spec: remove mut/var/assign — atomic cut (Approach A), grounding-check PASS

Removal milestone: Term::Mut + Term::Assign + the MutVar surface decl,
one indivisible feature. loop/recur (shipped, closed) + let/if cover
every shipped use; the construct fails the feature-acceptance criterion
applied inverted (clause 2 redundant, clause 3 IS the iterated-mutable-
state bug class). Approach A: no deprecation window, JSON tags fail
closed as generic unknown-variant, codegen alloca machinery kept (loop
reuses it) renamed binder_allocas, shared Term::Lam escape guard keeps
its loop half. Decoupled from Stateful-islands. Grounding-check PASS —
all 7 load-bearing assumptions ratified by currently-green tests.

Roadmap: mut-removal as in-flight P0; the DESIGN.md/docs honesty-lint
queued as a distinct P1 milestone (depends on the removal closing),
its own brainstorm — no aspirational Wunschdenken / no post-mortem in
DESIGN.md; reader sees the language as it IS now.

docs/roadmap.md

@@ -35,6 +35,20 @@ work progresses.
 
 ## P0 — In flight
 
+- [~] **\[milestone\]** Remove `mut` / `var` / `assign` — atomic
+  hard-removal of the local-mutable-state construct (`Term::Mut` +
+  `Term::Assign` + the `MutVar` surface decl; one indivisible
+  feature). `loop`/`recur` (shipped, closed) + `let`/`if` cover
+  every shipped use; the construct fails the feature-acceptance
+  criterion applied inverted (clause 2 redundant, clause 3 IS the
+  iterated-mutable-state bug class). Approach A: no deprecation
+  window, JSON tags fail closed as generic unknown-variant, codegen
+  alloca machinery kept (loop reuses it) + renamed `binder_allocas`,
+  shared `Term::Lam` escape guard keeps its `loop` half. Explicitly
+  decoupled from Stateful-islands (separate, deferred). Spec written
+  + grounding-check PASS; awaiting user spec review → planner.
+  - context: `docs/specs/2026-05-18-remove-mut-var-assign.md`
+
 - [x] **\[milestone\]** Prose `loop` binders — projection redesign —
   CLOSED 2026-05-18. Form-B prose now renders loop binders as a
   parenthesised init-list on the keyword (`loop(acc = 0, i = 1)
@@ -73,6 +87,25 @@ work progresses.
 
 ## P1 — Next
 
+- [ ] **\[milestone\]** DESIGN.md / docs honesty lint — sweep the
+  canonical docs (above all `docs/DESIGN.md`) so they mirror ONLY
+  the actual current state of development, correct and present-tense.
+  Two banned failure modes: aspirational "foundation for / we'd
+  like / planned" Wunschdenken (genuine forward intent belongs in
+  *this* roadmap, never in DESIGN.md) and "this went wrong"
+  post-mortem narrative (that lives in `docs/journals/`). Sole
+  legitimate exception: a "reserved / unimplemented" claim that is
+  explicitly AND correctly labelled as such (the effect-doc-honesty
+  precedent — the discriminator is whether the doc asserts something
+  exists/works that does not). A reader of DESIGN.md must see what
+  the language IS now, not wishful thinking. Needs its own
+  brainstorm (the Wunschdenken-vs-honest-reserved boundary is a
+  design judgement, and the architect drift-checks against this
+  file — its honesty is load-bearing).
+  - depends on: Remove `mut` / `var` / `assign` (closes first)
+  - context: 2026-05-18 user directive; reserved-vs-vapour
+    precedent `docs/journals/2026-05-16-iter-effect-doc-honesty.md`
+
 - [x] **\[milestone\]** Heap-`Str` ABI — runtime infrastructure for
   malloc-backed, refcounted `Str` values alongside the existing
   static `@.str_*` globals. Today the `Str` path is static-only