audit + close: design-ledger-formal-links CLEAN milestone close (no drift, bench 0/0/0, no tidy)

Cleanest close pattern in recent project history. Architect: zero
drift -- every commitment + invariant verified positively (clause-5
implements all 4 predicates incl. fence-skip, 8 link tokens match
the closed convert-set exactly, disposition-(b) applied to the 2
homeless pointers, honesty-rule positive-half pin-safe, commitments
4/7 byte-unchanged, composition invariant clause-3 ∧ clause-5 GREEN
simultaneously, out-of-scope set untouched incl. the 5 in-fence
data-model annotations, no commitment-2 violation in any reading
list, architect_sweeps clean). Bench: check.py exit 0 (63/0/0/63),
compile_check exit 0 (24/0/0/24), cross_lang exit 0 (25/0/0/25);
baseline pristine, no --update-baseline, no paired ratify.

The two spec amendments (clause-6 + cross-ref definition;
clause-5 fence-skip + closed convert-set enumeration) were the
discipline working: planner-recon and plan-corpus-fetch surfaced
gaps the brainstorm-sample missed; the spec was corpus-grounded
*before* any byte moved (grounding-check PASS x3); implementation
then ran clean 5/5 with one non-blocking concern (planner
self-review-item-8 arithmetic miss on the //! header line count --
substantive assertion unaffected; recorded as lesson).

No tidy iteration. No fieldtest -- zero authoring-surface change
(no .ail, no language construct, no compiler/checker/codegen path)
is the spec-stated reasoned exclusion, audit-confirmed.

This commit ratifies the milestone close:
- audit journal: docs/journals/2026-05-19-audit-design-ledger-formal-links.md
- journals/INDEX.md: audit pointer appended
- roadmap.md: [~] -> [x] CLOSED 2026-05-19 with full pipeline record
- WhatsNew.md: user-facing done-state entry (verbatim with notify)

Spec: docs/specs/2026-05-19-design-ledger-formal-links.md
Plan: docs/plans/design-ledger-formal-links.1.md
Iter journal: docs/journals/2026-05-19-iter-design-ledger-formal-links.1.md
Pipeline: brainstorm (PASS x3) -> planner (recon + plan +
self-review 8/8) -> implement (DONE 5/5, Boss-verified independently)
-> audit (CLEAN, no tidy).

docs/roadmap.md

@@ -506,33 +506,41 @@ work progresses.
     convergence). CLOSED — audited + drift-resolved; hard gate
     enforces the honesty spirit.
 
-- [~] **\[milestone\]** Formal cross-links in the `design/` ledger
-  (browsable wiki) — IN FLIGHT 2026-05-19. The positive completion
+- [x] **\[milestone\]** Formal cross-links in the `design/` ledger
+  (browsable wiki) — CLOSED 2026-05-19. The positive completion
   of DESIGN.md → `design/`: informal prose cross-references between
-  contracts/models (`(see "Str ABI" below)`, bare-path-in-prose,
-  `§"Section"`) become **formal file-relative Markdown links**
-  `[label](./sibling.md)` / `[label](../../crates/.../x.rs)`
-  resolved relative to the containing file, plus a new RED-first
+  contracts/models are now **formal file-relative Markdown links**
+  resolved relative to the containing file, gated by RED-first
   `design_index_pin.rs` **clause-5** that fails the build on any
   body link that does not resolve into the durable tier (`design/`
   + `crates/**` + `runtime/**` only — never `docs/`, never a
   `#fragment`). clause-5 ∘ clause-3 = complete invariant: every
   contract cross-reference is a resolving durable file-link or
-  clause-3-forbidden history prose. The INDEX **spine stays
-  repo-root-relative** (registry tier, clause-1 byte-unchanged) —
-  the move-fragility rationale that drives body prose to
-  file-relative is absent for the file that never moves.
-  No authoring surface (no `.ail`; precedent: the split spec,
-  audited clean). Out of scope (recon-forced): intra-file
-  "above/below" within one document (no file-link form; the
-  file-split is a separate concern).
+  clause-3-forbidden history prose. INDEX spine stays
+  repo-root-relative (registry tier, clause-1 byte-unchanged) — the
+  move-fragility rationale that drives body prose to file-relative
+  is absent for the file that never moves. Shipped in one iter
+  (5/5 tasks): clause-5 with `strip_fences` (toggle on ```/~~~ so a
+  `](` inside a fence is not treated as a link) + RED-first via
+  identity-stubbed `strip_fences` synthetic vectors; 7 prose
+  conversions (8 link tokens — float-semantics:69/100,
+  embedding-abi:45, memory-model:44/105, scope-boundaries:48/88
+  with mixed-referent split into a source link + a Pipeline
+  cross-file link); clause-6 disposition (b) on the 2
+  PROSE_ROUNDTRIP homeless pointers (pointer removed, behavioural
+  `ail merge-prose` prose preserved); pin-safe positive-half
+  paragraph in `honesty-rule.md`.
   - context: spec `docs/specs/2026-05-19-design-ledger-formal-links.md`
-    (grounding-check PASS, 7/7 ratified); origin this session's
-    six-turn design conversation following the split close;
-    precedent slice already shipped in the split's tidy
-    (`float-semantics.md` `(see "Str ABI" below)` →
-    `(see design/contracts/str-abi.md)`, now to be brought to the
-    final `[Str ABI](str-abi.md)` form). Awaiting plan.
+    (grounding-check PASS ×3 across two corpus-grounded amendments —
+    clause-6 + cross-ref definition; clause-5 fence-skip + closed
+    convert-set enumeration); plan
+    `docs/plans/design-ledger-formal-links.1.md`; iter journal
+    `docs/journals/2026-05-19-iter-design-ledger-formal-links.1.md`;
+    audit `docs/journals/2026-05-19-audit-design-ledger-formal-links.md`;
+    origin this session's six-turn design conversation following the
+    split close. CLOSED — audit clean (zero drift, bench trio
+    0/0/0); no tidy, no fieldtest (zero authoring-surface change —
+    reasoned exclusion).
 
 - [ ] **\[milestone\]** Flat array/slice primitive — performance
   follow-up to the Embedding ABI arc, *not* a capability gap.