Architect drift review at raw-buf milestone close (after 55d76ae closed
#43) surfaced three items; this commit clears them. All three lockstep-
invariant pairs were confirmed intact and the effective-name keying was
confirmed consistent across the desugar→lift boundary (lift_letrecs reads
the desugared tree's effective names too).
1. [high] Honesty fix. `fresh_binder`'s doc-comment (and 55d76ae's body)
claimed "authored names cannot contain `$` — the lexer reserves it".
False: the lexer (ailang-surface) reserves only `.`, not `$`. The
`$`-for-synthetic convention is not enforced. So collision-freedom
rests solely on the `used` + in-scope-`scope` probe, which does not
see an authored `<base>$<n>` that is out of scope at mint time but
later binds under the same `(def, name)` key — the very collision
class this fix closes. Latent (no fixture uses a `$` binder), but the
stated rationale was wrong. Doc-comment now describes the probe
honestly and names the gap + its two possible closures (enforce the
reservation, or seed `used` with every authored binder name in the
def). The enforce-or-retract decision is the next-direction follow-up.
2. [medium] design/models/0003-pipeline.md — "desugar currently only
flattens nested constructor patterns" no longer matches the code
(it now also alpha-renames shadowing binders). Corrected to current
state (honesty-rule).
3. [low] design/contracts/0008-memory-model.md — the three drop gates
all key on `(def_name, binder_name)` consume_count, silently relying
on per-fn binder-name injectivity, which the ledger never stated.
Added that invariant as an explicit precondition of the gates, with
the desugar guarantee and its ratifying tests.
No code-logic change; doc-comment + ledger only.
All 176 files in the four accumulating directories now use a
zero-padded 4-digit counter prefix that reflects creation order
(`NNNN-slug.md`). The counter is assigned per directory in strict
git-log creation order; ties broken alphabetically by original name.
The old `YYYY-MM-DD-` prefix on docs/specs/ and docs/plans/ files is
dropped — the date is recoverable from git log and the counter
carries the ordering.
A file's counter is stable for the life of the file: never reassigned,
never reused, never compacted. Deleted files retire their counter;
subsequent files do not fill the gap. This is the property that lets
cross-references stay literal — refs use the full filename including
the counter (`design/contracts/0007-honesty-rule.md`) so they grep
cleanly and resolve directly without a glob step.
313 cross-references updated across .md/.rs/.toml/.c/.json files
(test pins, include_str! paths, design-INDEX entries, baseline notes,
runtime C comments, inter-contract markdown links incl. bare basename
and `../models/foo.md` forms).
CLAUDE.md gets a new "File-naming convention" section spelling out
the rule and rationale. skills/brainstorm/SKILL.md and
skills/planner/SKILL.md updated so new spec/plan creation produces
counter-prefixed names from the start.
The full test suite (cargo test --workspace) passes.
Brummel