roadmap: close DESIGN.md->design/ ([~]->[x]); WhatsNew: design-spec-restructure done-state

docs/roadmap.md

@@ -381,15 +381,39 @@ work progresses.
 
 ## P2 — Medium-term
 
-- [~] **\[milestone\]** DESIGN.md → `design/` — role-split into a
-  typed contract ledger + per-model whitepapers, decision-records
-  rehomed to `docs/journals/`. `docs/DESIGN.md` is one 2905-line
-  file doing three different jobs for three different consumers
-  with three different lifetimes; the line count is the symptom of
-  role-conflation, not of mess. Replace it with a `design/`
-  directory split along the consumer/lifetime axis, with a typed
-  `design/INDEX.md` as the sole addressable spine and primary
-  entry point.
+- [x] **\[milestone\]** DESIGN.md → `design/` — CLOSED 2026-05-19.
+  The 3020-line `docs/DESIGN.md` is **deleted** (clean cut, no
+  stub) and replaced by the `design/` ledger: `design/INDEX.md`
+  (sole addressable spine, typed Contracts+Models tables with
+  polymorphic links — prose file OR authoritative source `//!`),
+  14 `design/contracts/*.md` test-linked invariants + 3
+  source-link-only contracts (mangling/env-construction/
+  qualified-xref — code is SoT), 5 `design/models/*.md`
+  whitepapers, and `docs/journals/2026-05-19-design-decision-records.md`
+  (the relitigation-guard archive). RED-first
+  `design_index_pin.rs` 4-clause anti-regrowth spine; clause-3 is
+  a hand-rolled **faithful Sweep-1 superset** so the in-code hard
+  gate enforces the honesty spirit (clause-3 GREEN ⟹ Sweep-1
+  clean in contracts/). Build-atomic by task ordering (the only
+  compile-time consumer's `include_str!` retargeted before the
+  deletion). Every live `DESIGN.md` reference — 4 executables, 2
+  diagnostics + 2 E2Es, ~12 agent reading lists, 5 SKILL bodies,
+  CLAUDE.md, README, ~25 code/C/.ail/spec comment xrefs —
+  retargeted in lockstep; the honesty rule rewritten to name the
+  new rationale home. Process: spec `a64b2cc`/`314e5e4`
+  (grounding-check PASS ×2) → plan `deeffb1` → iter .1 `176821c`
+  (DONE 9/9) → `audit` `2ba5e16` (architect drift_found
+  `[medium]`+`[low]`, relocation byte-faithful; bencher
+  causally-exonerated DECISIVE on byte-identical IR+binaries,
+  baseline pristine — M2/M3/M5 disposition) → tidy `f2cdd67`/
+  `f683f1a` (DONE 7/7; the audit Resolution mechanism+scope
+  corrected on planning-time evidence after a correctly-BLOCKED
+  plan defect — the "two+ defects ⇒ fix the upstream artifact"
+  discipline, not a third patch). No fieldtest (zero
+  authoring-surface change — reasoned exclusion). Stays briefly
+  for context; remove once stale (full record in
+  `docs/journals/INDEX.md`). Original decided-shape rationale
+  retained below for context until pruned.
 
   **Motivation.** The just-closed `docs-honesty-lint` milestone is
   the proof this is not a cleanup problem: it ran a full docs pass
@@ -474,12 +498,13 @@ work progresses.
   DESIGN.md. Brainstorm hard-gate before any plan/code — it
   rewrites enforced invariants and agent contracts.
   - context: spec `docs/specs/2026-05-19-design-md-rolesplit.md`
-    (grounding-check PASS 13/13, one re-dispatch after a corrected
-    commitment-4 pin-status claim); 2026-05-18 chat
-    (DESIGN.md-management dialogue — six-turn convergence:
-    role-conflation diagnosis, three-job split axis, "let the code
-    speak" principle, qmd rejection, blast-radius sequencing).
-    In flight — ABI-arc sequencing blocker cleared by M5 close.
+    (incl. the Boss-adjudicated relocation Appendix; grounding-check
+    PASS ×2); audit `docs/journals/2026-05-19-audit-design-md-rolesplit.md`;
+    iter journals `2026-05-19-iter-design-md-rolesplit.{1,tidy}.md`;
+    `docs/journals/2026-05-19-design-decision-records.md`; origin
+    2026-05-18 chat (DESIGN.md-management dialogue — six-turn
+    convergence). CLOSED — audited + drift-resolved; hard gate
+    enforces the honesty spirit.
 
 - [ ] **\[milestone\]** Flat array/slice primitive — performance
   follow-up to the Embedding ABI arc, *not* a capability gap.