From 4de8af4a6e5521c8ff78bb3e6b269b79002fa5a3 Mon Sep 17 00:00:00 2001
From: Dmitrii Vasilev <admin@t27.ai>
Date: Sun, 18 Oct 2026 11:04:13 +0700
Subject: [PATCH] feat(website): /t27f/graph/ draws the T27F graph view of a
 .t27 spec

One box per node and one line per edge of a .t27 spec, read from the spec's
bytes by specs/t27f/spec_graph_export.t27 and placed, sized and coloured by
specs/t27f/spec_graph_view.t27, both running as t27f.wasm. A spec picker over
tutorial 08 and eight t27f specs; a spec over 192 nodes or 254 edges shows the
exporter's refusal and nothing is drawn. graph.js is 39 lines of glue.
PROVENANCE.txt records the t27 commit, compiler, checksums and rebuild.

Refs #1648

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 apps/website/README.md                        |   10 +
 apps/website/public/t27f/graph/PROVENANCE.txt |   46 +
 apps/website/public/t27f/graph/graph.js       |   39 +
 apps/website/public/t27f/graph/index.html     |   33 +
 .../public/t27f/graph/spec_graph_view.mjs     |  182 +++
 .../graph/specs/08_modules_and_arrays.t27     |   93 ++
 .../website/public/t27f/graph/specs/quest.t27 |  360 ++++++
 .../t27f/graph/specs/reel_gf16_nmse.t27       |  349 ++++++
 .../t27f/graph/specs/reel_t27_basics.t27      |  212 ++++
 .../public/t27f/graph/specs/spec_graph.t27    | 1072 +++++++++++++++++
 .../t27f/graph/specs/spec_graph_export.t27    |  971 +++++++++++++++
 .../t27f/graph/specs/spec_graph_view.t27      |  800 ++++++++++++
 .../public/t27f/graph/specs/topic_reel.t27    |  241 ++++
 .../public/t27f/graph/specs/ui_plan.t27       |  638 ++++++++++
 apps/website/public/t27f/graph/t27f.wasm      |  Bin 0 -> 38321 bytes
 15 files changed, 5046 insertions(+)
 create mode 100644 apps/website/public/t27f/graph/PROVENANCE.txt
 create mode 100644 apps/website/public/t27f/graph/graph.js
 create mode 100644 apps/website/public/t27f/graph/index.html
 create mode 100644 apps/website/public/t27f/graph/spec_graph_view.mjs
 create mode 100644 apps/website/public/t27f/graph/specs/08_modules_and_arrays.t27
 create mode 100644 apps/website/public/t27f/graph/specs/quest.t27
 create mode 100644 apps/website/public/t27f/graph/specs/reel_gf16_nmse.t27
 create mode 100644 apps/website/public/t27f/graph/specs/reel_t27_basics.t27
 create mode 100644 apps/website/public/t27f/graph/specs/spec_graph.t27
 create mode 100644 apps/website/public/t27f/graph/specs/spec_graph_export.t27
 create mode 100644 apps/website/public/t27f/graph/specs/spec_graph_view.t27
 create mode 100644 apps/website/public/t27f/graph/specs/topic_reel.t27
 create mode 100644 apps/website/public/t27f/graph/specs/ui_plan.t27
 create mode 100644 apps/website/public/t27f/graph/t27f.wasm

diff --git a/apps/website/README.md b/apps/website/README.md
index 1f7ec8a8bd..73d595b745 100644
--- a/apps/website/README.md
+++ b/apps/website/README.md
@@ -236,6 +236,16 @@ npm run check:discovery                                                 # кон
 коммитит свои числа. Публикация на t27.ai остаётся за `deploy-site.yml` — вручную,
 по правилу «контент утверждается до выхода».
 
+### T27F graph view (`/t27f/graph/`)
+
+A static page, `public/t27f/graph/`, that draws the T27F graph of a `.t27` spec: one box per node,
+one line per edge, labelled with kind, name, source lines and inference label. The graph comes from
+`specs/t27f/spec_graph_export.t27` and the layout from `specs/t27f/spec_graph_view.t27`, both
+compiled to `t27f.wasm`; `graph.js` is only the glue (loads the wasm, feeds the bytes, emits SVG).
+A spec over the graph's cap (192 nodes, 254 edges) is refused with the verdict, never truncated.
+`PROVENANCE.txt` in that directory records the t27 commit, the compiler, the checksums and how to
+rebuild. To add a spec to the picker, copy it from t27 into `specs/` there and add an `<option>`.
+
 ### Проверки
 
 ```bash
diff --git a/apps/website/public/t27f/graph/PROVENANCE.txt b/apps/website/public/t27f/graph/PROVENANCE.txt
new file mode 100644
index 0000000000..b9ce341dd8
--- /dev/null
+++ b/apps/website/public/t27f/graph/PROVENANCE.txt
@@ -0,0 +1,46 @@
+/t27f/graph/ -- where every byte on the page comes from
+=======================================================
+
+The T27F graph view (epic gHashTag/trinity#1648, RFC gHashTag/trinity#1649). The page draws one
+box per node and one line per edge of a .t27 spec. It holds no graph, no layout and no verdict
+of its own:
+
+  spec_graph_export.t27   reads the spec's bytes into the graph (exact nodes and edges only;
+                          at most 192 nodes and 254 edges; over that it refuses, never truncates)
+  spec_graph_view.t27     places, sizes and colours every box and line
+  spec_graph.t27          the graph IR both of them share
+
+Both run as t27f.wasm. graph.js (39 lines, comments included) is the whole of the hand-written
+JavaScript: it loads the wasm, writes the spec's bytes in, loops over nodes and edges and emits
+SVG. The one number it computes is how many characters of "kind name" fit in a box's first line
+(font size x 0.6); the full text is in the box's tooltip.
+
+Source
+  gHashTag/t27 master 290ff17df, specs/t27f/ and specs/tutorial/08_modules_and_arrays.t27
+  (specs/*.t27 here are byte-identical to that commit)
+Compiler
+  t27c 0.5.2 (built from gHashTag/t27 90fc25b3b), zig 0.16.0, on the Railway lab
+Built in
+  gHashTag/t27-mcp wasm/ (export.zig is the hand glue: byte buffers and getters, no spec
+  knowledge), PR gHashTag/t27-mcp#13, commit 72ecc84. wasm/BUILD there has the full recipe.
+
+Checksums (sha256)
+  t27f.wasm              eaa97ac361cb2b7ebadacf0c7a33f6daaabf7b547df1f00353900dfd3e7c44e1
+  spec_graph_view.mjs    739118fa01cf501bdb3eab925ef9404873230a82907faf5e6e44c006e206c962
+  generated Zig the wasm is built from, not vendored:
+    spec_graph_view.zig    191d55d9bb54d57017943a1903790e4661dfd237dfe507804cef3fcdfab33c19
+    spec_graph_export.zig  5297308f1d54c2688801995d56db402809fc794a7dbe5f28ad119c5b3593ede7
+  specs/spec_graph.t27         a3dbe0ec5110c48183ebea101109598e8542bb0ffdf9e061c672162d7da03fe7
+  specs/spec_graph_view.t27    22579bc98aecb3c4405991eef8b5060eb4151b17b200dfbae07a75d8b1e8547a
+  specs/spec_graph_export.t27  ef4ee24d5debc51be4a10835947c86a0211b867dd6ca97890a15198daa744728
+  specs/ui_plan.t27            383fdfb78aa13f2e48172a20e9863d91aa5147b63b1685be8e3a40667243a3f1
+
+Reproduced on the Railway lab on 2026-10-18 from these vendored specs:
+  t27c gen-js spec_graph_view.t27 gives spec_graph_view.mjs byte for byte;
+  t27c gen spec_graph_view.t27 and spec_graph_export.t27 give the two .zig above;
+  zig build-exe export.zig -target wasm32-freestanding -fno-entry -rdynamic -O ReleaseSmall
+  -femit-bin=t27f.wasm gives t27f.wasm byte for byte.
+(Generate from a directory laid out as specs/t27f/, so that the `use t27f::...` lines resolve.)
+
+Not here yet: derived edges (calls inferred beyond what the exporter reads exactly). Every edge
+on the page is exact, and the page says so.
diff --git a/apps/website/public/t27f/graph/graph.js b/apps/website/public/t27f/graph/graph.js
new file mode 100644
index 0000000000..1eac7aec68
--- /dev/null
+++ b/apps/website/public/t27f/graph/graph.js
@@ -0,0 +1,39 @@
+// Thin glue for /t27f/graph/. The exporter and the layout run in t27f.wasm (specs/t27f/spec_graph_export.t27
+// and spec_graph_view.t27); this file moves a spec's bytes in, reads boxes and lines out and emits SVG. It
+// decides no node, edge, span, position, size, colour or verdict. See PROVENANCE.txt.
+import * as G from './spec_graph_view.mjs'
+const $ = (id) => document.getElementById(id), hex = (c) => `#${c.toString(16).padStart(6, '0')}`
+const nm = (p, v) => Object.keys(G).find((c) => c.startsWith(p) && !c.endsWith('KINDS') && G[c] === v)?.slice(p.length).toLowerCase() ?? String(v)
+const R = (await WebAssembly.instantiateStreaming(fetch('./t27f.wasm'), {})).instance.exports
+const dec = new TextDecoder(), enc = new TextEncoder()
+const name = (i) => dec.decode(new Uint8Array(R.memory.buffer, R.gx_node_name_ptr(i), R.gx_node_name_len(i)))
+const el = (tag, a, ...kids) => { const e = document.createElementNS('http://www.w3.org/2000/svg', tag); for (const k in a) e.setAttribute(k, a[k]); e.append(...kids); return e }
+const dash = (d) => (d ? { 'stroke-dasharray': d } : {})
+
+async function show(path, file) {
+  const out = $('graph'), status = $('status'), body = enc.encode(await (await fetch(`./specs/${file}`)).text()), p = enc.encode(path)
+  out.replaceChildren(); status.className = ''
+  if (!R.gx_set_len(body.length) || !R.gx_set_path_len(p.length)) return (status.textContent = `${path}: too large for the exporter's buffers; nothing drawn.`, status.className = 'refused')
+  new Uint8Array(R.memory.buffer).set(body, R.gx_src_ptr()); new Uint8Array(R.memory.buffer).set(p, R.gx_path_ptr())
+  const v = R.gx_load()
+  if (v !== G.GRAPH_OK) { // refused, never truncated
+    const why = v === G.ERR_TOO_MANY_NODES ? `${R.gx_node_count()} nodes found, at most ${G.MAX_NODES}` : v === G.ERR_TOO_MANY_EDGES ? `${R.gx_edge_count()} edges found, at most ${G.MAX_EDGES}` : `verdict ${v}`
+    return (status.textContent = `${path}: refused, ${nm('ERR_', v).replace(/_/g, ' ')} (${why}). No graph is drawn and none is truncated.`, status.className = 'refused')
+  }
+  if (R.gx_view_verdict() !== G.VIEW_OK) return (status.textContent = `${path}: the view refuses it, verdict ${R.gx_view_verdict()}.`, status.className = 'refused')
+  const W = R.gx_view_width(), H = R.gx_view_height(), svg = el('svg', { viewBox: `0 0 ${W} ${H}`, width: W, height: H, 'font-family': 'system-ui,sans-serif' }, el('rect', { width: W, height: H, fill: hex(G.VIEW_BACKDROP) }))
+  for (let j = 0; j < R.gx_edge_count(); j++)
+    svg.append(el('line', { x1: R.gx_view_edge_x1(j), y1: R.gx_view_edge_y1(j), x2: R.gx_view_edge_x2(j), y2: R.gx_view_edge_y2(j), stroke: hex(R.gx_view_edge_stroke(j)), 'stroke-width': 1.5, ...dash(R.gx_view_edge_dash(j)) },
+      el('title', {}, `${nm('EDGE_', R.gx_edge_kind(j))}: ${name(R.gx_edge_from(j))} -> ${name(R.gx_edge_to(j))}, line ${R.gx_edge_line(j)}`)))
+  for (let i = 0; i < R.gx_node_count(); i++) {
+    const x = R.gx_view_node_x(i), y = R.gx_view_node_y(i), w = R.gx_view_node_w(i), a = R.gx_line_start(i), b = R.gx_line_end(i), px = G.VIEW_FONT_PX
+    const l1 = `${nm('NODE_', R.gx_node_kind(i))} ${name(i)}`, l2 = `${nm('LABEL_', R.gx_node_label(i))} - L${a}${b > a ? `-${b}` : ''}`, fit = Math.floor((w - 16) / (px * 0.6))
+    const t = (dy, s) => el('text', { x: x + 8, y: y + dy, 'font-size': px, fill: hex(G.VIEW_TEXT) }, s)
+    svg.append(el('rect', { x, y, width: w, height: R.gx_view_node_h(i), rx: 6, fill: hex(R.gx_view_node_fill(i)), stroke: hex(R.gx_view_node_stroke(i)), 'stroke-width': 1.5, ...dash(R.gx_view_node_dash(i)) }),
+      t(px + 2, l1.length > fit ? `${l1.slice(0, fit - 1)}...` : l1), t(2 * px + 5, l2), el('title', {}, `${l1} - ${l2}`))
+  }
+  out.append(svg)
+  status.textContent = `${path}: ${R.gx_line_count()} lines, ${R.gx_node_count()} nodes, ${R.gx_edge_count()} edges, ${W}x${H}. Exact only: no derived or suggested edges.`
+}
+const pick = $('spec'), go = () => show(pick.selectedOptions[0].dataset.path, pick.value)
+pick.addEventListener('change', go); go()
diff --git a/apps/website/public/t27f/graph/index.html b/apps/website/public/t27f/graph/index.html
new file mode 100644
index 0000000000..8dd3b5b509
--- /dev/null
+++ b/apps/website/public/t27f/graph/index.html
@@ -0,0 +1,33 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>T27F graph view of a .t27 spec &middot; Trinity S&sup3;AI</title>
+<meta name="description" content="The T27F graph view: a box per node and a line per edge of a .t27 spec, placed and coloured by specs/t27f/spec_graph_view.t27, running as WebAssembly in your browser.">
+<link rel="canonical" href="https://t27.ai/t27f/graph/">
+<link rel="icon" href="../../favicon.svg" type="image/svg+xml">
+<style>body{margin:0;font:15px/1.5 system-ui,sans-serif;background:#fff;color:#1a1a1a}main{padding:1rem 1.25rem}h1{font-size:1.3rem;margin:0 0 .25rem}p{max-width:62rem;margin:.25rem 0 .75rem}select{font:inherit;padding:.2rem}#status{margin:.75rem 0;font-weight:600}#status.refused{color:#a02020}#graph{overflow:auto;border:1px solid #ccc}a{color:#2459a8}</style>
+</head>
+<body>
+<main>
+<h1>T27F graph view</h1>
+<p>One box per node, one line per edge of a <code>.t27</code> spec. The graph is read from the spec's bytes by <code>spec_graph_export.t27</code>; the placement, size and colour of every box come from <code>spec_graph_view.t27</code>. Both run here as WebAssembly. A box shows its kind, name, inference label (exact, derived, suggested, unknown) and source lines; dashed outlines mark labels weaker than exact. A spec over the graph's cap is refused, never drawn truncated. See <a href="./PROVENANCE.txt">PROVENANCE.txt</a> for the exact sources, compiler and checksums.</p>
+<label>Spec <select id="spec">
+<option value="08_modules_and_arrays.t27" data-path="specs/tutorial/08_modules_and_arrays.t27">tutorial 08: modules and arrays</option>
+<option value="quest.t27" data-path="specs/t27f/quest.t27">t27f: quest</option>
+<option value="reel_gf16_nmse.t27" data-path="specs/t27f/reel_gf16_nmse.t27">t27f: reel_gf16_nmse</option>
+<option value="ui_plan.t27" data-path="specs/t27f/ui_plan.t27">t27f: ui_plan (251 of 254 edges)</option>
+<option value="reel_t27_basics.t27" data-path="specs/t27f/reel_t27_basics.t27">t27f: reel_t27_basics</option>
+<option value="topic_reel.t27" data-path="specs/t27f/topic_reel.t27">t27f: topic_reel</option>
+<option value="spec_graph.t27" data-path="specs/t27f/spec_graph.t27">t27f: spec_graph (over the cap: refused)</option>
+<option value="spec_graph_view.t27" data-path="specs/t27f/spec_graph_view.t27">t27f: spec_graph_view (over the cap: refused)</option>
+<option value="spec_graph_export.t27" data-path="specs/t27f/spec_graph_export.t27">t27f: spec_graph_export (over the cap: refused)</option>
+</select></label>
+<div id="status" role="status">Loading the T27F wasm&hellip;</div>
+<div id="graph"></div>
+<noscript><p>This page runs WebAssembly and needs JavaScript.</p></noscript>
+</main>
+<script type="module" src="./graph.js"></script>
+</body>
+</html>
diff --git a/apps/website/public/t27f/graph/spec_graph_view.mjs b/apps/website/public/t27f/graph/spec_graph_view.mjs
new file mode 100644
index 0000000000..dac7fe8cc8
--- /dev/null
+++ b/apps/website/public/t27f/graph/spec_graph_view.mjs
@@ -0,0 +1,182 @@
+// Generated by `t27c gen-js` from spec_graph_view.t27. Do not edit.
+//
+// Every name and every value here comes from that spec. Change the spec and
+// regenerate; an edit made here is lost the next time anyone builds.
+
+export const VIEW_OK = 0;
+export const VIEW_ERR_EDGE_NO_LINE = 19;
+export const VIEW_KIND_ORDER = [0, 2, 3, 4, 5, 6, 1, 7];
+export const VIEW_MARGIN = 40;
+export const VIEW_COL_W = 220;
+export const VIEW_COL_STEP = 260;
+export const VIEW_ROW_STEP = 64;
+export const VIEW_BAND_GAP = 48;
+export const VIEW_LABEL_W = [220, 220, 200, 200];
+export const VIEW_LABEL_H = [44, 44, 36, 36];
+export const VIEW_LABEL_INDENT = [0, 0, 10, 10];
+export const VIEW_LABEL_FILL = [0xDCEFE0, 0xDDE8F7, 0xFFF1D0, 0xECECEC];
+export const VIEW_LABEL_STROKE = [0x1B7F3B, 0x2459A8, 0xB7791F, 0x8A8A8A];
+export const VIEW_LABEL_DASH = [0, 6, 3, 2];
+export const VIEW_TEXT = 0x1A1A1A;
+export const VIEW_BACKDROP = 0xFFFFFF;
+export const VIEW_FONT_PX = 13;
+export const VIEW_LANE_STEP = 4;
+export const VIEW_LANE_HALF = 8;
+// t27c gen-js: fn view_is_unknown was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_style was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_kind_present was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_column was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_column_count was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_node_column was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_row was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_known_depth was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_band_top was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_node_x was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_node_y was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_node_w was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_node_h was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_node_fill was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_node_stroke was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_node_dash was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_node_widget was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_width was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_height was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_edge_line was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_verdict was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_edge_x1 was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_edge_x2 was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_lane_y was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_edge_y1 was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_edge_y2 was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_edge_stroke was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_edge_dash was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_overlap was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_overlap_count was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_point_in was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_ends_on was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_edges_attach was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_alone_below was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn view_fx was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_verdict was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_node_count was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_edge_count was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_width was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_height was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_node_kind was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_node_label was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_node_line_start was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_node_line_end was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_node_x was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_node_y was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_node_w was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_node_h was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_node_fill was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_node_stroke was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_node_dash was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_node_widget was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_edge_kind was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_edge_label was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_edge_line was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_edge_x1 was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_edge_y1 was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_edge_x2 was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_edge_y2 was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_edge_stroke was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn fx_edge_dash was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: a TestBlock was not emitted -- it is checked by the compiler, not by the artifact.
+// t27c gen-js: a TestBlock was not emitted -- it is checked by the compiler, not by the artifact.
+// t27c gen-js: a TestBlock was not emitted -- it is checked by the compiler, not by the artifact.
+// t27c gen-js: a TestBlock was not emitted -- it is checked by the compiler, not by the artifact.
+// t27c gen-js: a TestBlock was not emitted -- it is checked by the compiler, not by the artifact.
+// t27c gen-js: a TestBlock was not emitted -- it is checked by the compiler, not by the artifact.
+// t27c gen-js: a TestBlock was not emitted -- it is checked by the compiler, not by the artifact.
+// t27c gen-js: a TestBlock was not emitted -- it is checked by the compiler, not by the artifact.
+// t27c gen-js: a TestBlock was not emitted -- it is checked by the compiler, not by the artifact.
+// t27c gen-js: a InvariantBlock was not emitted -- it is checked by the compiler, not by the artifact.
+// t27c gen-js: a InvariantBlock was not emitted -- it is checked by the compiler, not by the artifact.
+// t27c gen-js: a InvariantBlock was not emitted -- it is checked by the compiler, not by the artifact.
+// t27c gen-js: a InvariantBlock was not emitted -- it is checked by the compiler, not by the artifact.
+export const EDGE_CALLS = 0;
+export const EDGE_CONSTRAINS = 3;
+export const EDGE_DATA_FLOW = 4;
+export const EDGE_FROM_KINDS = [60, 61, 4, 16, 198];
+export const EDGE_KINDS = 5;
+export const EDGE_TESTED_BY = 2;
+export const EDGE_TO_KINDS = [4, 66, 56, 6, 188];
+export const EDGE_USES = 1;
+export const ERR_DUPLICATE_EDGE = 18;
+export const ERR_EDGE_DANGLING = 13;
+export const ERR_EDGE_ENDPOINT_KIND = 14;
+export const ERR_EDGE_KIND = 12;
+export const ERR_EDGE_LABEL = 16;
+export const ERR_EDGE_LINE = 17;
+export const ERR_EDGE_UNKNOWN_NODE = 15;
+export const ERR_GRAPH_VERSION = 1;
+export const ERR_LABEL = 7;
+export const ERR_MODULE = 5;
+export const ERR_NODE_KIND = 6;
+export const ERR_NODE_NAME = 8;
+export const ERR_SPAN_MISSING = 11;
+export const ERR_SPAN_ORDER = 9;
+export const ERR_SPAN_OUTSIDE = 10;
+export const ERR_SPEC_PATH = 2;
+export const ERR_TOO_MANY_EDGES = 4;
+export const ERR_TOO_MANY_NODES = 3;
+export const GRAPH_IR_VERSION = 1;
+export const GRAPH_OK = 0;
+export const LABEL_DERIVED = 1;
+export const LABEL_EXACT = 0;
+export const LABEL_KINDS = 4;
+export const LABEL_SUGGESTED = 2;
+export const LABEL_UNKNOWN = 3;
+export const MAX_EDGES = 254;
+export const MAX_NODES = 192;
+export const NODE_BENCH = 5;
+export const NODE_CONST = 1;
+export const NODE_FN = 2;
+export const NODE_INVARIANT = 4;
+export const NODE_KINDS = 8;
+export const NODE_MODULE = 0;
+export const NODE_OPAQUE = 7;
+export const NODE_TEST = 3;
+export const NODE_USE = 6;
+export const NO_INDEX = 255;
+export const NO_LINE = 0;
+export const SpecGraph = Object.freeze({ __struct__: "SpecGraph", fields: [["ir_version", "u32"], ["spec_path", "str"], ["line_count", "u32"], ["node_count", "u32"], ["node_kind", "[192]u8"], ["node_label", "[192]u8"], ["node_name", "[192]str"], ["line_start", "[192]u32"], ["line_end", "[192]u32"], ["edge_count", "u32"], ["edge_kind", "[254]u8"], ["edge_from", "[254]u8"], ["edge_to", "[254]u8"], ["edge_label", "[254]u8"], ["edge_line", "[254]u32"]] });
+export const VERDICT_KINDS = 19;
+// t27c gen-js: fn blank_graph was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn kind_bit was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn node_widget was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn span_holds was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn tutorial_08_graph was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn valid_edge_kind was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn valid_label was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn valid_node_kind was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn validate_edge was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn validate_graph was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn validate_graph_header was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn validate_node was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn with_edge was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn with_node was not emitted -- this backend lowers declarations, not bodies.
+// t27c gen-js: fn with_suggestion was not emitted -- this backend lowers declarations, not bodies.
+export const WIDGET_FORMULA_VIEW = 2;
+export const WIDGET_HONEYCOMB_CARD = 1;
+export const WIDGET_METRICS_TABLE = 3;
+export const WIDGET_RUN_BUTTON = 4;
+export const WIDGET_TEXT_BLOCK = 5;
+
+// Declaration order, which the spec's own laws depend on.
+export const __STRUCT_ORDER__ = ["SpecGraph"];
+export const __DECL_ORDER__ = ["VIEW_OK", "VIEW_ERR_EDGE_NO_LINE", "VIEW_KIND_ORDER", "VIEW_MARGIN", "VIEW_COL_W", "VIEW_COL_STEP", "VIEW_ROW_STEP", "VIEW_BAND_GAP", "VIEW_LABEL_W", "VIEW_LABEL_H", "VIEW_LABEL_INDENT", "VIEW_LABEL_FILL", "VIEW_LABEL_STROKE", "VIEW_LABEL_DASH", "VIEW_TEXT", "VIEW_BACKDROP", "VIEW_FONT_PX", "VIEW_LANE_STEP", "VIEW_LANE_HALF", "EDGE_CALLS", "EDGE_CONSTRAINS", "EDGE_DATA_FLOW", "EDGE_FROM_KINDS", "EDGE_KINDS", "EDGE_TESTED_BY", "EDGE_TO_KINDS", "EDGE_USES", "ERR_DUPLICATE_EDGE", "ERR_EDGE_DANGLING", "ERR_EDGE_ENDPOINT_KIND", "ERR_EDGE_KIND", "ERR_EDGE_LABEL", "ERR_EDGE_LINE", "ERR_EDGE_UNKNOWN_NODE", "ERR_GRAPH_VERSION", "ERR_LABEL", "ERR_MODULE", "ERR_NODE_KIND", "ERR_NODE_NAME", "ERR_SPAN_MISSING", "ERR_SPAN_ORDER", "ERR_SPAN_OUTSIDE", "ERR_SPEC_PATH", "ERR_TOO_MANY_EDGES", "ERR_TOO_MANY_NODES", "GRAPH_IR_VERSION", "GRAPH_OK", "LABEL_DERIVED", "LABEL_EXACT", "LABEL_KINDS", "LABEL_SUGGESTED", "LABEL_UNKNOWN", "MAX_EDGES", "MAX_NODES", "NODE_BENCH", "NODE_CONST", "NODE_FN", "NODE_INVARIANT", "NODE_KINDS", "NODE_MODULE", "NODE_OPAQUE", "NODE_TEST", "NODE_USE", "NO_INDEX", "NO_LINE", "SpecGraph", "VERDICT_KINDS", "WIDGET_FORMULA_VIEW", "WIDGET_HONEYCOMB_CARD", "WIDGET_METRICS_TABLE", "WIDGET_RUN_BUTTON", "WIDGET_TEXT_BLOCK"];
+
+// What this spec holds and this backend did not print. Empty is the whole
+// story most of the time; an entry here is a promise the artifact does not
+// keep, and reading it is how a tool tells a partial module from a complete
+// one without parsing comments.
+//
+// A LIST, not a map keyed by name. `specs/numeric/formats.t27` declares four
+// separate consts called `result`, one per test block, and under an object
+// literal three of the four omissions vanished into the fourth -- a record of
+// what went missing that itself went missing. A spec is free to reuse a
+// name; this file is not free to lose the second one.
+export const __NOT_EMITTED__ = Object.freeze([]);
diff --git a/apps/website/public/t27f/graph/specs/08_modules_and_arrays.t27 b/apps/website/public/t27f/graph/specs/08_modules_and_arrays.t27
new file mode 100644
index 0000000000..935144a539
--- /dev/null
+++ b/apps/website/public/t27f/graph/specs/08_modules_and_arrays.t27
@@ -0,0 +1,93 @@
+// SPDX-License-Identifier: Apache-2.0
+; 08 -- Modules, visibility and arrays
+; Lesson 8, the last one. How a spec names itself, what it exposes, how it
+; pulls in another spec, and the array/index syntax used by every lookup table
+; in the corpus.
+; .
+; After this, open specs/numeric/gf16.t27 -- it is a real spec built entirely
+; out of what these eight lessons cover.
+; phi^2 + 1/phi^2 = 3 | TRINITY
+
+module tutorial-08-modules;
+
+// ============================================================================
+// use
+//
+//   use path::to::spec;
+//
+// Pulls in another spec. Paths are `::`-separated and rooted at the corpus,
+// not at the filesystem.
+// ============================================================================
+
+use base::types;
+
+// ============================================================================
+// pub
+//
+// `pub` makes a name part of this spec's surface. Without it the name is
+// internal: usable here, invisible elsewhere. Default to leaving things
+// private -- a spec's exported surface is a promise to whoever imports it.
+// ============================================================================
+
+pub const EXPORTED_WIDTH : u8 = 16;
+
+// No `pub`: an implementation detail of this module.
+const INTERNAL_SCALE : u8 = 4;
+
+pub fn scaled_width() u8 {
+    return EXPORTED_WIDTH / INTERNAL_SCALE;
+}
+
+// ============================================================================
+// Arrays
+//
+//   pub const NAME : [N]TYPE = [a, b, c];
+//
+// The length and the element type are part of the declared type, written out
+// like every other width in this language. Fixed tables like this are how the
+// numeric specs carry their constants.
+//
+// The Zig-style `[_]TYPE{ a, b, c }` parses, but it lowers to an untyped tuple:
+// indexing one with a runtime value does not compile. Write the type.
+// ============================================================================
+
+pub const TRIT_VALUES : [3]i8 = [-1, 0, 1];
+
+pub const POWERS_OF_TWO : [8]u16 = [1, 2, 4, 8, 16, 32, 64, 128];
+
+pub const EXPONENT_BIAS : [4]u8 = [15, 31, 63, 127];
+
+// ============================================================================
+// Indexing
+//
+// `array[i]`, zero-based.
+// ============================================================================
+
+pub fn power_of_two(index: u8) u16 {
+    return POWERS_OF_TWO[index];
+}
+
+pub fn bias_for_width(index: u8) u8 {
+    return EXPONENT_BIAS[index];
+}
+
+// ============================================================================
+// Tests
+// ============================================================================
+
+test "the power table matches its own definition" {
+    try std.testing.expectEqual(@as(u16, 1), power_of_two(0));
+    try std.testing.expectEqual(@as(u16, 128), power_of_two(7));
+}
+
+test "bias table carries the four standard widths" {
+    try std.testing.expectEqual(@as(u8, 15), bias_for_width(0));
+    try std.testing.expectEqual(@as(u8, 127), bias_for_width(3));
+}
+
+test "a private constant is still usable inside its own module" {
+    try std.testing.expectEqual(@as(u8, 4), scaled_width());
+}
+
+invariant exported_width_is_a_power_of_two
+    assert EXPORTED_WIDTH == 16
diff --git a/apps/website/public/t27f/graph/specs/quest.t27 b/apps/website/public/t27f/graph/specs/quest.t27
new file mode 100644
index 0000000000..1c82062c14
--- /dev/null
+++ b/apps/website/public/t27f/graph/specs/quest.t27
@@ -0,0 +1,360 @@
+// SPDX-License-Identifier: Apache-2.0
+; specs/t27f/quest.t27 -- one quest turn on a topic map: the Queen picks one cell and one relevant bee,
+; the bee's evidence goes through the engine's gates, a progression event fires once, and anything
+; high-impact waits for a human (gHashTag/t27#10030).
+; This is an application built on T27F, like the topic map it walks (gHashTag/trinity#1677). It is
+; not T27F: T27F is the visual spec of a .t27 file; the definition lives in
+; .claude/skills/t27f/SKILL.md, "What T27F is".
+; Every gate is read from specs/t27f/topic_engine.t27 with `use`; nothing here restates a constant,
+; a bee list or a status rule. What this file adds is the turn around those gates:
+;   - quest_target(): the one cell a turn works on -- the first OPEN cell, else the first GAP, else
+;     none -- decided by the engine's bee_target();
+;   - bee_fits() / dispatch(): a bee is dispatched only while dispatch_allowed() holds and only if its
+;     name is on the domain's *_BEES list (kw_in_list, the engine's own reader); a GAP takes GAP_BEE;
+;   - review_counts(): a review is evidence only when the reviewer is not the author;
+;   - quest_evidence(): one piece of evidence through verify(), refusing a self-review;
+;   - progression_event(): true exactly when counts_as_progress() flips from false to true, worth
+;     POINTS_PER_VERIFIED_LESSON and never money;
+;   - quest_action(): the engine's approval gate, unchanged; a bee never publishes on its own;
+;   - board_state(): the cell's column on the Queen's board, as specs/queen/tasks.t27 TS_* codes.
+; Pilot: step 16 of the GF16 vs bfloat16 NMSE research map (specs/t27f/reel_gf16_nmse.t27, cell 15,
+; "The sealed run", DELIVER stage, research domain). The pilot starts from the cell as a GAP, its
+; state when that map was measured; it does not read the map's STATUS row, which is grounded
+; separately. The five-step timeline below is a worked rule check, not a record of a run.
+; Not claimed: no runtime dispatches a bee from this file yet, and no board shows a quest.
+; ASCII only (L3).
+; phi^2 + 1/phi^2 = 3 | TRINITY
+
+module t27f_quest;
+
+use t27f::reel::CELL_COUNT;
+use t27f::topic_engine::STATUS_GAP;
+use t27f::topic_engine::STATUS_LOCKED;
+use t27f::topic_engine::STATUS_OPEN;
+use t27f::topic_engine::STATUS_DRAFT;
+use t27f::topic_engine::STATUS_VERIFIED;
+use t27f::topic_engine::STATUS_PUBLISHED;
+use t27f::topic_engine::STAGE_DELIVER;
+use t27f::topic_engine::DOMAIN_GENERAL;
+use t27f::topic_engine::DOMAIN_CONTENT;
+use t27f::topic_engine::DOMAIN_ENGINEERING;
+use t27f::topic_engine::DOMAIN_RESEARCH;
+use t27f::topic_engine::DOMAIN_SALES;
+use t27f::topic_engine::GENERAL_BEES;
+use t27f::topic_engine::CONTENT_BEES;
+use t27f::topic_engine::ENGINEERING_BEES;
+use t27f::topic_engine::RESEARCH_BEES;
+use t27f::topic_engine::SALES_BEES;
+use t27f::topic_engine::GAP_BEE;
+use t27f::topic_engine::MAX_ACTIVE_BEES;
+use t27f::topic_engine::TARGET_OPEN_LESSON;
+use t27f::topic_engine::EVIDENCE_NONE;
+use t27f::topic_engine::EVIDENCE_SOURCE_LINK;
+use t27f::topic_engine::EVIDENCE_TEST_PASS;
+use t27f::topic_engine::EVIDENCE_REVIEW;
+use t27f::topic_engine::ACTION_DRAFT_ONLY;
+use t27f::topic_engine::ACTION_PUBLISH;
+use t27f::topic_engine::ACTION_DESTRUCTIVE;
+use t27f::topic_engine::POINTS_PER_VERIFIED_LESSON;
+use t27f::topic_engine::REWARD_IS_MONEY;
+use t27f::topic_engine::step_stage;
+use t27f::topic_engine::kw_in_list;
+use t27f::topic_engine::dispatch_allowed;
+use t27f::topic_engine::bee_target;
+use t27f::topic_engine::verify;
+use t27f::topic_engine::counts_as_progress;
+use t27f::topic_engine::needs_human_approval;
+use t27f::topic_engine::action_allowed;
+use t27f::topic_engine::after_action;
+use t27f::topic_engine::earned_status;
+use t27f::reel_gf16_nmse::DOMAIN;
+use t27f::reel_gf16_nmse::TITLES;
+use queen::tasks::TS_BACKLOG;
+use queen::tasks::TS_BLOCKED;
+use queen::tasks::TS_RUNNING;
+use queen::tasks::TS_REVIEW;
+use queen::tasks::TS_DONE;
+
+/// No cell to work on: every cell is past OPEN and none is a GAP.
+pub const QUEST_NONE : i32 = -1;
+
+/// The pilot: step 16 of the NMSE research map is cell 15.
+pub const PILOT_CELL : u8 = 15;
+pub const PILOT_STEP_NUMBER : u8 = 16;
+
+/// The pilot's two bees, by id, and their names as the bee lists spell them.
+pub const BEE_RESEARCHER : u8 = 1;
+pub const BEE_REVIEWER : u8 = 2;
+pub const RESEARCHER_NAME : str = "researcher";
+pub const REVIEWER_NAME : str = "reviewer";
+pub const CODER_NAME : str = "coder";
+pub const WRITER_NAME : str = "writer";
+
+/// The five steps of the pilot timeline, in order.
+pub const TIMELINE_STEPS : u8 = 5;
+pub const TIMELINE_NAMES : [5]str = ["run", "schema check", "self-review", "independent review", "publish"];
+
+/// Fixtures for quest_target: a map with two gaps, the same map with one OPEN cell, a finished map.
+pub const MAP_TWO_GAPS : [27]u8 = [5, 5, 5, 5, 5, 5, 3, 3, 3, 5, 5, 5, 5, 5, 5, 0, 0, 1, 5, 4, 5, 5, 3, 3, 1, 1, 3];
+pub const MAP_ONE_OPEN : [27]u8 = [5, 5, 5, 5, 5, 5, 3, 3, 3, 5, 5, 5, 5, 5, 5, 0, 0, 1, 5, 4, 2, 5, 3, 3, 1, 1, 3];
+pub const MAP_DONE : [27]u8 = [5, 5, 5, 5, 5, 5, 4, 4, 4, 5, 5, 5, 5, 5, 5, 4, 4, 4, 5, 4, 5, 5, 4, 4, 4, 4, 4];
+
+/// How many cells hold one status, as the u8 bee_target() takes.
+pub fn count_with(status: [27]u8, s: u8) -> u8 {
+    var n : u8 = 0;
+    var c : i32 = 0;
+    while (c < CELL_COUNT) {
+        if (status[@intCast(c)] == s) {
+            n = n + 1;
+        }
+        c = c + 1;
+    }
+    return n;
+}
+
+/// The first cell holding one status, or QUEST_NONE.
+pub fn first_with(status: [27]u8, s: u8) -> i32 {
+    var c : i32 = 0;
+    while (c < CELL_COUNT) {
+        if (status[@intCast(c)] == s) {
+            return c;
+        }
+        c = c + 1;
+    }
+    return QUEST_NONE;
+}
+
+/// The one cell a quest turn works on: the engine's bee_target() decides between the first OPEN
+/// cell and the first GAP; a map with neither has no target.
+pub fn quest_target(status: [27]u8) -> i32 {
+    if (bee_target(count_with(status, STATUS_OPEN)) == TARGET_OPEN_LESSON) {
+        return first_with(status, STATUS_OPEN);
+    }
+    return first_with(status, STATUS_GAP);
+}
+
+/// Whether a bee name is on the domain's list, read with the engine's own list reader.
+pub fn bee_on_list(domain: u8, name: []const u8, n: usize) -> bool {
+    if (domain == DOMAIN_CONTENT) {
+        return kw_in_list(name, 0, n, CONTENT_BEES, CONTENT_BEES.len);
+    }
+    if (domain == DOMAIN_ENGINEERING) {
+        return kw_in_list(name, 0, n, ENGINEERING_BEES, ENGINEERING_BEES.len);
+    }
+    if (domain == DOMAIN_RESEARCH) {
+        return kw_in_list(name, 0, n, RESEARCH_BEES, RESEARCH_BEES.len);
+    }
+    if (domain == DOMAIN_SALES) {
+        return kw_in_list(name, 0, n, SALES_BEES, SALES_BEES.len);
+    }
+    return kw_in_list(name, 0, n, GENERAL_BEES, GENERAL_BEES.len);
+}
+
+/// A bee fits a cell when it is on the domain's list; a GAP takes GAP_BEE, whose task is a source.
+pub fn bee_fits(status: u8, domain: u8, name: []const u8, n: usize) -> bool {
+    if (bee_on_list(domain, name, n) == false) {
+        return false;
+    }
+    if (status == STATUS_GAP) {
+        return kw_in_list(name, 0, n, GAP_BEE, GAP_BEE.len);
+    }
+    return status == STATUS_OPEN;
+}
+
+/// The Queen dispatches one bee only while the cap allows it and only a bee that fits the cell.
+pub fn dispatch(active_bees: u8, status: u8, domain: u8, name: []const u8, n: usize) -> bool {
+    return dispatch_allowed(active_bees) && bee_fits(status, domain, name, n);
+}
+
+/// A review is evidence only from someone other than the author.
+pub fn review_counts(author: u8, reviewer: u8) -> bool {
+    return author != reviewer;
+}
+
+/// One piece of evidence for a cell, through verify(); a self-review changes nothing.
+pub fn quest_evidence(status: u8, step: u8, domain: u8, evidence: u8, author: u8, reviewer: u8) -> u8 {
+    if (evidence == EVIDENCE_REVIEW && review_counts(author, reviewer) == false) {
+        return status;
+    }
+    return verify(status, step_stage(step), domain, evidence);
+}
+
+/// The progression event: a cell starts to count as progress. It fires once per cell.
+pub fn progression_event(before: u8, after: u8) -> bool {
+    return counts_as_progress(before) == false && counts_as_progress(after);
+}
+
+/// The points a status change earns: one event's worth or nothing. Points are never money.
+pub fn event_points(before: u8, after: u8) -> u32 {
+    if (progression_event(before, after)) {
+        return POINTS_PER_VERIFIED_LESSON;
+    }
+    return 0;
+}
+
+/// An action on a cell, through the engine's approval gate; `approved` is a human's yes.
+pub fn quest_action(status: u8, action: u8, approved: bool) -> u8 {
+    return after_action(status, action, approved);
+}
+
+/// The cell's column on the Queen's board (specs/queen/tasks.t27). A working bee means RUNNING; a
+/// draft waits in REVIEW for its evidence; a counted cell is DONE.
+pub fn board_state(status: u8, bee_working: bool) -> u8 {
+    if (bee_working) {
+        return TS_RUNNING;
+    }
+    if (status == STATUS_LOCKED) {
+        return TS_BLOCKED;
+    }
+    if (status == STATUS_DRAFT) {
+        return TS_REVIEW;
+    }
+    if (counts_as_progress(status)) {
+        return TS_DONE;
+    }
+    return TS_BACKLOG;
+}
+
+test the_target_is_first_open_else_first_gap {
+    assert quest_target(MAP_TWO_GAPS) == 15;
+    assert quest_target(MAP_ONE_OPEN) == 20;
+    assert quest_target(MAP_DONE) == QUEST_NONE;
+    assert count_with(MAP_TWO_GAPS, STATUS_OPEN) == 0;
+    assert count_with(MAP_ONE_OPEN, STATUS_OPEN) == 1;
+    assert count_with(MAP_TWO_GAPS, STATUS_GAP) == 2;
+}
+
+test only_a_listed_bee_is_dispatched {
+    // research lists researcher, analyst, reviewer; coder is engineering's
+    assert bee_on_list(DOMAIN_RESEARCH, REVIEWER_NAME, REVIEWER_NAME.len);
+    assert bee_on_list(DOMAIN_RESEARCH, CODER_NAME, CODER_NAME.len) == false;
+    assert bee_on_list(DOMAIN_ENGINEERING, CODER_NAME, CODER_NAME.len);
+    assert bee_on_list(DOMAIN_GENERAL, WRITER_NAME, WRITER_NAME.len);
+    assert bee_on_list(DOMAIN_SALES, WRITER_NAME, WRITER_NAME.len) == false;
+    // a gap takes the gap bee only
+    assert bee_fits(STATUS_GAP, DOMAIN_RESEARCH, RESEARCHER_NAME, RESEARCHER_NAME.len);
+    assert bee_fits(STATUS_GAP, DOMAIN_RESEARCH, REVIEWER_NAME, REVIEWER_NAME.len) == false;
+    assert bee_fits(STATUS_OPEN, DOMAIN_RESEARCH, REVIEWER_NAME, REVIEWER_NAME.len);
+    // a cell past OPEN is not a dispatch target
+    assert bee_fits(STATUS_DRAFT, DOMAIN_RESEARCH, REVIEWER_NAME, REVIEWER_NAME.len) == false;
+    assert bee_fits(STATUS_LOCKED, DOMAIN_RESEARCH, RESEARCHER_NAME, RESEARCHER_NAME.len) == false;
+}
+
+test the_cap_holds_before_relevance {
+    assert dispatch(0, STATUS_GAP, DOMAIN_RESEARCH, RESEARCHER_NAME, RESEARCHER_NAME.len);
+    assert dispatch(MAX_ACTIVE_BEES - 1, STATUS_GAP, DOMAIN_RESEARCH, RESEARCHER_NAME, RESEARCHER_NAME.len);
+    assert dispatch(MAX_ACTIVE_BEES, STATUS_GAP, DOMAIN_RESEARCH, RESEARCHER_NAME, RESEARCHER_NAME.len) == false;
+    assert dispatch(0, STATUS_GAP, DOMAIN_RESEARCH, CODER_NAME, CODER_NAME.len) == false;
+}
+
+test a_self_review_is_not_evidence {
+    assert review_counts(BEE_RESEARCHER, BEE_REVIEWER);
+    assert review_counts(BEE_RESEARCHER, BEE_RESEARCHER) == false;
+    assert quest_evidence(STATUS_DRAFT, PILOT_CELL, DOMAIN_RESEARCH, EVIDENCE_REVIEW, BEE_RESEARCHER, BEE_RESEARCHER) == STATUS_DRAFT;
+    assert quest_evidence(STATUS_DRAFT, PILOT_CELL, DOMAIN_RESEARCH, EVIDENCE_REVIEW, BEE_RESEARCHER, BEE_REVIEWER) == STATUS_VERIFIED;
+    assert quest_evidence(STATUS_DRAFT, PILOT_CELL, DOMAIN_RESEARCH, EVIDENCE_NONE, BEE_RESEARCHER, BEE_REVIEWER) == STATUS_DRAFT;
+}
+
+test the_event_fires_exactly_on_the_flip {
+    var b : u8 = STATUS_GAP;
+    while (b <= STATUS_PUBLISHED) {
+        var a : u8 = STATUS_GAP;
+        while (a <= STATUS_PUBLISHED) {
+            const want : bool = counts_as_progress(b) == false && counts_as_progress(a);
+            assert progression_event(b, a) == want;
+            if (want) {
+                assert event_points(b, a) == POINTS_PER_VERIFIED_LESSON;
+            } else {
+                assert event_points(b, a) == 0;
+            }
+            a = a + 1;
+        }
+        b = b + 1;
+    }
+    assert progression_event(STATUS_DRAFT, STATUS_VERIFIED);
+    assert progression_event(STATUS_VERIFIED, STATUS_PUBLISHED) == false;
+    assert progression_event(STATUS_DRAFT, STATUS_PUBLISHED);
+}
+
+test no_high_impact_action_without_a_yes {
+    var s : u8 = STATUS_GAP;
+    while (s <= STATUS_PUBLISHED) {
+        var act : u8 = ACTION_PUBLISH;
+        while (act <= ACTION_DESTRUCTIVE) {
+            assert needs_human_approval(act);
+            assert action_allowed(s, act, false) == false;
+            assert quest_action(s, act, false) == s;
+            act = act + 1;
+        }
+        s = s + 1;
+    }
+    assert needs_human_approval(ACTION_DRAFT_ONLY) == false;
+}
+
+test the_board_reads_the_status {
+    assert board_state(STATUS_GAP, false) == TS_BACKLOG;
+    assert board_state(STATUS_OPEN, false) == TS_BACKLOG;
+    assert board_state(STATUS_LOCKED, false) == TS_BLOCKED;
+    assert board_state(STATUS_GAP, true) == TS_RUNNING;
+    assert board_state(STATUS_DRAFT, false) == TS_REVIEW;
+    assert board_state(STATUS_VERIFIED, false) == TS_DONE;
+    assert board_state(STATUS_PUBLISHED, false) == TS_DONE;
+}
+
+test the_pilot_is_step_16_of_the_nmse_map {
+    assert PILOT_CELL + 1 == PILOT_STEP_NUMBER;
+    assert DOMAIN == DOMAIN_RESEARCH;
+    assert step_stage(PILOT_CELL) == STAGE_DELIVER;
+    assert TITLES[15].len > 0;
+    // at the start the cell is a GAP, so the turn's bee is the gap bee and its job is a source
+    assert dispatch(0, STATUS_GAP, DOMAIN, RESEARCHER_NAME, RESEARCHER_NAME.len);
+    assert dispatch(0, STATUS_GAP, DOMAIN, REVIEWER_NAME, REVIEWER_NAME.len) == false;
+}
+
+test the_pilot_timeline {
+    // 1. run: the bee's sealed manifest grounds the cell; a DELIVER step in research wants a review
+    const s0 : u8 = STATUS_GAP;
+    const s1 : u8 = earned_status(PILOT_CELL, DOMAIN, true, false, false, false);
+    assert s1 == STATUS_DRAFT;
+    assert quest_evidence(STATUS_DRAFT, PILOT_CELL, DOMAIN, EVIDENCE_SOURCE_LINK, BEE_RESEARCHER, BEE_RESEARCHER) == s1;
+    assert board_state(s1, false) == TS_REVIEW;
+    // 2. schema check passes: a passing test clears PRACTICE, not DELIVER
+    const s2 : u8 = earned_status(PILOT_CELL, DOMAIN, true, true, false, false);
+    assert s2 == STATUS_DRAFT;
+    assert quest_evidence(s1, PILOT_CELL, DOMAIN, EVIDENCE_TEST_PASS, BEE_RESEARCHER, BEE_RESEARCHER) == s2;
+    // 3. the author reviews its own run: refused
+    const s3 : u8 = earned_status(PILOT_CELL, DOMAIN, true, true, review_counts(BEE_RESEARCHER, BEE_RESEARCHER), false);
+    assert s3 == STATUS_DRAFT;
+    assert quest_evidence(s2, PILOT_CELL, DOMAIN, EVIDENCE_REVIEW, BEE_RESEARCHER, BEE_RESEARCHER) == s3;
+    // 4. an independent reviewer: VERIFIED, the one progression event
+    const s4 : u8 = earned_status(PILOT_CELL, DOMAIN, true, true, review_counts(BEE_RESEARCHER, BEE_REVIEWER), false);
+    assert s4 == STATUS_VERIFIED;
+    assert quest_evidence(s3, PILOT_CELL, DOMAIN, EVIDENCE_REVIEW, BEE_RESEARCHER, BEE_REVIEWER) == s4;
+    assert board_state(s4, false) == TS_DONE;
+    // 5. publish: a bee alone is refused; after a human's yes the cell is PUBLISHED
+    assert quest_action(s4, ACTION_PUBLISH, false) == STATUS_VERIFIED;
+    const s5 : u8 = quest_action(s4, ACTION_PUBLISH, true);
+    assert s5 == STATUS_PUBLISHED;
+    assert s5 == earned_status(PILOT_CELL, DOMAIN, true, true, true, true);
+    // exactly one event, worth one point, across the five steps
+    const points : u32 = event_points(s0, s1) + event_points(s1, s2) + event_points(s2, s3) + event_points(s3, s4) + event_points(s4, s5);
+    assert points == POINTS_PER_VERIFIED_LESSON;
+    assert progression_event(s3, s4);
+    assert TIMELINE_NAMES[4].len > 0;
+    assert TIMELINE_STEPS == 5;
+}
+
+invariant points_are_not_money {
+    assert REWARD_IS_MONEY == false;
+    assert POINTS_PER_VERIFIED_LESSON == 1;
+}
+
+invariant one_turn_one_bee_under_the_cap {
+    assert MAX_ACTIVE_BEES >= 1;
+    assert dispatch_allowed(MAX_ACTIVE_BEES) == false;
+}
+
+invariant publish_needs_a_human {
+    assert needs_human_approval(ACTION_PUBLISH);
+    assert quest_action(STATUS_VERIFIED, ACTION_PUBLISH, false) == STATUS_VERIFIED;
+}
diff --git a/apps/website/public/t27f/graph/specs/reel_gf16_nmse.t27 b/apps/website/public/t27f/graph/specs/reel_gf16_nmse.t27
new file mode 100644
index 0000000000..b00d95892a
--- /dev/null
+++ b/apps/website/public/t27f/graph/specs/reel_gf16_nmse.t27
@@ -0,0 +1,349 @@
+// SPDX-License-Identifier: Apache-2.0
+; specs/t27f/reel_gf16_nmse.t27 -- the second real T27F reel, and the first in another domain:
+; research, "how close does GF16 come to bfloat16", as the project's own NMSE protocol asks it.
+; gHashTag/trinity#1677 wants at least two very different domains on one widget and one workflow,
+; and a 27-step map that is source-grounded with its gaps named. The first reel
+; (reel_t27_basics.t27) is a course, routed to engineering; this one is a benchmark, routed to
+; research, and both go through the same code: topic_engine.t27 decides, topic_reel.t27 checks,
+; reel.t27 and deck.t27 draw. Nothing below is a rule of this file's own.
+
+; SOURCE: gHashTag/t27 at SOURCE_COMMIT, measured on MEASURED_ON. The protocol spec
+; specs/benchmarks/gf16_bfloat16_nmse.t27 and its mirror docs/GF16_BFLOAT16_NMSE_PROTOCOL.md, the
+; manifest schema schemas/nmse-protocol-v1.json, the roadmap docs/SCIENTIFIC_IMPROVEMENT_PLAN.md
+; (PUB-01, PUB-02), the PUB-02 run harness specs/benchmarks/gf16_bfloat16_nmse_run.t27 and the
+; manifest it wrote, RUN_MANIFEST (#10021), and what the repo already holds about GF16. Every cell
+; names its source in SOURCES; a cell with none is a gap and says in MISSING what would ground it.
+
+; BRIEF is the first three sentences of the protocol spec's header, verbatim. route_brief
+; counts gf16 twice and benchmark once, no other list is hit, so the domain is DOMAIN_RESEARCH.
+
+; LENSES: one row per lens. Steps 1-9 are the formats and why they compare at all; 10-18 the protocol
+; and the one run it asks for; 19-27 what may be said and what the repo has said so far.
+
+; MEASURED on 2026-10-18:
+;   - grounded: the source is in the repo at SOURCE_COMMIT (path and section in SOURCES).
+;   - test: t27c test-report and t27b test --check on the Railway lab passed all 7 tests of the
+;     protocol spec; a planted GF16_MANT_BITS = 8 turned 2 of them red under both, so they are real.
+;     The harness's own tests check its procedure, not the committed manifest, so no step of the
+;     run (16, 17, 25) is marked as tested; on a DELIVER step a test would not count anyway.
+;   - review: the PRs that wrote the protocol (#1399), the spec rewrite (#5947) and the run (#10021)
+;     have 0 reviews.
+;   - live: GET https://t27.ai/t27/files/<path> returned 200 for the protocol spec and the schema,
+;     and 404 for the doc, FORMAT-SPEC-001.json, gf16_bench_results.json, the crosswalk, the paper
+;     draft, the harness and the manifest; a made-up path returned 404, so 200 is not a catch-all.
+; The engine asks a research LEARN step for a source link, a PRACTICE step for a review or a passing
+; test, and a DELIVER step for a review. So: 15 published (sourced, earned, and live), 1 verified
+; (reporting rules: sourced, not live), 9 drafts (practice or deliver steps with neither a test nor a
+; review, three of them the run's own cells) and 2 gaps.
+
+; THE RUN. PUB-02 asks for one sealed bench/results/nmse-*.json. Until #10021 the repo held none, and
+; steps 16, 17 and 25 (the run, its schema check, the ratio per distribution) were gaps. They now cite
+; RUN_HARNESS and RUN_MANIFEST, and they are DRAFTS, not verified: each is a DELIVER step, a research
+; DELIVER step is verified by a review, and the run has none. The manifest is a software run on the
+; Railway lab (runner.host_arch x86_64), not a silicon measurement.
+; THE GAPS that remain: the chip repo's manifest, gHashTag/tt-trinity-gamma
+; tests/vectors/nmse_gf16_bf16.golden.json at GAMMA_COMMIT, pins the seeds but says measured_silicon
+; false and harness_committed false; and the paper draft has no Delta_dB yet (PUB-02 allowed one only
+; after the manifest, and attaching the manifest to the draft is still open). The older GF16/BF16
+; numbers, conformance/gf16_bench_results.json (2026-04-05, no seed, no seal), are drawn as a draft
+; that the protocol itself says does not count.
+
+; Not claimed: this reel quotes no NMSE value, no ratio and no winner; the manifest holds the numbers
+; and is the only place to read them. Nothing here is silicon. No GIF or MP4; stills only, for the chat.
+; phi^2 + 1/phi^2 = 3 | TRINITY
+
+module reel_gf16_nmse;
+
+use t27f::reel::CELL_COUNT;
+use t27f::reel::DEMO_COUNT;
+use t27f::reel::DEMO_CELL;
+use t27f::reel::DEMO_LENS;
+use t27f::topic_engine::STATUS_GAP;
+use t27f::topic_engine::STATUS_DRAFT;
+use t27f::topic_engine::STATUS_VERIFIED;
+use t27f::topic_engine::STATUS_PUBLISHED;
+use t27f::topic_engine::STAGE_DELIVER;
+use t27f::topic_engine::STAGE_PRACTICE;
+use t27f::topic_engine::DOMAIN_RESEARCH;
+use t27f::topic_engine::CONTENT_WORDS;
+use t27f::topic_engine::ENGINEERING_WORDS;
+use t27f::topic_engine::RESEARCH_WORDS;
+use t27f::topic_engine::SALES_WORDS;
+use t27f::topic_engine::keyword_hits;
+use t27f::topic_engine::route_brief;
+use t27f::topic_engine::step_stage;
+use t27f::topic_engine::earned_status;
+use t27f::topic_reel::count_status;
+use t27f::topic_reel::count_true;
+use t27f::topic_reel::statuses_earned;
+use t27f::topic_reel::gaps_are_named;
+use t27f::topic_reel::slides_fit;
+use t27f::topic_reel::stage_slides_bare;
+
+pub const TOPIC_ID : str = "gf16-nmse";
+pub const SOURCE_REPO : str = "gHashTag/t27";
+pub const SOURCE_SPEC : str = "specs/benchmarks/gf16_bfloat16_nmse.t27";
+pub const SOURCE_COMMIT : str = "cc80a305dd5fef1cd21f930e1394ae47cbdacbfc";
+pub const GAMMA_REPO : str = "gHashTag/tt-trinity-gamma";
+pub const GAMMA_COMMIT : str = "de484c4ff249356624ec508127fcbab880ee25fc";
+pub const LIVE_BASE : str = "https://t27.ai/t27/files/";
+pub const MEASURED_ON : str = "2026-10-18";
+/// The PUB-02 run (#10021): the harness that wrote the manifest, and the manifest.
+pub const RUN_HARNESS : str = "specs/benchmarks/gf16_bfloat16_nmse_run.t27";
+pub const RUN_MANIFEST : str = "bench/results/nmse-railway-x86_64-0x2545F4914F6CDD1D-2026-10-17.json";
+
+pub const BRIEF : str = "GF16 against bfloat16 NMSE protocol (TRI-NET benchmark 0). The standard comparison of GoldenFloat GF16 and bfloat16 numeric fidelity, as normalised mean squared error over named reference distributions. Protocol only: no silicon number is asserted.";
+/// The domain route_brief gives that brief (see the_domain_is_routed_not_chosen).
+pub const DOMAIN : u8 = 3;
+
+pub const LENS_TITLES : [3]str = ["formats", "protocol", "claims"];
+
+pub const TITLES : [27]str = [
+    "NMSE, the measure",
+    "GF16: 1 | 6 | 9, bias 31",
+    "bfloat16: 1 | 8 | 7, bias 127",
+    "Both are 16 bits",
+    "Each bias is half the exponent range",
+    "GF16 trades exponent for mantissa",
+    "Why the same width makes it fair",
+    "Where P3109 places both",
+    "GF16 in the numeric SSOT",
+    "Five reference distributions",
+    "Check phi before any NMSE",
+    "What a manifest holds",
+    "The witness holds in f64",
+    "D_DEEP weights sum to one",
+    "NMSE is never negative",
+    "The sealed run, 5 x 10M samples",
+    "A manifest checked against its schema",
+    "The chip repo's manifest",
+    "Reading the ratio",
+    "Reporting rules",
+    "What is not claimed",
+    "Which way the ratio points",
+    "The old numbers, 2026-04-05",
+    "Why they do not count",
+    "The ratio per distribution",
+    "Delta_dB in the paper",
+    "The paper draft"
+];
+
+/// Where each cell's text comes from in SOURCE_REPO at SOURCE_COMMIT; "" is a gap.
+pub const SOURCES : [27]str = [
+    "specs/benchmarks/gf16_bfloat16_nmse.t27 header, NMSE(F)",
+    "specs/benchmarks/gf16_bfloat16_nmse.t27 GF16_*",
+    "specs/benchmarks/gf16_bfloat16_nmse.t27 BF16_*",
+    "specs/benchmarks/gf16_bfloat16_nmse.t27 test both_layouts_are_sixteen_bits",
+    "specs/benchmarks/gf16_bfloat16_nmse.t27 test biases_are_half_the_exponent_range",
+    "specs/benchmarks/gf16_bfloat16_nmse.t27 test gf16_trades_exponent_for_mantissa",
+    "docs/GF16_BFLOAT16_NMSE_PROTOCOL.md section 3.3",
+    "docs/P3109_CROSSWALK_4PARAM.md rows bf16 and gf16",
+    "conformance/FORMAT-SPEC-001.json",
+    "specs/benchmarks/gf16_bfloat16_nmse.t27 DISTRIBUTIONS",
+    "specs/benchmarks/gf16_bfloat16_nmse.t27 WITNESS_TOLERANCE",
+    "schemas/nmse-protocol-v1.json",
+    "specs/benchmarks/gf16_bfloat16_nmse.t27 test identity_witnesses_hold_in_f64",
+    "specs/benchmarks/gf16_bfloat16_nmse.t27 test d_deep_mixture_weights_sum_to_one",
+    "specs/benchmarks/gf16_bfloat16_nmse.t27 test nmse_non_negative_and_zero_baseline_undefined",
+    "specs/benchmarks/gf16_bfloat16_nmse_run.t27 nmse_manifest; bench/results/nmse-railway-x86_64-0x2545F4914F6CDD1D-2026-10-17.json samples_per_distribution, seal_hash",
+    "bench/results/nmse-railway-x86_64-0x2545F4914F6CDD1D-2026-10-17.json schema_version, under schemas/nmse-protocol-v1.json",
+    "",
+    "specs/benchmarks/gf16_bfloat16_nmse.t27 header, the ratio",
+    "docs/GF16_BFLOAT16_NMSE_PROTOCOL.md section 8",
+    "specs/benchmarks/gf16_bfloat16_nmse.t27 NON_CLAIMS",
+    "specs/benchmarks/gf16_bfloat16_nmse.t27 test ratio_direction",
+    "conformance/gf16_bench_results.json",
+    "docs/GF16_BFLOAT16_NMSE_PROTOCOL.md section 6",
+    "bench/results/nmse-railway-x86_64-0x2545F4914F6CDD1D-2026-10-17.json results.*.ratio, from specs/benchmarks/gf16_bfloat16_nmse_run.t27",
+    "",
+    "docs/WHITEPAPER/gf_paper_v3_imrad_draft.md (PUB-01)"
+];
+
+/// What would ground each gap; "" for a cell that has its source.
+pub const MISSING : [27]str = [
+    "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "",
+    "tt-trinity-gamma nmse_gf16_bf16.golden.json pins seeds only: measured_silicon false, harness_committed false",
+    "", "", "", "", "", "", "",
+    "a Delta_dB figure in the paper draft: the manifest is not attached to it yet",
+    ""
+];
+
+/// The measurements per cell (see the header for how each was taken).
+pub const GROUNDED : [27]bool = [true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, false, true, true, true, true, true, true, true, false, true];
+pub const TEST_PASS : [27]bool = [false, false, false, true, true, true, false, false, false, false, false, false, true, true, true, false, false, false, false, false, false, true, false, false, false, false, false];
+pub const REVIEWED : [27]bool = [false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false];
+pub const LIVE : [27]bool = [true, true, true, true, true, true, false, false, false, true, true, true, true, true, true, false, false, false, true, false, true, true, false, false, false, false, false];
+
+/// What a host passes the viewer, per cell: the status code and the step number as a label.
+pub const STATUS : [27]u8 = [5, 5, 5, 5, 5, 5, 3, 3, 3, 5, 5, 5, 5, 5, 5, 3, 3, 0, 5, 4, 5, 5, 3, 3, 3, 0, 3];
+pub const LABELS : [27]str = ["1", "2", "3", "4", "5", "6", "7", "8", "9", "10", "11", "12", "13", "14", "15", "16", "17", "18", "19", "20", "21", "22", "23", "24", "25", "26", "27"];
+
+/// Slide text per demo scene, checked by topic_reel.t27 slides_fit (index scene*4+row).
+pub const HEAD : [5]str = [
+    "GF16 vs bfloat16 NMSE",
+    "Steps 1-9: formats",
+    "Witness first",
+    "Evidence",
+    "The sealed run"
+];
+pub const ROWS : [20]str = [
+    "", "", "", "",
+    "", "", "", "",
+    "Step 11 of 27: check phi before NMSE",
+    "phi^2 + 1/phi^2 = 3 within 1e-15",
+    "A failed witness aborts the run",
+    "No manifest is written after a failure",
+    "7 of 7 protocol tests pass on the lab",
+    "15 published, 1 verified, 9 drafts",
+    "2 gaps: chip run, paper Delta_dB",
+    "Measured 2026-10-18",
+    "PUB-02: one sealed NMSE manifest",
+    "5 distributions, 10M samples each",
+    "A software run, not silicon",
+    "Draft until someone reviews it"
+];
+
+/// The protocol spec's own test count, which the evidence slide quotes.
+pub const PROTOCOL_TESTS : i32 = 7;
+
+pub fn step_number(cell: i32) -> i32 {
+    return cell + 1;
+}
+
+/// Whether a SOURCES entry names a path: `path` occurs in `src` byte for byte.
+pub fn cites(src: []const u8, n: usize, path: []const u8, m: usize) -> bool {
+    if (m == 0 || m > n) {
+        return false;
+    }
+    var i : usize = 0;
+    while (i + m <= n) {
+        var j : usize = 0;
+        var same : bool = true;
+        while (j < m && same) {
+            if (src[i + j] != path[j]) {
+                same = false;
+            }
+            j += 1;
+        }
+        if (same) {
+            return true;
+        }
+        i += 1;
+    }
+    return false;
+}
+
+test the_domain_is_routed_not_chosen {
+    assert DOMAIN == DOMAIN_RESEARCH;
+    // gf16, gf16, benchmark; "bfloat16" is not "gf16", and no other list is hit
+    assert keyword_hits(BRIEF, BRIEF.len, RESEARCH_WORDS, RESEARCH_WORDS.len) == 3;
+    assert keyword_hits(BRIEF, BRIEF.len, CONTENT_WORDS, CONTENT_WORDS.len) == 0;
+    assert keyword_hits(BRIEF, BRIEF.len, ENGINEERING_WORDS, ENGINEERING_WORDS.len) == 0;
+    assert keyword_hits(BRIEF, BRIEF.len, SALES_WORDS, SALES_WORDS.len) == 0;
+    assert route_brief(BRIEF, BRIEF.len) == DOMAIN;
+}
+
+test every_step_is_a_cell {
+    assert CELL_COUNT == 27;
+    var c : i32 = 0;
+    while (c < CELL_COUNT) {
+        const i : usize = @intCast(c);
+        assert TITLES[i].len > 0;
+        var want : i32 = 1;
+        if (step_number(c) >= 10) {
+            want = 2;
+        }
+        const len : i32 = @intCast(LABELS[i].len);
+        assert len == want;
+        c = c + 1;
+    }
+    assert LENS_TITLES[2].len > 0;
+}
+
+test a_gap_is_named_not_filled {
+    assert gaps_are_named(SOURCES, MISSING, GROUNDED);
+    assert count_true(GROUNDED) == 25;
+    // a gap is drawn as a gap, and only a gap is
+    var c : i32 = 0;
+    while (c < CELL_COUNT) {
+        const i : usize = @intCast(c);
+        assert (STATUS[i] == STATUS_GAP) == (GROUNDED[i] == false);
+        c = c + 1;
+    }
+    // the two gaps left are DELIVER steps: the chip repo's run and the paper's Delta_dB
+    assert STATUS[17] == STATUS_GAP;
+    assert STATUS[25] == STATUS_GAP;
+    assert step_stage(17) == STAGE_DELIVER;
+    assert step_stage(25) == STAGE_DELIVER;
+    // the run's own cells cite the run, by both paths
+    assert MISSING[15].len == 0;
+    assert MISSING[16].len == 0;
+    assert MISSING[24].len == 0;
+    assert cites(SOURCES[15], SOURCES[15].len, RUN_HARNESS, RUN_HARNESS.len);
+    assert cites(SOURCES[15], SOURCES[15].len, RUN_MANIFEST, RUN_MANIFEST.len);
+    assert cites(SOURCES[16], SOURCES[16].len, RUN_MANIFEST, RUN_MANIFEST.len);
+    assert cites(SOURCES[24], SOURCES[24].len, RUN_MANIFEST, RUN_MANIFEST.len);
+    assert cites(SOURCES[24], SOURCES[24].len, RUN_HARNESS, RUN_HARNESS.len);
+    // and cites is not a yes-machine: the protocol's own cells do not name the run
+    assert cites(SOURCES[0], SOURCES[0].len, RUN_MANIFEST, RUN_MANIFEST.len) == false;
+    assert cites(SOURCES[16], SOURCES[16].len, RUN_HARNESS, RUN_HARNESS.len) == false;
+}
+
+test a_status_is_earned_not_chosen {
+    assert statuses_earned(STATUS, DOMAIN, GROUNDED, TEST_PASS, REVIEWED, LIVE);
+    // the evidence slide's "15 published, 1 verified, 9 drafts" and "2 gaps"
+    assert count_status(STATUS, STATUS_PUBLISHED) == 15;
+    assert count_status(STATUS, STATUS_VERIFIED) == 1;
+    assert count_status(STATUS, STATUS_DRAFT) == 9;
+    assert count_status(STATUS, STATUS_GAP) == 2;
+    assert count_true(REVIEWED) == 0;
+    // every passing test is one of the protocol's own tests, on a PRACTICE step
+    assert count_true(TEST_PASS) == PROTOCOL_TESTS;
+    var c : i32 = 0;
+    while (c < CELL_COUNT) {
+        const i : usize = @intCast(c);
+        if (TEST_PASS[i]) {
+            assert step_stage(@intCast(c)) == STAGE_PRACTICE;
+        }
+        c = c + 1;
+    }
+    // the old numbers have a source but no seed, seal, test or review: a draft, never published
+    assert STATUS[22] == STATUS_DRAFT;
+}
+
+test the_run_is_a_draft_until_reviewed {
+    // steps 16, 17 and 25 now have the run as their source, and are DELIVER steps
+    assert STATUS[15] == STATUS_DRAFT;
+    assert STATUS[16] == STATUS_DRAFT;
+    assert STATUS[24] == STATUS_DRAFT;
+    assert step_stage(15) == STAGE_DELIVER;
+    assert step_stage(16) == STAGE_DELIVER;
+    assert step_stage(24) == STAGE_DELIVER;
+    assert REVIEWED[15] == false;
+    assert REVIEWED[16] == false;
+    assert REVIEWED[24] == false;
+    // a passing test and a live page do not lift a research DELIVER step: only a review does
+    assert earned_status(15, DOMAIN, true, true, false, true) == STATUS_DRAFT;
+    assert earned_status(15, DOMAIN, true, false, true, false) == STATUS_VERIFIED;
+    assert earned_status(15, DOMAIN, true, false, true, true) == STATUS_PUBLISHED;
+}
+
+test the_camera_is_the_demo_camera {
+    assert DEMO_COUNT == 5;
+    // scene 1 shows lens 0, the row HEAD[1] calls "Steps 1-9"
+    assert DEMO_LENS[1] == 0;
+    // scenes 2 and 3 focus cell 10, which the focus slide calls "Step 11": the witness
+    assert DEMO_CELL[2] == 10;
+    assert DEMO_CELL[3] == 10;
+    assert step_number(DEMO_CELL[2]) == 11;
+    assert STATUS[10] == STATUS_PUBLISHED;
+}
+
+test every_slide_fits_every_preset {
+    assert slides_fit(HEAD, ROWS);
+    assert stage_slides_bare(ROWS);
+}
+
+invariant twenty_seven_steps {
+    assert CELL_COUNT == 27;
+}
diff --git a/apps/website/public/t27f/graph/specs/reel_t27_basics.t27 b/apps/website/public/t27f/graph/specs/reel_t27_basics.t27
new file mode 100644
index 0000000000..e034f749e6
--- /dev/null
+++ b/apps/website/public/t27f/graph/specs/reel_t27_basics.t27
@@ -0,0 +1,212 @@
+// SPDX-License-Identifier: Apache-2.0
+; specs/t27f/reel_t27_basics.t27 -- the first real T27F reel: course 0, "t27 basics", 27 lessons.
+; trinity#1677 (Topic-to-Value Engine) asks for a 27-step map that is source-grounded, with gaps shown
+; instead of filler. This file is that map for one real topic, drawn with the reel camera
+; (specs/t27f/reel.t27) and the deck look (specs/t27f/deck.t27).
+
+; SOURCE: gHashTag/trinity apps/website/specs/course/t27-basics.t27 at commit SOURCE_COMMIT. Its 27
+; lessons, in order, are the 27 cells; nothing here is new teaching text. The slide rows quote or
+; shorten that file's lesson 11 text and task, its SAY_PRIVATE line, and courses.t27's order.
+
+; LENSES: the reel draws one row per lens, nine cells per row. The course has 9 modules of 3 lessons,
+; so each row is three whole modules: lessons 1-9 (a spec file, values and types, arrays and trits),
+; 10-18 (tests and functions, inside a function, your own types), 19-27 (modules and rules, the
+; compiler and tri, errors and what next). The test lenses_are_whole_modules holds that.
+
+; WORKFLOW: this file is data. The checks it runs on that data are the shared ones in
+; specs/t27f/topic_reel.t27 (statuses_earned, slides_fit, stage_slides_bare), which the research
+; reel reel_gf16_nmse.t27 runs too; only the checks about this course stay here.
+
+; STATUS is earned through the topic engine (specs/t27f/topic_engine.t27, earned_status), not
+; chosen here. The engine routes BRIEF (the source's TITLE and DESCRIPTION at SOURCE_COMMIT) with
+; route_brief, which counts the KEYWORD_MATCH hits itself: spec, compiler, fpga are 3 engineering
+; hits and no other list is hit, so the domain is DOMAIN_ENGINEERING. Until 2026-10-17 the hits were
+; counted by hand and written down here. What was measured, per lesson, on 2026-10-17:
+;   - grounded: every lesson has its text in the source spec, so every one has a source link.
+;   - spec: t27c test-report on the Railway lab passed every test of all 27 lesson specs
+;     (apps/website/public/t27/files/specs/basics/*.t27 at SOURCE_COMMIT). 23 of them report their
+;     passes as vacuous because every assert is on constants and is checked when compiled; planting
+;     a wrong one (lesson 11, HOURS == 25) turned that test red, so the checks are real.
+;   - review: neither trinity PR that wrote the course (#1463, #1472) has a review, so no lesson does.
+;   - page: GET https://t27.ai/learn/<lesson-id>/ returned 200 with the title "<lesson>: t27 basics
+;     course, lesson N of 27" for all 27; a made-up id returned 404, so 200 is not a catch-all.
+; The engine asks a LEARN step for a source link and an engineering PRACTICE step for a passing test,
+; so lessons in those stages are VERIFIED, and their live pages make them PUBLISHED: 18 of 27. An
+; engineering DELIVER step asks for a review, which no lesson has, and a live page does not stand in
+; for one: lessons 7-9, 16-18 and 25-27 stay DRAFT although their pages are live. Until 2026-10-17
+; this file used its own rule (live page and passing spec -> published) and drew all 27 as published.
+
+; SCENES: the t27f_view host draws the reel.t27 demo camera (overview, lens 0, focus on cell 10,
+; evidence, call), so this reel uses that camera; the test the_camera_is_the_demo_camera holds it.
+; The slide text below is checked against deck.t27 for every preset, so the host never has to
+; refuse it as "does not fit one slide".
+
+; TWO COMPILERS: this file, reel.t27 and deck.t27 run under t27c (the Zig backend) and under t27b
+; (t27's own AArch64 backend, `t27b test --check`, qemu-aarch64 on the lab). On 2026-10-17 the two
+; agreed on every test, and each planted fault failed the same test in both (see the PRs).
+; t27b also refused the first draft of this file: it compared a str's u64 `.len` with an i32, which
+; t27c accepted; every length is now cast to i32 before it is compared.
+
+; Not claimed: no GIF or MP4 is rendered or posted; stills only, for the chat.
+; phi^2 + 1/phi^2 = 3 | TRINITY
+
+module reel_t27_basics;
+
+use t27f::reel::CELL_COUNT;
+use t27f::reel::COLS;
+use t27f::reel::DEMO_COUNT;
+use t27f::reel::DEMO_CELL;
+use t27f::reel::DEMO_LENS;
+use t27f::reel::STYLE_PUBLISHED;
+use t27f::reel::cell_row;
+use t27f::reel::cell_style;
+use t27f::topic_engine::STATUS_DRAFT;
+use t27f::topic_engine::STATUS_PUBLISHED;
+use t27f::topic_engine::STAGE_DELIVER;
+use t27f::topic_engine::DOMAIN_ENGINEERING;
+use t27f::topic_engine::ENGINEERING_WORDS;
+use t27f::topic_engine::keyword_hits;
+use t27f::topic_engine::route_brief;
+use t27f::topic_engine::step_stage;
+use t27f::topic_reel::count_status;
+use t27f::topic_reel::count_true;
+use t27f::topic_reel::statuses_earned;
+use t27f::topic_reel::slides_fit;
+use t27f::topic_reel::stage_slides_bare;
+
+pub const TOPIC_ID : str = "t27-basics";
+pub const SOURCE_REPO : str = "gHashTag/trinity";
+pub const SOURCE_SPEC : str = "apps/website/specs/course/t27-basics.t27";
+pub const SOURCE_COMMIT : str = "ee512359254bcd7438bb6a79c8a4a7f8b554b620";
+pub const LESSON_PAGE_BASE : str = "https://t27.ai/learn/";
+pub const MEASURED_ON : str = "2026-10-17";
+
+pub const LESSONS_PER_MODULE : i32 = 3;
+pub const MODULES_PER_LENS : i32 = 3;
+
+/// The brief the engine routes: the source's TITLE, a space, and its DESCRIPTION, verbatim.
+pub const BRIEF : str = "t27 basics: the language in 27 lessons Course 0, 27 lessons, one infographic and one t27 spec each: a module, constants and types, functions and tests, then the compiler's stages and the 7 languages it writes. It comes before the FPGA course.";
+/// The domain route_brief gives that brief (see the_domain_is_routed_not_chosen).
+pub const DOMAIN : u8 = 2;
+
+/// The measurements per lesson, in lesson order (see the header for how each was taken).
+pub const GROUNDED : [27]bool = [true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true];
+pub const PAGE_LIVE : [27]bool = [true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true];
+pub const SPEC_PASSES : [27]bool = [true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true];
+pub const REVIEWED : [27]bool = [false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false];
+
+/// What a host passes the viewer, per cell: the status code and the lesson number as a label.
+pub const STATUS : [27]u8 = [5, 5, 5, 5, 5, 5, 3, 3, 3, 5, 5, 5, 5, 5, 5, 3, 3, 3, 5, 5, 5, 5, 5, 5, 3, 3, 3];
+pub const LABELS : [27]str = ["1", "2", "3", "4", "5", "6", "7", "8", "9", "10", "11", "12", "13", "14", "15", "16", "17", "18", "19", "20", "21", "22", "23", "24", "25", "26", "27"];
+
+pub const LENS_TITLES : [3]str = ["values", "logic", "tools"];
+
+/// Slide text per demo scene. HEAD is the headline, one line; ROWS holds four card rows per scene
+/// (index scene*4+row; an empty row is no row). topic_reel.t27 slides_fit says why and checks it.
+pub const HEAD : [5]str = [
+    "t27 basics: 27 lessons",
+    "Lessons 1-9: values",
+    "Many small tests",
+    "Evidence",
+    "Start lesson 1"
+];
+pub const ROWS : [20]str = [
+    "", "", "", "",
+    "", "", "", "",
+    "Lesson 11 of 27: one test, one idea",
+    "A test's name says which idea broke",
+    "The lesson spec: 3 tests, 5 asserts",
+    "Try: break one, the other two still pass",
+    "27 of 27 lesson pages live on t27.ai",
+    "27 of 27 lesson specs pass on the lab",
+    "18 published; 9 wait for a review",
+    "Measured 2026-10-17",
+    "t27.ai/learn/what-a-spec-is/",
+    "Progress stays in this browser",
+    "Next: the FPGA course",
+    ""
+];
+
+pub fn lesson_number(cell: i32) -> i32 {
+    return cell + 1;
+}
+
+pub fn module_of(cell: i32) -> i32 {
+    return @divTrunc(cell, LESSONS_PER_MODULE);
+}
+
+test every_lesson_is_a_cell {
+    assert CELL_COUNT == 27;
+    assert lesson_number(0) == 1;
+    assert lesson_number(CELL_COUNT - 1) == 27;
+    assert LABELS[0].len == 1;
+    assert LABELS[26].len == 2;
+    var c : i32 = 0;
+    while (c < CELL_COUNT) {
+        const n : i32 = lesson_number(c);
+        var want : i32 = 1;
+        if (n >= 10) {
+            want = 2;
+        }
+        const len : i32 = @intCast(LABELS[@intCast(c)].len);
+        assert len == want;
+        c = c + 1;
+    }
+}
+
+test lenses_are_whole_modules {
+    assert COLS == LESSONS_PER_MODULE * MODULES_PER_LENS;
+    var c : i32 = 0;
+    while (c < CELL_COUNT) {
+        // the row a cell is drawn in is the lens of its module: three whole modules per row
+        assert cell_row(c) == @divTrunc(module_of(c), MODULES_PER_LENS);
+        c = c + 1;
+    }
+    assert LENS_TITLES[2].len > 0;
+}
+
+test a_status_is_earned_not_chosen {
+    assert statuses_earned(STATUS, DOMAIN, GROUNDED, SPEC_PASSES, REVIEWED, PAGE_LIVE);
+    assert count_true(GROUNDED) == 27;
+    assert count_true(PAGE_LIVE) == 27;
+    assert count_true(SPEC_PASSES) == 27;
+    assert count_true(REVIEWED) == 0;
+    // the evidence slide's "18 published; 9 wait for a review"
+    assert count_status(STATUS, STATUS_PUBLISHED) == 18;
+    assert count_status(STATUS, STATUS_DRAFT) == 9;
+    // the drafts are exactly the DELIVER lessons, whose pages are live all the same
+    var d : i32 = 0;
+    while (d < CELL_COUNT) {
+        const deliver : bool = step_stage(@intCast(d)) == STAGE_DELIVER;
+        assert (STATUS[@intCast(d)] == STATUS_DRAFT) == deliver;
+        d = d + 1;
+    }
+    // a published cell wears the published style, never a gap or a draft
+    assert cell_style(STATUS[0]) == STYLE_PUBLISHED;
+}
+
+test the_domain_is_routed_not_chosen {
+    assert DOMAIN == DOMAIN_ENGINEERING;
+    // spec, compiler, fpga: "tests" is not "test", and no other list is hit
+    assert keyword_hits(BRIEF, BRIEF.len, ENGINEERING_WORDS, ENGINEERING_WORDS.len) == 3;
+    assert route_brief(BRIEF, BRIEF.len) == DOMAIN;
+}
+
+test the_camera_is_the_demo_camera {
+    assert DEMO_COUNT == 5;
+    // scene 1 shows lens 0, the row HEAD[1] calls "Lessons 1-9"
+    assert DEMO_LENS[1] == 0;
+    // scenes 2 and 3 focus cell 10, which the focus slide calls "Lesson 11"
+    assert DEMO_CELL[2] == 10;
+    assert DEMO_CELL[3] == 10;
+    assert lesson_number(DEMO_CELL[2]) == 11;
+}
+
+test every_slide_fits_every_preset {
+    assert slides_fit(HEAD, ROWS);
+    assert stage_slides_bare(ROWS);
+}
+
+invariant one_lens_per_row {
+    assert CELL_COUNT == 3 * COLS;
+}
diff --git a/apps/website/public/t27f/graph/specs/spec_graph.t27 b/apps/website/public/t27f/graph/specs/spec_graph.t27
new file mode 100644
index 0000000000..0158c8e01d
--- /dev/null
+++ b/apps/website/public/t27f/graph/specs/spec_graph.t27
@@ -0,0 +1,1072 @@
+// SPDX-License-Identifier: Apache-2.0
+; specs/t27f/spec_graph.t27 -- the T27F spec graph IR: what a .t27 file becomes before T27F draws
+; it (RFC gHashTag/trinity#1649, epic gHashTag/trinity#1648, tracked in gHashTag/t27#10020).
+; T27F is the visual spec of .t27; the definition lives in .claude/skills/t27f/SKILL.md, "What T27F
+; is". This file is its core: one spec -> one graph -> many views. Every view (architecture, data
+; flow, dependencies, tests) is a projection of the same graph, and the graph is read from the
+; spec's source, never drawn by hand.
+; What this file decides, deterministically and without a language model:
+;   - the vocabulary: node kinds, edge kinds and inference labels, as u8 codes with name tables;
+;   - the records: a node carries kind, label, name and a source span; an edge carries kind,
+;     endpoints, label and the source line it was read from;
+;   - validation: validate_graph() returns GRAPH_OK or the first rule a graph breaks, and
+;     first_bad_node() / first_bad_edge() name the record that broke it;
+;   - source mapping both ways: a node has a span, and node_at_line() finds the node of a line;
+;   - which ui_plan widget (specs/t27f/ui_plan.t27) draws a node, so a renderer never picks one.
+; Inference labels, from strongest to weakest (RFC #1649, "Parsing and inference levels"):
+;   EXACT     present in the spec's source as written (a declaration, a call, a `use`);
+;   DERIVED   computed from EXACT facts by a rule stated here (tested_by is calls read backwards);
+;   SUGGESTED a model's explanation; drawn as plain text, always with the source lines it explains;
+;   UNKNOWN   cannot be read from the source; drawn alone, with no edge into or out of it.
+; Not claimed here: t27c has no graph export yet, so no graph is generated from a spec; the fixture
+; below is read by hand. No renderer draws a graph, there is no graph diff, and node kinds finer
+; than a top-level declaration (steps, branches, operators, parameters) are not in IR version 1.
+; phi^2 + 1/phi^2 = 3 | TRINITY
+
+module t27f_spec_graph;
+
+use t27f::ui_plan::UiPlan;
+use t27f::ui_plan::blank_plan;
+use t27f::ui_plan::validate_plan;
+use t27f::ui_plan::first_bad_slot;
+use t27f::ui_plan::catalog_widget;
+use t27f::ui_plan::bit;
+use t27f::ui_plan::PLAN_OK;
+use t27f::ui_plan::ERR_BINDING_KIND;
+use t27f::ui_plan::WIDGET_HONEYCOMB_CARD;
+use t27f::ui_plan::WIDGET_FORMULA_VIEW;
+use t27f::ui_plan::WIDGET_METRICS_TABLE;
+use t27f::ui_plan::WIDGET_RUN_BUTTON;
+use t27f::ui_plan::WIDGET_TEXT_BLOCK;
+use t27f::ui_plan::WIDGET_SOURCE;
+use t27f::ui_plan::SOURCE_NONE;
+use t27f::ui_plan::SOURCE_SPEC;
+use t27f::ui_plan::SOURCE_FORMULA;
+use t27f::ui_plan::SOURCE_METRICS;
+use t27f::ui_plan::PROP_TITLE;
+use t27f::ui_plan::PROP_SPEC_PATH;
+use t27f::ui_plan::PROP_FORMULA_ID;
+use t27f::ui_plan::PROP_CAPTION;
+use t27f::ui_plan::ACTION_NONE;
+use t27f::ui_plan::ACTION_OPEN_SPEC;
+use t27f::ui_plan::ACTION_RUN_TESTS;
+use t27f::ui_plan::CAP_READ_SPECS;
+use t27f::ui_plan::CAP_RUN_LAB;
+
+/// The IR version a graph names. Any other version is refused.
+pub const GRAPH_IR_VERSION : u32 = 1;
+
+/// Node kinds. IR version 1 has one node per top-level declaration, plus OPAQUE for a region the
+/// source names but this IR cannot read into.
+pub const NODE_MODULE : u8 = 0;
+pub const NODE_CONST : u8 = 1;
+pub const NODE_FN : u8 = 2;
+pub const NODE_TEST : u8 = 3;
+pub const NODE_INVARIANT : u8 = 4;
+pub const NODE_BENCH : u8 = 5;
+pub const NODE_USE : u8 = 6;
+pub const NODE_OPAQUE : u8 = 7;
+pub const NODE_KINDS : u8 = 8;
+pub const NODE_KIND_NAMES : [8]str = ["module", "const", "fn", "test", "invariant", "bench", "use", "opaque"];
+
+/// Edge kinds, read from -> to:
+///   CALLS      from a fn, test, invariant or bench to the fn it calls;
+///   USES       from a module or a body to the const or `use` it names (module -> use is the
+///              `use` statement itself);
+///   TESTED_BY  from a fn to the test, invariant or bench that calls it; DERIVED from CALLS;
+///   CONSTRAINS from an invariant to the const or fn its asserts are about;
+///   DATA_FLOW  from a value (const, fn result, import, opaque region) to a body whose result it
+///              reaches.
+pub const EDGE_CALLS : u8 = 0;
+pub const EDGE_USES : u8 = 1;
+pub const EDGE_TESTED_BY : u8 = 2;
+pub const EDGE_CONSTRAINS : u8 = 3;
+pub const EDGE_DATA_FLOW : u8 = 4;
+pub const EDGE_KINDS : u8 = 5;
+pub const EDGE_KIND_NAMES : [5]str = ["calls", "uses", "tested_by", "constrains", "data_flow"];
+
+/// Inference labels. A smaller code is a stronger claim; an edge is never stronger than either
+/// of its endpoints.
+pub const LABEL_EXACT : u8 = 0;
+pub const LABEL_DERIVED : u8 = 1;
+pub const LABEL_SUGGESTED : u8 = 2;
+pub const LABEL_UNKNOWN : u8 = 3;
+pub const LABEL_KINDS : u8 = 4;
+pub const LABEL_NAMES : [4]str = ["exact", "derived", "suggested", "unknown"];
+
+/// The code a name lookup returns for a name that is not in its table.
+pub const NO_CODE : u8 = 255;
+
+/// Which node kinds each edge kind may start and end at, as masks of node-kind bits, indexed by
+/// edge kind. The invariant edge_masks_are_spelled_right rebuilds each one from the named kinds.
+/// From: calls fn+test+invariant+bench; uses module+fn+test+invariant+bench; tested_by fn;
+/// constrains invariant; data_flow const+fn+use+opaque.
+pub const EDGE_FROM_KINDS : [5]u32 = [60, 61, 4, 16, 198];
+/// To: calls fn; uses const+use; tested_by test+invariant+bench; constrains const+fn;
+/// data_flow fn+test+invariant+bench+opaque.
+pub const EDGE_TO_KINDS : [5]u32 = [4, 66, 56, 6, 188];
+
+/// Capacity. Line 0 means "no source line": a span with line_start 0 is no span.
+/// Measured 2026-10-18 on the Railway lab, over the 2204 specs/**/*.t27 files of gHashTag/t27
+/// master (t27#10173 tree): top-level declarations per spec (nodes) p50 20, p90 66, p95 96,
+/// p98 183, p99 436, max 678. Call/use/constrain edges, read through the exporter on an 86-spec
+/// stratified sample: p50 at most 12, p95 at most 128 (82 of 86 specs), 85 of 86 at most 192, the
+/// largest between 193 and 256. The caps cover the node p98 and the edge p95. Node and edge
+/// endpoints are u8 and NO_INDEX is 255, so both caps must stay below 255; MAX_EDGES is the
+/// largest edge count that does, MAX_NODES is the 192 that covers p98 under the same
+/// limit. A larger graph is refused, never truncated (validate_graph).
+pub const MAX_NODES : u32 = 192;
+pub const MAX_EDGES : u32 = 254;
+pub const MEASURED_NODES_P95 : u32 = 96;
+pub const MEASURED_EDGES_P95 : u32 = 128;
+pub const NO_LINE : u32 = 0;
+pub const NO_INDEX : u32 = 255;
+
+/// Validation verdicts. validate_graph checks graph-level rules in this order, then each node in
+/// index order, then each edge in index order, and returns the first rule broken.
+pub const GRAPH_OK : u8 = 0;
+pub const ERR_GRAPH_VERSION : u8 = 1;
+pub const ERR_SPEC_PATH : u8 = 2;
+pub const ERR_TOO_MANY_NODES : u8 = 3;
+pub const ERR_TOO_MANY_EDGES : u8 = 4;
+pub const ERR_MODULE : u8 = 5;
+pub const ERR_NODE_KIND : u8 = 6;
+pub const ERR_LABEL : u8 = 7;
+pub const ERR_NODE_NAME : u8 = 8;
+pub const ERR_SPAN_ORDER : u8 = 9;
+pub const ERR_SPAN_OUTSIDE : u8 = 10;
+pub const ERR_SPAN_MISSING : u8 = 11;
+pub const ERR_EDGE_KIND : u8 = 12;
+pub const ERR_EDGE_DANGLING : u8 = 13;
+pub const ERR_EDGE_ENDPOINT_KIND : u8 = 14;
+pub const ERR_EDGE_UNKNOWN_NODE : u8 = 15;
+pub const ERR_EDGE_LABEL : u8 = 16;
+pub const ERR_EDGE_LINE : u8 = 17;
+pub const ERR_DUPLICATE_EDGE : u8 = 18;
+pub const VERDICT_KINDS : u8 = 19;
+
+/// One spec graph. Node arrays are indexed by node number, edge arrays by edge number; entries at
+/// or past node_count / edge_count are not read. Node 0 is the module and spans the whole file.
+/// Spans are 1-based, inclusive source lines of the file at spec_path.
+pub struct SpecGraph {
+    ir_version: u32,
+    spec_path: str,
+    line_count: u32,
+    node_count: u32,
+    node_kind: [192]u8,
+    node_label: [192]u8,
+    node_name: [192]str,
+    line_start: [192]u32,
+    line_end: [192]u32,
+    edge_count: u32,
+    edge_kind: [254]u8,
+    edge_from: [254]u8,
+    edge_to: [254]u8,
+    edge_label: [254]u8,
+    edge_line: [254]u32,
+}
+
+/// One node read out of a graph: the record a node inspector shows.
+pub struct SpecGraphNode {
+    kind: u8,
+    label: u8,
+    name: str,
+    line_start: u32,
+    line_end: u32,
+}
+
+pub fn kind_bit(k: u8) -> u32 {
+    return (1 as u32) << (k as u32);
+}
+
+pub fn valid_node_kind(k: u8) -> bool {
+    return k < NODE_KINDS;
+}
+
+pub fn valid_edge_kind(k: u8) -> bool {
+    return k < EDGE_KINDS;
+}
+
+pub fn valid_label(l: u8) -> bool {
+    return l < LABEL_KINDS;
+}
+
+/// The code of a node kind asked for by name, or NO_CODE.
+pub fn node_kind_id(name: str) -> u8 {
+    var i : u32 = 0;
+    while (i < (NODE_KINDS as u32)) {
+        if (NODE_KIND_NAMES[i as usize] == name) { return i as u8; }
+        i = i + 1;
+    }
+    return NO_CODE;
+}
+
+pub fn edge_kind_id(name: str) -> u8 {
+    var i : u32 = 0;
+    while (i < (EDGE_KINDS as u32)) {
+        if (EDGE_KIND_NAMES[i as usize] == name) { return i as u8; }
+        i = i + 1;
+    }
+    return NO_CODE;
+}
+
+pub fn label_id(name: str) -> u8 {
+    var i : u32 = 0;
+    while (i < (LABEL_KINDS as u32)) {
+        if (LABEL_NAMES[i as usize] == name) { return i as u8; }
+        i = i + 1;
+    }
+    return NO_CODE;
+}
+
+/// Every name in the three tables maps back to its own code.
+pub fn name_tables_round_trip() -> bool {
+    var k : u32 = 0;
+    while (k < (NODE_KINDS as u32)) {
+        if (node_kind_id(NODE_KIND_NAMES[k as usize]) != (k as u8)) { return false; }
+        k = k + 1;
+    }
+    var e : u32 = 0;
+    while (e < (EDGE_KINDS as u32)) {
+        if (edge_kind_id(EDGE_KIND_NAMES[e as usize]) != (e as u8)) { return false; }
+        e = e + 1;
+    }
+    var l : u32 = 0;
+    while (l < (LABEL_KINDS as u32)) {
+        if (label_id(LABEL_NAMES[l as usize]) != (l as u8)) { return false; }
+        l = l + 1;
+    }
+    return true;
+}
+
+/// Node n has a span and the span holds `line`.
+pub fn span_holds(g: SpecGraph, n: u32, line: u32) -> bool {
+    let k : usize = n as usize;
+    if (g.line_start[k] == NO_LINE) { return false; }
+    return g.line_start[k] <= line and line <= g.line_end[k];
+}
+
+/// The rules one node must meet, in order: a known kind, a known label, a name, an ordered span
+/// inside the file, a span when it is EXACT or SUGGESTED, and only node 0 may be the module.
+pub fn validate_node(g: SpecGraph, n: u32) -> u8 {
+    let k : usize = n as usize;
+    if (valid_node_kind(g.node_kind[k]) == false) { return ERR_NODE_KIND; }
+    if (valid_label(g.node_label[k]) == false) { return ERR_LABEL; }
+    if (g.node_name[k] == "") { return ERR_NODE_NAME; }
+    let s : u32 = g.line_start[k];
+    let e : u32 = g.line_end[k];
+    if (s > e) { return ERR_SPAN_ORDER; }
+    if (s == NO_LINE and e != NO_LINE) { return ERR_SPAN_ORDER; }
+    if (e > g.line_count) { return ERR_SPAN_OUTSIDE; }
+    let l : u8 = g.node_label[k];
+    if (s == NO_LINE and (l == LABEL_EXACT or l == LABEL_SUGGESTED)) { return ERR_SPAN_MISSING; }
+    if (n > 0 and g.node_kind[k] == NODE_MODULE) { return ERR_MODULE; }
+    return GRAPH_OK;
+}
+
+/// The rules one edge must meet, in order: a known kind; both endpoints exist; their kinds are
+/// allowed for the edge kind; neither is UNKNOWN; a label that is not UNKNOWN and no stronger than
+/// either endpoint; a source line inside an endpoint's span (required unless the edge is
+/// DERIVED); and no earlier edge with the same kind and endpoints.
+pub fn validate_edge(g: SpecGraph, j: u32) -> u8 {
+    let k : usize = j as usize;
+    let ek : u8 = g.edge_kind[k];
+    if (valid_edge_kind(ek) == false) { return ERR_EDGE_KIND; }
+    let f : u32 = g.edge_from[k] as u32;
+    let t : u32 = g.edge_to[k] as u32;
+    if (f >= g.node_count or t >= g.node_count) { return ERR_EDGE_DANGLING; }
+    let fk : u8 = g.node_kind[f as usize];
+    let tk : u8 = g.node_kind[t as usize];
+    if ((EDGE_FROM_KINDS[ek as usize] & kind_bit(fk)) == 0) { return ERR_EDGE_ENDPOINT_KIND; }
+    if ((EDGE_TO_KINDS[ek as usize] & kind_bit(tk)) == 0) { return ERR_EDGE_ENDPOINT_KIND; }
+    let fl : u8 = g.node_label[f as usize];
+    let tl : u8 = g.node_label[t as usize];
+    if (fl == LABEL_UNKNOWN or tl == LABEL_UNKNOWN) { return ERR_EDGE_UNKNOWN_NODE; }
+    let el : u8 = g.edge_label[k];
+    if (el >= LABEL_UNKNOWN) { return ERR_EDGE_LABEL; }
+    if (el < fl or el < tl) { return ERR_EDGE_LABEL; }
+    let line : u32 = g.edge_line[k];
+    if (line == NO_LINE) {
+        if (el != LABEL_DERIVED) { return ERR_EDGE_LINE; }
+    } else {
+        if (span_holds(g, f, line) == false and span_holds(g, t, line) == false) { return ERR_EDGE_LINE; }
+    }
+    var i : u32 = 0;
+    while (i < j) {
+        let m : usize = i as usize;
+        if (g.edge_kind[m] == ek and g.edge_from[m] == g.edge_from[k] and g.edge_to[m] == g.edge_to[k]) { return ERR_DUPLICATE_EDGE; }
+        i = i + 1;
+    }
+    return GRAPH_OK;
+}
+
+/// Graph-level rules, before any node is read: version, a spec path and a line count, capacity,
+/// and a module at node 0 whose span is the whole file.
+pub fn validate_graph_header(g: SpecGraph) -> u8 {
+    if (g.ir_version != GRAPH_IR_VERSION) { return ERR_GRAPH_VERSION; }
+    if (g.spec_path == "" or g.line_count == 0) { return ERR_SPEC_PATH; }
+    if (g.node_count > MAX_NODES) { return ERR_TOO_MANY_NODES; }
+    if (g.edge_count > MAX_EDGES) { return ERR_TOO_MANY_EDGES; }
+    if (g.node_count == 0) { return ERR_MODULE; }
+    if (g.node_kind[0] != NODE_MODULE) { return ERR_MODULE; }
+    if (g.line_start[0] != 1 or g.line_end[0] != g.line_count) { return ERR_MODULE; }
+    return GRAPH_OK;
+}
+
+/// GRAPH_OK, or the first rule the graph breaks.
+pub fn validate_graph(g: SpecGraph) -> u8 {
+    let h : u8 = validate_graph_header(g);
+    if (h != GRAPH_OK) { return h; }
+    var n : u32 = 0;
+    while (n < g.node_count) {
+        let v : u8 = validate_node(g, n);
+        if (v != GRAPH_OK) { return v; }
+        n = n + 1;
+    }
+    var j : u32 = 0;
+    while (j < g.edge_count) {
+        let w : u8 = validate_edge(g, j);
+        if (w != GRAPH_OK) { return w; }
+        j = j + 1;
+    }
+    return GRAPH_OK;
+}
+
+/// The first node that breaks a rule, or NO_INDEX when the header fails or no node does.
+pub fn first_bad_node(g: SpecGraph) -> u32 {
+    if (validate_graph_header(g) != GRAPH_OK) { return NO_INDEX; }
+    var n : u32 = 0;
+    while (n < g.node_count) {
+        if (validate_node(g, n) != GRAPH_OK) { return n; }
+        n = n + 1;
+    }
+    return NO_INDEX;
+}
+
+/// The first edge that breaks a rule, or NO_INDEX when the header or a node fails or no edge does.
+pub fn first_bad_edge(g: SpecGraph) -> u32 {
+    if (validate_graph_header(g) != GRAPH_OK) { return NO_INDEX; }
+    if (first_bad_node(g) != NO_INDEX) { return NO_INDEX; }
+    var j : u32 = 0;
+    while (j < g.edge_count) {
+        if (validate_edge(g, j) != GRAPH_OK) { return j; }
+        j = j + 1;
+    }
+    return NO_INDEX;
+}
+
+/// Node -> source: the record of node n, span included.
+pub fn node_at(g: SpecGraph, n: u32) -> SpecGraphNode {
+    let k : usize = n as usize;
+    return SpecGraphNode { kind: g.node_kind[k], label: g.node_label[k], name: g.node_name[k], line_start: g.line_start[k], line_end: g.line_end[k] };
+}
+
+/// Source -> node: the innermost node whose span holds `line` (the shortest span; on a tie, the
+/// lower node number), or NO_INDEX when no node does. A comment line inside the file belongs to
+/// the module.
+pub fn node_at_line(g: SpecGraph, line: u32) -> u32 {
+    var best : u32 = NO_INDEX;
+    var best_len : u32 = 0;
+    var n : u32 = 0;
+    while (n < g.node_count) {
+        if (span_holds(g, n, line)) {
+            let len : u32 = g.line_end[n as usize] - g.line_start[n as usize];
+            if (best == NO_INDEX or len < best_len) {
+                best = n;
+                best_len = len;
+            }
+        }
+        n = n + 1;
+    }
+    return best;
+}
+
+pub fn count_node_kind(g: SpecGraph, k: u8) -> u32 {
+    var c : u32 = 0;
+    var n : u32 = 0;
+    while (n < g.node_count) {
+        if (g.node_kind[n as usize] == k) { c = c + 1; }
+        n = n + 1;
+    }
+    return c;
+}
+
+pub fn count_node_label(g: SpecGraph, l: u8) -> u32 {
+    var c : u32 = 0;
+    var n : u32 = 0;
+    while (n < g.node_count) {
+        if (g.node_label[n as usize] == l) { c = c + 1; }
+        n = n + 1;
+    }
+    return c;
+}
+
+pub fn count_edge_kind(g: SpecGraph, k: u8) -> u32 {
+    var c : u32 = 0;
+    var j : u32 = 0;
+    while (j < g.edge_count) {
+        if (g.edge_kind[j as usize] == k) { c = c + 1; }
+        j = j + 1;
+    }
+    return c;
+}
+
+pub fn count_edge_label(g: SpecGraph, l: u8) -> u32 {
+    var c : u32 = 0;
+    var j : u32 = 0;
+    while (j < g.edge_count) {
+        if (g.edge_label[j as usize] == l) { c = c + 1; }
+        j = j + 1;
+    }
+    return c;
+}
+
+/// There is an edge of kind k from f to t.
+pub fn has_edge(g: SpecGraph, k: u8, f: u32, t: u32) -> bool {
+    var j : u32 = 0;
+    while (j < g.edge_count) {
+        let m : usize = j as usize;
+        if (g.edge_kind[m] == k and (g.edge_from[m] as u32) == f and (g.edge_to[m] as u32) == t) { return true; }
+        j = j + 1;
+    }
+    return false;
+}
+
+/// How many tests, invariants and benches exercise node n (its TESTED_BY edges).
+pub fn tests_of(g: SpecGraph, n: u32) -> u32 {
+    var c : u32 = 0;
+    var j : u32 = 0;
+    while (j < g.edge_count) {
+        let m : usize = j as usize;
+        if (g.edge_kind[m] == EDGE_TESTED_BY and (g.edge_from[m] as u32) == n) { c = c + 1; }
+        j = j + 1;
+    }
+    return c;
+}
+
+/// The DERIVED rule for TESTED_BY: fn f is tested by t exactly when t is a test, invariant or
+/// bench that CALLS f. True when the graph's TESTED_BY edges are that set and nothing else.
+pub fn tested_by_matches_calls(g: SpecGraph) -> bool {
+    let checkers : u32 = kind_bit(NODE_TEST) | kind_bit(NODE_INVARIANT) | kind_bit(NODE_BENCH);
+    var j : u32 = 0;
+    while (j < g.edge_count) {
+        let m : usize = j as usize;
+        let f : u32 = g.edge_from[m] as u32;
+        let t : u32 = g.edge_to[m] as u32;
+        if (g.edge_kind[m] == EDGE_TESTED_BY) {
+            if (has_edge(g, EDGE_CALLS, t, f) == false) { return false; }
+        }
+        if (g.edge_kind[m] == EDGE_CALLS and (kind_bit(g.node_kind[f as usize]) & checkers) != 0) {
+            if (has_edge(g, EDGE_TESTED_BY, t, f) == false) { return false; }
+        }
+        j = j + 1;
+    }
+    return true;
+}
+
+/// The fns no test, invariant or bench exercises.
+pub fn untested_fns(g: SpecGraph) -> u32 {
+    var c : u32 = 0;
+    var n : u32 = 0;
+    while (n < g.node_count) {
+        if (g.node_kind[n as usize] == NODE_FN and tests_of(g, n) == 0) { c = c + 1; }
+        n = n + 1;
+    }
+    return c;
+}
+
+/// The ui_plan widget that draws a node. A SUGGESTED or UNKNOWN node is drawn as plain text, never
+/// as a widget that presents a verified property (a formula, a run button, a metrics table): ui_plan
+/// IR version 1 has no way to badge a widget as a guess, so a guess gets no such widget.
+pub fn node_widget(kind: u8, label: u8) -> u8 {
+    if (valid_label(label) == false or label == LABEL_SUGGESTED or label == LABEL_UNKNOWN) { return WIDGET_TEXT_BLOCK; }
+    if (kind == NODE_MODULE or kind == NODE_USE) { return WIDGET_HONEYCOMB_CARD; }
+    if (kind == NODE_CONST or kind == NODE_FN) { return WIDGET_FORMULA_VIEW; }
+    if (kind == NODE_TEST or kind == NODE_INVARIANT) { return WIDGET_RUN_BUTTON; }
+    if (kind == NODE_BENCH) { return WIDGET_METRICS_TABLE; }
+    return WIDGET_TEXT_BLOCK;
+}
+
+/// The ui_plan source kind a node's widget binds to, read from the ui_plan catalog. Source refs:
+/// SOURCE_SPEC is the spec path (for a `use`, the imported spec); SOURCE_FORMULA is
+/// "<spec path>#<node name>", the form ui_plan's own fixture uses; SOURCE_METRICS is a results
+/// file the host declares, which the graph does not name.
+pub fn node_source_kind(kind: u8, label: u8) -> u8 {
+    return WIDGET_SOURCE[node_widget(kind, label) as usize];
+}
+
+/// Every (kind, label) pair, including out-of-range ones, binds to a catalog widget.
+pub fn all_bindings_trusted() -> bool {
+    var k : u32 = 0;
+    while (k <= (NODE_KINDS as u32)) {
+        var l : u32 = 0;
+        while (l <= (LABEL_KINDS as u32)) {
+            if (catalog_widget(node_widget(k as u8, l as u8)) == false) { return false; }
+            l = l + 1;
+        }
+        k = k + 1;
+    }
+    return true;
+}
+
+/// An empty graph of the current version: no path, no nodes, no edges.
+pub fn blank_graph() -> SpecGraph {
+    return SpecGraph {
+        ir_version: GRAPH_IR_VERSION, spec_path: "", line_count: 0, node_count: 0,
+        node_kind: [0; 192], node_label: [0; 192],
+        node_name: [
+            "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "",
+            "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "",
+            "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "",
+            "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "",
+            "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "",
+            "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "",
+            "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "",
+            "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "",
+            "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "",
+            "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "",
+            "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "",
+            "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", ""
+        ],
+        line_start: [0; 192], line_end: [0; 192],
+        edge_count: 0, edge_kind: [0; 254], edge_from: [0; 254], edge_to: [0; 254], edge_label: [0; 254], edge_line: [0; 254]
+    };
+}
+
+/// g with one more node. Past MAX_NODES the node is dropped and node_count still counts it, so
+/// validate_graph_header refuses the graph instead of silently losing a node.
+pub fn with_node(g: SpecGraph, kind: u8, label: u8, name: str, s: u32, e: u32) -> SpecGraph {
+    var h : SpecGraph = g;
+    if (h.node_count < MAX_NODES) {
+        let k : usize = h.node_count as usize;
+        h.node_kind[k] = kind;
+        h.node_label[k] = label;
+        h.node_name[k] = name;
+        h.line_start[k] = s;
+        h.line_end[k] = e;
+    }
+    h.node_count = h.node_count + 1;
+    return h;
+}
+
+/// g with one more edge, under the same capacity rule as with_node.
+pub fn with_edge(g: SpecGraph, kind: u8, f: u8, t: u8, label: u8, line: u32) -> SpecGraph {
+    var h : SpecGraph = g;
+    if (h.edge_count < MAX_EDGES) {
+        let k : usize = h.edge_count as usize;
+        h.edge_kind[k] = kind;
+        h.edge_from[k] = f;
+        h.edge_to[k] = t;
+        h.edge_label[k] = label;
+        h.edge_line[k] = line;
+    }
+    h.edge_count = h.edge_count + 1;
+    return h;
+}
+
+/// The fixture: the graph of specs/tutorial/08_modules_and_arrays.t27 at gHashTag/t27 commit
+/// 2f395025f (93 lines, sha256 c291e925d9dabef8b72b5a64aef153a2126c0b0b43d67bc08b1b2d7eaa98039a),
+/// read by hand. Every top-level declaration is a node; every span and edge line is a line of
+/// that file. Node numbers: 0 module, 1 use, 2-3 consts, 4 scaled_width, 5-7 consts,
+/// 8 power_of_two, 9 bias_for_width, 10-12 tests, 13 invariant, 14 std.testing.
+pub fn tutorial_08_graph() -> SpecGraph {
+    var g : SpecGraph = blank_graph();
+    g.spec_path = "specs/tutorial/08_modules_and_arrays.t27";
+    g.line_count = 93;
+    // `module tutorial-08-modules;` is line 11; the module node spans the file.
+    g = with_node(g, NODE_MODULE, LABEL_EXACT, "tutorial-08-modules", 1, 93);
+    g = with_node(g, NODE_USE, LABEL_EXACT, "base::types", 22, 22);
+    g = with_node(g, NODE_CONST, LABEL_EXACT, "EXPORTED_WIDTH", 32, 32);
+    g = with_node(g, NODE_CONST, LABEL_EXACT, "INTERNAL_SCALE", 35, 35);
+    g = with_node(g, NODE_FN, LABEL_EXACT, "scaled_width", 37, 39);
+    g = with_node(g, NODE_CONST, LABEL_EXACT, "TRIT_VALUES", 54, 54);
+    g = with_node(g, NODE_CONST, LABEL_EXACT, "POWERS_OF_TWO", 56, 56);
+    g = with_node(g, NODE_CONST, LABEL_EXACT, "EXPONENT_BIAS", 58, 58);
+    g = with_node(g, NODE_FN, LABEL_EXACT, "power_of_two", 66, 68);
+    g = with_node(g, NODE_FN, LABEL_EXACT, "bias_for_width", 70, 72);
+    g = with_node(g, NODE_TEST, LABEL_EXACT, "the power table matches its own definition", 78, 81);
+    g = with_node(g, NODE_TEST, LABEL_EXACT, "bias table carries the four standard widths", 83, 86);
+    g = with_node(g, NODE_TEST, LABEL_EXACT, "a private constant is still usable inside its own module", 88, 90);
+    g = with_node(g, NODE_INVARIANT, LABEL_EXACT, "exported_width_is_a_power_of_two", 92, 93);
+    // The tests call std.testing.expectEqual (lines 79-89). No `use` in the file declares std and
+    // it is not a corpus spec, so what it is cannot be read from this source.
+    g = with_node(g, NODE_OPAQUE, LABEL_UNKNOWN, "std.testing", 79, 89);
+    // The `use` statement (line 22).
+    g = with_edge(g, EDGE_USES, 0, 1, LABEL_EXACT, 22);
+    // Names in function bodies (lines 38, 67, 71).
+    g = with_edge(g, EDGE_USES, 4, 2, LABEL_EXACT, 38);
+    g = with_edge(g, EDGE_USES, 4, 3, LABEL_EXACT, 38);
+    g = with_edge(g, EDGE_USES, 8, 6, LABEL_EXACT, 67);
+    g = with_edge(g, EDGE_USES, 9, 7, LABEL_EXACT, 71);
+    // The named values are operands of each return expression, so they reach the result.
+    g = with_edge(g, EDGE_DATA_FLOW, 2, 4, LABEL_DERIVED, 38);
+    g = with_edge(g, EDGE_DATA_FLOW, 3, 4, LABEL_DERIVED, 38);
+    g = with_edge(g, EDGE_DATA_FLOW, 6, 8, LABEL_DERIVED, 67);
+    g = with_edge(g, EDGE_DATA_FLOW, 7, 9, LABEL_DERIVED, 71);
+    // Calls from test bodies (first call lines 79, 84, 89).
+    g = with_edge(g, EDGE_CALLS, 10, 8, LABEL_EXACT, 79);
+    g = with_edge(g, EDGE_CALLS, 11, 9, LABEL_EXACT, 84);
+    g = with_edge(g, EDGE_CALLS, 12, 4, LABEL_EXACT, 89);
+    // TESTED_BY is the calls above read backwards; it has no line of its own.
+    g = with_edge(g, EDGE_TESTED_BY, 8, 10, LABEL_DERIVED, NO_LINE);
+    g = with_edge(g, EDGE_TESTED_BY, 9, 11, LABEL_DERIVED, NO_LINE);
+    g = with_edge(g, EDGE_TESTED_BY, 4, 12, LABEL_DERIVED, NO_LINE);
+    // `assert EXPORTED_WIDTH == 16` (line 93).
+    g = with_edge(g, EDGE_CONSTRAINS, 13, 2, LABEL_EXACT, 93);
+    return g;
+}
+
+/// The fixture with a model's explanation added: node 15, "table lookup step", over the two
+/// indexing functions (lines 66-72), and the suggested flow of POWERS_OF_TWO into it (line 67).
+pub fn with_suggestion() -> SpecGraph {
+    var g : SpecGraph = tutorial_08_graph();
+    g = with_node(g, NODE_OPAQUE, LABEL_SUGGESTED, "table lookup step", 66, 72);
+    g = with_edge(g, EDGE_DATA_FLOW, 6, 15, LABEL_SUGGESTED, 67);
+    return g;
+}
+
+/// A UI plan for the fixture, every widget picked by node_widget: the module card (node 0), the
+/// formula view of power_of_two (node 8) and the run button of its test (node 10).
+pub fn tutorial_08_plan() -> UiPlan {
+    let g : SpecGraph = tutorial_08_graph();
+    var p : UiPlan = blank_plan();
+    p.intent = "Show the graph of tutorial lesson 08";
+    p.title = "Tutorial 08 spec graph";
+    p.granted = bit(CAP_READ_SPECS) | bit(CAP_RUN_LAB);
+    p.source_count = 2;
+    p.source_kind[0] = SOURCE_SPEC;
+    p.source_ref[0] = g.spec_path;
+    p.source_kind[1] = SOURCE_FORMULA;
+    p.source_ref[1] = "specs/tutorial/08_modules_and_arrays.t27#power_of_two";
+    p.widget_count = 3;
+    p.widget[0] = node_widget(g.node_kind[0], g.node_label[0]);
+    p.props[0] = bit(PROP_TITLE) | bit(PROP_SPEC_PATH);
+    p.binding[0] = 1;
+    p.action[0] = ACTION_OPEN_SPEC;
+    p.span[0] = 6;
+    p.label[0] = g.node_name[0];
+    p.widget[1] = node_widget(g.node_kind[8], g.node_label[8]);
+    p.props[1] = bit(PROP_TITLE) | bit(PROP_FORMULA_ID);
+    p.binding[1] = 2;
+    p.action[1] = ACTION_NONE;
+    p.col[1] = 6;
+    p.span[1] = 6;
+    p.label[1] = g.node_name[8];
+    p.widget[2] = node_widget(g.node_kind[10], g.node_label[10]);
+    p.props[2] = bit(PROP_TITLE) | bit(PROP_SPEC_PATH);
+    p.binding[2] = 1;
+    p.action[2] = ACTION_RUN_TESTS;
+    p.row[2] = 1;
+    p.span[2] = 4;
+    p.label[2] = g.node_name[10];
+    return p;
+}
+
+test name_tables_map_names_to_codes {
+    assert node_kind_id("module") == NODE_MODULE;
+    assert node_kind_id("fn") == NODE_FN;
+    assert node_kind_id("opaque") == NODE_OPAQUE;
+    assert edge_kind_id("tested_by") == EDGE_TESTED_BY;
+    assert edge_kind_id("data_flow") == EDGE_DATA_FLOW;
+    assert label_id("suggested") == LABEL_SUGGESTED;
+    assert label_id("unknown") == LABEL_UNKNOWN;
+    // names outside the tables, and a different spelling, are not codes
+    assert node_kind_id("step") == NO_CODE;
+    assert node_kind_id("Fn") == NO_CODE;
+    assert edge_kind_id("control_flow") == NO_CODE;
+    assert label_id("verified") == NO_CODE;
+    assert name_tables_round_trip();
+    assert valid_node_kind(NODE_OPAQUE);
+    assert valid_node_kind(NODE_KINDS) == false;
+    assert valid_edge_kind(EDGE_KINDS) == false;
+    assert valid_label(LABEL_UNKNOWN);
+    assert valid_label(LABEL_KINDS) == false;
+}
+
+test fixture_graph_is_valid {
+    let g : SpecGraph = tutorial_08_graph();
+    assert validate_graph(g) == GRAPH_OK;
+    assert first_bad_node(g) == NO_INDEX;
+    assert first_bad_edge(g) == NO_INDEX;
+    assert g.node_count == 15;
+    assert g.edge_count == 16;
+    // one node per top-level declaration of the file, plus the opaque region
+    assert count_node_kind(g, NODE_MODULE) == 1;
+    assert count_node_kind(g, NODE_USE) == 1;
+    assert count_node_kind(g, NODE_CONST) == 5;
+    assert count_node_kind(g, NODE_FN) == 3;
+    assert count_node_kind(g, NODE_TEST) == 3;
+    assert count_node_kind(g, NODE_INVARIANT) == 1;
+    assert count_node_kind(g, NODE_BENCH) == 0;
+    assert count_node_kind(g, NODE_OPAQUE) == 1;
+    assert count_node_label(g, LABEL_EXACT) == 14;
+    assert count_node_label(g, LABEL_UNKNOWN) == 1;
+    assert count_edge_kind(g, EDGE_USES) == 5;
+    assert count_edge_kind(g, EDGE_DATA_FLOW) == 4;
+    assert count_edge_kind(g, EDGE_CALLS) == 3;
+    assert count_edge_kind(g, EDGE_TESTED_BY) == 3;
+    assert count_edge_kind(g, EDGE_CONSTRAINS) == 1;
+    assert count_edge_label(g, LABEL_EXACT) == 9;
+    assert count_edge_label(g, LABEL_DERIVED) == 7;
+    assert count_edge_label(g, LABEL_SUGGESTED) == 0;
+}
+
+test header_rules_come_first {
+    var v : SpecGraph = tutorial_08_graph();
+    v.ir_version = GRAPH_IR_VERSION + 1;
+    assert validate_graph(v) == ERR_GRAPH_VERSION;
+    var p : SpecGraph = tutorial_08_graph();
+    p.spec_path = "";
+    assert validate_graph(p) == ERR_SPEC_PATH;
+    var c : SpecGraph = tutorial_08_graph();
+    c.line_count = 0;
+    assert validate_graph(c) == ERR_SPEC_PATH;
+    assert validate_graph(blank_graph()) == ERR_SPEC_PATH;
+    var e : SpecGraph = blank_graph();
+    e.spec_path = "specs/x.t27";
+    e.line_count = 1;
+    assert validate_graph(e) == ERR_MODULE;
+    // node 0 must be the module, and its span must be the whole file
+    var m : SpecGraph = tutorial_08_graph();
+    m.node_kind[0] = NODE_CONST;
+    assert validate_graph(m) == ERR_MODULE;
+    var s : SpecGraph = tutorial_08_graph();
+    s.line_start[0] = 11;
+    assert validate_graph(s) == ERR_MODULE;
+    assert first_bad_node(s) == NO_INDEX;
+    var f : SpecGraph = tutorial_08_graph();
+    f.line_count = 94;
+    assert validate_graph(f) == ERR_MODULE;
+    // a second module is a node rule, reported at that node
+    var d : SpecGraph = tutorial_08_graph();
+    d.node_kind[5] = NODE_MODULE;
+    assert validate_graph(d) == ERR_MODULE;
+    assert first_bad_node(d) == 5;
+}
+
+test capacity_is_refused_not_truncated {
+    var g : SpecGraph = tutorial_08_graph();
+    while (g.node_count < MAX_NODES + 1) {
+        g = with_node(g, NODE_CONST, LABEL_DERIVED, "extra", NO_LINE, NO_LINE);
+    }
+    // MAX_NODES + 1 nodes declared, MAX_NODES stored: the graph is refused, not cut short
+    assert g.node_count == MAX_NODES + 1;
+    assert validate_graph(g) == ERR_TOO_MANY_NODES;
+    var h : SpecGraph = tutorial_08_graph();
+    while (h.edge_count < MAX_EDGES + 1) {
+        h = with_edge(h, EDGE_TESTED_BY, 9, 13, LABEL_DERIVED, NO_LINE);
+    }
+    assert h.edge_count == MAX_EDGES + 1;
+    assert validate_graph(h) == ERR_TOO_MANY_EDGES;
+}
+
+test a_graph_exactly_at_capacity_is_valid {
+    // 16 fns and 16 tests after the fixture's 15 nodes, then consts up to MAX_NODES; every
+    // test calls every fn, so the CALLS edges are distinct (a repeated edge is a duplicate)
+    var g : SpecGraph = tutorial_08_graph();
+    var a : u32 = 0;
+    while (a < 16) {
+        g = with_node(g, NODE_FN, LABEL_EXACT, "f", 1, 1);
+        a = a + 1;
+    }
+    a = 0;
+    while (a < 16) {
+        g = with_node(g, NODE_TEST, LABEL_EXACT, "t", 1, 1);
+        a = a + 1;
+    }
+    while (g.node_count < MAX_NODES) {
+        g = with_node(g, NODE_CONST, LABEL_EXACT, "extra", 1, 1);
+    }
+    var t : u32 = 0;
+    while (t < 16) {
+        var f : u32 = 0;
+        while (f < 16) {
+            if (g.edge_count < MAX_EDGES) {
+                g = with_edge(g, EDGE_CALLS, (31 + t) as u8, (15 + f) as u8, LABEL_EXACT, 1);
+            }
+            f = f + 1;
+        }
+        t = t + 1;
+    }
+    assert g.node_count == MAX_NODES;
+    assert g.edge_count == MAX_EDGES;
+    assert validate_graph(g) == GRAPH_OK;
+    // the last stored node and edge are real cells, not clipped
+    assert g.node_kind[MAX_NODES as usize - 1] == NODE_CONST;
+    assert g.edge_kind[MAX_EDGES as usize - 1] == EDGE_CALLS;
+    // negative control: one more edge or node makes the same graph refused
+    assert validate_graph(with_edge(g, EDGE_CALLS, 31, 15, LABEL_EXACT, 1)) == ERR_TOO_MANY_EDGES;
+    assert validate_graph(with_node(g, NODE_CONST, LABEL_EXACT, "extra", 1, 1)) == ERR_TOO_MANY_NODES;
+}
+
+test node_rules {
+    var k : SpecGraph = tutorial_08_graph();
+    k.node_kind[3] = NODE_KINDS;
+    assert validate_graph(k) == ERR_NODE_KIND;
+    assert first_bad_node(k) == 3;
+    var l : SpecGraph = tutorial_08_graph();
+    l.node_label[7] = LABEL_KINDS;
+    assert validate_graph(l) == ERR_LABEL;
+    assert first_bad_node(l) == 7;
+    var n : SpecGraph = tutorial_08_graph();
+    n.node_name[9] = "";
+    assert validate_graph(n) == ERR_NODE_NAME;
+    // span order: start after end, or an end with no start
+    var o : SpecGraph = tutorial_08_graph();
+    o.line_start[4] = 40;
+    assert validate_graph(o) == ERR_SPAN_ORDER;
+    assert first_bad_node(o) == 4;
+    var z : SpecGraph = tutorial_08_graph();
+    z.line_start[4] = NO_LINE;
+    assert validate_graph(z) == ERR_SPAN_ORDER;
+    var x : SpecGraph = tutorial_08_graph();
+    x.line_end[13] = 94;
+    assert validate_graph(x) == ERR_SPAN_OUTSIDE;
+    assert first_bad_node(x) == 13;
+    // an EXACT node is in the source, so it has a span
+    var m : SpecGraph = tutorial_08_graph();
+    m.line_start[5] = NO_LINE;
+    m.line_end[5] = NO_LINE;
+    assert validate_graph(m) == ERR_SPAN_MISSING;
+    assert first_bad_node(m) == 5;
+    // a DERIVED or UNKNOWN node may have none
+    m.node_label[5] = LABEL_DERIVED;
+    assert validate_graph(m) == GRAPH_OK;
+    var u : SpecGraph = tutorial_08_graph();
+    u.line_start[14] = NO_LINE;
+    u.line_end[14] = NO_LINE;
+    assert validate_graph(u) == GRAPH_OK;
+}
+
+test suggested_node_needs_a_span {
+    let g : SpecGraph = with_suggestion();
+    assert validate_graph(g) == GRAPH_OK;
+    assert count_node_label(g, LABEL_SUGGESTED) == 1;
+    assert count_edge_label(g, LABEL_SUGGESTED) == 1;
+    // without the lines it explains, a guess is refused
+    var s : SpecGraph = with_suggestion();
+    s.line_start[15] = NO_LINE;
+    s.line_end[15] = NO_LINE;
+    assert validate_graph(s) == ERR_SPAN_MISSING;
+    assert first_bad_node(s) == 15;
+    // an edge into a guess is a guess: it may not be labelled EXACT or DERIVED
+    var e : SpecGraph = with_suggestion();
+    e.edge_label[16] = LABEL_EXACT;
+    assert validate_graph(e) == ERR_EDGE_LABEL;
+    assert first_bad_edge(e) == 16;
+    e.edge_label[16] = LABEL_DERIVED;
+    assert validate_graph(e) == ERR_EDGE_LABEL;
+    // and a suggested edge carries its source line too
+    var l : SpecGraph = with_suggestion();
+    l.edge_line[16] = NO_LINE;
+    assert validate_graph(l) == ERR_EDGE_LINE;
+}
+
+test unknown_node_draws_no_edges {
+    let g : SpecGraph = tutorial_08_graph();
+    var a : SpecGraph = with_edge(g, EDGE_DATA_FLOW, 14, 10, LABEL_DERIVED, 79);
+    assert validate_graph(a) == ERR_EDGE_UNKNOWN_NODE;
+    assert first_bad_edge(a) == 16;
+    var b : SpecGraph = with_edge(g, EDGE_DATA_FLOW, 6, 14, LABEL_SUGGESTED, 79);
+    assert validate_graph(b) == ERR_EDGE_UNKNOWN_NODE;
+    // the rule is about the label: the same edge from a DERIVED region is drawn
+    a.node_label[14] = LABEL_DERIVED;
+    assert validate_graph(a) == GRAPH_OK;
+}
+
+test edge_endpoints_must_exist_and_fit {
+    let g : SpecGraph = tutorial_08_graph();
+    assert validate_graph(with_edge(g, EDGE_CALLS, 10, 15, LABEL_EXACT, 79)) == ERR_EDGE_DANGLING;
+    assert validate_graph(with_edge(g, EDGE_CALLS, 255, 8, LABEL_EXACT, 79)) == ERR_EDGE_DANGLING;
+    assert validate_graph(with_edge(g, EDGE_KINDS, 10, 8, LABEL_EXACT, 79)) == ERR_EDGE_KIND;
+    // calls end at a fn, never at a const
+    assert validate_graph(with_edge(g, EDGE_CALLS, 10, 6, LABEL_EXACT, 79)) == ERR_EDGE_ENDPOINT_KIND;
+    // tested_by starts at a fn; constrains starts at an invariant
+    assert validate_graph(with_edge(g, EDGE_TESTED_BY, 10, 8, LABEL_DERIVED, NO_LINE)) == ERR_EDGE_ENDPOINT_KIND;
+    assert validate_graph(with_edge(g, EDGE_CONSTRAINS, 10, 6, LABEL_EXACT, 79)) == ERR_EDGE_ENDPOINT_KIND;
+    // a module uses an import, but does not call it
+    assert validate_graph(with_edge(g, EDGE_CALLS, 0, 1, LABEL_EXACT, 22)) == ERR_EDGE_ENDPOINT_KIND;
+    var w : SpecGraph = tutorial_08_graph();
+    w.edge_to[9] = 7;
+    assert validate_graph(w) == ERR_EDGE_ENDPOINT_KIND;
+    assert first_bad_edge(w) == 9;
+}
+
+test edge_labels_lines_and_duplicates {
+    let g : SpecGraph = tutorial_08_graph();
+    // an edge is drawn or it is not: UNKNOWN is not an edge label
+    var u : SpecGraph = tutorial_08_graph();
+    u.edge_label[0] = LABEL_UNKNOWN;
+    assert validate_graph(u) == ERR_EDGE_LABEL;
+    assert first_bad_edge(u) == 0;
+    // an EXACT edge is read from a line, so it names one
+    var t : SpecGraph = tutorial_08_graph();
+    t.edge_label[12] = LABEL_EXACT;
+    assert validate_graph(t) == ERR_EDGE_LINE;
+    assert first_bad_edge(t) == 12;
+    // that line lies in one of its endpoints: line 50 is a comment between them
+    var o : SpecGraph = tutorial_08_graph();
+    o.edge_line[1] = 50;
+    assert validate_graph(o) == ERR_EDGE_LINE;
+    // a line in the target's span counts (data_flow 2 -> 4 is read at line 38, inside node 4)
+    assert span_holds(g, 2, 38) == false;
+    assert span_holds(g, 4, 38);
+    // an EXACT edge may not touch a DERIVED node
+    var d : SpecGraph = tutorial_08_graph();
+    d.node_label[6] = LABEL_DERIVED;
+    assert validate_graph(d) == ERR_EDGE_LABEL;
+    assert first_bad_edge(d) == 3;
+    // the same kind and endpoints twice is one edge drawn twice
+    assert validate_graph(with_edge(g, EDGE_USES, 4, 2, LABEL_EXACT, 38)) == ERR_DUPLICATE_EDGE;
+    // the same endpoints under another kind is a different edge
+    assert has_edge(g, EDGE_USES, 4, 2);
+    assert has_edge(g, EDGE_DATA_FLOW, 2, 4);
+    assert has_edge(g, EDGE_DATA_FLOW, 4, 2) == false;
+}
+
+test source_mapping_goes_both_ways {
+    let g : SpecGraph = tutorial_08_graph();
+    // line -> node: the innermost span wins
+    assert node_at_line(g, 67) == 8;
+    assert node_at_line(g, 93) == 13;
+    assert node_at_line(g, 22) == 1;
+    // line 79 is in test 10 (78-81) and in std.testing (79-89); the shorter span wins
+    assert node_at_line(g, 79) == 10;
+    assert node_at_line(g, 87) == 14;
+    // a comment line belongs to the module; no line 0, nothing past the file
+    assert node_at_line(g, 50) == 0;
+    assert node_at_line(g, 0) == NO_INDEX;
+    assert node_at_line(g, 94) == NO_INDEX;
+    // node -> line, and back to the same node, for every declaration
+    var n : u32 = 1;
+    var back : u32 = 0;
+    while (n < 14) {
+        let r : SpecGraphNode = node_at(g, n);
+        if (node_at_line(g, r.line_start) == n and node_at_line(g, r.line_end) == n) { back = back + 1; }
+        n = n + 1;
+    }
+    assert back == 13;
+    let p : SpecGraphNode = node_at(g, 8);
+    assert p.kind == NODE_FN;
+    assert p.label == LABEL_EXACT;
+    assert p.name == "power_of_two";
+    assert p.line_start == 66;
+    assert p.line_end == 68;
+}
+
+test tested_by_is_derived_from_calls {
+    let g : SpecGraph = tutorial_08_graph();
+    assert tested_by_matches_calls(g);
+    assert tests_of(g, 8) == 1;
+    assert tests_of(g, 4) == 1;
+    // TRIT_VALUES is declared and never read: no edge, no test
+    assert tests_of(g, 5) == 0;
+    assert untested_fns(g) == 0;
+    // drop one TESTED_BY edge: the derivation no longer holds and a fn is untested
+    var m : SpecGraph = tutorial_08_graph();
+    m.edge_count = 15;
+    m.edge_kind[14] = EDGE_CONSTRAINS;
+    m.edge_from[14] = 13;
+    m.edge_to[14] = 2;
+    m.edge_label[14] = LABEL_EXACT;
+    m.edge_line[14] = 93;
+    assert tested_by_matches_calls(m) == false;
+    assert untested_fns(m) == 1;
+    // a TESTED_BY edge with no call behind it is not derived either
+    var x : SpecGraph = with_edge(g, EDGE_TESTED_BY, 9, 10, LABEL_DERIVED, NO_LINE);
+    assert validate_graph(x) == GRAPH_OK;
+    assert tested_by_matches_calls(x) == false;
+}
+
+test nodes_bind_to_trusted_widgets {
+    assert node_widget(NODE_MODULE, LABEL_EXACT) == WIDGET_HONEYCOMB_CARD;
+    assert node_widget(NODE_USE, LABEL_DERIVED) == WIDGET_HONEYCOMB_CARD;
+    assert node_widget(NODE_FN, LABEL_EXACT) == WIDGET_FORMULA_VIEW;
+    assert node_widget(NODE_CONST, LABEL_EXACT) == WIDGET_FORMULA_VIEW;
+    assert node_widget(NODE_TEST, LABEL_EXACT) == WIDGET_RUN_BUTTON;
+    assert node_widget(NODE_INVARIANT, LABEL_EXACT) == WIDGET_RUN_BUTTON;
+    assert node_widget(NODE_BENCH, LABEL_EXACT) == WIDGET_METRICS_TABLE;
+    assert node_widget(NODE_OPAQUE, LABEL_EXACT) == WIDGET_TEXT_BLOCK;
+    // a guess and an unknown are drawn as text, whatever their kind
+    assert node_widget(NODE_FN, LABEL_SUGGESTED) == WIDGET_TEXT_BLOCK;
+    assert node_widget(NODE_TEST, LABEL_UNKNOWN) == WIDGET_TEXT_BLOCK;
+    assert node_widget(NODE_KINDS, LABEL_EXACT) == WIDGET_TEXT_BLOCK;
+    assert node_source_kind(NODE_FN, LABEL_EXACT) == SOURCE_FORMULA;
+    assert node_source_kind(NODE_TEST, LABEL_EXACT) == SOURCE_SPEC;
+    assert node_source_kind(NODE_BENCH, LABEL_EXACT) == SOURCE_METRICS;
+    assert node_source_kind(NODE_FN, LABEL_SUGGESTED) == SOURCE_NONE;
+    // a plan whose widgets were picked from the fixture passes ui_plan's own gate
+    let p : UiPlan = tutorial_08_plan();
+    assert validate_plan(p) == PLAN_OK;
+    assert p.widget[1] == WIDGET_FORMULA_VIEW;
+    assert p.source_kind[(p.binding[1] - 1) as usize] == node_source_kind(NODE_FN, LABEL_EXACT);
+    // if node 8 were a guess, its widget would be text, and text takes no binding
+    var q : UiPlan = tutorial_08_plan();
+    q.widget[1] = node_widget(NODE_FN, LABEL_SUGGESTED);
+    q.props[1] = bit(PROP_CAPTION);
+    assert validate_plan(q) == ERR_BINDING_KIND;
+    assert first_bad_slot(q) == 1;
+    q.binding[1] = 0;
+    assert validate_plan(q) == PLAN_OK;
+}
+
+test first_broken_rule_is_reported {
+    // a node defect and an edge defect: the node is reported, and no edge is named
+    var g : SpecGraph = tutorial_08_graph();
+    g.edge_line[1] = 50;
+    g.node_name[12] = "";
+    assert validate_graph(g) == ERR_NODE_NAME;
+    assert first_bad_node(g) == 12;
+    assert first_bad_edge(g) == NO_INDEX;
+    // fix the node: the edge comes next
+    g.node_name[12] = "a private constant is still usable inside its own module";
+    assert validate_graph(g) == ERR_EDGE_LINE;
+    assert first_bad_edge(g) == 1;
+    // a header defect hides both
+    g.ir_version = 0;
+    assert validate_graph(g) == ERR_GRAPH_VERSION;
+    assert first_bad_node(g) == NO_INDEX;
+    assert first_bad_edge(g) == NO_INDEX;
+}
+
+invariant name_tables_cover_every_code {
+    assert name_tables_round_trip();
+    assert node_kind_id(NODE_KIND_NAMES[NODE_OPAQUE as usize]) == NODE_OPAQUE;
+    assert edge_kind_id(EDGE_KIND_NAMES[EDGE_DATA_FLOW as usize]) == EDGE_DATA_FLOW;
+}
+
+invariant edge_masks_are_spelled_right {
+    let bodies : u32 = kind_bit(NODE_FN) | kind_bit(NODE_TEST) | kind_bit(NODE_INVARIANT) | kind_bit(NODE_BENCH);
+    assert EDGE_FROM_KINDS[EDGE_CALLS as usize] == bodies;
+    assert EDGE_TO_KINDS[EDGE_CALLS as usize] == kind_bit(NODE_FN);
+    assert EDGE_FROM_KINDS[EDGE_USES as usize] == kind_bit(NODE_MODULE) | bodies;
+    assert EDGE_TO_KINDS[EDGE_USES as usize] == kind_bit(NODE_CONST) | kind_bit(NODE_USE);
+    assert EDGE_FROM_KINDS[EDGE_TESTED_BY as usize] == kind_bit(NODE_FN);
+    assert EDGE_TO_KINDS[EDGE_TESTED_BY as usize] == kind_bit(NODE_TEST) | kind_bit(NODE_INVARIANT) | kind_bit(NODE_BENCH);
+    assert EDGE_FROM_KINDS[EDGE_CONSTRAINS as usize] == kind_bit(NODE_INVARIANT);
+    assert EDGE_TO_KINDS[EDGE_CONSTRAINS as usize] == kind_bit(NODE_CONST) | kind_bit(NODE_FN);
+    assert EDGE_FROM_KINDS[EDGE_DATA_FLOW as usize] == kind_bit(NODE_CONST) | kind_bit(NODE_FN) | kind_bit(NODE_USE) | kind_bit(NODE_OPAQUE);
+    assert EDGE_TO_KINDS[EDGE_DATA_FLOW as usize] == bodies | kind_bit(NODE_OPAQUE);
+}
+
+invariant every_node_binds_to_a_catalog_widget {
+    assert all_bindings_trusted();
+}
+
+invariant the_fixture_stays_valid {
+    assert validate_graph(tutorial_08_graph()) == GRAPH_OK;
+    assert validate_graph(with_suggestion()) == GRAPH_OK;
+    assert tested_by_matches_calls(tutorial_08_graph());
+}
+
+invariant reserved_codes_stay_outside {
+    assert NO_CODE >= NODE_KINDS;
+    assert NO_CODE >= EDGE_KINDS;
+    assert NO_CODE >= LABEL_KINDS;
+    assert MAX_NODES < NO_INDEX;
+    assert MAX_EDGES < NO_INDEX;
+    assert MAX_NODES >= MEASURED_NODES_P95;
+    assert MAX_EDGES >= MEASURED_EDGES_P95;
+    assert (NODE_KINDS as u32) < 32;
+    assert ERR_DUPLICATE_EDGE + 1 == VERDICT_KINDS;
+}
diff --git a/apps/website/public/t27f/graph/specs/spec_graph_export.t27 b/apps/website/public/t27f/graph/specs/spec_graph_export.t27
new file mode 100644
index 0000000000..03a9d8c804
--- /dev/null
+++ b/apps/website/public/t27f/graph/specs/spec_graph_export.t27
@@ -0,0 +1,971 @@
+// SPDX-License-Identifier: Apache-2.0
+; specs/t27f/spec_graph_export.t27 -- the T27F exporter: spec source bytes -> SpecGraph
+; (RFC gHashTag/trinity#1649, epic gHashTag/trinity#1648, tracked in gHashTag/t27#10162).
+; specs/t27f/spec_graph.t27 defines the graph IR and holds one graph, read by hand. This file reads
+; a graph out of real source instead: export_graph(path, src) is a deterministic byte scanner, with
+; no language model and no heuristic beyond the rules below. It reuses spec_graph's builders, codes
+; and validate_graph through `use`; it restates none of them.
+; What it decides:
+;   - Nodes. Each top-level declaration line, with an optional leading `pub `, is one node: module,
+;     use, const, fn, test, invariant and bench map to their NODE_* kind; node 0 is the module and
+;     spans the file. struct, enum, var, spec and endmodule are NODE_OPAQUE with LABEL_EXACT (read,
+;     but no finer kind in IR version 1). Any other word at the head of a declaration, or a known
+;     keyword with no readable name, is NODE_OPAQUE with LABEL_UNKNOWN. A file with no module line
+;     gets node 0 named "(no module)", LABEL_UNKNOWN, and no edge out of it.
+;   - Spans. A node runs from its declaration line to the line of the brace that closes it, counting
+;     braces outside strings, character literals and comments. A declaration with no brace ends at
+;     the line whose code ends in `;` or `}`, or at its last indented continuation line.
+;   - Labels. Everything read directly is LABEL_EXACT. The scanner never emits DERIVED or SUGGESTED.
+;   - Edges, all EXACT, each with the line of its first use: CALLS to a declared fn when a body
+;     names it followed by `(`; USES to a declared const or an imported name (the last segment of a
+;     `use` path) when a body names it; CONSTRAINS from an invariant to a const it names; USES from
+;     the module to each `use` line. fn, test, invariant and bench bodies are read, and a fn's own
+;     name on its declaration is not a call. Duplicates are dropped.
+;   - Capacity. More than MAX_NODES nodes or MAX_EDGES edges keeps counting, so validate_graph
+;     answers ERR_TOO_MANY_NODES or ERR_TOO_MANY_EDGES; the graph is refused, never truncated.
+; Compared with the hand-read fixture tutorial_08_graph(): the 14 declaration nodes and the 9 EXACT
+; edges are identical (kind, label, name, span, endpoints, line). The fixture also holds what a
+; scanner must not invent: node 14 (std.testing, an UNKNOWN region inferred from call targets),
+; four DATA_FLOW edges and three TESTED_BY edges, all DERIVED. The test
+; tutorial_08_exports_the_fixture_exactly_except_what_is_derived states that boundary.
+; Not claimed here:
+;   - Names are matched as text, not resolved: a local variable or parameter named like a const
+;     or an import counts as a use of it, and one named like a fn counts only when followed by `(`.
+;   - Only the top level is read: no node for a statement, branch or parameter; nothing inside a
+;     struct or enum body; no `use` of a name from another spec is followed to that spec.
+;   - A `;` as the first non-blank character of a line is always a comment, and only `//` ends a
+;     line of code; there are no block comments. An opening brace that is not on the declaration
+;     line or an indented continuation line starts a node of its own. A block-form module is not
+;     descended as a unit: its declarations are read as top-level ones and its closing brace is
+;     skipped.
+;   - Capacity is the IR's: 192 nodes and 254 edges (measured, see spec_graph.t27), which holds about
+;     98 of 100 specs in specs/; the larger ones are refused.
+;   - The scanner takes the source as a byte slice; tutorial 08 is embedded below as a snapshot
+;     (sha256 c291e925d9dabef8b72b5a64aef153a2126c0b0b43d67bc08b1b2d7eaa98039a) and the test
+;     compares the snapshot, not the live file.
+; phi^2 + 1/phi^2 = 3 | TRINITY
+
+module t27f_spec_graph_export;
+
+use t27f::spec_graph::SpecGraph;
+use t27f::spec_graph::blank_graph;
+use t27f::spec_graph::with_node;
+use t27f::spec_graph::with_edge;
+use t27f::spec_graph::validate_graph;
+use t27f::spec_graph::tutorial_08_graph;
+use t27f::spec_graph::has_edge;
+use t27f::spec_graph::count_node_kind;
+use t27f::spec_graph::count_node_label;
+use t27f::spec_graph::count_edge_kind;
+use t27f::spec_graph::count_edge_label;
+use t27f::spec_graph::NODE_MODULE;
+use t27f::spec_graph::NODE_CONST;
+use t27f::spec_graph::NODE_FN;
+use t27f::spec_graph::NODE_TEST;
+use t27f::spec_graph::NODE_INVARIANT;
+use t27f::spec_graph::NODE_BENCH;
+use t27f::spec_graph::NODE_USE;
+use t27f::spec_graph::NODE_OPAQUE;
+use t27f::spec_graph::EDGE_CALLS;
+use t27f::spec_graph::EDGE_USES;
+use t27f::spec_graph::EDGE_TESTED_BY;
+use t27f::spec_graph::EDGE_CONSTRAINS;
+use t27f::spec_graph::EDGE_DATA_FLOW;
+use t27f::spec_graph::LABEL_EXACT;
+use t27f::spec_graph::LABEL_DERIVED;
+use t27f::spec_graph::LABEL_SUGGESTED;
+use t27f::spec_graph::LABEL_UNKNOWN;
+use t27f::spec_graph::MAX_NODES;
+use t27f::spec_graph::MAX_EDGES;
+use t27f::spec_graph::GRAPH_OK;
+use t27f::spec_graph::ERR_SPEC_PATH;
+use t27f::spec_graph::ERR_TOO_MANY_NODES;
+use t27f::spec_graph::ERR_TOO_MANY_EDGES;
+
+/// Node 0's name when the source has no module line.
+pub const NO_MODULE_NAME : str = "(no module)";
+
+/// Tutorial lesson 08 as a snapshot of specs/tutorial/08_modules_and_arrays.t27 at gHashTag/t27
+/// commit 2f395025f: 93 lines, sha256 c291e925d9dabef8b72b5a64aef153a2126c0b0b43d67bc08b1b2d7eaa98039a.
+pub const TUTORIAL_08_SRC : []const u8 = "// SPDX-License-Identifier: Apache-2.0\n; 08 -- Modules, visibility and arrays\n; Lesson 8, the last one. How a spec names itself, what it exposes, how it\n; pulls in another spec, and the array/index syntax used by every lookup table\n; in the corpus.\n; .\n; After this, open specs/numeric/gf16.t27 -- it is a real spec built entirely\n; out of what these eight lessons cover.\n; phi^2 + 1/phi^2 = 3 | TRINITY\n\nmodule tutorial-08-modules;\n\n// ============================================================================\n// use\n//\n//   use path::to::spec;\n//\n// Pulls in another spec. Paths are `::`-separated and rooted at the corpus,\n// not at the filesystem.\n// ============================================================================\n\nuse base::types;\n\n// ============================================================================\n// pub\n//\n// `pub` makes a name part of this spec's surface. Without it the name is\n// internal: usable here, invisible elsewhere. Default to leaving things\n// private -- a spec's exported surface is a promise to whoever imports it.\n// ============================================================================\n\npub const EXPORTED_WIDTH : u8 = 16;\n\n// No `pub`: an implementation detail of this module.\nconst INTERNAL_SCALE : u8 = 4;\n\npub fn scaled_width() u8 {\n    return EXPORTED_WIDTH / INTERNAL_SCALE;\n}\n\n// ============================================================================\n// Arrays\n//\n//   pub const NAME : [N]TYPE = [a, b, c];\n//\n// The length and the element type are part of the declared type, written out\n// like every other width in this language. Fixed tables like this are how the\n// numeric specs carry their constants.\n//\n// The Zig-style `[_]TYPE{ a, b, c }` parses, but it lowers to an untyped tuple:\n// indexing one with a runtime value does not compile. Write the type.\n// ============================================================================\n\npub const TRIT_VALUES : [3]i8 = [-1, 0, 1];\n\npub const POWERS_OF_TWO : [8]u16 = [1, 2, 4, 8, 16, 32, 64, 128];\n\npub const EXPONENT_BIAS : [4]u8 = [15, 31, 63, 127];\n\n// ============================================================================\n// Indexing\n//\n// `array[i]`, zero-based.\n// ============================================================================\n\npub fn power_of_two(index: u8) u16 {\n    return POWERS_OF_TWO[index];\n}\n\npub fn bias_for_width(index: u8) u8 {\n    return EXPONENT_BIAS[index];\n}\n\n// ============================================================================\n// Tests\n// ============================================================================\n\ntest \"the power table matches its own definition\" {\n    try std.testing.expectEqual(@as(u16, 1), power_of_two(0));\n    try std.testing.expectEqual(@as(u16, 128), power_of_two(7));\n}\n\ntest \"bias table carries the four standard widths\" {\n    try std.testing.expectEqual(@as(u8, 15), bias_for_width(0));\n    try std.testing.expectEqual(@as(u8, 127), bias_for_width(3));\n}\n\ntest \"a private constant is still usable inside its own module\" {\n    try std.testing.expectEqual(@as(u8, 4), scaled_width());\n}\n\ninvariant exported_width_is_a_power_of_two\n    assert EXPORTED_WIDTH == 16\n";
+
+/// One classified declaration line: node kind and label, the name's byte range, the byte range an
+/// identifier must equal to refer to the node (the whole name, or a `use` path's last segment),
+/// and whether it is a module line.
+pub struct Decl {
+    kind: u8,
+    label: u8,
+    na: usize,
+    nb: usize,
+    sa: usize,
+    sb: usize,
+    is_module: bool,
+}
+
+/// What reading one line of code leaves: the brace depth after it and its last code byte (0 when
+/// the line holds no code, only blanks or a comment).
+pub struct LineScan {
+    depth: u32,
+    tail: u8,
+}
+
+/// Per node: where its name matches and where its first line starts, as byte offsets into the
+/// source. Entries at or past node_count are not read.
+pub struct NameSpans {
+    ma: [192]usize,
+    mb: [192]usize,
+    ia: [192]usize,
+}
+
+pub fn ex_space(c: u8) -> bool {
+    return c == ' ' or c == '\t' or c == '\r';
+}
+
+/// A name byte: letter, digit or '_'.
+pub fn ex_word(c: u8) -> bool {
+    if (c >= '0' and c <= '9') { return true; }
+    if (c >= 'a' and c <= 'z') { return true; }
+    if (c >= 'A' and c <= 'Z') { return true; }
+    return c == '_';
+}
+
+pub fn skip_space(src: []const u8, i: usize, b: usize) -> usize {
+    var k : usize = i;
+    while (k < b and ex_space(src[k])) { k += 1; }
+    return k;
+}
+
+/// The end of the run of name bytes that starts at src[i], within the line that ends at b.
+pub fn word_end(src: []const u8, i: usize, b: usize) -> usize {
+    var k : usize = i;
+    while (k < b and ex_word(src[k])) { k += 1; }
+    return k;
+}
+
+/// The end of the token that starts at src[i]: up to a blank, `;` or `{`.
+pub fn token_end(src: []const u8, i: usize, b: usize) -> usize {
+    var k : usize = i;
+    while (k < b and ex_space(src[k]) == false and src[k] != ';' and src[k] != '{') { k += 1; }
+    return k;
+}
+
+/// The index of the newline that ends the line starting at a, or the length of src.
+pub fn line_end_at(src: []const u8, a: usize) -> usize {
+    var k : usize = a;
+    while (k < src.len and src[k] != '\n') { k += 1; }
+    return k;
+}
+
+/// The number of lines of src: its newlines, plus one for a last line with no newline.
+pub fn count_lines(src: []const u8) -> u32 {
+    var c : u32 = 0;
+    var k : usize = 0;
+    while (k < src.len) {
+        if (src[k] == '\n') { c += 1; }
+        k += 1;
+    }
+    if (src.len > 0 and src[src.len - 1] != '\n') { c += 1; }
+    return c;
+}
+
+/// If a string or character literal starts at src[i], the index just past it (a string that does
+/// not close stops at the line end b); otherwise i.
+pub fn skip_lit(src: []const u8, b: usize, i: usize) -> usize {
+    const c : u8 = src[i];
+    if (c == '"') {
+        var j : usize = i + 1;
+        while (j < b and src[j] != '"') {
+            if (src[j] == '\\') { j += 1; }
+            j += 1;
+        }
+        if (j >= b) { return b; }
+        return j + 1;
+    }
+    if (c == '\'') {
+        if (i + 2 < b and src[i + 1] != '\\' and src[i + 2] == '\'') { return i + 3; }
+        if (i + 3 < b and src[i + 1] == '\\' and src[i + 3] == '\'') { return i + 4; }
+    }
+    return i;
+}
+
+/// The index of the quote that closes the string whose first byte is src[i], or b.
+pub fn closing_quote(src: []const u8, i: usize, b: usize) -> usize {
+    var j : usize = i;
+    while (j < b and src[j] != '"') {
+        if (src[j] == '\\') { j += 1; }
+        j += 1;
+    }
+    if (j > b) { return b; }
+    return j;
+}
+
+/// Read the line src[a..b] (b is the newline or the end) starting at brace depth `depth_in`. A
+/// line whose first non-blank byte is `;` is a comment. Braces inside literals and after `//` do
+/// not count, and a `}` at depth 0 is dropped.
+pub fn scan_line(src: []const u8, a: usize, b: usize, depth_in: u32) -> LineScan {
+    var depth : u32 = depth_in;
+    var tail : u8 = 0;
+    var i : usize = skip_space(src, a, b);
+    if (i < b and src[i] == ';') { return LineScan { depth: depth, tail: 0 }; }
+    var stop : bool = false;
+    while (i < b and stop == false) {
+        const c : u8 = src[i];
+        if (c == '/' and i + 1 < b and src[i + 1] == '/') {
+            stop = true;
+        } else {
+            const j : usize = skip_lit(src, b, i);
+            if (j != i) {
+                tail = '"';
+                i = j;
+            } else {
+                if (c == '{') { depth += 1; }
+                if (c == '}') {
+                    if (depth > 0) { depth -= 1; }
+                }
+                if (ex_space(c) == false) { tail = c; }
+                i += 1;
+            }
+        }
+    }
+    return LineScan { depth: depth, tail: tail };
+}
+
+/// Keywords that declare something the IR has no finer kind for.
+pub fn opaque_keyword(kw: str) -> bool {
+    return kw == "struct" or kw == "enum" or kw == "var" or kw == "spec" or kw == "endmodule";
+}
+
+/// Classify the declaration line src[a..b] (it holds code). The node name is src[na .. nb].
+pub fn classify(src: []const u8, a: usize, b: usize) -> Decl {
+    const i0 : usize = skip_space(src, a, b);
+    const j0 : usize = word_end(src, i0, b);
+    var i : usize = i0;
+    var j : usize = j0;
+    var kw : str = src[i0 .. j0];
+    if (kw == "pub") {
+        const i1 : usize = skip_space(src, j0, b);
+        const j1 : usize = word_end(src, i1, b);
+        if (j1 > i1) {
+            i = i1;
+            j = j1;
+            kw = src[i1 .. j1];
+        }
+    }
+    // the fallback: the head word, or the one byte that is not a word, as an UNKNOWN opaque node
+    var d : Decl = Decl { kind: NODE_OPAQUE, label: LABEL_UNKNOWN, na: i, nb: j, sa: i, sb: j, is_module: false };
+    if (j == i) {
+        d.nb = i + 1;
+        d.sb = i + 1;
+        return d;
+    }
+    const k : usize = skip_space(src, j, b);
+    if (kw == "module") {
+        const e : usize = token_end(src, k, b);
+        if (e == k) { return d; }
+        return Decl { kind: NODE_MODULE, label: LABEL_EXACT, na: k, nb: e, sa: k, sb: e, is_module: true };
+    }
+    if (kw == "use") {
+        const e : usize = token_end(src, k, b);
+        if (e == k) { return d; }
+        var s : usize = e;
+        while (s > k and src[s - 1] != ':') { s -= 1; }
+        return Decl { kind: NODE_USE, label: LABEL_EXACT, na: k, nb: e, sa: s, sb: e, is_module: false };
+    }
+    if (kw == "const" or kw == "fn") {
+        const e : usize = word_end(src, k, b);
+        if (e == k) { return d; }
+        var kind : u8 = NODE_CONST;
+        if (kw == "fn") { kind = NODE_FN; }
+        return Decl { kind: kind, label: LABEL_EXACT, na: k, nb: e, sa: k, sb: e, is_module: false };
+    }
+    if (kw == "test" or kw == "invariant" or kw == "bench") {
+        var kind : u8 = NODE_TEST;
+        if (kw == "invariant") { kind = NODE_INVARIANT; }
+        if (kw == "bench") { kind = NODE_BENCH; }
+        if (k < b and src[k] == '"') {
+            const q : usize = closing_quote(src, k + 1, b);
+            if (q == k + 1) { return d; }
+            return Decl { kind: kind, label: LABEL_EXACT, na: k + 1, nb: q, sa: k + 1, sb: q, is_module: false };
+        }
+        const e : usize = word_end(src, k, b);
+        if (e == k) { return d; }
+        return Decl { kind: kind, label: LABEL_EXACT, na: k, nb: e, sa: k, sb: e, is_module: false };
+    }
+    if (opaque_keyword(kw)) {
+        const e : usize = word_end(src, k, b);
+        if (e == k) {
+            return Decl { kind: NODE_OPAQUE, label: LABEL_EXACT, na: i, nb: j, sa: i, sb: j, is_module: false };
+        }
+        return Decl { kind: NODE_OPAQUE, label: LABEL_EXACT, na: k, nb: e, sa: k, sb: e, is_module: false };
+    }
+    return d;
+}
+
+/// Is there already an edge of this kind between these nodes? Reads only stored edges, so it is
+/// safe on a graph that has gone past capacity.
+pub fn edge_seen(g: SpecGraph, ek: u8, f: u32, t: u32) -> bool {
+    var j : u32 = 0;
+    while (j < g.edge_count and j < MAX_EDGES) {
+        const m : usize = j as usize;
+        if (g.edge_kind[m] == ek and (g.edge_from[m] as u32) == f and (g.edge_to[m] as u32) == t) { return true; }
+        j += 1;
+    }
+    return false;
+}
+
+/// The edges one name token makes: it is src[i .. e], read in node k on `line`, whose source line
+/// ends at b. The first declared fn, const or import it equals is the target; nothing else is.
+pub fn token_edges(g0: SpecGraph, src: []const u8, sp: NameSpans, k: u32, i: usize, e: usize, b: usize, line: u32) -> SpecGraph {
+    var g : SpecGraph = g0;
+    const tok : str = src[i .. e];
+    const ks : usize = k as usize;
+    var t : u32 = 1;
+    var found : bool = false;
+    while (t < g.node_count and found == false) {
+        const ts : usize = t as usize;
+        const tk : u8 = g.node_kind[ts];
+        if (tk == NODE_FN or tk == NODE_CONST or tk == NODE_USE) {
+            const cand : str = src[sp.ma[ts] .. sp.mb[ts]];
+            if (tok == cand) {
+                found = true;
+                const own : bool = t == k and i >= sp.ma[ks] and i < sp.mb[ks];
+                if (own == false) {
+                    var ek : u8 = EDGE_USES;
+                    var emit : bool = true;
+                    if (tk == NODE_FN) {
+                        ek = EDGE_CALLS;
+                        const p : usize = skip_space(src, e, b);
+                        emit = p < b and src[p] == '(';
+                    }
+                    if (tk == NODE_CONST and g.node_kind[ks] == NODE_INVARIANT) { ek = EDGE_CONSTRAINS; }
+                    if (emit and edge_seen(g, ek, k, t) == false) {
+                        g = with_edge(g, ek, k as u8, t as u8, LABEL_EXACT, line);
+                    }
+                }
+            }
+        }
+        t += 1;
+    }
+    return g;
+}
+
+/// The edges read from one source line src[p..b] of node k: every name token outside strings,
+/// character literals and comments.
+pub fn line_edges(g0: SpecGraph, src: []const u8, sp: NameSpans, k: u32, p: usize, b: usize, line: u32) -> SpecGraph {
+    var g : SpecGraph = g0;
+    var i : usize = skip_space(src, p, b);
+    if (i < b and src[i] == ';') { return g; }
+    while (i < b) {
+        const c : u8 = src[i];
+        if (c == '/' and i + 1 < b and src[i + 1] == '/') {
+            i = b;
+        } else {
+            const j : usize = skip_lit(src, b, i);
+            if (j != i) {
+                i = j;
+            } else {
+                if (ex_word(c)) {
+                    const e : usize = word_end(src, i, b);
+                    if (c < '0' or c > '9') { g = token_edges(g, src, sp, k, i, e, b, line); }
+                    i = e;
+                } else {
+                    i += 1;
+                }
+            }
+        }
+    }
+    return g;
+}
+
+/// The edges read from the whole body of node k, line by line from its first to its last line.
+pub fn body_edges(g0: SpecGraph, src: []const u8, sp: NameSpans, k: u32) -> SpecGraph {
+    var g : SpecGraph = g0;
+    const ks : usize = k as usize;
+    const last : u32 = g.line_end[ks];
+    var line : u32 = g.line_start[ks];
+    var p : usize = sp.ia[ks];
+    while (line <= last and p < src.len) {
+        const b : usize = line_end_at(src, p);
+        g = line_edges(g, src, sp, k, p, b, line);
+        p = b + 1;
+        line += 1;
+    }
+    return g;
+}
+
+/// All edges: the module's USES of each `use` line, then the edges read from each fn, test,
+/// invariant and bench body in node order. Called only when every node is stored.
+pub fn read_edges(g0: SpecGraph, src: []const u8, sp: NameSpans) -> SpecGraph {
+    var g : SpecGraph = g0;
+    var k : u32 = 1;
+    if (g.node_label[0] == LABEL_EXACT) {
+        while (k < g.node_count) {
+            if (g.node_kind[k as usize] == NODE_USE) {
+                g = with_edge(g, EDGE_USES, 0, k as u8, LABEL_EXACT, g.line_start[k as usize]);
+            }
+            k += 1;
+        }
+    }
+    k = 1;
+    while (k < g.node_count) {
+        const kind : u8 = g.node_kind[k as usize];
+        if (kind == NODE_FN or kind == NODE_TEST or kind == NODE_INVARIANT or kind == NODE_BENCH) {
+            g = body_edges(g, src, sp, k);
+        }
+        k += 1;
+    }
+    return g;
+}
+
+/// The graph of the spec whose source is `src` and whose path is `path`. Pass 1 reads the nodes
+/// and spans line by line; pass 2 reads the edges. The result is always a SpecGraph;
+/// validate_graph says whether it is a valid one (empty source, no path, more than MAX_NODES nodes
+/// or MAX_EDGES edges are refused there).
+pub fn export_graph(path: str, src: []const u8) -> SpecGraph {
+    const n : usize = src.len;
+    var g : SpecGraph = blank_graph();
+    g.spec_path = path;
+    g.line_count = count_lines(src);
+    g = with_node(g, NODE_MODULE, LABEL_UNKNOWN, NO_MODULE_NAME, 1, g.line_count);
+    var sp : NameSpans = NameSpans { ma: [0; 192], mb: [0; 192], ia: [0; 192] };
+    var pos : usize = 0;
+    var line : u32 = 0;
+    var depth : u32 = 0;
+    var live : bool = false;
+    var closed : bool = true;
+    var cur : u32 = 0;
+    var mod_seen : bool = false;
+    while (pos < n) {
+        const b : usize = line_end_at(src, pos);
+        line += 1;
+        const sc : LineScan = scan_line(src, pos, b, depth);
+        if (depth > 0) {
+            // inside a body: this line belongs to the open node, up to the brace that closes it
+            if (live and cur < MAX_NODES) { g.line_end[cur as usize] = line; }
+            depth = sc.depth;
+            if (depth == 0) { closed = true; }
+        } else {
+            if (sc.tail != 0) {
+                const indented : bool = src[pos] == ' ' or src[pos] == '\t';
+                const first : usize = skip_space(src, pos, b);
+                if (live and closed == false and indented) {
+                    // a continuation line of a declaration that has no brace yet
+                    if (cur < MAX_NODES) { g.line_end[cur as usize] = line; }
+                    depth = sc.depth;
+                    if (depth == 0 and (sc.tail == ';' or sc.tail == '}')) { closed = true; }
+                } else {
+                    if (src[first] == '}') {
+                        // a stray closing brace, or the end of a block-form module
+                        depth = 0;
+                    } else {
+                        const d : Decl = classify(src, pos, b);
+                        if (d.is_module and mod_seen == false) {
+                            mod_seen = true;
+                            g.node_name[0] = src[d.na .. d.nb];
+                            g.node_label[0] = LABEL_EXACT;
+                            live = false;
+                            depth = 0;
+                        } else {
+                            var kind : u8 = d.kind;
+                            if (kind == NODE_MODULE) { kind = NODE_OPAQUE; }
+                            cur = g.node_count;
+                            g = with_node(g, kind, d.label, src[d.na .. d.nb], line, line);
+                            if (cur < MAX_NODES) {
+                                sp.ma[cur as usize] = d.sa;
+                                sp.mb[cur as usize] = d.sb;
+                                sp.ia[cur as usize] = pos;
+                            }
+                            live = true;
+                            depth = sc.depth;
+                            closed = depth == 0 and (sc.tail == ';' or sc.tail == '}');
+                        }
+                    }
+                }
+            }
+        }
+        pos = b + 1;
+    }
+    if (g.node_count <= MAX_NODES) { g = read_edges(g, src, sp); }
+    return g;
+}
+
+/// validate_graph of the export: GRAPH_OK, or the first rule the exported graph breaks.
+pub fn export_verdict(path: str, src: []const u8) -> u8 {
+    return validate_graph(export_graph(path, src));
+}
+
+/// Do node i of e and node i of f agree on kind, label, name and span? Both must hold node i.
+pub fn node_matches(e: SpecGraph, f: SpecGraph, i: u32) -> bool {
+    const k : usize = i as usize;
+    if (e.node_kind[k] != f.node_kind[k]) { return false; }
+    if (e.node_label[k] != f.node_label[k]) { return false; }
+    const en : str = e.node_name[k];
+    const fn_ : str = f.node_name[k];
+    if ((en == fn_) == false) { return false; }
+    if (e.line_start[k] != f.line_start[k]) { return false; }
+    return e.line_end[k] == f.line_end[k];
+}
+
+/// How many nodes, by index, the two graphs share.
+pub fn nodes_in_common(e: SpecGraph, f: SpecGraph) -> u32 {
+    var c : u32 = 0;
+    var i : u32 = 0;
+    while (i < e.node_count and i < f.node_count and i < MAX_NODES) {
+        if (node_matches(e, f, i)) { c += 1; }
+        i += 1;
+    }
+    return c;
+}
+
+/// Does g hold an edge with exactly these kind, endpoints, label and line?
+pub fn edge_in(g: SpecGraph, ek: u8, f: u8, t: u8, l: u8, line: u32) -> bool {
+    var j : u32 = 0;
+    while (j < g.edge_count and j < MAX_EDGES) {
+        const m : usize = j as usize;
+        if (g.edge_kind[m] == ek and g.edge_from[m] == f and g.edge_to[m] == t and g.edge_label[m] == l and g.edge_line[m] == line) { return true; }
+        j += 1;
+    }
+    return false;
+}
+
+/// How many edges of a are also edges of b, compared on every field.
+pub fn edges_shared(a: SpecGraph, b: SpecGraph) -> u32 {
+    var c : u32 = 0;
+    var j : u32 = 0;
+    while (j < a.edge_count and j < MAX_EDGES) {
+        const m : usize = j as usize;
+        if (edge_in(b, a.edge_kind[m], a.edge_from[m], a.edge_to[m], a.edge_label[m], a.edge_line[m])) { c += 1; }
+        j += 1;
+    }
+    return c;
+}
+
+test line_counts_follow_the_newlines {
+    assert count_lines("") == 0;
+    assert count_lines("a") == 1;
+    assert count_lines("a\n") == 1;
+    assert count_lines("a\nb") == 2;
+    assert count_lines("a\n\n") == 2;
+    assert count_lines("\n") == 1;
+    // negative controls: not one more for a trailing newline, not one fewer for a missing one
+    assert count_lines("a\n") != 2;
+    assert count_lines("a\nb") != 1;
+    assert count_lines(TUTORIAL_08_SRC) == 93;
+}
+
+test the_module_line_names_node_zero {
+    const g : SpecGraph = export_graph("specs/x.t27", "module m_one;\n");
+    assert g.node_count == 1;
+    assert g.node_kind[0] == NODE_MODULE;
+    assert g.node_label[0] == LABEL_EXACT;
+    assert g.node_name[0] == "m_one";
+    assert g.line_start[0] == 1;
+    assert g.line_end[0] == 1;
+    assert g.spec_path == "specs/x.t27";
+    assert validate_graph(g) == GRAPH_OK;
+    // a hyphenated module name is read whole, as tutorial 08 writes it
+    assert export_graph("specs/x.t27", "module a-b-c;\n").node_name[0] == "a-b-c";
+    // negative control: no module line means an UNKNOWN node 0, never an invented name
+    const h : SpecGraph = export_graph("specs/x.t27", "const A : u8 = 1;\n");
+    assert h.node_label[0] == LABEL_UNKNOWN;
+    assert h.node_name[0] == NO_MODULE_NAME;
+    assert (h.node_name[0] == "m_one") == false;
+    assert h.node_count == 2;
+    assert validate_graph(h) == GRAPH_OK;
+}
+
+test every_declaration_kind_reads_as_its_node_kind {
+    const src : []const u8 = "module m;\nuse p::q::Thing;\npub const A : u8 = 1;\nconst B : u8 = 2;\npub fn f() u8 { return A; }\nfn g() u8 { return B; }\ntest \"t one\" { assert f() == 1; }\ninvariant inv_one assert A == 1;\nbench bench_one { f(); }\n";
+    const g : SpecGraph = export_graph("specs/x.t27", src);
+    assert validate_graph(g) == GRAPH_OK;
+    assert g.node_count == 9;
+    assert g.line_count == 9;
+    assert g.node_kind[0] == NODE_MODULE;
+    assert g.node_kind[1] == NODE_USE;
+    assert g.node_kind[2] == NODE_CONST;
+    assert g.node_kind[3] == NODE_CONST;
+    assert g.node_kind[4] == NODE_FN;
+    assert g.node_kind[5] == NODE_FN;
+    assert g.node_kind[6] == NODE_TEST;
+    assert g.node_kind[7] == NODE_INVARIANT;
+    assert g.node_kind[8] == NODE_BENCH;
+    assert g.node_name[1] == "p::q::Thing";
+    assert g.node_name[2] == "A";
+    assert g.node_name[4] == "f";
+    assert g.node_name[6] == "t one";
+    assert g.node_name[7] == "inv_one";
+    assert g.node_name[8] == "bench_one";
+    // each is on its own line; a single-line declaration has start == end
+    assert g.line_start[1] == 2 and g.line_end[1] == 2;
+    assert g.line_start[4] == 5 and g.line_end[4] == 5;
+    assert g.line_start[6] == 7 and g.line_end[6] == 7;
+    assert g.line_start[8] == 9 and g.line_end[8] == 9;
+    // `pub` changes nothing about the kind: A is pub, B is not, both are consts
+    assert count_node_kind(g, NODE_CONST) == 2;
+    assert count_node_kind(g, NODE_FN) == 2;
+    // everything read directly is EXACT; negative control: nothing is UNKNOWN here
+    assert count_node_label(g, LABEL_EXACT) == 9;
+    assert count_node_label(g, LABEL_UNKNOWN) == 0;
+    // the six edges this source holds
+    assert g.edge_count == 6;
+    assert has_edge(g, EDGE_USES, 0, 1);
+    assert has_edge(g, EDGE_USES, 4, 2);
+    assert has_edge(g, EDGE_USES, 5, 3);
+    assert has_edge(g, EDGE_CALLS, 6, 4);
+    assert has_edge(g, EDGE_CONSTRAINS, 7, 2);
+    assert has_edge(g, EDGE_CALLS, 8, 4);
+    // negative controls: the invariant constrains A, it does not merely use it; nothing reads backwards
+    assert has_edge(g, EDGE_USES, 7, 2) == false;
+    assert has_edge(g, EDGE_CALLS, 4, 6) == false;
+    assert has_edge(g, EDGE_USES, 5, 2) == false;
+}
+
+test other_declarations_are_opaque {
+    const src : []const u8 = "module m;\nstruct S {\n    x: u8,\n}\nenum E { A, B }\nwhat is this;\n";
+    const g : SpecGraph = export_graph("specs/x.t27", src);
+    assert validate_graph(g) == GRAPH_OK;
+    assert g.node_count == 4;
+    // a known keyword is read: OPAQUE and EXACT, named, with its brace-closed span
+    assert g.node_kind[1] == NODE_OPAQUE;
+    assert g.node_label[1] == LABEL_EXACT;
+    assert g.node_name[1] == "S";
+    assert g.line_start[1] == 2 and g.line_end[1] == 4;
+    assert g.node_kind[2] == NODE_OPAQUE;
+    assert g.node_label[2] == LABEL_EXACT;
+    assert g.node_name[2] == "E";
+    assert g.line_start[2] == 5 and g.line_end[2] == 5;
+    // negative control: a word the scanner does not know is UNKNOWN, not guessed at
+    assert g.node_kind[3] == NODE_OPAQUE;
+    assert g.node_label[3] == LABEL_UNKNOWN;
+    assert g.node_name[3] == "what";
+    assert g.node_label[3] != LABEL_EXACT;
+    assert count_node_label(g, LABEL_UNKNOWN) == 1;
+}
+
+test a_declaration_with_no_readable_name_is_unknown {
+    const nameless_fn : SpecGraph = export_graph("specs/x.t27", "module m;\nfn () u8 { return 1; }\n");
+    assert validate_graph(nameless_fn) == GRAPH_OK;
+    assert nameless_fn.node_kind[1] == NODE_OPAQUE;
+    assert nameless_fn.node_label[1] == LABEL_UNKNOWN;
+    assert nameless_fn.node_name[1] == "fn";
+    const nameless_const : SpecGraph = export_graph("specs/x.t27", "module m;\nconst : u8 = 1;\n");
+    assert nameless_const.node_kind[1] == NODE_OPAQUE;
+    assert nameless_const.node_label[1] == LABEL_UNKNOWN;
+    const nameless_test : SpecGraph = export_graph("specs/x.t27", "module m;\ntest {\n}\n");
+    assert nameless_test.node_label[1] == LABEL_UNKNOWN;
+    const empty_title : SpecGraph = export_graph("specs/x.t27", "module m;\ntest \"\" { }\n");
+    assert empty_title.node_label[1] == LABEL_UNKNOWN;
+    const pub_alone : SpecGraph = export_graph("specs/x.t27", "module m;\npub\n");
+    assert pub_alone.node_label[1] == LABEL_UNKNOWN;
+    assert pub_alone.node_name[1] == "pub";
+    // positive controls: with a name, the same lines are fn, const and test nodes
+    assert export_graph("specs/x.t27", "module m;\nfn a() u8 { return 1; }\n").node_kind[1] == NODE_FN;
+    assert export_graph("specs/x.t27", "module m;\nconst A : u8 = 1;\n").node_kind[1] == NODE_CONST;
+    assert export_graph("specs/x.t27", "module m;\ntest \"t\" { }\n").node_kind[1] == NODE_TEST;
+}
+
+test a_span_runs_to_the_matching_closing_brace {
+    const src : []const u8 = "module m;\nfn f() u8 {\n    if (x) {\n        y();\n    }\n    return 1;\n}\nconst C : u8 = 1;\n";
+    const g : SpecGraph = export_graph("specs/x.t27", src);
+    assert validate_graph(g) == GRAPH_OK;
+    assert g.node_count == 3;
+    // nested braces: the fn closes on line 7, not on the inner brace at line 5
+    assert g.line_start[1] == 2;
+    assert g.line_end[1] == 7;
+    assert g.line_end[1] != 5;
+    // the next declaration starts after it, on its own line
+    assert g.node_kind[2] == NODE_CONST;
+    assert g.line_start[2] == 8 and g.line_end[2] == 8;
+    // a body that never closes runs to the end of the file, and the graph is still valid
+    const open_body : SpecGraph = export_graph("specs/x.t27", "module m;\nfn f() u8 {\n    return 1;\n");
+    assert open_body.line_end[1] == 3;
+    assert validate_graph(open_body) == GRAPH_OK;
+    // a closing brace on the declaration line gives a one-line span; negative control: it is not 2 lines
+    const one_line : SpecGraph = export_graph("specs/x.t27", "module m;\nfn f() u8 { return 1; }\nfn g() u8 { return 2; }\n");
+    assert one_line.line_start[1] == 2 and one_line.line_end[1] == 2;
+    assert one_line.line_start[2] == 3 and one_line.line_end[2] == 3;
+}
+
+test braces_in_strings_comments_and_characters_do_not_count {
+    // a closing brace in a string, a line comment, a character literal and a `;` comment line:
+    // none of them closes the fn, which still runs to its real brace on line 8
+    const closing : []const u8 = "module m;\nfn f() u8 {\n    let s = \"}\";\n    // }\n    let c = '}';\n    ; }\n    return 1;\n}\nconst C : u8 = 1;\n";
+    const g : SpecGraph = export_graph("specs/x.t27", closing);
+    assert validate_graph(g) == GRAPH_OK;
+    assert g.node_count == 3;
+    assert g.line_start[1] == 2 and g.line_end[1] == 8;
+    assert g.line_start[2] == 9 and g.line_end[2] == 9;
+    // an opening brace in the same places does not open anything: the fn closes on line 8
+    const opening : []const u8 = "module m;\nfn f() u8 {\n    let s = \"{\";\n    // {\n    let c = '{';\n    ; {\n    return 1;\n}\nconst C : u8 = 1;\n";
+    const h : SpecGraph = export_graph("specs/x.t27", opening);
+    assert h.node_count == 3;
+    assert h.line_end[1] == 8;
+    assert h.line_start[2] == 9;
+    // an escaped quote does not end the string, so the brace after it is still inside it
+    const escaped : []const u8 = "module m;\nfn f() u8 {\n    let s = \"a\\\"}\";\n}\nconst C : u8 = 1;\n";
+    const k : SpecGraph = export_graph("specs/x.t27", escaped);
+    assert k.node_count == 3;
+    assert k.line_end[1] == 4;
+    assert k.line_start[2] == 5;
+    // negative control: a real brace outside any literal does count
+    const real : []const u8 = "module m;\nfn f() u8 {\n    let s = 1;\n}\nconst C : u8 = 1;\n";
+    assert export_graph("specs/x.t27", real).line_end[1] == 4;
+    assert export_graph("specs/x.t27", real).line_end[1] != 3;
+}
+
+test a_declaration_with_no_brace_ends_at_its_last_continuation_line {
+    const src : []const u8 = "module m;\ninvariant big_one\n    assert A == 1\n    and B == 2\nconst A : u8 =\n    1;\nconst B : u8 = 2;\ninvariant after\nassert 1 == 1\n";
+    const g : SpecGraph = export_graph("specs/x.t27", src);
+    assert validate_graph(g) == GRAPH_OK;
+    assert g.node_count == 6;
+    // the invariant runs over its two indented lines
+    assert g.node_kind[1] == NODE_INVARIANT;
+    assert g.line_start[1] == 2 and g.line_end[1] == 4;
+    // a const split over two lines ends at the line with its `;`
+    assert g.node_kind[2] == NODE_CONST;
+    assert g.line_start[2] == 5 and g.line_end[2] == 6;
+    assert g.line_start[3] == 7 and g.line_end[3] == 7;
+    // negative control: an unindented line is not a continuation; it starts a node of its own
+    assert g.node_kind[4] == NODE_INVARIANT;
+    assert g.line_end[4] == 8;
+    assert g.node_kind[5] == NODE_OPAQUE;
+    assert g.node_label[5] == LABEL_UNKNOWN;
+    assert g.line_start[5] == 9;
+    // the continuation lines name A and B, so the invariant constrains both, on the lines it names them
+    assert g.edge_count == 2;
+    assert edge_in(g, EDGE_CONSTRAINS, 1, 2, LABEL_EXACT, 3);
+    assert edge_in(g, EDGE_CONSTRAINS, 1, 3, LABEL_EXACT, 4);
+}
+
+test blank_lines_and_comments_between_declarations_belong_to_none {
+    const src : []const u8 = "// header\n; prose\n\nmodule m;\n\n// about A\nconst A : u8 = 1;\n\n; about f\nfn f() u8 {\n\n    return A;\n\n}\n\n// trailing\n";
+    const g : SpecGraph = export_graph("specs/x.t27", src);
+    assert validate_graph(g) == GRAPH_OK;
+    assert g.node_count == 3;
+    assert g.line_count == 16;
+    assert g.line_start[1] == 7 and g.line_end[1] == 7;
+    // the fn runs from its declaration to its closing brace, blank lines included, and not into the trailing comment
+    assert g.line_start[2] == 10 and g.line_end[2] == 14;
+    assert g.line_end[2] != 16;
+    assert has_edge(g, EDGE_USES, 2, 1);
+}
+
+test a_block_form_module_still_exports_its_declarations {
+    const src : []const u8 = "module m {\n    const A : u8 = 1;\n    fn f() u8 { return A; }\n}\n";
+    const g : SpecGraph = export_graph("specs/x.t27", src);
+    assert validate_graph(g) == GRAPH_OK;
+    assert g.node_name[0] == "m";
+    assert g.node_label[0] == LABEL_EXACT;
+    assert g.node_count == 3;
+    assert g.node_kind[1] == NODE_CONST;
+    assert g.line_start[1] == 2;
+    assert g.node_kind[2] == NODE_FN;
+    assert has_edge(g, EDGE_USES, 2, 1);
+    // negative control: the module's closing brace is not a node
+    assert g.node_count != 4;
+    assert g.line_end[2] == 3;
+}
+
+test a_second_module_line_is_opaque_not_a_second_module {
+    const g : SpecGraph = export_graph("specs/x.t27", "module a;\nmodule b;\n");
+    assert validate_graph(g) == GRAPH_OK;
+    assert count_node_kind(g, NODE_MODULE) == 1;
+    assert g.node_name[0] == "a";
+    assert g.node_kind[1] == NODE_OPAQUE;
+    assert g.node_label[1] == LABEL_EXACT;
+    assert g.node_name[1] == "b";
+    assert (g.node_name[0] == "b") == false;
+}
+
+test edges_follow_the_direction_rules_and_carry_their_line {
+    const src : []const u8 = "module m;\nuse x::imp;\nconst K : u8 = 1;\nfn leaf() u8 { return K; }\nfn mid() u8 {\n    let a = leaf();\n    let b = leaf();\n    return a + b + imp();\n}\nfn rec(n: u8) u8 { return rec(n); }\nfn plain() u8 { let v = leaf; return v; }\nfn quiet() u8 { let s = \"leaf() K imp()\"; return 0; } // leaf() K\n";
+    const g : SpecGraph = export_graph("specs/x.t27", src);
+    assert validate_graph(g) == GRAPH_OK;
+    assert g.node_count == 8;
+    assert g.edge_count == 5;
+    // the module uses its import, on the `use` line
+    assert edge_in(g, EDGE_USES, 0, 1, LABEL_EXACT, 2);
+    // a fn naming a const uses it, on the line of the use
+    assert edge_in(g, EDGE_USES, 3, 2, LABEL_EXACT, 4);
+    // a call is a CALLS edge on the line of the first call; the second call, line 7, adds nothing
+    assert edge_in(g, EDGE_CALLS, 4, 3, LABEL_EXACT, 6);
+    assert edge_in(g, EDGE_CALLS, 4, 3, LABEL_EXACT, 7) == false;
+    assert count_edge_kind(g, EDGE_CALLS) == 2;
+    // an imported name is the last segment of its `use` path
+    assert edge_in(g, EDGE_USES, 4, 1, LABEL_EXACT, 8);
+    // recursion is a call; the fn's own name on its declaration is not
+    assert edge_in(g, EDGE_CALLS, 5, 5, LABEL_EXACT, 10);
+    assert g.edge_line[4] == 10;
+    // negative controls: a name with no `(` is not a call, and a name inside a string or after
+    // `//` is not a use, so plain and quiet have no edge out
+    assert has_edge(g, EDGE_CALLS, 6, 3) == false;
+    assert has_edge(g, EDGE_USES, 7, 2) == false;
+    assert has_edge(g, EDGE_USES, 7, 1) == false;
+    assert has_edge(g, EDGE_CALLS, 7, 3) == false;
+    // no const reads back into a fn, no fn is used (only called)
+    assert has_edge(g, EDGE_USES, 4, 3) == false;
+    assert has_edge(g, EDGE_CALLS, 3, 3) == false;
+}
+
+test a_test_that_calls_a_fn_calls_it_and_the_scanner_does_not_read_it_backwards {
+    const src : []const u8 = "module m;\nfn f() u8 { return 1; }\ntest \"calls f\" {\n    assert f() == 1;\n    assert f() == 1;\n}\n";
+    const g : SpecGraph = export_graph("specs/x.t27", src);
+    assert validate_graph(g) == GRAPH_OK;
+    assert g.edge_count == 1;
+    assert edge_in(g, EDGE_CALLS, 2, 1, LABEL_EXACT, 4);
+    // TESTED_BY is the call read backwards, so it is DERIVED by definition and not the scanner's
+    assert count_edge_kind(g, EDGE_TESTED_BY) == 0;
+    assert has_edge(g, EDGE_TESTED_BY, 1, 2) == false;
+}
+
+test a_name_in_a_non_body_position_makes_no_edge {
+    // const and use lines are not bodies; the module's only edge is its USES of the import
+    const g : SpecGraph = export_graph("specs/x.t27", "module m;\nuse a::K;\nconst K : u8 = 1;\nconst L : u8 = K;\n");
+    assert validate_graph(g) == GRAPH_OK;
+    assert g.edge_count == 1;
+    assert has_edge(g, EDGE_USES, 0, 1);
+    // negative control: the same const used from a fn body is an edge
+    const h : SpecGraph = export_graph("specs/x.t27", "module m;\nconst K : u8 = 1;\nfn f() u8 { return K; }\n");
+    assert has_edge(h, EDGE_USES, 2, 1);
+    // an unknown module has no edge out: UNKNOWN endpoints are refused by the IR
+    const n : SpecGraph = export_graph("specs/x.t27", "use a::K;\n");
+    assert n.edge_count == 0;
+    assert validate_graph(n) == GRAPH_OK;
+    const y : SpecGraph = export_graph("specs/x.t27", "module m;\nuse a::K;\n");
+    assert y.edge_count == 1;
+}
+
+test the_scanner_never_emits_derived_or_suggested {
+    const g : SpecGraph = export_graph("specs/tutorial/08_modules_and_arrays.t27", TUTORIAL_08_SRC);
+    assert count_node_label(g, LABEL_DERIVED) == 0;
+    assert count_node_label(g, LABEL_SUGGESTED) == 0;
+    assert count_edge_label(g, LABEL_DERIVED) == 0;
+    assert count_edge_label(g, LABEL_SUGGESTED) == 0;
+    assert count_edge_kind(g, EDGE_TESTED_BY) == 0;
+    assert count_edge_kind(g, EDGE_DATA_FLOW) == 0;
+    // negative control: the check can fail, because the hand-read fixture does hold such labels
+    const f : SpecGraph = tutorial_08_graph();
+    assert count_edge_label(f, LABEL_DERIVED) == 7;
+    assert count_edge_kind(f, EDGE_TESTED_BY) == 3;
+}
+
+test more_nodes_than_the_ir_holds_is_refused_not_truncated {
+    // module + 191 consts = 192 nodes: exactly at capacity, valid
+    const at_cap : []const u8 = "module m;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\n";
+    const a : SpecGraph = export_graph("specs/x.t27", at_cap);
+    assert a.node_count == MAX_NODES;
+    assert validate_graph(a) == GRAPH_OK;
+    // module + 192 consts = 193 nodes: one over, and the count says so
+    const over : []const u8 = "module m;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\nconst a : u8 = 1;\n";
+    const g : SpecGraph = export_graph("specs/x.t27", over);
+    assert g.node_count == MAX_NODES + 1;
+    assert validate_graph(g) == ERR_TOO_MANY_NODES;
+    assert export_verdict("specs/x.t27", over) == ERR_TOO_MANY_NODES;
+    // negative controls: the verdict is the capacity one, and it is not OK
+    assert export_verdict("specs/x.t27", over) != GRAPH_OK;
+    assert export_verdict("specs/x.t27", over) != ERR_TOO_MANY_EDGES;
+    assert export_verdict("specs/x.t27", at_cap) == GRAPH_OK;
+}
+
+test more_edges_than_the_ir_holds_is_refused_not_truncated {
+    // 2 fns and 127 tests that each call both: 254 edges, exactly at capacity
+    const at_cap : []const u8 = "module m;\nfn a() u8 { return 1; }\nfn b() u8 { return 1; }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\n";
+    const a : SpecGraph = export_graph("specs/x.t27", at_cap);
+    assert a.node_count == 130;
+    assert a.edge_count == MAX_EDGES;
+    assert validate_graph(a) == GRAPH_OK;
+    // a 128th test makes 256: over, and the count says so
+    const over : []const u8 = "module m;\nfn a() u8 { return 1; }\nfn b() u8 { return 1; }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\ntest \"t\" { a(); b(); }\n";
+    const g : SpecGraph = export_graph("specs/x.t27", over);
+    assert g.node_count == 131;
+    assert g.edge_count == MAX_EDGES + 2;
+    assert validate_graph(g) == ERR_TOO_MANY_EDGES;
+    // negative controls: it is the edge verdict, not the node one, and it is not OK
+    assert export_verdict("specs/x.t27", over) == ERR_TOO_MANY_EDGES;
+    assert export_verdict("specs/x.t27", over) != ERR_TOO_MANY_NODES;
+    assert export_verdict("specs/x.t27", at_cap) == GRAPH_OK;
+}
+
+test an_empty_source_or_a_missing_path_is_refused {
+    assert export_verdict("specs/x.t27", "") == ERR_SPEC_PATH;
+    assert export_verdict("", "module m;\n") == ERR_SPEC_PATH;
+    // negative control: a path and a line make a valid graph
+    assert export_verdict("specs/x.t27", "module m;\n") == GRAPH_OK;
+    assert export_verdict("specs/x.t27", "\n") == GRAPH_OK;
+    assert export_graph("specs/x.t27", "").node_count == 1;
+}
+
+test tutorial_08_export_is_a_valid_graph_of_the_lesson {
+    const g : SpecGraph = export_graph("specs/tutorial/08_modules_and_arrays.t27", TUTORIAL_08_SRC);
+    assert validate_graph(g) == GRAPH_OK;
+    assert g.spec_path == "specs/tutorial/08_modules_and_arrays.t27";
+    assert g.line_count == 93;
+    assert g.node_count == 14;
+    assert g.edge_count == 9;
+    assert g.node_name[0] == "tutorial-08-modules";
+    assert g.line_start[0] == 1 and g.line_end[0] == 93;
+    assert count_node_kind(g, NODE_USE) == 1;
+    assert count_node_kind(g, NODE_CONST) == 5;
+    assert count_node_kind(g, NODE_FN) == 3;
+    assert count_node_kind(g, NODE_TEST) == 3;
+    assert count_node_kind(g, NODE_INVARIANT) == 1;
+    assert count_node_kind(g, NODE_OPAQUE) == 0;
+    // negative control: the same lesson with a line cut off is a different graph
+    const cut : SpecGraph = export_graph("specs/tutorial/08_modules_and_arrays.t27", "module tutorial-08-modules;\nuse base::types;\n");
+    assert cut.node_count == 2;
+    assert cut.node_count != g.node_count;
+}
+
+test tutorial_08_exports_the_fixture_exactly_except_what_is_derived {
+    const e : SpecGraph = export_graph("specs/tutorial/08_modules_and_arrays.t27", TUTORIAL_08_SRC);
+    const f : SpecGraph = tutorial_08_graph();
+    assert validate_graph(e) == GRAPH_OK;
+    assert validate_graph(f) == GRAPH_OK;
+    assert e.spec_path == f.spec_path;
+    assert e.line_count == f.line_count;
+    // the 14 declaration nodes are identical, node by node: kind, label, name and span
+    assert nodes_in_common(e, f) == 14;
+    assert node_matches(e, f, 0);
+    assert node_matches(e, f, 4);
+    assert node_matches(e, f, 10);
+    assert node_matches(e, f, 13);
+    // difference 1: the fixture's node 14 (std.testing, UNKNOWN) is inferred from call targets,
+    // not declared in the file, so the scanner does not produce it
+    assert f.node_count == 15;
+    assert e.node_count == 14;
+    assert f.node_label[14] == LABEL_UNKNOWN;
+    // every edge the scanner reads is in the fixture, with the same kind, endpoints, label and line
+    assert e.edge_count == 9;
+    assert edges_shared(e, f) == 9;
+    // every EXACT edge of the fixture is one the scanner reads
+    assert count_edge_label(f, LABEL_EXACT) == 9;
+    assert edges_shared(f, e) == 9;
+    // difference 2: the fixture's other 7 edges are DERIVED (4 data flow, 3 tested_by), and the scanner never derives
+    assert f.edge_count == 16;
+    assert f.edge_count - edges_shared(f, e) == 7;
+    assert count_edge_label(f, LABEL_DERIVED) == 7;
+    assert count_edge_kind(f, EDGE_DATA_FLOW) == 4;
+    assert count_edge_kind(f, EDGE_TESTED_BY) == 3;
+    assert count_edge_kind(e, EDGE_DATA_FLOW) == 0;
+    assert count_edge_kind(e, EDGE_TESTED_BY) == 0;
+    // the nine, by name: USES 0->1 22, 4->2 38, 4->3 38, 8->6 67, 9->7 71; CALLS 10->8 79, 11->9 84, 12->4 89; CONSTRAINS 13->2 93
+    assert edge_in(e, EDGE_USES, 0, 1, LABEL_EXACT, 22);
+    assert edge_in(e, EDGE_USES, 4, 2, LABEL_EXACT, 38);
+    assert edge_in(e, EDGE_USES, 4, 3, LABEL_EXACT, 38);
+    assert edge_in(e, EDGE_USES, 8, 6, LABEL_EXACT, 67);
+    assert edge_in(e, EDGE_USES, 9, 7, LABEL_EXACT, 71);
+    assert edge_in(e, EDGE_CALLS, 10, 8, LABEL_EXACT, 79);
+    assert edge_in(e, EDGE_CALLS, 11, 9, LABEL_EXACT, 84);
+    assert edge_in(e, EDGE_CALLS, 12, 4, LABEL_EXACT, 89);
+    assert edge_in(e, EDGE_CONSTRAINS, 13, 2, LABEL_EXACT, 93);
+    // negative controls: the comparison can fail. A fixture with one span moved is not matched,
+    // and one with an edge line moved shares one fewer edge.
+    var moved : SpecGraph = tutorial_08_graph();
+    moved.line_end[4] = 40;
+    assert node_matches(e, moved, 4) == false;
+    assert nodes_in_common(e, moved) == 13;
+    var shifted : SpecGraph = tutorial_08_graph();
+    shifted.edge_line[1] = 37;
+    assert edges_shared(e, shifted) == 8;
+    assert edges_shared(e, shifted) != edges_shared(e, f);
+}
diff --git a/apps/website/public/t27f/graph/specs/spec_graph_view.t27 b/apps/website/public/t27f/graph/specs/spec_graph_view.t27
new file mode 100644
index 0000000000..d469b1b440
--- /dev/null
+++ b/apps/website/public/t27f/graph/specs/spec_graph_view.t27
@@ -0,0 +1,800 @@
+// SPDX-License-Identifier: Apache-2.0
+; specs/t27f/spec_graph_view.t27 -- the T27F graph view: a deterministic layout of a spec graph
+; (gHashTag/t27#10034; epic gHashTag/trinity#1648, RFC gHashTag/trinity#1649). T27F is the visual
+; spec of .t27 (.claude/skills/t27f/SKILL.md, "What T27F is"): one spec -> one graph -> many views.
+; The graph is specs/t27f/spec_graph.t27; this file is its first view, the one that shows the graph
+; itself, not a topic map. It turns a SpecGraph into numbers a host draws, as specs/t27f/reel.t27
+; does for a reel frame: a box per node, a line per edge, colours as 0xRRGGBB. Nothing here draws
+; pixels or writes markup.
+; Rules the layout holds, each with a test below:
+;   - one column per node kind present, in a fixed kind order, and no empty column;
+;   - a node's row order, size, fill, stroke and dash come from its inference label, so a fact, a
+;     derivation and a guess look different before any text is read;
+;   - an UNKNOWN node is drawn alone: in a band below every known node, and no edge ends at it;
+;   - every edge line carries a source line of the spec: its own, or for a DERIVED tested_by edge the
+;     line of the call it is read back from; an edge with no line makes the view refuse the graph;
+;   - each node's widget is spec_graph's node_widget, never a rule of this file;
+;   - a graph validate_graph refuses is refused here with the same code, and is not laid out.
+; Not claimed: t27c has no graph exporter yet, so the only graphs laid out are spec_graph's
+; hand-read fixtures; there is no edge routing around boxes, and no host draws this yet.
+; phi^2 + 1/phi^2 = 3 | TRINITY
+
+module t27f_spec_graph_view;
+
+use t27f::spec_graph::SpecGraph;
+use t27f::spec_graph::validate_graph;
+use t27f::spec_graph::valid_label;
+use t27f::spec_graph::node_widget;
+use t27f::spec_graph::tutorial_08_graph;
+use t27f::spec_graph::with_suggestion;
+use t27f::spec_graph::with_edge;
+use t27f::spec_graph::with_node;
+use t27f::spec_graph::MAX_NODES;
+use t27f::spec_graph::blank_graph;
+use t27f::spec_graph::GRAPH_OK;
+use t27f::spec_graph::VERDICT_KINDS;
+use t27f::spec_graph::ERR_EDGE_UNKNOWN_NODE;
+use t27f::spec_graph::ERR_SPEC_PATH;
+use t27f::spec_graph::NODE_KINDS;
+use t27f::spec_graph::NODE_MODULE;
+use t27f::spec_graph::NODE_CONST;
+use t27f::spec_graph::NODE_FN;
+use t27f::spec_graph::NODE_TEST;
+use t27f::spec_graph::NODE_INVARIANT;
+use t27f::spec_graph::NODE_BENCH;
+use t27f::spec_graph::NODE_USE;
+use t27f::spec_graph::NODE_OPAQUE;
+use t27f::spec_graph::EDGE_CALLS;
+use t27f::spec_graph::EDGE_TESTED_BY;
+use t27f::spec_graph::EDGE_DATA_FLOW;
+use t27f::spec_graph::EDGE_KINDS;
+use t27f::spec_graph::LABEL_EXACT;
+use t27f::spec_graph::LABEL_DERIVED;
+use t27f::spec_graph::LABEL_SUGGESTED;
+use t27f::spec_graph::LABEL_UNKNOWN;
+use t27f::spec_graph::LABEL_KINDS;
+use t27f::spec_graph::NO_LINE;
+use t27f::spec_graph::NO_INDEX;
+use t27f::ui_plan::WIDGET_HONEYCOMB_CARD;
+use t27f::ui_plan::WIDGET_FORMULA_VIEW;
+use t27f::ui_plan::WIDGET_RUN_BUTTON;
+use t27f::ui_plan::WIDGET_TEXT_BLOCK;
+
+/// Verdicts. VIEW_OK is GRAPH_OK; a graph validate_graph refuses keeps that code; the view adds one
+/// code of its own, the first after spec_graph's.
+pub const VIEW_OK : u8 = 0;
+pub const VIEW_ERR_EDGE_NO_LINE : u8 = 19;
+
+/// Column order by node kind code (module, const, fn, test, invariant, bench, use, opaque): the
+/// module, its imports, then constants, functions and what checks them, and opaque regions last.
+pub const VIEW_KIND_ORDER : [8]u8 = [0, 2, 3, 4, 5, 6, 1, 7];
+
+/// Geometry in pixels. A column is VIEW_COL_W wide and starts every VIEW_COL_STEP; a row starts
+/// every VIEW_ROW_STEP. The UNKNOWN band starts VIEW_BAND_GAP below the last known row.
+pub const VIEW_MARGIN : u32 = 40;
+pub const VIEW_COL_W : u32 = 220;
+pub const VIEW_COL_STEP : u32 = 260;
+pub const VIEW_ROW_STEP : u32 = 64;
+pub const VIEW_BAND_GAP : u32 = 48;
+
+/// Style by inference label (exact, derived, suggested, unknown). A guess and an unknown are
+/// narrower and lower than a fact and sit centred in the column (indent * 2 + width = VIEW_COL_W);
+/// only EXACT is drawn solid. Dash is the dash length in pixels, 0 for a solid line.
+pub const VIEW_LABEL_W : [4]u32 = [220, 220, 200, 200];
+pub const VIEW_LABEL_H : [4]u32 = [44, 44, 36, 36];
+pub const VIEW_LABEL_INDENT : [4]u32 = [0, 0, 10, 10];
+pub const VIEW_LABEL_FILL : [4]u32 = [0xDCEFE0, 0xDDE8F7, 0xFFF1D0, 0xECECEC];
+pub const VIEW_LABEL_STROKE : [4]u32 = [0x1B7F3B, 0x2459A8, 0xB7791F, 0x8A8A8A];
+pub const VIEW_LABEL_DASH : [4]u32 = [0, 6, 3, 2];
+
+/// Text and page colours, and the text size a host uses inside a box.
+pub const VIEW_TEXT : u32 = 0x1A1A1A;
+pub const VIEW_BACKDROP : u32 = 0xFFFFFF;
+pub const VIEW_FONT_PX : u32 = 13;
+
+/// Two edges between the same pair of nodes (uses and data_flow, calls and tested_by) would lie on
+/// one line; each edge kind is shifted by its own lane, VIEW_LANE_STEP * kind - VIEW_LANE_HALF.
+pub const VIEW_LANE_STEP : u32 = 4;
+pub const VIEW_LANE_HALF : u32 = 8;
+
+/// A label this file cannot read is drawn as UNKNOWN, never as a fact.
+pub fn view_is_unknown(label: u8) -> bool {
+    return label == LABEL_UNKNOWN or valid_label(label) == false;
+}
+
+/// The style row a label is drawn with.
+pub fn view_style(label: u8) -> u8 {
+    if (view_is_unknown(label)) { return LABEL_UNKNOWN; }
+    return label;
+}
+
+pub fn view_kind_present(g: SpecGraph, k: u8) -> bool {
+    var n : u32 = 0;
+    while (n < g.node_count) {
+        if (g.node_kind[n as usize] == k) { return true; }
+        n = n + 1;
+    }
+    return false;
+}
+
+/// The column of node kind k: how many kinds present come before it in VIEW_KIND_ORDER. A kind
+/// outside the vocabulary has no column.
+pub fn view_column(g: SpecGraph, k: u8) -> u32 {
+    if (k >= NODE_KINDS) { return NO_INDEX; }
+    var c : u32 = 0;
+    var kk : u32 = 0;
+    while (kk < (NODE_KINDS as u32)) {
+        if (view_kind_present(g, kk as u8) and VIEW_KIND_ORDER[kk as usize] < VIEW_KIND_ORDER[k as usize]) { c = c + 1; }
+        kk = kk + 1;
+    }
+    return c;
+}
+
+pub fn view_column_count(g: SpecGraph) -> u32 {
+    var c : u32 = 0;
+    var kk : u32 = 0;
+    while (kk < (NODE_KINDS as u32)) {
+        if (view_kind_present(g, kk as u8)) { c = c + 1; }
+        kk = kk + 1;
+    }
+    return c;
+}
+
+pub fn view_node_column(g: SpecGraph, n: u32) -> u32 {
+    return view_column(g, g.node_kind[n as usize]);
+}
+
+/// The row of node n inside its column. Known nodes are ordered by label (exact, derived,
+/// suggested), then by node number; UNKNOWN nodes are counted apart, by node number, in the band.
+pub fn view_row(g: SpecGraph, n: u32) -> u32 {
+    let k : usize = n as usize;
+    let ln : u8 = g.node_label[k];
+    let unk : bool = view_is_unknown(ln);
+    var r : u32 = 0;
+    var m : u32 = 0;
+    while (m < g.node_count) {
+        let q : usize = m as usize;
+        let lm : u8 = g.node_label[q];
+        if (m != n and g.node_kind[q] == g.node_kind[k] and view_is_unknown(lm) == unk) {
+            if (unk) {
+                if (m < n) { r = r + 1; }
+            } else {
+                if (lm < ln or (lm == ln and m < n)) { r = r + 1; }
+            }
+        }
+        m = m + 1;
+    }
+    return r;
+}
+
+/// The deepest column of known nodes, in rows.
+pub fn view_known_depth(g: SpecGraph) -> u32 {
+    var d : u32 = 0;
+    var n : u32 = 0;
+    while (n < g.node_count) {
+        if (view_is_unknown(g.node_label[n as usize]) == false) {
+            let r : u32 = view_row(g, n) + 1;
+            if (r > d) { d = r; }
+        }
+        n = n + 1;
+    }
+    return d;
+}
+
+/// The top of the UNKNOWN band.
+pub fn view_band_top(g: SpecGraph) -> u32 {
+    return VIEW_MARGIN + view_known_depth(g) * VIEW_ROW_STEP + VIEW_BAND_GAP;
+}
+
+pub fn view_node_x(g: SpecGraph, n: u32) -> u32 {
+    let s : u8 = view_style(g.node_label[n as usize]);
+    return VIEW_MARGIN + view_node_column(g, n) * VIEW_COL_STEP + VIEW_LABEL_INDENT[s as usize];
+}
+
+pub fn view_node_y(g: SpecGraph, n: u32) -> u32 {
+    if (view_is_unknown(g.node_label[n as usize])) { return view_band_top(g) + view_row(g, n) * VIEW_ROW_STEP; }
+    return VIEW_MARGIN + view_row(g, n) * VIEW_ROW_STEP;
+}
+
+pub fn view_node_w(g: SpecGraph, n: u32) -> u32 {
+    return VIEW_LABEL_W[view_style(g.node_label[n as usize]) as usize];
+}
+
+pub fn view_node_h(g: SpecGraph, n: u32) -> u32 {
+    return VIEW_LABEL_H[view_style(g.node_label[n as usize]) as usize];
+}
+
+pub fn view_node_fill(g: SpecGraph, n: u32) -> u32 {
+    return VIEW_LABEL_FILL[view_style(g.node_label[n as usize]) as usize];
+}
+
+pub fn view_node_stroke(g: SpecGraph, n: u32) -> u32 {
+    return VIEW_LABEL_STROKE[view_style(g.node_label[n as usize]) as usize];
+}
+
+pub fn view_node_dash(g: SpecGraph, n: u32) -> u32 {
+    return VIEW_LABEL_DASH[view_style(g.node_label[n as usize]) as usize];
+}
+
+/// The ui_plan widget of node n: spec_graph's binding, unchanged.
+pub fn view_node_widget(g: SpecGraph, n: u32) -> u8 {
+    let k : usize = n as usize;
+    return node_widget(g.node_kind[k], g.node_label[k]);
+}
+
+/// The canvas: every column, and the lowest box plus a margin.
+pub fn view_width(g: SpecGraph) -> u32 {
+    let c : u32 = view_column_count(g);
+    if (c == 0) { return 2 * VIEW_MARGIN; }
+    return 2 * VIEW_MARGIN + (c - 1) * VIEW_COL_STEP + VIEW_COL_W;
+}
+
+pub fn view_height(g: SpecGraph) -> u32 {
+    var bottom : u32 = VIEW_MARGIN;
+    var n : u32 = 0;
+    while (n < g.node_count) {
+        let b : u32 = view_node_y(g, n) + view_node_h(g, n);
+        if (b > bottom) { bottom = b; }
+        n = n + 1;
+    }
+    return bottom + VIEW_MARGIN;
+}
+
+/// The source line an edge points at: its own line, or for a tested_by edge with none, the line
+/// of the call it is read back from (spec_graph's DERIVED rule). NO_LINE when there is neither.
+pub fn view_edge_line(g: SpecGraph, j: u32) -> u32 {
+    let k : usize = j as usize;
+    if (g.edge_line[k] != NO_LINE) { return g.edge_line[k]; }
+    if (g.edge_kind[k] != EDGE_TESTED_BY) { return NO_LINE; }
+    var i : u32 = 0;
+    while (i < g.edge_count) {
+        let m : usize = i as usize;
+        if (g.edge_kind[m] == EDGE_CALLS and g.edge_from[m] == g.edge_to[k] and g.edge_to[m] == g.edge_from[k]) { return g.edge_line[m]; }
+        i = i + 1;
+    }
+    return NO_LINE;
+}
+
+/// VIEW_OK, or why the graph is not drawn: the validate_graph code, or VIEW_ERR_EDGE_NO_LINE.
+pub fn view_verdict(g: SpecGraph) -> u8 {
+    let v : u8 = validate_graph(g);
+    if (v != GRAPH_OK) { return v; }
+    var j : u32 = 0;
+    while (j < g.edge_count) {
+        if (view_edge_line(g, j) == NO_LINE) { return VIEW_ERR_EDGE_NO_LINE; }
+        j = j + 1;
+    }
+    return VIEW_OK;
+}
+
+/// Edge end points. A line leaves the side of the from-box that faces the to-box and enters the
+/// facing side of the to-box; inside one column both ends are on the right side.
+pub fn view_edge_x1(g: SpecGraph, j: u32) -> u32 {
+    let f : u32 = g.edge_from[j as usize] as u32;
+    let t : u32 = g.edge_to[j as usize] as u32;
+    if (view_node_column(g, f) > view_node_column(g, t)) { return view_node_x(g, f); }
+    return view_node_x(g, f) + view_node_w(g, f);
+}
+
+pub fn view_edge_x2(g: SpecGraph, j: u32) -> u32 {
+    let f : u32 = g.edge_from[j as usize] as u32;
+    let t : u32 = g.edge_to[j as usize] as u32;
+    if (view_node_column(g, f) < view_node_column(g, t)) { return view_node_x(g, t); }
+    return view_node_x(g, t) + view_node_w(g, t);
+}
+
+/// The vertical centre of node n, shifted to the lane of an edge of kind ek.
+pub fn view_lane_y(g: SpecGraph, n: u32, ek: u8) -> u32 {
+    return view_node_y(g, n) + view_node_h(g, n) / 2 + VIEW_LANE_STEP * (ek as u32) - VIEW_LANE_HALF;
+}
+
+pub fn view_edge_y1(g: SpecGraph, j: u32) -> u32 {
+    return view_lane_y(g, g.edge_from[j as usize] as u32, g.edge_kind[j as usize]);
+}
+
+pub fn view_edge_y2(g: SpecGraph, j: u32) -> u32 {
+    return view_lane_y(g, g.edge_to[j as usize] as u32, g.edge_kind[j as usize]);
+}
+
+pub fn view_edge_stroke(g: SpecGraph, j: u32) -> u32 {
+    return VIEW_LABEL_STROKE[view_style(g.edge_label[j as usize]) as usize];
+}
+
+pub fn view_edge_dash(g: SpecGraph, j: u32) -> u32 {
+    return VIEW_LABEL_DASH[view_style(g.edge_label[j as usize]) as usize];
+}
+
+/// Boxes a and b share at least one pixel.
+pub fn view_overlap(g: SpecGraph, a: u32, b: u32) -> bool {
+    let ax : u32 = view_node_x(g, a);
+    let ay : u32 = view_node_y(g, a);
+    let bx : u32 = view_node_x(g, b);
+    let by : u32 = view_node_y(g, b);
+    return ax < bx + view_node_w(g, b) and bx < ax + view_node_w(g, a) and ay < by + view_node_h(g, b) and by < ay + view_node_h(g, a);
+}
+
+pub fn view_overlap_count(g: SpecGraph) -> u32 {
+    var c : u32 = 0;
+    var a : u32 = 0;
+    while (a < g.node_count) {
+        var b : u32 = a + 1;
+        while (b < g.node_count) {
+            if (view_overlap(g, a, b)) { c = c + 1; }
+            b = b + 1;
+        }
+        a = a + 1;
+    }
+    return c;
+}
+
+/// The point (x, y) lies on or inside the box of node n.
+pub fn view_point_in(g: SpecGraph, n: u32, x: u32, y: u32) -> bool {
+    let nx : u32 = view_node_x(g, n);
+    let ny : u32 = view_node_y(g, n);
+    return nx <= x and x <= nx + view_node_w(g, n) and ny <= y and y <= ny + view_node_h(g, n);
+}
+
+/// Edge ends that land on node n's box, counting both ends of every edge.
+pub fn view_ends_on(g: SpecGraph, n: u32) -> u32 {
+    var c : u32 = 0;
+    var j : u32 = 0;
+    while (j < g.edge_count) {
+        if (view_point_in(g, n, view_edge_x1(g, j), view_edge_y1(g, j))) { c = c + 1; }
+        if (view_point_in(g, n, view_edge_x2(g, j), view_edge_y2(g, j))) { c = c + 1; }
+        j = j + 1;
+    }
+    return c;
+}
+
+/// Every edge end lands on the box of its own endpoint.
+pub fn view_edges_attach(g: SpecGraph) -> bool {
+    var j : u32 = 0;
+    while (j < g.edge_count) {
+        let f : u32 = g.edge_from[j as usize] as u32;
+        let t : u32 = g.edge_to[j as usize] as u32;
+        if (view_point_in(g, f, view_edge_x1(g, j), view_edge_y1(g, j)) == false) { return false; }
+        if (view_point_in(g, t, view_edge_x2(g, j), view_edge_y2(g, j)) == false) { return false; }
+        j = j + 1;
+    }
+    return true;
+}
+
+/// The lowest edge of every known box, plus VIEW_BAND_GAP, is above node n.
+pub fn view_alone_below(g: SpecGraph, n: u32) -> bool {
+    let y : u32 = view_node_y(g, n);
+    var m : u32 = 0;
+    while (m < g.node_count) {
+        if (view_is_unknown(g.node_label[m as usize]) == false) {
+            if (view_node_y(g, m) + view_node_h(g, m) + VIEW_BAND_GAP > y) { return false; }
+        }
+        m = m + 1;
+    }
+    return true;
+}
+
+/// --- host entry points ---
+
+/// A wasm export carries scalars only, so these name a fixture instead of taking a graph: 0 is
+/// spec_graph's tutorial_08_graph, 1 the same graph with its suggestion; any other number is the
+/// blank graph, which the view refuses. An index past the graph returns 0.
+pub fn view_fx(which: u32) -> SpecGraph {
+    if (which == 0) { return tutorial_08_graph(); }
+    if (which == 1) { return with_suggestion(); }
+    return blank_graph();
+}
+
+pub fn fx_verdict(which: u32) -> u8 {
+    return view_verdict(view_fx(which));
+}
+
+pub fn fx_node_count(which: u32) -> u32 {
+    return view_fx(which).node_count;
+}
+
+pub fn fx_edge_count(which: u32) -> u32 {
+    return view_fx(which).edge_count;
+}
+
+pub fn fx_width(which: u32) -> u32 {
+    return view_width(view_fx(which));
+}
+
+pub fn fx_height(which: u32) -> u32 {
+    return view_height(view_fx(which));
+}
+
+pub fn fx_node_kind(which: u32, n: u32) -> u8 {
+    let g : SpecGraph = view_fx(which);
+    if (n >= g.node_count) { return 0; }
+    return g.node_kind[n as usize];
+}
+
+pub fn fx_node_label(which: u32, n: u32) -> u8 {
+    let g : SpecGraph = view_fx(which);
+    if (n >= g.node_count) { return 0; }
+    return g.node_label[n as usize];
+}
+
+pub fn fx_node_line_start(which: u32, n: u32) -> u32 {
+    let g : SpecGraph = view_fx(which);
+    if (n >= g.node_count) { return 0; }
+    return g.line_start[n as usize];
+}
+
+pub fn fx_node_line_end(which: u32, n: u32) -> u32 {
+    let g : SpecGraph = view_fx(which);
+    if (n >= g.node_count) { return 0; }
+    return g.line_end[n as usize];
+}
+
+pub fn fx_node_x(which: u32, n: u32) -> u32 {
+    let g : SpecGraph = view_fx(which);
+    if (n >= g.node_count) { return 0; }
+    return view_node_x(g, n);
+}
+
+pub fn fx_node_y(which: u32, n: u32) -> u32 {
+    let g : SpecGraph = view_fx(which);
+    if (n >= g.node_count) { return 0; }
+    return view_node_y(g, n);
+}
+
+pub fn fx_node_w(which: u32, n: u32) -> u32 {
+    let g : SpecGraph = view_fx(which);
+    if (n >= g.node_count) { return 0; }
+    return view_node_w(g, n);
+}
+
+pub fn fx_node_h(which: u32, n: u32) -> u32 {
+    let g : SpecGraph = view_fx(which);
+    if (n >= g.node_count) { return 0; }
+    return view_node_h(g, n);
+}
+
+pub fn fx_node_fill(which: u32, n: u32) -> u32 {
+    let g : SpecGraph = view_fx(which);
+    if (n >= g.node_count) { return 0; }
+    return view_node_fill(g, n);
+}
+
+pub fn fx_node_stroke(which: u32, n: u32) -> u32 {
+    let g : SpecGraph = view_fx(which);
+    if (n >= g.node_count) { return 0; }
+    return view_node_stroke(g, n);
+}
+
+pub fn fx_node_dash(which: u32, n: u32) -> u32 {
+    let g : SpecGraph = view_fx(which);
+    if (n >= g.node_count) { return 0; }
+    return view_node_dash(g, n);
+}
+
+pub fn fx_node_widget(which: u32, n: u32) -> u8 {
+    let g : SpecGraph = view_fx(which);
+    if (n >= g.node_count) { return 0; }
+    return view_node_widget(g, n);
+}
+
+pub fn fx_edge_kind(which: u32, j: u32) -> u8 {
+    let g : SpecGraph = view_fx(which);
+    if (j >= g.edge_count) { return 0; }
+    return g.edge_kind[j as usize];
+}
+
+pub fn fx_edge_label(which: u32, j: u32) -> u8 {
+    let g : SpecGraph = view_fx(which);
+    if (j >= g.edge_count) { return 0; }
+    return g.edge_label[j as usize];
+}
+
+pub fn fx_edge_line(which: u32, j: u32) -> u32 {
+    let g : SpecGraph = view_fx(which);
+    if (j >= g.edge_count) { return 0; }
+    return view_edge_line(g, j);
+}
+
+pub fn fx_edge_x1(which: u32, j: u32) -> u32 {
+    let g : SpecGraph = view_fx(which);
+    if (j >= g.edge_count) { return 0; }
+    return view_edge_x1(g, j);
+}
+
+pub fn fx_edge_y1(which: u32, j: u32) -> u32 {
+    let g : SpecGraph = view_fx(which);
+    if (j >= g.edge_count) { return 0; }
+    return view_edge_y1(g, j);
+}
+
+pub fn fx_edge_x2(which: u32, j: u32) -> u32 {
+    let g : SpecGraph = view_fx(which);
+    if (j >= g.edge_count) { return 0; }
+    return view_edge_x2(g, j);
+}
+
+pub fn fx_edge_y2(which: u32, j: u32) -> u32 {
+    let g : SpecGraph = view_fx(which);
+    if (j >= g.edge_count) { return 0; }
+    return view_edge_y2(g, j);
+}
+
+pub fn fx_edge_stroke(which: u32, j: u32) -> u32 {
+    let g : SpecGraph = view_fx(which);
+    if (j >= g.edge_count) { return 0; }
+    return view_edge_stroke(g, j);
+}
+
+pub fn fx_edge_dash(which: u32, j: u32) -> u32 {
+    let g : SpecGraph = view_fx(which);
+    if (j >= g.edge_count) { return 0; }
+    return view_edge_dash(g, j);
+}
+
+/// --- tests ---
+
+test fixture_is_drawn {
+    let g : SpecGraph = tutorial_08_graph();
+    assert view_verdict(g) == VIEW_OK;
+    // seven kinds are present (no bench), so seven columns
+    assert view_column_count(g) == 7;
+    assert view_width(g) == 1860;
+    assert view_height(g) == 484;
+    assert view_known_depth(g) == 5;
+    // module (node 0), the first const (node 2), power_of_two (node 8), the invariant (node 13)
+    assert view_node_x(g, 0) == 40;
+    assert view_node_y(g, 0) == 40;
+    assert view_node_x(g, 2) == 560;
+    assert view_node_x(g, 8) == 820;
+    assert view_node_y(g, 8) == 104;
+    assert view_node_x(g, 13) == 1340;
+    assert view_node_w(g, 8) == 220;
+    assert view_node_h(g, 8) == 44;
+    // the last const is the deepest known box
+    assert view_node_y(g, 7) == 296;
+    assert view_overlap_count(g) == 0;
+    assert view_edges_attach(g);
+}
+
+test one_column_per_kind {
+    let g : SpecGraph = tutorial_08_graph();
+    assert view_column(g, NODE_MODULE) == 0;
+    assert view_column(g, NODE_USE) == 1;
+    assert view_column(g, NODE_CONST) == 2;
+    assert view_column(g, NODE_FN) == 3;
+    assert view_column(g, NODE_TEST) == 4;
+    assert view_column(g, NODE_INVARIANT) == 5;
+    assert view_column(g, NODE_OPAQUE) == 6;
+    assert view_kind_present(g, NODE_BENCH) == false;
+    assert view_column(g, NODE_KINDS) == NO_INDEX;
+    // nodes share a column exactly when they share a kind
+    var same : u32 = 0;
+    var a : u32 = 0;
+    while (a < g.node_count) {
+        var b : u32 = 0;
+        while (b < g.node_count) {
+            let sk : bool = g.node_kind[a as usize] == g.node_kind[b as usize];
+            let sc : bool = view_node_column(g, a) == view_node_column(g, b);
+            if (sk == sc) { same = same + 1; }
+            b = b + 1;
+        }
+        a = a + 1;
+    }
+    assert same == 225;
+}
+
+test label_sets_size_colour_and_order {
+    // the suggestion (node 15) is an opaque region: same column as std.testing, drawn as a guess
+    let s : SpecGraph = with_suggestion();
+    assert view_verdict(s) == VIEW_OK;
+    assert view_node_x(s, 15) == 1610;
+    assert view_node_y(s, 15) == 40;
+    assert view_node_w(s, 15) == 200;
+    assert view_node_h(s, 15) == 36;
+    assert view_node_fill(s, 15) == 0xFFF1D0;
+    assert view_node_dash(s, 15) == 3;
+    assert view_overlap_count(s) == 0;
+    // its edge is a guess too, and points at line 67
+    assert view_edge_stroke(s, 16) == VIEW_LABEL_STROKE[LABEL_SUGGESTED as usize];
+    assert view_edge_line(s, 16) == 67;
+    assert view_edge_x1(s, 16) == 780;
+    assert view_edge_y1(s, 16) == 262;
+    assert view_edge_x2(s, 16) == 1610;
+    assert view_edge_y2(s, 16) == 66;
+    // a derived const moves below the exact ones of its column and changes style
+    var d : SpecGraph = tutorial_08_graph();
+    d.node_label[5] = LABEL_DERIVED;
+    assert view_verdict(d) == VIEW_OK;
+    assert view_node_y(d, 5) == 296;
+    assert view_node_y(d, 6) == 168;
+    assert view_node_fill(d, 5) == 0xDDE8F7;
+    assert view_node_dash(d, 5) == 6;
+    // the name moves nothing: the layout reads kind, label and node number only
+    var r : SpecGraph = tutorial_08_graph();
+    r.node_name[4] = "renamed";
+    assert view_node_x(r, 4) == 820;
+    assert view_node_y(r, 4) == 40;
+}
+
+test unknown_node_is_drawn_alone {
+    let g : SpecGraph = tutorial_08_graph();
+    // std.testing (node 14): in its kind's column, in the band below every known box
+    assert view_node_x(g, 14) == 1610;
+    assert view_band_top(g) == 408;
+    assert view_node_y(g, 14) == 408;
+    assert view_node_fill(g, 14) == 0xECECEC;
+    assert view_node_widget(g, 14) == WIDGET_TEXT_BLOCK;
+    assert view_alone_below(g, 14);
+    // no edge end lands on it, while power_of_two (node 8) takes four
+    assert view_ends_on(g, 14) == 0;
+    assert view_ends_on(g, 8) == 4;
+    // relabelled DERIVED it is no longer unknown, so it leaves the band and the canvas shrinks
+    var d : SpecGraph = tutorial_08_graph();
+    d.node_label[14] = LABEL_DERIVED;
+    assert view_verdict(d) == VIEW_OK;
+    assert view_node_y(d, 14) == 40;
+    assert view_alone_below(d, 14) == false;
+    assert view_height(d) == 380;
+    // a label this file cannot read is drawn unknown
+    assert view_style(LABEL_KINDS) == LABEL_UNKNOWN;
+    assert view_is_unknown(LABEL_SUGGESTED) == false;
+}
+
+test every_edge_points_at_a_source_line {
+    let g : SpecGraph = tutorial_08_graph();
+    var lined : u32 = 0;
+    var j : u32 = 0;
+    while (j < g.edge_count) {
+        let l : u32 = view_edge_line(g, j);
+        if (l != NO_LINE and l <= g.line_count) { lined = lined + 1; }
+        j = j + 1;
+    }
+    assert lined == 16;
+    // the uses edge of the `use` statement
+    assert view_edge_line(g, 0) == 22;
+    assert view_edge_x1(g, 0) == 260;
+    assert view_edge_y1(g, 0) == 58;
+    assert view_edge_x2(g, 0) == 300;
+    // tested_by power_of_two -> its test has no line of its own: it points at the call, line 79
+    assert g.edge_line[12] == NO_LINE;
+    assert view_edge_line(g, 12) == 79;
+    assert view_edge_line(g, 14) == 89;
+    assert view_edge_dash(g, 12) == 6;
+    // the call and the tested_by between the same two nodes are drawn on different lanes
+    assert view_edge_y2(g, 9) == 118;
+    assert view_edge_y1(g, 12) == 126;
+    // constrains runs right to left: the invariant's left side to the const's right side
+    assert view_edge_x1(g, 15) == 1340;
+    assert view_edge_x2(g, 15) == 780;
+}
+
+test refused_graphs_are_not_drawn {
+    let g : SpecGraph = tutorial_08_graph();
+    // negative control: an edge into the unknown node is refused with spec_graph's own code
+    assert view_verdict(with_edge(g, EDGE_DATA_FLOW, 14, 10, LABEL_DERIVED, 79)) == ERR_EDGE_UNKNOWN_NODE;
+    // negative control: a tested_by edge with no call behind it passes validate_graph, but has no
+    // line to point at, so the view refuses it
+    let x : SpecGraph = with_edge(g, EDGE_TESTED_BY, 9, 10, LABEL_DERIVED, NO_LINE);
+    assert validate_graph(x) == GRAPH_OK;
+    assert view_edge_line(x, 16) == NO_LINE;
+    assert view_verdict(x) == VIEW_ERR_EDGE_NO_LINE;
+    assert view_verdict(blank_graph()) == ERR_SPEC_PATH;
+}
+
+test a_graph_at_node_capacity_is_drawn_in_a_tall_canvas {
+    let base : SpecGraph = tutorial_08_graph();
+    var g : SpecGraph = base;
+    while (g.node_count < MAX_NODES) {
+        g = with_node(g, NODE_CONST, LABEL_EXACT, "extra", 1, 1);
+    }
+    assert g.node_count == MAX_NODES;
+    assert view_verdict(g) == VIEW_OK;
+    // one column per kind is unchanged by more nodes of a kind already present
+    assert view_column_count(g) == view_column_count(base);
+    assert view_width(g) == view_width(base);
+    // the const column holds at least 177 more rows, so the canvas grows in height only
+    assert view_known_depth(g) >= 177;
+    assert view_height(g) > 11000;
+    assert view_height(g) > view_height(base);
+    // the last two extra nodes share a column on different rows: boxes do not overlap
+    let last : u32 = MAX_NODES - 1;
+    assert view_node_column(g, last) == view_node_column(g, last - 1);
+    assert view_node_y(g, last) == view_node_y(g, last - 1) + VIEW_ROW_STEP;
+    assert view_overlap(g, last, last - 1) == false;
+    // negative control: the same node drawn on top of itself overlaps
+    assert view_overlap(g, last, last);
+}
+
+test nodes_bind_through_spec_graph {
+    let g : SpecGraph = tutorial_08_graph();
+    assert view_node_widget(g, 0) == WIDGET_HONEYCOMB_CARD;
+    assert view_node_widget(g, 8) == WIDGET_FORMULA_VIEW;
+    assert view_node_widget(g, 10) == WIDGET_RUN_BUTTON;
+    var same : u32 = 0;
+    var n : u32 = 0;
+    while (n < g.node_count) {
+        if (view_node_widget(g, n) == node_widget(g.node_kind[n as usize], g.node_label[n as usize])) { same = same + 1; }
+        n = n + 1;
+    }
+    assert same == 15;
+    assert view_node_widget(with_suggestion(), 15) == WIDGET_TEXT_BLOCK;
+}
+
+test host_entry_points_match_the_layout {
+    let g : SpecGraph = tutorial_08_graph();
+    assert fx_verdict(0) == VIEW_OK;
+    assert fx_verdict(1) == VIEW_OK;
+    assert fx_verdict(2) == ERR_SPEC_PATH;
+    assert fx_node_count(0) == 15;
+    assert fx_node_count(1) == 16;
+    assert fx_edge_count(1) == 17;
+    assert fx_width(0) == view_width(g);
+    assert fx_height(0) == view_height(g);
+    assert fx_node_x(0, 14) == 1610;
+    assert fx_node_y(0, 14) == 408;
+    assert fx_node_label(0, 14) == LABEL_UNKNOWN;
+    assert fx_node_kind(0, 14) == NODE_OPAQUE;
+    assert fx_node_line_start(0, 8) == 66;
+    assert fx_node_line_end(0, 8) == 68;
+    assert fx_node_widget(0, 8) == WIDGET_FORMULA_VIEW;
+    assert fx_node_fill(1, 15) == 0xFFF1D0;
+    assert fx_node_stroke(0, 0) == 0x1B7F3B;
+    assert fx_node_dash(0, 0) == 0;
+    assert fx_node_w(0, 14) == 200;
+    assert fx_node_h(0, 0) == 44;
+    assert fx_edge_line(0, 12) == 79;
+    assert fx_edge_kind(0, 12) == EDGE_TESTED_BY;
+    assert fx_edge_label(0, 12) == LABEL_DERIVED;
+    assert fx_edge_x1(0, 15) == 1340;
+    assert fx_edge_y1(0, 0) == 58;
+    assert fx_edge_x2(0, 0) == 300;
+    assert fx_edge_y2(1, 16) == 66;
+    assert fx_edge_stroke(0, 12) == 0x2459A8;
+    assert fx_edge_dash(1, 16) == 3;
+    // past the graph, a host gets 0, not a neighbour's numbers
+    assert fx_node_x(0, 15) == 0;
+    assert fx_edge_x1(0, 16) == 0;
+}
+
+invariant label_styles_are_distinct_and_centred {
+    var l : u32 = 0;
+    while (l < (LABEL_KINDS as u32)) {
+        let k : usize = l as usize;
+        assert VIEW_LABEL_INDENT[k] * 2 + VIEW_LABEL_W[k] == VIEW_COL_W;
+        assert VIEW_LABEL_H[k] < VIEW_ROW_STEP;
+        var m : u32 = l + 1;
+        while (m < (LABEL_KINDS as u32)) {
+            assert VIEW_LABEL_FILL[k] != VIEW_LABEL_FILL[m as usize];
+            assert VIEW_LABEL_STROKE[k] != VIEW_LABEL_STROKE[m as usize];
+            assert VIEW_LABEL_DASH[k] != VIEW_LABEL_DASH[m as usize];
+            m = m + 1;
+        }
+        l = l + 1;
+    }
+    // only a fact is drawn solid, and a guess is never larger than a fact
+    assert VIEW_LABEL_DASH[LABEL_EXACT as usize] == 0;
+    assert VIEW_LABEL_W[LABEL_SUGGESTED as usize] < VIEW_LABEL_W[LABEL_EXACT as usize];
+    assert VIEW_LABEL_W[LABEL_UNKNOWN as usize] < VIEW_LABEL_W[LABEL_DERIVED as usize];
+}
+
+invariant kind_order_is_a_permutation {
+    var seen : u32 = 0;
+    var k : u32 = 0;
+    while (k < (NODE_KINDS as u32)) {
+        seen = seen | ((1 as u32) << (VIEW_KIND_ORDER[k as usize] as u32));
+        k = k + 1;
+    }
+    assert seen == 255;
+    assert VIEW_COL_W < VIEW_COL_STEP;
+}
+
+invariant view_codes_follow_spec_graph {
+    assert VIEW_OK == GRAPH_OK;
+    assert VIEW_ERR_EDGE_NO_LINE == VERDICT_KINDS;
+    // the lowest lane stays inside the shortest box, the highest too
+    assert VIEW_LANE_HALF < VIEW_LABEL_H[LABEL_UNKNOWN as usize] / 2;
+    assert VIEW_LANE_STEP * ((EDGE_KINDS as u32) - 1) - VIEW_LANE_HALF < VIEW_LABEL_H[LABEL_UNKNOWN as usize] / 2;
+}
+
+invariant the_fixtures_are_drawn {
+    assert view_verdict(tutorial_08_graph()) == VIEW_OK;
+    assert view_verdict(with_suggestion()) == VIEW_OK;
+}
diff --git a/apps/website/public/t27f/graph/specs/topic_reel.t27 b/apps/website/public/t27f/graph/specs/topic_reel.t27
new file mode 100644
index 0000000000..a5b074dab9
--- /dev/null
+++ b/apps/website/public/t27f/graph/specs/topic_reel.t27
@@ -0,0 +1,241 @@
+// SPDX-License-Identifier: Apache-2.0
+; specs/t27f/topic_reel.t27 -- the one workflow every T27F topic reel goes through.
+; gHashTag/trinity#1677 asks that two very different domains use the same widget and workflow
+; "without duplicated orchestration code". A topic reel (reel_t27_basics.t27, reel_gf16_nmse.t27)
+; is data: a brief, 27 cells with their measurements, and the slide text. Everything a reel decides
+; or checks with that data lives here, once:
+;   - the domain is route_brief of the brief's own text (topic_engine.t27, KEYWORD_MATCH);
+;   - every cell's STATUS is earned_status of its four measurements (statuses_earned);
+;   - a gap is a cell with no source, and it names what is missing (gaps_are_named);
+;   - every slide's text fits every preset as the host breaks it (slides_fit, stage_slides_bare).
+; A reel calls these from its tests and keeps only the checks that are about its own topic.
+; Before 2026-10-17 the first reel carried its own copy of the counting and slide-fit functions; a
+; second reel would have copied them again, which is the duplication #1677 rules out.
+; phi^2 + 1/phi^2 = 3 | TRINITY
+
+module topic_reel;
+
+use t27f::reel::CELL_COUNT;
+use t27f::reel::DEMO_COUNT;
+use t27f::reel::DEMO_KIND;
+use t27f::reel::PRESET_COUNT;
+use t27f::deck::LAYOUT_SPLIT;
+use t27f::deck::LAYOUT_STAGE;
+use t27f::deck::REGION_TITLE;
+use t27f::deck::HEADLINE_PX;
+use t27f::deck::BODY_PX;
+use t27f::deck::HEADLINE_EM_PERMILLE;
+use t27f::deck::BODY_EM_PERMILLE;
+use t27f::deck::MAX_ROWS;
+use t27f::deck::layout_for;
+use t27f::deck::text_fits;
+use t27f::deck::chars_per_line;
+use t27f::deck::card_inner_w;
+use t27f::deck::region_w;
+use t27f::topic_engine::STATUS_GAP;
+use t27f::topic_engine::STATUS_DRAFT;
+use t27f::topic_engine::STATUS_VERIFIED;
+use t27f::topic_engine::DOMAIN_RESEARCH;
+use t27f::topic_engine::earned_status;
+
+/// Slide rows per demo scene: a reel's ROWS holds DEMO_COUNT * ROWS_PER_SCENE entries, scene-major.
+pub const ROWS_PER_SCENE : i32 = 4;
+
+pub fn count_status(status: [27]u8, s: u8) -> i32 {
+    var n : i32 = 0;
+    var c : i32 = 0;
+    while (c < CELL_COUNT) {
+        if (status[@intCast(c)] == s) {
+            n = n + 1;
+        }
+        c = c + 1;
+    }
+    return n;
+}
+
+pub fn count_true(xs: [27]bool) -> i32 {
+    var n : i32 = 0;
+    var c : i32 = 0;
+    while (c < CELL_COUNT) {
+        if (xs[@intCast(c)]) {
+            n = n + 1;
+        }
+        c = c + 1;
+    }
+    return n;
+}
+
+/// The first cell whose drawn status is not the one the engine says its measurements earned, or -1.
+pub fn first_unearned(status: [27]u8, domain: u8, grounded: [27]bool, test_pass: [27]bool, reviewed: [27]bool, live: [27]bool) -> i32 {
+    var c : i32 = 0;
+    while (c < CELL_COUNT) {
+        const i : usize = @intCast(c);
+        if (status[i] != earned_status(@intCast(c), domain, grounded[i], test_pass[i], reviewed[i], live[i])) {
+            return c;
+        }
+        c = c + 1;
+    }
+    return -1;
+}
+
+pub fn statuses_earned(status: [27]u8, domain: u8, grounded: [27]bool, test_pass: [27]bool, reviewed: [27]bool, live: [27]bool) -> bool {
+    return first_unearned(status, domain, grounded, test_pass, reviewed, live) == -1;
+}
+
+/// A gap is named, not blank: a cell is grounded exactly when it has a source, and a cell with no
+/// source says what is missing instead.
+pub fn gaps_are_named(sources: [27]str, missing: [27]str, grounded: [27]bool) -> bool {
+    var c : i32 = 0;
+    while (c < CELL_COUNT) {
+        const i : usize = @intCast(c);
+        const has_source : bool = sources[i].len > 0;
+        const has_missing : bool = missing[i].len > 0;
+        if (grounded[i] != has_source) {
+            return false;
+        }
+        if (has_missing == has_source) {
+            return false;
+        }
+        c = c + 1;
+    }
+    return true;
+}
+
+pub fn row_count(rows: [20]str, scene: i32) -> i32 {
+    var n : i32 = 0;
+    var j : i32 = 0;
+    while (j < MAX_ROWS) {
+        if (rows[@intCast(scene * ROWS_PER_SCENE + j)].len > 0) {
+            n = n + 1;
+        }
+        j = j + 1;
+    }
+    return n;
+}
+
+/// Characters a headline line may hold on this scene's slide, as the host breaks it.
+pub fn head_chars(layout: u8, preset: u8) -> i32 {
+    if (layout == LAYOUT_SPLIT) {
+        return chars_per_line(card_inner_w(preset), HEADLINE_PX[preset], HEADLINE_EM_PERMILLE);
+    }
+    return chars_per_line(region_w(layout, preset, REGION_TITLE), HEADLINE_PX[preset], HEADLINE_EM_PERMILLE);
+}
+
+pub fn row_chars(preset: u8) -> i32 {
+    return chars_per_line(card_inner_w(preset), BODY_PX[preset], BODY_EM_PERMILLE);
+}
+
+/// Every demo slide fits every preset: one headline line the host never breaks, and card rows it
+/// never breaks either. A headline must be one line because the host wraps a title greedily by
+/// words, and only a one-line headline is drawn the same on every preset.
+pub fn slides_fit(head: [5]str, rows: [20]str) -> bool {
+    var s : i32 = 0;
+    while (s < DEMO_COUNT) {
+        const layout : u8 = layout_for(DEMO_KIND[@intCast(s)]);
+        if (head[@intCast(s)].len == 0) {
+            return false;
+        }
+        var p : u8 = 0;
+        while (p < PRESET_COUNT) {
+            if (text_fits(1, row_count(rows, s), layout, p) == false) {
+                return false;
+            }
+            const head_len : i32 = @intCast(head[@intCast(s)].len);
+            if (head_len > head_chars(layout, p)) {
+                return false;
+            }
+            var j : i32 = 0;
+            while (j < MAX_ROWS) {
+                const row_len : i32 = @intCast(rows[@intCast(s * ROWS_PER_SCENE + j)].len);
+                if (row_len > row_chars(p)) {
+                    return false;
+                }
+                j = j + 1;
+            }
+            p = p + 1;
+        }
+        s = s + 1;
+    }
+    return true;
+}
+
+/// A stage slide (title or overview) carries its headline on the strip and no card rows.
+pub fn stage_slides_bare(rows: [20]str) -> bool {
+    var s : i32 = 0;
+    while (s < DEMO_COUNT) {
+        if (layout_for(DEMO_KIND[@intCast(s)]) == LAYOUT_STAGE and row_count(rows, s) > 0) {
+            return false;
+        }
+        s = s + 1;
+    }
+    return true;
+}
+
+/// Fixture: a research map with every cell grounded and nothing else measured. LEARN steps have
+/// their source link and are VERIFIED; PRACTICE and DELIVER ask for a test or a review and stay DRAFT.
+pub const FIX_STATUS : [27]u8 = [4, 4, 4, 3, 3, 3, 3, 3, 3, 4, 4, 4, 3, 3, 3, 3, 3, 3, 4, 4, 4, 3, 3, 3, 3, 3, 3];
+pub const ALL : [27]bool = [true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true];
+pub const NONE : [27]bool = [false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false, false];
+pub const FIX_HEAD : [5]str = ["Title", "Lens", "Focus", "Evidence", "Next"];
+pub const FIX_ROWS : [20]str = ["", "", "", "", "", "", "", "", "a row", "", "", "", "a row", "a row", "", "", "a row", "", "", ""];
+pub const FIX_LONG : [20]str = ["", "", "", "", "", "", "", "", "a row far too long to sit on one line of the card on any preset at all", "", "", "", "", "", "", "", "", "", "", ""];
+pub const FIX_STAGE_ROW : [20]str = ["a row on the title strip", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", ""];
+
+test counts_are_counts {
+    assert count_true(ALL) == 27;
+    assert count_true(NONE) == 0;
+    assert count_status(FIX_STATUS, STATUS_VERIFIED) == 9;
+    assert count_status(FIX_STATUS, STATUS_DRAFT) == 18;
+    assert count_status(FIX_STATUS, STATUS_GAP) == 0;
+}
+
+test a_drawn_status_must_be_the_earned_one {
+    assert statuses_earned(FIX_STATUS, DOMAIN_RESEARCH, ALL, NONE, NONE, NONE);
+    // one cell drawn better than its measurements: caught, and at that cell
+    var wrong : [27]u8 = FIX_STATUS;
+    wrong[3] = STATUS_VERIFIED;
+    assert statuses_earned(wrong, DOMAIN_RESEARCH, ALL, NONE, NONE, NONE) == false;
+    assert first_unearned(wrong, DOMAIN_RESEARCH, ALL, NONE, NONE, NONE) == 3;
+    // the same drawing is right once a test passes for every cell: PRACTICE turns VERIFIED too
+    assert first_unearned(FIX_STATUS, DOMAIN_RESEARCH, ALL, ALL, NONE, NONE) == 3;
+    // no source anywhere: every cell is a gap, so the fixture is wrong from cell 0
+    assert first_unearned(FIX_STATUS, DOMAIN_RESEARCH, NONE, NONE, NONE, NONE) == 0;
+}
+
+test a_gap_names_what_is_missing {
+    var sources : [27]str = ["s", "s", "s", "s", "s", "s", "s", "s", "s", "s", "s", "s", "s", "s", "s", "s", "s", "s", "s", "s", "s", "s", "s", "s", "s", "s", "s"];
+    var missing : [27]str = ["", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", "", ""];
+    assert gaps_are_named(sources, missing, ALL);
+    var grounded : [27]bool = ALL;
+    // a gap with nothing said about it is refused
+    sources[5] = "";
+    grounded[5] = false;
+    assert gaps_are_named(sources, missing, grounded) == false;
+    missing[5] = "the run that would ground it";
+    assert gaps_are_named(sources, missing, grounded);
+    // a grounded cell may not also claim to be missing something, nor a sourceless one be grounded
+    missing[6] = "x";
+    assert gaps_are_named(sources, missing, grounded) == false;
+    missing[6] = "";
+    assert gaps_are_named(sources, missing, ALL) == false;
+}
+
+test slide_text_fits_or_is_refused {
+    assert row_count(FIX_ROWS, 2) == 1;
+    assert row_count(FIX_ROWS, 3) == 2;
+    assert slides_fit(FIX_HEAD, FIX_ROWS);
+    assert slides_fit(FIX_HEAD, FIX_LONG) == false;
+    var long_head : [5]str = FIX_HEAD;
+    long_head[0] = "A headline much too long to stay on one line of the title strip";
+    assert slides_fit(long_head, FIX_ROWS) == false;
+    var no_head : [5]str = FIX_HEAD;
+    no_head[4] = "";
+    assert slides_fit(no_head, FIX_ROWS) == false;
+}
+
+test stage_slides_carry_no_card_text {
+    // why a headline is one line: on the wide frame a second stage line would not fit the strip
+    assert text_fits(2, 0, LAYOUT_STAGE, 0) == false;
+    assert stage_slides_bare(FIX_ROWS);
+    assert stage_slides_bare(FIX_STAGE_ROW) == false;
+}
diff --git a/apps/website/public/t27f/graph/specs/ui_plan.t27 b/apps/website/public/t27f/graph/specs/ui_plan.t27
new file mode 100644
index 0000000000..14c1f4566c
--- /dev/null
+++ b/apps/website/public/t27f/graph/specs/ui_plan.t27
@@ -0,0 +1,638 @@
+// SPDX-License-Identifier: Apache-2.0
+; specs/t27f/ui_plan.t27 -- the T27F UI plan: a renderer-neutral IR and the trusted widget catalog
+; it may name (gHashTag/trinity#1648, MVP gHashTag/trinity#1652, tracked in gHashTag/t27#9962).
+; The T27F path is intent -> versioned system description -> solver -> UI plan (this file) ->
+; trusted renderer -> verification loop. A plan is data: widget ids from an allowlist, prop and
+; action ids, data bindings, a grid layout, a theme, accessibility labels and provenance. No field
+; of a plan holds code, markup or a script, so a renderer never evaluates anything a model wrote.
+; Labels, titles and source refs are plain text, drawn as text.
+; What this file decides, deterministically and without a language model:
+;   - the catalog: which widgets exist, which props and actions each accepts, which capabilities
+;     each needs, and which data source kind each binds to;
+;   - validation: validate_plan() returns PLAN_OK or the first rule a plan breaks, and
+;     first_bad_slot() names the widget that broke it;
+;   - that a plan proposed by a model (SOLVER_MODEL) is judged by exactly the same rules as one
+;     built by rules (SOLVER_RULES).
+; Not claimed here: no renderer draws a plan yet (React is the first target), nothing streams, no
+; solver turns an intent into a plan, and nothing is measured against other generative-UI stacks.
+; phi^2 + 1/phi^2 = 3 | TRINITY
+
+module t27f_ui_plan;
+
+/// Versions. A plan names the IR and catalog it was solved against; any other version is refused.
+pub const IR_VERSION : u32 = 1;
+pub const CATALOG_VERSION : u32 = 1;
+
+/// The widget catalog, an allowlist. Id 0 is an empty slot; 1..WIDGET_KINDS-1 are the trusted
+/// widgets a renderer implements. Every other id, and every name not listed, is unknown.
+pub const WIDGET_EMPTY : u8 = 0;
+pub const WIDGET_HONEYCOMB_CARD : u8 = 1;
+pub const WIDGET_FORMULA_VIEW : u8 = 2;
+pub const WIDGET_METRICS_TABLE : u8 = 3;
+pub const WIDGET_RUN_BUTTON : u8 = 4;
+pub const WIDGET_TEXT_BLOCK : u8 = 5;
+pub const WIDGET_KINDS : u8 = 6;
+pub const WIDGET_UNKNOWN : u8 = 255;
+pub const WIDGET_NAMES : [6]str = ["empty", "honeycomb_card", "formula_view", "metrics_table", "run_button", "text_block"];
+
+/// Names a planner may ask for that no trusted renderer implements, ever: each one would run or
+/// inject code the model wrote. The catalog must never contain them (invariant below).
+pub const FORBIDDEN_NAMES : [6]str = ["script", "eval", "html", "iframe", "raw_js", "function"];
+
+/// Props, as bit positions in a widget's prop mask.
+pub const PROP_TITLE : u8 = 0;
+pub const PROP_SPEC_PATH : u8 = 1;
+pub const PROP_FORMULA_ID : u8 = 2;
+pub const PROP_COLUMNS : u8 = 3;
+pub const PROP_UNITS : u8 = 4;
+pub const PROP_CAPTION : u8 = 5;
+pub const PROP_KINDS : u8 = 6;
+
+/// Actions. ACTION_NONE is always allowed; every other action must be in the widget's action mask
+/// and needs its capability granted. RUN_TESTS runs the bound spec's own tests on the lab through
+/// t27c; it never runs text the model wrote.
+pub const ACTION_NONE : u8 = 0;
+pub const ACTION_OPEN_SPEC : u8 = 1;
+pub const ACTION_RUN_TESTS : u8 = 2;
+pub const ACTION_EXPORT_CSV : u8 = 3;
+pub const ACTION_COPY_FORMULA : u8 = 4;
+pub const ACTION_KINDS : u8 = 5;
+
+/// Capabilities, as bit positions in a mask the host grants for one session.
+pub const CAP_READ_SPECS : u8 = 0;
+pub const CAP_READ_METRICS : u8 = 1;
+pub const CAP_RUN_LAB : u8 = 2;
+pub const CAP_EXPORT_LOCAL : u8 = 3;
+pub const CAP_CLIPBOARD : u8 = 4;
+pub const CAP_KINDS : u8 = 5;
+
+/// Data source kinds a plan may declare. A widget binds to one source of its own kind.
+pub const SOURCE_NONE : u8 = 0;
+pub const SOURCE_SPEC : u8 = 1;
+pub const SOURCE_FORMULA : u8 = 2;
+pub const SOURCE_METRICS : u8 = 3;
+pub const SOURCE_KINDS : u8 = 4;
+
+/// Catalog tables, indexed by widget id. Masks are spelled as numbers; the invariant
+/// catalog_masks_are_spelled_right rebuilds each one from the named bits.
+/// Props: card title+spec_path, formula title+formula_id+caption, table title+columns+units+caption,
+/// button title+spec_path, text title+caption.
+pub const WIDGET_PROPS : [6]u32 = [0, 3, 37, 57, 3, 33];
+/// Actions: card open_spec, formula copy_formula, table export_csv, button run_tests, text none.
+pub const WIDGET_ACTIONS : [6]u32 = [0, 2, 16, 8, 4, 0];
+/// Capabilities to show the widget at all: card, formula and button read specs, table reads metrics.
+pub const WIDGET_CAPS : [6]u32 = [0, 1, 1, 2, 1, 0];
+/// The source kind each widget binds to; SOURCE_NONE means it takes no binding.
+pub const WIDGET_SOURCE : [6]u8 = [SOURCE_NONE, SOURCE_SPEC, SOURCE_FORMULA, SOURCE_METRICS, SOURCE_SPEC, SOURCE_NONE];
+/// Capability each action needs, indexed by action id: none, read_specs, run_lab, export_local,
+/// clipboard.
+pub const ACTION_CAPS : [5]u32 = [0, 1, 4, 8, 16];
+
+/// Who produced the plan. Both kinds pass through validate_plan; neither is trusted on its own.
+pub const SOLVER_RULES : u8 = 0;
+pub const SOLVER_MODEL : u8 = 1;
+pub const SOLVER_KINDS : u8 = 2;
+
+pub const THEME_LIGHT : u8 = 0;
+pub const THEME_DARK : u8 = 1;
+pub const THEME_HIGH_CONTRAST : u8 = 2;
+pub const THEME_KINDS : u8 = 3;
+
+/// Layout: a grid of GRID_COLUMNS columns and at most GRID_ROWS rows.
+pub const GRID_COLUMNS : u8 = 12;
+pub const GRID_ROWS : u8 = 8;
+
+/// Plan capacity. Binding 0 means "no binding"; binding k names declared source k (1-based).
+pub const MAX_WIDGETS : u32 = 8;
+pub const MAX_SOURCES : u32 = 4;
+pub const BINDING_NONE : u8 = 0;
+pub const NO_SLOT : u32 = 255;
+
+/// Validation verdicts. validate_plan checks plan-level rules in this order, then each widget slot
+/// in slot order, and returns the first rule broken.
+pub const PLAN_OK : u8 = 0;
+pub const ERR_IR_VERSION : u8 = 1;
+pub const ERR_CATALOG_VERSION : u8 = 2;
+pub const ERR_PROVENANCE : u8 = 3;
+pub const ERR_THEME : u8 = 4;
+pub const ERR_SOURCE : u8 = 5;
+pub const ERR_EMPTY_PLAN : u8 = 6;
+pub const ERR_TOO_MANY_WIDGETS : u8 = 7;
+pub const ERR_UNKNOWN_WIDGET : u8 = 8;
+pub const ERR_PROP_NOT_ALLOWED : u8 = 9;
+pub const ERR_BINDING_MISSING : u8 = 10;
+pub const ERR_BINDING_DANGLING : u8 = 11;
+pub const ERR_BINDING_KIND : u8 = 12;
+pub const ERR_ACTION_NOT_ALLOWED : u8 = 13;
+pub const ERR_CAPABILITY_NOT_GRANTED : u8 = 14;
+pub const ERR_A11Y_LABEL_MISSING : u8 = 15;
+pub const ERR_LAYOUT : u8 = 16;
+
+/// One UI plan. Arrays are indexed by slot (widgets) or by source number minus one (sources); slots
+/// at or past widget_count, and sources at or past source_count, are not read.
+pub struct UiPlan {
+    ir_version: u32,
+    catalog_version: u32,
+    intent: str,
+    solver: u8,
+    theme: u8,
+    title: str,
+    granted: u32,
+    source_count: u32,
+    source_kind: [4]u8,
+    source_ref: [4]str,
+    widget_count: u32,
+    widget: [8]u8,
+    props: [8]u32,
+    binding: [8]u8,
+    action: [8]u8,
+    row: [8]u8,
+    col: [8]u8,
+    span: [8]u8,
+    label: [8]str,
+}
+
+pub fn bit(b: u8) -> u32 {
+    return (1 as u32) << (b as u32);
+}
+
+pub fn has_bit(mask: u32, b: u8) -> bool {
+    return ((mask >> (b as u32)) & 1) == 1;
+}
+
+/// A trusted widget a renderer can draw: in the catalog and not the empty slot.
+pub fn catalog_widget(w: u8) -> bool {
+    return w > WIDGET_EMPTY and w < WIDGET_KINDS;
+}
+
+/// The id of a widget asked for by name, or WIDGET_UNKNOWN. The empty slot cannot be asked for.
+pub fn widget_id(name: str) -> u8 {
+    var i : u32 = 1;
+    while (i < (WIDGET_KINDS as u32)) {
+        if (WIDGET_NAMES[i as usize] == name) { return i as u8; }
+        i = i + 1;
+    }
+    return WIDGET_UNKNOWN;
+}
+
+/// How many forbidden names resolve to a catalog widget. Zero, by invariant.
+pub fn forbidden_in_catalog() -> u32 {
+    var n : u32 = 0;
+    var j : u32 = 0;
+    while (j < 6) {
+        if (widget_id(FORBIDDEN_NAMES[j as usize]) != WIDGET_UNKNOWN) { n = n + 1; }
+        j = j + 1;
+    }
+    return n;
+}
+
+/// A widget is interactive when the catalog gives it any action; it then needs an accessible label.
+pub fn is_interactive(w: u8) -> bool {
+    if (catalog_widget(w) == false) { return false; }
+    return WIDGET_ACTIONS[w as usize] != 0;
+}
+
+/// Every set prop bit is one the widget allows.
+pub fn props_allowed(w: u8, props: u32) -> bool {
+    return (props & WIDGET_PROPS[w as usize]) == props;
+}
+
+pub fn action_in_catalog(w: u8, a: u8) -> bool {
+    if (a == ACTION_NONE) { return true; }
+    if (a >= ACTION_KINDS) { return false; }
+    return has_bit(WIDGET_ACTIONS[w as usize], a);
+}
+
+/// Every capability in `need` is in `granted`.
+pub fn caps_granted(granted: u32, need: u32) -> bool {
+    return (need & granted) == need;
+}
+
+/// Two spans [c1, c1 + s1) and [c2, c2 + s2) on one row share a column.
+pub fn spans_overlap(c1: u8, s1: u8, c2: u8, s2: u8) -> bool {
+    return (c1 as u32) < (c2 as u32) + (s2 as u32) and (c2 as u32) < (c1 as u32) + (s1 as u32);
+}
+
+/// The rules one widget slot must meet, in order: known widget, allowed props, a binding of its
+/// own kind to a declared source, an allowed and granted action, its own capabilities, a label
+/// when it is interactive, and a place on the grid that no earlier slot holds.
+pub fn validate_widget(p: UiPlan, slot: u32) -> u8 {
+    let k : usize = slot as usize;
+    let w : u8 = p.widget[k];
+    if (catalog_widget(w) == false) { return ERR_UNKNOWN_WIDGET; }
+    if (props_allowed(w, p.props[k]) == false) { return ERR_PROP_NOT_ALLOWED; }
+    let want : u8 = WIDGET_SOURCE[w as usize];
+    let b : u8 = p.binding[k];
+    if (want == SOURCE_NONE) {
+        if (b != BINDING_NONE) { return ERR_BINDING_KIND; }
+    } else {
+        if (b == BINDING_NONE) { return ERR_BINDING_MISSING; }
+        if ((b as u32) > p.source_count) { return ERR_BINDING_DANGLING; }
+        if (p.source_kind[(b - 1) as usize] != want) { return ERR_BINDING_KIND; }
+    }
+    let a : u8 = p.action[k];
+    if (action_in_catalog(w, a) == false) { return ERR_ACTION_NOT_ALLOWED; }
+    if (caps_granted(p.granted, ACTION_CAPS[a as usize]) == false) { return ERR_CAPABILITY_NOT_GRANTED; }
+    if (caps_granted(p.granted, WIDGET_CAPS[w as usize]) == false) { return ERR_CAPABILITY_NOT_GRANTED; }
+    if (is_interactive(w) and p.label[k] == "") { return ERR_A11Y_LABEL_MISSING; }
+    if (p.span[k] == 0) { return ERR_LAYOUT; }
+    if ((p.col[k] as u32) + (p.span[k] as u32) > (GRID_COLUMNS as u32)) { return ERR_LAYOUT; }
+    if (p.row[k] >= GRID_ROWS) { return ERR_LAYOUT; }
+    var j : u32 = 0;
+    while (j < slot) {
+        let m : usize = j as usize;
+        if (p.row[m] == p.row[k] and spans_overlap(p.col[m], p.span[m], p.col[k], p.span[k])) { return ERR_LAYOUT; }
+        j = j + 1;
+    }
+    return PLAN_OK;
+}
+
+/// Plan-level rules, before any widget is read.
+pub fn validate_header(p: UiPlan) -> u8 {
+    if (p.ir_version != IR_VERSION) { return ERR_IR_VERSION; }
+    if (p.catalog_version != CATALOG_VERSION) { return ERR_CATALOG_VERSION; }
+    if (p.intent == "" or p.solver >= SOLVER_KINDS) { return ERR_PROVENANCE; }
+    if (p.theme >= THEME_KINDS) { return ERR_THEME; }
+    if (p.source_count > MAX_SOURCES) { return ERR_SOURCE; }
+    var i : u32 = 0;
+    while (i < p.source_count and i < MAX_SOURCES) {
+        let s : u8 = p.source_kind[i as usize];
+        if (s == SOURCE_NONE or s >= SOURCE_KINDS or p.source_ref[i as usize] == "") { return ERR_SOURCE; }
+        i = i + 1;
+    }
+    if (p.widget_count == 0) { return ERR_EMPTY_PLAN; }
+    if (p.widget_count > MAX_WIDGETS) { return ERR_TOO_MANY_WIDGETS; }
+    // the workspace itself is a landmark and needs an accessible name
+    if (p.title == "") { return ERR_A11Y_LABEL_MISSING; }
+    return PLAN_OK;
+}
+
+/// PLAN_OK, or the first rule the plan breaks.
+pub fn validate_plan(p: UiPlan) -> u8 {
+    let h : u8 = validate_header(p);
+    if (h != PLAN_OK) { return h; }
+    var i : u32 = 0;
+    while (i < p.widget_count and i < MAX_WIDGETS) {
+        let e : u8 = validate_widget(p, i);
+        if (e != PLAN_OK) { return e; }
+        i = i + 1;
+    }
+    return PLAN_OK;
+}
+
+/// The slot of the first widget that breaks a rule, or NO_SLOT when the header fails or nothing does.
+pub fn first_bad_slot(p: UiPlan) -> u32 {
+    if (validate_header(p) != PLAN_OK) { return NO_SLOT; }
+    var i : u32 = 0;
+    while (i < p.widget_count and i < MAX_WIDGETS) {
+        if (validate_widget(p, i) != PLAN_OK) { return i; }
+        i = i + 1;
+    }
+    return NO_SLOT;
+}
+
+pub fn interactive_count(p: UiPlan) -> u32 {
+    var n : u32 = 0;
+    var i : u32 = 0;
+    while (i < p.widget_count and i < MAX_WIDGETS) {
+        if (is_interactive(p.widget[i as usize])) { n = n + 1; }
+        i = i + 1;
+    }
+    return n;
+}
+
+/// An empty plan of the current versions: no sources, no widgets, nothing granted.
+pub fn blank_plan() -> UiPlan {
+    return UiPlan { ir_version: IR_VERSION, catalog_version: CATALOG_VERSION, intent: "", solver: SOLVER_RULES, theme: THEME_LIGHT, title: "", granted: 0, source_count: 0, source_kind: [0; 4], source_ref: ["", "", "", ""], widget_count: 0, widget: [0; 8], props: [0; 8], binding: [0; 8], action: [0; 8], row: [0; 8], col: [0; 8], span: [0; 8], label: ["", "", "", "", "", "", "", ""] };
+}
+
+/// The fixture: a GF16 research workspace. Row 0 holds the spec honeycomb card and the formula
+/// view side by side; row 1 the metrics table and the run button. Every source ref is a file in
+/// this repository.
+pub fn gf16_workspace() -> UiPlan {
+    var p : UiPlan = blank_plan();
+    p.intent = "Compare GF16 against bf16 on the conformance vectors";
+    p.theme = THEME_DARK;
+    p.title = "GF16 research workspace";
+    p.granted = bit(CAP_READ_SPECS) | bit(CAP_READ_METRICS) | bit(CAP_RUN_LAB) | bit(CAP_CLIPBOARD);
+    p.source_count = 3;
+    p.source_kind[0] = SOURCE_SPEC;
+    p.source_ref[0] = "specs/numeric/gf16.t27";
+    p.source_kind[1] = SOURCE_FORMULA;
+    p.source_ref[1] = "specs/numeric/gf16.t27#gf16_decode_to_f32";
+    p.source_kind[2] = SOURCE_METRICS;
+    p.source_ref[2] = "conformance/gf16_bench_results.json";
+    p.widget_count = 4;
+    // slot 0: the spec honeycomb card, bound to the spec, opens it
+    p.widget[0] = WIDGET_HONEYCOMB_CARD;
+    p.props[0] = bit(PROP_TITLE) | bit(PROP_SPEC_PATH);
+    p.binding[0] = 1;
+    p.action[0] = ACTION_OPEN_SPEC;
+    p.row[0] = 0;
+    p.col[0] = 0;
+    p.span[0] = 6;
+    p.label[0] = "GF16 spec card";
+    // slot 1: the formula view, bound to the decode formula, copies it
+    p.widget[1] = WIDGET_FORMULA_VIEW;
+    p.props[1] = bit(PROP_TITLE) | bit(PROP_FORMULA_ID) | bit(PROP_CAPTION);
+    p.binding[1] = 2;
+    p.action[1] = ACTION_COPY_FORMULA;
+    p.row[1] = 0;
+    p.col[1] = 6;
+    p.span[1] = 6;
+    p.label[1] = "GF16 decode formula";
+    // slot 2: the metrics table, bound to the bench results, read only here
+    p.widget[2] = WIDGET_METRICS_TABLE;
+    p.props[2] = bit(PROP_TITLE) | bit(PROP_COLUMNS) | bit(PROP_UNITS);
+    p.binding[2] = 3;
+    p.action[2] = ACTION_NONE;
+    p.row[2] = 1;
+    p.col[2] = 0;
+    p.span[2] = 9;
+    p.label[2] = "GF16 versus bf16 metrics";
+    // slot 3: the run button, bound to the spec, runs its tests on the lab
+    p.widget[3] = WIDGET_RUN_BUTTON;
+    p.props[3] = bit(PROP_TITLE) | bit(PROP_SPEC_PATH);
+    p.binding[3] = 1;
+    p.action[3] = ACTION_RUN_TESTS;
+    p.row[3] = 1;
+    p.col[3] = 9;
+    p.span[3] = 3;
+    p.label[3] = "Run GF16 spec tests";
+    return p;
+}
+
+/// Malformed plans. Each changes the fixture in one place and must be rejected for that reason.
+pub fn bad_unknown_widget() -> UiPlan {
+    var p : UiPlan = gf16_workspace();
+    p.widget[1] = 200;
+    return p;
+}
+
+/// A planner asks for an "eval" widget by name; the name resolves to WIDGET_UNKNOWN.
+pub fn bad_eval_widget() -> UiPlan {
+    var p : UiPlan = gf16_workspace();
+    p.widget[3] = widget_id("eval");
+    return p;
+}
+
+pub fn bad_dangling_binding() -> UiPlan {
+    var p : UiPlan = gf16_workspace();
+    p.binding[2] = 4;
+    return p;
+}
+
+pub fn bad_binding_kind() -> UiPlan {
+    var p : UiPlan = gf16_workspace();
+    p.binding[2] = 2;
+    return p;
+}
+
+pub fn bad_missing_binding() -> UiPlan {
+    var p : UiPlan = gf16_workspace();
+    p.binding[0] = BINDING_NONE;
+    return p;
+}
+
+pub fn bad_action_not_allowed() -> UiPlan {
+    var p : UiPlan = gf16_workspace();
+    p.action[1] = ACTION_RUN_TESTS;
+    return p;
+}
+
+pub fn bad_run_without_lab() -> UiPlan {
+    var p : UiPlan = gf16_workspace();
+    p.granted = bit(CAP_READ_SPECS) | bit(CAP_READ_METRICS) | bit(CAP_CLIPBOARD);
+    return p;
+}
+
+pub fn bad_unlabelled_button() -> UiPlan {
+    var p : UiPlan = gf16_workspace();
+    p.label[3] = "";
+    return p;
+}
+
+pub fn bad_prop_not_allowed() -> UiPlan {
+    var p : UiPlan = gf16_workspace();
+    p.props[3] = p.props[3] | bit(PROP_COLUMNS);
+    return p;
+}
+
+pub fn bad_overlap() -> UiPlan {
+    var p : UiPlan = gf16_workspace();
+    p.col[3] = 8;
+    return p;
+}
+
+test catalog_is_an_allowlist {
+    assert widget_id("honeycomb_card") == WIDGET_HONEYCOMB_CARD;
+    assert widget_id("formula_view") == WIDGET_FORMULA_VIEW;
+    assert widget_id("metrics_table") == WIDGET_METRICS_TABLE;
+    assert widget_id("run_button") == WIDGET_RUN_BUTTON;
+    assert widget_id("text_block") == WIDGET_TEXT_BLOCK;
+    // the empty slot is not a widget anyone can ask for
+    assert widget_id("empty") == WIDGET_UNKNOWN;
+    assert widget_id("script") == WIDGET_UNKNOWN;
+    assert widget_id("eval") == WIDGET_UNKNOWN;
+    assert widget_id("iframe") == WIDGET_UNKNOWN;
+    assert widget_id("Run_Button") == WIDGET_UNKNOWN;
+    assert catalog_widget(WIDGET_EMPTY) == false;
+    assert catalog_widget(WIDGET_TEXT_BLOCK);
+    assert catalog_widget(WIDGET_KINDS) == false;
+    assert catalog_widget(WIDGET_UNKNOWN) == false;
+}
+
+test gf16_workspace_is_valid {
+    let p : UiPlan = gf16_workspace();
+    assert validate_plan(p) == PLAN_OK;
+    assert first_bad_slot(p) == NO_SLOT;
+    assert p.widget_count == 4;
+    assert interactive_count(p) == 4;
+    assert p.source_kind[(p.binding[0] - 1) as usize] == SOURCE_SPEC;
+    assert p.source_kind[(p.binding[1] - 1) as usize] == SOURCE_FORMULA;
+    assert p.source_kind[(p.binding[2] - 1) as usize] == SOURCE_METRICS;
+    assert p.source_kind[(p.binding[3] - 1) as usize] == SOURCE_SPEC;
+    // a model-proposed plan passes the same gate, no more and no less
+    var m : UiPlan = gf16_workspace();
+    m.solver = SOLVER_MODEL;
+    assert validate_plan(m) == PLAN_OK;
+}
+
+test unknown_widget_is_rejected {
+    assert validate_plan(bad_unknown_widget()) == ERR_UNKNOWN_WIDGET;
+    assert first_bad_slot(bad_unknown_widget()) == 1;
+    assert validate_plan(bad_eval_widget()) == ERR_UNKNOWN_WIDGET;
+    assert first_bad_slot(bad_eval_widget()) == 3;
+    // an empty slot inside widget_count is a hole, not a widget
+    var p : UiPlan = gf16_workspace();
+    p.widget[2] = WIDGET_EMPTY;
+    assert validate_plan(p) == ERR_UNKNOWN_WIDGET;
+    assert first_bad_slot(p) == 2;
+}
+
+test binding_must_name_a_declared_source {
+    assert validate_plan(bad_dangling_binding()) == ERR_BINDING_DANGLING;
+    assert first_bad_slot(bad_dangling_binding()) == 2;
+    assert validate_plan(bad_binding_kind()) == ERR_BINDING_KIND;
+    assert validate_plan(bad_missing_binding()) == ERR_BINDING_MISSING;
+    assert first_bad_slot(bad_missing_binding()) == 0;
+    // a source slot past source_count is not declared, even if it is filled in
+    var p : UiPlan = gf16_workspace();
+    p.source_count = 2;
+    assert validate_plan(p) == ERR_BINDING_DANGLING;
+    // a widget that takes no binding may not carry one
+    var t : UiPlan = gf16_workspace();
+    t.widget_count = 5;
+    t.widget[4] = WIDGET_TEXT_BLOCK;
+    t.row[4] = 2;
+    t.span[4] = 12;
+    assert validate_plan(t) == PLAN_OK;
+    t.binding[4] = 1;
+    assert validate_plan(t) == ERR_BINDING_KIND;
+    // a declared source with no ref is refused before any widget is read
+    var s : UiPlan = gf16_workspace();
+    s.source_ref[2] = "";
+    assert validate_plan(s) == ERR_SOURCE;
+    assert first_bad_slot(s) == NO_SLOT;
+}
+
+test action_must_be_allowed_and_granted {
+    assert validate_plan(bad_action_not_allowed()) == ERR_ACTION_NOT_ALLOWED;
+    assert first_bad_slot(bad_action_not_allowed()) == 1;
+    assert validate_plan(bad_run_without_lab()) == ERR_CAPABILITY_NOT_GRANTED;
+    assert first_bad_slot(bad_run_without_lab()) == 3;
+    // export is in the table's catalog entry, but its capability is not granted in the fixture
+    var e : UiPlan = gf16_workspace();
+    e.action[2] = ACTION_EXPORT_CSV;
+    assert validate_plan(e) == ERR_CAPABILITY_NOT_GRANTED;
+    e.granted = e.granted | bit(CAP_EXPORT_LOCAL);
+    assert validate_plan(e) == PLAN_OK;
+    // an action id past the catalog is not allowed anywhere
+    var x : UiPlan = gf16_workspace();
+    x.action[0] = ACTION_KINDS;
+    assert validate_plan(x) == ERR_ACTION_NOT_ALLOWED;
+    // showing the metrics table at all needs read_metrics
+    var r : UiPlan = gf16_workspace();
+    r.granted = bit(CAP_READ_SPECS) | bit(CAP_RUN_LAB) | bit(CAP_CLIPBOARD);
+    assert validate_plan(r) == ERR_CAPABILITY_NOT_GRANTED;
+    assert first_bad_slot(r) == 2;
+}
+
+test interactive_widgets_need_a_label {
+    assert validate_plan(bad_unlabelled_button()) == ERR_A11Y_LABEL_MISSING;
+    assert first_bad_slot(bad_unlabelled_button()) == 3;
+    assert is_interactive(WIDGET_RUN_BUTTON);
+    assert is_interactive(WIDGET_TEXT_BLOCK) == false;
+    assert is_interactive(WIDGET_UNKNOWN) == false;
+    // a text block is not interactive and may go without a label
+    var t : UiPlan = gf16_workspace();
+    t.widget_count = 5;
+    t.widget[4] = WIDGET_TEXT_BLOCK;
+    t.props[4] = bit(PROP_CAPTION);
+    t.row[4] = 2;
+    t.span[4] = 12;
+    assert validate_plan(t) == PLAN_OK;
+    assert interactive_count(t) == 4;
+    // the workspace itself needs an accessible name
+    var w : UiPlan = gf16_workspace();
+    w.title = "";
+    assert validate_plan(w) == ERR_A11Y_LABEL_MISSING;
+    assert first_bad_slot(w) == NO_SLOT;
+}
+
+test props_are_allowlisted {
+    assert validate_plan(bad_prop_not_allowed()) == ERR_PROP_NOT_ALLOWED;
+    assert first_bad_slot(bad_prop_not_allowed()) == 3;
+    assert props_allowed(WIDGET_METRICS_TABLE, bit(PROP_COLUMNS));
+    assert props_allowed(WIDGET_RUN_BUTTON, bit(PROP_COLUMNS)) == false;
+    // a bit past the last prop is never allowed
+    assert props_allowed(WIDGET_METRICS_TABLE, bit(PROP_KINDS)) == false;
+    assert props_allowed(WIDGET_EMPTY, 0);
+}
+
+test layout_fits_the_grid {
+    assert validate_plan(bad_overlap()) == ERR_LAYOUT;
+    assert first_bad_slot(bad_overlap()) == 3;
+    var o : UiPlan = gf16_workspace();
+    o.span[3] = 4;
+    assert validate_plan(o) == ERR_LAYOUT;
+    var z : UiPlan = gf16_workspace();
+    z.span[0] = 0;
+    assert validate_plan(z) == ERR_LAYOUT;
+    var r : UiPlan = gf16_workspace();
+    r.row[3] = GRID_ROWS;
+    assert validate_plan(r) == ERR_LAYOUT;
+    // touching spans do not overlap; one column more does
+    assert spans_overlap(0, 6, 6, 6) == false;
+    assert spans_overlap(0, 7, 6, 6);
+    assert spans_overlap(9, 3, 0, 9) == false;
+}
+
+test header_rules_come_first {
+    var v : UiPlan = gf16_workspace();
+    v.ir_version = IR_VERSION + 1;
+    assert validate_plan(v) == ERR_IR_VERSION;
+    var c : UiPlan = gf16_workspace();
+    c.catalog_version = 0;
+    assert validate_plan(c) == ERR_CATALOG_VERSION;
+    var i : UiPlan = gf16_workspace();
+    i.intent = "";
+    assert validate_plan(i) == ERR_PROVENANCE;
+    var s : UiPlan = gf16_workspace();
+    s.solver = SOLVER_KINDS;
+    assert validate_plan(s) == ERR_PROVENANCE;
+    var t : UiPlan = gf16_workspace();
+    t.theme = THEME_KINDS;
+    assert validate_plan(t) == ERR_THEME;
+    assert validate_plan(blank_plan()) == ERR_PROVENANCE;
+    var e : UiPlan = gf16_workspace();
+    e.widget_count = 0;
+    assert validate_plan(e) == ERR_EMPTY_PLAN;
+    e.widget_count = MAX_WIDGETS + 1;
+    assert validate_plan(e) == ERR_TOO_MANY_WIDGETS;
+    // two defects: the header one is reported, then the earlier slot
+    var d : UiPlan = bad_unlabelled_button();
+    d.widget[1] = 200;
+    assert validate_plan(d) == ERR_UNKNOWN_WIDGET;
+    assert first_bad_slot(d) == 1;
+    d.theme = THEME_KINDS;
+    assert validate_plan(d) == ERR_THEME;
+}
+
+invariant no_script_widget_in_catalog {
+    assert forbidden_in_catalog() == 0;
+}
+
+invariant catalog_masks_are_spelled_right {
+    assert WIDGET_PROPS[1] == bit(PROP_TITLE) | bit(PROP_SPEC_PATH);
+    assert WIDGET_PROPS[2] == bit(PROP_TITLE) | bit(PROP_FORMULA_ID) | bit(PROP_CAPTION);
+    assert WIDGET_PROPS[3] == bit(PROP_TITLE) | bit(PROP_COLUMNS) | bit(PROP_UNITS) | bit(PROP_CAPTION);
+    assert WIDGET_PROPS[4] == bit(PROP_TITLE) | bit(PROP_SPEC_PATH);
+    assert WIDGET_PROPS[5] == bit(PROP_TITLE) | bit(PROP_CAPTION);
+    assert WIDGET_ACTIONS[1] == bit(ACTION_OPEN_SPEC);
+    assert WIDGET_ACTIONS[2] == bit(ACTION_COPY_FORMULA);
+    assert WIDGET_ACTIONS[3] == bit(ACTION_EXPORT_CSV);
+    assert WIDGET_ACTIONS[4] == bit(ACTION_RUN_TESTS);
+    assert WIDGET_CAPS[1] == bit(CAP_READ_SPECS);
+    assert WIDGET_CAPS[3] == bit(CAP_READ_METRICS);
+    assert ACTION_CAPS[ACTION_OPEN_SPEC] == bit(CAP_READ_SPECS);
+    assert ACTION_CAPS[ACTION_RUN_TESTS] == bit(CAP_RUN_LAB);
+    assert ACTION_CAPS[ACTION_EXPORT_CSV] == bit(CAP_EXPORT_LOCAL);
+    assert ACTION_CAPS[ACTION_COPY_FORMULA] == bit(CAP_CLIPBOARD);
+}
+
+invariant empty_slot_is_inert {
+    assert WIDGET_PROPS[WIDGET_EMPTY] == 0;
+    assert WIDGET_ACTIONS[WIDGET_EMPTY] == 0;
+    assert WIDGET_CAPS[WIDGET_EMPTY] == 0;
+    assert WIDGET_SOURCE[WIDGET_EMPTY] == SOURCE_NONE;
+    assert ACTION_CAPS[ACTION_NONE] == 0;
+}
+
+invariant reserved_ids_stay_outside {
+    assert WIDGET_UNKNOWN >= WIDGET_KINDS;
+    assert MAX_WIDGETS <= 8;
+    assert MAX_SOURCES <= 4;
+    assert (PROP_KINDS as u32) < 32;
+    assert (CAP_KINDS as u32) < 32;
+}
diff --git a/apps/website/public/t27f/graph/t27f.wasm b/apps/website/public/t27f/graph/t27f.wasm
new file mode 100644
index 0000000000000000000000000000000000000000..34c41b5bdb702bb8e0983d72b6bd44f967bb03ee
GIT binary patch
literal 38321
zcmeHw3zS_|ndaW-+(+Fy^|)1q7%dymy`V&6e6XB^25qy`CJ=cxAUHGKeW|2wsJivc
zy*DJ~C@COF1cay&(>BwlduS7<g9Jg0N=wDIHRISCmC>juQBkAfbY_ihXIcj5`~JPp
zx#v_>Fapb7v$~3PbN2K9|NX!AzxUZ^qXrsdS}CQk?6_L#Em!L;_{ZDAe=}R~ho^5J
zC{(CcSGTd8f9mSIO&}$WuDd!b1?ZHsHOl`-{d29fr?juM_A(xlp67c=;ZJ*7XA}zY
zhkw{Y@n4N9`v=OTfH_w1Ay4$pdbxZX!OZ%z&9ur0Ku>3Y3;+1q_cKUm3Watr(~eGs
zLPoPF<NI3s8ZC5&2_N_~OybYW;3*_Y4pqKT&uUAh$_xI0CE#Qxt0&Pk>udFzTmk$v
z)6+95$RFwZkj{-&$0q7ip2}adxiUI2FsQz(yOC^Eo0Z9d=1^s{I<AiDc2~sQPjrBs
zR8BVQ>Zi7{zOJ%vU{d`o&av(Z-HE2d^~$x?dSiHETq)*9hsUdxbrT!Mo9Ytg$0r7(
z{KXwneq?xjP+b&Pj}EM@j;afbQT6!1ShYeF7o>|w;G1G3jpjhTsn(EQL0SdO^I2OR
zye2|<9#KkOP_B-%>+2I^Y86K=wap3j#<;5`=MUqygsxVeg0|NVS2tA%sWMrwHmVq-
z>57WiO^j|F8&@mhcDBIr;thRKJI4@d{0AgnfYv8Asn^GCM#d*LjaLS%lg%OZI`Tl;
ztQ`R2=ES5rH%2PJHmh^e1ykzx(*>K<+3A8IwY(<+D=^j%kB+KkF#%H6Xx1l2s_NgR
zTMiC1hSY1*EjJB=<xTY(vQS7x0Z4ykjC80ve9cf(y&?uBTo=Z^oEj;ephttl>zZnD
zTq3PDzeb%otK=;8(irsU02FRYy(Haa>NV<&StVzw(_^Xyup3`FO_YqU6!)C~Rin`T
z@OcrLuEYuUv{*co6T{=p%J8`Qy|^<}vQdF$^v6m;#Er^8vpKMCNOi^Z42(`-6tDuQ
zK?k|mm>d|d3{8v<HdG)O21bVm2bxt;SJfsYM@84v2PTJ9ZV?Ggl~snS1B2DN@>38f
zTcz99RYylFRJ%)U66&hHquT{Sg_Y`2os&kJ)wf-0N_|VWk5iUwCpOj_>YKVd&N+U3
zLuaZ3jjH;(&Wu*;lj?uyJj}LHSvRE~(FK?+6s59mv-(;qGo`*7XNESZujpWCV01l*
z7o9nz+ZyZY)#`X<v-)zJo>E_m({=R^5#3_tU(|seMPpqRmiymzuztANs94<U3%Y%M
zoerkatWK)`rrTwVjpo#7RUOn_jiHH64Vd@DHL&o8`n-N#b@Svzy;&KrRw2xRNmK#4
z`kd}^6$7J?T6IwUy$;q54UCUhM=R?m>guz)ux_G0UaeOKH><yEWv0|;bTA0VToE!F
z>VWQ)tWXQpP&2yS7Bp#;59_?mZC0O-l2ht$bxum_>LFJMo_;DyPN`42B>4FWU67{2
zoBg_Ip^-IU0bS_Fb(fSmavPh~o>?VR>aTVC=)ly(#-@zzZk?N`57Yns7u{X2UIXu6
znXJ~wKyOw3l`cd@o7G?H_Mw4B#TKYty3JK>QXh=dL+USdKC-jBbaAL!pQsEsDr*PU
zjSSY|@BUnOK!TOEQx)r1KA`i=k8d1Pe`b?|m>G8Jyz~Sk-XA5W)SWutfaz4BJv*Z0
zlzMlRtgG8GGMLHm_%)Tu&FWnc;y@j4wz|1l8B(`FF`1$Qsdwrw2)GXIfKbJE-K0CD
z^)RGfuWV8`LYvroV03b5K;57-R0wsw_UqTIRnyuZ8{Vw8WZ?P-)OGoRwT;2y_3PE!
z+Xjari1Bq*^|lVtLzvPi>`VP8m!(UBg1xo4X`<d}RyK~qs4*ee2h~(hs)$Tf*LI6H
z1p_yZ%S56!wo8fC@n-va_zCA~8=c6Av$s=roq2JNHou__dCT<40+P-qCpw~TqEzEC
z6gzc}^+we)F<UJgEv5=NTaOT=VBf52ae7J($LURKC{7QlYhtuAU9Inmx;sx^jqAmU
z561Owep<(R8J&>5HXf`cdmyeB;a*KfNo&kNl{kZ$<xk_x=CjnF#F?qH)E^V2^l>D;
zC59;^UD-y=m9@i7_2xiE?nt|$+q$e4b(cFQW@)?3)k`0t{*T&^-j856P)05Go;Wfy
zt%6gO`NgdVrd6nlH%w1YEAwl;A^4!Dvs+F_7WwT<M#|n9lJ-`ZZA(^ls?alSwNN4R
zWV=#<x58Uti*&7w4q<JnQf1$?t?5)IS5h4sP0;*MNh&hNzX%ois6v2g<2Tv)l-gns
zw3tPFnlIc45{)X}B$Vh4z-`*3pDC0a8QOU0nKe5)*rl8ck?fUZ_JU3Y#5oY0?Gzfa
zp|{vOh1lC8?5H&XU}d@x4Qmc2)F@IGi!#~J?=PtU<J-QZX4w#`px1G&xK$`4&-QAa
z-(qx0bF3s@p9jQhsoEZvJeKTORPyE7Tgu3@qm<>dSjzFyQOX;yq?wfJwmG8*xI8$(
zA(<J?QTW}Y*Edf|F4G;DEFk2ph(HvYWbq$H7v|6F2WRwo{UsfQI{2rAgo`8POeA0q
zKlDL4Mv@Kns!kAObg28mSPu!mznov)soBgFEq}GiTw+HG`XKq$p+e=BTG^+#!+a>u
z)f=Q(Upu?Fl<n{X@Y@eFMlFNzGwA&`NOT$az_h;BbZjW2sts9iY-E|&f%aK%h0n1U
zK@N~)fQIr{wZ%XRj`G<Evvmx^H<?<=?@&PyW>*292M&Nh<6UcX4YJPxdENn3q+D^_
zSpb0Kd_LM746qQOvSC~3o!99J#GEA;*xg|9Tn!|egUSXNRWZ_=Y)fx$j`ikNtmw9g
zJ}iRlL?1kF1<Wy4t+Fo)nekVk+zT_5jw;!#cG>PA1m}wHBv@f31_qYUn#(@)0X()X
z#K`AsfqFmb4Fr^UgNJ-w_^rLc&eNd)p>`IZr7M8GlPjIzAIxx(XcYVioJQW<{t{`~
z2Cath^5(WPC10SHccDWDR$k66_P$7u08QK(*2?W+8yi80bPOSCk4SBMSV)wcZsIeC
zOEn;r4&`>^uNFMguAJj2rN|V~Hg9funIMNfUVvu#upQLnA?=W)zoR7R1jYN9o#L*_
zSvE5o3P}}H(2{KN7U#N9rNTm@04f%UM6J7_6#%GDlc9tmyQhSEVVli8Y0arX>Gz7!
zpb4Z5CPQUQn#yQ;sBuYGl?_I<P72SDEZw<sxak^9+_`e-6@~}E(a_4;Iac5ZJ=(bk
zeAdBUM8D|I>lZOrZHFHGOzT`sz}MACStltddjP5J6qF#sk0+&fiAKW@&`~OXi(@|c
zL$*NIp;96IQq4^-#=oS~!3+JO?G0BET0Gm9)Y7=%P&Dw?S^%I9K1A)W>4(ZK_I^Q?
zs+m{U!pudG7+P=tx{3@M{`?YHo|OXyaJ^1*`{XCih<uM0po)LSVG9>OAPSUg!clRk
zWNcJq7T4!aO+UiMPRwu2-73j$!iH?qJb=(O9nW2hO7J|QlMr%Q80>+;)MYA!UxPMS
z!z^W-fV8t*m-UNx2)Q<-@Qd4-E52LGXr&Mobv6=E1jR4DC)Mq}scxNg+zdooZ1*k+
z9;V-nVifAt9A3B7no64>9%6$Woy*A--$!gPeCU)*vq7eKr<7}N1(d{xC-7R~4>cw>
z8W<e&890qYCB!i39jnjQtuxa=h9Qexwp2$4mET5HK#=t}9EPQws(3mbRdI(9$`&mi
zso*QK6v55$fTZ2f5E(G`K;GI(-s4c|^x~mrQtpAXkGO_fxh)Fk5V?Vp$Xx7rvo*lr
z%>Oi?{O|-I#Nxty?V?hSvuA5ax!`YqYnl6z!a~ELdzN!f${87YOZpL8e6RtLhIo2N
z)<#qFNu2)q1QPe*m}g1ce-;wAR`;7EzD0YnMZofXYxy!t=SE|>rrka`Lx&&vP^ef^
zrXmoyh@`9cWX|-O(0Wj%udSKQwcv_prqOQ2P<;QqYJ6>aP;;z&mV%}S;$tBAIbXhm
z##j>TcPgM$Hp4-0^+s!EaV;1FT8xn%5v2?e@=#_N3>z_fH-XWWAxM-!w9UrF^ddVs
z5*L;rf^=;;wQKydrdEPW6-Q`;QZIO0!k7KV^%iJG_*3$M88(kd3Xz`B<U&~Jb(uj3
z3gLJ_4<t+6S<IO5q)9J<@NrGhgGr%ymyn!mn!~CV{E};#$hV#hJ)%8ueOUXEzs@&c
zmWW9dUt_0l_!!0b3nob_#jhy_fp+C6G0=Ia$dJ!)G~NY>s_f!XN*I?lWDU{=(E^b8
zFmN@8sS4uChg^AvKyXQ?#~ecS08=`ck>eDaWI&FAv#^QN_Z?dMTR<~}y4c%x_W@{&
zhb$a|zXHAwQ6rh^*2^a~<+-UAIHD=>>1H~pQ&KN<up=2fK@i%Sv=_}pI<5VhVXh^a
z0TUDh)Mp*nu^b@RF$`)0c!<GJS#30d`4LNJurhl=zr^VnXv_6xQ&CQ9&j2#??DQV2
zL)ZaqFp<UH*4xNBF%4lIL_yY((PcliatVEeHIR-MaTW9K2c7j`B+vm!EkoI$P4I0m
zt(Qp;XJ>2c(_Pqy;dySVql$Q~Y0kOzv=;>RZ5~~}6nnLDA)4bnxDouE8?kd-u7+qh
z7DO5n*eC@ObhvGg`Cw$84n{US0sd%$d>Z_DNYCL-$0N3Hwzj6!mX6)q;<YI_rL7Et
z!L&oy^Jt%y8~7<(K|l*vfOy$0q0-3rivI=pgl4Jd8p%WRA}K}&sEQI?28jX*Qq#ki
zh$`7etTtI7ac<nH_+imm_^aUJ#Bv_mq>AxUpKBfHn1`Pae*#k%qkswi4SUOa9omkK
z5cp}+$4SCVqLfy_cV~rlPd_1o0?+JPBx`YQlyQp$;6XwL6<nl49M&IjJ(Y?v5fV$h
zj~EfN3|0r4R3nJzu;4=IW1~fC4tZIS8MjW&x&j{<VZa!Rb+Z7;)hg^G-jhlC<4n*M
zZLQryrUZXEzX#-crD$1c7MC*OWt@YiPje0+HqSYJQkFB3iOjR&3$xgPlKrL({2^Te
zB||@y(%uY1g_z=dh2j^0EyaCIVnReXfhOh<%KC$4j44#YFM=$Y0YeBO4jSn8WagG7
zJyf9OZi^o!SWbe$pQKIm>9rssS2xE-?xA=;AwnKWA>dsTpkpr)!4G6@;~mEGNM5%=
zq92b_iBN)IF^8$dJce4k6{A;PzjfQL85}7<3%_~K%H#URZM#LCu|w$_s#SJ%|Fbas
zd0pFc?Oo<YGQW3u=6-TsBww7@g+0eeY*bH?wx;=K<BaDWiA<HH*+>$;R}3}j<YXFe
znUw5<w6YSVCYwv}k}QzrT&siFVX|Hp8OZ{P)q~Ti@UR2AHuyBz(3bt5t^a3+_5rgG
z&X}joQuWJsN~}Y_K)am3(eay4qS3$HbP|o8yfM|tzRH;<k?AqaB*rlPzvD5a#+hpK
z^SI4RljDrq_)W9*duYNL#Ij>vP(HTIrrB;DmN`&M)k8O=#*kuJ+~~>aR3kgkC*_@$
zO&^zZo=&DP7Ra-0jeTNKBl+waNLrk$xH%C}9`jJBn!&WjFrzh2V*dyMvMPQ<{H!V|
zx<Af-I~FCQExX~ve{Ixb^H@K-uqVBKc8*CF9<2=^6?`p0!LI9dVh4+EmzcXer6o9S
zs};W~Byl?e1d2m<=xz86BeqRYwG&vZLpN9}nJ1<p57T2lqs&27{1)NZTG!NMOwM$p
z;oqs^w__|?umEg?23z-bGent3>7Wv$2lZ}m?sv#m=ZfdB^~m#EI|j#oeoDM(3iZl8
z7~P>@Io>2`b0;@;`Hl&5EnYi$E6nkiuX5Yb#hQ6ShIsttQCQ3UA1r9_-y_1#KBLWd
zB5vwXzs%ddWVyHV%23kVklubJL}<62xn+#kKmY(RNB~s?cPChfa%qtR^n(IDFsGVR
zou~vLIK153vlnTiLZ{{4uDv=&fV4wEcxeoKz9AT-2}f}J1`4msgeFX4*!K;<+<yaN
z4`M*4<=(y<5CFI#Anh;^UK+#xdpwRonh?XyWGyh9Zca~Pn7PMW?j1brFrd?NZ{~0d
z1JVuy;iWMgywN8HY2pFH_pT>~4)YRoW)j1p8~x?p;g4X$gJVFa<=&x>`0*H!b{GgR
zjp6V&1%ou<7!C=S0<+94OJX?kO~5?56<R|K=(OBBvNaQ9K-ys-yflWR_sU+GG$Dqc
z3WiQ|wmCbA;n=;I<=*jcISlBu+&lKI76zmp2Et2YIDS)>T#_cl@TkLZjyWfZVfr1}
z<=(dY5QcFK=(OCMzAqb(0cnSU@X{EzJt`Qa3FYt}CkMEe&!&yxQ9#{!GhU7o2fD!?
zZqCIxkajo-F^yyAM{{BkY(gAg6&zjWa|!n)P<MSa2b=hg!+~zFiSM*<AnkAvVj9Pu
zZF%C5CO&X{P;k85d`X$Fq{gvtTOL+%Ki1P62fD#3?&m(aHEg6E4nj=h*#BL@Ax((m
zF0t$-=4;A)J%wZDyMTJ|op4ITfo`yicXB7f;y~KrAjC9|gAZ`$%}5jCxLqWEHa79h
zw^BF`J<tZrc+BBIH(17FEgVQY9E6z0arl-3aYz&FCz+>Y9HDts&2oT8ZYjVvK31^f
zKsVUN#|rT{kajo-F^%Ks5y2r%@&<4JL>__pvNGRHjpNu6Ks|nIyTyTSu#Q{XV;o33
z9E6z0as0t{jzgNzI`}))PIwmD^vBy_7vFcV(HwU1{T6Jb9c)5M!`}9;fUu<r&O?aa
zzBCDY`@1mh?A(tiQS5=a?fbb|=_ZK%frCv*Y1lh|Ah6NA2AXkt26U%j@A?6t?YX_f
z!bWr0!R;L}Y@{7*LQ2El^N9}9Elsc(MI4~wD8Pc-_lXV|z~c@$+QR@IZvjWz0Vk+5
z@cnmm61X(crhr&Pna{fr!vdeVqZ69{$xfR?duaYAJ7da`cEAZL4gBB_1-LXJzp+u6
z=E|WT0@~s2T^2T)L*uu1#juffun8#*`|zi_NVqg1zvsX{@~JLp`i~rJG>4}Ds0ABo
z2b+-6u#djGo3Nz`<E}Q)9mQRi)MM}NhKfJbZF6W36@REZCLC!8oS@RckN;SJOOp)v
zT>$Vj$ES}1+_v`?EpW7lj=#4U14r5cC#W>=ZJ(A1Mw;LN6)0D*&y<pXx(Frzi35)I
zQ1YL&fFtdI6I2@b&K*5ui!{N3EKrU>D+PSljvi?F!#$RAw1<{I+!Irdv;$61Y2bT)
zD!`=)qXv30xD|<YEx3I@1-Sk1>$N$whnByuHwKQh15QwB;QMEKMa$U)+h<@597_`R
z%uFwo{AUg}nnTHd)`E?+gH1?j*az?IBW!8nfhWOi*oW@ygOVTUvvi|5l>9(nOgGXF
zHX)^9AAUk$OB0$;$86X~o&dC???1)DMsq0n`%j5sBkf=lQX2Nr&zvGk&L+O;6nBVV
z*)m+w10MU#DGb9Ujn>N<fQv6wfP^6vLK-GQ`Dl&tpl(I@Jf7G#YhSueUIIqz698`G
zaU<|i*2K0JyZfPk4qo5lP>y#F4(Z`_w9KVEhv<hmeYOZM&N9oqQ=$qvW*Fv|c{_Uf
zq6E*507rbVe5j$Z7rm0fu^#}6kRuasuLOTRi|+g^y7RN?&U4!pgxd`XTa8!mB>eW5
z@DLgZKON7^IqJ4EdEDq6b<4}}vP=d7dP(KZMFHM{St{>JlF4Q<nRxjY9j^#3ODv3A
zFaJXOo^I~a_%1GuZLPMO>vIpKJR6X*_5R#~lpX))7Nooncy2-3w*qs{p1$RoiznKk
zm_w)Rj65sA_9)8yfZzPvQJmB#+3=np>Xro5-?)EMJgMy)w}*Lh+c&=}{3qJy_+8<5
zyU}y@S$<de-A47l8h*EjJqQ0ECG_tk++<R#?dz#Imi;Us+PB|xAYS>5Y2?d7cg}N;
z`327wtQ^&!3-+pKOl@>>X%0+rY|jR+eP1>|+&@UutL=1-xfb)U+e4O2QC?-15bU&O
zS$srr(%t2~;+*cke=^wRz3ptoXP;cpMRQQDJeiIdy?q@%ySvDugZuS9e{1^fCcSq-
zumSJPjVkfAH1;(86{ybO#i$vy2U0^1FP#lzjOl&Y_v0%F^Dnyi&(qV>s(76L@~An&
zHT@=h-hgI!wQLXPvlo6+j1@o6(8?>^poxP%3~bG`H&(`3jphhqQ6)K?aBPm0vm+s1
z-5$-4;Z1PpqhbPQQSfisk1Mdj*M=C2Z)>NgGh+v&5nx2=vKl#HL2&oCSqqkfeGUl`
zPncuNM}Zdl(i|~g&5lBATD{Geia3e3{Yz>r$YA$A=q7z{t&xf5S9(qG5&$#PKfK3x
zFRkzrmMwT@`SE+fCHn$q1IKB{1@2)G(TI`8XCD~Ti#L`tjWEOUBf<k8$c<2s)XE+T
zQ0p~9ZzM%pa=;@8%48$j=>~h@Z8e94UH3$3(2hbYDZH9vJr3iD`1pQ?;|Go4Q0Ucy
zS1J4MgRjO}SL9JJ%NKV78siwFL2_6V!E!>wR~wC*`M+uuXceS3YP!dGvLRIG_v0-*
z83QFi>S$i-&+nHPbx4z6qE#gv<!8RQ^?E225bNeh@M1?Sir*o{gy~^@C%F+B4AD^u
zM#q8`%Iu_un%np<IQjMs{eVP~!JWR=6KKVo35kU~i&fml+}`U}9?fsr9h^x@ZS%5v
zttVhma~+R6SjaotNB3SHydr9+Au4vLnJkE~DV)lLYI0zAlZ@bQO;y1u3~vRXzrALz
z<MB9bB|&4zYZQB3zNZyVta5yQ@fM*F)M4DWGJPS=e`&}81pvGC0f046wT+q|V?&ZQ
zqDBoXRkAh5&(_<e^#{_eSsAr1WpK_nxRCnihK?6*A`{4fFW=_F2VH@06VNjqEkZPG
zrdVsq%}>cqC*_8bdUm9=EzL2w;gAg?=;9q5{L04_1R%|~GY>hPtAuT~@VzW_r#%7F
z_*RABg81543WSMr0%C9Q2K05{qMovT@|xz!{D!jkS}W-gN)aL>I<RH8Re0Up8=S4Z
z>j)Nd67qOVM{+_O59^@jJ){ZC)C|6t0-W5I-L;@BqcXm6Y#<THITk@<#)9)a+y()(
zks$mQG3Cs4A+nYnH!Lv~fKLo^Z<x96s*|JfeNRWDGciY_Ge4n`GYF2$$Or?M5l}7H
zBAjStg-xxja6QNZ%&OosJWUnZ2FFqS&k1Q#zW$sNFS37}3la^87%JZokQa_zd$?W{
zK>P&`_6WqdKb#RU#Qph&n=Nq=&d1U{cm4(l(iS^ep#+Qn^EX(_d3q=Hrq;kk3tL%{
zUMnjDckjzZhlJ*2fw(H^(DGryX=>&44O_SGngKuWS?RxH+it@dCx^q5ux6)p;6Y)`
z+^I*w&JU5nHS@Tt6?Zckl&yQx-U{^NN1J%iaXfNlW?I>4>_sRm?iGDe#e3vQS$#zM
z{~jtubRU)qzxZGItQG%8YF{CfE<hH>u#-|49WnRlQS%K<2+)4CnBKerpKSHlP*e-f
zOp?M60mVr=dS+(PbFZLF(z8!6-l{R_dMh}b;(aUu-YqyBhnU6rgr#Z^Jr@YTS8X^U
z_kiS(ILt)xL3ZLPFn)TV&2ARfmMZ#8d>DCx_7Ir{!u#2`_yGTf&-Q{pKM^s<azc!G
z#52eE4P$~5(+}aX(9y{`Lp<}Een*w-<(qv%8w0YaPmA0{w-XTe>a@?dGn_XTyFG+-
z;=VW;@1+ZS>j^mfpdCz1ae6$(kDi#J!ulHciZR%BC!qD^Em{{_FIa}5gVw!ssJzmK
zvyi%cJ^)oaAJTu4tSVvJ;{j+8m_>w39l;l-9zHj!l`|Jp+>i>6eAwfWXoZ+HItRFv
z%E^(kSHxURd(oz!dvLla79jIXu!OCT=A|_i<74Cj!ZOn>Xc)C1NV08Tr$B}Wi@*<I
zl7~tpkLD3PAqX5b`=5_2;-OJ9v-S1k_fXL=t4PSgsMeiov;zcn7@mAV%Wr8*0Lt-k
z901aa%!B_30<D!K$3i1PAkP75Jg9bsae59q3>+VnY8NB%z$s)v4tP-$es<#rr*ZIG
zO4<V@&V(%k5=WPEscNU{QZJ56LRN7#HhLBBW0PX|5-Y)Kq9{#*1nZluwzfR0b#rmx
zYyHwIPeh{gHp0!C9F|2CVG)ZrLDFRHXl$uCRGSpfCzB$CiIHQCC9Hrq5mpGV;9XaT
zx^6`;=cK$fLBRG;f!mqYwm(kH(}@Q{C){wVKfLp<k3pT`AT@RSv`~#(*1l4qA-oAc
z+=U0S89G1BFD+PuzI)l%oHlx4@Op9~3QfiL`{p!4)C^Yz=XEuHny+9K(26y5YFInk
znNNt%tqERe0jEUagkaBq$$VyKi$sBS*O)%V`{`D!gNP=IbarEci+!Z?ak24v;7=@8
z@!C;9A|A&w(&=uip*Uw7!jtK<7A9qsiN%2jk;Tn-a=5>Ba`-S!8v*E?lfwsGbYq48
zLhCBzficVS3PZOhR`xkJmgSopiDRsd6~^tPX+M%KiE!Pgw{T5ib~OfoFN3qI>rU1v
zl+R3f%$p76-UYZZ`9xcw+wZ8^Q2?N${nDpZZUI{TbOD|W(XN4QAVGIvbzXd)-Ad?p
z=l%*4!7t9xFN}`&9r<J?{tgz(h7AF%FFt+%-q>UE$p@LlF(JGS;f%|ZZ8fuBbTm5Q
z2QR%0C%jO%_2UPw$GNfFmH-m^z}F$(rYso9q0&y(rhPRXo{urwW8+X|>|%iJP~RI{
zt<FO$u?xITT4JE|fSLsso(FS;V5`JDd?O78um9lVAEUIr6tS*D^fm{T)4g^iavV${
z`(z+1=AG{XK{V~1HzUEt@LjL3mGCOJgg36GcKmp40q<AnjJ~y|8P5M-2wUX5gIAul
zQoC)#vM?wfA(3TW{GL4VqMYrz68t$AEF-G!uuv+7U5=IT{Pg=i0rK5$f}`bL^C~)g
zyZ|OF-`o^)@l~twffrkYyMFQeg0c_lZOQ=OC!dHr;(E=dT36Q7T6<teuL)%iM%P|*
z(-!&}yoUr;VG-JkJtaRZ;`D!!>$oCGDxwcS_6W#?aKi#WZ7!Ay9cWSL?C$8|&<bHU
zjf?j$;PpNK!}Sqcu-8(DIbaCEQYHF=k%i}hg2H($?Z9iwHMl{bGl=<B?pvx9b~jdc
zk|%v3*jfC6jIt-}8Yy?1FUqkWKY33I`Q*5dH_xtlA?)Sn<#>!>7`;v$r9Q}@2P5l(
zCK`p8qL2IN-o=fV9uB);{8HBBOMN1*o>Ff|z&D>A@a46z9fv2GkMWiGZo3a-pAo8Z
zDXK`z<3c)!SlwBG%69{)K1UtCgSy`bGJ5dLcC-fqWO~-nI&;EE!pEhB)0_%#nue}f
zma_N@a(2jziy<0_Ey)AorJ2oX4K4@+NQ(z!!{|5km-;$#)GoGuhoH>Fu)$0g-zvq0
z*~R};C}|P6suMSz;06)n&)chCN@sTheo{}fhy+G$C{sGUkWRU`RDcu0sjEvmGs2rf
z%gmq~kIJ`}-KM;{Q@(x#%OO#ysXVzIim`EfX^A;N%ko;DW!I<Sp{+M`evnO<s$-Ag
z&I(lQ{{ld1^X^c-XY$Rl3aBBheV-=1Y-|LE{o*i3^HpZgPXsC}c;tYCW9<DyYDMgU
z9cs3XyqdE&%vcB_ZA^?4f%o7`>kdFY_zCQJ@$*xv)4p9^t#k?!pZzEj&tqag5~m^|
zXxZ-hP`$vnW(mD_M62-mVZgPPxz4V6aJLNxLb~L755WEq4!b%yF<0ns%Zp@q`*ujZ
zI9|Bjb_GY%4Vdt{9bv#_7MMoIdvG^ToYqR6A&ywcv3fszo=dfbr@GV&9Eok=3pjoI
z(Ip(db+IL$I?7sUd_@qGzKCUU-OQ8o)%jtUa}n)fmv!W=3G7@et^I%scjpPK!gidR
z=#r0X4MCy;;kIZJra~la_i_;oMBE_$8c4+Vm)aq~7I^q<m}OU3aQ+&Xwh*C@X1e$z
z(FGeb0HO6>tTC&tRQ`#}o_KVWJs3)g5+k?b5H4f7yB>-Zi37MsFw^Q%FWi7{84O^)
z^&z6chd+UPMBocbK7`jxg}`{Q#ZIrFn>dS#c*YBh+^?~M?4@LTD8_Q18z$r}1!3Pv
z>>1Dtn0mv2gDr%eXb*OR6dySp_dpIlLUZyHTV@#5<!R1JYy&wtiD|Nxhu2#yU3^|A
zU1$%cD}%9wIjV7Hb$_XcCT^7ko{g*$Yl&kU+y%BfQ|5&;;K5TGt9*KTVGLZ7y=cW?
zQiyuO*VCi6S(^o9-+{z~&72VIjW)^%PPsh99uf$9ICzHh_BsaU-~`-F4XeQbio(TB
z4!Tp|1l@p6mT(qF+g|&LuqDMgkAx*yQY;I^fc;2Oa6kv$+c4Kg7*Rvnir>S(;xH_$
zxG)FOS_y$Y-6mV|a;6afAsvmI+~$={a>1I^h!-$WCwJ@GGEcq+X9<o%9l<olL#+rM
zZHau@f`fVdiW*pEv|uq?_aYB?@Lnhrm=4ot@3A#FztE~N(;bKb%{D?oFPx{E?r@#V
zbk2g@w$oPP@-&nsL2mmCSA#QYuEq{PzBO8Azm5lSPesJtYuiJ_C`&@R;XYdfVb7|W
zzTej1c8ggxPd#93@I6hd#vJGMXXduMZ5=LMLWy9aB7hZOFHDK*gh^_9h=~&=xONS*
zI-Zy(<=IgZcV8@tp?C1T4=f8UGW=)WYuC6D2l%~UF4wib3n>vFxSQ9c03S^Hp~T&N
zjQgnLmKw~>APOeMsF0?m>2s*_LaRBp8#7ubWc2<0NZ?eQ*>fKf?MU#Df2j)z8WAl-
zRtJ&+KV{~V4A?Gfhh7JnCI&=)N5<(XnPM%Gsv5~B<9u76!R<!8p^F`GLznR5=pC7|
zh7+^yFSrP1j$6@O7B_SGxS0!)j7(|K&0Jk}_Ou^@qWxlbCl?$&ov14}-RRhEo0f|P
z%O_@~g+$EVQe=u~)fRhS>|Kz6B0MA>-FP@3*$KfQ5~b^<F=DZaxrMe$C*v1?>?RX(
z08X}5z`&3^@>U>z>Xk(tq%x1c>Z6z<Z)II~<gH}Z!hKwRM?U4XoKw<rCl{wrPrSwa
zQgA2{%i)R@dwXKL$x|S>nNIq`A-c0k;1(<LQHARpu&=#5(SO>@6A8~0C}67%eYJ8|
zbax`A+UV}YE_~7pW)whhmt9;z3Grt64$+hL2s`Rc0ANMDKU7#!p-UfZC2U7ItbsxZ
za2@~_2Mw#iAQKy!%3xhyb7v-SlOgS)wN7EQDvLVC*YA_~y0wx31{VK=#Mg78@uSkZ
zwHk7*KQAkZIjy%!aVvIT)hW?_iWqB5S?~<2BiI|*-xv14pLD^ubYb$zQjya296LXS
zz;8`I!X~VCU|Pvm7_m&&GVsKrh<$qb!$jPJr5VoiLP4<#zy)OBquo7#Q|RL&wHuUl
zaiTv5L?Y7U^wg8a11;)fNw)+Bsg+zj0!pr%i_^}!L_rBcFAQlmy|{L9*AgV7MaVMm
zt|johop2b`jGarw8SQ*;v}6Ez`LGX{PR2b13hcc71X~#FoA6Cs2s3ib%R;k^Q`QAu
z4{2jLc!jWs*&I^=Qj7+&VG%6y&AF@b57x_d+&q8?q3A3<6LN_zw@nr>UTFdZY!7|K
zE~Jeqcv}H-1+WXPvUWu-`&Y>|FQmH)OL=ZYic(8V@c-+{<Tt>-LALl|zr)?K$Gq$j
zCPK`1t~zxIipIA~Eo0^hs{{m(8tbjVPLNy*;mI8@63@#1ncX5oK+Vk<?c;xK0Du~s
zAiSpsGkDD%(^0(a!m}?45`k{nGiQ=8PZq&M1XLQOaG)AD@}Vl(+Lt9T)dFi~An=S=
z3uUaZFHQYmiCs|=5Hfh{;lSJ!Z!+0+w3lGUnRZ(6@md1C7#&;G$v(CTKm0?Jn`2;S
zuI^{2V3p8;O7cB=w}l*smta-AAOiQ5?6aeHi&5*JIrn|7wQsqPO*GI5Q{dxQAYryJ
zW*=YAS>NqNGaEi;!8j8Zj2k%<$JcE&?s;;@*YS!;j<4hHRyn?o&x7Rnx&y<#C7i<N
z@%0>_@{oP%_&S?KxUhBHI==o!zEaTcg~g?Iy(l+$;xj*7`pWI@7hnnn|CoGCaVPp=
zSMkC%bzyHnmY$A%rD@(f7+<9p4;5#mAnph~oP~nsNFiS(Kn)RZc5nwgx-ygT=S8%e
z<Rxk<crnnRr!v=P)|44#8ql@O?nqNVN^$-4v`)5=?Q6DZb34-50LO;dbX0)X>cKCs
z)-0P*!4p@nn;362RkMnJhR3fRs1Fa|B6i$2y%GQKgtfy1jj%becC;Gef^gi?j@(c+
zT#xI-LtZjIh+D%$xzM|z*5aQ2bIxf_O;#JKxv_~G-3LaOzWVH?V-tfLM^OgQ%7Pl5
zm>AhO2>`e;-`;v(9kkbi^PcvB$|NqpuU974SDKq96!A%cqhoBKxo!w_;0pB+|67Z2
zu)2PDe7MQ~W61h(Rpl-2q?#AYyQ{_<>jp+61Zr({eBBU+H~3197}vC`jg2b04O%kQ
zKsZ?+z83#$gi!bbUWCI9kczwL!;KB$#PE0nH^9dPxQ>m<>N+*Kajm-IvNcy!t~3|E
zdDZ1=)mtvT<l<EqUr|}P#$2v0z2vG@mt9`DWOe0=t1gkc%dS}U#>!P|-gw3NYR$!0
zth(%Cb7AH3KQtGvQUup{Rm8_vz548m<70*Y+YZQLV5;%T=2^?t;_->lR=rHA*D0l5
zk6#AAB7UE9>6Lh%jb9GGhwyua`<;O&e~-G~K|J}3{@Rh?PkDYOo6~tF3BzX*e&=rK
zS9|{b8S2GTA6K{Ba*I0hkB_Q<KKdPX=zslMJ@Ld7N~6seG%0EQMfruN<;wye7WhEx
zSkQw7J@~hv2d$Z4A+^AP1r985V1WY*99ZDM0tXg2u)u)@4lHnBfddO1Sm3~O$$?dG
z{k6LE4R27pZ@pEW@$j$I!;dUgkNosc)pUJCy$Fax{J1Bqve+la<}rVVu))jcG<JP2
zWj!`?cVgpr6y>{+pT_fi<R9lo@Cp8oqMkqY--_oi0At4GS2%cYME^n5zXeaWdFUkJ
zkrw_UcxM3y^ADVWmSi#a$-j!<UbH7p(#O7}@9$lHu`9a)&)@V%cz5DA8(u`;$@ISs
zjfnq`f&WF|0cqmc2!rq={ym8NZ~9|<!XQ0=<@$3x%o7Le??amTFXQ)G<XLt;ena?e
z#%~*br{eb_{L1)gz5~FMf4_Er(fffYKl_<%JG+i~;=BOA|KOg?&;IL1!D+6LPx6U>
z7)HEjDg}xB!d_}oShB!}1wK#_7W8025B@FafjGT|e-=2fz<~u0EO20f0}C8j;J^Y0
t7C5lLfdvjMaA1K03mkaPIdByq^2fgqV^5dAyYTxGe%zDi-aenq|37$f4bA`n

literal 0
HcmV?d00001