Final iteration of spec 0064. Closes class 4, the one genuine corpus
bug (not a false positive): partition_eithers projects both
(app Pair.fst rest) and (app Pair.snd rest) from one owned rest;
fst/snd are own-param projections that move a field out, so rest is
consumed twice. Universal linearity activation (#55) would reject it.
Fix is a body rewrite (destructure rest once via match), not a check
change.
Latent-bug nature: partition_eithers has a bare (Implicit) param slot
today, so the check is skipped on it -- no RED->GREEN flip on the real
fixture. The rewrite's correctness is proven by the unchanged 2 3 2 3
E2E output (std_either_list_demo) and by the explicit-mode
c4_double_consume must-stay-RED fixture (the double-projection shape IS
rejected, verifiable today). Orchestrator verified the rewrite this
session: ail check std_either_list -> exit 0; ail run the demo ->
2 3 2 3 (applied, ran, reverted for the implementer to re-apply).
Two tasks: Task 1 rewrites partition_eithers + gates on the unchanged
E2E output; Task 2 adds c4_double_consume (must-stay-RED, folded into a
generalised harden_ownership_heap_double_consume_still_errors loop) and
c4_rewrite (stays-clean, added to the false-positives-clean array).
plan-recon confirmed no hash-pin on std_either_list (only the e2e
2 3 2 3 output pin, preserved). No check/schema/codegen change.
This is the last of the four #57 hardening classes; after it lands,
spec 0064 is code-complete and the cycle is ready for audit.
refs #57
