iter form-a.tidy: form_a.md class/instance/constraints + 3 documentary drift items

Six-task post-fieldtest documentary tidy. No production-code behaviour
changes; 559 tests green at every per-task gate.

T1-T3: form_a.md additions
- §Definitions intro "Three kinds" -> "Five kinds".
- New `### Class — (class ...)` subsection: EBNF carries optional
  superclass (0 or 1 per ClassDef.superclass schema), method
  signatures with optional defaults; anchored to
  examples/test_22c_user_class_e2e.ail (ok 24/2).
- New `### Instance — (instance ...)` subsection: EBNF carries the
  (method NAME (body LAM-TERM))* shape; canonical-form CLASS-REF
  rule explicitly stated (bare same-module / qualified cross-module);
  two examples — same-module abbreviated from
  mq3_class_eq_vs_fn_eq_classmod.ail and cross-module qualified
  from show_user_adt.ail; bare-cross-module-class-ref diagnostic
  named inline.
- §Types `(forall ...)` line extended with optional `(constraints
  (constraint CLASS-REF TYPE)+)?` clause; explanatory paragraph
  added with no-instance diagnostic anchor; fifth example added
  to the Examples block anchored to cmp_max_smoke.ail.

T4: docs/specs/2026-05-13-form-a-default-authoring.md "seven
carve-outs" → "eight carve-outs" at 6 sites contradicting the
§C4(b) compile-time-embed amendment (commit 9fcda8b). Sites:
preamble line 11, §C1 line 170, §C2 line 191, §C3 line 218,
§"Data flow" lines 363 + 374. Post-edit grep returns 4 surviving
"seven" lines (233, 238, 463, 469), all correctly §C4(a)-scope
or arithmetic/future-state.

T5: crates/ailang-core/src/hash.rs:50-57 — delete empty
`#[cfg(test)] mod tests {}` placeholder + 6-line relocation
comment. Tests live in crates/ailang-core/tests/hash_pin.rs
since form-a.1 T5; placeholder served no purpose. hash_pin.rs
still 10/10 passing.

T6: crates/ailang-surface/tests/round_trip.rs — module-level
`//!` and inner `///` docstrings rewritten to the post-T10
four-property framing (parse-determinism / idempotency /
CLI-pipeline-idempotency / carve-out-anchor) instead of the
retired Direction-1/Direction-2 language. Sibling-crate
breadcrumbs added pointing at the other two enforcement points
(roundtrip_cli.rs, carve_out_inventory.rs).

Drift item B2 (audit-form-a "plan file two sites") dropped per
recon verification: docs/plans/2026-05-13-iter-form-a.1.md
contains zero defective "seven" sites; all four hits are
internally scoped to §C4(a), arithmetic, or future-state.
Decision recorded in the journal.

Closes 2 of 3 fieldtest-form-a spec_gap findings (#2 form_a.md
typeclass surface + #3 form_a.md class-qualifier rule for
instance) and 3 of 4 audit-form-a drift items.

crates/ailang-surface/tests/round_trip.rs

@@ -1,24 +1,32 @@
-//! Round-trip gate for the form-(A) projection.
+//! Roundtrip Invariant gate (in-process) for the form-(A) projection.
 //!
 //! Two complementary checks over `examples/*.ail`, each gathering
 //! fixtures dynamically via `read_dir` (no hardcoded lists). The
 //! tests are pure readers — they do not write into the working
 //! tree.
 //!
-//! 1. `parse_is_deterministic_over_every_ail_fixture`: for every
+//! 1. `parse_is_deterministic_over_every_ail_fixture` — pins
+//!    **parse-determinism** (property 1 of the post-form-a Roundtrip
+//!    Invariant, DESIGN.md §"Roundtrip Invariant"). For every
 //!    well-formed `.ail` text `t`, `parse(t)` produces the same
 //!    canonical bytes every invocation. The parser is a pure
 //!    function of input — no randomness, no time dependence, no
 //!    environment leak. Hashing `canonical::to_bytes(parse(t))` is
 //!    therefore well-defined for any `.ail` source.
 //!
-//! 2. `parse_then_print_then_parse_is_idempotent_on_every_ail_fixture`:
-//!    Direction 2 of the Roundtrip Invariant (DESIGN.md §"Roundtrip
-//!    Invariant"). For every well-formed `.ail` text `t`, asserts
+//! 2. `parse_then_print_then_parse_is_idempotent_on_every_ail_fixture`
+//!    — pins **idempotency-under-print** (property 2). For every
+//!    well-formed `.ail` text `t`, asserts
 //!    `canonical_bytes(parse(t))` equals
 //!    `canonical_bytes(parse(print(parse(t))))`. The printer is a
 //!    left-inverse of the parser modulo canonical form.
 //!
+//! The other two properties of the post-form-a Roundtrip Invariant
+//! live in sibling test crates: **CLI-pipeline-idempotency** is
+//! pinned by `crates/ail/tests/roundtrip_cli.rs::cli_parse_then_render_then_parse_is_idempotent`,
+//! and **carve-out-anchor** is pinned by
+//! `crates/ailang-core/tests/carve_out_inventory.rs::examples_ail_json_inventory_matches_carve_outs`.
+//!
 //! Retired iter form-a.1 T9: `print_then_parse_round_trips_every_fixture`
 //! (corpus shrunk to 8 carve-outs post-iter) and
 //! `every_ail_fixture_matches_its_json_counterpart` (no longer
@@ -60,16 +68,15 @@ fn list_ail_fixtures() -> Vec<PathBuf> {
     paths
 }
 
-/// Direction 2 of the Roundtrip Invariant (DESIGN.md §"Roundtrip
-/// Invariant"): for every well-formed `.ail` text `t`, the
-/// composition `parse → print → parse` is idempotent on the AST.
+/// Pins **idempotency-under-print** (property 2 of the post-form-a
+/// Roundtrip Invariant, DESIGN.md §"Roundtrip Invariant"): for every
+/// well-formed `.ail` text `t`, the composition `parse → print → parse`
+/// is idempotent on the AST.
 ///
-/// For the 57 `.ail` fixtures that have a JSON counterpart this
-/// follows logically from `print_then_parse_round_trips_every_fixture`
-/// + `every_ail_fixture_matches_its_json_counterpart`. This test
-/// asserts the property directly so it stays robust for future
-/// `.ail` fixtures without a JSON counterpart, and so the spec's
-/// Direction-2 claim has a dedicated enforcement point.
+/// Direct enforcement complements the parse-determinism gate above
+/// (which alone does not constrain the printer). Together they pin
+/// `parse → print` as a left-inverse modulo canonical form for every
+/// `.ail` fixture in the corpus.
 #[test]
 fn parse_then_print_then_parse_is_idempotent_on_every_ail_fixture() {
     let fixtures = list_ail_fixtures();