feat(website): JavaScript joins the spec tab, and the corpus finally gets measured

[gHashTag]

What this adds

JavaScript is now a target language in the spec tab, beside the five that were
already there, backed by the gen-js backend landed upstream as
gHashTag/t27#4472.

The number that will look alarming, and why it is not

Refreshing the vendored compiler moved the published health counters:

	before	after
ok	1002	975
warn	399	100
fail	6	338

The cause is the instrument, not the corpus. The wasm served here until now
was built from no committed source, and it accepted anything. Fed
bootstrap/tests/fixtures/damage/damage_class_01.t27 — a fixture this
repository damages on purpose, with an unterminated string literal — it
answered tc.ok=true and emitted C, Rust, Verilog and Zig. The binary now
served is built from bootstrap/src; on the same bytes it refuses all six
backends and names the line (unterminated string literal opened at line 8:17).

Most of the movement is warn becoming fail, not working specs breaking.
And 145 of the 338 are not t27 at all:

class	count
gen-js declining by design (non-literal initialiser)	122
Zig source carrying a .t27 extension	68
older spec Name { } dialect	49
damage fixtures, meant to fail	23
Markdown prose carrying a .t27 extension	14

The largest class parses, typechecks and emits five other languages — gen-js
is declarations-only and says so by name.

The qualifier is published, not footnoted

HEALTH_FAIL_JS_ONLY is a new spec constant computed from the manifest by the
generator, not typed in, and bound to HEALTH_FAIL by two of the spec's own
asserts. It cannot drift away from the number it qualifies, and a reader who
meets 338 cannot miss what it is made of.

The rename is two changes, both correct

git pairs them by similarity; they are unrelated:

• public/t27/files/specs/catalog/onboarding.t27 was a vendored copy of a file
  gHashTag/t27 no longer has — upstream's specs/catalog/ holds only
  discovery.t27 (verified against the API, not assumed).
• specs/catalog/onboarding.t27 — the source onboarding-from-spec.mjs and
  check:onboarding have always read — was untracked, so a fresh clone
  could not have run the gate that guards it.

Gates

20 gates re-run on this exact base, all PASS: check:agents check:tools
check:docs check:viewport check:onboarding check:discovery
check:spec-catalog check:shared-core check:queen-atlas check:passport
check:skills-catalog check:crons-catalog check:tools-site
test:agents-specs test:docs-specs test:viewport-spec test:sync-skills
test:sync-crons check:render check:api. Build rc=0.

Stated plainly rather than left to be found

• The sync's provenance-preservation code has still never run end-to-end.
  The on-disk manifest was repaired out of band, so that path is unexercised.
• check:queen-cycle, check:queen-factory, check:queen-review and
  check:queen-honesty are red — and byte-identically red at origin/main.
  Compared against a pristine worktree at HEAD, the failing line sets match
  exactly (1, 5, 0 and 2 lines). Nothing here touches them.
• Two vendored docs still name the old mirror path. They are byte-identical to
  gHashTag/t27 master, so that fix is an upstream PR, not a hand-edit here.

🤖 Generated with Claude Code

{
  "version": 1,
  "head_sha": "f0e776aba8622bb8b3bb2dcc80afd60089c6d617",
  "summary": "JavaScript becomes a sixth target language in the spec tab, and refreshing the vendored compiler moves the published corpus-health counters because the previous binary accepted files it should have refused.",
  "changes": [
    "The spec tab offers JavaScript beside the five existing targets, backed by the gen-js backend landed upstream as gHashTag/t27#4472.",
    "The vendored t27_compiler.wasm is rebuilt from bootstrap/src instead of from no committed source, so it reports parse failures rather than emitting from them.",
    "Published health counters are re-measured: ok 1002 to 975, warn 399 to 100, fail 6 to 338, with most of the movement being warn reclassified as fail.",
    "A new HEALTH_FAIL_JS_ONLY constant is computed from the manifest by the generator and bound to HEALTH_FAIL by two of the spec's own asserts, so the qualifier cannot drift from the number it qualifies.",
    "The stale vendored copy of onboarding.t27 is dropped because gHashTag/t27 no longer carries that file, and the real source at specs/catalog/onboarding.t27 is tracked for the first time.",
    "The root CLAUDE.md worked example now names the source path the generator actually reads rather than the vendored copy of it.",
    "Generated artifacts are regenerated along the whole dependency chain: shared-core, universe-atlas and manifest, plus the agents and llms surfaces."
  ],
  "tests": [
    {
      "command": "npm run check:onboarding",
      "result": "Passes and writes both surfaces byte-identically from the spec",
      "status": "passed",
      "evidence": "public/agents.t27 and public/llms.txt, 16989 bytes each, spec sha256 9bd5b1d06500c083, spec tests 9, asserts 44, all hold"
    },
    {
      "command": "npm run check:spec-catalog",
      "result": "Passes after the generated chain was rebuilt in order",
      "status": "passed",
      "evidence": "Reports 1413 exact source links; it failed first on a stale universe-atlas and needed core index, rescan, then build"
    },
    {
      "command": "A/B of identical bytes through the old and new wasm binaries",
      "result": "The old binary compiled a deliberately damaged fixture",
      "status": "passed",
      "evidence": "On bootstrap/tests/fixtures/damage/damage_class_01.t27 the old binary reported tc.ok=true and emitted C, Rust, Verilog and Zig; the new one refuses all six backends with unterminated string literal opened at line 8:17"
    },
    {
      "command": "Twenty website gates re-run on this exact base",
      "result": "All twenty pass, and the production build succeeds",
      "status": "passed",
      "evidence": "check:agents, check:tools, check:docs, check:viewport, check:onboarding, check:discovery, check:spec-catalog, check:shared-core, check:queen-atlas, check:passport, check:skills-catalog, check:crons-catalog, check:tools-site, check:render, check:api and five test targets; build rc=0"
    },
    {
      "command": "Differential run of the four red queen gates against a pristine worktree at HEAD",
      "result": "Failing line sets are identical, so they predate this branch",
      "status": "passed",
      "evidence": "check:queen-cycle 1 line, check:queen-factory 5 lines, check:queen-review 0 lines, check:queen-honesty 2 lines, byte-identical in both trees"
    },
    {
      "command": "Secret scan over the newly vendored configuration files",
      "result": "Zero matches across all four vendored files",
      "status": "passed",
      "evidence": "Pattern covering sbp_, ghp_, sk-, pplx-, eyJ, AKIA and long opaque strings returned no hits in .mcp.json, .claude/mcp.json, the tri-ssot manifest and fleet_seed.json"
    },
    {
      "command": "The sync provenance-preservation path",
      "result": "Never exercised end to end in this change",
      "status": "not_run",
      "evidence": "The on-disk manifest was repaired out of band, so the code that is supposed to preserve provenance during a sync has still not been observed running"
    }
  ],
  "limitations": [
    "The sync's provenance-preservation code has still never run end to end; the manifest it would have produced was repaired out of band instead.",
    "Documentation Consistency is red here and has been red on main since at least 2026-09-06, because it asserts that src/hslm/tjepa.zig exists when that file is absent on main as well.",
    "Four queen gates are red and byte-identically red at origin/main, verified against a pristine worktree rather than assumed.",
    "Two vendored documents still name the old mirror path; they are byte-identical to gHashTag/t27 master, so correcting them belongs in an upstream pull request rather than a hand edit here.",
    "The 338 figure counts 145 files that are not t27 at all, including Zig source and Markdown prose carrying a t27 extension, which is a corpus hygiene problem this change measures but does not fix."
  ],
  "tags": ["t27", "compiler", "javascript", "measurement"],
  "blog": {
    "title": "When the compiler started reading the files it had been approving",
    "summary": "Adding JavaScript as a sixth target meant rebuilding the vendored compiler, and the rebuilt binary refused files its predecessor had happily compiled. The count of failing specs went from 6 to 338 without a single spec changing.",
    "outline": [
      "The task looked small: add a sixth backend to the spec tab so JavaScript sits beside C, Rust, Verilog, Zig and the ternary HIR target.",
      "Rebuilding the vendored wasm from actual committed source, rather than serving a binary whose provenance nobody could name, was supposed to be housekeeping.",
      "The published health counters then moved hard, and the honest first reaction was that the new compiler had broken three hundred specifications that used to work.",
      "Feeding identical bytes through both binaries settled it: a fixture damaged on purpose, with a string literal left open, compiled cleanly to four languages under the old one.",
      "A compiler that answers typecheck ok for a file it never parsed is not a lenient compiler, it is an instrument reporting a measurement it did not take.",
      "Decomposing the 338 showed that 145 of them are not t27 source at all, but Zig files, Markdown prose and an older dialect, all wearing the same file extension.",
      "The largest single class is a backend declining by design, because a declarations-only emitter has nothing to say about a constant whose initialiser is an expression.",
      "Publishing a frightening number without its decomposition invites the wrong reading, so the qualifier became a constant the generator computes and the spec asserts against."
    ]
  }
}