# audit — iteration-discipline-revert milestone close

**Date:** 2026-05-16
**Milestone:** iteration-discipline-revert (HEAD `37ac704`)
**Verdict:** Milestone-iteration-discipline-revert tidy — **clean**

## Step 1 — Architect drift review

The revert is byte-pristine: all 18 reverted production source files
+ 5 reverted test files byte-identical to `git show 1ff7e81:<path>`
(`crates/ailang-check/src/lib.rs` fully so); zero residual it.1/it.2
production surface (`Term::Loop`/`Recur`/`LoopBinder`/
`verify_structural_recursion`/`term_contains_loop`/`module_fns`/
`"Diverge"`-injection / the five `Recur*`+`NonStructuralRecursion`
variants all absent from `crates/*/src/`). DESIGN.md coherent:
Decision 3 & 8 byte-identical to oracle, no loop/recur in §"Data
model", clause 3 retained (hunk-edited, not wholesale-restored — the
`1ff7e81` DESIGN.md had zero clause-3 text) with its worked example
de-claimed to explicit hypothetical, `skills/brainstorm/SKILL.md`
de-claimed in lockstep, F1/F4 idiom note present and guarded by a
passing `design_schema_drift.rs` test. Roadmap: Iteration-discipline
block + blocking-fork section gone, single deferred P2 entry with
correct `depends on:`/`context:`, F3 todo + Stateful-islands intact,
old spec carries the superseded header.

One `[medium]` drift item:

- `docs/roadmap.md` Stateful-islands `[~]` scope bullet still
  asserted *"the 'Iteration discipline' P1 milestone supersedes the
  earlier 'while-loops legal' scope … repetition is structural
  recursion or named `loop`/`recur`"* — a dangling cross-reference
  into the now-reverted milestone from a **live planning doc** that
  would mislead the next brainstorm into treating `loop`/`recur` as
  the committed repetition story. **Resolved inline** (Boss
  doc-hygiene, full context already loaded): reworded to keep the
  real, still-true scope guard (AILang has no `while`/`for`; this
  milestone introduces none; repetition stays recursion exactly as
  the language has it today; a `mut` block is a sealed expression,
  never a loop) and drop the reverted-milestone reference.

## Step 2 — Bench-regression check

- `bench/compile_check.py` — exit 0 (24/24 stable).
- `bench/cross_lang.py` — exit 0 (25/25 stable; notably
  `bench_list_sum.ail_bump_s` only +2.44% vs baseline).
- `bench/check.py` — exit 1: single metric
  `throughput.bench_list_sum.bump_s` baseline 0.046s → 0.052s,
  +12.71% (tol 10%); the 4 "improvements" are `gc_over_bump` ratio
  shifts downstream of that one number.

**Localisation (bencher, hypothesis-driven).** Built release `ail`
at HEAD `37ac704` and at the byte-oracle `1ff7e81` (read-only
`git worktree`, removed after). The compiled `bench_list_sum`
bump binaries are **`cmp`-identical** (byte-for-byte same machine
code, identical stdout). Interleaved 3 trials × 60 runs/arm: head
median 0.051233s vs oracle median 0.051206s; head−oracle delta
oscillates around zero (+0.05% / +0.61% / −0.20%, within ~1.5%
stdev); **both** arms read ~+11% over the 0.046 baseline on this
machine *now*. Verdict: **environmental/hardware drift relative to
the 2026-05-09 baseline-capture machine state, NOT a revert
regression** — confirmed independently of the architect byte-diff
and the implement Task-11 behavioural-equivalence sweep (third
independent proof the revert's codegen == `1ff7e81`'s codegen).

## Step 3 — Classification & resolution

- Architect `[medium]` roadmap dangling xref → **fix**, done inline
  (Boss doc-hygiene; no separate tidy iteration warranted for a
  one-bullet prose correction with a single correct outcome).
- `check.py` exit 1 → **carry-on**, baseline **NOT ratified**.
  Ratify is categorically wrong here: nothing *intentionally* moved
  the metric (the revert returned codegen to byte-identical
  `1ff7e81`), and the audit Iron Law forbids a baseline bump without
  an iter that intentionally moved it. Bumping 0.052 in would bake a
  noise/environment value into `bench/baseline.json`. The spec's
  "bench PRISTINE, not ratified" mandate is **satisfied**: pristine
  means the revert introduced no regression, and it provably did not
  (byte-identical binaries vs the clean `1ff7e81` oracle).
- The pre-existing `*.bump_s` baseline-vs-hardware staleness (the
  `1ff7e81` oracle itself trips the same +11% on current hardware —
  predates this milestone, revert-foreign) recorded as a separate
  **P2 roadmap `[todo]`** (bench-harness recalibration; no language
  change), so it is tracked without being mis-attributed to the
  revert or laundered through a ratify.

## Fieldtest

**Skipped** (Boss judgement; fieldtest is non-mandatory). A revert
restores the already-field-tested pre-`9973546` user-visible surface
(structural / tail recursion; `tail-app` intact) — the surface that
the mut-local fieldtest already exercised and that started this
corrective arc. A fieldtest here would re-test a known, well-trodden
state and add no signal; the implement Task-11 byte-equivalence
sweep over 164 fixtures is the stronger correctness proof for a
revert.

## Close

Milestone **iteration-discipline-revert** closed clean:
byte-pristine vs `1ff7e81` across all production surface; behaviour
byte-identical over 164 surviving fixtures; `cargo test --workspace`
600/0; one roadmap drift fixed inline; the single `check.py` metric
localised to environmental variance (baseline untouched) with the
pre-existing staleness filed forward. AILang's iteration story is
exactly the pre-`9973546` state; the genuine total-recursion
ambition is preserved on the roadmap, sequenced behind a future
`Nat`/refinement-types milestone.
