iter design-md-rolesplit.1 (DONE 9/9): DESIGN.md -> design/ ledger role-split

The 3020-line docs/DESIGN.md is replaced by the design/ ledger:
design/INDEX.md (sole addressable spine, typed Contracts+Models tables,
polymorphic links — prose file OR authoritative source //!), 14
design/contracts/*.md test-linked invariants + 3 source-link-only
contracts (mangling/env-construction/qualified-xref, no prose file —
code is SoT), 5 design/models/*.md whitepapers, and
docs/journals/2026-05-19-design-decision-records.md (the
relitigation-guard archive — every why/rejected/does-not-do/rollback/
empirical ### moved out at ###-granularity). Clean cut: git rm
docs/DESIGN.md, no stub.

RED-first crates/ailang-core/tests/design_index_pin.rs — the 4-clause
anti-regrowth spine (DESIGN.md-gone / every-INDEX-link-resolves /
every-contract-names-a-resolvable-ratifier /
contracts-carry-no-decision-record-prose) — demonstrably RED before,
GREEN after. Build-atomic by task ordering: design_schema_drift.rs's
include_str! (the only compile-time consumer) retargeted to
design/contracts/data-model.md BEFORE the deletion; its
## Data model/## Pipeline slicer dropped (a simplification the split
enables). 2 NoInstance diagnostics + 2 lockstep E2Es retargeted to
design/contracts/{float-semantics,typeclasses}.md. ~12 agent reading
lists + 5 SKILL bodies + CLAUDE.md + skills/README.md + ~25
code/C/.ail/spec comment xrefs retargeted; OQ7 dangling 'Iter 13b'
cite deleted (no forward target — a pointer would be fiction).
honesty-rule.md rewritten so the rule names the new home
(rationale->journals), resolving the recon-found internal
contradiction; the two docs_honesty_pin.rs:70,72 pinned phrases kept
verbatim+contiguous.

Boss-verified independently: cargo test --workspace 646 passed /
0 failed; design_index_pin 4/4; acceptance grep CLEAN of live
DESIGN.md refs (residuals = only the spec-mandated clause-4
deletion-enforcer). 2 DONE_WITH_CONCERNS routed to the mandatory
milestone-close audit: (a) str-abi.md:23 '(iter str-concat,
2026-05-13)' provenance stamp trips advisory architect_sweeps Sweep-1
— Boss-confirmed byte-identical to DESIGN.md@deeffb1:2062-2065, a
faithfully-migrated PRE-EXISTING anchor (regexes verbatim, only path
retargeted), NOT split-introduced — RATIFY-or-tidy at audit; (b) a
now stale-direction intra-prose 'see Str ABI below' cross-ref in
float-semantics.md — audit-adjudication candidate. Plan defect noted:
Task 9 Step 4's verbatim acceptance grep used a ^./ anchor not
matching the system's grep -rIn output; substance re-verified CLEAN.

Spec grounding-check PASS x2. Journals INDEX + decision-records
pointer appended (Boss-only).

CLAUDE.md

@@ -42,7 +42,8 @@ it measurably improves correctness or removes redundancy.
 | `runtime/` | C glue around the RC runtime |
 | `bench/` | Regression harnesses (`check.py`, `compile_check.py`, `cross_lang.py`) and the throughput-and-latency runner (`run.sh`); `bench/reference/` holds the hand-C corpus for cross-language ratios |
 | `examples/` | AILang fixtures used by tests and benches |
-| `docs/` | Canonical specs and decisions log — `docs/DESIGN.md`, `docs/journals/` (per-iter journals + `INDEX.md`), `docs/journal-archive.md` (pre-2026-05-11 history), `docs/specs/` (per-milestone design specs), `docs/plans/` (per-iteration plans), `PROSE_ROUNDTRIP.md` |
+| `design/` | The canonical contract ledger — `design/INDEX.md` (sole addressable spine: a typed Contracts + Models table), `design/contracts/` (prose-authoritative test-linked invariants), `design/models/` (onboarding whitepapers) |
+| `docs/` | Specs and decisions log — `docs/journals/` (per-iter journals + `INDEX.md`; incl. the migrated design decision-records), `docs/journal-archive.md` (pre-2026-05-11 history), `docs/specs/` (per-milestone design specs), `docs/plans/` (per-iteration plans), `PROSE_ROUNDTRIP.md` |
 | `skills/` | Project-local skill definitions and their agents. See `skills/README.md` for the skill table, agent roster, and discovery layout. |
 
 ## Skill system
@@ -74,8 +75,8 @@ See @skills/README.md for the skill + agent roster.
 ### What this means in practice
 
 - **Plan, design, decide** — myself. Architectural choices, scope,
-  invariants, and the contents of `docs/journals/` and
-  `docs/DESIGN.md` are my work product.
+  invariants, and the contents of `docs/journals/` and the
+  `design/` ledger are my work product.
 - **Implement, refactor, write tests, diagnose bugs** — by default,
   delegated. `ailang-implementer` for code changes that follow a
   fixed design, `ailang-tester` for E2E coverage, `ailang-debugger`
@@ -175,7 +176,7 @@ The test for whether a feature ships is whether an LLM author
 naturally produces code that uses it AND whether the feature
 measurably improves correctness or removes redundancy. Aesthetic
 appeal does not count; neither does human ergonomics. Full criterion
-lives in `docs/DESIGN.md` ("Feature-acceptance criterion") and is
+lives in `design/contracts/feature-acceptance.md` and is
 applied as a gate by `skills/brainstorm/SKILL.md` during spec writing.
 
 ## Bug fixes — TDD, always
@@ -196,20 +197,27 @@ Vocabulary note: legacy JOURNAL entries (pre-2026-05-09) use
 "iter" / "family"; new entries use "iteration" / "milestone".
 Existing entries are not retroactively renamed.
 
-## Roles of `docs/DESIGN.md`, `docs/journals/`, `docs/journal-archive.md`, `docs/roadmap.md`, `docs/specs/`, `docs/plans/`
+## Roles of the `design/` ledger, `docs/journals/`, `docs/journal-archive.md`, `docs/roadmap.md`, `docs/specs/`, `docs/plans/`
 
-- **`docs/DESIGN.md`** is the canonical specification. It describes
-  what AILang *is*: schema, semantics, invariants, runtime contracts.
-  Every new feature must justify itself against `docs/DESIGN.md`
-  before it can ship; if the feature requires changes to
-  `docs/DESIGN.md`, those changes are part of the same iteration.
-  `docs/DESIGN.md` is also the artefact `ailang-architect` checks
-  the code against during drift review.
+- **The `design/` ledger** is the canonical specification. It
+  describes what AILang *is*: schema, semantics, invariants, runtime
+  contracts. `design/INDEX.md` is the sole addressable spine — a
+  typed two-table ledger; `design/contracts/` holds the
+  prose-authoritative, test-linked invariants; `design/models/`
+  holds the onboarding whitepapers. Every new feature must justify
+  itself against the relevant contract before it can ship; if the
+  feature requires changes to a contract, those changes are part of
+  the same iteration. The `design/` ledger is also the artefact
+  `ailang-architect` checks the code against during drift review.
+  The current-state-mirror discipline is unchanged, just re-homed:
+  a contract describes only the actual present state; forward intent
+  goes to `docs/roadmap.md`, history and rationale to
+  `docs/journals/` (see `design/contracts/honesty-rule.md`).
 
 - **`docs/journals/<YYYY-MM-DD>-iter-<id>.md`** is the decisions
   log, one file per iter. Each file records *why* the iter moved
   the way it did — alternatives considered and rejected, lessons,
-  rationale that does not belong in `docs/DESIGN.md`. Append-only
+  rationale that does not belong in the `design/` ledger. Append-only
   per file; new files are appended via `docs/journals/INDEX.md`.
   `docs/journals/INDEX.md` is the chronological pointer list,
   orchestrator-maintained, one line per iter.
@@ -242,7 +250,7 @@ Existing entries are not retroactively renamed.
   rules (in particular: no internals, lead with the change).
 
 Together these answer three questions: "what is the language right
-now?" (DESIGN), "how did we get here?" (per-iter journals, specs,
-plans), and "what's next?" (roadmap). `WhatsNew.md` is the
-user-facing mirror of the journals — the same history, told without
-internals.
+now?" (the `design/` ledger), "how did we get here?" (per-iter
+journals, specs, plans), and "what's next?" (roadmap).
+`WhatsNew.md` is the user-facing mirror of the journals — the same
+history, told without internals.