iter embedding-abi-m3.1 (DONE 6-7): freeze the value layout — DESIGN.md frozen-layout SSOT + lockstep pointers + enforceable byte-pin

Tasks 6-7 of the Boss-repaired split dispatch (Tasks 1-5 committed d5c565d).
Task 6: DESIGN.md §"Embedding ABI" gains the `### Frozen value layout
(M3 — one-way commitment)` SSOT subsection; both "provisional until M3"
sentences rewritten to one-way-freeze wording (docs_honesty_pin-safe — the
pinned "written **bare**" sentence stayed byte-verbatim, :2297->:2299
content-asserted); // FROZEN ABI lockstep pointers at runtime/rc.c +
match_lower.rs lower_ctor + drop.rs; 3 plan-named stale rustdocs fixed +
the Boss-caught stale // gate-comment block (check/lib.rs:1917-1922,
M1/scalar-only -> M1/M2/M3/C-ABI-permitted-incl-record); byte-pin
enforceability demonstrated (RED on a local offset perturbation, GREEN on
git-checkout restore — the only legitimate git op, working-tree only).
Task 7: milestone-close verification gate.

Boss-verified independently (agent report = intent, not outcome): workspace
639 passed / 0 failed; embed_record_e2e 2/2 (own+borrow, global
leak-freedom model); byte-pin 1/1; gate 10/10; forwarder 3/3;
docs_honesty_pin 5/5 pin-safe; design_schema_drift + embed_export_hash_stable
+ embed_e2e + M2 swarm regression-green-unmodified.

INDEX.md line added (deferred from the PARTIAL — one line per iter, final
title). Milestone-close audit next (architect Invariant 1 + bench trio,
spec Testing items 8/9 — audit-owned, not the implement run's job).

docs/DESIGN.md

@@ -2277,9 +2277,11 @@ the internal `@ail_<module>_<fn>`. The symbol is author-chosen and
 decoupled from the `ail_<module>_<def>` mangling so a module/fn
 rename does not move the C symbol.
 
-The M1 ABI is **scalar-only and provisional until M3**: every
-parameter and the return type must be `Int` (lowered `i64`) or
-`Float` (lowered `double`), and the fn's effect set must be empty.
+The embedding ABI accepts `Int` (lowered `i64`), `Float` (lowered
+`double`), or a single-constructor record of those (crossing as a
+bare `ptr` to the frozen box layout below); the fn's effect set must
+be empty. **Frozen as of M3**: a future compiler change MUST NOT
+move the box offsets below or invert the host-free rule.
 These are enforced at `ail check` (`export-non-scalar-signature`,
 `export-has-effects`) — an effectful or non-scalar export *fails to
 typecheck*. Every exported entrypoint takes a mandatory leading `ailang_ctx_t*`
@@ -2290,9 +2292,9 @@ and the runtime accounts RC alloc/free into it (no shared mutable
 runtime state — the swarm artefact is data-race-free, sanitiser-
 verified). The staticlib swarm artefact is **RC-only**:
 `ail build --emit=staticlib` rejects `--alloc=gc`/`--alloc=bump`
-(the shared Boehm collector is not swarm-safe). Only the value/record
-layout remains provisional until M3; the ctx-threaded C signature is
-the M2 shape.
+(the shared Boehm collector is not swarm-safe). The value/record
+layout is **frozen as of M3** (see "Frozen value layout" below); the
+ctx-threaded C signature is the M2 shape.
 
 Export parameters are written **bare**: a scalar type carries no
 `own`/`borrow` mode (modes apply only to heap-shaped types, which the
@@ -2316,6 +2318,46 @@ IR (the external `@<sym>` forwarders, no `@main`) instead of the
 executable-path `main`-required rejection — the Decision-5
 IR-readability affordance for a `main`-free kernel.
 
+### Frozen value layout (M3 — one-way commitment)
+
+For a single-constructor `data T` whose `n` fields are each `Int`
+or `Float`, a value of `T` crossing the embedding C boundary is a
+bare payload pointer `p`:
+
+| bytes | content |
+|---|---|
+| `p - 8 .. p` | `uint64_t` refcount header (`HEADER_SIZE = 8`) |
+| `p + 0 .. p + 8` | `int64_t` constructor tag (written; `0` for the single ctor — no elision) |
+| `p + 8 + i*8` | field `i`, declaration order: `int64_t` for `Int`, IEEE-754 `double` bit-pattern for `Float` |
+
+Total box payload size = `8 + n*8`. This is the layout codegen
+emits today (`match_lower.rs` `lower_ctor`); it is **frozen** — a
+future compiler change MUST NOT move these offsets.
+
+**Construction (host → kernel input).** The host MUST obtain an
+input record's storage from `ailang_rc_alloc(8 + n*8)` (returns the
+payload pointer with the refcount header pre-set to `1`, payload
+zeroed), then write the tag (`0`) and the scalar fields at the
+offsets above. A raw `malloc` is a contract violation:
+`own`-consume and `ailang_rc_dec` both require the runtime's 8-byte
+header at `p - 8` initialised to `1`.
+
+**Ownership follows the declared mode** (the §"Mode metadata is
+load-bearing for codegen" contract, as the C ABI): a `(own (con
+T))` parameter transfers ownership in — the kernel consumes it
+(Iter-B drop-at-return); the host MUST NOT touch or `dec` it after
+the call. A `(borrow (con T))` parameter is retained by the host —
+the kernel does not consume it; the host frees it. The return value
+is always owned by the host.
+
+**Free (host side).** `ailang_rc_dec(payload)`. Leak-free for an M3
+record because every field is a scalar — `ailang_rc_dec` is
+header-only and an M3 record has no boxed children. A record with
+boxed fields (`Str`/`List`/nested record) is **not** an M3 type
+(rejected by the export gate); a recursive typed-free for that
+shape is an additive M4 concern, not a contradiction of this
+freeze.
+
 ## Data model
 
 The on-disk JSON-AST is what the toolchain hashes, typechecks, and