iter design-md-rolesplit.1 (DONE 9/9): DESIGN.md -> design/ ledger role-split

The 3020-line docs/DESIGN.md is replaced by the design/ ledger:
design/INDEX.md (sole addressable spine, typed Contracts+Models tables,
polymorphic links — prose file OR authoritative source //!), 14
design/contracts/*.md test-linked invariants + 3 source-link-only
contracts (mangling/env-construction/qualified-xref, no prose file —
code is SoT), 5 design/models/*.md whitepapers, and
docs/journals/2026-05-19-design-decision-records.md (the
relitigation-guard archive — every why/rejected/does-not-do/rollback/
empirical ### moved out at ###-granularity). Clean cut: git rm
docs/DESIGN.md, no stub.

RED-first crates/ailang-core/tests/design_index_pin.rs — the 4-clause
anti-regrowth spine (DESIGN.md-gone / every-INDEX-link-resolves /
every-contract-names-a-resolvable-ratifier /
contracts-carry-no-decision-record-prose) — demonstrably RED before,
GREEN after. Build-atomic by task ordering: design_schema_drift.rs's
include_str! (the only compile-time consumer) retargeted to
design/contracts/data-model.md BEFORE the deletion; its
## Data model/## Pipeline slicer dropped (a simplification the split
enables). 2 NoInstance diagnostics + 2 lockstep E2Es retargeted to
design/contracts/{float-semantics,typeclasses}.md. ~12 agent reading
lists + 5 SKILL bodies + CLAUDE.md + skills/README.md + ~25
code/C/.ail/spec comment xrefs retargeted; OQ7 dangling 'Iter 13b'
cite deleted (no forward target — a pointer would be fiction).
honesty-rule.md rewritten so the rule names the new home
(rationale->journals), resolving the recon-found internal
contradiction; the two docs_honesty_pin.rs:70,72 pinned phrases kept
verbatim+contiguous.

Boss-verified independently: cargo test --workspace 646 passed /
0 failed; design_index_pin 4/4; acceptance grep CLEAN of live
DESIGN.md refs (residuals = only the spec-mandated clause-4
deletion-enforcer). 2 DONE_WITH_CONCERNS routed to the mandatory
milestone-close audit: (a) str-abi.md:23 '(iter str-concat,
2026-05-13)' provenance stamp trips advisory architect_sweeps Sweep-1
— Boss-confirmed byte-identical to DESIGN.md@deeffb1:2062-2065, a
faithfully-migrated PRE-EXISTING anchor (regexes verbatim, only path
retargeted), NOT split-introduced — RATIFY-or-tidy at audit; (b) a
now stale-direction intra-prose 'see Str ABI below' cross-ref in
float-semantics.md — audit-adjudication candidate. Plan defect noted:
Task 9 Step 4's verbatim acceptance grep used a ^./ anchor not
matching the system's grep -rIn output; substance re-verified CLEAN.

Spec grounding-check PASS x2. Journals INDEX + decision-records
pointer appended (Boss-only).

crates/ailang-codegen/src/drop.rs

@@ -85,7 +85,7 @@ impl<'a> Emitter<'a> {
         out.push_str("  %is_null = icmp eq ptr %p, null\n");
         out.push_str("  br i1 %is_null, label %ret, label %live\n");
         out.push_str("live:\n");
-        // FROZEN ABI (embedding boundary) — see DESIGN.md §"Embedding ABI".
+        // FROZEN ABI (embedding boundary) — see design/contracts/embedding-abi.md.
         out.push_str("  %tag = load i64, ptr %p, align 8\n");
 
         let n_ctors = td.ctors.len();
@@ -111,7 +111,7 @@ impl<'a> Emitter<'a> {
                 if lty != "ptr" {
                     continue;
                 }
-                // FROZEN ABI (embedding boundary) — see DESIGN.md §"Embedding ABI".
+                // FROZEN ABI (embedding boundary) — see design/contracts/embedding-abi.md.
                 let off = 8 + (j as i64) * 8;
                 let addr_id = local;
                 local += 1;

crates/ailang-codegen/src/lib.rs

@@ -99,9 +99,10 @@ pub enum CodegenError {
 
     /// `llvm_type` was asked to lower an AILang [`Type`] it does not
     /// know how to represent. In the MVP this fires for an unresolved
-    /// rigid `Type::Var` reaching codegen (a substitution bug; see
-    /// Iter 13b notes in `DESIGN.md`) or for any non-`Con`/`Fn`/`Var`
-    /// shape that has not yet been wired through.
+    /// rigid `Type::Var` reaching codegen (a substitution bug: a
+    /// parameterised-ADT type argument that monomorphisation should
+    /// have substituted to a concrete type before codegen) or for any
+    /// non-`Con`/`Fn`/`Var` shape that has not yet been wired through.
     #[error("unsupported type: {0}")]
     UnsupportedType(String),
 
@@ -175,8 +176,8 @@ pub enum Target {
     /// a mandatory leading `ptr %ctx` (per-thread embedding context)
     /// published via `@__ail_tls_ctx` around the unchanged internal
     /// call. The ctx-threaded C signature is the M2 shape; the
-    /// value/record layout is frozen as of M3 (DESIGN.md §"Embedding
-    /// ABI" > "Frozen value layout").
+    /// value/record layout is frozen as of M3
+    /// (design/contracts/frozen-value-layout.md).
     StaticLib,
 }
 
@@ -682,8 +683,8 @@ fn llvm_scalar(t: &Type) -> &'static str {
         Type::Con { name, .. } if name == "Int" => "i64",
         // M3: any other Type::Con reaching an (export) signature is,
         // by the Task-2 export gate, a single-ctor scalar record;
-        // it crosses the C ABI as a bare `ptr` (DESIGN.md §"Embedding
-        // ABI" frozen layout — payload pointer).
+        // it crosses the C ABI as a bare `ptr`
+        // (design/contracts/frozen-value-layout.md — payload pointer).
         Type::Con { .. } => "ptr",
         _ => "i64",
     }

crates/ailang-codegen/src/match_lower.rs

@@ -104,8 +104,8 @@ impl<'a> Emitter<'a> {
             }
             compiled.push((v, vty));
         }
-        // FROZEN ABI (embedding boundary) — DESIGN.md §"Embedding ABI"
-        // > "Frozen value layout". size = 8 + n*8, tag@0, fields@8+i*8.
+        // FROZEN ABI (embedding boundary) —
+        // design/contracts/frozen-value-layout.md. size = 8 + n*8, tag@0, fields@8+i*8.
         let size_bytes = 8 + (compiled.len() * 8) as i64;
         let p = self.fresh_ssa();
         // Iter 17a: pick allocator based on escape analysis. `alloca`