lemmascript 0.5.18 → 0.5.20

package/tools/dist/dafny-emit.js

@@ -1,14 +1,14 @@
 /**
  * Dafny emitter — IR → Dafny text.
  */
-import { usesName, usesNameInDecl } from "./ir.js";
-import { freshName, userNames } from "./names.js";
+import { exactIntegerLiteral, usesName, usesNameInDecl, usesNameInStmts } from "./ir.js";
+import { freshNameWhere, userNames } from "./names.js";
 import { renameFreeVar } from "./transform.js";
 /** Fresh binder for a comprehension wrapping the given subexpressions: `base`
  *  verbatim unless one of them references it, then primed until free. A *local*
  *  check — a same-named name elsewhere in the module keeps the plain binder. */
 function freshBinder(base, ...wrapped) {
-    return freshName(base, name => wrapped.some(w => usesName(w, name)));
+    return freshNameWhere(base, name => wrapped.some(w => usesName(w, name)));
 }
 /** Binder + body for lowering a single-return lambda to a comprehension whose
  *  receiver is emitted inside the binder's scope. TS scoping keeps the receiver
@@ -80,6 +80,24 @@ const DAFNY_KEYWORDS = new Set([
 // by methodHeader and reset per decl. `\result` in an ensures must use the
 // *same* name, so escapeName routes it here.
 let _resultName = "res";
+// User-type names appearing as the type of a havoc anywhere in the module —
+// populated per file by emitDafnyFile, read by the opaque-type case.
+const _havocedTypeNames = new Set();
+/** Collect the user-type names of every havoc in a decl tree. */
+function collectHavocedTypeNames(v, out) {
+    if (Array.isArray(v)) {
+        for (const x of v)
+            collectHavocedTypeNames(x, out);
+        return;
+    }
+    if (v === null || typeof v !== "object")
+        return;
+    const n = v;
+    if (n.kind === "havoc" && n.type?.kind === "user")
+        out.add(n.type.name);
+    for (const x of Object.values(v))
+        collectHavocedTypeNames(x, out);
+}
 // ── Dafny name allocation ──────────────────────────────────
 //
 // freshName (names.ts) freshens in the *raw TS* namespace — but that is not the
@@ -128,6 +146,13 @@ function resetDafnyNameCache() {
             _takenDafnyNames.add(emitted);
         }
 }
+/** Source-name → emitted-Dafny-name pairs from the most recent emitDafnyFile
+ *  call (identity-mapped names included). Consumed by `lsc info --typed` so
+ *  satellites (e.g. lemmascript-crosscheck) can address emitted declarations
+ *  by their mangled names (`_Box` → `i_Box'`) without re-deriving the rules. */
+export function emittedNameMap() {
+    return new Map([..._generatedDafnyNames, ..._userDafnyNames]);
+}
 function escapeName(name) {
     // \result is carried through the IR as var "\\result"; render it as the
     // current method's out-parameter name (chosen locally by methodHeader).
@@ -138,6 +163,13 @@ function escapeName(name) {
         return user;
     return escapeGeneratedName(name);
 }
+function isEmittedUserName(name) {
+    for (const emitted of _userDafnyNames.values()) {
+        if (emitted === name)
+            return true;
+    }
+    return false;
+}
 /** Allocate a toolchain-generated name (an ANF temp, a comprehension binder, a
  *  companion `_ensures` lemma). Escapes to a base, then freshens in the Dafny
  *  namespace so it can't collapse onto an escaped user name. Bypasses the user
@@ -171,7 +203,7 @@ function methodHeader(prefix, params, returnType, scope) {
     // name is recorded so `\result` references resolve to it.
     const taken = (n) => params.some(p => escapeName(p.name) === n) ||
         (scope !== undefined && usesNameInDecl(scope.requires, scope.ensures, scope.body, n));
-    const resName = freshName("res", taken);
+    const resName = freshNameWhere("res", taken);
     _resultName = resName;
     return `${sig} returns (${resName}: ${tyToDafny(returnType)})`;
 }
@@ -183,9 +215,8 @@ const OP_MAP = {
 };
 function mapOp(op) { return OP_MAP[op] ?? op; }
 // ── Expression emission ─────────────────────────────────────
-/** Emit a match scrutinee — either a variable name (string) or an expression. */
 function emitScrutinee(s) {
-    return typeof s === "string" ? escapeName(s) : emitExpr(s);
+    return emitExpr(s);
 }
 /** Collapse nested forall/exists into a single quantifier with multiple bound vars. */
 function emitQuantifier(e, keyword) {
@@ -212,6 +243,8 @@ function emitExpr(e) {
     switch (e.kind) {
         case "var": return e.name === "undefined" ? "None" : escapeName(e.name);
         case "num": return `${e.value}`;
+        // Already canonical decimal; Dafny's `int` is mathematical, so no `n` suffix.
+        case "bigint": return e.value;
         case "bool": return e.value ? "true" : "false";
         case "str": return `"${e.value.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\n/g, '\\n')}"`;
         case "constructor": {
@@ -281,8 +314,43 @@ function emitExpr(e) {
                     }
                     return `${obj}[${args[0]}..${args[1]}]`;
                 }
-                if (e.method === "map")
-                    return `Std.Collections.Seq.Map(${args[0]}, ${obj})`;
+                if (e.method === "map") {
+                    // Always a seq comprehension: Seq.Map would hide the element access
+                    // behind a closure, defeating Dafny's termination checker for
+                    // recursive rebuild walkers. A literal lambda argument is
+                    // beta-reduced through a `var` binding — an applied closure defeats
+                    // the checker too; any other argument is applied to the element
+                    // directly. A non-variable receiver is bound once up front: the
+                    // comprehension mentions it three times, and splicing would make
+                    // any closure literal inside it (e.g. a Filter predicate) three
+                    // distinct closures, unprovably equal through an opaque callee.
+                    // Name freshness is a local IR-level check until a backend name
+                    // allocator exists.
+                    const lam = e.args[0];
+                    const fresh = (base, taken) => {
+                        let name = base;
+                        for (let n = 2; taken(name); n++)
+                            name = `${base}${n}`;
+                        return name;
+                    };
+                    const taken = (n) => usesName(e.obj, n) || usesName(lam, n) ||
+                        (lam.kind === "lambda" && (lam.params.some(pp => pp.name === n) ||
+                            usesNameInStmts(lam.body, n)));
+                    const bind = e.obj.kind !== "var";
+                    const s = bind ? fresh("s_map", taken) : obj;
+                    const idx = fresh("i_map", n => taken(n) || n === s);
+                    let core;
+                    if (lam.kind === "lambda" && lam.params.length === 1 &&
+                        lam.body.length === 1 && lam.body[0].kind === "return") {
+                        const p = escapeName(lam.params[0].name);
+                        core = `var ${p} := ${s}[${idx}]; ${emitExpr(lam.body[0].value)}`;
+                    }
+                    else {
+                        core = `(${args[0]})(${s}[${idx}])`;
+                    }
+                    const comp = `seq(|${s}|, ${idx} requires 0 <= ${idx} < |${s}| => ${core})`;
+                    return bind ? `(var ${s} := ${obj}; ${comp})` : comp;
+                }
                 if (e.method === "filter")
                     return `Std.Collections.Seq.Filter(${args[0]}, ${obj})`;
                 // filterMap (synthesized in resolve): drop Nones and unwrap to seq<T>.
@@ -293,6 +361,11 @@ function emitExpr(e) {
                 }
                 if (e.method === "every")
                     return `Std.Collections.Seq.All(${obj}, ${args[0]})`;
+                if (e.method === "find") {
+                    needPreamble("OptionType");
+                    needPreamble("SeqFind");
+                    return `SeqFind(${obj}, ${args[0]})`;
+                }
                 if (e.method === "findLast") {
                     needPreamble("OptionType");
                     needPreamble("SeqFindLast");
@@ -348,10 +421,14 @@ function emitExpr(e) {
                     return `StringSplit(${obj}, ${args[0]})`;
                 }
                 if (e.method === "slice") {
-                    // JS negative index: arr.slice(0, -N) → arr[0..|arr|-N]. After
-                    // transform, unary minus on a numeric literal is folded to a
-                    // negative `num` IR node, so check for that here.
-                    const negVal = (a) => a.kind === "num" && a.value < 0 ? -a.value : null;
+                    // JS negative index: arr.slice(0, -N) → arr[0..|arr|-N]. Transform
+                    // folds unary minus on a numeric literal into a negative `num` node,
+                    // but leaves a negated bigint structural — `exactIntegerLiteral`
+                    // recognizes both.
+                    const negVal = (a) => {
+                        const v = exactIntegerLiteral(a);
+                        return v !== null && v < 0n ? (-v).toString(10) : null;
+                    };
                     const loN = negVal(e.args[0]);
                     const loEx = loN !== null ? `|${obj}|-${loN}` : args[0];
                     if (args.length === 1)
@@ -395,6 +472,10 @@ function emitExpr(e) {
                     return `(|${obj}| >= |${args[0]}| && ${obj}[..|${args[0]}|] == ${args[0]})`;
                 if (e.method === "charCodeAt")
                     return `(${obj}[${args[0]}] as int)`;
+                if (e.method === "repeat") {
+                    needPreamble("StringRepeat");
+                    return `StringRepeat(${obj}, ${args[0]})`;
+                }
             }
             // Map methods
             if (ty === "map") {
@@ -453,6 +534,8 @@ function emitExpr(e) {
                 return `!(${emitExpr(e.expr)})`;
             if (e.op === "-" && e.expr.kind === "num")
                 return `(-(${e.expr.value}))`;
+            if (e.op === "-" && e.expr.kind === "bigint")
+                return `(-(${e.expr.value}))`;
             if (e.op === "-")
                 return `(-(${emitExpr(e.expr)}))`;
             return `${op}(${emitExpr(e.expr)})`;
@@ -461,34 +544,30 @@ function emitExpr(e) {
             // Discriminant check: x == .Ctor → x.Ctor?
             const op = mapOp(e.op);
             if ((op === "==" || op === "!=") && e.right.kind === "constructor") {
-                const ctorName = escapeName(e.right.name.replace(/^\./, ""));
+                const ctorName = dafnyCtorName(e.right.name.replace(/^\./, ""));
                 const pred = `${emitExpr(e.left)}.${ctorName}?`;
                 return op === "!=" ? `(!${pred})` : pred;
             }
             // Bitwise operators on int: translate to arithmetic
             // x >> n → x / 2^n (right shift)
             // x << n → x * 2^n (left shift)
-            if (e.op === ">>") {
-                if (e.right.kind === "num") {
-                    return `(${emitExpr(e.left)} / ${Math.pow(2, e.right.value)})`;
-                }
-                needPreamble("Pow2");
-                return `(${emitExpr(e.left)} / Pow2(${emitExpr(e.right)}))`;
-            }
-            if (e.op === "<<") {
-                if (e.right.kind === "num") {
-                    return `(${emitExpr(e.left)} * ${Math.pow(2, e.right.value)})`;
+            if (e.op === ">>" || e.op === "<<") {
+                const shift = exactIntegerLiteral(e.right);
+                // Cap the fold: a huge literal shift would inline an absurd numeral.
+                if (shift !== null && shift >= 0n && shift <= 1024n) {
+                    const factor = (1n << shift).toString(10);
+                    return `(${emitExpr(e.left)} ${e.op === ">>" ? "/" : "*"} ${factor})`;
                 }
                 needPreamble("Pow2");
-                return `(${emitExpr(e.left)} * Pow2(${emitExpr(e.right)}))`;
+                return `(${emitExpr(e.left)} ${e.op === ">>" ? "/" : "*"} Pow2(${emitExpr(e.right)}))`;
             }
             // x & mask → x % (mask + 1) for literal masks of form 2^n - 1, else BitAnd
             if (e.op === "&") {
-                if (e.right.kind === "num") {
-                    const mask = e.right.value;
-                    const modulus = mask + 1;
-                    if ((modulus & (modulus - 1)) === 0) {
-                        return `(${emitExpr(e.left)} % ${modulus})`;
+                const mask = exactIntegerLiteral(e.right);
+                if (mask !== null && mask >= 0n) {
+                    const modulus = mask + 1n;
+                    if ((modulus & (modulus - 1n)) === 0n) {
+                        return `(${emitExpr(e.left)} % ${modulus.toString(10)})`;
                     }
                 }
                 needPreamble("BitAnd");
@@ -532,6 +611,8 @@ function emitExpr(e) {
                 needPreamble("CeilReal");
             if (e.fn === "FloorReal")
                 needPreamble("FloorReal");
+            if (e.fn === "StringFromCharCode")
+                needPreamble("StringFromCharCode");
             if (e.fn === "NatToString")
                 needPreamble("NatToString");
             if (e.fn === "IntToString") {
@@ -556,6 +637,20 @@ function emitExpr(e) {
                 needPreamble("Perm");
             if (e.fn === "SetFromSeq")
                 needPreamble("SetFromSeq");
+            // A constructor application must spell the name the same way the
+            // datatype declaration does — `dafnyCtorName`, not `escapeName`, since
+            // tags come from source strings ("spec-pure") that escapeName leaves alone.
+            if (e.ctorOf) {
+                const ctor = dafnyCtorName(e.fn);
+                // A source local may have the same name as a discriminated-union
+                // variant (`const error = ...; return { kind: "error", error }`).
+                // The bare `error(error)` is then parsed as a call through the local.
+                // Qualify whenever the emitted constructor spelling is already claimed
+                // in the user namespace, as well as when two datatypes share it.
+                return _ambiguousCtors.has(e.fn) || isEmittedUserName(ctor)
+                    ? `${e.ctorOf}.${ctor}(${args.join(", ")})`
+                    : `${ctor}(${args.join(", ")})`;
+            }
             return `${escapeName(e.fn)}(${args.join(", ")})`;
         }
         case "field": {
@@ -568,6 +663,11 @@ function emitExpr(e) {
                 return `${obj}.Keys`;
             if (e.field === "toNat")
                 return obj;
+            if (e.ctor && e.fromUnion) {
+                const renamed = _ctorFieldRenames.get(`${e.fromUnion}.${e.ctor}.${e.field}`);
+                if (renamed)
+                    return `${obj}.${escapeName(renamed)}`;
+            }
             return `${obj}.${escapeName(e.field)}`;
         }
         case "toNat":
@@ -588,7 +688,10 @@ function emitExpr(e) {
                 if (e.fields.length === 0) {
                     return emitExpr(e.spread);
                 }
-                const updates = e.fields.map(f => `${escapeName(f.name)} := ${emitExpr(f.value)}`);
+                const updates = e.fields.map(f => {
+                    const renamed = e.ctor && e.ctorOf ? _ctorFieldRenames.get(`${e.ctorOf}.${e.ctor}.${f.name}`) : undefined;
+                    return `${escapeName(renamed ?? f.name)} := ${emitExpr(f.value)}`;
+                });
                 return `${emitExpr(e.spread)}.(${updates.join(", ")})`;
             }
             // Match constructor by field names — prefer exact match over first-field heuristic
@@ -792,9 +895,9 @@ function emitDecl(d) {
             const collides = new Set([...typesByField].filter(([, s]) => s.size > 1).map(([n]) => n));
             const ctors = d.constructors.map(c => {
                 if (c.fields.length === 0)
-                    return escapeName(c.name);
-                const fields = c.fields.map(f => collides.has(f.name) ? { ...f, name: `${f.name}_${c.name}` } : f);
-                return `${escapeName(c.name)}(${paramList(fields)})`;
+                    return dafnyCtorName(c.name);
+                const fields = c.fields.map(f => collides.has(f.name) ? { ...f, name: `${f.name}_${c.name.replace(/[^A-Za-z0-9_'?]/g, "_")}` } : f);
+                return `${dafnyCtorName(c.name)}(${paramList(fields)})`;
             });
             return `datatype ${escapeName(d.name)}${tp} = ${ctors.join(" | ")}`;
         }
@@ -808,7 +911,10 @@ function emitDecl(d) {
         case "opaque-type": {
             // Abstract type — no definition. `(==)` so it can sit inside datatypes
             // that derive structural equality. Never constructed or destructured.
-            return `type ${escapeName(d.name)}(==)`;
+            // `0` (auto-init) only when a havoc of this type needs a witness to
+            // satisfy definite assignment — `var x: T := *` requires it.
+            const autoInit = _havocedTypeNames.has(d.name) ? ", 0" : "";
+            return `type ${escapeName(d.name)}(==${autoInit})`;
         }
         case "def": {
             const tp = d.typeParams.length > 0 ? `<${d.typeParams.join(", ")}>` : "";
@@ -1036,6 +1142,19 @@ const SEQ_FIND_LAST_INDEX = `function SeqFindLastIndex<T>(s: seq<T>, p: T -> boo
   else if p(s[|s|-1]) then |s| - 1
   else SeqFindLastIndex(s[..|s|-1], p)
 }`;
+const SEQ_FIND = `function SeqFind<T>(s: seq<T>, p: T -> bool): Option<T>
+  ensures SeqFind(s, p).Some? ==> p(SeqFind(s, p).value)
+  ensures SeqFind(s, p).Some? ==> SeqFind(s, p).value in s
+  ensures SeqFind(s, p).Some? ==>
+    exists i: nat :: i < |s| && s[i] == SeqFind(s, p).value && p(s[i]) &&
+                     (forall j: nat :: j < i ==> !p(s[j]))
+  ensures SeqFind(s, p).None? ==> forall i :: 0 <= i < |s| ==> !p(s[i])
+  decreases |s|
+{
+  if |s| == 0 then None
+  else if p(s[0]) then Some(s[0])
+  else SeqFind(s[1..], p)
+}`;
 const SEQ_FIND_LAST = `function SeqFindLast<T>(s: seq<T>, p: T -> bool): Option<T>
   ensures SeqFindLast(s, p).Some? ==> p(SeqFindLast(s, p).value)
   ensures SeqFindLast(s, p).Some? ==> SeqFindLast(s, p).value in s
@@ -1189,6 +1308,27 @@ const STRING_TO_UPPER = `function StringToUpper(s: string): string
     var upper := if 'a' <= c <= 'z' then (c - 'a' + 'A') as char else c;
     [upper] + StringToUpper(s[1..])
 }`;
+// `String.fromCharCode(n)` — the inverse of `s.charCodeAt(i)`'s `(s[i] as int)`.
+// Dafny's `char` is a Unicode scalar value, so the argument must miss the
+// surrogate range; that is the `requires`, discharged at each call site. The two
+// `ensures` give callers the round-trip law without unfolding the body.
+const STRING_FROM_CHAR_CODE = `function StringFromCharCode(n: int): string
+  requires 0 <= n < 0xD800 || 0xE000 <= n < 0x110000
+  ensures |StringFromCharCode(n)| == 1
+  ensures (StringFromCharCode(n)[0] as int) == n
+{
+  [n as char]
+}`;
+// `s.repeat(n)` — n copies of s, concatenated. The per-index ensures is stated
+// for the single-character receiver (the common case: padding with one digit).
+const STRING_REPEAT = `function StringRepeat(s: string, n: int): string
+  requires n >= 0
+  ensures |StringRepeat(s, n)| == |s| * n
+  ensures |s| == 1 ==> forall i :: 0 <= i < n ==> StringRepeat(s, n)[i] == s[0]
+  decreases n
+{
+  if n == 0 then "" else s + StringRepeat(s, n - 1)
+}`;
 const MATH_MIN = `function MathMin(a: int, b: int): int { if a <= b then a else b }`;
 const MATH_MAX = `function MathMax(a: int, b: int): int { if a >= b then a else b }`;
 const MAX_OF_SEQ = `function MaxOfSeq(s: seq<int>): int
@@ -1294,6 +1434,7 @@ const PREAMBLE_CODE = [
     ["SeqFindIndex", SEQ_FIND_INDEX],
     ["SeqFindLastIndex", SEQ_FIND_LAST_INDEX],
     ["SeqFilterSome", SEQ_FILTER_SOME],
+    ["SeqFind", SEQ_FIND],
     ["SeqFindLast", SEQ_FIND_LAST],
     ["SeqFlatten", SEQ_FLATTEN],
     ["SeqJoin", SEQ_JOIN],
@@ -1305,6 +1446,8 @@ const PREAMBLE_CODE = [
     ["StringTrim", STRING_TRIM],
     ["StringToLower", STRING_TO_LOWER],
     ["StringToUpper", STRING_TO_UPPER],
+    ["StringFromCharCode", STRING_FROM_CHAR_CODE],
+    ["StringRepeat", STRING_REPEAT],
     ["NatToString", NAT_TO_STRING],
     ["IntToString", INT_TO_STRING],
     ["MathAbs", MATH_ABS],
@@ -1319,10 +1462,18 @@ const PREAMBLE_CODE = [
 let _recordCtors = new Map();
 let _structureDecls = new Map();
 let _declaredTypes = new Set();
+let _ambiguousCtors = new Set();
+// `"<union>.<ctor>.<field>"` → per-constructor destructor name, for fields the
+// inductive emission renames (shared name, differing types). Field reads and
+// datatype updates with a pinned ctor must use the renamed destructor.
+let _ctorFieldRenames = new Map();
 function buildRecordCtorMap(decls) {
     _recordCtors = new Map();
     _structureDecls = new Map();
     _declaredTypes = new Set();
+    _ambiguousCtors = new Set();
+    _ctorFieldRenames = new Map();
+    const ctorSeen = new Set();
     function collectDecl(d) {
         if (d.kind === "structure") {
             _declaredTypes.add(d.name);
@@ -1330,8 +1481,36 @@ function buildRecordCtorMap(decls) {
             if (d.fields.length > 0)
                 _recordCtors.set(d.fields[0].name, d.name);
         }
-        if (d.kind === "inductive")
+        if (d.kind === "inductive") {
             _declaredTypes.add(d.name);
+            // Constructor names shared by two datatypes in this module (Expr.let vs
+            // Stmt.let) can't be used bare — emitters must qualify them.
+            for (const c of d.constructors) {
+                if (ctorSeen.has(c.name))
+                    _ambiguousCtors.add(c.name);
+                ctorSeen.add(c.name);
+            }
+            // Mirror the destructor renaming the inductive case of emitDecl performs
+            // (shared field name, differing types → per-constructor names), so reads
+            // and updates can be translated to the renamed destructors.
+            const typesByField = new Map();
+            for (const c of d.constructors)
+                for (const f of c.fields) {
+                    let s = typesByField.get(f.name);
+                    if (!s) {
+                        s = new Set();
+                        typesByField.set(f.name, s);
+                    }
+                    s.add(tyToDafny(f.type));
+                }
+            const collides = new Set([...typesByField].filter(([, s]) => s.size > 1).map(([n]) => n));
+            for (const c of d.constructors)
+                for (const f of c.fields) {
+                    if (!collides.has(f.name))
+                        continue;
+                    _ctorFieldRenames.set(`${d.name}.${c.name}.${f.name}`, `${f.name}_${c.name.replace(/[^A-Za-z0-9_'?]/g, "_")}`);
+                }
+        }
         if (d.kind === "type-alias")
             _declaredTypes.add(d.name);
         if (d.kind === "def")
@@ -1359,9 +1538,19 @@ function resolveTy(ty) {
         return { kind: "set", elem: resolveTy(ty.elem) };
     return ty;
 }
+/** Constructor names come from source strings (string-union values like
+ *  "spec-pure", discriminated-union tags), which may contain characters no
+ *  TS identifier has; map those to `_` before the ordinary escaping. A
+ *  collision after mapping fails loudly in Dafny (duplicate constructor)
+ *  rather than silently merging. */
+function dafnyCtorName(name) {
+    return escapeName(name.replace(/[^A-Za-z0-9_'?]/g, "_"));
+}
 function qualifyCtor(name, type) {
     const rawName = name.replace(/^\./, "");
-    const mapped = CTOR_MAP[rawName] ?? escapeName(rawName);
+    // hasOwn: a ctor literally named "constructor" (the IR's own Expr variant)
+    // must not hit Object.prototype.constructor through the bare index.
+    const mapped = (Object.hasOwn(CTOR_MAP, rawName) ? CTOR_MAP[rawName] : undefined) ?? dafnyCtorName(rawName);
     if (type)
         return `${type}.${mapped}`;
     return mapped;
@@ -1375,7 +1564,7 @@ const CTOR_MAP = { "some": "Some", "none": "None" };
 function translatePattern(p) {
     if (p.kind === "wild")
         return "_";
-    const ctorName = CTOR_MAP[p.ctor] ?? escapeName(p.ctor);
+    const ctorName = (Object.hasOwn(CTOR_MAP, p.ctor) ? CTOR_MAP[p.ctor] : undefined) ?? dafnyCtorName(p.ctor);
     if (p.binders.length === 0)
         return ctorName;
     return `${ctorName}(${p.binders.map(escapeName).join(", ")})`;
@@ -1385,6 +1574,8 @@ export function emitDafnyFile(file, tsFileName, opts) {
     resetDafnyNameCache();
     buildRecordCtorMap(file.decls);
     _neededPreambles.clear();
+    _havocedTypeNames.clear();
+    collectHavocedTypeNames(file.decls, _havocedTypeNames);
     // Track successfully emitted pure defs — method wrappers are only
     // skipped when the corresponding pure def was actually emitted.
     const emittedPureDefs = new Set();