Lint: fence the two load-bearing traps — W015 outer-mutation-without-local, W016 bare-predicate aliasing

[InauguralPhysicist]

Why. Two of the three documented silent-wrong traps are deliberate semantics that cannot be removed (observer state IS binding identity; is mutating outward is the scope model). Lua's lesson: traps left as documentation-only become a permanent per-user tax — the community verdict there was default-on linting (luacheck/strict.lua). Fence them at type-time.

What.

• W015: a function assigns to an enclosing binding without local — "outer mutation; add local or rename". Scope the rule to module/library functions, where it is almost always unintended.
• W016: bare trajectory predicate reads the last-observed variable — "write stable of x explicitly" (the feat: observer loop-halting is opt-in (compositional) — fixes cross-talk truncation #247/Observer dH-window lost when a residual is built via temps that NUM_REUSE-alias the convergence variable #262 aliasing family).
• Both emitted in --lint --json and as eigenlsp diagnostics so the editor teaches the model as-you-type. This encodes the write-eigenscript skill's hard-won rules into the toolchain instead of tribal docs.

Acceptance. tests/test_lint.sh cases both ways (fires on the trap, silent on local-correct / explicit-predicate code); docs/DIAGNOSTICS.md contract entries; LSP surfaces both.

Effort: days. Source: 2026-07-04 survey (learnability dimension).

[InauguralPhysicist]

Partially addressed by #425 (W015 as the function-clobber core).

Corpus evidence reshaped the rule. The broad "any outer-mutation-without-local" reading fires 258× across working lib/ + examples/: 101 on _-prefixed intentional module state, 155 on benign generic module-variable reuse under mutate-outward, and only 2 on a genuine bug. "Almost always unintended" doesn't hold — generic name reuse between module and function scope is a normal EigenScript idiom. A rule that noisy would break all 10 consumers' --lint CI.

So W015 shipped as the zero-false-positive core: fire only when an assignment clobbers a module-level function (skip _-prefixed, as W001 does). It found + fixed a real latent bug (lib/tensor.eigs clobbered its own scale function). Zero FP across the corpus.

Remaining, still open here:

• The general local-discipline lint (variable-level outer mutation) needs the dataflow of the scope-aware name-resolution pass (Lint/LSP: scope-aware name-resolution pass — E-class 'no binding on any path' #404) to separate benign reuse from a real clobber — belongs there.
• W016 (bare-predicate aliasing): W014 already fences the ambiguous loop-condition case; the corpus's only bare-predicate use is the legitimate single-var loop while not converged idiom, so a broader rule can't hit the zero-FP bar until inline suppression (--lint severity control: --lint-level, inline suppression, per-file allow in eigs.json #399) lands.