spec: design-ledger-formal-links — formal cross-links in the design/ ledger

Positive completion of the DESIGN.md -> design/ split: informal prose
cross-references become formal file-relative Markdown links, gated by a
new RED-first design_index_pin.rs clause-5 (every design/ body link
resolves into the durable tier or fails the build). INDEX spine stays
repo-root-relative (registry tier, clause-1 unchanged). No authoring
surface. Eight converged commitments + the user-decided INDEX sub-fork;
grounding-check PASS 7/7. roadmap [~] in-flight.

docs/roadmap.md

@@ -506,6 +506,34 @@ work progresses.
     convergence). CLOSED — audited + drift-resolved; hard gate
     enforces the honesty spirit.
 
+- [~] **\[milestone\]** Formal cross-links in the `design/` ledger
+  (browsable wiki) — IN FLIGHT 2026-05-19. The positive completion
+  of DESIGN.md → `design/`: informal prose cross-references between
+  contracts/models (`(see "Str ABI" below)`, bare-path-in-prose,
+  `§"Section"`) become **formal file-relative Markdown links**
+  `[label](./sibling.md)` / `[label](../../crates/.../x.rs)`
+  resolved relative to the containing file, plus a new RED-first
+  `design_index_pin.rs` **clause-5** that fails the build on any
+  body link that does not resolve into the durable tier (`design/`
+  + `crates/**` + `runtime/**` only — never `docs/`, never a
+  `#fragment`). clause-5 ∘ clause-3 = complete invariant: every
+  contract cross-reference is a resolving durable file-link or
+  clause-3-forbidden history prose. The INDEX **spine stays
+  repo-root-relative** (registry tier, clause-1 byte-unchanged) —
+  the move-fragility rationale that drives body prose to
+  file-relative is absent for the file that never moves.
+  No authoring surface (no `.ail`; precedent: the split spec,
+  audited clean). Out of scope (recon-forced): intra-file
+  "above/below" within one document (no file-link form; the
+  file-split is a separate concern).
+  - context: spec `docs/specs/2026-05-19-design-ledger-formal-links.md`
+    (grounding-check PASS, 7/7 ratified); origin this session's
+    six-turn design conversation following the split close;
+    precedent slice already shipped in the split's tidy
+    (`float-semantics.md` `(see "Str ABI" below)` →
+    `(see design/contracts/str-abi.md)`, now to be brought to the
+    final `[Str ABI](str-abi.md)` form). Awaiting plan.
+
 - [ ] **\[milestone\]** Flat array/slice primitive — performance
   follow-up to the Embedding ABI arc, *not* a capability gap.
   AILang's only sequence is the recursive `List` ADT (one RC cell