AILang/docs/journals/2026-05-19-audit-design-ledger-formal-links.md

audit — milestone close: formal cross-links in the design/ ledger

Date: 2026-05-19 Scope: 2ee4087..8ad91e7 (5 commits — 3 spec commits incl. 2 corpus-grounded amendments, 1 plan, 1 iter) Status: CLEAN (no drift; bench pristine; no tidy)

Architect (clean — drift_items: none)

Every claimed commitment and invariant verified positively:

• clause-5 (design_body_links_are_durable_and_resolve) implements all four predicates (resolves-from-containing-file; durable-tier; no-fragment; fence-skip via toggle-strip_fences); RED-first synthetic-vector mechanism honest; scope is design/contracts/ + design/models/, excludes design/INDEX.md per commitment 4.
• The 7 prose conversions (8 link tokens) match the spec's Acceptance-3 closed enumeration verbatim; file-relative arithmetic correct (siblings → bare filename; crates/ reach via ../../; cross-design/-subtree via ../models/). Zero docs/ link targets; zero #fragment.
• Disposition (b) on pipeline.md:61 + authoring-surface.md:180 correctly applied: cross-tier pointer removed, surrounding behavioural ail merge-prose prose preserved (the authoring-surface case is slightly rephrased to keep the meaning without the pointer).
• honesty-rule.md positive-half paragraph pin-safe: both docs_honesty_pin.rs-pinned phrases byte-identical (L14 and now L25, shifted from L19 by the +6 lines); the design_index_pin.rs clause-5 mention is a nominal identifier in the existing "Ratified by:" footer style (no [](...) form, no navigational pointer) — consistent with the spec's §Scope navigational-vs-nominal definition. No clause-3 PHRASE tripwire, no Sweep-1 anchor.
• Commitment 4 honored: design/INDEX.md byte-unchanged (zero-line diff vs HEAD); design_index_pin.rs clauses 1–4 source byte-unchanged (the only - lines are the two-line //! header rewrite delivered by Task 1 Step 5 itself).
• Commitment 7 honored: docs/journals/2026-05-19-design-decision-records.md byte-unchanged.
• Composition invariant holds on the post-milestone tree: clause-3 GREEN ∧ clause-5 GREEN simultaneously for every design/contracts/*.md (independently verified by running both in the same suite).
• Out-of-scope set untouched: data-model.md 38/66/79/206/226 verified inside ```jsonc fences (30–87, 203–228); embedding-abi.md:51 "frozen value layout below specifies" untouched; intra-file above/below directional prose untouched (sample-checked float-semantics.md:70 "The NaN-spelling caveat above" still intra-file).
• No commitment-2 violation: no agent/SKILL reading list adds a docs/PROSE_ROUNDTRIP.md design/-link target. The sole remaining mention is design/INDEX.md:43 — prose mention only (no [](...) form), outside clause-5's scope and not a navigational link.
• bench/architect_sweeps.sh exit 0 ("All five sweeps clean"); Sweep-1 shares no scope or regex with clause-5 (orthogonality asserted in spec confirmed empirically).

Two minor non-drift observations recorded without raising drift:

• design/INDEX.md:43's prose mention of docs/PROSE_ROUNDTRIP.md is now the sole remaining docs/ reference in design/. The spec consciously scopes clause-5 to body files only; this is a nominal mention in the spine, not a formal link — commitment-2 governs formal links. Recorded for future-tightening awareness, not as drift.
• The roadmap entry stands [~] IN FLIGHT; flipping to [x] CLOSED is the standard post-audit ratification step, executed in this same done-state commit. Not drift.

Bench (check.py exit 0; compile_check exit 0; cross_lang exit 0)

check.py        63 metrics: 0 regressed (within tolerance), 0 improved beyond tolerance, 63 stable; exit 0
compile_check   24 metrics: 0 regressed, 0 improved beyond tolerance, 24 stable; exit 0
cross_lang      25 metrics: 0 regressed, 0 improved beyond tolerance, 25 stable; exit 0
aggregate       0 / 0 / 0

Cleanest possible bench outcome. Two metric movements were flagged in the per-metric output (1 regressed and 1 improved in the check.py summary line) but both are within their tolerance bands — the ok status the script prints means the threshold check passed. No metric exceeds tolerance; baseline pristine; no --update-baseline and no paired JOURNAL ratify entry warranted.

This matches the spec's expectation precisely: the milestone makes zero codegen / runtime / IR-emitting changes (every code edit is either a new test, a //! doc comment, or design/ prose). The firings inside the bands are the standing P2 environmental jitter already familiar from the M2/M3/M5/rolesplit closes.

Resolution (orchestrator)

• Architect: carry-on. Zero drift items.
• Bench: carry-on. All three scripts exit 0; baseline pristine; no ratify warranted.
• No tidy iteration. No fix path.
• No fieldtest. The milestone touches no authoring surface (no .ail program, no language construct, no compiler/checker/codegen path) — spec's reasoned exclusion stands.
• Milestone closes immediately. Done-state procedure (roadmap [~] → [x], WhatsNew append, notify) runs in this same cohesive commit.

This is the cleanest milestone close pattern in the project's recent history: zero spec defects surviving to audit (the two were caught and amended at planner-recon and plan-corpus-fetch time, before any byte moved), zero drift, zero bench movement, zero re-loop. The two amendment cycles (clause-6 + cross-ref definition; clause-5 fence-skip + closed convert-set enumeration) were the discipline working — recon and corpus-fetching surfaced gaps the brainstorm-sample missed, the spec was grounded properly before implementation, and the implementation then ran clean 5/5 with one non-blocking concern (a planner self-review-item-8 arithmetic miss on the //! header rewrite line count — substantive assertion unaffected, recorded as lesson).