iter embedding-abi-m3.1 (PARTIAL 5/7 + Boss spec-defect repair): single-ctor scalar record crosses the C ABI, ownership follows declared mode

Tasks 1-5 GREEN. T1 baseline pins (re-point annotation + @ailang_rc_alloc
heap-box byte-pin: size=8+n*8, tag@0, fields@8/16). T2 export gate widened
(is_c_scalar -> two-level is_c_abi_type: single-ctor all-Int/Float record;
multi-ctor/Str/List/nested still RED; gate suite 10/10; M1 adt-ret must-fail
re-pointed to multi-ctor+Str Reading). T3 codegen forwarder widened
(llvm_scalar record Type::Con -> ptr; M2 forwarder body byte-unchanged;
3/3 staticlib pins). T4/T5 E2E record round-trip own+borrow, global
leak-freedom.

Boss spec-consistency repair (M2.1-precedent class): orchestrator
correctly BLOCKED Task 5 on a genuine spec defect -- the single-ctx-readback
allocs==frees proof model is unsatisfiable for borrow (and only
coincidentally passes for own) because M2's TLS-ctx is bound only during
the synchronous forwarder call, so host-side decs land on g_rc_*, not ctx.
Boss-verified globally leak-free + value-correct both modes. Spec + plan +
harness amended to the stronger global model (sum all ailang_rc_stats:
lines; the M2-TLS cross-attribution documented as correct behaviour). No
fresh grounding-check (removes an over-strong measurement assumption).

Tasks 6 (DESIGN.md frozen-layout SSOT + lockstep pointers + freeze wording
+ enforceability demo) and 7 (workspace-green gate) re-dispatched on the
amended plan. Bench/architect milestone-close is audit-owned.

iter embedding-abi-m3.1 (PARTIAL); INDEX.md line deferred to the DONE commit

crates/ailang-codegen/tests/embed_record_layout_pin.rs

@@ -0,0 +1,47 @@
+//! FROZEN ABI byte-pin — see DESIGN.md §"Embedding ABI" frozen layout.
+//! Pins the heap (@ailang_rc_alloc) box layout a boundary-crossing
+//! single-ctor scalar record takes: size = 8 + n*8, tag i64 @ offset
+//! 0, fields i64-strided from offset 8. Goes RED if codegen moves an
+//! offset — the M3 freeze made enforceable, not aspirational.
+//!
+//! The carrier (`embed_record_layout_carrier.ail`) is a non-export
+//! exe-target program whose `mk` returns a `Pt` consumed by an
+//! `(own (con Pt))` param `sum_pt`, forcing the escaping heap box
+//! (NOT the `alloca` non-escape path the pre-existing
+//! `iter17a_local_box_alloca` pins — that is a different path and not
+//! a substitute for this one). Lowered under `AllocStrategy::Rc`
+//! (the path a crossing M3 record actually takes), mirroring the
+//! workspace-load + lower incantation of `embed_staticlib_lowering.rs`.
+
+use ailang_core::Workspace;
+use std::path::PathBuf;
+
+fn load(file: &str) -> Workspace {
+    let path = PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+        .parent().unwrap().parent().unwrap()
+        .join("examples").join(file);
+    ailang_surface::load_workspace(&path).unwrap()
+}
+
+fn lower_carrier_ir() -> String {
+    let ws = load("embed_record_layout_carrier.ail");
+    ailang_codegen::lower_workspace_with_alloc(
+        &ws, ailang_codegen::AllocStrategy::Rc).unwrap()
+}
+
+#[test]
+fn heap_box_layout_is_frozen_8_plus_n_times_8_tag_at_0_fields_from_8() {
+    let ir = lower_carrier_ir();
+    // Pt has 2 Int fields → payload size 8 (tag) + 2*8 (fields) = 24,
+    // on the @ailang_rc_alloc heap path (record crosses the boundary).
+    assert!(ir.contains("call ptr @ailang_rc_alloc(i64 24)"),
+        "frozen: heap box payload size = 8 + n*8 (n=2 → 24); IR:\n{ir}");
+    // constructor tag written at offset 0 (single-ctor → 0; no elision)
+    assert!(ir.contains("store i64 0, ptr"),
+        "frozen: ctor tag i64 at offset 0; IR:\n{ir}");
+    // field 0 at offset 8, field 1 at offset 16 (i64-strided from 8)
+    assert!(ir.contains("getelementptr inbounds i8, ptr") && ir.contains("i64 8"),
+        "frozen: field 0 at payload offset 8; IR:\n{ir}");
+    assert!(ir.contains("i64 16"),
+        "frozen: field 1 at payload offset 16 (8 + 1*8); IR:\n{ir}");
+}

crates/ailang-codegen/tests/embed_staticlib_lowering.rs

@@ -43,6 +43,33 @@ fn staticlib_emits_forwarder_no_main() {
         "internal call must stay byte-unchanged (no ctx arg);\nIR:\n{ir}");
 }
 
+/// M3: a single-ctor scalar record param/ret crosses the embedding
+/// C boundary as a bare `ptr` (the frozen payload pointer — DESIGN.md
+/// §"Embedding ABI" > "Frozen value layout"). The M2 forwarder body
+/// is byte-unchanged: leading `ptr %ctx`, TLS save/store/restore, the
+/// internal `@ail_<module>_<fn>` call carrying no ctx arg and no
+/// aggregate calling convention (no `sret`/`byval` — a record is a
+/// bare ptr, not an LLVM aggregate). Internal symbol is module-
+/// qualified `@ail_embed_backtest_step_record_step` (module ==
+/// file stem, Design-decision 6).
+#[test]
+fn staticlib_record_forwarder_is_ptr_passthrough() {
+    let ws = load("embed_backtest_step_record.ail");
+    let ir = ailang_codegen::lower_workspace_staticlib_with_alloc(
+        &ws, ailang_codegen::AllocStrategy::Rc).unwrap();
+    // record param + ret cross as bare ptr; ctx leading; M2 TLS shape.
+    assert!(ir.contains("define ptr @backtest_step(ptr %ctx, ptr %a0, double %a1)"),
+        "record fwd: ptr ret, leading ptr %ctx, ptr record param, double sample;\nIR:\n{ir}");
+    assert!(ir.contains("store ptr %ctx, ptr @__ail_tls_ctx"),
+        "M2 TLS store byte-unchanged;\nIR:\n{ir}");
+    assert!(ir.contains("call ptr @ail_embed_backtest_step_record_step(ptr %a0, double %a1)"),
+        "internal call byte-unchanged (no ctx arg, module-qualified);\nIR:\n{ir}");
+    assert!(!ir.contains("sret") && !ir.contains("byval"),
+        "no aggregate convention introduced — record is a bare ptr;\nIR:\n{ir}");
+    assert!(!ir.contains("define i32 @main()"),
+        "staticlib: no @main;\nIR:\n{ir}");
+}
+
 #[test]
 fn executable_target_still_emits_main() {
     let ws = load("embed_backtest_step.ail");