verify: warn on bare +=/mset/mdel result-discard (ILO-T033)

[danieljohnmorris]

Summary

+=xs v, mset m k v, and mdel m k look like in-place mutation but return a new value under ilo's functional semantics. As a bare statement, the result is silently discarded on every engine and the source binding is unchanged. The verifier now flags this with ILO-T033 and a hint pointing at the rebind shape that fixes it.

This is a diagnostic-only change. Runtime behaviour across tree, VM, and Cranelift is unchanged. Same shape as the ILO-T032 fix for bare fmt/fmt2 shipped in #299.

Persona context

db-analyst surfaced the silent no-op three sessions in a row (assessment doc lines 2351, 2628, 3865). The semantics are correct ilo, but the surface area, no diagnostic at all, was the worst-of-both-worlds case I'd noted as a follow-up at the bottom of the T032 PR. This closes that loop.

Repro before/after

f>L n;out=[];@i 0..3{+=out i};out

Before: runs silently to completion, returns []. The +=out i inside the loop body builds a new list each iteration but the result is thrown away, so out stays empty. Agent spends 5-30 minutes diagnosing why their accumulator is zero-length.

After: verifier emits ILO-T033 bare '+=' result is discarded with hint +=xs v returns a new list, rebind with out=+=out v to mutate, or use the result. Program still runs (warning, not error), but the trap is visible at verify time.

Same shape for mset:

f>M t n;m=mmap;mset m "a" 1;m

returns {} before, warns + returns {} after; fix is m=mset m "a" 1.

What's in the diff (per commit)

• verify: warn on bare +=/mset/mdel at non-tail or in-loop position (ILO-T033) - the verifier check, the registry entry with worked examples, and 10 unit tests covering bare-in-loop warns for all three shapes, rebind no-warn for all three, tail-position-in-function no-warn, guard-body-in-loop warns, nested-in-call no-warn, multiple bare calls each warn independently. Hint extracts the source binding name from the first operand so the suggested rebind matches the user's local variable.
• example: bare-mut-warns.ilo pins the rebind shapes for ILO-T033 - new examples/bare-mut-warns.ilo demonstrating all three canonical fix shapes plus a tail-position case where bare +=xs v is legitimate. Exercised across tree + VM via tests/examples_engines.rs.
• docs: note that +=/mset/mdel return new values, not in-place mutation - SPEC.md, ai.txt, and skills/ilo/SKILL.md gain a short callout next to the existing fmt-does-not-print note, cross-referencing ILO-T033.

Test plan

• cargo test --release --features cranelift --lib verify::tests - 415/415 pass
• cargo test --release --features cranelift --test examples_engines - examples_engines passes (new example included)
• cargo test --release --features cranelift --lib vm::compile_cranelift::tests::aot - all 7 AOT tests pass against default target dir
• cargo test --release --features cranelift (full suite) - 3074 tests pass in isolated target dir; the 7 AOT failures there are the pre-existing target-dir-relative behaviour also seen in verify: warn on bare fmt/fmt2 at non-tail position (ILO-T032) #299 and pass against the default target
• cargo fmt --check - clean
• cargo clippy --release --features cranelift --all-targets -- -D warnings - clean
• Manual: ran all three bare shapes (+=, mset, mdel) plus their rebind forms on all three engines, confirmed warning surfaces at CLI and program still runs (exit 0)

Follow-ups

• Loop-body discards for bare fmt/fmt2 (T032's deferred follow-up). Same shape: T032 only checks non-tail position, so @i 0..3{fmt "x={}" i} doesn't warn yet. Widening the T032 check to mirror this PR's in-loop logic is the natural next step.
• The hint stays under ~100 chars so it fits the agent's token budget. If we want to surface the ilo --explain ILO-T033 worked examples on the warning line itself, that's an orthogonal CLI change.

[codecov]

Codecov Report

❌ Patch coverage is 99.40476% with 1 line in your changes missing coverage. Please review.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
src/verify.rs	99.40%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!