iter mut.4-tidy + audit close — mut-local milestone closed

Tidy iter addressing the audit-mut-local drift. Plus paired baseline
update on bench/baseline_compile.json (audit-skill discipline).

Architect [high] items closed:

1. CheckError::MutVarCapturedByLambda rejects lambdas whose body
   free vars include a mut-var of the enclosing mut_scope_stack.
   Uses the existing ailang_core::desugar::free_vars_in_term walker
   (which honours Term::Match pattern bindings). The scan runs only
   when mut_scope_stack is non-empty.

2. crates/ailang-codegen/src/lambda.rs: the capture-not-in-locals
   path that previously raised CodegenError::Internal blaming the
   typechecker now uses unreachable!. The companion comment block
   was rewritten to state the current reality.

Architect [medium] items closed (stale mut.1-stub history comments):

3. docs/DESIGN.md §'Term (expression)' mut/assign block: the
   trailing paragraph describing the iter mut.1 stub state was
   replaced with one describing the current mut.3-end-state. The
   inline jsonc comment on {'t': 'assign'} was updated to drop the
   'deferred to mut.2/mut.3' language.

4. crates/ailang-codegen/src/lib.rs: the stale comment block above
   the real Term::Mut arm describing the mut.1 stub was removed
   entirely.

Other:

- Short-circuit on empty mut_scope_stack in synth's Term::Var arm:
  the iter mut.2 prepend now skips the iter-and-find walk when
  the stack is empty, eliminating any per-Var-resolution overhead
  for the common case (programs with no mut blocks). The
  short-circuit did NOT close the check_ms regression — see ratify
  below.

- Spec docs/specs/2026-05-15-mut-local.md §'Out of scope' amended
  with the lambda-capture rejection bullet.

- Negative fixture examples/test_mut_var_captured_by_lambda.ail.json
  + driver test extension in crates/ailang-check/tests/
  mut_typecheck_pin.rs (6th test) +
  crates/ailang-core/tests/carve_out_inventory.rs EXPECTED bumped
  12 → 13.

Bench-regression ratify:

bench/compile_check.py check_ms showed a uniform ~30-50% relative
shift across the entire 11-fixture suite (~0.5ms absolute on a
1.4-1.5ms baseline). The uniformity across fixtures of very
different Var counts argues for a fixed-cost-per-invocation tax,
not a Var-proportional hot path. The Term::Var short-circuit
falsified the hot-path hypothesis. The plausible remaining causes
(synth-parameter-passing through ~19 recursive sites, and binary-
size startup tax from mut-* adding ~1400 LOC to typecheck/codegen)
are both feature-cost, not pathological. Ratified by paired
journal entry; bench/baseline_compile.json updated to the post-
mut-local numbers via 'bench/compile_check.py --update-baseline'.

bench/check.py continues to show the established tail-latency-noise
envelope from audit-pd (2026-05-14) — no separate ratify needed.

bench/cross_lang.py clean.

Tests: 594 → 598 green (4 new lib.rs mod tests + 1 driver test +
1 fixture-corpus uptake).

Journal: docs/journals/2026-05-15-iter-mut.4-tidy.md.

mut-local milestone end-to-end status:
  - mut.1 (7b92719): AST + Form A surface.
  - mut.2 (b24718a): typecheck.
  - mut.3 (03fb633): codegen + e2e.
  - mut.4-tidy (this commit): audit-drift close + bench ratify.
mut-local milestone CLOSED.

Refs: docs/specs/2026-05-15-mut-local.md,
docs/plans/2026-05-15-iter-mut.4-tidy.md.

crates/ailang-codegen/src/lambda.rs

@@ -84,6 +84,13 @@ impl<'a> Emitter<'a> {
         // would mean the typechecker let through an unbound var, so a
         // hard internal error is right.
         // Tuple: (name, outer_ssa, llvm_type, ail_type, optional_fn_sig).
+        //
+        // Iter mut.4-tidy: post-Task-2 the typechecker rejects
+        // lambda-captures-of-mut-var via
+        // `CheckError::MutVarCapturedByLambda`. Reaching the `None`
+        // arm below means typecheck was skipped or a bug let the AST
+        // through — both are bugs in upstream layers, so panic rather
+        // than return an Internal error.
         let mut cap_meta: Vec<(String, String, String, Type, Option<FnSig>)> = Vec::new();
         for c in &captures {
             let (_, outer_ssa, lty, ail_ty) = self
@@ -91,11 +98,11 @@ impl<'a> Emitter<'a> {
                 .iter()
                 .rev()
                 .find(|(n, _, _, _)| n == c)
-                .ok_or_else(|| {
-                    CodegenError::Internal(format!(
-                        "lambda capture `{c}` not in scope (typechecker bug?)"
-                    ))
-                })?
+                .unwrap_or_else(|| {
+                    unreachable!(
+                        "lambda capture `{c}` not in locals — typecheck should have rejected via MutVarCapturedByLambda",
+                    )
+                })
                 .clone();
             let sig = self.ssa_fn_sigs.get(&outer_ssa).cloned();
             cap_meta.push((c.clone(), outer_ssa, lty, ail_ty, sig));
@@ -463,10 +470,11 @@ impl<'a> Emitter<'a> {
             // Iter mut.1: a mut-var name binds inside the block. Var
             // inits before the binding see the outer scope; later
             // inits and the body see the var as bound. Mut-vars
-            // cannot be captured by an inner lambda in mut.1 (the
-            // typecheck pass at mut.2 will enforce this); for the
-            // capture-collection scan the var bindings are tracked
-            // identically to let-bound names.
+            // cannot be captured by an inner lambda — the typecheck
+            // pass rejects this via `CheckError::MutVarCapturedByLambda`
+            // (added in mut.4-tidy). For the capture-collection scan
+            // the var bindings are tracked identically to let-bound
+            // names.
             Term::Mut { vars, body } => {
                 let mut newly_bound: Vec<String> = Vec::new();
                 for v in vars {