# audit — remove-mut-var-assign milestone close

**Date:** 2026-05-18
**Scope:** `48e7774..07f0802` (prev close → the single terminal iter)
**Outcome:** CLEAN after one inline `.tidy` fix; bench causally
exonerated; two P2 roadmap todos filed/strengthened. Fieldtest
remains (surface-touching milestone).

## Step 1 — Architect drift review

**`[high]` — `crates/ailang-core/specs/form_a.md` (EBNF 286-288,
prose 308-328, dangling `like mut` at 332).** The live in-tree
Form-A grammar reference still documented the full `mut`/`var`/
`assign` construct. The spec (Components #2, Architecture table
row 2) explicitly named "form_a.md" for deletion; the
schema-vs-doc honesty invariant the milestone advertises was
broken. **Root cause = the recon-undercount class (4th
recurrence), and specifically a Boss error:** at plan time the
Boss grepped `docs/form_a.md` (dir-scoped), got "No such file",
concluded "form_a.md does not exist", and propagated that
unverified non-existence claim into the recon brief. The file
lives at `crates/ailang-core/specs/form_a.md` and is actively
maintained (form-a.tidy edited it) — not frozen historical
record. A compile-driven sweep cannot catch this: a stale doc
never produces `E0004`/`E0061`.

**Resolution — inline Boss `.tidy`, not planner+implement.**
Rationale (CLAUDE.md "When NOT to delegate": context already
loaded, an agent would redo all milestone reading for a ~40-line
single-file doc deletion whose design was already settled by the
approved spec): deleted the three EBNF productions (keeping
`reuse-as`→`loop`→`recur`), the three mut/var/assign prose
bullets, and reworded the surviving `loop` bullet so its
"right-folded into `Term::Seq`" no longer back-references the
deleted `mut`. Full review-and-commit discipline kept (no
discipline shed for the carve-out): verified tree-wide that the
only remaining `Term::Mut`/`Term::Assign`/`MutVar` strings in
`crates/` + `docs/DESIGN.md` + `docs/roadmap.md` are the roadmap
entry *describing the milestone itself* (not residue), and
form_a.md's two remaining `mut`/`var` substrings are the unrelated
`[unbound-var]` / `reuse-as-source-not-bare-var` diagnostic names.
Grammar + notes read coherently after the cut.

**`[medium]` — process-drift, recon-undercount 4th recurrence.**
The existing loop-recur.tidy P2 (`ailang-plan-recon`
cross-crate-caller-undercount) is demonstrably insufficient: the
class now recurs through a *new* site type each time (test bodies,
drift pins, carve-out files, and now a spec-named non-compiled
doc + an unverified existence claim feeding the recon brief).
Escalated that P2 in place — broadened from "cross-crate caller"
to a structural recon-contract defect with two named gaps
(non-compile-checked spec-named sites; unverified "X does not
exist" claims inheriting into a recon brief), and a concrete
agent-definition fix (compile-driven enumeration as authoritative
code-site set **plus** an `ls`-verified spec-named-path existence
table). Not a code defect; an agent-discipline fix, parked P2.

## Step 2 — Bench-regression

`bench/check.py` **exit 1** (3 firings); `compile_check.py`
**exit 0** (24/24 stable — no check-time tax, consistent with a
pure removal); `cross_lang.py` **exit 0** (25/25 stable, incl. the
independent `bench_list_sum.ail_bump_s` +2.95% ok).

check.py firings: `throughput.bench_list_sum.bump_s` +12.51%;
`latency.explicit_at_rc.max_us` +108.38%;
`latency.implicit_at_rc.max_us` +66.46%. All medians/p99 stable.

**Bencher localisation — causal exoneration (decisive).** Built
`ail` at HEAD and at pre-milestone `48e7774`; the three
firing-relevant bench binaries (`list_sum_bump`, `lat_expl_rc`,
`lat_impl_rc`) are **`cmp`-byte-identical** across the milestone.
The −2520-line removal diff does not alter one byte of these
fixtures' machine code (none contain `mut`); no causal mechanism
exists. By elimination every firing is non-code-caused.

Per-firing verdict: `bump_s` = the tracked P2 environmental
staleness (stable ~+11–14% across 4 runs, byte-identical binary,
cross_lang corroborates); both `*.max_us` = single-sample `-n 5`
jitter (`explicit_at_rc.max_us` collapsed +108%→**-2.30% ok** by
an identical-code rerun3; `implicit_at_rc.max_us` swings
477→1172→843→756 on the identical binary while its median holds
+3.1…3.9%).

**Resolution: PRISTINE met on the merits. NO baseline ratify.**
The Iron Law forbids ratifying noise into the baseline and the
spec explicitly forecloses opportunistic ratification here; the
non-pristine exit code is bench-harness noise, not a code defect,
and does not block close. Filed a **new, distinct P2** (separate
from the `*.bump_s` staleness P2): `check.py` RC-latency
`*.max_us` at `-n 5` is a structural false-positive — 3-for-3 on
consecutive no-runtime-change milestones — recommending drop
`max_us` from gating / raise `-n` / cpuset-pin (mitigation choice
left to a future iteration).

## Step 3/4 — Classification & resolution

| Item | Class | Outcome |
|------|-------|---------|
| form_a.md construct doc | fix | inline Boss `.tidy` (this commit) |
| recon-undercount 4th recurrence | process-drift | P2 escalated in place (roadmap) |
| `bump_s` +12.51% | carry-on | tracked P2 (no ratify) |
| `*.max_us` ×2 | carry-on | new P2 filed (no ratify) |

Milestone audit **CLEAN** post-tidy. Next pipeline step:
`fieldtest` (the removal is a user-visible Form-A surface change —
`mut`/`var`/`assign` no longer lex; an LLM author must now reach
for `let`/`if`/`loop`/`recur`).
