feat(website): t27 world discovery -- scan GitHub for every public repository that writes .t27 and vendor it into the catalog

[dmitrii-f-t27]

The catalog behind #/specs and the Queen map (/#/queen, "All repositories · shared map") knew five repositories, each typed into apps/website/scripts/sync-t27-specs.mjs by hand. gHashTag/trios (71 .t27 files) sat in the same owner's public inventory unnoticed, and dmitrii-f-t27/trinity-memory (37, the memory specs whose tmem contracts landed in gHashTag/t27#3562) belongs to another owner, so no list would have found it; the "＋ Repository" dialog only saves a map on one device. This PR makes the scan a program with a contract, and runs it on a schedule.

Related to #988 (the audit there reads the Queen snapshot: 760 entries, five contributors — "observed snapshot data, not live GitHub counts"). Do not merge without the owner's approval. Deploy stays manual (deploy-site.yml).

What

Contract, as a .t27 spec (no owner, limit or exclusion typed twice)

• public/t27/files/specs/catalog/discovery.t27, module catalog_discovery: OWNERS (gHashTag, dmitrii-f-t27), CODE_SEARCH extension:t27 + pages, PUBLIC_ONLY, SKIP_FORKS, SKIP_ARCHIVED=false, MIRRORS (ghashtag.github.io is build output), FOUNDING (the five hand-vendored sources the scan never rewrites), PROBE_FILES 8, MIN_DECLARATIONS 1, limits. 5 test blocks / 18 asserts. The script reads it through the vendored wasm, checks the schema (checkSchema), refuses non-ASCII, a dropped item, a wrong module, and evaluates the tests (runSpecTests) before the first GitHub call.

Scan → vendor

• scripts/discover-t27-worlds.mjs scan --out NEW.json: owner inventories (users/<owner>/repos, identity checked against html_url/owner.login), GitHub code search hits as extra candidates (best effort; status recorded), default-branch tree per candidate (.t27 blobs, .git/.claude worktree copies and files over MAX_FILE_BYTES set aside), then up to PROBE_FILES files compiled with the vendored wasm, spread evenly over specs/ paths first, stopping at the first that qualifies. A repository qualifies only when a probed file yields a declaration (fn/struct/enum/const/type/test/invariant/bench): the compiler accepts any text as an empty module, so "it compiles" proves nothing — code search returned 2 244 hits in 10 repositories, all licence texts and perf logs named .t27, all rejected. Spread sampling, not the first three: trinity-fpga's first three specs by name parse to empty modules under the vendored compiler (newer syntax), while 26 of its 64 do not.
• scripts/discover-t27-worlds.mjs vendor --report X: tarball at the scanned commit, byte-level dedup against the catalog (tt-trinity-euler/phi are 49/49 duplicates of chips/ and leave no record; gamma differs in one file), files under public/t27/files/<name>/ (gHashTag, the founding convention) or <owner>/<name>/ (any other owner — two owners with one repository name cannot collide), manifest merge that replaces the world's previous entries and leaves every other entry byte for byte. Refuses a founding source, a stale contract (report sha ≠ spec sha), a duplicate path.
• scripts/t27-corpus.mjs: describe/deriveTags/summarise/entry/aggregates/RU-audit exceptions moved out of sync-t27-specs.mjs so both writers derive an entry the same way. The old and new sync were run on the same input (t27 @ bff21b85, T27_SKIP_REMOTE=1): manifest, files and qa/language-exceptions.json byte-identical.
• scripts/universe-atlas.mjs scan: repeated --owner, --discovery report.json (owners come from the contract; the atlas carries discovery.worldScan), and every catalog source outside the owner inventories is read on its own — the atlas refuses a spec whose repository is not a world.
• src/lib/sharedSpecCore.ts: sourcePath strips <owner>/<name>/ as well as <name>/ (the indexer sha changes; core and atlas rebuilt).

Schedule

• .github/workflows/t27-world-scan.yml: daily (17 3 * * *) and on dispatch. scan → vendor → core index → skills/agents/docs generators (they pin the manifest sha) → atlas scan → atlas build → gates → commit, the way signal-health-self.yml commits its numbers. Public reads only, github.token. Never publishes: deploy-site.yml stays the manual, approved step.
• website-checks.yml: npm run check:discovery on every PR.

QA

• qa/t27-world-discovery.mjs (new, in website-checks): contract loads and its tests hold; a failing spec assert, a bare ; before module, a wrong module are problems; identity (foreign html_url, owner mismatch) rejected; verdicts (private/fork/mirror skipped, archived kept, founding reported-not-vendored); tree filter; spread probe; licence/JSON/empty text = 0 declarations, hello_world and this contract qualify; prefixes; merge (order, aggregates, replace-on-refresh, input not mutated, founding refused, path outside prefix refused); the workflow runs the steps and touches no deploy token.
• qa/queen-catalog-hive.mjs and qa/spec-catalog-contract.mjs derived their pins (760 specs, 5 repos, 68 trinity-fpga issues) from the manifest/atlas instead of freezing a snapshot; the five founding repos must still be on the map. qa/queen-continuous-map.mjs: the readability bound is an equality at 390×300 and floating point landed 3·10⁻¹⁴ px under it once the field held eight repositories — tolerance 10⁻⁶ px.

UI: the atlas scope panel (?view=atlas → details) shows the scan: owners and the count of repositories with .t27 specs, EN/RU.

Measured (scan of 2026-09-12, report in the atlas discovery.worldScan)

	before	after
repositories on the map	5	8 (trios 58 specs after 13 duplicates, trinity-memory 37, tt-trinity-gamma 1)
catalog specs (distinct bytes)	760	856
open issues in the snapshot	651	1 030
owners	1	2
candidates inspected	—	121 (gHashTag 107, dmitrii-f-t27 14) + 10 from code search; skipped: 27 forks, 1 mirror, 83 without .t27, 4 without a declaration

Founding five untouched (t27 575, tri-net 113, trinity-fpga 64, trinity 3, tt-trinity-corona 5), hello_world still featured.

Verification

check:discovery         PASS (contract 5 tests / 18 asserts, owners gHashTag, dmitrii-f-t27, 3 scanned worlds)
check:spec-catalog      PASS (856 exact source links, identity, SHA pinning, fail-closed paths, embedded Explorer)
check:queen-catalog     PASS (856 real specs, 8 contributing repos, exact source edges, no fake issue identity)
check:queen-continuous  PASS (8 repositories, 1030 distinct issues, 856 specs, picking + non-overlap + stable updates)
check:queen-spec-mirrors PASS (856 canonical specs, 856 source placements)
check:queen-atlas, check:shared-core, check:queen-worlds, check:skills-catalog, check:crons-catalog,
check:agents, check:tools, check:docs, check:viewport, test:viewport-spec, check:queen-languages,
check:explorer-languages, check:api, check:aria, check:silicon, check:clients-console,
typecheck:ratchet, test:sync-skills, test:sync-crons, test:agents-specs, test:docs-specs   PASS
vite build              ok; /#/queen served from dist: 8 REPOSITORIES · 856 .T27 · 1030 ISSUES

What this does not do

• It does not refresh the five founding sources. They come from a local t27 checkout through sync-t27-specs.mjs, and that checkout carries the teaching course (specs/tutorial, hello_world) on a branch that is not on t27 master (checked at 28652b3): a re-vendor from GitHub alone would delete it from the site. t27 master holds 940 .t27 today against 575 vendored; that refresh remains the owner's manual step until the course lands.
• The vendored compiler is the one from t27 1cd2877f9; 33 of trinity-memory's 37 and 38 of trinity-fpga's 64 specs read as warn under it (newer syntax dropped by recovery). Health is what that wasm says, no more.
• Code search is a hint, not the inventory: the index did not contain trinity-memory at all. Owners outside OWNERS reach the map only if code search indexes them and the probe agrees.
• Daily commits of universe-atlas.json (~780 KB) whenever an issue title changes. If that churn is unwelcome, weekly is one line in the cron.

Dmitrii Fedorov (@dmitrii-f-t27)