iter design-md-rolesplit.tidy (DONE 7/7): resolve milestone-close audit drift

Gate-first TDD: widened design_index_pin.rs clause-3 to a hand-rolled
FAITHFUL Sweep-1 superset (case-sensitive digit-anchored line anchors
+ Sweep-1's ^[^/]* path-excluded date + the audit-named
decision-record phrases, case-insensitive); no regex dep; the blanket
iter-detector rejected as unworkable. Sentence-level strip of
faithfully-migrated history/decision-record prose out of 5 contract
files (the audit's 3 spot-checked + roundtrip-invariant.md +
data-model.md the exhaustive scan found) into the decision-record
journal, each replaced by its present-tense contract equivalent;
float-semantics.md stale 'see Str ABI below' -> str-abi.md;
architect_sweeps honesty sweeps re-scoped to design/contracts only
(models/ is the narrative tier) + ailang-architect.md lockstep.
Invariant: clause-3 GREEN => Sweep-1 clean in contracts/.

The prior dispatch correctly BLOCKED on a real plan defect (iso_date
lacked Sweep-1's path-exclusion, over-firing on legit
docs/specs/2026-.. citations); per the two+-defects-in-one-iteration
discipline the audit Resolution mechanism+scope were corrected
upstream in lockstep (f2cdd67) before re-dispatch, not patched a
third time.

Boss-verified independently: cargo test --workspace 646/0,
design_index_pin 4/4 (clause-3 RED->GREEN), architect_sweeps.sh exit
0 'All five sweeps clean' (acceptance criterion 9 met), acceptance
grep CLEAN, 3 docs_honesty_pin pinned runs each exactly 1 contiguous
match. Zero spec/quality re-loops. FINAL design-md-rolesplit
iteration — milestone functionally complete, audited, drift-resolved,
hard gate enforces the honesty spirit.

docs/journals/2026-05-19-design-decision-records.md

@@ -429,3 +429,51 @@ post-ct.2.2 — a different consumer story, hence a different
 overlay shape. The asymmetry between the check side and the mono
 side is by design and is pinned by
 `crates/ailang-check/tests/duplicate_ctor_pin.rs`.
+
+## Migrated from design/contracts/ at design-md-rolesplit.tidy (2026-05-19)
+
+History/decision-record prose extracted from contract files by the
+post-audit tidy (the `###`-whole relocation in iter .1 dragged these
+into contracts; they are relitigation-guard content, not contract).
+
+### typeclasses.md — Prelude-classes evolution
+
+An earlier draft committed to a fixed Prelude (Show/Eq/Ord on the
+primitives), but the implementation work to wire `int_to_str` as a
+heap-allocated-string runtime primitive proved substantively
+separable from the typeclass machinery itself, and the LLM-utility
+case for primitive `Show` is weak (LLM-natural form is `int_to_str
+x`, not `show x`). Milestone 23 added `Ordering`/`Eq`/`Ord` +
+primitive instances + the five helpers; operator routing through
+`Eq`/`Ord` and `print`-rewire were held out for bench-rebaseline /
+post-mq-dispatcher reasons; `Show` shipped in milestone 24 (iters
+24.2/24.3). `MethodNameCollision` was retired at iter mq.3
+(cross-class method sharing became structurally legal). The
+dedicated `KindMismatch` diagnostic was retired at iter ctt.3
+(`BareCrossModuleTypeRef` subsumes it).
+
+### str-abi.md — heap-Str builtin provenance + deferred-operator rationale
+
+Builtin iter provenance: `int_to_str`/`bool_to_str`/`float_to_str`/
+`str_clone` shipped iter 24.1; `str_concat` shipped iter str-concat
+(2026-05-13); the non-escape static-Str lowering pass landed iter
+18b, move-tracking partial-drop iter 18d.3. Operator routing through
+classes is deliberately deferred — it would migrate every fixture
+and re-baseline the bench corpus (a new-baseline decision, not an
+iter detail). `Num` is not in milestone 22: class-based numeric
+overloading would invoke literal-defaulting which axis-7 excluded.
+
+### scope-boundaries.md — retired ops + deferral rationale
+
+Polymorphic-fn-as-value is deferred because it would need one
+closure-pair global per instantiation. The per-type print ops
+`io/print_int`/`io/print_bool`/`io/print_float` were retired in iter
+rpe.1 (the polymorphic `print` is the canonical non-Str output path).
+
+### roundtrip-invariant.md / data-model.md — corpus + loop-recur provenance
+
+The Form-A round-trip corpus was flipped from `.ail.json` to `.ail`
+at iter form-a.1. The `loop`/`recur` schema entries were added at
+loop-recur iter 1 (strictly additive; pre-existing fixtures hash
+bit-identically). Provenance only — the present-tense schema/contract
+is the entry shapes themselves.

docs/journals/2026-05-19-iter-design-md-rolesplit.tidy.md

@@ -0,0 +1,96 @@
+# iter design-md-rolesplit.tidy — contract-history strip + clause-3 widening
+
+**Date:** 2026-05-19
+**Started from:** f2cdd67e69574f564b63bfd4b7f5715046d75a5a
+**Status:** DONE
+**Tasks completed:** 7 of 7 (Tasks 1, 2, 3, 4, 5, 5b, 6, 7 — task_range [1,7] covers the 5b sub-task)
+
+## Summary
+
+Closes the `[medium]`+`[low]` spirit-vs-letter drift from
+audit-design-md-rolesplit: the `###`-whole relocation in iter .1
+dragged decision-record/history prose into 5 contract files. This
+tidy extracts that prose into
+`docs/journals/2026-05-19-design-decision-records.md` (each removed
+history sentence replaced by its present-tense contract equivalent),
+fixes the one stale `(see "Str ABI" below)` cross-ref in
+float-semantics.md, re-scopes `architect_sweeps.sh` from
+`design/contracts design/models` to `design/contracts` only (the
+narrative tier is not honesty-bound) with its lockstep
+`ailang-architect.md` sentence, and widens `design_index_pin.rs`
+clause-3 into a hand-rolled **faithful superset** of Sweep-1 over
+the contracts scope (case-sensitive digit-anchored `sweep1_line_anchor`
++ path-EXCLUDED `date_anchor` + case-insensitive decision-record
+PHRASES; no `regex` dep, no blanket iter detector). Gate-first TDD:
+clause-3 was verified RED against the un-stripped tree (PHRASES hit
+`"an earlier draft"` in typeclasses.md) before any strip, then
+flipped GREEN after Tasks 2–5b. End state: design_index_pin 4/4,
+`architect_sweeps.sh` exit 0, `cargo test --workspace` 646 passed /
+0 failed, acceptance grep CLEAN.
+
+## Per-task notes
+
+- Task 1: replaced `contracts_carry_no_decision_record_prose`
+  (:130-157) with the widened provable-superset matcher (verbatim
+  from plan; other 3 clauses + helpers untouched). RED verified
+  against un-stripped tree; other 3 clauses + build GREEN.
+- Task 2: typeclasses.md — 6 spans rewritten present-tense (:77-78,
+  :182-186, :197-200, :279-289 deleted wholesale, :291-300, :302-317);
+  Prelude-classes evolution history appended to the decision-record
+  journal. `io/print_str` pin contiguous at :297; docs_honesty_pin 5/5.
+- Task 3: str-abi.md — `(iter …)` parentheticals + deferred-operator
+  + `Num`/axis-7 rationale stripped (:14, :16, :18, :20, :22-23
+  soft-wrap collapsed, :74, :38-43, :45-47); journal appended.
+  `type-installed; codegen is reserved…` pin contiguous at :19.
+- Task 4: scope-boundaries.md — process-meta line plain-deleted
+  (:5-6), closure-pair-global + rpe.1-retirement rationale stripped
+  (:14-17, :36-38); journal appended. Diverge over-strip guard:
+  pin byte-untouched, effect_doc_honesty_pin 4/4 (pin line shifted
+  :9→:8 as the expected consequence of the authorized :5-6 two-line
+  collapse — content match unaffected).
+- Task 5: float-semantics.md:99-100 stale `(see "Str ABI" below …)`
+  → `(see design/contracts/str-abi.md …)`. eq_float_noinstance 1/1.
+- Task 5b: roundtrip-invariant.md:73 corpus-flip parenthetical
+  dropped; data-model.md:149/161 `// loop-recur iter 1:` → `// loop:`
+  / `// recur:`; :154 `pre-existing` left untouched (ordinary word);
+  journal appended. No lowercase iter-code provenance remains;
+  design_schema_drift 7/7, round_trip 2/2.
+- Task 6: architect_sweeps.sh DESIGN_GLOB narrowed to
+  `design/contracts` with substantive-reason inline comment + header
+  prose; ailang-architect.md `:77-84` bullet gains the scope sentence.
+  All five sweeps clean, exit 0.
+- Task 7: whole-tree gate — design_index_pin 4/4 (clause-3 RED→GREEN),
+  3 pins + 2 E2Es PASS, workspace 646/0, sweep exit 0, acceptance
+  grep CLEAN.
+
+## Concerns
+
+(none)
+
+## Known debt
+
+(none — the audit Resolution scope is fully covered: Resolution-1
+history→journal across the corrected 5-file set, Resolution-2 stale
+below, Resolution-3 sweep re-scope+lockstep, Resolution-4 faithful-
+superset clause-3, Resolution-5 exit state.)
+
+## Blocked detail
+
+(none — DONE)
+
+## Files touched
+
+- Test gate: `crates/ailang-core/tests/design_index_pin.rs`
+- Contract strips: `design/contracts/typeclasses.md`,
+  `design/contracts/str-abi.md`,
+  `design/contracts/scope-boundaries.md`,
+  `design/contracts/float-semantics.md`,
+  `design/contracts/roundtrip-invariant.md`,
+  `design/contracts/data-model.md`
+- Decision-record archive: `docs/journals/2026-05-19-design-decision-records.md`
+- Sweep re-scope + lockstep: `bench/architect_sweeps.sh`,
+  `skills/audit/agents/ailang-architect.md`
+
+## Stats
+
+bench/orchestrator-stats/2026-05-19-iter-design-md-rolesplit.tidy.json

docs/journals/INDEX.md

@@ -117,3 +117,4 @@
 - 2026-05-19 — iter design-md-rolesplit.1 (DONE 9/9, whole milestone): the 3020-line `docs/DESIGN.md` replaced by the `design/` ledger — `design/INDEX.md` (sole addressable spine, typed Contracts+Models tables, polymorphic links: prose file OR authoritative source `//!`), 14 `design/contracts/*.md` test-linked invariants + 3 source-link-only contracts (mangling/env-construction/qualified-xref, no prose file — code is SoT), 5 `design/models/*.md` onboarding whitepapers, and `docs/journals/2026-05-19-design-decision-records.md` (the relitigation-guard archive: every why/rejected/does-not-do/rollback/empirical `###` moved out at `###` granularity). Clean cut (`git rm docs/DESIGN.md`, no stub). RED-first `crates/ailang-core/tests/design_index_pin.rs` 4-clause anti-regrowth spine (DESIGN.md-gone / every-INDEX-link-resolves / every-contract-names-a-resolvable-ratifier / contracts-carry-no-decision-record-prose) demonstrably RED→GREEN. Build-atomic by task ordering (the only compile-time consumer, `design_schema_drift.rs` `include_str!`, retargeted to `design/contracts/data-model.md` BEFORE the deletion; the `## Data model`/`## Pipeline` slicer dropped — a simplification the split enables). 2 NoInstance diagnostics + their 2 lockstep E2Es retargeted to `design/contracts/{float-semantics,typeclasses}.md` (the contiguity-across-`\`-continuation hazard scrubbed). ~12 agent reading lists + 5 SKILL bodies + CLAUDE.md + skills/README.md + ~25 code/C/.ail/spec comment xrefs retargeted to the Appendix destinations; OQ7 dangling "Iter 13b" cite deleted (no forward target — a pointer would be fiction). honesty-rule.md rewritten so the rule names the new home (rationale→journals), resolving the recon-found internal contradiction; the two `docs_honesty_pin.rs:70,72` pinned phrases preserved verbatim+contiguous. Boss-verified independently: whole `cargo test --workspace` **646 passed / 0 failed**, `design_index_pin` 4/4, acceptance grep **CLEAN of live DESIGN.md refs** (residuals = only the spec-mandated clause-4 deletion-enforcer), honesty-rule repair carries no clause-3 marker. Spec grounding-check PASS ×2 (one re-dispatch after a corrected commitment-4 pin-status claim; one after the Boss-adjudicated relocation-appendix amendment resolving plan-recon's 7 open questions — ledger completed to 17 contract rows incl. the qualified-xref/str-abi/scope-boundaries additions the 12-list under-counted). 2 DONE_WITH_CONCERNS routed to the mandatory milestone-close `audit`: (a) `design/contracts/str-abi.md:23` `(iter str-concat, 2026-05-13)` API-provenance stamp trips advisory `architect_sweeps.sh` Sweep-1 — Boss-confirmed **byte-identical to DESIGN.md@deeffb1:2062-2065**, a faithfully-migrated PRE-EXISTING anchor (sweep regexes verbatim, only the path retargeted), NOT a split-introduced regression — RATIFY-or-tidy at audit; (b) the now stale-direction `(see "Str ABI" below)` intra-prose cross-ref in `float-semantics.md` (the Appendix is heading-level; no task prescribes intra-prose cross-ref rewrite) — audit-adjudication candidate. One plan defect recorded (Task 9 Step 4's verbatim acceptance grep used a `^\./` anchor not matching the system's `grep -rIn` output; substance independently re-verified CLEAN). → 2026-05-19-iter-design-md-rolesplit.1.md
 - 2026-05-19 — design-decision-records (migration): relitigation-guard archive — every why/rejected/does-not-do/rollback/empirical ### moved out of the former docs/DESIGN.md by the design-md-rolesplit milestone. Companion to spec 2026-05-19-design-md-rolesplit. → 2026-05-19-design-decision-records.md
 - 2026-05-19 — audit design-md-rolesplit (milestone close): DRIFT (one tidy iteration) + bench causally-exonerated (baseline pristine). Architect drift_found, relocation byte-faithful (MIXED Decisions / dual-link / source-link / rewritten honesty-rule all match the spec Appendix vs deeffb1; build-atomicity holds; design_index_pin 4/4; honesty-rule.md correct + pins retargeted; agent contracts coherent) — one [medium] spirit-finding: faithfully-migrated decision-record/history prose in design/contracts/{typeclasses,str-abi,scope-boundaries}.md DODGES the 6 literal clause-3 markers (case+wording variance) but IS the relitigation content the split's spirit sends to journals; plus [low] float-semantics.md stale-direction "see Str ABI below". Both routed items adjudicated strippable-doc-archaeology-to-TIDY-not-ratify (the str-abi.md:23 advisory Sweep-1 exit-1 correctly diagnoses real pre-existing history residue, byte-identical DESIGN.md@deeffb1:2062-2065, faithfully migrated — not split-introduced). Bencher: NO-ratify, causally-exonerated DECISIVE on byte-evidence — emitted IR AND final -O2 binaries byte-identical 176821c vs pre-milestone dd5b183 for all 6 check.py firings (sha256+cmp), all ~11 changed code/runtime files audited comment/docstring/diagnostic-string-only, zero IR-path change; the firings are tracked-P2 (*.bump_s staleness, *_at_rc.max_us -n5 tail jitter, *.gc_s Boehm-scan variance — NOT the M5 gc_rss trio); compile_check 24/24 + cross_lang 25/25 pristine corroborate; baseline untouched (identical to M2/M3/M5). Resolution: one tidy iter design-md-rolesplit.tidy — (1) move the history prose to the decision-record journal, (2) fix the stale "below", (3) re-scope architect_sweeps honesty sweeps to design/contracts only (models/ is the explicitly-narrative tier — scanning it for history-anchors is a post-split category error), (4) widen design_index_pin.rs clause-3 to SUBSUME Sweep-1's history-anchor regex over contracts/ (invariant: clause-3 GREEN ⟹ Sweep-1 clean in contracts/ — the hard gate enforces the spirit, closing the literal-marker dodge permanently). No fieldtest (zero authoring-surface change). Milestone closes after the tidy lands Boss-verified. → 2026-05-19-audit-design-md-rolesplit.md
+- 2026-05-19 — iter design-md-rolesplit.tidy (DONE 7/7): resolves the milestone-close audit DRIFT (2ba5e16). Gate-first TDD: widened design_index_pin.rs clause-3 to a hand-rolled FAITHFUL Sweep-1 superset — case-sensitive digit-anchored Sweep-1 line anchors (confirmed ZERO across all contracts) + Sweep-1's `^[^/]*` path-EXCLUDED date_anchor (so docs/specs/2026-.. citations are not flagged) + the audit-named decision-record PHRASES (case-insensitive, closing the capital-variance dodge); NO regex dep, the blanket case-insensitive iter-detector REJECTED as unworkable (it conflated the memory-model rule-names "Iter A/B" + ordinary "pre-existing/pre-set/pre-Boehm" with provenance). Sentence-level strip of the faithfully-migrated history/decision-record prose out of 5 contract files (typeclasses/str-abi/scope-boundaries — the audit's spot-check — PLUS roundtrip-invariant.md:73 + data-model.md:149,161, the 2 the exhaustive plan-time scan found the spot-check missed) into docs/journals/2026-05-19-design-decision-records.md, each removed sentence replaced by its present-tense contract equivalent; float-semantics.md stale `(see "Str ABI" below)` → `(see design/contracts/str-abi.md)`; architect_sweeps.sh honesty sweeps re-scoped design/contracts+design/models → design/contracts only (models/ is the explicitly-narrative tier; scanning it for history-anchors is a post-split category error) + skills/audit/agents/ailang-architect.md lockstep. Invariant established: clause-3 GREEN ⟹ Sweep-1 finds nothing in contracts/. The prior dispatch correctly BLOCKED on a real plan defect (iso_date lacked Sweep-1's path-exclusion → over-fired on legit spec-path citations); per the "two+ defects in one iteration ⇒ fix the upstream artifact, not a third patch" discipline the audit Resolution mechanism+scope were corrected in lockstep (f2cdd67) before re-dispatch. Three docs_honesty_pin pinned-byte runs survived contiguous (str-abi.md:19, typeclasses.md:297, scope-boundaries.md:8 — shifted from :9 by the authorized :5-6 collapse, content byte-untouched). Boss-verified independently: cargo test --workspace 646/0, design_index_pin 4/4 (clause-3 RED→GREEN), architect_sweeps.sh exit 0 "All five sweeps clean" (acceptance criterion 9 met), acceptance grep CLEAN, 3 pins each exactly 1 contiguous match. Zero spec/quality re-loops. This is the FINAL design-md-rolesplit iteration — the milestone (DESIGN.md → design/ ledger role-split) is now functionally complete, audited, drift-resolved, and the in-code hard gate enforces the honesty spirit. → 2026-05-19-iter-design-md-rolesplit.tidy.md