lemmascript 0.5.12 → 0.5.14

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lemmascript",
-  "version": "0.5.12",
+  "version": "0.5.14",
   "description": "A verification toolchain for TypeScript — generates Lean 4 or Dafny from annotated TS",
   "type": "module",
   "engines": {
@@ -32,7 +32,7 @@
     "type": "git",
     "url": "https://github.com/midspiral/LemmaScript"
   },
-  "homepage": "https://lemmascript.com",
+  "homepage": "https://lemmascript.org",
   "keywords": [
     "lemmascript",
     "verification",

package/tools/dist/dafny-commands.js

@@ -60,11 +60,14 @@ export function dafnyVerify(dfyPath, dir, timeLimit, extraFlags) {
         execFileSync("dafny", args, { cwd: dir, stdio: "inherit" });
         return true;
     }
-    catch {
+    catch (e) {
+        if (e?.code === "ENOENT") {
+            console.error("ERROR: `dafny` not found on PATH — verification never ran. Install Dafny 4.x: https://dafny.org/");
+        }
         return false;
     }
 }
-export function dafnyRegen(genPath, dfyPath, basePath, text, dir) {
+export function dafnyRegen(genPath, dfyPath, basePath, text, dir, timeLimit, extraFlags) {
     // 1. Read old gen before overwriting (needed for base seeding)
     const oldGen = existsSync(genPath) ? readFileSync(genPath, "utf-8") : "";
     // 2. Always write new gen so user can inspect latest output
@@ -73,7 +76,7 @@ export function dafnyRegen(genPath, dfyPath, basePath, text, dir) {
     if (!existsSync(dfyPath)) {
         writeFileSync(dfyPath, text);
         console.log(`Created: ${path.basename(dfyPath)}`);
-        if (!dafnyVerify(dfyPath, dir)) {
+        if (!dafnyVerify(dfyPath, dir, timeLimit, extraFlags)) {
             console.error(`FAILED: ${path.basename(dfyPath)} verification failed on first run.`);
             process.exit(1);
         }
@@ -108,7 +111,7 @@ export function dafnyRegen(genPath, dfyPath, basePath, text, dir) {
         process.exit(1);
     }
     // 7. Verify
-    if (!dafnyVerify(dfyPath, dir)) {
+    if (!dafnyVerify(dfyPath, dir, timeLimit, extraFlags)) {
         console.error(`FAILED: ${path.basename(dfyPath)} verification failed.`);
         process.exit(1);
     }

package/tools/dist/dafny-emit.js

@@ -1,6 +1,31 @@
 /**
  * Dafny emitter — IR → Dafny text.
  */
+import { usesName, usesNameInDecl } from "./ir.js";
+import { freshName, userNames } from "./names.js";
+import { renameFreeVar } from "./transform.js";
+/** Fresh binder for a comprehension wrapping the given subexpressions: `base`
+ *  verbatim unless one of them references it, then primed until free. A *local*
+ *  check — a same-named name elsewhere in the module keeps the plain binder. */
+function freshBinder(base, ...wrapped) {
+    return freshName(base, name => wrapped.some(w => usesName(w, name)));
+}
+/** Binder + body for lowering a single-return lambda to a comprehension whose
+ *  receiver is emitted inside the binder's scope. TS scoping keeps the receiver
+ *  outside the lambda, so a lambda param sharing a name with anything free in
+ *  the receiver would capture it — e.g. `mk(n).some(n => …)` naively emitting
+ *  `exists n :: n in mk(n) && …`. Alpha-rename the param out of the way (and
+ *  its free uses in the body); the zero-param default must also dodge free
+ *  names in the body. */
+function comprehensionBinder(lam, value, receiver) {
+    const rawName = lam.params[0]?.name;
+    if (rawName === undefined)
+        return { binder: escapeName(freshBinder("x", receiver, value)), body: value };
+    if (!usesName(receiver, rawName))
+        return { binder: escapeName(rawName), body: value };
+    const fresh = freshBinder(rawName, receiver, value);
+    return { binder: escapeName(fresh), body: renameFreeVar(value, rawName, fresh) };
+}
 // ── Ty → Dafny type string ─────────────────────────────────
 function tyToDafny(ty) {
     switch (ty.kind) {
@@ -17,7 +42,7 @@ function tyToDafny(ty) {
             needPreamble("OptionType");
             return `Option<${tyToDafny(ty.inner)}>`;
         }
-        case "user": return ty.name;
+        case "user": return escapeName(ty.name);
         case "fn": return `(${ty.params.map(tyToDafny).join(", ")}) -> ${tyToDafny(ty.result)}`;
         // Out-of-subset (`any`/`unknown`); opaque so real ops on it fail loudly
         // rather than silently verify as `int`. Mirrors the Lean backend's `_`.
@@ -50,22 +75,83 @@ const DAFNY_KEYWORDS = new Set([
     "copredicate", "inductive",
 ]);
 // The Dafny out-parameter name for the method currently being emitted. Default
-// `res`, but bumped (e.g. `res_`) when a parameter is named `res` — set by
-// methodHeader and reset per decl. `\result` in an ensures must use the *same*
-// name, so escapeName routes it here.
+// `res`, but bumped (e.g. `res'`) when the method's own scope uses `res` — set
+// by methodHeader and reset per decl. `\result` in an ensures must use the
+// *same* name, so escapeName routes it here.
 let _resultName = "res";
-function escapeName(name) {
-    // \result is carried through the IR as the var name "\\result"; render it
-    // as the current method's out-parameter name.
-    if (name === "\\result")
-        return _resultName;
+// ── Dafny name allocation ──────────────────────────────────
+//
+// freshName (names.ts) freshens in the *raw TS* namespace — but that is not the
+// namespace Dafny sees. Escaping maps `_x`→`i_x` and keyword `match`→`match_`,
+// so two raw-distinct names can collapse *after* escaping: a raw-freshened temp
+// `_t0'`→`i_t0'` colliding with a user `_t0` that escaped-and-primed to `i_t0'`.
+// So Dafny hygiene is a second allocator, layered at emission: escape to a base,
+// then freshen against the names already claimed in the Dafny namespace. User
+// names are allocated up front (Dafny-safe ones kept exact); generated names are
+// allocated on first sight and cached so a decl and its references agree. Reset
+// per file. (The raw freshName layer stays — Lean has a different escaping story.)
+function dafnyBaseName(name) {
     if (DAFNY_KEYWORDS.has(name))
         return `${name}_`;
-    // Dafny doesn't allow identifiers starting with _
     if (name.startsWith("_"))
-        return `i${name}`;
+        return `i${name}`; // Dafny forbids leading `_`
     return name;
 }
+let _userDafnyNames = new Map();
+let _generatedDafnyNames = new Map();
+let _takenDafnyNames = new Set();
+/** `base`, primed until free in the Dafny namespace. A prime can't occur in a
+ *  TS identifier, so priming always leaves user-name space. */
+function freshDafnyName(base) {
+    let out = base;
+    while (_takenDafnyNames.has(out))
+        out += "'";
+    return out;
+}
+function resetDafnyNameCache() {
+    _userDafnyNames = new Map();
+    _generatedDafnyNames = new Map();
+    _takenDafnyNames = new Set();
+    const raws = [...userNames()].sort();
+    // Dafny-safe source names keep their spelling; names that must mangle are then
+    // freshened in the emitted namespace (safe-first, sorted → deterministic).
+    for (const raw of raws)
+        if (dafnyBaseName(raw) === raw) {
+            _userDafnyNames.set(raw, raw);
+            _takenDafnyNames.add(raw);
+        }
+    for (const raw of raws)
+        if (dafnyBaseName(raw) !== raw) {
+            const emitted = freshDafnyName(dafnyBaseName(raw));
+            _userDafnyNames.set(raw, emitted);
+            _takenDafnyNames.add(emitted);
+        }
+}
+function escapeName(name) {
+    // \result is carried through the IR as var "\\result"; render it as the
+    // current method's out-parameter name (chosen locally by methodHeader).
+    if (name === "\\result")
+        return _resultName;
+    const user = _userDafnyNames.get(name);
+    if (user !== undefined)
+        return user;
+    return escapeGeneratedName(name);
+}
+/** Allocate a toolchain-generated name (an ANF temp, a comprehension binder, a
+ *  companion `_ensures` lemma). Escapes to a base, then freshens in the Dafny
+ *  namespace so it can't collapse onto an escaped user name. Bypasses the user
+ *  map on purpose: the raw name is synthesized, so it must be freshened *away
+ *  from* a same-spelled user name, not aliased onto it. Cached so a declaration
+ *  and its references render identically. */
+function escapeGeneratedName(name) {
+    const cached = _generatedDafnyNames.get(name);
+    if (cached !== undefined)
+        return cached;
+    const emitted = freshDafnyName(dafnyBaseName(name));
+    _generatedDafnyNames.set(name, emitted);
+    _takenDafnyNames.add(emitted);
+    return emitted;
+}
 /** Format a typed parameter list for Dafny: "x: int, y: seq<int>" */
 function paramList(params) {
     return params.map(p => `${escapeName(p.name)}: ${tyToDafny(p.type)}`).join(", ");
@@ -73,17 +159,18 @@ function paramList(params) {
 /** Format a method signature header, omitting `returns` for void methods.
  *  Dafny's definite-assignment rule rejects unassigned out-parameters, so a
  *  `returns (res: ())` on a void method fails verification. */
-function methodHeader(prefix, params, returnType) {
+function methodHeader(prefix, params, returnType, scope) {
     const sig = `${prefix}(${paramList(params)})`;
     if (returnType.kind === "void")
         return sig;
-    // The out-parameter is `res` by default, but a parameter named `res` (e.g. an
-    // Express handler's `(req, res)`) would collide; pick a fresh name and record
-    // it so `\result` references in the ensures/body resolve to the same name.
-    const taken = new Set(params.map(p => escapeName(p.name)));
-    let resName = "res";
-    while (taken.has(resName))
-        resName += "_";
+    // The out-parameter is `res` by default, but a param (an Express handler's
+    // `(req, res)`), body local, or callee named `res` would shadow it. Check only
+    // *this method's own* signature and body — `res` is common module-wide (fields,
+    // unrelated params), so a module-wide check would prime spuriously. The primed
+    // name is recorded so `\result` references resolve to it.
+    const taken = (n) => params.some(p => escapeName(p.name) === n) ||
+        (scope !== undefined && usesNameInDecl(scope.requires, scope.ensures, scope.body, n));
+    const resName = freshName("res", taken);
     _resultName = resName;
     return `${sig} returns (${resName}: ${tyToDafny(returnType)})`;
 }
@@ -106,7 +193,7 @@ function emitQuantifier(e, keyword) {
     while (body.kind === e.kind) {
         const dty = tyToDafny(body.type);
         const ann = dty === "string" ? "" : `: ${dty}`;
-        vars.push(`${body.var}${ann}`);
+        vars.push(`${escapeName(body.var)}${ann}`);
         body = body.body;
     }
     return `${keyword} ${vars.join(", ")} :: ${emitExpr(body)}`;
@@ -222,8 +309,8 @@ function emitExpr(e) {
                     const ret = lam.body[0];
                     if (ret.kind !== "return")
                         throw new Error("unreachable");
-                    const p = escapeName(lam.params[0]?.name ?? "x");
-                    const body = emitExpr(ret.value);
+                    const { binder: p, body: v } = comprehensionBinder(lam, ret.value, e.obj);
+                    const body = emitExpr(v);
                     return `(exists ${p} :: ${p} in ${obj} && ${body})`;
                 }
             }
@@ -300,8 +387,13 @@ function emitExpr(e) {
                     return `${obj}[${args[0]} := ${args[1]}]`;
                 if (e.method === "has")
                     return `(${args[0]} in ${obj})`;
-                if (e.method === "delete")
-                    return `(map k | k in ${obj} && k != ${args[0]} :: ${obj}[k])`;
+                if (e.method === "delete") {
+                    // Minted comprehension binder: freshen so a user variable `k` in the
+                    // receiver or key isn't captured (`k != k` would delete nothing).
+                    // Local check — only this comprehension's own operands can collide.
+                    const k = escapeName(freshBinder("k", e.obj, e.args[0]));
+                    return `(map ${k} | ${k} in ${obj} && ${k} != ${args[0]} :: ${obj}[${k}])`;
+                }
             }
             // Set methods
             if (ty === "set") {
@@ -321,8 +413,8 @@ function emitExpr(e) {
                     const ret = lam.body[0];
                     if (ret.kind !== "return")
                         throw new Error("unreachable");
-                    const p = escapeName(lam.params[0]?.name ?? "x");
-                    const body = emitExpr(ret.value);
+                    const { binder: p, body: v } = comprehensionBinder(lam, ret.value, e.obj);
+                    const body = emitExpr(v);
                     return `(set ${p} | ${p} in ${obj} && ${body})`;
                 }
             }
@@ -447,9 +539,11 @@ function emitExpr(e) {
         }
         case "field": {
             const obj = emitExpr(e.obj);
-            if (e.field === "size" || e.field === "length" || e.field === "collectionSize")
+            // `size`/`length`/`keys` are collection intrinsics unless the transform
+            // proved this is a declared datatype field (then project it).
+            if (!e.datatypeField && (e.field === "size" || e.field === "length" || e.field === "collectionSize"))
                 return `|${obj}|`;
-            if (e.field === "keys")
+            if (!e.datatypeField && e.field === "keys")
                 return `${obj}.Keys`;
             if (e.field === "toNat")
                 return obj;
@@ -681,23 +775,23 @@ function emitDecl(d) {
                 const fields = c.fields.map(f => collides.has(f.name) ? { ...f, name: `${f.name}_${c.name}` } : f);
                 return `${escapeName(c.name)}(${paramList(fields)})`;
             });
-            return `datatype ${d.name}${tp} = ${ctors.join(" | ")}`;
+            return `datatype ${escapeName(d.name)}${tp} = ${ctors.join(" | ")}`;
         }
         case "structure": {
             const tp = d.typeParams?.length ? `<${d.typeParams.join(", ")}>` : "";
-            return `datatype ${d.name}${tp} = ${d.name}(${paramList(d.fields)})`;
+            return `datatype ${escapeName(d.name)}${tp} = ${escapeName(d.name)}(${paramList(d.fields)})`;
         }
         case "type-alias": {
-            return `type ${d.name} = ${tyToDafny(d.target)}`;
+            return `type ${escapeName(d.name)} = ${tyToDafny(d.target)}`;
         }
         case "opaque-type": {
             // Abstract type — no definition. `(==)` so it can sit inside datatypes
             // that derive structural equality. Never constructed or destructured.
-            return `type ${d.name}(==)`;
+            return `type ${escapeName(d.name)}(==)`;
         }
         case "def": {
             const tp = d.typeParams.length > 0 ? `<${d.typeParams.join(", ")}>` : "";
-            const lines = [`function ${d.name}${tp}(${paramList(d.params)}): ${tyToDafny(d.returnType)}`];
+            const lines = [`function ${escapeName(d.name)}${tp}(${paramList(d.params)}): ${tyToDafny(d.returnType)}`];
             for (const r of d.requires)
                 lines.push(`  requires ${emitExpr(r)}`);
             if (d.decreases)
@@ -710,7 +804,7 @@ function emitDecl(d) {
                 // Strip constraints like (==) from type params — ghost lemmas don't need them
                 const lemmaTP = d.typeParams.length > 0 ? `<${d.typeParams.map(t => t.replace(/\(.*\)/, '')).join(", ")}>` : "";
                 lines.push("");
-                lines.push(`lemma ${d.name}_ensures${lemmaTP}(${paramList(d.params)})`);
+                lines.push(`lemma ${escapeGeneratedName(`${d.name}_ensures`)}${lemmaTP}(${paramList(d.params)})`);
                 for (const r of d.requires)
                     lines.push(`  requires ${emitExpr(r)}`);
                 for (const e of d.ensures)
@@ -722,7 +816,7 @@ function emitDecl(d) {
         }
         case "def-by-method": {
             const tp = d.typeParams.length > 0 ? `<${d.typeParams.join(", ")}>` : "";
-            const lines = [`function ${d.name}${tp}(${paramList(d.params)}): ${tyToDafny(d.returnType)}`];
+            const lines = [`function ${escapeName(d.name)}${tp}(${paramList(d.params)}): ${tyToDafny(d.returnType)}`];
             for (const r of d.requires)
                 lines.push(`  requires ${emitExpr(r)}`);
             if (d.decreases)
@@ -736,7 +830,7 @@ function emitDecl(d) {
         }
         case "method": {
             const tp = d.typeParams.length > 0 ? `<${d.typeParams.join(", ")}>` : "";
-            const lines = [methodHeader(`method ${d.name}${tp}`, d.params, d.returnType)];
+            const lines = [methodHeader(`method ${escapeName(d.name)}${tp}`, d.params, d.returnType, d)];
             for (const r of d.requires)
                 lines.push(`  requires ${emitExpr(r)}`);
             for (const e of d.ensures)
@@ -749,14 +843,14 @@ function emitDecl(d) {
             return lines.join("\n");
         }
         case "class": {
-            const lines = [`class ${d.name} {`];
+            const lines = [`class ${escapeName(d.name)} {`];
             for (const f of d.fields) {
                 lines.push(`  var ${escapeName(f.name)}: ${tyToDafny(f.type)}`);
             }
             if (d.fields.length > 0 && d.methods.length > 0)
                 lines.push("");
             for (const m of d.methods) {
-                lines.push(`  ${methodHeader(`method ${m.name}`, m.params, m.returnType)}`);
+                lines.push(`  ${methodHeader(`method ${escapeName(m.name)}`, m.params, m.returnType, m)}`);
                 for (const r of m.requires)
                     lines.push(`    requires ${emitExpr(r)}`);
                 for (const e of m.ensures)
@@ -1211,21 +1305,17 @@ function qualifyCtor(name, type) {
  *  "_" → "_"
  */
 const CTOR_MAP = { "some": "Some", "none": "None" };
-function translatePattern(pattern) {
-    if (pattern === "_")
+function translatePattern(p) {
+    if (p.kind === "wild")
         return "_";
-    const m = pattern.match(/^\.(\w+)\s*(.*)$/);
-    if (!m)
-        return pattern;
-    const ctorName = CTOR_MAP[m[1]] ?? escapeName(m[1]);
-    const fields = m[2].trim();
-    if (!fields)
+    const ctorName = CTOR_MAP[p.ctor] ?? escapeName(p.ctor);
+    if (p.binders.length === 0)
         return ctorName;
-    const fieldNames = fields.split(/\s+/).map(escapeName);
-    return `${ctorName}(${fieldNames.join(", ")})`;
+    return `${ctorName}(${p.binders.map(escapeName).join(", ")})`;
 }
 export function emitDafnyFile(file, tsFileName, opts) {
     _useSafeSlice = !!opts?.safeSlice;
+    resetDafnyNameCache();
     buildRecordCtorMap(file.decls);
     _neededPreambles.clear();
     // Track successfully emitted pure defs — method wrappers are only

package/tools/dist/extract.js

@@ -6,6 +6,7 @@
  */
 import { Project, Node, SyntaxKind, ScriptTarget, ts } from "ts-morph";
 import { initTypeParser } from "./types.js";
+import { setUserNames, freshName } from "./names.js";
 // ── Expression extraction ────────────────────────────────────
 /** When set, calls whose function/method name matches this key are replaced with havoc. */
 let _havocKey = null;
@@ -1215,7 +1216,7 @@ function extractStmts(stmts) {
                         let initExpr = extractExpr(initializer);
                         let initVar = initExpr;
                         if (initExpr.kind !== "var") {
-                            const tempName = `_destr${_destrCounter++}`;
+                            const tempName = freshName(`_destr${_destrCounter++}`);
                             const initTs = _eraseGenerics(typeToString(initializer.getType()));
                             result.push({ kind: "let", name: tempName, mutable: false, tsType: initTs, init: initExpr, line });
                             initVar = { kind: "var", name: tempName };
@@ -1259,7 +1260,7 @@ function extractStmts(stmts) {
                             let initExpr = extractExpr(initializer);
                             let initVar = initExpr;
                             if (initExpr.kind !== "var") {
-                                const tempName = `_destr${_destrCounter++}`;
+                                const tempName = freshName(`_destr${_destrCounter++}`);
                                 const initTs = _eraseGenerics(typeToString(initializer.getType()));
                                 result.push({ kind: "let", name: tempName, mutable: false, tsType: initTs, init: initExpr, line });
                                 initVar = { kind: "var", name: tempName };
@@ -1859,6 +1860,9 @@ function extractFunctionInner(fn, parentAnnotations) {
 }
 // ── Module extraction ────────────────────────────────────────
 export function extractModule(sourceFile) {
+    // Seed the fresh-name check (names.ts) before anything mints: every
+    // Identifier token in the module, a deliberate over-approximation.
+    setUserNames(new Set(sourceFile.getDescendantsOfKind(SyntaxKind.Identifier).map(i => i.getText())));
     const typeDecls = [];
     // Cross-file calls are auto-externed: ts-morph resolves the call's symbol;
     // if it's defined in a different source file we treat the symbol as opaque

package/tools/dist/ir.js

@@ -4,6 +4,19 @@
  * The transform phase produces these types.
  * The emit phase pretty-prints them to backend syntax (Lean or Dafny).
  */
+export const pWild = () => ({ kind: "wild" });
+export const pCtor = (ctor, ...binders) => ({ kind: "ctor", ctor, binders });
+/** Binder identifiers a pattern introduces (`[]` for wildcard / nullary ctor). */
+export function patternBinders(p) {
+    return p.kind === "ctor" ? p.binders : [];
+}
+export function patternCtor(p) {
+    return p.kind === "ctor" ? p.ctor : null;
+}
+/** Does the pattern bind `name`? */
+export function patternBinds(p, name) {
+    return patternBinders(p).includes(name);
+}
 export function anyExpr(e, pred) {
     if (pred(e))
         return true;
@@ -60,3 +73,47 @@ export function anyExprInStmt(s, pred) {
 export function anyExprInStmts(stmts, pred) {
     return stmts.some(s => anyExprInStmt(s, pred));
 }
+// A name is "used" — such that a synthesized binder of the same name would
+// capture or shadow it — iff it appears as a variable reference or a called
+// function. These drive the *local* freshness checks for user-facing binders
+// (the result out-parameter, comprehension binders): a binder is checked only
+// against the expressions/scope it actually wraps, not the whole module.
+const _refsName = (name) => e => (e.kind === "var" && e.name === name) ||
+    (e.kind === "app" && e.fn === name) ||
+    (e.kind === "constructor" && e.name === name) ||
+    (e.kind === "match" && typeof e.scrutinee === "string" && e.scrutinee === name);
+export function usesName(e, name) {
+    return anyExpr(e, _refsName(name));
+}
+export function usesNameInStmts(stmts, name) {
+    return anyExprInStmts(stmts, _refsName(name));
+}
+/** Names a statement tree *binds, targets, or introduces* — `let`/`let-bind`/
+ *  `ghostLet` names, `assign`/`bind`/`ghostAssign` targets, `for-in` indices,
+ *  and `match`-arm pattern binders — recursing through nested blocks. Distinct
+ *  from `usesNameInStmts` (expression references only): an unread or assign-only
+ *  local still duplicate-declares against a method's out-parameter in Dafny. */
+export function bindsNameInStmts(stmts, name) {
+    return stmts.some(s => {
+        switch (s.kind) {
+            case "let":
+            case "let-bind":
+            case "ghostLet": return s.name === name;
+            case "assign":
+            case "bind":
+            case "ghostAssign": return s.target === name;
+            case "forin": return s.idx === name || bindsNameInStmts(s.body, name);
+            case "if": return bindsNameInStmts(s.then, name) || bindsNameInStmts(s.else, name);
+            case "while": return bindsNameInStmts(s.body, name);
+            case "match": return s.arms.some(a => patternBinds(a.pattern, name) || bindsNameInStmts(a.body, name));
+            default: return false;
+        }
+    });
+}
+/** Every occurrence of `name` a method's out-parameter binder must dodge —
+ *  referenced in a spec (requires/ensures) or body, *or* bound/targeted anywhere
+ *  in the body (an unread local still duplicate-declares). Both emitters share it. */
+export function usesNameInDecl(requires, ensures, body, name) {
+    return requires.some(e => usesName(e, name)) || ensures.some(e => usesName(e, name))
+        || usesNameInStmts(body, name) || bindsNameInStmts(body, name);
+}

package/tools/dist/lean-emit.js

@@ -2,7 +2,8 @@
  * Lean emitter — IR → Lean text.
  * No logic, no type decisions — just serialization.
  */
-import { anyExpr } from "./ir.js";
+import { anyExpr, usesNameInDecl, patternBinders } from "./ir.js";
+import { freshName } from "./names.js";
 // ── Ty → Lean type string ──────────────────────────────────
 function tyToLean(ty) {
     switch (ty.kind) {
@@ -76,11 +77,15 @@ const LEAN_KEYWORDS = new Set([
     "partial", "unsafe", "macro", "syntax", "by", "fun", "have", "show",
     "at", "from", "to", "deriving", "extends", "true", "false",
 ]);
+// The return-value identifier for the method currently being emitted. Default
+// `res`, but primed (e.g. `res'`) when a module identifier is named `res` — set
+// by the method case. `\result` in an ensures/body must use the same name.
+let _resultName = "res";
 function escapeName(name) {
     // \result is carried through the IR as the var name "\\result"; render it
-    // as Lean's canonical return-value identifier (matches `return (res : T)`).
+    // as the method's return-value identifier (matches `return (res : T)`).
     if (name === "\\result")
-        return "res";
+        return _resultName;
     return LEAN_KEYWORDS.has(name) ? `«${name}»` : name;
 }
 // ── Operator precedence (for parenthesization) ──────────────
@@ -173,6 +178,10 @@ let _unknownEmitted = false; // across files in one run — the def file imports
 // built only from decidable atoms (comparisons, Bool-returning calls) coerces fine
 // and stays in the more proof-friendly Prop form.
 let _boolCtx = false;
+/** Render a match pattern to Lean syntax: `_`, `.none`, `.some x`, `.syn seq`. */
+function renderLeanPattern(p) {
+    return p.kind === "wild" ? "_" : "." + [p.ctor, ...p.binders].join(" ");
+}
 // A Bool-valued atom that does NOT coerce to Prop: an inlined union discriminator
 // (lowered to a match-bool `match x with | .C .. => true | _ => false`) or a raw
 // `match` used as a Bool — neither has a `Decidable` instance Lean can synthesize
@@ -258,6 +267,8 @@ function emitMethodCall(tyKind, method, monadic, obj, args) {
             return `${obj}.contains ${args[0]}`;
         if (method === "set")
             return `${obj}.insert ${args[0]} ${args[1]}`;
+        if (method === "delete")
+            return `${obj}.erase ${args[0]}`;
     }
     // Set methods
     if (tyKind === "set") {
@@ -458,7 +469,7 @@ function emitExpr(e, parentPrec) {
             // Always parenthesize inline matches — Lean parses alternatives greedily,
             // so any token after an arm body (`→`, another match's `|`, etc.) would
             // bleed into the last `.none` case without explicit bracketing.
-            const arms = e.arms.map(a => `| ${a.pattern} => ${emitExpr(a.body)}`);
+            const arms = e.arms.map(a => `| ${renderLeanPattern(a.pattern)} => ${emitExpr(a.body)}`);
             const scrut = typeof e.scrutinee === "string" ? e.scrutinee : emitExpr(e.scrutinee);
             return `(match ${scrut} with ${arms.join(" ")})`;
         }
@@ -550,10 +561,10 @@ function emitStmt(s, indent) {
             const scrut = typeof s.scrutinee === "string" ? s.scrutinee : emitExpr(s.scrutinee);
             // Option match (.some/.none) → emit as if/let for WPGen.if compatibility
             if (s.arms.length === 2) {
-                const someArm = s.arms.find(a => a.pattern.startsWith(".some "));
-                const noneArm = s.arms.find(a => a.pattern === ".none");
+                const someArm = s.arms.find(a => a.pattern.kind === "ctor" && a.pattern.ctor === "some");
+                const noneArm = s.arms.find(a => a.pattern.kind === "ctor" && a.pattern.ctor === "none");
                 if (someArm && noneArm) {
-                    const boundVar = someArm.pattern.slice(6); // strip ".some "
+                    const boundVar = patternBinders(someArm.pattern)[0]; // ".some x" ⇒ "x"
                     const hName = `h_${scrut.replace(/[^a-zA-Z0-9_]/g, "_")}`;
                     const lines = [
                         `${pad}if ${hName} : (${scrut}).isSome = true then`,
@@ -578,7 +589,7 @@ function emitStmt(s, indent) {
             // General match
             const lines = [`${pad}match ${scrut} with`];
             for (const arm of s.arms) {
-                lines.push(`${pad}| ${arm.pattern} =>`);
+                lines.push(`${pad}| ${renderLeanPattern(arm.pattern)} =>`);
                 if (arm.body.length === 0) {
                     lines.push(`${pad}  pure ()`);
                 }
@@ -680,7 +691,12 @@ function emitDecl(d) {
             // Spec clauses are Prop; the `do` body is computational (Bool).
             const prevBoolCtx = _boolCtx;
             _boolCtx = false;
-            const lines = [`method ${d.name} ${params} return (res : ${tyToLean(d.returnType)})`];
+            // Prime the return binder only on a collision within *this method's own*
+            // signature/body — `res` is a common identifier module-wide (record
+            // fields, unrelated params), so a module-wide check would prime spuriously.
+            _resultName = freshName("res", n => d.params.some(p => escapeName(p.name) === n) ||
+                usesNameInDecl(d.requires, d.ensures, d.body, n));
+            const lines = [`method ${d.name} ${params} return (${_resultName} : ${tyToLean(d.returnType)})`];
             for (const r of d.requires)
                 lines.push(`  require ${emitExpr(r)}`);
             for (const e of d.ensures)
@@ -732,7 +748,7 @@ function emitPureExpr(e, indent) {
         case "match": {
             const lines = [`${pad}match ${typeof e.scrutinee === "string" ? e.scrutinee : emitExpr(e.scrutinee)} with`];
             for (const arm of e.arms) {
-                lines.push(`${pad}| ${arm.pattern} =>`);
+                lines.push(`${pad}| ${renderLeanPattern(arm.pattern)} =>`);
                 lines.push(emitPureExpr(arm.body, indent + 1));
             }
             return lines.join("\n");

package/tools/dist/lsc.js

@@ -76,7 +76,12 @@ function main() {
     const timeLimitIdx = args.findIndex(a => a.startsWith("--time-limit="));
     let timeLimit;
     if (timeLimitIdx >= 0) {
-        timeLimit = parseInt(args[timeLimitIdx].split("=")[1]);
+        const val = args[timeLimitIdx].split("=")[1];
+        if (!/^[1-9]\d*$/.test(val)) {
+            console.error(`Invalid --time-limit: ${val} (expected seconds as a positive integer)`);
+            process.exit(1);
+        }
+        timeLimit = parseInt(val);
         args.splice(timeLimitIdx, 1);
     }
     const extraFlagsIdx = args.findIndex(a => a.startsWith("--extra-flags="));
@@ -93,6 +98,14 @@ function main() {
         slow = true;
         args.splice(slowIdx, 1);
     }
+    // Anything flag-shaped left over is a typo or a space-separated form
+    // (`--backend lean`): reject it rather than let it become a positional arg
+    // or be silently ignored (which would e.g. verify with the wrong backend).
+    const stray = args.find(a => a.startsWith("-"));
+    if (stray) {
+        console.error(`Unknown flag: ${stray} (flags take the form --flag=value, e.g. --backend=dafny)`);
+        process.exit(1);
+    }
     const [cmd, filePath] = args;
     if (!cmd) {
         console.error("Usage: lsc <gen|check|regen|extract|info> [--backend=lean|dafny] <file.ts>");
@@ -234,7 +247,7 @@ function runFile(cmd, filePath, backend, timeLimit, extraFlags) {
             return;
         }
         if (cmd === "regen") {
-            dafnyRegen(genPath, dfyPath, basePath, text, dir);
+            dafnyRegen(genPath, dfyPath, basePath, text, dir, timeLimit, extraFlags);
             return;
         }
         console.error(`Unknown command: ${cmd}`);