diff --git a/apps/website/package.json b/apps/website/package.json
index a8762414a3..100b3aa939 100644
--- a/apps/website/package.json
+++ b/apps/website/package.json
@@ -114,6 +114,7 @@
     "test:docs-specs": "node --test scripts/docs-from-specs.test.mjs",
     "check:viewport": "node scripts/viewport-from-spec.mjs --check",
     "check:onboarding": "node scripts/onboarding-from-spec.mjs --check",
+    "check:t27f": "cd public/t27f/graph && grep -v '^#' t27f.build | shasum -a 256 -c -",
     "gen:ci-triggers": "node scripts/ci-triggers-from-spec.mjs",
     "check:ci-triggers": "node scripts/ci-triggers-from-spec.mjs --check",
     "test:onboarding-spec": "node --test scripts/onboarding-from-spec.test.mjs",
diff --git a/apps/website/public/t27f/graph/PROVENANCE.txt b/apps/website/public/t27f/graph/PROVENANCE.txt
index b2d691f7b5..d50ecd14bc 100644
--- a/apps/website/public/t27f/graph/PROVENANCE.txt
+++ b/apps/website/public/t27f/graph/PROVENANCE.txt
@@ -39,16 +39,13 @@ Built in
   (PR gHashTag/t27-mcp#13). It is built with the reel, deck, spec_graph_view,
   spec_graph_export and spec_graph_outline modules. wasm/BUILD there has the full recipe.
 
-Checksums (sha256)
-  t27f.wasm              7b2a0f0caf6eafbeefa8813e9880346fb03d99b190efc396d59d4146aafa1e60
-  spec_graph_view.mjs    6918f5075e815f182fe854b8beab0d0202f1d1a11dbb67e556e03a4875bac9d4
-  generated Zig the wasm is built from, not vendored:
-    spec_graph_view.zig    59c2c14184759efaa1c4756d31f0c0b3b037d2d4c127eeed5be8e91bb6df5bab
-    spec_graph_export.zig  5297308f1d54c2688801995d56db402809fc794a7dbe5f28ad119c5b3593ede7
-  specs/spec_graph.t27         a3dbe0ec5110c48183ebea101109598e8542bb0ffdf9e061c672162d7da03fe7
-  specs/spec_graph_view.t27    662df660969b2ebccaf99129ea8d9eb41f38ded82ff34e085cf5e07b629e3089
-  specs/spec_graph_export.t27  ef4ee24d5debc51be4a10835947c86a0211b867dd6ca97890a15198daa744728
-  specs/ui_plan.t27            383fdfb78aa13f2e48172a20e9863d91aa5147b63b1685be8e3a40667243a3f1
+Checksums
+  t27f.build, next to this file, is the record: `#` lines hold the inputs of the build (closure digest,
+  zig version, t27c sha256) and every other line is `<sha256>  <file>` for the vendored wasm, the vendored
+  view constants and the vendored specs. It is a copy of the lines of gHashTag/t27-mcp wasm/t27f.build
+  that name files kept here, produced by the rule in gHashTag/t27 specs/t27f/build.t27 (#10229), not typed by hand. Check it with
+  `npm run check:t27f` in apps/website; one changed byte names the file. (The generated Zig the wasm is
+  built from is not vendored; its checksums are in the t27-mcp record.)
 
 Reproduced on the Railway lab on 2026-10-18 from these vendored specs:
   t27c gen-js spec_graph_view.t27 gives spec_graph_view.mjs byte for byte;
diff --git a/apps/website/public/t27f/graph/t27f.build b/apps/website/public/t27f/graph/t27f.build
new file mode 100644
index 0000000000..3bac80c5f3
--- /dev/null
+++ b/apps/website/public/t27f/graph/t27f.build
@@ -0,0 +1,10 @@
+# T27F graph page: the files copied from the build in gHashTag/t27-mcp wasm/ (t27f.build there is the full record)
+# closure 92cfc99130d9ee167324acec3aa9ab3cab911a9ab7bc53c55b065ce57de18986
+# zig 0.16.0
+# t27c cb1115f6a4d713ffa24817e2b5b1eb53eacd173474e2939b3b207f3d8ae33c78
+6918f5075e815f182fe854b8beab0d0202f1d1a11dbb67e556e03a4875bac9d4  spec_graph_view.mjs
+7b2a0f0caf6eafbeefa8813e9880346fb03d99b190efc396d59d4146aafa1e60  t27f.wasm
+a3dbe0ec5110c48183ebea101109598e8542bb0ffdf9e061c672162d7da03fe7  specs/spec_graph.t27
+662df660969b2ebccaf99129ea8d9eb41f38ded82ff34e085cf5e07b629e3089  specs/spec_graph_view.t27
+ef4ee24d5debc51be4a10835947c86a0211b867dd6ca97890a15198daa744728  specs/spec_graph_export.t27
+383fdfb78aa13f2e48172a20e9863d91aa5147b63b1685be8e3a40667243a3f1  specs/ui_plan.t27