Brummel
c8b765614d
Design spec for #55, superseding #54. Deletes ParamMode::Implicit in a single cutover -> binary {Own, Borrow}; no defaulted ownership mode survives on any fn-type slot, authored or compiler-synthesised. The grounding pass corrected the central architecture claim. Both #55 and the first draft assumed a new return-provenance check was needed to reject an own-return aliasing a borrowed binder, "silently accepted today". Running the candidate fixtures through the live `ail check` falsified that: consume-while-borrowed already rejects all three provenance paths -- direct passthrough, let-indirection, and borrow escaping into a returned constructor (regime A). Own-return soundness and regime A are already-green properties. The cutover therefore adds exactly one new check (borrow-return rejection) plus one signature-level reject (borrow-over-value), not two new provenance analyses. Scope decisions ratified: keyword stays verbal (own/borrow), ParamMode keeps its name; totality is strict including value-type slots (every slot moded, (own value) trivial, (borrow value) an error, bare slot a parse error) so an LLM author needs no heap/value knowledge. The leak fix (spec 0061 symptom) falls out of Implicit->Own at the synthesis sites: the old typechecker made Implicit and Own indistinguishable (mode_eq), so setting Own changes no typecheck outcome -- it only flips the codegen dec gate from skip to emit. Out of scope: re-enabling borrow-returns (needs the escape/liveness axis), multi-return, mode polymorphism. grounding-check: PASS (7 assumptions ratified against named green tests; all fenced ail blocks validated against the live tool). refs #55