iter embedding-abi-m3.1 (PARTIAL 5/7 + Boss spec-defect repair): single-ctor scalar record crosses the C ABI, ownership follows declared mode

Tasks 1-5 GREEN. T1 baseline pins (re-point annotation + @ailang_rc_alloc
heap-box byte-pin: size=8+n*8, tag@0, fields@8/16). T2 export gate widened
(is_c_scalar -> two-level is_c_abi_type: single-ctor all-Int/Float record;
multi-ctor/Str/List/nested still RED; gate suite 10/10; M1 adt-ret must-fail
re-pointed to multi-ctor+Str Reading). T3 codegen forwarder widened
(llvm_scalar record Type::Con -> ptr; M2 forwarder body byte-unchanged;
3/3 staticlib pins). T4/T5 E2E record round-trip own+borrow, global
leak-freedom.

Boss spec-consistency repair (M2.1-precedent class): orchestrator
correctly BLOCKED Task 5 on a genuine spec defect -- the single-ctx-readback
allocs==frees proof model is unsatisfiable for borrow (and only
coincidentally passes for own) because M2's TLS-ctx is bound only during
the synchronous forwarder call, so host-side decs land on g_rc_*, not ctx.
Boss-verified globally leak-free + value-correct both modes. Spec + plan +
harness amended to the stronger global model (sum all ailang_rc_stats:
lines; the M2-TLS cross-attribution documented as correct behaviour). No
fresh grounding-check (removes an over-strong measurement assumption).

Tasks 6 (DESIGN.md frozen-layout SSOT + lockstep pointers + freeze wording
+ enforceability demo) and 7 (workspace-green gate) re-dispatched on the
amended plan. Bench/architect milestone-close is audit-owned.

iter embedding-abi-m3.1 (PARTIAL); INDEX.md line deferred to the DONE commit

crates/ailang-codegen/src/lib.rs

@@ -662,17 +662,27 @@ fn fn_scalar_sig(t: &Type) -> Option<(Vec<Type>, Type)> {
         other => other,
     };
     match inner {
+        // M3: params/ret may include a single-ctor scalar record type;
+        // llvm_scalar maps it to `ptr`. fn_scalar_sig is type-shape only.
         Type::Fn { params, ret, .. } =>
             Some((params.clone(), (**ret).clone())),
         _ => None,
     }
 }
 
-/// `Int` → `i64`, `Float` → `double` (the only two M1 scalars; the
-/// check-side gate rejects everything else before codegen).
+/// `Int` → `i64`, `Float` → `double`, a single-ctor scalar record
+/// (any other named `Type::Con` reaching an `(export)` signature, by
+/// the Task-2 export gate) → `ptr`. The check-side gate rejects every
+/// other shape before codegen.
 fn llvm_scalar(t: &Type) -> &'static str {
     match t {
         Type::Con { name, .. } if name == "Float" => "double",
+        Type::Con { name, .. } if name == "Int" => "i64",
+        // M3: any other Type::Con reaching an (export) signature is,
+        // by the Task-2 export gate, a single-ctor scalar record;
+        // it crosses the C ABI as a bare `ptr` (DESIGN.md §"Embedding
+        // ABI" frozen layout — payload pointer).
+        Type::Con { .. } => "ptr",
         _ => "i64",
     }
 }