tidy: rustdoc-sweep + drift-test-narrowing — autonomous batch

Two unrelated hygiene iters bundled because they shipped together
in one autonomous-while-Boss-away batch:

- iter rustdoc-sweep: cleared all 23 `cargo doc --workspace
  --no-deps` warnings (17 in ailang-check + 4 in ailang-core + 2
  in ailang-surface). Two warning classes: pub-doc-comment links
  to pub(crate)/private items (15 hits — replaced with plain
  backtick-code-spans), and unresolved/ambiguous links (8 hits
  — fully-qualified, disambiguated to fn-form, or escaped).
  No behaviour change; tests 562 → 562.

- iter drift-test-narrowing: design_schema_drift.rs now scans
  §"Data model" only via new helper data_model_section(),
  instead of full DESIGN.md. Closes the audit-form-a-precursor
  [high] "anchor-elsewhere-passes-silently" failure mode. All
  38 anchors verified pre-edit to live in §"Data model" so the
  tightening doesn't regress to red. New pin
  data_model_section_is_bounded guards the extractor against
  silent regression. Tests 562 → 563.

crates/ailang-check/src/diagnostic.rs

@@ -167,7 +167,7 @@ pub struct SuggestedRewrite {
     /// Form-A AILang snippet to substitute at the offending site. For
     /// the linearity-check diagnostics this is typically `(clone <n>)`
     /// or a small enclosing rewrite. The string MUST parse via the
-    /// surface `parse_term` entrypoint; [`crate::linearity`] tests
+    /// surface `parse_term` entrypoint; `crate::linearity` tests
     /// guard the round-trip.
     pub replacement: String,
 }

crates/ailang-check/src/lib.rs

@@ -2016,7 +2016,7 @@ pub(crate) fn is_fully_concrete(t: &Type) -> bool {
 }
 
 /// Iter 22b.2 (Task 9): per-call-site residual class constraint
-/// recorded by [`synth`] when a `Term::Var` resolves to a class method.
+/// recorded by `synth` when a `Term::Var` resolves to a class method.
 /// Carries the method name (for diagnostic rendering), the class, and
 /// the type the class is applied to at the call site. The type is
 /// typically a fresh metavar (which unification then ties to the
@@ -2290,7 +2290,7 @@ pub fn refine_multi_candidate_residual(
 }
 
 /// Iter 23.4: per-call-site polymorphic-free-fn observation recorded by
-/// [`synth`] when a `Term::Var` resolves to a `Type::Forall`-quantified
+/// `synth` when a `Term::Var` resolves to a `Type::Forall`-quantified
 /// top-level def (NOT a class method — those are pushed to
 /// [`ResidualConstraint`] instead). Carries the bare name, the owning
 /// module (resolved through the same lookup ladder as `synth`'s Var arm),
@@ -2298,7 +2298,7 @@ pub fn refine_multi_candidate_residual(
 /// fresh metavars instantiated for those vars at the call site.
 ///
 /// Consumed by the mono pass: after `synth` completes a body, each
-/// `metas[i]` is `subst.apply`'d to recover the concrete type at vars[i].
+/// `metas\[i\]` is `subst.apply`'d to recover the concrete type at `vars\[i\]`.
 /// Fully-concrete observations become [`crate::mono::MonoTarget::FreeFn`]
 /// targets; non-concrete observations are silently dropped (covered by
 /// the missing-constraint check on residuals if relevant).
@@ -3693,7 +3693,7 @@ pub struct Env {
     /// actual-module-name). Sibling-shape to [`Self::module_globals`];
     /// populated workspace-flat by [`crate::build_check_env`] so the
     /// mono pass's per-fn entry points can re-seed the local
-    /// [`Self::imports`] before re-running [`synth`] on a body. Both
+    /// [`Self::imports`] before re-running `synth` on a body. Both
     /// `check_in_workspace` and `mono::build_workspace_env` consume
     /// the same env shape; `check_in_workspace` then overwrites
     /// [`Self::imports`] with the current module's map at the call
@@ -3718,7 +3718,7 @@ pub struct Env {
     /// [`ModuleGlobals::class_methods`], re-keyed to
     /// `(qualified-class-name, method-name)` so post-retirement of
     /// `MethodNameCollision` two classes can share a method name.
-    /// Consumed by [`synth`]'s `Term::Var` arm via the resolved class
+    /// Consumed by `synth`'s `Term::Var` arm via the resolved class
     /// (from `method_to_candidate_classes` + dispatch) plus the method
     /// name. Mono's presence checks consult
     /// [`Self::method_to_candidate_classes`] (method-keyed natively).
@@ -3742,13 +3742,13 @@ pub struct Env {
     /// Iter 22b.2 (Task 9): one-step superclass expansion table.
     /// Maps each class name to its superclass class name. Absence from
     /// the map means the class has no superclass — populated only for
-    /// classes that declare one. Used by [`check_fn`] to expand
+    /// classes that declare one. Used by `check_fn` to expand
     /// `Forall.constraints` for the missing-constraint check
     /// (Decision 11: max one step). The schema permits at most one
     /// superclass per class.
     pub class_superclasses: BTreeMap<String, String>,
     /// Iter 22b.2 (Task 10): workspace-wide instance registry, threaded
-    /// through from [`Workspace::registry`]. Read by [`check_fn`] in the
+    /// through from [`Workspace::registry`]. Read by `check_fn` in the
     /// concrete-residual path: when a class-method call at a fully-
     /// concrete type produces a residual `(class, type_)` whose
     /// `(class, type_hash(type_))` key is absent from `registry.entries`,

crates/ailang-check/src/mono.rs

@@ -23,16 +23,16 @@
 //!
 //! See `docs/plans/2026-05-09-22b3-monomorphisation.md` for the
 //! full task list. The eventual contract is for the pass to
-//! consume the workspace's typeclass [`Registry`] and the per-
+//! consume the workspace's typeclass [`ailang_core::workspace::Registry`] and the per-
 //! module class-method tables (already populated by
-//! [`crate::check_in_workspace`]) and produce a workspace with:
+//! `crate::check_in_workspace`) and produce a workspace with:
 //!
 //! 1. Synthesised [`Def::Fn`] entries — one per unique
 //!    `(class, method, type-hash)` triple observed at any
-//!    class-method call site — appended to the [`Registry`]'s
+//!    class-method call site — appended to the registry's
 //!    `defining_module` for that instance.
 //! 2. Rewritten call sites — every `Term::Var { name }` whose
-//!    `name` resolves through [`Env::class_methods`] is replaced
+//!    `name` resolves through `crate::Env::class_methods` is replaced
 //!    by the corresponding mono-symbol name (qualified with the
 //!    instance's `defining_module` iff that module differs from
 //!    the calling module).
@@ -403,7 +403,7 @@ fn workspace_has_specialisable_targets(ws: &Workspace) -> bool {
 ///
 /// Determinism: `ailang_core::canonical::type_hash` is the same
 /// function `workspace::build_registry` uses to key
-/// [`Registry::entries`], so a registry-key match implies a
+/// [`ailang_core::workspace::Registry::entries`], so a registry-key match implies a
 /// `mono_symbol` match.
 pub fn mono_symbol(base: &str, ty: &Type) -> String {
     mono_symbol_n(base, std::slice::from_ref(ty))
@@ -511,7 +511,7 @@ pub fn mono_target_key(t: &MonoTarget) -> (String, String, String) {
 /// and apply per-fn overlay (current_module, globals from
 /// module_globals, imports from module_imports, rigid_vars) plus the
 /// per-module env.types overlay
-/// (see [`apply_per_module_types_overlay`]).
+/// (see `apply_per_module_types_overlay`).
 pub fn build_workspace_env(ws: &Workspace) -> crate::Env {
     crate::build_check_env(ws)
 }
@@ -773,7 +773,7 @@ fn contains_rigid_var(t: &Type) -> bool {
 /// 1. has name [`mono_symbol`]`(target.method, target.type_)`,
 /// 2. has type = the class's method type with the class param
 ///    substituted to `target.type_` (rigid-var substitution via
-///    [`crate::substitute_rigids`]); the result is a plain
+///    `crate::substitute_rigids`); the result is a plain
 ///    `Type::Fn` with no `Forall`,
 /// 3. has params + body taken from the instance's matching
 ///    `InstanceMethod.body` if present and Lam-shaped; from the

crates/ailang-check/src/uniqueness.rs

@@ -2,7 +2,7 @@
 //!
 //! This pass classifies every binder of every fn body as either
 //! [`Uniqueness::Unique`] or [`Uniqueness::Shared`]. Unlike the
-//! [`crate::linearity`] check it is **not** a user-facing diagnostic
+//! `crate::linearity` check it is **not** a user-facing diagnostic
 //! pass — it is internal codegen input. Codegen consults the side
 //! table to decide where to emit `ailang_rc_inc` and `ailang_rc_dec`
 //! calls under `--alloc=rc` (Iter 18c.3).
@@ -39,7 +39,7 @@
 //!
 //! ## Position model
 //!
-//! Identical to [`crate::linearity`]'s, modulo that this pass has no
+//! Identical to `crate::linearity`'s, modulo that this pass has no
 //! activation gate (it runs on every fn). See that module's docs for
 //! the propagation rules. `Term::Lam` captures are conservatively
 //! treated as Consume — the same conservative decision the linearity