iter intrinsic-bodies.1-mechanism (DONE 8/8): Term::Intrinsic leaf + cross-crate wiring (refs #9)

First iteration of the intrinsic-bodies milestone. Introduces the
Form-A `(intrinsic)` body marker as a new leaf AST term and wires it
through surface, checker, codegen, and a kernel_stub ratifier. The
prelude migration + hard-lockstep pin + dead-path removal are .2.

What landed (8 tasks):

  Task 1 — Term::Intrinsic unit variant (ast.rs), tag "t":"intrinsic"
    via the enum's rename_all=lowercase. Additive: no existing fixture
    carries it, hashes bit-identical. In-core exhaustive-match arms
    (canonical/hash/visit/pretty/desugar/workspace) added as leaves.
  Task 2 — surface parse + print: (intrinsic) as a fn body-slot clause
    and a lambda positional body, mapped to/from Term::Intrinsic.
  Task 3 — cross-crate walker sweep (check/codegen/prose/ail-main):
    leaf no-op/identity arms at every no-wildcard Term match the
    compiler flagged.
  Task 4 — checker: new Env.current_module_kernel_tier flag (m.kernel
    || m.name=="prelude"), set alongside current_module. A def whose
    body is intrinsic (top-level fn OR instance-method lambda, via the
    shared is_intrinsic_body helper) is checked signature-only; an
    intrinsic body outside kernel-tier/prelude is rejected with
    intrinsic-outside-kernel-tier.
  Task 5 — codegen: an intrinsic-bodied fn routes through the existing
    try_emit_primitive_instance_body / intercepts::lookup path; if no
    intercept fired it is an internal error, never a lower_term
    fallthrough. lower_term and the synth walker get Term::Intrinsic
    internal-error arms (an intrinsic body reaching either is an
    escape bug).
  Task 6 — answer intercept (ret i64 42) registered in INTERCEPTS;
    the `answer : () -> Int` intrinsic added to STUB_AIL;
    examples/kernel_intrinsic_smoke.ail added so schema_coverage
    observes Term::Intrinsic in the examples/ corpus.
  Task 7 — E2E ratifier: examples/kernel_answer.ail calls
    kernel_stub.answer and prints 42; answer_intrinsic_builds_and_runs_printing_42
    asserts it end-to-end (source → native).
  Task 8 — design/contracts/0002-data-model.md gains the
    { "t": "intrinsic" } Term entry + fn/lam prose; form_a.md grammar
    note updated.

Verification:
  cargo test --workspace → 669 passed, 0 failed (baseline 667 +2:
    intrinsic_in_user_module_is_rejected, answer_intrinsic_builds_and_runs_printing_42).
  bench/check.py + bench/compile_check.py → 0 regressed.
  Reject E2E (subprocess ail check --json, exit 1, code
    intrinsic-outside-kernel-tier) GREEN.
  Round-trip + hash pins GREEN — Term::Intrinsic is additive, no
    existing fixture carries it, no hash moved.

Three implementation completions beyond the plan (all behaviour-
preserving, surfaced during execution):

1. The signature-only skip had to apply at the mono pass's two
   synth-on-body re-entry sites (collect_mono_targets,
   collect_residuals_ordered), not only check_fn — else an intrinsic
   body hits synth's Term::Intrinsic internal-error guard. Repaired by
   extracting the shared crate::is_intrinsic_body helper and applying
   it at all three synth-on-body paths. Not a representation surprise:
   the same signature-only treatment, more call sites.

2. The compiler-enumerated exhaustive-match set was broader than the
   plan's named grep set (the plan anticipated this and made the sweep
   compile-driven). Extra leaf arms in core desugar/workspace, check
   reuse-as + qualify_workspace_term, codegen synth_with_extras,
   ail/src/main.rs, and four test targets.

3. Fixture corrections: emit_answer needed the body-close
   (block terminator) the plan snippet omitted; kernel_answer.ail's
   main is (ret Unit)(effects IO) using (app print ...) since
   io/print_int does not exist (the plan flagged this for the
   implementer to resolve against real effect-op names).

IR snapshots (hello/sum/list/max3/ws_main.ll) refreshed: purely
additive @ail_kernel_stub_answer fn+adapter+closure, emitted into
every workspace exactly as the pre-existing @ail_kernel_stub_new
already was (kernel_stub is auto-injected; confirmed new was present
in the pre-iter hello.ll baseline). No user-fn IR changed.

The .2 iteration migrates the 18 prelude dummy bodies to (intrinsic),
upgrades registry_contains_all_legacy_arms to a source<->registry
bijection pin, and removes the dead body-lowering path.

crates/ail/src/main.rs

@@ -1585,6 +1585,7 @@ fn walk_term(
                 }
             }
         }
+        Term::Intrinsic => {}
     }
 }
 
@@ -2956,6 +2957,7 @@ fn rewrite_def(
                     }
                 }
             }
+            Term::Intrinsic => {}
         }
     }
 

crates/ail/tests/codegen_import_map_fallback_pin.rs

@@ -106,6 +106,7 @@ fn synthesised_print_uses_user_module_show_via_fallback() {
                 ailang_core::ast::NewArg::Type(_) => false,
             }),
             Term::Lit { .. } => false,
+            Term::Intrinsic => false,
         }
     }
 

crates/ail/tests/e2e.rs

@@ -82,6 +82,19 @@ fn sum_1_to_10_is_55() {
     assert_eq!(stdout.trim(), "55");
 }
 
+/// Property protected: a kernel-tier `(intrinsic)` fn builds and runs
+/// from source to native via the codegen intercept registry. The
+/// `kernel_stub.answer` intrinsic (body `Term::Intrinsic`, intercept
+/// `emit_answer` → `ret i64 42`) is consumed by a user module and its
+/// value reaches stdout. This is the end-to-end ratifier for the whole
+/// Term::Intrinsic mechanism: parse → signature-only typecheck →
+/// mono-skip → intercept-routed codegen → native 42.
+#[test]
+fn answer_intrinsic_builds_and_runs_printing_42() {
+    let out = build_and_run("kernel_answer.ail");
+    assert_eq!(out.trim(), "42");
+}
+
 #[test]
 fn loop_recur_sum_to_runs_to_value() {
     let stdout = build_and_run("loop_sum_to_run.ail");
@@ -1259,6 +1272,53 @@ fn check_json_unbound_var() {
     );
 }
 
+/// Property protected: an `(intrinsic)` body is rejected in a
+/// non-kernel-tier user module. `check_fn`'s honesty-rule guard fires
+/// `intrinsic-outside-kernel-tier` (Error) when a module that is
+/// neither kernel-tier nor the prelude declares a compiler-supplied
+/// body. Without the guard, user code could claim the compiler
+/// supplies a body it does not. The reject rides the subprocess
+/// `ail check --json` path so the diagnostic code is asserted as the
+/// machine consumer would see it; a temp file keeps the reject case
+/// out of the round-trip corpus.
+#[test]
+fn intrinsic_in_user_module_is_rejected() {
+    let tmp = std::env::temp_dir().join(format!(
+        "ailang_intrinsic_reject_{}",
+        std::process::id()
+    ));
+    std::fs::create_dir_all(&tmp).unwrap();
+    let src = tmp.join("intr_user.ail");
+    std::fs::write(
+        &src,
+        "(module intr_user (fn f (type (fn-type (params (con Int)) (ret (con Int)))) (params n) (intrinsic)))",
+    )
+    .unwrap();
+
+    let output = Command::new(ail_bin())
+        .args(["check", src.to_str().unwrap(), "--json"])
+        .output()
+        .expect("ail check --json failed to run");
+
+    let code = output.status.code().expect("process terminated by signal");
+    assert_eq!(
+        code, 1,
+        "expected exit 1, stderr: {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+    let stdout = String::from_utf8(output.stdout).expect("stdout utf8");
+    let diags: serde_json::Value =
+        serde_json::from_str(stdout.trim()).expect("stdout must be valid JSON");
+    let arr = diags.as_array().expect("diagnostics must be a JSON array");
+    assert!(
+        arr.iter().any(|d| {
+            d.get("severity").and_then(|v| v.as_str()) == Some("error")
+                && d.get("code").and_then(|v| v.as_str()) == Some("intrinsic-outside-kernel-tier")
+        }),
+        "expected an error with code intrinsic-outside-kernel-tier; got: {stdout}"
+    );
+}
+
 /// literal patterns at top level and inside Ctor
 /// sub-patterns. Property protected: the 16a desugar pass rewrites
 /// every `Pattern::Lit` to a `Term::If` against the scrutinee/field

crates/ail/tests/snapshots/hello.ll

@@ -26,6 +26,7 @@ declare i64 @llvm.fptosi.sat.i64.f64(double)
 
 @ail_hello_main_clos = private unnamed_addr constant { ptr, ptr } { ptr @ail_hello_main_adapter, ptr null }
 @ail_kernel_stub_new_clos = private unnamed_addr constant { ptr, ptr } { ptr @ail_kernel_stub_new_adapter, ptr null }
+@ail_kernel_stub_answer_clos = private unnamed_addr constant { ptr, ptr } { ptr @ail_kernel_stub_answer_adapter, ptr null }
 @ail_prelude_float_eq_clos = private unnamed_addr constant { ptr, ptr } { ptr @ail_prelude_float_eq_adapter, ptr null }
 @ail_prelude_float_ne_clos = private unnamed_addr constant { ptr, ptr } { ptr @ail_prelude_float_ne_adapter, ptr null }
 @ail_prelude_float_lt_clos = private unnamed_addr constant { ptr, ptr } { ptr @ail_prelude_float_lt_adapter, ptr null }
@@ -61,6 +62,17 @@ entry:
   ret ptr %r
 }
 
+define i64 @ail_kernel_stub_answer() {
+entry:
+  ret i64 42
+}
+
+define i64 @ail_kernel_stub_answer_adapter(ptr %_env) {
+entry:
+  %r = call i64 @ail_kernel_stub_answer()
+  ret i64 %r
+}
+
 define void @drop_kernel_stub_StubT(ptr %p) {
 entry:
   %is_null = icmp eq ptr %p, null

crates/ail/tests/snapshots/list.ll

@@ -23,6 +23,7 @@ declare ptr @ailang_str_concat(ptr, ptr)
 declare i64 @llvm.fptosi.sat.i64.f64(double)
 
 @ail_kernel_stub_new_clos = private unnamed_addr constant { ptr, ptr } { ptr @ail_kernel_stub_new_adapter, ptr null }
+@ail_kernel_stub_answer_clos = private unnamed_addr constant { ptr, ptr } { ptr @ail_kernel_stub_answer_adapter, ptr null }
 @ail_list_sum_list_clos = private unnamed_addr constant { ptr, ptr } { ptr @ail_list_sum_list_adapter, ptr null }
 @ail_list_main_clos = private unnamed_addr constant { ptr, ptr } { ptr @ail_list_main_adapter, ptr null }
 @ail_prelude_float_eq_clos = private unnamed_addr constant { ptr, ptr } { ptr @ail_prelude_float_eq_adapter, ptr null }
@@ -48,6 +49,17 @@ entry:
   ret ptr %r
 }
 
+define i64 @ail_kernel_stub_answer() {
+entry:
+  ret i64 42
+}
+
+define i64 @ail_kernel_stub_answer_adapter(ptr %_env) {
+entry:
+  %r = call i64 @ail_kernel_stub_answer()
+  ret i64 %r
+}
+
 define void @drop_kernel_stub_StubT(ptr %p) {
 entry:
   %is_null = icmp eq ptr %p, null

crates/ail/tests/snapshots/max3.ll

@@ -23,6 +23,7 @@ declare ptr @ailang_str_concat(ptr, ptr)
 declare i64 @llvm.fptosi.sat.i64.f64(double)
 
 @ail_kernel_stub_new_clos = private unnamed_addr constant { ptr, ptr } { ptr @ail_kernel_stub_new_adapter, ptr null }
+@ail_kernel_stub_answer_clos = private unnamed_addr constant { ptr, ptr } { ptr @ail_kernel_stub_answer_adapter, ptr null }
 @ail_max3_max_clos = private unnamed_addr constant { ptr, ptr } { ptr @ail_max3_max_adapter, ptr null }
 @ail_max3_max3_clos = private unnamed_addr constant { ptr, ptr } { ptr @ail_max3_max3_adapter, ptr null }
 @ail_max3_main_clos = private unnamed_addr constant { ptr, ptr } { ptr @ail_max3_main_adapter, ptr null }
@@ -51,6 +52,17 @@ entry:
   ret ptr %r
 }
 
+define i64 @ail_kernel_stub_answer() {
+entry:
+  ret i64 42
+}
+
+define i64 @ail_kernel_stub_answer_adapter(ptr %_env) {
+entry:
+  %r = call i64 @ail_kernel_stub_answer()
+  ret i64 %r
+}
+
 define void @drop_kernel_stub_StubT(ptr %p) {
 entry:
   %is_null = icmp eq ptr %p, null

crates/ail/tests/snapshots/sum.ll

@@ -23,6 +23,7 @@ declare ptr @ailang_str_concat(ptr, ptr)
 declare i64 @llvm.fptosi.sat.i64.f64(double)
 
 @ail_kernel_stub_new_clos = private unnamed_addr constant { ptr, ptr } { ptr @ail_kernel_stub_new_adapter, ptr null }
+@ail_kernel_stub_answer_clos = private unnamed_addr constant { ptr, ptr } { ptr @ail_kernel_stub_answer_adapter, ptr null }
 @ail_prelude_float_eq_clos = private unnamed_addr constant { ptr, ptr } { ptr @ail_prelude_float_eq_adapter, ptr null }
 @ail_prelude_float_ne_clos = private unnamed_addr constant { ptr, ptr } { ptr @ail_prelude_float_ne_adapter, ptr null }
 @ail_prelude_float_lt_clos = private unnamed_addr constant { ptr, ptr } { ptr @ail_prelude_float_lt_adapter, ptr null }
@@ -49,6 +50,17 @@ entry:
   ret ptr %r
 }
 
+define i64 @ail_kernel_stub_answer() {
+entry:
+  ret i64 42
+}
+
+define i64 @ail_kernel_stub_answer_adapter(ptr %_env) {
+entry:
+  %r = call i64 @ail_kernel_stub_answer()
+  ret i64 %r
+}
+
 define void @drop_kernel_stub_StubT(ptr %p) {
 entry:
   %is_null = icmp eq ptr %p, null

crates/ail/tests/snapshots/ws_main.ll

@@ -23,6 +23,7 @@ declare ptr @ailang_str_concat(ptr, ptr)
 declare i64 @llvm.fptosi.sat.i64.f64(double)
 
 @ail_kernel_stub_new_clos = private unnamed_addr constant { ptr, ptr } { ptr @ail_kernel_stub_new_adapter, ptr null }
+@ail_kernel_stub_answer_clos = private unnamed_addr constant { ptr, ptr } { ptr @ail_kernel_stub_answer_adapter, ptr null }
 @ail_prelude_float_eq_clos = private unnamed_addr constant { ptr, ptr } { ptr @ail_prelude_float_eq_adapter, ptr null }
 @ail_prelude_float_ne_clos = private unnamed_addr constant { ptr, ptr } { ptr @ail_prelude_float_ne_adapter, ptr null }
 @ail_prelude_float_lt_clos = private unnamed_addr constant { ptr, ptr } { ptr @ail_prelude_float_lt_adapter, ptr null }
@@ -48,6 +49,17 @@ entry:
   ret ptr %r
 }
 
+define i64 @ail_kernel_stub_answer() {
+entry:
+  ret i64 42
+}
+
+define i64 @ail_kernel_stub_answer_adapter(ptr %_env) {
+entry:
+  %r = call i64 @ail_kernel_stub_answer()
+  ret i64 %r
+}
+
 define void @drop_kernel_stub_StubT(ptr %p) {
 entry:
   %is_null = icmp eq ptr %p, null