iter loop-recur.tidy GREEN: reject lambda-captures-loop-binder at check + milestone-close audit resolution

GREEN side of the RED audit-trail commit 39380d3. The loop/recur
milestone-close audit found a [high] correctness defect — a lambda
capturing a loop binder passed `ail check` then panicked
unreachable!() at codegen (crates/ailang-codegen/src/lambda.rs:102)
on type-correct input. Fixed symmetrically to mut.4-tidy: new
CheckError::LoopBinderCapturedByLambda (code
loop-binder-captured-by-lambda, bracket-free F2 Display), the
Term::Lam escape guard gained a parallel loop_stack pass. Minimal
mechanism: loop_stack element Vec<Type> -> Vec<(String,Type)> so
the already-threaded per-loop frame carries binder names; recur
still reads .1 by position (Boss-call-2 positional invariant
preserved verbatim — the name is a second field for the escape
guard only, a consumer iter-2 did not anticipate). Codegen
byte-unchanged (typecheck-only fix). carve_out 17->18 + ct1-F2 +
DESIGN.md note lockstep.

Folded in (Boss-side, audit resolution): the two [medium]
doc-honesty edits the audit surfaced (mut_var_allocas rustdoc now
states its mut-var+loop-binder dual use; Term::Loop doc-comment
now describes the real shipped state, not iter-1's stale
"per-binder phi" forward-look) + a [low] P2 roadmap todo
(plan-recon undercount countermeasure, pairs with planner Step-5
items 7+8). Bench gate: all 3 scripts exit 0, 25 metrics 0
regressed — pristine, carry-on (no baseline/ratify).

cargo test --workspace 619 -> 622 / 0 red (Boss-reran
independently, hash_pin 11/0). The loop/recur milestone is
audit-clean; fieldtest is the only remaining step before close.

docs/roadmap.md

@@ -36,12 +36,16 @@ work progresses.
 ## P0 — In flight
 
 - [~] **\[milestone\]** Standalone `loop` / `recur` — strictly-additive
-  iteration surface lowering to the existing `tail-app` back-edge, with
-  one closed rule (`recur` valid only in tail position of its enclosing
-  `loop`). De-bundled re-attempt of the reverted Iteration-discipline
-  it.1 core only: no totality claim, no guardedness pass, no `Diverge`,
-  `tail-app` byte-unchanged. Spec written + grounding-checked + user-
-  approved 2026-05-17 (97c1ed1).
+  iteration surface, `recur` valid only in tail position. All three
+  iterations + a tidy shipped: iter 1 `a179ec3` (additive AST nodes),
+  iter 2 `1566ce0` (typecheck), iter 3 `edd2558` (codegen + run-to-value
+  E2E), tidy (lambda-captures-loop-binder rejected at check, symmetric
+  to mut.4-tidy). Milestone-close `audit` clean: architect drift
+  resolved (the `[high]` codegen crash fixed in the tidy + two
+  `[medium]` doc-honesty edits folded in), bench pristine (25 metrics,
+  0 regressed — strictly-additive surface, no hot-path touched).
+  **Remaining: `fieldtest`** (loop/recur is user-visible Form-A
+  surface) — the only step before full close.
   - context: `docs/specs/2026-05-17-loop-recur.md`; principles entry
     `docs/specs/2026-05-17-llm-surface-discipline.md` §6.2; revert
     rationale `docs/specs/2026-05-16-iteration-discipline-revert.md`.
@@ -254,6 +258,23 @@ work progresses.
   intra-crate links). All predate the design-md-consolidation
   milestone; treat as a one-off sweep.
   - context: JOURNAL 2026-05-10 ("Audit close: design-md-consolidation").
+- [ ] **\[todo\]** `ailang-plan-recon` cross-crate-caller-undercount
+  countermeasure — the recon agent hand-lists exhaustive-`match`/caller
+  sites and has under-counted the true blast radius **three times in
+  one milestone** (loop-recur.1 walker arms, loop-recur.2 cross-module
+  `synth` callers, loop-recur.tidy implicit). Each was caught only by
+  the implement orchestrator's compile-driven sweep, not by the plan.
+  The pattern is structural: a hand-enumerated site list for a
+  workspace-wide signature/exhaustive-match change is inherently
+  lossy. Tighten `skills/planner/agents/ailang-plan-recon.md` so that
+  for any signature-change / additive-enum-variant scope the recon
+  REPORTS the compile-driven enumeration command as the authoritative
+  site set (and frames its own hand-list as advisory), rather than
+  presenting the hand-list as complete. No language change; an
+  agent-definition discipline fix.
+  - context: loop/recur milestone-close audit (architect `[low]`,
+    2026-05-18); pairs with the planner Step-5 items 7+8 added the
+    same milestone (those scrub the *plan*; this scrubs the *recon*).
 - [ ] **\[todo\]** `design_schema_drift.rs` fidelity widening —
   current test checks anchor *presence* anywhere in DESIGN.md;
   the audit found that `[high]` schema gaps in §"Data model"