convention: counter-prefix file naming across docs/specs/, docs/plans/, design/contracts/, design/models/

All 176 files in the four accumulating directories now use a
zero-padded 4-digit counter prefix that reflects creation order
(`NNNN-slug.md`). The counter is assigned per directory in strict
git-log creation order; ties broken alphabetically by original name.
The old `YYYY-MM-DD-` prefix on docs/specs/ and docs/plans/ files is
dropped — the date is recoverable from git log and the counter
carries the ordering.

A file's counter is stable for the life of the file: never reassigned,
never reused, never compacted. Deleted files retire their counter;
subsequent files do not fill the gap. This is the property that lets
cross-references stay literal — refs use the full filename including
the counter (`design/contracts/0007-honesty-rule.md`) so they grep
cleanly and resolve directly without a glob step.

313 cross-references updated across .md/.rs/.toml/.c/.json files
(test pins, include_str! paths, design-INDEX entries, baseline notes,
runtime C comments, inter-contract markdown links incl. bare basename
and `../models/foo.md` forms).

CLAUDE.md gets a new "File-naming convention" section spelling out
the rule and rationale. skills/brainstorm/SKILL.md and
skills/planner/SKILL.md updated so new spec/plan creation produces
counter-prefixed names from the start.

The full test suite (cargo test --workspace) passes.

crates/ail/src/main.rs

@@ -1098,7 +1098,7 @@ fn workspace_error_to_diagnostic(
         // typeclass-coherence diagnostics emitted from
         // `workspace::build_registry`. The codes follow the
         // diagnostic-categories section of
-        // `design/contracts/typeclasses.md`.
+        // `design/contracts/0013-typeclasses.md`.
         W::OrphanInstance {
             class,
             type_repr,
@@ -1568,7 +1568,7 @@ fn walk_term(
 /// Adds the variable bindings introduced by a pattern to `scope` and
 /// returns the names that were freshly inserted (so the caller can roll
 /// them back). MVP-restricted: nested ctor patterns only contain
-/// `Var`/`Wild` — see design/contracts/data-model.md.
+/// `Var`/`Wild` — see design/contracts/0002-data-model.md.
 fn bind_pattern(
     p: &ailang_core::ast::Pattern,
     scope: &mut std::collections::HashSet<String>,

crates/ail/tests/codegen_import_map_fallback_pin.rs

@@ -1,5 +1,5 @@
 //! Pin for the iter-24.3 codegen `import_map`-fallback path
-//! (design/contracts/typeclasses.md, "Cross-module references in
+//! (design/contracts/0013-typeclasses.md, "Cross-module references in
 //! synthesised bodies" invariant 2).
 //!
 //! Property protected: post-mono synthesised body cross-module

crates/ail/tests/e2e.rs

@@ -2742,7 +2742,7 @@ fn str_clone_drop_balances_rc_stats() {
 /// input bytes; RC stats account for three heap-Str slabs (one
 /// from int_to_str, two from str_clone) and three matching frees.
 /// Pins the "uniform consumer ABI" claim from
-/// design/contracts/str-abi.md — str_clone only reads len + bytes +
+/// design/contracts/0011-str-abi.md — str_clone only reads len + bytes +
 /// NUL, never the rc_header.
 #[test]
 fn str_clone_cross_realisation_uniform_abi() {

crates/ail/tests/embed/record_roundtrip.c

@@ -1,6 +1,6 @@
 /* Embedding-ABI M3 record round-trip C host (own + borrow via a
  * compile-time -DBORROW switch). Frozen value layout
- * (design/contracts/frozen-value-layout.md):
+ * (design/contracts/0006-frozen-value-layout.md):
  *   p - 8 .. p   uint64_t refcount header (set to 1 by ailang_rc_alloc)
  *   p + 0        int64_t  constructor tag (single ctor → 0)
  *   p + 8        IEEE-754 double  field 0 = Float acc

crates/ail/tests/embed/tick_roundtrip.c

@@ -3,7 +3,7 @@
  * only ever push a *scalar* per-tick sample; this host pushes a
  * single-ctor all-scalar *record* `Tick` as the per-call payload —
  * the actual minimal data-server binding shape. Frozen value layout
- * (design/contracts/frozen-value-layout.md):
+ * (design/contracts/0006-frozen-value-layout.md):
  *
  *   State (24-byte payload):
  *     p - 8 .. p   uint64_t refcount header (set to 1 by ailang_rc_alloc)

crates/ail/tests/eq_float_noinstance.rs

@@ -2,7 +2,7 @@
 //!
 //! Property protected: a polymorphic Eq/Ord helper invoked at Float
 //! fires `no-instance` (since Float has neither Eq nor Ord instance
-//! per design/contracts/float-semantics.md) AND the diagnostic message
+//! per design/contracts/0005-float-semantics.md) AND the diagnostic message
 //! cross-references the canonical float-semantics contract so the
 //! LLM author immediately learns the partial-Float story rather
 //! than seeing a bare "no instance" message.
@@ -38,7 +38,7 @@ fn eq_at_float_fires_float_aware_noinstance() {
     // Cross-ref to the float-semantics contract — the LLM author should
     // be pointed at the canonical explanation of partial Float orderability.
     assert!(
-        no_inst.message.contains("design/contracts/float-semantics.md"),
+        no_inst.message.contains("design/contracts/0005-float-semantics.md"),
         "expected NoInstance message to cross-reference the float-semantics contract, got: {:?}",
         no_inst.message
     );

crates/ail/tests/nullary_app_e2e.rs

@@ -7,8 +7,8 @@
 //! invoked as `(app greet)`.
 //!
 //! Two independent fieldtest specs flagged the same gap:
-//! `docs/specs/2026-05-15-fieldtest-mut-local.md` F3 and
-//! `docs/specs/2026-05-18-fieldtest-loop-recur.md` spec_gap. The
+//! `docs/specs/0030-fieldtest-mut-local.md` F3 and
+//! `docs/specs/0035-fieldtest-loop-recur.md` spec_gap. The
 //! Form-A surface refusing nullary calls had no schema backing —
 //! `Term::App.args` is `[Term...]` (zero-or-more), so the parser
 //! guard was an unbacked rule.

crates/ail/tests/polyfn_dot_qualified_branch_pin.rs

@@ -1,5 +1,5 @@
 //! Pin for the iter-24.3 FreeFnCall constraint-residual-push
-//! invariant (design/contracts/typeclasses.md, "Cross-module
+//! invariant (design/contracts/0013-typeclasses.md, "Cross-module
 //! references in synthesised bodies" invariant 3).
 //!
 //! Property protected: bare-name references to polymorphic free fns

crates/ail/tests/show_no_instance_e2e.rs

@@ -2,7 +2,7 @@
 //!
 //! Property protected: calling `print` on a function type fires the
 //! `no-instance` diagnostic with a Show-aware message that
-//! cross-references design/contracts/typeclasses.md, so the
+//! cross-references design/contracts/0013-typeclasses.md, so the
 //! LLM author immediately learns which types ship with built-in Show
 //! and how to declare their own instance for a user type.
 
@@ -40,11 +40,11 @@ fn print_on_fn_type_fires_show_aware_no_instance() {
         no_inst.message
     );
 
-    // Must cross-reference design/contracts/typeclasses.md — that's
+    // Must cross-reference design/contracts/0013-typeclasses.md — that's
     // the canonical contract naming which types ship with Show.
     assert!(
-        no_inst.message.contains("design/contracts/typeclasses.md"),
-        "expected design/contracts/typeclasses.md cross-reference, got message: {:?}",
+        no_inst.message.contains("design/contracts/0013-typeclasses.md"),
+        "expected design/contracts/0013-typeclasses.md cross-reference, got message: {:?}",
         no_inst.message
     );
 }