2, c2 + s2) on one row share a column.
+pub fn spans_overlap(c1: u8, s1: u8, c2: u8, s2: u8) -> bool {
+    return (c1 as u32) < (c2 as u32) + (s2 as u32) and (c2 as u32) < (c1 as u32) + (s1 as u32);
+}
+
+/// The rules one widget slot must meet, in order: known widget, allowed props, a binding of its
+/// own kind to a declared source, an allowed and granted action, its own capabilities, a label
+/// when it is interactive, and a place on the grid that no earlier slot holds.
+pub fn validate_widget(p: UiPlan, slot: u32) -> u8 {
+    let k : usize = slot as usize;
+    let w : u8 = p.widget[k];
+    if (catalog_widget(w) == false) { return ERR_UNKNOWN_WIDGET; }
+    if (props_allowed(w, p.props[k]) == false) { return ERR_PROP_NOT_ALLOWED; }
+    let want : u8 = WIDGET_SOURCE[w as usize];
+    let b : u8 = p.binding[k];
+    if (want == SOURCE_NONE) {
+        if (b != BINDING_NONE) { return ERR_BINDING_KIND; }
+    } else {
+        if (b == BINDING_NONE) { return ERR_BINDING_MISSING; }
+        if ((b as u32) > p.source_count) { return ERR_BINDING_DANGLING; }
+        if (p.source_kind[(b - 1) as usize] != want) { return ERR_BINDING_KIND; }
+    }
+    let a : u8 = p.action[k];
+    if (action_in_catalog(w, a) == false) { return ERR_ACTION_NOT_ALLOWED; }
+    if (caps_granted(p.granted, ACTION_CAPS[a as usize]) == false) { return ERR_CAPABILITY_NOT_GRANTED; }
+    if (caps_granted(p.granted, WIDGET_CAPS[w as usize]) == false) { return ERR_CAPABILITY_NOT_GRANTED; }
+    if (is_interactive(w) and p.label[k] == "") { return ERR_A11Y_LABEL_MISSING; }
+    if (p.span[k] == 0) { return ERR_LAYOUT; }
+    if ((p.col[k] as u32) + (p.span[k] as u32) > (GRID_COLUMNS as u32)) { return ERR_LAYOUT; }
+    if (p.row[k] >= GRID_ROWS) { return ERR_LAYOUT; }
+    var j : u32 = 0;
+    while (j < slot) {
+        let m : usize = j as usize;
+        if (p.row[m] == p.row[k] and spans_overlap(p.col[m], p.span[m], p.col[k], p.span[k])) { return ERR_LAYOUT; }
+        j = j + 1;
+    }
+    return PLAN_OK;
+}
+
+/// Plan-level rules, before any widget is read.
+pub fn validate_header(p: UiPlan) -> u8 {
+    if (p.ir_version != IR_VERSION) { return ERR_IR_VERSION; }
+    if (p.catalog_version != CATALOG_VERSION) { return ERR_CATALOG_VERSION; }
+    if (p.intent == "" or p.solver >= SOLVER_KINDS) { return ERR_PROVENANCE; }
+    if (p.theme >= THEME_KINDS) { return ERR_THEME; }
+    if (p.source_count > MAX_SOURCES) { return ERR_SOURCE; }
+    var i : u32 = 0;
+    while (i < p.source_count and i < MAX_SOURCES) {
+        let s : u8 = p.source_kind[i as usize];
+        if (s == SOURCE_NONE or s >= SOURCE_KINDS or p.source_ref[i as usize] == "") { return ERR_SOURCE; }
+        i = i + 1;
+    }
+    if (p.widget_count == 0) { return ERR_EMPTY_PLAN; }
+    if (p.widget_count > MAX_WIDGETS) { return ERR_TOO_MANY_WIDGETS; }
+    // the workspace itself is a landmark and needs an accessible name
+    if (p.title == "") { return ERR_A11Y_LABEL_MISSING; }
+    return PLAN_OK;
+}
+
+/// PLAN_OK, or the first rule the plan breaks.
+pub fn validate_plan(p: UiPlan) -> u8 {
+    let h : u8 = validate_header(p);
+    if (h != PLAN_OK) { return h; }
+    var i : u32 = 0;
+    while (i < p.widget_count and i < MAX_WIDGETS) {
+        let e : u8 = validate_widget(p, i);
+        if (e != PLAN_OK) { return e; }
+        i = i + 1;
+    }
+    return PLAN_OK;
+}
+
+/// The slot of the first widget that breaks a rule, or NO_SLOT when the header fails or nothing does.
+pub fn first_bad_slot(p: UiPlan) -> u32 {
+    if (validate_header(p) != PLAN_OK) { return NO_SLOT; }
+    var i : u32 = 0;
+    while (i < p.widget_count and i < MAX_WIDGETS) {
+        if (validate_widget(p, i) != PLAN_OK) { return i; }
+        i = i + 1;
+    }
+    return NO_SLOT;
+}
+
+pub fn interactive_count(p: UiPlan) -> u32 {
+    var n : u32 = 0;
+    var i : u32 = 0;
+    while (i < p.widget_count and i < MAX_WIDGETS) {
+        if (is_interactive(p.widget[i as usize])) { n = n + 1; }
+        i = i + 1;
+    }
+    return n;
+}
+
+/// An empty plan of the current versions: no sources, no widgets, nothing granted.
+pub fn blank_plan() -> UiPlan {
+    return UiPlan { ir_version: IR_VERSION, catalog_version: CATALOG_VERSION, intent: "", solver: SOLVER_RULES, theme: THEME_LIGHT, title: "", granted: 0, source_count: 0, source_kind: [0; 4], source_ref: ["", "", "", ""], widget_count: 0, widget: [0; 8], props: [0; 8], binding: [0; 8], action: [0; 8], row: [0; 8], col: [0; 8], span: [0; 8], label: ["", "", "", "", "", "", "", ""] };
+}
+
+/// The fixture: a GF16 research workspace. Row 0 holds the spec honeycomb card and the formula
+/// view side by side; row 1 the metrics table and the run button. Every source ref is a file in
+/// this repository.
+pub fn gf16_workspace() -> UiPlan {
+    var p : UiPlan = blank_plan();
+    p.intent = "Compare GF16 against bf16 on the conformance vectors";
+    p.theme = THEME_DARK;
+    p.title = "GF16 research workspace";
+    p.granted = bit(CAP_READ_SPECS) | bit(CAP_READ_METRICS) | bit(CAP_RUN_LAB) | bit(CAP_CLIPBOARD);
+    p.source_count = 3;
+    p.source_kind[0] = SOURCE_SPEC;
+    p.source_ref[0] = "specs/numeric/gf16.t27";
+    p.source_kind[1] = SOURCE_FORMULA;
+    p.source_ref[1] = "specs/numeric/gf16.t27#gf16_decode_to_f32";
+    p.source_kind[2] = SOURCE_METRICS;
+    p.source_ref[2] = "conformance/gf16_bench_results.json";
+    p.widget_count = 4;
+    // slot 0: the spec honeycomb card, bound to the spec, opens it
+    p.widget[0] = WIDGET_HONEYCOMB_CARD;
+    p.props[0] = bit(PROP_TITLE) | bit(PROP_SPEC_PATH);
+    p.binding[0] = 1;
+    p.action[0] = ACTION_OPEN_SPEC;
+    p.row[0] = 0;
+    p.col[0] = 0;
+    p.span[0] = 6;
+    p.label[0] = "GF16 spec card";
+    // slot 1: the formula view, bound to the decode formula, copies it
+    p.widget[1] = WIDGET_FORMULA_VIEW;
+    p.props[1] = bit(PROP_TITLE) | bit(PROP_FORMULA_ID) | bit(PROP_CAPTION);
+    p.binding[1] = 2;
+    p.action[1] = ACTION_COPY_FORMULA;
+    p.row[1] = 0;
+    p.col[1] = 6;
+    p.span[1] = 6;
+    p.label[1] = "GF16 decode formula";
+    // slot 2: the metrics table, bound to the bench results, read only here
+    p.widget[2] = WIDGET_METRICS_TABLE;
+    p.props[2] = bit(PROP_TITLE) | bit(PROP_COLUMNS) | bit(PROP_UNITS);
+    p.binding[2] = 3;
+    p.action[2] = ACTION_NONE;
+    p.row[2] = 1;
+    p.col[2] = 0;
+    p.span[2] = 9;
+    p.label[2] = "GF16 versus bf16 metrics";
+    // slot 3: the run button, bound to the spec, runs its tests on the lab
+    p.widget[3] = WIDGET_RUN_BUTTON;
+    p.props[3] = bit(PROP_TITLE) | bit(PROP_SPEC_PATH);
+    p.binding[3] = 1;
+    p.action[3] = ACTION_RUN_TESTS;
+    p.row[3] = 1;
+    p.col[3] = 9;
+    p.span[3] = 3;
+    p.label[3] = "Run GF16 spec tests";
+    return p;
+}
+
+/// Malformed plans. Each changes the fixture in one place and must be rejected for that reason.
+pub fn bad_unknown_widget() -> UiPlan {
+    var p : UiPlan = gf16_workspace();
+    p.widget[1] = 200;
+    return p;
+}
+
+/// A planner asks for an "eval" widget by name; the name resolves to WIDGET_UNKNOWN.
+pub fn bad_eval_widget() -> UiPlan {
+    var p : UiPlan = gf16_workspace();
+    p.widget[3] = widget_id("eval");
+    return p;
+}
+
+pub fn bad_dangling_binding() -> UiPlan {
+    var p : UiPlan = gf16_workspace();
+    p.binding[2] = 4;
+    return p;
+}
+
+pub fn bad_binding_kind() -> UiPlan {
+    var p : UiPlan = gf16_workspace();
+    p.binding[2] = 2;
+    return p;
+}
+
+pub fn bad_missing_binding() -> UiPlan {
+    var p : UiPlan = gf16_workspace();
+    p.binding[0] = BINDING_NONE;
+    return p;
+}
+
+pub fn bad_action_not_allowed() -> UiPlan {
+    var p : UiPlan = gf16_workspace();
+    p.action[1] = ACTION_RUN_TESTS;
+    return p;
+}
+
+pub fn bad_run_without_lab() -> UiPlan {
+    var p : UiPlan = gf16_workspace();
+    p.granted = bit(CAP_READ_SPECS) | bit(CAP_READ_METRICS) | bit(CAP_CLIPBOARD);
+    return p;
+}
+
+pub fn bad_unlabelled_button() -> UiPlan {
+    var p : UiPlan = gf16_workspace();
+    p.label[3] = "";
+    return p;
+}
+
+pub fn bad_prop_not_allowed() -> UiPlan {
+    var p : UiPlan = gf16_workspace();
+    p.props[3] = p.props[3] | bit(PROP_COLUMNS);
+    return p;
+}
+
+pub fn bad_overlap() -> UiPlan {
+    var p : UiPlan = gf16_workspace();
+    p.col[3] = 8;
+    return p;
+}
+
+test catalog_is_an_allowlist {
+    assert widget_id("honeycomb_card") == WIDGET_HONEYCOMB_CARD;
+    assert widget_id("formula_view") == WIDGET_FORMULA_VIEW;
+    assert widget_id("metrics_table") == WIDGET_METRICS_TABLE;
+    assert widget_id("run_button") == WIDGET_RUN_BUTTON;
+    assert widget_id("text_block") == WIDGET_TEXT_BLOCK;
+    // the empty slot is not a widget anyone can ask for
+    assert widget_id("empty") == WIDGET_UNKNOWN;
+    assert widget_id("script") == WIDGET_UNKNOWN;
+    assert widget_id("eval") == WIDGET_UNKNOWN;
+    assert widget_id("iframe") == WIDGET_UNKNOWN;
+    assert widget_id("Run_Button") == WIDGET_UNKNOWN;
+    assert catalog_widget(WIDGET_EMPTY) == false;
+    assert catalog_widget(WIDGET_TEXT_BLOCK);
+    assert catalog_widget(WIDGET_KINDS) == false;
+    assert catalog_widget(WIDGET_UNKNOWN) == false;
+}
+
+test gf16_workspace_is_valid {
+    let p : UiPlan = gf16_workspace();
+    assert validate_plan(p) == PLAN_OK;
+    assert first_bad_slot(p) == NO_SLOT;
+    assert p.widget_count == 4;
+    assert interactive_count(p) == 4;
+    assert p.source_kind[(p.binding[0] - 1) as usize] == SOURCE_SPEC;
+    assert p.source_kind[(p.binding[1] - 1) as usize] == SOURCE_FORMULA;
+    assert p.source_kind[(p.binding[2] - 1) as usize] == SOURCE_METRICS;
+    assert p.source_kind[(p.binding[3] - 1) as usize] == SOURCE_SPEC;
+    // a model-proposed plan passes the same gate, no more and no less
+    var m : UiPlan = gf16_workspace();
+    m.solver = SOLVER_MODEL;
+    assert validate_plan(m) == PLAN_OK;
+}
+
+test unknown_widget_is_rejected {
+    assert validate_plan(bad_unknown_widget()) == ERR_UNKNOWN_WIDGET;
+    assert first_bad_slot(bad_unknown_widget()) == 1;
+    assert validate_plan(bad_eval_widget()) == ERR_UNKNOWN_WIDGET;
+    assert first_bad_slot(bad_eval_widget()) == 3;
+    // an empty slot inside widget_count is a hole, not a widget
+    var p : UiPlan = gf16_workspace();
+    p.widget[2] = WIDGET_EMPTY;
+    assert validate_plan(p) == ERR_UNKNOWN_WIDGET;
+    assert first_bad_slot(p) == 2;
+}
+
+test binding_must_name_a_declared_source {
+    assert validate_plan(bad_dangling_binding()) == ERR_BINDING_DANGLING;
+    assert first_bad_slot(bad_dangling_binding()) == 2;
+    assert validate_plan(bad_binding_kind()) == ERR_BINDING_KIND;
+    assert validate_plan(bad_missing_binding()) == ERR_BINDING_MISSING;
+    assert first_bad_slot(bad_missing_binding()) == 0;
+    // a source slot past source_count is not declared, even if it is filled in
+    var p : UiPlan = gf16_workspace();
+    p.source_count = 2;
+    assert validate_plan(p) == ERR_BINDING_DANGLING;
+    // a widget that takes no binding may not carry one
+    var t : UiPlan = gf16_workspace();
+    t.widget_count = 5;
+    t.widget[4] = WIDGET_TEXT_BLOCK;
+    t.row[4] = 2;
+    t.span[4] = 12;
+    assert validate_plan(t) == PLAN_OK;
+    t.binding[4] = 1;
+    assert validate_plan(t) == ERR_BINDING_KIND;
+    // a declared source with no ref is refused before any widget is read
+    var s : UiPlan = gf16_workspace();
+    s.source_ref[2] = "";
+    assert validate_plan(s) == ERR_SOURCE;
+    assert first_bad_slot(s) == NO_SLOT;
+}
+
+test action_must_be_allowed_and_granted {
+    assert validate_plan(bad_action_not_allowed()) == ERR_ACTION_NOT_ALLOWED;
+    assert first_bad_slot(bad_action_not_allowed()) == 1;
+    assert validate_plan(bad_run_without_lab()) == ERR_CAPABILITY_NOT_GRANTED;
+    assert first_bad_slot(bad_run_without_lab()) == 3;
+    // export is in the table's catalog entry, but its capability is not granted in the fixture
+    var e : UiPlan = gf16_workspace();
+    e.action[2] = ACTION_EXPORT_CSV;
+    assert validate_plan(e) == ERR_CAPABILITY_NOT_GRANTED;
+    e.granted = e.granted | bit(CAP_EXPORT_LOCAL);
+    assert validate_plan(e) == PLAN_OK;
+    // an action id past the catalog is not allowed anywhere
+    var x : UiPlan = gf16_workspace();
+    x.action[0] = ACTION_KINDS;
+    assert validate_plan(x) == ERR_ACTION_NOT_ALLOWED;
+    // showing the metrics table at all needs read_metrics
+    var r : UiPlan = gf16_workspace();
+    r.granted = bit(CAP_READ_SPECS) | bit(CAP_RUN_LAB) | bit(CAP_CLIPBOARD);
+    assert validate_plan(r) == ERR_CAPABILITY_NOT_GRANTED;
+    assert first_bad_slot(r) == 2;
+}
+
+test interactive_widgets_need_a_label {
+    assert validate_plan(bad_unlabelled_button()) == ERR_A11Y_LABEL_MISSING;
+    assert first_bad_slot(bad_unlabelled_button()) == 3;
+    assert is_interactive(WIDGET_RUN_BUTTON);
+    assert is_interactive(WIDGET_TEXT_BLOCK) == false;
+    assert is_interactive(WIDGET_UNKNOWN) == false;
+    // a text block is not interactive and may go without a label
+    var t : UiPlan = gf16_workspace();
+    t.widget_count = 5;
+    t.widget[4] = WIDGET_TEXT_BLOCK;
+    t.props[4] = bit(PROP_CAPTION);
+    t.row[4] = 2;
+    t.span[4] = 12;
+    assert validate_plan(t) == PLAN_OK;
+    assert interactive_count(t) == 4;
+    // the workspace itself needs an accessible name
+    var w : UiPlan = gf16_workspace();
+    w.title = "";
+    assert validate_plan(w) == ERR_A11Y_LABEL_MISSING;
+    assert first_bad_slot(w) == NO_SLOT;
+}
+
+test props_are_allowlisted {
+    assert validate_plan(bad_prop_not_allowed()) == ERR_PROP_NOT_ALLOWED;
+    assert first_bad_slot(bad_prop_not_allowed()) == 3;
+    assert props_allowed(WIDGET_METRICS_TABLE, bit(PROP_COLUMNS));
+    assert props_allowed(WIDGET_RUN_BUTTON, bit(PROP_COLUMNS)) == false;
+    // a bit past the last prop is never allowed
+    assert props_allowed(WIDGET_METRICS_TABLE, bit(PROP_KINDS)) == false;
+    assert props_allowed(WIDGET_EMPTY, 0);
+}
+
+test layout_fits_the_grid {
+    assert validate_plan(bad_overlap()) == ERR_LAYOUT;
+    assert first_bad_slot(bad_overlap()) == 3;
+    var o : UiPlan = gf16_workspace();
+    o.span[3] = 4;
+    assert validate_plan(o) == ERR_LAYOUT;
+    var z : UiPlan = gf16_workspace();
+    z.span[0] = 0;
+    assert validate_plan(z) == ERR_LAYOUT;
+    var r : UiPlan = gf16_workspace();
+    r.row[3] = GRID_ROWS;
+    assert validate_plan(r) == ERR_LAYOUT;
+    // touching spans do not overlap; one column more does
+    assert spans_overlap(0, 6, 6, 6) == false;
+    assert spans_overlap(0, 7, 6, 6);
+    assert spans_overlap(9, 3, 0, 9) == false;
+}
+
+test header_rules_come_first {
+    var v : UiPlan = gf16_workspace();
+    v.ir_version = IR_VERSION + 1;
+    assert validate_plan(v) == ERR_IR_VERSION;
+    var c : UiPlan = gf16_workspace();
+    c.catalog_version = 0;
+    assert validate_plan(c) == ERR_CATALOG_VERSION;
+    var i : UiPlan = gf16_workspace();
+    i.intent = "";
+    assert validate_plan(i) == ERR_PROVENANCE;
+    var s : UiPlan = gf16_workspace();
+    s.solver = SOLVER_KINDS;
+    assert validate_plan(s) == ERR_PROVENANCE;
+    var t : UiPlan = gf16_workspace();
+    t.theme = THEME_KINDS;
+    assert validate_plan(t) == ERR_THEME;
+    assert validate_plan(blank_plan()) == ERR_PROVENANCE;
+    var e : UiPlan = gf16_workspace();
+    e.widget_count = 0;
+    assert validate_plan(e) == ERR_EMPTY_PLAN;
+    e.widget_count = MAX_WIDGETS + 1;
+    assert validate_plan(e) == ERR_TOO_MANY_WIDGETS;
+    // two defects: the header one is reported, then the earlier slot
+    var d : UiPlan = bad_unlabelled_button();
+    d.widget[1] = 200;
+    assert validate_plan(d) == ERR_UNKNOWN_WIDGET;
+    assert first_bad_slot(d) == 1;
+    d.theme = THEME_KINDS;
+    assert validate_plan(d) == ERR_THEME;
+}
+
+invariant no_script_widget_in_catalog {
+    assert forbidden_in_catalog() == 0;
+}
+
+invariant catalog_masks_are_spelled_right {
+    assert WIDGET_PROPS[1] == bit(PROP_TITLE) | bit(PROP_SPEC_PATH);
+    assert WIDGET_PROPS[2] == bit(PROP_TITLE) | bit(PROP_FORMULA_ID) | bit(PROP_CAPTION);
+    assert WIDGET_PROPS[3] == bit(PROP_TITLE) | bit(PROP_COLUMNS) | bit(PROP_UNITS) | bit(PROP_CAPTION);
+    assert WIDGET_PROPS[4] == bit(PROP_TITLE) | bit(PROP_SPEC_PATH);
+    assert WIDGET_PROPS[5] == bit(PROP_TITLE) | bit(PROP_CAPTION);
+    assert WIDGET_ACTIONS[1] == bit(ACTION_OPEN_SPEC);
+    assert WIDGET_ACTIONS[2] == bit(ACTION_COPY_FORMULA);
+    assert WIDGET_ACTIONS[3] == bit(ACTION_EXPORT_CSV);
+    assert WIDGET_ACTIONS[4] == bit(ACTION_RUN_TESTS);
+    assert WIDGET_CAPS[1] == bit(CAP_READ_SPECS);
+    assert WIDGET_CAPS[3] == bit(CAP_READ_METRICS);
+    assert ACTION_CAPS[ACTION_OPEN_SPEC] == bit(CAP_READ_SPECS);
+    assert ACTION_CAPS[ACTION_RUN_TESTS] == bit(CAP_RUN_LAB);
+    assert ACTION_CAPS[ACTION_EXPORT_CSV] == bit(CAP_EXPORT_LOCAL);
+    assert ACTION_CAPS[ACTION_COPY_FORMULA] == bit(CAP_CLIPBOARD);
+}
+
+invariant empty_slot_is_inert {
+    assert WIDGET_PROPS[WIDGET_EMPTY] == 0;
+    assert WIDGET_ACTIONS[WIDGET_EMPTY] == 0;
+    assert WIDGET_CAPS[WIDGET_EMPTY] == 0;
+    assert WIDGET_SOURCE[WIDGET_EMPTY] == SOURCE_NONE;
+    assert ACTION_CAPS[ACTION_NONE] == 0;
+}
+
+invariant reserved_ids_stay_outside {
+    assert WIDGET_UNKNOWN >= WIDGET_KINDS;
+    assert MAX_WIDGETS <= 8;
+    assert MAX_SOURCES <= 4;
+    assert (PROP_KINDS as u32) < 32;
+    assert (CAP_KINDS as u32) < 32;
+}
diff --git a/apps/website/public/t27f/graph/t27f.wasm b/apps/website/public/t27f/graph/t27f.wasm
new file mode 100644
index 0000000000..34c41b5bdb
Binary files /dev/null and b/apps/website/public/t27f/graph/t27f.wasm differ