fieldtest: remove-mut-var-assign — 4 examples, all working; milestone CLOSED

Post-audit downstream-LLM-author field test of the post-removal
Form-A surface. 4 fresh real-world programs written from DESIGN.md +
form_a.md + public examples only (no compiler source): running
sum-of-squares accumulator (loop/recur → 385), grade cascade
(let-threaded if → 4/2/0), Horner polynomial straight-line build-up
(let-shadow chain → 73), multi-state bracket scanner threading
(rest,depth,ok) by tail recursion → true/false. 0 bugs, 0 friction,
0 spec_gap, 4 working — every task clean and correct on the first
try with only let/if/loop/recur; all parse|render|parse
byte-identical; zero mut/var/assign tokens produced (a doc-faithful
author did not reach for the removed construct).

The closest-to-friction case (multi-state machine restates the full
state tuple per tail-call) is correctly classified working, not a
spec_gap: that explicit-dataflow cost is the local-reasoning pillar
working as designed; mut's implicit cross-iteration persistence is
exactly the failure class the removal eliminates. mut-keyword
rejection is fail-closed with a diagnostic that enumerates the
surviving forms (no tombstone, no-nostalgia, as spec'd).

Removal thesis empirically CONFIRMED — mut was redundant with
let/if/loop/recur in 100% of the fresh tasks. The
remove-mut-var-assign milestone is fully ratified and CLOSED:
spec+plan+iter, audit clean (architect [high] form_a.md fixed in
.tidy, bench causally exonerated), fieldtest clean. Roadmap P0
flipped [~]→[x]; WhatsNew user-facing entry appended.

docs/WhatsNew.md

@@ -198,3 +198,11 @@ The milestone is closed and fully verified — built across three steps plus a f
 The readable prose rendering of a loop no longer misleads. Until now, a loop's carried values were printed as plain assignment lines inside the loop body — which reads exactly like "reset these to their starting values on every pass", the opposite of what a loop actually does. The starting values now sit in parentheses on the loop keyword itself, the way function parameters do, and the body block contains only the body. This also makes the loop header line up one-to-one with the re-entry form that supplies the next round's values, so the relationship between the two is visible at a glance instead of obscured.
 
 Nothing about how loops are written, type-checked, compiled, or run changed — this is purely the human-reading projection telling the truth about the code it shows. You raised this directly; it is a one-change milestone, drift-reviewed clean and benchmarked clean (the one flagged benchmark metric is the same pre-existing machine-drift item already on the list, not caused by this).
+
+## 2026-05-18 — The mutable-local construct has been removed
+
+AILang no longer has the block of mutable local variables (`mut`/`var`/`assign`). Everything that used it is now written with ordinary value bindings and loops — plain bindings and `if` for straight-line and conditional code, the loop construct for iteration. A program that still uses the old keyword is rejected at the first check with a clear error that lists the forms to use instead; there is no lingering half-support.
+
+The removal was justified by examining every existing use: in all of them the mutable block was doing nothing a plain binding or a loop accumulator does not already do. It was then field-tested by writing four fresh real-world programs entirely from the documentation — a running sum of squares, a grade-classification cascade, a polynomial evaluation, and a multi-state bracket-balance scanner. All four worked correctly on the first try with no mutable locals. The one thing the old construct did differently — letting a value silently carry from one loop pass to the next without being restated — is exactly the class of hard-to-follow state bug the language is designed to make impossible, so removing it makes programs easier to reason about, not harder.
+
+The milestone is closed and fully verified — built in one atomic change, drift-reviewed (with one documentation-only follow-up fix), benchmarked clean (the one flagged metric is the same pre-existing machine-drift item already on the list, proven unrelated here by byte-identical binaries before and after), and field-tested. The next milestone is a fresh decision — a documentation-honesty sweep so the specification shows only the language as it actually is, with no wishful "we would like" and no "this went wrong" — and that is the natural place to pick up when you are back.