lemmascript 0.5.0 → 0.5.2

package/README.md

@@ -27,6 +27,12 @@ See the external case studies:
 - **[xyflow-lemmascript](https://github.com/midspiral/xyflow-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield verification of [xyflow](https://github.com/xyflow/xyflow)'s core edge and geometry utilities. 9 functions verified: `addEdge` (dedup — never loses edges, adds at most one), `reconnectEdge` (semantic: under a unique-id precondition, the result is in-place — `|result| ≤ |edges|`, no insertion — *and* when a matching edge existed with non-empty new endpoints, the output contains an edge with those endpoints. Uses `//@ assume` to characterize destructuring, `find`, and the constructed edge), `connectionExists`, `getEdgeCenter` (midpoint correctness), `clamp` (bounds), `rectToBox`/`boxToRect` (field arithmetic), `getBoundsOfBoxes` (enclosure), `getOverlappingArea` (non-negative), `areSetsEqual` (subset + same size). 14 Dafny proof obligations. Dafny only.
 - **[rallly-lemmascript](https://github.com/midspiral/rallly-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield verification of [rallly](https://github.com/lukevella/rallly)'s meeting-poll Next.js app. 2 functions: `validateRedirectUrl` (in-place — open-redirect predicate; non-`undefined` outputs start with `/` but not `//`) and `scorePoll` (extracted ranking core — length preservation, score bounds, top-choice characterization, score-formula equality, within-poll monotonicity, tiebreaker injectivity). The injectivity proof surfaced a real spec-level constraint on the existing `(yes + ifNeedBe) * 1000 + yes` encoding: it overflows when an option has ≥ 1000 yes votes. 10 Dafny VCs, 0 errors. Drove four toolchain additions: `s.startsWith()`, `T | null` nullability, `\result` narrowing under `==>`, `Math.max(...arr)` spread. Dafny only.
 - **[opencode-lemmascript](https://github.com/midspiral/opencode-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield verification of [opencode](https://github.com/anomalyco/opencode)'s permission system and unified-diff patch parser. Highlights: (1) `Patch.parsePatch` carries conservation loop invariants over local ghost state — a parser bug here would silently corrupt user files when an AI applies a patch, and (2) the permission-engine work mechanically closes opencode bug #26514 (subagents bypassing Plan Mode's file-edit restrictions). 9 functions verified in-place, 0 errors. Dafny only.
+- **[pi-lemmascript](https://github.com/midspiral/pi-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield, **in-place** verification of the context-compaction cut-point selector in **pi** (the [earendil-works](https://pi.dev) agent harness). When the context window fills, pi discards history before a chosen cut; a provider API rejects a retained prefix containing an orphaned `toolResult` (a tool result whose tool call was cut away). Both selector functions proven: the cut never lets the kept suffix *start with* — nor *split a tool-use/tool-result run* into — an orphaned tool result, even across the backward metadata snap. The no-orphan result forced the session tree's tool-pairing ordering into an explicit `requires`. 4 VCs, 0 errors. Drove five toolchain additions, headlined by an **opaque fall-through type**: a union LemmaScript can't discriminate (here an array-element union of unreachable imports) becomes a single opaque `type` — the field stays present so distinct values stay distinct, and with no constructor or tag predicate it can only be passed through, never unsoundly observed. Dafny only.
+- **[balanced-match-lemmascript](https://github.com/midspiral/balanced-match-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield, **in-place** verification of [balanced-match](https://github.com/juliangruber/balanced-match), the ~70-line balanced-bracket finder pulled in by `npm`, `webpack`, and most of the JS tooling stack (1B+ downloads/month). The stack-based `range` core is verified by **refinement**: a pure recursive spec `range_spec` mirrors the loop one branch per recursive case, so the single equivalence `range == range_spec` transfers every property automatically — including an unconditional Dyck body-balance theorem for the interior of every returned pair. 2233 VCs, 0 errors under `--isolate-assertions` (registered on the `dafny-slow` track). Dafny only.
+- **[guardians-lemmascript](https://github.com/midspiral/guardians-lemmascript)** — greenfield verification of the core safety argument behind [Guardians](https://github.com/metareflection/guardians) (Erik Meijer, "Guardians of the Agents", CACM Jan 2026), a generate-verify-execute checker for AI-agent workflows. Instead of verifying an app, it proves the agent *guardrail itself sound* — that a static taint/automaton check over the real recursive workflow AST can never admit an unsafe plan. Highlights: taint over **nested conditionals** as a sound branch-union over-approximation; per-source **provenance** with a join (a multi-input tool is tainted if *any* input was); **unbounded loops** discharged by a one-step pre-fixpoint (`sat = t0 ‖ bodyTaint(t0)`) that bounds taint over any iteration count without iterating to a fixpoint; and a **unified capstone** (`verifyWfSound`) — one clean verdict rules out, on *every* path, both a tainted-data-to-sink leak and a security-automaton error. 54 Dafny obligations, 0 errors. The verified cores are reached from a Guardians-style `Workflow`/`Policy` through a thin *unverified* adapter, differentially tested against the real Python Guardians (used as the oracle, not a porting target). Dafny only.
+- **[quorum-lemmascript](https://github.com/midspiral/quorum-lemmascript)** — greenfield verified when2meet/Doodle-style group scheduler (React + Cloudflare Durable Objects), with one `domain.ts` running unchanged in the browser, the in-app query, and the server. The standout is that **the proof licenses the architecture**: `countFree` is a homomorphism from participant-list concatenation to integer addition (so the heatmap is order-independent) plus same-participant last-writer-wins convergence — which is exactly what makes the lock-free, no-login, *optimistic* multi-device backend safe, with the Durable Object and the browser applying the **same** verified `applyOp` (server-authoritatively, client-optimistically) with no rollback or operational transform. Also: heatmap is exactly the per-slot count and `isBest` exactly its argmax; monotonicity; invariant-preserving mutations + op-log `replay`; a sparse export codec round-trip; an in-app `whoIsFree(e, s)` whose length provably equals the cell's count; and a separate `grid.ts` proving the `(day, time) → slot` map in-range + injective — which makes specific-dates-vs-days-of-the-week pure shell labeling at zero proof cost; and full element-level permutation invariance (`heatmapPermInvariant` — the heatmap depends only on the *multiset* of participant rows), which drove the `perm(...)` spec predicate into LemmaScript itself. 100 Dafny VCs (90 + 10), 0 errors. The *aggregate* is proven; the React UI, WebSocket/DO I/O, and timezone labeling are the stated trust boundary. Dafny only.
+- **[quota-lemmascript](https://github.com/midspiral/quota-lemmascript)** — greenfield verified booking app: providers publish a page of limited-capacity *featured slots*, signed-in users grab them (React + Cloudflare Durable Objects + D1). A deliberate **inverse** of [quorum-lemmascript](https://github.com/midspiral/quorum-lemmascript): where Quorum counts *up to* a threshold over data partitioned **per participant** (no conflicts ⇒ optimistic, lock-free, no rollback), Quota's bookings **contend** for shared inventory, so the load-bearing fact flips from a count to a **bound** — for every slot `j`, `confirmedCount(bookings, j) <= slots[j].capacity` — and so does the concurrency story: the *same* `domain.ts` runs in the browser and the Durable Object, but **server-authoritatively** (it never oversells under contention; no optimistic client apply). Proven: no overbooking (invariant preservation across `tryBook` / cancel), accept-iff-room, an **idempotent three-way `tryBook`** (a retry reads as success, not rejection — only "confirmed" mutates), cancellation frees seats, replay determinism, and full order-invariance of availability under contention — `confirmedCountPerm` / `hasRoomPermInvariant` show availability depends only on the *multiset* of the booking log (any reordering, not just a pairwise swap), via the same `perm(...)` predicate Quorum drove into LemmaScript. NDJSON export is built on the verified `confirmedOnly`. The counting kernel is Quorum's `countFree` re-pointed at bookings — total and precondition-free so it composes. 80 Dafny VCs, 0 errors. Trust boundary (stated plainly): auth, the React UI, WebSocket/DO/D1 I/O, email, slot date/time labeling, and abuse/rate-limiting. Dafny only.
+- **[henri-lemmascript](https://github.com/midspiral/henri-lemmascript)** — a runnable TypeScript coding-agent CLI (a port of [henri](https://github.com/metareflection/henri/); multi-provider, Anthropic + AWS Bedrock) whose security- and protocol-critical core is verified and **imported directly by the live agent** — `decide()` gates every real tool call and the conversation invariant is asserted on every turn (it streams end-to-end against Bedrock). Three modules, 48 Dafny VCs, 0 errors. (1) **Permission gate**: soundness (`decide == Allow ⟺ isAllowed`), **path-traversal containment** — auto-allow-in-cwd can never resolve outside cwd, with `.`/`..` normalization proved in-core so the shell is trusted only to `resolve().split('/')` — grant monotonicity, and `rejectPrompts` is deny-only. (2) **Conversation protocol**: tool-call/result pairing plus the [pi-lemmascript](https://github.com/midspiral/pi-lemmascript)-style **no-orphaned-`tool_result`** property, proved as an invariant *preserved by the loop* — `wellFormed(msgs + [assistant(calls), tool(makeResults(calls))])` — not checked after the fact. (3) **Hook/config merge**: removal, **tool-name uniqueness — a fix** (henri concatenated hook tool lists with no dedup, so two hooks could shadow a name), order-independence, and additivity composed **cross-module** with the gate's monotonicity (merging only grows the allow-sets, which by P3 never revokes an `Allow`). The merge is verified **in place** via `//@ declare-type Tool { name: string }`, shadowing the real `Tool`'s function-valued `execute` so the actual `mergeTools(Tool[])` is the proof target rather than a parallel model. Dafny only.
 
 ## Setup
 
@@ -71,9 +77,7 @@ npx lsc gen --backend=lean src/myModule.ts
 lake build
 ```
 
-## What's Supported
-
-### Annotations
+## Annotations
 
 ```typescript
 //@ requires arr.length > 0
@@ -83,6 +87,8 @@ lake build
 //@ type i nat
 ```
 
+For the full surface, see [SPEC.md](SPEC.md).
+
 ## File Structure
 
 ### Dafny backend

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lemmascript",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "description": "A verification toolchain for TypeScript — generates Lean 4 or Dafny from annotated TS",
   "type": "module",
   "engines": {

package/tools/dist/dafny-emit.js

@@ -35,6 +35,15 @@ const DAFNY_KEYWORDS = new Set([
     "datatype", "type", "const", "ghost", "static",
     "reads", "modifies", "assert", "assume", "print",
     "by", "calc", "reveal",
+    // Further reserved words (validated against the Dafny parser) that are also
+    // legal TS identifiers. `this` stays excluded above — class methods emit it
+    // directly. `then`/`else` already covered.
+    "bool", "char", "int", "nat", "real", "string", "object", "array",
+    "as", "is", "label", "modify", "expect", "yield", "yields", "returns",
+    "unchanged", "witness", "constructor", "iterator", "abstract", "extends",
+    "refines", "opened", "provides", "reveals", "include", "newtype",
+    "codatatype", "nameonly", "twostate", "opaque", "replaceable", "colemma",
+    "copredicate", "inductive",
 ]);
 function escapeName(name) {
     // \result is carried through the IR as the var name "\\result"; render it
@@ -157,6 +166,12 @@ function emitExpr(e) {
                     return `Std.Collections.Seq.Map(${args[0]}, ${obj})`;
                 if (e.method === "filter")
                     return `Std.Collections.Seq.Filter(${args[0]}, ${obj})`;
+                // filterMap (synthesized in resolve): drop Nones and unwrap to seq<T>.
+                if (e.method === "filterSome") {
+                    needPreamble("SeqFilterSome");
+                    needPreamble("OptionType");
+                    return `SeqFilterSome(${obj})`;
+                }
                 if (e.method === "every")
                     return `Std.Collections.Seq.All(${obj}, ${args[0]})`;
                 if (e.method === "findLast") {
@@ -341,16 +356,9 @@ function emitExpr(e) {
                 needPreamble("BitAnd");
                 return `BitAnd(${emitExpr(e.left)}, ${emitExpr(e.right)})`;
             }
-            // int * real coercion: wrap int side with "as real"
-            if (["+", "-", "*", "/"].includes(op)) {
-                const leftIsReal = e.left.kind === "num" && !Number.isInteger(e.left.value);
-                const rightIsReal = e.right.kind === "num" && !Number.isInteger(e.right.value);
-                if (leftIsReal !== rightIsReal) {
-                    const left = leftIsReal ? emitExpr(e.left) : `(${emitExpr(e.left)} as real)`;
-                    const right = rightIsReal ? emitExpr(e.right) : `(${emitExpr(e.right)} as real)`;
-                    return `(${left} ${op} ${right})`;
-                }
-            }
+            // int→real coercion is now injected upstream in transform (toReal nodes),
+            // which has full type information — including real-typed variables, not
+            // just literals — so no literal-based coercion is needed here.
             return `(${wrapQuantifier(e.left)} ${op} ${emitExpr(e.right)})`;
         }
         case "implies": {
@@ -390,6 +398,8 @@ function emitExpr(e) {
                 needPreamble("MathMin");
                 needPreamble("MinOfSeq");
             }
+            if (e.fn === "Perm")
+                needPreamble("Perm");
             return `${escapeName(e.fn)}(${args.join(", ")})`;
         }
         case "field": {
@@ -405,6 +415,8 @@ function emitExpr(e) {
         case "toNat":
             // Dafny doesn't need toNat — just emit the inner expression
             return emitExpr(e.expr);
+        case "toReal":
+            return `(${emitExpr(e.expr)} as real)`;
         case "index": {
             const obj = emitExpr(e.arr);
             const idx = emitExpr(e.idx);
@@ -587,10 +599,29 @@ function emitDecl(d) {
     switch (d.kind) {
         case "inductive": {
             const tp = d.typeParams?.length ? `<${d.typeParams.join(", ")}>` : "";
+            // Dafny requires a destructor shared across constructors to have a single
+            // type. Two TS variants can legitimately share a field name with different
+            // types (e.g. label.targetId: string vs leaf.targetId: string?). Detect
+            // such collisions and make those destructors per-constructor unique. Safe:
+            // variant-field reads lower to positional match bindings, never named
+            // destructors on the union (a name shared with differing types isn't even
+            // accessible on the union type in TS), so nothing references the old name.
+            const typesByField = new Map();
+            for (const c of d.constructors)
+                for (const f of c.fields) {
+                    let s = typesByField.get(f.name);
+                    if (!s) {
+                        s = new Set();
+                        typesByField.set(f.name, s);
+                    }
+                    s.add(tyToDafny(f.type));
+                }
+            const collides = new Set([...typesByField].filter(([, s]) => s.size > 1).map(([n]) => n));
             const ctors = d.constructors.map(c => {
                 if (c.fields.length === 0)
                     return escapeName(c.name);
-                return `${escapeName(c.name)}(${paramList(c.fields)})`;
+                const fields = c.fields.map(f => collides.has(f.name) ? { ...f, name: `${f.name}_${c.name}` } : f);
+                return `${escapeName(c.name)}(${paramList(fields)})`;
             });
             return `datatype ${d.name}${tp} = ${ctors.join(" | ")}`;
         }
@@ -600,6 +631,11 @@ function emitDecl(d) {
         case "type-alias": {
             return `type ${d.name} = ${tyToDafny(d.target)}`;
         }
+        case "opaque-type": {
+            // Abstract type — no definition. `(==)` so it can sit inside datatypes
+            // that derive structural equality. Never constructed or destructured.
+            return `type ${d.name}(==)`;
+        }
         case "def": {
             const tp = d.typeParams.length > 0 ? `<${d.typeParams.join(", ")}>` : "";
             const lines = [`function ${d.name}${tp}(${paramList(d.params)}): ${tyToDafny(d.returnType)}`];
@@ -734,6 +770,12 @@ const CEIL_REAL = `function CeilReal(x: real): int
   if x == (x.Floor as real) then x.Floor
   else x.Floor + 1
 }`;
+const SEQ_FILTER_SOME = `function SeqFilterSome<T>(xs: seq<Option<T>>): seq<T>
+  ensures |SeqFilterSome(xs)| <= |xs|
+{
+  if |xs| == 0 then []
+  else (if xs[0].Some? then [xs[0].value] else []) + SeqFilterSome(xs[1..])
+}`;
 const SEQ_FIND_INDEX = `function SeqFindIndex<T>(s: seq<T>, p: T -> bool): int
   ensures -1 <= SeqFindIndex(s, p) < |s|
   ensures SeqFindIndex(s, p) >= 0 ==> p(s[SeqFindIndex(s, p)])
@@ -947,6 +989,10 @@ const NAT_TO_STRING = `function NatToString(n: nat): string
   else NatToString(n / 10) + [digit]
 }`;
 const MATH_ABS = `function MathAbs(x: int): nat { if x >= 0 then x else -x }`;
+// perm(a, b) — `a` and `b` are reorderings of each other (equal as multisets).
+// Transparent (Dafny unfolds it), so hand-proofs can reason with `multiset`
+// directly. The `(==)` bound requires the element type to support equality.
+const PERM = `predicate Perm<T(==)>(a: seq<T>, b: seq<T>) { multiset(a) == multiset(b) }`;
 const SET_TO_SEQ = `method SetToSeq<T>(s: set<T>) returns (res: seq<T>)
   ensures forall x :: x in s <==> x in res
   ensures |res| == |s|
@@ -977,6 +1023,7 @@ const PREAMBLE_CODE = [
     ["FloorReal", FLOOR_REAL],
     ["SeqIndexOf", SEQ_INDEX_OF],
     ["SeqFindIndex", SEQ_FIND_INDEX],
+    ["SeqFilterSome", SEQ_FILTER_SOME],
     ["SeqFindLast", SEQ_FIND_LAST],
     ["SeqFlatten", SEQ_FLATTEN],
     ["SeqJoin", SEQ_JOIN],
@@ -992,6 +1039,7 @@ const PREAMBLE_CODE = [
     ["MathMax", MATH_MAX],
     ["MaxOfSeq", MAX_OF_SEQ],
     ["MinOfSeq", MIN_OF_SEQ],
+    ["Perm", PERM],
 ];
 // ── Constructor and record helpers ───────────────────────────
 let _recordCtors = new Map();

package/tools/dist/extract.js

@@ -159,6 +159,26 @@ function _synthName(elemName, otherName) {
     const sanitize = (s) => s.replace(/[^A-Za-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
     return `ArrayOf_${sanitize(elemName)}_Or_${sanitize(otherName)}`;
 }
+/**
+ * Fall-through for a union LS can't model as a tagged union (no runtime type
+ * test maps to a tag — e.g. members are unreachable imports with no visible
+ * discriminant). Registers an opaque-type TypeDeclInfo and returns its name, so
+ * the union becomes one abstract `type` rather than invalid raw-union Dafny.
+ *
+ * Sound because an opaque type has no constructor and no tag predicate: any
+ * attempt to build or type-test the value fails to lower, so it can only be
+ * passed through — the one sound use of a union we can't discriminate. Distinct
+ * from dropping the field (which collapses values and is unsound): the value is
+ * preserved, just uninspectable.
+ */
+function _synthOpaque(memberNames) {
+    const sanitize = (s) => s.replace(/[^A-Za-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+    const name = `Opaque_${memberNames.map(sanitize).join("_or_")}`;
+    if (_synthArrayUnions !== null && !_synthArrayUnions.some(d => d.name === name)) {
+        _synthArrayUnions.push({ name, kind: "opaque" });
+    }
+    return name;
+}
 /**
  * String-level fallback for synth detection on a `T[] | U` shape, used by
  * declare-type field parsing (where no ts-morph TypeNode is available). The
@@ -277,10 +297,10 @@ function extractExpr(node) {
     if (Node.isNumericLiteral(node)) {
         return { kind: "num", value: Number(node.getLiteralValue()) };
     }
-    // BigInt literal (e.g. 32n, 0xffffn) — treat as integer
+    // BigInt literal (e.g. 32n, 0xffffn) — integer, with bigint division semantics
     if (Node.isBigIntLiteral(node)) {
         const text = node.getText().replace(/n$/, '');
-        return { kind: "num", value: Number(text) };
+        return { kind: "num", value: Number(text), big: true };
     }
     // Template literal: `foo${x}bar` → "foo" + x + "bar"
     if (Node.isTemplateExpression(node)) {
@@ -431,12 +451,16 @@ function extractExpr(node) {
             const typeNode = p.getTypeNode();
             return { name: p.getName(), tsType: typeNode ? typeNode.getText() : undefined };
         });
+        // Capture an explicit return annotation (`(x): Out => …`) so resolve can type
+        // return-position record literals to their named type instead of a tuple.
+        const retNode = node.getReturnTypeNode();
+        const returnTsType = retNode ? typeToString(node.getReturnType()) : undefined;
         const body = node.getBody();
         if (Node.isExpression(body)) {
-            return { kind: "lambda", params, body: extractExpr(body) };
+            return { kind: "lambda", params, body: extractExpr(body), returnTsType };
         }
         if (Node.isBlock(body)) {
-            return { kind: "lambda", params, body: extractStmts(body.getStatements()) };
+            return { kind: "lambda", params, body: extractStmts(body.getStatements()), returnTsType };
         }
         throw new Error(`Unsupported arrow function body: ${node.getText().slice(0, 80)}`);
     }
@@ -552,6 +576,12 @@ function extractExpr(node) {
     if (Node.isNullLiteral(node)) {
         return { kind: "var", name: "undefined" };
     }
+    // `typeof X` — only meaningful in a `typeof X === "string"` discriminator over
+    // a synth `U | T[]` union (see narrow's parseTypeofStringCheck); any other use
+    // survives to emit and errors there.
+    if (Node.isTypeOfExpression(node)) {
+        return { kind: "unop", op: "typeof", expr: extractExpr(node.getExpression()) };
+    }
     throw new Error(`Unsupported expression: ${node.getText()}`);
 }
 // ── Annotation parsing ───────────────────────────────────────
@@ -796,7 +826,10 @@ function typeToString(type) {
         return "bigint";
     if (type.isString() || type.isStringLiteral())
         return "string";
-    if (type.isBoolean())
+    // TS expands `boolean` to the literal union `false | true`; normalize the
+    // literals back so the union dedupes to a single `boolean` rather than being
+    // mistaken for an unmodelable multi-member union.
+    if (type.isBoolean() || type.isBooleanLiteral())
         return "boolean";
     // Named type alias (e.g. Priority = "low" | "medium" | "high") — use the alias name
     if (type.getAliasSymbol()) {
@@ -838,7 +871,15 @@ function typeToString(type) {
             }
         }
         const parts = [...new Set(unionTypes.map(typeToString))];
-        return parts.join(" | ");
+        // `undefined`/`null` are optional markers; a single real member with them
+        // is an Option, left as `X | undefined` for the optional lowering.
+        const real = parts.filter(p => p !== "undefined" && p !== "null");
+        if (real.length <= 1)
+            return parts.join(" | ");
+        // A genuine multi-member union with no tagged-union shape LS can model →
+        // a single opaque type. (See _synthOpaque.) Preserve an outer optional.
+        const opaque = _synthOpaque(real);
+        return real.length === parts.length ? opaque : `${opaque} | undefined`;
     }
     if (type.isTuple()) {
         return `[${type.getTupleElements().map(t => typeToString(t)).join(", ")}]`;
@@ -1502,17 +1543,39 @@ function extractStmts(stmts) {
             const switchExpr = exprAst.kind === "field" ? exprAst.obj : exprAst;
             const cases = [];
             let defaultBody = [];
+            // Two JS-`switch` faithfulness concerns the Dafny `match` doesn't share:
+            //  (1) Fall-through: stacked `case A: case B: body` is several clauses
+            //      where the leading ones have no statements; those labels share the
+            //      next clause's body (we duplicate it per label).
+            //  (2) `break` is the switch exit, not a loop break. We extract the full
+            //      body (extractStmts flattens `{ }` blocks but keeps loop bodies
+            //      nested) and strip the *top-level* breaks — so a `break` written
+            //      inside a `{ }` case block is stripped, while a `break` inside a
+            //      nested loop stays put.
+            const stripExitBreaks = (b) => b.filter(st => st.kind !== "break");
+            let fallthrough = [];
             for (const clause of s.getClauses()) {
                 if (Node.isCaseClause(clause)) {
                     const label = clause.getExpression().getText().replace(/^["']|["']$/g, "");
-                    const bodyStmts = clause.getStatements().filter(st => !Node.isBreakStatement(st));
-                    cases.push({ label, body: extractStmts(bodyStmts) });
+                    if (clause.getStatements().length === 0) {
+                        fallthrough.push(label);
+                        continue;
+                    }
+                    const body = stripExitBreaks(extractStmts(clause.getStatements()));
+                    for (const l of fallthrough)
+                        cases.push({ label: l, body });
+                    cases.push({ label, body });
+                    fallthrough = [];
                 }
                 else {
-                    const bodyStmts = clause.getStatements().filter(st => !Node.isBreakStatement(st));
-                    defaultBody = extractStmts(bodyStmts);
+                    defaultBody = stripExitBreaks(extractStmts(clause.getStatements()));
+                    for (const l of fallthrough)
+                        cases.push({ label: l, body: defaultBody });
+                    fallthrough = [];
                 }
             }
+            for (const l of fallthrough)
+                cases.push({ label: l, body: [] });
             result.push({ kind: "switch", expr: switchExpr, discriminant, cases, defaultBody, line });
             continue;
         }
@@ -1735,7 +1798,19 @@ export function extractModule(sourceFile) {
         }
         const aliasMatch = body.match(/^(\w+)\s*=\s*(.+)$/);
         if (aliasMatch) {
-            typeDecls.push({ name: aliasMatch[1], kind: "alias", aliasOf: aliasMatch[2].trim() });
+            const rhs = aliasMatch[2].trim();
+            // A string-literal union (`= "a" | "b" | …`) becomes an enum datatype —
+            // the same shape a real string-union alias resolves to. Dafny has no
+            // string-literal type, so a plain alias (`type X = "a" | "b"`) would be
+            // invalid. Other RHS forms (`Rule[]`, `number`, `A | B`) fall through.
+            const parts = rhs.split("|").map(s => s.trim());
+            const lits = parts.map(p => p.match(/^["'](.+)["']$/));
+            if (parts.length >= 2 && lits.every(m => m !== null)) {
+                typeDecls.push({ name: aliasMatch[1], kind: "string-union", values: lits.map(m => m[1]) });
+            }
+            else {
+                typeDecls.push({ name: aliasMatch[1], kind: "alias", aliasOf: rhs });
+            }
         }
     }
     for (const range of sourceFile.getLeadingCommentRanges()) {
@@ -1861,11 +1936,14 @@ export function extractModule(sourceFile) {
         if (!sig)
             continue;
         const typeParams = sig.getTypeParameters().map(tp => tp.getText());
+        // Normalize via typeToString (not raw getText): resolves declare-type
+        // shadows and yields bare names, so a param typed by an unreachable import
+        // becomes `AgentMessage`, not `import("/abs/path").AgentMessage`.
         const params = sig.getParameters().map(p => ({
             name: p.getName(),
-            tsType: p.getTypeAtLocation(f.node).getText(),
+            tsType: typeToString(p.getTypeAtLocation(f.node)),
         }));
-        const returnType = sig.getReturnType().getText();
+        const returnType = typeToString(sig.getReturnType());
         const annots = collectFunctionAnnotations(f.node);
         const requires = annots.filter(a => a.kind === "requires").map(a => a.expr);
         const ensures = annots.filter(a => a.kind === "ensures").map(a => a.expr);
@@ -2087,10 +2165,17 @@ export function extractModule(sourceFile) {
                 collectNamesExpr(e.else);
             }
         }
+        // Signature types (params + return) get base-name stripping below; body /
+        // spec references stay exact-match (so a body `let xs: Hunk[]` doesn't pull
+        // `Hunk` into the filter early and reorder output that resolveType re-adds).
+        const sigTypes = new Set();
         for (const fn of functions) {
-            for (const p of fn.params)
+            for (const p of fn.params) {
                 referencedNames.add(p.tsType);
+                sigTypes.add(p.tsType);
+            }
             referencedNames.add(fn.returnType);
+            sigTypes.add(fn.returnType);
             collectNames(fn.body);
             // Also scan spec annotations for identifier references
             for (const spec of [...fn.requires, ...fn.ensures]) {
@@ -2119,6 +2204,15 @@ export function extractModule(sourceFile) {
         }
         for (const name of referencedNames)
             markType(name);
+        // Signature types also mark their base after stripping array/optional
+        // WRAPPERS (`Out[]`/`Msg | undefined` → `Out`/`Msg`), so a function returning
+        // a local `Out[]` keeps `Out`. Wrappers only — never dig into generic args
+        // (`Omit<FilePathOptions, …>` must not pull in the inner type).
+        for (const name of sigTypes) {
+            const base = name.replace(/\s*\|\s*(undefined|null)\s*$/, "").replace(/(\[\])+$/, "").trim();
+            if (base !== name && /^[A-Za-z_]\w*$/.test(base))
+                markType(base);
+        }
         typeDecls.splice(0, typeDecls.length, ...typeDecls.filter(d => neededTypes.has(d.name) || declaredNames.has(d.name)));
     }
     // Resolve imported types: extract types referenced in function signatures but not in this file

package/tools/dist/lean-emit.js

@@ -7,7 +7,22 @@ function tyToLean(ty) {
     switch (ty.kind) {
         case "nat": return "Nat";
         case "int": return "Int";
-        case "real": return "Float"; // Lean doesn't have exact reals; Float is approximate
+        case "real":
+            // Real arithmetic isn't supported by the Lean backend yet: ℝ is
+            // noncomputable and needs Mathlib's real-number development, so we fail
+            // fast here rather than emit Lean that can't compile.
+            //
+            // Workarounds, in order of preference:
+            //   1. If integer division was intended, write `Math.floor(a / b)` — it
+            //      lowers to flooring integer division on Lean (no real involved).
+            //   2. For `bigint` operands, `/` is already integer division — declaring
+            //      the value `bigint` instead of `number` keeps it off the real path.
+            //   3. If the file genuinely needs reals, restrict it to Dafny with a
+            //      `//@ backend dafny` directive.
+            // Full Lean real support is feasible but was set aside: it needs
+            // `import Mathlib.Data.Real.Basic`, `noncomputable def`s for real-valued
+            // functions, and the Int→ℝ coercion (see the stashed WIP for a sketch).
+            throw new Error("real arithmetic is not supported by the Lean backend (needs noncomputable ℝ / Mathlib).");
         case "bool": return "Bool";
         case "string": return "String";
         case "void": return "Unit";
@@ -90,6 +105,16 @@ function emitMethodCall(tyKind, method, monadic, obj, args) {
             return `Array.push ${obj} ${args[0]}`;
         if (method === "concat")
             return `Array.push ${obj} ${args[0]}`;
+        // arr.slice → Array.extract. No-arg slice is a full copy (Array is a value
+        // type in Lean, so the receiver itself); one arg drops the prefix, two args
+        // give the half-open range. Matches JS for non-negative bounds (negative
+        // indices are unsupported — same caveat as the Dafny backend's direct slice).
+        if (method === "slice" && args.length === 0)
+            return obj;
+        if (method === "slice" && args.length === 1)
+            return `${obj}.extract ${args[0]} ${obj}.size`;
+        if (method === "slice" && args.length === 2)
+            return `${obj}.extract ${args[0]} ${args[1]}`;
     }
     // String methods
     if (tyKind === "string") {
@@ -122,12 +147,17 @@ function emitMethodCall(tyKind, method, monadic, obj, args) {
     throw new Error(`Unsupported Lean method call: .${method}() on ${tyKind}`);
 }
 // ── Expression emission ─────────────────────────────────────
-// Lean's `∀`/`∃` body extends as far as possible. So `(∃ x, P) <op> Q`
-// (or `∃ x, P → Q`) would parse with the operator absorbed into the body.
-// Wrap a quantifier in parens to terminate its body before the operator.
-function wrapQuantifier(sub, parentPrec) {
+// Some Lean term forms extend their body as far as possible: `∀`/`∃` bodies,
+// and `if`/`let` tails. As an operator operand they would swallow the operator
+// — `(if c then 1 else 0) + r` written bare parses as `if c then 1 else (0 + r)`.
+// Wrap these forms in parens so the operand is closed before the operator.
+// (`match` self-parenthesizes in `emitExpr`, and other forms close via
+// precedence, so neither needs wrapping here.)
+function wrapOperand(sub, parentPrec) {
     const inner = emitExpr(sub, parentPrec);
-    return (sub.kind === "forall" || sub.kind === "exists") ? `(${inner})` : inner;
+    return (sub.kind === "forall" || sub.kind === "exists" ||
+        sub.kind === "if" || sub.kind === "let")
+        ? `(${inner})` : inner;
 }
 function emitExpr(e, parentPrec) {
     switch (e.kind) {
@@ -183,11 +213,11 @@ function emitExpr(e, parentPrec) {
                 return `${wrap ? `(${recv})` : recv}.contains ${emitExpr(e.left)}`;
             }
             const op = e.op === "arrayConcat" ? "++" : e.op;
-            const s = `${wrapQuantifier(e.left, prec(e.op))} ${op} ${emitExpr(e.right, prec(e.op))}`;
+            const s = `${wrapOperand(e.left, prec(e.op))} ${op} ${wrapOperand(e.right, prec(e.op))}`;
             return (parentPrec !== undefined && prec(e.op) < parentPrec) ? `(${s})` : s;
         }
         case "implies": {
-            const parts = [...e.premises.map(p => wrapQuantifier(p)), emitExpr(e.conclusion)];
+            const parts = [...e.premises.map(p => wrapOperand(p)), emitExpr(e.conclusion)];
             const s = parts.join(" → ");
             return parentPrec !== undefined ? `(${s})` : s;
         }
@@ -196,6 +226,12 @@ function emitExpr(e, parentPrec) {
             // SetToSeq → .toArray for Lean (HashSet has native toArray)
             if (e.fn === "SetToSeq" && args.length === 1)
                 return `${args[0]}.toArray`;
+            // perm(a, b) → `List.Perm` on the underlying lists. Dafny lowers it to
+            // `multiset(a) == multiset(b)`; the Lean image is `a.toList ~ b.toList`,
+            // which mathlib's `List.Perm` provides (reflexivity, symmetry,
+            // `perm_append_comm`, and `Perm.count_eq` for the count-invariance payoff).
+            if (e.fn === "Perm" && args.length === 2)
+                return `(${args[0]}.toList).Perm (${args[1]}.toList)`;
             return `${e.fn} ${args.join(" ")}`;
         }
         case "field": {
@@ -210,6 +246,10 @@ function emitExpr(e, parentPrec) {
             const wrap = e.expr.kind !== "var" && e.expr.kind !== "num";
             return wrap ? `(${inner}).toNat` : `${inner}.toNat`;
         }
+        case "toReal":
+            // A real value reached the Lean backend via coercion (e.g. number `/`).
+            // Same unsupported-real story as the `real` type case in tyToLean.
+            throw new Error("real arithmetic is not supported by the Lean backend (needs noncomputable ℝ / Mathlib).");
         case "index":
             return `${emitExpr(e.arr)}[${emitExpr(e.idx)}]!`;
         case "record": {
@@ -393,9 +433,24 @@ function emitDecl(d) {
         case "type-alias": {
             return `abbrev ${d.name} := ${tyToLean(d.target)}`;
         }
+        case "opaque-type": {
+            // Abstract type — no definition. Never constructed or destructured.
+            return `opaque ${d.name} : Type`;
+        }
         case "def": {
             const params = d.params.map(p => `(${escapeName(p.name)} : ${tyToLean(p.type)})`).join(" ");
-            return `def ${d.name} ${params} : ${tyToLean(d.returnType)} :=\n${emitPureExpr(d.body, 1)}`;
+            let out = `def ${d.name} ${params} : ${tyToLean(d.returnType)} :=\n${emitPureExpr(d.body, 1)}`;
+            // A `//@ decreases` on a pure function marks it recursive and names its
+            // termination measure — emit it as Lean's `termination_by`. This is
+            // required when the recursion is on `arr.slice(...)` (→ `Array.extract`,
+            // which Lean cannot see as a structural subterm); for a bare-Nat counter
+            // Lean could infer structural recursion on its own, but honoring the
+            // clause uniformly is simpler and harmless. Lean's default `decreasing_by`
+            // discharges the goal in both cases (it knows `Array.size_extract`), so no
+            // explicit tactic is needed.
+            if (d.decreases)
+                out += `\ntermination_by ${emitExpr(d.decreases)}`;
+            return out;
         }
         case "def-by-method":
             throw new Error("function by method is not supported for Lean backend");

package/tools/dist/narrow.js

@@ -349,14 +349,18 @@ function ruleConditionalArrayIsArray(e) {
     if (e.kind !== "conditional")
         return null;
     const pos = parseArrayIsArrayCall(e.cond);
-    const neg = e.cond.kind === "unop" && e.cond.op === "!"
+    // `typeof x === "string"` is a positive check like `Array.isArray`, but selects
+    // the NonArrayBranch — its then-branch is the matched-variant body.
+    const tof = pos ? null : parseTypeofStringCheck(e.cond);
+    const neg = !pos && !tof && e.cond.kind === "unop" && e.cond.op === "!"
         ? parseArrayIsArrayCall(e.cond.expr)
         : null;
-    const matched = pos ?? (neg ? { scrutinee: neg.scrutinee, typeName: neg.typeName, variant: "NonArrayBranch" } : null);
+    const matched = pos ?? tof ?? (neg ? { scrutinee: neg.scrutinee, typeName: neg.typeName, variant: "NonArrayBranch" } : null);
     if (!matched)
         return null;
-    const thenBody = pos ? e.then : e.else;
-    const elseBody = pos ? e.else : e.then;
+    const positive = pos ?? tof;
+    const thenBody = positive ? e.then : e.else;
+    const elseBody = positive ? e.else : e.then;
     return {
         kind: "tagMatch",
         scrutinee: matched.scrutinee,
@@ -602,6 +606,30 @@ function parseArrayIsArrayCall(call) {
         return null;
     return { scrutinee: arg, typeName: arg.ty.name, variant: "ArrayBranch" };
 }
+/** Detect `typeof <path> === "string"` where `<path>`'s type is a synth array-
+ *  union (`U | T[]`) AND its `NonArrayBranch` payload `U` is itself `string`.
+ *  The runtime `=== "string"` test matches that branch only when `U` is string —
+ *  for any other non-array payload (`number | T[]`, …) it never holds, so we must
+ *  NOT narrow. Returns the `NonArrayBranch` variant; the dual of `Array.isArray`. */
+function parseTypeofStringCheck(e) {
+    if (e.kind !== "binop" || e.op !== "===")
+        return null;
+    const tof = e.left.kind === "unop" && e.left.op === "typeof" ? e.left.expr
+        : e.right.kind === "unop" && e.right.op === "typeof" ? e.right.expr : null;
+    const lit = e.left.kind === "str" ? e.left.value : e.right.kind === "str" ? e.right.value : null;
+    if (!tof || lit !== "string")
+        return null;
+    if (!isNarrowablePath(tof) || tof.ty.kind !== "user")
+        return null;
+    const baseTyName = tof.ty.name.includes("<") ? tof.ty.name.slice(0, tof.ty.name.indexOf("<")) : tof.ty.name;
+    const decl = _typeDecls.find(d => d.name === baseTyName);
+    if (decl?.kind !== "discriminated-union" || decl.discriminant !== "__isArray__")
+        return null;
+    const valTy = decl.variants?.find(v => v.name === "NonArrayBranch")?.fields.find(f => f.name === "val")?.type;
+    if (valTy?.kind !== "string")
+        return null; // guard: the non-array branch must actually be `string`
+    return { scrutinee: tof, typeName: tof.ty.name, variant: "NonArrayBranch" };
+}
 /** A "narrowable path" is a var or a chain of field accesses rooted at a var
  *  — i.e., pure and structurally addressable, so transforms can substitute
  *  occurrences inside a matched arm without worrying about re-evaluation. */

package/tools/dist/peephole.js

@@ -20,6 +20,7 @@ function mapExpr(e, f) {
         case "app": return { ...e, args: e.args.map(r) };
         case "field": return { ...e, obj: r(e.obj) };
         case "toNat": return { ...e, expr: r(e.expr) };
+        case "toReal": return { ...e, expr: r(e.expr) };
         case "index": return { ...e, arr: r(e.arr), idx: r(e.idx) };
         case "record": return { ...e, spread: e.spread ? r(e.spread) : null,
             fields: e.fields.map(fi => ({ ...fi, value: r(fi.value) })) };
@@ -364,6 +365,7 @@ function rewriteChildrenExpr(e) {
         case "app": return { ...e, args: e.args.map(r) };
         case "field": return { ...e, obj: r(e.obj) };
         case "toNat": return { ...e, expr: r(e.expr) };
+        case "toReal": return { ...e, expr: r(e.expr) };
         case "index": return { ...e, arr: r(e.arr), idx: r(e.idx) };
         case "record": return { ...e, spread: e.spread ? r(e.spread) : null,
             fields: e.fields.map(fi => ({ ...fi, value: r(fi.value) })) };
@@ -445,6 +447,7 @@ function peepholeDecl(d) {
         case "inductive":
         case "structure":
         case "type-alias":
+        case "opaque-type":
         case "extern":
             return d;
     }

package/tools/dist/resolve.js

@@ -4,6 +4,7 @@
  * Uses linked environments (Scheme-style) for lexical scoping.
  * No mutation — each let extends the chain, lookup walks it.
  */
+import { isBigInt } from "./typedir.js";
 import { parseTsType } from "./types.js";
 import { parseExpr } from "./specparser.js";
 function lookup(env, name) {
@@ -290,6 +291,41 @@ function expandAlias(ty, typeDecls, seen = new Set()) {
 function getDiscriminant(ctx, typeName) {
     return findDecl(ctx, typeName)?.discriminant;
 }
+// ── Equality hazard: structural in the proof vs reference at runtime ─────────
+// `===`/`!==` is modeled as Dafny structural equality, but the SAME TypeScript
+// runs `===` as JS *reference* equality on objects/arrays. The two agree only
+// when the operand is a primitive at runtime: number / string / bool, or a
+// string-union enum (which runs as a plain string). Records, discriminated
+// unions, arrays, maps, sets, and unresolved generics are reference-compared at
+// runtime, so a structural proof over them is unsound. Returns true for those.
+function refEqHazard(ty, typeDecls) {
+    if (ty.kind === "array" || ty.kind === "map" || ty.kind === "set")
+        return true;
+    if (ty.kind === "user") {
+        let decl = typeDecls.find(d => d.name === ty.name);
+        if (!decl && ty.name.includes(".")) {
+            const tail = ty.name.slice(ty.name.lastIndexOf(".") + 1);
+            decl = typeDecls.find(d => d.name === tail);
+        }
+        if (!decl)
+            return true; // generic type parameter / unknown → assume reference
+        if (decl.kind === "string-union")
+            return false; // runs as a JS string → `===` is structural
+        if (decl.kind === "alias")
+            return decl.aliasOfTy ? refEqHazard(decl.aliasOfTy, typeDecls) : false;
+        return true; // record / discriminated-union → reference at runtime
+    }
+    return false; // primitives, optional, unknown, fn, void
+}
+const _warnedRefEq = new Set();
+function warnRefEq(op, l, r) {
+    const label = (t) => t.kind === "user" ? t.name : t.kind;
+    const msg = `'${op}' compares non-primitive operands (${label(l)} ${op} ${label(r)}): structural equality in the proof, but reference equality when this TypeScript runs. Sound only if operands are primitives or a canonical (string/number) encoding; otherwise compare via an explicit structural equals.`;
+    if (_warnedRefEq.has(msg))
+        return;
+    _warnedRefEq.add(msg);
+    console.error(`WARNING: ${msg}`);
+}
 /** A type ts-morph handed us that LemmaScript hasn't modeled: contains
  *  `unknown` (TS `any`), or a `user` type whose name isn't a known declaration
  *  (an opaque expanded union like `"AssistantMsg | ToolMsg"` that ts-morph
@@ -412,6 +448,12 @@ function tyToTsStr(ty) {
         return "number";
     if (ty.kind === "bool")
         return "boolean";
+    // Optional element (e.g. a `.filter` over a `T | undefined`-typed map result):
+    // type the callback param so its `x !== undefined` check narrows correctly.
+    if (ty.kind === "optional") {
+        const inner = tyToTsStr(ty.inner);
+        return inner ? `${inner} | undefined` : undefined;
+    }
     return undefined;
 }
 function inferLambdaParamTypes(fn, rawArgs, ctx) {
@@ -451,6 +493,21 @@ function inferLambdaParamTypes(fn, rawArgs, ctx) {
     }
     return rawArgs;
 }
+/** A defined-check filter predicate: `(x) => x !== undefined` (expression or
+ *  single-return body). Detected on the raw IR before narrowing rewrites it. */
+function isDefinedCheckRawLambda(raw) {
+    if (raw.kind !== "lambda" || raw.params.length !== 1)
+        return false;
+    const p = raw.params[0].name;
+    const body = Array.isArray(raw.body)
+        ? (raw.body.length === 1 && raw.body[0].kind === "return" ? raw.body[0].value : null)
+        : raw.body;
+    if (!body || body.kind !== "binop" || body.op !== "!==")
+        return false;
+    const isParam = (x) => x.kind === "var" && x.name === p;
+    const isUndef = (x) => x.kind === "var" && x.name === "undefined";
+    return (isParam(body.left) && isUndef(body.right)) || (isParam(body.right) && isUndef(body.left));
+}
 /** Coerce call arguments: string literals → user types, non-optional → Some, pad missing optional args. */
 function coerceCallArgs(args, fn, ctx) {
     if (fn.kind !== "var" || !ctx.fnParams.has(fn.name))
@@ -482,6 +539,16 @@ function inferMethodReturnTy(fn, args, ctx) {
     if (fn.obj.kind === "var" && fn.obj.name === "Array" && fn.field === "isArray") {
         return { kind: "bool" };
     }
+    // Math.* numeric builtins: abs/min/max preserve the operand's numeric type
+    // (real if any operand is real); floor/ceil/round/trunc return an integer.
+    if (fn.obj.kind === "var" && fn.obj.name === "Math") {
+        if (fn.field === "abs" && args.length === 1)
+            return args[0].ty;
+        if ((fn.field === "min" || fn.field === "max") && args.length >= 1)
+            return args.some(a => a.ty.kind === "real") ? { kind: "real" } : args[0].ty;
+        if (["floor", "ceil", "round", "trunc"].includes(fn.field))
+            return { kind: "int" };
+    }
     const objTy = fn.obj.ty;
     if (objTy.kind === "map") {
         if (fn.field === "get")
@@ -523,8 +590,11 @@ function inferMethodReturnTy(fn, args, ctx) {
         if (fn.field === "join" && objTy.elem.kind === "string")
             return { kind: "string" };
         if (fn.field === "map" && args.length >= 1 && args[0].kind === "lambda") {
-            const retTy = args[0].body.length > 0 && args[0].body[0].kind === "return"
-                ? args[0].body[0].value.ty : { kind: "unknown" };
+            const lam = args[0];
+            // Prefer the lambda's declared return type (handles multi-statement bodies
+            // where body[0] is an `if`, not a `return`); fall back to the body's return.
+            const retTy = lam.ty.kind === "fn" ? lam.ty.result
+                : lam.body.length > 0 && lam.body[0].kind === "return" ? lam.body[0].value.ty : { kind: "unknown" };
             return { kind: "array", elem: retTy };
         }
     }
@@ -578,6 +648,8 @@ function resolveExpr(e, ctx) {
         case "num":
             if (!Number.isInteger(e.value))
                 return { kind: "num", value: e.value, ty: { kind: "real" } };
+            if (e.big)
+                return { kind: "num", value: e.value, ty: { kind: "int", big: true } };
             return { kind: "num", value: e.value, ty: e.value >= 0 ? { kind: "nat" } : { kind: "int" } };
         case "str":
             return { kind: "str", value: e.value, ty: { kind: "string" } };
@@ -606,6 +678,11 @@ function resolveExpr(e, ctx) {
             if (e.op === "===" || e.op === "!==") {
                 left = coerceStr(left, right.ty);
                 right = coerceStr(right, left.ty);
+                // Spec (`//@`) comparisons are proof-only, so they can't diverge at
+                // runtime; only warn on executable code.
+                if (!ctx.inSpec && refEqHazard(left.ty, ctx.typeDecls) && refEqHazard(right.ty, ctx.typeDecls)) {
+                    warnRefEq(e.op, left.ty, right.ty);
+                }
             }
             let ty = { kind: "unknown" };
             if (["===", "!==", ">=", "<=", ">", "<", "in"].includes(e.op))
@@ -618,16 +695,38 @@ function resolveExpr(e, ctx) {
             }
             else if (e.op === "||")
                 ty = right.ty;
-            else if (["+", "-", "*", "/", "%"].includes(e.op)) {
+            else if (e.op === "/") {
+                // `number / number` is real (floating-point) division: 3 / 2 === 1.5,
+                // never 1 — an integer quotient requires an explicit Math.floor (which
+                // lowers to JSFloorDiv). But `bigint / bigint` is genuinely integer
+                // division in JS (3n / 2n === 1n), so keep it integer.
+                ty = (isBigInt(left.ty) || isBigInt(right.ty)) ? { kind: "int", big: true } : { kind: "real" };
+            }
+            else if (["+", "-", "*", "%"].includes(e.op)) {
                 ty = (left.ty.kind === "real" || right.ty.kind === "real") ? { kind: "real" } : left.ty;
             }
             return { kind: "binop", op: e.op, left, right, ty };
         }
         case "unop": {
             const expr = resolveExpr(e.expr, ctx);
-            return { kind: "unop", op: e.op, expr, ty: e.op === "!" ? { kind: "bool" } : expr.ty };
+            const ty = e.op === "!" ? { kind: "bool" } : e.op === "typeof" ? { kind: "string" } : expr.ty;
+            return { kind: "unop", op: e.op, expr, ty };
         }
         case "call": {
+            // perm(a, b): spec-only permutation predicate — true iff `a` and `b` are
+            // reorderings of each other (equal as multisets). Lowers to the `Perm`
+            // preamble (Dafny `multiset(a) == multiset(b)`; Lean `a.toList ~ b.toList`).
+            // It has no runtime counterpart, so it is rejected outside `//@` specs.
+            if (e.fn.kind === "var" && e.fn.name === "perm" && e.args.length === 2) {
+                if (!ctx.inSpec)
+                    throw new Error("perm(a, b) may only be used in //@ specifications");
+                const a = resolveExpr(e.args[0], ctx);
+                const b = resolveExpr(e.args[1], ctx);
+                if (a.ty.kind !== "array" || b.ty.kind !== "array")
+                    throw new Error(`perm(a, b) requires two array arguments (got ${a.ty.kind} and ${b.ty.kind})`);
+                const fn = { kind: "var", name: "Perm", ty: { kind: "unknown" } };
+                return { kind: "call", fn, args: [a, b], ty: { kind: "bool" }, callKind: "pure" };
+            }
             // Extern dispatch: `NS.method(args)` where NS.method is declared via
             // `//@ extern`. Rewrite into a flat-name call (`NS_method(args)`) so the
             // rest of the pipeline sees an ordinary pure function. The extern's
@@ -671,6 +770,16 @@ function resolveExpr(e, ctx) {
             if (ty.kind === "unknown" && fn.kind === "var" && ctx.fnReturns.has(fn.name)) {
                 ty = ctx.fnReturns.get(fn.name);
             }
+            // filterMap: `seqOfOption.filter(x => x !== undefined)` (a defined-check,
+            // typically with an `x is T` type guard) drops the Nones AND unwraps to
+            // seq<T>. Rewrite to a synthetic `filterSome` call lowered to the proven
+            // SeqFilterSome preamble (a plain `Map(.value, Filter(.Some?))` wouldn't
+            // verify — `.value` is partial).
+            if (e.fn.kind === "field" && e.fn.field === "filter" && e.args.length === 1
+                && isDefinedCheckRawLambda(e.args[0])
+                && fn.kind === "field" && fn.obj.ty.kind === "array" && fn.obj.ty.elem.kind === "optional") {
+                return { kind: "call", fn: { ...fn, field: "filterSome" }, args: [], ty: { kind: "array", elem: fn.obj.ty.elem.inner }, callKind: "method" };
+            }
             return { kind: "call", fn, args, ty, callKind: classifyCall(e.fn, ctx) };
         }
         case "index": {
@@ -855,12 +964,21 @@ function resolveExpr(e, ctx) {
             let lambdaEnv = ctx.env;
             for (const p of params)
                 lambdaEnv = extend(lambdaEnv, p.name, p.ty);
-            const lambdaCtx = { ...withEnv(ctx, lambdaEnv), inLambda: true };
+            // Set returnTy to the lambda's own return annotation (not the enclosing
+            // function's), so return-position record literals in the body resolve to
+            // their named type rather than an anonymous tuple.
+            const lambdaReturnTy = e.returnTsType ? parseTsType(e.returnTsType) : { kind: "unknown" };
+            const lambdaCtx = { ...withEnv(ctx, lambdaEnv), inLambda: true, returnTy: lambdaReturnTy };
             // Body: expression (wrap in return stmt) or statement block
             const body = Array.isArray(e.body)
                 ? resolveBlock(e.body, lambdaCtx)
                 : [{ kind: "return", value: resolveExpr(e.body, lambdaCtx) }];
-            return { kind: "lambda", params, body, ty: { kind: "unknown" } };
+            // Carry the lambda's type as a fn type when its return is known, so chained
+            // array methods (`.map(...).filter(...)`) can infer downstream element types.
+            const lamTy = e.returnTsType
+                ? { kind: "fn", params: params.map(p => p.ty), result: lambdaReturnTy }
+                : { kind: "unknown" };
+            return { kind: "lambda", params, body, ty: lamTy };
         }
         case "conditional": {
             const cond = resolveExpr(e.cond, ctx);
@@ -1002,6 +1120,12 @@ function resolveStmt(s, ctx) {
                     ? { kind: "optional", inner: init.ty }
                     : init.ty;
             }
+            else if ((declTy.kind === "int" || declTy.kind === "nat") && init.ty.kind === "real" && !ctx.overrides.has(s.name)) {
+                // TS infers `number` (→ int/nat) for an expression LS computes as `real`
+                // (e.g. `a / b`, now real division). `number` can't tell them apart, so
+                // trust the real-valued initializer — unless the user pinned the type.
+                ty = init.ty;
+            }
             else {
                 // Map indexing: TS says T, but access can fail → use Optional<T> from init
                 ty = (declTy.kind !== "optional" && init.ty.kind === "optional") ? init.ty : declTy;
@@ -1388,6 +1512,7 @@ function precomputeFieldTypesInner(typeDecls) {
     }
 }
 export function resolveModule(raw) {
+    _warnedRefEq.clear();
     precomputeFieldTypes(raw.typeDecls);
     const pureFns = computePureFns(raw.functions);
     // Pre-compute function parameter and return types

package/tools/dist/transform.js

@@ -32,6 +32,7 @@ function mapExpr(e, f) {
         case "app": return { ...e, args: e.args.map(r) };
         case "field": return { ...e, obj: r(e.obj) };
         case "toNat": return { ...e, expr: r(e.expr) };
+        case "toReal": return { ...e, expr: r(e.expr) };
         case "index": return { ...e, arr: r(e.arr), idx: r(e.idx) };
         case "record": return { ...e, spread: e.spread ? r(e.spread) : null, fields: e.fields.map(fi => ({ ...fi, value: r(fi.value) })) };
         case "arrayLiteral": return { ...e, elems: e.elems.map(r) };
@@ -154,6 +155,7 @@ function buildMatchPattern(variantName, fields, scopePrefix) {
 }
 const _forofCounters = new Map();
 function isNat(ty) { return ty.kind === "nat"; }
+function isIntegral(ty) { return ty.kind === "int" || ty.kind === "nat"; }
 function isArray(ty) { return ty.kind === "array"; }
 function isUser(ty) { return ty.kind === "user"; }
 /** Check if transformed lambda body contains monadic binds. */
@@ -186,6 +188,8 @@ const OP_MAP = {
 const BOOL_OP_MAP = {
     ...OP_MAP, "===": "==", "!==": "!=",
 };
+/** Arithmetic + comparison ops eligible for int→real operand coercion. */
+const NUMERIC_OPS = new Set(["+", "-", "*", "/", "===", "!==", ">=", "<=", ">", "<"]);
 function transformExpr(e) { return lowerExpr(e, null); }
 /** Reduce an if/let/return-shaped statement body to a single expression, for
  *  expression-only lambda bodies. Returns null for shapes that can't be a pure
@@ -219,6 +223,19 @@ function flattenLambdaBody(stmts) {
         const elseExpr = flattenLambdaBody(first.else.length > 0 ? [...first.else, ...rest] : rest);
         return thenExpr === null || elseExpr === null ? null : { kind: "if", cond: first.cond, then: thenExpr, else: elseExpr };
     }
+    // A `switch` lowered to a match-statement: reduce each arm's body to an
+    // expression (an arm that doesn't return falls through into `rest`), giving a
+    // match-expression — same reduction the `if` case does, one level wider.
+    if (first.kind === "match") {
+        const arms = [];
+        for (const arm of first.arms) {
+            const armExpr = flattenLambdaBody([...arm.body, ...rest]);
+            if (armExpr === null)
+                return null;
+            arms.push({ pattern: arm.pattern, body: armExpr });
+        }
+        return { kind: "match", scrutinee: first.scrutinee, arms };
+    }
     return null;
 }
 /**
@@ -419,6 +436,20 @@ function lowerExpr(e, binds) {
                         right: { kind: "app", fn: "NatToString", args: [lowerExpr(e.right, binds)] } };
                 }
             }
+            // Numeric int→real coercion. After resolve, `/` is always real, and any
+            // arithmetic/comparison mixing real and integral operands is real-valued.
+            // Lift each integral operand to `real` so the backend sees homogeneous
+            // real operations (Dafny `as real`, Lean Int→Float).
+            if (NUMERIC_OPS.has(e.op)) {
+                const realCtx = e.ty.kind === "real" || e.left.ty.kind === "real" || e.right.ty.kind === "real";
+                if (realCtx) {
+                    const lift = (operand) => {
+                        const lowered = lowerExpr(operand, binds);
+                        return isIntegral(operand.ty) ? { kind: "toReal", expr: lowered } : lowered;
+                    };
+                    return { kind: "binop", op: OP_MAP[e.op] ?? e.op, left: lift(e.left), right: lift(e.right) };
+                }
+            }
             return {
                 kind: "binop",
                 op: OP_MAP[e.op] ?? e.op,
@@ -494,13 +525,23 @@ function lowerExpr(e, binds) {
                     return { kind: "app", fn: "CeilReal", args: [lowerExpr(arg, binds)] };
                 return lowerExpr(arg, binds);
             }
-            // Math.floor(x): FloorReal on real args, JSFloorDiv for int division, identity on int
+            // Math.floor(x):
+            //   - a / b on integral operands → integer floor division, kept in
+            //     integer arithmetic (JSFloorDiv on Dafny; native Int/Nat `/` floors
+            //     on Lean). Checked first: after resolve, `a / b` is typed `real`, so
+            //     the real branch below would otherwise drag it into real arithmetic.
+            //   - real arg → FloorReal (Dafny's .Floor)
+            //   - int arg → identity
             if (e.fn.kind === "field" && e.fn.field === "floor" && e.fn.obj.kind === "var" && e.fn.obj.name === "Math" && e.args.length === 1) {
                 const arg = e.args[0];
+                if (arg.kind === "binop" && arg.op === "/" && isIntegral(arg.left.ty) && isIntegral(arg.right.ty)) {
+                    const l = lowerExpr(arg.left, binds), r = lowerExpr(arg.right, binds);
+                    return _opts.backend === "dafny"
+                        ? { kind: "app", fn: "JSFloorDiv", args: [l, r] }
+                        : { kind: "binop", op: "/", left: l, right: r };
+                }
                 if (arg.ty.kind === "real")
                     return { kind: "app", fn: "FloorReal", args: [lowerExpr(arg, binds)] };
-                if (_opts.backend === "dafny" && arg.kind === "binop" && arg.op === "/")
-                    return { kind: "app", fn: "JSFloorDiv", args: [lowerExpr(arg.left, binds), lowerExpr(arg.right, binds)] };
                 return lowerExpr(arg, binds);
             }
             // Method call: receiver.method(args) → methodCall node
@@ -642,7 +683,10 @@ function lowerExpr(e, binds) {
                 return { kind: "app", fn: "SetLiteral", args: e.elems.map(el => lowerExpr(el, binds)) };
             return { kind: "arrayLiteral", elems: e.elems.map(el => lowerExpr(el, binds)) };
         case "lambda": {
-            const body = transformStmts(e.body, []);
+            // Pass the module typeDecls (not []), so type lookups inside the lambda
+            // body — e.g. a `switch`'s variant fields — resolve. A bare `[]` left a
+            // discriminated-union switch in a lambda with binderless patterns.
+            const body = transformStmts(e.body, _typeDecls);
             // Flatten an if/let/return-shaped multi-statement body into a single
             // `return <expr>` so both backends' single-return-lambda fast path emits
             // it (Dafny lambdas are expression-only; Lean prefers the expression form
@@ -1321,14 +1365,37 @@ function remainingVariant(typeName, cases, typeDecls) {
         return null;
     return remaining[0];
 }
+/** `switch(obj.field)` is stripped at extraction to scrutinee `obj` + discriminant
+ *  `field`, assuming `obj` is a discriminated union with `field` as its
+ *  discriminant. When that's NOT so — e.g. `obj` is a plain record with an
+ *  enum-typed `field` — the switch is really on the enum VALUE. This returns the
+ *  enum scrutinee `obj.field` (+ the field's enum type) to match directly; null
+ *  for a genuine discriminant switch or `switch(localVar)`, which callers handle
+ *  their usual way. Shared by emitSwitchStmt and transformPureSwitch. */
+function enumFieldSwitch(s, typeDecls) {
+    if (!s.discriminant)
+        return null;
+    const objBase = s.expr.ty.kind === "user"
+        ? (s.expr.ty.name.includes("<") ? s.expr.ty.name.slice(0, s.expr.ty.name.indexOf("<")) : s.expr.ty.name)
+        : undefined;
+    const objDecl = objBase ? typeDecls.find(d => d.name === objBase) : undefined;
+    if (objDecl?.kind === "discriminated-union" && objDecl.discriminant === s.discriminant)
+        return null;
+    const fieldTy = objDecl?.kind === "record" ? objDecl.fields?.find(f => f.name === s.discriminant)?.type : undefined;
+    return {
+        scrutinee: { kind: "field", obj: transformExpr(s.expr), field: s.discriminant },
+        enumTyName: fieldTy?.kind === "user" ? fieldTy.name : undefined,
+    };
+}
 function emitSwitchStmt(s, typeDecls) {
-    const varName = s.expr.kind === "var" ? s.expr.name : "?";
-    const typeName = s.expr.ty.kind === "user" ? s.expr.ty.name : undefined;
     const cases = s.cases.map(c => ({ name: c.label, body: c.body }));
-    const arms = buildMatchArms(cases, varName, typeName, typeDecls, (body, vn, fields) => transformStmts(replaceFieldAccessInTStmts(body, vn, fields), typeDecls));
+    const ef = enumFieldSwitch(s, typeDecls);
+    const arms = ef
+        ? buildMatchArms(cases, undefined, ef.enumTyName, typeDecls, (body) => transformStmts(body, typeDecls))
+        : buildMatchArms(cases, s.expr.kind === "var" ? s.expr.name : "?", s.expr.ty.kind === "user" ? s.expr.ty.name : undefined, typeDecls, (body, vn, fields) => transformStmts(replaceFieldAccessInTStmts(body, vn, fields), typeDecls));
     if (s.defaultBody.length > 0)
         arms.push({ pattern: "_", body: transformStmts(s.defaultBody, typeDecls) });
-    return { kind: "match", scrutinee: varName, arms };
+    return { kind: "match", scrutinee: ef ? ef.scrutinee : (s.expr.kind === "var" ? s.expr.name : "?"), arms };
 }
 /** Replace obj.field → replacement var in typed IR.
  *  Uses the TExpr's resolved type when available, falling back to `fallbackTy`. */
@@ -1472,6 +1539,20 @@ function transformPureBody(stmts, typeDecls) {
     return null;
 }
 function transformPureSwitch(s, typeDecls) {
+    const ef = enumFieldSwitch(s, typeDecls);
+    if (ef) {
+        const cases = s.cases.map(c => ({ name: c.label, body: c.body }));
+        const arms = buildMatchArms(cases, undefined, ef.enumTyName, typeDecls, (body) => transformPureBody(body, typeDecls));
+        if (!arms)
+            return null;
+        if (s.defaultBody.length > 0) {
+            const body = transformPureBody(s.defaultBody, typeDecls);
+            if (!body)
+                return null;
+            arms.push({ pattern: "_", body });
+        }
+        return { kind: "match", scrutinee: ef.scrutinee, arms };
+    }
     const typeName = s.expr.ty.kind === "user" ? s.expr.ty.name : "";
     if (!typeDecls.find(d => d.name === typeName))
         return null;
@@ -1570,6 +1651,9 @@ function transformTypeDecl(d) {
             target: d.aliasOfTy,
         };
     }
+    else if (d.kind === "opaque") {
+        return { kind: "opaque-type", name: d.name };
+    }
     else {
         return {
             kind: "structure", name: d.name,

package/tools/dist/typedir.js

@@ -4,4 +4,7 @@
  * Produced by the resolve pass. Consumed by the transform.
  * Still TS-shaped (not Lean-shaped).
  */
-export {};
+/** True for an int/nat that came from a TS `bigint` (integer division semantics). */
+export function isBigInt(ty) {
+    return (ty.kind === "int" || ty.kind === "nat") && !!ty.big;
+}

package/tools/dist/types.js

@@ -32,6 +32,11 @@ export function parseTsType(tsType) {
 function tyFromTypeNode(tn) {
     if (Node.isParenthesizedTypeNode(tn))
         return tyFromTypeNode(tn.getTypeNode());
+    // `readonly T[]` / `readonly [A, B]` — the modifier is a TypeOperator wrapping
+    // the array/tuple; verification treats it identically to the mutable form.
+    if (Node.isTypeOperatorTypeNode(tn) && tn.getOperator() === SyntaxKind.ReadonlyKeyword) {
+        return tyFromTypeNode(tn.getTypeNode());
+    }
     if (Node.isUnionTypeNode(tn)) {
         const arms = tn.getTypeNodes();
         const isBoolLit = (a) => Node.isLiteralTypeNode(a) && (a.getLiteral().getKind() === SyntaxKind.TrueKeyword || a.getLiteral().getKind() === SyntaxKind.FalseKeyword);
@@ -91,8 +96,9 @@ function tyFromTypeNode(tn) {
     }
     switch (tn.getKind()) {
         case SyntaxKind.NumberKeyword:
-        case SyntaxKind.BigIntKeyword:
             return { kind: "int" };
+        case SyntaxKind.BigIntKeyword:
+            return { kind: "int", big: true };
         case SyntaxKind.BooleanKeyword:
             return { kind: "bool" };
         case SyntaxKind.StringKeyword:
@@ -109,7 +115,11 @@ function tyFromTypeNode(tn) {
         const args = tn.getTypeArguments();
         if (name === "nat" && args.length === 0)
             return { kind: "nat" };
-        if (name === "Array" && args.length === 1)
+        if (name === "real" && args.length === 0)
+            return { kind: "real" };
+        if (name === "int" && args.length === 0)
+            return { kind: "int" };
+        if ((name === "Array" || name === "ReadonlyArray") && args.length === 1)
             return { kind: "array", elem: tyFromTypeNode(args[0]) };
         if (name === "Set" && args.length === 1)
             return { kind: "set", elem: tyFromTypeNode(args[0]) };