Track drop points by MIR Place, splitting partially-moved locals (fix #121, #122)

[coord-e]

Supersedes #154 and #124. Fixes #121 and #122.

Motivation

• Track implicit drops by MIR Place rather than Local (the Track drop points by MIR Place #154 generalization), and on that basis fix the Unsoundness: partially-moved locals are still implicitly dropped, resolving prophecies of moved-out &mut borrows #121/Unsound: aggregate dropped wholesale after a partial field-move double-resolves the field's &mut prophecy #122 double-resolution bug.
• A local with a partial field move (e.g. move (_2.0)) was still dropped wholesale, so the drop walked into the moved-out sub-place and resolved the &mut prophecy it owns a second time. The two resolutions contradict (final = 1 ∧ final = 2), making the clause body unsatisfiable, after which any assertion — including false ones — "verifies".

Approach

Fix it in the drop-point production, keeping whole-local drops intact and dropping the still-owned siblings of a partially-moved local (sound and complete), without a hand-rolled type walk:

• drop_point.rs — Moves::collect gathers all non-reference moved operands in one body traversal: whole-local moves (keyed by location, where the local also dies) and, keyed by the parent local, the partial field moves. DropSet { drops, except } carries, per drop point, the places to drop plus the moved-out sub-places to skip. A dying local always goes in drops; its partial-move sub-places go in except.
• env.rs — dropping_assumption threads the except set and returns early on any subtree whose path matches an excepted place, so the drop resolves the still-owned siblings while skipping the moved-out ones (which are resolved at the move destination). Path::same_place performs the match and peels Deref: the drop walk inserts a Deref for every own-box the type elaboration introduces (mut/reborrowed locals, and every tuple field), whereas the moved-out places come straight from MIR without them. Moved-out places never contain a real deref (reference moves are excluded upstream), so peeling cannot conflate distinct owned places. This is what makes the skip fire for partially-moved locals that get box-elaborated (e.g. when a sibling is mutated through).
• Drop points are collected into sets rather than Vec, dropping the manual dedup bookkeeping; the analyzer drops each point through a single drop_places helper.

Testing

New pass/fail regression tests:

• partial_move_drop.rs — Unsoundness: partially-moved locals are still implicitly dropped, resolving prophecies of moved-out &mut borrows #121's partial-move-into-local (let b = s.0;).
• partial_move_field_call.rs — Unsound: aggregate dropped wholesale after a partial field-move double-resolves the field's &mut prophecy #122's partial-move-into-call (owned (&mut i64,) field passed to a function).
• partial_move_sibling.rs — a partially-moved local with a still-owned sibling: the sibling's prophecy must be resolved by the parent's drop (completeness), and — when the moved-out part is used and the sibling is reborrowed — the moved-out sub-place must not be resolved twice (soundness; this false-assertion variant was vacuously accepted before the Deref-peeling fix).

Each false-assertion variant reports Unsat (rejected); the true companions verify. Full UI suite: 294 passed, 0 failed (pcsat via Docker, z3 4.15.4), plus doc-tests. cargo fmt --all -- --check, cargo clippy -- -D warnings, and git diff --check are clean.

🤖 Generated with Claude Code