iter rt.1: roundtrip-invariant audit tests — 3 new tests, all PASS first-shot

Three new reader-only tests pin the .ail.json / .ailx bijection
plus AST-variant coverage. All three passed first observation
across the current corpus — no roundtrip, schema-coverage, or
CLI-drift gaps surfaced.

- every_ailx_fixture_matches_its_json_counterpart (replaces the
  3-pair handwritten exhibits): 57 paired .ailx fixtures pass.
- every_ast_variant_is_observed_in_the_fixture_corpus (new): 34/34
  AST variants exercised across 136 fixtures; exhaustive matches
  without _ wildcard so AST drift fails the build.
- cli_render_then_parse_preserves_canonical_bytes_on_every_fixture
  (new): 136 fixtures round-trip through ail render → tempfile →
  ail parse with BLAKE3 identity on canonical bytes.

No production code, no DESIGN.md changes (those follow in later
iterations). Tests are pure readers of the repo per spec
acceptance #7 — tempfile crate added as workspace dep for the CLI
roundtrip's intermediate file outside the repo.

crates/ailang-surface/tests/round_trip.rs

@@ -1,17 +1,21 @@
 //! Round-trip gate for the form-(A) projection.
 //!
-//! For every `examples/*.ail.json` fixture, this test:
+//! Two complementary checks over `examples/`:
 //!
-//! 1. Loads the original module via `ailang_core::load_module`.
-//! 2. Prints it with `ailang_surface::print`.
-//! 3. Re-parses the printed text with `ailang_surface::parse`.
-//! 4. Canonicalises both modules and asserts byte-equal canonical JSON.
+//! 1. `print_then_parse_round_trips_every_fixture`: for every
+//!    `examples/*.ail.json` fixture, load → `print` → `parse` →
+//!    canonical bytes; assert byte-equal to original.
 //!
-//! In addition, the three hand-written exhibits (`hello.ailx`,
-//! `box.ailx`, `list_map_poly.ailx`) are parsed and asserted to produce
-//! canonical JSON identical to their corresponding `.ail.json`
-//! fixtures. This is the human/AI authoring ground-truth check that
-//! the form is writeable without going through the printer.
+//! 2. `every_ailx_fixture_matches_its_json_counterpart`: for every
+//!    `examples/*.ailx` fixture, parse → canonical bytes; if a
+//!    same-stem `.ail.json` counterpart exists, assert canonical-byte
+//!    equality against it. The `.ailx` side is the human/AI authoring
+//!    ground-truth — fixtures must be writeable without going through
+//!    the printer and still match the JSON-AST.
+//!
+//! Both tests gather fixtures dynamically via `read_dir`; no hardcoded
+//! lists. The tests are pure readers — they do not write into the
+//! working tree.
 
 use std::path::{Path, PathBuf};
 
@@ -90,44 +94,105 @@ fn round_trip_one(path: &Path) -> Result<(), String> {
     Ok(())
 }
 
-#[test]
-fn handwritten_exhibits_match_json_fixtures() {
+fn list_ailx_fixtures() -> Vec<PathBuf> {
     let dir = examples_dir();
-    let pairs: &[(&str, &str)] = &[
-        ("hello.ailx", "hello.ail.json"),
-        ("box.ailx", "box.ail.json"),
-        ("list_map_poly.ailx", "list_map_poly.ail.json"),
-    ];
-    let mut failures = Vec::new();
-    for (ailx, json) in pairs {
-        let ailx_path = dir.join(ailx);
-        let json_path = dir.join(json);
-        let text = std::fs::read_to_string(&ailx_path)
-            .unwrap_or_else(|e| panic!("read {}: {e}", ailx_path.display()));
-        let parsed = match ailang_surface::parse(&text) {
-            Ok(m) => m,
+    let mut paths: Vec<PathBuf> = std::fs::read_dir(&dir)
+        .unwrap_or_else(|e| panic!("read_dir({}): {e}", dir.display()))
+        .filter_map(|entry| entry.ok())
+        .map(|e| e.path())
+        .filter(|p| {
+            p.file_name()
+                .and_then(|n| n.to_str())
+                .map(|n| n.ends_with(".ailx"))
+                .unwrap_or(false)
+        })
+        .collect();
+    paths.sort();
+    paths
+}
+
+#[test]
+fn every_ailx_fixture_matches_its_json_counterpart() {
+    let fixtures = list_ailx_fixtures();
+    assert!(
+        !fixtures.is_empty(),
+        "no .ailx fixtures found under {}",
+        examples_dir().display()
+    );
+
+    let mut failures = Vec::<String>::new();
+    let mut paired = 0usize;
+    let mut parse_only = 0usize;
+
+    for ailx_path in &fixtures {
+        let text = match std::fs::read_to_string(ailx_path) {
+            Ok(t) => t,
             Err(e) => {
-                failures.push(format!("{ailx}: parse failed: {e}"));
+                failures.push(format!("{}: read failed: {e}", ailx_path.display()));
+                continue;
+            }
+        };
+        let parsed = match ailang_surface::parse(&text) {
+            Ok(m) => m,
+            Err(e) => {
+                failures.push(format!("{}: parse failed: {e}", ailx_path.display()));
+                continue;
+            }
+        };
+
+        // Same-stem counterpart lookup. `<stem>.ailx` → `<stem>.ail.json`.
+        let stem = ailx_path
+            .file_name()
+            .and_then(|n| n.to_str())
+            .and_then(|n| n.strip_suffix(".ailx"))
+            .unwrap_or("");
+        let json_path = ailx_path.with_file_name(format!("{stem}.ail.json"));
+
+        if !json_path.exists() {
+            // Spec: parse success alone is sufficient for `.ailx` files
+            // without a JSON counterpart. (Today: none expected.)
+            parse_only += 1;
+            continue;
+        }
+
+        let original = match ailang_core::load_module(&json_path) {
+            Ok(m) => m,
+            Err(e) => {
+                failures.push(format!(
+                    "{}: load_module({}) failed: {e}",
+                    ailx_path.display(),
+                    json_path.display()
+                ));
                 continue;
             }
         };
-        let original = ailang_core::load_module(&json_path)
-            .unwrap_or_else(|e| panic!("load {}: {e}", json_path.display()));
         let bytes_orig = ailang_core::canonical::to_bytes(&original);
         let bytes_parsed = ailang_core::canonical::to_bytes(&parsed);
         if bytes_orig != bytes_parsed {
             let s_orig = String::from_utf8_lossy(&bytes_orig).into_owned();
             let s_round = String::from_utf8_lossy(&bytes_parsed).into_owned();
             failures.push(format!(
-                "{ailx} vs {json}: canonical bytes differ.\noriginal: {s_orig}\nparsed:   {s_round}"
+                "{} vs {}: canonical bytes differ.\noriginal: {s_orig}\nparsed:   {s_round}",
+                ailx_path.display(),
+                json_path.display()
             ));
+            continue;
         }
+        paired += 1;
     }
+
     if !failures.is_empty() {
         panic!(
-            "{} hand-written exhibit(s) failed:\n{}",
+            "{} of {} .ailx fixture(s) failed cross-check (paired ok: {}, parse-only: {}):\n{}",
             failures.len(),
+            fixtures.len(),
+            paired,
+            parse_only,
             failures.join("\n\n")
         );
     }
+    eprintln!(
+        ".ailx cross-check ok ({} paired, {} parse-only)",
+        paired, parse_only
+    );
 }