iter intrinsic-bodies.1-mechanism (DONE 8/8): Term::Intrinsic leaf + cross-crate wiring (refs #9)

First iteration of the intrinsic-bodies milestone. Introduces the
Form-A `(intrinsic)` body marker as a new leaf AST term and wires it
through surface, checker, codegen, and a kernel_stub ratifier. The
prelude migration + hard-lockstep pin + dead-path removal are .2.

What landed (8 tasks):

  Task 1 — Term::Intrinsic unit variant (ast.rs), tag "t":"intrinsic"
    via the enum's rename_all=lowercase. Additive: no existing fixture
    carries it, hashes bit-identical. In-core exhaustive-match arms
    (canonical/hash/visit/pretty/desugar/workspace) added as leaves.
  Task 2 — surface parse + print: (intrinsic) as a fn body-slot clause
    and a lambda positional body, mapped to/from Term::Intrinsic.
  Task 3 — cross-crate walker sweep (check/codegen/prose/ail-main):
    leaf no-op/identity arms at every no-wildcard Term match the
    compiler flagged.
  Task 4 — checker: new Env.current_module_kernel_tier flag (m.kernel
    || m.name=="prelude"), set alongside current_module. A def whose
    body is intrinsic (top-level fn OR instance-method lambda, via the
    shared is_intrinsic_body helper) is checked signature-only; an
    intrinsic body outside kernel-tier/prelude is rejected with
    intrinsic-outside-kernel-tier.
  Task 5 — codegen: an intrinsic-bodied fn routes through the existing
    try_emit_primitive_instance_body / intercepts::lookup path; if no
    intercept fired it is an internal error, never a lower_term
    fallthrough. lower_term and the synth walker get Term::Intrinsic
    internal-error arms (an intrinsic body reaching either is an
    escape bug).
  Task 6 — answer intercept (ret i64 42) registered in INTERCEPTS;
    the `answer : () -> Int` intrinsic added to STUB_AIL;
    examples/kernel_intrinsic_smoke.ail added so schema_coverage
    observes Term::Intrinsic in the examples/ corpus.
  Task 7 — E2E ratifier: examples/kernel_answer.ail calls
    kernel_stub.answer and prints 42; answer_intrinsic_builds_and_runs_printing_42
    asserts it end-to-end (source → native).
  Task 8 — design/contracts/0002-data-model.md gains the
    { "t": "intrinsic" } Term entry + fn/lam prose; form_a.md grammar
    note updated.

Verification:
  cargo test --workspace → 669 passed, 0 failed (baseline 667 +2:
    intrinsic_in_user_module_is_rejected, answer_intrinsic_builds_and_runs_printing_42).
  bench/check.py + bench/compile_check.py → 0 regressed.
  Reject E2E (subprocess ail check --json, exit 1, code
    intrinsic-outside-kernel-tier) GREEN.
  Round-trip + hash pins GREEN — Term::Intrinsic is additive, no
    existing fixture carries it, no hash moved.

Three implementation completions beyond the plan (all behaviour-
preserving, surfaced during execution):

1. The signature-only skip had to apply at the mono pass's two
   synth-on-body re-entry sites (collect_mono_targets,
   collect_residuals_ordered), not only check_fn — else an intrinsic
   body hits synth's Term::Intrinsic internal-error guard. Repaired by
   extracting the shared crate::is_intrinsic_body helper and applying
   it at all three synth-on-body paths. Not a representation surprise:
   the same signature-only treatment, more call sites.

2. The compiler-enumerated exhaustive-match set was broader than the
   plan's named grep set (the plan anticipated this and made the sweep
   compile-driven). Extra leaf arms in core desugar/workspace, check
   reuse-as + qualify_workspace_term, codegen synth_with_extras,
   ail/src/main.rs, and four test targets.

3. Fixture corrections: emit_answer needed the body-close
   (block terminator) the plan snippet omitted; kernel_answer.ail's
   main is (ret Unit)(effects IO) using (app print ...) since
   io/print_int does not exist (the plan flagged this for the
   implementer to resolve against real effect-op names).

IR snapshots (hello/sum/list/max3/ws_main.ll) refreshed: purely
additive @ail_kernel_stub_answer fn+adapter+closure, emitted into
every workspace exactly as the pre-existing @ail_kernel_stub_new
already was (kernel_stub is auto-injected; confirmed new was present
in the pre-iter hello.ll baseline). No user-fn IR changed.

The .2 iteration migrates the 18 prelude dummy bodies to (intrinsic),
upgrades registry_contains_all_legacy_arms to a source<->registry
bijection pin, and removes the dead body-lowering path.

crates/ailang-codegen/src/escape.rs

@@ -213,6 +213,7 @@ fn walk(t: &Term, out: &mut NonEscapeSet) {
             }
         }
         Term::Lit { .. } | Term::Var { .. } => {}
+        Term::Intrinsic => {}
     }
 }
 
@@ -420,6 +421,7 @@ fn escapes(t: &Term, tainted: &BTreeSet<String>, in_tail: bool) -> bool {
             }
             false
         }
+        Term::Intrinsic => false,
     }
 }
 
@@ -552,6 +554,7 @@ fn collect_free_vars(t: &Term, bound: &mut BTreeSet<String>, out: &mut BTreeSet<
                 }
             }
         }
+        Term::Intrinsic => {}
     }
 }
 

crates/ailang-codegen/src/intercepts.rs

@@ -164,6 +164,13 @@ pub(crate) static INTERCEPTS: &[Intercept] = &[
         wants_alwaysinline: true,
         emit: emit_ne_int,
     },
+    Intercept {
+        name: "answer",
+        expected_params: &[],
+        expected_ret: "i64",
+        wants_alwaysinline: false,
+        emit: emit_answer,
+    },
 ];
 
 pub(crate) fn lookup(name: &str) -> Option<&'static Intercept> {
@@ -440,6 +447,17 @@ pub(crate) fn emit_ne_int(emitter: &mut Emitter<'_>) -> Result<()> {
         .map(|_| ())
 }
 
+/// Ratifier intrinsic for intrinsic-bodies.1: `answer : () -> Int`
+/// returns the constant 42. Exercises the Term::Intrinsic → registry
+/// route end-to-end. May be retired once a real kernel-tier intrinsic
+/// (raw-buf) lands.
+pub(crate) fn emit_answer(emitter: &mut Emitter<'_>) -> Result<()> {
+    emitter.body.push_str("  ret i64 42\n");
+    emitter.body.push_str("}\n\n");
+    emitter.block_terminated = true;
+    Ok(())
+}
+
 #[cfg(test)]
 mod tests {
     use super::lookup;

crates/ailang-codegen/src/lambda.rs

@@ -502,6 +502,7 @@ impl<'a> Emitter<'a> {
                     }
                 }
             }
+            Term::Intrinsic => {}
         }
     }
 

crates/ailang-codegen/src/lib.rs

@@ -1320,6 +1320,21 @@ impl<'a> Emitter<'a> {
         let body_was_intercepted =
             self.try_emit_primitive_instance_body(&f.name, &llvm_param_tys, &llvm_ret)?;
 
+        // An `(intrinsic)` body is supplied entirely by the intercept
+        // registry. `try_emit_primitive_instance_body` already consults
+        // `intercepts::lookup(&f.name)`; if it fired, the body is fully
+        // emitted. If it did NOT fire, the intrinsic has no registered
+        // implementation — surface that as an internal error rather than
+        // falling through to `lower_term`, which cannot lower a
+        // `Term::Intrinsic` (it is signature-only, not an expression).
+        if !body_was_intercepted && matches!(f.body, Term::Intrinsic) {
+            return Err(CodegenError::Internal(format!(
+                "intrinsic fn `{}` has no registered intercept; an `(intrinsic)` body must \
+                 resolve through the intercept registry",
+                f.name
+            )));
+        }
+
         if !body_was_intercepted {
             let (val, val_ty) = self.lower_term(&f.body)?;
         if !self.block_terminated {
@@ -2076,6 +2091,11 @@ impl<'a> Emitter<'a> {
                 "Term::New requires the type's `new` def to be desugared first; \
                  codegen does not yet support Term::New directly — milestone raw-buf".into(),
             )),
+            Term::Intrinsic => Err(CodegenError::Internal(
+                "Term::Intrinsic must be consumed by the intercept route in fn-body \
+                 emission, not lowered as an expression; reaching lower_term means an \
+                 intrinsic body escaped its definition slot".into(),
+            )),
         }
     }
 
@@ -3273,6 +3293,11 @@ impl<'a> Emitter<'a> {
                 "Term::New cannot be synthed at codegen — must be desugared first; \
                  codegen support lands in the raw-buf milestone".into(),
             )),
+            Term::Intrinsic => Err(CodegenError::Internal(
+                "Term::Intrinsic cannot be synthed at codegen — an intrinsic body is \
+                 signature-only and routed through the intercept registry, never an expression"
+                    .into(),
+            )),
         }
     }
 }