lawspec 0.7.0 → 0.8.0

package/API-MIGRATION.md

@@ -1,27 +1,71 @@
-# Compiler API migration: schema 1 → schema 2
+# Compiler API migration: schema 2 → schema 3
 
-LawSpec 0.7.0 responses include `schemaVersion: 2`. Requests may omit the version
-or explicitly send `schemaVersion: 2`; unsupported versions receive a request
-diagnostic. Existing specification source remains compatible. Consumers of the
-JSON AST must migrate together with the compiler.
+LawSpec 0.8 uses API schema version **3**. Requests may omit `schemaVersion` or
+send `3`. An explicit `2` (or any other version) receives a request diagnostic;
+it is never silently reinterpreted. LawSpec specification syntax remains compatible.
+The generated `index.d.ts` describes the public protocol. Internal Haskell
+constructors and record fields are no longer the wire format.
 
-## Scalar values
+## Laws and typed expressions
 
-Example bindings and expected values are uniformly tagged. Do not coerce every
-numeric value to JavaScript Number.
+Read `result.laws[i].examples` instead of `law.original.examples`. A binding is
+now `{id, name, type, value}` rather than `[name, value]`. `value` retains the
+lossless tagged scalar representation from schema 2. Expected results are typed
+expressions in an assertion, for example `example.expectations[0].right.node.value`.
 
-```js
-// Previously: ["x", 42]
-// Now:
-["x", { type: "Int32", value: "42" }]
+Every expression has `{type, origin, text, node}`. `text` is for presentation;
+inspect `node` for semantics. Nodes explicitly distinguish constants, resolved
+locals, declaration calls, arithmetic with capability evidence, short-circuit
+operators, helpers, and conversions. Conversion mode `checked` means an exact
+result must fit its adapter parameter; `explicit` records a source conversion.
+There is no separate `typedExpressions` side table to match against source ASTs.
+
+Assertions are the authoritative proposition tree:
+
+- `{kind: "equal", evidence, left, right}`
+- `{kind: "implies", guard, body}`
+- `{kind: "all", items}`
+
+The `left`, `right`, and `guards` compatibility projections on laws are removed.
+Traverse the tree to preserve shared guard scope and conjunction order. Do not
+flatten guards or turn refinement predicates into implications.
+
+Inputs use `{id, name, type, predicates, bounds}`. IDs identify binders;
+display names need not be globally unique. Bounds are derived generation hints
+`{operator, value}` over preceding inputs. Predicates remain authoritative.
+`generationPlan` and `inputRefinements` are replaced by these explicit fields.
+Contracts expose typed argument/result binders, preconditions, and postconditions.
+Refinement declarations expose documented parameter kinds, requirements, and a
+printed definition; they are not serialized source ASTs.
+
+## Types, identity, and locations
 
-// Lossless unsigned 64-bit example:
-{ type: "UInt64", value: "18446744073709551615" }
+Types are discriminated views, not `tag`/`contents` encodings:
+
+```js
+{ kind: "constructor", name: "Int8", arguments: [] }
+{ kind: "constructor", name: "Optional", arguments: [
+  { kind: "type", type: { kind: "constructor", name: "Int8", arguments: [] } }
+] }
 ```
 
+Function types use `{kind: "function", parameter, result}`; type variables use
+`{kind: "variable", id}`. The argument model distinguishes types, natural indices
+(encoded as decimal strings), and index variables. This representation does not
+make unimplemented containers or dependent families available in 0.8.
+
+Declaration/property/binder IDs remain stable when unrelated laws are inserted.
+Origins are either `{kind: "source", span: {start, end}}` or
+`{kind: "generated", declaration}`. Source ranges come from parsing, including
+expressions in reused laws and refinements. Generated nodes identify their owner
+instead of inventing source coordinates. Positions use one-based lines/columns;
+end positions are exclusive and can include trailing parser whitespace.
+
+## Scalar values remain lossless
+
 | Domain | Payload after `type` |
 | --- | --- |
-| All integers | `value`: decimal string |
+| Integers, including logical Integer | `value`: decimal string |
 | Bool | `value`: Boolean |
 | Decimal | `coefficient`, `exponent`: decimal strings |
 | Rational | `numerator`, `denominator`: decimal strings; reduced, denominator positive |
@@ -33,53 +77,27 @@ numeric value to JavaScript Number.
 | Unit / Null / Undefined | No payload |
 | Nullable / Optional | `value`: null for missing, otherwise a tagged scalar |
 
-Text is also encoded as units, making the scalar schema uniform. Raw surrogate
-code points never travel through JSON strings. The enclosing input type supplies
-the inner type of a missing presence value.
-
-`Expr.Number.contents` is now a decimal **string**. New expression nodes are
-`DecimalNumber` (coefficient/exponent strings), `ScalarLit`, `Binary`, `Unary`, and `Annotate`. `Type.Applied` represents Nullable
-and Optional. Expanded laws include `typedExpressions`, with operation operand
-and result types plus an explicit `requiredConversion` for checked adapter bridges. Assertion trees remain authoritative;
-`left`, `right`, and `guards` remain compatibility projections.
-
-## Profiles and artifacts
-
-Requests accept `machineBits?: 32 | 64`, defaulting to 64. Successful responses
-include the selected `machineBits`. A profile controls language domains, not the
-architecture of the WASM compiler itself.
-
-Artifacts now include `placement: "source" | "test"` independently of
-`ownership: "user" | "generated"`. A generated runtime belongs in a source
-directory. Do not infer its placement from generated ownership. Continue using
-the manifest writer to protect edited generated files and preserve user adapters.
-
-The generated `index.d.ts` declares the complete discriminated unions. CLI
-`explain` prints the new scalar values without converting large integers to
-floating point. Native and WASM dispatch expose the same schema.
-
-
-## Refinements in the unreleased 0.7.0 schema
-
-API v2 also carries parameterized refinements and executable contracts. `Integer`
-is a logical integer scalar tag whose `value` is a decimal string. Default integer
-literals and promoted integer operations now have logical type `Integer`; explicit
-`BigInt` declarations retain their native mappings. Both tags preserve exact values.
-
-`Law.requirements` contains `Capability` nodes (`Eq`, `Integer`, `Ordered`,
-`Bounded`) with their target types. Types add `Refined`, `RefinementApp`,
-`Qualified`, and `CheckedType` nodes. Refinement arguments explicitly distinguish
-`TypeArgument` from `ValueArgument`; declaration parameter kind `Type` is not a
-runtime scalar. Expressions add `TypeBound` and logical operators.
-
-Responses expose unit-owned `refinements` and `contracts`. Each expanded property
-has `propertyKind` (`law` or `contract`), `generation` settings, and a
-`generationPlan`. Inputs retain their underlying `inputType` and carry separate
-`inputRefinements`. Domain plans include derived comparison bounds; the complete
-predicate remains authoritative. Refinements must not be interpreted as implication
-guards or as permission to count rejected inputs as successful checks.
-
-Requests accept partial `generation` settings (`cases`, `maxAttempts`,
-`maxShrinks`, `exhaustiveLimit`). Project configuration accepts the same object.
-Generated TypeScript declarations define the complete wire shapes. These additions
-are included in schema v2 before its release; schema v1 remains unsupported.
+Do not coerce integer strings to JavaScript Number. Text uses code units or code
+points as appropriate to its domain; raw surrogates never pass through JSON
+strings. The enclosing type supplies the inner type of a missing presence value.
+
+## Checking, generation, and artifacts
+
+`check` and `expand` validate the language. `planGeneration` additionally checks
+whether its input domains can be executed. For example, a well-typed empty finite
+refinement can pass `check` and fail generation with an empty-domain diagnostic.
+Exhausted refinement searches fail explicitly; rejected inputs do not count as
+successful tests.
+
+Requests retain `machineBits?: 32 | 64` (default 64) and partial `generation`
+settings (`cases`, `maxAttempts`, `maxShrinks`, `exhaustiveLimit`). Rust joins the
+seven existing targets. Artifacts retain separate `ownership` and `placement`:
+generated runtime source belongs in source directories, adapters remain
+user-owned, and test helpers belong in test directories. Never infer placement
+from ownership or assume a fixed number of generated files. Continue using the
+manifest writer to protect edited files.
+
+All nonempty test plans now emit the portable scalar runtime. Existing Haskell
+projects must include `text` and `bytestring` in the component that compiles
+that source. Doctor reports the missing dependencies before generation. Build
+files remain user-owned; new scaffolds already include these dependencies.

package/LANGUAGE.md

@@ -0,0 +1,136 @@
+# LawSpec language and compiler boundary (0.8)
+
+LawSpec describes portable laws, concrete examples, and adapter contracts. The
+compiler is written in Haskell. Rust is an output backend alongside Java, Python,
+JavaScript, TypeScript, Go, Haskell, and Kotlin.
+
+## Source and declarations
+
+A source has one named `unit`, function signatures, reusable refinements, and
+laws. Qualified unit names determine target module/package paths. Function
+signatures are curried: `a -> b -> c` takes two inputs and returns `c`. Parentheses
+group types and expressions. Comments start with `--` and run to the line end.
+
+The following grammar summarizes the main forms; the parser and executable
+compiler tests specify lexical details:
+
+```text
+source       = "unit" qualified-name declaration*
+declaration  = name "::" type | law | refinement
+type         = type-atom ["->" type]
+type-atom    = primitive | type-variable | "(" type ")"
+             | ("Nullable" | "Optional") type-atom
+             | refinement-name argument*
+             | "(" name "::" type ["where" expression] ")"
+refinement   = "refinement" name parameter* requirements?
+               "is" type "end"
+parameter    = "(" name "::" type ["where" expression] ")"
+requirements = "requires" (capability type)+
+capability   = "Eq" | "Integer" | "Ordered" | "Bounded"
+law          = "law" quoted-name parameter* requirements? "is"
+               "definition" "is" proposition "end"
+               description? rationale? example* references? "end"
+proposition  = "`for all`" parameter+ "." proposition
+             | expression "=" expression
+             | expression "implies" proposition
+             | proposition "and" proposition
+             | quoted-name expression* | expression
+example      = "example" quoted-name "is" (name "=" literal)+
+               ("expect" expression "=" literal)+ "end"
+```
+
+Law names use backticks. Text/metadata use double quotes with escapes. Named
+refinement declarations state their type versus value parameter kinds, including
+forward references; the compiler validates their arity and argument kinds.
+Lowercase type names represent variables. `a :: Type` is a type parameter, not a
+runtime value with a generator.
+
+A generic law is specialized when invoked with concrete adapters. Its declared
+capabilities must justify its operations; specialization resolves those
+requirements for the actual types. `Integer` as a capability requires an integer
+type. `Integer` in a concrete result signature denotes a representation-independent
+mathematical integer. See [refinements and abstract integers](REFINEMENTS.md).
+
+## Expressions and arithmetic
+
+Application binds most tightly. The remaining precedence, highest first, is:
+unary `!`/`-`, composition `.`, multiplication/division, addition/subtraction,
+comparisons (`==`, `!=`, `<`, `<=`, `>`, `>=`), `&&`, then `||`.
+Comparisons do not chain. Arithmetic associates left; composition associates
+right. An adjacent numeric sign remains part of an argument: `f -42` applies `f`
+to negative 42. Write `x - 42` for subtraction.
+
+Assertion `=` differs from Boolean `==`. `implies` guards its following
+proposition; `and` requires both assertions. Parentheses determine the scope of a
+shared guard. Both Boolean operators and implications short-circuit.
+
+Literals acquire types from declared context. Unconstrained integers have type
+`Integer`; decimal tokens have type `Decimal`. An annotation such as
+`(127 :: Int8)` specifies context. A declared float context can type a decimal
+token directly, but an explicitly constructed exact Decimal is not implicitly
+converted into a float.
+
+Integer `+`, `-`, `*`, and negation produce exact `Integer` results. Decimal
+dominates integer/Decimal combinations; Rational dominates exact combinations
+involving Rational. Exact `/` returns Rational. `prelude.quot` truncates integer
+quotients toward zero; `prelude.rem` is the associated remainder. Division by
+zero fails when evaluated. Explicit numeric conversions use `prelude.Type`.
+Exact/inexact mixing otherwise fails type checking. IEEE arithmetic widens float
+or complex precision as required; equality treats NaN as unequal and signed
+zero as equal. Decimal rounding is explicit, with a scale and ties-to-even rule.
+
+Passing a computed exact result to a bounded adapter argument performs a checked
+conversion. It never wraps, truncates a fraction, or silently changes precision.
+Adapter results are validated against the declared domain before use. See the
+[primitive reference](PRIMITIVES.md) for all domains and helpers.
+
+## Refinements and executable contracts
+
+Refinements are pure Boolean predicates over a value and preceding binders.
+They cannot call user adapters. Dependent inputs are generated in order;
+shrinking preserves their predicates. Bounds such as `y > Int8.max - x` are
+computed with exact arithmetic and can drive a dependent generator. If a chosen
+`x` has no possible `y`, generation retries earlier inputs. Search exhaustion
+fails explicitly rather than passing a property with no valid cases.
+
+Contracts check preconditions, evaluate an adapter once, validate the result,
+and then check postconditions against that same result. Predicate errors are
+contextual failures, not rejected samples. Small finite domains are enumerated;
+other domains use target property frameworks. `machineBits: 32 | 64` controls
+machine-integer domains independently of the compiler host architecture. Native
+machine-sized adapter bindings additionally verify the executing architecture.
+
+## Compiler stages and public API
+
+The parser retains source ranges. Resolution and inference check names, kinds,
+capabilities, contextual literals, and generic specializations. Elaboration
+produces typed core expressions with resolved declaration/binder IDs, explicit
+arithmetic evidence and conversions, plus an authoritative proposition tree.
+Refinement declarations become predicates on quantifiers and contracts; targets
+do not interpret refinement syntax.
+
+An independent core validator checks scopes, kinds, operand/result types,
+capability evidence, and conversions. A pure core evaluator supports deterministic
+domain checks and reference tests. The testing planner computes finite cases,
+boundaries, and dependent generator requirements. All eight emitters consume
+that plan and the core, without importing source syntax or inference.
+
+`check`/`expand` report semantic validity. `planGeneration` additionally reports
+execution feasibility, including empty finite domains. Source syntax errors,
+semantic errors, core invariant failures, and generation errors have distinct
+diagnostic codes. Runtime failures identify the law/example or adapter contract.
+Parsed expressions retain real source ranges; synthesized expressions identify
+the declaration that caused their creation.
+
+API schema v3 uses separately defined wire views, with lossless tagged scalar
+values. It does not serialize internal AST constructors. See the
+[API migration guide](API-MIGRATION.md).
+
+## Next language features
+
+`List`, algebraic `Maybe`/`Either`, user-defined sums and products, pattern
+matching, GADTs, and general dependent types are outside 0.8. The core type model
+supports arbitrary constructor arity and distinguishes type and index arguments
+so those features can be added without target-specific surface interpretation.
+`Nullable` and `Optional` retain their interoperability semantics; they do not
+stand in for future algebraic sum types.

package/PRIMITIVES.md

@@ -1,4 +1,4 @@
-# LawSpec scalar reference (0.7.0)
+# LawSpec scalar reference (0.8.0)
 
 A scalar has a declared domain, checked literals, equality, property inputs, and
 boundary fixtures. General collections, objects, pointers, and type-only constructs
@@ -142,7 +142,7 @@ portable across architectures.
 The bundled `scalars.lawspec`, `scalar_catalog.lawspec`, and
 `scalar_adapters.lawspec` contain explicit fixtures for every scalar family.
 `tools/scalar-reference.py` produces independent Fraction-based conformance
-vectors; `tools/scalar-integration.mjs` executes them across the seven targets.
+vectors; `tools/scalar-integration.mjs` executes them across the eight targets.
 Set `LAWSPEC_MUTANTS=1` to also verify that incorrect adapters are detected.
 
 

package/README.md

@@ -2,19 +2,24 @@
 
 **State the law once. Check it everywhere.**
 
-LawSpec 0.6 compiles reusable laws into native property tests, executable examples,
+LawSpec 0.8 compiles reusable laws into native property tests, executable examples,
 and implementation adapters. The compiler is Haskell, distributed as prebuilt
 WebAssembly with a Node CLI and an asynchronous, typed JavaScript API.
 
-## Portable scalars in 0.7.0
+## Rust and the typed front end in 0.8.0
 
-LawSpec now supports fixed and arbitrary integers, exact decimals and rationals,
+Rust joins Java, Python, JavaScript, TypeScript, Go, Haskell, and Kotlin. All
+eight backends consume the same typed core and testing plan. Source expressions
+retain their ranges, resolved identities, arithmetic evidence, and checked
+conversions. See the [Rust guide](RUST.md) and [language reference](LANGUAGE.md).
+
+The scalar catalog includes fixed and arbitrary integers, exact decimals and rationals,
 IEEE floats and complex values, Unicode and raw-text domains, bytes, symbols,
-and nested absence states on all seven targets. Integer arithmetic produces representation-independent
+and nested absence states on all eight targets. Integer arithmetic produces representation-independent
 `Integer` values; exact division returns Rational. See the [primitive reference](PRIMITIVES.md)
 for constructors, arithmetic, native bridges, and machine-width profiles.
 
-Compiler API consumers should read the [schema v2 migration guide](API-MIGRATION.md).
+Compiler API consumers should read the [schema v3 migration guide](API-MIGRATION.md).
 Scalar values use tagged, lossless encodings; generated runtime placement is
 separate from artifact ownership. Java 25+ and Python 3.13+ baselines are unchanged.
 
@@ -23,7 +28,7 @@ separate from artifact ownership. Java 25+ and Python 3.13+ baselines are unchan
 Install [LawSpec from npm](https://www.npmjs.com/package/lawspec):
 
 ```sh
-npm install --save-dev lawspec@0.7.0
+npm install --save-dev lawspec@0.8.0
 npx lawspec --version
 ```
 
@@ -37,8 +42,8 @@ local dependencies so LawSpec can create its `package.json` and test script:
 ```sh
 mkdir lawspec-example
 cd lawspec-example
-npm exec --package=lawspec@0.7.0 -- lawspec init --target javascript
-npm install --save-dev lawspec@0.7.0
+npm exec --package=lawspec@0.8.0 -- lawspec init --target javascript
+npm install --save-dev lawspec@0.8.0
 npx lawspec check
 npx lawspec explain 'example.atoi_codec::itoa and then atoi yields a'
 npx lawspec doctor
@@ -71,9 +76,10 @@ properties with the selected framework's shrinking and failure reporting.
 | `go` | Go modules, Go 1.22–1.26 | Rapid 1.2.0, testing | `go test ./...` |
 | `haskell` | Stack, GHC 9.10, LTS 24.58 | Hspec 2.11, Hedgehog 1.5, hspec-hedgehog 0.3 | `stack test` |
 | `kotlin` | JDK/JVM 25, Gradle 9.1–9.3, Kotlin 2.3.21 | Kotest 5.9.1 | `gradle test` |
+| `rust` | Rust 1.85+, edition 2024, Cargo | Proptest 1.11.0 | `cargo test` |
 
 Java 25 and Python 3.13 are the minimum baselines. New JVM releases are admitted
-through compatibility profiles after testing; v0.6's current JVM profile certifies
+through compatibility profiles after testing; the current JVM profile certifies
 25. Python templates declare `requires-python = ">=3.13"` and runtime checks
 currently recognize 3.13 and 3.14. Kotlin templates pin Gradle's supported build
 configuration to Kotlin 2.3.21 and target JVM 25.
@@ -244,7 +250,7 @@ reusable laws accept these curried functions, their partial applications, and
 scalar parameters. Quantified test inputs remain scalar.
 
 The prelude defines the following laws. Every row has an executable example in
-[algebra.lawspec](https://github.com/brain-fuel/lawspec/blob/v0.7.0/examples/specs/algebra.lawspec), including both sides of every
+[algebra.lawspec](https://github.com/brain-fuel/lawspec/blob/v0.8.0/examples/specs/algebra.lawspec), including both sides of every
 combined law. `f` and `g` are binary operations, `inverse` is unary, and `e` and
 `zero` are scalar parameters. All these laws require equality of the element type.
 
@@ -280,10 +286,10 @@ explicit domain predicate and conditional equations.
 `invertible` checks the supplied inverse operation. Check `identity` and
 `associative` as well when specifying a group. The prelude states contracts;
 it does not supply arithmetic implementations or prove a structure from random
-tests. The numeric examples use Int32 arithmetic modulo 2^32 so their laws hold
-at overflow boundaries on every target. JavaScript uses `Math.imul` for products,
-and Python explicitly wraps results into the signed Int32 range in the test
-adapters.
+tests. The algebra and numeric currying examples use mathematical `Integer`
+values and exact native arithmetic. Explicit expectations exceed Int32 and
+machine bounds, so wrapping or lossy adapters fail even when their modular
+arithmetic happens to satisfy the algebraic identities.
 
 Use `and` to require multiple conclusions in one law. For example:
 
@@ -312,11 +318,11 @@ their entire consequence. Every conjunct is type-checked and emitted. As with
 existing assertions, the first failure stops that individual test. `and` is now
 a reserved word.
 
-[Currying examples](https://github.com/brain-fuel/lawspec/blob/v0.7.0/examples/specs/currying.lawspec) demonstrate a four-argument
+[Currying examples](https://github.com/brain-fuel/lawspec/blob/v0.8.0/examples/specs/currying.lawspec) demonstrate a four-argument
 function partially applied twice, a formatter with four heterogeneous arguments,
 and composition after partial application. Each example states its exact outputs.
 Run `node npm/bin/lawspec.mjs examples` after rebuilding to inspect all nine units
-in all seven target languages (126 artifacts).
+in all eight target languages.
 
 The expanded API's **`assertion` tree is authoritative**: `AssertEqual` contains
 two expressions, `AssertImplies` contains a condition and consequence, and
@@ -364,7 +370,7 @@ law `valid ports round trip` is
 end
 ```
 
-The [complete port example](https://github.com/brain-fuel/lawspec/blob/v0.7.0/examples/specs/parse_port.lawspec)
+The [complete port example](https://github.com/brain-fuel/lawspec/blob/v0.8.0/examples/specs/parse_port.lawspec)
 defines valid ports as 1–65535, and covers both endpoints, ordinary ports, zero,
 negative values, and 65536. All explicit `expect` assertions run regardless of
 the law's condition. A false condition skips only the consequence: invalid ports
@@ -382,7 +388,7 @@ The prelude includes `satisfies predicate` (the predicate holds for every input)
 and `left inverse when predicate parse render` (the guarded round trip above).
 These reusable laws preserve the condition and its lexical bindings when expanded.
 `equivalent` can also compare two predicates, since `Bool` supports equality.
-The [Boolean flags example](https://github.com/brain-fuel/lawspec/blob/v0.7.0/examples/specs/boolean_flags.lawspec)
+The [Boolean flags example](https://github.com/brain-fuel/lawspec/blob/v0.8.0/examples/specs/boolean_flags.lawspec)
 checks that flipping twice restores both `false` and `true`; all targets generate
 Boolean property inputs and explicit tests for both Boolean boundary values. Java caps Boolean-only JetCheck runs at the number of
 possible input combinations (up to 100), avoiding generator exhaustion.
@@ -461,7 +467,7 @@ This expands to `for all (x :: Int32) . render (x) = referenceRender (x)`.
 The example inherits the input name `x` from the prelude. Both functions are
 user-owned adapter functions; either may delegate to your existing code.
 
-[The complete example](https://github.com/brain-fuel/lawspec/blob/v0.7.0/examples/specs/equivalent.lawspec) compares decimal
+[The complete example](https://github.com/brain-fuel/lawspec/blob/v0.8.0/examples/specs/equivalent.lawspec) compares decimal
 renderers and two implementations that clamp negative integers to zero. For
 JavaScript, their adapters can be:
 
@@ -472,7 +478,7 @@ export const clamp = x => Math.max(0, x);
 export const referenceClamp = x => x < 0 ? 0 : x;
 ```
 
-The same specification generates native tests for all seven targets. The
+The same specification generates native tests for all eight targets. The
 integration suite checks both examples with matching implementations, then
 breaks each alternative separately to verify detection. The general equivalence law alone does not establish independent correctness;
 two implementations can share the same bug. Explicit expectations additionally
@@ -498,7 +504,7 @@ law `normalizers agree` is
 end
 ```
 
-The [slug example](https://github.com/brain-fuel/lawspec/blob/v0.7.0/examples/specs/slug.lawspec)
+The [slug example](https://github.com/brain-fuel/lawspec/blob/v0.8.0/examples/specs/slug.lawspec)
 compares two implementations of ASCII-space replacement. It includes empty,
 Unicode and escaped text. Each target uses its native string generator:
 JetCheck `Generator.stringsOf(Generator.asciiPrintableChars())`, Hypothesis `st.text()`, fast-check `fc.string()`,
@@ -525,7 +531,7 @@ law `canonicalization reaches a fixed point` is
 end
 ```
 
-The [canonical URL example](https://github.com/brain-fuel/lawspec/blob/v0.7.0/examples/specs/canonical_url.lawspec)
+The [canonical URL example](https://github.com/brain-fuel/lawspec/blob/v0.8.0/examples/specs/canonical_url.lawspec)
 uses removal of **all trailing slashes** as a small fixed-point demonstration,
 not a complete URL canonicalization algorithm. For JavaScript:
 
@@ -534,7 +540,7 @@ export const canonicalize = value => value.replace(/\/+$/, "");
 ```
 
 Removing just one trailing slash fails the supplied repeated-slash example.
-The [mixed-input example](https://github.com/brain-fuel/lawspec/blob/v0.7.0/examples/specs/mixed_inputs.lawspec)
+The [mixed-input example](https://github.com/brain-fuel/lawspec/blob/v0.8.0/examples/specs/mixed_inputs.lawspec)
 shows `Text` and `Int32` in the same quantified property and executable example.
 The JavaScript API represents input bindings and expected values as `number | string | boolean`.
 Each example includes `expectations: { actual: Expr; expected: number | string | boolean }[]`.
@@ -550,7 +556,7 @@ npx lawspec examples --target java --output example_artifacts
 This command works without a project configuration or native build tools. It
 compiles every bundled example and writes its tests and user-owned stubs to
 `example_artifacts/<language>/`, using each target's normal source/test layout.
-By default it exports all seven languages; `--json` returns the file inventory.
+By default it exports all eight languages; `--json` returns the file inventory.
 From a checkout, `make examples` runs the same command.
 
 These are inspection artifacts, not initialized projects: no build files are
@@ -599,7 +605,7 @@ by the JS shim.
 ## Build and verify
 
 For contributors working from a repository checkout, build a local archive with
-`npm pack ./npm` and install it with `npm install --save-dev ./lawspec-0.7.0.tgz`.
+`npm pack ./npm` and install it with `npm install --save-dev ./lawspec-0.8.0.tgz`.
 The package payload lives in `npm/`.
 
 ```sh
@@ -623,7 +629,7 @@ compiler-source and artifact hashes in `npm/build.json`; CI rejects stale WASM
 or hand-edited generated wrappers. The npm archive is a self-contained consumer
 artifact, with no install-time compilation or download hook.
 
-For all seven native integrations, install their build tools, then:
+For all eight native integrations, install their build tools, then:
 
 ```sh
 # Set LAWSPEC_GRADLE to a Gradle 9.3.0 executable if it is not on PATH.

package/REFINEMENTS.md

@@ -1,4 +1,4 @@
-# Refinements and abstract integers (0.7.0)
+# Refinements and abstract integers (0.8.0)
 
 A refinement restricts a scalar domain with a pure Boolean expression. LawSpec
 checks concrete examples, generates satisfying input tuples, and checks adapter

package/RUST.md

@@ -0,0 +1,97 @@
+# Rust backend (0.8)
+
+Rust is the first backend built on LawSpec's typed core and testing plan. The
+compiler remains implemented in Haskell. Rust generation does not parse source
+expressions, infer their types, or expand refinement declarations.
+
+## Project setup
+
+Use Rust 1.85 or later, edition 2024, and Cargo. The generated project pins
+Proptest 1.11.0, num-bigint 0.4.8, num-rational 0.4.2, num-complex 0.4.6, and
+num-traits 0.2.19.
+
+```sh
+lawspec init --target rust
+lawspec doctor
+lawspec generate
+cargo test
+cargo test --release
+```
+
+Adapters are user-owned files under `src/`. LawSpec maintains
+`lawspec_runtime.rs`, module declarations in `lawspec_modules.rs`, and tests
+under `tests/`. The scaffolded `src/lib.rs` includes the generated declarations;
+an existing library can include those declarations explicitly. Generation
+preserves edited adapters and reports required signature updates.
+
+The numeric runtime has no Proptest dependency. Framework support lives in a
+separate generated file, `tests/support/lawspec_strategies.rs`.
+
+## Owned adapter values
+
+Arguments and results are owned Rust values. LawSpec does not add borrowing,
+lifetimes, or pointer operations to its language. Tests clone values where an
+expression needs to use an input more than once.
+
+| LawSpec domain | Rust adapter representation |
+| --- | --- |
+| `Bool` | `bool` |
+| Fixed signed/unsigned integers | `i8`…`i64`, `u8`…`u64` |
+| `IntSize`, `UIntSize`, `UIntPtr` | `isize`, `usize`, `usize` |
+| `BigInt`, `BigUInt` | `BigInt`, `BigUint` |
+| `Integer` input | `BigInt` |
+| `Integer` result | `Integer`, with lossless `From` implementations |
+| `Decimal`, `Rational` | Generated `Decimal`, `BigRational` |
+| `Float32`, `Float64` | `f32`, `f64` |
+| `Complex64`, `Complex128` | `Complex32`, `Complex64` from num-complex |
+| `Char`, `Text` | `char`, `String` |
+| `CodePoint`, `CodePointText` | Generated checked wrappers |
+| `CodeUnit16`, `Utf16Text`, `Bytes` | `u16`, generated UTF-16 wrapper, `Vec<u8>` |
+| `Symbol` | Generated identity type; cloning preserves identity |
+| `Unit`, `Null`, `Undefined` | `()`, distinct generated absence types |
+| `Nullable a`, `Optional a` | Distinct generated enums, including nested presence |
+
+Names such as `Integer` and `Decimal` above are exported by the generated
+`lawspec_runtime` module. Machine-sized native bindings check the requested
+`machineBits` against the executing architecture.
+
+For a declaration such as `successor :: Int8 -> Integer`, an implementation can
+return a wider native integer through the logical result wrapper:
+
+```rust
+use crate::lawspec_runtime as ls;
+
+pub fn successor(value: i8) -> ls::Integer {
+    (i16::from(value) + 1).into()
+}
+```
+
+Exact arithmetic in laws uses arbitrary precision. Passing its result to an
+`i8` adapter parameter performs a checked conversion. A fractional or
+out-of-range value fails with the adapter's context.
+
+`Decimal` stores an arbitrary integer coefficient and exponent. Decimal
+arithmetic is exact; explicit rounding uses the requested scale and ties to
+even. Exact-to-float conversion rounds directly to the requested IEEE precision,
+including subnormal and halfway cases.
+
+## Refinements and generation
+
+Small finite domains are enumerated. Larger domains use native Proptest
+strategies. Integer bounds over earlier inputs become dependent strategies;
+when a prefix has no possible continuation, generation retries the prefix.
+Shrinking recomputes those dependent bounds and retains only valid tuples.
+Refinement evaluation errors fail the test rather than being counted as rejected
+samples. Generation limits prevent an empty or unreachable domain from passing
+vacuously.
+
+Contracts check preconditions, evaluate the adapter once, validate its native
+result, and then check postconditions on that result.
+
+## Custom layouts
+
+`sourceDir` and `testDir` move generated sources and imports together. Set Cargo's
+`[lib] path` to the library entry point under the selected source directory. For
+test directories other than `tests`, register generated test files using Cargo
+`[[test]]` entries. Doctor checks the selected Cargo package, edition, resolved
+dependencies, library directory, and custom test registration.

package/api.mjs

@@ -2,5 +2,5 @@
 import { loadCore } from './launcher.mjs';
 export async function createCompiler() {
   const call = await loadCore();
-  return { check: (input) => call({ ...input, method: 'check' }), expand: (input) => call({ ...input, method: 'expand' }), planGeneration: (input) => call({ ...input, method: 'planGeneration' }) };
+  return { check: (input) => call({ schemaVersion: 3, ...input, method: 'check' }), expand: (input) => call({ schemaVersion: 3, ...input, method: 'expand' }), planGeneration: (input) => call({ schemaVersion: 3, ...input, method: 'planGeneration' }) };
 }