lemmascript 0.3.2 → 0.3.3

package/README.md

@@ -13,6 +13,7 @@ Each example and case study is verified in Lean 4 and/or Dafny from the same ann
 See the internal [examples](examples).
 
 See the external case studies:
+- **[collab-todo-lemmascript](https://github.com/midspiral/collab-todo-lemmascript/)** — collaborative task management web app (React + Supabase) with a verified domain model. Single `domain.ts` imported directly by the UI, hooks, and edge functions — no adapter layer. 123 Dafny lemmas (120 in a separate `domain.proofs.dfy`): 16-conjunct invariant preserved across 25 single-project + 3 cross-project actions, NoOp completeness/soundness, initialization. Dafny only.
 - **[colorwheel-lemmascript](https://github.com/midspiral/colorwheel-lemmascript/)** — verified color palette generator with mood + harmony constraints. 31 Lean proofs + 18 behavioral properties, 115 Dafny lemmas (invariant preservation, commutativity, NoOp completeness).
 - **[clear-split-lemmascript](https://github.com/midspiral/clear-split-lemmascript/)** — greenfield verified expense splitting web app. Conservation theorem, invariant preservation, delta laws — all proven in both Lean (no sorry) and Dafny (56 lemmas).
 - **[node-casbin-lemmascript](https://github.com/midspiral/node-casbin-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield verification of [node-casbin](https://github.com/casbin/node-casbin). 5 functions verified, 217 existing tests pass. End-to-end correctness and order independence for all 4 effect modes in both Lean and Dafny (39 lemmas).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lemmascript",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "A verification toolchain for TypeScript — generates Lean 4 or Dafny from annotated TS",
   "type": "module",
   "bin": {
@@ -12,7 +12,8 @@
   "scripts": {
     "build": "tsc -p tools/tsconfig.json",
     "prepublishOnly": "npm run build",
-    "typecheck": "tsc -p tools/tsconfig.json --noEmit"
+    "typecheck": "tsc -p tools/tsconfig.json --noEmit",
+    "typecheck:examples": "tsc -p examples/tsconfig.json"
   },
   "dependencies": {
     "ts-morph": "^25.0.0"

package/tools/dist/dafny-emit.js

@@ -325,6 +325,8 @@ function emitExpr(e) {
                 const vals = e.fields.map(f => emitExpr(f.value));
                 return `${ctorName}(${vals.join(", ")})`;
             }
+            if (e.fields.length === 0)
+                return `map[]`;
             const vals = e.fields.map(f => emitExpr(f.value));
             return `(${vals.join(", ")})`;
         }
@@ -473,6 +475,8 @@ function emitDecl(d) {
             const lines = [`function ${d.name}${tp}(${paramList(d.params)}): ${tyToDafny(d.returnType)}`];
             for (const r of d.requires)
                 lines.push(`  requires ${emitExpr(r)}`);
+            if (d.decreases)
+                lines.push(`  decreases ${emitExpr(d.decreases)}`);
             lines.push(`{`);
             lines.push(emitPureExpr(d.body, 1));
             lines.push(`}`);
@@ -491,6 +495,20 @@ function emitDecl(d) {
             }
             return lines.join("\n");
         }
+        case "def-by-method": {
+            const tp = d.typeParams.length > 0 ? `<${d.typeParams.join(", ")}>` : "";
+            const lines = [`function ${d.name}${tp}(${paramList(d.params)}): ${tyToDafny(d.returnType)}`];
+            for (const r of d.requires)
+                lines.push(`  requires ${emitExpr(r)}`);
+            if (d.decreases)
+                lines.push(`  decreases ${emitExpr(d.decreases)}`);
+            lines.push(`{`);
+            lines.push(`}`);
+            lines.push(`by method {`);
+            lines.push(emitStmts(d.methodBody, 1));
+            lines.push(`}`);
+            return lines.join("\n");
+        }
         case "method": {
             const tp = d.typeParams.length > 0 ? `<${d.typeParams.join(", ")}>` : "";
             const lines = [`method ${d.name}${tp}(${paramList(d.params)}) returns (res: ${tyToDafny(d.returnType)})`];
@@ -656,6 +674,7 @@ const MATH_ABS = `function MathAbs(x: int): nat { if x >= 0 then x else -x }`;
 const SET_TO_SEQ = `method SetToSeq<T>(s: set<T>) returns (res: seq<T>)
   ensures forall x :: x in s <==> x in res
   ensures |res| == |s|
+  ensures forall i, j :: 0 <= i < j < |res| ==> res[i] != res[j]
 {
   var remaining := s;
   res := [];
@@ -663,6 +682,7 @@ const SET_TO_SEQ = `method SetToSeq<T>(s: set<T>) returns (res: seq<T>)
     invariant remaining <= s
     invariant forall x :: x in res <==> (x in s && x !in remaining)
     invariant |res| + |remaining| == |s|
+    invariant forall i, j :: 0 <= i < j < |res| ==> res[i] != res[j]
     decreases remaining
   {
     var x :| x in remaining;
@@ -760,26 +780,40 @@ function translatePattern(pattern) {
 export function emitDafnyFile(file, tsFileName) {
     buildRecordCtorMap(file.decls);
     _neededPreambles.clear();
-    // Collect pure def names so we can skip their method wrappers
-    const pureDefs = new Set();
-    for (const d of file.decls) {
-        if (d.kind === "namespace") {
-            for (const inner of d.decls)
-                if (inner.kind === "def")
-                    pureDefs.add(inner.name);
-        }
-        if (d.kind === "def")
-            pureDefs.add(d.name);
-    }
+    // Track successfully emitted pure defs — method wrappers are only
+    // skipped when the corresponding pure def was actually emitted.
+    const emittedPureDefs = new Set();
     // Emit declarations
     const declLines = [];
     const skipped = [];
     for (const decl of file.decls) {
-        if (decl.kind === "method" && pureDefs.has(decl.name))
+        if (decl.kind === "method" && emittedPureDefs.has(decl.name))
             continue;
+        if (decl.kind === "namespace") {
+            // Emit each inner decl individually — if one fails, the rest survive
+            // and failed defs fall back to their method wrappers
+            for (const inner of decl.decls) {
+                try {
+                    declLines.push("");
+                    declLines.push(emitDecl(inner));
+                    if (inner.kind === "def")
+                        emittedPureDefs.add(inner.name);
+                }
+                catch (e) {
+                    const name = "name" in inner ? inner.name : "unknown";
+                    const msg = e.message;
+                    console.error(`WARNING: skipping pure '${name}': ${msg}`);
+                    declLines.push(`\n// LemmaScript: skipped pure ${name}`);
+                    skipped.push(name);
+                }
+            }
+            continue;
+        }
         try {
             declLines.push("");
             declLines.push(emitDecl(decl));
+            if (decl.kind === "def-by-method")
+                emittedPureDefs.add(decl.name);
         }
         catch (e) {
             const name = "name" in decl ? decl.name : "unknown";

package/tools/dist/extract.js

@@ -8,6 +8,13 @@ import { Project, Node, SyntaxKind, ScriptTarget } from "ts-morph";
 // ── Expression extraction ────────────────────────────────────
 /** When set, calls whose function/method name matches this key are replaced with havoc. */
 let _havocKey = null;
+/**
+ * Maps property-name fingerprints to type alias names for collapsed single-variant unions.
+ * TypeScript collapses `type X = | { kind: 'A'; ... }` to the underlying object type,
+ * causing getAliasSymbol() to return null. This map lets typeToString recover the alias.
+ * Populated in extractModule before type extraction; used by typeToString.
+ */
+let _collapsedUnionMap = new Map();
 /** Generic bounds erasure map — set during extractFunction, applied in extractStmts. */
 let _typeParamMap = new Map();
 function _eraseGenerics(tsType) {
@@ -106,6 +113,14 @@ function extractExpr(node) {
     }
     // Call expression: f(a, b)
     if (Node.isCallExpression(node)) {
+        // Object.fromEntries(map) → identity (Map IS Record in Dafny)
+        const callee = node.getExpression();
+        if (Node.isPropertyAccessExpression(callee) &&
+            callee.getExpression().getText() === "Object" &&
+            callee.getName() === "fromEntries" &&
+            node.getArguments().length === 1) {
+            return extractExpr(node.getArguments()[0]);
+        }
         return {
             kind: "call",
             fn: extractExpr(node.getExpression()),
@@ -318,6 +333,17 @@ function collectAnnotations(node, body) {
         return [...own, ...parseAnnotations(body[0])];
     return own;
 }
+/** Check for bare `//@ pure` annotation (no expression). */
+function hasPureAnnotation(node, body) {
+    const nodes = body && body.length > 0 ? [node, body[0]] : [node];
+    for (const n of nodes) {
+        for (const range of n.getLeadingCommentRanges()) {
+            if (range.getText().trim() === "//@ pure")
+                return true;
+        }
+    }
+    return false;
+}
 // ── Type declaration extraction ──────────────────────────────
 function extractTypeDecl(decl, extraDecls) {
     const name = decl.getName();
@@ -349,6 +375,30 @@ function extractTypeDecl(decl, extraDecls) {
             }
         }
     }
+    // Single-variant discriminated union: type X = | { kind: 'Foo', ... }
+    // TypeScript collapses single-member unions to their member type,
+    // so type.isUnion() returns false. Detect by checking the source text
+    // for union syntax '|' AND a string-literal discriminant field.
+    if (type.isObject() && !type.isIntersection()) {
+        const srcText = decl.getTypeNode()?.getText() ?? "";
+        if (srcText.includes("|")) {
+            const disc = findDiscriminant([type]);
+            if (disc) {
+                const tagProp = type.getProperty(disc);
+                const tagType = tagProp?.getTypeAtLocation(decl);
+                const tag = tagType?.isStringLiteral() ? String(tagType.getLiteralValue()) : null;
+                if (tag) {
+                    const fields = [];
+                    for (const prop of type.getProperties()) {
+                        if (prop.getName() === disc)
+                            continue;
+                        fields.push({ name: prop.getName(), tsType: typeToString(prop.getTypeAtLocation(decl)) });
+                    }
+                    return { name, typeParams: tpField, kind: "discriminated-union", discriminant: disc, variants: [{ name: tag, fields }] };
+                }
+            }
+        }
+    }
     if (type.isObject() || type.isIntersection())
         return extractRecord(name, type, decl, undefined, extraDecls);
     // Primitive type alias: type TaskId = number → alias
@@ -461,6 +511,13 @@ function typeToString(type) {
     const symbol = type.getSymbol() ?? type.getAliasSymbol();
     if (symbol) {
         const name = symbol.getName();
+        // Recover collapsed single-variant union alias via property fingerprint
+        if (name === "__type" && _collapsedUnionMap.size > 0) {
+            const props = type.getProperties().map(p => p.getName()).sort().join(",");
+            const alias = _collapsedUnionMap.get(props);
+            if (alias)
+                return alias;
+        }
         const typeArgs = type.getTypeArguments();
         if (typeArgs.length > 0) {
             return `${name}<${typeArgs.map(t => typeToString(t)).join(", ")}>`;
@@ -632,13 +689,29 @@ function extractStmts(stmts) {
             else {
                 names.push("_");
             }
+            // Unwrap Object.entries(expr) / Object.values(expr) to bare map iteration
+            let iterableExpr = s.getExpression();
+            if (Node.isCallExpression(iterableExpr)) {
+                const callee = iterableExpr.getExpression();
+                if (Node.isPropertyAccessExpression(callee) &&
+                    callee.getExpression().getText() === "Object") {
+                    const method = callee.getName();
+                    if ((method === "entries" || method === "values") && iterableExpr.getArguments().length === 1) {
+                        iterableExpr = iterableExpr.getArguments()[0];
+                        // Object.values with single name → prepend "_" so it looks like [_, v] destructuring
+                        if (method === "values" && names.length === 1) {
+                            names.unshift("_");
+                        }
+                    }
+                }
+            }
             const bodyNode = s.getStatement();
             const bodyStmts = Node.isBlock(bodyNode) ? bodyNode.getStatements() : [bodyNode];
             const annots = collectAnnotations(s, bodyStmts);
             result.push({
                 kind: "forof",
                 names,
-                iterable: extractExpr(s.getExpression()),
+                iterable: extractExpr(iterableExpr),
                 invariants: annots.filter(a => a.kind === "invariant").map(a => a.expr),
                 doneWith: annots.find(a => a.kind === "done_with")?.expr ?? null,
                 body: extractStmts(bodyStmts),
@@ -864,6 +937,8 @@ function extractFunction(fn, parentAnnotations) {
         })(),
         requires: annots.filter(a => a.kind === "requires").map(a => a.expr),
         ensures: annots.filter(a => a.kind === "ensures").map(a => a.expr),
+        decreases: annots.find(a => a.kind === "decreases")?.expr ?? null,
+        pure: hasPureAnnotation(fn, body && Node.isBlock(body) ? body.getStatements() : undefined),
         typeAnnotations,
         body: extractedBody,
         line: fn.getStartLineNumber(),
@@ -907,6 +982,22 @@ export function extractModule(sourceFile) {
             typeDecls.push({ name, kind: "record", fields });
         }
     }
+    // Pre-scan for collapsed single-variant unions so typeToString can recover alias names.
+    // TypeScript collapses `type X = | { kind: 'A'; ... }` to a plain object type, losing
+    // the alias. We record a fingerprint (sorted property names) → alias name mapping.
+    _collapsedUnionMap = new Map();
+    for (const stmt of sourceFile.getStatements()) {
+        if (Node.isTypeAliasDeclaration(stmt)) {
+            const type = stmt.getType();
+            if (!type.isUnion() && type.isObject() && !type.isIntersection()) {
+                const srcText = stmt.getTypeNode()?.getText() ?? "";
+                if (srcText.includes("|") && findDiscriminant([type])) {
+                    const props = type.getProperties().map(p => p.getName()).sort().join(",");
+                    _collapsedUnionMap.set(props, stmt.getName());
+                }
+            }
+        }
+    }
     // Extract type declarations in source order to respect dependencies
     // Skip types already declared via //@ declare-type
     const declaredNames = new Set(typeDecls.map(d => d.name));
@@ -1266,6 +1357,12 @@ export function extractModule(sourceFile) {
         }
         const sym = retType.getSymbol();
         if (sym?.getName() === "__type" && retType.isObject() && !retType.isArray()) {
+            // Try typeToString first — it resolves collapsed single-variant unions
+            const resolved = typeToString(retType);
+            if (resolved !== "__type" && !resolved.includes("__type") && knownTypes.has(resolved)) {
+                fn.returnType = resolved;
+                continue;
+            }
             const synName = fn.name.charAt(0).toUpperCase() + fn.name.slice(1) + "Result";
             if (!knownTypes.has(synName)) {
                 const extra = [];

package/tools/dist/lean-emit.js

@@ -325,6 +325,8 @@ function emitDecl(d) {
             const params = d.params.map(p => `(${escapeName(p.name)} : ${tyToLean(p.type)})`).join(" ");
             return `def ${d.name} ${params} : ${tyToLean(d.returnType)} :=\n${emitPureExpr(d.body, 1)}`;
         }
+        case "def-by-method":
+            throw new Error("function by method is not supported for Lean backend");
         case "method": {
             const params = d.params.map(p => `(${escapeName(p.name)} : ${tyToLean(p.type)})`).join(" ");
             const lines = [`method ${d.name} ${params} return (res : ${tyToLean(d.returnType)})`];

package/tools/dist/resolve.js

@@ -108,7 +108,9 @@ function wrapSome(value, optionalTy) {
 }
 /** Detect `v !== undefined` or `undefined !== v` where v: optional<T>.
  *  Handles simple variables, field access chains, and arbitrary expressions.
- *  When `fieldExpr` is returned, callers must use `substituteRawExpr` to narrow.
+ *  When `fieldExpr` is returned for a simple field chain (obj.field), callers
+ *  can narrow via `narrowedFields` context. For complex expressions (calls, etc.),
+ *  callers should fall back to `substituteRawExpr`.
  *
  *  Does NOT recurse into `&&` — callers that need to detect optional checks
  *  inside `&&` conditions should check `cond.left` explicitly. */
@@ -141,6 +143,19 @@ function detectOptionalCheck(cond, ctx) {
     }
     return null;
 }
+/** Collect all optional narrowings from an early-return condition.
+ *  Handles single checks (x === undefined) and compound || chains
+ *  (x === undefined || y === undefined). */
+function collectEarlyReturnNarrowings(cond, ctx) {
+    if (cond.kind === "binop" && cond.op === "||") {
+        return [...collectEarlyReturnNarrowings(cond.left, ctx), ...collectEarlyReturnNarrowings(cond.right, ctx)];
+    }
+    const narrowed = detectOptionalCheck(cond, ctx);
+    if (narrowed && !narrowed.inThen && !narrowed.fieldExpr) {
+        return [{ varName: narrowed.varName, innerTy: narrowed.innerTy }];
+    }
+    return [];
+}
 /** TS reference types that become value types in Dafny/Lean — const bindings need mutable var. */
 function isRefMutableInTS(ty) {
     return ty.kind === "array" || ty.kind === "map" || ty.kind === "set";
@@ -389,8 +404,21 @@ function resolveExpr(e, ctx) {
                 fn.obj.ty.elem.kind === "user") {
                 argCtx = { ...ctx, returnTy: fn.obj.ty.elem };
             }
-            const args = coerceCallArgs(rawArgs.map(a => resolveExpr(a, argCtx)), fn, ctx);
-            const ty = inferMethodReturnTy(fn, args, ctx);
+            // Propagate parameter types to arguments for record literal resolution
+            // (enables inline discriminated union construction in function arguments)
+            const paramTypes = fn.kind === "var" && ctx.fnParams.has(fn.name) ? ctx.fnParams.get(fn.name) : null;
+            const args = coerceCallArgs(rawArgs.map((a, i) => {
+                let aCtx = argCtx;
+                if (paramTypes && i < paramTypes.length && paramTypes[i].kind === "user") {
+                    aCtx = { ...aCtx, returnTy: paramTypes[i] };
+                }
+                return resolveExpr(a, aCtx);
+            }), fn, ctx);
+            let ty = inferMethodReturnTy(fn, args, ctx);
+            // For same-file function calls, use the known return type
+            if (ty.kind === "unknown" && fn.kind === "var" && ctx.fnReturns.has(fn.name)) {
+                ty = ctx.fnReturns.get(fn.name);
+            }
             return { kind: "call", fn, args, ty, callKind: classifyCall(e.fn, ctx) };
         }
         case "index": {
@@ -405,16 +433,24 @@ function resolveExpr(e, ctx) {
             const obj = resolveExpr(e.obj, ctx);
             let isDiscriminant = false;
             let ty = { kind: "unknown" };
-            if (e.field === "length" && (obj.ty.kind === "array" || obj.ty.kind === "string")) {
+            // Check narrowed field context (from conditional optional checks on field chains)
+            if (obj.kind === "var" && ctx.narrowedFields.length > 0) {
+                const nf = ctx.narrowedFields.find(n => n.objName === obj.name && n.fieldName === e.field);
+                if (nf)
+                    ty = nf.narrowedTy;
+            }
+            if (ty.kind === "unknown" && e.field === "length" && (obj.ty.kind === "array" || obj.ty.kind === "string")) {
                 ty = { kind: "nat" };
             }
-            else if (e.field === "size" && (obj.ty.kind === "map" || obj.ty.kind === "set")) {
+            else if (ty.kind === "unknown" && e.field === "size" && (obj.ty.kind === "map" || obj.ty.kind === "set")) {
                 ty = { kind: "nat" };
             }
-            else if (obj.ty.kind === "user") {
-                if (getDiscriminant(ctx, obj.ty.name) === e.field)
+            else if (ty.kind === "unknown" && obj.ty.kind === "user") {
+                // Strip generic args for type lookup: "Result<Model, Err>" → "Result"
+                const baseTyName = obj.ty.name.includes("<") ? obj.ty.name.slice(0, obj.ty.name.indexOf("<")) : obj.ty.name;
+                if (getDiscriminant(ctx, baseTyName) === e.field)
                     isDiscriminant = true;
-                const decl = findDecl(ctx, obj.ty.name);
+                const decl = findDecl(ctx, baseTyName);
                 if (decl?.kind === "record") {
                     const f = decl.fields?.find(f => f.name === e.field);
                     if (f)
@@ -442,8 +478,13 @@ function resolveExpr(e, ctx) {
             // Clear returnTy for field values — it applies to THIS record, not nested ones
             const fieldCtx = recordTy ? { ...ctx, returnTy: { kind: "unknown" } } : ctx;
             const fields = e.fields.map(f => {
-                let value = resolveExpr(f.value, fieldCtx);
                 const fieldDecl = decl?.fields?.find(df => df.name === f.name);
+                // Propagate declared field type into context so nested records resolve
+                // their union variant correctly (e.g., { kind: 'Idle' } → EffectMode.Idle)
+                const valueCtx = (fieldDecl?.type?.kind === "user")
+                    ? { ...fieldCtx, returnTy: fieldDecl.type }
+                    : fieldCtx;
+                let value = resolveExpr(f.value, valueCtx);
                 if (fieldDecl) {
                     const declTy = fieldDecl.type;
                     value = coerceStr(value, declTy);
@@ -499,7 +540,6 @@ function resolveExpr(e, ctx) {
         case "conditional": {
             const cond = resolveExpr(e.cond, ctx);
             let narrowedVar;
-            let narrowedExprResolved;
             let thenCtx = ctx;
             let rawThen = e.then;
             // Phase 1: Optional truthiness — cond itself is optional (e.g. opt ? X : Y)
@@ -515,23 +555,56 @@ function resolveExpr(e, ctx) {
                     thenCtx = withEnv(ctx, extend(ctx.env, narrowedVar, innerTy));
                 }
             }
-            // Phase 2: Explicit check — v !== undefined (simple vars, field chains,
-            // complex expressions all handled uniformly by detectOptionalCheck)
+            // Phase 2/3: Explicit check — v !== undefined, or && with optional check.
+            // Resolve only narrows the type environment; transform handles all structural
+            // narrowing (match generation, variable binding, && splitting).
+            let narrowedExprResolved;
+            let elseCtx = ctx;
             if (!narrowedVar) {
                 const narrowed = detectOptionalCheck(e.cond, ctx)
-                    // Phase 3: && with optional check — (v !== undefined && ...) ? ... : ...
                     ?? (e.cond.kind === "binop" && e.cond.op === "&&" ? detectOptionalCheck(e.cond.left, ctx) : null);
                 if (narrowed && narrowed.inThen) {
-                    narrowedVar = narrowed.varName;
-                    thenCtx = withEnv(ctx, extend(ctx.env, narrowed.varName, narrowed.innerTy));
-                    if (narrowed.fieldExpr) {
+                    if (!narrowed.fieldExpr) {
+                        // Simple var: extend env only — transform will detect and generate match
+                        thenCtx = withEnv(thenCtx, extend(thenCtx.env, narrowed.varName, narrowed.innerTy));
+                    }
+                    else if (narrowed.fieldExpr.kind === "field" && narrowed.fieldExpr.obj.kind === "var") {
+                        // Simple field chain (obj.field): narrow via field context — no substitution
+                        thenCtx = {
+                            ...thenCtx,
+                            narrowedFields: [...thenCtx.narrowedFields, {
+                                    objName: narrowed.fieldExpr.obj.name,
+                                    fieldName: narrowed.fieldExpr.field,
+                                    narrowedTy: narrowed.innerTy,
+                                }],
+                        };
+                    }
+                    else {
+                        // Complex expression (call result, deep chain, etc.): transform can't detect these,
+                        // so keep old behavior — substitute + narrowedVar + narrowedExpr
+                        narrowedVar = narrowed.varName;
                         narrowedExprResolved = narrowed.narrowedExpr ?? resolveExpr(narrowed.fieldExpr, ctx);
                         rawThen = substituteRawExpr(e.then, narrowed.fieldExpr, { kind: "var", name: narrowed.varName });
+                        thenCtx = withEnv(thenCtx, extend(thenCtx.env, narrowed.varName, narrowed.innerTy));
+                    }
+                }
+                else if (narrowed && !narrowed.inThen && !narrowed.fieldExpr) {
+                    // v === undefined: narrow v in the else branch
+                    elseCtx = withEnv(elseCtx, extend(elseCtx.env, narrowed.varName, narrowed.innerTy));
+                }
+                // Compound || with === undefined: narrow all checked vars in else branch
+                // e.g. if (a === undefined || b === undefined) then X else Y → narrow a,b in Y
+                // TODO: resolve-time narrowing works but transform doesn't emit match unwrap
+                // for || conditions yet — decompose || into nested matches in transform.
+                // Workaround: split || into separate if guards in user code.
+                if (!narrowed && e.cond.kind === "binop" && e.cond.op === "||") {
+                    for (const n of collectEarlyReturnNarrowings(e.cond, ctx)) {
+                        elseCtx = withEnv(elseCtx, extend(elseCtx.env, n.varName, n.innerTy));
                     }
                 }
             }
             let then_ = resolveExpr(rawThen, thenCtx);
-            let else_ = resolveExpr(e.else, ctx);
+            let else_ = resolveExpr(e.else, elseCtx);
             then_ = coerceStr(then_, else_.ty);
             else_ = coerceStr(else_, then_.ty);
             let ty = then_.ty.kind !== "unknown" ? then_.ty : else_.ty;
@@ -543,8 +616,7 @@ function resolveExpr(e, ctx) {
                 ty = { kind: "optional", inner: then_.ty };
             }
             // When narrowedExpr is set AND a branch is void, the match produces Optional
-            const hasVoidBranch = then_.ty.kind === "void" || else_.ty.kind === "void";
-            if (narrowedExprResolved && hasVoidBranch && ty.kind !== "optional") {
+            if (narrowedExprResolved && (then_.ty.kind === "void" || else_.ty.kind === "void") && ty.kind !== "optional") {
                 ty = { kind: "optional", inner: ty };
             }
             return { kind: "conditional", cond, then: then_, else: else_, ty, narrowedVar, narrowedExpr: narrowedExprResolved };
@@ -585,12 +657,13 @@ function resolveBlock(stmts, ctx) {
         result.push(typed);
         env = nextEnv;
         // Flow narrowing: if (x === undefined) { return } narrows x for rest of block.
+        // Also handles compound: if (x === undefined || y === undefined) { return }
         // Field chains are excluded — resolve can't substitute in statement lists;
         // transform's emitOptionalMatch handles field chains in statement contexts.
         if (s.kind === "if" && s.then.length > 0 && s.then[s.then.length - 1].kind === "return" && s.else.length === 0) {
-            const narrowed = detectOptionalCheck(s.cond, withEnv(ctx, env));
-            if (narrowed && !narrowed.inThen && !narrowed.fieldExpr) {
-                env = extend(env, narrowed.varName, narrowed.innerTy);
+            const narrowings = collectEarlyReturnNarrowings(s.cond, withEnv(ctx, env));
+            for (const n of narrowings) {
+                env = extend(env, n.varName, n.innerTy);
             }
         }
     }
@@ -600,7 +673,10 @@ function resolveStmt(s, ctx) {
     switch (s.kind) {
         case "let": {
             const declTy = resolveTsType(s.tsType, ctx.overrides, s.name);
-            const init = coerceStr(resolveExpr(s.init, ctx), declTy);
+            // Propagate declared type as returnTy so nested record expressions
+            // resolve union variants correctly (e.g., EffectState → mode: EffectMode → { kind: 'Idle' })
+            const initCtx = declTy.kind === "user" ? { ...ctx, returnTy: declTy } : ctx;
+            const init = coerceStr(resolveExpr(s.init, initCtx), declTy);
             // Map indexing: TS says T, but access can fail → use Optional<T> from init
             const ty = (declTy.kind !== "optional" && init.ty.kind === "optional") ? init.ty : declTy;
             // const collections are mutable in value-semantics world (TS mutates in place, Dafny/Lean reassign)
@@ -833,6 +909,8 @@ function collectCallsStmts(stmts, fns, out) {
 }
 function computePureFns(functions) {
     const allFnNames = new Set(functions.map(fn => fn.name));
+    // //@ pure functions are always considered pure — never taint callers
+    const forcePure = new Set(functions.filter(fn => fn.pure).map(fn => fn.name));
     // Build call graph: fn → set of same-file functions it calls
     const callGraph = new Map();
     for (const fn of functions) {
@@ -840,8 +918,8 @@ function computePureFns(functions) {
         collectCallsStmts(fn.body, allFnNames, calls);
         callGraph.set(fn.name, calls);
     }
-    // Seed: syntactically non-pure functions
-    const nonPure = new Set(functions.filter(fn => !isSyntacticallyPure(fn.body)).map(fn => fn.name));
+    // Seed: syntactically non-pure functions (skip //@ pure)
+    const nonPure = new Set(functions.filter(fn => !forcePure.has(fn.name) && !isSyntacticallyPure(fn.body)).map(fn => fn.name));
     // Build reverse graph: fn → set of functions that call it
     const callers = new Map();
     for (const name of allFnNames)
@@ -850,12 +928,12 @@ function computePureFns(functions) {
         for (const callee of callees)
             callers.get(callee).add(caller);
     }
-    // Propagate impurity through reverse call graph
+    // Propagate impurity through reverse call graph (skip //@ pure)
     const worklist = [...nonPure];
     while (worklist.length > 0) {
         const fn = worklist.pop();
         for (const caller of callers.get(fn) ?? []) {
-            if (!nonPure.has(caller)) {
+            if (!nonPure.has(caller) && !forcePure.has(caller)) {
                 nonPure.add(caller);
                 worklist.push(caller);
             }
@@ -888,7 +966,7 @@ function containsReturn(stmts) {
     return false;
 }
 // ── Resolve function / module ────────────────────────────────
-function resolveFunction(fn, typeDecls, pureFns, fnParams = new Map(), opts) {
+function resolveFunction(fn, typeDecls, pureFns, fnParams = new Map(), fnReturns = new Map(), opts) {
     const overrides = new Map(fn.typeAnnotations.map(a => [a.name, a.type]));
     const params = fn.params.map(p => ({ name: p.name, ty: resolveTsType(p.tsType, overrides, p.name) }));
     const returnTy = resolveTsType(fn.returnType, overrides, "\\result");
@@ -897,7 +975,7 @@ function resolveFunction(fn, typeDecls, pureFns, fnParams = new Map(), opts) {
         env = extend(env, opts.thisBinding.name, opts.thisBinding.ty);
     for (const p of params)
         env = extend(env, p.name, p.ty);
-    const baseCtx = { env, typeDecls, overrides, allowResult: false, returnTy, pureFns, fnParams, inSpec: false, inLambda: false };
+    const baseCtx = { env, typeDecls, overrides, allowResult: false, returnTy, pureFns, fnParams, fnReturns, inSpec: false, inLambda: false, narrowedFields: [] };
     const requiresCtx = { ...baseCtx, inSpec: true };
     const ensuresCtx = { ...baseCtx, allowResult: true, inSpec: true };
     // Apply type parameter constraints from //@ type T (==) annotations
@@ -909,17 +987,19 @@ function resolveFunction(fn, typeDecls, pureFns, fnParams = new Map(), opts) {
         name: fn.name, typeParams, params, returnTy,
         requires: resolveSpecs(fn.requires, requiresCtx),
         ensures: resolveSpecs(fn.ensures, ensuresCtx),
+        decreases: fn.decreases ? resolveSpec(fn.decreases, requiresCtx) : null,
         isPure: opts?.forcePure !== undefined ? opts.forcePure : pureFns.has(fn.name),
+        forcePure: fn.pure,
         body: resolveBlock(fn.body, baseCtx),
     };
 }
-function resolveClass(cls, typeDecls, pureFns, fnParams = new Map()) {
+function resolveClass(cls, typeDecls, pureFns, fnParams = new Map(), fnReturns = new Map()) {
     const fields = cls.fields.map(f => ({ name: f.name, ty: parseTsType(f.tsType) }));
     // Create a synthetic record type for 'this' so field access resolves
     const thisType = { kind: "user", name: cls.name };
     const thisDecl = { name: cls.name, kind: "record", fields: cls.fields.map(f => ({ name: f.name, tsType: f.tsType, type: parseTsType(f.tsType) })) };
     const allTypeDecls = [...typeDecls, thisDecl];
-    const methods = cls.methods.map(fn => resolveFunction(fn, allTypeDecls, pureFns, fnParams, {
+    const methods = cls.methods.map(fn => resolveFunction(fn, allTypeDecls, pureFns, fnParams, fnReturns, {
         thisBinding: { name: "this", ty: thisType },
         forcePure: false, // class methods are never pure (they access this)
     }));
@@ -941,15 +1021,18 @@ function precomputeFieldTypes(typeDecls) {
     }
 }
 export function resolveModule(raw) {
+    _synVarCounter = 0;
     precomputeFieldTypes(raw.typeDecls);
     const pureFns = computePureFns(raw.functions);
-    // Pre-compute function parameter types for optional coercion
+    // Pre-compute function parameter and return types
     const fnParams = new Map();
+    const fnReturns = new Map();
     for (const fn of raw.functions) {
         const overrides = new Map(fn.typeAnnotations.map(a => [a.name, a.type]));
         fnParams.set(fn.name, fn.params.map(p => resolveTsType(p.tsType, overrides, p.name)));
+        fnReturns.set(fn.name, resolveTsType(fn.returnType, overrides, "\\result"));
     }
-    const emptyCtx = { env: null, typeDecls: raw.typeDecls, overrides: new Map(), allowResult: false, returnTy: { kind: "int" }, pureFns, fnParams, inSpec: false, inLambda: false };
+    const emptyCtx = { env: null, typeDecls: raw.typeDecls, overrides: new Map(), allowResult: false, returnTy: { kind: "int" }, pureFns, fnParams, fnReturns, inSpec: false, inLambda: false, narrowedFields: [] };
     const constants = (raw.constants ?? []).map(c => ({
         name: c.name,
         ty: parseTsType(c.tsType),
@@ -959,7 +1042,7 @@ export function resolveModule(raw) {
         file: raw.file,
         typeDecls: raw.typeDecls,
         constants,
-        functions: raw.functions.map(fn => resolveFunction(fn, raw.typeDecls, pureFns, fnParams)),
-        classes: (raw.classes ?? []).map(cls => resolveClass(cls, raw.typeDecls, pureFns, fnParams)),
+        functions: raw.functions.map(fn => resolveFunction(fn, raw.typeDecls, pureFns, fnParams, fnReturns)),
+        classes: (raw.classes ?? []).map(cls => resolveClass(cls, raw.typeDecls, pureFns, fnParams, fnReturns)),
     };
 }

package/tools/dist/transform.js

@@ -58,7 +58,10 @@ function mapStmt(s, f) {
         case "break":
         case "continue": return s;
         case "if": return { ...s, cond: r(s.cond), then: s.then.map(t => mapStmt(t, f)), else: s.else.map(t => mapStmt(t, f)) };
-        case "match": return { ...s, arms: s.arms.map(a => ({ ...a, body: a.body.map(t => mapStmt(t, f)) })) };
+        case "match": {
+            const scr = typeof s.scrutinee === "string" ? s.scrutinee : r(s.scrutinee);
+            return { ...s, scrutinee: scr, arms: s.arms.map(a => ({ ...a, body: a.body.map(t => mapStmt(t, f)) })) };
+        }
         case "while": return { ...s, cond: r(s.cond), invariants: s.invariants.map(r), body: s.body.map(t => mapStmt(t, f)) };
         case "forin": return { ...s, bound: r(s.bound), invariants: s.invariants.map(r), body: s.body.map(t => mapStmt(t, f)) };
         case "ghostLet": return { ...s, value: r(s.value) };
@@ -347,6 +350,18 @@ function lowerExpr(e, binds) {
                 return { kind: "field", obj: transformExpr(e.obj), field: "length" };
             if (e.field === "size" && (e.obj.ty.kind === "map" || e.obj.ty.kind === "set"))
                 return { kind: "field", obj: transformExpr(e.obj), field: "collectionSize" };
+            // Boolean discriminant bare access: `result.ok` where Result has variants
+            // {ok: true, ...} | {ok: false, ...}. String discriminants are always used via
+            // comparison (x.kind === 'Foo' → x.Foo?), but boolean discriminants are used
+            // as bare truthiness checks. Emit as the Dafny discriminator predicate for the
+            // 'true' variant: result.ok → result.true_?
+            if (e.isDiscriminant && e.obj.ty.kind === "user") {
+                const baseName = e.obj.ty.name.includes("<") ? e.obj.ty.name.slice(0, e.obj.ty.name.indexOf("<")) : e.obj.ty.name;
+                const decl = _typeDecls.find(d => d.name === baseName && d.kind === "discriminated-union");
+                if (decl?.variants?.some(v => v.name === "true")) {
+                    return { kind: "field", obj: transformExpr(e.obj), field: "true_?" };
+                }
+            }
             return { kind: "field", obj: transformExpr(e.obj), field: e.field };
         case "index": {
             const idx = transformExpr(e.idx);
@@ -397,6 +412,15 @@ function lowerExpr(e, binds) {
                 if (method === "get" && e.fn.obj.ty.kind === "map" && e.ty.kind !== "optional") {
                     method = "getDirect";
                 }
+                // map.set(k, v): if v is an Optional-wrapped map get, unwrap to getDirect
+                // (the desugared spread { ...m, [k]: m2[k] } becomes m.set(k, m2.get(k)),
+                // but the value should be direct access, not Optional)
+                if (method === "set" && e.fn.obj.ty.kind === "map" && args.length === 2) {
+                    const val = args[1];
+                    if (val.kind === "methodCall" && val.method === "get" && val.objTy.kind === "map") {
+                        args[1] = { ...val, method: "getDirect" };
+                    }
+                }
                 // Check if any lambda arg has monadic body
                 const needsMonadic = _opts.monadic && args.some(a => a.kind === "lambda" && isMonadicBody(a.body));
                 const result = { kind: "methodCall", obj: recv, objTy: e.fn.obj.ty, method, args, monadic: needsMonadic };
@@ -479,6 +503,10 @@ function lowerExpr(e, binds) {
                 });
                 return { kind: "record", spread: lowerExpr(e.spread, binds), fields: loweredFields };
             }
+            // Empty record with map type → empty map
+            if (e.fields.length === 0 && !e.spread && e.ty.kind === "map") {
+                return { kind: "emptyMap" };
+            }
             return { kind: "record", spread: null, fields: e.fields.map(f => ({ name: f.name, value: lowerExpr(f.value, binds) })) };
         }
         case "arrayLiteral":
@@ -497,19 +525,16 @@ function lowerExpr(e, binds) {
         case "exists":
             return { kind: "exists", var: e.var, type: e.varTy, body: transformExpr(e.body) };
         case "conditional": {
-            // When narrowedExpr is set, the match replaces the condition — don't lift from it
-            const condBinds = (e.narrowedVar && e.narrowedExpr) ? null : binds;
-            const cond = lowerExpr(e.cond, condBinds);
-            let thenExpr = lowerExpr(e.then, binds);
-            let elseExpr = lowerExpr(e.else, binds);
-            // Explicit !== undefined with narrowedExpr → match Some/None on the optional expression
+            // Phase 0: Complex expression check (call results, etc.) — resolve substituted
+            // and set narrowedVar + narrowedExpr because transform can't detect these.
             if (e.narrowedVar && e.narrowedExpr) {
                 const scrutinee = lowerExpr(e.narrowedExpr, binds);
                 const bound = matchBinder(e.narrowedVar);
+                let thenExpr = lowerExpr(e.then, binds);
+                let elseExpr = lowerExpr(e.else, binds);
                 if (bound !== e.narrowedVar) {
                     thenExpr = replaceVar(thenExpr, e.narrowedVar, { kind: "var", name: bound });
                 }
-                // Wrap in Some/None only when result is optional (one branch is undefined)
                 if (e.ty.kind === "optional") {
                     thenExpr = wrapOptionalBranch(thenExpr, e.then);
                     elseExpr = wrapOptionalBranch(elseExpr, e.else);
@@ -522,14 +547,16 @@ function lowerExpr(e, binds) {
                     ],
                 };
             }
-            // Optional cond with narrowedVar → match Some/None (truthiness)
+            // Phase 1: Truthiness — cond itself is optional (e.g. opt ? X : Y)
+            // Uses narrowedVar set by resolve's Phase 1 (unchanged).
             if (e.narrowedVar && e.cond.ty.kind === "optional") {
+                const cond = lowerExpr(e.cond, binds);
+                let thenExpr = lowerExpr(e.then, binds);
+                let elseExpr = lowerExpr(e.else, binds);
                 const bound = matchBinder(e.narrowedVar);
-                // Replace the synthetic/narrowed var with the match-bound name
                 if (bound !== e.narrowedVar) {
                     thenExpr = replaceVar(thenExpr, e.narrowedVar, { kind: "var", name: bound });
                 }
-                // The match produces an Optional: wrap branches in Some/None.
                 thenExpr = wrapOptionalBranch(thenExpr, e.then);
                 elseExpr = wrapOptionalBranch(elseExpr, e.else);
                 return {
@@ -540,7 +567,26 @@ function lowerExpr(e, binds) {
                     ],
                 };
             }
-            // Non-optional: regular if with optional wrapping
+            // Phase 2: Explicit check — x !== undefined ? A : B
+            // Transform detects the pattern itself (no narrowedVar/narrowedExpr from resolve).
+            const check = parseOptionalCheck(e.cond);
+            if (check && !check.negated) {
+                return lowerOptionalConditional(e, check, null, binds);
+            }
+            // Phase 3: && with optional check — x !== undefined && guard(x) ? A : B
+            if (e.cond.kind === "binop" && e.cond.op === "&&") {
+                const extracted = extractLeftmostOptional(e.cond);
+                if (extracted) {
+                    const innerCheck = parseOptionalCheck(extracted.optCond);
+                    if (innerCheck && !innerCheck.negated) {
+                        return lowerOptionalConditional(e, innerCheck, extracted.rest, binds);
+                    }
+                }
+            }
+            // Phase 4: Regular conditional (no optional narrowing)
+            const cond = lowerExpr(e.cond, binds);
+            let thenExpr = lowerExpr(e.then, binds);
+            let elseExpr = lowerExpr(e.else, binds);
             if (e.ty.kind === "optional") {
                 thenExpr = wrapOptionalBranch(thenExpr, e.then);
                 elseExpr = wrapOptionalBranch(elseExpr, e.else);
@@ -644,13 +690,13 @@ function transformStmts(stmts, typeDecls) {
             if (s.names.length === 1 && s.iterable.ty.kind === "map") {
                 const keyName = s.names[0];
                 const keyTy = s.nameTypes[0] ?? s.iterable.ty.key ?? { kind: "unknown" };
-                const keysSeqName = `_${keyName}_keys`;
-                const convExpr = { kind: "app", fn: "SetToSeq", args: [{ kind: "field", obj: iterExpr, field: "keys" }] };
-                result.push({ kind: "let", name: keysSeqName, type: { kind: "array", elem: keyTy }, mutable: false, value: convExpr });
-                const keysVar = { kind: "var", name: keysSeqName };
                 const count = _forofCounters.get(keyName) ?? 0;
                 _forofCounters.set(keyName, count + 1);
                 const suffix = count === 0 ? "" : `${count + 1}`;
+                const keysSeqName = `_${keyName}_keys${suffix}`;
+                const convExpr = { kind: "app", fn: "SetToSeq", args: [{ kind: "field", obj: iterExpr, field: "keys" }] };
+                result.push({ kind: "let", name: keysSeqName, type: { kind: "array", elem: keyTy }, mutable: false, value: convExpr });
+                const keysVar = { kind: "var", name: keysSeqName };
                 const idxName = `_${keyName}_idx${suffix}`;
                 const idx = { kind: "var", name: idxName };
                 const arrSize = { kind: "field", obj: keysVar, field: "size" };
@@ -670,13 +716,13 @@ function transformStmts(stmts, typeDecls) {
                 const keyName = s.names[0], valueName = s.names[1];
                 const keyTy = s.nameTypes[0] ?? { kind: "unknown" };
                 const valueTy = s.nameTypes[1] ?? { kind: "unknown" };
-                const keysSeqName = `_${keyName}_keys`;
-                const convExpr = { kind: "app", fn: "SetToSeq", args: [{ kind: "field", obj: iterExpr, field: "keys" }] };
-                result.push({ kind: "let", name: keysSeqName, type: { kind: "array", elem: keyTy }, mutable: false, value: convExpr });
-                const keysVar = { kind: "var", name: keysSeqName };
                 const count = _forofCounters.get(keyName) ?? 0;
                 _forofCounters.set(keyName, count + 1);
                 const suffix = count === 0 ? "" : `${count + 1}`;
+                const keysSeqName = `_${keyName}_keys${suffix}`;
+                const convExpr = { kind: "app", fn: "SetToSeq", args: [{ kind: "field", obj: iterExpr, field: "keys" }] };
+                result.push({ kind: "let", name: keysSeqName, type: { kind: "array", elem: keyTy }, mutable: false, value: convExpr });
+                const keysVar = { kind: "var", name: keysSeqName };
                 const idxName = `_${keyName}_idx${suffix}`;
                 const idx = { kind: "var", name: idxName };
                 const arrSize = { kind: "field", obj: keysVar, field: "size" };
@@ -798,6 +844,21 @@ function transformStmt(s, typeDecls) {
                     return stmts;
                 }
             }
+            // Desugar: const x = optCheck && guard ? A : B
+            // → var x := B; if (optCheck && guard) { x := A; }
+            // This avoids putting method calls (from guard) inside a match expression,
+            // which Dafny doesn't allow.  The if-case in transformStmt handles the &&
+            // via extractLeftmostOptional → emitOptionalMatch (statement-level match).
+            if (s.init.kind === "conditional" && s.init.cond.kind === "binop" && s.init.cond.op === "&&") {
+                const extracted = extractLeftmostOptional(s.init.cond);
+                if (extracted) {
+                    const desugared = [
+                        { kind: "let", name: s.name, ty: s.ty, mutable: true, init: s.init.else },
+                        { kind: "if", cond: s.init.cond, then: [{ kind: "assign", target: s.name, value: s.init.then }], else: [] },
+                    ];
+                    return desugared.flatMap(ds => transformStmt(ds, typeDecls));
+                }
+            }
             const { binds, expr } = liftMethodCalls(s.init);
             return [...binds, { kind: "let", name: s.name, type: s.ty, mutable: s.mutable, value: expr }];
         }
@@ -945,7 +1006,8 @@ function emitOptionalMatch(varName, negated, s, typeDecls, restStmts, fieldExpr)
     if (someBranch.length === 0 && restStmts && restStmts.length > 0) {
         someBranch = restStmts;
     }
-    const bound = matchBinder(`${varName}_val`);
+    const sanitized = varName.replace(/\./g, "_");
+    const bound = matchBinder(`${sanitized}_val`);
     // Replace the narrowed variable/field in the Some branch body.
     // Field chains: replace in TStmt before transform (so downstream narrowing sees simple vars).
     // Simple vars: replace in IR after transform (the original mechanism).
@@ -959,10 +1021,14 @@ function emitOptionalMatch(varName, negated, s, typeDecls, restStmts, fieldExpr)
     }
     else {
         const transformed = transformStmts(someBranch, typeDecls);
-        someBody = transformed.map(stmt => mapStmtExprs(stmt, e => replaceVar(e, varName, { kind: "var", name: bound })));
+        someBody = transformed.map(stmt => mapStmtExprs(stmt, e => replaceVar(e, varName, { kind: "var", name: bound }, true)));
     }
+    // For field chains, use an Expr scrutinee so outer match replaceVar can
+    // substitute the object variable (e.g. task → i_task_val in task.deletedFromList).
+    // String scrutinees are opaque to replaceVar/mapExpr.
+    const scrutinee = fieldExpr ? transformExpr(fieldExpr) : varName;
     return {
-        kind: "match", scrutinee: varName,
+        kind: "match", scrutinee,
         arms: [
             { pattern: `.some ${bound}`, body: someBody },
             { pattern: ".none", body: noneBranch.length > 0 ? transformStmts(noneBranch, typeDecls) : [] },
@@ -975,25 +1041,21 @@ function mapStmtExprs(s, r) {
 }
 // ── Optional narrowing helpers ──────────────────────────────
 //
-// Optional narrowing converts TS `if (x === undefined)` patterns to Dafny
-// `match x { Some(val) => ..., None => ... }`.
+// Optional narrowing converts TS `if (x === undefined)` / `x !== undefined ? a : b`
+// patterns to `match x { Some(val) => ..., None => ... }`.
 //
-// The resolve phase (resolve.ts) handles:
+// The resolve phase (resolve.ts) handles TYPE narrowing only:
 //   - Flow narrowing: after `if (x === undefined) return`, x is non-optional
 //   - && narrowing: in `x !== undefined && f(x)`, f(x) sees x as non-optional
-//   - Conditional narrowing: in `x !== undefined ? x.field : default`, sets
-//     narrowedVar/narrowedExpr on TExpr for the transform phase
+//   - Conditional type narrowing: extends env (simple vars) or narrowedFields context
+//     (field chains) so the then-branch resolves with the unwrapped type
 //
-// The transform phase (here) handles:
+// The transform phase (here) handles ALL structural narrowing:
 //   - Statement-level: `transformStmts` detects optional checks → `emitOptionalMatch`
-//   - Expression-level: `lowerExpr` conditional reads narrowedVar/narrowedExpr → match
-//   - && restructuring: `extractLeftmostOptional` splits `&&` chains into nested ifs
-//     so `emitOptionalMatch` can detect the inner optional check
-//
-// Both phases detect `v !== undefined` patterns. The resolve phase uses
-// `detectOptionalCheck` (on RawExpr), the transform uses `parseOptionalCheck` (on TExpr).
-// These are separate because they operate on different IR types, but both handle
-// simple variables and field access chains.
+//   - Expression-level: `lowerExpr` detects optional checks via `parseOptionalCheck`
+//     and `extractLeftmostOptional` → `lowerOptionalConditional`
+//   - && restructuring: `extractLeftmostOptional` splits `&&` chains, generating
+//     match with guard: `match x { Some(val) => if guard then A else B, None => B }`
 /** Shared logic for optional match in both imperative and pure function paths.
  *  Detects optional check, selects branches, handles early-return consumption.
  *  Returns null if the condition is not an optional check. */
@@ -1006,7 +1068,8 @@ function prepareOptionalMatch(s, restStmts) {
     // Early-return pattern: Some branch is empty → consume rest of block
     if (someBranch.length === 0 && restStmts.length > 0)
         someBranch = restStmts;
-    const bound = matchBinder(`${check.varName}_val`);
+    const sanitized = check.varName.replace(/\./g, "_");
+    const bound = matchBinder(`${sanitized}_val`);
     return { check, someBranch, noneBranch, bound };
 }
 /** Extract the leftmost optional check from a && chain, returning the check and the rest.
@@ -1120,6 +1183,96 @@ function replaceFieldAccessInTStmts(stmts, varName, fields) {
         fallbackTy: f.type ?? parseTsType(f.tsType),
     })));
 }
+/** Replace obj.field → replacement var in typed IR expressions (before lowering).
+ *  Mirrors replaceFieldsInTStmts but operates on a single TExpr tree. */
+function replaceFieldInTExpr(expr, objName, replacements) {
+    if (replacements.length === 0)
+        return expr;
+    return mapTExpr(expr, e => {
+        if (e.kind === "field" && e.obj.kind === "var" && e.obj.name === objName) {
+            const r = replacements.find(r => r.fieldName === e.field);
+            if (r) {
+                const ty = e.ty.kind !== "unknown" ? e.ty : r.fallbackTy;
+                return { kind: "var", name: r.newName, ty };
+            }
+        }
+        return null;
+    });
+}
+/** Unwrap optional type on match-bound variables in TExpr.
+ *  After replaceFieldInTExpr, the replaced variable carries the original optional
+ *  type from the field declaration. The match binding unwraps it to the inner type. */
+function fixBoundType(expr, boundName) {
+    return mapTExpr(expr, e => e.kind === "var" && e.name === boundName && e.ty.kind === "optional"
+        ? { ...e, ty: e.ty.inner } : null);
+}
+/** Lower a conditional with an optional check (Phase 2: explicit, Phase 3: && with guard).
+ *  Generates: match scrutinee { Some(val) => [if guard then] A [else B], None => B }
+ *  For field chains, replaces field accesses in TExpr before lowering.
+ *  For simple vars, replaces variable names in Expr after lowering. */
+function lowerOptionalConditional(e, check, guard, binds) {
+    const sanitized = check.varName.replace(/\./g, "_");
+    const bound = matchBinder(`${sanitized}_val`);
+    const isFieldChain = check.fieldExpr && check.fieldExpr.kind === "field" &&
+        check.fieldExpr.obj.kind === "var";
+    // Determine which branch is Some (unwrapped) vs None
+    let thenTExpr = e.then;
+    let guardTExpr = guard;
+    // For field chains: replace field access with bound var in TExpr before lowering
+    if (isFieldChain) {
+        const fe = check.fieldExpr;
+        const innerTy = fe.ty.kind === "optional" ? fe.ty.inner : fe.ty;
+        const replacements = [{ fieldName: fe.field, newName: bound, fallbackTy: innerTy }];
+        thenTExpr = fixBoundType(replaceFieldInTExpr(thenTExpr, fe.obj.name, replacements), bound);
+        if (guardTExpr) {
+            guardTExpr = fixBoundType(replaceFieldInTExpr(guardTExpr, fe.obj.name, replacements), bound);
+        }
+    }
+    let thenExpr = lowerExpr(thenTExpr, binds);
+    let elseExpr = lowerExpr(e.else, binds);
+    // For simple vars: replace after lowering
+    if (!isFieldChain) {
+        thenExpr = replaceVar(thenExpr, check.varName, { kind: "var", name: bound }, true);
+    }
+    // Optional wrapping: check if either branch is undefined (produces optional result)
+    const isOptionalResult = (e.then.kind === "var" && e.then.name === "undefined") ||
+        (e.else.kind === "var" && e.else.name === "undefined");
+    if (isOptionalResult) {
+        thenExpr = wrapOptionalBranch(thenExpr, e.then);
+        elseExpr = wrapOptionalBranch(elseExpr, e.else);
+    }
+    // Build Some arm body — add guard for && patterns
+    // Note: if the guard has method calls, the impure path desugars the let to a
+    // statement-level if+match in transformStmt, so this expression-level path only
+    // runs for pure guards. Use null for binds to avoid escaping the match scope.
+    let someBody;
+    if (guard) {
+        let guardExpr = lowerExpr(guardTExpr, null);
+        if (!isFieldChain) {
+            guardExpr = replaceVar(guardExpr, check.varName, { kind: "var", name: bound }, true);
+        }
+        // Guard-else gets the same expression as None arm
+        let guardElse = lowerExpr(e.else, null);
+        if (isOptionalResult) {
+            guardElse = wrapOptionalBranch(guardElse, e.else);
+        }
+        someBody = { kind: "if", cond: guardExpr, then: thenExpr, else: guardElse };
+    }
+    else {
+        someBody = thenExpr;
+    }
+    // Build scrutinee
+    const scrutinee = isFieldChain
+        ? lowerExpr(check.fieldExpr, binds)
+        : check.varName;
+    return {
+        kind: "match", scrutinee,
+        arms: [
+            { pattern: `.some ${bound}`, body: someBody },
+            { pattern: ".none", body: elseExpr },
+        ],
+    };
+}
 // ── Pure function generation ─────────────────────────────────
 function transformPureBody(stmts, typeDecls) {
     // Detect discriminant if-chain
@@ -1140,16 +1293,42 @@ function transformPureBody(stmts, typeDecls) {
                 return { kind: "let", name: s.name, value: transformExpr(s.init), body: restExpr };
             }
             case "if": {
+                // Restructure && with optional check: split into nested ifs so
+                // prepareOptionalMatch can detect the optional check and bind the unwrapped value
+                if (s.cond.kind === "binop" && s.cond.op === "&&" && s.else.length === 0) {
+                    const extracted = extractLeftmostOptional(s.cond);
+                    if (extracted) {
+                        const innerIf = { kind: "if", cond: extracted.rest, then: s.then, else: [] };
+                        const outerIf = { kind: "if", cond: extracted.optCond, then: [innerIf], else: [] };
+                        return transformPureBody([outerIf, ...rest], typeDecls);
+                    }
+                }
                 // Optional narrowing: if (x === undefined) → match x { None => ..., Some(x_val) => ... }
                 const optMatch = prepareOptionalMatch(s, rest);
                 if (optMatch) {
-                    const someExpr = transformPureBody(optMatch.someBranch, typeDecls);
+                    // For field chains (a.dueDate !== undefined), replace in TStmt before transform
+                    let someBranch = [...optMatch.someBranch, ...rest];
+                    const fe = optMatch.check.fieldExpr;
+                    if (fe && fe.kind === "field" && fe.obj.kind === "var") {
+                        const innerTy = fe.ty.kind === "optional" ? fe.ty.inner : fe.ty;
+                        someBranch = replaceFieldsInTStmts(someBranch, fe.obj.name, [
+                            { fieldName: fe.field, newName: optMatch.bound, fallbackTy: innerTy },
+                        ]);
+                        // The replacement keeps the original optional type, but the match binding
+                        // unwraps it. Fix the type so downstream record coercion re-wraps with Some().
+                        someBranch = someBranch.map(s => mapTStmt(s, e => e.kind === "var" && e.name === optMatch.bound && e.ty.kind === "optional"
+                            ? { ...e, ty: e.ty.inner } : null));
+                    }
+                    const someExpr = transformPureBody(someBranch, typeDecls);
                     if (!someExpr)
                         return null;
                     const noneExpr = transformPureBody(optMatch.noneBranch, typeDecls);
                     if (!noneExpr)
                         return null;
-                    const someReplaced = replaceVar(someExpr, optMatch.check.varName, { kind: "var", name: optMatch.bound });
+                    // For simple vars, replace in Expr after transform
+                    const someReplaced = optMatch.check.fieldExpr
+                        ? someExpr
+                        : replaceVar(someExpr, optMatch.check.varName, { kind: "var", name: optMatch.bound }, true);
                     return {
                         kind: "match", scrutinee: optMatch.check.varName,
                         arms: [
@@ -1158,11 +1337,13 @@ function transformPureBody(stmts, typeDecls) {
                         ],
                     };
                 }
-                const thenExpr = transformPureBody(s.then, typeDecls);
+                // Append rest to both branches so nested ifs that fall through
+                // can reach the continuation (e.g. early return inside then-branch)
+                const thenExpr = transformPureBody([...s.then, ...rest], typeDecls);
                 if (!thenExpr)
                     return null;
-                const elseBranch = s.else.length > 0 ? s.else : rest;
-                const elseExpr = transformPureBody(elseBranch, typeDecls);
+                const elseStmts = s.else.length > 0 ? [...s.else, ...rest] : rest;
+                const elseExpr = transformPureBody(elseStmts, typeDecls);
                 if (!elseExpr)
                     return null;
                 return { kind: "if", cond: transformExpr(s.cond), then: thenExpr, else: elseExpr };
@@ -1293,17 +1474,38 @@ function findReassignedNames(stmts, names) {
     return found;
 }
 /** Replace all occurrences of a variable name with a new expression. */
-function replaceVar(e, name, replacement) {
+/**
+ * Replace all occurrences of variable `name` with `replacement`.
+ * If `narrowing` is true, the replacement is an unwrapped Optional value
+ * (e.g., replacing `x: Option<T>` with `x_val: T`). In that case, when the
+ * variable appears directly as a record spread field value, it's wrapped in
+ * Some() to preserve the field's Optional type.
+ */
+function replaceVar(e, name, replacement, narrowing) {
+    const rec = (expr) => replaceVar(expr, name, replacement, narrowing);
     return mapExpr(e, x => {
         if (x.kind === "var" && x.name === name)
             return replacement;
+        // Record spread: wrap direct variable uses in field values with Some when narrowing
+        if (narrowing && x.kind === "record" && x.spread) {
+            return {
+                ...x,
+                spread: rec(x.spread),
+                fields: x.fields.map(f => {
+                    if (f.value.kind === "var" && f.value.name === name) {
+                        return { ...f, value: { kind: "app", fn: "Some", args: [replacement] } };
+                    }
+                    return { ...f, value: rec(f.value) };
+                }),
+            };
+        }
         // Don't descend past bindings that shadow the name
         if (x.kind === "forall" && x.var === name)
             return x;
         if (x.kind === "exists" && x.var === name)
             return x;
         if (x.kind === "let" && x.name === name)
-            return { ...x, value: replaceVar(x.value, name, replacement) };
+            return { ...x, value: replaceVar(x.value, name, replacement, narrowing) };
         return null;
     });
 }
@@ -1344,25 +1546,43 @@ export function transformModule(mod, specImport) {
     }));
     // Pure function mirrors
     const pureDefs = [];
+    const defByMethods = [];
     for (const fn of mod.functions) {
         if (!fn.isPure)
             continue;
         const body = transformPureBody(fn.body, mod.typeDecls);
-        if (!body)
-            continue;
-        // For ensures, replace \result (→ "res") with the function call
-        const fnCall = { kind: "app", fn: fn.name, args: fn.params.map(p => ({ kind: "var", name: p.name })) };
-        const ensures = fn.ensures.map(e => replaceVar(transformExpr(e), "res", fnCall));
-        pureDefs.push({
-            kind: "def",
-            name: fn.name,
-            typeParams: fn.typeParams,
-            params: fn.params.map(p => ({ name: p.name, type: p.ty })),
-            returnType: fn.returnTy,
-            requires: fn.requires.map(transformExpr),
-            ensures,
-            body,
-        });
+        if (body) {
+            // For ensures, replace \result (→ "res") with the function call
+            const fnCall = { kind: "app", fn: fn.name, args: fn.params.map(p => ({ kind: "var", name: p.name })) };
+            const ensures = fn.ensures.map(e => replaceVar(transformExpr(e), "res", fnCall));
+            pureDefs.push({
+                kind: "def",
+                name: fn.name,
+                typeParams: fn.typeParams,
+                params: fn.params.map(p => ({ name: p.name, type: p.ty })),
+                returnType: fn.returnTy,
+                requires: fn.requires.map(transformExpr),
+                ensures,
+                decreases: fn.decreases ? transformExpr(fn.decreases) : null,
+                body,
+            });
+        }
+        else if (fn.forcePure) {
+            // //@ pure but body can't be auto-converted — emit function by method
+            _forofCounters.clear();
+            const methodBody = transformStmts(fn.body, mod.typeDecls);
+            defByMethods.push({
+                kind: "def-by-method",
+                name: fn.name,
+                typeParams: fn.typeParams,
+                params: fn.params.map(p => ({ name: p.name, type: p.ty })),
+                returnType: fn.returnTy,
+                requires: fn.requires.map(transformExpr),
+                ensures: fn.ensures.map(transformExpr),
+                decreases: fn.decreases ? transformExpr(fn.decreases) : null,
+                methodBody,
+            });
+        }
     }
     const base = mod.file.split("/").pop()?.replace(/\.ts$/, "") ?? "module";
     // Types file
@@ -1381,7 +1601,8 @@ export function transformModule(mod, specImport) {
     }
     // Def file: Velvet methods
     // Pure functions get a thin wrapper that calls Pure.fnName
-    const pureDefNames = new Set(pureDefs.map(d => d.name));
+    // def-by-method functions also skip their method wrappers
+    const pureDefNames = new Set([...pureDefs.map(d => d.name), ...defByMethods.map(d => d.name)]);
     const methods = mod.functions.map(fn => {
         const ensures = [];
         for (const e of fn.ensures) {
@@ -1448,7 +1669,7 @@ export function transformModule(mod, specImport) {
             { key: "loom.semantics.termination", value: '"total"' },
             { key: "loom.semantics.choice", value: '"demonic"' },
         ],
-        decls: [...constDecls, ...methods, ...classDecls],
+        decls: [...constDecls, ...defByMethods, ...methods, ...classDecls],
     };
     return { typesFile, defFile };
 }