convention: counter-prefix file naming across docs/specs/, docs/plans/, design/contracts/, design/models/

All 176 files in the four accumulating directories now use a
zero-padded 4-digit counter prefix that reflects creation order
(`NNNN-slug.md`). The counter is assigned per directory in strict
git-log creation order; ties broken alphabetically by original name.
The old `YYYY-MM-DD-` prefix on docs/specs/ and docs/plans/ files is
dropped — the date is recoverable from git log and the counter
carries the ordering.

A file's counter is stable for the life of the file: never reassigned,
never reused, never compacted. Deleted files retire their counter;
subsequent files do not fill the gap. This is the property that lets
cross-references stay literal — refs use the full filename including
the counter (`design/contracts/0007-honesty-rule.md`) so they grep
cleanly and resolve directly without a glob step.

313 cross-references updated across .md/.rs/.toml/.c/.json files
(test pins, include_str! paths, design-INDEX entries, baseline notes,
runtime C comments, inter-contract markdown links incl. bare basename
and `../models/foo.md` forms).

CLAUDE.md gets a new "File-naming convention" section spelling out
the rule and rationale. skills/brainstorm/SKILL.md and
skills/planner/SKILL.md updated so new spec/plan creation produces
counter-prefixed names from the start.

The full test suite (cargo test --workspace) passes.

CLAUDE.md

@@ -42,10 +42,39 @@ it measurably improves correctness or removes redundancy.
 | `runtime/` | C glue around the RC runtime |
 | `bench/` | Regression harnesses (`check.py`, `compile_check.py`, `cross_lang.py`) and the throughput-and-latency runner (`run.sh`); `bench/reference/` holds the hand-C corpus for cross-language ratios |
 | `examples/` | AILang fixtures used by tests and benches |
-| `design/` | The canonical contract ledger — `design/INDEX.md` (sole addressable spine: a typed Contracts + Models table), `design/contracts/` (prose-authoritative test-linked invariants), `design/models/` (onboarding whitepapers) |
-| `docs/` | Specs and plans — `docs/specs/` (per-milestone design specs), `docs/plans/` (per-iteration plans), `PROSE_ROUNDTRIP.md`. Project history lives in `git log`; the forward queue lives in Gitea issues (see "Roles" section below). |
+| `design/` | The canonical contract ledger — `design/INDEX.md` (sole addressable spine: a typed Contracts + Models table), `design/contracts/` (prose-authoritative test-linked invariants), `design/models/` (onboarding whitepapers). Files under `contracts/` and `models/` follow the counter-prefix convention (see "File-naming convention" below). |
+| `docs/` | Specs and plans — `docs/specs/` (per-milestone design specs), `docs/plans/` (per-iteration plans), `PROSE_ROUNDTRIP.md`. Files under `specs/` and `plans/` follow the counter-prefix convention (see "File-naming convention" below). Project history lives in `git log`; the forward queue lives in Gitea issues (see "Roles" section below). |
 | `skills/` | Project-local skill definitions and their agents. See `skills/README.md` for the skill table, agent roster, and discovery layout. |
 
+## File-naming convention
+
+Four directories accumulate files over the life of the project and
+use a zero-padded counter prefix that reflects creation order:
+
+- `docs/specs/NNNN-slug.md`
+- `docs/plans/NNNN-slug.md`
+- `design/contracts/NNNN-slug.md`
+- `design/models/NNNN-slug.md`
+
+The counter is 4-digit, zero-padded, assigned per directory in
+strict creation order. A new file takes the next-higher counter for
+its directory. A file's counter is **stable for the life of the
+file** — never reassigned, never reused, never compacted. If a file
+is deleted, its counter is retired; subsequent files do not fill the
+gap. This is the property that lets cross-references stay literal.
+
+Slugs are the short identity (`honesty-rule`, `skill-system-buildout`).
+Cross-references include the full filename with counter
+(`design/contracts/0007-honesty-rule.md`) so they grep cleanly and
+resolve directly without a glob step. The convention forbids
+renumbering precisely so refs do not need to chase moving prefixes.
+
+The backfill on 2026-05-28 assigned counters by git-log creation
+timestamp (alphabetical by original name on ties) and stripped the
+old `YYYY-MM-DD-` prefix from `docs/specs/` and `docs/plans/` —
+the date is recoverable from git log and the counter carries the
+ordering.
+
 ## Skill system
 
 Day-to-day discipline lives under `skills/<name>/SKILL.md`; see
@@ -176,7 +205,7 @@ The test for whether a feature ships is whether an LLM author
 naturally produces code that uses it AND whether the feature
 measurably improves correctness or removes redundancy. Aesthetic
 appeal does not count; neither does human ergonomics. Full criterion
-lives in `design/contracts/feature-acceptance.md` and is
+lives in `design/contracts/0004-feature-acceptance.md` and is
 applied as a gate by `skills/brainstorm/SKILL.md` during spec writing.
 
 ## Bug fixes — TDD, always
@@ -211,7 +240,7 @@ not retroactively renamed.
   `ailang-architect` checks the code against during drift review.
   A contract describes only the actual present state; forward intent
   goes to the Gitea backlog, history and rationale to `git log`
-  (see `design/contracts/honesty-rule.md`).
+  (see `design/contracts/0007-honesty-rule.md`).
 
 - **`git log`** is the project history. Iter and audit commit
   bodies carry the *why* — alternatives considered and rejected,