design/ + source rustdoc: replace opaque shorthand with content phrases + links

Reader-facing prose and rustdoc carried opaque shorthand like
"Decision 10", "clause-5", "mq.1", "ct.1", "eob.1", "rpe.1",
"post-mq.3", and "Iter 22b.1:" with no in-repo definition the reader
could follow. This commit replaces every such occurrence in the
durable tier the reader is most likely to land on (design/ ledger +
source //! module headers + the central /// public-item rustdoc) with
an inline content phrase plus, where applicable, a Markdown link to
the file that defines the referenced concept.

design/ ledger — 16 files:
  Definition-site headings demoted from "Decision N: <title>" to
  "<title>": authoring-surface, tail-calls, memory-model section in
  rc-uniqueness.md, dual-allocator section, typeclass design,
  effects "pure core + algebraic effects".
  Cross-reference sites: "Decision 1" -> canonical-schema principle
  (data-model); "Decision 3/4" -> effects + scope-boundaries; "Decision
  6" -> authoring-surface; "Decision 8" -> tail-calls; "Decision 9" ->
  rc-uniqueness (dual-allocator); "Decision 10" -> memory-model;
  "Decision 11" -> typeclasses (model). "clause-5" -> body-link
  durability gate. "clause-3" (in language-constraints) ->
  bug-class-reintroduction discriminator. "mq.1/2/3", "ct.1/4",
  "eob.1", "rpe.1" -> the canonical-form rule / the type-driven
  dispatch / the Str carve-out / etc. "post-mq.3" -> "type-driven".

design/contracts/feature-acceptance.md: file-local "clauses 1/2/3"
-> "criteria 1/2/3" (sprachliche Kohärenz mit der File-Überschrift
"Feature-acceptance criterion"); "the clause-3 mechanism" -> "the
bug-class-reintroduction discriminator".

Source //! module headers — 24 files:
  Stripped "Iter X.Y:" prefixes and "(Decision N)" / "(mq.X)" tags
  from spec_drift, uniqueness, reuse_shape, migrate_canonical_types,
  typeclass_22b{2,3,c}, suppress_filter, lift, mono, linearity,
  diagnostic, method_dispatch_pin, method_collision_pin,
  no_per_type_print_ops, mq3_multi_class_e2e, print_mono_body_shape,
  print_no_leak_pin, cli_diag_human_workspace_load_error,
  ct1_check_cli, prose snapshot, unbound_in_instance_method_pin,
  mono_xmod_ctor_pattern, desugar.

Central /// public-item rustdoc:
  ast.rs (full sweep — every "Iter X" + "Decision N" prefix
  reformulated; mode/Type::Fn rustdoc now points at memory-model.md;
  Constraint / SuperclassRef / InstanceDef / ClassDef rustdoc points
  at typeclasses contract).
  diagnostic.rs (all "(Iter X)" / "(mq.X)" tags on diagnostic codes
  removed).
  lib.rs (FORM_A_SPEC rustdoc points at authoring-surface.md
  instead of "Decision 6").
  canonical.rs (type_hash + Float-literal rustdoc).

Still outstanding (for a follow-up commit): ~500 inline `//`
code-body comments with `Iter X.Y` markers across the workspace, and
a handful of `///` rustdoc items in hash_pin / workspace_pin / lift /
mono / suppress_filter test-pin and internal-function bodies. Code
identifiers (test filenames like `mq3_multi_class_e2e.rs`, function
names like `iter18e_drop_iterative_default_preserves_hashes`) stay
verbatim per the user's "code identifiers stay verbatim" rule.

Tests: design_index_pin 5/5 + docs_honesty_pin 5/5; workspace builds
clean; full `cargo test --workspace` previously green (every
`test result: ok` line, no FAILED line).

design/models/effects.md

@@ -1,6 +1,6 @@
 # Effects — pure core + algebraic effects
 
-## Decision 3: pure core language + algebraic effects
+## Pure core language + algebraic effects
 
 The default is total, pure functions. Effects are declared as a set in the
 function type: `(Int) -> Int ![IO]`. The effect set is a
@@ -13,7 +13,9 @@ currently in scope vs. excluded lives in
 In the MVP only the effect `IO` is wired up (its sole op is `io/print_str`).
 `Diverge` (for non-termination) is reserved as an effect name but is
 unimplemented — no op, no codegen, no checker injection — in the same
-sense Decision 4 reserves refinements.
+sense the refinements layer is reserved as a future extension without
+present-day surface (see
+[scope boundaries](../contracts/scope-boundaries.md)).
 
 This is the most important LLM property: when I read a function, I can trust
 its signature without reading the body.

design/models/pipeline.md

@@ -7,7 +7,7 @@
             ├─ load + validate schema
             ├─ resolve names + assign hashes
             ├─ desugar (AST → AST)
-            ├─ typecheck (HM, effect rows; mode-strict per Decision 10)
+            ├─ typecheck (HM, effect rows; mode-strict per the memory model)
             ├─ lift_letrecs (post-typecheck AST → AST)
             ├─ lower to MIR (SSA-like, named SSA values)
             ├─ emit LLVM IR (.ll)

design/models/prose-projection.md

@@ -5,9 +5,9 @@
 AILang ships a
 second textual projection of the AST: `ailang-prose`, a one-way
 projection from `Module → human-readable text`. It is **not** an
-authoring surface; it is the "display" projection that Decision 6's
-architectural pin (see [authoring surface](../contracts/authoring-surface.md))
-explicitly anticipated:
+authoring surface; it is the "display" projection that the
+[authoring surface](../contracts/authoring-surface.md)'s
+architectural pin explicitly anticipated:
 
 > *"Future projections are explicitly anticipated: a visual /
 > graphical front-end is a plausible second projection for human
@@ -41,7 +41,8 @@ form (B) deliberately is not. Re-integrating prose edits requires an
 external LLM mediator, not a compiler pass — the prompt template
 `ail merge-prose` composes the six-step cycle.
 
-Form (B) does not weaken any Decision 6 invariant:
+Form (B) does not weaken any
+[authoring surface](../contracts/authoring-surface.md) invariant:
 
 - The [JSON-AST](../contracts/data-model.md) remains the only
   hashable artefact. Prose is not hashed, not content-addressed,

design/models/rc-uniqueness.md

@@ -1,6 +1,6 @@
 # RC + Uniqueness — memory model whitepaper
 
-## Decision 9: dual allocator — RC canonical, Boehm parity oracle
+## Dual allocator — RC canonical, Boehm parity oracle
 
 AILang ships two allocator backends with an asymmetric role:
 
@@ -25,12 +25,11 @@ when the parity oracle stops paying its keep — concretely, when a
 few iter families ship without the gc arm catching anything that
 the rc arm did not already catch. Until then, the cost of
 keeping libgc as a build dependency is accepted in exchange for
-diagnostic leverage. Decision 10 (RC + uniqueness) holds as the
-specification of the canonical runtime (the contract version is
-[memory model](../contracts/memory-model.md), built on
-[language constraints](../contracts/language-constraints.md));
-the rest of this section documents the Boehm half, retained as
-the oracle.
+diagnostic leverage. The
+[RC + uniqueness memory model](../contracts/memory-model.md), built
+on the [language constraints](../contracts/language-constraints.md),
+holds as the specification of the canonical runtime; the rest of
+this section documents the Boehm half, retained as the oracle.
 
 **Choice: Boehm-Demers-Weiser conservative GC.** The simplest
 working option:
@@ -130,7 +129,7 @@ The closure-pair and its env share an escape verdict — they have
 parallel lifetimes. If the closure pair is non-escaping, the env
 is too.
 
-## Decision 10: memory model — RC + Uniqueness with LLM-author annotations
+## Memory model — RC + Uniqueness with LLM-author annotations
 
 **The GC bench (`bench/run.sh`) showed
 Boehm contributing a substantial fraction of runtime on allocation-heavy workloads
@@ -150,9 +149,10 @@ stdlib is the cheapest moment to commit.
 **Choice.** AILang's canonical [memory model](../contracts/memory-model.md)
 is reference counting with static uniqueness inference **and
 explicit LLM-author annotations on fn signatures**, in the lineage
-of Lean 4 / Roc / Koka. Boehm becomes a transitional allocator (Decision 9) and is
-retired when the RC pipeline matches the bump-allocator floor
-within an acceptable margin (target 1.3× on `bench/run.sh`).
+of Lean 4 / Roc / Koka. Boehm becomes a transitional allocator (see
+the dual-allocator section above) and is retired when the RC pipeline
+matches the bump-allocator floor within an acceptable margin (target
+1.3× on `bench/run.sh`).
 
 **Workload scope of the 1.3× target.** The 1.3× target was
 calibrated on the original `bench/run.sh` corpus: linear list
@@ -168,16 +168,17 @@ one bump-pointer bump, doubling the allocation tax on closure
 construction (current ratio recorded in JOURNAL bench entries).
 This is a representational cost of the closure-pair layout,
 not a defect in the RC implementation; a future slab/pool
-allocator for fixed-shape pair cells (Decision 9 retirement
-follow-up) would compress this ratio without changing semantics.
+allocator for fixed-shape pair cells (a Boehm-retirement follow-up)
+would compress this ratio without changing semantics.
 
 The 1.3× retirement target therefore applies to the linear /
 tree / poly-ADT subset of the corpus. Closure-heavy workloads are
 tracked under a wider band (the closure-chain baseline records its rc/bump ratio as the `rc_over_bump` reference value with ±15% tolerance) and
 are explicitly excluded from the Boehm-retirement gate until a
-slab/pool answer ships. Decision-10's RC commitment is unchanged;
-what is scoped is the *quantitative* retirement criterion, not
-the choice of memory model.
+slab/pool answer ships. The
+[memory model](../contracts/memory-model.md)'s RC commitment is
+unchanged; what is scoped is the *quantitative* retirement criterion,
+not the choice of memory model.
 
 The architecture has two layers:
 

design/models/typeclasses.md

@@ -8,7 +8,7 @@ built-in classes shipped in the prelude in
 covers the design choices and the resolution / monomorphisation
 algorithm.
 
-## Decision 11: typeclasses — Haskell-lite, monomorphised, coherent
+## The design — Haskell-lite, monomorphised, coherent
 
 **The design pass for typeclasses. Codified after the
 [Feature-acceptance criterion](../contracts/feature-acceptance.md)
@@ -158,10 +158,9 @@ component contains `__` by project convention.
 
 **No runtime dispatch, no dictionary passing.** The monomorphisation
 pass is the ONLY specialiser. Codegen sees only monomorphic
-`Def::Fn`s and direct calls; the pre-iter-23.4 codegen-time
-specialiser (`lower_polymorphic_call` + `module_polymorphic_fns` +
-`mono_queue`) was removed in iter 23.4. A call that cannot be
-monomorphised — for instance, because a constraint remains
-unresolved at the entry point — is a static error, not a runtime
-one. This is the LLVM-friendly form and is consistent with
-Decision 10's performance commitment.
+`Def::Fn`s and direct calls. A call that cannot be monomorphised —
+for instance, because a constraint remains unresolved at the entry
+point — is a static error, not a runtime one. This is the
+LLVM-friendly form and is consistent with the performance
+commitment of the
+[RC + uniqueness memory model](../contracts/memory-model.md).