iter embedding-abi-m3.1 (PARTIAL 5/7 + Boss spec-defect repair): single-ctor scalar record crosses the C ABI, ownership follows declared mode

Tasks 1-5 GREEN. T1 baseline pins (re-point annotation + @ailang_rc_alloc
heap-box byte-pin: size=8+n*8, tag@0, fields@8/16). T2 export gate widened
(is_c_scalar -> two-level is_c_abi_type: single-ctor all-Int/Float record;
multi-ctor/Str/List/nested still RED; gate suite 10/10; M1 adt-ret must-fail
re-pointed to multi-ctor+Str Reading). T3 codegen forwarder widened
(llvm_scalar record Type::Con -> ptr; M2 forwarder body byte-unchanged;
3/3 staticlib pins). T4/T5 E2E record round-trip own+borrow, global
leak-freedom.

Boss spec-consistency repair (M2.1-precedent class): orchestrator
correctly BLOCKED Task 5 on a genuine spec defect -- the single-ctx-readback
allocs==frees proof model is unsatisfiable for borrow (and only
coincidentally passes for own) because M2's TLS-ctx is bound only during
the synchronous forwarder call, so host-side decs land on g_rc_*, not ctx.
Boss-verified globally leak-free + value-correct both modes. Spec + plan +
harness amended to the stronger global model (sum all ailang_rc_stats:
lines; the M2-TLS cross-attribution documented as correct behaviour). No
fresh grounding-check (removes an over-strong measurement assumption).

Tasks 6 (DESIGN.md frozen-layout SSOT + lockstep pointers + freeze wording
+ enforceability demo) and 7 (workspace-green gate) re-dispatched on the
amended plan. Bench/architect milestone-close is audit-owned.

iter embedding-abi-m3.1 (PARTIAL); INDEX.md line deferred to the DONE commit

crates/ailang-codegen/tests/embed_staticlib_lowering.rs

@@ -43,6 +43,33 @@ fn staticlib_emits_forwarder_no_main() {
         "internal call must stay byte-unchanged (no ctx arg);\nIR:\n{ir}");
 }
 
+/// M3: a single-ctor scalar record param/ret crosses the embedding
+/// C boundary as a bare `ptr` (the frozen payload pointer — DESIGN.md
+/// §"Embedding ABI" > "Frozen value layout"). The M2 forwarder body
+/// is byte-unchanged: leading `ptr %ctx`, TLS save/store/restore, the
+/// internal `@ail_<module>_<fn>` call carrying no ctx arg and no
+/// aggregate calling convention (no `sret`/`byval` — a record is a
+/// bare ptr, not an LLVM aggregate). Internal symbol is module-
+/// qualified `@ail_embed_backtest_step_record_step` (module ==
+/// file stem, Design-decision 6).
+#[test]
+fn staticlib_record_forwarder_is_ptr_passthrough() {
+    let ws = load("embed_backtest_step_record.ail");
+    let ir = ailang_codegen::lower_workspace_staticlib_with_alloc(
+        &ws, ailang_codegen::AllocStrategy::Rc).unwrap();
+    // record param + ret cross as bare ptr; ctx leading; M2 TLS shape.
+    assert!(ir.contains("define ptr @backtest_step(ptr %ctx, ptr %a0, double %a1)"),
+        "record fwd: ptr ret, leading ptr %ctx, ptr record param, double sample;\nIR:\n{ir}");
+    assert!(ir.contains("store ptr %ctx, ptr @__ail_tls_ctx"),
+        "M2 TLS store byte-unchanged;\nIR:\n{ir}");
+    assert!(ir.contains("call ptr @ail_embed_backtest_step_record_step(ptr %a0, double %a1)"),
+        "internal call byte-unchanged (no ctx arg, module-qualified);\nIR:\n{ir}");
+    assert!(!ir.contains("sret") && !ir.contains("byval"),
+        "no aggregate convention introduced — record is a bare ptr;\nIR:\n{ir}");
+    assert!(!ir.contains("define i32 @main()"),
+        "staticlib: no @main;\nIR:\n{ir}");
+}
+
 #[test]
 fn executable_target_still_emits_main() {
     let ws = load("embed_backtest_step.ail");