plan+audit: design-md-rolesplit.tidy re-derived on planning-time evidence (mechanism + scope corrected)

The tidy's gate-first Task 1 RED-verification + Boss independent
verification surfaced two defects in the audit Resolution as first
written — caught exactly where the planner->Boss loop is designed to,
before any contract byte moved. Per the 'two+ defects in one
iteration => fix the upstream artifact, do not patch a third time'
discipline, the audit Resolution is corrected in lockstep with the
plan re-derivation:

- Mechanism (Resolution-4): the 'case-insensitive iter-code regex'
  clause-3 design is REJECTED as unworkable — a blanket
  iter/milestone detector conflates the memory-model rule-names
  'Iter A'/'Iter B' and ordinary words 'pre-existing'/'pre-set'/
  'pre-Boehm' with provenance, over-firing on legit present-tense
  contract prose (4 no-strip files). Replaced by a FAITHFUL Sweep-1
  superset: case-sensitive digit-anchored Sweep-1 line anchors
  (confirmed ZERO across all contracts) + Sweep-1's ^[^/]*
  path-excluded date (so docs/specs/2026-.. citations are not
  flagged — repairs the iso_date over-fire the implement
  orchestrator correctly BLOCKED on) + the audit-named
  decision-record phrases (case-insensitive). No regex dep. The
  load-bearing invariant (clause-3 GREEN => Sweep-1 clean) is
  preserved; it never required the blanket detector.
- Scope (Resolution-1): the architect's [medium] was a 3-file
  spot-check; the exhaustive scan found roundtrip-invariant.md:73
  ('at iter form-a.1') and data-model.md:149,161 ('loop-recur iter
  1:') also carry lowercase provenance. True strip set = 5 files;
  plan Task 5b adds the 2 (spirit-cleanup, not gate-blocking).

Plan self-review 8/8 re-run; clause-3 = hand-rolled faithful Sweep-1
superset, no regex dep, no blanket iter detector.

docs/journals/2026-05-19-audit-design-md-rolesplit.md

@@ -83,13 +83,21 @@ milestone.
   iteration** `design-md-rolesplit.tidy`. Orchestrator-decided
   scope (the architect named the gap; the clause-3-widening
   decision is mine):
-  1. Move the decision-record/history prose out of
-     `design/contracts/{typeclasses,str-abi,scope-boundaries}.md`
-     into `docs/journals/2026-05-19-design-decision-records.md`
-     (append — same milestone's relitigation archive). Each removed
-     history sentence is replaced by its present-tense contract
-     equivalent (e.g. the builtin *signature* is the contract; the
-     `(iter …)` stamp is journal metadata).
+  1. Move the decision-record/history prose out of the affected
+     contract files into
+     `docs/journals/2026-05-19-design-decision-records.md` (append —
+     same milestone's relitigation archive). Each removed history
+     sentence is replaced by its present-tense contract equivalent
+     (the builtin *signature* is the contract; the `(iter …)` stamp
+     is journal metadata). **Scope corrected on planning-time
+     evidence (see amendment below):** the architect's `[medium]`
+     was a 3-file spot-check
+     (`typeclasses`/`str-abi`/`scope-boundaries`); the exhaustive
+     plan-recon + Boss verification scan found two more contract
+     files carrying lowercase `iter <code>` provenance the
+     spot-check missed — `roundtrip-invariant.md:73` ("at iter
+     form-a.1") and `data-model.md:149,161` ("loop-recur iter 1:").
+     The true strip set is **5 contract files**.
   2. Fix `float-semantics.md` stale-direction cross-ref →
      `(see design/contracts/str-abi.md)`.
   3. **Re-scope the `architect_sweeps.sh` honesty sweeps from
@@ -102,19 +110,60 @@ milestone.
      `ailang-architect.md` + any sweep-scope doc in lockstep.
   4. **Widen `design_index_pin.rs` clause-3** so, over the
      `design/contracts/` scope, it *subsumes* `architect_sweeps.sh`
-     Sweep-1's history-anchor regex (case-insensitive; iter-code
-     and ISO-date regexes; "earlier draft", "amends the above",
-     "was retired", "deliberately deferred", "new-baseline
-     decision", "milestone NN"). Invariant established:
+     Sweep-1's history-anchor regex. Invariant established:
      **clause-3 GREEN ⟹ Sweep-1 finds nothing in `contracts/`** —
-     the in-code hard gate enforces the spirit; the advisory can
-     then only legitimately fire on `models/` (now out of its
-     scope). This permanently closes the spirit-vs-letter gap the
-     literal 6-marker list left open.
-  5. Exit state: `architect_sweeps.sh` exit 0; widened
-     `design_index_pin.rs` clause-3 GREEN; whole `cargo test
-     --workspace` GREEN; the decision-record journal grows; no new
-     contract carries history residue.
+     the in-code hard gate enforces the spirit; the advisory then
+     only legitimately fires on `models/` (out of its scope after
+     point 3). This permanently closes the spirit-vs-letter gap the
+     literal 6-marker list left open. **Mechanism corrected on
+     planning-time evidence (see amendment below):** the original
+     "case-insensitive iter-code regex" sketch is *unworkable* and
+     is rejected — a blanket case-insensitive `iter`/`milestone`
+     detector conflates the memory-model rule-names "Iter A"/"Iter
+     B" and the ordinary words "pre-existing"/"pre-set"/"pre-Boehm"
+     with provenance, over-firing on legitimate present-tense
+     contract prose. The workable design: clause-3 = a **faithful
+     reproduction** of Sweep-1's actual alternatives
+     (case-*sensitive*, digit-anchored — confirmed ZERO across all
+     contracts) + Sweep-1's `^[^/]*` **path-excluded** date
+     (so `docs/specs/2026-…` citations are not flagged) + the
+     audit-named decision-record **phrases** (case-insensitive — the
+     deliberate widening that closes the capital-variance dodge).
+     The lowercase `(iter <code>)` provenance is removed by the
+     strip tasks (point 1), not by a fragile hard-gate regex; the
+     invariant holds without the rejected detector.
+  5. Exit state: `architect_sweeps.sh` exit 0; the widened
+     (faithful-superset) `design_index_pin.rs` clause-3 GREEN; whole
+     `cargo test --workspace` GREEN; the decision-record journal
+     grows; no contract carries history residue.
+
+### Resolution amendment (2026-05-19, planning-time evidence)
+
+The tidy plan's gate-first Task 1 (RED-verification) + Boss
+independent verification surfaced two defects in this Resolution as
+first written — caught exactly where the planner→Boss loop is
+designed to catch them, before any contract byte moved:
+
+- **Mechanism (point 4):** "case-insensitive iter-code regex" is
+  unworkable (conflates rule-names + ordinary words with
+  provenance). Replaced by the faithful-Sweep-1 + path-excluded-date
+  + phrases design above. The load-bearing invariant (clause-3 ⟹
+  Sweep-1 clean) is *preserved* — it never required the blanket
+  detector; faithful-Sweep-1 + phrases suffices and faithful-Sweep-1
+  is confirmed already ZERO across every contract.
+- **Scope (point 1):** the `[medium]` was a 3-file spot-check; the
+  exhaustive scan found `roundtrip-invariant.md` + `data-model.md`
+  also carry lowercase provenance. The strip set is 5 files (the
+  plan's Task 5b covers the 2 additions; they are spirit-cleanup,
+  not gate-blocking — neither Sweep-1 nor the corrected clause-3
+  trips on lowercase `iter form-a.1`, so the invariant/gate close
+  regardless; stripping them is the audit's *spirit* fully honored).
+
+This amendment is the upstream-artifact correction the discipline
+mandates over patching the plan a third time (the "two+ defects in
+one iteration ⇒ the upstream artifact is wrong" rule). The plan
+`docs/plans/design-md-rolesplit.tidy.md` is re-derived consistently
+with it.
 
 Milestone closes after the tidy iteration lands Boss-verified.
 No fieldtest (zero authoring-surface change — the only author-facing