diff --git a/docs/DESIGN.md b/docs/DESIGN.md
index 16bc820..1dc64dd 100644
--- a/docs/DESIGN.md
+++ b/docs/DESIGN.md
@@ -1069,6 +1069,25 @@ identical: `param_modes` is skipped when every entry is
 `Implicit`, `ret_mode` is skipped when `Implicit`. Existing
 modules emit the same bytes as before.
 
+**Type::Con name scoping (canonical form, since ct.1).** Within a
+`.ail.json`, a `Type::Con.name` is interpreted relative to the
+file's top-level `"name"` field (the owning module). Bare names
+(no `.`) refer to a TypeDef in the owning module's own `defs`.
+Cross-module references MUST be qualified `<owning_module>.<TypeName>`
+where `<owning_module>` is a known module in the workspace.
+Primitives (`Int`, `Bool`, `Str`, `Unit`, `Float`) are bare and
+have no module qualifier. Bare cross-module references are a
+schema violation (`WorkspaceLoadError::BareCrossModuleTypeRef`);
+qualified references whose owner is unknown are also a violation
+(`WorkspaceLoadError::BadCrossModuleTypeRef`). The same rule
+applies to `Term::Ctor.type_name`.
+
+Class names (`ClassDef.name`, `InstanceDef.class`,
+`SuperclassRef.class`, `Constraint.class`) are NOT module-scoped
+under this rule; they remain workspace-flat with
+`MethodNameCollision` enforced at load. Class-name scoping is a
+future milestone with its own DESIGN amendment.
+
 The legacy `(con T)` form is treated as `(own T)` semantically.
 
 (An incidental observation, not a design reason: keeping `Type`
@@ -1137,6 +1156,15 @@ Skipped from serialisation when empty so existing fixtures keep
 bit-identical canonical-JSON hashes (regression-pinned by
 `iter19b_empty_suppress_preserves_pre_19b_hashes` and
 `iter19b_schema_extension_preserves_pre_19b_hashes`).
+The canonical-form tightening in ct.1 shifted the hashes of two
+cross-module fixtures (`ordering_match.ail.json` and
+`test_22b1_dup_a.ail.json`); all intra-module fixtures, including
+the regression-pinned `sum.ail.json` and `list.ail.json`, remain
+bit-identical. The new pins are
+`ct4_migrated_fixtures_have_canonical_form_hashes` (locks the
+post-migration hashes) and
+`ct4_unmigrated_fixtures_remain_bit_identical` (re-asserts the
+existing 13a/19b/22b.1 hashes still hold).
 
 ### Advisory diagnostics