iter boehm-retirement.1 (DONE 10/10): retire the transitional Boehm GC backend

Closes Gitea #4. Removes the Boehm-Demers-Weiser conservative GC
backend wholesale across six layers in one atomic iteration. After
this iter, `AllocStrategy` has two variants (`Rc`, `Bump`),
`--alloc=gc` is rejected at CLI parse with `unknown --alloc value`,
the libgc link arm is gone, and the design ledger describes RC
(canonical) + bump (raw-alloc bench-floor) as the only allocators.

Layer-by-layer summary:

  CLI surface — `crates/ail/src/main.rs`:
    `parse_alloc_strategy` arm `"gc" => Ok(AllocStrategy::Gc)`
    removed; error wording updated to `(expected `rc` or `bump`)`;
    clap-derive `value_parser = ["gc","bump","rc"]` allowlist on
    BOTH `Build` and `Run` subcommands DROPPED so that
    `parse_alloc_strategy` remains the sole gatekeeper for the
    unknown-value diagnostic (otherwise clap shadows the runtime
    diagnostic with `invalid value 'gc' for '--alloc'`, which would
    miss the milestone-pin's stderr substring check). The
    `default_value = "rc"` stays.

  Codegen — `crates/ailang-codegen/src/lib.rs`:
    `AllocStrategy::Gc` variant + `Default` derive removed (no
    caller of `AllocStrategy::default()` existed in the workspace,
    so the trait derivation was dead). `fn_name` (spec called it
    `runtime_alloc_fn` loosely; actual identifier is `fn_name`)
    drops the `Gc => "GC_malloc"` arm. `lower_workspace` and
    `lower_workspace_staticlib` defaults flip from `Gc` to `Rc`.
    In-source negative-complement codegen test (mod tests, lib.rs:3571ff)
    retargets from `AllocStrategy::Gc` to `AllocStrategy::Bump`
    (bump also doesn't emit per-type drop fns; the test's semantic
    "no drop fns under non-RC" is preserved).

  Link branch — `crates/ail/src/main.rs:2389ff`:
    The `match strategy { AllocStrategy::Gc => { ... cmd.arg("-lgc"); ... } }`
    arm and its libgc-link block are entirely gone. The surviving
    match exhausts on `Bump` and `Rc` (Rust's exhaustiveness check
    confirms; no `error[E0004]`). Staticlib-guard diagnostic
    rewritten to drop the "shared Boehm collector" phrasing while
    preserving the prefix `staticlib (swarm) artefact is RC-only`
    verbatim (the surviving `staticlib_bump_is_rejected` test
    depends on that substring).

  Test suite — 3 pure-differential e2e tests deleted
    (`gc_handles_recursive_list_construction`,
    `alloc_rc_produces_same_stdout_as_gc`,
    `alloc_rc_matches_gc_on_std_list_demo`); 9 RC-feature tests
    stripped of their `stdout_gc` build call and differential
    `assert_eq!(stdout_gc, stdout_rc, ...)` (absolute
    `assert_eq!(stdout_rc.trim(), "<n>")` pin retained as
    correctness oracle); `staticlib_gc_is_rejected` deleted; new
    milestone-pin `crates/ail/tests/boehm_retirement_pin.rs`
    asserts `ail build --alloc=gc` exits ≠ 0 with stderr containing
    `unknown --alloc value` and `\`gc\``; `examples/gc_stress.ail`
    fixture deleted (no remaining references).

    Implementer expansion (not in plan): `iter17a_local_box_alloca`
    (in `e2e.rs`) carried an IR-shape assertion against
    `@GC_malloc`-absence as the witness for non-escaping
    allocation. After the Task-2 codegen default flip, the witness
    shifts to `@ailang_rc_alloc`-absence in escape-targeted
    positions; assertion + doc-comment updated. Property
    protected ("no heap allocation in non-escaping contexts") is
    unchanged; only the named allocator shifts.

  Bench harness — `bench/run.sh` 9→6 column compaction
    (workload + bump(s) + rc(s) + rc/bump + bump RSS + rc RSS);
    gc-arm `bench_latency_implicit_gc` build call + harness
    invocation dropped from latency block; header comment reframed
    from "GC-overhead bench harness" to "RC-overhead bench
    harness"; "Decision 10's Boehm-retirement target (1.3x)"
    rewording to "RC-overhead-vs-bump bench-health regression gate".

    `bench/check.py:62` header-sentinel changes from
    `"gc(s)" in line` to `"bump(s)" in line`; column-count check
    at `:72` flips from `!= 9` to `!= 6`; per-workload field set
    drops `gc_s`/`gc_over_bump`/`gc_rss_kb`; `ARM_LABEL_TO_KEY`
    drops the `"implicit @ gc": "implicit_at_gc"` entry.
    `bench/baseline.json` regenerated via `--update-baseline`.

    Implementer note (planner-defect): `write_new_baseline`
    iterated over the *existing* baseline's metric list when
    emitting the regenerated file, so even after parser-level
    `gc_*` removal, the fallback emitted them back into the JSON.
    Scrubbed post-update; the cleaner fix (have
    `write_new_baseline` emit only keys present in
    `parsed_throughput[workload]`) is a follow-up if the script
    becomes load-bearing for further allocator changes.

  Design ledger — `design/models/rc-uniqueness.md` excises the
    `## Dual allocator — RC canonical, Boehm parity oracle`
    section and the `Boehm-Demers-Weiser conservative GC` choice
    block + rationale + trade-offs; the per-fn-alloca section
    generalises Boehm-specific language to allocator-agnostic;
    the memory-model section's `## Choice.` paragraph reframes the
    1.3× target from "Boehm-retirement gate" to "bench-health
    regression gate".

    `design/models/pipeline.md` drops the `--alloc=gc → links libgc`
    arm of the pipeline diagram and replaces it with
    `--alloc=bump → links bump-floor`; the accompanying prose
    rewrites accordingly.

    `design/contracts/scope-boundaries.md` rewrites the
    "Memory management via Boehm conservative GC" bullet to
    describe RC + per-fn-arena present-tense; the dead reference
    to `examples/gc_stress.ail.json` (file never existed; the
    fixture only ever had a `.ail` form, deleted by this iter) is
    dropped along with the `examples/std_list_stress.ail.json`
    reference whose purpose was Boehm-only soak testing.
    `:67`'s `@printf` / `@GC_malloc` parenthetical updated.

    `design/contracts/memory-model.md:232` drops the
    "leaks like the pre-Boehm era" phrase; the RC inc/dec
    instrumentation is wired up, so the "until then" conditional
    that referenced pre-Boehm is closed.

    `design/contracts/embedding-abi.md:42-44` rewrites the
    staticlib-guard prose to drop the `--alloc=gc` clause (gc is
    now a CLI-parser-level unknown-value, not a staticlib-guard
    rejection) and reframe the swarm-safety justification around
    `--alloc=bump` (leak-only bench instrument) rather than the
    historical Boehm collector.

  Honesty pin — `crates/ailang-core/tests/docs_honesty_pin.rs`
    inverts the polarity: the present-tense Boehm-anchor assertion
    on `pipeline.md` (`:116-117`) is deleted, and four
    absence-pins are added to `design_md_has_no_wunschdenken`
    against the Boehm-zombie strings `transitional Boehm`,
    `parity oracle`, `GC_malloc`, `libgc`. The
    `design_corpus()` already includes `rc-uniqueness.md` so no
    path-list change was needed for the new pins to scan.

    `crates/ailang-core/tests/design_index_pin.rs:166` drops the
    `"pre-Boehm"` token from the protected-exception comment list
    (the phrase no longer appears in `memory-model.md` after this
    iter, so the exception is dead).

  Runtime docs — `runtime/bump.c`, `runtime/rc.c`, `runtime/str.c`
    header comments scrubbed of Boehm/`GC_malloc`/`libgc`
    references. `bump.c`'s function signature description still
    documents `void *bump_malloc(size_t)` as the bench-floor
    allocator interface, but no longer cross-references libgc.

  Example fixtures — `examples/bench_latency_implicit.ail`,
    `bench_latency_explicit.ail`, `escape_local_demo.ail`,
    `reuse_as_demo.ail`, `rc_pin_recurse_implicit.ail` doc-comment
    headers scrubbed of `--alloc=gc` / Boehm references. The
    `.ail` surface (AST) is untouched in every case; round-trip
    invariant holds (`cargo test -p ailang-surface --test round_trip`
    green).

  Skill / agent prompts — `skills/audit/agents/ailang-bencher.md`
    rewritten to use an RC-vs-bump worked example pattern for the
    hypothesis-driven bench tutorial, replacing the recurring
    "RC vs Boehm under heap pressure" example.
    `skills/implement/agents/ailang-implementer.md` Decision-10 /
    Boehm references replaced with present-tense RC-commitment
    framing.

  IR snapshots — the 5 checked-in snapshots
    (`crates/ail/tests/snapshots/{hello,list,max3,sum,ws_main}.ll`)
    regenerated via `UPDATE_SNAPSHOTS=1 cargo test -p ail --test
    ir_snapshot`. Each previously contained
    `declare ptr @GC_malloc(i64)` and (for `list.ll`) a `call ptr
    @GC_malloc(...)` invocation; post-flip the snapshots contain
    `declare ptr @ailang_rc_alloc(i64)` plus the rc inc/dec runtime
    declarations.

Spec-vs-acceptance addendum (caught at orchestrator end-report,
absorbed here rather than in a follow-up spec edit): spec §6
acceptance criteria said "Boehm-grep returns matches ONLY in
docs_honesty_pin.rs". The plan itself prescribed historical Boehm
references in 3 additional files: (a) the new milestone-pin
`boehm_retirement_pin.rs` (must literally invoke `--alloc=gc` to
assert its rejection), (b) `embed_staticlib_alloc_guard.rs` file
doc-comment historical note ("`--alloc=gc` no longer exists as a
CLI value"), (c) `embedding-abi.md:44-45` contract historical
clause ("see the Boehm-retirement iter"). All three are
prescribed; the spec's grep wording was too narrow. The four
absence-pins in `docs_honesty_pin.rs` catch the actual zombies
(Boehm-narrative re-emerging in the design ledger), which is the
substantive intent the spec was aiming at — the four extra
documented-by-design exceptions are the cost of having an
explicit milestone-pin and contract-level historical anchors.

Net delta:
  - 32 files modified, 2 new (boehm_retirement_pin.rs + stats),
    1 deleted (gc_stress.ail);
  - workspace tests: every binary `0 failed`. Pass-count delta:
    -3 net (4 e2e tests deleted, 1 new milestone-pin test added);
  - boehm-grep state: hits only in the four by-design exceptions
    documented above;
  - `bench/check.py` exit 0 against regenerated baseline;
  - CLI must-fail fixture: `ail build --alloc=gc examples/hello.ail`
    exits non-zero with stderr containing `unknown --alloc value`
    and `\`gc\``;
  - design ledger present-tense honest (Boehm-narrative gone from
    `rc-uniqueness.md` + `pipeline.md`; the few historical
    references in `embedding-abi.md` / `boehm_retirement_pin.rs` /
    `embed_staticlib_alloc_guard.rs` are explicit milestone-pins
    or contract anchors, not silent ledger residue).

Bench measurement variance noted: closure-chain and hof-pipeline
are ±1-5% jittery between runs; one regeneration flagged 2
metrics as `regressed` before a second run returned 0. The
captured baseline is within self-comparison range. Existing
per-metric tolerances absorb the jitter.

Stats file:
`bench/orchestrator-stats/2026-05-20-iter-boehm-retirement.1.json`.

closes #4

examples/bench_latency_explicit.ail

@@ -9,11 +9,11 @@
 ; deallocation O(1)-stack regardless of list length.
 ;
 ; This is the "RC-fair" arm of the latency bench; together with
-; bench_latency_implicit (under --alloc=gc) it tests the hypothesis
-; "Boehm has unbounded p99 per-operation latency under continuous
-; alloc pressure with a large persistent live working set; RC under
-; explicit-mode has p99 within a small constant factor of the
-; median".
+; bench_latency_implicit (the implicit-mode control arm at rc) it
+; tests the hypothesis "RC under explicit-mode has p99
+; per-operation latency within a small constant factor of the
+; median, even under continuous alloc pressure with a large
+; persistent live working set".
 ;
 ; Workload (must match bench_latency_implicit's parameters exactly
 ; for the comparison to be fair):

examples/bench_latency_implicit.ail

@@ -1,18 +1,20 @@
 ; Latency-distribution bench fixture — Implicit-mode variant.
 ;
 ; Companion to bench_latency_explicit. Together they test the
-; hypothesis "Boehm has unbounded p99 per-operation latency under
+; hypothesis "RC under explicit-mode has p99 per-operation latency
+; within a small constant factor of the median, even under
 ; continuous alloc pressure with a large persistent live working
-; set; RC under explicit-mode has p99 within a small constant
-; factor of the median".
+; set; RC under implicit-mode is the control arm — it LEAKS
+; because Implicit params are not dec'd, so its p99 is
+; alloc-pressure-bounded but the live set grows monotonically".
 ;
 ; Implicit-mode variant: no `(borrow T)`, `(own T)`, `(reuse-as)`,
-; `(drop-iterative)` annotations. This is the canonical "Boehm-fair"
-; arm — the way you'd write the program without thinking about
-; modes. Under `--alloc=gc`, Boehm cleans up. Under `--alloc=rc`,
-; this variant LEAKS (Implicit params are not dec'd) and is not a
-; meaningful RC measurement; the bench harness intentionally only
-; runs this fixture under `--alloc=gc`.
+; `(drop-iterative)` annotations. This is the control arm — the
+; way you'd write the program without thinking about modes. Under
+; `--alloc=rc` this variant LEAKS (Implicit params are not dec'd);
+; the bench harness runs it as a control to measure the
+; alloc-only-no-free latency floor against the RC-fair explicit
+; arm.
 ;
 ; Workload:
 ;   - Live cache: balanced binary tree of depth 19 (524_287 nodes,
@@ -20,7 +22,9 @@
 ;   - Per-op work: build a 500-cell IntList of 0..499, sum it
 ;     (sum = 124750), print one stdout marker line every PRINT_K
 ;     ops. Total churn: 20000 * 500 cells = 10M cell-allocs ≈
-;     240 MB ≫ live-set, forcing Boehm to collect many times.
+;     240 MB ≫ live-set; in the implicit-mode arm the live set
+;     grows monotonically (no free), so the working set tracks
+;     total allocation.
 ;   - Total ops: 20_000. Print every PRINT_K=20 ops → 1000 timing
 ;     samples + 1 final summary line.
 ;
@@ -147,9 +151,9 @@
   ; Note: we don't actually want sum_tree to fire on every op (it
   ; would dominate the per-op cost and bury allocator effects).
   ; Instead we touch only the tree's root via a cheap `pin_root`
-  ; that pattern-matches once. Boehm's tracing still walks the
-  ; whole tree on every collection because the tree pointer is
-  ; live through the loop scope.
+  ; that pattern-matches once. The tree pointer remains a live
+  ; root through the entire loop scope; under RC every per-op
+  ; alloc pays inc/dec instrumentation against that root.
   (fn pin_root
     (doc "Constant-time tree liveness pin — read root tag, return 1 (TNode) or 0 (TLeaf).")
     (type
@@ -182,8 +186,7 @@
   ; tractable for the harness (1000 timings instead of 20000).
   ;
   ; The tree `t` is passed through every recursive call so it
-  ; stays a live root; Boehm has to trace through it on every
-  ; collection.
+  ; stays a live root for the duration of the bench loop.
 
   (fn loop
     (doc "Tail-recursive bench loop. Ops countdown in `remaining`; print marker every time `print_countdown` hits 0.")

examples/escape_local_demo.ail

@@ -7,14 +7,14 @@
 ; flows to a fn arg, never becomes a ctor field, never returns.
 ; Iter 17a's escape analysis flags the `(term-ctor Box MkBox n)`
 ; allocation as non-escaping; codegen lowers it to LLVM `alloca`
-; instead of `@GC_malloc`. Boehm's heap is not touched at all by
-; this fn.
+; instead of the runtime allocator. The heap is not touched at
+; all by this fn.
 ;
 ; `count` repeats the same pattern under recursion: each call to
 ; `count` builds a fresh Box(_), matches it, and returns either 0
-; or 1 + (count rest). Without the alloca optimisation, each
-; recursive frame leaks a Box onto the GC heap until collection;
-; with the optimisation, each frame's Box dies with its frame.
+; or 1 + (count rest). Without the alloca optimisation each
+; recursive frame allocates a Box on the heap; with the
+; optimisation, each frame's Box dies with its frame.
 ;
 ; Expected stdout (one per line):
 ;   42  — peek(0) returns the literal 42 from the only arm

examples/gc_stress.ail

@@ -1,47 +0,0 @@
-; Iter 14f stress fixture for the Boehm conservative GC integration.
-; Builds a List Int of length 50 by recursive Cons construction,
-; sums it, prints the sum (1275 = 50*51/2).
-;
-; Bool branching uses the canonical `if` form (Decision 7, restored
-; in Iter 14g): `(if (== n 0) Nil (Cons n (build (- n 1))))`.
-
-(module gc_stress
-
-  (data List (vars a)
-    (doc "Polymorphic singly-linked list (re-declared locally).")
-    (ctor Nil)
-    (ctor Cons a (con List a)))
-
-  (fn build
-    (doc "Build [n, n-1, ..., 1] :: List Int via Cons recursion.")
-    (type
-      (fn-type
-        (params (con Int))
-        (ret (con List (con Int)))))
-    (params n)
-    (body
-      (if (app == n 0)
-        (term-ctor List Nil)
-        (term-ctor List Cons
-          n
-          (app build (app - n 1))))))
-
-  (fn sum_list
-    (doc "Recursively sum a List Int.")
-    (type
-      (fn-type
-        (params (con List (con Int)))
-        (ret (con Int))))
-    (params xs)
-    (body
-      (match xs
-        (case (pat-ctor Nil) 0)
-        (case (pat-ctor Cons h t)
-          (app + h (app sum_list t))))))
-
-  (fn main
-    (doc "Build [50..1], sum, print 1275.")
-    (type (fn-type (params) (ret (con Unit)) (effects IO)))
-    (params)
-    (body
-      (app print (app sum_list (app build 50))))))

examples/rc_pin_recurse_implicit.ail

@@ -5,7 +5,7 @@
 ;
 ; Symptom under --alloc=rc before the fix:
 ;   - Implicit-mode pin/loop: refcount underflow at runtime.
-;   - Same code under --alloc=gc: clean exit, prints `0`.
+;   - Post-fix: clean exit, prints `0`.
 ;
 ; Pattern shape: a heap-allocated value `t` shared between a
 ; callee that pattern-destructures it (pin) and a recursive

examples/reuse_as_demo.ail

@@ -10,11 +10,11 @@
 ;   - linearity check: `xs` is consumed exactly once via reuse-as in
 ;     the Cons arm; the Nil arm doesn't consume `xs`. Merge across
 ;     arms is consistent.
-;   - codegen identity under --alloc=gc: program prints `9`
+;   - codegen under `--alloc=rc`: program prints `9`
 ;     (1+1 + 2+1 + 3+1 = 9), the same value the non-reuse-as
 ;     `map_inc` would print.
 ;
-; Expected stdout under --alloc=gc:
+; Expected stdout:
 ;   9
 
 (module reuse_as_demo