feat(lang): eliminate the Implicit ownership default — totality + the drop-soundness it demasks (#55)

Deletes `ParamMode::Implicit`. `ParamMode` is now `{Own, Borrow}`:
every fn-type slot on every signature carries an explicit `own` or
`borrow`, no defaulted position survives anywhere (model 0008 §2,
spec 0062). The parser rejects a bare fn-type slot; `borrow-return`
and `borrow-over-value` reject at the signature; the corpus is
migrated to minimal-ownership modes (consumed ⇒ own, read-only-heap
⇒ borrow, value ⇒ trivial-own). The documented `Implicit`-ret-mode
leak is fixed: an owned heap return now drops exactly once (live=0,
acceptance criterion 5).

This was the easy half. Removing the default ACTIVATED a family of
drop paths that `Implicit` had silently skipped — the pre-cutover
language was leaking (and in places mis-dropping) here rather than
crashing, because an Implicit scrutinee turned the drop off. Making
the modes explicit (Own) turned those paths on and exposed two
latent-bug clusters, all fixed RED-first as part of this cutover:

Drop-soundness family (four legs):
  A. lit-sub-pattern double-free — the desugar re-matched the same
     owned scrutinee in the lit fall-through; fixed by grouping
     consecutive same-ctor arms into one match (bind fields once),
     in ailang-core desugar.
  B. Cons-husk leak on non-tail arm bodies — the lit-sub-pattern
     desugar rebound the owned scrutinee via `Let $mp = xs`, which
     bumped consume_count and suppressed the existing fn-return
     partial_drop. Fixed by not rebinding a bare-Var scrutinee
     (one husk-freeing mechanism, not two).
  C. polymorphic `drop_<T>` rc_dec'd monomorphised value fields —
     the per-ADT drop fn was emitted once from the polymorphic
     TypeDef, defaulting type-var fields to ptr and rc_dec'ing
     inline Ints (segfault). Fixed with per-monomorph drop
     functions (new ailang-codegen::dropmono): the drop set is
     collected from the lowered MIR, value-type fields are skipped,
     heap fields still freed once; monomorphic-concrete ADTs keep
     their byte-identical un-suffixed drop symbol.
  D. static Str literal passed to an `(own Str)` param — the
     literal lowers to a header-less rodata constant; the callee's
     now-active rc_dec read its length field as a refcount and
     freed a static address (segfault). Fixed with the missing
     fourth StrRep::Static→Heap promotion in lower_to_mir's App arm,
     gated on Own mode (borrow args stay static, no regression).

over-strict-mode lint over-fired: it suggested `(borrow V)` for
value-typed params (which `borrow-over-value` rejects — own is the
only legal mode there) and fired on `(intrinsic)` bodies (whose
consumption the linearity walk cannot observe). Tightened to skip
both; contract 0008 updated to the narrowed firing scope.

Irreversible step — canonical-form hash reset (model 0008 §6,
acceptance criterion 6). Every signature now carries explicit modes,
so the hashable canonical JSON changed for every module. RATIFY:
the corpus-wide hash-pin reset (hash_pin, prelude_module_hash_pin,
mono_hash_stability, eq_ord_e2e, embed_export_hash_stable, the
ct4/iter*/loop_recur schema-extension pins) and the list ir_snapshot
golden were regenerated once, deliberately, as the intended one-time
consequence of removing the mode elision from the canonical form —
not a regression. Each regenerated hash verified deterministic across
two runs.

Also fixes a pre-existing latent failure surfaced by the verification
gate, unrelated to this cutover: the `every_contract_names_a_resolvable_
ratifying_test` resolver (design_index_pin) could not resolve the
" + " dual-link ratifying-test form (`uniqueness.rs + linearity.rs`)
that the #57 audit-close (dfdc65f) introduced — it shipped red on that
commit. Resolver taught the dual-link form, mirroring its sibling.

Verification: cargo test --workspace = 731 passed, 0 failed (twice,
stable); e2e 102 passed, no binary exits non-zero (corpus crash-free);
grep-clean for Implicit/fn_implicit/mode_eq across crates; every drop
fix confirmed via emitted IR + AILANG_RC_STATS balance on the head==K,
head!=K, and Nil paths. Three BLOCKEDs en route (the unsound first
husk-dec attempt, the over-strict derivation premise, the leg-B fix
direction) were each treated as a real design/spec gap and rediagnosed,
not patched over.

Supersedes #54 (return-position-only leak patch). Precondition #57
(linearity hardening) was already met. Spec docs/specs/0062, plan
docs/plans/0121.

closes #55

crates/ail/tests/e2e.rs

@@ -82,6 +82,80 @@ fn sum_1_to_10_is_55() {
     assert_eq!(stdout.trim(), "55");
 }
 
+/// Property: a static `Str` literal passed by value into an `(own Str)`
+/// parameter that the callee drops must be RC-sound — dropped exactly
+/// once, no double-free, no leak.
+///
+/// RED for the #55-cutover drop-soundness crash. The literal lowers to
+/// `StrRep::Static` (a header-less rodata constant), but the cutover
+/// activates the Own-param drop path, which emits `ailang_rc_dec` on
+/// the unused param. `rc_dec` reads `payload - 8` as a refcount and
+/// `free()`s a static address -> SIGSEGV. `lower_to_mir`'s `Term::App`
+/// arm must flip such an argument to `StrRep::Heap` (str_clone into an
+/// owned slab), the same promotion mir.4 applies to loop-carried Str
+/// literals. Distinct root from legs A/B (the lit-pattern desugar); the
+/// match in eq_demo merely happens to drop its owned Str scrutinee too.
+///
+/// The assertion is robust against the stats-path masking leg A showed:
+/// it runs the binary on the NON-stats path (catching the SIGSEGV via
+/// the exit status) AND on the stats path asserting `live=0` /
+/// `frees==allocs`.
+#[test]
+fn own_str_literal_arg_is_dropped_exactly_once() {
+    let manifest_dir = env!("CARGO_MANIFEST_DIR");
+    let workspace = Path::new(manifest_dir).parent().unwrap().parent().unwrap();
+    let src = workspace.join("examples").join("own_str_arg_drop.ail");
+    let tmp = std::env::temp_dir().join(format!(
+        "ailang_e2e_own_str_arg_drop_{}",
+        std::process::id()
+    ));
+    std::fs::create_dir_all(&tmp).unwrap();
+    let out = tmp.join("bin");
+
+    let status = Command::new(ail_bin())
+        .args(["build", src.to_str().unwrap(), "-o"])
+        .arg(&out)
+        .status()
+        .expect("ail build failed to run");
+    assert!(status.success(), "ail build failed for own_str_arg_drop.ail");
+
+    // NON-stats path: this is the crashing path (SIGSEGV / double-free).
+    let plain = Command::new(&out).output().expect("execute binary");
+    assert!(
+        plain.status.success(),
+        "binary {} exited non-zero (expected success; got {:?}) — \
+         the owned Str literal was dropped on a header-less static",
+        out.display(),
+        plain.status.code()
+    );
+    assert_eq!(
+        String::from_utf8(plain.stdout).expect("stdout utf8").trim(),
+        "0"
+    );
+
+    // Stats path: RC balance must close — no leaked or double-freed Str.
+    let stats = Command::new(&out)
+        .env("AILANG_RC_STATS", "1")
+        .output()
+        .expect("execute binary with RC stats");
+    assert!(
+        stats.status.success(),
+        "binary {} (RC stats) exited non-zero (expected success; got {:?})",
+        out.display(),
+        stats.status.code()
+    );
+    let stderr = String::from_utf8(stats.stderr).expect("stderr utf8");
+    let line = stderr
+        .lines()
+        .find(|l| l.starts_with("ailang_rc_stats:"))
+        .unwrap_or_else(|| panic!("no ailang_rc_stats line in stderr: {stderr:?}"));
+    // Format: `ailang_rc_stats: allocs=N frees=M live=K`
+    assert!(
+        line.contains("live=0"),
+        "RC balance not closed: {line:?} (live != 0 means leak or double-free)"
+    );
+}
+
 #[test]
 fn loop_recur_sum_to_runs_to_value() {
     let stdout = build_and_run("loop_sum_to_run.ail");
@@ -1294,7 +1368,7 @@ fn intrinsic_in_user_module_is_rejected() {
     let src = tmp.join("intr_user.ail");
     std::fs::write(
         &src,
-        "(module intr_user (fn f (type (fn-type (params (con Int)) (ret (con Int)))) (params n) (intrinsic)))",
+        "(module intr_user (fn f (type (fn-type (params (own (con Int))) (ret (own (con Int))))) (params n) (intrinsic)))",
     )
     .unwrap();
 
@@ -1344,6 +1418,88 @@ fn lit_pat_demo() {
     assert_eq!(lines, vec!["100", "200", "999", "-1", "0", "7"]);
 }
 
+/// RED (refs #55, Implicit-cutover double-drop). Property protected:
+/// a ctor arm with a literal sub-pattern in a non-tail field —
+/// `(Cons (pat-lit K) _)` — drops the matched value's owned children
+/// EXACTLY ONCE, on both the head==K and head!=K paths.
+///
+/// The 16c lit-sub-pattern desugar lowers the arm into an outer
+/// Cons-match (binding the fields) wrapping `if (== head K) body
+/// else fall_k`; `fall_k` re-matches the same owned scrutinee, re-
+/// binding its children. Post-#55 the param mode is `Own`, so the
+/// match_lower.rs arm-close Iter-A drop (gated on `scrutinee_is_owned`)
+/// fires on the tail child in BOTH the re-match arm AND the enclosing
+/// lit-arm's join — `arg_xs+16` is dropped twice → double-free →
+/// SIGSEGV on the head!=K path.
+///
+/// Two assertions, so the symptom is pinned independently of the
+/// stats-drop masking divergence:
+///   1. `build_and_run` (no AILANG_RC_STATS): asserts the binary exits
+///      0 AND prints `0` then `7` — surfaces the segfault directly.
+///   2. rc-stats: `live == 0` and `frees == allocs` — pins single-drop
+///      (a double-free would over-count frees / corrupt the heap)
+///      rather than mere exit-0.
+#[test]
+fn lit_pat_ctor_tail_drop_single_drop() {
+    let stdout = build_and_run("lit_pat_ctor_tail_drop.ail");
+    let lines: Vec<&str> = stdout.lines().collect();
+    assert_eq!(lines, vec!["0", "7"]);
+
+    let (stats_stdout, allocs, frees, live) =
+        build_and_run_with_rc_stats("lit_pat_ctor_tail_drop.ail");
+    assert_eq!(
+        stats_stdout.lines().collect::<Vec<_>>(),
+        vec!["0", "7"],
+        "stdout under rc-stats must match the non-stats run"
+    );
+    assert_eq!(live, 0, "owned IntList children must all be freed (no leak)");
+    assert_eq!(
+        frees, allocs,
+        "every alloc freed exactly once — a double-free over-counts frees"
+    );
+}
+
+/// RED (refs #55, Implicit-cutover husk leak — leg B, Nil sub-case).
+/// Property protected: an owned scrutinee threaded through the
+/// lit-sub-pattern chain desugar has its OUTER cell freed exactly once
+/// on the Nil return path — the path that matches the Nil arm and
+/// touches neither inner Cons re-match.
+///
+/// The 16c desugar takes `first_or_default` off the `is_flat`
+/// fast-path (it has a lit sub-pattern arm), let-binds the owned
+/// scrutinee into a fresh `$mp` var, and chains single-level matches.
+/// Post-#55 the `Let $mp = xs` consumes `xs` (consume_count := 1),
+/// which trips the codegen fn-return gate (lib.rs ~1522, `if
+/// consume_count != 0 { continue }`) and suppresses the husk free a
+/// single-match owned fn would emit as `partial_drop_<T>(arg_xs, _)`.
+/// The husk obligation also moves to the internal `$mp` binder the
+/// gate never inspects. The Nil cell leaks -> live=1.
+///
+/// Distinct from `lit_pat_ctor_tail_drop_single_drop`, which only
+/// drives the Cons path: a fix that frees the husk on the Cons path
+/// but forgets the Nil path passes that test while still leaking here.
+#[test]
+fn lit_pat_nil_scrutinee_single_drop() {
+    let stdout = build_and_run("lit_pat_nil_scrutinee_drop.ail");
+    assert_eq!(stdout.lines().collect::<Vec<_>>(), vec!["-1"]);
+
+    let (stats_stdout, allocs, frees, live) =
+        build_and_run_with_rc_stats("lit_pat_nil_scrutinee_drop.ail");
+    assert_eq!(
+        stats_stdout.lines().collect::<Vec<_>>(),
+        vec!["-1"],
+        "stdout under rc-stats must match the non-stats run"
+    );
+    assert_eq!(
+        live, 0,
+        "the Nil scrutinee's outer cell must be freed (no husk leak)"
+    );
+    assert_eq!(
+        frees, allocs,
+        "every alloc freed exactly once — a double-free over-counts frees"
+    );
+}
+
 /// `__unreachable__` as an explicit user-callable
 /// primitive. Property protected: a polymorphic `forall a. a` value
 /// reference (a) typechecks against any expected type at the use
@@ -2395,43 +2551,41 @@ fn alloc_rc_let_binder_for_owned_returning_app_drops_at_scope_close() {
     );
 }
 
-/// a let-binder whose value is the
-/// result of an `Implicit`-ret-mode (default, unannotated) call must
-/// NOT be trackable. Implicit is the back-compat lane that 18c.3
-/// documented as "params don't get any dec — leak rather than mis-
-/// dec"; the symmetric carve-out for ret-modes is "Implicit-returning
-/// calls do not flow ownership to the caller, the caller must NOT
-/// dec".
+/// a let-binder whose value is the result of an `(own T)`-ret-mode
+/// call IS trackable for scope-close drop. ParamMode is binary
+/// `{Own, Borrow}`: an unannotated return defaults to `Own`, the
+/// callee's `(own T)` return signs the static contract that the
+/// caller now owns the returned cell, and the let-scope close emits
+/// the caller dec so the cell frees exactly once.
 ///
-/// If `is_rc_heap_allocated` were mistakenly to fire on this shape,
-/// the let-scope close would emit an unjustified dec — refcount
-/// underflow at runtime (the cell's RC reaches zero before any other
-/// owner had a chance to dec). The fixture under `--alloc=rc` must:
+/// The fixture under `--alloc=rc` must:
 ///
 /// (1) Build cleanly (no consume-while-borrowed false positive,
 ///     parse error, or unimplemented).
 /// (2) Exit cleanly with stdout `7` — the unboxed Int from the cell.
-/// (3) Report `live = 1` — the one MkT cell leaks. The leak is the
-///     intentional Implicit-mode behaviour; if codegen ever started
-///     dec'ing this shape it would crash with refcount underflow
-///     before the leak number could even be observed.
+/// (3) Report `live = 0` — the one MkT cell frees. The own-return
+///     contract flows ownership to the caller, which dec's the
+///     binder at scope close. This is the typed-MIR leak fix spec
+///     0062 delivers (acceptance criterion 5): the legacy `Implicit`
+///     back-compat lane that left this shape leaked (`live = 1`) is
+///     gone, so the owned-ret binder is dropped exactly once.
 ///
-/// This test is the negative-side companion to
+/// This test is the positive companion to
 /// `alloc_rc_let_binder_for_owned_returning_app_drops_at_scope_close`:
-/// the asymmetry between (own)-ret-mode (live=0) and Implicit-ret-mode
-/// (live=1) is the documented contract.
+/// both `(own)`-ret-mode shapes free at scope close (`live = 0`).
 #[test]
-fn alloc_rc_let_binder_for_implicit_returning_app_does_not_drop() {
+fn alloc_rc_let_binder_for_owned_returning_app_drops_exactly_once() {
     let (stdout, allocs, frees, live) =
         build_and_run_with_rc_stats("rc_let_implicit_returning_app.ail");
     assert_eq!(stdout.trim(), "7", "alloc(7) -> unbox should print 7");
     assert_eq!(
-        live, 1,
-        "Implicit-ret-mode App must leak (not crash with refcount \
-         underflow); allocs={allocs} frees={frees} live={live}. \
-         A live count of 0 means is_rc_heap_allocated mistakenly \
-         marked Implicit-ret-mode App as trackable; a non-zero exit \
-         means the unjustified dec triggered the underflow guard."
+        live, 0,
+        "owned-ret-mode App binder must drop exactly once at scope \
+         close (post-cutover: no Implicit leak lane); allocs={allocs} \
+         frees={frees} live={live}. A live count of 1 would mean \
+         is_rc_heap_allocated failed to mark the owned-ret App as \
+         trackable; a non-zero exit means an unjustified dec triggered \
+         the underflow guard."
     );
 }