audit-rt: milestone close — Direction-2 5th test + roadmap entry retired + wording sync

Milestone-close audit found three drift items (architect) plus
two carry-on items; bench all-green.

Fixes (rt.tidy, boss-direct):
- 5th test parse_then_print_then_parse_is_idempotent_on_every_ailx_fixture
  enforces Direction 2 of the Roundtrip Invariant directly. The
  DESIGN.md enforcement list grows from four to five tests.
- docs/roadmap.md P1 'Round-trip completeness invariant' entry
  retired with one-line journal mirror per roadmap convention.
- DESIGN.md wording sync: <16-hex> → <16-lowercase-hex> for the
  Float-bits-hex spelling in the new section (matches §Data model).

Milestone closed clean; five workspace-wide tests anchor the
.ail.json ↔ .ailx bijection plus AST-variant coverage.

crates/ailang-surface/tests/round_trip.rs

@@ -1,21 +1,27 @@
 //! Round-trip gate for the form-(A) projection.
 //!
-//! Two complementary checks over `examples/`:
+//! Three complementary checks over `examples/`, each gathering
+//! fixtures dynamically via `read_dir` (no hardcoded lists). The
+//! tests are pure readers — they do not write into the working
+//! tree.
 //!
-//! 1. `print_then_parse_round_trips_every_fixture`: for every
-//!    `examples/*.ail.json` fixture, load → `print` → `parse` →
-//!    canonical bytes; assert byte-equal to original.
+//! 1. `print_then_parse_round_trips_every_fixture`: Direction 1 of
+//!    the Roundtrip Invariant (DESIGN.md §"Roundtrip Invariant").
+//!    For every `examples/*.ail.json` fixture, load → `print` →
+//!    `parse` → canonical bytes; assert byte-equal to original.
 //!
-//! 2. `every_ailx_fixture_matches_its_json_counterpart`: for every
-//!    `examples/*.ailx` fixture, parse → canonical bytes; if a
-//!    same-stem `.ail.json` counterpart exists, assert canonical-byte
-//!    equality against it. The `.ailx` side is the human/AI authoring
-//!    ground-truth — fixtures must be writeable without going through
-//!    the printer and still match the JSON-AST.
+//! 2. `every_ailx_fixture_matches_its_json_counterpart`: hand-
+//!    authored ground-truth check. For every `examples/*.ailx`
+//!    fixture, parse → canonical bytes; if a same-stem `.ail.json`
+//!    counterpart exists, assert canonical-byte equality against
+//!    it. Pins the `.ailx` corpus against semantic drift between
+//!    the two forms at the fixture level.
 //!
-//! Both tests gather fixtures dynamically via `read_dir`; no hardcoded
-//! lists. The tests are pure readers — they do not write into the
-//! working tree.
+//! 3. `parse_then_print_then_parse_is_idempotent_on_every_ailx_fixture`:
+//!    Direction 2 of the Roundtrip Invariant. For every well-formed
+//!    `.ailx` text `t`, asserts `canonical_bytes(parse(t))` equals
+//!    `canonical_bytes(parse(print(parse(t))))`. Robust against
+//!    future `.ailx` fixtures without a JSON counterpart.
 
 use std::path::{Path, PathBuf};
 
@@ -196,3 +202,76 @@ fn every_ailx_fixture_matches_its_json_counterpart() {
         paired, parse_only
     );
 }
+
+/// Direction 2 of the Roundtrip Invariant (DESIGN.md §"Roundtrip
+/// Invariant"): for every well-formed `.ailx` text `t`, the
+/// composition `parse → print → parse` is idempotent on the AST.
+///
+/// For the 57 `.ailx` fixtures that have a JSON counterpart this
+/// follows logically from `print_then_parse_round_trips_every_fixture`
+/// + `every_ailx_fixture_matches_its_json_counterpart`. This test
+/// asserts the property directly so it stays robust for future
+/// `.ailx` fixtures without a JSON counterpart, and so the spec's
+/// Direction-2 claim has a dedicated enforcement point.
+#[test]
+fn parse_then_print_then_parse_is_idempotent_on_every_ailx_fixture() {
+    let fixtures = list_ailx_fixtures();
+    assert!(
+        !fixtures.is_empty(),
+        "no .ailx fixtures found under {}",
+        examples_dir().display()
+    );
+
+    let mut failures = Vec::<String>::new();
+    let mut passed = 0usize;
+    for path in &fixtures {
+        let text = match std::fs::read_to_string(path) {
+            Ok(t) => t,
+            Err(e) => {
+                failures.push(format!("{}: read failed: {e}", path.display()));
+                continue;
+            }
+        };
+        let parsed_once = match ailang_surface::parse(&text) {
+            Ok(m) => m,
+            Err(e) => {
+                failures.push(format!("{}: parse(t) failed: {e}", path.display()));
+                continue;
+            }
+        };
+        let printed = ailang_surface::print(&parsed_once);
+        let parsed_twice = match ailang_surface::parse(&printed) {
+            Ok(m) => m,
+            Err(e) => {
+                failures.push(format!(
+                    "{}: parse(print(parse(t))) failed: {e}\n--- printed ---\n{printed}",
+                    path.display()
+                ));
+                continue;
+            }
+        };
+        let bytes_a = ailang_core::canonical::to_bytes(&parsed_once);
+        let bytes_b = ailang_core::canonical::to_bytes(&parsed_twice);
+        if bytes_a != bytes_b {
+            let s_a = String::from_utf8_lossy(&bytes_a).into_owned();
+            let s_b = String::from_utf8_lossy(&bytes_b).into_owned();
+            failures.push(format!(
+                "{}: parse → print → parse is NOT idempotent.\nparse(t):              {s_a}\nparse(print(parse(t))): {s_b}",
+                path.display()
+            ));
+            continue;
+        }
+        passed += 1;
+    }
+
+    if !failures.is_empty() {
+        panic!(
+            "{} of {} .ailx fixture(s) failed idempotency check (passed: {}):\n{}",
+            failures.len(),
+            fixtures.len(),
+            passed,
+            failures.join("\n\n")
+        );
+    }
+    eprintln!("parse→print→parse idempotency ok for {passed} .ailx fixtures");
+}