lemmascript 0.5.1 → 0.5.3

package/tools/dist/lean-emit.js

@@ -7,7 +7,22 @@ function tyToLean(ty) {
     switch (ty.kind) {
         case "nat": return "Nat";
         case "int": return "Int";
-        case "real": return "Float"; // Lean doesn't have exact reals; Float is approximate
+        case "real":
+            // Real arithmetic isn't supported by the Lean backend yet: ℝ is
+            // noncomputable and needs Mathlib's real-number development, so we fail
+            // fast here rather than emit Lean that can't compile.
+            //
+            // Workarounds, in order of preference:
+            //   1. If integer division was intended, write `Math.floor(a / b)` — it
+            //      lowers to flooring integer division on Lean (no real involved).
+            //   2. For `bigint` operands, `/` is already integer division — declaring
+            //      the value `bigint` instead of `number` keeps it off the real path.
+            //   3. If the file genuinely needs reals, restrict it to Dafny with a
+            //      `//@ backend dafny` directive.
+            // Full Lean real support is feasible but was set aside: it needs
+            // `import Mathlib.Data.Real.Basic`, `noncomputable def`s for real-valued
+            // functions, and the Int→ℝ coercion (see the stashed WIP for a sketch).
+            throw new Error("real arithmetic is not supported by the Lean backend (needs noncomputable ℝ / Mathlib).");
         case "bool": return "Bool";
         case "string": return "String";
         case "void": return "Unit";
@@ -90,6 +105,16 @@ function emitMethodCall(tyKind, method, monadic, obj, args) {
             return `Array.push ${obj} ${args[0]}`;
         if (method === "concat")
             return `Array.push ${obj} ${args[0]}`;
+        // arr.slice → Array.extract. No-arg slice is a full copy (Array is a value
+        // type in Lean, so the receiver itself); one arg drops the prefix, two args
+        // give the half-open range. Matches JS for non-negative bounds (negative
+        // indices are unsupported — same caveat as the Dafny backend's direct slice).
+        if (method === "slice" && args.length === 0)
+            return obj;
+        if (method === "slice" && args.length === 1)
+            return `${obj}.extract ${args[0]} ${obj}.size`;
+        if (method === "slice" && args.length === 2)
+            return `${obj}.extract ${args[0]} ${args[1]}`;
     }
     // String methods
     if (tyKind === "string") {
@@ -122,12 +147,17 @@ function emitMethodCall(tyKind, method, monadic, obj, args) {
     throw new Error(`Unsupported Lean method call: .${method}() on ${tyKind}`);
 }
 // ── Expression emission ─────────────────────────────────────
-// Lean's `∀`/`∃` body extends as far as possible. So `(∃ x, P) <op> Q`
-// (or `∃ x, P → Q`) would parse with the operator absorbed into the body.
-// Wrap a quantifier in parens to terminate its body before the operator.
-function wrapQuantifier(sub, parentPrec) {
+// Some Lean term forms extend their body as far as possible: `∀`/`∃` bodies,
+// and `if`/`let` tails. As an operator operand they would swallow the operator
+// — `(if c then 1 else 0) + r` written bare parses as `if c then 1 else (0 + r)`.
+// Wrap these forms in parens so the operand is closed before the operator.
+// (`match` self-parenthesizes in `emitExpr`, and other forms close via
+// precedence, so neither needs wrapping here.)
+function wrapOperand(sub, parentPrec) {
     const inner = emitExpr(sub, parentPrec);
-    return (sub.kind === "forall" || sub.kind === "exists") ? `(${inner})` : inner;
+    return (sub.kind === "forall" || sub.kind === "exists" ||
+        sub.kind === "if" || sub.kind === "let")
+        ? `(${inner})` : inner;
 }
 function emitExpr(e, parentPrec) {
     switch (e.kind) {
@@ -183,19 +213,30 @@ function emitExpr(e, parentPrec) {
                 return `${wrap ? `(${recv})` : recv}.contains ${emitExpr(e.left)}`;
             }
             const op = e.op === "arrayConcat" ? "++" : e.op;
-            const s = `${wrapQuantifier(e.left, prec(e.op))} ${op} ${emitExpr(e.right, prec(e.op))}`;
+            const s = `${wrapOperand(e.left, prec(e.op))} ${op} ${wrapOperand(e.right, prec(e.op))}`;
             return (parentPrec !== undefined && prec(e.op) < parentPrec) ? `(${s})` : s;
         }
         case "implies": {
-            const parts = [...e.premises.map(p => wrapQuantifier(p)), emitExpr(e.conclusion)];
+            const parts = [...e.premises.map(p => wrapOperand(p)), emitExpr(e.conclusion)];
             const s = parts.join(" → ");
             return parentPrec !== undefined ? `(${s})` : s;
         }
         case "app": {
             const args = e.args.map(a => (a.kind === "binop" || a.kind === "unop" || a.kind === "implies" || a.kind === "app" || a.kind === "methodCall") ? `(${emitExpr(a)})` : emitExpr(a));
+            // Datatype constructor (tagged by transform): Lean needs the qualified name
+            // `BaseType.variant`; a bare `variant` is an unknown identifier. (Dafny keeps
+            // the bare form, so its output is unaffected.)
+            if (e.ctorOf)
+                return args.length ? `${e.ctorOf}.${e.fn} ${args.join(" ")}` : `${e.ctorOf}.${e.fn}`;
             // SetToSeq → .toArray for Lean (HashSet has native toArray)
             if (e.fn === "SetToSeq" && args.length === 1)
                 return `${args[0]}.toArray`;
+            // perm(a, b) → `List.Perm` on the underlying lists. Dafny lowers it to
+            // `multiset(a) == multiset(b)`; the Lean image is `a.toList ~ b.toList`,
+            // which mathlib's `List.Perm` provides (reflexivity, symmetry,
+            // `perm_append_comm`, and `Perm.count_eq` for the count-invariance payoff).
+            if (e.fn === "Perm" && args.length === 2)
+                return `(${args[0]}.toList).Perm (${args[1]}.toList)`;
             return `${e.fn} ${args.join(" ")}`;
         }
         case "field": {
@@ -210,6 +251,10 @@ function emitExpr(e, parentPrec) {
             const wrap = e.expr.kind !== "var" && e.expr.kind !== "num";
             return wrap ? `(${inner}).toNat` : `${inner}.toNat`;
         }
+        case "toReal":
+            // A real value reached the Lean backend via coercion (e.g. number `/`).
+            // Same unsupported-real story as the `real` type case in tyToLean.
+            throw new Error("real arithmetic is not supported by the Lean backend (needs noncomputable ℝ / Mathlib).");
         case "index":
             return `${emitExpr(e.arr)}[${emitExpr(e.idx)}]!`;
         case "record": {
@@ -393,9 +438,24 @@ function emitDecl(d) {
         case "type-alias": {
             return `abbrev ${d.name} := ${tyToLean(d.target)}`;
         }
+        case "opaque-type": {
+            // Abstract type — no definition. Never constructed or destructured.
+            return `opaque ${d.name} : Type`;
+        }
         case "def": {
             const params = d.params.map(p => `(${escapeName(p.name)} : ${tyToLean(p.type)})`).join(" ");
-            return `def ${d.name} ${params} : ${tyToLean(d.returnType)} :=\n${emitPureExpr(d.body, 1)}`;
+            let out = `def ${d.name} ${params} : ${tyToLean(d.returnType)} :=\n${emitPureExpr(d.body, 1)}`;
+            // A `//@ decreases` on a pure function marks it recursive and names its
+            // termination measure — emit it as Lean's `termination_by`. This is
+            // required when the recursion is on `arr.slice(...)` (→ `Array.extract`,
+            // which Lean cannot see as a structural subterm); for a bare-Nat counter
+            // Lean could infer structural recursion on its own, but honoring the
+            // clause uniformly is simpler and harmless. Lean's default `decreasing_by`
+            // discharges the goal in both cases (it knows `Array.size_extract`), so no
+            // explicit tactic is needed.
+            if (d.decreases)
+                out += `\ntermination_by ${emitExpr(d.decreases)}`;
+            return out;
         }
         case "def-by-method":
             throw new Error("function by method is not supported for Lean backend");

package/tools/dist/lsc.js

@@ -10,6 +10,7 @@ import path from "path";
 import { extractModule } from "./extract.js";
 import { resolveModule } from "./resolve.js";
 import { narrowModule } from "./narrow.js";
+import { autoHavocModule } from "./autohavoc.js";
 import { transformModuleLean, transformModuleDafny } from "./transform.js";
 import { peepholeModule } from "./peephole.js";
 import { emitLeanFile } from "./lean-emit.js";
@@ -95,7 +96,10 @@ function main() {
     // Resolve: Raw IR → Typed IR
     const resolved = resolveModule(raw);
     // Narrow: Typed IR → Typed IR (rewrites optional-narrowing patterns to someMatch)
-    const typed = narrowModule(resolved);
+    // auto-havoc (//@ autohavoc): replace unmodellable expressions with arbitrary
+    // values so verification rests only on the declared contracts (a sound
+    // over-approximation). No-op unless a function opts in.
+    const typed = autoHavocModule(narrowModule(resolved));
     const dir = path.dirname(absPath);
     const base = path.basename(filePath, ".ts");
     // ── Dafny backend ─────────────────────────────────────────

package/tools/dist/narrow.js

@@ -349,14 +349,18 @@ function ruleConditionalArrayIsArray(e) {
     if (e.kind !== "conditional")
         return null;
     const pos = parseArrayIsArrayCall(e.cond);
-    const neg = e.cond.kind === "unop" && e.cond.op === "!"
+    // `typeof x === "string"` is a positive check like `Array.isArray`, but selects
+    // the NonArrayBranch — its then-branch is the matched-variant body.
+    const tof = pos ? null : parseTypeofStringCheck(e.cond);
+    const neg = !pos && !tof && e.cond.kind === "unop" && e.cond.op === "!"
         ? parseArrayIsArrayCall(e.cond.expr)
         : null;
-    const matched = pos ?? (neg ? { scrutinee: neg.scrutinee, typeName: neg.typeName, variant: "NonArrayBranch" } : null);
+    const matched = pos ?? tof ?? (neg ? { scrutinee: neg.scrutinee, typeName: neg.typeName, variant: "NonArrayBranch" } : null);
     if (!matched)
         return null;
-    const thenBody = pos ? e.then : e.else;
-    const elseBody = pos ? e.else : e.then;
+    const positive = pos ?? tof;
+    const thenBody = positive ? e.then : e.else;
+    const elseBody = positive ? e.else : e.then;
     return {
         kind: "tagMatch",
         scrutinee: matched.scrutinee,
@@ -602,6 +606,30 @@ function parseArrayIsArrayCall(call) {
         return null;
     return { scrutinee: arg, typeName: arg.ty.name, variant: "ArrayBranch" };
 }
+/** Detect `typeof <path> === "string"` where `<path>`'s type is a synth array-
+ *  union (`U | T[]`) AND its `NonArrayBranch` payload `U` is itself `string`.
+ *  The runtime `=== "string"` test matches that branch only when `U` is string —
+ *  for any other non-array payload (`number | T[]`, …) it never holds, so we must
+ *  NOT narrow. Returns the `NonArrayBranch` variant; the dual of `Array.isArray`. */
+function parseTypeofStringCheck(e) {
+    if (e.kind !== "binop" || e.op !== "===")
+        return null;
+    const tof = e.left.kind === "unop" && e.left.op === "typeof" ? e.left.expr
+        : e.right.kind === "unop" && e.right.op === "typeof" ? e.right.expr : null;
+    const lit = e.left.kind === "str" ? e.left.value : e.right.kind === "str" ? e.right.value : null;
+    if (!tof || lit !== "string")
+        return null;
+    if (!isNarrowablePath(tof) || tof.ty.kind !== "user")
+        return null;
+    const baseTyName = tof.ty.name.includes("<") ? tof.ty.name.slice(0, tof.ty.name.indexOf("<")) : tof.ty.name;
+    const decl = _typeDecls.find(d => d.name === baseTyName);
+    if (decl?.kind !== "discriminated-union" || decl.discriminant !== "__isArray__")
+        return null;
+    const valTy = decl.variants?.find(v => v.name === "NonArrayBranch")?.fields.find(f => f.name === "val")?.type;
+    if (valTy?.kind !== "string")
+        return null; // guard: the non-array branch must actually be `string`
+    return { scrutinee: tof, typeName: tof.ty.name, variant: "NonArrayBranch" };
+}
 /** A "narrowable path" is a var or a chain of field accesses rooted at a var
  *  — i.e., pure and structurally addressable, so transforms can substitute
  *  occurrences inside a matched arm without worrying about re-evaluation. */

package/tools/dist/peephole.js

@@ -20,6 +20,7 @@ function mapExpr(e, f) {
         case "app": return { ...e, args: e.args.map(r) };
         case "field": return { ...e, obj: r(e.obj) };
         case "toNat": return { ...e, expr: r(e.expr) };
+        case "toReal": return { ...e, expr: r(e.expr) };
         case "index": return { ...e, arr: r(e.arr), idx: r(e.idx) };
         case "record": return { ...e, spread: e.spread ? r(e.spread) : null,
             fields: e.fields.map(fi => ({ ...fi, value: r(fi.value) })) };
@@ -364,6 +365,7 @@ function rewriteChildrenExpr(e) {
         case "app": return { ...e, args: e.args.map(r) };
         case "field": return { ...e, obj: r(e.obj) };
         case "toNat": return { ...e, expr: r(e.expr) };
+        case "toReal": return { ...e, expr: r(e.expr) };
         case "index": return { ...e, arr: r(e.arr), idx: r(e.idx) };
         case "record": return { ...e, spread: e.spread ? r(e.spread) : null,
             fields: e.fields.map(fi => ({ ...fi, value: r(fi.value) })) };
@@ -445,6 +447,7 @@ function peepholeDecl(d) {
         case "inductive":
         case "structure":
         case "type-alias":
+        case "opaque-type":
         case "extern":
             return d;
     }

package/tools/dist/resolve.js

@@ -4,6 +4,7 @@
  * Uses linked environments (Scheme-style) for lexical scoping.
  * No mutation — each let extends the chain, lookup walks it.
  */
+import { isBigInt } from "./typedir.js";
 import { parseTsType } from "./types.js";
 import { parseExpr } from "./specparser.js";
 function lookup(env, name) {
@@ -447,6 +448,12 @@ function tyToTsStr(ty) {
         return "number";
     if (ty.kind === "bool")
         return "boolean";
+    // Optional element (e.g. a `.filter` over a `T | undefined`-typed map result):
+    // type the callback param so its `x !== undefined` check narrows correctly.
+    if (ty.kind === "optional") {
+        const inner = tyToTsStr(ty.inner);
+        return inner ? `${inner} | undefined` : undefined;
+    }
     return undefined;
 }
 function inferLambdaParamTypes(fn, rawArgs, ctx) {
@@ -486,6 +493,21 @@ function inferLambdaParamTypes(fn, rawArgs, ctx) {
     }
     return rawArgs;
 }
+/** A defined-check filter predicate: `(x) => x !== undefined` (expression or
+ *  single-return body). Detected on the raw IR before narrowing rewrites it. */
+function isDefinedCheckRawLambda(raw) {
+    if (raw.kind !== "lambda" || raw.params.length !== 1)
+        return false;
+    const p = raw.params[0].name;
+    const body = Array.isArray(raw.body)
+        ? (raw.body.length === 1 && raw.body[0].kind === "return" ? raw.body[0].value : null)
+        : raw.body;
+    if (!body || body.kind !== "binop" || body.op !== "!==")
+        return false;
+    const isParam = (x) => x.kind === "var" && x.name === p;
+    const isUndef = (x) => x.kind === "var" && x.name === "undefined";
+    return (isParam(body.left) && isUndef(body.right)) || (isParam(body.right) && isUndef(body.left));
+}
 /** Coerce call arguments: string literals → user types, non-optional → Some, pad missing optional args. */
 function coerceCallArgs(args, fn, ctx) {
     if (fn.kind !== "var" || !ctx.fnParams.has(fn.name))
@@ -517,6 +539,16 @@ function inferMethodReturnTy(fn, args, ctx) {
     if (fn.obj.kind === "var" && fn.obj.name === "Array" && fn.field === "isArray") {
         return { kind: "bool" };
     }
+    // Math.* numeric builtins: abs/min/max preserve the operand's numeric type
+    // (real if any operand is real); floor/ceil/round/trunc return an integer.
+    if (fn.obj.kind === "var" && fn.obj.name === "Math") {
+        if (fn.field === "abs" && args.length === 1)
+            return args[0].ty;
+        if ((fn.field === "min" || fn.field === "max") && args.length >= 1)
+            return args.some(a => a.ty.kind === "real") ? { kind: "real" } : args[0].ty;
+        if (["floor", "ceil", "round", "trunc"].includes(fn.field))
+            return { kind: "int" };
+    }
     const objTy = fn.obj.ty;
     if (objTy.kind === "map") {
         if (fn.field === "get")
@@ -558,8 +590,11 @@ function inferMethodReturnTy(fn, args, ctx) {
         if (fn.field === "join" && objTy.elem.kind === "string")
             return { kind: "string" };
         if (fn.field === "map" && args.length >= 1 && args[0].kind === "lambda") {
-            const retTy = args[0].body.length > 0 && args[0].body[0].kind === "return"
-                ? args[0].body[0].value.ty : { kind: "unknown" };
+            const lam = args[0];
+            // Prefer the lambda's declared return type (handles multi-statement bodies
+            // where body[0] is an `if`, not a `return`); fall back to the body's return.
+            const retTy = lam.ty.kind === "fn" ? lam.ty.result
+                : lam.body.length > 0 && lam.body[0].kind === "return" ? lam.body[0].value.ty : { kind: "unknown" };
             return { kind: "array", elem: retTy };
         }
     }
@@ -613,6 +648,8 @@ function resolveExpr(e, ctx) {
         case "num":
             if (!Number.isInteger(e.value))
                 return { kind: "num", value: e.value, ty: { kind: "real" } };
+            if (e.big)
+                return { kind: "num", value: e.value, ty: { kind: "int", big: true } };
             return { kind: "num", value: e.value, ty: e.value >= 0 ? { kind: "nat" } : { kind: "int" } };
         case "str":
             return { kind: "str", value: e.value, ty: { kind: "string" } };
@@ -658,16 +695,38 @@ function resolveExpr(e, ctx) {
             }
             else if (e.op === "||")
                 ty = right.ty;
-            else if (["+", "-", "*", "/", "%"].includes(e.op)) {
+            else if (e.op === "/") {
+                // `number / number` is real (floating-point) division: 3 / 2 === 1.5,
+                // never 1 — an integer quotient requires an explicit Math.floor (which
+                // lowers to JSFloorDiv). But `bigint / bigint` is genuinely integer
+                // division in JS (3n / 2n === 1n), so keep it integer.
+                ty = (isBigInt(left.ty) || isBigInt(right.ty)) ? { kind: "int", big: true } : { kind: "real" };
+            }
+            else if (["+", "-", "*", "%"].includes(e.op)) {
                 ty = (left.ty.kind === "real" || right.ty.kind === "real") ? { kind: "real" } : left.ty;
             }
             return { kind: "binop", op: e.op, left, right, ty };
         }
         case "unop": {
             const expr = resolveExpr(e.expr, ctx);
-            return { kind: "unop", op: e.op, expr, ty: e.op === "!" ? { kind: "bool" } : expr.ty };
+            const ty = e.op === "!" ? { kind: "bool" } : e.op === "typeof" ? { kind: "string" } : expr.ty;
+            return { kind: "unop", op: e.op, expr, ty };
         }
         case "call": {
+            // perm(a, b): spec-only permutation predicate — true iff `a` and `b` are
+            // reorderings of each other (equal as multisets). Lowers to the `Perm`
+            // preamble (Dafny `multiset(a) == multiset(b)`; Lean `a.toList ~ b.toList`).
+            // It has no runtime counterpart, so it is rejected outside `//@` specs.
+            if (e.fn.kind === "var" && e.fn.name === "perm" && e.args.length === 2) {
+                if (!ctx.inSpec)
+                    throw new Error("perm(a, b) may only be used in //@ specifications");
+                const a = resolveExpr(e.args[0], ctx);
+                const b = resolveExpr(e.args[1], ctx);
+                if (a.ty.kind !== "array" || b.ty.kind !== "array")
+                    throw new Error(`perm(a, b) requires two array arguments (got ${a.ty.kind} and ${b.ty.kind})`);
+                const fn = { kind: "var", name: "Perm", ty: { kind: "unknown" } };
+                return { kind: "call", fn, args: [a, b], ty: { kind: "bool" }, callKind: "pure" };
+            }
             // Extern dispatch: `NS.method(args)` where NS.method is declared via
             // `//@ extern`. Rewrite into a flat-name call (`NS_method(args)`) so the
             // rest of the pipeline sees an ordinary pure function. The extern's
@@ -711,6 +770,16 @@ function resolveExpr(e, ctx) {
             if (ty.kind === "unknown" && fn.kind === "var" && ctx.fnReturns.has(fn.name)) {
                 ty = ctx.fnReturns.get(fn.name);
             }
+            // filterMap: `seqOfOption.filter(x => x !== undefined)` (a defined-check,
+            // typically with an `x is T` type guard) drops the Nones AND unwraps to
+            // seq<T>. Rewrite to a synthetic `filterSome` call lowered to the proven
+            // SeqFilterSome preamble (a plain `Map(.value, Filter(.Some?))` wouldn't
+            // verify — `.value` is partial).
+            if (e.fn.kind === "field" && e.fn.field === "filter" && e.args.length === 1
+                && isDefinedCheckRawLambda(e.args[0])
+                && fn.kind === "field" && fn.obj.ty.kind === "array" && fn.obj.ty.elem.kind === "optional") {
+                return { kind: "call", fn: { ...fn, field: "filterSome" }, args: [], ty: { kind: "array", elem: fn.obj.ty.elem.inner }, callKind: "method" };
+            }
             return { kind: "call", fn, args, ty, callKind: classifyCall(e.fn, ctx) };
         }
         case "index": {
@@ -881,7 +950,13 @@ function resolveExpr(e, ctx) {
             return { kind: "exists", var: e.var, varTy, body: resolveExpr(e.body, withEnv(ctx, extend(ctx.env, e.var, varTy))), ty: { kind: "bool" } };
         }
         case "arrayLiteral": {
-            const elems = e.elems.map(el => resolveExpr(el, ctx));
+            // Thread the expected element type into each element, so a record/union
+            // literal in an array resolves to its named datatype rather than an
+            // anonymous tuple (mirrors return-position and call-argument records, which
+            // get their type via ctx.returnTy). Only narrow when the context type is an
+            // array; otherwise leave ctx untouched.
+            const elemCtx = ctx.returnTy.kind === "array" ? { ...ctx, returnTy: ctx.returnTy.elem } : ctx;
+            const elems = e.elems.map(el => resolveExpr(el, elemCtx));
             const elemTy = elems.length > 0 ? elems[0].ty : { kind: "unknown" };
             return { kind: "arrayLiteral", elems, ty: { kind: "array", elem: elemTy } };
         }
@@ -895,12 +970,21 @@ function resolveExpr(e, ctx) {
             let lambdaEnv = ctx.env;
             for (const p of params)
                 lambdaEnv = extend(lambdaEnv, p.name, p.ty);
-            const lambdaCtx = { ...withEnv(ctx, lambdaEnv), inLambda: true };
+            // Set returnTy to the lambda's own return annotation (not the enclosing
+            // function's), so return-position record literals in the body resolve to
+            // their named type rather than an anonymous tuple.
+            const lambdaReturnTy = e.returnTsType ? parseTsType(e.returnTsType) : { kind: "unknown" };
+            const lambdaCtx = { ...withEnv(ctx, lambdaEnv), inLambda: true, returnTy: lambdaReturnTy };
             // Body: expression (wrap in return stmt) or statement block
             const body = Array.isArray(e.body)
                 ? resolveBlock(e.body, lambdaCtx)
                 : [{ kind: "return", value: resolveExpr(e.body, lambdaCtx) }];
-            return { kind: "lambda", params, body, ty: { kind: "unknown" } };
+            // Carry the lambda's type as a fn type when its return is known, so chained
+            // array methods (`.map(...).filter(...)`) can infer downstream element types.
+            const lamTy = e.returnTsType
+                ? { kind: "fn", params: params.map(p => p.ty), result: lambdaReturnTy }
+                : { kind: "unknown" };
+            return { kind: "lambda", params, body, ty: lamTy };
         }
         case "conditional": {
             const cond = resolveExpr(e.cond, ctx);
@@ -1028,9 +1112,11 @@ function resolveStmt(s, ctx) {
             // to its underlying type, so array methods / index-assignment on the
             // local dispatch correctly (params get the same treatment, see makeParams).
             const declTy = expandAlias(resolveTsType(s.tsType, ctx.overrides, s.name), ctx.typeDecls);
-            // Propagate declared type as returnTy so nested record expressions
-            // resolve union variants correctly (e.g., EffectState → mode: EffectMode → { kind: 'Idle' })
-            const initCtx = declTy.kind === "user" ? { ...ctx, returnTy: declTy } : ctx;
+            // Propagate declared type as returnTy so nested record expressions resolve
+            // union variants correctly (e.g., EffectState → mode: EffectMode → { kind:
+            // 'Idle' }). Arrays too, so `const xs: Foo[] = [{...}]` threads the element
+            // type into the array literal (see the arrayLiteral case).
+            const initCtx = (declTy.kind === "user" || declTy.kind === "array") ? { ...ctx, returnTy: declTy } : ctx;
             const init = coerceStr(resolveExpr(s.init, initCtx), declTy);
             let ty;
             if (isUnmodeledTy(declTy, ctx.typeDecls) && !isUnmodeledTy(init.ty, ctx.typeDecls)) {
@@ -1042,6 +1128,12 @@ function resolveStmt(s, ctx) {
                     ? { kind: "optional", inner: init.ty }
                     : init.ty;
             }
+            else if ((declTy.kind === "int" || declTy.kind === "nat") && init.ty.kind === "real" && !ctx.overrides.has(s.name)) {
+                // TS infers `number` (→ int/nat) for an expression LS computes as `real`
+                // (e.g. `a / b`, now real division). `number` can't tell them apart, so
+                // trust the real-valued initializer — unless the user pinned the type.
+                ty = init.ty;
+            }
             else {
                 // Map indexing: TS says T, but access can fail → use Optional<T> from init
                 ty = (declTy.kind !== "optional" && init.ty.kind === "optional") ? init.ty : declTy;
@@ -1381,6 +1473,7 @@ function resolveFunction(fn, typeDecls, pureFns, fnParams = new Map(), fnReturns
         decreases: fn.decreases ? resolveSpec(fn.decreases, requiresCtx) : null,
         isPure: opts?.forcePure !== undefined ? opts.forcePure : pureFns.has(fn.name),
         forcePure: fn.pure,
+        autohavoc: fn.autohavoc,
         body: resolveBlock(fn.body, bodyCtx),
     };
 }

package/tools/dist/transform.js

@@ -32,6 +32,7 @@ function mapExpr(e, f) {
         case "app": return { ...e, args: e.args.map(r) };
         case "field": return { ...e, obj: r(e.obj) };
         case "toNat": return { ...e, expr: r(e.expr) };
+        case "toReal": return { ...e, expr: r(e.expr) };
         case "index": return { ...e, arr: r(e.arr), idx: r(e.idx) };
         case "record": return { ...e, spread: e.spread ? r(e.spread) : null, fields: e.fields.map(fi => ({ ...fi, value: r(fi.value) })) };
         case "arrayLiteral": return { ...e, elems: e.elems.map(r) };
@@ -154,6 +155,7 @@ function buildMatchPattern(variantName, fields, scopePrefix) {
 }
 const _forofCounters = new Map();
 function isNat(ty) { return ty.kind === "nat"; }
+function isIntegral(ty) { return ty.kind === "int" || ty.kind === "nat"; }
 function isArray(ty) { return ty.kind === "array"; }
 function isUser(ty) { return ty.kind === "user"; }
 /** Check if transformed lambda body contains monadic binds. */
@@ -186,6 +188,8 @@ const OP_MAP = {
 const BOOL_OP_MAP = {
     ...OP_MAP, "===": "==", "!==": "!=",
 };
+/** Arithmetic + comparison ops eligible for int→real operand coercion. */
+const NUMERIC_OPS = new Set(["+", "-", "*", "/", "===", "!==", ">=", "<=", ">", "<"]);
 function transformExpr(e) { return lowerExpr(e, null); }
 /** Reduce an if/let/return-shaped statement body to a single expression, for
  *  expression-only lambda bodies. Returns null for shapes that can't be a pure
@@ -219,6 +223,19 @@ function flattenLambdaBody(stmts) {
         const elseExpr = flattenLambdaBody(first.else.length > 0 ? [...first.else, ...rest] : rest);
         return thenExpr === null || elseExpr === null ? null : { kind: "if", cond: first.cond, then: thenExpr, else: elseExpr };
     }
+    // A `switch` lowered to a match-statement: reduce each arm's body to an
+    // expression (an arm that doesn't return falls through into `rest`), giving a
+    // match-expression — same reduction the `if` case does, one level wider.
+    if (first.kind === "match") {
+        const arms = [];
+        for (const arm of first.arms) {
+            const armExpr = flattenLambdaBody([...arm.body, ...rest]);
+            if (armExpr === null)
+                return null;
+            arms.push({ pattern: arm.pattern, body: armExpr });
+        }
+        return { kind: "match", scrutinee: first.scrutinee, arms };
+    }
     return null;
 }
 /**
@@ -419,6 +436,20 @@ function lowerExpr(e, binds) {
                         right: { kind: "app", fn: "NatToString", args: [lowerExpr(e.right, binds)] } };
                 }
             }
+            // Numeric int→real coercion. After resolve, `/` is always real, and any
+            // arithmetic/comparison mixing real and integral operands is real-valued.
+            // Lift each integral operand to `real` so the backend sees homogeneous
+            // real operations (Dafny `as real`, Lean Int→Float).
+            if (NUMERIC_OPS.has(e.op)) {
+                const realCtx = e.ty.kind === "real" || e.left.ty.kind === "real" || e.right.ty.kind === "real";
+                if (realCtx) {
+                    const lift = (operand) => {
+                        const lowered = lowerExpr(operand, binds);
+                        return isIntegral(operand.ty) ? { kind: "toReal", expr: lowered } : lowered;
+                    };
+                    return { kind: "binop", op: OP_MAP[e.op] ?? e.op, left: lift(e.left), right: lift(e.right) };
+                }
+            }
             return {
                 kind: "binop",
                 op: OP_MAP[e.op] ?? e.op,
@@ -494,13 +525,23 @@ function lowerExpr(e, binds) {
                     return { kind: "app", fn: "CeilReal", args: [lowerExpr(arg, binds)] };
                 return lowerExpr(arg, binds);
             }
-            // Math.floor(x): FloorReal on real args, JSFloorDiv for int division, identity on int
+            // Math.floor(x):
+            //   - a / b on integral operands → integer floor division, kept in
+            //     integer arithmetic (JSFloorDiv on Dafny; native Int/Nat `/` floors
+            //     on Lean). Checked first: after resolve, `a / b` is typed `real`, so
+            //     the real branch below would otherwise drag it into real arithmetic.
+            //   - real arg → FloorReal (Dafny's .Floor)
+            //   - int arg → identity
             if (e.fn.kind === "field" && e.fn.field === "floor" && e.fn.obj.kind === "var" && e.fn.obj.name === "Math" && e.args.length === 1) {
                 const arg = e.args[0];
+                if (arg.kind === "binop" && arg.op === "/" && isIntegral(arg.left.ty) && isIntegral(arg.right.ty)) {
+                    const l = lowerExpr(arg.left, binds), r = lowerExpr(arg.right, binds);
+                    return _opts.backend === "dafny"
+                        ? { kind: "app", fn: "JSFloorDiv", args: [l, r] }
+                        : { kind: "binop", op: "/", left: l, right: r };
+                }
                 if (arg.ty.kind === "real")
                     return { kind: "app", fn: "FloorReal", args: [lowerExpr(arg, binds)] };
-                if (_opts.backend === "dafny" && arg.kind === "binop" && arg.op === "/")
-                    return { kind: "app", fn: "JSFloorDiv", args: [lowerExpr(arg.left, binds), lowerExpr(arg.right, binds)] };
                 return lowerExpr(arg, binds);
             }
             // Method call: receiver.method(args) → methodCall node
@@ -564,12 +605,17 @@ function lowerExpr(e, binds) {
                             if (nonDiscFields.length === 0) {
                                 return { kind: "constructor", name: variantName, type: tyName };
                             }
-                            // Constructor with args: match variant field order
+                            // Constructor with args: match variant field order. Emit a bare `app`
+                            // (Dafny renders `variantName(args)`, a valid unqualified constructor
+                            // call — unchanged output) tagged with `ctorOf` so the Lean emitter,
+                            // which CANNOT take a bare constructor name, qualifies it as
+                            // `BaseType.variantName args`. Use the BASE type name (no generic args):
+                            // `Result.true_` is valid in Lean; `Result<Model,Err>.true_` is not.
                             const args = variant.fields.map(vf => {
                                 const ef = nonDiscFields.find(f => f.name === vf.name);
                                 return ef ? lowerExpr(ef.value, binds) : { kind: "var", name: "None" };
                             });
-                            return { kind: "app", fn: variantName, args };
+                            return { kind: "app", fn: variantName, args, ctorOf: baseName };
                         }
                     }
                 }
@@ -642,7 +688,10 @@ function lowerExpr(e, binds) {
                 return { kind: "app", fn: "SetLiteral", args: e.elems.map(el => lowerExpr(el, binds)) };
             return { kind: "arrayLiteral", elems: e.elems.map(el => lowerExpr(el, binds)) };
         case "lambda": {
-            const body = transformStmts(e.body, []);
+            // Pass the module typeDecls (not []), so type lookups inside the lambda
+            // body — e.g. a `switch`'s variant fields — resolve. A bare `[]` left a
+            // discriminated-union switch in a lambda with binderless patterns.
+            const body = transformStmts(e.body, _typeDecls);
             // Flatten an if/let/return-shaped multi-statement body into a single
             // `return <expr>` so both backends' single-return-lambda fast path emits
             // it (Dafny lambdas are expression-only; Lean prefers the expression form
@@ -1321,14 +1370,37 @@ function remainingVariant(typeName, cases, typeDecls) {
         return null;
     return remaining[0];
 }
+/** `switch(obj.field)` is stripped at extraction to scrutinee `obj` + discriminant
+ *  `field`, assuming `obj` is a discriminated union with `field` as its
+ *  discriminant. When that's NOT so — e.g. `obj` is a plain record with an
+ *  enum-typed `field` — the switch is really on the enum VALUE. This returns the
+ *  enum scrutinee `obj.field` (+ the field's enum type) to match directly; null
+ *  for a genuine discriminant switch or `switch(localVar)`, which callers handle
+ *  their usual way. Shared by emitSwitchStmt and transformPureSwitch. */
+function enumFieldSwitch(s, typeDecls) {
+    if (!s.discriminant)
+        return null;
+    const objBase = s.expr.ty.kind === "user"
+        ? (s.expr.ty.name.includes("<") ? s.expr.ty.name.slice(0, s.expr.ty.name.indexOf("<")) : s.expr.ty.name)
+        : undefined;
+    const objDecl = objBase ? typeDecls.find(d => d.name === objBase) : undefined;
+    if (objDecl?.kind === "discriminated-union" && objDecl.discriminant === s.discriminant)
+        return null;
+    const fieldTy = objDecl?.kind === "record" ? objDecl.fields?.find(f => f.name === s.discriminant)?.type : undefined;
+    return {
+        scrutinee: { kind: "field", obj: transformExpr(s.expr), field: s.discriminant },
+        enumTyName: fieldTy?.kind === "user" ? fieldTy.name : undefined,
+    };
+}
 function emitSwitchStmt(s, typeDecls) {
-    const varName = s.expr.kind === "var" ? s.expr.name : "?";
-    const typeName = s.expr.ty.kind === "user" ? s.expr.ty.name : undefined;
     const cases = s.cases.map(c => ({ name: c.label, body: c.body }));
-    const arms = buildMatchArms(cases, varName, typeName, typeDecls, (body, vn, fields) => transformStmts(replaceFieldAccessInTStmts(body, vn, fields), typeDecls));
+    const ef = enumFieldSwitch(s, typeDecls);
+    const arms = ef
+        ? buildMatchArms(cases, undefined, ef.enumTyName, typeDecls, (body) => transformStmts(body, typeDecls))
+        : buildMatchArms(cases, s.expr.kind === "var" ? s.expr.name : "?", s.expr.ty.kind === "user" ? s.expr.ty.name : undefined, typeDecls, (body, vn, fields) => transformStmts(replaceFieldAccessInTStmts(body, vn, fields), typeDecls));
     if (s.defaultBody.length > 0)
         arms.push({ pattern: "_", body: transformStmts(s.defaultBody, typeDecls) });
-    return { kind: "match", scrutinee: varName, arms };
+    return { kind: "match", scrutinee: ef ? ef.scrutinee : (s.expr.kind === "var" ? s.expr.name : "?"), arms };
 }
 /** Replace obj.field → replacement var in typed IR.
  *  Uses the TExpr's resolved type when available, falling back to `fallbackTy`. */
@@ -1472,6 +1544,20 @@ function transformPureBody(stmts, typeDecls) {
     return null;
 }
 function transformPureSwitch(s, typeDecls) {
+    const ef = enumFieldSwitch(s, typeDecls);
+    if (ef) {
+        const cases = s.cases.map(c => ({ name: c.label, body: c.body }));
+        const arms = buildMatchArms(cases, undefined, ef.enumTyName, typeDecls, (body) => transformPureBody(body, typeDecls));
+        if (!arms)
+            return null;
+        if (s.defaultBody.length > 0) {
+            const body = transformPureBody(s.defaultBody, typeDecls);
+            if (!body)
+                return null;
+            arms.push({ pattern: "_", body });
+        }
+        return { kind: "match", scrutinee: ef.scrutinee, arms };
+    }
     const typeName = s.expr.ty.kind === "user" ? s.expr.ty.name : "";
     if (!typeDecls.find(d => d.name === typeName))
         return null;
@@ -1570,6 +1656,9 @@ function transformTypeDecl(d) {
             target: d.aliasOfTy,
         };
     }
+    else if (d.kind === "opaque") {
+        return { kind: "opaque-type", name: d.name };
+    }
     else {
         return {
             kind: "structure", name: d.name,