# audit-form-a — Milestone close (Form-A as the default authoring surface)

**Date:** 2026-05-13
**Audited range:** aabcadc (iter form-a.0) .. 9fdc4ca (iter form-a.1 T6-12) HEAD
**Spec:** `docs/specs/2026-05-13-form-a-default-authoring.md` (amended at 9fcda8b)
**Status:** drift_found (4 items, all documentary-only); bench clean (exit 0 across all three scripts)
**Recommendation:** carry-on — no form-a.tidy queued at architect's explicit recommendation; drift items deferred to documentary cleanup at next opportunity.

## What holds (architect-verified)

- DESIGN.md §"Roundtrip Invariant" restated correctly: four numbered
  properties (parse-determinism + idempotency-under-print + CLI-
  pipeline-idempotency + carve-out-anchor) replace the prior
  Direction-1/Direction-2 framing; five surviving enforcement tests
  named verbatim (parse_is_deterministic_over_every_ail_fixture,
  parse_then_print_then_parse_is_idempotent_on_every_ail_fixture,
  cli_parse_then_render_then_parse_is_idempotent,
  every_ast_variant_is_observed_in_the_fixture_corpus,
  examples_ail_json_inventory_matches_carve_outs). §"Float literals"
  + §"Why anchored at top level" preserved.
- §A4 doctrine rewording landed verbatim per spec at CLAUDE.md:5-6
  + DESIGN.md:465-466 (canonical form = JSON-AST; authoring projection
  = `.ail`; "Form (A) is one projection; the JSON-AST stays canonical"
  preserved as the second sentence).
- Carve-out inventory matches the eight-file spec post-amendment:
  `ls examples/*.ail.json | wc -l` returns 8, alphabetical order
  `broken_unbound + prelude + 3× test_22b2_* + 3× test_ct1_*`.
  `crates/ailang-core/tests/carve_out_inventory.rs::EXPECTED`
  hardcodes the same eight entries.
- 156 non-carve-out `.ail.json` deleted; 157 `.ail` files present
  (98 fresh-rendered in iter form-a.1 T2 + 58 pre-iter + the
  prelude pilot from form-a.0). No regressions in
  `cargo test --workspace` (557 green + 3 ignored).
- WhatsNew milestone-close entry editorial-clean per /boss
  convention: English, no crates / iter-codes / agent names, leads
  with the change, factual tone, telegram-pragmatic length.
- Roadmap milestone struck `[x]` with closing attribution
  `(Closed 2026-05-13 by iter form-a.1.)`; follow-up milestone
  `[Prelude embed: Form-A as compile-time source]` present with
  motivation + problem + three resolution options.
- Per-iter journals (`2026-05-13-iter-form-a.0.md`,
  `2026-05-13-iter-form-a.1.md`) both present; `INDEX.md` carries
  both lines in chronological order.

## Drift items (deferred per architect recommendation)

| Severity | Path | Issue |
|----------|------|-------|
| medium | `docs/specs/2026-05-13-form-a-default-authoring.md` (§C1, §C2, §"Data flow") | Three sites still say "seven carve-outs" post-amendment; acceptance #1/#2 correctly say eight. Spec self-inconsistent against its own amendment commit 9fcda8b. |
| medium | `docs/plans/2026-05-13-iter-form-a.1.md` (two sites) | Same "seven carve-outs" wording surviving the amendment; harmless now but contradicts the eight-file reality the plan executed. |
| low | `crates/ailang-core/src/hash.rs:57` | Empty `mod tests {}` placeholder left after iter form-a.1 T5 relocation. Documentary-only today; drift if it stays past one further milestone. |
| low | `crates/ailang-surface/tests/round_trip.rs:16` | Module docstring still says "Direction 2 of the Roundtrip Invariant", but DESIGN.md T10 retired the Direction-1/Direction-2 framing. Stale cross-reference to a renamed concept. |

All four items are documentary-only: the spec / plan orphans
contradict their own post-amendment sections but do not affect the
shipped implementation (which is eight-carve-out-correct); the
hash.rs placeholder and the round_trip.rs docstring are cleanup
hygiene that does not change behaviour or invariants.

Architect's explicit recommendation: "carry on as planned. Queue a
documentary `form-a.tidy` only if a subsequent reader hits the
seven-vs-eight orphans; the implementation is correct and the spec
orphans are post-hoc retro-clean-up, not active drift." The audit
follows this recommendation.

## Bench-regression report

All three bench scripts exit 0; baseline left pristine.

### `bench/check.py` (exit 0)

63 metrics; 2 regressed-by-magnitude, 2 improved-by-magnitude, 59
stable. Regressions both on `max_us` tail-latency metrics:

- `latency.explicit_at_rc.max_us` +124.99% (tol 25%) — paired with
  `latency.explicit_at_rc.p99_us` *improvement* −27.02%.
- `latency.implicit_at_rc.max_us` +126.13% (tol 30%).

This is the 12th consecutive audit observation of the metric-
identity-migrating noise envelope on tail-latency metrics, dating
back to audit-cma (2026-05-12). The pattern across the lineage:
different metric identifiers fire each run, magnitudes oscillate,
median + p99 stay stable; the firing-metric set has migrated
through approximately a dozen distinct identifiers across the
twelve audits. The convention since the audit-cma originating
observation is to hold the baseline pristine — the metric-migration-
between-runs is itself attribution evidence that the cluster is
noise-class, not signal-class. The queued P3 latency-methodology-
histogram rework is the right ratification path; --update-baseline
is not.

The form-a milestone is intentionally test-infra + corpus migration,
not language semantics. Zero language-semantic surface was touched.
The tail-latency regressions are not caused by the migration; they
are the noise envelope continuing.

### `bench/compile_check.py` (exit 0)

24 metrics; 2 regressed-by-magnitude, 0 improved, 22 stable.

- `check_ms.hello` +32.44% (tol 25%) — 1.2ms → 1.5ms.
- `check_ms.borrow_own_demo` +26.18% (tol 25%) — 1.3ms → 1.7ms.

Both on the smallest fixtures in the corpus where `check_ms` is
sub-2-millisecond. iter form-a.1 T6 journal already flagged this:
"First compile_check run reported exit-1 due to sub-millisecond
`check_ms` noise on `hello` and `borrow_own_demo`; second run
clean." Now both still fire at the current audit re-run. This is
sub-millisecond timing-jitter, not a migration-induced regression.
The migration touched only fixture file extensions and test-loader
call sites; the `ail check` binary path was not modified.

### `bench/cross_lang.py` (exit 0)

25 metrics; 0 regressed, 0 improved-beyond-tolerance, 25 stable.
Cross-language ratios (AILang RC / AILang bump / C reference) all
hold within tolerance. The most interesting movement is
`bench_tree_walk.rc_over_c` from 2.7394 to 2.5871 (−5.56%) — a
modest improvement still inside the noise envelope.

## Recommendation summary

| Item | Recommendation |
|------|----------------|
| 4 architect drift items | carry-on (per architect's explicit recommendation; documentary-only) |
| `bench/check.py` 2 regressions | noise-envelope continuation (12th audit); baseline pristine |
| `bench/compile_check.py` 2 regressions | sub-millisecond timing-jitter; baseline pristine |
| `bench/cross_lang.py` clean | no action |

No `form-a.tidy` iter is queued. The four documentary drift items
are recorded here for future-reader visibility; they will be
addressed inline at the next iter that touches the affected files,
or in a dedicated cleanup pass if a subsequent reader hits them.

The form-a-default-authoring milestone is fully closed.

## Next-step pointer

Per `/boss` and the milestone-close pipeline: the next milestone
candidate at the top of the roadmap is `[Retire io/print_int/_bool/_float]`
(P2, post-milestone-24 mechanical follow-up). The `[Prelude embed:
Form-A as compile-time source]` milestone is the second P2 entry,
queued behind the io/print retire. Starting either is a `/boss`
bounce-back per the new-milestone rule — the Boss surfaces the
candidate and the user picks the session shape.
