iter design-md-rolesplit.1 (DONE 9/9): DESIGN.md -> design/ ledger role-split

The 3020-line docs/DESIGN.md is replaced by the design/ ledger:
design/INDEX.md (sole addressable spine, typed Contracts+Models tables,
polymorphic links — prose file OR authoritative source //!), 14
design/contracts/*.md test-linked invariants + 3 source-link-only
contracts (mangling/env-construction/qualified-xref, no prose file —
code is SoT), 5 design/models/*.md whitepapers, and
docs/journals/2026-05-19-design-decision-records.md (the
relitigation-guard archive — every why/rejected/does-not-do/rollback/
empirical ### moved out at ###-granularity). Clean cut: git rm
docs/DESIGN.md, no stub.

RED-first crates/ailang-core/tests/design_index_pin.rs — the 4-clause
anti-regrowth spine (DESIGN.md-gone / every-INDEX-link-resolves /
every-contract-names-a-resolvable-ratifier /
contracts-carry-no-decision-record-prose) — demonstrably RED before,
GREEN after. Build-atomic by task ordering: design_schema_drift.rs's
include_str! (the only compile-time consumer) retargeted to
design/contracts/data-model.md BEFORE the deletion; its
## Data model/## Pipeline slicer dropped (a simplification the split
enables). 2 NoInstance diagnostics + 2 lockstep E2Es retargeted to
design/contracts/{float-semantics,typeclasses}.md. ~12 agent reading
lists + 5 SKILL bodies + CLAUDE.md + skills/README.md + ~25
code/C/.ail/spec comment xrefs retargeted; OQ7 dangling 'Iter 13b'
cite deleted (no forward target — a pointer would be fiction).
honesty-rule.md rewritten so the rule names the new home
(rationale->journals), resolving the recon-found internal
contradiction; the two docs_honesty_pin.rs:70,72 pinned phrases kept
verbatim+contiguous.

Boss-verified independently: cargo test --workspace 646 passed /
0 failed; design_index_pin 4/4; acceptance grep CLEAN of live
DESIGN.md refs (residuals = only the spec-mandated clause-4
deletion-enforcer). 2 DONE_WITH_CONCERNS routed to the mandatory
milestone-close audit: (a) str-abi.md:23 '(iter str-concat,
2026-05-13)' provenance stamp trips advisory architect_sweeps Sweep-1
— Boss-confirmed byte-identical to DESIGN.md@deeffb1:2062-2065, a
faithfully-migrated PRE-EXISTING anchor (regexes verbatim, only path
retargeted), NOT split-introduced — RATIFY-or-tidy at audit; (b) a
now stale-direction intra-prose 'see Str ABI below' cross-ref in
float-semantics.md — audit-adjudication candidate. Plan defect noted:
Task 9 Step 4's verbatim acceptance grep used a ^./ anchor not
matching the system's grep -rIn output; substance re-verified CLEAN.

Spec grounding-check PASS x2. Journals INDEX + decision-records
pointer appended (Boss-only).

skills/implement/agents/ailang-implement-orchestrator.md

@@ -32,7 +32,7 @@ Read these before doing anything else, in this order:
    commit discipline). Note: the "Done-state notifications:
    WhatsNew.md" procedure has moved to `skills/boss/SKILL.md`;
    WhatsNew is Boss-side regardless of mode, NOT this agent's job.
-2. `docs/DESIGN.md` — invariants any iter must respect.
+2. `design/INDEX.md` — the contract ledger; invariants any iter must respect (walk to the linked `design/contracts/` files).
 3. `docs/journals/INDEX.md` plus the last 1–3 per-iter journal
    files it points at — recent state of the project.
 4. `skills/implement/SKILL.md` — the **canonical discipline**

skills/implement/agents/ailang-implementer.md

@@ -27,8 +27,8 @@ These are the always-binding documents for AILang work. Read them at the start
 of every dispatch:
 
 1. `CLAUDE.md` — orchestrator framing, agent role boundaries.
-2. `docs/DESIGN.md` — the canonical specification. Architectural decisions
-   here are binding.
+2. `design/INDEX.md` — the contract ledger and sole spine. The
+   contracts it links are binding architectural decisions.
 3. `docs/journals/INDEX.md` + the latest 1–3 milestone-relevant per-iter files. The latest
    entry is the current state of the project.
 
@@ -99,7 +99,7 @@ the test.
 
 ## The Process
 
-1. Read the standing list (CLAUDE.md, DESIGN.md, latest per-iter journals).
+1. Read the standing list (CLAUDE.md, `design/INDEX.md`, latest per-iter journals).
 2. Read the carrier in full, then read the file at `task_text_path` — that
    is your task block. Confirm it is concrete (no TBD, no "similar to Task
    N"). If it contains placeholders, return `BLOCKED` with "plan placeholder"
@@ -153,7 +153,7 @@ End every report with exactly one of:
   exactly what — do not guess. The controller will redispatch.
 - `BLOCKED` — you cannot complete the task. Reasons fall into:
   - plan placeholder ("similar to Task N", TBD, vague step)
-  - design contradiction (task asks for something DESIGN.md forbids)
+  - design contradiction (task asks for something the design/ ledger forbids)
   - hypothesis-space exhaustion (≥ 3 implementation strategies failed —
     architecture is wrong, escalate)
   Never push past BLOCKED by hand.
@@ -183,7 +183,7 @@ and stop. Do not implement on a hunch.
 | "Build red but the failure is unrelated to my task" | Then your task isn't done. Either fix the failure (if it's truly your scope) or return `BLOCKED` naming the unrelated failure. Never report `DONE` on a red tree. |
 | "Let me just commit this so the next task's diff is cleaner" | You never commit. Boss-only commit is the project rule. The next task's spec-check phase will read `git diff HEAD` and focus on the task's claimed files — extra signal from your earlier task isn't noise. |
 | "Implicit-mode RC numbers are tied with Boehm — not informative" | Correct — but that's a bench observation, not your problem. Report and move on; don't try to fix the leak inline. |
-| "I read DESIGN.md and disagree with Decision N" | Decisions are binding. Disagreement goes to the orchestrator as a concern, not into the diff. |
+| "I read the design/ ledger and disagree with a contract" | Contracts are binding. Disagreement goes to the orchestrator as a concern, not into the diff. |
 | "The plan mentions a helper I should reuse but I'll inline it for now" | Cross-task context says use the helper. Use the helper. Inlining "for now" creates the duplication the plan tried to avoid. |
 | "Task says 'add function X' — plan didn't script a test, so I'll just write X" | TDD is independent of the plan. If the task adds behaviour, RED-first applies even if the plan template forgot it. Add the test inline; report the plan gap. |
 | "I wrote the test after the function but it tests the same thing — same outcome" | No. Tests-after pass immediately and prove nothing about whether the test would have caught the bug pre-implementation. Delete the function, write the test, watch it fail, then write the function. Spirit-not-ritual is the exact rationalisation TDD is built to defeat. |

skills/implement/agents/ailang-quality-reviewer.md

@@ -29,8 +29,9 @@ toward your solution rather than the right one.
 ## Standing reading list
 
 1. `CLAUDE.md` — orchestrator framing, agent role boundaries.
-2. `docs/DESIGN.md` — invariants the diff must respect (RC, schema, codegen
-   rules, mode discipline, effect system).
+2. `design/INDEX.md` — the contract ledger; invariants the diff must
+   respect (RC, schema, codegen rules, mode discipline, effect
+   system) live in the linked `design/contracts/` files.
 3. The "Doing tasks" section of `CLAUDE.md` (project-level), in particular
    the rules on commenting, no over-engineering, no backwards-compat
    hacks. These are AILang's stated quality bar.
@@ -64,7 +65,7 @@ NO REVIEWING WORK NOT IN THE DIFF.
 
 ## What you check (AILang quality bar)
 
-The bar is stated in `CLAUDE.md` (project) and `docs/DESIGN.md`. The
+The bar is stated in `CLAUDE.md` (project) and the `design/` ledger. The
 recurring categories:
 
 - **No speculative abstraction.** Three similar lines beats a premature

skills/implement/agents/ailang-spec-reviewer.md

@@ -31,8 +31,9 @@ list missing requirements and unrequested extras, and you stop.
 ## Standing reading list
 
 1. `CLAUDE.md` — orchestrator framing, agent role boundaries.
-2. `docs/DESIGN.md` — the canonical specification. Cross-reference any
-   architectural-feeling claim in the task text against it.
+2. `design/INDEX.md` — the contract ledger and sole spine.
+   Cross-reference any architectural-feeling claim in the task text
+   against the contract it links.
 3. `skills/implement/SKILL.md` — the two-stage review process you are
    one half of.
 

skills/implement/agents/ailang-tester.md

@@ -23,7 +23,7 @@ invariant in the doc comment, and you stop.
 
 ## Standing reading list
 
-1. `CLAUDE.md`, `docs/DESIGN.md` — invariants the tests must protect.
+1. `CLAUDE.md`, `design/INDEX.md` — invariants (the linked contracts) the tests must protect.
 2. `docs/journals/INDEX.md` + the latest 1–3 referenced files — most recent iteration entries; they tell you what
    shipped and is therefore worth protecting.
 3. `examples/*.ail.json` — the canonical fixture style. The schema is