feat(lang): eliminate the Implicit ownership default — totality + the drop-soundness it demasks (#55)

Deletes `ParamMode::Implicit`. `ParamMode` is now `{Own, Borrow}`:
every fn-type slot on every signature carries an explicit `own` or
`borrow`, no defaulted position survives anywhere (model 0008 §2,
spec 0062). The parser rejects a bare fn-type slot; `borrow-return`
and `borrow-over-value` reject at the signature; the corpus is
migrated to minimal-ownership modes (consumed ⇒ own, read-only-heap
⇒ borrow, value ⇒ trivial-own). The documented `Implicit`-ret-mode
leak is fixed: an owned heap return now drops exactly once (live=0,
acceptance criterion 5).

This was the easy half. Removing the default ACTIVATED a family of
drop paths that `Implicit` had silently skipped — the pre-cutover
language was leaking (and in places mis-dropping) here rather than
crashing, because an Implicit scrutinee turned the drop off. Making
the modes explicit (Own) turned those paths on and exposed two
latent-bug clusters, all fixed RED-first as part of this cutover:

Drop-soundness family (four legs):
  A. lit-sub-pattern double-free — the desugar re-matched the same
     owned scrutinee in the lit fall-through; fixed by grouping
     consecutive same-ctor arms into one match (bind fields once),
     in ailang-core desugar.
  B. Cons-husk leak on non-tail arm bodies — the lit-sub-pattern
     desugar rebound the owned scrutinee via `Let $mp = xs`, which
     bumped consume_count and suppressed the existing fn-return
     partial_drop. Fixed by not rebinding a bare-Var scrutinee
     (one husk-freeing mechanism, not two).
  C. polymorphic `drop_<T>` rc_dec'd monomorphised value fields —
     the per-ADT drop fn was emitted once from the polymorphic
     TypeDef, defaulting type-var fields to ptr and rc_dec'ing
     inline Ints (segfault). Fixed with per-monomorph drop
     functions (new ailang-codegen::dropmono): the drop set is
     collected from the lowered MIR, value-type fields are skipped,
     heap fields still freed once; monomorphic-concrete ADTs keep
     their byte-identical un-suffixed drop symbol.
  D. static Str literal passed to an `(own Str)` param — the
     literal lowers to a header-less rodata constant; the callee's
     now-active rc_dec read its length field as a refcount and
     freed a static address (segfault). Fixed with the missing
     fourth StrRep::Static→Heap promotion in lower_to_mir's App arm,
     gated on Own mode (borrow args stay static, no regression).

over-strict-mode lint over-fired: it suggested `(borrow V)` for
value-typed params (which `borrow-over-value` rejects — own is the
only legal mode there) and fired on `(intrinsic)` bodies (whose
consumption the linearity walk cannot observe). Tightened to skip
both; contract 0008 updated to the narrowed firing scope.

Irreversible step — canonical-form hash reset (model 0008 §6,
acceptance criterion 6). Every signature now carries explicit modes,
so the hashable canonical JSON changed for every module. RATIFY:
the corpus-wide hash-pin reset (hash_pin, prelude_module_hash_pin,
mono_hash_stability, eq_ord_e2e, embed_export_hash_stable, the
ct4/iter*/loop_recur schema-extension pins) and the list ir_snapshot
golden were regenerated once, deliberately, as the intended one-time
consequence of removing the mode elision from the canonical form —
not a regression. Each regenerated hash verified deterministic across
two runs.

Also fixes a pre-existing latent failure surfaced by the verification
gate, unrelated to this cutover: the `every_contract_names_a_resolvable_
ratifying_test` resolver (design_index_pin) could not resolve the
" + " dual-link ratifying-test form (`uniqueness.rs + linearity.rs`)
that the #57 audit-close (dfdc65f) introduced — it shipped red on that
commit. Resolver taught the dual-link form, mirroring its sibling.

Verification: cargo test --workspace = 731 passed, 0 failed (twice,
stable); e2e 102 passed, no binary exits non-zero (corpus crash-free);
grep-clean for Implicit/fn_implicit/mode_eq across crates; every drop
fix confirmed via emitted IR + AILANG_RC_STATS balance on the head==K,
head!=K, and Nil paths. Three BLOCKEDs en route (the unsound first
husk-dec attempt, the over-strict derivation premise, the leg-B fix
direction) were each treated as a real design/spec gap and rediagnosed,
not patched over.

Supersedes #54 (return-position-only leak patch). Precondition #57
(linearity hardening) was already met. Spec docs/specs/0062, plan
docs/plans/0121.

closes #55

design/contracts/0002-data-model.md

@@ -269,9 +269,8 @@ metadata is defined and gated there as well.
 // Function type. paramModes/retMode are metadata on Type::Fn —
 // they are NOT separate Type variants, so every existing match-arm
 // in the typechecker (unify, occurs, apply) keeps working.
-// `paramModes` omitted when every entry is "implicit"; `retMode`
-// omitted when "implicit" (hash-stable when omitted). Full mode
-// contract lives in contracts/0008-memory-model.md.
+// `paramModes` and `retMode` are always present (one mode per slot).
+// Full mode contract lives in contracts/0008-memory-model.md.
 { "k": "fn",
   "params":     [Type...],
   "paramModes": [ParamMode...],
@@ -294,17 +293,15 @@ metadata is defined and gated there as well.
 [memory model](0008-memory-model.md)):
 
 ```
-"implicit"   — unannotated / back-compat. Treated as `own` by the typechecker.
 "own"        — (own T) — caller transfers ownership; callee consumes.
 "borrow"     — (borrow T) — caller retains ownership; callee may not consume.
 ```
 
-`implicit ≡ own` semantically; the distinction exists so existing
-unannotated fixtures continue to serialize without the mode wrapper and keep their
-canonical-JSON hash. The full mode contract (codegen consequences,
-the over-strict-mode lint, the `Suppress` mechanism) lives in
-[memory model](0008-memory-model.md); the four language-design
-preconditions that make RC sound live in
+Every fn-type slot carries `own` or `borrow`; ownership has no
+default — there is no bare/unannotated mode. The full mode
+contract (codegen consequences, the over-strict-mode lint, the
+`Suppress` mechanism) lives in [memory model](0008-memory-model.md);
+the four language-design preconditions that make RC sound live in
 [language constraints](0015-language-constraints.md).
 
 Ratified by: `crates/ailang-core/tests/design_schema_drift.rs`.

design/contracts/0008-memory-model.md

@@ -54,14 +54,13 @@ schema). The substantive reasons for per-position metadata over a
   ordering that don't exist when modes live in a flat metadata
   vector.
 
-`Implicit` is the legacy / back-compat state — semantically
-equivalent to `Own` but printed bare (`(con T)`, no wrapper).
-`Own` and `Borrow` are explicitly annotated.
+`Own` and `Borrow` are the two modes; every fn-type slot carries
+one explicitly. Ownership has no default — there is no
+bare/unannotated mode.
 
-JSON canonical hash for every existing fixture stays bit-
-identical: `param_modes` is skipped when every entry is
-`Implicit`, `ret_mode` is skipped when `Implicit`. Existing
-modules emit the same bytes as before.
+JSON canonical form: `param_modes` and `ret_mode` are always
+present, one mode per slot, with no elision — the mode vectors
+are never omitted from the canonical bytes.
 
 **Type::Con name scoping (canonical form).** Within a
 `.ail.json`, a `Type::Con.name` is interpreted relative to the
@@ -189,6 +188,9 @@ fn-param `p` annotated `(own T)` when:
      never consumes `p` as a whole).
   2. For every match arm whose scrutinee is `p`, no
      **heap-typed** pattern-binder has `consume_count > 0`.
+  3. `p`'s type `T` is **not** a value type
+     (`Int`/`Bool`/`Float`/`Unit`).
+  4. The enclosing fn's body is **not** `(intrinsic)`.
 
 The heap-type filter is load-bearing for soundness:
 `match xs { Cons(h, t) => h }` records `consume_count(h) == 1`,
@@ -198,6 +200,22 @@ binders is what lets the lint correctly identify `head_or_zero`
 as over-strict (could be `borrow`) while staying silent on
 `sum_list` where `t: List` *is* moved out.
 
+Conditions 3 and 4 keep the lint coherent under universal mode
+activation:
+
+- **Value-typed params never fire.** `(borrow V)` for a value
+  type `V` is itself rejected by the `borrow-over-value` check,
+  so `(own V)` is the only legal mode for a value-typed param.
+  A suggestion to relax `(own Int)` to `(borrow Int)` would point
+  at an illegal rewrite, so the lint stays silent on value-typed
+  params regardless of whether they are consumed.
+- **`(intrinsic)`-bodied fns never fire.** The linearity walk
+  does nothing for a `Term::Intrinsic` body, so every param of an
+  intrinsic has `consume_count == 0` — a guaranteed false positive.
+  An intrinsic's param modes are hand-authored contracts
+  (`new`/`get`/`set`/`float_*`), not lint-derivable from a walkable
+  body, so the whole fn is skipped.
+
 Severity: `Warning`. `ail check`, `ail build`, `ail emit-ir` exit 1
 only on at least one `Error`; warnings print but do not abort.
 
@@ -246,10 +264,9 @@ metadata's role is explicit:
   fall-throughs to a `ret` (no tail-call), every parameter with
   `param_modes[i] == Own` is dec'd before the `ret` iff its
   uniqueness `consume_count == 0` and the ret value is not the
-  param itself. `Borrow` and `Implicit` parameters are skipped:
-  `Borrow` retains the caller's ownership by contract;
-  `Implicit` carries no static caller-handed-off-ownership
-  signal (it's the back-compat lane).
+  param itself. `Borrow` parameters are skipped: `Borrow` retains
+  the caller's ownership by contract. (There is no `Implicit`
+  parameter any longer — every param is `Own` or `Borrow`.)
 
 - **Iter A: arm-close pattern-binder dec.** When a match-arm's
   body terminates without a tail-call, every ptr-typed
@@ -257,8 +274,8 @@ metadata's role is explicit:
   iff its `consume_count == 0` and it is not the arm's tail
   value, **gated on the scrutinee's static ownership**. If the
   scrutinee is a fn-param, only `Own`-mode scrutinees enable
-  the dec — `Borrow` and `Implicit` scrutinees would let the
-  arm dec memory the caller still references.
+  the dec — a `Borrow` scrutinee would let the arm dec memory
+  the caller still references.
 
 - **Pre-tail-call shallow-dec.** When a match-arm's
   body IS a tail call, both Iter A and Iter B are skipped (the
@@ -292,10 +309,12 @@ suppressing or doubling a drop. Ratified by
   trackable for scope-close drop iff the callee's
   `ret_mode == Own`. The signal is the callee's static
   contract that ownership of the freshly heap-allocated cell
-  flows to the caller. `Borrow`-returning calls remain
-  non-trackable (the callee retains ownership; the caller
-  holds a view, not an own ref). `Implicit`-returning calls
-  remain non-trackable (back-compat lane).
+  flows to the caller. Every `Term::App` callee now carries an
+  explicit `Own`/`Borrow` `ret_mode`; an `Own`-returning call is
+  trackable for scope-close drop, a `Borrow`-returning call is
+  not (the callee retains ownership; the caller holds a view,
+  not an own ref — and a borrow-return is in any case rejected
+  at the signature, spec 0062).
 
 The drop fn's symbol resolution for an Own-returning App:
 synthesise the call's return type, resolve `Type::Con { name }`