lemmascript 0.5.15 → 0.5.17

package/README.md

@@ -30,6 +30,7 @@ See the external case studies:
 - **[rallly-lemmascript](https://github.com/midspiral/rallly-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield verification of [rallly](https://github.com/lukevella/rallly)'s meeting-poll Next.js app. 2 functions: `validateRedirectUrl` (in-place — open-redirect predicate; non-`undefined` outputs start with `/` but not `//`) and `scorePoll` (extracted ranking core — length preservation, score bounds, top-choice characterization, score-formula equality, within-poll monotonicity, tiebreaker injectivity). The injectivity proof surfaced a real spec-level constraint on the existing `(yes + ifNeedBe) * 1000 + yes` encoding: it overflows when an option has ≥ 1000 yes votes. 10 Dafny VCs, 0 errors. Drove four toolchain additions: `s.startsWith()`, `T | null` nullability, `\result` narrowing under `==>`, `Math.max(...arr)` spread. Dafny only.
 - **[opencode-lemmascript](https://github.com/midspiral/opencode-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield verification of [opencode](https://github.com/anomalyco/opencode)'s permission system and unified-diff patch parser. Highlights: (1) `Patch.parsePatch` carries conservation loop invariants over local ghost state — a parser bug here would silently corrupt user files when an AI applies a patch, and (2) the permission-engine work mechanically closes opencode bug #26514 (subagents bypassing Plan Mode's file-edit restrictions). 9 functions verified in-place, 0 errors. Dafny only.
 - **[pi-lemmascript](https://github.com/midspiral/pi-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield, **in-place** verification of the context-compaction cut-point selector in **pi** (the [earendil-works](https://pi.dev) agent harness). When the context window fills, pi discards history before a chosen cut; a provider API rejects a retained prefix containing an orphaned `toolResult` (a tool result whose tool call was cut away). Both selector functions proven: the cut never lets the kept suffix *start with* — nor *split a tool-use/tool-result run* into — an orphaned tool result, even across the backward metadata snap. The no-orphan result forced the session tree's tool-pairing ordering into an explicit `requires`. 4 VCs, 0 errors. Drove five toolchain additions, headlined by an **opaque fall-through type**: a union LemmaScript can't discriminate (here an array-element union of unreachable imports) becomes a single opaque `type` — the field stays present so distinct values stay distinct, and with no constructor or tag predicate it can only be passed through, never unsoundly observed. **Dafny + Lean**: the no-orphan theorem, the changelog semver core, and both tool-output truncators also carry Lean 4 (Velvet/Loom) proofs from the same annotated source, zero `sorry`; the Lean port drove the backend's brownfield batch (cross-file externs, union destructor lowering, Bool-vs-Prop contexts, `return`-in-loop elimination).
+- **[flue-lemmascript](https://github.com/midspiral/flue-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield, **in-place** verification of pure logic in **Flue** ([withastro/flue](https://github.com/withastro/flue)), Astro's agent harness — crash-recovery and context-compaction functions proven byte-identical. What it drove into the toolchain: native Dafny `continue`, bounds-guarded `noUncheckedIndexedAccess` optional indexing, optional narrowing past an `opt?.disc` guard composing with discriminated-union matching, and object truthiness. Dafny only.
 - **[balanced-match-lemmascript](https://github.com/midspiral/balanced-match-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield, **in-place** verification of [balanced-match](https://github.com/juliangruber/balanced-match), the ~70-line balanced-bracket finder pulled in by `npm`, `webpack`, and most of the JS tooling stack (1B+ downloads/month). The stack-based `range` core is verified by **refinement**: a pure recursive spec `range_spec` mirrors the loop one branch per recursive case, so the single equivalence `range == range_spec` transfers every property automatically — including an unconditional Dyck body-balance theorem for the interior of every returned pair. 2233 VCs, 0 errors under `--isolate-assertions` (registered on the `dafny-slow` track). Dafny only.
 - **[guardians-lemmascript](https://github.com/midspiral/guardians-lemmascript)** — greenfield verification of the core safety argument behind [Guardians](https://github.com/metareflection/guardians) (Erik Meijer, "Guardians of the Agents", CACM Jan 2026), a generate-verify-execute checker for AI-agent workflows. Instead of verifying an app, it proves the agent *guardrail itself sound* — that a static taint/automaton check over the real recursive workflow AST can never admit an unsafe plan. Highlights: taint over **nested conditionals** as a sound branch-union over-approximation; per-source **provenance** with a join (a multi-input tool is tainted if *any* input was); **unbounded loops** discharged by a one-step pre-fixpoint (`sat = t0 ‖ bodyTaint(t0)`) that bounds taint over any iteration count without iterating to a fixpoint; and a **unified capstone** (`verifyWfSound`) — one clean verdict rules out, on *every* path, both a tainted-data-to-sink leak and a security-automaton error. 54 Dafny obligations, 0 errors. The verified cores are reached from a Guardians-style `Workflow`/`Policy` through a thin *unverified* adapter, differentially tested against the real Python Guardians (used as the oracle, not a porting target). Dafny only.
 - **[quorum-lemmascript](https://github.com/midspiral/quorum-lemmascript)** — greenfield verified when2meet/Doodle-style group scheduler (React + Cloudflare Durable Objects), with one `domain.ts` running unchanged in the browser, the in-app query, and the server. The standout is that **the proof licenses the architecture**: `countFree` is a homomorphism from participant-list concatenation to integer addition (so the heatmap is order-independent) plus same-participant last-writer-wins convergence — which is exactly what makes the lock-free, no-login, *optimistic* multi-device backend safe, with the Durable Object and the browser applying the **same** verified `applyOp` (server-authoritatively, client-optimistically) with no rollback or operational transform. Also: heatmap is exactly the per-slot count and `isBest` exactly its argmax; monotonicity; invariant-preserving mutations + op-log `replay`; a sparse export codec round-trip; an in-app `whoIsFree(e, s)` whose length provably equals the cell's count; and a separate `grid.ts` proving the `(day, time) → slot` map in-range + injective — which makes specific-dates-vs-days-of-the-week pure shell labeling at zero proof cost; and full element-level permutation invariance (`heatmapPermInvariant` — the heatmap depends only on the *multiset* of participant rows), which drove the `perm(...)` spec predicate into LemmaScript itself. 100 Dafny VCs (90 + 10), 0 errors. The *aggregate* is proven; the React UI, WebSocket/DO I/O, and timezone labeling are the stated trust boundary. Dafny only.
@@ -85,6 +86,52 @@ lsc gen --backend=lean src/myModule.ts
 lake build
 ```
 
+## Continuous Integration
+
+LemmaScript ships a **reusable GitHub Actions workflow** that regenerates your artifacts, verifies them, and fails the build if any committed generated file is out of date. Call it from your own repo's workflow:
+
+```yaml
+# .github/workflows/lemmascript.yml
+name: LemmaScript
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  verify:
+    uses: midspiral/LemmaScript/.github/workflows/verify.yml@main
+    with:
+      backend: dafny      # dafny | lean | dafny-slow
+```
+
+The workflow installs the toolchain and (per `backend`) the Dafny or Lean stack, then runs `tools/check.sh`, which batches over a **`LemmaScript-files.txt`** at your repo root. This file is the list of sources CI verifies — you create and maintain it. One entry per line, `filepath [timeout] [extra dafny flags…]`:
+
+```
+src/domain.ts
+src/patch.ts 120
+src/heavy.ts 300 --isolate-assertions
+```
+
+The optional second column is a per-file timeout in seconds; anything after it is passed verbatim to Dafny. The same list drives `lsc check` locally when you run it with no file argument, so CI and your local runs verify exactly the same set. To verify additional Dafny files outside that list, add an executable `check-extra.sh` at the root and it runs automatically (Dafny backends only).
+
+Inputs (all optional):
+
+| Input | Default | Purpose |
+|-------|---------|---------|
+| `backend` | `dafny` | `dafny`, `lean`, or `dafny-slow` (isolate-assertions / long-running proofs) |
+| `node-version` | `24` | Node.js version |
+| `ls-ref` | `main` | LemmaScript ref to verify against |
+| `typecheck` | `true` | Run `npm ci && npm run typecheck` in the calling repo first |
+
+To verify against **both** backends, add a second job with `backend: lean`.
+
+Examples:
+- **[talktimer-lemmascript](https://github.com/midspiral/talktimer-lemmascript/blob/main/.github/workflows/lemmascript.yml)** — Dafny-only.
+- **[pi-lemmascript](https://github.com/midspiral/pi-lemmascript/blob/lemmascript/.github/workflows/lemmascript.yml)** — Dafny + Lean (two jobs).
+
 ## Annotations
 
 ```typescript

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lemmascript",
-  "version": "0.5.15",
+  "version": "0.5.17",
   "description": "A verification toolchain for TypeScript — generates Lean 4 or Dafny from annotated TS",
   "type": "module",
   "engines": {

package/tools/dist/dafny-commands.js

@@ -67,7 +67,7 @@ export function dafnyVerify(dfyPath, dir, timeLimit, extraFlags) {
         return false;
     }
 }
-export function dafnyRegen(genPath, dfyPath, basePath, text, dir, timeLimit, extraFlags) {
+export function dafnyRegen(genPath, dfyPath, basePath, text, dir, timeLimit, extraFlags, noVerify = false) {
     // 1. Read old gen before overwriting (needed for base seeding)
     const oldGen = existsSync(genPath) ? readFileSync(genPath, "utf-8") : "";
     // 2. Always write new gen so user can inspect latest output
@@ -76,7 +76,7 @@ export function dafnyRegen(genPath, dfyPath, basePath, text, dir, timeLimit, ext
     if (!existsSync(dfyPath)) {
         writeFileSync(dfyPath, text);
         console.log(`Created: ${path.basename(dfyPath)}`);
-        if (!dafnyVerify(dfyPath, dir, timeLimit, extraFlags)) {
+        if (!noVerify && !dafnyVerify(dfyPath, dir, timeLimit, extraFlags)) {
             console.error(`FAILED: ${path.basename(dfyPath)} verification failed on first run.`);
             process.exit(1);
         }
@@ -110,8 +110,8 @@ export function dafnyRegen(genPath, dfyPath, basePath, text, dir, timeLimit, ext
         console.error(`FAILED: ${path.basename(dfyPath)} has modifications to generated lines.`);
         process.exit(1);
     }
-    // 7. Verify
-    if (!dafnyVerify(dfyPath, dir, timeLimit, extraFlags)) {
+    // 7. Verify (skipped under --no-verify: caller verifies separately)
+    if (!noVerify && !dafnyVerify(dfyPath, dir, timeLimit, extraFlags)) {
         console.error(`FAILED: ${path.basename(dfyPath)} verification failed.`);
         process.exit(1);
     }

package/tools/dist/dafny-emit.js

@@ -36,6 +36,7 @@ function tyToDafny(ty) {
         case "string": return "string";
         case "void": return "()";
         case "array": return `seq<${tyToDafny(ty.elem)}>`;
+        case "tuple": return `(${ty.elems.map(tyToDafny).join(", ")})`;
         case "map": return `map<${tyToDafny(ty.key)}, ${tyToDafny(ty.value)}>`;
         case "set": return `set<${tyToDafny(ty.elem)}>`;
         case "optional": {
@@ -228,6 +229,8 @@ function emitExpr(e) {
             if (e.elems.length === 0)
                 return `[]`;
             return `[${e.elems.map(emitExpr).join(", ")}]`;
+        case "tupleLiteral": return `(${e.elems.map(emitExpr).join(", ")})`;
+        case "tupleProj": return `${emitExpr(e.obj)}.${e.index}`;
         case "emptyMap": return `map[]`;
         case "emptySet": return `{}`;
         case "mapLiteral": {
@@ -255,6 +258,10 @@ function emitExpr(e) {
                 if (e.method === "concat")
                     return `(${obj} + [${args.join(", ")}])`;
                 if (e.method === "sort") {
+                    if (args.length === 0) {
+                        needPreamble("SeqSort");
+                        return `SeqSort(${obj})`;
+                    }
                     needPreamble("SeqSortBy");
                     return `SeqSortBy(${obj}, ${args[0]})`;
                 }
@@ -295,6 +302,10 @@ function emitExpr(e) {
                     needPreamble("SeqFindIndex");
                     return `SeqFindIndex(${obj}, ${args[0]})`;
                 }
+                if (e.method === "findLastIndex") {
+                    needPreamble("SeqFindLastIndex");
+                    return `SeqFindLastIndex(${obj}, ${args[0]})`;
+                }
                 if (e.method === "flat" && args.length === 0) {
                     needPreamble("SeqFlatten");
                     return `SeqFlatten(${obj})`;
@@ -303,16 +314,26 @@ function emitExpr(e) {
                     needPreamble("SeqJoin");
                     return `SeqJoin(${obj}, ${args[0]})`;
                 }
-                if (e.method === "some" && e.args[0].kind === "lambda" &&
-                    e.args[0].body.length === 1 && e.args[0].body[0].kind === "return") {
+                // `.some(pred)`: inline a single-return lambda's body, else apply the
+                // predicate (e.g. a function reference).
+                if (e.method === "some") {
                     const lam = e.args[0];
-                    const ret = lam.body[0];
-                    if (ret.kind !== "return")
-                        throw new Error("unreachable");
-                    const { binder: p, body: v } = comprehensionBinder(lam, ret.value, e.obj);
-                    const body = emitExpr(v);
+                    let p, body;
+                    if (lam.kind === "lambda" && lam.body.length === 1 && lam.body[0].kind === "return") {
+                        const cb = comprehensionBinder(lam, lam.body[0].value, e.obj);
+                        p = cb.binder;
+                        body = emitExpr(cb.body);
+                    }
+                    else {
+                        p = escapeName(freshBinder("x", e.obj, e.args[0]));
+                        body = `${args[0]}(${p})`;
+                    }
                     return `(exists ${p} :: ${p} in ${obj} && ${body})`;
                 }
+                // `.reduce(f, init)` → Std's FoldLeft(f, init, xs) (same arg order).
+                if (e.method === "reduce" && args.length === 2) {
+                    return `Std.Collections.Seq.FoldLeft(${args[0]}, ${args[1]}, ${obj})`;
+                }
             }
             // String methods
             if (ty === "string") {
@@ -694,7 +715,7 @@ function emitStmt(s, indent) {
         case "break":
             return `${pad}break;`;
         case "continue":
-            throw new Error("Unsupported Dafny construct: 'continue' statement");
+            return `${pad}continue;`;
         case "if": {
             let out = `${pad}if ${emitExpr(s.cond)} {\n${emitStmts(s.then, indent + 1)}\n${pad}}`;
             if (s.else.length > 0) {
@@ -1003,6 +1024,18 @@ function SeqIndexOfFrom<T(==)>(s: seq<T>, x: T, from: nat): int
   else if s[from] == x then from as int
   else SeqIndexOfFrom(s, x, from + 1)
 }`;
+const SEQ_FIND_LAST_INDEX = `function SeqFindLastIndex<T>(s: seq<T>, p: T -> bool): int
+  ensures -1 <= SeqFindLastIndex(s, p) < |s|
+  ensures SeqFindLastIndex(s, p) >= 0 ==> p(s[SeqFindLastIndex(s, p)])
+  ensures SeqFindLastIndex(s, p) >= 0 ==>
+    (forall j: int :: SeqFindLastIndex(s, p) < j < |s| ==> !p(s[j]))
+  ensures SeqFindLastIndex(s, p) == -1 ==> (forall i: nat :: i < |s| ==> !p(s[i]))
+  decreases |s|
+{
+  if |s| == 0 then -1
+  else if p(s[|s|-1]) then |s| - 1
+  else SeqFindLastIndex(s[..|s|-1], p)
+}`;
 const SEQ_FIND_LAST = `function SeqFindLast<T>(s: seq<T>, p: T -> bool): Option<T>
   ensures SeqFindLast(s, p).Some? ==> p(SeqFindLast(s, p).value)
   ensures SeqFindLast(s, p).Some? ==> SeqFindLast(s, p).value in s
@@ -1029,12 +1062,21 @@ const SEQ_JOIN = `function SeqJoin(s: seq<string>, sep: string): string
   else if |s| == 1 then s[0]
   else s[0] + sep + SeqJoin(s[1..], sep)
 }`;
-const SAFE_SLICE = `function SafeSlice<T>(s: seq<T>, lo: int, hi: int): seq<T>
+const SAFE_SLICE = `function NormalizeSliceIndex(n: nat, i: int): int
+  ensures 0 <= NormalizeSliceIndex(n, i) <= n as int
+{
+  if i < 0 then
+    if n as int + i < 0 then 0 else n as int + i
+  else if i > n as int then n as int
+  else i
+}
+
+function SafeSlice<T>(s: seq<T>, lo: int, hi: int): seq<T>
   ensures |SafeSlice(s, lo, hi)| <= |s|
 {
-  var lo' := if lo < 0 then 0 else if lo > |s| as int then |s| else lo;
-  var hi' := if hi > |s| as int then |s| else if hi < lo' then lo' else hi;
-  s[lo'..hi']
+  var lo' := NormalizeSliceIndex(|s|, lo);
+  var hi' := NormalizeSliceIndex(|s|, hi);
+  if hi' < lo' then [] else s[lo'..hi']
 }`;
 const STRING_INDEX_OF = `function StringIndexOf(s: string, sub: string): int
   ensures StringIndexOf(s, sub) == -1
@@ -1077,6 +1119,10 @@ const STRING_SPLIT = `function {:axiom} StringSplit(s: string, d: string): seq<s
 // is the soundness condition — cmp must be a total preorder, otherwise no sorted
 // permutation exists and the axiom would be vacuous. Callers discharge it (e.g.
 // `(a,b) => a.k - b.k` is total + transitive by linear arithmetic).
+// Bare `.sort()`: permutation only, no sortedness (JS default order is type-dependent).
+const SEQ_SORT = `function {:axiom} SeqSort<T(==,!new)>(s: seq<T>): seq<T>
+  ensures multiset(SeqSort(s)) == multiset(s)
+  ensures |SeqSort(s)| == |s|`;
 const SEQ_SORT_BY = `function {:axiom} SeqSortBy<T(==,!new)>(s: seq<T>, cmp: (T, T) -> int): seq<T>
   requires forall a: T, b: T :: cmp(a, b) <= 0 || cmp(b, a) <= 0
   requires forall a: T, b: T, c: T :: cmp(a, b) <= 0 && cmp(b, c) <= 0 ==> cmp(a, c) <= 0
@@ -1246,6 +1292,7 @@ const PREAMBLE_CODE = [
     ["FloorReal", FLOOR_REAL],
     ["SeqIndexOf", SEQ_INDEX_OF],
     ["SeqFindIndex", SEQ_FIND_INDEX],
+    ["SeqFindLastIndex", SEQ_FIND_LAST_INDEX],
     ["SeqFilterSome", SEQ_FILTER_SOME],
     ["SeqFindLast", SEQ_FIND_LAST],
     ["SeqFlatten", SEQ_FLATTEN],
@@ -1253,6 +1300,7 @@ const PREAMBLE_CODE = [
     ["SafeSlice", SAFE_SLICE],
     ["StringIndexOf", STRING_INDEX_OF],
     ["StringSplit", STRING_SPLIT],
+    ["SeqSort", SEQ_SORT],
     ["SeqSortBy", SEQ_SORT_BY],
     ["StringTrim", STRING_TRIM],
     ["StringToLower", STRING_TO_LOWER],
@@ -1303,6 +1351,8 @@ function resolveTy(ty) {
         return { kind: "optional", inner: resolveTy(ty.inner) };
     if (ty.kind === "array")
         return { kind: "array", elem: resolveTy(ty.elem) };
+    if (ty.kind === "tuple")
+        return { kind: "tuple", elems: ty.elems.map(resolveTy) };
     if (ty.kind === "map")
         return { kind: "map", key: resolveTy(ty.key), value: resolveTy(ty.value) };
     if (ty.kind === "set")

package/tools/dist/extract.js

@@ -1887,7 +1887,8 @@ export function extractModule(sourceFile) {
             const name = recordMatch[1];
             // `<T extends B>` → bare `T`: a Dafny type param, like the def path.
             const typeParams = recordMatch[2]?.split(",").map(s => s.trim().split(/\s+extends\s+/)[0].trim()).filter(Boolean);
-            const fields = recordMatch[3].split(",").map(f => f.trim()).filter(Boolean).map(f => {
+            // Split on `,` OR `;` — TS object types allow both.
+            const fields = recordMatch[3].split(/[,;]/).map(f => f.trim()).filter(Boolean).map(f => {
                 const [fname, ftype] = f.split(":").map(s => s.trim());
                 const synth = _synthFromTsTypeString(ftype);
                 return { name: fname, tsType: synth ?? ftype };

package/tools/dist/ir.js

@@ -37,6 +37,8 @@ export function anyExpr(e, pred) {
         case "app": return e.args.some(a => anyExpr(a, pred));
         case "field": return anyExpr(e.obj, pred);
         case "index": return anyExpr(e.arr, pred) || anyExpr(e.idx, pred);
+        case "tupleLiteral": return e.elems.some(x => anyExpr(x, pred));
+        case "tupleProj": return anyExpr(e.obj, pred);
         case "implies": return e.premises.some(p => anyExpr(p, pred)) || anyExpr(e.conclusion, pred);
         case "record": return (e.spread ? anyExpr(e.spread, pred) : false) || e.fields.some(f => anyExpr(f.value, pred));
         case "arrayLiteral": return e.elems.some(x => anyExpr(x, pred));

package/tools/dist/lean-emit.js

@@ -34,6 +34,13 @@ function tyToLean(ty) {
             const elem = tyToLean(ty.elem);
             return elem.includes(" ") ? `Array (${elem})` : `Array ${elem}`;
         }
+        case "tuple":
+            // Right-nested Prod: `A × B × C` = `A × (B × C)`. Parenthesize any element
+            // whose rendering has a space so it binds tighter than `×` (e.g. `A → B`).
+            return ty.elems.map(el => {
+                const s = tyToLean(el);
+                return s.includes(" ") ? `(${s})` : s;
+            }).join(" × ");
         case "map": {
             const k = tyToLean(ty.key);
             const v = tyToLean(ty.value);
@@ -112,6 +119,9 @@ function collectUserRefs(ty, into) {
         case "set":
             collectUserRefs(ty.elem, into);
             break;
+        case "tuple":
+            ty.elems.forEach(el => collectUserRefs(el, into));
+            break;
         case "optional":
             collectUserRefs(ty.inner, into);
             break;
@@ -226,6 +236,8 @@ function emitMethodCall(tyKind, method, monadic, obj, args) {
             return `${obj}.${monadic ? "allM" : "all"} ${args[0]}`;
         if (method === "some")
             return `${obj}.${monadic ? "anyM" : "any"} ${args[0]}`;
+        if (method === "reduce" && args.length === 2)
+            return `(${obj}.foldl ${args[0]} ${args[1]})`;
         if (method === "includes")
             return args.length > 1 ? `(${obj}.extract ${args[1]} ${obj}.size).contains ${args[0]}` : `${obj}.contains ${args[0]}`;
         if (method === "find")
@@ -318,6 +330,15 @@ function emitExpr(e, parentPrec) {
             if (e.elems.length === 0)
                 return `#[]`;
             return `#[${e.elems.map(el => emitExpr(el)).join(", ")}]`;
+        case "tupleLiteral":
+            return `(${e.elems.map(el => emitExpr(el)).join(", ")})`;
+        case "tupleProj": {
+            // Right-nested Prod projection: element i is `.2`×i then `.1`, except the
+            // last (i = arity-1) which is `.2`×i with no trailing `.1`.
+            const obj = emitExpr(e.obj);
+            const twos = ".2".repeat(e.index);
+            return e.index === e.arity - 1 ? `${obj}${twos}` : `${obj}${twos}.1`;
+        }
         case "emptyMap": return `Std.HashMap.empty`;
         case "emptySet": return `Std.HashSet.empty`;
         case "default": return `(default : ${tyToLean(e.type)})`;
@@ -457,8 +478,13 @@ function emitExpr(e, parentPrec) {
             // A real value reached the Lean backend via coercion (e.g. number `/`).
             // Same unsupported-real story as the `real` type case in tyToLean.
             throw new Error("real arithmetic is not supported by the Lean backend (needs noncomputable ℝ / Mathlib).");
-        case "index":
-            return `${emitExpr(e.arr)}[${emitExpr(e.idx)}]!`;
+        case "index": {
+            const arr = emitExpr(e.arr);
+            // Parenthesize a low-precedence array expr (e.g. a function application)
+            // so the index binds to the whole thing, not its last token.
+            const wrap = e.arr.kind === "app" || e.arr.kind === "binop" || e.arr.kind === "methodCall" || e.arr.kind === "if" || e.arr.kind === "let" || e.arr.kind === "unop";
+            return `${wrap ? `(${arr})` : arr}[${emitExpr(e.idx)}]!`;
+        }
         case "record": {
             const fields = e.fields.map(f => `${escapeName(f.name)} := ${emitExpr(f.value)}`);
             if (e.spread)
@@ -633,6 +659,59 @@ function emitStmt(s, indent) {
     }
 }
 // ── Declaration emission ─────────────────────────────────────
+/** Collect every function/variable name an IR tree references (stripping any
+ *  `Pure.` qualifier), via a generic walk over `app`/`var` nodes. */
+function collectRefNames(node, into) {
+    if (node === null || typeof node !== "object")
+        return;
+    if (Array.isArray(node)) {
+        for (const x of node)
+            collectRefNames(x, into);
+        return;
+    }
+    const n = node;
+    if (n.kind === "app" && typeof n.fn === "string")
+        into.add(n.fn.replace(/^Pure\./, ""));
+    if (n.kind === "var" && typeof n.name === "string")
+        into.add(n.name.replace(/^Pure\./, ""));
+    for (const k of Object.keys(node))
+        collectRefNames(node[k], into);
+}
+/** Lean requires definition-before-use: order sibling decls so one that
+ *  references another is emitted after it. Cycles are left in place (they would
+ *  need a `mutual` block). Bails to the original order if any decl is unnamed. */
+function orderDeclsByDeps(decls) {
+    const named = decls.filter((d) => typeof d.name === "string");
+    if (named.length !== decls.length)
+        return decls;
+    const names = new Set(named.map(d => d.name));
+    const byName = new Map(named.map(d => [d.name, d]));
+    const deps = new Map();
+    for (const d of named) {
+        const refs = new Set();
+        collectRefNames(d, refs);
+        refs.delete(d.name);
+        deps.set(d.name, [...refs].filter(r => names.has(r)));
+    }
+    const sorted = [];
+    const done = new Set();
+    const onStack = new Set();
+    const visit = (name) => {
+        if (done.has(name) || onStack.has(name))
+            return;
+        onStack.add(name);
+        for (const dep of deps.get(name) ?? [])
+            visit(dep);
+        onStack.delete(name);
+        done.add(name);
+        const def = byName.get(name);
+        if (def)
+            sorted.push(def);
+    };
+    for (const d of named)
+        visit(d.name);
+    return sorted;
+}
 function emitDecl(d) {
     switch (d.kind) {
         case "inductive": {
@@ -711,7 +790,7 @@ function emitDecl(d) {
         }
         case "namespace": {
             const lines = [`namespace ${d.name}`];
-            for (const inner of d.decls)
+            for (const inner of orderDeclsByDeps(d.decls))
                 lines.push("", emitDecl(inner));
             lines.push("", `end ${d.name}`);
             return lines.join("\n");
@@ -733,8 +812,10 @@ function emitDecl(d) {
                 return sig;
             // Spec axiom: ∀ params, req1 → … → (ens1 ∧ … ∧ ensN). Tagged `@[grind]` so
             // the proof automation can use it, matching the ghost-function convention.
-            const hyps = d.requires.map(emitExpr);
-            const concl = d.ensures.map(emitExpr).join(" ∧ ");
+            // Parenthesize each clause: an unwrapped `∀ k, P` would otherwise swallow
+            // the following ` ∧ …` conjuncts into its body.
+            const hyps = d.requires.map(e => `(${emitExpr(e)})`);
+            const concl = d.ensures.map(e => `(${emitExpr(e)})`).join(" ∧ ");
             const axBody = [...hyps, concl].join(" → ");
             const axiom = `@[grind] axiom ${escapeName(d.name)}_spec${params ? ` ${params}` : ""} : ${axBody}`;
             return `${sig}\n${axiom}`;

package/tools/dist/lsc.js

@@ -98,6 +98,16 @@ function main() {
         slow = true;
         args.splice(slowIdx, 1);
     }
+    // --no-verify (regen only): do regen + three-way merge + additions-only check
+    // but skip `dafny verify`. CI's `tools` job passes this to regen-dafny.sh so
+    // regen only enforces the drift + additions-only invariants; the separate
+    // `lsc check` pass over the same files does the one and only verification.
+    let noVerify = false;
+    const noVerifyIdx = args.indexOf("--no-verify");
+    if (noVerifyIdx >= 0) {
+        noVerify = true;
+        args.splice(noVerifyIdx, 1);
+    }
     // Anything flag-shaped left over is a typo or a space-separated form
     // (`--backend lean`): reject it rather than let it become a positional arg
     // or be silently ignored (which would e.g. verify with the wrong backend).
@@ -117,7 +127,7 @@ function main() {
         runBatch(cmd, backend, slow);
         return;
     }
-    runFile(cmd, filePath, backend, timeLimit, extraFlags);
+    runFile(cmd, filePath, backend, timeLimit, extraFlags, noVerify);
 }
 // LemmaScript-files.txt, parsed: `filepath [timeout_in_seconds] [extra dafny
 // flags…]` per line; no timeout = Dafny default. Exits if the file is absent.
@@ -154,7 +164,7 @@ function runBatch(cmd, backend, slow) {
         }
     }
 }
-function runFile(cmd, filePath, backend, timeLimit, extraFlags) {
+function runFile(cmd, filePath, backend, timeLimit, extraFlags, noVerify = false) {
     const absPath = path.resolve(filePath);
     if (!existsSync(absPath)) {
         console.error(`File not found: ${absPath}`);
@@ -247,7 +257,7 @@ function runFile(cmd, filePath, backend, timeLimit, extraFlags) {
             return;
         }
         if (cmd === "regen") {
-            dafnyRegen(genPath, dfyPath, basePath, text, dir, timeLimit, extraFlags);
+            dafnyRegen(genPath, dfyPath, basePath, text, dir, timeLimit, extraFlags, noVerify);
             return;
         }
         console.error(`Unknown command: ${cmd}`);

package/tools/dist/narrow.js

@@ -145,7 +145,7 @@ function walkStmt(s) {
     // array rule fires; independent narrows commute, so the order is harmless.)
     // && rules fire before the simple rule because they produce nested ifs whose
     // inner shape doesn't match the simple rule directly.
-    return ruleIfAndOptional(r) ?? ruleIfAndArrayIsArray(r) ?? ruleIfOptionalSimple(r) ?? ruleExprStmtAndOptional(r) ?? r;
+    return ruleIfAndOptional(r) ?? ruleIfAndArrayIsArray(r) ?? ruleIfOptionalSimple(r) ?? ruleExprStmtAndOptional(r) ?? ruleOptionalIndexBinding(r) ?? r;
 }
 function walkStmts(stmts) {
     const result = [];
@@ -159,7 +159,7 @@ function walkStmts(stmts) {
             i += tagged.consumed - 1;
             continue;
         }
-        const consumed = ruleEarlyReturnOrChain(s, rest) ?? ruleEarlyReturnConsume(s, rest);
+        const consumed = ruleEarlyReturnOrChain(s, rest) ?? ruleEarlyReturnConsume(s, rest) ?? ruleEarlyReturnOptChainCompare(s, rest);
         if (consumed) {
             result.push(walkStmt(consumed));
             return result;
@@ -260,54 +260,138 @@ function ruleEarlyReturnConsume(s, rest) {
         noneBody: noneBranch,
     };
 }
-/** Collect a `||` chain of negative optional checks (`x === undefined`).
- *  Returns the list of checks if every leaf is a negative optional check; null otherwise. */
-function collectOrChainOfNegativeChecks(cond) {
-    if (cond.kind === "binop" && cond.op === "||") {
-        const left = collectOrChainOfNegativeChecks(cond.left);
-        const right = collectOrChainOfNegativeChecks(cond.right);
-        if (!left || !right)
-            return null;
-        return [...left, ...right];
+/** Flatten a nested `||` chain into its leaf conditions. */
+function flattenOr(e) {
+    if (e.kind === "binop" && e.op === "||")
+        return [...flattenOr(e.left), ...flattenOr(e.right)];
+    return [e];
+}
+function classifyDisjunct(leaf) {
+    // `x?.chain !== lit` — `undefined !== lit` is true when x is None.
+    if (leaf.kind === "binop" && leaf.op === "!==") {
+        const oc = leaf.left.kind === "optChain" ? leaf.left : leaf.right.kind === "optChain" ? leaf.right : null;
+        if (oc && oc.kind === "optChain" && oc.obj.ty.kind === "optional") {
+            const hint = binderHintFor(oc.obj);
+            if (hint === null)
+                return null;
+            const binder = freshName(hint);
+            const unwrapped = applyChain({ kind: "var", name: binder, ty: oc.obj.ty.inner }, oc.chain);
+            if (unwrapped.kind === "field" && unwrapped.obj.ty.kind === "user") {
+                const base = unwrapped.obj.ty.name.replace(/<.*/, "");
+                const decl = _typeDecls.find(d => d.name === base);
+                if (decl?.kind === "discriminated-union" && decl.discriminant === unwrapped.field)
+                    unwrapped.isDiscriminant = true;
+            }
+            const lit = leaf.left === oc ? leaf.right : leaf.left;
+            return { scrutinee: oc.obj, innerTy: oc.obj.ty.inner, binder, residual: { kind: "binop", op: "!==", left: unwrapped, right: lit, ty: { kind: "bool" } } };
+        }
     }
-    const check = parseSimpleOptionalCheck(cond);
-    if (!check || !check.negated)
-        return null;
-    return [check];
+    // `!x` / `x === undefined`.
+    const chk = parseOptionalCheck(leaf);
+    if (chk && chk.negated) {
+        const residual = canBeFalsy(chk)
+            ? { kind: "unop", op: "!", expr: { kind: "var", name: chk.binderHint, ty: chk.innerTy }, ty: { kind: "bool" } }
+            : null;
+        return { scrutinee: chk.scrutinee, innerTy: chk.innerTy, binder: chk.binderHint, residual };
+    }
+    return null;
 }
-/** Rule: `if (x === undefined || y === undefined || ...) terminate; rest`.
- *  → nested someMatches narrowing each var in turn, each None branch = terminate,
- *    deepest someBody = rest.
+/** Rule: `if (D1 || … || Dn) terminate; rest`. Each `Di` that detects some optional
+ *  `x` is None (`!x`, `x === undefined`, `x?.chain !== lit`) narrows that `x` to Some
+ *  across `rest`; the rest — value guards reading a narrowed `x` directly, plus the
+ *  detectors' Some-case residuals — become a trailing early-return. Sound: reaching
+ *  `rest` means every disjunct was false, so every detected optional is present.
+ *  Covers `if (!x || x.f !== v) continue` / `if (x?.t !== 'm' || x.g) break`.
  *  Closes the resolve.ts:602 TODO ("|| narrowing"). */
 function ruleEarlyReturnOrChain(s, rest) {
     if (s.kind !== "if")
         return null;
     if (rest.length === 0)
         return null;
-    if (s.then.length === 0 || s.else.length !== 0)
+    if (s.then.length === 0 || s.else.length !== 0 || !isTerminating(s.then))
         return null;
     if (s.cond.kind !== "binop" || s.cond.op !== "||")
         return null; // single check is the simpler rule
-    const checks = collectOrChainOfNegativeChecks(s.cond);
-    if (!checks || checks.length < 2)
-        return null;
-    // Build nested someMatch from innermost outward
-    let inner = rest;
-    for (let i = checks.length - 1; i >= 0; i--) {
-        const check = checks[i];
-        const someBody = canBeFalsy(check)
-            ? [{ kind: "if", cond: bound(check), then: inner, else: s.then }]
-            : inner;
-        inner = [{
-                kind: "someMatch",
-                scrutinee: check.scrutinee, binderTy: check.innerTy,
-                binder: check.binderHint,
-                someBody,
-                noneBody: s.then,
-            }];
+    const leaves = flattenOr(s.cond);
+    if (leaves.length < 2)
+        return null;
+    const detectors = [];
+    const residualLeaves = [];
+    const seen = new Set();
+    for (const leaf of leaves) {
+        const d = classifyDisjunct(leaf);
+        if (!d) {
+            residualLeaves.push(leaf);
+            continue;
+        }
+        const key = binderHintFor(d.scrutinee);
+        if (seen.has(key))
+            return null; // two detectors on one optional: rare; leave to other rules
+        seen.add(key);
+        detectors.push(d);
+        if (d.residual)
+            residualLeaves.push(d.residual);
+    }
+    if (detectors.length === 0)
+        return null;
+    let inner = residualLeaves.length === 0
+        ? rest
+        : [{ kind: "if", cond: residualLeaves.reduce((a, b) => ({ kind: "binop", op: "||", left: a, right: b, ty: { kind: "bool" } })), then: s.then, else: [] }, ...rest];
+    for (let i = detectors.length - 1; i >= 0; i--) {
+        const d = detectors[i];
+        inner = [{ kind: "someMatch", scrutinee: d.scrutinee, binderTy: d.innerTy, binder: d.binder, someBody: inner, noneBody: s.then }];
     }
     return inner[0];
 }
+/** Rule: `if (opt?.chain !== lit) terminate; rest` where `opt` is optional.
+ *  `opt?.chain` is `undefined` when `opt` is None, and `undefined !== lit` is
+ *  true, so the None case takes the terminating branch — falling through to
+ *  `rest` proves `opt` is Some. Rewrite to
+ *    someMatch opt { Some(v) => [if (v.chain !== lit) terminate; rest]; None => terminate }
+ *  narrowing `opt` to `v` across `rest` (transform substitutes the scrutinee) and
+ *  handing the now-non-optional inner guard to the ordinary rules (e.g.
+ *  discriminant narrowing). Bound-optional companion to ruleEarlyReturnConsume,
+ *  which handles only a bare presence check (`opt !== undefined`). Restricted to
+ *  `!==` so the None case is guaranteed to terminate. */
+function ruleEarlyReturnOptChainCompare(s, rest) {
+    if (s.kind !== "if")
+        return null;
+    if (rest.length === 0)
+        return null;
+    if (s.else.length !== 0 || !isTerminating(s.then))
+        return null;
+    const c = s.cond;
+    if (c.kind !== "binop" || c.op !== "!==")
+        return null;
+    const oc = c.left.kind === "optChain" ? c.left : c.right.kind === "optChain" ? c.right : null;
+    if (!oc || oc.kind !== "optChain" || oc.obj.ty.kind !== "optional")
+        return null;
+    const lit = c.left === oc ? c.right : c.left;
+    const innerTy = oc.obj.ty.inner;
+    const hint = binderHintFor(oc.obj);
+    if (hint === null)
+        return null;
+    const binder = freshName(hint);
+    const binderVar = { kind: "var", name: binder, ty: innerTy };
+    const unwrapped = applyChain(binderVar, oc.chain);
+    // applyChain rebuilds the field without the `isDiscriminant` flag resolve sets
+    // on a direct `x.disc`; restore it when the unwrapped access is the binder
+    // union's discriminant, so the inner guard feeds discriminant narrowing.
+    if (unwrapped.kind === "field" && unwrapped.obj.ty.kind === "user") {
+        const base = unwrapped.obj.ty.name.replace(/<.*/, "");
+        const decl = _typeDecls.find(d => d.name === base);
+        if (decl?.kind === "discriminated-union" && decl.discriminant === unwrapped.field) {
+            unwrapped.isDiscriminant = true;
+        }
+    }
+    const innerGuard = { kind: "binop", op: "!==", left: unwrapped, right: lit, ty: { kind: "bool" } };
+    // Keep `rest` as trailing statements (not an else branch) — `s.then` terminates,
+    // so `if (g) terminate; rest` ≡ `if (g) terminate else rest`, and the trailing
+    // form lets the ordinary early-exit rules (e.g. discriminant narrowing) fire on
+    // the now-non-optional inner guard when `chain` is a union discriminant.
+    const someBody = [{ kind: "if", cond: innerGuard, then: s.then, else: [] }, ...rest];
+    return { kind: "someMatch", scrutinee: oc.obj, binder, binderTy: innerTy, someBody, noneBody: s.then };
+}
 /** Rule (expression): `e !== undefined ? a : b`. */
 function ruleConditionalOptionalSimple(e) {
     if (e.kind !== "conditional")
@@ -491,6 +575,32 @@ function ruleOptChainIndex(e) {
     const undef = { kind: "var", name: "undefined", ty: { kind: "void" } };
     return { kind: "conditional", cond, then: body, else: undef, ty: e.ty };
 }
+/** Rule (statement): reconcile a `const e = arr[i]` whose binding is optional
+ *  (`e: T | undefined`) but whose array-index initializer is total (`T`). Model
+ *  the index as its JS semantics — `e := (0 <= i && i < arr.length) ? arr[i] :
+ *  undefined` — so `e` is a real `Option<T>` and a later `e?.f` someMatch is
+ *  well-typed; an in-bounds proof makes the None branch dead, so safely-indexed
+ *  code verifies as if total. Bound-form sibling of ruleOptChainIndex /
+ *  ruleNullishIndex. Fires purely on the optional-binding/total-index shape (the
+ *  usual source is `noUncheckedIndexedAccess`, but the flag itself is never
+ *  checked). Skipped when the element type is already optional: no mismatch. */
+function ruleOptionalIndexBinding(s) {
+    if (s.kind !== "let")
+        return null;
+    if (s.ty.kind !== "optional")
+        return null;
+    const init = s.init;
+    if (init.kind !== "index")
+        return null;
+    if (init.obj.ty.kind !== "array")
+        return null;
+    if (init.ty.kind === "optional")
+        return null; // array-of-optionals: not a flag artifact
+    const cond = arrayBoundsCond(init.obj, init.idx);
+    const undef = { kind: "var", name: "undefined", ty: { kind: "void" } };
+    const guarded = { kind: "conditional", cond, then: init, else: undef, ty: s.ty };
+    return { ...s, init: guarded };
+}
 /** Rule (expression): `obj?.<chain>` — single-eval optional chain.
  *  → `someMatch obj { Some(_oc{N}_val) => apply(chain, _oc{N}_val), None => undefined }`.
  *  The someBody applies the chain to the binder directly (field/call/index),

package/tools/dist/peephole.js

@@ -24,6 +24,8 @@ function mapExpr(e, f) {
         case "toNat": return { ...e, expr: r(e.expr) };
         case "toReal": return { ...e, expr: r(e.expr) };
         case "index": return { ...e, arr: r(e.arr), idx: r(e.idx) };
+        case "tupleLiteral": return { ...e, elems: e.elems.map(r) };
+        case "tupleProj": return { ...e, obj: r(e.obj) };
         case "record": return { ...e, spread: e.spread ? r(e.spread) : null,
             fields: e.fields.map(fi => ({ ...fi, value: r(fi.value) })) };
         case "arrayLiteral": return { ...e, elems: e.elems.map(r) };
@@ -368,6 +370,8 @@ function rewriteChildrenExpr(e) {
         case "toNat": return { ...e, expr: r(e.expr) };
         case "toReal": return { ...e, expr: r(e.expr) };
         case "index": return { ...e, arr: r(e.arr), idx: r(e.idx) };
+        case "tupleLiteral": return { ...e, elems: e.elems.map(r) };
+        case "tupleProj": return { ...e, obj: r(e.obj) };
         case "record": return { ...e, spread: e.spread ? r(e.spread) : null,
             fields: e.fields.map(fi => ({ ...fi, value: r(fi.value) })) };
         case "arrayLiteral": return { ...e, elems: e.elems.map(r) };

package/tools/dist/resolve.js

@@ -4,7 +4,7 @@
  * Uses linked environments (Scheme-style) for lexical scoping.
  * No mutation — each let extends the chain, lookup walks it.
  */
-import { isBigInt } from "./typedir.js";
+import { isBigInt, tyEqual } from "./typedir.js";
 import { parseTsType, tyToCanonical } from "./types.js";
 import { parseExpr } from "./specparser.js";
 import { freshName } from "./names.js";
@@ -283,6 +283,8 @@ function expandAlias(ty, typeDecls, seen = new Set()) {
         return { kind: "optional", inner: expandAlias(ty.inner, typeDecls, seen) };
     if (ty.kind === "array")
         return { kind: "array", elem: expandAlias(ty.elem, typeDecls, seen) };
+    if (ty.kind === "tuple")
+        return { kind: "tuple", elems: ty.elems.map(e => expandAlias(e, typeDecls, seen)) };
     if (ty.kind === "set")
         return { kind: "set", elem: expandAlias(ty.elem, typeDecls, seen) };
     if (ty.kind === "map")
@@ -300,7 +302,7 @@ function getDiscriminant(ctx, typeName) {
 // unions, arrays, maps, sets, and unresolved generics are reference-compared at
 // runtime, so a structural proof over them is unsound. Returns true for those.
 function refEqHazard(ty, typeDecls) {
-    if (ty.kind === "array" || ty.kind === "map" || ty.kind === "set")
+    if (ty.kind === "array" || ty.kind === "map" || ty.kind === "set" || ty.kind === "tuple")
         return true;
     if (ty.kind === "user") {
         let decl = typeDecls.find(d => d.name === ty.name);
@@ -340,6 +342,8 @@ function isUnmodeledTy(ty, typeDecls) {
         return isUnmodeledTy(ty.inner, typeDecls);
     if (ty.kind === "array")
         return isUnmodeledTy(ty.elem, typeDecls);
+    if (ty.kind === "tuple")
+        return ty.elems.some(e => isUnmodeledTy(e, typeDecls));
     if (ty.kind === "set")
         return isUnmodeledTy(ty.elem, typeDecls);
     if (ty.kind === "map")
@@ -476,8 +480,19 @@ function inferLambdaParamTypes(fn, rawArgs, ctx) {
             return [{ ...lam, params: updatedParams }, ...rawArgs.slice(1)];
         }
     }
+    // reduce's callback is (acc, elem): acc from the init arg's type, elem from the array.
+    if (fn.kind === "field" && fn.obj.ty.kind === "array" && fn.field === "reduce" && ctx &&
+        rawArgs.length >= 2 && rawArgs[0].kind === "lambda" && rawArgs[0].params.length >= 2) {
+        const accTs = tyToTsStr(resolveExpr(rawArgs[1], ctx).ty);
+        const elemTs = tyToTsStr(fn.obj.ty.elem);
+        if (accTs && elemTs) {
+            const lam = rawArgs[0];
+            const updatedParams = lam.params.map((p, i) => p.tsType || i > 1 ? p : { ...p, tsType: i === 0 ? accTs : elemTs });
+            return [{ ...lam, params: updatedParams }, ...rawArgs.slice(1)];
+        }
+    }
     if (fn.kind === "field" && fn.obj.ty.kind === "array" &&
-        ["map", "filter", "every", "some", "find", "findLast", "findIndex"].includes(fn.field) &&
+        ["map", "filter", "every", "some", "find", "findLast", "findIndex", "findLastIndex"].includes(fn.field) &&
         rawArgs.length >= 1 && rawArgs[0].kind === "lambda" &&
         rawArgs[0].params.length >= 1 && !rawArgs[0].params[0].tsType) {
         const elemTy = fn.obj.ty.elem;
@@ -600,9 +615,11 @@ function inferMethodReturnTy(fn, args, ctx) {
             return objTy;
         if (fn.field === "every" || fn.field === "some")
             return { kind: "bool" };
+        if (fn.field === "reduce" && args.length === 2)
+            return args[1].ty;
         if (fn.field === "find" || fn.field === "findLast")
             return { kind: "optional", inner: objTy.elem };
-        if (fn.field === "findIndex")
+        if (fn.field === "findIndex" || fn.field === "findLastIndex")
             return { kind: "int" };
         if (fn.field === "flat" && objTy.elem.kind === "array")
             return { kind: "array", elem: objTy.elem.elem };
@@ -926,6 +943,16 @@ function resolveExpr(e, ctx) {
             if (obj.ty.kind === "array") {
                 idxTy = obj.ty.elem;
             }
+            else if (obj.ty.kind === "tuple") {
+                // Tuple projection: the position must be a literal — a tuple has a
+                // distinct type per slot, so a runtime index has no single result type
+                // and no backend projection (`t.0`/`t.1`) exists for it.
+                const elems = obj.ty.elems;
+                if (idx.kind !== "num" || !Number.isInteger(idx.value) || idx.value < 0 || idx.value >= elems.length) {
+                    throw new Error(`tuple index must be an integer literal in [0, ${elems.length}); got ${tyToCanonical(idx.ty)} index into ${tyToCanonical(obj.ty)}`);
+                }
+                idxTy = elems[idx.value];
+            }
             else if (obj.ty.kind === "map") {
                 const objPath = asTExprAccessPath(obj);
                 const idxPath = asTExprAccessPath(idx);
@@ -1090,6 +1117,17 @@ function resolveExpr(e, ctx) {
             return { kind: "exists", var: e.var, varTy, body: resolveExpr(e.body, withEnv(ctx, extend(ctx.env, e.var, varTy))), ty: { kind: "bool" } };
         }
         case "arrayLiteral": {
+            // Expected-tuple context: type each element against its own slot type and
+            // produce a tuple literal (`[1, "a"]: [number, string]`).
+            if (ctx.returnTy.kind === "tuple") {
+                const slots = ctx.returnTy.elems;
+                const elems = e.elems.map((el, i) => {
+                    const slot = slots[i];
+                    const r = resolveExpr(el, slot ? { ...ctx, returnTy: slot } : ctx);
+                    return slot ? coerceStr(r, slot) : r;
+                });
+                return { kind: "arrayLiteral", elems, ty: { kind: "tuple", elems: elems.map(x => x.ty) } };
+            }
             // Thread the expected element type into each element, so a record/union
             // literal in an array resolves to its named datatype rather than an
             // anonymous tuple (mirrors return-position and call-argument records, which
@@ -1104,6 +1142,12 @@ function resolveExpr(e, ctx) {
                 return expectedElem ? coerceStr(r, expectedElem) : r;
             });
             const elemTy = elems.length > 0 ? elems[0].ty : { kind: "unknown" };
+            // No expected collection type: infer array vs tuple from the elements —
+            // heterogeneous element types can't be a homogeneous seq, so they form a
+            // tuple (`[1, "a"]` → `(int, string)`); otherwise a seq.
+            if (!expectedElem && elems.length >= 2 && !elems.every(x => tyEqual(x.ty, elemTy))) {
+                return { kind: "arrayLiteral", elems, ty: { kind: "tuple", elems: elems.map(x => x.ty) } };
+            }
             return { kind: "arrayLiteral", elems, ty: { kind: "array", elem: elemTy } };
         }
         case "lambda": {
@@ -1369,6 +1413,12 @@ function resolveStmt(s, ctx) {
                 // Map destructuring: [key, value]
                 nameTypes.push(iterable.ty.key, iterable.ty.value);
             }
+            else if (s.names.length >= 2 && iterable.ty.kind === "array" && iterable.ty.elem.kind === "tuple") {
+                // Array of tuples: bind each name to its slot type.
+                const elems = iterable.ty.elem.elems;
+                for (let i = 0; i < s.names.length; i++)
+                    nameTypes.push(elems[i] ?? { kind: "unknown" });
+            }
             else {
                 // General tuple destructuring: all unknown
                 for (const _ of s.names)

package/tools/dist/transform.js

@@ -37,6 +37,8 @@ function mapExpr(e, f) {
         case "toNat": return { ...e, expr: r(e.expr) };
         case "toReal": return { ...e, expr: r(e.expr) };
         case "index": return { ...e, arr: r(e.arr), idx: r(e.idx) };
+        case "tupleLiteral": return { ...e, elems: e.elems.map(r) };
+        case "tupleProj": return { ...e, obj: r(e.obj) };
         case "record": return { ...e, spread: e.spread ? r(e.spread) : null, fields: e.fields.map(fi => ({ ...fi, value: r(fi.value) })) };
         case "arrayLiteral": return { ...e, elems: e.elems.map(r) };
         case "if": return { ...e, cond: r(e.cond), then: r(e.then), else: r(e.else) };
@@ -187,6 +189,12 @@ export const DAFNY_OPTIONS = {
 let _opts = DAFNY_OPTIONS;
 /** Type declarations — set once per module transform for discriminated union handling. */
 let _typeDecls = [];
+/** Names of functions that get a `Pure.` mirror (Lean). A bare reference to one
+ *  in a higher-order position resolves to the monadic method, so it must be
+ *  redirected to the pure mirror. Set once per module transform. */
+let _pureDefNames = new Set();
+/** Array methods that take a function argument. */
+const HOF_METHODS = new Set(["map", "filter", "every", "some", "find", "findLast", "findIndex", "findLastIndex", "reduce"]);
 /** Prefix match-bound field names to avoid capturing user variables.
  *  When prefix is given (the scrutinee name), include it to avoid
  *  collisions in nested matches on different variables. `freshName` closes
@@ -329,7 +337,8 @@ function coerceCondToBool(cond, ty) {
         return { kind: "binop", op: "≠", left: cond, right: { kind: "num", value: 0 } };
     if (ty.kind === "string")
         return { kind: "binop", op: ">", left: { kind: "field", obj: cond, field: "length" }, right: { kind: "num", value: 0 } };
-    if (ty.kind === "array")
+    // Arrays, objects, maps, sets, tuples are always truthy in JS (even `[]`/`{}`).
+    if (["array", "user", "map", "set", "tuple"].includes(ty.kind))
         return { kind: "bool", value: true };
     return cond;
 }
@@ -439,8 +448,9 @@ function lowerExpr(e, binds) {
             // Number truthiness: !n → n == 0
             if (e.op === "!" && (e.expr.ty.kind === "int" || e.expr.ty.kind === "nat"))
                 return { kind: "binop", op: "=", left: lowerExpr(e.expr, binds), right: { kind: "num", value: 0 } };
-            // Array truthiness: every array is truthy in JS, so !xs is always false.
-            if (e.op === "!" && e.expr.ty.kind === "array") {
+            // Object truthiness: arrays, objects, maps, and sets are always truthy in
+            // JS, so `!x` is always false.
+            if (e.op === "!" && ["array", "user", "map", "set", "tuple"].includes(e.expr.ty.kind)) {
                 lowerExpr(e.expr, binds); // preserve any lifted side effects; value is the constant false
                 return { kind: "bool", value: false };
             }
@@ -605,6 +615,13 @@ function lowerExpr(e, binds) {
                     else: { kind: "var", name: "undefined" },
                 };
             }
+            // || on a number → `if x != 0 then x else default` (0 the only falsy int).
+            if (e.op === "||" && (e.left.ty.kind === "int" || e.left.ty.kind === "nat")) {
+                const left = lowerExpr(e.left, binds);
+                const right = lowerExpr(e.right, binds);
+                const truthy = valueTruthyCond(left, e.left.ty);
+                return { kind: "if", cond: truthy, then: left, else: right };
+            }
             // String concatenation: `+` with a string operand. Stringify int/nat
             // operands (Dafny NatToString, Lean toString) and join with arrayConcat
             // (rendered `+` in Dafny, `++` in Lean).
@@ -697,6 +714,10 @@ function lowerExpr(e, binds) {
             return { kind: "field", obj: transformExpr(e.obj), field: e.field, datatypeField: isRecordType(e.obj.ty) };
         case "index": {
             const idx = transformExpr(e.idx);
+            if (e.obj.ty.kind === "tuple") {
+                // resolve guarantees a numeric-literal index here; project at that slot.
+                return { kind: "tupleProj", obj: transformExpr(e.obj), index: e.idx.value, arity: e.obj.ty.elems.length };
+            }
             if (e.obj.ty.kind === "map") {
                 // Mirrors the .get() → .getDirect switch at line ~453: when resolve has
                 // narrowed the index type to non-optional (via `k in m` atoms in scope),
@@ -766,8 +787,15 @@ function lowerExpr(e, binds) {
             if (e.fn.kind === "field") {
                 const recv = lowerExpr(e.fn.obj, binds);
                 let method = e.fn.field;
+                const isHOF = e.fn.obj.ty.kind === "array" && HOF_METHODS.has(method);
                 const args = e.args.map((a, i) => {
                     const lowered = lowerExpr(a, binds);
+                    // Lean: a pure fn passed to a HOF by name resolves to the monadic
+                    // method; redirect to its pure `Pure.` mirror.
+                    if (_opts.backend === "lean" && isHOF &&
+                        lowered.kind === "var" && _pureDefNames.has(lowered.name)) {
+                        return { kind: "var", name: `Pure.${lowered.name}` };
+                    }
                     // Array index args must be nat in Lean: `with`'s index (0), includes/indexOf `from` (1).
                     const isArrIdxArg = e.fn.kind === "field" && e.fn.obj.ty.kind === "array" &&
                         ((e.fn.field === "with" && i === 0) || ((e.fn.field === "includes" || e.fn.field === "indexOf") && i === 1));
@@ -918,6 +946,8 @@ function lowerExpr(e, binds) {
             // Set with initial elements: new Set([a, b]) → {a, b}
             if (e.ty.kind === "set")
                 return { kind: "app", fn: "SetLiteral", args: e.elems.map(el => lowerExpr(el, binds)) };
+            if (e.ty.kind === "tuple")
+                return { kind: "tupleLiteral", elems: e.elems.map(el => lowerExpr(el, binds)) };
             return { kind: "arrayLiteral", elems: e.elems.map(el => lowerExpr(el, binds)) };
         case "lambda": {
             // Pass the module typeDecls (not []), so type lookups inside the lambda
@@ -1397,86 +1427,73 @@ function transformStmts(stmts, typeDecls) {
         const s = stmts[i];
         // Transform for-of → for-in over range
         if (s.kind === "forof") {
-            const varName = s.names[0];
-            const varTy = s.nameTypes[0] ?? { kind: "unknown" };
-            let iterExpr = transformExpr(s.iterable);
-            // Map key-only iteration: for (const k in record) → iterate keys only
-            if (s.names.length === 1 && s.iterable.ty.kind === "map") {
-                const keyName = s.names[0];
+            const headName = s.names[0];
+            const headTy = s.nameTypes[0] ?? { kind: "unknown" };
+            const iterExpr = transformExpr(s.iterable);
+            // All for-of shapes lower to the same range loop `for idx in 0..seq.size`;
+            // they differ only in (a) which indexable `seq` is iterated and (b) the
+            // per-iteration `let`s that bind the loop names. Compute the shared loop-
+            // variable naming once, then let each shape fill in `seq` + `perIter`.
+            const count = _forofCounters.get(headName) ?? 0;
+            _forofCounters.set(headName, count + 1);
+            const suffix = count === 0 ? "" : `${count + 1}`;
+            const idxName = freshName(`_${headName}_idx${suffix}`);
+            const idxVar = { kind: "var", name: idxName };
+            let seq;
+            let perIter;
+            if (s.iterable.ty.kind === "map") {
+                // for (const k of map) / for (const [k, v] of map): materialize the keys
+                // as a seq and index into it; a value name looks up via getDirect.
                 const keyTy = s.nameTypes[0] ?? s.iterable.ty.key ?? { kind: "unknown" };
-                const count = _forofCounters.get(keyName) ?? 0;
-                _forofCounters.set(keyName, count + 1);
-                const suffix = count === 0 ? "" : `${count + 1}`;
-                const keysSeqName = freshName(`_${keyName}_keys${suffix}`);
-                const convExpr = { kind: "app", fn: "SetToSeq", args: [{ kind: "field", obj: iterExpr, field: "keys" }] };
-                result.push({ kind: "let", name: keysSeqName, type: { kind: "array", elem: keyTy }, mutable: false, value: convExpr });
-                const keysVar = { kind: "var", name: keysSeqName };
-                const idxName = freshName(`_${keyName}_idx${suffix}`);
-                const idx = { kind: "var", name: idxName };
-                const arrSize = { kind: "field", obj: keysVar, field: "size" };
-                const bodyStmts = eliminateTopLevelContinue(transformStmts(s.body, typeDecls));
-                const letKey = { kind: "let", name: keyName, type: keyTy, mutable: false, value: { kind: "index", arr: keysVar, idx } };
-                const boundInv = { kind: "binop", op: "≤", left: idx, right: arrSize };
-                result.push({
-                    kind: "forin", idx: idxName, bound: arrSize,
-                    invariants: [boundInv, ...s.invariants.map(transformExpr)],
-                    body: [letKey, ...bodyStmts],
-                });
-                i++;
-                continue;
+                const keysSeqName = freshName(`_${headName}_keys${suffix}`);
+                result.push({ kind: "let", name: keysSeqName, type: { kind: "array", elem: keyTy }, mutable: false,
+                    value: { kind: "app", fn: "SetToSeq", args: [{ kind: "field", obj: iterExpr, field: "keys" }] } });
+                seq = { kind: "var", name: keysSeqName };
+                const letKey = { kind: "let", name: headName, type: keyTy, mutable: false, value: { kind: "index", arr: seq, idx: idxVar } };
+                if (s.names.length >= 2) {
+                    const valueTy = s.nameTypes[1] ?? { kind: "unknown" };
+                    const letVal = { kind: "let", name: s.names[1], type: valueTy, mutable: false,
+                        value: { kind: "methodCall", obj: iterExpr, objTy: s.iterable.ty, method: "getDirect", args: [{ kind: "var", name: headName }], monadic: false } };
+                    perIter = [letKey, letVal];
+                }
+                else {
+                    perIter = [letKey];
+                }
             }
-            // Map iteration: for (const [k, v] of map) → iterate keys, look up values
-            if (s.names.length >= 2 && s.iterable.ty.kind === "map") {
-                const keyName = s.names[0], valueName = s.names[1];
-                const keyTy = s.nameTypes[0] ?? { kind: "unknown" };
-                const valueTy = s.nameTypes[1] ?? { kind: "unknown" };
-                const count = _forofCounters.get(keyName) ?? 0;
-                _forofCounters.set(keyName, count + 1);
-                const suffix = count === 0 ? "" : `${count + 1}`;
-                const keysSeqName = freshName(`_${keyName}_keys${suffix}`);
-                const convExpr = { kind: "app", fn: "SetToSeq", args: [{ kind: "field", obj: iterExpr, field: "keys" }] };
-                result.push({ kind: "let", name: keysSeqName, type: { kind: "array", elem: keyTy }, mutable: false, value: convExpr });
-                const keysVar = { kind: "var", name: keysSeqName };
-                const idxName = freshName(`_${keyName}_idx${suffix}`);
-                const idx = { kind: "var", name: idxName };
-                const arrSize = { kind: "field", obj: keysVar, field: "size" };
-                const bodyStmts = eliminateTopLevelContinue(transformStmts(s.body, typeDecls));
-                const letKey = { kind: "let", name: keyName, type: keyTy, mutable: false, value: { kind: "index", arr: keysVar, idx } };
-                const letVal = { kind: "let", name: valueName, type: valueTy, mutable: false,
-                    value: { kind: "methodCall", obj: iterExpr, objTy: s.iterable.ty, method: "getDirect", args: [{ kind: "var", name: keyName }], monadic: false } };
-                const boundInv = { kind: "binop", op: "≤", left: idx, right: arrSize };
-                result.push({
-                    kind: "forin", idx: idxName, bound: arrSize,
-                    invariants: [boundInv, ...s.invariants.map(transformExpr)],
-                    body: [letKey, letVal, ...bodyStmts],
-                });
-                i++;
-                continue;
+            else if (s.names.length >= 2 && s.iterable.ty.kind === "array" && s.iterable.ty.elem.kind === "tuple") {
+                // for (const [a, b] of tupleArr): bind the element once, then destructure
+                // it into each name via a tuple projection.
+                const tupleTy = s.iterable.ty.elem;
+                seq = iterExpr;
+                const elemName = freshName(`_${headName}_elem${suffix}`);
+                const letElem = { kind: "let", name: elemName, type: tupleTy, mutable: false, value: { kind: "index", arr: seq, idx: idxVar } };
+                perIter = [letElem, ...s.names.map((n, k) => ({
+                        kind: "let", name: n, type: tupleTy.elems[k] ?? { kind: "unknown" }, mutable: false,
+                        value: { kind: "tupleProj", obj: { kind: "var", name: elemName }, index: k, arity: tupleTy.elems.length },
+                    }))];
             }
-            // Sets aren't indexable — bind SetToSeq to a variable for iteration
-            if (s.iterable.ty.kind === "set") {
-                const seqName = freshName(`_${varName}_seq`);
-                const convExpr = { kind: "app", fn: "SetToSeq", args: [iterExpr] };
-                const elemTy = varTy.kind !== "unknown" ? varTy : { kind: "string" };
-                result.push({ kind: "let", name: seqName, type: { kind: "array", elem: elemTy }, mutable: false, value: convExpr });
-                iterExpr = { kind: "var", name: seqName };
+            else {
+                // Single element by index. Sets aren't indexable, so materialize first.
+                if (s.iterable.ty.kind === "set") {
+                    const seqName = freshName(`_${headName}_seq${suffix}`);
+                    const elemTy = headTy.kind !== "unknown" ? headTy : { kind: "string" };
+                    result.push({ kind: "let", name: seqName, type: { kind: "array", elem: elemTy }, mutable: false,
+                        value: { kind: "app", fn: "SetToSeq", args: [iterExpr] } });
+                    seq = { kind: "var", name: seqName };
+                }
+                else {
+                    seq = iterExpr;
+                }
+                perIter = [{ kind: "let", name: headName, type: headTy, mutable: false, value: { kind: "index", arr: seq, idx: idxVar } }];
             }
-            const count = _forofCounters.get(varName) ?? 0;
-            _forofCounters.set(varName, count + 1);
-            const suffix = count === 0 ? "" : `${count + 1}`;
-            const idxName = freshName(`_${varName}_idx${suffix}`);
-            const idx = { kind: "var", name: idxName };
-            const arrSize = { kind: "field", obj: iterExpr, field: "size" };
-            const bodyStmts = eliminateTopLevelContinue(transformStmts(s.body, typeDecls));
-            const letElem = { kind: "let", name: varName, type: varTy, mutable: false, value: { kind: "index", arr: iterExpr, idx } };
+            const arrSize = { kind: "field", obj: seq, field: "size" };
             // Auto-add bound invariant: idx ≤ bound (always true for range loops)
-            const boundInv = { kind: "binop", op: "≤", left: idx, right: arrSize };
+            const boundInv = { kind: "binop", op: "≤", left: idxVar, right: arrSize };
+            const bodyStmts = eliminateTopLevelContinue(transformStmts(s.body, typeDecls));
             result.push({
-                kind: "forin",
-                idx: idxName,
-                bound: arrSize,
+                kind: "forin", idx: idxName, bound: arrSize,
                 invariants: [boundInv, ...s.invariants.map(transformExpr)],
-                body: [letElem, ...bodyStmts],
+                body: [...perIter, ...bodyStmts],
             });
             i++;
             continue;
@@ -2186,6 +2203,7 @@ export function transformModule(mod, specImport, moduleBaseOverride) {
     _forofCounters.clear();
     _liftCounter = 0;
     _typeDecls = mod.typeDecls;
+    _pureDefNames = new Set(mod.functions.filter(f => f.isPure).map(f => f.name));
     const typeDecls = mod.typeDecls.map(transformTypeDecl);
     // Module-level constants
     const constDecls = (mod.constants ?? []).map(c => ({

package/tools/dist/typedir.js

@@ -8,3 +8,39 @@
 export function isBigInt(ty) {
     return (ty.kind === "int" || ty.kind === "nat") && !!ty.big;
 }
+/** Structural equality on Ty. Used to decide whether a tuple type is homogeneous
+ *  (all elements equal ⇒ lower to `seq`) vs heterogeneous (⇒ keep as `tuple`). */
+export function tyEqual(a, b) {
+    if (a.kind !== b.kind)
+        return false;
+    switch (a.kind) {
+        case "array": return tyEqual(a.elem, b.elem);
+        case "set": return tyEqual(a.elem, b.elem);
+        case "tuple": {
+            const bt = b;
+            return a.elems.length === bt.elems.length && a.elems.every((e, i) => tyEqual(e, bt.elems[i]));
+        }
+        case "map": {
+            const bm = b;
+            return tyEqual(a.key, bm.key) && tyEqual(a.value, bm.value);
+        }
+        case "optional": return tyEqual(a.inner, b.inner);
+        case "user": return a.name === b.name;
+        case "fn": {
+            const bf = b;
+            return a.params.length === bf.params.length
+                && a.params.every((p, i) => tyEqual(p, bf.params[i]))
+                && tyEqual(a.result, bf.result);
+        }
+        case "string": {
+            const bs = b;
+            return JSON.stringify(a.values ?? null) === JSON.stringify(bs.values ?? null);
+        }
+        case "int":
+        case "nat": return !!a.big === !!b.big;
+        case "bool":
+        case "real":
+        case "void":
+        case "unknown": return true; // no payload
+    }
+}

package/tools/dist/types.js

@@ -4,6 +4,7 @@
  * Single source of truth for type-related decisions.
  * The transform phase imports this.
  */
+import { tyEqual } from "./typedir.js";
 import { Node, Project, SyntaxKind } from "ts-morph";
 /**
  * Parses TS type strings via a real ts-morph parse — no regex cascade. Set
@@ -90,10 +91,14 @@ function tyFromTypeNode(tn) {
     if (Node.isArrayTypeNode(tn))
         return { kind: "array", elem: tyFromTypeNode(tn.getElementTypeNode()) };
     if (Node.isTupleTypeNode(tn)) {
-        const elems = tn.getElements();
+        const elems = tn.getElements().map(tyFromTypeNode);
         if (elems.length === 0)
             return { kind: "array", elem: { kind: "unknown" } };
-        return { kind: "array", elem: tyFromTypeNode(elems[0]) };
+        // Homogeneous tuple → seq; only heterogeneous tuples need the tuple
+        // representation.
+        if (elems.every(e => tyEqual(e, elems[0])))
+            return { kind: "array", elem: elems[0] };
+        return { kind: "tuple", elems };
     }
     if (Node.isFunctionTypeNode(tn)) {
         const params = tn.getParameters().map(p => {
@@ -158,6 +163,7 @@ export function tyToCanonical(ty) {
         case "void": return "void";
         case "unknown": return "unknown";
         case "array": return `seq<${tyToCanonical(ty.elem)}>`;
+        case "tuple": return `(${ty.elems.map(tyToCanonical).join(", ")})`;
         case "map": return `map<${tyToCanonical(ty.key)}, ${tyToCanonical(ty.value)}>`;
         case "set": return `set<${tyToCanonical(ty.elem)}>`;
         case "optional": return `Option<${tyToCanonical(ty.inner)}>`;