From 832375f2ac54344f4c83e6d79600997f16c28ab1 Mon Sep 17 00:00:00 2001
From: Brummel <mould@mycelium.de>
Date: Thu, 28 May 2026 13:31:31 +0200
Subject: [PATCH] convention: counter-prefix file naming across docs/specs/,
 docs/plans/, design/contracts/, design/models/
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

All 176 files in the four accumulating directories now use a
zero-padded 4-digit counter prefix that reflects creation order
(`NNNN-slug.md`). The counter is assigned per directory in strict
git-log creation order; ties broken alphabetically by original name.
The old `YYYY-MM-DD-` prefix on docs/specs/ and docs/plans/ files is
dropped — the date is recoverable from git log and the counter
carries the ordering.

A file's counter is stable for the life of the file: never reassigned,
never reused, never compacted. Deleted files retire their counter;
subsequent files do not fill the gap. This is the property that lets
cross-references stay literal — refs use the full filename including
the counter (`design/contracts/0007-honesty-rule.md`) so they grep
cleanly and resolve directly without a glob step.

313 cross-references updated across .md/.rs/.toml/.c/.json files
(test pins, include_str! paths, design-INDEX entries, baseline notes,
runtime C comments, inter-contract markdown links incl. bare basename
and `../models/foo.md` forms).

CLAUDE.md gets a new "File-naming convention" section spelling out
the rule and rationale. skills/brainstorm/SKILL.md and
skills/planner/SKILL.md updated so new spec/plan creation produces
counter-prefixed names from the start.

The full test suite (cargo test --workspace) passes.
---
 CLAUDE.md                                     |  37 ++++-
 Cargo.toml                                    |   2 +-
 ail-embed/Cargo.toml                          |   2 +-
 ail-embed/src/lib.rs                          |   6 +-
 bench/baseline.json                           |   2 +-
 crates/ail/src/main.rs                        |   4 +-
 .../tests/codegen_import_map_fallback_pin.rs  |   2 +-
 crates/ail/tests/e2e.rs                       |   2 +-
 crates/ail/tests/embed/record_roundtrip.c     |   2 +-
 crates/ail/tests/embed/tick_roundtrip.c       |   2 +-
 crates/ail/tests/eq_float_noinstance.rs       |   4 +-
 crates/ail/tests/nullary_app_e2e.rs           |   4 +-
 .../tests/polyfn_dot_qualified_branch_pin.rs  |   2 +-
 crates/ail/tests/show_no_instance_e2e.rs      |   8 +-
 crates/ailang-check/src/diagnostic.rs         |   2 +-
 crates/ailang-check/src/lib.rs                |  18 +--
 crates/ailang-codegen/src/drop.rs             |   4 +-
 crates/ailang-codegen/src/lib.rs              |   6 +-
 crates/ailang-codegen/src/match_lower.rs      |   2 +-
 .../tests/embed_record_layout_pin.rs          |   2 +-
 .../tests/embed_staticlib_lowering.rs         |   2 +-
 crates/ailang-core/specs/form_a.md            |   4 +-
 crates/ailang-core/src/ast.rs                 |  18 +--
 crates/ailang-core/src/desugar.rs             |   4 +-
 crates/ailang-core/src/lib.rs                 |   2 +-
 crates/ailang-core/tests/design_index_pin.rs  |   4 +-
 .../ailang-core/tests/design_schema_drift.rs  |  40 +++---
 crates/ailang-core/tests/docs_honesty_pin.rs  |  46 +++---
 .../tests/effect_doc_honesty_pin.rs           |  14 +-
 crates/ailang-prose/src/lib.rs                |   2 +-
 crates/ailang-surface/src/lib.rs              |   2 +-
 crates/ailang-surface/src/parse.rs            |   2 +-
 crates/ailang-surface/src/print.rs            |   2 +-
 .../tests/prelude_decouple_carve_out_pin.rs   |   2 +-
 crates/ailang-surface/tests/round_trip.rs     |   4 +-
 design/INDEX.md                               |  50 +++----
 ...g-surface.md => 0001-authoring-surface.md} |   4 +-
 .../{data-model.md => 0002-data-model.md}     |  28 ++--
 ...embedding-abi.md => 0003-embedding-abi.md} |   4 +-
 ...ceptance.md => 0004-feature-acceptance.md} |   4 +-
 ...t-semantics.md => 0005-float-semantics.md} |  12 +-
 ...-layout.md => 0006-frozen-value-layout.md} |   4 +-
 .../{honesty-rule.md => 0007-honesty-rule.md} |   0
 .../{memory-model.md => 0008-memory-model.md} |  14 +-
 ...variant.md => 0009-roundtrip-invariant.md} |   8 +-
 ...boundaries.md => 0010-scope-boundaries.md} |  24 ++--
 .../contracts/{str-abi.md => 0011-str-abi.md} |  10 +-
 .../{tail-calls.md => 0012-tail-calls.md}     |   4 +-
 .../{typeclasses.md => 0013-typeclasses.md}   |  16 +--
 .../{verification.md => 0014-verification.md} |   2 +-
 ...raints.md => 0015-language-constraints.md} |   8 +-
 ...od-dispatch.md => 0016-method-dispatch.md} |   6 +-
 ...ude-classes.md => 0017-prelude-classes.md} |  12 +-
 ...g-surface.md => 0001-authoring-surface.md} |  10 +-
 design/models/{effects.md => 0002-effects.md} |   6 +-
 .../models/{pipeline.md => 0003-pipeline.md}  |  10 +-
 ...rc-uniqueness.md => 0004-rc-uniqueness.md} |  12 +-
 .../{typeclasses.md => 0005-typeclasses.md}   |  12 +-
 ...projection.md => 0006-prose-projection.md} |  10 +-
 ...xtensions.md => 0007-kernel-extensions.md} |  18 +--
 ...ldout.md => 0001-skill-system-buildout.md} |   6 +-
 ...ck-arms.md => 0002-22b2-typecheck-arms.md} |   2 +-
 ...ation.md => 0003-22b3-monomorphisation.md} |   2 +-
 ...md => 0004-22b4a-form-a-class-instance.md} |  10 +-
 ...lass-e2e.md => 0005-22c-user-class-e2e.md} |   4 +-
 ...-drift.md => 0006-22-tidy-design-drift.md} |  10 +-
 ...nify.md => 0007-env-construction-unify.md} |   6 +-
 ...mes.md => 0008-22-tidy-primitive-names.md} |   2 +-
 ... 0009-22-tidy-strict-duplicate-clauses.md} |   2 +-
 ...d => 0010-22-tidy-prose-class-instance.md} |   2 +-
 ...d => 0011-22-tidy-strict-clause-helper.md} |   2 +-
 ...ign-md-consolidation-1-history-anchors.md} |  18 +--
 ...consolidation-2-reverted-and-migration.md} |   4 +-
 ...d-consolidation-3-schema-sot-inversion.md} |   4 +-
 ...gn-md-consolidation-4-workflow-cleanup.md} |   8 +-
 ...ts-1-schema.md => 0016-floats-1-schema.md} |   2 +-
 ...-2-surface.md => 0017-floats-2-surface.md} |   2 +-
 ...ypecheck.md => 0018-floats-3-typecheck.md} |   2 +-
 ...-4-codegen.md => 0019-floats-4-codegen.md} |   2 +-
 ...esign.md => 0020-floats-5-prose-design.md} |   2 +-
 ...d => 0021-architect-iron-law-extension.md} |   0
 ...022-23.1-ordering-and-prelude-skeleton.md} |   0
 ...-23.2-eq-class-and-primitive-instances.md} |   0
 ...23.3-ord-class-and-primitive-instances.md} |   0
 ...d => 0025-ct.1-validator-and-migration.md} |   2 +-
 ...up.md => 0026-ct.2-typechecker-cleanup.md} |   4 +-
 ...p.md => 0027-ct.3-codegen-mono-cleanup.md} |   2 +-
 ...-close.md => 0028-ct.4-milestone-close.md} |   4 +-
 ...actor.md => 0029-orchestrator-refactor.md} |   2 +-
 ...nt.md => 0030-pr.1-plan-recon-subagent.md} |   4 +-
 ...0031-audit-fieldtest-docwriter-cadence.md} |   2 +-
 ...6-05-11-iter-gc.1.md => 0032-iter-gc.1.md} |   8 +-
 ...6-05-11-iter-23.4.md => 0033-iter-23.4.md} |   6 +-
 ...er-23.4-prep.md => 0034-iter-23.4-prep.md} |   2 +-
 ...6-05-12-iter-23.5.md => 0035-iter-23.5.md} |   6 +-
 docs/plans/{rt.1.md => 0036-rt.1.md}          |   2 +-
 ...6-05-12-iter-boss.md => 0037-iter-boss.md} |   2 +-
 docs/plans/{cma.1.md => 0038-cma.1.md}        |   4 +-
 docs/plans/{cma.2.md => 0039-cma.2.md}        |   2 +-
 docs/plans/{ms.1.md => 0040-ms.1.md}          |   2 +-
 docs/plans/{ms.2.md => 0041-ms.2.md}          |   4 +-
 .../plans/{ext-cli.1.md => 0042-ext-cli.1.md} |   0
 docs/plans/{hs.1.md => 0043-hs.1.md}          |   2 +-
 docs/plans/{hs.2.md => 0044-hs.2.md}          |   2 +-
 docs/plans/{hs.3.md => 0045-hs.3.md}          |   2 +-
 docs/plans/{hs.4.md => 0046-hs.4.md}          |   2 +-
 docs/plans/{eob.1.md => 0047-eob.1.md}        |   2 +-
 docs/plans/{ctt.1.md => 0048-ctt.1.md}        |   2 +-
 docs/plans/{ctt.2.md => 0049-ctt.2.md}        |   2 +-
 docs/plans/{ctt.3.md => 0050-ctt.3.md}        |   2 +-
 docs/plans/{24.1.md => 0051-24.1.md}          |   2 +-
 docs/plans/{mq.1.md => 0052-mq.1.md}          |   2 +-
 docs/plans/{mq.2.md => 0053-mq.2.md}          |   2 +-
 docs/plans/{mq.3.md => 0054-mq.3.md}          |   2 +-
 docs/plans/{mq.tidy.md => 0055-mq.tidy.md}    |   2 +-
 docs/plans/{24.2.md => 0056-24.2.md}          |   2 +-
 docs/plans/{24.3.md => 0057-24.3.md}          |   2 +-
 docs/plans/{24.tidy.md => 0058-24.tidy.md}    |   0
 ...iter-form-a.0.md => 0059-iter-form-a.0.md} |   6 +-
 ...iter-form-a.1.md => 0060-iter-form-a.1.md} |   2 +-
 ...orm-a.tidy.md => 0061-iter-form-a.tidy.md} |  22 +--
 ...-str-concat.md => 0062-iter-str-concat.md} |   2 +-
 ...05-14-iter-rpe.1.md => 0063-iter-rpe.1.md} |   2 +-
 ...6-05-14-iter-pd.1.md => 0064-iter-pd.1.md} |   4 +-
 ...6-05-14-iter-pd.2.md => 0065-iter-pd.2.md} |   4 +-
 ...6-05-14-iter-pd.3.md => 0066-iter-pd.3.md} |  18 +--
 ...05-15-iter-mut.1.md => 0067-iter-mut.1.md} |   8 +-
 ...05-15-iter-mut.2.md => 0068-iter-mut.2.md} |   6 +-
 ...05-15-iter-mut.3.md => 0069-iter-mut.3.md} |   4 +-
 ...-mut.4-tidy.md => 0070-iter-mut.4-tidy.md} |  12 +-
 ...6-05-15-iter-it.1.md => 0071-iter-it.1.md} |   2 +-
 ...6-05-15-iter-it.2.md => 0072-iter-it.2.md} |   2 +-
 ...6-05-15-iter-it.3.md => 0073-iter-it.3.md} |   4 +-
 ...-16-iter-revert.md => 0074-iter-revert.md} |  16 +--
 ...-honesty.md => 0075-effect-doc-honesty.md} |   0
 .../{loop-recur.1.md => 0076-loop-recur.1.md} |  12 +-
 .../{loop-recur.2.md => 0077-loop-recur.2.md} |   6 +-
 .../{loop-recur.3.md => 0078-loop-recur.3.md} |   6 +-
 ...ders.1.md => 0079-prose-loop-binders.1.md} |   4 +-
 ...n.1.md => 0080-remove-mut-var-assign.1.md} |   2 +-
 ...-lint.1.md => 0081-docs-honesty-lint.1.md} |   4 +-
 ...abi-m1.1.md => 0082-embedding-abi-m1.1.md} |   2 +-
 ...0083-form-a-scalar-param-mode-carveout.md} |   2 +-
 ...staticlib.md => 0084-emit-ir-staticlib.md} |   2 +-
 ...abi-m2.1.md => 0085-embedding-abi-m2.1.md} |   2 +-
 ....tidy.md => 0086-embedding-abi-m2.tidy.md} |   0
 ...abi-m3.1.md => 0087-embedding-abi-m3.1.md} |   2 +-
 ....tidy.md => 0088-embedding-abi-m3.tidy.md} |   2 +-
 ...abi-m5.1.md => 0089-embedding-abi-m5.1.md} |   4 +-
 ...abi-m5.2.md => 0090-embedding-abi-m5.2.md} |   2 +-
 ...abi-m5.3.md => 0091-embedding-abi-m5.3.md} |   2 +-
 ....tidy.md => 0092-embedding-abi-m5.tidy.md} |   0
 ...lit.1.md => 0093-design-md-rolesplit.1.md} |  76 +++++-----
 ...dy.md => 0094-design-md-rolesplit.tidy.md} |  36 ++---
 ...d => 0095-design-ledger-formal-links.1.md} |  56 ++++----
 ... => 0096-bench-harness-recalibration.1.md} |   8 +-
 ...nullary-app.1.md => 0097-nullary-app.1.md} |  26 ++--
 ...rement.1.md => 0098-boehm-retirement.1.md} |  54 +++----
 ...1.md => 0099-operator-routing-eq-ord.1.md} |  44 +++---
 ...se-fix.md => 0100-schema-camelcase-fix.md} |  16 +--
 ...9-skill-system.md => 0001-skill-system.md} |   0
 ...-typeclasses.md => 0002-22-typeclasses.md} |   0
 ...nify.md => 0003-env-construction-unify.md} |   0
 ...ion.md => 0004-design-md-consolidation.md} |   0
 .../{2026-05-10-floats.md => 0005-floats.md}  |   0
 ...est-floats.md => 0006-fieldtest-floats.md} |   0
 ...-names.md => 0007-canonical-type-names.md} |   0
 ...d => 0008-implement-orchestrator-agent.md} |   0
 ...ubagent.md => 0009-plan-recon-subagent.md} |   0
 ...=> 0010-fieldtest-canonical-type-names.md} |   0
 ...nt.md => 0011-audit-orchestrator-agent.md} |   0
 ...0012-audit-fieldtest-docwriter-cadence.md} |   0
 ....md => 0013-brainstorm-grounding-check.md} |   2 +-
 ...d-prelude.md => 0014-23-eq-ord-prelude.md} |   2 +-
 ...variant.md => 0015-roundtrip-invariant.md} |   0
 ...05-12-boss-skill.md => 0016-boss-skill.md} |   0
 ...> 0017-cross-model-authoring-form-test.md} |   0
 ...ama.md => 0018-multi-subject-codellama.md} |   0
 ...2-heap-str-abi.md => 0019-heap-str-abi.md} |   0
 ...-op-borrow.md => 0020-effect-op-borrow.md} |   0
 ...{2026-05-12-ct-tidy.md => 0021-ct-tidy.md} |   0
 ...24-show-print.md => 0022-24-show-print.md} |   2 +-
 ...d => 0023-module-qualified-class-names.md} |   4 +-
 ...24-show-print.md => 0024-24-show-print.md} |   2 +-
 ...ng.md => 0025-form-a-default-authoring.md} |   2 +-
 ...est-form-a.md => 0026-fieldtest-form-a.md} |   0
 ... => 0027-retire-per-type-print-effects.md} |   0
 ...e-decouple.md => 0028-prelude-decouple.md} |   4 +-
 ...6-05-15-mut-local.md => 0029-mut-local.md} |   0
 ...t-local.md => 0030-fieldtest-mut-local.md} |   0
 ...ipline.md => 0031-iteration-discipline.md} |   4 +-
 ...md => 0032-iteration-discipline-revert.md} |   6 +-
 ...line.md => 0033-llm-surface-discipline.md} |   4 +-
 ...05-17-loop-recur.md => 0034-loop-recur.md} |   6 +-
 ...-recur.md => 0035-fieldtest-loop-recur.md} |   0
 ...-binders.md => 0036-prose-loop-binders.md} |   0
 ...ssign.md => 0037-remove-mut-var-assign.md} |   0
 ...> 0038-fieldtest-remove-mut-var-assign.md} |   0
 ...esty-lint.md => 0039-docs-honesty-lint.md} |   0
 ...ing-abi-m1.md => 0040-embedding-abi-m1.md} |   0
 ....md => 0041-fieldtest-embedding-abi-m1.md} |   0
 ...ing-abi-m2.md => 0042-embedding-abi-m2.md} |   0
 ...ing-abi-m3.md => 0043-embedding-abi-m3.md} |   0
 ...ing-abi-m5.md => 0044-embedding-abi-m5.md} |   0
 ...lesplit.md => 0045-design-md-rolesplit.md} | 136 +++++++++---------
 ....md => 0046-design-ledger-formal-links.md} |  24 ++--
 ...md => 0047-bench-harness-recalibration.md} |   0
 ...retirement.md => 0048-boehm-retirement.md} |  18 +--
 ...ord.md => 0049-operator-routing-eq-ord.md} |  26 ++--
 ...0050-fieldtest-operator-routing-eq-ord.md} |  12 +-
 ...se-fix.md => 0051-schema-camelcase-fix.md} |  16 +--
 ....md => 0052-kernel-extension-mechanics.md} |   6 +-
 examples/eq_demo.ail                          |   2 +-
 examples/fieldtest/floats_3_safe_division.ail |   2 +-
 .../fieldtest/floats_4_float_to_str_reach.ail |   2 +-
 .../README.md                                 |   2 +-
 .../render/Cargo.toml                         |   2 +-
 runtime/rc.c                                  |   2 +-
 runtime/str.c                                 |   4 +-
 skills/README.md                              |   2 +-
 skills/audit/agents/ailang-architect.md       |   2 +-
 skills/audit/agents/ailang-bencher.md         |   2 +-
 skills/boss/SKILL.md                          |   2 +-
 skills/brainstorm/SKILL.md                    |  13 +-
 skills/fieldtest/SKILL.md                     |   2 +-
 skills/fieldtest/agents/ailang-fieldtester.md |   2 +-
 skills/planner/SKILL.md                       |   6 +-
 227 files changed, 785 insertions(+), 751 deletions(-)
 rename design/contracts/{authoring-surface.md => 0001-authoring-surface.md} (96%)
 rename design/contracts/{data-model.md => 0002-data-model.md} (92%)
 rename design/contracts/{embedding-abi.md => 0003-embedding-abi.md} (95%)
 rename design/contracts/{feature-acceptance.md => 0004-feature-acceptance.md} (96%)
 rename design/contracts/{float-semantics.md => 0005-float-semantics.md} (92%)
 rename design/contracts/{frozen-value-layout.md => 0006-frozen-value-layout.md} (94%)
 rename design/contracts/{honesty-rule.md => 0007-honesty-rule.md} (100%)
 rename design/contracts/{memory-model.md => 0008-memory-model.md} (96%)
 rename design/contracts/{roundtrip-invariant.md => 0009-roundtrip-invariant.md} (94%)
 rename design/contracts/{scope-boundaries.md => 0010-scope-boundaries.md} (92%)
 rename design/contracts/{str-abi.md => 0011-str-abi.md} (94%)
 rename design/contracts/{tail-calls.md => 0012-tail-calls.md} (96%)
 rename design/contracts/{typeclasses.md => 0013-typeclasses.md} (95%)
 rename design/contracts/{verification.md => 0014-verification.md} (93%)
 rename design/contracts/{language-constraints.md => 0015-language-constraints.md} (86%)
 rename design/contracts/{method-dispatch.md => 0016-method-dispatch.md} (91%)
 rename design/contracts/{prelude-classes.md => 0017-prelude-classes.md} (90%)
 rename design/models/{authoring-surface.md => 0001-authoring-surface.md} (94%)
 rename design/models/{effects.md => 0002-effects.md} (82%)
 rename design/models/{pipeline.md => 0003-pipeline.md} (92%)
 rename design/models/{rc-uniqueness.md => 0004-rc-uniqueness.md} (96%)
 rename design/models/{typeclasses.md => 0005-typeclasses.md} (95%)
 rename design/models/{prose-projection.md => 0006-prose-projection.md} (92%)
 rename design/models/{kernel-extensions.md => 0007-kernel-extensions.md} (97%)
 rename docs/plans/{2026-05-09-skill-system-buildout.md => 0001-skill-system-buildout.md} (99%)
 rename docs/plans/{2026-05-09-22b2-typecheck-arms.md => 0002-22b2-typecheck-arms.md} (99%)
 rename docs/plans/{2026-05-09-22b3-monomorphisation.md => 0003-22b3-monomorphisation.md} (99%)
 rename docs/plans/{2026-05-09-22b4a-form-a-class-instance.md => 0004-22b4a-form-a-class-instance.md} (99%)
 rename docs/plans/{2026-05-09-22c-user-class-e2e.md => 0005-22c-user-class-e2e.md} (99%)
 rename docs/plans/{2026-05-09-22-tidy-design-drift.md => 0006-22-tidy-design-drift.md} (97%)
 rename docs/plans/{2026-05-10-env-construction-unify.md => 0007-env-construction-unify.md} (99%)
 rename docs/plans/{2026-05-10-22-tidy-primitive-names.md => 0008-22-tidy-primitive-names.md} (99%)
 rename docs/plans/{2026-05-10-22-tidy-strict-duplicate-clauses.md => 0009-22-tidy-strict-duplicate-clauses.md} (99%)
 rename docs/plans/{2026-05-10-22-tidy-prose-class-instance.md => 0010-22-tidy-prose-class-instance.md} (99%)
 rename docs/plans/{2026-05-10-22-tidy-strict-clause-helper.md => 0011-22-tidy-strict-clause-helper.md} (99%)
 rename docs/plans/{2026-05-10-design-md-consolidation-1-history-anchors.md => 0012-design-md-consolidation-1-history-anchors.md} (97%)
 rename docs/plans/{2026-05-10-design-md-consolidation-2-reverted-and-migration.md => 0013-design-md-consolidation-2-reverted-and-migration.md} (99%)
 rename docs/plans/{2026-05-10-design-md-consolidation-3-schema-sot-inversion.md => 0014-design-md-consolidation-3-schema-sot-inversion.md} (99%)
 rename docs/plans/{2026-05-10-design-md-consolidation-4-workflow-cleanup.md => 0015-design-md-consolidation-4-workflow-cleanup.md} (98%)
 rename docs/plans/{2026-05-10-floats-1-schema.md => 0016-floats-1-schema.md} (99%)
 rename docs/plans/{2026-05-10-floats-2-surface.md => 0017-floats-2-surface.md} (99%)
 rename docs/plans/{2026-05-10-floats-3-typecheck.md => 0018-floats-3-typecheck.md} (99%)
 rename docs/plans/{2026-05-10-floats-4-codegen.md => 0019-floats-4-codegen.md} (99%)
 rename docs/plans/{2026-05-10-floats-5-prose-design.md => 0020-floats-5-prose-design.md} (99%)
 rename docs/plans/{2026-05-10-architect-iron-law-extension.md => 0021-architect-iron-law-extension.md} (100%)
 rename docs/plans/{2026-05-10-23.1-ordering-and-prelude-skeleton.md => 0022-23.1-ordering-and-prelude-skeleton.md} (100%)
 rename docs/plans/{2026-05-10-23.2-eq-class-and-primitive-instances.md => 0023-23.2-eq-class-and-primitive-instances.md} (100%)
 rename docs/plans/{2026-05-10-23.3-ord-class-and-primitive-instances.md => 0024-23.3-ord-class-and-primitive-instances.md} (100%)
 rename docs/plans/{2026-05-11-ct.1-validator-and-migration.md => 0025-ct.1-validator-and-migration.md} (99%)
 rename docs/plans/{2026-05-11-ct.2-typechecker-cleanup.md => 0026-ct.2-typechecker-cleanup.md} (99%)
 rename docs/plans/{2026-05-11-ct.3-codegen-mono-cleanup.md => 0027-ct.3-codegen-mono-cleanup.md} (99%)
 rename docs/plans/{2026-05-11-ct.4-milestone-close.md => 0028-ct.4-milestone-close.md} (99%)
 rename docs/plans/{2026-05-11-orchestrator-refactor.md => 0029-orchestrator-refactor.md} (99%)
 rename docs/plans/{2026-05-11-pr.1-plan-recon-subagent.md => 0030-pr.1-plan-recon-subagent.md} (99%)
 rename docs/plans/{2026-05-11-audit-fieldtest-docwriter-cadence.md => 0031-audit-fieldtest-docwriter-cadence.md} (99%)
 rename docs/plans/{2026-05-11-iter-gc.1.md => 0032-iter-gc.1.md} (98%)
 rename docs/plans/{2026-05-11-iter-23.4.md => 0033-iter-23.4.md} (99%)
 rename docs/plans/{2026-05-11-iter-23.4-prep.md => 0034-iter-23.4-prep.md} (99%)
 rename docs/plans/{2026-05-12-iter-23.5.md => 0035-iter-23.5.md} (99%)
 rename docs/plans/{rt.1.md => 0036-rt.1.md} (99%)
 rename docs/plans/{2026-05-12-iter-boss.md => 0037-iter-boss.md} (99%)
 rename docs/plans/{cma.1.md => 0038-cma.1.md} (99%)
 rename docs/plans/{cma.2.md => 0039-cma.2.md} (99%)
 rename docs/plans/{ms.1.md => 0040-ms.1.md} (98%)
 rename docs/plans/{ms.2.md => 0041-ms.2.md} (98%)
 rename docs/plans/{ext-cli.1.md => 0042-ext-cli.1.md} (100%)
 rename docs/plans/{hs.1.md => 0043-hs.1.md} (99%)
 rename docs/plans/{hs.2.md => 0044-hs.2.md} (99%)
 rename docs/plans/{hs.3.md => 0045-hs.3.md} (99%)
 rename docs/plans/{hs.4.md => 0046-hs.4.md} (99%)
 rename docs/plans/{eob.1.md => 0047-eob.1.md} (99%)
 rename docs/plans/{ctt.1.md => 0048-ctt.1.md} (99%)
 rename docs/plans/{ctt.2.md => 0049-ctt.2.md} (99%)
 rename docs/plans/{ctt.3.md => 0050-ctt.3.md} (99%)
 rename docs/plans/{24.1.md => 0051-24.1.md} (99%)
 rename docs/plans/{mq.1.md => 0052-mq.1.md} (99%)
 rename docs/plans/{mq.2.md => 0053-mq.2.md} (99%)
 rename docs/plans/{mq.3.md => 0054-mq.3.md} (99%)
 rename docs/plans/{mq.tidy.md => 0055-mq.tidy.md} (99%)
 rename docs/plans/{24.2.md => 0056-24.2.md} (99%)
 rename docs/plans/{24.3.md => 0057-24.3.md} (99%)
 rename docs/plans/{24.tidy.md => 0058-24.tidy.md} (100%)
 rename docs/plans/{2026-05-13-iter-form-a.0.md => 0059-iter-form-a.0.md} (97%)
 rename docs/plans/{2026-05-13-iter-form-a.1.md => 0060-iter-form-a.1.md} (99%)
 rename docs/plans/{2026-05-13-iter-form-a.tidy.md => 0061-iter-form-a.tidy.md} (95%)
 rename docs/plans/{2026-05-13-iter-str-concat.md => 0062-iter-str-concat.md} (99%)
 rename docs/plans/{2026-05-14-iter-rpe.1.md => 0063-iter-rpe.1.md} (99%)
 rename docs/plans/{2026-05-14-iter-pd.1.md => 0064-iter-pd.1.md} (99%)
 rename docs/plans/{2026-05-14-iter-pd.2.md => 0065-iter-pd.2.md} (99%)
 rename docs/plans/{2026-05-14-iter-pd.3.md => 0066-iter-pd.3.md} (97%)
 rename docs/plans/{2026-05-15-iter-mut.1.md => 0067-iter-mut.1.md} (99%)
 rename docs/plans/{2026-05-15-iter-mut.2.md => 0068-iter-mut.2.md} (99%)
 rename docs/plans/{2026-05-15-iter-mut.3.md => 0069-iter-mut.3.md} (99%)
 rename docs/plans/{2026-05-15-iter-mut.4-tidy.md => 0070-iter-mut.4-tidy.md} (98%)
 rename docs/plans/{2026-05-15-iter-it.1.md => 0071-iter-it.1.md} (99%)
 rename docs/plans/{2026-05-15-iter-it.2.md => 0072-iter-it.2.md} (99%)
 rename docs/plans/{2026-05-15-iter-it.3.md => 0073-iter-it.3.md} (99%)
 rename docs/plans/{2026-05-16-iter-revert.md => 0074-iter-revert.md} (97%)
 rename docs/plans/{2026-05-16-effect-doc-honesty.md => 0075-effect-doc-honesty.md} (100%)
 rename docs/plans/{loop-recur.1.md => 0076-loop-recur.1.md} (99%)
 rename docs/plans/{loop-recur.2.md => 0077-loop-recur.2.md} (99%)
 rename docs/plans/{loop-recur.3.md => 0078-loop-recur.3.md} (99%)
 rename docs/plans/{prose-loop-binders.1.md => 0079-prose-loop-binders.1.md} (98%)
 rename docs/plans/{remove-mut-var-assign.1.md => 0080-remove-mut-var-assign.1.md} (99%)
 rename docs/plans/{docs-honesty-lint.1.md => 0081-docs-honesty-lint.1.md} (99%)
 rename docs/plans/{embedding-abi-m1.1.md => 0082-embedding-abi-m1.1.md} (99%)
 rename docs/plans/{form-a-scalar-param-mode-carveout.md => 0083-form-a-scalar-param-mode-carveout.md} (99%)
 rename docs/plans/{emit-ir-staticlib.md => 0084-emit-ir-staticlib.md} (99%)
 rename docs/plans/{embedding-abi-m2.1.md => 0085-embedding-abi-m2.1.md} (99%)
 rename docs/plans/{embedding-abi-m2.tidy.md => 0086-embedding-abi-m2.tidy.md} (100%)
 rename docs/plans/{embedding-abi-m3.1.md => 0087-embedding-abi-m3.1.md} (99%)
 rename docs/plans/{embedding-abi-m3.tidy.md => 0088-embedding-abi-m3.tidy.md} (99%)
 rename docs/plans/{embedding-abi-m5.1.md => 0089-embedding-abi-m5.1.md} (99%)
 rename docs/plans/{embedding-abi-m5.2.md => 0090-embedding-abi-m5.2.md} (99%)
 rename docs/plans/{embedding-abi-m5.3.md => 0091-embedding-abi-m5.3.md} (99%)
 rename docs/plans/{embedding-abi-m5.tidy.md => 0092-embedding-abi-m5.tidy.md} (100%)
 rename docs/plans/{design-md-rolesplit.1.md => 0093-design-md-rolesplit.1.md} (92%)
 rename docs/plans/{design-md-rolesplit.tidy.md => 0094-design-md-rolesplit.tidy.md} (95%)
 rename docs/plans/{design-ledger-formal-links.1.md => 0095-design-ledger-formal-links.1.md} (86%)
 rename docs/plans/{bench-harness-recalibration.1.md => 0096-bench-harness-recalibration.1.md} (97%)
 rename docs/plans/{nullary-app.1.md => 0097-nullary-app.1.md} (94%)
 rename docs/plans/{boehm-retirement.1.md => 0098-boehm-retirement.1.md} (94%)
 rename docs/plans/{operator-routing-eq-ord.1.md => 0099-operator-routing-eq-ord.1.md} (96%)
 rename docs/plans/{2026-05-21-schema-camelcase-fix.md => 0100-schema-camelcase-fix.md} (96%)
 rename docs/specs/{2026-05-09-skill-system.md => 0001-skill-system.md} (100%)
 rename docs/specs/{2026-05-09-22-typeclasses.md => 0002-22-typeclasses.md} (100%)
 rename docs/specs/{2026-05-10-env-construction-unify.md => 0003-env-construction-unify.md} (100%)
 rename docs/specs/{2026-05-10-design-md-consolidation.md => 0004-design-md-consolidation.md} (100%)
 rename docs/specs/{2026-05-10-floats.md => 0005-floats.md} (100%)
 rename docs/specs/{2026-05-10-fieldtest-floats.md => 0006-fieldtest-floats.md} (100%)
 rename docs/specs/{2026-05-10-canonical-type-names.md => 0007-canonical-type-names.md} (100%)
 rename docs/specs/{2026-05-11-implement-orchestrator-agent.md => 0008-implement-orchestrator-agent.md} (100%)
 rename docs/specs/{2026-05-11-plan-recon-subagent.md => 0009-plan-recon-subagent.md} (100%)
 rename docs/specs/{2026-05-11-fieldtest-canonical-type-names.md => 0010-fieldtest-canonical-type-names.md} (100%)
 rename docs/specs/{2026-05-11-audit-orchestrator-agent.md => 0011-audit-orchestrator-agent.md} (100%)
 rename docs/specs/{2026-05-11-audit-fieldtest-docwriter-cadence.md => 0012-audit-fieldtest-docwriter-cadence.md} (100%)
 rename docs/specs/{2026-05-11-brainstorm-grounding-check.md => 0013-brainstorm-grounding-check.md} (99%)
 rename docs/specs/{2026-05-11-23-eq-ord-prelude.md => 0014-23-eq-ord-prelude.md} (99%)
 rename docs/specs/{2026-05-12-roundtrip-invariant.md => 0015-roundtrip-invariant.md} (100%)
 rename docs/specs/{2026-05-12-boss-skill.md => 0016-boss-skill.md} (100%)
 rename docs/specs/{2026-05-12-cross-model-authoring-form-test.md => 0017-cross-model-authoring-form-test.md} (100%)
 rename docs/specs/{2026-05-12-multi-subject-codellama.md => 0018-multi-subject-codellama.md} (100%)
 rename docs/specs/{2026-05-12-heap-str-abi.md => 0019-heap-str-abi.md} (100%)
 rename docs/specs/{2026-05-12-effect-op-borrow.md => 0020-effect-op-borrow.md} (100%)
 rename docs/specs/{2026-05-12-ct-tidy.md => 0021-ct-tidy.md} (100%)
 rename docs/specs/{2026-05-12-24-show-print.md => 0022-24-show-print.md} (99%)
 rename docs/specs/{2026-05-13-module-qualified-class-names.md => 0023-module-qualified-class-names.md} (99%)
 rename docs/specs/{2026-05-13-24-show-print.md => 0024-24-show-print.md} (99%)
 rename docs/specs/{2026-05-13-form-a-default-authoring.md => 0025-form-a-default-authoring.md} (99%)
 rename docs/specs/{2026-05-13-fieldtest-form-a.md => 0026-fieldtest-form-a.md} (100%)
 rename docs/specs/{2026-05-14-retire-per-type-print-effects.md => 0027-retire-per-type-print-effects.md} (100%)
 rename docs/specs/{2026-05-14-prelude-decouple.md => 0028-prelude-decouple.md} (99%)
 rename docs/specs/{2026-05-15-mut-local.md => 0029-mut-local.md} (100%)
 rename docs/specs/{2026-05-15-fieldtest-mut-local.md => 0030-fieldtest-mut-local.md} (100%)
 rename docs/specs/{2026-05-15-iteration-discipline.md => 0031-iteration-discipline.md} (99%)
 rename docs/specs/{2026-05-16-iteration-discipline-revert.md => 0032-iteration-discipline-revert.md} (99%)
 rename docs/specs/{2026-05-17-llm-surface-discipline.md => 0033-llm-surface-discipline.md} (98%)
 rename docs/specs/{2026-05-17-loop-recur.md => 0034-loop-recur.md} (98%)
 rename docs/specs/{2026-05-18-fieldtest-loop-recur.md => 0035-fieldtest-loop-recur.md} (100%)
 rename docs/specs/{2026-05-18-prose-loop-binders.md => 0036-prose-loop-binders.md} (100%)
 rename docs/specs/{2026-05-18-remove-mut-var-assign.md => 0037-remove-mut-var-assign.md} (100%)
 rename docs/specs/{2026-05-18-fieldtest-remove-mut-var-assign.md => 0038-fieldtest-remove-mut-var-assign.md} (100%)
 rename docs/specs/{2026-05-18-docs-honesty-lint.md => 0039-docs-honesty-lint.md} (100%)
 rename docs/specs/{2026-05-18-embedding-abi-m1.md => 0040-embedding-abi-m1.md} (100%)
 rename docs/specs/{2026-05-18-fieldtest-embedding-abi-m1.md => 0041-fieldtest-embedding-abi-m1.md} (100%)
 rename docs/specs/{2026-05-18-embedding-abi-m2.md => 0042-embedding-abi-m2.md} (100%)
 rename docs/specs/{2026-05-18-embedding-abi-m3.md => 0043-embedding-abi-m3.md} (100%)
 rename docs/specs/{2026-05-19-embedding-abi-m5.md => 0044-embedding-abi-m5.md} (100%)
 rename docs/specs/{2026-05-19-design-md-rolesplit.md => 0045-design-md-rolesplit.md} (85%)
 rename docs/specs/{2026-05-19-design-ledger-formal-links.md => 0046-design-ledger-formal-links.md} (95%)
 rename docs/specs/{2026-05-20-bench-harness-recalibration.md => 0047-bench-harness-recalibration.md} (100%)
 rename docs/specs/{2026-05-20-boehm-retirement.md => 0048-boehm-retirement.md} (93%)
 rename docs/specs/{2026-05-20-operator-routing-eq-ord.md => 0049-operator-routing-eq-ord.md} (96%)
 rename docs/specs/{2026-05-21-fieldtest-operator-routing-eq-ord.md => 0050-fieldtest-operator-routing-eq-ord.md} (96%)
 rename docs/specs/{2026-05-21-schema-camelcase-fix.md => 0051-schema-camelcase-fix.md} (96%)
 rename docs/specs/{2026-05-28-kernel-extension-mechanics.md => 0052-kernel-extension-mechanics.md} (99%)

diff --git a/CLAUDE.md b/CLAUDE.md
index 54104ad..aa740eb 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -42,10 +42,39 @@ it measurably improves correctness or removes redundancy.
 | `runtime/` | C glue around the RC runtime |
 | `bench/` | Regression harnesses (`check.py`, `compile_check.py`, `cross_lang.py`) and the throughput-and-latency runner (`run.sh`); `bench/reference/` holds the hand-C corpus for cross-language ratios |
 | `examples/` | AILang fixtures used by tests and benches |
-| `design/` | The canonical contract ledger — `design/INDEX.md` (sole addressable spine: a typed Contracts + Models table), `design/contracts/` (prose-authoritative test-linked invariants), `design/models/` (onboarding whitepapers) |
-| `docs/` | Specs and plans — `docs/specs/` (per-milestone design specs), `docs/plans/` (per-iteration plans), `PROSE_ROUNDTRIP.md`. Project history lives in `git log`; the forward queue lives in Gitea issues (see "Roles" section below). |
+| `design/` | The canonical contract ledger — `design/INDEX.md` (sole addressable spine: a typed Contracts + Models table), `design/contracts/` (prose-authoritative test-linked invariants), `design/models/` (onboarding whitepapers). Files under `contracts/` and `models/` follow the counter-prefix convention (see "File-naming convention" below). |
+| `docs/` | Specs and plans — `docs/specs/` (per-milestone design specs), `docs/plans/` (per-iteration plans), `PROSE_ROUNDTRIP.md`. Files under `specs/` and `plans/` follow the counter-prefix convention (see "File-naming convention" below). Project history lives in `git log`; the forward queue lives in Gitea issues (see "Roles" section below). |
 | `skills/` | Project-local skill definitions and their agents. See `skills/README.md` for the skill table, agent roster, and discovery layout. |
 
+## File-naming convention
+
+Four directories accumulate files over the life of the project and
+use a zero-padded counter prefix that reflects creation order:
+
+- `docs/specs/NNNN-slug.md`
+- `docs/plans/NNNN-slug.md`
+- `design/contracts/NNNN-slug.md`
+- `design/models/NNNN-slug.md`
+
+The counter is 4-digit, zero-padded, assigned per directory in
+strict creation order. A new file takes the next-higher counter for
+its directory. A file's counter is **stable for the life of the
+file** — never reassigned, never reused, never compacted. If a file
+is deleted, its counter is retired; subsequent files do not fill the
+gap. This is the property that lets cross-references stay literal.
+
+Slugs are the short identity (`honesty-rule`, `skill-system-buildout`).
+Cross-references include the full filename with counter
+(`design/contracts/0007-honesty-rule.md`) so they grep cleanly and
+resolve directly without a glob step. The convention forbids
+renumbering precisely so refs do not need to chase moving prefixes.
+
+The backfill on 2026-05-28 assigned counters by git-log creation
+timestamp (alphabetical by original name on ties) and stripped the
+old `YYYY-MM-DD-` prefix from `docs/specs/` and `docs/plans/` —
+the date is recoverable from git log and the counter carries the
+ordering.
+
 ## Skill system
 
 Day-to-day discipline lives under `skills/<name>/SKILL.md`; see
@@ -176,7 +205,7 @@ The test for whether a feature ships is whether an LLM author
 naturally produces code that uses it AND whether the feature
 measurably improves correctness or removes redundancy. Aesthetic
 appeal does not count; neither does human ergonomics. Full criterion
-lives in `design/contracts/feature-acceptance.md` and is
+lives in `design/contracts/0004-feature-acceptance.md` and is
 applied as a gate by `skills/brainstorm/SKILL.md` during spec writing.
 
 ## Bug fixes — TDD, always
@@ -211,7 +240,7 @@ not retroactively renamed.
   `ailang-architect` checks the code against during drift review.
   A contract describes only the actual present state; forward intent
   goes to the Gitea backlog, history and rationale to `git log`
-  (see `design/contracts/honesty-rule.md`).
+  (see `design/contracts/0007-honesty-rule.md`).
 
 - **`git log`** is the project history. Iter and audit commit
   bodies carry the *why* — alternatives considered and rejected,
diff --git a/Cargo.toml b/Cargo.toml
index b1e25da..ae317ff 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -10,7 +10,7 @@ members = [
 ]
 # `ail-embed/` is intentionally NOT a member: it depends on the
 # external `../libs/data-server` and is the sole data-server↔AILang
-# meeting point (Invariant 1, docs/specs/2026-05-19-embedding-abi-m5.md).
+# meeting point (Invariant 1, docs/specs/0044-embedding-abi-m5.md).
 # Adding it here would couple the compiler workspace to a sibling dir.
 
 [workspace.package]
diff --git a/ail-embed/Cargo.toml b/ail-embed/Cargo.toml
index 6f9b264..dc80ecd 100644
--- a/ail-embed/Cargo.toml
+++ b/ail-embed/Cargo.toml
@@ -3,7 +3,7 @@
 # auto-absorb this nested package. This is cargo's documented
 # mechanism for a deliberately workspace-excluded crate and keeps
 # `ail-embed` out of the AILang dependency graph entirely
-# (Invariant 1, docs/specs/2026-05-19-embedding-abi-m5.md).
+# (Invariant 1, docs/specs/0044-embedding-abi-m5.md).
 [workspace]
 
 [package]
diff --git a/ail-embed/src/lib.rs b/ail-embed/src/lib.rs
index 0cfa1c9..e1f4733 100644
--- a/ail-embed/src/lib.rs
+++ b/ail-embed/src/lib.rs
@@ -1,7 +1,7 @@
 //! Lean embedding of an AILang M3-frozen staticlib kernel into a
 //! Rust host. The Rust analogue of the audited C host
 //! `crates/ail/tests/embed/tick_roundtrip.c`: same frozen value
-//! layout (design/contracts/frozen-value-layout.md), same
+//! layout (design/contracts/0006-frozen-value-layout.md), same
 //! `own`-mode contract. ZERO `data_server`/finance knowledge.
 
 use std::ffi::c_void;
@@ -32,7 +32,7 @@ impl Ctx {
         Self(unsafe { ailang_ctx_new() })
     }
 
-    /// `State` box, frozen layout (design/contracts/frozen-value-layout.md):
+    /// `State` box, frozen layout (design/contracts/0006-frozen-value-layout.md):
     /// payload `8 + 2*8` = 24 bytes — tag:i64@0, acc:f64@8, n:i64@16.
     /// `ailang_rc_alloc` sets the `p-8` rc header to 1 and zeroes the
     /// payload, so the tag write of 0 is the single-ctor tag.
@@ -88,7 +88,7 @@ impl Kernel {
     }
 
     /// Folds `prices` via the kernel and returns `(Σ px, count)`.
-    /// `own` discipline (design/contracts/frozen-value-layout.md): each `Tick` is freshly
+    /// `own` discipline (design/contracts/0006-frozen-value-layout.md): each `Tick` is freshly
     /// `ailang_rc_alloc`'d and consumed by the kernel; `st` is
     /// consumed and replaced by the return each step; only the final
     /// return is host-`dec`'d.
diff --git a/bench/baseline.json b/bench/baseline.json
index 37131c1..14abc90 100644
--- a/bench/baseline.json
+++ b/bench/baseline.json
@@ -2,7 +2,7 @@
   "version": 1,
   "captured": "2026-05-20",
   "captured_via": "bench/run.sh -n 5",
-  "note": "Baseline for bench/check.py regression detection. The language-invariant thresholds (rc/bump <= 1.3x throughput, p99/median <= 5x latency) are NOT the regression-check tolerances; the per-metric tolerances below are tuned to absorb run-to-run noise on a quiet developer machine. To update after an intentional change, re-run bench/run.sh and replace the values, recording the reason in the commit body that ships the baseline bump. The latency arms gate only on median / p99 / p99_over_median \u2014 max_us and p99_9_us were removed on the 2026-05-20 recapture (Gitea #15 / #16) because tail-of-distribution latency metrics are dominated by OS-level jitter (THP defrag, scheduler preemption, IRQ load), not allocator behaviour, and produced 3+ consecutive false-positive REGRESSION rows on byte-identical no-op milestones. See docs/specs/2026-05-20-bench-harness-recalibration.md.",
+  "note": "Baseline for bench/check.py regression detection. The language-invariant thresholds (rc/bump <= 1.3x throughput, p99/median <= 5x latency) are NOT the regression-check tolerances; the per-metric tolerances below are tuned to absorb run-to-run noise on a quiet developer machine. To update after an intentional change, re-run bench/run.sh and replace the values, recording the reason in the commit body that ships the baseline bump. The latency arms gate only on median / p99 / p99_over_median \u2014 max_us and p99_9_us were removed on the 2026-05-20 recapture (Gitea #15 / #16) because tail-of-distribution latency metrics are dominated by OS-level jitter (THP defrag, scheduler preemption, IRQ load), not allocator behaviour, and produced 3+ consecutive false-positive REGRESSION rows on byte-identical no-op milestones. See docs/specs/0047-bench-harness-recalibration.md.",
   "throughput": {
     "bench_list_sum": {
       "bump_s": {
diff --git a/crates/ail/src/main.rs b/crates/ail/src/main.rs
index 6251dc8..37a8161 100644
--- a/crates/ail/src/main.rs
+++ b/crates/ail/src/main.rs
@@ -1098,7 +1098,7 @@ fn workspace_error_to_diagnostic(
         // typeclass-coherence diagnostics emitted from
         // `workspace::build_registry`. The codes follow the
         // diagnostic-categories section of
-        // `design/contracts/typeclasses.md`.
+        // `design/contracts/0013-typeclasses.md`.
         W::OrphanInstance {
             class,
             type_repr,
@@ -1568,7 +1568,7 @@ fn walk_term(
 /// Adds the variable bindings introduced by a pattern to `scope` and
 /// returns the names that were freshly inserted (so the caller can roll
 /// them back). MVP-restricted: nested ctor patterns only contain
-/// `Var`/`Wild` — see design/contracts/data-model.md.
+/// `Var`/`Wild` — see design/contracts/0002-data-model.md.
 fn bind_pattern(
     p: &ailang_core::ast::Pattern,
     scope: &mut std::collections::HashSet<String>,
diff --git a/crates/ail/tests/codegen_import_map_fallback_pin.rs b/crates/ail/tests/codegen_import_map_fallback_pin.rs
index a3e0a3d..a3603ac 100644
--- a/crates/ail/tests/codegen_import_map_fallback_pin.rs
+++ b/crates/ail/tests/codegen_import_map_fallback_pin.rs
@@ -1,5 +1,5 @@
 //! Pin for the iter-24.3 codegen `import_map`-fallback path
-//! (design/contracts/typeclasses.md, "Cross-module references in
+//! (design/contracts/0013-typeclasses.md, "Cross-module references in
 //! synthesised bodies" invariant 2).
 //!
 //! Property protected: post-mono synthesised body cross-module
diff --git a/crates/ail/tests/e2e.rs b/crates/ail/tests/e2e.rs
index 153ab8d..c44f0ed 100644
--- a/crates/ail/tests/e2e.rs
+++ b/crates/ail/tests/e2e.rs
@@ -2742,7 +2742,7 @@ fn str_clone_drop_balances_rc_stats() {
 /// input bytes; RC stats account for three heap-Str slabs (one
 /// from int_to_str, two from str_clone) and three matching frees.
 /// Pins the "uniform consumer ABI" claim from
-/// design/contracts/str-abi.md — str_clone only reads len + bytes +
+/// design/contracts/0011-str-abi.md — str_clone only reads len + bytes +
 /// NUL, never the rc_header.
 #[test]
 fn str_clone_cross_realisation_uniform_abi() {
diff --git a/crates/ail/tests/embed/record_roundtrip.c b/crates/ail/tests/embed/record_roundtrip.c
index 44507b1..ad98896 100644
--- a/crates/ail/tests/embed/record_roundtrip.c
+++ b/crates/ail/tests/embed/record_roundtrip.c
@@ -1,6 +1,6 @@
 /* Embedding-ABI M3 record round-trip C host (own + borrow via a
  * compile-time -DBORROW switch). Frozen value layout
- * (design/contracts/frozen-value-layout.md):
+ * (design/contracts/0006-frozen-value-layout.md):
  *   p - 8 .. p   uint64_t refcount header (set to 1 by ailang_rc_alloc)
  *   p + 0        int64_t  constructor tag (single ctor → 0)
  *   p + 8        IEEE-754 double  field 0 = Float acc
diff --git a/crates/ail/tests/embed/tick_roundtrip.c b/crates/ail/tests/embed/tick_roundtrip.c
index f5bcff6..626d52b 100644
--- a/crates/ail/tests/embed/tick_roundtrip.c
+++ b/crates/ail/tests/embed/tick_roundtrip.c
@@ -3,7 +3,7 @@
  * only ever push a *scalar* per-tick sample; this host pushes a
  * single-ctor all-scalar *record* `Tick` as the per-call payload —
  * the actual minimal data-server binding shape. Frozen value layout
- * (design/contracts/frozen-value-layout.md):
+ * (design/contracts/0006-frozen-value-layout.md):
  *
  *   State (24-byte payload):
  *     p - 8 .. p   uint64_t refcount header (set to 1 by ailang_rc_alloc)
diff --git a/crates/ail/tests/eq_float_noinstance.rs b/crates/ail/tests/eq_float_noinstance.rs
index e132710..3a08cad 100644
--- a/crates/ail/tests/eq_float_noinstance.rs
+++ b/crates/ail/tests/eq_float_noinstance.rs
@@ -2,7 +2,7 @@
 //!
 //! Property protected: a polymorphic Eq/Ord helper invoked at Float
 //! fires `no-instance` (since Float has neither Eq nor Ord instance
-//! per design/contracts/float-semantics.md) AND the diagnostic message
+//! per design/contracts/0005-float-semantics.md) AND the diagnostic message
 //! cross-references the canonical float-semantics contract so the
 //! LLM author immediately learns the partial-Float story rather
 //! than seeing a bare "no instance" message.
@@ -38,7 +38,7 @@ fn eq_at_float_fires_float_aware_noinstance() {
     // Cross-ref to the float-semantics contract — the LLM author should
     // be pointed at the canonical explanation of partial Float orderability.
     assert!(
-        no_inst.message.contains("design/contracts/float-semantics.md"),
+        no_inst.message.contains("design/contracts/0005-float-semantics.md"),
         "expected NoInstance message to cross-reference the float-semantics contract, got: {:?}",
         no_inst.message
     );
diff --git a/crates/ail/tests/nullary_app_e2e.rs b/crates/ail/tests/nullary_app_e2e.rs
index 0a3e64b..71f0598 100644
--- a/crates/ail/tests/nullary_app_e2e.rs
+++ b/crates/ail/tests/nullary_app_e2e.rs
@@ -7,8 +7,8 @@
 //! invoked as `(app greet)`.
 //!
 //! Two independent fieldtest specs flagged the same gap:
-//! `docs/specs/2026-05-15-fieldtest-mut-local.md` F3 and
-//! `docs/specs/2026-05-18-fieldtest-loop-recur.md` spec_gap. The
+//! `docs/specs/0030-fieldtest-mut-local.md` F3 and
+//! `docs/specs/0035-fieldtest-loop-recur.md` spec_gap. The
 //! Form-A surface refusing nullary calls had no schema backing —
 //! `Term::App.args` is `[Term...]` (zero-or-more), so the parser
 //! guard was an unbacked rule.
diff --git a/crates/ail/tests/polyfn_dot_qualified_branch_pin.rs b/crates/ail/tests/polyfn_dot_qualified_branch_pin.rs
index d282e63..e236ad9 100644
--- a/crates/ail/tests/polyfn_dot_qualified_branch_pin.rs
+++ b/crates/ail/tests/polyfn_dot_qualified_branch_pin.rs
@@ -1,5 +1,5 @@
 //! Pin for the iter-24.3 FreeFnCall constraint-residual-push
-//! invariant (design/contracts/typeclasses.md, "Cross-module
+//! invariant (design/contracts/0013-typeclasses.md, "Cross-module
 //! references in synthesised bodies" invariant 3).
 //!
 //! Property protected: bare-name references to polymorphic free fns
diff --git a/crates/ail/tests/show_no_instance_e2e.rs b/crates/ail/tests/show_no_instance_e2e.rs
index b875994..d285822 100644
--- a/crates/ail/tests/show_no_instance_e2e.rs
+++ b/crates/ail/tests/show_no_instance_e2e.rs
@@ -2,7 +2,7 @@
 //!
 //! Property protected: calling `print` on a function type fires the
 //! `no-instance` diagnostic with a Show-aware message that
-//! cross-references design/contracts/typeclasses.md, so the
+//! cross-references design/contracts/0013-typeclasses.md, so the
 //! LLM author immediately learns which types ship with built-in Show
 //! and how to declare their own instance for a user type.
 
@@ -40,11 +40,11 @@ fn print_on_fn_type_fires_show_aware_no_instance() {
         no_inst.message
     );
 
-    // Must cross-reference design/contracts/typeclasses.md — that's
+    // Must cross-reference design/contracts/0013-typeclasses.md — that's
     // the canonical contract naming which types ship with Show.
     assert!(
-        no_inst.message.contains("design/contracts/typeclasses.md"),
-        "expected design/contracts/typeclasses.md cross-reference, got message: {:?}",
+        no_inst.message.contains("design/contracts/0013-typeclasses.md"),
+        "expected design/contracts/0013-typeclasses.md cross-reference, got message: {:?}",
         no_inst.message
     );
 }
diff --git a/crates/ailang-check/src/diagnostic.rs b/crates/ailang-check/src/diagnostic.rs
index 4f87beb..cd2cafa 100644
--- a/crates/ailang-check/src/diagnostic.rs
+++ b/crates/ailang-check/src/diagnostic.rs
@@ -39,7 +39,7 @@
 //! - `module-cycle` — workspace loader (Iter 5b, in the CLI path)
 //! - `module-name-mismatch` — workspace loader (Iter 5b, in the CLI path)
 //! - `module-hash-mismatch` — workspace loader (Iter 5b, in the CLI path)
-//! - `tail-call-not-in-tail-position` (see `design/contracts/tail-calls.md`)
+//! - `tail-call-not-in-tail-position` (see `design/contracts/0012-tail-calls.md`)
 //! - `use-after-consume` — `ctx`: `{"binder": "<n>"}` (Iter 18c.2);
 //!   carries non-empty [`Diagnostic::suggested_rewrites`] showing how to
 //!   spell the fix in form-A AILang.
diff --git a/crates/ailang-check/src/lib.rs b/crates/ailang-check/src/lib.rs
index 0e61b9f..7e855e9 100644
--- a/crates/ailang-check/src/lib.rs
+++ b/crates/ailang-check/src/lib.rs
@@ -446,7 +446,7 @@ pub enum CheckError {
 
     /// An `(export …)` fn has a parameter or return type that is not
     /// a permitted embedding-ABI type. The embedding ABI is frozen as
-    /// of M3 (design/contracts/embedding-abi.md):
+    /// of M3 (design/contracts/0003-embedding-abi.md):
     /// `Int`/`Float` or a single-constructor record of those; every
     /// other shape (multi-ctor sums, `Str`/`List`/nested-record
     /// fields) is rejected at typecheck (the feature-acceptance
@@ -556,7 +556,7 @@ pub enum CheckError {
 
     /// a `Term::App { tail: true, .. }` or
     /// `Term::Do { tail: true, .. }` was found in a non-tail position.
-    /// Code: `tail-call-not-in-tail-position`. See `design/contracts/tail-calls.md`.
+    /// Code: `tail-call-not-in-tail-position`. See `design/contracts/0012-tail-calls.md`.
     #[error("call marked `tail` is not in tail position")]
     TailCallNotInTailPosition,
 
@@ -858,7 +858,7 @@ impl CheckError {
         }
         // Float-aware addendum on `NoInstance`. When the
         // unresolved class is `Eq` or `Ord` AND the type is `Float`,
-        // append a cross-reference to design/contracts/float-semantics.md so
+        // append a cross-reference to design/contracts/0005-float-semantics.md so
         // the LLM author learns the partial-Float story immediately
         // rather than seeing a bare "no instance" message. Float has
         // neither Eq nor Ord by design (partial orderability per
@@ -874,7 +874,7 @@ impl CheckError {
                      orderability per IEEE-754); use float_eq / float_lt \
                      (and siblings float_ne / float_le / float_gt / float_ge) \
                      for explicit IEEE-aware comparison. \
-                     See design/contracts/float-semantics.md.",
+                     See design/contracts/0005-float-semantics.md.",
                     d.message
                 );
             } else if class == "prelude.Show" {
@@ -883,12 +883,12 @@ impl CheckError {
                 // a function type (`print f` where f is bare-fn-typed)
                 // or a user type the LLM-author forgot to give an
                 // instance for. Cross-references
-                // design/contracts/typeclasses.md so the author learns
+                // design/contracts/0013-typeclasses.md so the author learns
                 // which types ship with built-in Show immediately.
                 d.message = format!(
                     "{} — `print` and `show` require a Show instance. \
                      Built-in Show ships for Int, Bool, Str, Float in \
-                     the prelude; see design/contracts/typeclasses.md. \
+                     the prelude; see design/contracts/0013-typeclasses.md. \
                      User types declare their own \
                      `instance prelude.Show <T>` in the type's defining \
                      module per the typeclass design coherence.",
@@ -2643,10 +2643,10 @@ fn constraint_type_matches(declared: &Type, residual: &Type) -> bool {
 /// verifies that every `Term::App { tail: true, .. }` and
 /// `Term::Do { tail: true, .. }` actually sits in tail position, per
 /// the explicit-tail-call contract
-/// (`design/contracts/tail-calls.md`).
+/// (`design/contracts/0012-tail-calls.md`).
 ///
 /// `is_tail` is the tail-context flag for the term currently being
-/// visited. The propagation rules (from design/contracts/tail-calls.md):
+/// visited. The propagation rules (from design/contracts/0012-tail-calls.md):
 ///
 /// - The body of a fn / Lam is visited with `is_tail = true`.
 /// - `Match { scrutinee, arms }`: the scrutinee is **not** in tail
@@ -6031,7 +6031,7 @@ mod tests {
     /// Floats milestone post-fieldtest B1 (RED): pattern-matching on a
     /// `Literal::Float` literal must be hard-rejected at typecheck via
     /// `CheckError::FloatPatternNotAllowed` per
-    /// design/contracts/float-semantics.md — even when the match arm reaches `check` through
+    /// design/contracts/0005-float-semantics.md — even when the match arm reaches `check` through
     /// the *full* check pipeline (which runs `desugar_module` first).
     ///
     /// The existing `reject_float_pattern_in_match` test in
diff --git a/crates/ailang-codegen/src/drop.rs b/crates/ailang-codegen/src/drop.rs
index d419b54..e4aea2f 100644
--- a/crates/ailang-codegen/src/drop.rs
+++ b/crates/ailang-codegen/src/drop.rs
@@ -85,7 +85,7 @@ impl<'a> Emitter<'a> {
         out.push_str("  %is_null = icmp eq ptr %p, null\n");
         out.push_str("  br i1 %is_null, label %ret, label %live\n");
         out.push_str("live:\n");
-        // FROZEN ABI (embedding boundary) — see design/contracts/embedding-abi.md.
+        // FROZEN ABI (embedding boundary) — see design/contracts/0003-embedding-abi.md.
         out.push_str("  %tag = load i64, ptr %p, align 8\n");
 
         let n_ctors = td.ctors.len();
@@ -111,7 +111,7 @@ impl<'a> Emitter<'a> {
                 if lty != "ptr" {
                     continue;
                 }
-                // FROZEN ABI (embedding boundary) — see design/contracts/embedding-abi.md.
+                // FROZEN ABI (embedding boundary) — see design/contracts/0003-embedding-abi.md.
                 let off = 8 + (j as i64) * 8;
                 let addr_id = local;
                 local += 1;
diff --git a/crates/ailang-codegen/src/lib.rs b/crates/ailang-codegen/src/lib.rs
index a9b9646..c1be04a 100644
--- a/crates/ailang-codegen/src/lib.rs
+++ b/crates/ailang-codegen/src/lib.rs
@@ -174,7 +174,7 @@ pub enum Target {
     /// published via `@__ail_tls_ctx` around the unchanged internal
     /// call. The ctx-threaded C signature is the M2 shape; the
     /// value/record layout is frozen as of M3
-    /// (design/contracts/frozen-value-layout.md).
+    /// (design/contracts/0006-frozen-value-layout.md).
     StaticLib,
 }
 
@@ -687,7 +687,7 @@ fn llvm_scalar(t: &Type) -> &'static str {
         // M3: any other Type::Con reaching an (export) signature is,
         // by the Task-2 export gate, a single-ctor scalar record;
         // it crosses the C ABI as a bare `ptr`
-        // (design/contracts/frozen-value-layout.md — payload pointer).
+        // (design/contracts/0006-frozen-value-layout.md — payload pointer).
         Type::Con { .. } => "ptr",
         _ => "i64",
     }
@@ -2813,7 +2813,7 @@ impl<'a> Emitter<'a> {
     /// allocates an `Ordering` ctor per call via the
     /// `compare__Int` → `match` path, which surfaces as a
     /// `bench_closure_chain` regression. See
-    /// `design/contracts/prelude-classes.md` for the full surface
+    /// `design/contracts/0017-prelude-classes.md` for the full surface
     /// and the Int-only asymmetry rationale.
     fn try_emit_primitive_instance_body(
         &mut self,
diff --git a/crates/ailang-codegen/src/match_lower.rs b/crates/ailang-codegen/src/match_lower.rs
index 596a49e..4f93a48 100644
--- a/crates/ailang-codegen/src/match_lower.rs
+++ b/crates/ailang-codegen/src/match_lower.rs
@@ -105,7 +105,7 @@ impl<'a> Emitter<'a> {
             compiled.push((v, vty));
         }
         // FROZEN ABI (embedding boundary) —
-        // design/contracts/frozen-value-layout.md. size = 8 + n*8, tag@0, fields@8+i*8.
+        // design/contracts/0006-frozen-value-layout.md. size = 8 + n*8, tag@0, fields@8+i*8.
         let size_bytes = 8 + (compiled.len() * 8) as i64;
         let p = self.fresh_ssa();
         // pick allocator based on escape analysis. `alloca`
diff --git a/crates/ailang-codegen/tests/embed_record_layout_pin.rs b/crates/ailang-codegen/tests/embed_record_layout_pin.rs
index 986805c..b52838d 100644
--- a/crates/ailang-codegen/tests/embed_record_layout_pin.rs
+++ b/crates/ailang-codegen/tests/embed_record_layout_pin.rs
@@ -1,4 +1,4 @@
-//! FROZEN ABI byte-pin — see design/contracts/frozen-value-layout.md.
+//! FROZEN ABI byte-pin — see design/contracts/0006-frozen-value-layout.md.
 //! Pins the heap (@ailang_rc_alloc) box layout a boundary-crossing
 //! single-ctor scalar record takes: size = 8 + n*8, tag i64 @ offset
 //! 0, fields i64-strided from offset 8. Goes RED if codegen moves an
diff --git a/crates/ailang-codegen/tests/embed_staticlib_lowering.rs b/crates/ailang-codegen/tests/embed_staticlib_lowering.rs
index 935dce8..883c0f4 100644
--- a/crates/ailang-codegen/tests/embed_staticlib_lowering.rs
+++ b/crates/ailang-codegen/tests/embed_staticlib_lowering.rs
@@ -45,7 +45,7 @@ fn staticlib_emits_forwarder_no_main() {
 
 /// M3: a single-ctor scalar record param/ret crosses the embedding
 /// C boundary as a bare `ptr` (the frozen payload pointer —
-/// design/contracts/frozen-value-layout.md). The M2 forwarder body
+/// design/contracts/0006-frozen-value-layout.md). The M2 forwarder body
 /// is byte-unchanged: leading `ptr %ctx`, TLS save/store/restore, the
 /// internal `@ail_<module>_<fn>` call carrying no ctx arg and no
 /// aggregate calling convention (no `sret`/`byval` — a record is a
diff --git a/crates/ailang-core/specs/form_a.md b/crates/ailang-core/specs/form_a.md
index 26f2b53..9b5dac1 100644
--- a/crates/ailang-core/specs/form_a.md
+++ b/crates/ailang-core/specs/form_a.md
@@ -86,7 +86,7 @@ externally-callable entrypoint (Embedding ABI M1). The symbol is
 author-chosen and decoupled from the internal `ail_<module>_<def>`
 mangling. M1 requires the fn's parameter and return types to be
 scalar (`Int`/`Float`) and its effect set to be empty — see
-design/contracts/embedding-abi.md.
+design/contracts/0003-embedding-abi.md.
 
 `suppress` clauses silence advisory diagnostics for this def. The
 `code` MUST be one of the registered codes (today: `over-strict-mode`).
@@ -324,7 +324,7 @@ Notes:
   both enforced at typecheck (`recur-arity-mismatch`,
   `recur-not-in-tail-position`). `loop`/`recur` make no termination
   claim: a `loop` with no non-`recur` exit runs forever. See
-  `docs/specs/2026-05-17-loop-recur.md`.
+  `docs/specs/0034-loop-recur.md`.
 
 ## Patterns
 
diff --git a/crates/ailang-core/src/ast.rs b/crates/ailang-core/src/ast.rs
index 77ef23a..9979fe8 100644
--- a/crates/ailang-core/src/ast.rs
+++ b/crates/ailang-core/src/ast.rs
@@ -1,6 +1,6 @@
 //! AST nodes for the AILang language.
 //!
-//! **The canonical schema lives in `design/contracts/data-model.md`**;
+//! **The canonical schema lives in `design/contracts/0002-data-model.md`**;
 //! this module is the Rust-side projection of it. When the two drift,
 //! `crates/ailang-core/tests/design_schema_drift.rs` fires.
 //!
@@ -208,7 +208,7 @@ pub struct FnDef {
     /// embedding boundary. Codegen's `Target::StaticLib` mode
     /// additionally emits an externally-visible C entrypoint
     /// `@<sym>` (signature frozen as of M3 —
-    /// design/contracts/embedding-abi.md) forwarding
+    /// design/contracts/0003-embedding-abi.md) forwarding
     /// to `@ail_<module>_<fn>`. The symbol is author-chosen and
     /// decoupled from the `ail_<module>_<def>` mangling so the
     /// M3-frozen ABI survives module/fn refactors.
@@ -256,7 +256,7 @@ pub struct Suppress {
 }
 
 /// A typeclass declaration (narrative in
-/// `design/contracts/typeclasses.md`).
+/// `design/contracts/0013-typeclasses.md`).
 ///
 /// Single-parameter, multi-method, optional-default, optional-superclass
 /// typeclass. The `param` is a single string — multi-param classes are
@@ -326,7 +326,7 @@ pub struct ClassMethod {
 }
 
 /// An instance declaration (narrative in
-/// `design/contracts/typeclasses.md`).
+/// `design/contracts/0013-typeclasses.md`).
 ///
 /// `class` is the name of the class being instantiated. `type_` is the
 /// concrete type expression the class is applied to — never the class
@@ -360,7 +360,7 @@ pub struct InstanceMethod {
 }
 
 /// A class constraint on a polymorphic function (narrative in
-/// `design/contracts/typeclasses.md`). `(class, type)` pair where
+/// `design/contracts/0013-typeclasses.md`). `(class, type)` pair where
 /// `class` is a class name and `type` is a `Type` expression —
 /// typically a single `Type::Var` (e.g. `(Eq, a)` for
 /// `Eq a => ...`). Concrete-type constraints are legal schema-wise
@@ -412,7 +412,7 @@ pub enum Term {
     /// `args` are evaluated left-to-right.
     ///
     /// `tail` marks this call as occurring in tail position (see
-    /// `design/contracts/tail-calls.md`). When set, codegen lowers
+    /// `design/contracts/0012-tail-calls.md`). When set, codegen lowers
     /// the call as `musttail call`. The flag defaults to `false` and
     /// is omitted during canonical-JSON serialisation when unset, so
     /// pre-tail-flag fixtures keep bit-identical hashes.
@@ -548,7 +548,7 @@ pub enum Term {
     /// loop-carried SSA / phi form is produced by `clang -O2`
     /// mem2reg (NOT hand-emitted phi). No totality claim — an
     /// infinite loop is legal. See
-    /// `docs/specs/2026-05-17-loop-recur.md`.
+    /// `docs/specs/0034-loop-recur.md`.
     Loop {
         binders: Vec<LoopBinder>,
         body: Box<Term>,
@@ -707,7 +707,7 @@ pub enum Type {
     /// every entry is `Implicit`; `ret_mode` is omitted when it is
     /// `Implicit`, so pre-mode-annotation fixtures hash
     /// bit-identically. Full contract in
-    /// `design/contracts/memory-model.md`.
+    /// `design/contracts/0008-memory-model.md`.
     Fn {
         params: Vec<Type>,
         #[serde(default, skip_serializing_if = "all_implicit")]
@@ -780,7 +780,7 @@ impl Type {
 }
 
 /// Per-parameter / return mode marker on a [`Type::Fn`]. Full
-/// contract lives in `design/contracts/memory-model.md`.
+/// contract lives in `design/contracts/0008-memory-model.md`.
 ///
 /// `Implicit` is the legacy state for fn-types that were constructed
 /// before the borrow/own surface annotations existed. Semantically,
diff --git a/crates/ailang-core/src/desugar.rs b/crates/ailang-core/src/desugar.rs
index 13a8260..a6414da 100644
--- a/crates/ailang-core/src/desugar.rs
+++ b/crates/ailang-core/src/desugar.rs
@@ -1090,12 +1090,12 @@ fn is_flat(p: &Pattern) -> bool {
 /// Builds the equality-test AST node for a literal pattern. Lowers
 /// `(pat-lit <lit>)` to `(if (eq sv <lit>) <body> <fall_k>)`. The
 /// emitted `eq` resolves via prelude.Eq's class-method dispatch
-/// (per design/contracts/method-dispatch.md) — Int/Bool/Str/Unit
+/// (per design/contracts/0016-method-dispatch.md) — Int/Bool/Str/Unit
 /// patterns all route through the corresponding primitive instance.
 ///
 /// Float-Literal patterns are hard-rejected at typecheck
 /// (`CheckError::FloatPatternNotAllowed`, per
-/// design/contracts/float-semantics.md) before this fn is reached,
+/// design/contracts/0005-float-semantics.md) before this fn is reached,
 /// so the `eq`-dispatch never encounters Float at runtime; the
 /// Float arm of the match below remains for AST-level totality.
 ///
diff --git a/crates/ailang-core/src/lib.rs b/crates/ailang-core/src/lib.rs
index b601e65..346ae94 100644
--- a/crates/ailang-core/src/lib.rs
+++ b/crates/ailang-core/src/lib.rs
@@ -108,7 +108,7 @@ pub type Result<T> = std::result::Result<T, Error>;
 pub const SCHEMA: &str = "ailang/v0";
 
 /// Complete LLM-targeted specification of Form-A — the canonical
-/// authoring surface (see `design/contracts/authoring-surface.md`).
+/// authoring surface (see `design/contracts/0001-authoring-surface.md`).
 /// Embedded verbatim into any prompt that asks an LLM to produce or
 /// edit AILang code; in particular, `ail merge-prose` includes it in
 /// the round-trip prompt template. The string is the raw bytes of
diff --git a/crates/ailang-core/tests/design_index_pin.rs b/crates/ailang-core/tests/design_index_pin.rs
index 724b962..4fe3ad0 100644
--- a/crates/ailang-core/tests/design_index_pin.rs
+++ b/crates/ailang-core/tests/design_index_pin.rs
@@ -4,8 +4,8 @@
 //! dangles, a contract loses its ratifying test, docs/DESIGN.md is
 //! resurrected, or a design/ body cross-link fails to resolve into
 //! the durable tier (clause-5; spec
-//! docs/specs/2026-05-19-design-ledger-formal-links.md). Spec for
-//! the split: docs/specs/2026-05-19-design-md-rolesplit.md.
+//! docs/specs/0046-design-ledger-formal-links.md). Spec for
+//! the split: docs/specs/0045-design-md-rolesplit.md.
 
 use std::fs;
 use std::path::PathBuf;
diff --git a/crates/ailang-core/tests/design_schema_drift.rs b/crates/ailang-core/tests/design_schema_drift.rs
index b111b64..15affee 100644
--- a/crates/ailang-core/tests/design_schema_drift.rs
+++ b/crates/ailang-core/tests/design_schema_drift.rs
@@ -1,6 +1,6 @@
-//! Drift detection between ast.rs and `design/contracts/data-model.md`.
+//! Drift detection between ast.rs and `design/contracts/0002-data-model.md`.
 //!
-//! `design/contracts/data-model.md` is the canonical schema
+//! `design/contracts/0002-data-model.md` is the canonical schema
 //! source-of-truth. Every AST enum (`Term`, `Pattern`, `Type`, `Def`,
 //! `Literal`, `ParamMode`) must have a JSON-schema anchor (e.g.
 //! `"t": "lit"`, `"k": "fn"`) present in that document. These tests
@@ -9,7 +9,7 @@
 //! The exhaustive `match` per enum is the load-bearing mechanism: adding a
 //! new variant without a matching arm fails compilation before the test runs.
 //! Once the variant is matched, the test asserts the anchor is present in
-//! `design/contracts/data-model.md`. The whole file is the data-model
+//! `design/contracts/0002-data-model.md`. The whole file is the data-model
 //! contract, so the file boundary now bounds the section — the former
 //! `## Data model` … `## Pipeline` slicer is no longer needed (the split
 //! gave the section its own file).
@@ -19,7 +19,7 @@ use ailang_core::ast::{
     InstanceMethod, Literal, Pattern, ParamMode, Suppress, Term, Type, TypeDef,
 };
 
-const DATA_MODEL: &str = include_str!("../../../design/contracts/data-model.md");
+const DATA_MODEL: &str = include_str!("../../../design/contracts/0002-data-model.md");
 
 /// Scoped substring match: returns `true` iff `anchor` appears inside a
 /// fenced code block (``` or ~~~) of `md`. Info-string `jsonc` / `json` /
@@ -47,7 +47,7 @@ fn anchor_in_jsonc_block(md: &str, anchor: &str) -> bool {
 }
 
 /// Every `Term` variant must have its JSON-schema anchor present in
-/// design/contracts/data-model.md. An LLM author cannot produce a term variant
+/// design/contracts/0002-data-model.md. An LLM author cannot produce a term variant
 /// whose `"t"` tag is absent from the canonical schema document.
 #[test]
 fn design_md_anchors_every_term_variant() {
@@ -182,8 +182,8 @@ fn design_md_anchors_every_term_variant() {
         };
         assert!(
             anchor_in_jsonc_block(DATA_MODEL, anchor),
-            "design/contracts/data-model.md is missing anchor `{anchor}` for a Term variant — \
-             add it to design/contracts/data-model.md"
+            "design/contracts/0002-data-model.md is missing anchor `{anchor}` for a Term variant — \
+             add it to design/contracts/0002-data-model.md"
         );
     }
 
@@ -194,14 +194,14 @@ fn design_md_anchors_every_term_variant() {
     for anchor in [r#""param-types""#, r#""ret-type""#] {
         assert!(
             anchor_in_jsonc_block(DATA_MODEL, anchor),
-            "design/contracts/data-model.md is missing Term::Lam kebab-key anchor `{anchor}` — \
+            "design/contracts/0002-data-model.md is missing Term::Lam kebab-key anchor `{anchor}` — \
              check the `lam` fenced JSON block"
         );
     }
 }
 
 /// Every `Pattern` variant must have its JSON-schema anchor present in
-/// design/contracts/data-model.md. Missing anchors mean an LLM cannot produce
+/// design/contracts/0002-data-model.md. Missing anchors mean an LLM cannot produce
 /// the corresponding pattern form.
 #[test]
 fn design_md_anchors_every_pattern_variant() {
@@ -224,13 +224,13 @@ fn design_md_anchors_every_pattern_variant() {
         };
         assert!(
             anchor_in_jsonc_block(DATA_MODEL, anchor),
-            "design/contracts/data-model.md is missing anchor `{anchor}` for a Pattern variant"
+            "design/contracts/0002-data-model.md is missing anchor `{anchor}` for a Pattern variant"
         );
     }
 }
 
 /// Every `Type` variant must have its JSON-schema anchor present in
-/// design/contracts/data-model.md. The `"k"` discriminator is load-bearing for
+/// design/contracts/0002-data-model.md. The `"k"` discriminator is load-bearing for
 /// the codegen and typechecker; an LLM must know all four forms.
 #[test]
 fn design_md_anchors_every_type_variant() {
@@ -257,13 +257,13 @@ fn design_md_anchors_every_type_variant() {
         };
         assert!(
             anchor_in_jsonc_block(DATA_MODEL, anchor),
-            "design/contracts/data-model.md is missing anchor `{anchor}` for a Type variant"
+            "design/contracts/0002-data-model.md is missing anchor `{anchor}` for a Type variant"
         );
     }
 }
 
 /// Every `Literal` variant must have its JSON-schema anchor present in
-/// design/contracts/data-model.md. The `"kind"` discriminator identifies the
+/// design/contracts/0002-data-model.md. The `"kind"` discriminator identifies the
 /// literal type; an LLM cannot produce a literal it hasn't seen in the
 /// schema.
 #[test]
@@ -286,13 +286,13 @@ fn design_md_anchors_every_literal_variant() {
         };
         assert!(
             anchor_in_jsonc_block(DATA_MODEL, anchor),
-            "design/contracts/data-model.md is missing anchor `{anchor}` for a Literal variant"
+            "design/contracts/0002-data-model.md is missing anchor `{anchor}` for a Literal variant"
         );
     }
 }
 
 /// Every `Def` kind must have its JSON-schema anchor present in
-/// design/contracts/data-model.md. All five kinds (`fn`, `const`, `type`,
+/// design/contracts/0002-data-model.md. All five kinds (`fn`, `const`, `type`,
 /// `class`, `instance`) must be documented so an LLM can write
 /// any kind of top-level definition.
 #[test]
@@ -358,13 +358,13 @@ fn design_md_anchors_every_def_kind() {
         };
         assert!(
             anchor_in_jsonc_block(DATA_MODEL, anchor),
-            "design/contracts/data-model.md is missing anchor `{anchor}` for a Def kind"
+            "design/contracts/0002-data-model.md is missing anchor `{anchor}` for a Def kind"
         );
     }
 }
 
 /// Every `ParamMode` variant must have its serialized string form present
-/// in design/contracts/data-model.md. The mode annotations are load-bearing for
+/// in design/contracts/0002-data-model.md. The mode annotations are load-bearing for
 /// ownership checking; an LLM author must know all three forms.
 #[test]
 fn design_md_anchors_every_parammode_variant() {
@@ -382,7 +382,7 @@ fn design_md_anchors_every_parammode_variant() {
         };
         assert!(
             anchor_in_jsonc_block(DATA_MODEL, anchor),
-            "design/contracts/data-model.md is missing anchor `{anchor}` for a ParamMode variant"
+            "design/contracts/0002-data-model.md is missing anchor `{anchor}` for a ParamMode variant"
         );
     }
 }
@@ -502,7 +502,7 @@ fn lam_serialises_with_kebab_keys() {
     );
 }
 
-/// Nested struct key anchors must be present in design/contracts/data-model.md.
+/// Nested struct key anchors must be present in design/contracts/0002-data-model.md.
 /// These keys appear inside `Suppress`, `ClassMethod`, `InstanceMethod`,
 /// and `Type::Forall` — they are not discriminators but they ARE part
 /// of the canonical JSON schema and must remain documented.
@@ -534,7 +534,7 @@ fn design_md_anchors_nested_struct_keys() {
     for anchor in anchors {
         assert!(
             anchor_in_jsonc_block(DATA_MODEL, anchor),
-            "design/contracts/data-model.md is missing nested-struct-key anchor `{anchor}`"
+            "design/contracts/0002-data-model.md is missing nested-struct-key anchor `{anchor}`"
         );
     }
 }
diff --git a/crates/ailang-core/tests/docs_honesty_pin.rs b/crates/ailang-core/tests/docs_honesty_pin.rs
index 8ecafbe..e735079 100644
--- a/crates/ailang-core/tests/docs_honesty_pin.rs
+++ b/crates/ailang-core/tests/docs_honesty_pin.rs
@@ -28,25 +28,25 @@ fn norm(s: &str) -> String {
 /// The `design/` prose set the absent-pins span after the role-split
 /// (these pins formerly scanned the single canonical design doc): the
 /// RC + bump memory-model narrative
-/// (`models/rc-uniqueness.md`), float semantics
-/// (`contracts/float-semantics.md`), the typeclass contract incl.
+/// (`models/0004-rc-uniqueness.md`), float semantics
+/// (`contracts/0005-float-semantics.md`), the typeclass contract incl.
 /// prelude classes & "does NOT commit to"
-/// (`contracts/typeclasses.md`), the effects model
-/// (`models/effects.md`), and the authoring-surface notation model
-/// (`models/authoring-surface.md`). A swept Wunschdenken /
+/// (`contracts/0013-typeclasses.md`), the effects model
+/// (`models/0002-effects.md`), and the authoring-surface notation model
+/// (`models/0001-authoring-surface.md`). A swept Wunschdenken /
 /// doc-archaeology string must be absent from **all** of them, so the
 /// reads are joined and a single absence assertion covers the set.
 fn design_corpus() -> String {
     [
-        read("design/models/rc-uniqueness.md"),
-        read("design/contracts/float-semantics.md"),
-        read("design/contracts/typeclasses.md"),
-        read("design/contracts/method-dispatch.md"),
-        read("design/contracts/prelude-classes.md"),
-        read("design/contracts/language-constraints.md"),
-        read("design/models/effects.md"),
-        read("design/models/authoring-surface.md"),
-        read("design/models/prose-projection.md"),
+        read("design/models/0004-rc-uniqueness.md"),
+        read("design/contracts/0005-float-semantics.md"),
+        read("design/contracts/0013-typeclasses.md"),
+        read("design/contracts/0016-method-dispatch.md"),
+        read("design/contracts/0017-prelude-classes.md"),
+        read("design/contracts/0015-language-constraints.md"),
+        read("design/models/0002-effects.md"),
+        read("design/models/0001-authoring-surface.md"),
+        read("design/models/0006-prose-projection.md"),
     ]
     .join("\n")
 }
@@ -103,13 +103,13 @@ fn design_md_present_tense_anchors_present() {
     // ever lived in the (now-removed) decision-records annex are
     // dropped — anything the design/ ledger truly needs lives in
     // design/contracts/ or design/models/.
-    let honesty = norm(&read("design/contracts/honesty-rule.md"));
-    let scope = norm(&read("design/contracts/scope-boundaries.md"));
-    let memory = norm(&read("design/contracts/memory-model.md"));
-    let str_abi = norm(&read("design/contracts/str-abi.md"));
-    let prelude_classes = norm(&read("design/contracts/prelude-classes.md"));
+    let honesty = norm(&read("design/contracts/0007-honesty-rule.md"));
+    let scope = norm(&read("design/contracts/0010-scope-boundaries.md"));
+    let memory = norm(&read("design/contracts/0008-memory-model.md"));
+    let str_abi = norm(&read("design/contracts/0011-str-abi.md"));
+    let prelude_classes = norm(&read("design/contracts/0017-prelude-classes.md"));
 
-    // the discriminator meta-subsection -> contracts/honesty-rule.md
+    // the discriminator meta-subsection -> contracts/0007-honesty-rule.md
     assert!(honesty.contains("the honesty rule it holds itself to"),
         "honesty-rule.md must carry the discriminator meta-subsection heading");
     assert!(honesty.contains("whether the document asserts something exists, works, or changed that does not"),
@@ -144,7 +144,7 @@ fn form_a_scalar_param_carveout_present_and_old_rule_absent() {
     // (planner Step-5 item 6: line-wrap is structurally discharged,
     // the substrings need not be contiguous in the .md source).
     let f = norm(FORM_A_SPEC);
-    let d = norm(&read("design/contracts/embedding-abi.md"));
+    let d = norm(&read("design/contracts/0003-embedding-abi.md"));
 
     // --- ABSENT: the four old unconditional phrasings must be gone ---
     assert!(!f.contains("Mode annotations on every `(fn ...)` parameter."),
@@ -166,7 +166,7 @@ fn form_a_scalar_param_carveout_present_and_old_rule_absent() {
     assert!(f.contains("Putting a mode on a scalar parameter."),
         "form_a.md Pitfalls must carry the inverse pitfall — over-wrapping a scalar (site 4)");
 
-    // --- PRESENT: the design/contracts/embedding-abi.md mirror ---
+    // --- PRESENT: the design/contracts/0003-embedding-abi.md mirror ---
     assert!(d.contains("Export parameters are written **bare**: a scalar type carries no `own`/`borrow` mode"),
-        "design/contracts/embedding-abi.md must mirror the canonical bare-scalar export-param rule");
+        "design/contracts/0003-embedding-abi.md must mirror the canonical bare-scalar export-param rule");
 }
diff --git a/crates/ailang-core/tests/effect_doc_honesty_pin.rs b/crates/ailang-core/tests/effect_doc_honesty_pin.rs
index c92cdac..41a197d 100644
--- a/crates/ailang-core/tests/effect_doc_honesty_pin.rs
+++ b/crates/ailang-core/tests/effect_doc_honesty_pin.rs
@@ -25,23 +25,23 @@ fn norm(s: &str) -> String {
 
 #[test]
 fn design_md_effect_prose_is_true() {
-    // Effect prose -> design/models/effects.md; the
+    // Effect prose -> design/models/0002-effects.md; the
     // "the built-in IO and Diverge ops" absent-pin's home
-    // `## What is not (yet) supported` -> design/contracts/scope-boundaries.md.
-    let d = norm(&[read("design/models/effects.md"),
-                   read("design/contracts/scope-boundaries.md")].join("\n"));
+    // `## What is not (yet) supported` -> design/contracts/0010-scope-boundaries.md.
+    let d = norm(&[read("design/models/0002-effects.md"),
+                   read("design/contracts/0010-scope-boundaries.md")].join("\n"));
     // fiction absent
     assert!(!d.contains("row-polymorphic"),
         "design/: the effect row is NOT row-polymorphic (no EffectRow / row var exists)");
     assert!(!d.contains("`IO` and `Diverge` (for infinite"),
         "design/: `Diverge` is not a wired-up MVP effect");
     assert!(!d.contains("the built-in IO and Diverge ops"),
-        "design/contracts/scope-boundaries.md: there is no built-in Diverge op");
+        "design/contracts/0010-scope-boundaries.md: there is no built-in Diverge op");
     // corrected anchors present
     assert!(d.contains("flat, unordered, closed set of effect names"),
-        "design/models/effects.md Decision 3 must describe the real (flat set-equality) effect model");
+        "design/models/0002-effects.md Decision 3 must describe the real (flat set-equality) effect model");
     assert!(d.contains("`Diverge` (for non-termination) is reserved"),
-        "design/models/effects.md Decision 3 must state Diverge is reserved/unimplemented");
+        "design/models/0002-effects.md Decision 3 must state Diverge is reserved/unimplemented");
 }
 
 #[test]
diff --git a/crates/ailang-prose/src/lib.rs b/crates/ailang-prose/src/lib.rs
index eff11dc..abe1d2d 100644
--- a/crates/ailang-prose/src/lib.rs
+++ b/crates/ailang-prose/src/lib.rs
@@ -15,7 +15,7 @@
 //! effects, `clone`, `reuse-as`, doc strings, type annotations on
 //! signatures and lambdas, the `tail` flag) stays visible.
 //!
-//! See `design/contracts/authoring-surface.md` for the prose-surface
+//! See `design/contracts/0001-authoring-surface.md` for the prose-surface
 //! invariants this crate must respect.
 //!
 //! # Public API
diff --git a/crates/ailang-surface/src/lib.rs b/crates/ailang-surface/src/lib.rs
index 7d8c12a..69c8192 100644
--- a/crates/ailang-surface/src/lib.rs
+++ b/crates/ailang-surface/src/lib.rs
@@ -4,7 +4,7 @@
 //! [`ailang_core::ast::Module`] values. The JSON-AST in `ailang-core`
 //! remains the canonical, hashable, content-addressed source of truth;
 //! form (A) is the AI-authoring projection optimised for token-efficient
-//! production by LLMs (see `design/contracts/authoring-surface.md`).
+//! production by LLMs (see `design/contracts/0001-authoring-surface.md`).
 //!
 //! ## Modules
 //!
diff --git a/crates/ailang-surface/src/parse.rs b/crates/ailang-surface/src/parse.rs
index 7d2b56b..73168a4 100644
--- a/crates/ailang-surface/src/parse.rs
+++ b/crates/ailang-surface/src/parse.rs
@@ -76,7 +76,7 @@
 //! ```
 //!
 //! Notes on the form (the binding constraints are in
-//! design/contracts/authoring-surface.md):
+//! design/contracts/0001-authoring-surface.md):
 //!
 //! - The `lam` form carries `param-types`, a `ret` type, and an
 //!   optional `effects` clause. The AST stores them per-lambda and
diff --git a/crates/ailang-surface/src/print.rs b/crates/ailang-surface/src/print.rs
index dda2066..1ca757f 100644
--- a/crates/ailang-surface/src/print.rs
+++ b/crates/ailang-surface/src/print.rs
@@ -125,7 +125,7 @@ fn write_type_def(out: &mut String, td: &TypeDef, level: usize) {
     }
     // `(drop-iterative)` annotation. Printed last (after
     // every ctor) so the canonical form lands consistent with the
-    // design/contracts/data-model.md example. Omitted when `drop_iterative == false`.
+    // design/contracts/0002-data-model.md example. Omitted when `drop_iterative == false`.
     if td.drop_iterative {
         out.push('\n');
         indent(out, level + 1);
diff --git a/crates/ailang-surface/tests/prelude_decouple_carve_out_pin.rs b/crates/ailang-surface/tests/prelude_decouple_carve_out_pin.rs
index 0a48e33..a1bff51 100644
--- a/crates/ailang-surface/tests/prelude_decouple_carve_out_pin.rs
+++ b/crates/ailang-surface/tests/prelude_decouple_carve_out_pin.rs
@@ -23,7 +23,7 @@ fn prelude_ail_json_does_not_exist_on_disk() {
          re-introduced this file, you must also: (a) remove this pin, \
          (b) restore the §C4 (b) entry in carve_out_inventory.rs, \
          (c) revert the §C4 (b) status marker in \
-         docs/specs/2026-05-13-form-a-default-authoring.md, and \
+         docs/specs/0025-form-a-default-authoring.md, and \
          (d) record the rationale in the commit body."
     );
 }
diff --git a/crates/ailang-surface/tests/round_trip.rs b/crates/ailang-surface/tests/round_trip.rs
index 07594e4..1aeeba6 100644
--- a/crates/ailang-surface/tests/round_trip.rs
+++ b/crates/ailang-surface/tests/round_trip.rs
@@ -7,7 +7,7 @@
 //!
 //! 1. `parse_is_deterministic_over_every_ail_fixture` — pins
 //!    **parse-determinism** (property 1 of the post-form-a Roundtrip
-//!    Invariant, design/contracts/roundtrip-invariant.md). For every
+//!    Invariant, design/contracts/0009-roundtrip-invariant.md). For every
 //!    well-formed `.ail` text `t`, `parse(t)` produces the same
 //!    canonical bytes every invocation. The parser is a pure
 //!    function of input — no randomness, no time dependence, no
@@ -69,7 +69,7 @@ fn list_ail_fixtures() -> Vec<PathBuf> {
 }
 
 /// Pins **idempotency-under-print** (property 2 of the post-form-a
-/// Roundtrip Invariant, design/contracts/roundtrip-invariant.md): for every
+/// Roundtrip Invariant, design/contracts/0009-roundtrip-invariant.md): for every
 /// well-formed `.ail` text `t`, the composition `parse → print → parse`
 /// is idempotent on the AST.
 ///
diff --git a/design/INDEX.md b/design/INDEX.md
index fb16481..681ac49 100644
--- a/design/INDEX.md
+++ b/design/INDEX.md
@@ -36,7 +36,7 @@ evolving in lockstep with the language:
 - **Surface forms** (`crates/ailang-surface`, `crates/ailang-prose`):
   the LLM-facing renderings of a module. `ailang-surface`
   is the lossless Form-A printer/parser — the canonical
-  [authoring surface](contracts/authoring-surface.md), with a
+  [authoring surface](contracts/0001-authoring-surface.md), with a
   round-trip property `parse ∘ print = id` gating every release. `ailang-prose`
   is the lossy Form-B projection — human-readable prose for review and
   edit, with no parser; re-integration goes through the
@@ -78,34 +78,34 @@ is the default.
 ## Contracts
 | id | consumer / lifetime | ratifying-test | link |
 |----|---------------------|----------------|------|
-| feature-acceptance   | brainstorm-gate / stable      | skills/brainstorm/SKILL.md         | design/contracts/feature-acceptance.md |
-| authoring-surface    | LLM author / stable           | crates/ailang-surface/tests/round_trip.rs       | design/contracts/authoring-surface.md |
-| roundtrip-invariant  | every release / stable        | crates/ailang-surface/tests/round_trip.rs       | design/contracts/roundtrip-invariant.md |
-| language-constraints | LLM author / stable           | crates/ailang-check/src/uniqueness.rs (in-source mod tests) | design/contracts/language-constraints.md |
-| memory-model         | LLM author / stable           | crates/ailang-check/src/uniqueness.rs (in-source mod tests) | design/contracts/memory-model.md |
-| data-model           | LLM author / stable           | crates/ailang-core/tests/design_schema_drift.rs | design/contracts/data-model.md |
+| feature-acceptance   | brainstorm-gate / stable      | skills/brainstorm/SKILL.md         | design/contracts/0004-feature-acceptance.md |
+| authoring-surface    | LLM author / stable           | crates/ailang-surface/tests/round_trip.rs       | design/contracts/0001-authoring-surface.md |
+| roundtrip-invariant  | every release / stable        | crates/ailang-surface/tests/round_trip.rs       | design/contracts/0009-roundtrip-invariant.md |
+| language-constraints | LLM author / stable           | crates/ailang-check/src/uniqueness.rs (in-source mod tests) | design/contracts/0015-language-constraints.md |
+| memory-model         | LLM author / stable           | crates/ailang-check/src/uniqueness.rs (in-source mod tests) | design/contracts/0008-memory-model.md |
+| data-model           | LLM author / stable           | crates/ailang-core/tests/design_schema_drift.rs | design/contracts/0002-data-model.md |
 | mangling             | codegen / stable              | crates/ail/tests/eq_ord_e2e.rs            | crates/ailang-codegen/src/lib.rs //! |
 | env-construction     | codegen / stable              | crates/ailang-check/tests/duplicate_ctor_pin.rs | crates/ailang-codegen/src/lib.rs //! |
 | qualified-xref       | codegen / stable              | crates/ail/tests/codegen_import_map_fallback_pin.rs | crates/ail/src/main.rs //! |
-| frozen-value-layout  | embedding ABI / one-way-frozen| crates/ailang-codegen/tests/embed_record_layout_pin.rs | design/contracts/frozen-value-layout.md + runtime/rc.c §layout |
-| float-semantics      | LLM author / stable           | crates/ail/tests/eq_float_noinstance.rs   | design/contracts/float-semantics.md |
-| typeclasses          | LLM author / stable           | crates/ail/tests/show_no_instance_e2e.rs  | design/contracts/typeclasses.md |
-| method-dispatch      | LLM author / stable           | crates/ail/tests/show_no_instance_e2e.rs  | design/contracts/method-dispatch.md |
-| prelude-classes      | LLM author / stable           | crates/ail/tests/show_no_instance_e2e.rs  | design/contracts/prelude-classes.md |
-| str-abi              | runtime ABI / stable          | crates/ail/tests/e2e.rs (Str path)        | design/contracts/str-abi.md + runtime/str.c §heap-Str |
-| tail-calls           | codegen / stable              | crates/ailang-check/src/lib.rs (in-source tail_call_in_non_tail_position_is_rejected) | design/contracts/tail-calls.md |
-| honesty-rule         | architect+grounding / stable  | crates/ailang-core/tests/docs_honesty_pin.rs | design/contracts/honesty-rule.md |
-| embedding-abi        | embedding host / stable       | crates/ailang-codegen/tests/embed_record_layout_pin.rs | design/contracts/embedding-abi.md |
-| scope-boundaries     | architect+author / stable     | crates/ailang-core/tests/effect_doc_honesty_pin.rs | design/contracts/scope-boundaries.md |
-| verification         | architect / stable            | bench/architect_sweeps.sh                 | design/contracts/verification.md |
+| frozen-value-layout  | embedding ABI / one-way-frozen| crates/ailang-codegen/tests/embed_record_layout_pin.rs | design/contracts/0006-frozen-value-layout.md + runtime/rc.c §layout |
+| float-semantics      | LLM author / stable           | crates/ail/tests/eq_float_noinstance.rs   | design/contracts/0005-float-semantics.md |
+| typeclasses          | LLM author / stable           | crates/ail/tests/show_no_instance_e2e.rs  | design/contracts/0013-typeclasses.md |
+| method-dispatch      | LLM author / stable           | crates/ail/tests/show_no_instance_e2e.rs  | design/contracts/0016-method-dispatch.md |
+| prelude-classes      | LLM author / stable           | crates/ail/tests/show_no_instance_e2e.rs  | design/contracts/0017-prelude-classes.md |
+| str-abi              | runtime ABI / stable          | crates/ail/tests/e2e.rs (Str path)        | design/contracts/0011-str-abi.md + runtime/str.c §heap-Str |
+| tail-calls           | codegen / stable              | crates/ailang-check/src/lib.rs (in-source tail_call_in_non_tail_position_is_rejected) | design/contracts/0012-tail-calls.md |
+| honesty-rule         | architect+grounding / stable  | crates/ailang-core/tests/docs_honesty_pin.rs | design/contracts/0007-honesty-rule.md |
+| embedding-abi        | embedding host / stable       | crates/ailang-codegen/tests/embed_record_layout_pin.rs | design/contracts/0003-embedding-abi.md |
+| scope-boundaries     | architect+author / stable     | crates/ailang-core/tests/effect_doc_honesty_pin.rs | design/contracts/0010-scope-boundaries.md |
+| verification         | architect / stable            | bench/architect_sweeps.sh                 | design/contracts/0014-verification.md |
 
 ## Models
 | id | consumer / lifetime | link |
 |----|---------------------|------|
-| rc-uniqueness     | onboarding / evolves | design/models/rc-uniqueness.md |
-| typeclasses       | onboarding / evolves | design/models/typeclasses.md |
-| effects           | onboarding / evolves | design/models/effects.md |
-| authoring-surface | onboarding / evolves | design/models/authoring-surface.md |
-| prose-projection  | onboarding / evolves | design/models/prose-projection.md |
-| pipeline          | onboarding / evolves | design/models/pipeline.md |
-| kernel-extensions | onboarding / evolves (design accepted 2026-05-28; impl in progress) | design/models/kernel-extensions.md |
+| rc-uniqueness     | onboarding / evolves | design/models/0004-rc-uniqueness.md |
+| typeclasses       | onboarding / evolves | design/models/0005-typeclasses.md |
+| effects           | onboarding / evolves | design/models/0002-effects.md |
+| authoring-surface | onboarding / evolves | design/models/0001-authoring-surface.md |
+| prose-projection  | onboarding / evolves | design/models/0006-prose-projection.md |
+| pipeline          | onboarding / evolves | design/models/0003-pipeline.md |
+| kernel-extensions | onboarding / evolves (design accepted 2026-05-28; impl in progress) | design/models/0007-kernel-extensions.md |
diff --git a/design/contracts/authoring-surface.md b/design/contracts/0001-authoring-surface.md
similarity index 96%
rename from design/contracts/authoring-surface.md
rename to design/contracts/0001-authoring-surface.md
index a172e7c..938d88f 100644
--- a/design/contracts/authoring-surface.md
+++ b/design/contracts/0001-authoring-surface.md
@@ -18,7 +18,7 @@ the same time, leaving only diagnostic helpers (`type_to_string`,
 The textual surface is **not** a replacement for the JSON-AST. It is
 one projection among potentially many. Concretely:
 
-- The [JSON-AST](data-model.md) keeps its role as the canonical, hashable, content-
+- The [JSON-AST](0002-data-model.md) keeps its role as the canonical, hashable, content-
   addressed representation of a module. All hashing, content-
   addressing, cross-module references, and typecheck/codegen input
   flow through the JSON-AST. **No new hashable form is introduced.**
@@ -55,7 +55,7 @@ the AST and remain projection-agnostic.
    shape. The full bijection between `.ail.json` and `.ail` (both
    directions, BLAKE3-stable hashing, Float-bits-hex encoding,
    workspace-CI enforcement points) is anchored as the top-level
-   [Roundtrip Invariant](roundtrip-invariant.md) — this constraint
+   [Roundtrip Invariant](0009-roundtrip-invariant.md) — this constraint
    records that the surface-design choice must satisfy that
    invariant; the invariant itself lives at top level because the
    property is load-bearing on the language identity, not on this
diff --git a/design/contracts/data-model.md b/design/contracts/0002-data-model.md
similarity index 92%
rename from design/contracts/data-model.md
rename to design/contracts/0002-data-model.md
index d693ea9..6d19555 100644
--- a/design/contracts/data-model.md
+++ b/design/contracts/0002-data-model.md
@@ -28,10 +28,10 @@ contract is what makes growing the schema cheap.
 are real surface forms. Class and type cross-module references
 (canonical-form rule, qualified `<module>.<Class>` /
 `<module>.<TypeName>`) follow the scoping rule in
-[memory model](memory-model.md); the `class`/`instance` schema
+[memory model](0008-memory-model.md); the `class`/`instance` schema
 narrative — defaults, superclasses, diagnostics — lives in
-[typeclasses](typeclasses.md). Exported `fn` defs interact with
-[embedding ABI](embedding-abi.md).
+[typeclasses](0013-typeclasses.md). Exported `fn` defs interact with
+[embedding ABI](0003-embedding-abi.md).
 
 ```jsonc
 // fn (the unit that gets a content hash)
@@ -65,7 +65,7 @@ narrative — defaults, superclasses, diagnostics — lives in
   "drop-iterative": true   // opt-in; omitted when false (hash-stable when omitted)
 }
 
-// class (typeclass declaration; narrative in contracts/typeclasses.md)
+// class (typeclass declaration; narrative in contracts/0013-typeclasses.md)
 { "kind": "class",
   "name": "<id>",          // class name (e.g. "Show")
   "param": "<id>",          // single class parameter, kind *
@@ -80,7 +80,7 @@ narrative — defaults, superclasses, diagnostics — lives in
   "doc": "<optional string>"
 }
 
-// instance (typeclass instance; narrative in contracts/typeclasses.md)
+// instance (typeclass instance; narrative in contracts/0013-typeclasses.md)
 { "kind": "instance",
   "class": "<id>",          // class being instantiated; canonical form (bare for same-module, "<module>.<Class>" for cross-module)
   "type": Type,             // concrete type expression (never the class param)
@@ -165,7 +165,7 @@ narrative — defaults, superclasses, diagnostics — lives in
 // non-`recur` branch. Strictly additive (no `skip_serializing_if`;
 // pre-existing fixtures hash bit-identically — none carry the tag).
 // No totality claim — an infinite loop is legal. See
-// `docs/specs/2026-05-17-loop-recur.md`.
+// `docs/specs/0034-loop-recur.md`.
 { "t": "loop",
   "binders": [ { "name": "<id>", "type": Type, "init": Term }, ... ],
   "body": Term }
@@ -179,7 +179,7 @@ narrative — defaults, superclasses, diagnostics — lives in
 ```
 
 In the MVP, `do` is only a direct call to a built-in effect op (no
-handler); the effect system is described in [effects](../models/effects.md).
+handler); the effect system is described in [effects](../models/0002-effects.md).
 A `lam` term constructs an anonymous function value; free
 variables of its body are captured from the enclosing scope.
 
@@ -188,7 +188,7 @@ ordinary local scope plus a positional `loop_stack`, and codegen
 lowers them as entry-block allocas. Capturing a `loop` binder into a
 lambda body is rejected at typecheck via
 `CheckError::LoopBinderCapturedByLambda`. See
-`docs/specs/2026-05-17-loop-recur.md`.
+`docs/specs/0034-loop-recur.md`.
 
 **`Literal`**:
 
@@ -215,7 +215,7 @@ Patterns are linear: each pattern variable may appear at most once.
 
 The `Type::Con.name` canonical-form rule (bare for same-module /
 primitives, qualified `<module>.<TypeName>` for cross-module) lives
-in [memory model](memory-model.md); `Type::Fn`'s parameter-mode
+in [memory model](0008-memory-model.md); `Type::Fn`'s parameter-mode
 metadata is defined and gated there as well.
 
 ```jsonc
@@ -228,7 +228,7 @@ metadata is defined and gated there as well.
 // in the typechecker (unify, occurs, apply) keeps working.
 // `paramModes` omitted when every entry is "implicit"; `retMode`
 // omitted when "implicit" (hash-stable when omitted). Full mode
-// contract lives in contracts/memory-model.md.
+// contract lives in contracts/0008-memory-model.md.
 { "k": "fn",
   "params":     [Type...],
   "paramModes": [ParamMode...],
@@ -239,7 +239,7 @@ metadata is defined and gated there as well.
 { "k": "var", "name": "<id>" }
 
 // Top-level polymorphism only. `constraints` carries class
-// constraints (narrative in contracts/typeclasses.md); omitted when
+// constraints (narrative in contracts/0013-typeclasses.md); omitted when
 // empty (hash-stable when omitted).
 { "k": "forall",
   "vars": ["<id>"...],
@@ -248,7 +248,7 @@ metadata is defined and gated there as well.
 ```
 
 **`ParamMode`** (full contract in
-[memory model](memory-model.md)):
+[memory model](0008-memory-model.md)):
 
 ```
 "implicit"   — unannotated / back-compat. Treated as `own` by the typechecker.
@@ -260,8 +260,8 @@ metadata is defined and gated there as well.
 unannotated fixtures continue to serialize without the mode wrapper and keep their
 canonical-JSON hash. The full mode contract (codegen consequences,
 the over-strict-mode lint, the `Suppress` mechanism) lives in
-[memory model](memory-model.md); the four language-design
+[memory model](0008-memory-model.md); the four language-design
 preconditions that make RC sound live in
-[language constraints](language-constraints.md).
+[language constraints](0015-language-constraints.md).
 
 Ratified by: `crates/ailang-core/tests/design_schema_drift.rs`.
diff --git a/design/contracts/embedding-abi.md b/design/contracts/0003-embedding-abi.md
similarity index 95%
rename from design/contracts/embedding-abi.md
rename to design/contracts/0003-embedding-abi.md
index 1bfc257..e3cc8cf 100644
--- a/design/contracts/embedding-abi.md
+++ b/design/contracts/0003-embedding-abi.md
@@ -44,12 +44,12 @@ The staticlib swarm artefact is **RC-only**:
 stub is leak-only and not swarm-safe; `--alloc=gc` no longer
 exists as a CLI value — see the Boehm-retirement iter). The
 value/record
-layout is **frozen as of M3** (see [Frozen value layout](frozen-value-layout.md)); the
+layout is **frozen as of M3** (see [Frozen value layout](0006-frozen-value-layout.md)); the
 ctx-threaded C signature is the M2 shape.
 
 Export parameters are written **bare**: a scalar type carries no
 `own`/`borrow` mode (a single-constructor record export parameter,
-by contrast, carries `own`/`borrow` — see [memory model](memory-model.md)
+by contrast, carries `own`/`borrow` — see [memory model](0008-memory-model.md)
 for the full ownership contract; the
 frozen value layout below specifies how that contract lands at the C ABI). The
 canonical M1 export shape:
diff --git a/design/contracts/feature-acceptance.md b/design/contracts/0004-feature-acceptance.md
similarity index 96%
rename from design/contracts/feature-acceptance.md
rename to design/contracts/0004-feature-acceptance.md
index b5bcb8c..1491f1d 100644
--- a/design/contracts/feature-acceptance.md
+++ b/design/contracts/0004-feature-acceptance.md
@@ -30,7 +30,7 @@ A proposed feature ships only if all three hold:
    question is whether the construct re-opens a class of mistakes
    (iterated-mutable-state reasoning, silently-unbounded recursion,
    reference cycles) that a foundational invariant — see
-   [language constraints](language-constraints.md) — closes. If it does,
+   [language constraints](0015-language-constraints.md) — closes. If it does,
    it is cut even when 1 and 2 hold — *or* it must be reshaped until
    the bug class is structurally impossible rather than merely
    discouraged. A documentation note is not a reshape; the
@@ -44,7 +44,7 @@ A proposed feature ships only if all three hold:
    built without a documented-unenforced precondition*, pass all
    three — and the fact that the 2026-05 attempt could not (it
    forced a silent-divergence precondition; see
-   `docs/specs/2026-05-16-iteration-discipline-revert.md`) is itself
+   `docs/specs/0032-iteration-discipline-revert.md`) is itself
    the bug-class-reintroduction discriminator working as intended.
 
 This is the positive complement to the CLAUDE.md rule that
diff --git a/design/contracts/float-semantics.md b/design/contracts/0005-float-semantics.md
similarity index 92%
rename from design/contracts/float-semantics.md
rename to design/contracts/0005-float-semantics.md
index b4368da..8ae4e16 100644
--- a/design/contracts/float-semantics.md
+++ b/design/contracts/0005-float-semantics.md
@@ -12,7 +12,7 @@ no `f32` variant. The runtime / codegen contract:
   fmul / fdiv double`, `fneg double`. Float comparison goes through
   the named prelude fns `float_eq` / `float_ne` / `float_lt` /
   `float_le` / `float_gt` / `float_ge` (Float has no Eq/Ord instance
-  — see [Prelude (built-in) classes](prelude-classes.md)); each fn
+  — see [Prelude (built-in) classes](0017-prelude-classes.md)); each fn
   lowers to a single `fcmp` instruction (`oeq` / `une` / `olt` /
   `ole` / `ogt` / `oge` respectively) via the codegen intercept
   `try_emit_primitive_instance_body`, with the `alwaysinline`
@@ -73,7 +73,7 @@ no `f32` variant. The runtime / codegen contract:
 
 The same libc-`%g` rendering applies to `show 1.5` / `show nan` /
 `show inf` via `instance Show Float` (which calls `float_to_str`
-internally — see [Prelude (built-in) classes](prelude-classes.md) for the Show ship).
+internally — see [Prelude (built-in) classes](0017-prelude-classes.md) for the Show ship).
 The NaN-spelling caveat above is observable via `do print x` for
 Float-typed `x`; the rendering is libc-version-dependent and
 target-libc-specific. AILang does NOT canonicalise Float textual
@@ -91,15 +91,15 @@ use case appears.
 **Form-A serialisation:** Float literals carry the IEEE-754
 bit pattern as a 16-character lowercase hex string in the canonical
 JSON: `{"kind":"float","bits":"<16-hex>"}` (see
-[Data model](data-model.md) for the literal schema). Routing through the
+[Data model](0002-data-model.md) for the literal schema). Routing through the
 JSON *string* path (not `serde_json::Number`) preserves bit
 stability across `serde_json` versions and lets NaN / ±Inf
 round-trip through Form-A — JSON numbers cannot represent them.
 This bits-hex encoding is what keeps Floats inside the
-[Roundtrip Invariant](roundtrip-invariant.md).
+[Roundtrip Invariant](0009-roundtrip-invariant.md).
 
 **Pattern matching:** `Pattern::Lit` on `Literal::Float` (see
-[Data model](data-model.md) for the pattern schema) is hard-
+[Data model](0002-data-model.md) for the pattern schema) is hard-
 rejected at typecheck (`CheckError::FloatPatternNotAllowed`). IEEE
 semantics make Float patterns semantically dubious — NaN never
 matches via `float_eq` (its `fcmp oeq` lowering is `false` for
@@ -109,7 +109,7 @@ Use the explicit comparison fns (`float_lt`, `float_gt`, ...) and
 
 `float_to_str` (Float → Str) and `int_to_str` (Int → Str) are
 fully wired through checker, codegen, and runtime. Both allocate
-a fresh heap-Str slab at the call site (see [Str ABI](str-abi.md)
+a fresh heap-Str slab at the call site (see [Str ABI](0011-str-abi.md)
 for the dual realisation) and carry `ret_mode: Own` so the let-binder
 for the call result is RC-tracked and the slab is freed at scope
 close.
diff --git a/design/contracts/frozen-value-layout.md b/design/contracts/0006-frozen-value-layout.md
similarity index 94%
rename from design/contracts/frozen-value-layout.md
rename to design/contracts/0006-frozen-value-layout.md
index 93347ba..17cce0c 100644
--- a/design/contracts/frozen-value-layout.md
+++ b/design/contracts/0006-frozen-value-layout.md
@@ -4,7 +4,7 @@
 
 For a single-constructor `data T` whose `n` fields are each `Int`
 or `Float`, a value of `T` crossing the
-[embedding C boundary](embedding-abi.md) is a
+[embedding C boundary](0003-embedding-abi.md) is a
 bare payload pointer `p`:
 
 | bytes | content |
@@ -29,7 +29,7 @@ offsets above. A raw `malloc` is a contract violation:
 header at `p - 8` initialised to `1`.
 
 **Ownership follows the declared mode** (the
-[Mode metadata is load-bearing for codegen](memory-model.md)
+[Mode metadata is load-bearing for codegen](0008-memory-model.md)
 contract, as the C ABI): a `(own (con
 T))` parameter transfers ownership in — the kernel consumes it
 (Iter-B drop-at-return); the host MUST NOT touch or `dec` it after
diff --git a/design/contracts/honesty-rule.md b/design/contracts/0007-honesty-rule.md
similarity index 100%
rename from design/contracts/honesty-rule.md
rename to design/contracts/0007-honesty-rule.md
diff --git a/design/contracts/memory-model.md b/design/contracts/0008-memory-model.md
similarity index 96%
rename from design/contracts/memory-model.md
rename to design/contracts/0008-memory-model.md
index 52cbe1c..00ded55 100644
--- a/design/contracts/memory-model.md
+++ b/design/contracts/0008-memory-model.md
@@ -3,16 +3,16 @@
 The four language-design constraints that make RC sound without a
 cycle-collector backstop (strict evaluation, no recursive value
 bindings, no shared mutable refs, acyclic ADTs) live in
-[language constraints](language-constraints.md); this file covers
+[language constraints](0015-language-constraints.md); this file covers
 the schema additions, advisory diagnostics, and codegen contract
 that build on them.
 
 ## Schema additions
 
-**Parameter modes on `Type::Fn`** (see [Data model](data-model.md)
+**Parameter modes on `Type::Fn`** (see [Data model](0002-data-model.md)
 for the schema-level definition of `Type::Fn`).
 
-The form-A surface (see [authoring surface](authoring-surface.md))
+The form-A surface (see [authoring surface](0001-authoring-surface.md))
 for fn signatures gains mode wrappers:
 
 ```
@@ -22,7 +22,7 @@ for fn signatures gains mode wrappers:
 
 Internally, this is *not* a new `Type` variant. Modes are
 metadata on `Type::Fn` — `paramModes` and `retMode` fields run
-parallel to `params` and `ret` (see [Data model](data-model.md) for the JSON
+parallel to `params` and `ret` (see [Data model](0002-data-model.md) for the JSON
 schema). The substantive reasons for per-position metadata over a
 `Type::Borrow` / `Type::Own` variant approach:
 
@@ -33,7 +33,7 @@ schema). The substantive reasons for per-position metadata over a
   `(con List (borrow Int))` — syntactically possible, semantically
   meaningless (you cannot separately own/borrow a list element
   from the list it lives in). The
-  [canonical-schema principle](data-model.md) is "schema = data,
+  [canonical-schema principle](0002-data-model.md) is "schema = data,
   schema permits exactly what is meaningful"; per-position
   metadata is the option that holds that line.
 - **Compositional clarity.** A `Type` value's identity should
@@ -85,7 +85,7 @@ Three schema fields carry class references in this form:
 `TypeDef.name`).
 
 Method dispatch is type-driven (see
-[Method dispatch](method-dispatch.md)):
+[Method dispatch](0016-method-dispatch.md)):
 synth resolves a `Term::Var { name: "show" }` by consulting
 the workspace's method-to-candidate-class index, filtering by
 argument type (concrete) or by declared constraint (rigid-var), and
@@ -150,7 +150,7 @@ until the fixture intentionally adopts the feature.
 **`FnDef.suppress`.** The `suppress` field on `FnDef` carries a
 list of advisory-diagnostic suppress entries; each entry has a
 `code` (the diagnostic being suppressed) and a `because` (a
-mandatory non-empty reason). See [Data model](data-model.md) for
+mandatory non-empty reason). See [Data model](0002-data-model.md) for
 the canonical schema.
 
 Form-A surface: `(suppress (code "...") (because "..."))` clause
diff --git a/design/contracts/roundtrip-invariant.md b/design/contracts/0009-roundtrip-invariant.md
similarity index 94%
rename from design/contracts/roundtrip-invariant.md
rename to design/contracts/0009-roundtrip-invariant.md
index 4647550..45db3bc 100644
--- a/design/contracts/roundtrip-invariant.md
+++ b/design/contracts/0009-roundtrip-invariant.md
@@ -4,8 +4,8 @@
 
 Every well-formed AILang module has a canonical `.ail.json`
 representation (the hashable, content-addressed
-[JSON-AST](data-model.md)) and a hand-authored `.ail` representation
-(Form A, the [authoring projection](authoring-surface.md)). The
+[JSON-AST](0002-data-model.md)) and a hand-authored `.ail` representation
+(Form A, the [authoring projection](0001-authoring-surface.md)). The
 JSON-AST is derived from `.ail` in-process by consumers that need
 it; the round-trip is now the *property* of that derivation, not
 the byte-level agreement of two on-disk forms.
@@ -47,7 +47,7 @@ approximation. The canonical encoding is
 `{"kind":"float","bits":"<16-lowercase-hex>"}` and the surface
 emits the same bits-hex string. NaN, ±Inf, signed zero, and subnormals all
 round-trip exactly because the JSON-number path is bypassed (see
-[Float semantics](float-semantics.md), "Form-A serialisation").
+[Float semantics](0005-float-semantics.md), "Form-A serialisation").
 Floats are not an exception to the invariant — the bits-hex
 encoding is the mechanism that keeps them *inside* it.
 
@@ -85,7 +85,7 @@ never by relaxing the test.
 ### Why this is anchored at top level
 
 The invariant is a property of the language identity, not of any
-one surface-design choice. The [authoring surface](authoring-surface.md)
+one surface-design choice. The [authoring surface](0001-authoring-surface.md)
 introduces the `.ail` surface and lists round-trip-as-property as
 one of its constraints, but the property is load-bearing for every
 downstream concern that treats the two forms as exchangeable:
diff --git a/design/contracts/scope-boundaries.md b/design/contracts/0010-scope-boundaries.md
similarity index 92%
rename from design/contracts/scope-boundaries.md
rename to design/contracts/0010-scope-boundaries.md
index 2350e80..6a112c1 100644
--- a/design/contracts/scope-boundaries.md
+++ b/design/contracts/0010-scope-boundaries.md
@@ -5,12 +5,12 @@
 Snapshot of the current boundary.
 
 - No effect handlers — only the built-in `IO` op (`io/print_str`);
-  the effect system is described in [effects](../models/effects.md).
+  the effect system is described in [effects](../models/0002-effects.md).
   `Diverge` is a reserved effect name with no op and no codegen.
 - No refinements / SMT escalation.
 - No HM inference inside bodies. Top-level def types are explicit;
   polymorphism is opt-in via `Type::Forall { vars, body }` (see
-  [Data model](data-model.md)). Inside a body, lambdas check
+  [Data model](0002-data-model.md)). Inside a body, lambdas check
   monomorphically against their declared type.
 - Polymorphic fns must be **directly called** at the use site.
   Passing a polymorphic fn as a value (`let f = id in f(42)`) is
@@ -20,11 +20,11 @@ Snapshot of the current boundary.
 - No recursive `let` for non-fn values. Plain `let x = … in …` only
   sees `x` inside the body, not inside its own RHS — recursive value
   bindings would break the
-  [acyclicity invariant](language-constraints.md). Recursive
+  [acyclicity invariant](0015-language-constraints.md). Recursive
   *fn* bindings are supported via `Term::LetRec` (`{ "t": "letrec",
   ... }`); the desugar pass lifts most occurrences to a synthetic
   top-level fn, with `lift_letrecs` finishing the residue after
-  typecheck (see [pipeline](../models/pipeline.md)).
+  typecheck (see [pipeline](../models/0003-pipeline.md)).
 - No visibility rules in imports. Every top-level def of an imported module
   is reachable; there is no `pub` / `priv`.
 
@@ -34,7 +34,7 @@ What **is** supported (and used as the smoke test for the pipeline):
 - `if`, `let`, function calls, recursion.
 - Effects on function signatures, with `do op(args)` for direct effect
   ops (`io/print_str`). The polymorphic `print` (see
-  [prelude classes](prelude-classes.md)) is the canonical output
+  [prelude classes](0017-prelude-classes.md)) is the canonical output
   path for non-Str values.
 - **Builtins.** Arithmetic operators (`+`, `-`, `*`, `/`) of type
   `forall a. (a, a) -> a` (codegen-restricted to `{Int, Float}`);
@@ -47,7 +47,7 @@ What **is** supported (and used as the smoke test for the pipeline):
   `float_to_int_truncate : (Float) -> Int` (saturating, NaN → 0),
   `float_to_str : (Float) -> Str`,
   `int_to_str : (Int) -> Str` (both allocate a heap-Str slab at
-  call time and return it with `ret_mode: Own`; see [Str ABI](str-abi.md) for
+  call time and return it with `ret_mode: Own`; see [Str ABI](0011-str-abi.md) for
   the dual heap-/static-Str realisation); inspection
   `is_nan : (Float) -> Bool` (LLVM
   `fcmp uno`); Float bit-pattern constants `nan : Float`,
@@ -69,7 +69,7 @@ What **is** supported (and used as the smoke test for the pipeline):
     ctor; every primitive instance body carries the
     `alwaysinline` attribute so the call folds at every use site.
     Float has no Eq / Ord instance (see
-    [Float semantics](float-semantics.md)); explicit comparison
+    [Float semantics](0005-float-semantics.md)); explicit comparison
     is via the named fns `float_eq` / `float_ne` / `float_lt` /
     `float_le` / `float_gt` / `float_ge`, each lowering to a
     single `fcmp` with the matching predicate. `float_ne` uses
@@ -92,7 +92,7 @@ What **is** supported (and used as the smoke test for the pipeline):
   `Pattern::Lit` (top-level or sub-) to a `Term::If` on `eq` (the
   class method `prelude.Eq.eq`) before typecheck/codegen — see
   [desugar](../../crates/ailang-core/src/desugar.rs) and
-  [Pipeline](../models/pipeline.md).
+  [Pipeline](../models/0003-pipeline.md).
 - Literal patterns at top level and inside Ctor sub-patterns (via desugar).
   `(pat-lit 0)` and `(pat-ctor Cons (pat-lit 0) _)` both
   parse and lower; the rewrite is to `Term::If { cond = (eq sv lit) }`,
@@ -100,7 +100,7 @@ What **is** supported (and used as the smoke test for the pipeline):
   primitive Eq instance is authorable. The primitive instances
   cover `Int` / `Bool` / `Str` / `Unit`; `Float` lit-patterns are
   hard-rejected at typecheck (`CheckError::FloatPatternNotAllowed`,
-  see [float-semantics](float-semantics.md)). `(pat-lit "hi")` over
+  see [float-semantics](0005-float-semantics.md)). `(pat-lit "hi")` over
   a `Str` scrutinee is exercised by `examples/eq_demo.ail.json`.
 - **Imports + qualified cross-module references** via dotted names.
   Extends to **types and constructors**: a foreign
@@ -109,7 +109,7 @@ What **is** supported (and used as the smoke test for the pipeline):
   inside that scrutinee. Std-library demos (`examples/std_*_demo.ail.json`)
   exercise this end-to-end.
 - **AI-authoring text surface, form (A)** (see
-  [authoring surface](authoring-surface.md)). The `ailang-surface`
+  [authoring surface](0001-authoring-surface.md)). The `ailang-surface`
   crate parses `.ail` form-A text into a canonical
   `ailang-core::ast::Module` and prints any module back as form-A
   text. `ail render` and `ail describe` use it as the
@@ -117,7 +117,7 @@ What **is** supported (and used as the smoke test for the pipeline):
   identity (text → AST → JSON → AST → text) is gated by
   `ailang-surface/tests/round_trip.rs` over every shipped fixture.
 - **Memory management via reference counting + uniqueness inference**
-  (see [RC + uniqueness](../models/rc-uniqueness.md)), with
+  (see [RC + uniqueness](../models/0004-rc-uniqueness.md)), with
   **per-fn arena via stack `alloca` for non-escaping allocations**
   layered on top. Every ADT box, lambda env, and closure pair
   allocates either via `@ailang_rc_alloc` (escaping; RC-managed
@@ -125,7 +125,7 @@ What **is** supported (and used as the smoke test for the pipeline):
   `alloca` (non-escaping; freed at fn return). The decision is
   made by an escape-analysis pre-pass over the fn body — see the
   "Per-fn arena via stack `alloca`" subsection of
-  [RC + uniqueness](../models/rc-uniqueness.md). The per-fn-arena
+  [RC + uniqueness](../models/0004-rc-uniqueness.md). The per-fn-arena
   path is exercised end-to-end by
   `examples/escape_local_demo.ail.json`.
 - **First-class function references.** A top-level fn name (or
diff --git a/design/contracts/str-abi.md b/design/contracts/0011-str-abi.md
similarity index 94%
rename from design/contracts/str-abi.md
rename to design/contracts/0011-str-abi.md
index abb6166..37e96e6 100644
--- a/design/contracts/str-abi.md
+++ b/design/contracts/0011-str-abi.md
@@ -13,14 +13,14 @@ and backed by a `runtime/str.c` C helper.
 
 - `int_to_str : (borrow Int) -> Str` — decimal rendering
   of an `Int`. Backs `Show Int` in the
-  [prelude](prelude-classes.md).
+  [prelude](0017-prelude-classes.md).
 - `bool_to_str : (borrow Bool) -> Str` — `"true"`/`"false"`.
-  Backs `Show Bool` in the [prelude](prelude-classes.md).
+  Backs `Show Bool` in the [prelude](0017-prelude-classes.md).
 - `float_to_str : (borrow Float) -> Str` —
   type-installed; codegen is reserved and not yet shipped.
 - `str_clone : (borrow Str) -> Str` — allocates a fresh
   heap-Str copy of the input's bytes. Backs `Show Str` in the
-  [prelude](prelude-classes.md).
+  [prelude](0017-prelude-classes.md).
 - `str_concat : (borrow Str, borrow Str) -> Str` — combines two `Str`
   values into a single owned `Str`.
   General-purpose; commonly used in Show bodies for labelled output
@@ -34,7 +34,7 @@ instance body that wants to combine fragments.
 
 Primitive output for `Str` values goes through `io/print_str`
 directly; values of other primitive types route through the
-polymorphic `print` helper (see [prelude classes](prelude-classes.md)),
+polymorphic `print` helper (see [prelude classes](0017-prelude-classes.md)),
 which feeds the heap-Str result of `show x` into `io/print_str`.
 
 Equality on `Str` dispatches via `prelude.Eq.eq` (Str instance,
@@ -70,7 +70,7 @@ implicit trailing newline (Gitea #29; the earlier `@puts` lowering
 appended a newline per call).
 
 The heap-Str realisation participates in standard RC (see
-[memory model](memory-model.md)): the
+[memory model](0008-memory-model.md)): the
 `rc_header` slot eight bytes before the `len` field is managed
 by `ailang_rc_alloc` / `ailang_rc_inc` / `ailang_rc_dec` exactly
 like any other RC-allocated cell. The static-Str realisation has
diff --git a/design/contracts/tail-calls.md b/design/contracts/0012-tail-calls.md
similarity index 96%
rename from design/contracts/tail-calls.md
rename to design/contracts/0012-tail-calls.md
index ddcb996..54c88e7 100644
--- a/design/contracts/tail-calls.md
+++ b/design/contracts/0012-tail-calls.md
@@ -13,7 +13,7 @@ Solution: explicit, verified tail calls.
 
 - **AST.** `Term::App { fn, args, tail: bool }` and
   `Term::Do { op, args, tail: bool }` (see
-  [Data model](data-model.md)) gain a `tail` flag,
+  [Data model](0002-data-model.md)) gain a `tail` flag,
   serde-defaulting to `false` so existing fixtures load with
   `tail: false` and their hashes stay bit-identical.
 - **Typecheck.** A new pass `verify_tail_positions(fn_body)`
@@ -39,7 +39,7 @@ Solution: explicit, verified tail calls.
   `tail: true` set on the resulting term. EBNF gains 2 lines;
   total production count goes from ~28 to ~30, still inside
   the constraint-1 budget (see
-  [authoring surface](authoring-surface.md)).
+  [authoring surface](0001-authoring-surface.md)).
 
 **What this does NOT promise.** Per the tail-call survey of existing fixtures,
 many existing recursive calls are *not* in tail position
diff --git a/design/contracts/typeclasses.md b/design/contracts/0013-typeclasses.md
similarity index 95%
rename from design/contracts/typeclasses.md
rename to design/contracts/0013-typeclasses.md
index 45e8c86..c44aa58 100644
--- a/design/contracts/typeclasses.md
+++ b/design/contracts/0013-typeclasses.md
@@ -2,16 +2,16 @@
 
 The schema, registry, and diagnostic contract for the typeclass
 layer. The resolution/monomorphisation whitepaper lives at
-[models/typeclasses](../models/typeclasses.md); the call-site
-lookup rule at [method dispatch](method-dispatch.md); the built-in
-classes the prelude ships at [prelude classes](prelude-classes.md).
+[models/typeclasses](../models/0005-typeclasses.md); the call-site
+lookup rule at [method dispatch](0016-method-dispatch.md); the built-in
+classes the prelude ships at [prelude classes](0017-prelude-classes.md).
 
 ## Form-A schema (the JSON authoring surface)
 
 Three additive schema extensions; no existing module becomes invalid.
 The canonical schema for `ClassDef`, `InstanceDef`, and the
 `FnDef.type` constraints field lives in
-[Data model](data-model.md); this section is the typeclass-layer
+[Data model](0002-data-model.md); this section is the typeclass-layer
 narrative.
 
 **`ClassDef`** — top-level definition kind, declares a class:
@@ -75,7 +75,7 @@ exactly as for any free function.
 ## Cross-module references in synthesised bodies
 
 The unified mono pass (see
-[models/typeclasses](../models/typeclasses.md) for the
+[models/typeclasses](../models/0005-typeclasses.md) for the
 resolution/monomorphisation algorithm) synthesises mono symbols for
 polymorphic free fns and class-method instances in the symbol's
 owner module — e.g. `print__Int` lives in `prelude` (because `print`
@@ -84,7 +84,7 @@ is defined in the prelude), but a user-ADT call site
 whose body references `show_user_adt.show__IntBox` (the user
 instance lives in the user-defining module per the
 orphan-free-coherence rule documented in
-[models/typeclasses](../models/typeclasses.md)). The synthesised
+[models/typeclasses](../models/0005-typeclasses.md)). The synthesised
 body crosses a module boundary the source template did not.
 
 Three invariants make this work:
@@ -218,7 +218,7 @@ wording is fixed; the categories and their triggers are:
 Cross-class method sharing is structurally legal; ambiguity surfaces
 at the call site via `AmbiguousMethodResolution` or, for class-fn
 name overlap, via the `class-method-shadowed-by-fn` warning. See
-[Method dispatch](method-dispatch.md).
+[Method dispatch](0016-method-dispatch.md).
 
 **Class-schema diagnostics** (validation of class declarations):
 
@@ -259,6 +259,6 @@ There is no `AmbiguousInstance` diagnostic at the registry level —
 coherence (`DuplicateInstance` at registry build, W2) makes
 per-`(class, type)` ambiguity structurally impossible. Cross-class
 method ambiguity is a separate concern resolved at the call site
-via `AmbiguousMethodResolution` (see [Method dispatch](method-dispatch.md)).
+via `AmbiguousMethodResolution` (see [Method dispatch](0016-method-dispatch.md)).
 
 Ratified by: `crates/ail/tests/show_no_instance_e2e.rs`.
diff --git a/design/contracts/verification.md b/design/contracts/0014-verification.md
similarity index 93%
rename from design/contracts/verification.md
rename to design/contracts/0014-verification.md
index 04be46d..2d17968 100644
--- a/design/contracts/verification.md
+++ b/design/contracts/0014-verification.md
@@ -5,7 +5,7 @@
 1. **Snapshot tests** for the pretty-printer and IR emit. The diff makes
    regressions visible immediately.
 2. **Property tests** for the JSON ↔ pretty-print
-   [roundtrip](roundtrip-invariant.md).
+   [roundtrip](0009-roundtrip-invariant.md).
 3. **End-to-end tests** for `examples/` with expected program output.
 4. **Hash stability**: a test ensures the same def always produces the same
    hash.
diff --git a/design/contracts/language-constraints.md b/design/contracts/0015-language-constraints.md
similarity index 86%
rename from design/contracts/language-constraints.md
rename to design/contracts/0015-language-constraints.md
index 9a2a9d4..bc1fb90 100644
--- a/design/contracts/language-constraints.md
+++ b/design/contracts/0015-language-constraints.md
@@ -5,11 +5,11 @@
 The four constraints below are necessary preconditions for RC to
 be sound and complete *without* a cycle-collector backstop. They
 are not new — AILang already satisfies all four — but the
-[memory model](memory-model.md) makes them load-bearing rather
+[memory model](0008-memory-model.md) makes them load-bearing rather
 than incidental:
 
 1. **Strict evaluation.** Every `Term::App` (see
-   [Data model](data-model.md)) argument is fully
+   [Data model](0002-data-model.md)) argument is fully
    evaluated before the call. No laziness, no thunks. (Already
    true.)
 2. **No recursive value bindings.** `(let x EXPR ...)` evaluates
@@ -31,11 +31,11 @@ proposal proves the cycle is collectible by an extension (e.g.
 linear ownership).
 
 These constraints are the precondition for the
-[memory model](memory-model.md): a sound RC implementation without
+[memory model](0008-memory-model.md): a sound RC implementation without
 a cycle-collector backstop requires the reference graph to be a
 DAG, which constraint 4 establishes from 1–3. They are also the
 load-bearing structural reason behind several rejections under the
-[feature-acceptance](feature-acceptance.md) bug-class-reintroduction
+[feature-acceptance](0004-feature-acceptance.md) bug-class-reintroduction
 discriminator (notably iterated-mutable-state reasoning).
 
 Ratified by: `crates/ailang-check/src/uniqueness.rs` (in-source mod tests).
diff --git a/design/contracts/method-dispatch.md b/design/contracts/0016-method-dispatch.md
similarity index 91%
rename from design/contracts/method-dispatch.md
rename to design/contracts/0016-method-dispatch.md
index 9a05de1..7eda549 100644
--- a/design/contracts/method-dispatch.md
+++ b/design/contracts/0016-method-dispatch.md
@@ -3,8 +3,8 @@
 ## Method dispatch
 
 The class-method resolution rule that pairs with the
-[typeclasses](typeclasses.md) contract; the `Show`/`Eq`/`Ord` instances
-the rule dispatches against live in [prelude classes](prelude-classes.md).
+[typeclasses](0013-typeclasses.md) contract; the `Show`/`Eq`/`Ord` instances
+the rule dispatches against live in [prelude classes](0017-prelude-classes.md).
 
 Dispatch is two-mode:
 
@@ -12,7 +12,7 @@ Dispatch is two-mode:
 constraint set): the constraint names the class via the qualified
 `Constraint.class` field (canonical form: bare for same-module,
 `<module>.<Class>` for cross-module; see
-[memory model](memory-model.md) for the canonical-form rule).
+[memory model](0008-memory-model.md) for the canonical-form rule).
 Synth's residual carries the class name directly;
 constraint-discharge at fn-body-end matches against the workspace
 registry by `(class, type_hash)` key.
diff --git a/design/contracts/prelude-classes.md b/design/contracts/0017-prelude-classes.md
similarity index 90%
rename from design/contracts/prelude-classes.md
rename to design/contracts/0017-prelude-classes.md
index 41749fd..51d30bf 100644
--- a/design/contracts/prelude-classes.md
+++ b/design/contracts/0017-prelude-classes.md
@@ -3,7 +3,7 @@
 ## Prelude (built-in) classes
 
 The prelude ships the `Ordering` ADT, the `Eq` and `Ord`
-[classes](typeclasses.md), primitive `Eq Int/Bool/Str/Unit` and
+[classes](0013-typeclasses.md), primitive `Eq Int/Bool/Str/Unit` and
 `Ord Int/Bool/Str` instances, and the five polymorphic free-fn
 helpers `ne`/`lt`/`le`/`gt`/`ge`. The primitive `Eq` / `Ord`
 instance bodies are placeholder lambdas in `examples/prelude.ail`;
@@ -35,12 +35,12 @@ maintenance; the symmetric extensions are mechanical when the
 first such workload appears.
 
 Float has neither `Eq` nor `Ord` instance per [Float semantics](
-float-semantics.md); a polymorphic helper invoked at Float fires
+0005-float-semantics.md); a polymorphic helper invoked at Float fires
 `NoInstance` at typecheck with a Float-aware diagnostic that names
 the explicit `float_eq` / `float_lt` alternatives and
 cross-references this section. The lookup machinery that turns a
 `show x` call site into the right monomorphic instance is
-documented in [method dispatch](method-dispatch.md).
+documented in [method dispatch](0016-method-dispatch.md).
 
 Float comparison is a separate surface: the six monomorphic prelude
 fns `float_eq` / `float_ne` / `float_lt` / `float_le` / `float_gt`
@@ -57,15 +57,15 @@ primitive `Show Int`, `Show Bool`, `Show Str`, `Show Float`
 instances. Float **is** included in Show (unlike Eq/Ord) — IEEE-754
 makes structural equality and total ordering semantically dubious,
 but textual representation of a Float is well-defined modulo the
-NaN-spelling caveat in [Float semantics](float-semantics.md). Each
+NaN-spelling caveat in [Float semantics](0005-float-semantics.md). Each
 `Show <T>` instance body is a single-application lambda invoking the
 corresponding runtime primitive (`int_to_str`, `bool_to_str`,
-`str_clone`, `float_to_str`; see [Str ABI](str-abi.md) for the
+`str_clone`, `float_to_str`; see [Str ABI](0011-str-abi.md) for the
 heap-Str primitives); no codegen intercept is required. The
 polymorphic helper `print : forall a. Show a => a -> () !IO` has body
 `\x -> let s = show x in do io/print_str s` (explicit let-binder for
 heap-Str RC discipline per the Str carve-out in
-[Str ABI](str-abi.md)). The let-binder is
+[Str ABI](0011-str-abi.md)). The let-binder is
 structurally pinned by `crates/ail/tests/print_mono_body_shape.rs`.
 Routing through `print` is the path for non-`Str` primitives;
 `io/print_str` is the only built-in direct-output effect-op.
diff --git a/design/models/authoring-surface.md b/design/models/0001-authoring-surface.md
similarity index 94%
rename from design/models/authoring-surface.md
rename to design/models/0001-authoring-surface.md
index 556b9ae..92b6fb7 100644
--- a/design/models/authoring-surface.md
+++ b/design/models/0001-authoring-surface.md
@@ -63,7 +63,7 @@ Bool literals (`true`, `false`) and unit (`(lit-unit)`) are
 disambiguated by parser context, not by lex. Comparison and
 equality are class methods (`eq` / `compare`) and named fns
 (`float_eq` / `float_lt` / etc.), not operators — see
-[Prelude classes](../contracts/prelude-classes.md).
+[Prelude classes](../contracts/0017-prelude-classes.md).
 
 Every AST node form has a unique head keyword (`module`, `data`,
 `fn`, `forall`, `fn-type`, `con`, `var`, `app`, `lam`, `match`,
@@ -144,10 +144,10 @@ params, `<>` for type args). Formalising it crisply is harder than
 designing a uniform form from scratch.
 
 The chosen form is (A), shipped as the `ailang-surface` crate (see
-[authoring surface](../contracts/authoring-surface.md)); the
+[authoring surface](../contracts/0001-authoring-surface.md)); the
 canonical JSON-AST it round-trips against is documented in
-[Data model](../contracts/data-model.md), and the round-trip
-property itself in [Roundtrip Invariant](../contracts/roundtrip-invariant.md).
+[Data model](../contracts/0002-data-model.md), and the round-trip
+property itself in [Roundtrip Invariant](../contracts/0009-roundtrip-invariant.md).
 
 For the prose projection used for human review (Form B), see
-[prose projection](prose-projection.md).
+[prose projection](0006-prose-projection.md).
diff --git a/design/models/effects.md b/design/models/0002-effects.md
similarity index 82%
rename from design/models/effects.md
rename to design/models/0002-effects.md
index 866f2c5..de3467d 100644
--- a/design/models/effects.md
+++ b/design/models/0002-effects.md
@@ -7,15 +7,15 @@ function type: `(Int) -> Int ![IO]`. The effect set is a
 flat, unordered, closed set of effect names, unified by set-equality —
 there is no effect row variable; a signature lists exactly the effects
 its body may perform. The schema-level effect-set field on `Type::Fn`
-is documented in [Data model](../contracts/data-model.md); what is
+is documented in [Data model](../contracts/0002-data-model.md); what is
 currently in scope vs. excluded lives in
-[scope boundaries](../contracts/scope-boundaries.md).
+[scope boundaries](../contracts/0010-scope-boundaries.md).
 In the MVP only the effect `IO` is wired up (its sole op is `io/print_str`).
 `Diverge` (for non-termination) is reserved as an effect name but is
 unimplemented — no op, no codegen, no checker injection — in the same
 sense the refinements layer is reserved as a future extension without
 present-day surface (see
-[scope boundaries](../contracts/scope-boundaries.md)).
+[scope boundaries](../contracts/0010-scope-boundaries.md)).
 
 This is the most important LLM property: when I read a function, I can trust
 its signature without reading the body.
diff --git a/design/models/pipeline.md b/design/models/0003-pipeline.md
similarity index 92%
rename from design/models/pipeline.md
rename to design/models/0003-pipeline.md
index dc775f0..d4c3b3b 100644
--- a/design/models/pipeline.md
+++ b/design/models/0003-pipeline.md
@@ -18,7 +18,7 @@
 
 Two allocator backends share the same MIR. `--alloc=rc` is the
 canonical backend committed to in the
-[memory model](../contracts/memory-model.md) and the CLI default;
+[memory model](../contracts/0008-memory-model.md) and the CLI default;
 the typechecker enforces `(own)` / `(borrow)` modes, codegen emits
 `ailang_rc_inc` / `_dec` calls at the points dictated by linearity,
 and `Term::Clone` / `Term::ReuseAs` materialise into actual rc-bumps
@@ -73,8 +73,8 @@ ail run       <module>                   — build + execute (tempdir), passthro
 ```
 
 The text projections the CLI moves between are documented in
-[authoring surface](../contracts/authoring-surface.md) (Form-A,
-round-trippable) and [prose projection](prose-projection.md)
+[authoring surface](../contracts/0001-authoring-surface.md) (Form-A,
+round-trippable) and [prose projection](0006-prose-projection.md)
 (Form-B, lossy, no parser); `ail build --emit=staticlib` produces
-the layout fixed in [embedding ABI](../contracts/embedding-abi.md)
-plus [frozen value layout](../contracts/frozen-value-layout.md).
+the layout fixed in [embedding ABI](../contracts/0003-embedding-abi.md)
+plus [frozen value layout](../contracts/0006-frozen-value-layout.md).
diff --git a/design/models/rc-uniqueness.md b/design/models/0004-rc-uniqueness.md
similarity index 96%
rename from design/models/rc-uniqueness.md
rename to design/models/0004-rc-uniqueness.md
index 3580f51..c6095a0 100644
--- a/design/models/rc-uniqueness.md
+++ b/design/models/0004-rc-uniqueness.md
@@ -73,10 +73,10 @@ RC's costs are bounded and analysable per program point; the
 canonical position is "RC + inference" sharpened with the five
 LLM-author mechanisms below. A corpus committed to one memory
 model is expensive to switch — the commitment lives in the
-contracts ([memory-model](../contracts/memory-model.md),
-[language-constraints](../contracts/language-constraints.md)).
+contracts ([memory-model](../contracts/0008-memory-model.md),
+[language-constraints](../contracts/0015-language-constraints.md)).
 
-**Choice.** AILang's canonical [memory model](../contracts/memory-model.md)
+**Choice.** AILang's canonical [memory model](../contracts/0008-memory-model.md)
 is reference counting with static uniqueness inference **and
 explicit LLM-author annotations on fn signatures**, in the lineage
 of Lean 4 / Roc / Koka. The RC pipeline tracks the bump-allocator
@@ -110,7 +110,7 @@ baseline records its rc/bump ratio as the `rc_over_bump`
 reference value with ±15% tolerance) and are excluded from the
 linear/tree 1.3× regression gate; the closure-chain corpus has
 its own ±15% band until a slab/pool optimisation ships. The
-[memory model](../contracts/memory-model.md)'s RC commitment is
+[memory model](../contracts/0008-memory-model.md)'s RC commitment is
 unchanged; what is scoped is the *quantitative* regression band,
 not the choice of memory model.
 
@@ -166,7 +166,7 @@ guess.
 
 **(2) Linear-by-default consumption with explicit `(clone X)`**
 (the `Term::Clone` schema entry lives in
-[Data model](../contracts/data-model.md)).
+[Data model](../contracts/0002-data-model.md)).
 
 In bodies, every binder is consumed by exactly one `own`-mode
 use. If the LLM writes:
@@ -241,7 +241,7 @@ compiles, but what the compiler tells the author when it doesn't.
 
 ## Inference algorithm
 
-Post-typecheck, post-`lift_letrecs` (see [pipeline](pipeline.md)),
+Post-typecheck, post-`lift_letrecs` (see [pipeline](0003-pipeline.md)),
 pre-codegen pass over the elaborated module. For each `Term` node that produces or binds a
 boxed value, the pass computes a uniqueness flag:
 
diff --git a/design/models/typeclasses.md b/design/models/0005-typeclasses.md
similarity index 95%
rename from design/models/typeclasses.md
rename to design/models/0005-typeclasses.md
index c17b6f9..db26c66 100644
--- a/design/models/typeclasses.md
+++ b/design/models/0005-typeclasses.md
@@ -1,17 +1,17 @@
 # Typeclasses — resolution and monomorphisation whitepaper
 
 The schema-and-diagnostics contract for typeclasses lives in
-[typeclasses](../contracts/typeclasses.md); the call-site lookup
-rule in [method dispatch](../contracts/method-dispatch.md); the
+[typeclasses](../contracts/0013-typeclasses.md); the call-site lookup
+rule in [method dispatch](../contracts/0016-method-dispatch.md); the
 built-in classes shipped in the prelude in
-[prelude classes](../contracts/prelude-classes.md). This file
+[prelude classes](../contracts/0017-prelude-classes.md). This file
 covers the design choices and the resolution / monomorphisation
 algorithm.
 
 ## The design — Haskell-lite, monomorphised, coherent
 
 **The design pass for typeclasses. Codified after the
-[Feature-acceptance criterion](../contracts/feature-acceptance.md)
+[Feature-acceptance criterion](../contracts/0004-feature-acceptance.md)
 was committed; the criterion is the explicit basis for the choices
 below.**
 
@@ -56,7 +56,7 @@ types) is one an LLM author does not unprompted produce.
 **Constraint collection (per function body).** During typechecking
 of a body, each method call generates a residual constraint of shape
 `<Class> <Type>` (the schema for these lives in
-[Data model](../contracts/data-model.md)) where `<Type>` may still
+[Data model](../contracts/0002-data-model.md)) where `<Type>` may still
 contain type variables.
 After local typechecking, residual constraints are checked against
 the function's declared constraints (modulo α-conversion and modulo
@@ -163,4 +163,4 @@ for instance, because a constraint remains unresolved at the entry
 point — is a static error, not a runtime one. This is the
 LLVM-friendly form and is consistent with the performance
 commitment of the
-[RC + uniqueness memory model](../contracts/memory-model.md).
+[RC + uniqueness memory model](../contracts/0008-memory-model.md).
diff --git a/design/models/prose-projection.md b/design/models/0006-prose-projection.md
similarity index 92%
rename from design/models/prose-projection.md
rename to design/models/0006-prose-projection.md
index 024811f..684453b 100644
--- a/design/models/prose-projection.md
+++ b/design/models/0006-prose-projection.md
@@ -6,7 +6,7 @@ AILang ships a
 second textual projection of the AST: `ailang-prose`, a one-way
 projection from `Module → human-readable text`. It is **not** an
 authoring surface; it is the "display" projection that the
-[authoring surface](../contracts/authoring-surface.md)'s
+[authoring surface](../contracts/0001-authoring-surface.md)'s
 architectural pin explicitly anticipated:
 
 > *"Future projections are explicitly anticipated: a visual /
@@ -36,15 +36,15 @@ human readers. Form (B) inverts the trade-offs:
   lambdas, the `tail` flag — all preserved verbatim.
 
 Critically, **form (B) has no parser**. Form (A) is round-trippable
-by construction (see [roundtrip invariant](../contracts/roundtrip-invariant.md));
+by construction (see [roundtrip invariant](../contracts/0009-roundtrip-invariant.md));
 form (B) deliberately is not. Re-integrating prose edits requires an
 external LLM mediator, not a compiler pass — the prompt template
 `ail merge-prose` composes the six-step cycle.
 
 Form (B) does not weaken any
-[authoring surface](../contracts/authoring-surface.md) invariant:
+[authoring surface](../contracts/0001-authoring-surface.md) invariant:
 
-- The [JSON-AST](../contracts/data-model.md) remains the only
+- The [JSON-AST](../contracts/0002-data-model.md) remains the only
   hashable artefact. Prose is not hashed, not content-addressed,
   not load-bearing for any cross-module reference.
 - Form (A) remains the canonical authoring surface. Foreign LLMs
@@ -58,7 +58,7 @@ Form (B) does not weaken any
 The CLI gains `ail prose <m.ail.json>` (the deterministic
 projection) and `ail merge-prose <m.ail.json> <edited.prose.txt>`
 (the mediator-prompt composer); both are listed under
-[pipeline](pipeline.md).
+[pipeline](0003-pipeline.md).
 
 ## Form-A spec embedding
 
diff --git a/design/models/kernel-extensions.md b/design/models/0007-kernel-extensions.md
similarity index 97%
rename from design/models/kernel-extensions.md
rename to design/models/0007-kernel-extensions.md
index 0ba85c2..8b6ea88 100644
--- a/design/models/kernel-extensions.md
+++ b/design/models/0007-kernel-extensions.md
@@ -8,7 +8,7 @@ whole; the per-milestone specs in `docs/specs/` carry the
 implementation-level detail. As each milestone closes, sections of
 this whitepaper transition from forward-looking design to
 present-state description, per the
-[honesty-rule](../contracts/honesty-rule.md).
+[honesty-rule](../contracts/0007-honesty-rule.md).
 
 ## The problem
 
@@ -232,7 +232,7 @@ kernel-tier modules (the stub, future Series, future Matrix)
 become auto-injected through the same path.
 
 Class-method dispatch (a separate mechanism — see
-[method dispatch](../contracts/method-dispatch.md)) is
+[method dispatch](../contracts/0016-method-dispatch.md)) is
 orthogonal: the dispatch is about how method calls are
 resolved; the auto-import is about which names are in scope.
 
@@ -516,7 +516,7 @@ of off-by-one and warmup-handling bugs (clause 2); the bounded
 push-only mutation surface — gated by the `Series` effect — does
 not reintroduce the iterated-mutable-state bug class that the
 `mut`/`var`/`assign` removal addressed (clause 3 — see
-`docs/specs/2026-05-28-kernel-extension-mechanics.md`'s clause-3
+`docs/specs/0052-kernel-extension-mechanics.md`'s clause-3
 discussion).
 
 The same three-clause check applies to *each future kernel
@@ -578,7 +578,7 @@ here so the spec can quote the position:
 
 - **Classes / method dispatch.** Orthogonal. Type-scoped
   namespacing accesses *top-level defs* in a type's home module;
-  class-method dispatch (see [method dispatch](../contracts/method-dispatch.md))
+  class-method dispatch (see [method dispatch](../contracts/0016-method-dispatch.md))
   resolves *class method calls* by type-driven instance lookup.
   Both can coexist on the same type — e.g. `Series` could
   someday have a `Show` instance (class method `show` dispatches
@@ -598,7 +598,7 @@ here so the spec can quote the position:
 
 - **Heap-Str ABI.** The Series runtime borrows the heap-Str
   RC-pointer-to-opaque-struct pattern (see
-  [str-abi](../contracts/str-abi.md)). Same pattern: opaque
+  [str-abi](../contracts/0011-str-abi.md)). Same pattern: opaque
   `ptr` from the compiler's view; dedicated `_new`, `_drop`,
   and operation symbols in C; RC header in the struct prefix.
 
@@ -623,14 +623,14 @@ above is the only commitment.
 ## Cross-references
 
 - **Feature-acceptance gate** applied to each kernel extension:
-  [feature-acceptance](../contracts/feature-acceptance.md).
+  [feature-acceptance](../contracts/0004-feature-acceptance.md).
 - **Method dispatch** (orthogonal to type-scoped namespacing):
-  [method-dispatch](../contracts/method-dispatch.md).
+  [method-dispatch](../contracts/0016-method-dispatch.md).
 - **Honesty rule** (this whitepaper's STATUS contract):
-  [honesty-rule](../contracts/honesty-rule.md).
+  [honesty-rule](../contracts/0007-honesty-rule.md).
 - **Reference design** for Series storage layout:
   `/home/brummel/dev/RustAst/src/ast/rtl/series/` (external Rust
   project; not in this repo).
-- **Per-milestone specs:** `docs/specs/2026-05-28-kernel-extension-mechanics.md`
+- **Per-milestone specs:** `docs/specs/0052-kernel-extension-mechanics.md`
   (prep milestone); future `docs/specs/YYYY-MM-DD-series.md`
   (Series milestone, written after prep closes).
diff --git a/docs/plans/2026-05-09-skill-system-buildout.md b/docs/plans/0001-skill-system-buildout.md
similarity index 99%
rename from docs/plans/2026-05-09-skill-system-buildout.md
rename to docs/plans/0001-skill-system-buildout.md
index 1a60d8b..68fe064 100644
--- a/docs/plans/2026-05-09-skill-system-buildout.md
+++ b/docs/plans/0001-skill-system-buildout.md
@@ -1,6 +1,6 @@
 # Skill System Build-out — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-09-skill-system.md`
+> **Parent spec:** `docs/specs/0001-skill-system.md`
 >
 > **Discipline:** Skill construction follows TDD per
 > `superpowers:writing-skills` (RED → GREEN → REFACTOR with subagent
@@ -748,8 +748,8 @@ Insert at the bottom (after the latest existing entry):
 ## 2026-05-09 — Milestone 22c: skill system live
 
 The five-skill development pipeline shipped today. Spec at
-`docs/specs/2026-05-09-skill-system.md`; build-out plan at
-`docs/plans/2026-05-09-skill-system-buildout.md`. Five `SKILL.md`
+`docs/specs/0001-skill-system.md`; build-out plan at
+`docs/plans/0001-skill-system-buildout.md`. Five `SKILL.md`
 files under `skills/<name>/`, six agents migrated to
 `skills/<name>/agents/`, `CLAUDE.md` split into orchestrator-identity
 and skill-pointers, `.claude/agents/` symlinks installed, this entry
diff --git a/docs/plans/2026-05-09-22b2-typecheck-arms.md b/docs/plans/0002-22b2-typecheck-arms.md
similarity index 99%
rename from docs/plans/2026-05-09-22b2-typecheck-arms.md
rename to docs/plans/0002-22b2-typecheck-arms.md
index ab64b5b..54576b1 100644
--- a/docs/plans/2026-05-09-22b2-typecheck-arms.md
+++ b/docs/plans/0002-22b2-typecheck-arms.md
@@ -1,6 +1,6 @@
 # 22b.2 — Typecheck Arms — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-09-22-typeclasses.md`
+> **Parent spec:** `docs/specs/0002-22-typeclasses.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
diff --git a/docs/plans/2026-05-09-22b3-monomorphisation.md b/docs/plans/0003-22b3-monomorphisation.md
similarity index 99%
rename from docs/plans/2026-05-09-22b3-monomorphisation.md
rename to docs/plans/0003-22b3-monomorphisation.md
index 77dc1ae..3fe579b 100644
--- a/docs/plans/2026-05-09-22b3-monomorphisation.md
+++ b/docs/plans/0003-22b3-monomorphisation.md
@@ -1,6 +1,6 @@
 # Iteration 22b.3 — Monomorphisation Pass — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-09-22-typeclasses.md`
+> **Parent spec:** `docs/specs/0002-22-typeclasses.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
diff --git a/docs/plans/2026-05-09-22b4a-form-a-class-instance.md b/docs/plans/0004-22b4a-form-a-class-instance.md
similarity index 99%
rename from docs/plans/2026-05-09-22b4a-form-a-class-instance.md
rename to docs/plans/0004-22b4a-form-a-class-instance.md
index 78ad154..5423501 100644
--- a/docs/plans/2026-05-09-22b4a-form-a-class-instance.md
+++ b/docs/plans/0004-22b4a-form-a-class-instance.md
@@ -1,6 +1,6 @@
 # 22b.4a — Form-A parser+printer arms for ClassDef/InstanceDef + spec amendment
 
-> **Parent spec:** `docs/specs/2026-05-09-22-typeclasses.md`
+> **Parent spec:** `docs/specs/0002-22-typeclasses.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
@@ -55,7 +55,7 @@ arbitrary polymorphic top-levels.
 - Modify: `crates/ailang-surface/tests/round_trip.rs` — removes the
   `test_22b1_*` / `test_22b2_*` / `test_22b3_*` filter clauses; lets
   the gate exercise every fixture.
-- Modify: `docs/specs/2026-05-09-22-typeclasses.md` — appends an
+- Modify: `docs/specs/0002-22-typeclasses.md` — appends an
   "Amendments" section recording the 22b.4a / 22b.4b split, the
   Form-A vs Form-B terminology fix, the `__` separator decision, and
   the 22c-and-beyond impact.
@@ -1157,7 +1157,7 @@ git commit -m "iter 22b.4a.5: retire round-trip skip-list for class/instance fix
 ## Task 6: Spec amendment
 
 **Files:**
-- Modify: `docs/specs/2026-05-09-22-typeclasses.md` — append an
+- Modify: `docs/specs/0002-22-typeclasses.md` — append an
   "Amendments" section.
 - Modify: `docs/DESIGN.md` — locate Decision 11 §"Resolution and
   monomorphisation" (DESIGN.md mono-symbol naming subsection) and
@@ -1165,7 +1165,7 @@ git commit -m "iter 22b.4a.5: retire round-trip skip-list for class/instance fix
 
 - [ ] **Step 6.1: Append the spec amendments section**
 
-Open `docs/specs/2026-05-09-22-typeclasses.md`. Append at end of
+Open `docs/specs/0002-22-typeclasses.md`. Append at end of
 file:
 
 ```markdown
@@ -1270,7 +1270,7 @@ the right home for naming-convention micro-decisions.)
 - [ ] **Step 6.3: Commit**
 
 ```
-git add docs/specs/2026-05-09-22-typeclasses.md docs/DESIGN.md
+git add docs/specs/0002-22-typeclasses.md docs/DESIGN.md
 git commit -m "iter 22b.4a.6: spec + DESIGN amendments — 22b.4 split, terminology fix, '__' separator"
 ```
 
diff --git a/docs/plans/2026-05-09-22c-user-class-e2e.md b/docs/plans/0005-22c-user-class-e2e.md
similarity index 99%
rename from docs/plans/2026-05-09-22c-user-class-e2e.md
rename to docs/plans/0005-22c-user-class-e2e.md
index d5d073c..25f6c8d 100644
--- a/docs/plans/2026-05-09-22c-user-class-e2e.md
+++ b/docs/plans/0005-22c-user-class-e2e.md
@@ -1,6 +1,6 @@
 # 22c — User-class e2e fixture
 
-> **Parent spec:** `docs/specs/2026-05-09-22-typeclasses.md`
+> **Parent spec:** `docs/specs/0002-22-typeclasses.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
@@ -354,7 +354,7 @@ done — there is nothing left to wire.
 22b.4b (Prelude for primitives) dropped from milestone scope; 22c's
 fixture re-scoped to vocabulary AILang already has (no `++`, no
 named-field record syntax, no top-level polymorphic `print`). See
-`docs/specs/2026-05-09-22-typeclasses.md` "Amendments" §"22b.4b
+`docs/specs/0002-22-typeclasses.md` "Amendments" §"22b.4b
 dropped" and §"22c scope tightened".
 
 **Milestone-22 acceptance check:**
diff --git a/docs/plans/2026-05-09-22-tidy-design-drift.md b/docs/plans/0006-22-tidy-design-drift.md
similarity index 97%
rename from docs/plans/2026-05-09-22-tidy-design-drift.md
rename to docs/plans/0006-22-tidy-design-drift.md
index 422e2c8..b60ee6a 100644
--- a/docs/plans/2026-05-09-22-tidy-design-drift.md
+++ b/docs/plans/0006-22-tidy-design-drift.md
@@ -1,6 +1,6 @@
 # 22-tidy — DESIGN.md and spec drift after milestone-22 close
 
-> **Parent spec:** `docs/specs/2026-05-09-22-typeclasses.md` (already
+> **Parent spec:** `docs/specs/0002-22-typeclasses.md` (already
 > amended for the 22b.4b drop and 22c rescope).
 >
 > **Trigger:** `audit` skill found drift between `docs/DESIGN.md`
@@ -26,7 +26,7 @@ as the gate.
 - Modify: `docs/DESIGN.md:1725-1766` — rewrite §"Prelude (built-in)
   classes" and §"What this decision does NOT commit to" to match
   the 22b.4b-deferral + `__` separator decisions.
-- Modify: `docs/specs/2026-05-09-22-typeclasses.md:50-56` — split
+- Modify: `docs/specs/0002-22-typeclasses.md:50-56` — split
   the 22b.4 components-table row into 22b.4a (shipped) + 22b.4b
   (post-22); mark 22c shipped.
 - Modify: `crates/ailang-prose/src/lib.rs:80-101` — update the
@@ -90,7 +90,7 @@ case for primitive `Show` is weak (LLM-natural form is `int_to_str
 x`, not `show x` through a single-instance class). The user-class
 end-to-end path is the milestone's typeclass acceptance gate
 (22c's `class Foo a` + `data IntBox` + `instance Foo IntBox`
-fixture); see `docs/specs/2026-05-09-22-typeclasses.md`
+fixture); see `docs/specs/0002-22-typeclasses.md`
 "Amendments" §"22b.4b dropped" for the substantive rationale.
 
 A future milestone may add a Prelude when concrete LLM-author code
@@ -151,7 +151,7 @@ git commit -m "iter 22-tidy.1: DESIGN.md — reconcile Decision 11 with mileston
 
 ## Task 2: Spec components-table drift
 
-**Files:** `docs/specs/2026-05-09-22-typeclasses.md` lines 50-56.
+**Files:** `docs/specs/0002-22-typeclasses.md` lines 50-56.
 
 The Components table still has the original 22b.4 row (Prelude +
 Form-B + retire) which the amendments section supersedes. Reader
@@ -179,7 +179,7 @@ remains as-is — it's still historically accurate.)
 ### Step 2.2 — Commit
 
 ```bash
-git add docs/specs/2026-05-09-22-typeclasses.md
+git add docs/specs/0002-22-typeclasses.md
 git commit -m "iter 22-tidy.2: spec — components table reflects 22b.4a/b split + 22c shipped"
 ```
 
diff --git a/docs/plans/2026-05-10-env-construction-unify.md b/docs/plans/0007-env-construction-unify.md
similarity index 99%
rename from docs/plans/2026-05-10-env-construction-unify.md
rename to docs/plans/0007-env-construction-unify.md
index 727620a..56c36eb 100644
--- a/docs/plans/2026-05-10-env-construction-unify.md
+++ b/docs/plans/0007-env-construction-unify.md
@@ -1,6 +1,6 @@
 # Env-construction unify — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-10-env-construction-unify.md`
+> **Parent spec:** `docs/specs/0003-env-construction-unify.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
@@ -630,8 +630,8 @@ Tasks:
   (preserves pre-refactor fail-fast behaviour without re-mutating
   the shared env).
 
-Spec: `docs/specs/2026-05-10-env-construction-unify.md`. Plan:
-`docs/plans/2026-05-10-env-construction-unify.md`. Tests: pin test
+Spec: `docs/specs/0003-env-construction-unify.md`. Plan:
+`docs/plans/0007-env-construction-unify.md`. Tests: pin test
 green, the three RED tests
 (`typeclass_22c`, `mono_recursive_fn`, `mono_xmod_qualified_ref`)
 remain green, full workspace test suite green, bench gates 0/0/0.
diff --git a/docs/plans/2026-05-10-22-tidy-primitive-names.md b/docs/plans/0008-22-tidy-primitive-names.md
similarity index 99%
rename from docs/plans/2026-05-10-22-tidy-primitive-names.md
rename to docs/plans/0008-22-tidy-primitive-names.md
index e7ef966..5cd4da4 100644
--- a/docs/plans/2026-05-10-22-tidy-primitive-names.md
+++ b/docs/plans/0008-22-tidy-primitive-names.md
@@ -1,6 +1,6 @@
 # 22-tidy primitive-name-set consolidation — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-09-22-typeclasses.md` (milestone 22, closed 2026-05-09)
+> **Parent spec:** `docs/specs/0002-22-typeclasses.md` (milestone 22, closed 2026-05-09)
 >
 > **Audit anchor:** `docs/JOURNAL.md` 2026-05-09 entry "Iteration 22-tidy: DESIGN.md and spec drift after milestone-22 close" → "Carried debt" → primitive-name-set consolidation.
 >
diff --git a/docs/plans/2026-05-10-22-tidy-strict-duplicate-clauses.md b/docs/plans/0009-22-tidy-strict-duplicate-clauses.md
similarity index 99%
rename from docs/plans/2026-05-10-22-tidy-strict-duplicate-clauses.md
rename to docs/plans/0009-22-tidy-strict-duplicate-clauses.md
index f5f6fa6..6f4423d 100644
--- a/docs/plans/2026-05-10-22-tidy-strict-duplicate-clauses.md
+++ b/docs/plans/0009-22-tidy-strict-duplicate-clauses.md
@@ -1,6 +1,6 @@
 # 22-tidy.5 strict duplicate-clause detection — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-09-22-typeclasses.md` (milestone 22, closed 2026-05-09)
+> **Parent spec:** `docs/specs/0002-22-typeclasses.md` (milestone 22, closed 2026-05-09)
 >
 > **Carried-debt anchor:** `docs/JOURNAL.md` 2026-05-09 entry "Iteration 22-tidy" → "Strict duplicate-clause detection in `parse_fn` / `parse_data` / `parse_const` (sibling parsers to the 22b.4a additions). The asymmetry is documented; promoting siblings to the strict pattern is queued."
 >
diff --git a/docs/plans/2026-05-10-22-tidy-prose-class-instance.md b/docs/plans/0010-22-tidy-prose-class-instance.md
similarity index 99%
rename from docs/plans/2026-05-10-22-tidy-prose-class-instance.md
rename to docs/plans/0010-22-tidy-prose-class-instance.md
index 302c618..cfb618f 100644
--- a/docs/plans/2026-05-10-22-tidy-prose-class-instance.md
+++ b/docs/plans/0010-22-tidy-prose-class-instance.md
@@ -1,6 +1,6 @@
 # 22-tidy.6 Form-B prose printer arms for ClassDef + InstanceDef — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-09-22-typeclasses.md` (milestone 22, closed 2026-05-09)
+> **Parent spec:** `docs/specs/0002-22-typeclasses.md` (milestone 22, closed 2026-05-09)
 >
 > **Carried-debt anchor:** `docs/JOURNAL.md` 2026-05-09 entry "Iteration 22-tidy" → "Form-B (prose) printer arms for ClassDef / InstanceDef. One-way, not gating."
 >
diff --git a/docs/plans/2026-05-10-22-tidy-strict-clause-helper.md b/docs/plans/0011-22-tidy-strict-clause-helper.md
similarity index 99%
rename from docs/plans/2026-05-10-22-tidy-strict-clause-helper.md
rename to docs/plans/0011-22-tidy-strict-clause-helper.md
index 3acf94c..b7bb7c9 100644
--- a/docs/plans/2026-05-10-22-tidy-strict-clause-helper.md
+++ b/docs/plans/0011-22-tidy-strict-clause-helper.md
@@ -1,6 +1,6 @@
 # 22-tidy.7 strict-clause helper consolidation — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-09-22-typeclasses.md` (milestone 22, closed 2026-05-09)
+> **Parent spec:** `docs/specs/0002-22-typeclasses.md` (milestone 22, closed 2026-05-09)
 >
 > **Trigger:** 22-tidy.5 JOURNAL entry observation that the duplicate-clause check pattern now appears at 17 sites across the parser (10 from 22b.4a + 8 from 22-tidy.5; the JOURNAL entry's "18 sites" was an off-by-one — re-grep confirms 17). 17 × ~12 LOC of identical structure is past the tipping point for the "three similar lines beats a premature abstraction" rule.
 >
diff --git a/docs/plans/2026-05-10-design-md-consolidation-1-history-anchors.md b/docs/plans/0012-design-md-consolidation-1-history-anchors.md
similarity index 97%
rename from docs/plans/2026-05-10-design-md-consolidation-1-history-anchors.md
rename to docs/plans/0012-design-md-consolidation-1-history-anchors.md
index bfa5c2e..477da5b 100644
--- a/docs/plans/2026-05-10-design-md-consolidation-1-history-anchors.md
+++ b/docs/plans/0012-design-md-consolidation-1-history-anchors.md
@@ -1,6 +1,6 @@
 # design-md-consolidation iter 1 — sweep 1: history anchors
 
-> **Parent spec:** `docs/specs/2026-05-10-design-md-consolidation.md`
+> **Parent spec:** `docs/specs/0004-design-md-consolidation.md`
 > §"Sweep 1 — Remove history anchors"
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
@@ -250,11 +250,11 @@ Edit:
 - [ ] **Step 8: Decision 11 §"Prelude" (line 1753)**
 
 Edit:
-- old: `fixture); see `docs/specs/2026-05-09-22-typeclasses.md``
+- old: `fixture); see `docs/specs/0002-22-typeclasses.md``
 - new: `fixture); see `docs/specs/22-typeclasses.md``
 
 NOTE: this step renames the spec-file reference. The actual file
-`docs/specs/2026-05-09-22-typeclasses.md` exists on disk; sweep 1
+`docs/specs/0002-22-typeclasses.md` exists on disk; sweep 1
 does NOT rename the file (that would lose git history). Instead,
 the in-text reference is left as the date-prefixed actual filename
 because it points to a real file. **Revert this step** if the
@@ -262,7 +262,7 @@ filename on disk uses the date prefix.
 
 Verify before editing:
 ```bash
-ls docs/specs/2026-05-09-22-typeclasses.md
+ls docs/specs/0002-22-typeclasses.md
 ```
 
 If the file exists with the date prefix, KEEP the reference and
@@ -296,7 +296,7 @@ grep -nE '2026-[0-9]{2}-[0-9]{2}' docs/DESIGN.md
 ```
 
 Expected: empty, OR exactly one line — the spec-file path
-`docs/specs/2026-05-09-22-typeclasses.md` (if the file on disk
+`docs/specs/0002-22-typeclasses.md` (if the file on disk
 uses that prefix). Record this in the JOURNAL exception list.
 
 - [ ] **Step 12: Commit**
@@ -410,7 +410,7 @@ grep -nE 'Iter [0-9]+[a-z]?(\.[0-9]+)?' docs/DESIGN.md
 
 Expected: empty output, OR the date-prefixed spec-file reference
 from Task 3 Step 11 (the path
-`docs/specs/2026-05-09-22-typeclasses.md` does not match this iter
+`docs/specs/0002-22-typeclasses.md` does not match this iter
 pattern, so the exception list need not grow here).
 
 - [ ] **Step 5: Commit**
@@ -498,7 +498,7 @@ grep -nE 'Iter [0-9]+[a-z]?(\.[0-9]+)?|Family [0-9]+|^[^/]*2026-[0-9]{2}-[0-9]{2
 ```
 
 Expected: empty, OR up to one line (the
-`docs/specs/2026-05-09-22-typeclasses.md` path from Task 3 Step 11,
+`docs/specs/0002-22-typeclasses.md` path from Task 3 Step 11,
 *if* the file on disk has that prefix). The leading `^[^/]*` in the
 date regex pre-filters paths that begin with `docs/specs/`.
 
@@ -533,7 +533,7 @@ Append to `docs/JOURNAL.md` (after the last entry):
 ## 2026-05-10 — Iteration design-md-consolidation 1: history-anchor sweep
 
 First iteration of the milestone defined in
-`docs/specs/2026-05-10-design-md-consolidation.md`. Sweep 1 closes
+`docs/specs/0004-design-md-consolidation.md`. Sweep 1 closes
 the "history anchors in DESIGN.md" item: every iter tag, family
 tag, date anchor, status marker, and historical bench data-point
 that anchored the document to a specific moment is removed.
@@ -565,7 +565,7 @@ Specific anchor examples discarded (representative):
   (bench notes in JOURNAL).`
 
 Deliberate exceptions to the sweep-1 grep pattern (if any):
-- `docs/specs/2026-05-09-22-typeclasses.md` — date-prefixed spec
+- `docs/specs/0002-22-typeclasses.md` — date-prefixed spec
   filename, kept verbatim because the on-disk file uses that
   prefix and renaming would lose git history. Record only.
 
diff --git a/docs/plans/2026-05-10-design-md-consolidation-2-reverted-and-migration.md b/docs/plans/0013-design-md-consolidation-2-reverted-and-migration.md
similarity index 99%
rename from docs/plans/2026-05-10-design-md-consolidation-2-reverted-and-migration.md
rename to docs/plans/0013-design-md-consolidation-2-reverted-and-migration.md
index 38dd564..69fde61 100644
--- a/docs/plans/2026-05-10-design-md-consolidation-2-reverted-and-migration.md
+++ b/docs/plans/0013-design-md-consolidation-2-reverted-and-migration.md
@@ -1,6 +1,6 @@
 # design-md-consolidation iter 2 — sweep 2: REVERTED + migration plans + correction history + future speculations
 
-> **Parent spec:** `docs/specs/2026-05-10-design-md-consolidation.md`
+> **Parent spec:** `docs/specs/0004-design-md-consolidation.md`
 > §"Sweep 2 — REVERTED + migration plans out".
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
@@ -682,7 +682,7 @@ Append to `docs/JOURNAL.md`. Template:
 ## 2026-05-10 — Iteration design-md-consolidation 2: REVERTED + migration + correction history + future speculations
 
 Second iteration of the milestone defined in
-`docs/specs/2026-05-10-design-md-consolidation.md`. Sweep 2 closes
+`docs/specs/0004-design-md-consolidation.md`. Sweep 2 closes
 the "REVERTED + migration plans + correction history + future
 speculations" item: the audit-trail preservation of Decision 7,
 the 7-point Decision 10 Migration plan, the Decision 9
diff --git a/docs/plans/2026-05-10-design-md-consolidation-3-schema-sot-inversion.md b/docs/plans/0014-design-md-consolidation-3-schema-sot-inversion.md
similarity index 99%
rename from docs/plans/2026-05-10-design-md-consolidation-3-schema-sot-inversion.md
rename to docs/plans/0014-design-md-consolidation-3-schema-sot-inversion.md
index 76a62a3..b0641f9 100644
--- a/docs/plans/2026-05-10-design-md-consolidation-3-schema-sot-inversion.md
+++ b/docs/plans/0014-design-md-consolidation-3-schema-sot-inversion.md
@@ -1,6 +1,6 @@
 # design-md-consolidation iter 3 — sweep 3: schema SoT inversion + data-model hardening
 
-> **Parent spec:** `docs/specs/2026-05-10-design-md-consolidation.md`
+> **Parent spec:** `docs/specs/0004-design-md-consolidation.md`
 > §"Sweep 3 — Schema SoT inversion + Data-model hardening".
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
@@ -860,7 +860,7 @@ Template (adjust specifics to actual outcome):
 ## 2026-05-10 — Iteration design-md-consolidation 3: schema SoT inversion + data-model hardening
 
 Third iteration of the milestone defined in
-`docs/specs/2026-05-10-design-md-consolidation.md`. Sweep 3
+`docs/specs/0004-design-md-consolidation.md`. Sweep 3
 inverts the schema source-of-truth between `docs/DESIGN.md`
 §"Data model" and `crates/ailang-core/src/ast.rs`: DESIGN.md is
 canonical, `ast.rs` is the projection, and a new drift test
diff --git a/docs/plans/2026-05-10-design-md-consolidation-4-workflow-cleanup.md b/docs/plans/0015-design-md-consolidation-4-workflow-cleanup.md
similarity index 98%
rename from docs/plans/2026-05-10-design-md-consolidation-4-workflow-cleanup.md
rename to docs/plans/0015-design-md-consolidation-4-workflow-cleanup.md
index 0f3e760..73c2f23 100644
--- a/docs/plans/2026-05-10-design-md-consolidation-4-workflow-cleanup.md
+++ b/docs/plans/0015-design-md-consolidation-4-workflow-cleanup.md
@@ -1,6 +1,6 @@
 # design-md-consolidation iter 4 — sweep 4: workflow / cross-reference cleanup
 
-> **Parent spec:** `docs/specs/2026-05-10-design-md-consolidation.md`
+> **Parent spec:** `docs/specs/0004-design-md-consolidation.md`
 > §"Sweep 4 — Workflow / cross-reference cleanup".
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
@@ -488,7 +488,7 @@ DESIGN.md line count and any cross-reference inventory specifics):
 ## 2026-05-10 — Iteration design-md-consolidation 4: workflow / cross-reference cleanup
 
 Fourth and final iteration of the milestone defined in
-`docs/specs/2026-05-10-design-md-consolidation.md`. Sweep 4
+`docs/specs/0004-design-md-consolidation.md`. Sweep 4
 closes the "workflow / cross-reference cleanup" item: the
 stale `agents/` ecosystem entry is replaced with a `Skills`
 entry pointing to `skills/<name>/agents/`; the workflow-detail
@@ -646,7 +646,7 @@ Edit `docs/roadmap.md`:
   becomes a state-only specification across four thematic sweeps
   (history anchors out, migration plans out, schema-SoT inversion +
   data-model hardening, workflow / cross-reference cleanup).
-  - context: `docs/specs/2026-05-10-design-md-consolidation.md`
+  - context: `docs/specs/0004-design-md-consolidation.md`
   - sub-entries:
     - [x] Sweep 1 — remove history anchors
     - [x] Sweep 2 — REVERTED + migration plans out
@@ -660,7 +660,7 @@ Edit `docs/roadmap.md`:
   (history anchors out, REVERTED + migration plans out,
   schema-SoT inversion + data-model hardening, workflow /
   cross-reference cleanup). Closed 2026-05-10.
-  - context: `docs/specs/2026-05-10-design-md-consolidation.md`,
+  - context: `docs/specs/0004-design-md-consolidation.md`,
     JOURNAL milestone-close entry of same date.
 ```
 
diff --git a/docs/plans/2026-05-10-floats-1-schema.md b/docs/plans/0016-floats-1-schema.md
similarity index 99%
rename from docs/plans/2026-05-10-floats-1-schema.md
rename to docs/plans/0016-floats-1-schema.md
index b30c7da..67fa226 100644
--- a/docs/plans/2026-05-10-floats-1-schema.md
+++ b/docs/plans/0016-floats-1-schema.md
@@ -1,6 +1,6 @@
 # Floats Iteration 1 — Schema Layer (Implementation Plan)
 
-> **Parent spec:** `docs/specs/2026-05-10-floats.md` (committed
+> **Parent spec:** `docs/specs/0005-floats.md` (committed
 > `e37366f`, approved 2026-05-10)
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
diff --git a/docs/plans/2026-05-10-floats-2-surface.md b/docs/plans/0017-floats-2-surface.md
similarity index 99%
rename from docs/plans/2026-05-10-floats-2-surface.md
rename to docs/plans/0017-floats-2-surface.md
index 0fb69c5..a45b84d 100644
--- a/docs/plans/2026-05-10-floats-2-surface.md
+++ b/docs/plans/0017-floats-2-surface.md
@@ -1,6 +1,6 @@
 # Floats Iteration 2 — Surface Layer (Implementation Plan)
 
-> **Parent spec:** `docs/specs/2026-05-10-floats.md` (committed
+> **Parent spec:** `docs/specs/0005-floats.md` (committed
 > `e37366f`, approved 2026-05-10) — sections A2 and the
 > `crates/ailang-surface/` Components subsection.
 >
diff --git a/docs/plans/2026-05-10-floats-3-typecheck.md b/docs/plans/0018-floats-3-typecheck.md
similarity index 99%
rename from docs/plans/2026-05-10-floats-3-typecheck.md
rename to docs/plans/0018-floats-3-typecheck.md
index bca172f..1b54267 100644
--- a/docs/plans/2026-05-10-floats-3-typecheck.md
+++ b/docs/plans/0018-floats-3-typecheck.md
@@ -1,6 +1,6 @@
 # Floats Iteration 3 — Typecheck + Builtins (Implementation Plan)
 
-> **Parent spec:** `docs/specs/2026-05-10-floats.md` (committed
+> **Parent spec:** `docs/specs/0005-floats.md` (committed
 > `e37366f`, approved 2026-05-10) — section A3 + the
 > `crates/ailang-check/` Components subsection.
 >
diff --git a/docs/plans/2026-05-10-floats-4-codegen.md b/docs/plans/0019-floats-4-codegen.md
similarity index 99%
rename from docs/plans/2026-05-10-floats-4-codegen.md
rename to docs/plans/0019-floats-4-codegen.md
index 5c9a3c0..b2a12d5 100644
--- a/docs/plans/2026-05-10-floats-4-codegen.md
+++ b/docs/plans/0019-floats-4-codegen.md
@@ -1,6 +1,6 @@
 # Floats Iteration 4 — Codegen + Runtime (Implementation Plan)
 
-> **Parent spec:** `docs/specs/2026-05-10-floats.md` (committed
+> **Parent spec:** `docs/specs/0005-floats.md` (committed
 > `e37366f`, approved 2026-05-10) — sections A3 (codegen-side
 > dispatch), A4 (conversions), A5 (determinism), and the
 > `crates/ailang-codegen/` + `runtime/` Components subsections.
diff --git a/docs/plans/2026-05-10-floats-5-prose-design.md b/docs/plans/0020-floats-5-prose-design.md
similarity index 99%
rename from docs/plans/2026-05-10-floats-5-prose-design.md
rename to docs/plans/0020-floats-5-prose-design.md
index 8d65767..eca4362 100644
--- a/docs/plans/2026-05-10-floats-5-prose-design.md
+++ b/docs/plans/0020-floats-5-prose-design.md
@@ -1,6 +1,6 @@
 # Floats Iteration 5 — Prose + DESIGN.md + Milestone Close (Implementation Plan)
 
-> **Parent spec:** `docs/specs/2026-05-10-floats.md` (committed
+> **Parent spec:** `docs/specs/0005-floats.md` (committed
 > `e37366f`, approved 2026-05-10) — section A5 (determinism
 > contract) + the `crates/ailang-prose/` Components subsection.
 >
diff --git a/docs/plans/2026-05-10-architect-iron-law-extension.md b/docs/plans/0021-architect-iron-law-extension.md
similarity index 100%
rename from docs/plans/2026-05-10-architect-iron-law-extension.md
rename to docs/plans/0021-architect-iron-law-extension.md
diff --git a/docs/plans/2026-05-10-23.1-ordering-and-prelude-skeleton.md b/docs/plans/0022-23.1-ordering-and-prelude-skeleton.md
similarity index 100%
rename from docs/plans/2026-05-10-23.1-ordering-and-prelude-skeleton.md
rename to docs/plans/0022-23.1-ordering-and-prelude-skeleton.md
diff --git a/docs/plans/2026-05-10-23.2-eq-class-and-primitive-instances.md b/docs/plans/0023-23.2-eq-class-and-primitive-instances.md
similarity index 100%
rename from docs/plans/2026-05-10-23.2-eq-class-and-primitive-instances.md
rename to docs/plans/0023-23.2-eq-class-and-primitive-instances.md
diff --git a/docs/plans/2026-05-10-23.3-ord-class-and-primitive-instances.md b/docs/plans/0024-23.3-ord-class-and-primitive-instances.md
similarity index 100%
rename from docs/plans/2026-05-10-23.3-ord-class-and-primitive-instances.md
rename to docs/plans/0024-23.3-ord-class-and-primitive-instances.md
diff --git a/docs/plans/2026-05-11-ct.1-validator-and-migration.md b/docs/plans/0025-ct.1-validator-and-migration.md
similarity index 99%
rename from docs/plans/2026-05-11-ct.1-validator-and-migration.md
rename to docs/plans/0025-ct.1-validator-and-migration.md
index 97daa83..4e68980 100644
--- a/docs/plans/2026-05-11-ct.1-validator-and-migration.md
+++ b/docs/plans/0025-ct.1-validator-and-migration.md
@@ -1,6 +1,6 @@
 # ct.1 — Canonical Type Names: Validator + Migration — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-10-canonical-type-names.md` (Components row ct.1)
+> **Parent spec:** `docs/specs/0007-canonical-type-names.md` (Components row ct.1)
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
diff --git a/docs/plans/2026-05-11-ct.2-typechecker-cleanup.md b/docs/plans/0026-ct.2-typechecker-cleanup.md
similarity index 99%
rename from docs/plans/2026-05-11-ct.2-typechecker-cleanup.md
rename to docs/plans/0026-ct.2-typechecker-cleanup.md
index 2f26d9e..4410875 100644
--- a/docs/plans/2026-05-11-ct.2-typechecker-cleanup.md
+++ b/docs/plans/0026-ct.2-typechecker-cleanup.md
@@ -1,6 +1,6 @@
 # Iteration ct.2: Typechecker Cleanup — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-10-canonical-type-names.md`
+> **Parent spec:** `docs/specs/0007-canonical-type-names.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
@@ -1011,7 +1011,7 @@ allows — see `skills/audit/SKILL.md`).
 - [ ] **Step C2: Confirm the four obsolete mechanisms catalogue**
 
 After ct.2 closes, two of the four mechanisms named in
-`docs/specs/2026-05-10-canonical-type-names.md` ct.1 JOURNAL
+`docs/specs/0007-canonical-type-names.md` ct.1 JOURNAL
 entry are gone:
 - ✅ `Pattern::Ctor` imports-fallback (was lib.rs:2486-2521).
 - ✅ `Term::Ctor` synth imports-fallback (was lib.rs:1979-2025).
diff --git a/docs/plans/2026-05-11-ct.3-codegen-mono-cleanup.md b/docs/plans/0027-ct.3-codegen-mono-cleanup.md
similarity index 99%
rename from docs/plans/2026-05-11-ct.3-codegen-mono-cleanup.md
rename to docs/plans/0027-ct.3-codegen-mono-cleanup.md
index 1610530..0376ff4 100644
--- a/docs/plans/2026-05-11-ct.3-codegen-mono-cleanup.md
+++ b/docs/plans/0027-ct.3-codegen-mono-cleanup.md
@@ -1,6 +1,6 @@
 # Iteration ct.3: Codegen + Mono Cleanup — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-10-canonical-type-names.md`
+> **Parent spec:** `docs/specs/0007-canonical-type-names.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
diff --git a/docs/plans/2026-05-11-ct.4-milestone-close.md b/docs/plans/0028-ct.4-milestone-close.md
similarity index 99%
rename from docs/plans/2026-05-11-ct.4-milestone-close.md
rename to docs/plans/0028-ct.4-milestone-close.md
index e14761d..a400cbe 100644
--- a/docs/plans/2026-05-11-ct.4-milestone-close.md
+++ b/docs/plans/0028-ct.4-milestone-close.md
@@ -1,6 +1,6 @@
 # Iteration ct.4: Milestone Close — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-10-canonical-type-names.md`
+> **Parent spec:** `docs/specs/0007-canonical-type-names.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
@@ -828,7 +828,7 @@ policy. No new regressions vs. baseline.
 
 - [ ] **Step C2: Confirm all acceptance criteria from the spec**
 
-Verify each item in `docs/specs/2026-05-10-canonical-type-names.md`
+Verify each item in `docs/specs/0007-canonical-type-names.md`
 § "Acceptance criteria":
 
 1. ✅ `load_workspace` validates every `Type::Con` (ct.1).
diff --git a/docs/plans/2026-05-11-orchestrator-refactor.md b/docs/plans/0029-orchestrator-refactor.md
similarity index 99%
rename from docs/plans/2026-05-11-orchestrator-refactor.md
rename to docs/plans/0029-orchestrator-refactor.md
index 46869fb..08a22a8 100644
--- a/docs/plans/2026-05-11-orchestrator-refactor.md
+++ b/docs/plans/0029-orchestrator-refactor.md
@@ -1,6 +1,6 @@
 # Orchestrator-Refactor — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-11-implement-orchestrator-agent.md`
+> **Parent spec:** `docs/specs/0008-implement-orchestrator-agent.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
diff --git a/docs/plans/2026-05-11-pr.1-plan-recon-subagent.md b/docs/plans/0030-pr.1-plan-recon-subagent.md
similarity index 99%
rename from docs/plans/2026-05-11-pr.1-plan-recon-subagent.md
rename to docs/plans/0030-pr.1-plan-recon-subagent.md
index 8ee68d6..48247c2 100644
--- a/docs/plans/2026-05-11-pr.1-plan-recon-subagent.md
+++ b/docs/plans/0030-pr.1-plan-recon-subagent.md
@@ -1,6 +1,6 @@
 # Iteration pr.1 — Plan-recon Subagent — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-11-plan-recon-subagent.md`
+> **Parent spec:** `docs/specs/0009-plan-recon-subagent.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
@@ -455,7 +455,7 @@ Replace with:
   during Step 1 when the milestone enters code territory the Boss
   has not recently read; this is opt-in and not part of the standard
   process. Rationale: brainstorm's recon phase is interwoven with
-  the user Q&A — see `docs/specs/2026-05-11-plan-recon-subagent.md`
+  the user Q&A — see `docs/specs/0009-plan-recon-subagent.md`
   for the full reasoning.
 ```
 
diff --git a/docs/plans/2026-05-11-audit-fieldtest-docwriter-cadence.md b/docs/plans/0031-audit-fieldtest-docwriter-cadence.md
similarity index 99%
rename from docs/plans/2026-05-11-audit-fieldtest-docwriter-cadence.md
rename to docs/plans/0031-audit-fieldtest-docwriter-cadence.md
index b83d98d..52332f5 100644
--- a/docs/plans/2026-05-11-audit-fieldtest-docwriter-cadence.md
+++ b/docs/plans/0031-audit-fieldtest-docwriter-cadence.md
@@ -1,6 +1,6 @@
 # Audit / fieldtest / docwriter cadence restructure — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-11-audit-fieldtest-docwriter-cadence.md`
+> **Parent spec:** `docs/specs/0012-audit-fieldtest-docwriter-cadence.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement` to run this plan. Steps use `- [ ]` checkboxes for tracking.
 
diff --git a/docs/plans/2026-05-11-iter-gc.1.md b/docs/plans/0032-iter-gc.1.md
similarity index 98%
rename from docs/plans/2026-05-11-iter-gc.1.md
rename to docs/plans/0032-iter-gc.1.md
index 311f7c2..5a976bf 100644
--- a/docs/plans/2026-05-11-iter-gc.1.md
+++ b/docs/plans/0032-iter-gc.1.md
@@ -1,6 +1,6 @@
 # gc.1 — Grounding-Check Agent — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-11-brainstorm-grounding-check.md`
+> **Parent spec:** `docs/specs/0013-brainstorm-grounding-check.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
@@ -410,7 +410,7 @@ Current (lines 213-219):
   during Step 1 when the milestone enters code territory the Boss
   has not recently read; this is opt-in and not part of the standard
   process. Rationale: brainstorm's recon phase is interwoven with
-  the user Q&A — see `docs/specs/2026-05-11-plan-recon-subagent.md`
+  the user Q&A — see `docs/specs/0009-plan-recon-subagent.md`
   for the full reasoning.
 ```
 
@@ -420,14 +420,14 @@ Replace with:
 - **Private agent:** `skills/brainstorm/agents/ailang-grounding-check.md`
   — dispatched in Step 7.5 as a hard-gate. The agent reads the spec
   with fresh context and reports PASS / BLOCK / INFRA_ERROR. See
-  `docs/specs/2026-05-11-brainstorm-grounding-check.md` for the
+  `docs/specs/0013-brainstorm-grounding-check.md` for the
   design rationale.
 - **Ad-hoc dispatch.** The Boss MAY also ad-hoc dispatch
   `skills/planner/agents/ailang-plan-recon.md` during Step 1 when
   the milestone enters code territory the Boss has not recently
   read; this is opt-in and not part of the standard process.
   Rationale: brainstorm's recon phase is interwoven with the user
-  Q&A — see `docs/specs/2026-05-11-plan-recon-subagent.md` for the
+  Q&A — see `docs/specs/0009-plan-recon-subagent.md` for the
   full reasoning.
 ```
 
diff --git a/docs/plans/2026-05-11-iter-23.4.md b/docs/plans/0033-iter-23.4.md
similarity index 99%
rename from docs/plans/2026-05-11-iter-23.4.md
rename to docs/plans/0033-iter-23.4.md
index 7be6194..10331a5 100644
--- a/docs/plans/2026-05-11-iter-23.4.md
+++ b/docs/plans/0033-iter-23.4.md
@@ -1,6 +1,6 @@
 # Iter 23.4 — Mono-Pass Unification — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-11-23-eq-ord-prelude.md` (commit 841d65d, re-grounded 2026-05-11 against main HEAD 51da9fa, PASS)
+> **Parent spec:** `docs/specs/0014-23-eq-ord-prelude.md` (commit 841d65d, re-grounded 2026-05-11 against main HEAD 51da9fa, PASS)
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement` to run this plan. Steps use `- [ ]` checkboxes for tracking. The implementer does NOT commit — work accumulates in the working tree; the Boss commits the iter at the end.
 
@@ -1267,11 +1267,11 @@ The implement orchestrator's terminal Phase 4 (journal write) includes a "Bench"
 
 ## Hand-off
 
-This plan is written to the working tree at `docs/plans/2026-05-11-iter-23.4.md` (uncommitted). The Boss reviews and commits when handing off to `implement` (suggested commit subject: `plan: 23.4 mono-pass unification`).
+This plan is written to the working tree at `docs/plans/0033-iter-23.4.md` (uncommitted). The Boss reviews and commits when handing off to `implement` (suggested commit subject: `plan: 23.4 mono-pass unification`).
 
 Hand-off to `implement` carries:
 
-- `plan_path`: `docs/plans/2026-05-11-iter-23.4.md`
+- `plan_path`: `docs/plans/0033-iter-23.4.md`
 - `iter_id`: `23.4`
 - `task_range`: full (Tasks 1–11)
 - Notes for the orchestrator-agent:
diff --git a/docs/plans/2026-05-11-iter-23.4-prep.md b/docs/plans/0034-iter-23.4-prep.md
similarity index 99%
rename from docs/plans/2026-05-11-iter-23.4-prep.md
rename to docs/plans/0034-iter-23.4-prep.md
index d1ad744..eeeedb1 100644
--- a/docs/plans/2026-05-11-iter-23.4-prep.md
+++ b/docs/plans/0034-iter-23.4-prep.md
@@ -43,7 +43,7 @@ or any on-disk fixture (including the prelude).
 **Out of scope:**
 - The five prelude free fns themselves (`ne`/`lt`/`le`/`gt`/`ge`).
   They land in iter 23.4 unchanged from the existing
-  `docs/plans/2026-05-11-iter-23.4.md`.
+  `docs/plans/0033-iter-23.4.md`.
 - Any modification to `examples/prelude.ail.json`.
 - Any new diagnostic for the hypothetical multi-implicit-import
   ambiguity case.
diff --git a/docs/plans/2026-05-12-iter-23.5.md b/docs/plans/0035-iter-23.5.md
similarity index 99%
rename from docs/plans/2026-05-12-iter-23.5.md
rename to docs/plans/0035-iter-23.5.md
index 899896f..1d7376d 100644
--- a/docs/plans/2026-05-12-iter-23.5.md
+++ b/docs/plans/0035-iter-23.5.md
@@ -1,6 +1,6 @@
 # Iter 23.5 — Prelude free fns + E2E — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-11-23-eq-ord-prelude.md`
+> **Parent spec:** `docs/specs/0014-23-eq-ord-prelude.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking. No
@@ -1224,7 +1224,7 @@ Same command as Step 1. Confirm empty output. (This is the "RED" state.)
 - [ ] **Step 3: Write minimal implementation**
 
 Edit `docs/DESIGN.md`. After line 1702 (the line ending with
-`"... see `docs/specs/2026-05-09-22-typeclasses.md` 'Amendments' for the substantive rationale."`),
+`"... see `docs/specs/0002-22-typeclasses.md` 'Amendments' for the substantive rationale."`),
 insert two blank lines and the following paragraph block:
 
 ```markdown
@@ -1409,7 +1409,7 @@ record per-script exit codes in the `Stats` section.
 
 ## Handoff
 
-Plan file: `docs/plans/2026-05-12-iter-23.5.md`.
+Plan file: `docs/plans/0035-iter-23.5.md`.
 
 Hand off to `skills/implement` with: this plan path. Boss commits the
 plan with subject `plan: iter 23.5 prelude free fns + E2E — 8 tasks`
diff --git a/docs/plans/rt.1.md b/docs/plans/0036-rt.1.md
similarity index 99%
rename from docs/plans/rt.1.md
rename to docs/plans/0036-rt.1.md
index 4df39ee..fe26cf1 100644
--- a/docs/plans/rt.1.md
+++ b/docs/plans/0036-rt.1.md
@@ -1,6 +1,6 @@
 # rt.1 — Roundtrip Invariant Audit Tests — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-12-roundtrip-invariant.md`
+> **Parent spec:** `docs/specs/0015-roundtrip-invariant.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
diff --git a/docs/plans/2026-05-12-iter-boss.md b/docs/plans/0037-iter-boss.md
similarity index 99%
rename from docs/plans/2026-05-12-iter-boss.md
rename to docs/plans/0037-iter-boss.md
index 3a90ccf..09c8167 100644
--- a/docs/plans/2026-05-12-iter-boss.md
+++ b/docs/plans/0037-iter-boss.md
@@ -1,6 +1,6 @@
 # Iter boss — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-12-boss-skill.md`
+> **Parent spec:** `docs/specs/0016-boss-skill.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
diff --git a/docs/plans/cma.1.md b/docs/plans/0038-cma.1.md
similarity index 99%
rename from docs/plans/cma.1.md
rename to docs/plans/0038-cma.1.md
index d075d35..cbb385e 100644
--- a/docs/plans/cma.1.md
+++ b/docs/plans/0038-cma.1.md
@@ -1,6 +1,6 @@
 # cma.1 — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-12-cross-model-authoring-form-test.md`
+> **Parent spec:** `docs/specs/0017-cross-model-authoring-form-test.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
@@ -74,7 +74,7 @@ Empirical measurement of whether `.ail.json` or `.ailx` is the form a
 foreign LLM author reaches for and succeeds with. Single subject for
 v1: Qwen3-Coder-Next via IONOS. Two blind cohorts; same four tasks.
 
-Parent spec: `docs/specs/2026-05-12-cross-model-authoring-form-test.md`.
+Parent spec: `docs/specs/0017-cross-model-authoring-form-test.md`.
 
 ## Layout
 
diff --git a/docs/plans/cma.2.md b/docs/plans/0039-cma.2.md
similarity index 99%
rename from docs/plans/cma.2.md
rename to docs/plans/0039-cma.2.md
index 218cded..e223fcb 100644
--- a/docs/plans/cma.2.md
+++ b/docs/plans/0039-cma.2.md
@@ -1,6 +1,6 @@
 # cma.2 — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-12-cross-model-authoring-form-test.md`
+> **Parent spec:** `docs/specs/0017-cross-model-authoring-form-test.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
diff --git a/docs/plans/ms.1.md b/docs/plans/0040-ms.1.md
similarity index 98%
rename from docs/plans/ms.1.md
rename to docs/plans/0040-ms.1.md
index e49cc70..760d1c4 100644
--- a/docs/plans/ms.1.md
+++ b/docs/plans/0040-ms.1.md
@@ -1,6 +1,6 @@
 # ms.1 — Pipeline anyhow-chain preservation — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-12-multi-subject-codellama.md`
+> **Parent spec:** `docs/specs/0018-multi-subject-codellama.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
diff --git a/docs/plans/ms.2.md b/docs/plans/0041-ms.2.md
similarity index 98%
rename from docs/plans/ms.2.md
rename to docs/plans/0041-ms.2.md
index 6c6b9ba..31ae062 100644
--- a/docs/plans/ms.2.md
+++ b/docs/plans/0041-ms.2.md
@@ -1,6 +1,6 @@
 # ms.2 — Multi-subject run + DESIGN.md addendum extension — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-12-multi-subject-codellama.md`
+> **Parent spec:** `docs/specs/0018-multi-subject-codellama.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
@@ -309,7 +309,7 @@ rejected and a different model ran in its place.)
 - [ ] **Step 1: Confirm all spec acceptance criteria are green**
 
 For each of the 7 criteria in
-`docs/specs/2026-05-12-multi-subject-codellama.md` §"Acceptance
+`docs/specs/0018-multi-subject-codellama.md` §"Acceptance
 criteria", verify the corresponding artefact exists in the working
 tree. Report green/red per criterion in the iter journal.
 
diff --git a/docs/plans/ext-cli.1.md b/docs/plans/0042-ext-cli.1.md
similarity index 100%
rename from docs/plans/ext-cli.1.md
rename to docs/plans/0042-ext-cli.1.md
diff --git a/docs/plans/hs.1.md b/docs/plans/0043-hs.1.md
similarity index 99%
rename from docs/plans/hs.1.md
rename to docs/plans/0043-hs.1.md
index 21df1bf..994bd2e 100644
--- a/docs/plans/hs.1.md
+++ b/docs/plans/0043-hs.1.md
@@ -1,6 +1,6 @@
 # hs.1 — Heap-Str ABI: Static-Str Layout Migration — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-12-heap-str-abi.md`
+> **Parent spec:** `docs/specs/0019-heap-str-abi.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
diff --git a/docs/plans/hs.2.md b/docs/plans/0044-hs.2.md
similarity index 99%
rename from docs/plans/hs.2.md
rename to docs/plans/0044-hs.2.md
index be2fc49..feabbe5 100644
--- a/docs/plans/hs.2.md
+++ b/docs/plans/0044-hs.2.md
@@ -1,6 +1,6 @@
 # hs.2 — Static-Str sentinel-slot retrofit — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-12-heap-str-abi.md`
+> **Parent spec:** `docs/specs/0019-heap-str-abi.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
diff --git a/docs/plans/hs.3.md b/docs/plans/0045-hs.3.md
similarity index 99%
rename from docs/plans/hs.3.md
rename to docs/plans/0045-hs.3.md
index 382e282..7742584 100644
--- a/docs/plans/hs.3.md
+++ b/docs/plans/0045-hs.3.md
@@ -1,6 +1,6 @@
 # hs.3 — Heap-Str runtime additions — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-12-heap-str-abi.md`
+> **Parent spec:** `docs/specs/0019-heap-str-abi.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
diff --git a/docs/plans/hs.4.md b/docs/plans/0046-hs.4.md
similarity index 99%
rename from docs/plans/hs.4.md
rename to docs/plans/0046-hs.4.md
index 7343373..e3621fa 100644
--- a/docs/plans/hs.4.md
+++ b/docs/plans/0046-hs.4.md
@@ -1,6 +1,6 @@
 # hs.4 — IR + checker + linker wiring for int_to_str / float_to_str — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-12-heap-str-abi.md`
+> **Parent spec:** `docs/specs/0019-heap-str-abi.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
diff --git a/docs/plans/eob.1.md b/docs/plans/0047-eob.1.md
similarity index 99%
rename from docs/plans/eob.1.md
rename to docs/plans/0047-eob.1.md
index d27c659..3807a69 100644
--- a/docs/plans/eob.1.md
+++ b/docs/plans/0047-eob.1.md
@@ -1,6 +1,6 @@
 # eob.1 — Effect-op arguments borrow — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-12-effect-op-borrow.md`
+> **Parent spec:** `docs/specs/0020-effect-op-borrow.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
diff --git a/docs/plans/ctt.1.md b/docs/plans/0048-ctt.1.md
similarity index 99%
rename from docs/plans/ctt.1.md
rename to docs/plans/0048-ctt.1.md
index a9a4311..fe3b1c3 100644
--- a/docs/plans/ctt.1.md
+++ b/docs/plans/0048-ctt.1.md
@@ -1,6 +1,6 @@
 # ctt.1 — Env-overlay shape ratification — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-12-ct-tidy.md`
+> **Parent spec:** `docs/specs/0021-ct-tidy.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
diff --git a/docs/plans/ctt.2.md b/docs/plans/0049-ctt.2.md
similarity index 99%
rename from docs/plans/ctt.2.md
rename to docs/plans/0049-ctt.2.md
index c294ebe..32fbe6a 100644
--- a/docs/plans/ctt.2.md
+++ b/docs/plans/0049-ctt.2.md
@@ -1,6 +1,6 @@
 # ctt.2 — `Registry.type_def_module` re-key — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-12-ct-tidy.md`
+> **Parent spec:** `docs/specs/0021-ct-tidy.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
diff --git a/docs/plans/ctt.3.md b/docs/plans/0050-ctt.3.md
similarity index 99%
rename from docs/plans/ctt.3.md
rename to docs/plans/0050-ctt.3.md
index 624a06f..9747aa0 100644
--- a/docs/plans/ctt.3.md
+++ b/docs/plans/0050-ctt.3.md
@@ -1,6 +1,6 @@
 # ctt.3 — `KindMismatch` retire — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-12-ct-tidy.md`
+> **Parent spec:** `docs/specs/0021-ct-tidy.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
diff --git a/docs/plans/24.1.md b/docs/plans/0051-24.1.md
similarity index 99%
rename from docs/plans/24.1.md
rename to docs/plans/0051-24.1.md
index 5e00ae2..eadba37 100644
--- a/docs/plans/24.1.md
+++ b/docs/plans/0051-24.1.md
@@ -1,6 +1,6 @@
 # 24.1 — `bool_to_str` + `str_clone` Runtime + Codegen Wiring — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-12-24-show-print.md` (commit 953f2e1)
+> **Parent spec:** `docs/specs/0022-24-show-print.md` (commit 953f2e1)
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
diff --git a/docs/plans/mq.1.md b/docs/plans/0052-mq.1.md
similarity index 99%
rename from docs/plans/mq.1.md
rename to docs/plans/0052-mq.1.md
index 1b8560e..4705a7e 100644
--- a/docs/plans/mq.1.md
+++ b/docs/plans/0052-mq.1.md
@@ -1,6 +1,6 @@
 # Iter mq.1 — Canonical-form extension for class-ref fields — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-13-module-qualified-class-names.md`
+> **Parent spec:** `docs/specs/0023-module-qualified-class-names.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement` to
 > run this plan. Steps use `- [ ]` checkboxes for tracking.
diff --git a/docs/plans/mq.2.md b/docs/plans/0053-mq.2.md
similarity index 99%
rename from docs/plans/mq.2.md
rename to docs/plans/0053-mq.2.md
index 317ea6e..d0bb949 100644
--- a/docs/plans/mq.2.md
+++ b/docs/plans/0053-mq.2.md
@@ -1,6 +1,6 @@
 # Iter mq.2 — Type-driven dispatch mechanism (installed, not yet exercised) — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-13-module-qualified-class-names.md`
+> **Parent spec:** `docs/specs/0023-module-qualified-class-names.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
diff --git a/docs/plans/mq.3.md b/docs/plans/0054-mq.3.md
similarity index 99%
rename from docs/plans/mq.3.md
rename to docs/plans/0054-mq.3.md
index dac2310..086d64b 100644
--- a/docs/plans/mq.3.md
+++ b/docs/plans/0054-mq.3.md
@@ -1,6 +1,6 @@
 # Iter mq.3 — Retire MethodNameCollision + multi-class E2E + DESIGN.md sync — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-13-module-qualified-class-names.md`
+> **Parent spec:** `docs/specs/0023-module-qualified-class-names.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement` to run
 > this plan. Steps use `- [ ]` checkboxes for tracking.
diff --git a/docs/plans/mq.tidy.md b/docs/plans/0055-mq.tidy.md
similarity index 99%
rename from docs/plans/mq.tidy.md
rename to docs/plans/0055-mq.tidy.md
index 5c8d180..f1f2830 100644
--- a/docs/plans/mq.tidy.md
+++ b/docs/plans/0055-mq.tidy.md
@@ -1,6 +1,6 @@
 # Iter mq.tidy — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-13-module-qualified-class-names.md`
+> **Parent spec:** `docs/specs/0023-module-qualified-class-names.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
diff --git a/docs/plans/24.2.md b/docs/plans/0056-24.2.md
similarity index 99%
rename from docs/plans/24.2.md
rename to docs/plans/0056-24.2.md
index 04b7830..689a72f 100644
--- a/docs/plans/24.2.md
+++ b/docs/plans/0056-24.2.md
@@ -1,6 +1,6 @@
 # Iter 24.2 — class Show + 4 instances + 22b migration — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-13-24-show-print.md`
+> **Parent spec:** `docs/specs/0024-24-show-print.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
diff --git a/docs/plans/24.3.md b/docs/plans/0057-24.3.md
similarity index 99%
rename from docs/plans/24.3.md
rename to docs/plans/0057-24.3.md
index d6c1ae8..9d3c0f2 100644
--- a/docs/plans/24.3.md
+++ b/docs/plans/0057-24.3.md
@@ -1,6 +1,6 @@
 # Iter 24.3 — `fn print` polymorphic free fn + E2E + DESIGN.md sync — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-13-24-show-print.md`
+> **Parent spec:** `docs/specs/0024-24-show-print.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
diff --git a/docs/plans/24.tidy.md b/docs/plans/0058-24.tidy.md
similarity index 100%
rename from docs/plans/24.tidy.md
rename to docs/plans/0058-24.tidy.md
diff --git a/docs/plans/2026-05-13-iter-form-a.0.md b/docs/plans/0059-iter-form-a.0.md
similarity index 97%
rename from docs/plans/2026-05-13-iter-form-a.0.md
rename to docs/plans/0059-iter-form-a.0.md
index 45513ed..cbe3b19 100644
--- a/docs/plans/2026-05-13-iter-form-a.0.md
+++ b/docs/plans/0059-iter-form-a.0.md
@@ -1,6 +1,6 @@
 # Iter form-a.0 — Prelude Pilot — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-13-form-a-default-authoring.md`
+> **Parent spec:** `docs/specs/0025-form-a-default-authoring.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
@@ -140,8 +140,8 @@ recon-observed values; if Task 1 Step 2 observed different values
 # Iter form-a.0 — Prelude Pilot
 
 **Date:** 2026-05-13
-**Parent spec:** `docs/specs/2026-05-13-form-a-default-authoring.md`
-**Parent plan:** `docs/plans/2026-05-13-iter-form-a.0.md`
+**Parent spec:** `docs/specs/0025-form-a-default-authoring.md`
+**Parent plan:** `docs/plans/0059-iter-form-a.0.md`
 
 ## Outcome
 
diff --git a/docs/plans/2026-05-13-iter-form-a.1.md b/docs/plans/0060-iter-form-a.1.md
similarity index 99%
rename from docs/plans/2026-05-13-iter-form-a.1.md
rename to docs/plans/0060-iter-form-a.1.md
index 4cbfb28..8d01ff7 100644
--- a/docs/plans/2026-05-13-iter-form-a.1.md
+++ b/docs/plans/0060-iter-form-a.1.md
@@ -1,6 +1,6 @@
 # Iter form-a.1 — Big-bang Migration + Milestone Close — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-13-form-a-default-authoring.md`
+> **Parent spec:** `docs/specs/0025-form-a-default-authoring.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
diff --git a/docs/plans/2026-05-13-iter-form-a.tidy.md b/docs/plans/0061-iter-form-a.tidy.md
similarity index 95%
rename from docs/plans/2026-05-13-iter-form-a.tidy.md
rename to docs/plans/0061-iter-form-a.tidy.md
index f1c2bf7..574e3c9 100644
--- a/docs/plans/2026-05-13-iter-form-a.tidy.md
+++ b/docs/plans/0061-iter-form-a.tidy.md
@@ -1,7 +1,7 @@
 # form-a.tidy — Implementation Plan
 
 > **Parent specs:**
-> - `docs/specs/2026-05-13-fieldtest-form-a.md` §Findings 2-3 (spec_gap: form_a.md missing class/instance/constraint sections + canonical-form qualifier rule)
+> - `docs/specs/0026-fieldtest-form-a.md` §Findings 2-3 (spec_gap: form_a.md missing class/instance/constraint sections + canonical-form qualifier rule)
 > - `docs/journals/2026-05-13-audit-form-a.md` §"Drift items" (3 of 4 documentary items; item #2 dropped per recon — see Architecture)
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement` to run this plan. Steps use `- [ ]` checkboxes for tracking.
@@ -17,7 +17,7 @@
 **Files this plan creates or modifies:**
 
 - Modify: `crates/ailang-core/specs/form_a.md` — three new sections (Tasks 1-3) + line 66 intro update (Task 1)
-- Modify: `docs/specs/2026-05-13-form-a-default-authoring.md` — 5 site edits (Task 4)
+- Modify: `docs/specs/0025-form-a-default-authoring.md` — 5 site edits (Task 4)
 - Modify: `crates/ailang-core/src/hash.rs:50-57` — delete 8 lines (Task 5)
 - Modify: `crates/ailang-surface/tests/round_trip.rs` — module docstring + test inner docstring rewrite (Task 6)
 
@@ -234,7 +234,7 @@ Expected: total `559 passed`.
 ### Task 4: form-a spec — fix 5 contradictory "seven carve-outs" sites
 
 **Files:**
-- Modify: `docs/specs/2026-05-13-form-a-default-authoring.md` at five line ranges
+- Modify: `docs/specs/0025-form-a-default-authoring.md` at five line ranges
 
 The audit-form-a journal flagged three sections (§C1, §C2, §"Data flow")
 contradicting the §C4(b) amendment. Recon expanded the find to 5 sites
@@ -251,7 +251,7 @@ the §"Data flow" diagram.
 
 - [ ] **Step 1: Fix preamble line 11**
 
-Replace at `docs/specs/2026-05-13-form-a-default-authoring.md:11`:
+Replace at `docs/specs/0025-form-a-default-authoring.md:11`:
 
 ```
 that remain in the repository are seven specific negative-test
@@ -265,7 +265,7 @@ that remain in the repository are eight specific negative-test
 
 - [ ] **Step 2: Fix §C1 line 170**
 
-Replace at `docs/specs/2026-05-13-form-a-default-authoring.md:170`:
+Replace at `docs/specs/0025-form-a-default-authoring.md:170`:
 
 ```
 walks examples/*.ail.json, skips the seven carve-outs (named
@@ -279,7 +279,7 @@ walks examples/*.ail.json, skips the eight carve-outs (named
 
 - [ ] **Step 3: Fix §C2 line 191**
 
-Replace at `docs/specs/2026-05-13-form-a-default-authoring.md:191`:
+Replace at `docs/specs/0025-form-a-default-authoring.md:191`:
 
 ```
 `ailang_surface::parse_module_from_str`. The seven carve-outs
@@ -293,7 +293,7 @@ with:
 
 - [ ] **Step 4: Fix §C3 line 218**
 
-Replace at `docs/specs/2026-05-13-form-a-default-authoring.md:218`:
+Replace at `docs/specs/0025-form-a-default-authoring.md:218`:
 
 ```
 **Carve-out anchor.** The seven .ail.json-only fixtures are
@@ -307,7 +307,7 @@ with:
 
 - [ ] **Step 5: Fix §"Data flow" lines 363, 374**
 
-Replace at `docs/specs/2026-05-13-form-a-default-authoring.md:363`:
+Replace at `docs/specs/0025-form-a-default-authoring.md:363`:
 
 ```
 except for the seven carve-outs:
@@ -319,7 +319,7 @@ with:
 except for the eight carve-outs:
 ```
 
-Replace at `docs/specs/2026-05-13-form-a-default-authoring.md:374`:
+Replace at `docs/specs/0025-form-a-default-authoring.md:374`:
 
 ```
 only by the seven carve-outs (and by any test that explicitly mixes
@@ -333,7 +333,7 @@ only by the eight carve-outs (and by any test that explicitly mixes
 
 - [ ] **Step 6: Sanity-check no other "seven" → "eight" candidates were missed**
 
-Run: `grep -n 'seven' docs/specs/2026-05-13-form-a-default-authoring.md`
+Run: `grep -n 'seven' docs/specs/0025-form-a-default-authoring.md`
 Expected output (post-edit; verbatim — these surviving "seven" sites
 are correct under §C4(a) scope or are arithmetic / future-state, not
 defects):
@@ -497,7 +497,7 @@ Expected output: empty (zero hits).
 
 ## Decision recorded — Drift item B2 (plan-file "seven carve-outs" orphans)
 
-Recon verified that `docs/plans/2026-05-13-iter-form-a.1.md` contains
+Recon verified that `docs/plans/0060-iter-form-a.1.md` contains
 **zero** defective `seven` mentions; the four hits are all internally
 scoped to §C4(a) (which IS seven), arithmetic, or future-state. The
 audit-form-a journal's "two sites" claim against this file does not
diff --git a/docs/plans/2026-05-13-iter-str-concat.md b/docs/plans/0062-iter-str-concat.md
similarity index 99%
rename from docs/plans/2026-05-13-iter-str-concat.md
rename to docs/plans/0062-iter-str-concat.md
index 3cbe488..29e7d8b 100644
--- a/docs/plans/2026-05-13-iter-str-concat.md
+++ b/docs/plans/0062-iter-str-concat.md
@@ -1,6 +1,6 @@
 # str-concat — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-13-fieldtest-form-a.md` §"[friction] No primitive str_concat / str_append in builtins" (lines 186-212).
+> **Parent spec:** `docs/specs/0026-fieldtest-form-a.md` §"[friction] No primitive str_concat / str_append in builtins" (lines 186-212).
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement` to run this plan. Steps use `- [ ]` checkboxes for tracking.
 
diff --git a/docs/plans/2026-05-14-iter-rpe.1.md b/docs/plans/0063-iter-rpe.1.md
similarity index 99%
rename from docs/plans/2026-05-14-iter-rpe.1.md
rename to docs/plans/0063-iter-rpe.1.md
index 1341b72..bf02e2d 100644
--- a/docs/plans/2026-05-14-iter-rpe.1.md
+++ b/docs/plans/0063-iter-rpe.1.md
@@ -1,6 +1,6 @@
 # rpe.1 — Retire per-type print effect-ops — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-14-retire-per-type-print-effects.md`
+> **Parent spec:** `docs/specs/0027-retire-per-type-print-effects.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
diff --git a/docs/plans/2026-05-14-iter-pd.1.md b/docs/plans/0064-iter-pd.1.md
similarity index 99%
rename from docs/plans/2026-05-14-iter-pd.1.md
rename to docs/plans/0064-iter-pd.1.md
index 86e5b5c..f07e759 100644
--- a/docs/plans/2026-05-14-iter-pd.1.md
+++ b/docs/plans/0064-iter-pd.1.md
@@ -1,6 +1,6 @@
 # pd.1 — core API split (load_modules_with + build_workspace) — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-14-prelude-decouple.md`
+> **Parent spec:** `docs/specs/0028-prelude-decouple.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
@@ -796,7 +796,7 @@ touched in pd.1:
 - Deleting `examples/prelude.ail.json` (pd.3).
 - Deleting the defensive include in `crates/ail/src/main.rs:472-484` (pd.3).
 - Updating `crates/ailang-core/tests/carve_out_inventory.rs` (pd.3).
-- Updating `docs/specs/2026-05-13-form-a-default-authoring.md` §C4 (b)
+- Updating `docs/specs/0025-form-a-default-authoring.md` §C4 (b)
   (pd.3).
 
 A pd.1 implementer who finds themselves about to edit any of the above
diff --git a/docs/plans/2026-05-14-iter-pd.2.md b/docs/plans/0065-iter-pd.2.md
similarity index 99%
rename from docs/plans/2026-05-14-iter-pd.2.md
rename to docs/plans/0065-iter-pd.2.md
index 0f242c9..ad0e2ee 100644
--- a/docs/plans/2026-05-14-iter-pd.2.md
+++ b/docs/plans/0065-iter-pd.2.md
@@ -1,6 +1,6 @@
 # pd.2 — surface assumes prelude ownership; core shim retired — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-14-prelude-decouple.md`
+> **Parent spec:** `docs/specs/0028-prelude-decouple.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
@@ -793,7 +793,7 @@ in pd.2:
   `crates/ail/src/main.rs:472-484` (pd.3 work).
 - Updating `crates/ailang-core/tests/carve_out_inventory.rs` to reflect
   §C4 (b) becoming empty (pd.3 work).
-- Updating `docs/specs/2026-05-13-form-a-default-authoring.md` §C4 (b)
+- Updating `docs/specs/0025-form-a-default-authoring.md` §C4 (b)
   (pd.3 work).
 - Creating `prelude_decouple_carve_out_pin.rs` (pd.3 work — asserts
   the JSON file does not exist; pd.2-time the file IS still present).
diff --git a/docs/plans/2026-05-14-iter-pd.3.md b/docs/plans/0066-iter-pd.3.md
similarity index 97%
rename from docs/plans/2026-05-14-iter-pd.3.md
rename to docs/plans/0066-iter-pd.3.md
index 72523d9..549ea65 100644
--- a/docs/plans/2026-05-14-iter-pd.3.md
+++ b/docs/plans/0066-iter-pd.3.md
@@ -1,6 +1,6 @@
 # pd.3 — retire prelude.ail.json + carve-out cleanup — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-14-prelude-decouple.md`
+> **Parent spec:** `docs/specs/0028-prelude-decouple.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
@@ -32,7 +32,7 @@ dev-dep edge.
 delete), `ailang-surface/tests/` (one test fn + supporting bytes
 delete + new carve-out pin), `ailang-core` (one in-mod test re-point),
 `ailang-core/tests/carve_out_inventory.rs` (list + comment update),
-`docs/specs/2026-05-13-form-a-default-authoring.md` (§C4 (b) status
+`docs/specs/0025-form-a-default-authoring.md` (§C4 (b) status
 note), `examples/prelude.ail.json` (deleted).
 
 ---
@@ -63,7 +63,7 @@ note), `examples/prelude.ail.json` (deleted).
   class-def rejection); §C4 (b) compile-time-embed: retired by
   prelude-decouple milestone, 2026-05-14"; update the header sentence
   at line 2 from "eight" to "seven".
-- Modify: `docs/specs/2026-05-13-form-a-default-authoring.md:270-311`
+- Modify: `docs/specs/0025-form-a-default-authoring.md:270-311`
   — add a "Status: RETIRED 2026-05-14 by prelude-decouple milestone"
   marker at the top of §C4 (b) and a one-paragraph epitaph at the
   bottom; preserve the original §C4 (b) text below as historical
@@ -370,10 +370,10 @@ order is correct.
 
 ---
 
-### Task 5: Update `docs/specs/2026-05-13-form-a-default-authoring.md` §C4 (b)
+### Task 5: Update `docs/specs/0025-form-a-default-authoring.md` §C4 (b)
 
 **Files:**
-- Modify: `docs/specs/2026-05-13-form-a-default-authoring.md:270-311` —
+- Modify: `docs/specs/0025-form-a-default-authoring.md:270-311` —
   add a "Status: RETIRED" marker at top of §C4 (b) and a one-paragraph
   epitaph at the bottom; preserve the original text as historical
   context.
@@ -389,7 +389,7 @@ qualifiers preserve correctness.
 
 - [ ] **Step 1: Insert a status marker at the top of §C4 (b)**
 
-Edit `docs/specs/2026-05-13-form-a-default-authoring.md`. Find the
+Edit `docs/specs/0025-form-a-default-authoring.md`. Find the
 `**(b) Compile-time-embed carve-outs (one file as of 2026-05-13):**`
 heading (line 270 area). Insert immediately above:
 
@@ -400,7 +400,7 @@ heading (line 270 area). Insert immediately above:
 > and parsed at compile time via `ailang_surface::parse_prelude`. The
 > original §C4 (b) framing below is preserved as historical context;
 > it documents the doctrine inconsistency that prelude-decouple
-> resolved. See `docs/specs/2026-05-14-prelude-decouple.md` and the
+> resolved. See `docs/specs/0028-prelude-decouple.md` and the
 > per-iter journals 2026-05-14-iter-pd.{1,2,3}.md for the resolution.
 ```
 
@@ -456,7 +456,7 @@ fn prelude_ail_json_does_not_exist_on_disk() {
          re-introduced this file, you must also: (a) remove this pin, \
          (b) restore the §C4 (b) entry in carve_out_inventory.rs, \
          (c) revert the §C4 (b) status marker in \
-         docs/specs/2026-05-13-form-a-default-authoring.md, and \
+         docs/specs/0025-form-a-default-authoring.md, and \
          (d) record the rationale in a per-iter journal."
     );
 }
@@ -561,7 +561,7 @@ Per the parent spec (§Acceptance criteria):
    didn't regress.
 4. `cargo test --workspace` is green — verified Task 7 Step 5 + Task 8 Step 1.
 5. Baselines green at unchanged values — verified Task 8 Step 1.
-6. `docs/specs/2026-05-13-form-a-default-authoring.md` §C4 (b) is
+6. `docs/specs/0025-form-a-default-authoring.md` §C4 (b) is
    updated — verified by Task 5.
 7. CLAUDE.md and `docs/DESIGN.md` reviewed — spot-check now.
 
diff --git a/docs/plans/2026-05-15-iter-mut.1.md b/docs/plans/0067-iter-mut.1.md
similarity index 99%
rename from docs/plans/2026-05-15-iter-mut.1.md
rename to docs/plans/0067-iter-mut.1.md
index c5794c4..98d3126 100644
--- a/docs/plans/2026-05-15-iter-mut.1.md
+++ b/docs/plans/0067-iter-mut.1.md
@@ -1,6 +1,6 @@
 # mut.1 — schema + surface — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-15-mut-local.md`
+> **Parent spec:** `docs/specs/0029-mut-local.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
@@ -907,7 +907,7 @@ always sees a single `body: Term`. A `(mut ...)` form with neither
 vars nor body is rejected at parse; `(var ...)` and `(assign ...)`
 outside a `(mut ...)` are rejected at parse for `var` and at
 typecheck for `assign` (mut.2). See spec
-`docs/specs/2026-05-15-mut-local.md`.
+`docs/specs/0029-mut-local.md`.
 ```
 
 - [ ] **Step 5: Extend DESIGN.md §"Term (expression)"**
@@ -930,7 +930,7 @@ line 2364), append:
 // Iter mut.1: in-block update of a mut-var. Legal only as a
 // sub-term of a `Term::Mut` whose `vars` includes a var with the
 // same `name`. Static type Unit. See
-// `docs/specs/2026-05-15-mut-local.md`.
+// `docs/specs/0029-mut-local.md`.
 { "t": "assign",
   "name": "<id>",
   "value": Term }
@@ -1063,7 +1063,7 @@ before continuing — the iteration's gate is full-workspace-green.
 
 ## Self-review checklist
 
-- [ ] **Spec coverage:** every section of `docs/specs/2026-05-15-mut-local.md`
+- [ ] **Spec coverage:** every section of `docs/specs/0029-mut-local.md`
   §"Iteration mut.1 — Schema + surface" has a corresponding task here.
   Cross-check: AST extension (Task 1), Form A surface (Task 4),
   canonical-form invariants (Task 1 empty-vars pin + Task 5 drift
diff --git a/docs/plans/2026-05-15-iter-mut.2.md b/docs/plans/0068-iter-mut.2.md
similarity index 99%
rename from docs/plans/2026-05-15-iter-mut.2.md
rename to docs/plans/0068-iter-mut.2.md
index 3ed652e..9aa3f53 100644
--- a/docs/plans/2026-05-15-iter-mut.2.md
+++ b/docs/plans/0068-iter-mut.2.md
@@ -1,6 +1,6 @@
 # mut.2 — typecheck — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-15-mut-local.md`
+> **Parent spec:** `docs/specs/0029-mut-local.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
@@ -123,7 +123,7 @@ immediately before the `Internal` variant at line 638, insert:
     /// whose declared `ty` is not one of the four supported scalar
     /// primitives (Int, Float, Bool, Unit). The temporary
     /// restriction is named explicitly in spec
-    /// `docs/specs/2026-05-15-mut-local.md` §"Out of scope".
+    /// `docs/specs/0029-mut-local.md` §"Out of scope".
     UnsupportedMutVarType {
         name: String,
         ty: String,
@@ -667,7 +667,7 @@ clean.
 //! the expected diagnostic codes (or zero diagnostics for the
 //! positive nested-shadow case).
 //!
-//! Spec: docs/specs/2026-05-15-mut-local.md §"Testing strategy /
+//! Spec: docs/specs/0029-mut-local.md §"Testing strategy /
 //! Typecheck negative tests".
 
 use std::path::PathBuf;
diff --git a/docs/plans/2026-05-15-iter-mut.3.md b/docs/plans/0069-iter-mut.3.md
similarity index 99%
rename from docs/plans/2026-05-15-iter-mut.3.md
rename to docs/plans/0069-iter-mut.3.md
index b740ceb..8a897d7 100644
--- a/docs/plans/2026-05-15-iter-mut.3.md
+++ b/docs/plans/0069-iter-mut.3.md
@@ -1,6 +1,6 @@
 # mut.3 — codegen + e2e — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-15-mut-local.md`
+> **Parent spec:** `docs/specs/0029-mut-local.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
@@ -642,7 +642,7 @@ Insert (with appropriate context):
   path lift the type restriction (heap-RC-managed Str + ADTs), add
   escaping references (`ref a` + `!Mut` effect), and introduce
   composable transducers (`Stateful a b` + `pipe`). Spec:
-  `docs/specs/2026-05-15-mut-local.md`.
+  `docs/specs/0029-mut-local.md`.
 ```
 
 - [ ] **Step 3: Verify schema-drift tests still pass**
diff --git a/docs/plans/2026-05-15-iter-mut.4-tidy.md b/docs/plans/0070-iter-mut.4-tidy.md
similarity index 98%
rename from docs/plans/2026-05-15-iter-mut.4-tidy.md
rename to docs/plans/0070-iter-mut.4-tidy.md
index 85d186d..5c4ca7b 100644
--- a/docs/plans/2026-05-15-iter-mut.4-tidy.md
+++ b/docs/plans/0070-iter-mut.4-tidy.md
@@ -1,6 +1,6 @@
 # mut.4-tidy — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-15-mut-local.md` (covered by
+> **Parent spec:** `docs/specs/0029-mut-local.md` (covered by
 > audit-mut-local findings; no new spec).
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
@@ -20,7 +20,7 @@ eliminate the per-Var-resolution overhead for programs with no mut
 blocks.
 
 **Architecture:** Architect's two `[high]` drift items are downstream
-of one spec gap: `docs/specs/2026-05-15-mut-local.md` does not
+of one spec gap: `docs/specs/0029-mut-local.md` does not
 enumerate "lambda body referencing an enclosing mut-var" as a
 diagnostic. The fix has three sites — typecheck adds the diagnostic
 in `Term::Lam`'s synth arm, codegen replaces its blame-comment path
@@ -68,7 +68,7 @@ new negative fixture and one driver-test extension.
   jsonc block) — remove the trailing paragraph describing the
   mut.1-stub dispatch state; replace with a paragraph describing the
   current end-to-end mut.3 state.
-- Modify: `docs/specs/2026-05-15-mut-local.md` (§"Out of scope" or
+- Modify: `docs/specs/0029-mut-local.md` (§"Out of scope" or
   equivalent) — add a bullet naming "Lambda capture of a mut-var"
   as explicitly rejected, with the diagnostic name.
 - Modify: `crates/ailang-check/tests/mut_typecheck_pin.rs` — add
@@ -111,7 +111,7 @@ In the `CheckError` enum body, immediately after
     /// Iter mut.4-tidy: `Term::Lam` reached typecheck inside a
     /// `Term::Mut` scope, and the lambda's body references a mut-var
     /// declared in that enclosing scope. Spec
-    /// `docs/specs/2026-05-15-mut-local.md` §"Out of scope": mut-vars
+    /// `docs/specs/0029-mut-local.md` §"Out of scope": mut-vars
     /// cannot escape — they are alloca-resident and lexically scoped.
     /// Capturing one into a closure would require either lifting it
     /// to the heap (deferred milestone) or rejecting the capture.
@@ -509,7 +509,7 @@ yielding the canonical Unit SSA. Mut-vars must be of one of the
 stack-resident scalar types {Int, Float, Bool, Unit}; capturing a
 mut-var into a lambda is rejected at typecheck via
 `CheckError::MutVarCapturedByLambda`. See
-`docs/specs/2026-05-15-mut-local.md`.
+`docs/specs/0029-mut-local.md`.
 ```
 
 - [ ] **Step 2: Verify schema-drift tests still pass**
@@ -522,7 +522,7 @@ Expected: PASS.
 ## Task 7 — Spec amendment
 
 **Files:**
-- Modify: `docs/specs/2026-05-15-mut-local.md` (§"Out of scope" or §"Acceptance criteria")
+- Modify: `docs/specs/0029-mut-local.md` (§"Out of scope" or §"Acceptance criteria")
 
 - [ ] **Step 1: Add bullet to §"Out of scope"**
 
diff --git a/docs/plans/2026-05-15-iter-it.1.md b/docs/plans/0071-iter-it.1.md
similarity index 99%
rename from docs/plans/2026-05-15-iter-it.1.md
rename to docs/plans/0071-iter-it.1.md
index 3a7e028..6316902 100644
--- a/docs/plans/2026-05-15-iter-it.1.md
+++ b/docs/plans/0071-iter-it.1.md
@@ -1,6 +1,6 @@
 # it.1 — loop/recur additive — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-15-iteration-discipline.md`
+> **Parent spec:** `docs/specs/0031-iteration-discipline.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
diff --git a/docs/plans/2026-05-15-iter-it.2.md b/docs/plans/0072-iter-it.2.md
similarity index 99%
rename from docs/plans/2026-05-15-iter-it.2.md
rename to docs/plans/0072-iter-it.2.md
index 8bda409..57e70cb 100644
--- a/docs/plans/2026-05-15-iter-it.2.md
+++ b/docs/plans/0072-iter-it.2.md
@@ -1,6 +1,6 @@
 # it.2 — guardedness checker + Diverge effect — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-15-iteration-discipline.md`
+> **Parent spec:** `docs/specs/0031-iteration-discipline.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
diff --git a/docs/plans/2026-05-15-iter-it.3.md b/docs/plans/0073-iter-it.3.md
similarity index 99%
rename from docs/plans/2026-05-15-iter-it.3.md
rename to docs/plans/0073-iter-it.3.md
index 67ec931..f2155e4 100644
--- a/docs/plans/2026-05-15-iter-it.3.md
+++ b/docs/plans/0073-iter-it.3.md
@@ -1,6 +1,6 @@
 # it.3 — retire tail-app/tail-do + corpus migration — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-15-iteration-discipline.md`
+> **Parent spec:** `docs/specs/0031-iteration-discipline.md`
 > (scope-corrected at 2018178 + it.3-recon-corrected at 10a0595)
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
@@ -428,7 +428,7 @@ keep the heading, replace the body with "Superseded by the
 iteration-discipline milestone (2026-05-15): explicit tail calls
 were retired in favour of structural recursion (total by
 construction under Decision 10) + named `loop`/`recur`. See
-`docs/specs/2026-05-15-iteration-discipline.md`." EBNF block
+`docs/specs/0031-iteration-discipline.md`." EBNF block
 `:552–565`: remove `tail-app-term`/`tail-do-term` productions.
 §"Data model" `:2357–2359` (`"app"` tail jsonc + comment),
 `:2373–2375` (`"do"`), `:2452–2467` (the it.1/it.2 transitional
diff --git a/docs/plans/2026-05-16-iter-revert.md b/docs/plans/0074-iter-revert.md
similarity index 97%
rename from docs/plans/2026-05-16-iter-revert.md
rename to docs/plans/0074-iter-revert.md
index 00a9b93..4e9b6f4 100644
--- a/docs/plans/2026-05-16-iter-revert.md
+++ b/docs/plans/0074-iter-revert.md
@@ -1,6 +1,6 @@
 # Iteration-discipline revert — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-16-iteration-discipline-revert.md`
+> **Parent spec:** `docs/specs/0032-iteration-discipline-revert.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
@@ -340,7 +340,7 @@ Replace the current Decision 3 body (the it.2 paragraph "As of iter it.2 … unb
 Locate the clause-3 sentence at DESIGN.md ~105-110: *"The canonical worked example is the iteration story: a bare `while` over mutable state passes 1 and 2 yet fails 3 (it reinstates iterated-mutable-state reasoning); structural recursion over an acyclic ADT and a named loop/recur point pass all three (the bug class is closed by construction, not by advice)."*
 Replace with (hypothetical-illustration form — the `loop`/`recur` machinery no longer exists, so it must not read as shipped):
 
-> The criterion's discriminator is whether the wrong code fails to typecheck, not whether a guideline advises against it. Worked example: a bare `while` over mutable state would pass clauses 1 and 2 yet fail clause 3 (it reinstates iterated-mutable-state reasoning the pure core exists to remove); a hypothetical "all repetition is either structurally-decreasing recursion over an acyclic ADT or an explicit named loop" iteration story would, *if it could be built without a documented-unenforced precondition*, pass all three — and the fact that the 2026-05 attempt could not (it forced a silent-divergence precondition; see `docs/specs/2026-05-16-iteration-discipline-revert.md`) is itself the clause-3 mechanism working as intended.
+> The criterion's discriminator is whether the wrong code fails to typecheck, not whether a guideline advises against it. Worked example: a bare `while` over mutable state would pass clauses 1 and 2 yet fail clause 3 (it reinstates iterated-mutable-state reasoning the pure core exists to remove); a hypothetical "all repetition is either structurally-decreasing recursion over an acyclic ADT or an explicit named loop" iteration story would, *if it could be built without a documented-unenforced precondition*, pass all three — and the fact that the 2026-05 attempt could not (it forced a silent-divergence precondition; see `docs/specs/0032-iteration-discipline-revert.md`) is itself the clause-3 mechanism working as intended.
 
 - [ ] **Step 3: De-claim the brainstorm SKILL.md reference in lockstep**
 
@@ -348,7 +348,7 @@ In `skills/brainstorm/SKILL.md` ~107, change "(with the canonical worked example
 
 - [ ] **Step 4: Add the F1/F4 documentation note**
 
-In `docs/DESIGN.md`, in the §"Local mutable state" vicinity (after the bullet ending `Spec: docs/specs/2026-05-15-mut-local.md.` ~line 2918, before "Pipeline regression smoke tests:"), insert verbatim:
+In `docs/DESIGN.md`, in the §"Local mutable state" vicinity (after the bullet ending `Spec: docs/specs/0029-mut-local.md.` ~line 2918, before "Pipeline regression smoke tests:"), insert verbatim:
 
 > **Accumulator-over-iteration shape (documented idiom, not an enforced rule).** `mut`/`var`/`assign` removes friction from *straight-line* and *cascade-of-if* accumulators, but does **not** by itself express the "one running total updated once per loop iteration" shape: a `var` cannot be captured into a lambda (the seal) and there is no loop construct in the language. Until a future iteration-totality milestone lands (gated behind `Nat`/refinement types — see the deferred roadmap entry), the canonical pattern for the per-iteration accumulator is a tail-recursive helper that threads the running total as an explicit parameter; `examples/mut_counter.ail` is the reference. This is a documented authoring idiom, not a typecheck-enforced constraint — wrong code here does not fail to compile, it is merely less ergonomic, which is exactly why this is documentation and not a language rule.
 
@@ -388,7 +388,7 @@ Expected: PASS.
 
 **Files:**
 - Modify: `docs/roadmap.md` (remove the Iteration-discipline `[~]` entry + blocking-fork sub-section, contiguous ~43-178; add one deferred entry; KEEP F3 ~375-382 + Stateful-islands untouched)
-- Modify: `docs/specs/2026-05-15-iteration-discipline.md` (add superseded header — file is already clean; the A1 discard was done Boss-side pre-plan, so this is the ONLY edit to this file)
+- Modify: `docs/specs/0031-iteration-discipline.md` (add superseded header — file is already clean; the A1 discard was done Boss-side pre-plan, so this is the ONLY edit to this file)
 - Create: `docs/journals/2026-05-16-iter-revert.md` (the iter journal — written by the implement skill at iter close)
 - Modify: `docs/journals/INDEX.md` (append the new journal line)
 
@@ -409,7 +409,7 @@ Delete the contiguous `- [~] **[milestone]** Iteration discipline …` entry and
   SMT). Not abandoned; correctly sequenced after the type machinery.
   - depends on: a future `Nat`/refinement-types milestone (no spec
     yet).
-  - context: `docs/specs/2026-05-16-iteration-discipline-revert.md`
+  - context: `docs/specs/0032-iteration-discipline-revert.md`
     (why the 2026-05 attempt was reverted) and
     `docs/journals/2026-05-15-iter-it.3.md` (the branching-builder
     counter-example that surfaced the gap).
@@ -422,11 +422,11 @@ Expected: the F3 todo and the Stateful-islands milestone entry are still present
 
 - [ ] **Step 3: Add the superseded header to the old spec**
 
-At the very top of `docs/specs/2026-05-15-iteration-discipline.md` (before `# Iteration discipline — Design Spec`), insert verbatim:
+At the very top of `docs/specs/0031-iteration-discipline.md` (before `# Iteration discipline — Design Spec`), insert verbatim:
 
 ```markdown
 > **SUPERSEDED 2026-05-16 by
-> `docs/specs/2026-05-16-iteration-discipline-revert.md`.** This
+> `docs/specs/0032-iteration-discipline-revert.md`.** This
 > milestone was reverted in full (it.1 + it.2 backed out forward;
 > it.3 never ran). It is retained as a historical record of the
 > attempt and the design-thesis gap it surfaced; it is **not** the
@@ -437,7 +437,7 @@ At the very top of `docs/specs/2026-05-15-iteration-discipline.md` (before `# It
 
 - [ ] **Step 4: Confirm working tree of the old spec is otherwise clean**
 
-Run: `git diff --stat 1ff7e81 -- docs/specs/2026-05-15-iteration-discipline.md`
+Run: `git diff --stat 1ff7e81 -- docs/specs/0031-iteration-discipline.md`
 Expected: shows ONLY the spec's committed history relative to `1ff7e81` plus the new header line as a working-tree change — i.e. there is no residual A1 amendment (it was discarded Boss-side pre-plan). If unexpected uncommitted body changes appear, STOP and report.
 
 ---
diff --git a/docs/plans/2026-05-16-effect-doc-honesty.md b/docs/plans/0075-effect-doc-honesty.md
similarity index 100%
rename from docs/plans/2026-05-16-effect-doc-honesty.md
rename to docs/plans/0075-effect-doc-honesty.md
diff --git a/docs/plans/loop-recur.1.md b/docs/plans/0076-loop-recur.1.md
similarity index 99%
rename from docs/plans/loop-recur.1.md
rename to docs/plans/0076-loop-recur.1.md
index 395f1f3..6825ca3 100644
--- a/docs/plans/loop-recur.1.md
+++ b/docs/plans/0076-loop-recur.1.md
@@ -1,6 +1,6 @@
 # loop-recur.1 — Additive AST-Node Foundation — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-17-loop-recur.md`
+> **Parent spec:** `docs/specs/0034-loop-recur.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
@@ -211,7 +211,7 @@ line 542), before the enum's closing `}` (line 543), add:
     /// in this iter); codegen (loop-header + per-binder phi +
     /// back-edge) in iter 3 (`lower_term` stubs with
     /// `CodegenError::Internal`). No totality claim — an infinite
-    /// loop is legal. See `docs/specs/2026-05-17-loop-recur.md`.
+    /// loop is legal. See `docs/specs/0034-loop-recur.md`.
     Loop {
         binders: Vec<LoopBinder>,
         body: Box<Term>,
@@ -501,7 +501,7 @@ paragraph (ends line 326), add:
   both enforced at typecheck (`recur-arity-mismatch`,
   `recur-not-in-tail-position`). `loop`/`recur` make no termination
   claim: a `loop` with no non-`recur` exit runs forever. See
-  `docs/specs/2026-05-17-loop-recur.md`.
+  `docs/specs/0034-loop-recur.md`.
 ```
 
 - [ ] **Step 7: Run the parser test + surface build**
@@ -1471,7 +1471,7 @@ is 2422), before the closing ```` ``` ```` fence (line 2423), add:
 // non-`recur` branch. Strictly additive (no `skip_serializing_if`;
 // pre-existing fixtures hash bit-identically — none carry the tag).
 // No totality claim — an infinite loop is legal. See
-// `docs/specs/2026-05-17-loop-recur.md`.
+// `docs/specs/0034-loop-recur.md`.
 { "t": "loop",
   "binders": [ { "name": "<id>", "type": Type, "init": Term }, ... ],
   "body": Term }
@@ -1689,12 +1689,12 @@ Boss-call-1: `verify_tail_positions`' tail-app role is unchanged).
 
 ## Cross-references
 
-- Parent spec: `docs/specs/2026-05-17-loop-recur.md`
+- Parent spec: `docs/specs/0034-loop-recur.md`
   (Components 1/2/3/6 = this iter; Component 4 = iter 2;
   Component 5 = iter 3).
 - mut.1 precedent for the additive-node-across-no-wildcard-workspace
   pattern + the `Internal`-stub-at-the-two-dispatch-points shape:
-  `docs/specs/2026-05-15-mut-local.md` §"Iteration mut.1".
+  `docs/specs/0029-mut-local.md` §"Iteration mut.1".
 - Boss-call-1 (`verify_tail_positions` byte-unchanged reading) and
   Boss-call-2 (codegen in iter-1 as stubs) are recorded in the
   plan header above and must be mirrored into the per-iter journal
diff --git a/docs/plans/loop-recur.2.md b/docs/plans/0077-loop-recur.2.md
similarity index 99%
rename from docs/plans/loop-recur.2.md
rename to docs/plans/0077-loop-recur.2.md
index b93b592..1a88ce6 100644
--- a/docs/plans/loop-recur.2.md
+++ b/docs/plans/0077-loop-recur.2.md
@@ -1,6 +1,6 @@
 # loop-recur.2 — Typecheck Semantics (Component 4) — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-17-loop-recur.md`
+> **Parent spec:** `docs/specs/0034-loop-recur.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
@@ -1016,13 +1016,13 @@ spec's frozen-tail-app-role acceptance criterion).
 
 ## Cross-references
 
-- Parent spec `docs/specs/2026-05-17-loop-recur.md`
+- Parent spec `docs/specs/0034-loop-recur.md`
   (Component 4 = this iter; Component 5 codegen + the positive
   RUN-to-a-value / deep-`n` E2E = iter 3).
 - iter-1 (`a179ec3`) shipped the additive nodes + the `synth` /
   `lower_term` `Internal` stubs this iter's `synth` arm replaces
   (codegen stub stays).
-- mut.2 (`docs/specs/2026-05-15-mut-local.md`) is the structural
+- mut.2 (`docs/specs/0029-mut-local.md`) is the structural
   precedent: `mut_scope_stack` threading discipline, the
   variant/`code()`/`ctx()`/bracket-free-Display pattern, the
   `.ail.json` negative-fixture + `carve_out_inventory` +
diff --git a/docs/plans/loop-recur.3.md b/docs/plans/0078-loop-recur.3.md
similarity index 99%
rename from docs/plans/loop-recur.3.md
rename to docs/plans/0078-loop-recur.3.md
index f90895e..a0e5e9a 100644
--- a/docs/plans/loop-recur.3.md
+++ b/docs/plans/0078-loop-recur.3.md
@@ -1,6 +1,6 @@
 # loop-recur.3 — Codegen (Component 5) + run-to-value E2E — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-17-loop-recur.md`
+> **Parent spec:** `docs/specs/0034-loop-recur.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
@@ -600,13 +600,13 @@ now covering runnable loop/recur programs).
 
 ## Cross-references
 
-- Parent spec `docs/specs/2026-05-17-loop-recur.md` (Component 5 +
+- Parent spec `docs/specs/0034-loop-recur.md` (Component 5 +
   Positive E2E = this iter; this is the milestone's TERMINAL
   iteration — after it ships the milestone CLOSES and the Boss
   runs `audit`, then `fieldtest` since loop/recur is user-visible
   Form-A surface; that pipeline is the Boss's post-iter call, NOT
   part of this plan).
-- mut.3 (`docs/specs/2026-05-15-mut-local.md`) is the codegen
+- mut.3 (`docs/specs/0029-mut-local.md`) is the codegen
   precedent: `pending_entry_allocas` entry-block hoist,
   `mut_var_allocas` save/restore, the lambda-boundary
   save/reset/restore triple. loop-recur.3 reuses the *mechanism*;
diff --git a/docs/plans/prose-loop-binders.1.md b/docs/plans/0079-prose-loop-binders.1.md
similarity index 98%
rename from docs/plans/prose-loop-binders.1.md
rename to docs/plans/0079-prose-loop-binders.1.md
index c5a335a..da58a8f 100644
--- a/docs/plans/prose-loop-binders.1.md
+++ b/docs/plans/0079-prose-loop-binders.1.md
@@ -1,6 +1,6 @@
 # prose-loop-binders.1 — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-18-prose-loop-binders.md`
+> **Parent spec:** `docs/specs/0036-prose-loop-binders.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
@@ -257,7 +257,7 @@ nothing else:
 ```
 
 (Order may differ. The plan file
-`docs/plans/prose-loop-binders.1.md` is already committed by the
+`docs/plans/0079-prose-loop-binders.1.md` is already committed by the
 Boss before this run, so it does NOT appear here — its absence is
 expected, not an anomaly. `docs/journals/` + stats files added by
 the implement skill are also expected and fine.) Crucially: NO other
diff --git a/docs/plans/remove-mut-var-assign.1.md b/docs/plans/0080-remove-mut-var-assign.1.md
similarity index 99%
rename from docs/plans/remove-mut-var-assign.1.md
rename to docs/plans/0080-remove-mut-var-assign.1.md
index c925c8a..86dbe24 100644
--- a/docs/plans/remove-mut-var-assign.1.md
+++ b/docs/plans/0080-remove-mut-var-assign.1.md
@@ -1,6 +1,6 @@
 # Remove `mut` / `var` / `assign` — Implementation Plan (iteration 1, terminal)
 
-> **Parent spec:** `docs/specs/2026-05-18-remove-mut-var-assign.md`
+> **Parent spec:** `docs/specs/0037-remove-mut-var-assign.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
diff --git a/docs/plans/docs-honesty-lint.1.md b/docs/plans/0081-docs-honesty-lint.1.md
similarity index 99%
rename from docs/plans/docs-honesty-lint.1.md
rename to docs/plans/0081-docs-honesty-lint.1.md
index 38155d6..10c9fb9 100644
--- a/docs/plans/docs-honesty-lint.1.md
+++ b/docs/plans/0081-docs-honesty-lint.1.md
@@ -1,6 +1,6 @@
 # docs-honesty-lint.1 — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-18-docs-honesty-lint.md`
+> **Parent spec:** `docs/specs/0039-docs-honesty-lint.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
@@ -787,7 +787,7 @@ Append immediately after that entry's last line:
   Relocated here from DESIGN.md §"prose roundtrip" + PROSE_ROUNDTRIP.md
   by the docs-honesty-lint milestone (forward intent does not live in
   the canonical docs).
-  - context: `docs/specs/2026-05-18-docs-honesty-lint.md`
+  - context: `docs/specs/0039-docs-honesty-lint.md`
 ```
 
 - [ ] **Step 3: Re-run the full pin — all four tests GREEN**
diff --git a/docs/plans/embedding-abi-m1.1.md b/docs/plans/0082-embedding-abi-m1.1.md
similarity index 99%
rename from docs/plans/embedding-abi-m1.1.md
rename to docs/plans/0082-embedding-abi-m1.1.md
index a5cd64e..ae1d3fb 100644
--- a/docs/plans/embedding-abi-m1.1.md
+++ b/docs/plans/0082-embedding-abi-m1.1.md
@@ -1,6 +1,6 @@
 # Embedding ABI — M1.1 — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-18-embedding-abi-m1.md`
+> **Parent spec:** `docs/specs/0040-embedding-abi-m1.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
diff --git a/docs/plans/form-a-scalar-param-mode-carveout.md b/docs/plans/0083-form-a-scalar-param-mode-carveout.md
similarity index 99%
rename from docs/plans/form-a-scalar-param-mode-carveout.md
rename to docs/plans/0083-form-a-scalar-param-mode-carveout.md
index 46982d5..a0dddef 100644
--- a/docs/plans/form-a-scalar-param-mode-carveout.md
+++ b/docs/plans/0083-form-a-scalar-param-mode-carveout.md
@@ -1,6 +1,6 @@
 # form_a.md scalar-parameter mode carve-out — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-18-fieldtest-embedding-abi-m1.md`
+> **Parent spec:** `docs/specs/0041-fieldtest-embedding-abi-m1.md`
 > (findings **[friction]** "The published authoring rule steers an LLM
 > away from the only spelling that works for scalar export params" +
 > **[spec_gap]#1** "form_a.md mandates a mode on every fn param;
diff --git a/docs/plans/emit-ir-staticlib.md b/docs/plans/0084-emit-ir-staticlib.md
similarity index 99%
rename from docs/plans/emit-ir-staticlib.md
rename to docs/plans/0084-emit-ir-staticlib.md
index b40f262..42c63c7 100644
--- a/docs/plans/emit-ir-staticlib.md
+++ b/docs/plans/0084-emit-ir-staticlib.md
@@ -1,6 +1,6 @@
 # emit-ir --emit=staticlib — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-18-fieldtest-embedding-abi-m1.md`
+> **Parent spec:** `docs/specs/0041-fieldtest-embedding-abi-m1.md`
 > (finding **[spec_gap]#2** "No public path emits the staticlib IR,
 > though DESIGN.md Decision 5 makes IR readability a first-class LLM
 > affordance"). Orchestrator resolution recorded in `docs/roadmap.md`
diff --git a/docs/plans/embedding-abi-m2.1.md b/docs/plans/0085-embedding-abi-m2.1.md
similarity index 99%
rename from docs/plans/embedding-abi-m2.1.md
rename to docs/plans/0085-embedding-abi-m2.1.md
index 335c77c..ec1963c 100644
--- a/docs/plans/embedding-abi-m2.1.md
+++ b/docs/plans/0085-embedding-abi-m2.1.md
@@ -1,6 +1,6 @@
 # Embedding ABI — M2.1: per-thread runtime context + concurrency safety — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-18-embedding-abi-m2.md`
+> **Parent spec:** `docs/specs/0042-embedding-abi-m2.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
diff --git a/docs/plans/embedding-abi-m2.tidy.md b/docs/plans/0086-embedding-abi-m2.tidy.md
similarity index 100%
rename from docs/plans/embedding-abi-m2.tidy.md
rename to docs/plans/0086-embedding-abi-m2.tidy.md
diff --git a/docs/plans/embedding-abi-m3.1.md b/docs/plans/0087-embedding-abi-m3.1.md
similarity index 99%
rename from docs/plans/embedding-abi-m3.1.md
rename to docs/plans/0087-embedding-abi-m3.1.md
index 87a07c1..645be57 100644
--- a/docs/plans/embedding-abi-m3.1.md
+++ b/docs/plans/0087-embedding-abi-m3.1.md
@@ -1,6 +1,6 @@
 # Embedding ABI — M3.1 — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-18-embedding-abi-m3.md`
+> **Parent spec:** `docs/specs/0043-embedding-abi-m3.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
diff --git a/docs/plans/embedding-abi-m3.tidy.md b/docs/plans/0088-embedding-abi-m3.tidy.md
similarity index 99%
rename from docs/plans/embedding-abi-m3.tidy.md
rename to docs/plans/0088-embedding-abi-m3.tidy.md
index 47073b7..b3d9029 100644
--- a/docs/plans/embedding-abi-m3.tidy.md
+++ b/docs/plans/0088-embedding-abi-m3.tidy.md
@@ -1,6 +1,6 @@
 # Embedding ABI — M3.tidy — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-18-embedding-abi-m3.md`
+> **Parent spec:** `docs/specs/0043-embedding-abi-m3.md`
 > (the milestone whose §"Embedding ABI" surface this reconciles);
 > scoping source-of-truth: `docs/journals/2026-05-18-audit-embedding-abi-m3.md`.
 >
diff --git a/docs/plans/embedding-abi-m5.1.md b/docs/plans/0089-embedding-abi-m5.1.md
similarity index 99%
rename from docs/plans/embedding-abi-m5.1.md
rename to docs/plans/0089-embedding-abi-m5.1.md
index 24e988d..9649447 100644
--- a/docs/plans/embedding-abi-m5.1.md
+++ b/docs/plans/0089-embedding-abi-m5.1.md
@@ -1,6 +1,6 @@
 # embedding-abi-m5.1 — lean `ail-embed` core + build.rs + hermetic smoke — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-19-embedding-abi-m5.md`
+> **Parent spec:** `docs/specs/0044-embedding-abi-m5.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
@@ -188,7 +188,7 @@ members = [
 ]
 # `ail-embed/` is intentionally NOT a member: it depends on the
 # external `../libs/data-server` and is the sole data-server↔AILang
-# meeting point (Invariant 1, docs/specs/2026-05-19-embedding-abi-m5.md).
+# meeting point (Invariant 1, docs/specs/0044-embedding-abi-m5.md).
 # Adding it here would couple the compiler workspace to a sibling dir.
 ```
 
diff --git a/docs/plans/embedding-abi-m5.2.md b/docs/plans/0090-embedding-abi-m5.2.md
similarity index 99%
rename from docs/plans/embedding-abi-m5.2.md
rename to docs/plans/0090-embedding-abi-m5.2.md
index eedba03..b99b8fc 100644
--- a/docs/plans/embedding-abi-m5.2.md
+++ b/docs/plans/0090-embedding-abi-m5.2.md
@@ -1,6 +1,6 @@
 # embedding-abi-m5.2 — data-server adapter + symbol-fan swarm + leak-proof — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-19-embedding-abi-m5.md`
+> **Parent spec:** `docs/specs/0044-embedding-abi-m5.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
diff --git a/docs/plans/embedding-abi-m5.3.md b/docs/plans/0091-embedding-abi-m5.3.md
similarity index 99%
rename from docs/plans/embedding-abi-m5.3.md
rename to docs/plans/0091-embedding-abi-m5.3.md
index e53515e..424dbfa 100644
--- a/docs/plans/embedding-abi-m5.3.md
+++ b/docs/plans/0091-embedding-abi-m5.3.md
@@ -1,6 +1,6 @@
 # embedding-abi-m5.3 — time-shard boundary-invisibility proof + friction harvest — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-19-embedding-abi-m5.md`
+> **Parent spec:** `docs/specs/0044-embedding-abi-m5.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
diff --git a/docs/plans/embedding-abi-m5.tidy.md b/docs/plans/0092-embedding-abi-m5.tidy.md
similarity index 100%
rename from docs/plans/embedding-abi-m5.tidy.md
rename to docs/plans/0092-embedding-abi-m5.tidy.md
diff --git a/docs/plans/design-md-rolesplit.1.md b/docs/plans/0093-design-md-rolesplit.1.md
similarity index 92%
rename from docs/plans/design-md-rolesplit.1.md
rename to docs/plans/0093-design-md-rolesplit.1.md
index f03ff98..418a5cf 100644
--- a/docs/plans/design-md-rolesplit.1.md
+++ b/docs/plans/0093-design-md-rolesplit.1.md
@@ -1,6 +1,6 @@
 # DESIGN.md → `design/` role-split — Implementation Plan (iter 1, the whole milestone)
 
-> **Parent spec:** `docs/specs/2026-05-19-design-md-rolesplit.md`
+> **Parent spec:** `docs/specs/0045-design-md-rolesplit.md`
 > (incl. the authoritative **Appendix — Boss-adjudicated relocation
 > map**; grounding-check PASS ×2).
 >
@@ -15,7 +15,7 @@ build-atomic shape.
 
 **Architecture:** The spec Appendix table is the per-`##`/`###`
 relocation map (line ranges → destination); this plan executes it.
-Build-atomicity is achieved *by task ordering*: `design/contracts/data-model.md`
+Build-atomicity is achieved *by task ordering*: `design/contracts/0002-data-model.md`
 is created (Task 2) and `design_schema_drift.rs`'s `include_str!`
 retargeted to it (Task 5) **before** `docs/DESIGN.md` is deleted
 (Task 9), so the workspace compiles at every task boundary. The
@@ -49,7 +49,7 @@ no content edits except (a) heading level, (b) `honesty-rule.md` is
 //! docs_honesty_pin.rs. Fails RED the instant the design/ split
 //! re-conflates contract + rationale + narrative, an INDEX row
 //! dangles, a contract loses its ratifying test, or docs/DESIGN.md
-//! is resurrected. Spec: docs/specs/2026-05-19-design-md-rolesplit.md.
+//! is resurrected. Spec: docs/specs/0045-design-md-rolesplit.md.
 
 use std::fs;
 use std::path::{Path, PathBuf};
@@ -275,7 +275,7 @@ this file). Files and their Appendix-sourced ranges:
 Each file starts `# <Title>` and ends with a line
 `Ratified by: <the INDEX ratifying-test path for this contract>.`
 
-- [ ] **Step 4: Write the rewritten `design/contracts/honesty-rule.md`**
+- [ ] **Step 4: Write the rewritten `design/contracts/0007-honesty-rule.md`**
 
 Do NOT raw-move DESIGN.md:56–82. Rewrite so the rule names the new
 home. The two `docs_honesty_pin.rs:70,72` anchors MUST appear as
@@ -421,7 +421,7 @@ Line 22, exact before → after:
 
 ```rust
 - const DESIGN_MD: &str = include_str!("../../../docs/DESIGN.md");
-+ const DATA_MODEL: &str = include_str!("../../../design/contracts/data-model.md");
++ const DATA_MODEL: &str = include_str!("../../../design/contracts/0002-data-model.md");
 ```
 
 Delete `fn data_model_section()` (lines 28–37) and
@@ -430,7 +430,7 @@ anchor tests (`design_md_anchors_every_term_variant` :43,
 `…pattern…` :185, `…type…` :214, `…literal…` :248, `…def_kind`
 :277, `…parammode…` :348, `…nested_struct_keys` :373) replace every
 `data_model_section()` call with the const `DATA_MODEL`. Update the
-module rustdoc (:1,3,11) "DESIGN.md §Data model" → "design/contracts/data-model.md".
+module rustdoc (:1,3,11) "DESIGN.md §Data model" → "design/contracts/0002-data-model.md".
 
 - [ ] **Step 2: Retarget `docs_honesty_pin.rs` per-sentence home**
 
@@ -440,19 +440,19 @@ file where that test's pinned strings now live (per spec Appendix):
 - `design_md_has_no_wunschdenken` (:30) and
   `design_md_has_no_doc_archaeology` (:51): absent-pins span
   Boehm/float/typeclasses/effects/Form-B — read the concatenation
-  of `design/models/rc-uniqueness.md`, `design/contracts/float-semantics.md`,
-  `design/contracts/typeclasses.md`, `design/models/effects.md`,
-  `design/models/authoring-surface.md` (absent-pins must be absent
+  of `design/models/0004-rc-uniqueness.md`, `design/contracts/0005-float-semantics.md`,
+  `design/contracts/0013-typeclasses.md`, `design/models/0002-effects.md`,
+  `design/models/0001-authoring-surface.md` (absent-pins must be absent
   from all → join the reads).
 - `design_md_present_tense_anchors_present` (:68): split per anchor
   to its home file; **:70** `"the honesty rule it holds itself to"`
   and **:72** `"whether the document asserts something exists,
-  works, or changed that does not"` → read `design/contracts/honesty-rule.md`;
-  the Form-B placeholder anchor (:90 area) → `design/models/authoring-surface.md`;
+  works, or changed that does not"` → read `design/contracts/0007-honesty-rule.md`;
+  the Form-B placeholder anchor (:90 area) → `design/models/0001-authoring-surface.md`;
   the remaining present-anchors → their Appendix home file.
 - `form_a_scalar_param_carveout_present_and_old_rule_absent`
   (:104–137): the `FORM_A_SPEC` read is unchanged; the
-  `read("docs/DESIGN.md")` at :112 → `design/contracts/embedding-abi.md`
+  `read("docs/DESIGN.md")` at :112 → `design/contracts/0003-embedding-abi.md`
   (the `:135` pin `Export parameters are written **bare**…` lives
   in `## Embedding ABI`, Appendix → embedding-abi.md).
 - `prose_roundtrip_md_has_no_wunschdenken` (:94–101): reads
@@ -464,13 +464,13 @@ file where that test's pinned strings now live (per spec Appendix):
 
 ```rust
 - let d = read("docs/DESIGN.md");
-+ let d = norm(&[read("design/models/effects.md"),
-+               read("design/contracts/scope-boundaries.md")].join("\n"));
++ let d = norm(&[read("design/models/0002-effects.md"),
++               read("design/contracts/0010-scope-boundaries.md")].join("\n"));
 ```
 
-(Decision 3 effect prose → `models/effects.md`; the
+(Decision 3 effect prose → `models/0002-effects.md`; the
 `"the built-in IO and Diverge ops"` absent-pin's home
-`## What is not (yet) supported` → `contracts/scope-boundaries.md`.
+`## What is not (yet) supported` → `contracts/0010-scope-boundaries.md`.
 Adjust the existing `norm()` usage in the test so the join is
 normalised once; keep every pinned string assertion unchanged.)
 
@@ -480,7 +480,7 @@ Run: `cargo test -p ailang-core --test design_schema_drift --test docs_honesty_p
 Expected: PASS for all three (they now read `design/` files which
 exist from Tasks 2–3; `docs/DESIGN.md` still on disk but no longer
 read by these tests). `cargo build --workspace` still green
-(`include_str!` now points at the existing `design/contracts/data-model.md`).
+(`include_str!` now points at the existing `design/contracts/0002-data-model.md`).
 
 ---
 
@@ -497,13 +497,13 @@ read by these tests). `cargo build --workspace` still green
 
 ```rust
 -                     orderability per IEEE-754); see DESIGN.md §\"Float semantics\".",
-+                     orderability per IEEE-754); see design/contracts/float-semantics.md.",
++                     orderability per IEEE-754); see design/contracts/0005-float-semantics.md.",
 ```
 
 - [ ] **Step 2: Retarget the Show-branch diagnostic (contiguity-safe)**
 
 `crates/ailang-check/src/lib.rs` Show branch. The path
-`design/contracts/typeclasses.md` MUST contain no interior literal
+`design/contracts/0013-typeclasses.md` MUST contain no interior literal
 whitespace and must not be split by a `\`-continuation in a way
 that injects a space (Rust `\`-continuation strips the newline +
 leading indent, so keep the full path token on one physical source
@@ -512,11 +512,11 @@ line). Exact:
 ```rust
 -                     the prelude; see DESIGN.md §\"Prelude (built-in) \
 -                     classes\". User types declare their own \
-+                     the prelude; see design/contracts/typeclasses.md. \
++                     the prelude; see design/contracts/0013-typeclasses.md. \
 +                     User types declare their own \
 ```
 
-(Runtime string becomes `…the prelude; see design/contracts/typeclasses.md. User types declare their own …` — the path is one contiguous run; the E2E `contains("design/contracts/typeclasses.md")` holds.)
+(Runtime string becomes `…the prelude; see design/contracts/0013-typeclasses.md. User types declare their own …` — the path is one contiguous run; the E2E `contains("design/contracts/0013-typeclasses.md")` holds.)
 
 - [ ] **Step 3: Retarget the two E2E assertions (lockstep)**
 
@@ -525,7 +525,7 @@ line). Exact:
 ```rust
 -        no_inst.message.contains("Float semantics") || no_inst.message.contains("DESIGN"),
 -        "expected NoInstance message to cross-reference DESIGN.md §Float semantics, got: {:?}",
-+        no_inst.message.contains("design/contracts/float-semantics.md"),
++        no_inst.message.contains("design/contracts/0005-float-semantics.md"),
 +        "expected NoInstance message to cross-reference the float-semantics contract, got: {:?}",
 ```
 
@@ -534,8 +534,8 @@ line). Exact:
 ```rust
 -        no_inst.message.contains("Prelude (built-in) classes"),
 -        "expected DESIGN.md §Prelude (built-in) classes cross-reference, got message: {:?}",
-+        no_inst.message.contains("design/contracts/typeclasses.md"),
-+        "expected design/contracts/typeclasses.md cross-reference, got message: {:?}",
++        no_inst.message.contains("design/contracts/0013-typeclasses.md"),
++        "expected design/contracts/0013-typeclasses.md cross-reference, got message: {:?}",
 ```
 
 Also update the module-rustdoc / comment lines in both E2E files
@@ -632,7 +632,7 @@ exit-2 / Sweep-5 references): replace "DESIGN.md" with
 Per spec §4: `grounding-check` (`:34`) and architect read
 `design/contracts/`; `fieldtester` (`:41`, no-edit limit `:255`
 preserved) reads `design/INDEX.md` + `design/models/`; `bencher`
-(`:38`) reads `design/models/rc-uniqueness.md` (Decision-9/Boehm
+(`:38`) reads `design/models/0004-rc-uniqueness.md` (Decision-9/Boehm
 narrative); `debugger` (`:29`), `tester` (`:26`), `implementer`
 (`:30`), `implement-orchestrator` (`:35`), `spec-reviewer` (`:34`),
 `quality-reviewer` (`:32`), `plan-recon` (`:34,72,147`),
@@ -647,7 +647,7 @@ Replace every live `docs/DESIGN.md` reference in
 `skills/README.md` with `design/INDEX.md` (or the specific
 `design/contracts/<x>.md` where the prose names a section, e.g.
 `boss/SKILL.md:284` "Canonical feature-acceptance criterion" →
-`design/contracts/feature-acceptance.md`). `CLAUDE.md`: `:45`
+`design/contracts/0004-feature-acceptance.md`). `CLAUDE.md`: `:45`
 code-layout table row, the `## Roles of docs/DESIGN.md …` heading
 and its paragraph (:199–212) → rewrite to describe the `design/`
 ledger (DESIGN = current-state mirror discipline preserved, just
@@ -657,29 +657,29 @@ re-homed); `:78,178` inline refs → `design/INDEX.md`.
 
 Replace `DESIGN.md §"X"` → the Appendix destination
 (`design/contracts/<x>.md` or `design/models/<x>.md`) in: `ail-embed/src/lib.rs:4,35,91`
-(drop the DESIGN.md line-number cites — `→ design/contracts/frozen-value-layout.md`);
+(drop the DESIGN.md line-number cites — `→ design/contracts/0006-frozen-value-layout.md`);
 `crates/ailang-check/src/lib.rs:449,861,882,2647,6336`;
 `crates/ailang-check/tests/duplicate_ctor_pin.rs:4` (→ env-construction
 source-link note); `crates/ailang-codegen/src/drop.rs:88,114`,
 `lib.rs:178,685`, `match_lower.rs:107`;
 `crates/ailang-codegen/tests/embed_record_layout_pin.rs:1`,
 `embed_staticlib_lowering.rs:47`; `crates/ailang-core/src/ast.rs:3`
-(→ `design/contracts/data-model.md`), `:211`;
+(→ `design/contracts/0002-data-model.md`), `:211`;
 `crates/ailang-surface/src/lib.rs:7`, `parse.rs:78,81`,
 `print.rs:128`; `crates/ailang-surface/tests/round_trip.rs:10,72`
-(→ `design/contracts/roundtrip-invariant.md`);
+(→ `design/contracts/0009-roundtrip-invariant.md`);
 `crates/ail/src/main.rs:1393` (→ qualified-xref source-link),
 `:1572`; `crates/ail/tests/codegen_import_map_fallback_pin.rs:2`,
 `polyfn_dot_qualified_branch_pin.rs:2` (→
-`design/contracts/typeclasses.md`), `e2e.rs:2843` (→
-`design/contracts/str-abi.md`), `eq_ord_e2e.rs:89,110` (→ mangling
+`design/contracts/0013-typeclasses.md`), `e2e.rs:2843` (→
+`design/contracts/0011-str-abi.md`), `eq_ord_e2e.rs:89,110` (→ mangling
 source-link), `embed/record_roundtrip.c:2`, `embed/tick_roundtrip.c:6`
-(→ `design/contracts/frozen-value-layout.md`);
+(→ `design/contracts/0006-frozen-value-layout.md`);
 `examples/fieldtest/floats_3_safe_division.ail:19`,
 `floats_4_float_to_str_reach.ail:6` (→
-`design/contracts/float-semantics.md`); `runtime/rc.c:41` (→
-`design/contracts/frozen-value-layout.md`), `runtime/str.c:172,198`
-(→ `design/contracts/str-abi.md`);
+`design/contracts/0005-float-semantics.md`); `runtime/rc.c:41` (→
+`design/contracts/0006-frozen-value-layout.md`), `runtime/str.c:172,198`
+(→ `design/contracts/0011-str-abi.md`);
 `crates/ailang-core/specs/form_a.md:89`.
 
 **OQ7 — delete, not retarget:** `crates/ailang-codegen/src/lib.rs:103`
@@ -714,7 +714,7 @@ Run: `cargo build --workspace 2>&1 | tail -3`
 Expected: `Finished …` with **0 errors**. This proves
 build-atomicity: the only compile-time consumer
 (`design_schema_drift.rs` `include_str!`) was retargeted in Task 5
-to the now-existing `design/contracts/data-model.md`, so deleting
+to the now-existing `design/contracts/0002-data-model.md`, so deleting
 `docs/DESIGN.md` does not break the build.
 
 - [ ] **Step 3: Whole-suite GREEN incl. the design_index_pin spine**
@@ -767,13 +767,13 @@ Expected: `exit=0` (all five sweeps clean against the migrated
    deletion in the working tree; the Boss commits the iter). ✓
 6. **Pin/replacement contiguity:** Task 2 Step 4 keeps the two
    `docs_honesty_pin.rs:70,72` phrases each on one physical line;
-   Task 6 Step 2 keeps `design/contracts/typeclasses.md` a
+   Task 6 Step 2 keeps `design/contracts/0013-typeclasses.md` a
    whitespace-free contiguous token across the `\`-continuation
    (the recurring grep/line-wrap family — scrubbed). ✓
 7. **Compile-gate vs deferred-caller:** the only compile-time
    coupling is `design_schema_drift.rs` `include_str!` ↔
    `docs/DESIGN.md` deletion. Task 5 retargets the `include_str!`
-   to the already-created `design/contracts/data-model.md` (Task 2)
+   to the already-created `design/contracts/0002-data-model.md` (Task 2)
    **before** Task 9 deletes the file. No task's build/test gate
    depends on a step a later task performs: Tasks 1–8 keep
    `docs/DESIGN.md` on disk, so every intermediate `cargo build` is
diff --git a/docs/plans/design-md-rolesplit.tidy.md b/docs/plans/0094-design-md-rolesplit.tidy.md
similarity index 95%
rename from docs/plans/design-md-rolesplit.tidy.md
rename to docs/plans/0094-design-md-rolesplit.tidy.md
index 61dde2e..7c6c7c2 100644
--- a/docs/plans/design-md-rolesplit.tidy.md
+++ b/docs/plans/0094-design-md-rolesplit.tidy.md
@@ -1,6 +1,6 @@
 # design-md-rolesplit.tidy — Implementation Plan (audit drift fix)
 
-> **Parent spec:** `docs/specs/2026-05-19-design-md-rolesplit.md`
+> **Parent spec:** `docs/specs/0045-design-md-rolesplit.md`
 > **Scope authority:** `docs/journals/2026-05-19-audit-design-md-rolesplit.md`
 > "Resolution" (committed 2ba5e16) — the architect `[medium]`+`[low]`
 > drift fix, 5 orchestrator-decided points.
@@ -201,10 +201,10 @@ Expected: those 3 still `ok` (only clause-3 RED). `cargo build -p ailang-core --
 
 ---
 
-## Task 2: strip history prose from `design/contracts/typeclasses.md`
+## Task 2: strip history prose from `design/contracts/0013-typeclasses.md`
 
 **Files:**
-- Modify: `design/contracts/typeclasses.md` (:77-78, :182-186, :197-200, :279-289, :291-300, :302-317 — recon's complete scan)
+- Modify: `design/contracts/0013-typeclasses.md` (:77-78, :182-186, :197-200, :279-289, :291-300, :302-317 — recon's complete scan)
 - Modify: `docs/journals/2026-05-19-design-decision-records.md` (append at EOF, after :431)
 
 - [ ] **Step 1: Append the migrated typeclasses history to the decision-record journal**
@@ -252,15 +252,15 @@ history clause:
 
 Run: `cargo test -p ailang-core --test docs_honesty_pin 2>&1 | grep -E 'test result:'`
 Expected: PASS (the `io/print_str…` pinned run intact). Run
-`grep -n 'io/print_str` is the only built-in direct-output effect-op' design/contracts/typeclasses.md`
+`grep -n 'io/print_str` is the only built-in direct-output effect-op' design/contracts/0013-typeclasses.md`
 Expected: exactly one contiguous match (pin survived).
 
 ---
 
-## Task 3: strip history prose from `design/contracts/str-abi.md`
+## Task 3: strip history prose from `design/contracts/0011-str-abi.md`
 
 **Files:**
-- Modify: `design/contracts/str-abi.md` (:14, :16, :18, :20, :22-23, :74, :38-43, :45-47)
+- Modify: `design/contracts/0011-str-abi.md` (:14, :16, :18, :20, :22-23, :74, :38-43, :45-47)
 - Modify: `docs/journals/2026-05-19-design-decision-records.md` (append under the tidy section)
 
 - [ ] **Step 1: Append str-abi history to the journal**
@@ -294,16 +294,16 @@ overloading would invoke literal-defaulting which axis-7 excluded.
 
 - [ ] **Step 3: Verify str-abi pin intact**
 
-Run: `grep -n 'type-installed; codegen is reserved and not yet shipped' design/contracts/str-abi.md`
+Run: `grep -n 'type-installed; codegen is reserved and not yet shipped' design/contracts/0011-str-abi.md`
 Expected: exactly one contiguous match. Run
 `cargo test -p ailang-core --test docs_honesty_pin 2>&1 | grep 'test result:'` → PASS.
 
 ---
 
-## Task 4: strip history prose from `design/contracts/scope-boundaries.md`
+## Task 4: strip history prose from `design/contracts/0010-scope-boundaries.md`
 
 **Files:**
-- Modify: `design/contracts/scope-boundaries.md` (:5-6, :14-17, :36-38)
+- Modify: `design/contracts/0010-scope-boundaries.md` (:5-6, :14-17, :36-38)
 - Modify: `docs/journals/2026-05-19-design-decision-records.md` (append under the tidy section)
 
 - [ ] **Step 1: Append scope-boundaries history to the journal**
@@ -326,30 +326,30 @@ rpe.1 (the polymorphic `print` is the canonical non-Str output path).
 
 - [ ] **Step 3: Over-strip guard — the Diverge pin must be untouched**
 
-Run: `grep -n 'Diverge` is a reserved effect name with no op and no codegen' design/contracts/scope-boundaries.md`
+Run: `grep -n 'Diverge` is a reserved effect name with no op and no codegen' design/contracts/0010-scope-boundaries.md`
 Expected: exactly one match at the original location (`:9`,
 unedited — it is NOT in any edit span; this guards against
 collateral deletion). `cargo test -p ailang-core --test effect_doc_honesty_pin 2>&1 | grep 'test result:'` → PASS.
 
 ---
 
-## Task 5: fix the stale cross-ref in `design/contracts/float-semantics.md`
+## Task 5: fix the stale cross-ref in `design/contracts/0005-float-semantics.md`
 
 **Files:**
-- Modify: `design/contracts/float-semantics.md:100`
+- Modify: `design/contracts/0005-float-semantics.md:100`
 
 - [ ] **Step 1: Repoint the stale "below" direction**
 
 `:99-100` verbatim `Both allocate a fresh heap-Str slab at the call
 site (see "Str ABI" below for the dual realisation) and carry
 `ret_mode: Own`…`. Replace `(see "Str ABI" below for the dual
-realisation)` → `(see design/contracts/str-abi.md for the dual
-realisation)`. (`design/contracts/str-abi.md` exists — confirmed
+realisation)` → `(see design/contracts/0011-str-abi.md for the dual
+realisation)`. (`design/contracts/0011-str-abi.md` exists — confirmed
 recon; INDEX row `design/INDEX.md:93`.)
 
 - [ ] **Step 2: Verify float-semantics pin intact + no stale "below"**
 
-Run: `grep -n '"Str ABI" below' design/contracts/float-semantics.md || echo "CLEAN: stale below gone"`
+Run: `grep -n '"Str ABI" below' design/contracts/0005-float-semantics.md || echo "CLEAN: stale below gone"`
 Expected: `CLEAN: stale below gone`. Run
 `cargo test -p ail --test eq_float_noinstance 2>&1 | grep 'test result:'` → PASS.
 
@@ -367,8 +367,8 @@ Expected: `CLEAN: stale below gone`. Run
 > milestone exists to remove. Strip + journal-note for completeness.
 
 **Files:**
-- Modify: `design/contracts/roundtrip-invariant.md:73`
-- Modify: `design/contracts/data-model.md:149,161`
+- Modify: `design/contracts/0009-roundtrip-invariant.md:73`
+- Modify: `design/contracts/0002-data-model.md:149,161`
 - Modify: `docs/journals/2026-05-19-design-decision-records.md` (append under the tidy section)
 
 - [ ] **Step 1: Append the provenance to the journal**
@@ -493,7 +493,7 @@ Expected: `CLEAN` (no live-ref regression from the tidy edits).
    points covered, scope corrected on evidence. ✓
 2. **Placeholder scan:** no TBD/TODO/"similar to". Every strip names
    the exact recon line + verbatim before→after text. ✓
-3. **Type/path consistency:** `design/contracts/str-abi.md`,
+3. **Type/path consistency:** `design/contracts/0011-str-abi.md`,
    `docs/journals/2026-05-19-design-decision-records.md`,
    `contracts_carry_no_decision_record_prose` used identically
    across tasks; the journal append section header
diff --git a/docs/plans/design-ledger-formal-links.1.md b/docs/plans/0095-design-ledger-formal-links.1.md
similarity index 86%
rename from docs/plans/design-ledger-formal-links.1.md
rename to docs/plans/0095-design-ledger-formal-links.1.md
index d450358..d384f33 100644
--- a/docs/plans/design-ledger-formal-links.1.md
+++ b/docs/plans/0095-design-ledger-formal-links.1.md
@@ -1,6 +1,6 @@
 # design-ledger-formal-links.1 — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-19-design-ledger-formal-links.md` (HEAD `42ff44a`; grounding-check PASS ×3 across two corpus-grounded amendments — clause-6 + cross-ref definition, then clause-5 fence-skip + closed convert-set enumeration)
+> **Parent spec:** `docs/specs/0046-design-ledger-formal-links.md` (HEAD `42ff44a`; grounding-check PASS ×3 across two corpus-grounded amendments — clause-6 + cross-ref definition, then clause-5 fence-skip + closed convert-set enumeration)
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement` to run this plan. Steps use `- [ ]` checkboxes for tracking.
 
@@ -16,16 +16,16 @@
 
 - Modify: `crates/ailang-core/tests/design_index_pin.rs:1-5` — extend `//!` header to name clause-5.
 - Modify: `crates/ailang-core/tests/design_index_pin.rs:253-` — append clause-5 `design_body_links_are_durable_and_resolve` (with `strip_fences`, `targets`, `is_durable`, RED-first synthetic vectors, tree walk).
-- Modify: `design/contracts/float-semantics.md:69` — convert §"Prelude (built-in) classes" → `[Prelude (built-in) classes](typeclasses.md)`.
-- Modify: `design/contracts/float-semantics.md:100` — convert bare-path `design/contracts/str-abi.md` → `[Str ABI](str-abi.md)`.
-- Modify: `design/contracts/embedding-abi.md:45` — convert "Frozen value layout" below → `[Frozen value layout](frozen-value-layout.md)`; drop stale "below".
-- Modify: `design/contracts/memory-model.md:44` — convert §"Data model" → `[Data model](data-model.md)`.
-- Modify: `design/contracts/memory-model.md:105-106` — convert §"Method dispatch" below → `[Method dispatch](typeclasses.md)`; drop stale "below" (target is in typeclasses.md, not in this file).
-- Modify: `design/contracts/scope-boundaries.md:48-49` — convert "Str ABI" → `[Str ABI](str-abi.md)`.
-- Modify: `design/contracts/scope-boundaries.md:88` — convert mixed-referent: `ailang-core::desugar` → source link, "Pipeline" → `../models/pipeline.md`; drop stale "above".
-- Modify: `design/models/pipeline.md:60-61` — disposition-(b): drop the `(see docs/PROSE_ROUNDTRIP.md)` continuation line; preserve CLI prose.
-- Modify: `design/models/authoring-surface.md:180-181` — disposition-(b): drop the `see docs/PROSE_ROUNDTRIP.md for the six-step cycle and` clause; preserve the surrounding `ail merge-prose` sentence.
-- Modify: `design/contracts/honesty-rule.md:14` — append pin-safe positive-half paragraph after line 14, before blank line 15.
+- Modify: `design/contracts/0005-float-semantics.md:69` — convert §"Prelude (built-in) classes" → `[Prelude (built-in) classes](typeclasses.md)`.
+- Modify: `design/contracts/0005-float-semantics.md:100` — convert bare-path `design/contracts/0011-str-abi.md` → `[Str ABI](str-abi.md)`.
+- Modify: `design/contracts/0003-embedding-abi.md:45` — convert "Frozen value layout" below → `[Frozen value layout](frozen-value-layout.md)`; drop stale "below".
+- Modify: `design/contracts/0008-memory-model.md:44` — convert §"Data model" → `[Data model](data-model.md)`.
+- Modify: `design/contracts/0008-memory-model.md:105-106` — convert §"Method dispatch" below → `[Method dispatch](typeclasses.md)`; drop stale "below" (target is in typeclasses.md, not in this file).
+- Modify: `design/contracts/0010-scope-boundaries.md:48-49` — convert "Str ABI" → `[Str ABI](str-abi.md)`.
+- Modify: `design/contracts/0010-scope-boundaries.md:88` — convert mixed-referent: `ailang-core::desugar` → source link, "Pipeline" → `../models/0003-pipeline.md`; drop stale "above".
+- Modify: `design/models/0003-pipeline.md:60-61` — disposition-(b): drop the `(see docs/PROSE_ROUNDTRIP.md)` continuation line; preserve CLI prose.
+- Modify: `design/models/0001-authoring-surface.md:180-181` — disposition-(b): drop the `see docs/PROSE_ROUNDTRIP.md for the six-step cycle and` clause; preserve the surrounding `ail merge-prose` sentence.
+- Modify: `design/contracts/0007-honesty-rule.md:14` — append pin-safe positive-half paragraph after line 14, before blank line 15.
 - Untouched (assert): `design/INDEX.md`; clauses 1–4 of `design_index_pin.rs`; `docs/journals/2026-05-19-design-decision-records.md`; `data-model.md` lines 38/66/79/206/226 (in-fence schema annotations — out of scope); `embedding-abi.md:48` (`docs_honesty_pin.rs:172`-pinned phrase — sits between the :45 conversion and the :51 stay-prose, must be byte-identical); `embedding-abi.md:51` (no-title-no-(see)-form — out of scope); every intra-file "above/below".
 
 ---
@@ -193,7 +193,7 @@ Replace lines 1–5:
 //! docs_honesty_pin.rs. Fails RED the instant the design/ split
 //! re-conflates contract + rationale + narrative, an INDEX row
 //! dangles, a contract loses its ratifying test, or docs/DESIGN.md
-//! is resurrected. Spec: docs/specs/2026-05-19-design-md-rolesplit.md.
+//! is resurrected. Spec: docs/specs/0045-design-md-rolesplit.md.
 ```
 
 with:
@@ -205,8 +205,8 @@ with:
 //! dangles, a contract loses its ratifying test, docs/DESIGN.md is
 //! resurrected, or a design/ body cross-link fails to resolve into
 //! the durable tier (clause-5; spec
-//! docs/specs/2026-05-19-design-ledger-formal-links.md). Spec for
-//! the split: docs/specs/2026-05-19-design-md-rolesplit.md.
+//! docs/specs/0046-design-ledger-formal-links.md). Spec for
+//! the split: docs/specs/0045-design-md-rolesplit.md.
 ```
 
 - [ ] **Step 6: Run the whole suite to confirm nothing else regressed.**
@@ -220,10 +220,10 @@ Expected: **5 passed; 0 failed; 0 ignored**. The four pre-existing clauses (`des
 ### Task 2: Convert the seven Acceptance-3 prose refs to file-relative Markdown links
 
 **Files:**
-- Modify: `design/contracts/float-semantics.md:69, 100`
-- Modify: `design/contracts/embedding-abi.md:45`
-- Modify: `design/contracts/memory-model.md:44, 105-106`
-- Modify: `design/contracts/scope-boundaries.md:48, 88`
+- Modify: `design/contracts/0005-float-semantics.md:69, 100`
+- Modify: `design/contracts/0003-embedding-abi.md:45`
+- Modify: `design/contracts/0008-memory-model.md:44, 105-106`
+- Modify: `design/contracts/0010-scope-boundaries.md:48, 88`
 
 Verbatim before→after for each. Iter-provenance suffixes do not appear on any of these seven (they were all on the in-fence data-model refs, which are out of scope). Each edit is a single-line or two-adjacent-line text replacement; no surrounding line is perturbed.
 
@@ -243,12 +243,12 @@ internally — see [Prelude (built-in) classes](typeclasses.md) for the Show shi
 
 (`float-semantics.md` and `typeclasses.md` are siblings in `design/contracts/` ⇒ file-relative target is `typeclasses.md`. The label retains the original section title verbatim; Markdown handles balanced parens in labels.)
 
-- [ ] **Step 2: `float-semantics.md:100` — bare path `design/contracts/str-abi.md` → `[Str ABI](str-abi.md)`.**
+- [ ] **Step 2: `float-semantics.md:100` — bare path `design/contracts/0011-str-abi.md` → `[Str ABI](str-abi.md)`.**
 
 Replace verbatim (line 100; line 101 unchanged):
 
 ```
-a fresh heap-Str slab at the call site (see design/contracts/str-abi.md
+a fresh heap-Str slab at the call site (see design/contracts/0011-str-abi.md
 ```
 
 with:
@@ -330,24 +330,24 @@ Replace verbatim line 88:
 with:
 
 ```
-  typecheck/codegen — see [desugar](../../crates/ailang-core/src/desugar.rs) and [Pipeline](../models/pipeline.md).
+  typecheck/codegen — see [desugar](../../crates/ailang-core/src/desugar.rs) and [Pipeline](../models/0003-pipeline.md).
 ```
 
-(`scope-boundaries.md` is in `design/contracts/`; `../../` reaches the repo root; `../models/pipeline.md` reaches `design/models/pipeline.md`. Both targets verified existing pre-plan. "above" dropped: stale-direction (Pipeline lives in a different file, not above in this one).)
+(`scope-boundaries.md` is in `design/contracts/`; `../../` reaches the repo root; `../models/0003-pipeline.md` reaches `design/models/0003-pipeline.md`. Both targets verified existing pre-plan. "above" dropped: stale-direction (Pipeline lives in a different file, not above in this one).)
 
 - [ ] **Step 8: Run clause-5 to confirm all seven new links resolve into the durable tier — still GREEN.**
 
 Run: `cargo test -p ailang-core --test design_index_pin design_body_links_are_durable_and_resolve`
 
-Expected: **PASS**. Each of the seven introduced `](path)` resolves from its containing file's directory to a real `design/`-or-source file (`typeclasses.md`, `str-abi.md`, `frozen-value-layout.md`, `data-model.md`, `typeclasses.md`, `str-abi.md`, `../../crates/ailang-core/src/desugar.rs` + `../models/pipeline.md`). All targets are in the durable tier (`design/` or `crates/`). No `#fragment`. No in-fence link.
+Expected: **PASS**. Each of the seven introduced `](path)` resolves from its containing file's directory to a real `design/`-or-source file (`typeclasses.md`, `str-abi.md`, `frozen-value-layout.md`, `data-model.md`, `typeclasses.md`, `str-abi.md`, `../../crates/ailang-core/src/desugar.rs` + `../models/0003-pipeline.md`). All targets are in the durable tier (`design/` or `crates/`). No `#fragment`. No in-fence link.
 
 ---
 
 ### Task 3: Disposition-(b) on the two PROSE_ROUNDTRIP homeless refs
 
 **Files:**
-- Modify: `design/models/pipeline.md:60-61` (in-fence CLI block; pointer removed regardless — the in-fence carve-out preserves *schema documentation* annotations, not cross-tier pointers).
-- Modify: `design/models/authoring-surface.md:178-181`.
+- Modify: `design/models/0003-pipeline.md:60-61` (in-fence CLI block; pointer removed regardless — the in-fence carve-out preserves *schema documentation* annotations, not cross-tier pointers).
+- Modify: `design/models/0001-authoring-surface.md:178-181`.
 
 - [ ] **Step 1: `pipeline.md:60-61` — drop the `(see docs/PROSE_ROUNDTRIP.md)` continuation line.**
 
@@ -399,7 +399,7 @@ Expected: **PASS** (Task 3 only *removes* prose; introduces no link).
 ### Task 4: honesty-rule.md positive-half sentence (pin-safe)
 
 **Files:**
-- Modify: `design/contracts/honesty-rule.md:14` — append a new paragraph after line 14, before blank line 15.
+- Modify: `design/contracts/0007-honesty-rule.md:14` — append a new paragraph after line 14, before blank line 15.
 
 - [ ] **Step 1: Insert the positive-half paragraph between line 14 and line 15.**
 
@@ -493,7 +493,7 @@ Expected: **8** (the 7 Task-2 conversions including the source-link, plus the Pi
 
 Run:
 ```
-grep -nE 'see §"Class names"|see §"Type::Con name scoping"|see §"Embedding ABI"' design/contracts/data-model.md
+grep -nE 'see §"Class names"|see §"Type::Con name scoping"|see §"Embedding ABI"' design/contracts/0002-data-model.md
 ```
 
 Expected: **5 lines** (the lines 38, 66, 79, 206, 226) — confirming the in-fence schema annotations were untouched (out of scope per §Scope; clause-5 skips fences regardless).
@@ -515,4 +515,4 @@ Run:
 git diff HEAD -- crates/ailang-core/tests/design_index_pin.rs | grep -cE '^-[^-]'
 ```
 
-Expected: **`1`** — exactly one removed line (the original `//! is resurrected. Spec: docs/specs/2026-05-19-design-md-rolesplit.md.` being replaced by the extended four-line `//!` block). Any value > 1 means content was removed from clauses 1–4 — STOP and inspect.
+Expected: **`1`** — exactly one removed line (the original `//! is resurrected. Spec: docs/specs/0045-design-md-rolesplit.md.` being replaced by the extended four-line `//!` block). Any value > 1 means content was removed from clauses 1–4 — STOP and inspect.
diff --git a/docs/plans/bench-harness-recalibration.1.md b/docs/plans/0096-bench-harness-recalibration.1.md
similarity index 97%
rename from docs/plans/bench-harness-recalibration.1.md
rename to docs/plans/0096-bench-harness-recalibration.1.md
index 6b9a2b5..34685f5 100644
--- a/docs/plans/bench-harness-recalibration.1.md
+++ b/docs/plans/0096-bench-harness-recalibration.1.md
@@ -1,6 +1,6 @@
 # Bench harness recalibration — Implementation Plan (iteration 1, terminal)
 
-> **Parent spec:** `docs/specs/2026-05-20-bench-harness-recalibration.md`
+> **Parent spec:** `docs/specs/0047-bench-harness-recalibration.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
@@ -65,7 +65,7 @@ are for readability only; the JSON value must NOT contain literal
 newlines, escape them as needed or keep it one logical sentence):
 
 ```
-Baseline for bench/check.py regression detection. The language-invariant thresholds (rc/bump <= 1.3x throughput, p99/median <= 5x latency) are NOT the regression-check tolerances; the per-metric tolerances below are tuned to absorb run-to-run noise on a quiet developer machine. To update after an intentional change, re-run bench/run.sh and replace the values, recording the reason in the commit body that ships the baseline bump. The latency arms gate only on median / p99 / p99_over_median — max_us and p99_9_us were removed on the 2026-05-20 recapture (Gitea #15 / #16) because tail-of-distribution latency metrics are dominated by OS-level jitter (THP defrag, scheduler preemption, IRQ load), not allocator behaviour, and produced 3+ consecutive false-positive REGRESSION rows on byte-identical no-op milestones. See docs/specs/2026-05-20-bench-harness-recalibration.md.
+Baseline for bench/check.py regression detection. The language-invariant thresholds (rc/bump <= 1.3x throughput, p99/median <= 5x latency) are NOT the regression-check tolerances; the per-metric tolerances below are tuned to absorb run-to-run noise on a quiet developer machine. To update after an intentional change, re-run bench/run.sh and replace the values, recording the reason in the commit body that ships the baseline bump. The latency arms gate only on median / p99 / p99_over_median — max_us and p99_9_us were removed on the 2026-05-20 recapture (Gitea #15 / #16) because tail-of-distribution latency metrics are dominated by OS-level jitter (THP defrag, scheduler preemption, IRQ load), not allocator behaviour, and produced 3+ consecutive false-positive REGRESSION rows on byte-identical no-op milestones. See docs/specs/0047-bench-harness-recalibration.md.
 ```
 
 - [ ] **Step 2: Delete the 6 latency entries**
@@ -123,7 +123,7 @@ If `max_us` or `p99_9_us` is in the list, Step 2 was incomplete.
 Run:
 
 ```bash
-jq -r '.note' bench/baseline.json | grep -c 'docs/specs/2026-05-20-bench-harness-recalibration.md'
+jq -r '.note' bench/baseline.json | grep -c 'docs/specs/0047-bench-harness-recalibration.md'
 ```
 
 Expected stdout: `1`. Zero hits means the rewrite from Step 1 was
@@ -176,7 +176,7 @@ Expected stdout:
 Also confirm note + entry deletions still hold:
 
 ```bash
-jq -r '.note' bench/baseline.json | grep -c 'docs/specs/2026-05-20-bench-harness-recalibration.md'
+jq -r '.note' bench/baseline.json | grep -c 'docs/specs/0047-bench-harness-recalibration.md'
 jq '[.latency | to_entries[] | .value | keys[]] | unique' bench/baseline.json
 ```
 
diff --git a/docs/plans/nullary-app.1.md b/docs/plans/0097-nullary-app.1.md
similarity index 94%
rename from docs/plans/nullary-app.1.md
rename to docs/plans/0097-nullary-app.1.md
index 999979d..5aa4238 100644
--- a/docs/plans/nullary-app.1.md
+++ b/docs/plans/0097-nullary-app.1.md
@@ -2,8 +2,8 @@
 
 > **No parent spec.** Gitea issue #12 carries the resolved design
 > fork verbatim; two prior fieldtest specs
-> (`docs/specs/2026-05-15-fieldtest-mut-local.md` F3,
-> `docs/specs/2026-05-18-fieldtest-loop-recur.md` spec_gap) are the
+> (`docs/specs/0030-fieldtest-mut-local.md` F3,
+> `docs/specs/0035-fieldtest-loop-recur.md` spec_gap) are the
 > LLM-natural-shape evidence. User accepted `(app f)` + Ctor-style
 > serde convention on 2026-05-20.
 >
@@ -21,11 +21,11 @@ serde-attribute edit on `Term::App.args` to mirror `Term::Ctor.args`
 (read-tolerant when `args` is absent in canonical JSON).
 
 **Doc-honesty side-fix:** the existing comment on `Term::Ctor` in
-`design/contracts/data-model.md:130-131` claims "`args` omitted when
+`design/contracts/0002-data-model.md:130-131` claims "`args` omitted when
 empty", which is *factually false* for the current code — `Ctor.args`
 has `#[serde(default)]` (read-tolerant) but NO `skip_serializing_if`,
 so writes always emit `"args":[]`. Fix the comment to describe actual
-behaviour. This is `design/contracts/honesty-rule.md` enforcement
+behaviour. This is `design/contracts/0007-honesty-rule.md` enforcement
 folded into the same iter (the discovery happened while researching
 this iter's serde change, and a stale comment in the same jsonc
 block we're modifying must not be left behind).
@@ -36,7 +36,7 @@ change). No typechecker, codegen, or runtime changes — every layer
 below the parser already handles empty `args` correctly today.
 
 **Tech Stack:** `ailang-surface` (parser), `ailang-core` (AST serde),
-`design/contracts/data-model.md` (schema doc), `crates/ail` (E2E
+`design/contracts/0002-data-model.md` (schema doc), `crates/ail` (E2E
 test).
 
 **Files this plan creates or modifies:**
@@ -54,10 +54,10 @@ test).
   `Term::App.args` with `#[serde(default)]`, mirroring
   `Term::Ctor.args` at line 472-477. `skip_serializing_if` is NOT
   added (mirror Ctor's *actual* attrs, not the doc claim).
-- Modify: `design/contracts/data-model.md:112` — add an inline comment
+- Modify: `design/contracts/0002-data-model.md:112` — add an inline comment
   to the `app` jsonc shape that `args` MAY be empty (e.g. nullary
   call `(app f)`).
-- Modify: `design/contracts/data-model.md:130-131` — rewrite the
+- Modify: `design/contracts/0002-data-model.md:130-131` — rewrite the
   misleading "args omitted when empty" comment on the `ctor` jsonc
   shape so it describes the actual write/read behaviour: write
   always emits `"args":[]`; read tolerates absent `args`.
@@ -113,8 +113,8 @@ string; that confirms the RED hits the targeted symptom.
   //! invoked as `(app greet)`.
   //!
   //! Two independent fieldtest specs flagged the same gap:
-  //! `docs/specs/2026-05-15-fieldtest-mut-local.md` F3 and
-  //! `docs/specs/2026-05-18-fieldtest-loop-recur.md` spec_gap. The
+  //! `docs/specs/0030-fieldtest-mut-local.md` F3 and
+  //! `docs/specs/0035-fieldtest-loop-recur.md` spec_gap. The
   //! Form-A surface refusing nullary calls had no schema backing —
   //! `Term::App.args` is `[Term...]` (zero-or-more), so the parser
   //! guard was an unbacked rule.
@@ -309,9 +309,9 @@ string; that confirms the RED hits the targeted symptom.
 ## Task 4: Doc-honesty fix — `data-model.md` `ctor` and `app` comments
 
 **Files:**
-- Modify: `design/contracts/data-model.md:110-131`
+- Modify: `design/contracts/0002-data-model.md:110-131`
 
-This task is `design/contracts/honesty-rule.md` enforcement — the
+This task is `design/contracts/0007-honesty-rule.md` enforcement — the
 prose-authoritative contract must describe present-state behaviour,
 not aspirational behaviour. The current `Ctor` comment is
 aspirational (the omit-when-empty rule is not implemented), and the
@@ -320,7 +320,7 @@ calls are legal.
 
 - [ ] **Step 4.1: Add an empty-args note to the `app` shape**
 
-  `design/contracts/data-model.md:110-112` currently reads:
+  `design/contracts/0002-data-model.md:110-112` currently reads:
 
   ```jsonc
   // fn application; tail flag triggers musttail under codegen.
@@ -342,7 +342,7 @@ calls are legal.
 
 - [ ] **Step 4.2: Rewrite the misleading `ctor` comment**
 
-  `design/contracts/data-model.md:130-131` currently reads:
+  `design/contracts/0002-data-model.md:130-131` currently reads:
 
   ```jsonc
   // Ctor application; `args` omitted when empty.
diff --git a/docs/plans/boehm-retirement.1.md b/docs/plans/0098-boehm-retirement.1.md
similarity index 94%
rename from docs/plans/boehm-retirement.1.md
rename to docs/plans/0098-boehm-retirement.1.md
index d608a1b..77a978a 100644
--- a/docs/plans/boehm-retirement.1.md
+++ b/docs/plans/0098-boehm-retirement.1.md
@@ -1,6 +1,6 @@
 # Boehm Retirement (iter .1) — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-20-boehm-retirement.md`
+> **Parent spec:** `docs/specs/0048-boehm-retirement.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
@@ -52,11 +52,11 @@ shell + Python in `bench/`; C runtime in `runtime/`; Markdown in
 - `bench/run.sh:3-11,65,149-167,170-205` — drop gc-arm + columns + latency-bench gc-fixture
 - `bench/check.py:75-97` — drop gc-keyed throughput fields + drop `"implicit @ gc"` arm mapping
 - `bench/baseline.json` — drop gc-keyed entries (via `bench/check.py --update-baseline` after a clean `bench/run.sh`)
-- `design/models/rc-uniqueness.md:3-32,71-79,132-156,170-183` — excise + reframe
-- `design/models/pipeline.md:14-28` — pipeline diagram + prose
-- `design/contracts/scope-boundaries.md:67,114-127` — rewrite Boehm block + `@GC_malloc` reference
-- `design/contracts/memory-model.md:232` — drop `"pre-Boehm era"`
-- `design/contracts/embedding-abi.md:42-44` — drop gc clause from staticlib-guard prose
+- `design/models/0004-rc-uniqueness.md:3-32,71-79,132-156,170-183` — excise + reframe
+- `design/models/0003-pipeline.md:14-28` — pipeline diagram + prose
+- `design/contracts/0010-scope-boundaries.md:67,114-127` — rewrite Boehm block + `@GC_malloc` reference
+- `design/contracts/0008-memory-model.md:232` — drop `"pre-Boehm era"`
+- `design/contracts/0003-embedding-abi.md:42-44` — drop gc clause from staticlib-guard prose
 - `skills/audit/agents/ailang-bencher.md` — multi-site Boehm rewrite (recon enumerated ≈18 sites)
 - `skills/implement/agents/ailang-implementer.md:95,185` — drop Decision-10/Boehm references
 - `examples/gc_stress.ail` — **DELETE entire file** (47 lines)
@@ -685,22 +685,22 @@ Expected: `exit: 0`. The just-regenerated baseline matches a fresh run (the same
 
 ## Task 6: Design ledger updates
 
-**Goal:** Bring the design ledger into post-retirement present-tense honesty. After this task: `design/models/rc-uniqueness.md` and `design/models/pipeline.md` describe RC + bump as the only allocators; `design/contracts/scope-boundaries.md` and `design/contracts/memory-model.md` carry no Boehm prose; `design/contracts/embedding-abi.md:42-44` reframes the staticlib-guard justification around bump.
+**Goal:** Bring the design ledger into post-retirement present-tense honesty. After this task: `design/models/0004-rc-uniqueness.md` and `design/models/0003-pipeline.md` describe RC + bump as the only allocators; `design/contracts/0010-scope-boundaries.md` and `design/contracts/0008-memory-model.md` carry no Boehm prose; `design/contracts/0003-embedding-abi.md:42-44` reframes the staticlib-guard justification around bump.
 
 **Files:**
-- Modify: `design/models/rc-uniqueness.md`
-- Modify: `design/models/pipeline.md`
-- Modify: `design/contracts/scope-boundaries.md`
-- Modify: `design/contracts/memory-model.md`
-- Modify: `design/contracts/embedding-abi.md`
+- Modify: `design/models/0004-rc-uniqueness.md`
+- Modify: `design/models/0003-pipeline.md`
+- Modify: `design/contracts/0010-scope-boundaries.md`
+- Modify: `design/contracts/0008-memory-model.md`
+- Modify: `design/contracts/0003-embedding-abi.md`
 
-- [ ] **Step 1: `design/models/rc-uniqueness.md` — excise Boehm sections**
+- [ ] **Step 1: `design/models/0004-rc-uniqueness.md` — excise Boehm sections**
 
 Delete `:3-32` (the entire `## Dual allocator — RC canonical, Boehm parity oracle` section, from the heading down to the last sentence "the rest of this section documents the Boehm half, retained as the oracle.").
 
 Delete `:34-69` (the `**Choice: Boehm-Demers-Weiser conservative GC.**` block and its full `Rationale:` + `Trade-offs accepted:` bullet lists, ending with "Users without it get a link-time error from clang, not a silent failure.").
 
-- [ ] **Step 2: `design/models/rc-uniqueness.md` — generalise Per-fn arena section**
+- [ ] **Step 2: `design/models/0004-rc-uniqueness.md` — generalise Per-fn arena section**
 
 Edit `:71-79` (the `## Per-fn arena via stack \`alloca\`` section) to generalise the Boehm-specific language:
 
@@ -711,7 +711,7 @@ Edit `:71-79` (the `## Per-fn arena via stack \`alloca\`` section) to generalise
 Edit `:115-127` (the `**Codegen integration.**` block):
 - `:124-125`: `\`alloca i8, i64 <size>, align 8\`; on a miss it writes \`call ptr @GC_malloc(i64 <size>)\`.` → `\`alloca i8, i64 <size>, align 8\`; on a miss it writes \`call ptr @ailang_rc_alloc(i64 <size>)\` (or the bump-mode equivalent).`
 
-- [ ] **Step 3: `design/models/rc-uniqueness.md` — memory-model section reframe**
+- [ ] **Step 3: `design/models/0004-rc-uniqueness.md` — memory-model section reframe**
 
 Edit `:132-156` (the `## Memory model — RC + Uniqueness …` section). Rewrite the opening paragraph at `:134-144` to drop the Boehm-bench framing:
 
@@ -735,11 +735,11 @@ to:
 
 > **Choice.** AILang's canonical memory model is reference counting with static uniqueness inference and explicit LLM-author annotations on fn signatures, in the lineage of Lean 4 / Roc / Koka. The RC pipeline tracks the bump-allocator raw-alloc floor: a bench-health regression gate requires RC overhead ≤ 1.3× bump on the linear/tree corpus, with a wider ±15% band on the closure-chain corpus (representational cost of the closure-pair layout). See `bench/run.sh` for the active check.
 
-- [ ] **Step 4: `design/models/rc-uniqueness.md` — closure-chain wider band**
+- [ ] **Step 4: `design/models/0004-rc-uniqueness.md` — closure-chain wider band**
 
 Edit `:170-183` to drop Boehm-retirement framing. The phrase `a Boehm-retirement follow-up` at `:173` becomes `a future closure-pair slab/pool optimisation`. The phrase `excluded from the Boehm-retirement gate until a slab/pool answer ships` at `:179-180` becomes `excluded from the linear/tree 1.3× regression gate; the closure-chain corpus has its own ±15% band until a slab/pool optimisation ships`.
 
-- [ ] **Step 5: `design/models/pipeline.md` — pipeline diagram + prose**
+- [ ] **Step 5: `design/models/0003-pipeline.md` — pipeline diagram + prose**
 
 Edit `:14-17` (pipeline diagram) from:
 
@@ -759,13 +759,13 @@ to:
 
 Edit `:19-28` (the accompanying prose). Replace:
 
-> Two allocator backends share the same MIR. `--alloc=rc` is the canonical backend committed to in the [memory model](../contracts/memory-model.md) and the CLI default. The typechecker enforces `(own)` / `(borrow)` modes, codegen emits `ailang_rc_inc` / `_dec` calls at the points dictated by linearity, and `Term::Clone` / `Term::ReuseAs` materialise into actual rc-bumps and in-place rewrites respectively. `--alloc=gc` selects the transitional Boehm backend (see [RC + uniqueness](rc-uniqueness.md)); `--alloc=rc` is the canonical backend and the CLI default.
+> Two allocator backends share the same MIR. `--alloc=rc` is the canonical backend committed to in the [memory model](../contracts/0008-memory-model.md) and the CLI default. The typechecker enforces `(own)` / `(borrow)` modes, codegen emits `ailang_rc_inc` / `_dec` calls at the points dictated by linearity, and `Term::Clone` / `Term::ReuseAs` materialise into actual rc-bumps and in-place rewrites respectively. `--alloc=gc` selects the transitional Boehm backend (see [RC + uniqueness](rc-uniqueness.md)); `--alloc=rc` is the canonical backend and the CLI default.
 
 with:
 
-> Two allocator backends share the same MIR. `--alloc=rc` is the canonical backend committed to in the [memory model](../contracts/memory-model.md) and the CLI default; the typechecker enforces `(own)` / `(borrow)` modes, codegen emits `ailang_rc_inc` / `_dec` calls at the points dictated by linearity, and `Term::Clone` / `Term::ReuseAs` materialise into actual rc-bumps and in-place rewrites respectively. `--alloc=bump` selects the raw-alloc bench-floor (`runtime/bump.c`, no free, leak-only) and is used by `bench/run.sh` to measure RC overhead against the structurally cheapest allocator — it is not a production target.
+> Two allocator backends share the same MIR. `--alloc=rc` is the canonical backend committed to in the [memory model](../contracts/0008-memory-model.md) and the CLI default; the typechecker enforces `(own)` / `(borrow)` modes, codegen emits `ailang_rc_inc` / `_dec` calls at the points dictated by linearity, and `Term::Clone` / `Term::ReuseAs` materialise into actual rc-bumps and in-place rewrites respectively. `--alloc=bump` selects the raw-alloc bench-floor (`runtime/bump.c`, no free, leak-only) and is used by `bench/run.sh` to measure RC overhead against the structurally cheapest allocator — it is not a production target.
 
-- [ ] **Step 6: `design/contracts/scope-boundaries.md` — rewrite Boehm block**
+- [ ] **Step 6: `design/contracts/0010-scope-boundaries.md` — rewrite Boehm block**
 
 Edit `:67` (the `==` polymorphic codegen list). The current `@printf` / `@GC_malloc` parenthetical should become `@printf` / `@ailang_rc_alloc` (or just `@printf` — the canonical declared-extern set in the LLVM IR header; the implementer reads the header at codegen-lib emit-time and writes whichever extern is actually paired with `@printf` in the current header).
 
@@ -773,7 +773,7 @@ Edit `:114-127` (the `**Memory management via Boehm conservative GC**` bullet).
 
 ```markdown
 - **Memory management via reference counting + uniqueness inference**
-  (see [RC + uniqueness](../models/rc-uniqueness.md)), with
+  (see [RC + uniqueness](../models/0004-rc-uniqueness.md)), with
   **per-fn arena via stack `alloca` for non-escaping allocations**
   layered on top. Every ADT box, lambda env, and closure pair
   allocates either via `@ailang_rc_alloc` (escaping; RC-managed
@@ -781,14 +781,14 @@ Edit `:114-127` (the `**Memory management via Boehm conservative GC**` bullet).
   `alloca` (non-escaping; freed at fn return). The decision is
   made by an escape-analysis pre-pass over the fn body — see the
   "Per-fn arena via stack `alloca`" subsection of
-  [RC + uniqueness](../models/rc-uniqueness.md). The per-fn-arena
+  [RC + uniqueness](../models/0004-rc-uniqueness.md). The per-fn-arena
   path is exercised end-to-end by
   `examples/escape_local_demo.ail.json`.
 ```
 
 The `examples/gc_stress.ail.json` reference is dropped entirely (file does not exist; the comment was always doc-archaeology pointing at a non-existent file). The `examples/std_list_stress.ail.json` reference is dropped similarly — its purpose ("Boehm-only soak tests") no longer exists.
 
-- [ ] **Step 7: `design/contracts/memory-model.md` — drop "pre-Boehm era"**
+- [ ] **Step 7: `design/contracts/0008-memory-model.md` — drop "pre-Boehm era"**
 
 Edit `:230-232` from:
 
@@ -798,7 +798,7 @@ to (post-retirement, the "until then" branch is closed since RC inc/dec instrume
 
 > Codegen for `Term::Ctor` / `Term::Lam` env / closure pair under `--alloc=rc` calls `ailang_rc_alloc(SIZE)`; inc/dec instrumentation is emitted per the uniqueness inference. `--alloc=bump` selects the bench-floor allocator, which leaks by design (no inc/dec, no free); it is bench-only and never a production target.
 
-- [ ] **Step 8: `design/contracts/embedding-abi.md` — staticlib-guard prose**
+- [ ] **Step 8: `design/contracts/0003-embedding-abi.md` — staticlib-guard prose**
 
 Edit `:42-44` from:
 
@@ -838,7 +838,7 @@ Edit `crates/ailang-core/tests/docs_honesty_pin.rs:116-117`. Delete the two line
 
 ```rust
     assert!(pipeline.contains("`--alloc=gc` selects the transitional Boehm backend"),
-        "models/pipeline.md must describe Boehm present-tense, not as 'on the path to retirement'");
+        "models/0003-pipeline.md must describe Boehm present-tense, not as 'on the path to retirement'");
 ```
 
 - [ ] **Step 2: Add four absence-pins to `design_md_has_no_wunschdenken`**
@@ -858,7 +858,7 @@ Edit `crates/ailang-core/tests/docs_honesty_pin.rs:54-73` (the `design_md_has_no
 
 - [ ] **Step 3: Update the file-level doc-comment**
 
-Edit `crates/ailang-core/tests/docs_honesty_pin.rs:28-38` (the `design_corpus()` preamble doc-comment block). Replace the phrase `the Boehm/Decision-9 narrative (\`models/rc-uniqueness.md\`)` with `the RC + bump memory-model narrative (\`models/rc-uniqueness.md\`)` — the comment lists what the corpus scans, and the description should match post-retirement reality.
+Edit `crates/ailang-core/tests/docs_honesty_pin.rs:28-38` (the `design_corpus()` preamble doc-comment block). Replace the phrase `the Boehm/Decision-9 narrative (\`models/0004-rc-uniqueness.md\`)` with `the RC + bump memory-model narrative (\`models/0004-rc-uniqueness.md\`)` — the comment lists what the corpus scans, and the description should match post-retirement reality.
 
 - [ ] **Step 4: Drop `"pre-Boehm"` from the protected-exception list**
 
@@ -1010,7 +1010,7 @@ Expected: stderr contains `unknown --alloc value` and `\`gc\``; `exit: 2` (or an
 
 - [ ] **Step 5: Honesty rule + design-doc present-tense**
 
-Read `design/models/rc-uniqueness.md` and `design/models/pipeline.md` end-to-end:
+Read `design/models/0004-rc-uniqueness.md` and `design/models/0003-pipeline.md` end-to-end:
 - No `Boehm` / `libgc` / `GC_malloc` / `--alloc=gc` / `parity oracle` / `transitional` (in the allocator sense) appears.
 - Present-tense describes RC (canonical) + bump (bench-floor) only.
 - The 1.3× ceiling is framed as a bench-health regression gate, not a retirement target.
diff --git a/docs/plans/operator-routing-eq-ord.1.md b/docs/plans/0099-operator-routing-eq-ord.1.md
similarity index 96%
rename from docs/plans/operator-routing-eq-ord.1.md
rename to docs/plans/0099-operator-routing-eq-ord.1.md
index c267cf5..df780a2 100644
--- a/docs/plans/operator-routing-eq-ord.1.md
+++ b/docs/plans/0099-operator-routing-eq-ord.1.md
@@ -1,6 +1,6 @@
 # operator-routing-eq-ord.1 — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-20-operator-routing-eq-ord.md`
+> **Parent spec:** `docs/specs/0049-operator-routing-eq-ord.md`
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
 > to run this plan. Steps use `- [ ]` checkboxes for tracking.
@@ -59,11 +59,11 @@
 - Modify: `crates/ail/tests/snapshots/max3.ll` — regenerate via `UPDATE_SNAPSHOTS=1` (max3.ail uses `>` directly)
 - Modify: `crates/ailang-prose/src/lib.rs:546-563` — delete the 6 comparator arms from `binop_info` (dead code after operator-name removal)
 - Modify: `crates/ailang-prose/src/lib.rs:1952, 2020-2062` — delete the 3 in-source `mod tests` that pinned comparator-infix rendering
-- Modify: `design/contracts/float-semantics.md:10-31, :98-99` — transfer comparison guarantees from `==` / `<` / `!=` to `float_eq` / `float_lt` / `float_ne` (arithmetic guarantees on `+` / `-` / `*` / `/` unchanged); `==` / `<` / `!=` mentions removed from the present-tense surface description
-- Modify: `design/contracts/prelude-classes.md:5-13` — instance list extends with `Eq Unit`; new paragraph on the six `float_*` fns; Float-no-Eq/Ord clause gains `→ use float_eq` cross-reference
-- Modify: `design/contracts/str-abi.md:40-42` — rewrite "`==`, `<`, …  REMAIN primitive operators" clause to describe the class-method dispatch path
-- Modify: `design/contracts/scope-boundaries.md:42-96` — operator-name mentions and `Pattern::Lit`-desugar-to-`==` clauses rewrite to the class-dispatch present
-- Modify: `design/models/authoring-surface.md:58` — drop `==` / `<=` from the operator-example list; the example becomes arithmetic-only or names class methods explicitly
+- Modify: `design/contracts/0005-float-semantics.md:10-31, :98-99` — transfer comparison guarantees from `==` / `<` / `!=` to `float_eq` / `float_lt` / `float_ne` (arithmetic guarantees on `+` / `-` / `*` / `/` unchanged); `==` / `<` / `!=` mentions removed from the present-tense surface description
+- Modify: `design/contracts/0017-prelude-classes.md:5-13` — instance list extends with `Eq Unit`; new paragraph on the six `float_*` fns; Float-no-Eq/Ord clause gains `→ use float_eq` cross-reference
+- Modify: `design/contracts/0011-str-abi.md:40-42` — rewrite "`==`, `<`, …  REMAIN primitive operators" clause to describe the class-method dispatch path
+- Modify: `design/contracts/0010-scope-boundaries.md:42-96` — operator-name mentions and `Pattern::Lit`-desugar-to-`==` clauses rewrite to the class-dispatch present
+- Modify: `design/models/0001-authoring-surface.md:58` — drop `==` / `<=` from the operator-example list; the example becomes arithmetic-only or names class methods explicitly
 
 ---
 
@@ -861,13 +861,13 @@ The doc-comment at lines ~1095-1099 currently describes the function as emitting
 /// Builds the equality-test AST node for a literal pattern. Lowers
 /// `(pat-lit <lit>)` to `(if (eq sv <lit>) <body> <fall_k>)`. The
 /// emitted `eq` resolves via prelude.Eq's class-method dispatch
-/// (per design/contracts/method-dispatch.md) — Int/Bool/Str/Unit
+/// (per design/contracts/0016-method-dispatch.md) — Int/Bool/Str/Unit
 /// patterns all route through the corresponding primitive
 /// instance.
 ///
 /// Float-Literal patterns are hard-rejected at typecheck
 /// (`CheckError::FloatPatternNotAllowed`, per
-/// design/contracts/float-semantics.md) before this fn is reached,
+/// design/contracts/0005-float-semantics.md) before this fn is reached,
 /// so the `eq`-dispatch never encounters Float.
 fn build_eq(scrutinee: Term, lit: &Literal) -> Term {
 ```
@@ -1029,7 +1029,7 @@ In `crates/ailang-check/src/lib.rs:856-880`, the existing addendum reads (around
             if (class == "prelude.Eq" || class == "prelude.Ord") && at_type == "Float" {
                 d.message = format!(
                     "{} — Float has no Eq/Ord instance by design (partial \
-                     orderability per IEEE-754); see design/contracts/float-semantics.md.",
+                     orderability per IEEE-754); see design/contracts/0005-float-semantics.md.",
                     d.message
                 );
             } else if class == "prelude.Show" {
@@ -1043,7 +1043,7 @@ Extend the wording to mention `float_eq` and `float_lt`:
                     "{} — Float has no Eq/Ord instance by design (partial \
                      orderability per IEEE-754); use float_eq / float_lt \
                      (and siblings) for explicit IEEE-aware comparison. \
-                     See design/contracts/float-semantics.md.",
+                     See design/contracts/0005-float-semantics.md.",
                     d.message
                 );
             } else if class == "prelude.Show" {
@@ -1061,13 +1061,13 @@ In `crates/ail/tests/eq_float_noinstance.rs:32-44`, the existing test asserts th
 ```rust
 // Existing (around line 38-44):
 assert!(
-    stderr.contains("Float") && stderr.contains("design/contracts/float-semantics.md"),
+    stderr.contains("Float") && stderr.contains("design/contracts/0005-float-semantics.md"),
     "expected Float-aware addendum, got: {stderr}"
 );
 
 // Replace with:
 assert!(
-    stderr.contains("Float") && stderr.contains("design/contracts/float-semantics.md") && stderr.contains("float_eq"),
+    stderr.contains("Float") && stderr.contains("design/contracts/0005-float-semantics.md") && stderr.contains("float_eq"),
     "expected Float-aware addendum with float_eq hint, got: {stderr}"
 );
 ```
@@ -1148,15 +1148,15 @@ Expected: `0 failed`.
 ## Task 11: Contract updates — 5 design files
 
 **Files:**
-- Modify: `design/contracts/float-semantics.md:10-31, :98-99`
-- Modify: `design/contracts/prelude-classes.md:5-13`
-- Modify: `design/contracts/str-abi.md:40-42`
-- Modify: `design/contracts/scope-boundaries.md:42-96` (operator-name mentions + Pattern::Lit-to-`==` clause)
-- Modify: `design/models/authoring-surface.md:58`
+- Modify: `design/contracts/0005-float-semantics.md:10-31, :98-99`
+- Modify: `design/contracts/0017-prelude-classes.md:5-13`
+- Modify: `design/contracts/0011-str-abi.md:40-42`
+- Modify: `design/contracts/0010-scope-boundaries.md:42-96` (operator-name mentions + Pattern::Lit-to-`==` clause)
+- Modify: `design/models/0001-authoring-surface.md:58`
 
 - [ ] **Step 1: Update `float-semantics.md`**
 
-In `design/contracts/float-semantics.md:10-14`, the bullet currently reads:
+In `design/contracts/0005-float-semantics.md:10-14`, the bullet currently reads:
 
 ```markdown
 - Every individual builtin (`+`/`-`/`*`/`/`/`neg`/`<`/`==`/...) lowers
@@ -1199,7 +1199,7 @@ Line 98-99 (NaN-rendering caveat) — strip the `==`/`<` mentions; reword the cr
 
 - [ ] **Step 2: Update `prelude-classes.md`**
 
-In `design/contracts/prelude-classes.md:5-13`, the current text describes Eq/Ord with primitive instances for Int/Bool/Str. Update:
+In `design/contracts/0017-prelude-classes.md:5-13`, the current text describes Eq/Ord with primitive instances for Int/Bool/Str. Update:
 
 - Extend the instance list with Eq Unit.
 - Add a paragraph after the existing Eq/Ord/Show description naming the six `float_*` fns as the Float-comparison surface (each `Float -> Float -> Bool` without a class constraint; lowered to a single `fcmp` via codegen intercept; replaces the deleted polymorphic `==`/`<`/etc. operators on Float).
@@ -1207,11 +1207,11 @@ In `design/contracts/prelude-classes.md:5-13`, the current text describes Eq/Ord
 
 - [ ] **Step 3: Update `str-abi.md:40-42`**
 
-In `design/contracts/str-abi.md:40-42`, the current clause reads (paraphrase from recon): "`==`, `<`, `<=`, `>`, `>=` REMAIN primitive operators". Rewrite to describe the class-method dispatch path: equality on Str dispatches via `prelude.Eq.eq` (Str instance, lowered to `@ail_str_eq` via try_emit_primitive_instance_body::eq__Str); ordering on Str dispatches via `prelude.Ord.compare` (Str instance, lowered to `@ail_str_compare`).
+In `design/contracts/0011-str-abi.md:40-42`, the current clause reads (paraphrase from recon): "`==`, `<`, `<=`, `>`, `>=` REMAIN primitive operators". Rewrite to describe the class-method dispatch path: equality on Str dispatches via `prelude.Eq.eq` (Str instance, lowered to `@ail_str_eq` via try_emit_primitive_instance_body::eq__Str); ordering on Str dispatches via `prelude.Ord.compare` (Str instance, lowered to `@ail_str_compare`).
 
 - [ ] **Step 4: Update `scope-boundaries.md:42-96`**
 
-Read `design/contracts/scope-boundaries.md:42-96` in full. Per recon, multiple clauses describe the dying surface:
+Read `design/contracts/0010-scope-boundaries.md:42-96` in full. Per recon, multiple clauses describe the dying surface:
 - "`==` is polymorphic"
 - "`!=` for Float uses `fcmp UNE`"
 - "`Pattern::Lit` to `Term::If` on `==`"
@@ -1225,7 +1225,7 @@ For each:
 
 - [ ] **Step 5: Update `authoring-surface.md:58`**
 
-In `design/models/authoring-surface.md:58`, the current example lists `==`, `<=` among operators. Drop `==` and `<=` from the example; the operator list becomes arithmetic-only (`+`, `-`, `*`, `/`, `%`). Add a follow-up sentence: "Comparison and equality are class methods (`eq` / `compare`), not operators — see [Prelude classes](../contracts/prelude-classes.md)."
+In `design/models/0001-authoring-surface.md:58`, the current example lists `==`, `<=` among operators. Drop `==` and `<=` from the example; the operator list becomes arithmetic-only (`+`, `-`, `*`, `/`, `%`). Add a follow-up sentence: "Comparison and equality are class methods (`eq` / `compare`), not operators — see [Prelude classes](../contracts/0017-prelude-classes.md)."
 
 - [ ] **Step 6: Verify honesty-rule pin still passes**
 
diff --git a/docs/plans/2026-05-21-schema-camelcase-fix.md b/docs/plans/0100-schema-camelcase-fix.md
similarity index 96%
rename from docs/plans/2026-05-21-schema-camelcase-fix.md
rename to docs/plans/0100-schema-camelcase-fix.md
index 8a5747d..652837f 100644
--- a/docs/plans/2026-05-21-schema-camelcase-fix.md
+++ b/docs/plans/0100-schema-camelcase-fix.md
@@ -1,6 +1,6 @@
 # schema-camelcase-fix — Implementation Plan
 
-> **Parent spec:** `docs/specs/2026-05-21-schema-camelcase-fix.md`
+> **Parent spec:** `docs/specs/0051-schema-camelcase-fix.md`
 > (commit `55ce6d0`, amended after plan-recon)
 >
 > **For agentic workers:** REQUIRED SUB-SKILL: use `skills/implement`
@@ -18,7 +18,7 @@ touched: (1) `#[serde(rename)]` strings on `Term::Lam` in
 `crates/ailang-core/src/ast.rs`; (2) one in-source test JSON-literal
 in `crates/ailang-core/src/workspace.rs`; (3) two `.ail.json` fixtures
 + one canonical-schema contract document
-(`design/contracts/data-model.md`); (4) three rustdoc strings that
+(`design/contracts/0002-data-model.md`); (4) three rustdoc strings that
 describe present-state schema vocabulary. The Form-A surface
 (`crates/ailang-surface/`) is structurally untouched — Form-A uses
 `(params (typed ...)) (ret ...)`, not the renamed tags. No hash-pin
@@ -49,7 +49,7 @@ helper.
   `//!` rustdoc mentions `lam`'s `paramTypes` carry.
 - Modify: `crates/ailang-check/src/lib.rs:1707` — `///` rustdoc on
   the InstanceMethod routing helper.
-- Modify: `design/contracts/data-model.md:142-147` — fenced JSON
+- Modify: `design/contracts/0002-data-model.md:142-147` — fenced JSON
   block describing the `Term::Lam` schema.
 - Modify: `examples/test_loop_binder_captured_by_lambda.ail.json`
   — two key renames, one per line (currently lines 32-33; verify
@@ -58,8 +58,8 @@ helper.
   — two key renames, one per line (currently lines 25-26).
 
 **Forbidden touches** (per spec acceptance criterion 7):
-- `docs/plans/2026-05-10-23.3-*.md`, `docs/plans/2026-05-09-22b3-monomorphisation.md`,
-  `docs/plans/2026-05-09-22c-user-class-e2e.md`, `docs/plans/24.2.md`
+- `docs/plans/2026-05-10-23.3-*.md`, `docs/plans/0003-22b3-monomorphisation.md`,
+  `docs/plans/0005-22c-user-class-e2e.md`, `docs/plans/0056-24.2.md`
 - `experiments/2026-05-12-cross-model-authoring/master/spec.md`
 - `experiments/2026-05-12-cross-model-authoring/rendered/*.md`
 - `experiments/2026-05-12-cross-model-authoring/runs/**`
@@ -189,7 +189,7 @@ proceeding.
 - Modify: `crates/ailang-core/src/workspace.rs:1925-1926`
 - Modify: `examples/test_loop_binder_captured_by_lambda.ail.json`
 - Modify: `experiments/2026-05-12-cross-model-authoring/master/examples/fn_with_lambda.ail.json`
-- Modify: `design/contracts/data-model.md:142-147`
+- Modify: `design/contracts/0002-data-model.md:142-147`
 
 These files MUST move together. Changing only `ast.rs` makes any
 JSON literal containing the old tags undeserialisable: serde
@@ -273,7 +273,7 @@ Expected: 2 hits on consecutive lines (currently 25-26; verify).
 
 Same rename as Step 4.
 
-- [ ] **Step 6: Edit `design/contracts/data-model.md:142-147`**
+- [ ] **Step 6: Edit `design/contracts/0002-data-model.md:142-147`**
 
 The fenced JSON block currently reads (lines 142-147):
 
@@ -336,7 +336,7 @@ with a `serde_json::from_value` error mentioning the missing field.
 
 These are pure prose edits — no compile or test consequence. They
 exist solely to keep the rustdoc honest after the rename. Per the
-Honesty Rule (`design/contracts/honesty-rule.md`), production
+Honesty Rule (`design/contracts/0007-honesty-rule.md`), production
 rustdoc describes present-state vocabulary, not history.
 
 - [ ] **Step 1: Edit `crates/ailang-core/src/ast.rs:8`**
diff --git a/docs/specs/2026-05-09-skill-system.md b/docs/specs/0001-skill-system.md
similarity index 100%
rename from docs/specs/2026-05-09-skill-system.md
rename to docs/specs/0001-skill-system.md
diff --git a/docs/specs/2026-05-09-22-typeclasses.md b/docs/specs/0002-22-typeclasses.md
similarity index 100%
rename from docs/specs/2026-05-09-22-typeclasses.md
rename to docs/specs/0002-22-typeclasses.md
diff --git a/docs/specs/2026-05-10-env-construction-unify.md b/docs/specs/0003-env-construction-unify.md
similarity index 100%
rename from docs/specs/2026-05-10-env-construction-unify.md
rename to docs/specs/0003-env-construction-unify.md
diff --git a/docs/specs/2026-05-10-design-md-consolidation.md b/docs/specs/0004-design-md-consolidation.md
similarity index 100%
rename from docs/specs/2026-05-10-design-md-consolidation.md
rename to docs/specs/0004-design-md-consolidation.md
diff --git a/docs/specs/2026-05-10-floats.md b/docs/specs/0005-floats.md
similarity index 100%
rename from docs/specs/2026-05-10-floats.md
rename to docs/specs/0005-floats.md
diff --git a/docs/specs/2026-05-10-fieldtest-floats.md b/docs/specs/0006-fieldtest-floats.md
similarity index 100%
rename from docs/specs/2026-05-10-fieldtest-floats.md
rename to docs/specs/0006-fieldtest-floats.md
diff --git a/docs/specs/2026-05-10-canonical-type-names.md b/docs/specs/0007-canonical-type-names.md
similarity index 100%
rename from docs/specs/2026-05-10-canonical-type-names.md
rename to docs/specs/0007-canonical-type-names.md
diff --git a/docs/specs/2026-05-11-implement-orchestrator-agent.md b/docs/specs/0008-implement-orchestrator-agent.md
similarity index 100%
rename from docs/specs/2026-05-11-implement-orchestrator-agent.md
rename to docs/specs/0008-implement-orchestrator-agent.md
diff --git a/docs/specs/2026-05-11-plan-recon-subagent.md b/docs/specs/0009-plan-recon-subagent.md
similarity index 100%
rename from docs/specs/2026-05-11-plan-recon-subagent.md
rename to docs/specs/0009-plan-recon-subagent.md
diff --git a/docs/specs/2026-05-11-fieldtest-canonical-type-names.md b/docs/specs/0010-fieldtest-canonical-type-names.md
similarity index 100%
rename from docs/specs/2026-05-11-fieldtest-canonical-type-names.md
rename to docs/specs/0010-fieldtest-canonical-type-names.md
diff --git a/docs/specs/2026-05-11-audit-orchestrator-agent.md b/docs/specs/0011-audit-orchestrator-agent.md
similarity index 100%
rename from docs/specs/2026-05-11-audit-orchestrator-agent.md
rename to docs/specs/0011-audit-orchestrator-agent.md
diff --git a/docs/specs/2026-05-11-audit-fieldtest-docwriter-cadence.md b/docs/specs/0012-audit-fieldtest-docwriter-cadence.md
similarity index 100%
rename from docs/specs/2026-05-11-audit-fieldtest-docwriter-cadence.md
rename to docs/specs/0012-audit-fieldtest-docwriter-cadence.md
diff --git a/docs/specs/2026-05-11-brainstorm-grounding-check.md b/docs/specs/0013-brainstorm-grounding-check.md
similarity index 99%
rename from docs/specs/2026-05-11-brainstorm-grounding-check.md
rename to docs/specs/0013-brainstorm-grounding-check.md
index ee03c05..0b00975 100644
--- a/docs/specs/2026-05-11-brainstorm-grounding-check.md
+++ b/docs/specs/0013-brainstorm-grounding-check.md
@@ -188,7 +188,7 @@ The validation strategy has three layers:
 
 2. **Dry-run on past specs** is optional but useful for prompt
    tuning. The agent can be invoked manually on
-   `docs/specs/2026-05-09-skill-system.md` and other past specs to
+   `docs/specs/0001-skill-system.md` and other past specs to
    surface false-positive and false-negative rates before relying
    on it in the live pipeline. Not a hard acceptance criterion.
 
diff --git a/docs/specs/2026-05-11-23-eq-ord-prelude.md b/docs/specs/0014-23-eq-ord-prelude.md
similarity index 99%
rename from docs/specs/2026-05-11-23-eq-ord-prelude.md
rename to docs/specs/0014-23-eq-ord-prelude.md
index df3bbf2..fd548e0 100644
--- a/docs/specs/2026-05-11-23-eq-ord-prelude.md
+++ b/docs/specs/0014-23-eq-ord-prelude.md
@@ -402,7 +402,7 @@ relies on as currently-true.
    mechanism handles a free-fn body whose specialisation triggers
    a class-method specialisation.
 10. The canonical-form layer (per
-    `docs/specs/2026-05-10-canonical-type-names.md`, ct.4 closure)
+    `docs/specs/0007-canonical-type-names.md`, ct.4 closure)
     treats mono Defs as post-typecheck artefacts not in
     `CheckedModule.symbols`, so renaming or extending mono symbols
     does not affect surface-level hash pins.
diff --git a/docs/specs/2026-05-12-roundtrip-invariant.md b/docs/specs/0015-roundtrip-invariant.md
similarity index 100%
rename from docs/specs/2026-05-12-roundtrip-invariant.md
rename to docs/specs/0015-roundtrip-invariant.md
diff --git a/docs/specs/2026-05-12-boss-skill.md b/docs/specs/0016-boss-skill.md
similarity index 100%
rename from docs/specs/2026-05-12-boss-skill.md
rename to docs/specs/0016-boss-skill.md
diff --git a/docs/specs/2026-05-12-cross-model-authoring-form-test.md b/docs/specs/0017-cross-model-authoring-form-test.md
similarity index 100%
rename from docs/specs/2026-05-12-cross-model-authoring-form-test.md
rename to docs/specs/0017-cross-model-authoring-form-test.md
diff --git a/docs/specs/2026-05-12-multi-subject-codellama.md b/docs/specs/0018-multi-subject-codellama.md
similarity index 100%
rename from docs/specs/2026-05-12-multi-subject-codellama.md
rename to docs/specs/0018-multi-subject-codellama.md
diff --git a/docs/specs/2026-05-12-heap-str-abi.md b/docs/specs/0019-heap-str-abi.md
similarity index 100%
rename from docs/specs/2026-05-12-heap-str-abi.md
rename to docs/specs/0019-heap-str-abi.md
diff --git a/docs/specs/2026-05-12-effect-op-borrow.md b/docs/specs/0020-effect-op-borrow.md
similarity index 100%
rename from docs/specs/2026-05-12-effect-op-borrow.md
rename to docs/specs/0020-effect-op-borrow.md
diff --git a/docs/specs/2026-05-12-ct-tidy.md b/docs/specs/0021-ct-tidy.md
similarity index 100%
rename from docs/specs/2026-05-12-ct-tidy.md
rename to docs/specs/0021-ct-tidy.md
diff --git a/docs/specs/2026-05-12-24-show-print.md b/docs/specs/0022-24-show-print.md
similarity index 99%
rename from docs/specs/2026-05-12-24-show-print.md
rename to docs/specs/0022-24-show-print.md
index ed3cff9..f46da6c 100644
--- a/docs/specs/2026-05-12-24-show-print.md
+++ b/docs/specs/0022-24-show-print.md
@@ -653,7 +653,7 @@ relies on as currently-true.
     not an infrastructure extension.
 
 11. The canonical-form layer (per
-    `docs/specs/2026-05-10-canonical-type-names.md`) treats mono
+    `docs/specs/0007-canonical-type-names.md`) treats mono
     Defs as post-typecheck artefacts not in
     `CheckedModule.symbols`, so adding `show__T` and `print__T`
     symbols does not affect surface-level hash pins. The four
diff --git a/docs/specs/2026-05-13-module-qualified-class-names.md b/docs/specs/0023-module-qualified-class-names.md
similarity index 99%
rename from docs/specs/2026-05-13-module-qualified-class-names.md
rename to docs/specs/0023-module-qualified-class-names.md
index 4afc946..572e0f8 100644
--- a/docs/specs/2026-05-13-module-qualified-class-names.md
+++ b/docs/specs/0023-module-qualified-class-names.md
@@ -38,7 +38,7 @@ context, symmetric to `TypeDef.name`).
 Why this is the right shape: the canonical-type-names milestone
 explicitly out-of-scoped class-reference fields and named
 `MethodNameCollision` as the load-bearing workaround that made bare
-class names viable (`docs/specs/2026-05-10-canonical-type-names.md`
+class names viable (`docs/specs/0007-canonical-type-names.md`
 §"Out of scope: Class names"). This milestone closes that loop. The
 workaround was honest about being a workaround; this is the milestone
 that retires it.
@@ -413,7 +413,7 @@ If the qualifier names a class not in the workspace
 
 - **Milestone 24 (Show + print rewire).** Re-brainstorms separately
   against the post-retirement architecture per the deferral note at
-  `docs/specs/2026-05-12-24-show-print.md`'s Status header. The
+  `docs/specs/0022-24-show-print.md`'s Status header. The
   re-brainstorm is queued automatically once Iter 3 closes.
 
 - **Overlapping instances within a single class.** Already handled by
diff --git a/docs/specs/2026-05-13-24-show-print.md b/docs/specs/0024-24-show-print.md
similarity index 99%
rename from docs/specs/2026-05-13-24-show-print.md
rename to docs/specs/0024-24-show-print.md
index 7789585..1ef5385 100644
--- a/docs/specs/2026-05-13-24-show-print.md
+++ b/docs/specs/0024-24-show-print.md
@@ -3,7 +3,7 @@
 **Date:** 2026-05-13
 **Status:** Draft — awaiting user spec review
 **Authors:** Brummel (orchestrator) + Claude
-**Supersedes:** `docs/specs/2026-05-12-24-show-print.md` for iters 24.2 +
+**Supersedes:** `docs/specs/0022-24-show-print.md` for iters 24.2 +
 24.3 only. The earlier spec stays as historical context for the
 deferral rationale; iter 24.1 shipped against the earlier spec at
 `f38bad8` and is unchanged. This document re-derives 24.2 + 24.3 from
diff --git a/docs/specs/2026-05-13-form-a-default-authoring.md b/docs/specs/0025-form-a-default-authoring.md
similarity index 99%
rename from docs/specs/2026-05-13-form-a-default-authoring.md
rename to docs/specs/0025-form-a-default-authoring.md
index c875ee5..6a4583c 100644
--- a/docs/specs/2026-05-13-form-a-default-authoring.md
+++ b/docs/specs/0025-form-a-default-authoring.md
@@ -273,7 +273,7 @@ Justification per file:
 > and parsed at compile time via `ailang_surface::parse_prelude`. The
 > original §C4 (b) framing below is preserved as historical context;
 > it documents the doctrine inconsistency that prelude-decouple
-> resolved. See `docs/specs/2026-05-14-prelude-decouple.md` and the
+> resolved. See `docs/specs/0028-prelude-decouple.md` and the
 > per-iter journals 2026-05-14-iter-pd.{1,2,3}.md for the resolution.
 
 **(b) Compile-time-embed carve-outs (one file as of 2026-05-13):**
diff --git a/docs/specs/2026-05-13-fieldtest-form-a.md b/docs/specs/0026-fieldtest-form-a.md
similarity index 100%
rename from docs/specs/2026-05-13-fieldtest-form-a.md
rename to docs/specs/0026-fieldtest-form-a.md
diff --git a/docs/specs/2026-05-14-retire-per-type-print-effects.md b/docs/specs/0027-retire-per-type-print-effects.md
similarity index 100%
rename from docs/specs/2026-05-14-retire-per-type-print-effects.md
rename to docs/specs/0027-retire-per-type-print-effects.md
diff --git a/docs/specs/2026-05-14-prelude-decouple.md b/docs/specs/0028-prelude-decouple.md
similarity index 99%
rename from docs/specs/2026-05-14-prelude-decouple.md
rename to docs/specs/0028-prelude-decouple.md
index 2e8052f..1b849bd 100644
--- a/docs/specs/2026-05-14-prelude-decouple.md
+++ b/docs/specs/0028-prelude-decouple.md
@@ -21,7 +21,7 @@ all knowledge of the literal module name `"prelude"` from
    becomes a pure module-graph + schema-validator with no language-
    content awareness.
 3. The §C4 (b) compile-time-embed carve-out in
-   `docs/specs/2026-05-13-form-a-default-authoring.md` becomes empty
+   `docs/specs/0025-form-a-default-authoring.md` becomes empty
    and is struck. The seven §C4 (a) subject-matter-rejection
    fixtures remain the only `.ail.json` files in the corpus.
 
@@ -403,7 +403,7 @@ The milestone closes when ALL of the following hold:
    pins above.
 5. `bench/check.py`, `bench/compile_check.py`, `bench/cross_lang.py`
    are green at unchanged baselines.
-6. `docs/specs/2026-05-13-form-a-default-authoring.md` §C4 (b) is
+6. `docs/specs/0025-form-a-default-authoring.md` §C4 (b) is
    updated: the carve-out list is empty; the section either
    deletes the (b) sub-bullet or notes "retired by
    prelude-decouple milestone, 2026-05-14".
diff --git a/docs/specs/2026-05-15-mut-local.md b/docs/specs/0029-mut-local.md
similarity index 100%
rename from docs/specs/2026-05-15-mut-local.md
rename to docs/specs/0029-mut-local.md
diff --git a/docs/specs/2026-05-15-fieldtest-mut-local.md b/docs/specs/0030-fieldtest-mut-local.md
similarity index 100%
rename from docs/specs/2026-05-15-fieldtest-mut-local.md
rename to docs/specs/0030-fieldtest-mut-local.md
diff --git a/docs/specs/2026-05-15-iteration-discipline.md b/docs/specs/0031-iteration-discipline.md
similarity index 99%
rename from docs/specs/2026-05-15-iteration-discipline.md
rename to docs/specs/0031-iteration-discipline.md
index da904c0..51c4099 100644
--- a/docs/specs/2026-05-15-iteration-discipline.md
+++ b/docs/specs/0031-iteration-discipline.md
@@ -1,5 +1,5 @@
 > **SUPERSEDED 2026-05-16 by
-> `docs/specs/2026-05-16-iteration-discipline-revert.md`.** This
+> `docs/specs/0032-iteration-discipline-revert.md`.** This
 > milestone was reverted in full (it.1 + it.2 backed out forward;
 > it.3 never ran). It is retained as a historical record of the
 > attempt and the design-thesis gap it surfaced; it is **not** the
@@ -120,7 +120,7 @@ First-iteration planner scope: **it.1** in full.
 ## Components
 
 Per-construct touch-point set follows the mut-local milestone
-template (`docs/specs/2026-05-15-mut-local.md` §Components): AST+serde
+template (`docs/specs/0029-mut-local.md` §Components): AST+serde
 → schema-drift + DESIGN.md §Data-model anchor → Form-A surface
 parse+print → round-trip fixture → check arm + diagnostics → codegen
 lower + escape → e2e example.
diff --git a/docs/specs/2026-05-16-iteration-discipline-revert.md b/docs/specs/0032-iteration-discipline-revert.md
similarity index 99%
rename from docs/specs/2026-05-16-iteration-discipline-revert.md
rename to docs/specs/0032-iteration-discipline-revert.md
index c15dcc2..d4c45a0 100644
--- a/docs/specs/2026-05-16-iteration-discipline-revert.md
+++ b/docs/specs/0032-iteration-discipline-revert.md
@@ -21,7 +21,7 @@ Root cause being corrected (recorded so a future reader does not
 re-derive the same mistake):
 
 - The milestone was scoped from fieldtest finding **F1**
-  (`docs/specs/2026-05-15-fieldtest-mut-local.md`), which was tagged
+  (`docs/specs/0030-fieldtest-mut-local.md`), which was tagged
   `[friction]` and whose *own* summary table named the honest minimal
   action: "tighten DESIGN.md to name the gap — less work, more
   honest". It was instead escalated into "retire `tail-app`,
@@ -237,8 +237,8 @@ oracle for every *restored* file).
 ### Working tree / docs hygiene
 
 - Discard the uncommitted A1 amendment to
-  `docs/specs/2026-05-15-iteration-discipline.md`
-  (`git checkout -- docs/specs/2026-05-15-iteration-discipline.md`),
+  `docs/specs/0031-iteration-discipline.md`
+  (`git checkout -- docs/specs/0031-iteration-discipline.md`),
   then add a **superseded header** to that committed spec pointing to
   this one (specs are per-milestone historical records — superseded,
   not deleted). The it.1/it.2/it.3 plans under `docs/plans/` and the
diff --git a/docs/specs/2026-05-17-llm-surface-discipline.md b/docs/specs/0033-llm-surface-discipline.md
similarity index 98%
rename from docs/specs/2026-05-17-llm-surface-discipline.md
rename to docs/specs/0033-llm-surface-discipline.md
index f84b1fc..88f74cd 100644
--- a/docs/specs/2026-05-17-llm-surface-discipline.md
+++ b/docs/specs/0033-llm-surface-discipline.md
@@ -215,8 +215,8 @@ per cost.
   addressed), Decision 3 (pure core + effects), Decision 8
   (verified tail calls), Decision 9/10 (RC + uniqueness, no
   collector), Feature-acceptance criterion.
-- `docs/specs/2026-05-15-mut-local.md` — the sealed-mut milestone
+- `docs/specs/0029-mut-local.md` — the sealed-mut milestone
   whose redundancy §6.3 questions.
-- `docs/specs/2026-05-16-iteration-discipline-revert.md` — why
+- `docs/specs/0032-iteration-discipline-revert.md` — why
   the bundled loop/recur milestone was backed out; §6.2 is the
   de-bundled re-attempt.
diff --git a/docs/specs/2026-05-17-loop-recur.md b/docs/specs/0034-loop-recur.md
similarity index 98%
rename from docs/specs/2026-05-17-loop-recur.md
rename to docs/specs/0034-loop-recur.md
index 826678b..e1d05b7 100644
--- a/docs/specs/2026-05-17-loop-recur.md
+++ b/docs/specs/0034-loop-recur.md
@@ -306,11 +306,11 @@ from the current `lib.rs` ctx structure. Explicitly **excluded**:
 
 - `docs/DESIGN.md` — Decision 8 (verified tail calls; unchanged),
   Roundtrip Invariant, Feature-acceptance criterion, §"Data model".
-- `docs/specs/2026-05-16-iteration-discipline-revert.md` — why the
+- `docs/specs/0032-iteration-discipline-revert.md` — why the
   bundle was reverted; this spec is the de-bundled, gate-passed
   re-attempt of its it.1 core only.
-- `docs/specs/2026-05-15-iteration-discipline.md` — superseded
+- `docs/specs/0031-iteration-discipline.md` — superseded
   bundle spec; its it.1 surface is the *shape* reference (its it.2 /
   it.3 content is explicitly out of scope here).
-- `docs/specs/2026-05-17-llm-surface-discipline.md` §6.2 — the
+- `docs/specs/0033-llm-surface-discipline.md` §6.2 — the
   principles entry this milestone discharges.
diff --git a/docs/specs/2026-05-18-fieldtest-loop-recur.md b/docs/specs/0035-fieldtest-loop-recur.md
similarity index 100%
rename from docs/specs/2026-05-18-fieldtest-loop-recur.md
rename to docs/specs/0035-fieldtest-loop-recur.md
diff --git a/docs/specs/2026-05-18-prose-loop-binders.md b/docs/specs/0036-prose-loop-binders.md
similarity index 100%
rename from docs/specs/2026-05-18-prose-loop-binders.md
rename to docs/specs/0036-prose-loop-binders.md
diff --git a/docs/specs/2026-05-18-remove-mut-var-assign.md b/docs/specs/0037-remove-mut-var-assign.md
similarity index 100%
rename from docs/specs/2026-05-18-remove-mut-var-assign.md
rename to docs/specs/0037-remove-mut-var-assign.md
diff --git a/docs/specs/2026-05-18-fieldtest-remove-mut-var-assign.md b/docs/specs/0038-fieldtest-remove-mut-var-assign.md
similarity index 100%
rename from docs/specs/2026-05-18-fieldtest-remove-mut-var-assign.md
rename to docs/specs/0038-fieldtest-remove-mut-var-assign.md
diff --git a/docs/specs/2026-05-18-docs-honesty-lint.md b/docs/specs/0039-docs-honesty-lint.md
similarity index 100%
rename from docs/specs/2026-05-18-docs-honesty-lint.md
rename to docs/specs/0039-docs-honesty-lint.md
diff --git a/docs/specs/2026-05-18-embedding-abi-m1.md b/docs/specs/0040-embedding-abi-m1.md
similarity index 100%
rename from docs/specs/2026-05-18-embedding-abi-m1.md
rename to docs/specs/0040-embedding-abi-m1.md
diff --git a/docs/specs/2026-05-18-fieldtest-embedding-abi-m1.md b/docs/specs/0041-fieldtest-embedding-abi-m1.md
similarity index 100%
rename from docs/specs/2026-05-18-fieldtest-embedding-abi-m1.md
rename to docs/specs/0041-fieldtest-embedding-abi-m1.md
diff --git a/docs/specs/2026-05-18-embedding-abi-m2.md b/docs/specs/0042-embedding-abi-m2.md
similarity index 100%
rename from docs/specs/2026-05-18-embedding-abi-m2.md
rename to docs/specs/0042-embedding-abi-m2.md
diff --git a/docs/specs/2026-05-18-embedding-abi-m3.md b/docs/specs/0043-embedding-abi-m3.md
similarity index 100%
rename from docs/specs/2026-05-18-embedding-abi-m3.md
rename to docs/specs/0043-embedding-abi-m3.md
diff --git a/docs/specs/2026-05-19-embedding-abi-m5.md b/docs/specs/0044-embedding-abi-m5.md
similarity index 100%
rename from docs/specs/2026-05-19-embedding-abi-m5.md
rename to docs/specs/0044-embedding-abi-m5.md
diff --git a/docs/specs/2026-05-19-design-md-rolesplit.md b/docs/specs/0045-design-md-rolesplit.md
similarity index 85%
rename from docs/specs/2026-05-19-design-md-rolesplit.md
rename to docs/specs/0045-design-md-rolesplit.md
index f5a5912..a6fa70c 100644
--- a/docs/specs/2026-05-19-design-md-rolesplit.md
+++ b/docs/specs/0045-design-md-rolesplit.md
@@ -100,7 +100,7 @@ Five structural commitments:
      `"whether the document asserts something exists, works, or
      changed that does not"` (both inside
      `design_md_present_tense_anchors_present`). This becomes
-     `contracts/honesty-rule.md`, **rewritten** so the rule states
+     `contracts/0007-honesty-rule.md`, **rewritten** so the rule states
      the new home (rationale → `docs/journals/`); those two pins are
      retargeted to the new file *and* the new wording in the same
      atomic change.
@@ -152,32 +152,32 @@ header when the code is the single source of truth.
 ## Contracts
 | id | consumer / lifetime | ratifying-test | link |
 |----|---------------------|----------------|------|
-| feature-acceptance   | brainstorm-gate / stable      | skills/brainstorm/SKILL.md Step 4         | contracts/feature-acceptance.md |
-| authoring-surface    | LLM author / stable           | crates/ailang-surface round_trip.rs       | contracts/authoring-surface.md |
-| roundtrip-invariant  | every release / stable        | crates/ailang-surface round_trip.rs       | contracts/roundtrip-invariant.md |
-| memory-model         | LLM author / stable           | crates/ailang-check/src/uniqueness.rs (in-source mod tests) | contracts/memory-model.md |
-| data-model           | LLM author / stable           | crates/ailang-core/tests/design_schema_drift.rs | contracts/data-model.md |
+| feature-acceptance   | brainstorm-gate / stable      | skills/brainstorm/SKILL.md Step 4         | contracts/0004-feature-acceptance.md |
+| authoring-surface    | LLM author / stable           | crates/ailang-surface round_trip.rs       | contracts/0001-authoring-surface.md |
+| roundtrip-invariant  | every release / stable        | crates/ailang-surface round_trip.rs       | contracts/0009-roundtrip-invariant.md |
+| memory-model         | LLM author / stable           | crates/ailang-check/src/uniqueness.rs (in-source mod tests) | contracts/0008-memory-model.md |
+| data-model           | LLM author / stable           | crates/ailang-core/tests/design_schema_drift.rs | contracts/0002-data-model.md |
 | mangling             | codegen / stable              | crates/ail/tests/eq_ord_e2e.rs            | crates/ailang-codegen/src/lib.rs //! |
 | env-construction     | codegen / stable              | crates/ailang-check/tests/duplicate_ctor_pin.rs | crates/ailang-codegen/src/lib.rs //! |
 | qualified-xref       | codegen / stable              | crates/ail/tests/codegen_import_map_fallback_pin.rs | crates/ail/src/main.rs //! |
-| frozen-value-layout  | embedding ABI / one-way-frozen| crates/ailang-codegen/tests/embed_record_layout_pin.rs | contracts/frozen-value-layout.md + runtime/rc.c §layout |
-| float-semantics      | LLM author / stable           | crates/ail/tests/eq_float_noinstance.rs   | contracts/float-semantics.md |
-| typeclasses          | LLM author / stable           | crates/ail/tests/show_no_instance_e2e.rs  | contracts/typeclasses.md |
-| str-abi              | runtime ABI / stable          | crates/ail/tests/e2e.rs (Str path)        | contracts/str-abi.md + runtime/str.c §heap-Str |
-| tail-calls           | codegen / stable              | crates/ailang-check/src/lib.rs (in-source tail_call_in_non_tail_position_is_rejected) | contracts/tail-calls.md |
-| honesty-rule         | architect+grounding / stable  | crates/ailang-core/tests/docs_honesty_pin.rs | contracts/honesty-rule.md |
-| embedding-abi        | embedding host / stable       | crates/ailang-codegen/tests/embed_record_layout_pin.rs | contracts/embedding-abi.md |
-| scope-boundaries     | architect+author / stable     | crates/ailang-core/tests/effect_doc_honesty_pin.rs | contracts/scope-boundaries.md |
-| verification         | architect / stable            | bench/architect_sweeps.sh                 | contracts/verification.md |
+| frozen-value-layout  | embedding ABI / one-way-frozen| crates/ailang-codegen/tests/embed_record_layout_pin.rs | contracts/0006-frozen-value-layout.md + runtime/rc.c §layout |
+| float-semantics      | LLM author / stable           | crates/ail/tests/eq_float_noinstance.rs   | contracts/0005-float-semantics.md |
+| typeclasses          | LLM author / stable           | crates/ail/tests/show_no_instance_e2e.rs  | contracts/0013-typeclasses.md |
+| str-abi              | runtime ABI / stable          | crates/ail/tests/e2e.rs (Str path)        | contracts/0011-str-abi.md + runtime/str.c §heap-Str |
+| tail-calls           | codegen / stable              | crates/ailang-check/src/lib.rs (in-source tail_call_in_non_tail_position_is_rejected) | contracts/0012-tail-calls.md |
+| honesty-rule         | architect+grounding / stable  | crates/ailang-core/tests/docs_honesty_pin.rs | contracts/0007-honesty-rule.md |
+| embedding-abi        | embedding host / stable       | crates/ailang-codegen/tests/embed_record_layout_pin.rs | contracts/0003-embedding-abi.md |
+| scope-boundaries     | architect+author / stable     | crates/ailang-core/tests/effect_doc_honesty_pin.rs | contracts/0010-scope-boundaries.md |
+| verification         | architect / stable            | bench/architect_sweeps.sh                 | contracts/0014-verification.md |
 
 ## Models
 | id | consumer / lifetime | link |
 |----|---------------------|------|
-| rc-uniqueness     | onboarding / evolves | models/rc-uniqueness.md |
-| typeclasses       | onboarding / evolves | models/typeclasses.md |
-| effects           | onboarding / evolves | models/effects.md |
-| authoring-surface | onboarding / evolves | models/authoring-surface.md |
-| pipeline          | onboarding / evolves | models/pipeline.md |
+| rc-uniqueness     | onboarding / evolves | models/0004-rc-uniqueness.md |
+| typeclasses       | onboarding / evolves | models/0005-typeclasses.md |
+| effects           | onboarding / evolves | models/0002-effects.md |
+| authoring-surface | onboarding / evolves | models/0001-authoring-surface.md |
+| pipeline          | onboarding / evolves | models/0003-pipeline.md |
 ```
 
 The `ratifying-test` column above is now **Boss-resolved to exact
@@ -191,7 +191,7 @@ are in the **Appendix — Boss-adjudicated relocation map** at the
 end of this spec; that appendix is the authoritative,
 placeholder-free map the planner consumes.
 
-**A sample contract file** — `design/contracts/float-semantics.md`
+**A sample contract file** — `design/contracts/0005-float-semantics.md`
 (content moved verbatim from DESIGN.md:2700–2838, header re-levelled
 to file root, all decision-record/why-prose stripped to the journal):
 
@@ -275,7 +275,7 @@ writes that **must fail** to typecheck:
 
 ```
 - orderability per IEEE-754); see DESIGN.md §\"Float semantics\".",
-+ orderability per IEEE-754); see design/contracts/float-semantics.md.",
++ orderability per IEEE-754); see design/contracts/0005-float-semantics.md.",
 ```
 
 `crates/ailang-check/src/lib.rs:888` (the Show branch):
@@ -283,7 +283,7 @@ writes that **must fail** to typecheck:
 ```
 - the prelude; see DESIGN.md §\"Prelude (built-in) \
 - classes\". User types declare their own \
-+ the prelude; see design/contracts/typeclasses.md. \
++ the prelude; see design/contracts/0013-typeclasses.md. \
 + User types declare their own \
 ```
 
@@ -294,12 +294,12 @@ vanish, so it updates in lockstep:
 ```rust
 -   no_inst.message.contains("Float semantics") || no_inst.message.contains("DESIGN"),
 -   "expected NoInstance message to cross-reference DESIGN.md §Float semantics, got: {:?}",
-+   no_inst.message.contains("design/contracts/float-semantics.md"),
++   no_inst.message.contains("design/contracts/0005-float-semantics.md"),
 +   "expected NoInstance message to cross-reference the float-semantics contract, got: {:?}",
 ```
 
 `crates/ail/tests/show_no_instance_e2e.rs:48` — analogous: the
-asserted substring becomes `"design/contracts/typeclasses.md"`.
+asserted substring becomes `"design/contracts/0013-typeclasses.md"`.
 
 ### 3. The four executable retargets (before → after)
 
@@ -321,7 +321,7 @@ scans all `design/` prose; the verbatim regexes are unchanged.
 
 ```rust
 - const DESIGN_MD: &str = include_str!("../../../docs/DESIGN.md");
-+ const DATA_MODEL: &str = include_str!("../../../design/contracts/data-model.md");
++ const DATA_MODEL: &str = include_str!("../../../design/contracts/0002-data-model.md");
 ```
 
 The `data_model_section()` slicer (`## Data model` … `\n## Pipeline`)
@@ -338,7 +338,7 @@ now lives. The present/absent pin strings are unchanged **except**
 the two honesty-rule anchors at `docs_honesty_pin.rs:70,72` (`"the
 honesty rule it holds itself to"` / `"whether the document asserts
 something exists, works, or changed that does not"`), which are
-updated to the rewritten `contracts/honesty-rule.md` wording in
+updated to the rewritten `contracts/0007-honesty-rule.md` wording in
 lockstep with that file. The Decision-6 `:242` audit-trail sentence
 is pinned by no test (verified) and is retired to the decision-record
 journal, not retargeted — there is nothing to repoint, by design.
@@ -361,7 +361,7 @@ The other ~11 reading-list bullets
 `quality-reviewer`, `plan-recon`, `docwriter`) are rewritten to their
 role: grounding-check and architect read `contracts/`; fieldtester
 reads `INDEX.md` + `models/` (no-edit limit preserved, repointed);
-bencher reads `models/rc-uniqueness.md` (Decision-9/Boehm narrative);
+bencher reads `models/0004-rc-uniqueness.md` (Decision-9/Boehm narrative);
 the rest point at `design/INDEX.md` as the spine.
 
 ## Components
@@ -408,7 +408,7 @@ rejected" passage, moved whole at `###` granularity. The journals
 - **grounding-check, per spec:** reads `design/INDEX.md` → the
   contract rows the spec's assumptions touch → composes.
 - **LLM author, NoInstance:** the diagnostic names
-  `design/contracts/float-semantics.md` (or `…/typeclasses.md`) →
+  `design/contracts/0005-float-semantics.md` (or `…/typeclasses.md`) →
   opens exactly that contract → self-corrects.
 - **Future brainstorm tempted to re-propose region inference:** the
   "why rejected" prose is in
@@ -503,8 +503,8 @@ All failure modes fail closed:
 5. `design_schema_drift.rs`, `docs_honesty_pin.rs`,
    `effect_doc_honesty_pin.rs` are GREEN against the new files;
    their protected properties are unchanged.
-6. The compiler emits `design/contracts/float-semantics.md` /
-   `design/contracts/typeclasses.md` in the two NoInstance
+6. The compiler emits `design/contracts/0005-float-semantics.md` /
+   `design/contracts/0013-typeclasses.md` in the two NoInstance
    diagnostics; `eq_float_noinstance.rs` and `show_no_instance_e2e.rs`
    assert the new pointer and are GREEN.
 7. `cargo test` workspace-wide is GREEN; `cargo build` is clean.
@@ -547,64 +547,64 @@ how-the-doc-reached-its-wording.
 |---|---|---|
 | `## Goal` | 6–18 | IX preamble |
 | `## Project ecosystem` (intro) | 19–55 | IX preamble |
-| ` ### What this document is — honesty rule` | 56–82 | `contracts/honesty-rule.md` (**rewritten**; pins `docs_honesty_pin.rs:70,72`) |
+| ` ### What this document is — honesty rule` | 56–82 | `contracts/0007-honesty-rule.md` (**rewritten**; pins `docs_honesty_pin.rs:70,72`) |
 | `## Project language: English` | 83–92 | IX preamble |
-| `## Feature-acceptance criterion` | 93–164 | `contracts/feature-acceptance.md` |
+| `## Feature-acceptance criterion` | 93–164 | `contracts/0004-feature-acceptance.md` |
 | `## Decision 1: source = data` | 165–176 | D |
 | `## Decision 2: content-addressed` | 177–189 | D |
-| `## Decision 3: pure core + effects` | 190–204 | `models/effects.md` (pins `effect_doc_honesty_pin.rs` present-anchors — pin reads this file) |
+| `## Decision 3: pure core + effects` | 190–204 | `models/0002-effects.md` (pins `effect_doc_honesty_pin.rs` present-anchors — pin reads this file) |
 | `## Decision 4: HM + refinements` | 205–213 | D |
 | `## Decision 5: emit LLVM IR as text` | 214–229 | D |
-| `## Decision 6` intro | 230–240 | `contracts/authoring-surface.md` |
+| `## Decision 6` intro | 230–240 | `contracts/0001-authoring-surface.md` |
 | ` (Decision 6 :241–243 audit-trail sentence)` | 241–243 | D (retired, no successor pin — §Architecture-4) |
 | ` ### Why this is opening up` | 245–267 | D |
-| ` ### Architectural pin: data structure is SoT` | 268–297 | `contracts/authoring-surface.md` |
-| ` ### Constraints (hard, in priority order)` | 298–331 | `contracts/authoring-surface.md` |
-| ` ### Candidate notations` | 332–471 | `models/authoring-surface.md` |
+| ` ### Architectural pin: data structure is SoT` | 268–297 | `contracts/0001-authoring-surface.md` |
+| ` ### Constraints (hard, in priority order)` | 298–331 | `contracts/0001-authoring-surface.md` |
+| ` ### Candidate notations` | 332–471 | `models/0001-authoring-surface.md` |
 | ` ### First choice and rollback plan` | 472–486 | D |
 | ` ### Implementation outline` | 487–519 | D |
 | ` ### What this Decision deliberately does not do` | 520–536 | D |
 | ` ### Form refinements during implementation` | 537–589 | D |
-| ` ### Form (B) — human prose projection` | 590–674 | `models/authoring-surface.md` (the Form-B placeholder present-anchor in `docs_honesty_pin.rs` re-points here) |
+| ` ### Form (B) — human prose projection` | 590–674 | `models/0001-authoring-surface.md` (the Form-B placeholder present-anchor in `docs_honesty_pin.rs` re-points here) |
 | ` ### Empirical addendum` | 675–730 | D |
-| `## Decision 8: explicit verified tail calls` | 731–787 | `contracts/tail-calls.md` |
-| `## Decision 9` intro | 788–852 | `models/rc-uniqueness.md` |
-| ` ### Per-fn arena via stack alloca` | 853–913 | `models/rc-uniqueness.md` |
-| `## Decision 10` intro | 914–977 | `models/rc-uniqueness.md` |
+| `## Decision 8: explicit verified tail calls` | 731–787 | `contracts/0012-tail-calls.md` |
+| `## Decision 9` intro | 788–852 | `models/0004-rc-uniqueness.md` |
+| ` ### Per-fn arena via stack alloca` | 853–913 | `models/0004-rc-uniqueness.md` |
+| `## Decision 10` intro | 914–977 | `models/0004-rc-uniqueness.md` |
 | ` ### Why not other memory models` | 978–1014 | D |
-| ` ### The LLM-aware sharpening` | 1015–1122 | `models/rc-uniqueness.md` |
-| ` ### Language-design constraints (binding)` | 1123–1150 | `contracts/memory-model.md` |
-| ` ### Schema additions` | 1151–1312 | `contracts/memory-model.md` |
-| ` ### Advisory diagnostics` | 1313–1351 | `contracts/memory-model.md` |
+| ` ### The LLM-aware sharpening` | 1015–1122 | `models/0004-rc-uniqueness.md` |
+| ` ### Language-design constraints (binding)` | 1123–1150 | `contracts/0008-memory-model.md` |
+| ` ### Schema additions` | 1151–1312 | `contracts/0008-memory-model.md` |
+| ` ### Advisory diagnostics` | 1313–1351 | `contracts/0008-memory-model.md` |
 | ` ### Why advisory + suppress instead of inference` | 1352–1377 | D |
-| ` ### Inference algorithm` | 1378–1393 | `models/rc-uniqueness.md` |
-| ` ### Codegen contract` | 1394–1412 | `contracts/memory-model.md` |
-| ` ### Mode metadata is load-bearing for codegen` | 1413–1509 | `contracts/memory-model.md` |
+| ` ### Inference algorithm` | 1378–1393 | `models/0004-rc-uniqueness.md` |
+| ` ### Codegen contract` | 1394–1412 | `contracts/0008-memory-model.md` |
+| ` ### Mode metadata is load-bearing for codegen` | 1413–1509 | `contracts/0008-memory-model.md` |
 | ` ### Adjacent extensions for mutability (out of scope)` | 1510–1519 | D |
 | ` ### What this Decision deliberately does not do` | 1520–1535 | D |
-| `## Decision 11` intro | 1536–1577 | `models/typeclasses.md` |
-| ` ### Form-A schema (JSON authoring surface)` | 1578–1639 | `contracts/typeclasses.md` |
-| ` ### Resolution and monomorphisation` | 1640–1752 | `models/typeclasses.md` |
-| ` ### Cross-module references in synthesised bodies` | 1753–1823 | `contracts/typeclasses.md` (pins `codegen_import_map_fallback_pin.rs:2`, `polyfn_dot_qualified_branch_pin.rs:2`) |
-| ` ### Defaults and superclasses` | 1824–1855 | `contracts/typeclasses.md` |
-| ` ### Diagnostic categories` | 1856–1917 | `contracts/typeclasses.md` |
-| ` ### Method dispatch` | 1918–1964 | `contracts/typeclasses.md` |
+| `## Decision 11` intro | 1536–1577 | `models/0005-typeclasses.md` |
+| ` ### Form-A schema (JSON authoring surface)` | 1578–1639 | `contracts/0013-typeclasses.md` |
+| ` ### Resolution and monomorphisation` | 1640–1752 | `models/0005-typeclasses.md` |
+| ` ### Cross-module references in synthesised bodies` | 1753–1823 | `contracts/0013-typeclasses.md` (pins `codegen_import_map_fallback_pin.rs:2`, `polyfn_dot_qualified_branch_pin.rs:2`) |
+| ` ### Defaults and superclasses` | 1824–1855 | `contracts/0013-typeclasses.md` |
+| ` ### Diagnostic categories` | 1856–1917 | `contracts/0013-typeclasses.md` |
+| ` ### Method dispatch` | 1918–1964 | `contracts/0013-typeclasses.md` |
 | ` ### What the typeclass design explicitly does NOT support` | 1965–2000 | D |
-| ` ### Prelude (built-in) classes` | 2001–2042 | `contracts/typeclasses.md` (pins `show_no_instance_e2e.rs:47`; Show diagnostic target) |
-| ` ### Heap-Str primitives` | 2043–2088 | `contracts/str-abi.md` (ledger addition — see below) |
+| ` ### Prelude (built-in) classes` | 2001–2042 | `contracts/0013-typeclasses.md` (pins `show_no_instance_e2e.rs:47`; Show diagnostic target) |
+| ` ### Heap-Str primitives` | 2043–2088 | `contracts/0011-str-abi.md` (ledger addition — see below) |
 | ` ### What this decision does NOT commit to` | 2089–2112 | D |
-| `## Roundtrip Invariant` (+ 3 `###`s 2152–2208) | 2113–2208 | `contracts/roundtrip-invariant.md` (whole block kept together — pins `round_trip.rs:10,72`) |
+| `## Roundtrip Invariant` (+ 3 `###`s 2152–2208) | 2113–2208 | `contracts/0009-roundtrip-invariant.md` (whole block kept together — pins `round_trip.rs:10,72`) |
 | `## Mangling scheme` | 2209–2218 | **source-link only** (no prose file): behaviour → dropped (code is SoT); any "why" sentence → D |
 | `## Convention: qualified cross-module references` | 2219–2236 | **source-link only** `qualified-xref` (ledger addition): behaviour → dropped; rationale → D |
 | `## Env construction` | 2237–2265 | **source-link only** (no prose file): behaviour → dropped (code is SoT); any "why" sentence → D |
-| `## Embedding ABI` intro | 2266–2333 | `contracts/embedding-abi.md` (pins `docs_honesty_pin.rs:135`) |
-| ` ### Frozen value layout (M3 — one-way commitment)` | 2334–2376 | `contracts/frozen-value-layout.md` + source-link `runtime/rc.c §layout` (dual; pins `embed_record_layout_pin.rs:1`) |
-| `## Data model` (+ 4 `###`s) | 2377–2615 | `contracts/data-model.md` (whole; `design_schema_drift.rs` `include_str!`s it) |
-| `## Pipeline` | 2616–2662 | `models/pipeline.md` |
-| `## CLI` | 2663–2686 | `models/pipeline.md` |
-| `## Verification and correctness (across cycles)` | 2687–2699 | `contracts/verification.md` |
-| `## Float semantics` | 2700–2838 | `contracts/float-semantics.md` (the inline `**Str ABI.**` para at 2802 is **moved to `contracts/str-abi.md`** — the one sentence-level exception, justified below) |
-| `## What is not (yet) supported` | 2839–3020 | `contracts/scope-boundaries.md` (ledger addition — present-tense, honesty-pinned by `effect_doc_honesty_pin.rs:28`) |
+| `## Embedding ABI` intro | 2266–2333 | `contracts/0003-embedding-abi.md` (pins `docs_honesty_pin.rs:135`) |
+| ` ### Frozen value layout (M3 — one-way commitment)` | 2334–2376 | `contracts/0006-frozen-value-layout.md` + source-link `runtime/rc.c §layout` (dual; pins `embed_record_layout_pin.rs:1`) |
+| `## Data model` (+ 4 `###`s) | 2377–2615 | `contracts/0002-data-model.md` (whole; `design_schema_drift.rs` `include_str!`s it) |
+| `## Pipeline` | 2616–2662 | `models/0003-pipeline.md` |
+| `## CLI` | 2663–2686 | `models/0003-pipeline.md` |
+| `## Verification and correctness (across cycles)` | 2687–2699 | `contracts/0014-verification.md` |
+| `## Float semantics` | 2700–2838 | `contracts/0005-float-semantics.md` (the inline `**Str ABI.**` para at 2802 is **moved to `contracts/0011-str-abi.md`** — the one sentence-level exception, justified below) |
+| `## What is not (yet) supported` | 2839–3020 | `contracts/0010-scope-boundaries.md` (ledger addition — present-tense, honesty-pinned by `effect_doc_honesty_pin.rs:28`) |
 
 ### Ledger additions — rationale (the brainstorm's 12-list under-counted)
 
diff --git a/docs/specs/2026-05-19-design-ledger-formal-links.md b/docs/specs/0046-design-ledger-formal-links.md
similarity index 95%
rename from docs/specs/2026-05-19-design-ledger-formal-links.md
rename to docs/specs/0046-design-ledger-formal-links.md
index c400b53..9efe78d 100644
--- a/docs/specs/2026-05-19-design-ledger-formal-links.md
+++ b/docs/specs/0046-design-ledger-formal-links.md
@@ -8,7 +8,7 @@
 
 Make the `design/` ledger a browsable wiki: replace informal prose
 cross-references between contracts/models (`(see "Str ABI" below)`,
-`(see design/contracts/str-abi.md …)`, `see §"Data model"`) with
+`(see design/contracts/0011-str-abi.md …)`, `see §"Data model"`) with
 **formal, machine-checkable, file-level Markdown links**, and add an
 in-tree hard gate that turns a broken cross-link into a same-commit
 test failure instead of silent rot.
@@ -27,7 +27,7 @@ The milestone has **no authoring surface**: it changes no `.ail`
 program, no language construct, no compiler/checker/codegen path. It
 is a documentation-form + Rust-test-infrastructure milestone, the
 same category as the immediately-preceding DESIGN.md → design/ split
-(`docs/specs/2026-05-19-design-md-rolesplit.md`), whose concrete code
+(`docs/specs/0045-design-md-rolesplit.md`), whose concrete code
 was likewise the structural Rust pin plus the ledger shape, audited
 clean. The no-`.ail` disposition is therefore precedent-governed and
 reasoned, not an omission (see Concrete code shapes §"No authoring
@@ -103,11 +103,11 @@ not forks):
   the non-durable tier; else **(c)** deleted outright **only if the
   reference itself is relitigation residue** (clause-3-class).
   Recon-confirmed canonical instance:
-  `design/models/pipeline.md:61` and
-  `design/models/authoring-surface.md:180`, both
+  `design/models/0003-pipeline.md:61` and
+  `design/models/0001-authoring-surface.md:180`, both
   `(see docs/PROSE_ROUNDTRIP.md)`, cite the *prose-mediator cycle /
   `ail merge-prose`* — content
-  `design/contracts/roundtrip-invariant.md` does **not** carry
+  `design/contracts/0009-roundtrip-invariant.md` does **not** carry
   (that contract is the orthogonal hashing / parse-determinism
   invariant). (a) is therefore unavailable and the content is real
   current behaviour, not relitigation, so the disposition is
@@ -340,16 +340,16 @@ Three real, in-tree references (recon-confirmed line numbers; exact
 bytes are the planner's):
 
 ```
-design/contracts/float-semantics.md:100  (the tidy precedent, still
+design/contracts/0005-float-semantics.md:100  (the tidy precedent, still
   half-formal: bare root path in prose, not a Markdown link)
 - before:  … a fresh heap-Str slab at the call site (see
-           design/contracts/str-abi.md for the dual realisation).
+           design/contracts/0011-str-abi.md for the dual realisation).
 - after:   … a fresh heap-Str slab at the call site (see
            [Str ABI](str-abi.md) for the dual realisation).
            # float-semantics.md and str-abi.md are siblings in
            # design/contracts/ ⇒ file-relative target is `str-abi.md`
 
-design/contracts/embedding-abi.md:45  (informal AND stale-direction
+design/contracts/0003-embedding-abi.md:45  (informal AND stale-direction
   — the exact wart class motivating the milestone: "below" but the
   target is a different file)
 - before:  … layout is **frozen as of M3** (see "Frozen value
@@ -357,7 +357,7 @@ design/contracts/embedding-abi.md:45  (informal AND stale-direction
 - after:   … layout is **frozen as of M3** (see
            [Frozen value layout](frozen-value-layout.md)); …
 
-design/models/pipeline.md:61 + design/models/authoring-surface.md:180
+design/models/0003-pipeline.md:61 + design/models/0001-authoring-surface.md:180
   (the canonical HOMELESS references — `(see docs/PROSE_ROUNDTRIP.md)`
   into the non-durable tier; recon proved roundtrip-invariant.md
   does NOT carry the merge-prose-cycle content ⇒ clause-6
@@ -383,7 +383,7 @@ crates/ailang-core/tests/design_index_pin.rs
 ```
 
 The INDEX table cells stay repo-root-relative
-(`design/contracts/str-abi.md`); clause-1 keeps resolving them via
+(`design/contracts/0011-str-abi.md`); clause-1 keeps resolving them via
 `root().join`. No INDEX content edit, no clause-1 resolver edit.
 One resolution rule per *tier* (registry-spine: root-relative;
 movable body prose: file-relative), each locally justified — not
@@ -397,7 +397,7 @@ one rule everywhere, by deliberate design.
 | `design/contracts/*.md`, `design/models/*.md` | **Modify** — every genuine cross-*file* prose reference rewritten to a file-relative Markdown link; homeless refs retargeted-or-deleted; intra-file "above/below" untouched (out of scope). |
 | `design/INDEX.md` | **Untouched** — spine tier, commitment 4. |
 | `docs/journals/2026-05-19-design-decision-records.md` | **Untouched** — monolithic append-only relitigation archive; never a link target (commitment 2/7). |
-| `design/contracts/honesty-rule.md` | **Modify (prose only)** — one sentence stating cross-references are formal file-relative links into the durable tier (the positive-half companion to the clause-3 sentence it already carries). Pin-safe: the two `docs_honesty_pin.rs` phrases stay verbatim+contiguous. |
+| `design/contracts/0007-honesty-rule.md` | **Modify (prose only)** — one sentence stating cross-references are formal file-relative links into the durable tier (the positive-half companion to the clause-3 sentence it already carries). Pin-safe: the two `docs_honesty_pin.rs` phrases stay verbatim+contiguous. |
 | `bench/architect_sweeps.sh` | **Untouched** — clause-5 ("does every link resolve into the durable tier?") and Sweep-1 ("does any line carry a history anchor: `Iter <n>`, a date, `**Status:`?") are orthogonal predicates over the same files. A Markdown link `[label](file.md)` contains no Sweep-1 anchor token, so converting prose to links cannot trip Sweep-1; clause-5 shares no regex or scope with it. No sweep change. |
 
 ## Data flow
@@ -467,7 +467,7 @@ outcome, not a dodge).
      `str-abi.md`), `scope-boundaries.md:88` (splits:
      `ailang-core::desugar` →
      `../../crates/ailang-core/src/desugar.rs` AND "Pipeline" →
-     `../models/pipeline.md`).
+     `../models/0003-pipeline.md`).
    - **disposition (b):** `pipeline.md:61`,
      `authoring-surface.md:180` — the `(see docs/PROSE_ROUNDTRIP.md)`
      pointer removed, surrounding `ail merge-prose` prose kept.
diff --git a/docs/specs/2026-05-20-bench-harness-recalibration.md b/docs/specs/0047-bench-harness-recalibration.md
similarity index 100%
rename from docs/specs/2026-05-20-bench-harness-recalibration.md
rename to docs/specs/0047-bench-harness-recalibration.md
diff --git a/docs/specs/2026-05-20-boehm-retirement.md b/docs/specs/0048-boehm-retirement.md
similarity index 93%
rename from docs/specs/2026-05-20-boehm-retirement.md
rename to docs/specs/0048-boehm-retirement.md
index 35e66fe..19b440f 100644
--- a/docs/specs/2026-05-20-boehm-retirement.md
+++ b/docs/specs/0048-boehm-retirement.md
@@ -19,7 +19,7 @@ Resolves Gitea issue #4 (`Boehm full retirement`).
 
 The Boehm backend was introduced as a transitional dual-allocator
 during the pre-22 RC commitment window. Its standing role per
-`design/models/rc-uniqueness.md` was twofold: (a) **production
+`design/models/0004-rc-uniqueness.md` was twofold: (a) **production
 fallback** before RC was mature; (b) **parity oracle** —
 differential RC-vs-GC stdout assertions to catch RC bugs cheaply.
 Both roles have expired:
@@ -49,11 +49,11 @@ cohesive iteration:
    drop fns under non-RC" retargets from `AllocStrategy::Gc` to
    `AllocStrategy::Bump`; the M2 staticlib alloc-guard test loses
    its gc-arm but keeps its bump-arm.
-5. **Design ledger** — `design/models/rc-uniqueness.md` excises
+5. **Design ledger** — `design/models/0004-rc-uniqueness.md` excises
    the "Dual allocator — RC canonical, Boehm parity oracle"
    section and the Boehm-Choice-block; the per-fn-alloca section's
    language generalises from "on top of Boehm" to "on top of the
-   allocator". `design/models/pipeline.md` drops the
+   allocator". `design/models/0003-pipeline.md` drops the
    `--alloc=gc → libgc` arm of the pipeline diagram and the
    accompanying prose. The 1.3× RC-over-bump number is retained
    in `rc-uniqueness.md` but reframed as a **bench-health
@@ -247,7 +247,7 @@ Before (`crates/ailang-core/tests/docs_honesty_pin.rs:116-117`):
 
 ```rust
 assert!(pipeline.contains("`--alloc=gc` selects the transitional Boehm backend"),
-    "models/pipeline.md must describe Boehm present-tense, not as 'on the path to retirement'");
+    "models/0003-pipeline.md must describe Boehm present-tense, not as 'on the path to retirement'");
 ```
 
 After: this assertion is **deleted**, and the
@@ -340,9 +340,9 @@ rewritten to describe the rc/bump pair as the present state.
 | E2E RC-feature w/ differential backstop | `crates/ail/tests/e2e.rs` — `reuse_as_drop_demo` (1475ff), `rc_box_drop` (1602ff), `rc_list_drop` (1628ff), `rc_list_drop_borrow` (1674ff), `pat_extract_partial_drop` (1762ff), `rc_own_param_drop` (1858ff), `rc_drop_iterative_long_list` (1981ff), `rc_pin_recurse_implicit` (2168ff), `rc_let_alias_implicit_param` (2396ff) — **the `stdout_gc` build call and the `assert_eq!(stdout_gc, stdout_rc, ...)` differential line dropped**; the absolute `assert_eq!(stdout_rc.trim(), "<n>")` pin stays; doc-comments cleaned of `--alloc=gc` references |
 | E2E staticlib guard | `crates/ail/tests/embed_staticlib_alloc_guard.rs` — `staticlib_gc_is_rejected` deleted; `staticlib_bump_is_rejected` unchanged; file-level doc-comment updated |
 | Bench harness | `bench/run.sh` — `bench_latency_implicit_gc` arm removed; all `--alloc=gc` build calls removed; comment "decisive number for Decision 10's Boehm-retirement target (1.3x)" → "RC-overhead-vs-bump bench-health gate (1.3× ceiling)"; comment "Boehm-fair Implicit @ gc" arm dropped |
-| Design ledger | `design/models/rc-uniqueness.md` — full Boehm sections excised (per "Concrete code shapes" above); 1.3× reframed as bench-health regression gate |
-| Design ledger | `design/models/pipeline.md` — pipeline diagram + accompanying prose updated (per above) |
-| Design ledger | `design/contracts/embedding-abi.md:43-44` — the present-tense sentence `ail build --emit=staticlib rejects --alloc=gc/--alloc=bump (the shared Boehm collector is not swarm-safe)` is rewritten to drop the gc clause (gc is now a CLI-parser-level unknown-value, not a staticlib-guard rejection) and to reframe the swarm-safety justification: only `--alloc=bump` is rejected by the staticlib guard, on the grounds that bump is a leak-only bench instrument, not the historical Boehm-collector justification |
+| Design ledger | `design/models/0004-rc-uniqueness.md` — full Boehm sections excised (per "Concrete code shapes" above); 1.3× reframed as bench-health regression gate |
+| Design ledger | `design/models/0003-pipeline.md` — pipeline diagram + accompanying prose updated (per above) |
+| Design ledger | `design/contracts/0003-embedding-abi.md:43-44` — the present-tense sentence `ail build --emit=staticlib rejects --alloc=gc/--alloc=bump (the shared Boehm collector is not swarm-safe)` is rewritten to drop the gc clause (gc is now a CLI-parser-level unknown-value, not a staticlib-guard rejection) and to reframe the swarm-safety justification: only `--alloc=bump` is rejected by the staticlib guard, on the grounds that bump is a leak-only bench instrument, not the historical Boehm-collector justification |
 | Honesty pin | `crates/ailang-core/tests/docs_honesty_pin.rs` — present-tense Boehm pin deleted; four absence-pins added (per above); test-file doc-comment header updated to drop the Boehm/Decision-9 phrase |
 | Bencher agent | `skills/audit/agents/ailang-bencher.md` — the worked example "under heap pressure where Boehm GC has stop-the-world pauses" is rewritten to use an allocator-agnostic hypothesis (RC overhead under a workload that doesn't exercise the rc path is a natural replacement) |
 
@@ -452,9 +452,9 @@ The milestone closes CLEAN when all of the following hold:
    all exit 0 against the existing baseline.
 4. The CLI must-fail fixture exits ≠ 0 with the expected stderr
    wording.
-5. `design/models/rc-uniqueness.md` and `design/models/pipeline.md`
+5. `design/models/0004-rc-uniqueness.md` and `design/models/0003-pipeline.md`
    describe RC + bump as the present state; the honesty rule
-   (`design/contracts/honesty-rule.md`) is upheld — no past-tense
+   (`design/contracts/0007-honesty-rule.md`) is upheld — no past-tense
    "Boehm was kept as oracle" narrative remains; Boehm's history
    is recorded in the iter's git-log commit body.
 6. Issue #4 is closed by the iter commit's `closes #4` trailer.
diff --git a/docs/specs/2026-05-20-operator-routing-eq-ord.md b/docs/specs/0049-operator-routing-eq-ord.md
similarity index 96%
rename from docs/specs/2026-05-20-operator-routing-eq-ord.md
rename to docs/specs/0049-operator-routing-eq-ord.md
index 524e442..5b69b8f 100644
--- a/docs/specs/2026-05-20-operator-routing-eq-ord.md
+++ b/docs/specs/0049-operator-routing-eq-ord.md
@@ -22,7 +22,7 @@ Today AILang has two parallel paths for comparison:
   with instances for `{Int, Bool, Str}`, plus the polymorphic free-
   fn helpers `ne`/`lt`/`le`/`gt`/`ge`. Float and Unit have no Eq/Ord
   instance by design (Float: partial orderability per
-  [float-semantics](../../design/contracts/float-semantics.md);
+  [float-semantics](../../design/contracts/0005-float-semantics.md);
   Unit: oversight that today's `(app == () ())` builtin path hides).
 
 The two paths are redundant — `instance Eq Int` body literally
@@ -56,7 +56,7 @@ at lines 96-98, polymorphic `==` Forall block at lines 109-125,
 list-side mirror at lines 303-308) are removed. Surface use of these
 names resolves like any other unknown identifier — first via the
 class-method-dispatch index per
-[method-dispatch](../../design/contracts/method-dispatch.md), which
+[method-dispatch](../../design/contracts/0016-method-dispatch.md), which
 finds no candidate (the method name is `eq`, not `==`), then via
 fn lookup, which also finds none, then fails with the standard
 `unknown variable` diagnostic. The diagnostic does NOT special-case
@@ -67,7 +67,7 @@ external users requiring migration.
 All `(app eq …)` / `(app compare …)` / `(app ne …)` / `(app lt …)`
 / etc. resolve through the existing class-method-dispatch machinery
 documented in
-[method-dispatch](../../design/contracts/method-dispatch.md).
+[method-dispatch](../../design/contracts/0016-method-dispatch.md).
 No new dispatch rule.
 
 **Codegen:** `try_emit_primitive_instance_body` in
@@ -86,7 +86,7 @@ Six new prelude free functions ship for Float comparison:
 constraint. Their bodies are intercept-lowered to the corresponding
 `fcmp` instruction (`oeq` / `une` / `olt` / `ole` / `ogt` / `oge`),
 preserving the bit-exact IEEE semantics
-[float-semantics](../../design/contracts/float-semantics.md)
+[float-semantics](../../design/contracts/0005-float-semantics.md)
 guarantees today for `==` / `<` etc. on Float — the guarantee is
 transferred from the deleted operator names to the named Float
 fns.
@@ -161,7 +161,7 @@ the call site).
 
 Must produce a typecheck-time diagnostic — `NoInstance Eq Float`
 with a follow-up sentence `Float has no Eq instance by design
-(partial orderability per design/contracts/float-semantics.md); use
+(partial orderability per design/contracts/0005-float-semantics.md); use
 float_eq for explicit IEEE-aware comparison`. The diagnostic is the
 existing `NoInstance` channel; the Float-aware addendum is the
 existing Float-specific hint in `crates/ailang-check/src/lib.rs`
@@ -374,16 +374,16 @@ The milestone touches seven layers, all in one cohesive iter:
    from operator-form to method-form. The planner enumerates the
    exact set via grep and assigns it as a discrete task.
 7. **Contracts** — three updates:
-   - `design/contracts/float-semantics.md` lines 10-14: the
+   - `design/contracts/0005-float-semantics.md` lines 10-14: the
      guarantees about `+`/`-`/etc. and `==`/`<`/`!=` lowering to
      single LLVM instructions are retained for arithmetic but
      transferred from `==`/`<`/`!=` to `float_eq`/`float_lt`/`float_ne`/etc.
      for the comparison set. The NaN-spelling caveat is unchanged.
-   - `design/contracts/prelude-classes.md`: instance list extends
+   - `design/contracts/0017-prelude-classes.md`: instance list extends
      with `Eq Unit`; a new paragraph documents the six `float_*` fns
      as the Float-comparison surface; the Float-no-Eq/Ord clause
      gains a `→ use float_eq` cross-reference.
-   - `design/contracts/typeclasses.md`: no change. Class schema,
+   - `design/contracts/0013-typeclasses.md`: no change. Class schema,
      dispatch rule, and diagnostics are stable; the milestone only
      activates existing machinery for `eq`/`compare` over more
      types.
@@ -395,7 +395,7 @@ A surface `(app eq p1 p2)` flows through the existing pipeline:
 1. **Parse** — `Term::App { fn: Var "eq", args: [p1, p2] }`. No
    change from today.
 2. **Typecheck** — class-method-dispatch (per
-   `design/contracts/method-dispatch.md`) consults
+   `design/contracts/0016-method-dispatch.md`) consults
    `method_to_candidate_classes["eq"]` → `{prelude.Eq}`. Singleton
    class survivor; type-driven filter against the workspace
    registry for the resolved type:
@@ -404,7 +404,7 @@ A surface `(app eq p1 p2)` flows through the existing pipeline:
      - `p1, p2 : Float` → no instance → `NoInstance Eq Float` with
        Float-aware hint pointing at `float_eq`.
 3. **Mono** — synth produces the instance-body symbol (existing
-   pass; per `design/contracts/typeclasses.md` invariants 1-3).
+   pass; per `design/contracts/0013-typeclasses.md` invariants 1-3).
 4. **Codegen** — emits a call to the resolved instance fn. For
    primitive instances, the body is intercept-lowered to a single
    icmp/fcmp/call; `alwaysinline` attribute ensures the call folds
@@ -426,7 +426,7 @@ addendum (lib.rs:860-873) is extended:
 
 ```
 Eq has no instance at Float — Float has no Eq/Ord instance by
-design (partial orderability per design/contracts/float-semantics.md);
+design (partial orderability per design/contracts/0005-float-semantics.md);
 use float_eq for explicit IEEE-aware comparison.
 ```
 
@@ -519,11 +519,11 @@ The milestone ships when all of the following hold:
 8. `bench/check.py` exit 0; `bench/compile_check.py` exit 0;
    `bench/cross_lang.py` exit 0 (full bench-corpus green against
    the post-milestone baseline regenerated by the iter).
-9. `design/contracts/float-semantics.md` updated to name `float_eq`
+9. `design/contracts/0005-float-semantics.md` updated to name `float_eq`
    / `float_lt` / `float_ne` / etc. as the comparison guarantees
    (comparison guarantees on `==`/`<`/`!=` removed; arithmetic
    guarantees on `+`/`-`/`*`/`/` unchanged).
-10. `design/contracts/prelude-classes.md` updated: `Eq Unit` in the
+10. `design/contracts/0017-prelude-classes.md` updated: `Eq Unit` in the
     instance list; new section on the six Float-named comparison
     fns; the Float-no-Eq/Ord clause carries a `→ use float_eq`
     cross-reference.
diff --git a/docs/specs/2026-05-21-fieldtest-operator-routing-eq-ord.md b/docs/specs/0050-fieldtest-operator-routing-eq-ord.md
similarity index 96%
rename from docs/specs/2026-05-21-fieldtest-operator-routing-eq-ord.md
rename to docs/specs/0050-fieldtest-operator-routing-eq-ord.md
index 9fef742..ce14c70 100644
--- a/docs/specs/2026-05-21-fieldtest-operator-routing-eq-ord.md
+++ b/docs/specs/0050-fieldtest-operator-routing-eq-ord.md
@@ -75,7 +75,7 @@ single `fcmp` via the codegen intercept with `alwaysinline`.
   workspace — Float has no Eq/Ord instance by design (partial
   orderability per IEEE-754); use float_eq / float_lt (and siblings
   float_ne / float_le / float_gt / float_ge) for explicit IEEE-aware
-  comparison. See design/contracts/float-semantics.md.
+  comparison. See design/contracts/0005-float-semantics.md.
   ```
 
 ### `examples/fieldtest/eqord_5_float_eq_must_fail.ail` — Eq at Float rejection (companion)
@@ -155,7 +155,7 @@ single `fcmp` via the codegen intercept with `alwaysinline`.
   helper `lt` is reported via its desugar to `compare`), the named-fn
   family `float_eq / float_lt (and siblings …)`, the IEEE-754 design
   rationale, and the contract path
-  `design/contracts/float-semantics.md`. An LLM-author who hits this
+  `design/contracts/0005-float-semantics.md`. An LLM-author who hits this
   diagnostic learns the entire replacement surface in one read.
 - **Why it's `working`:** this is the milestone's clause-2 evidence —
   the diagnostic carries enough information for an LLM that has only
@@ -173,7 +173,7 @@ single `fcmp` via the codegen intercept with `alwaysinline`.
   copied the pattern from the existing `eq_ord_user_adt.ail`, not
   from the spec.
 - **What happened:** the design spec at
-  `docs/specs/2026-05-20-operator-routing-eq-ord.md:113` writes
+  `docs/specs/0049-operator-routing-eq-ord.md:113` writes
   `(class Eq)` (bare) in the §"Concrete code shapes" north-star
   example program. An LLM-author who copies that pattern verbatim
   hits the diagnostic:
@@ -194,10 +194,10 @@ single `fcmp` via the codegen intercept with `alwaysinline`.
   drift, but it is the highest-information reference an LLM-author
   consults when picking up the milestone surface.
 - **Recommended downstream action:** tighten the design ledger — fix
-  the example in `docs/specs/2026-05-20-operator-routing-eq-ord.md`
+  the example in `docs/specs/0049-operator-routing-eq-ord.md`
   (lines 109-133) to use `(class prelude.Eq)`, and consider whether
-  the same drift exists in `design/contracts/prelude-classes.md` or
-  `design/models/typeclasses.md`. A single forward-fix doc commit.
+  the same drift exists in `design/contracts/0017-prelude-classes.md` or
+  `design/models/0005-typeclasses.md`. A single forward-fix doc commit.
 
 ### [friction] `(app compare …)` at Float diagnostic does not acknowledge there is no `float_compare`
 
diff --git a/docs/specs/2026-05-21-schema-camelcase-fix.md b/docs/specs/0051-schema-camelcase-fix.md
similarity index 96%
rename from docs/specs/2026-05-21-schema-camelcase-fix.md
rename to docs/specs/0051-schema-camelcase-fix.md
index 0cd369b..8bc81d0 100644
--- a/docs/specs/2026-05-21-schema-camelcase-fix.md
+++ b/docs/specs/0051-schema-camelcase-fix.md
@@ -47,7 +47,7 @@ This is a schema-only milestone. Four layers are affected:
 4. **Canonical-schema contract + rustdoc layer.** Three rustdoc
    strings in production source describe the present-state schema
    (rather than implementation history); per the Honesty Rule
-   (`design/contracts/honesty-rule.md`) they must read truthfully
+   (`design/contracts/0007-honesty-rule.md`) they must read truthfully
    after the rename:
    - `crates/ailang-core/src/ast.rs:8` — module-level `//!` enumerating
      example field renames.
@@ -58,7 +58,7 @@ This is a schema-only milestone. Four layers are affected:
 
    Plus the canonical data-model contract document itself, which
    ships fenced JSON blocks describing the schema verbatim:
-   - `design/contracts/data-model.md:142-147` — the `Term::Lam`
+   - `design/contracts/0002-data-model.md:142-147` — the `Term::Lam`
      fenced-JSON schema block.
 
    The data-model contract IS the canonical schema documentation
@@ -219,7 +219,7 @@ the surrounding fixture content is untouched.
 | `crates/ailang-surface/src/parse.rs:81` | Module-level `//!` rustdoc — substitute the new tag spelling. |
 | `crates/ailang-check/src/lib.rs:1707` | `///` rustdoc — substitute the new tag spellings. |
 | `crates/ailang-core/src/workspace.rs:1925-1926` | In-source JSON-literal in `ct1_validator_walks_lam_embedded_types` (function at L1911): same two key renames. |
-| `design/contracts/data-model.md:142-147` | Fenced JSON-block in the canonical data-model contract: same two key renames. |
+| `design/contracts/0002-data-model.md:142-147` | Fenced JSON-block in the canonical data-model contract: same two key renames. |
 | `examples/test_loop_binder_captured_by_lambda.ail.json` | Same two key renames (2 occurrences total of the two tags, one per line). |
 | `experiments/2026-05-12-cross-model-authoring/master/examples/fn_with_lambda.ail.json` | Same two key renames (2 occurrences total). |
 | `crates/ailang-surface/src/{print,parse}.rs` (code) | **No change.** Form-A never used these tag names — only `parse.rs:81` rustdoc above. |
@@ -229,8 +229,8 @@ Historic / frozen documents NOT migrated (per Honesty Rule
 analogue: these describe state at the time of writing, not the
 present state):
 - `docs/plans/2026-05-10-23.3-...md`,
-  `docs/plans/2026-05-09-22b3-monomorphisation.md`,
-  `docs/plans/2026-05-09-22c-user-class-e2e.md`, `docs/plans/24.2.md`
+  `docs/plans/0003-22b3-monomorphisation.md`,
+  `docs/plans/0005-22c-user-class-e2e.md`, `docs/plans/0056-24.2.md`
   — embed old tag names in example JSON blocks.
 - `experiments/2026-05-12-cross-model-authoring/master/spec.md`,
   `experiments/2026-05-12-cross-model-authoring/rendered/*.md`,
@@ -303,7 +303,7 @@ The milestone is GREEN if:
   `serde_json::to_value(&Term::Lam{...})` emits the keys
   `"param-types"` and `"ret-type"` (and NOT the old camelCase),
   AND extends the existing fenced-block anchor sweep to assert
-  that `design/contracts/data-model.md` contains the new tag
+  that `design/contracts/0002-data-model.md` contains the new tag
   spellings inside the `Term::Lam` fenced JSON block. The home
   is `design_schema_drift.rs` (not `schema_coverage.rs`, which is
   a corpus-coverage walker) because that file already operates as
@@ -323,7 +323,7 @@ literal swap at compile time with no runtime cost path.
 1. Tag-rename change in `crates/ailang-core/src/ast.rs:492,494` is
    landed and observable in serialisation output.
 2. All four code call-sites (`workspace.rs` JSON-literal + two
-   `.ail.json` fixtures + `design/contracts/data-model.md` fenced
+   `.ail.json` fixtures + `design/contracts/0002-data-model.md` fenced
    JSON block) carry the new tag names verbatim.
 3. All three rustdoc strings (`ast.rs:8`, `parse.rs:81`,
    `check/lib.rs:1707`) describe the new tag spellings.
@@ -338,7 +338,7 @@ literal swap at compile time with no runtime cost path.
 
 ## Feature-acceptance gate
 
-Per `design/contracts/feature-acceptance.md`, three clauses must
+Per `design/contracts/0004-feature-acceptance.md`, three clauses must
 hold. This milestone's gate evaluation:
 
 - **Clause 1 — an LLM author naturally produces code that uses the
diff --git a/docs/specs/2026-05-28-kernel-extension-mechanics.md b/docs/specs/0052-kernel-extension-mechanics.md
similarity index 99%
rename from docs/specs/2026-05-28-kernel-extension-mechanics.md
rename to docs/specs/0052-kernel-extension-mechanics.md
index 11c3e91..7025267 100644
--- a/docs/specs/2026-05-28-kernel-extension-mechanics.md
+++ b/docs/specs/0052-kernel-extension-mechanics.md
@@ -3,7 +3,7 @@
 **Date:** 2026-05-28
 **Status:** Draft — awaiting user spec review
 **Authors:** Brummel (orchestrator) + Claude
-**Reference:** `design/models/kernel-extensions.md` for the
+**Reference:** `design/models/0007-kernel-extensions.md` for the
 architectural whitepaper. This spec covers the *first* of three
 milestones implementing the kernel-extensions design: the
 language-level mechanisms (this milestone), the `raw-buf` base
@@ -182,7 +182,7 @@ for hash-pin sites is mandatory (per the
   (e.g. a hypothetical `std_math.factorial` that doesn't have a
   receiver type). No retirement of the module-scope mechanism
   itself.
-- Class method dispatch (see [method-dispatch](../../design/contracts/method-dispatch.md))
+- Class method dispatch (see [method-dispatch](../../design/contracts/0016-method-dispatch.md))
   is orthogonal. `(app show x)` continues to type-dispatch via the
   Show instance; this is not type-scoped namespacing.
 - `term-ctor` and `pat-ctor` continue to use bare ctor names
@@ -651,7 +651,7 @@ Milestone closes when:
 7. Hash pins refreshed in both `crates/ailang-core/tests/hash_pin.rs`
    and `crates/ailang-surface/tests/prelude_module_hash_pin.rs`,
    each with an Honesty-Rule provenance comment.
-8. The whitepaper `design/models/kernel-extensions.md` is
+8. The whitepaper `design/models/0007-kernel-extensions.md` is
    updated: sections describing prep.1, prep.2, prep.3 transition
    from forward-looking ("will resolve…") to present-state
    ("resolves…") where appropriate; STATUS header updated to
diff --git a/examples/eq_demo.ail b/examples/eq_demo.ail
index c661997..91b82da 100644
--- a/examples/eq_demo.ail
+++ b/examples/eq_demo.ail
@@ -9,7 +9,7 @@
 ;
 ; Float has no Eq instance; partial-Float comparison is done via
 ; the explicit float_eq / float_lt / etc. fns (see
-; design/contracts/float-semantics.md).
+; design/contracts/0005-float-semantics.md).
 ;
 ; This fixture exercises all four supported types, both directly via
 ; `(app eq ...)` and indirectly via the lit-pattern desugar (which
diff --git a/examples/fieldtest/floats_3_safe_division.ail b/examples/fieldtest/floats_3_safe_division.ail
index a189b8f..a335639 100644
--- a/examples/fieldtest/floats_3_safe_division.ail
+++ b/examples/fieldtest/floats_3_safe_division.ail
@@ -16,7 +16,7 @@
 ; NOT `(== x x)` (which is false for NaN — but the LLM author who
 ; reaches for `==` first will get the right answer by accident here,
 ; only because the natural reading of the operator doesn't apply).
-; design/contracts/float-semantics.md says explicitly to use `is_nan`.
+; design/contracts/0005-float-semantics.md says explicitly to use `is_nan`.
 ;
 ; Expected stdout (one per line):
 ;   2.0      ; 6/3
diff --git a/examples/fieldtest/floats_4_float_to_str_reach.ail b/examples/fieldtest/floats_4_float_to_str_reach.ail
index 8c17520..2305dd3 100644
--- a/examples/fieldtest/floats_4_float_to_str_reach.ail
+++ b/examples/fieldtest/floats_4_float_to_str_reach.ail
@@ -3,7 +3,7 @@
 ; Natural task: build a label like "result = <float>" by concatenating
 ; a Str prefix with the float's text. The LLM-author who looks at
 ; `ail builtins` sees `float_to_str : (Float) -> Str`, reaches for it,
-; and gets a codegen-deferred error per design/contracts/float-semantics.md:
+; and gets a codegen-deferred error per design/contracts/0005-float-semantics.md:
 ;
 ;   `float_to_str` (Float → Str) is type-installed but codegen-
 ;   deferred to a follow-up milestone: ... Calling it typechecks but
diff --git a/experiments/2026-05-12-cross-model-authoring/README.md b/experiments/2026-05-12-cross-model-authoring/README.md
index cf8e759..04b1768 100644
--- a/experiments/2026-05-12-cross-model-authoring/README.md
+++ b/experiments/2026-05-12-cross-model-authoring/README.md
@@ -4,7 +4,7 @@ Empirical measurement of whether `.ail.json` or `.ail` is the form a
 foreign LLM author reaches for and succeeds with. Single subject for
 v1: Qwen3-Coder-Next via IONOS. Two blind cohorts; same four tasks.
 
-Parent spec: `docs/specs/2026-05-12-cross-model-authoring-form-test.md`.
+Parent spec: `docs/specs/0017-cross-model-authoring-form-test.md`.
 
 ## Layout
 
diff --git a/experiments/2026-05-12-cross-model-authoring/render/Cargo.toml b/experiments/2026-05-12-cross-model-authoring/render/Cargo.toml
index 763fc35..99f65ee 100644
--- a/experiments/2026-05-12-cross-model-authoring/render/Cargo.toml
+++ b/experiments/2026-05-12-cross-model-authoring/render/Cargo.toml
@@ -1,7 +1,7 @@
 # Empty `[workspace]` table declares this crate as a standalone
 # Cargo workspace of its own, so it is NOT auto-discovered as a member
 # of the root workspace at /home/brummel/dev/ailang/Cargo.toml. The
-# spec (`docs/specs/2026-05-12-cross-model-authoring-form-test.md`
+# spec (`docs/specs/0017-cross-model-authoring-form-test.md`
 # §Architecture lines 90-95) requires this experiment to live outside
 # the root workspace; the root Cargo.toml is intentionally not modified.
 [workspace]
diff --git a/runtime/rc.c b/runtime/rc.c
index 42b30c2..efa6931 100644
--- a/runtime/rc.c
+++ b/runtime/rc.c
@@ -40,7 +40,7 @@
  * lambda envs, etc.
  *
  * FROZEN ABI for the embedding boundary — see
- * design/contracts/frozen-value-layout.md. A boundary-crossing
+ * design/contracts/0006-frozen-value-layout.md. A boundary-crossing
  * single-ctor scalar record's box offsets MUST NOT move.
  *
  * Threading: the per-object refcount header ops and the per-ctx RC
diff --git a/runtime/str.c b/runtime/str.c
index 72a2529..18e75c4 100644
--- a/runtime/str.c
+++ b/runtime/str.c
@@ -198,7 +198,7 @@ char *ailang_bool_to_str(bool b) {
  * the trailing NUL. Works uniformly on static-Str and heap-Str
  * inputs because the consumer ABI (i64 len at offset 0, bytes
  * starting at offset 8, NUL at offset 8 + len) is identical
- * between realisations (see design/contracts/str-abi.md); the rc_header at
+ * between realisations (see design/contracts/0011-str-abi.md); the rc_header at
  * offset -8 — present only on heap-Str — is never consulted.
  *
  * Used by `show__Str` (parent spec milestone 24): converts a
@@ -224,7 +224,7 @@ char *ailang_str_clone(const char *src) {
  * memcpys both payloads in order, NUL-terminates, returns the new
  * payload pointer. Like `str_clone`, this works uniformly on static-
  * Str and heap-Str inputs because the consumer ABI is identical
- * between realisations (see design/contracts/str-abi.md).
+ * between realisations (see design/contracts/0011-str-abi.md).
  *
  * Used by Show bodies that want labelled output (e.g.
  * `"Item " ++ int_to_str n`) and by any caller that needs to
diff --git a/skills/README.md b/skills/README.md
index 3040fa5..6e26993 100644
--- a/skills/README.md
+++ b/skills/README.md
@@ -7,7 +7,7 @@ discipline so the orchestrator (me) cannot accidentally diverge from
 established practice without explicitly violating a named rule.
 
 The system was bootstrapped on 2026-05-09. See
-`docs/specs/2026-05-09-skill-system.md` for the design;
+`docs/specs/0001-skill-system.md` for the design;
 the bootstrap rationale lives in the commits from that week.
 
 ## The eight skills
diff --git a/skills/audit/agents/ailang-architect.md b/skills/audit/agents/ailang-architect.md
index 7ff7bf8..dc48e52 100644
--- a/skills/audit/agents/ailang-architect.md
+++ b/skills/audit/agents/ailang-architect.md
@@ -90,7 +90,7 @@ If `milestone_scope` is empty, return a structural error and stop.
 - **design/ honesty drift.** Sweep 5 of `bench/architect_sweeps.sh`
   (the docs-honesty-lint invariant) flags Wunschdenken / non-citation
   post-mortem. Apply the discriminator from
-  `design/contracts/honesty-rule.md`: a hit is
+  `design/contracts/0007-honesty-rule.md`: a hit is
   drift unless it is a present-tense correctly-labelled
   reserved/excluded claim, present-tense design rationale, or a
   block-quote commit-body citation. Forward intent belongs in the
diff --git a/skills/audit/agents/ailang-bencher.md b/skills/audit/agents/ailang-bencher.md
index 6605dd1..5f2defd 100644
--- a/skills/audit/agents/ailang-bencher.md
+++ b/skills/audit/agents/ailang-bencher.md
@@ -38,7 +38,7 @@ limitation; don't paper over it with a chart.
 ## Standing reading list
 
 1. `CLAUDE.md` — orchestrator framing.
-2. `design/models/rc-uniqueness.md` — the RC + Uniqueness whitepaper
+2. `design/models/0004-rc-uniqueness.md` — the RC + Uniqueness whitepaper
    (canonical RC commitment + bump as raw-alloc bench-floor).
 3. `git log -5 --format=full` plus `git log -20 --oneline` — current
    state of the memory-management infrastructure as it landed on main.
diff --git a/skills/boss/SKILL.md b/skills/boss/SKILL.md
index 390ed61..e405816 100644
--- a/skills/boss/SKILL.md
+++ b/skills/boss/SKILL.md
@@ -270,7 +270,7 @@ actionable ask, not a wrap-up summary.
   Browse: http://192.168.178.103:3000/Brummel/AILang/issues; CLI:
   `tea issues ls --repo Brummel/AILang --state open`.
 - **Canonical feature-acceptance criterion:**
-  `design/contracts/feature-acceptance.md` — the criterion that gates
+  `design/contracts/0004-feature-acceptance.md` — the criterion that gates
   new features; applied at spec time by `skills/brainstorm`.
 - **Downstream skills dispatched:** `skills/brainstorm`,
   `skills/planner`, `skills/implement`, `skills/audit`,
diff --git a/skills/brainstorm/SKILL.md b/skills/brainstorm/SKILL.md
index 2172511..b494686 100644
--- a/skills/brainstorm/SKILL.md
+++ b/skills/brainstorm/SKILL.md
@@ -113,7 +113,7 @@ Aesthetic appeal does not count. Human ergonomics do not count. If
 the answer to any of the three is "I'm not sure", the feature is
 probably not ready. The full criterion (with the canonical worked
 example — see the criterion text) lives in
-`design/contracts/feature-acceptance.md`; this skill is the gate that
+`design/contracts/0004-feature-acceptance.md`; this skill is the gate that
 applies it during spec writing.
 
 **Clause 1 is unjudgeable without the worked author code.** For any
@@ -164,7 +164,10 @@ earlier sections if a later one surfaces a contradiction.
 
 ### Step 6 — Write the spec
 
-Path: `docs/specs/YYYY-MM-DD-<milestone>.md`.
+Path: `docs/specs/NNNN-<milestone>.md` where `NNNN` is the next-higher
+4-digit counter in the directory. Determine it with
+`ls docs/specs/ | tail -1` and add 1. See CLAUDE.md "File-naming
+convention" for the rule.
 
 Structure:
 
@@ -345,19 +348,19 @@ Hand off carries:
 
 ## Cross-references
 
-- **Project source:** `design/contracts/feature-acceptance.md`
+- **Project source:** `design/contracts/0004-feature-acceptance.md`
   — gate this skill applies during spec writing.
 - **Output target:** `skills/planner/SKILL.md` — only valid next
   skill.
 - **Private agent:** `skills/brainstorm/agents/ailang-grounding-check.md`
   — dispatched in Step 7.5 as a hard-gate. The agent reads the spec
   with fresh context and reports PASS / BLOCK / INFRA_ERROR. See
-  `docs/specs/2026-05-11-brainstorm-grounding-check.md` for the
+  `docs/specs/0013-brainstorm-grounding-check.md` for the
   design rationale.
 - **Ad-hoc dispatch.** The Boss MAY also ad-hoc dispatch
   `skills/planner/agents/ailang-plan-recon.md` during Step 1 when
   the milestone enters code territory the Boss has not recently
   read; this is opt-in and not part of the standard process.
   Rationale: brainstorm's recon phase is interwoven with the user
-  Q&A — see `docs/specs/2026-05-11-plan-recon-subagent.md` for the
+  Q&A — see `docs/specs/0009-plan-recon-subagent.md` for the
   full reasoning.
diff --git a/skills/fieldtest/SKILL.md b/skills/fieldtest/SKILL.md
index 53d6e34..8ee07cd 100644
--- a/skills/fieldtest/SKILL.md
+++ b/skills/fieldtest/SKILL.md
@@ -131,7 +131,7 @@ The orchestrator drives downstream:
   - `skills/debug/SKILL.md` — for each `bug` finding
   - `skills/brainstorm/SKILL.md` or `skills/planner/SKILL.md` — for
     `friction` and `spec_gap` findings worth a follow-up iteration
-- **Project source:** `design/contracts/feature-acceptance.md`
+- **Project source:** `design/contracts/0004-feature-acceptance.md`
   — the field test is the empirical complement to brainstorm's
   prospective application of that criterion. Brainstorm asks "would
   an LLM author reach for this?"; fieldtest asks "did one?"
diff --git a/skills/fieldtest/agents/ailang-fieldtester.md b/skills/fieldtest/agents/ailang-fieldtester.md
index 9d61de1..6569857 100644
--- a/skills/fieldtest/agents/ailang-fieldtester.md
+++ b/skills/fieldtest/agents/ailang-fieldtester.md
@@ -20,7 +20,7 @@ the design/ ledger and the public example corpus.
 AILang ships features by the LLM-utility criterion: a feature earns
 its keep only if a downstream LLM author reaches for it naturally and
 gets a measurable correctness/redundancy improvement out of it
-(`design/contracts/feature-acceptance.md`). The brainstorm
+(`design/contracts/0004-feature-acceptance.md`). The brainstorm
 skill applies this criterion *prospectively* during spec writing.
 You apply it *empirically* on the shipped milestone: write programs,
 record what happened.
diff --git a/skills/planner/SKILL.md b/skills/planner/SKILL.md
index 050a2ed..70ce831 100644
--- a/skills/planner/SKILL.md
+++ b/skills/planner/SKILL.md
@@ -15,8 +15,10 @@ that will be created or modified, and decomposes work into bites
 small enough that a subagent can execute one in 2-5 minutes
 without making judgement calls outside its remit.
 
-Plans live at `docs/plans/<iteration>.md` and the header references
-the parent spec. The plan decomposes work into tasks; each task is
+Plans live at `docs/plans/NNNN-<iteration>.md` where `NNNN` is the
+next-higher 4-digit counter in `docs/plans/` (determine with
+`ls docs/plans/ | tail -1` and add 1; see CLAUDE.md "File-naming
+convention"). The header references the parent spec. The plan decomposes work into tasks; each task is
 the unit of review (spec-compliance and quality gates inside
 `implement`), not the unit of commit. Commits are a Boss-only
 decision taken at the end of the iter against the full working-tree