design/ ledger: dense cross-linking via three topical splits + 88-link sweep

The first formal-links milestone shipped clause-5 + 8 links across the
existing file layout. Browsing surfaced that file-only granularity is
only as precise as the file boundaries — three files mixed two or
three navigation targets under one address, so the 8 links could not
multiply without ambiguity. This commit fixes the substrate, then
applies the sweep the original milestone deferred.

Splits (each extracts an already-self-contained section into its own
file so links land on the topic, not the parent doc's TOC):

  contracts/typeclasses.md
    → +contracts/prelude-classes.md  (Eq/Ord/Show ships, polymorphic `print`)
    → +contracts/method-dispatch.md  (5-step dispatch rule, candidate index)

  contracts/memory-model.md
    → +contracts/language-constraints.md  (the 4 binding constraints
                                           making RC sound without a
                                           cycle collector)

  models/authoring-surface.md
    → +models/prose-projection.md  (Form-B / `ail prose` / merge-prose)

Each new file enters design/INDEX.md as its own row (three contracts
share show_no_instance_e2e.rs / uniqueness.rs as ratifying tests;
prose-projection is a model). Two pre-existing links rebind to the
new topic-files (memory-model.md → method-dispatch.md;
float-semantics.md → prelude-classes.md).

Link sweep: 8 → 88 formal Markdown links over 23 files. Every file
in design/contracts/ + design/models/ now has at least one outgoing
link; the tree is fully connected. Links are file-relative
`[label](path)` per the established convention, fenced code blocks
are skipped (a `](` inside ```jsonc``` is literal text), the durable
tier (design/ + crates/ + runtime/) is enforced by clause-5.

Tests:
  - design_index_pin.rs (5/5 clauses): clean-cut, INDEX resolution,
    ratifying-test resolution, no decision-record prose in contracts/,
    body links durable + resolving.
  - docs_honesty_pin.rs (5/5): one assertion rebinds from typeclasses.md
    to prelude-classes.md (where the gated sentence now lives);
    design_corpus widens to include the 4 new files so the Wunschdenken
    / doc-archaeology sweeps continue to cover everything that used to
    live in the parents.

No spec/plan/journal for this batch — interactive collaboration after
the milestone closed; the user gated the splits explicitly before the
sweep.

design/models/typeclasses.md

@@ -1,10 +1,19 @@
 # Typeclasses — resolution and monomorphisation whitepaper
 
+The schema-and-diagnostics contract for typeclasses lives in
+[typeclasses](../contracts/typeclasses.md); the call-site lookup
+rule in [method dispatch](../contracts/method-dispatch.md); the
+built-in classes shipped in the prelude in
+[prelude classes](../contracts/prelude-classes.md). This file
+covers the design choices and the resolution / monomorphisation
+algorithm.
+
 ## Decision 11: typeclasses — Haskell-lite, monomorphised, coherent
 
-**The design pass for typeclasses. Codified after the Feature-acceptance
-criterion (this document, above) was committed; the criterion is
-the explicit basis for the choices below.**
+**The design pass for typeclasses. Codified after the
+[Feature-acceptance criterion](../contracts/feature-acceptance.md)
+was committed; the criterion is the explicit basis for the choices
+below.**
 
 AILang ships typeclasses to compress a real LLM-author redundancy:
 without them, every comparable function must be written per-type
@@ -46,17 +55,19 @@ types) is one an LLM author does not unprompted produce.
 
 **Constraint collection (per function body).** During typechecking
 of a body, each method call generates a residual constraint of shape
-`<Class> <Type>` where `<Type>` may still contain type variables.
+`<Class> <Type>` (the schema for these lives in
+[Data model](../contracts/data-model.md)) where `<Type>` may still
+contain type variables.
 After local typechecking, residual constraints are checked against
 the function's declared constraints (modulo α-conversion and modulo
 auto-expansion through superclasses; see below). Any residual not
 covered by declared constraints fires `MissingConstraint`.
 
 **Instance registry (workspace-global).** At workspace load (see
-`crates/ailang-core/src/workspace.rs`), all `InstanceDef` nodes
-across all reachable modules are collected into a registry keyed by
-`(class-name, canonical-hash-of-instance-type)`. Registry build
-performs three checks:
+[`crates/ailang-core/src/workspace.rs`](../../crates/ailang-core/src/workspace.rs)),
+all `InstanceDef` nodes across all reachable modules are collected
+into a registry keyed by `(class-name, canonical-hash-of-instance-type)`.
+Registry build performs three checks:
 
 - **Coherence.** Each instance's module must be either the class's
   defining module or the instance type's defining module. Otherwise