lemmascript 0.5.4 → 0.5.6

package/README.md

@@ -24,7 +24,7 @@ See the external case studies:
 - **[talktimer-lemmascript](https://github.com/midspiral/talktimer-lemmascript/)** — verified talk timer React app, ported from a Dafny-only [`talktimer-lemmafit`](https://github.com/midspiral/talktimer-lemmafit/) twin. 17-variant `Action` state machine + verified `History` (undo/redo/preview/commitFrom) all in one `domain.ts` — the original Dafny's `Domain refines Kernel` abstract-module pattern inlined since LS has no abstract modules. 108 VCs in `domain.dfy` (invariant preservation) + 123 in `domain.proofs.dfy` (behavioral lemmas + Kernel round-trip). Dafny only.
 - **[node-casbin-lemmascript](https://github.com/midspiral/node-casbin-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield verification of [node-casbin](https://github.com/casbin/node-casbin). 5 functions verified, 217 existing tests pass. End-to-end correctness and order independence for all 4 effect modes in both Lean and Dafny (39 lemmas).
 - **[hono-lemmascript](https://github.com/midspiral/hono-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield verification of [hono](https://github.com/honojs/hono)'s security middleware. Four CVEs covered: IP restriction bypass ([CVE-2026-39409](https://github.com/honojs/hono/security/advisories/GHSA-3mpf-rcc7-5347)) and cookie name bypass ([CVE-2026-39410](https://github.com/honojs/hono/security/advisories/GHSA-r5rp-j6wh-rvv4)) — 51 Dafny lemmas, [cookie verification **in-place**](https://github.com/midspiral/hono-lemmascript/blob/lemmascript/src/utils/cookie.ts#L79); plus `serveStatic`'s URL-encoded directory traversal ([CVE-2024-32869](https://github.com/honojs/hono/security/advisories/GHSA-q5w7-8mq6-2hxq)) + repeated-slash bypass ([CVE-2026-39407](https://github.com/honojs/hono/security/advisories/GHSA-jw53-c2g8-vmwm)), proved as a *composition* — `decode(rawPath)` before `check(decoded)`, so a buggy implementation that reordered the steps would fail the proof. First use of `//@ assume` + `//@ havoc`-on-assign. Dafny only.
-- **[hono-rate-limiter-with-lemmascript](https://github.com/midspiral/hono-rate-limiter-with-lemmascript)** — a greenfield verified feature shipped through a brownfield host's *middleware seam*: a standalone [Hono](https://hono.dev) rate-limit middleware whose admission decision is a machine-checked theorem. Every fixed-window "N per minute" limiter leaks the same way — a client fires `limit` requests just before a boundary and `limit` more just after, a 2× burst the docs swear can't happen. The verified core proves the crisp guarantee people actually want: over an integer-millisecond admission log, `admit` keeps `|log| ≤ limit` and window-faithful, and folding it over **any** monotone request stream (`run`) keeps the cumulative log `Spread` — so **no half-open window `(s, s+W]` ever admits more than `limit`** (`SlidingWindowBound`); the boundary burst is not mitigated but *impossible*. The naive cousin is refuted in the same file: `FixedWindowLeaks` exhibits a concrete trace where a fixed-window counter admits `2 × limit` in one sliding window while the verified `admit` rejects the overflow. An invariant-over-a-stateful-core proof (not a one-shot algorithm), wired into a live Hono server that gates real HTTP. 23 Dafny VCs, 0 errors; the clock's monotonicity and the per-key store's atomicity are the named trust boundary. Dafny only.
+- **[hono-rate-limiter-with-lemmascript](https://github.com/midspiral/hono-rate-limiter-with-lemmascript)** — a greenfield verified feature shipped through a brownfield host's *middleware seam*: a standalone [Hono](https://hono.dev) sliding-window rate-limit middleware whose admission decision is a machine-checked theorem. `SlidingWindowBound` proves no half-open window `(s, s+W]` ever admits more than `limit`, so the boundary-straddling 2× burst that every fixed-window limiter leaks is *impossible* (the naive cousin is refuted in the same file, `FixedWindowLeaks`); the proof is wired into a live Hono server, with the clock's monotonicity and the per-key store's atomicity as the named trust boundary. 23 Dafny VCs, 0 errors. Dafny only.
 - **[charmchat](https://github.com/CHARM-BDF/charmchat/blob/lemma/README_LemmaScript.md)** — brownfield verification of an AI agent orchestration backend. `isEmptyResult` (string emptiness predicate, 8 postconditions, <1s) and `topologicalSort` (Kahn's algorithm — memory safety, output bounds, completeness via acyclicity ranking witness, termination). Full completeness proof: 23 helper lemmas, 14 opaque ghost predicates, 115 loop invariants; 736 VCs verified under `--isolate-assertions --verification-time-limit 600`. Key technique: snapshot-based inner invariants (`ghost var originalRemDeps := remDeps`) replace the mid-iteration SEEN/UNSEEN split so preservation is frame reasoning against a ghost-constant rather than set-subtraction against mutating state. Dafny only.
 - **[xyflow-lemmascript](https://github.com/midspiral/xyflow-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield verification of [xyflow](https://github.com/xyflow/xyflow)'s core edge and geometry utilities. 9 functions verified: `addEdge` (dedup — never loses edges, adds at most one), `reconnectEdge` (semantic: under a unique-id precondition, the result is in-place — `|result| ≤ |edges|`, no insertion — *and* when a matching edge existed with non-empty new endpoints, the output contains an edge with those endpoints. Uses `//@ assume` to characterize destructuring, `find`, and the constructed edge), `connectionExists`, `getEdgeCenter` (midpoint correctness), `clamp` (bounds), `rectToBox`/`boxToRect` (field arithmetic), `getBoundsOfBoxes` (enclosure), `getOverlappingArea` (non-negative), `areSetsEqual` (subset + same size). 14 Dafny proof obligations. Also adds a new verified feature — a **DAG connection gate**: `canReach` decides reachability soundly *and* completely, and `wouldCreateCycle` gates both new connections and edge reconnections so the graph is proven to stay acyclic, with `isAcyclic` (sound + complete) establishing the base case and a topological-rank witness giving a safe evaluation order (+29 obligations), shown live in a React Flow demo that refuses cycle-closing edges — extending the case study from verifying existing code to adding a verified feature. Dafny only.
 - **[rallly-lemmascript](https://github.com/midspiral/rallly-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield verification of [rallly](https://github.com/lukevella/rallly)'s meeting-poll Next.js app. 2 functions: `validateRedirectUrl` (in-place — open-redirect predicate; non-`undefined` outputs start with `/` but not `//`) and `scorePoll` (extracted ranking core — length preservation, score bounds, top-choice characterization, score-formula equality, within-poll monotonicity, tiebreaker injectivity). The injectivity proof surfaced a real spec-level constraint on the existing `(yes + ifNeedBe) * 1000 + yes` encoding: it overflows when an option has ≥ 1000 yes votes. 10 Dafny VCs, 0 errors. Drove four toolchain additions: `s.startsWith()`, `T | null` nullability, `\result` narrowing under `==>`, `Math.max(...arr)` spread. Dafny only.
@@ -36,6 +36,7 @@ See the external case studies:
 - **[quota-lemmascript](https://github.com/midspiral/quota-lemmascript)** — greenfield verified booking app: providers publish a page of limited-capacity *featured slots*, signed-in users grab them (React + Cloudflare Durable Objects + D1). A deliberate **inverse** of [quorum-lemmascript](https://github.com/midspiral/quorum-lemmascript): where Quorum counts *up to* a threshold over data partitioned **per participant** (no conflicts ⇒ optimistic, lock-free, no rollback), Quota's bookings **contend** for shared inventory, so the load-bearing fact flips from a count to a **bound** — for every slot `j`, `confirmedCount(bookings, j) <= slots[j].capacity` — and so does the concurrency story: the *same* `domain.ts` runs in the browser and the Durable Object, but **server-authoritatively** (it never oversells under contention; no optimistic client apply). Proven: no overbooking (invariant preservation across `tryBook` / cancel), accept-iff-room, an **idempotent three-way `tryBook`** (a retry reads as success, not rejection — only "confirmed" mutates), cancellation frees seats, replay determinism, and full order-invariance of availability under contention — `confirmedCountPerm` / `hasRoomPermInvariant` show availability depends only on the *multiset* of the booking log (any reordering, not just a pairwise swap), via the same `perm(...)` predicate Quorum drove into LemmaScript. NDJSON export is built on the verified `confirmedOnly`. The counting kernel is Quorum's `countFree` re-pointed at bookings — total and precondition-free so it composes. 80 Dafny VCs, 0 errors. Trust boundary (stated plainly): auth, the React UI, WebSocket/DO/D1 I/O, email, slot date/time labeling, and abuse/rate-limiting. Dafny only.
 - **[henri-lemmascript](https://github.com/midspiral/henri-lemmascript)** — a runnable TypeScript coding-agent CLI (a port of [henri](https://github.com/metareflection/henri/); multi-provider, Anthropic + AWS Bedrock) whose security- and protocol-critical core is verified and **imported directly by the live agent** — `decide()` gates every real tool call and the conversation invariant is asserted on every turn (it streams end-to-end against Bedrock). Three modules, 48 Dafny VCs, 0 errors. (1) **Permission gate**: soundness (`decide == Allow ⟺ isAllowed`), **path-traversal containment** — auto-allow-in-cwd can never resolve outside cwd, with `.`/`..` normalization proved in-core so the shell is trusted only to `resolve().split('/')` — grant monotonicity, and `rejectPrompts` is deny-only. (2) **Conversation protocol**: tool-call/result pairing plus the [pi-lemmascript](https://github.com/midspiral/pi-lemmascript)-style **no-orphaned-`tool_result`** property, proved as an invariant *preserved by the loop* — `wellFormed(msgs + [assistant(calls), tool(makeResults(calls))])` — not checked after the fact. (3) **Hook/config merge**: removal, **tool-name uniqueness — a fix** (henri concatenated hook tool lists with no dedup, so two hooks could shadow a name), order-independence, and additivity composed **cross-module** with the gate's monotonicity (merging only grows the allow-sets, which by P3 never revokes an `Allow`). The merge is verified **in place** via `//@ declare-type Tool { name: string }`, shadowing the real `Tool`'s function-valued `execute` so the actual `mergeTools(Tool[])` is the proof target rather than a parallel model. Dafny only.
 - **[eslint-plugin-with-lemmascript](https://github.com/midspiral/eslint-plugin-with-lemmascript)** — a greenfield verified feature shipped through a brownfield host's *extension API*: a real, npm-published [ESLint](https://eslint.org) flat-config plugin whose rule decision is a machine-checked theorem. `no-forbidden-reach` enforces architecture boundaries — "the UI must never reach the DB layer" — through **any** import chain, catching the *laundered* `ui → service → db` violation that every one-hop incumbent (`import/no-restricted-paths`, `eslint-plugin-boundaries`, Nx module boundaries) silently passes. The verified core decides reachability soundly *and* completely (`reachesAny` / `violates`) and **constructs** the offending chain in proven code (`findReachPath` — a path-carrying BFS proven sound + complete by mirroring the frontier's endpoints in a ghost seq, so completeness reduces to the same closure argument as the reachability search; the chain printed in the lint error is therefore itself a *verified* import path, not a heuristic guess). The headline is a meta-theorem — `Domination` + `Strictness` — proving the transitive check **strictly dominates** one-hop checking: every direct violation is caught, *and* there provably exist laundered violations that direct-edge checks miss. 30 Dafny VCs, 0 errors. The reachability decision and the witness are proven; the import-graph extraction (which edges exist) is the stated trust boundary, and `dist/*.js` is `tsc`'s erasure of the verified source it ships alongside. Dafny only.
+- **[infisical-lemmascript](https://github.com/midspiral/infisical-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield, **in-place** verification of the permission-boundary glob set-containment check in [Infisical](https://github.com/Infisical/infisical) — the privilege-escalation guard that stops a role from delegating broader secret-path access than it holds. The loop-bearing `segmentMatch` compiles to a Dafny `method` (unnameable in specs), so soundness is proven by **refinement**: the method certifies `result == segMatchSpec` (a pure mirror), and a standalone lemma proves that spec sound against a hand-written segment-glob semantics — *if it returns true, every path the subset glob matches, the parent matches too*. 12 Dafny VCs, 0 errors; drove a toolchain fix (recursive `method`s now carry a method-level `//@ decreases`). Dafny only.
 
 ## Setup
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lemmascript",
-  "version": "0.5.4",
+  "version": "0.5.6",
   "description": "A verification toolchain for TypeScript — generates Lean 4 or Dafny from annotated TS",
   "type": "module",
   "engines": {

package/tools/dist/dafny-commands.js

@@ -28,7 +28,9 @@ export function dafnyCheckDiff(genPath, dfyPath) {
             diff = typeof e.stdout === "string" ? e.stdout : e.stdout.toString("utf-8");
         }
         else {
-            return true;
+            // git couldn't be spawned: the check never ran, so fail loud, don't green-pass.
+            console.error(`ERROR: could not run \`git diff\` to verify ${path.basename(dfyPath)} is additions-only (is git installed?)`);
+            return false;
         }
     }
     const deletions = diff.split("\n").filter(l => l.startsWith("-") && !l.startsWith("---"));

package/tools/dist/dafny-emit.js

@@ -86,7 +86,7 @@ function methodHeader(prefix, params, returnType) {
 // ── Lean op → Dafny op ─────────────────────────────────────
 const OP_MAP = {
     "=": "==", "≠": "!=", "≥": ">=", "≤": "<=",
-    "∧": "&&", "∨": "||", "¬": "!",
+    "∧": "&&", "∨": "||", "¬": "!", "↔": "<==>",
     "arrayConcat": "+",
 };
 function mapOp(op) { return OP_MAP[op] ?? op; }
@@ -152,15 +152,15 @@ function emitExpr(e) {
                 if (e.method === "with")
                     return `${obj}[${args[0]} := ${args[1]}]`;
                 if (e.method === "includes")
-                    return `(${args[0]} in ${obj})`;
+                    return args.length > 1 ? `(${args[0]} in ${obj}[${args[1]}..])` : `(${args[0]} in ${obj})`;
                 if (e.method === "indexOf") {
                     needPreamble("SeqIndexOf");
-                    return `SeqIndexOf(${obj}, ${args[0]})`;
+                    return args.length > 1 ? `SeqIndexOfFrom(${obj}, ${args[0]}, ${args[1]})` : `SeqIndexOf(${obj}, ${args[0]})`;
                 }
                 if (e.method === "push")
-                    return `(${obj} + [${args[0]}])`;
+                    return `(${obj} + [${args.join(", ")}])`;
                 if (e.method === "concat")
-                    return `(${obj} + [${args[0]}])`;
+                    return `(${obj} + [${args.join(", ")}])`;
                 // No-arg slice is a full copy; Dafny seq is an immutable value type, so
                 // the copy is just the seq itself (the idiom for "copy then mutate").
                 if (e.method === "slice" && args.length === 0)
@@ -399,12 +399,22 @@ function emitExpr(e) {
                 return `{${args.join(", ")}}`;
             if (e.fn === "JSFloorDiv")
                 needPreamble("JSFloorDiv");
+            if (e.fn === "JSRem")
+                needPreamble("JSRem");
+            if (e.fn === "JSTruncDiv")
+                needPreamble("JSTruncDiv");
+            if (e.fn === "JSStringLt")
+                needPreamble("JSStringLt");
             if (e.fn === "CeilReal")
                 needPreamble("CeilReal");
             if (e.fn === "FloorReal")
                 needPreamble("FloorReal");
             if (e.fn === "NatToString")
                 needPreamble("NatToString");
+            if (e.fn === "IntToString") {
+                needPreamble("NatToString");
+                needPreamble("IntToString");
+            }
             if (e.fn === "MathAbs")
                 needPreamble("MathAbs");
             if (e.fn === "MathMin")
@@ -421,6 +431,8 @@ function emitExpr(e) {
             }
             if (e.fn === "Perm")
                 needPreamble("Perm");
+            if (e.fn === "SetFromSeq")
+                needPreamble("SetFromSeq");
             return `${escapeName(e.fn)}(${args.join(", ")})`;
         }
         case "field": {
@@ -458,12 +470,19 @@ function emitExpr(e) {
             let ctorName;
             if (e.fields.length > 0) {
                 const fieldNames = new Set(e.fields.map(f => f.name));
+                const matches = [];
                 for (const [name, fields] of _structureDecls) {
                     if (fields.length >= e.fields.length && fields.every(f => fieldNames.has(f.name) || f.type.kind === "optional")) {
-                        ctorName = name;
-                        break;
+                        matches.push(name);
                     }
                 }
+                // When several datatypes share this field-name set (e.g. Event vs
+                // SparseEvent), disambiguate by the resolved record type carried from
+                // transform; otherwise take the sole structural match.
+                if (e.ctor && matches.includes(e.ctor))
+                    ctorName = e.ctor;
+                else if (matches.length > 0)
+                    ctorName = matches[0];
                 if (!ctorName)
                     ctorName = _recordCtors.get(e.fields[0].name);
             }
@@ -708,6 +727,8 @@ function emitDecl(d) {
                 lines.push(`  requires ${emitExpr(r)}`);
             for (const e of d.ensures)
                 lines.push(`  ensures ${emitExpr(e)}`);
+            if (d.decreases)
+                lines.push(`  decreases ${emitExpr(d.decreases)}`);
             lines.push(`{`);
             lines.push(emitStmts(d.body, 1));
             lines.push(`}`);
@@ -795,6 +816,26 @@ const JS_FLOOR_DIV = `function JSFloorDiv(a: int, b: int): int
     if a <= 0 then (-a) / (-b)
     else -((a - 1) / (-b)) - 1
 }`;
+const JS_REM = `function JSRem(a: int, b: int): int
+  requires b != 0
+{
+  var r := (if a < 0 then -a else a) % (if b < 0 then -b else b);
+  if a < 0 then -r else r
+}`;
+const JS_TRUNC_DIV = `function JSTruncDiv(a: int, b: int): int
+  requires b != 0
+{
+  var q := (if a < 0 then -a else a) / (if b < 0 then -b else b);
+  if (a < 0) != (b < 0) then -q else q
+}`;
+const JS_STRING_LT = `predicate JSStringLt(s: string, t: string)
+  decreases |s|
+{
+  if |s| == 0 then |t| > 0
+  else if |t| == 0 then false
+  else if s[0] != t[0] then s[0] < t[0]
+  else JSStringLt(s[1..], t[1..])
+}`;
 const FLOOR_REAL = `function FloorReal(x: real): int
 {
   x.Floor
@@ -1022,11 +1063,16 @@ const NAT_TO_STRING = `function NatToString(n: nat): string
   if n < 10 then [digit]
   else NatToString(n / 10) + [digit]
 }`;
+const INT_TO_STRING = `function IntToString(n: int): string
+{
+  if n < 0 then "-" + NatToString(-n) else NatToString(n)
+}`;
 const MATH_ABS = `function MathAbs(x: int): nat { if x >= 0 then x else -x }`;
 // perm(a, b) — `a` and `b` are reorderings of each other (equal as multisets).
 // Transparent (Dafny unfolds it), so hand-proofs can reason with `multiset`
 // directly. The `(==)` bound requires the element type to support equality.
 const PERM = `predicate Perm<T(==)>(a: seq<T>, b: seq<T>) { multiset(a) == multiset(b) }`;
+const SET_FROM_SEQ = `function SetFromSeq<T(==)>(s: seq<T>): set<T> { set x | x in s }`;
 const SET_TO_SEQ = `method SetToSeq<T>(s: set<T>) returns (res: seq<T>)
   ensures forall x :: x in s <==> x in res
   ensures |res| == |s|
@@ -1054,6 +1100,9 @@ const PREAMBLE_CODE = [
     ["BitAnd", BIT_AND],
     ["BitOr", BIT_OR],
     ["JSFloorDiv", JS_FLOOR_DIV],
+    ["JSRem", JS_REM],
+    ["JSTruncDiv", JS_TRUNC_DIV],
+    ["JSStringLt", JS_STRING_LT],
     ["CeilReal", CEIL_REAL],
     ["FloorReal", FLOOR_REAL],
     ["SeqIndexOf", SEQ_INDEX_OF],
@@ -1069,12 +1118,14 @@ const PREAMBLE_CODE = [
     ["StringToLower", STRING_TO_LOWER],
     ["StringToUpper", STRING_TO_UPPER],
     ["NatToString", NAT_TO_STRING],
+    ["IntToString", INT_TO_STRING],
     ["MathAbs", MATH_ABS],
     ["MathMin", MATH_MIN],
     ["MathMax", MATH_MAX],
     ["MaxOfSeq", MAX_OF_SEQ],
     ["MinOfSeq", MIN_OF_SEQ],
     ["Perm", PERM],
+    ["SetFromSeq", SET_FROM_SEQ],
 ];
 // ── Constructor and record helpers ───────────────────────────
 let _recordCtors = new Map();

package/tools/dist/extract.js

@@ -4,7 +4,7 @@
  * Produces structured AST nodes, not strings.
  * The only strings are //@ annotation expressions (parsed later by specparser).
  */
-import { Project, Node, SyntaxKind, ScriptTarget } from "ts-morph";
+import { Project, Node, SyntaxKind, ScriptTarget, ts } from "ts-morph";
 import { initTypeParser } from "./types.js";
 // ── Expression extraction ────────────────────────────────────
 /** When set, calls whose function/method name matches this key are replaced with havoc. */
@@ -87,11 +87,16 @@ function detectCrossFileExtern(callee, sourceFile) {
     // types in the callee's own type-parameter namespace, so these names match
     // what `params`/`returnType` reference — declare them on the emitted axiom.
     const typeParams = sig.getTypeParameters().map(tp => tp.getText());
+    // Print types relative to the call site (enclosingNode = callee, alias names
+    // kept): a bare `TMsg`, not `import("/abs/path/transcript").TMsg` — the
+    // importing module declares the datatype locally, so the axiom must use the
+    // local name.
+    const externTypeText = (t) => t.getText(callee, ts.TypeFormatFlags.UseAliasDefinedOutsideCurrentScope);
     const params = sig.getParameters().map(p => ({
         name: p.getName(),
-        tsType: p.getTypeAtLocation(callee).getText(),
+        tsType: externTypeText(p.getTypeAtLocation(callee)),
     }));
-    const returnType = sig.getReturnType().getText();
+    const returnType = externTypeText(sig.getReturnType());
     let qualified;
     if (Node.isPropertyAccessExpression(callee)) {
         qualified = `${callee.getExpression().getText()}.${callee.getName()}`;
@@ -309,9 +314,10 @@ function extractExpr(node) {
     // Template literal: `foo${x}bar` → "foo" + x + "bar"
     if (Node.isTemplateExpression(node)) {
         const parts = [];
-        const head = node.getHead().getLiteralText();
-        if (head)
-            parts.push({ kind: "str", value: head });
+        // Always push the head, even when empty: a leading string literal anchors the
+        // whole chain as string-typed so each interpolated value is stringified (not
+        // added numerically — `${a}${b}` is concatenation, not `a + b`).
+        parts.push({ kind: "str", value: node.getHead().getLiteralText() });
         for (const span of node.getTemplateSpans()) {
             parts.push(extractExpr(span.getExpression()));
             const text = span.getLiteral().getLiteralText();
@@ -481,43 +487,42 @@ function extractExpr(node) {
     }
     // Object literal: { res: true, done: false } or { ...obj, res: true }
     if (Node.isObjectLiteralExpression(node)) {
-        let spread = null;
-        const fields = [];
-        const computedFields = [];
+        // Fold properties in source order: a later spread overrides everything before
+        // it, a named field is a record-update on the accumulator, a computed key is a
+        // map `.set`. Order matters: if `a` has `k`, `{ k: v, ...a }` is `a`, not `a.(k := v)`.
+        let acc = null;
+        const update = (name, value) => {
+            acc = acc && acc.kind === "record"
+                ? { kind: "record", spread: acc.spread, fields: [...acc.fields, { name, value }] }
+                : { kind: "record", spread: acc, fields: [{ name, value }] };
+        };
         for (const prop of node.getProperties()) {
             if (Node.isSpreadAssignment(prop)) {
-                spread = extractExpr(prop.getExpression());
+                acc = extractExpr(prop.getExpression());
             }
             else if (Node.isShorthandPropertyAssignment(prop)) {
                 const name = prop.getName();
-                fields.push({ name, value: { kind: "var", name } });
+                update(name, { kind: "var", name });
             }
             else if (Node.isPropertyAssignment(prop)) {
                 const nameNode = prop.getNameNode();
                 const init = prop.getInitializer();
-                if (init && Node.isComputedPropertyName(nameNode)) {
-                    computedFields.push({ key: extractExpr(nameNode.getExpression()), value: extractExpr(init) });
+                if (!init)
+                    continue;
+                if (Node.isComputedPropertyName(nameNode)) {
+                    // { ...base, [k]: v } → base.set(k, v); { [k]: v } → {}.set(k, v)
+                    const base = acc ?? { kind: "record", spread: null, fields: [] };
+                    acc = { kind: "call", fn: { kind: "field", obj: base, field: "set" }, args: [extractExpr(nameNode.getExpression()), extractExpr(init)] };
                 }
-                else if (init) {
+                else {
                     // String-literal keys (e.g. `"bun run": 3`) — use the unquoted literal
                     // value; otherwise `prop.getName()` may include surrounding quotes.
                     const name = Node.isStringLiteral(nameNode) ? nameNode.getLiteralValue() : prop.getName();
-                    fields.push({ name, value: extractExpr(init) });
+                    update(name, extractExpr(init));
                 }
             }
         }
-        // Desugar computed keys: { ...base, [k]: v } → base.set(k, v)
-        // No spread: { [k]: v } → {}.set(k, v) (empty map base)
-        if (computedFields.length > 0) {
-            let result = spread ?? { kind: "record", spread: null, fields: [] };
-            for (const cf of computedFields) {
-                result = { kind: "call",
-                    fn: { kind: "field", obj: result, field: "set" },
-                    args: [cf.key, cf.value] };
-            }
-            return result;
-        }
-        return { kind: "record", spread, fields };
+        return acc ?? { kind: "record", spread: null, fields: [] };
     }
     // Ternary: cond ? then : else
     if (Node.isConditionalExpression(node)) {
@@ -555,8 +560,12 @@ function extractExpr(node) {
                 if (Node.isArrayLiteralExpression(arg)) {
                     return { kind: "emptyCollection", collectionType: "Set", tsType, initElems: arg.getElements().map(e => extractExpr(e)) };
                 }
-                // new Set(existingSet) — pass through
-                return extractExpr(arg);
+                const argSymbol = arg.getType().getSymbol()?.getName() ?? arg.getType().getAliasSymbol()?.getName();
+                // new Set(existingSet) — identity (sets are value types)
+                if (argSymbol === "Set")
+                    return extractExpr(arg);
+                // new Set(arr) — build a deduplicated set from the array's elements
+                return { kind: "call", fn: { kind: "var", name: "__setFromArray" }, args: [extractExpr(arg)] };
             }
             return { kind: "emptyCollection", collectionType: name, tsType };
         }
@@ -1557,6 +1566,7 @@ function extractStmts(stmts) {
             //      inside a `{ }` case block is stripped, while a `break` inside a
             //      nested loop stays put.
             const stripExitBreaks = (b) => b.filter(st => st.kind !== "break");
+            const isExit = (st) => !!st && ["break", "return", "throw", "continue"].includes(st.kind);
             let fallthrough = [];
             for (const clause of s.getClauses()) {
                 if (Node.isCaseClause(clause)) {
@@ -1565,7 +1575,10 @@ function extractStmts(stmts) {
                         fallthrough.push(label);
                         continue;
                     }
-                    const body = stripExitBreaks(extractStmts(clause.getStatements()));
+                    const raw = extractStmts(clause.getStatements());
+                    if (!isExit(raw[raw.length - 1]))
+                        throw new Error(`switch case "${label}" at line ${line}: a non-empty case must end with break/return/throw; fall-through into the next case is not supported`);
+                    const body = stripExitBreaks(raw);
                     for (const l of fallthrough)
                         cases.push({ label: l, body });
                     cases.push({ label, body });

package/tools/dist/lean-emit.js

@@ -77,6 +77,7 @@ function escapeName(name) {
 }
 // ── Operator precedence (for parenthesization) ──────────────
 const PREC = {
+    "↔": 0, // Lean: Iff (20) binds looser than → (25)
     "→": 1, "∨": 2, "∧": 3,
     "=": 4, "≠": 4, "≥": 4, "≤": 4, ">": 4, "<": 4,
     "+": 5, "-": 5, "++": 5, "arrayConcat": 5, "*": 6, "/": 6, "%": 6,
@@ -96,15 +97,15 @@ function emitMethodCall(tyKind, method, monadic, obj, args) {
         if (method === "some")
             return `${obj}.${monadic ? "anyM" : "any"} ${args[0]}`;
         if (method === "includes")
-            return `${obj}.contains ${args[0]}`;
+            return args.length > 1 ? `(${obj}.extract ${args[1]} ${obj}.size).contains ${args[0]}` : `${obj}.contains ${args[0]}`;
         if (method === "find")
             return `${obj}.find? ${args[0]}`;
         if (method === "with")
             return `${obj}.set! ${args[0]} ${args[1]}`;
         if (method === "push")
-            return `Array.push ${obj} ${args[0]}`;
+            return args.length === 1 ? `Array.push ${obj} ${args[0]}` : `${obj} ++ #[${args.join(", ")}]`;
         if (method === "concat")
-            return `Array.push ${obj} ${args[0]}`;
+            return args.length === 1 ? `Array.push ${obj} ${args[0]}` : `${obj} ++ #[${args.join(", ")}]`;
         // arr.slice → Array.extract. No-arg slice is a full copy (Array is a value
         // type in Lean, so the receiver itself); one arg drops the prefix, two args
         // give the half-open range. Matches JS for non-negative bounds (negative
@@ -184,7 +185,7 @@ function emitExpr(e, parentPrec) {
         case "emptySet": return `Std.HashSet.empty`;
         case "methodCall": {
             const obj = emitExpr(e.obj);
-            const wrap = e.obj.kind === "binop" || e.obj.kind === "app" || e.obj.kind === "methodCall";
+            const wrap = e.obj.kind === "binop" || e.obj.kind === "app" || e.obj.kind === "methodCall" || e.obj.kind === "if" || e.obj.kind === "let";
             const receiver = wrap ? `(${obj})` : obj;
             const args = e.args.map(a => (a.kind === "binop" || a.kind === "unop" || a.kind === "implies" || a.kind === "app" || a.kind === "methodCall") ? `(${emitExpr(a)})` : emitExpr(a));
             return emitMethodCall(e.objTy.kind, e.method, e.monadic, receiver, args);
@@ -213,11 +214,23 @@ function emitExpr(e, parentPrec) {
                 return `${wrap ? `(${recv})` : recv}.contains ${emitExpr(e.left)}`;
             }
             const op = e.op === "arrayConcat" ? "++" : e.op;
-            const s = `${wrapOperand(e.left, prec(e.op))} ${op} ${wrapOperand(e.right, prec(e.op))}`;
+            // ↔ does not chain in Lean — a nested iff operand needs parens.
+            const childPrec = e.op === "↔" ? prec(e.op) + 1 : prec(e.op);
+            // `-`, `/`, `%` are left-associative and non-associative, so an equal-
+            // precedence right operand must be parenthesized: `a - (b - c)` would
+            // otherwise emit as `a - b - c`, i.e. `(a - b) - c`.
+            const rightPrec = e.op === "↔" ? childPrec
+                : ["-", "/", "%"].includes(e.op) ? prec(e.op) + 1 : childPrec;
+            const s = `${wrapOperand(e.left, childPrec)} ${op} ${wrapOperand(e.right, rightPrec)}`;
             return (parentPrec !== undefined && prec(e.op) < parentPrec) ? `(${s})` : s;
         }
         case "implies": {
-            const parts = [...e.premises.map(p => wrapOperand(p)), emitExpr(e.conclusion)];
+            // Premises bind at →'s level: a nested-implication premise must keep its
+            // parens (→ is right-associative, so `(a → b) → c` ≠ `a → b → c`), and
+            // ↔ binds looser than → in Lean. The conclusion is the right-assoc tail,
+            // where a nested implication is safe bare — only ↔ needs parens there.
+            const wrapIff = (x) => x.kind === "binop" && x.op === "↔" ? `(${emitExpr(x)})` : undefined;
+            const parts = [...e.premises.map(p => wrapOperand(p, prec("→"))), wrapIff(e.conclusion) ?? emitExpr(e.conclusion)];
             const s = parts.join(" → ");
             return parentPrec !== undefined ? `(${s})` : s;
         }
@@ -231,6 +244,16 @@ function emitExpr(e, parentPrec) {
             // SetToSeq → .toArray for Lean (HashSet has native toArray)
             if (e.fn === "SetToSeq" && args.length === 1)
                 return `${args[0]}.toArray`;
+            if (e.fn === "SetFromSeq" && args.length === 1)
+                return `Std.HashSet.ofList ${args[0]}.toList`;
+            if (e.fn === "ToString" && args.length === 1)
+                return `toString ${args[0]}`;
+            // JSRem (JS truncated remainder) → Lean's native truncated `Int.tmod`
+            if (e.fn === "JSRem" && args.length === 2)
+                return `Int.tmod ${args[0]} ${args[1]}`;
+            // JSTruncDiv (JS truncated bigint division) → Lean's native `Int.tdiv`
+            if (e.fn === "JSTruncDiv" && args.length === 2)
+                return `Int.tdiv ${args[0]} ${args[1]}`;
             // perm(a, b) → `List.Perm` on the underlying lists. Dafny lowers it to
             // `multiset(a) == multiset(b)`; the Lean image is `a.toList ~ b.toList`,
             // which mathlib's `List.Perm` provides (reflexivity, symmetry,

package/tools/dist/narrow.js

@@ -44,25 +44,29 @@ let _typeDecls = [];
  *  pure-access-path optional-typed e. `!e` is equivalent to `=== undefined`.
  *  Following TS, only pure access paths narrow; complex scrutinees return null. */
 function parseOptionalCheck(cond) {
-    // `!e` where e is optional — same as `e === undefined` (negated: true).
+    // `!e` where e is optional — a truthiness form: false iff e is absent OR its
+    // inner value is itself falsy (so `Some(0)`/`Some("")` count as falsy too).
     if (cond.kind === "unop" && cond.op === "!" && cond.expr.ty.kind === "optional") {
         const e = cond.expr;
         const innerTy = cond.expr.ty.inner;
         const hint = binderHintFor(e);
         if (hint === null)
             return null;
-        return { scrutinee: e, innerTy, negated: true, binderHint: hint };
+        return { scrutinee: e, innerTy, negated: true, binderHint: hint, truthiness: true };
     }
     if (cond.kind !== "binop" || (cond.op !== "!==" && cond.op !== "===")) {
-        // Bare optional truthiness: `if (e)` where e: T | undefined — same as `e !== undefined`.
+        // Bare optional truthiness: `if (e)` where e: T | undefined — true iff e is
+        // present AND its inner value is truthy.
         if (cond.ty.kind === "optional") {
             const hint = binderHintFor(cond);
             if (hint === null)
                 return null;
-            return { scrutinee: cond, innerTy: cond.ty.inner, negated: false, binderHint: hint };
+            return { scrutinee: cond, innerTy: cond.ty.inner, negated: false, binderHint: hint, truthiness: true };
         }
         return null;
     }
+    // Explicit `e === undefined` / `e !== undefined` — a pure presence check,
+    // independent of the inner value (so NOT a truthiness form).
     let e = null;
     if (cond.right.kind === "var" && cond.right.name === "undefined")
         e = cond.left;
@@ -73,7 +77,7 @@ function parseOptionalCheck(cond) {
     const hint = binderHintFor(e);
     if (hint === null)
         return null;
-    return { scrutinee: e, innerTy: e.ty.inner, negated: cond.op === "===", binderHint: hint };
+    return { scrutinee: e, innerTy: e.ty.inner, negated: cond.op === "===", binderHint: hint, truthiness: false };
 }
 function binderHintFor(e) {
     // Pure access paths: var(x) or field(purePath, name).
@@ -205,6 +209,8 @@ function recurseStmt(s) {
             fallthrough: rs(s.fallthrough) };
     }
 }
+const canBeFalsy = (c) => c.truthiness && ["int", "nat", "string", "bool"].includes(c.innerTy.kind);
+const bound = (c) => ({ kind: "var", name: c.binderHint, ty: c.innerTy });
 // ── Rules ───────────────────────────────────────────────────
 /** Rule: `if (e !== undefined) then else` where e is a simple optional var or
  *  `obj.field` chain, and the Some branch is non-empty.
@@ -223,7 +229,8 @@ function ruleIfOptionalSimple(s) {
         kind: "someMatch",
         scrutinee: check.scrutinee, binderTy: check.innerTy,
         binder: check.binderHint,
-        someBody, noneBody,
+        someBody: canBeFalsy(check) ? [{ kind: "if", cond: bound(check), then: someBody, else: noneBody }] : someBody,
+        noneBody,
     };
 }
 /** Rule: `if (e === undefined) terminate; rest` (early return / throw / break).
@@ -242,11 +249,13 @@ function ruleEarlyReturnConsume(s, rest) {
     const noneBranch = check.negated ? s.then : s.else;
     if (someBranch.length !== 0)
         return null;
+    if (!isTerminating(noneBranch))
+        return null;
     return {
         kind: "someMatch",
         scrutinee: check.scrutinee, binderTy: check.innerTy,
         binder: check.binderHint,
-        someBody: rest,
+        someBody: canBeFalsy(check) ? [{ kind: "if", cond: bound(check), then: rest, else: noneBranch }] : rest,
         noneBody: noneBranch,
     };
 }
@@ -285,11 +294,14 @@ function ruleEarlyReturnOrChain(s, rest) {
     let inner = rest;
     for (let i = checks.length - 1; i >= 0; i--) {
         const check = checks[i];
+        const someBody = canBeFalsy(check)
+            ? [{ kind: "if", cond: bound(check), then: inner, else: s.then }]
+            : inner;
         inner = [{
                 kind: "someMatch",
                 scrutinee: check.scrutinee, binderTy: check.innerTy,
                 binder: check.binderHint,
-                someBody: inner,
+                someBody,
                 noneBody: s.then,
             }];
     }
@@ -308,7 +320,8 @@ function ruleConditionalOptionalSimple(e) {
         kind: "someMatch",
         scrutinee: check.scrutinee, binderTy: check.innerTy,
         binder: check.binderHint,
-        someBody, noneBody,
+        someBody: canBeFalsy(check) ? { kind: "conditional", cond: bound(check), then: someBody, else: noneBody, ty: e.ty } : someBody,
+        noneBody,
         ty: e.ty,
     };
 }
@@ -574,11 +587,14 @@ function ruleIfAndOptional(s) {
         return null;
     const { check, restCond } = extracted;
     const innerIf = { kind: "if", cond: restCond, then: s.then, else: [] };
+    const someBody = canBeFalsy(check)
+        ? [{ kind: "if", cond: bound(check), then: [walkStmt(innerIf)], else: [] }]
+        : [walkStmt(innerIf)];
     return {
         kind: "someMatch",
         scrutinee: check.scrutinee, binderTy: check.innerTy,
         binder: check.binderHint,
-        someBody: [walkStmt(innerIf)],
+        someBody,
         noneBody: [],
     };
 }
@@ -768,8 +784,16 @@ function ruleDiscriminantChain(stmts) {
     }
     if (cases.length === 0)
         return null;
+    // If every case terminates, the trailing statements are the default arm
+    // (preserving the clean dispatch-as-expression shape). Otherwise the tail runs
+    // after the match for every variant, so leave it to the caller (empty default)
+    // rather than mis-routing it into the default arm only.
+    if (cases.every(c => isTerminating(c.body))) {
+        return { stmt: { kind: "tagMatch", scrutinee: first.scrutinee, typeName: first.typeName,
+                cases, fallthrough: stmts.slice(consumed) }, consumed: stmts.length };
+    }
     return { stmt: { kind: "tagMatch", scrutinee: first.scrutinee, typeName: first.typeName,
-            cases, fallthrough: stmts.slice(consumed) }, consumed: stmts.length };
+            cases, fallthrough: [] }, consumed };
 }
 /** Rule (list-level): `if (x.kind !== "v") terminate; rest` → tagMatch
  *  with cases = [{ variant: v, body: rest }] and fallthrough = terminate. */
@@ -801,12 +825,16 @@ function ruleLetCondAndOptional(s) {
     if (!extracted)
         return null;
     const { check, restCond } = extracted;
+    const assignIf = { kind: "if", cond: restCond,
+        then: [{ kind: "assign", target: s.name, value: s.init.then }], else: [] };
+    const someBody = canBeFalsy(check)
+        ? [{ kind: "if", cond: bound(check), then: [assignIf], else: [] }]
+        : [assignIf];
     const sm = {
         kind: "someMatch",
         scrutinee: check.scrutinee, binderTy: check.innerTy,
         binder: check.binderHint,
-        someBody: [{ kind: "if", cond: restCond,
-                then: [{ kind: "assign", target: s.name, value: s.init.then }], else: [] }],
+        someBody,
         noneBody: [],
     };
     return [
@@ -881,11 +909,15 @@ function ruleConditionalAndOptional(e) {
         kind: "conditional",
         cond: restCond, then: e.then, else: e.else, ty: e.ty,
     };
+    const someExpr = walkExpr(innerCond);
+    const someBody = canBeFalsy(check)
+        ? { kind: "conditional", cond: bound(check), then: someExpr, else: e.else, ty: e.ty }
+        : someExpr;
     return {
         kind: "someMatch",
         scrutinee: check.scrutinee, binderTy: check.innerTy,
         binder: check.binderHint,
-        someBody: walkExpr(innerCond), noneBody: e.else, ty: e.ty,
+        someBody, noneBody: e.else, ty: e.ty,
     };
 }
 /** Rule (statement): `if (<rest> && Array.isArray(path) && <more>) then [else]`

package/tools/dist/peephole.js

@@ -440,7 +440,8 @@ function peepholeDecl(d) {
                 decreases: d.decreases ? peepholeExpr(d.decreases) : null };
         case "method":
             return { ...d, body: peepholeStmts(d.body),
-                requires: d.requires.map(peepholeExpr), ensures: d.ensures.map(peepholeExpr) };
+                requires: d.requires.map(peepholeExpr), ensures: d.ensures.map(peepholeExpr),
+                decreases: d.decreases ? peepholeExpr(d.decreases) : null };
         case "namespace": return { ...d, decls: d.decls.map(peepholeDecl) };
         case "class": return { ...d, methods: d.methods.map(m => peepholeDecl(m)) };
         case "const": return { ...d, value: peepholeExpr(d.value) };

package/tools/dist/resolve.js

@@ -685,7 +685,9 @@ function resolveExpr(e, ctx) {
                 }
             }
             let ty = { kind: "unknown" };
-            if (["===", "!==", ">=", "<=", ">", "<", "in"].includes(e.op))
+            // <==> is bool like the comparisons; unlike ==>, neither side narrows
+            // the other (no premise to assume).
+            if (["===", "!==", ">=", "<=", ">", "<", "in", "<==>"].includes(e.op))
                 ty = { kind: "bool" };
             else if (e.op === "&&")
                 ty = right.ty;
@@ -727,6 +729,16 @@ function resolveExpr(e, ctx) {
                 const fn = { kind: "var", name: "Perm", ty: { kind: "unknown" } };
                 return { kind: "call", fn, args: [a, b], ty: { kind: "bool" }, callKind: "pure" };
             }
+            // new Set(arr): build a deduplicated set from the array's elements (extract
+            // marks the array form `__setFromArray`). Lowers to the SetFromSeq preamble
+            // (Dafny `set x | x in s`); size/membership are then set semantics.
+            if (e.fn.kind === "var" && e.fn.name === "__setFromArray" && e.args.length === 1) {
+                const arr = resolveExpr(e.args[0], ctx);
+                if (arr.ty.kind !== "array")
+                    throw new Error(`new Set(...) expects an array argument (got ${arr.ty.kind})`);
+                const fn = { kind: "var", name: "SetFromSeq", ty: { kind: "unknown" } };
+                return { kind: "call", fn, args: [arr], ty: { kind: "set", elem: arr.ty.elem }, callKind: "pure" };
+            }
             // Extern dispatch: `NS.method(args)` where NS.method is declared via
             // `//@ extern`. Rewrite into a flat-name call (`NS_method(args)`) so the
             // rest of the pipeline sees an ordinary pure function. The extern's

package/tools/dist/specparser.js

@@ -2,7 +2,7 @@
  * Spec expression parser.
  * Parses //@ annotation expressions into RawExpr AST nodes.
  */
-const MULTI_OPS = ["==>", "===", "!==", "==", "!=", ">=", "<=", "&&", "||"];
+const MULTI_OPS = ["<==>", "==>", "===", "!==", "==", "!=", ">=", "<=", "&&", "||"];
 function tokenize(input) {
     const tokens = [];
     let i = 0;
@@ -20,8 +20,22 @@ function tokenize(input) {
             const quote = input[i];
             i++;
             let s = "";
-            while (i < input.length && input[i] !== quote)
-                s += input[i++];
+            while (i < input.length && input[i] !== quote) {
+                if (input[i] === "\\") {
+                    // Standard escapes, where TS source, Dafny, and Lean all agree.
+                    // The emitters re-escape on output, so the round trip is faithful.
+                    const esc = input[i + 1];
+                    const mapped = esc === "n" ? "\n" : esc === "r" ? "\r" : esc === "t" ? "\t"
+                        : esc === "0" ? "\0" : esc === "\\" || esc === '"' || esc === "'" ? esc : null;
+                    if (mapped === null)
+                        throw new Error(`Unsupported string escape '\\${esc}' at ${i} in: ${input}`);
+                    s += mapped;
+                    i += 2;
+                }
+                else {
+                    s += input[i++];
+                }
+            }
             if (i < input.length)
                 i++;
             tokens.push({ type: "str", value: s });
@@ -103,11 +117,19 @@ class Parser {
         return false;
     }
     parse() {
-        const r = this.parseImplies();
+        const r = this.parseIff();
         if (this.pos < this.tokens.length)
             throw new Error(`Unexpected: ${JSON.stringify(this.peek())}`);
         return r;
     }
+    // <==> binds loosest (Dafny precedence: a ==> b <==> c is (a ==> b) <==> c),
+    // right-associative like ==> — immaterial semantically, iff is associative.
+    parseIff() {
+        const left = this.parseImplies();
+        if (this.match("op", "<==>"))
+            return { kind: "binop", op: "<==>", left, right: this.parseIff() };
+        return left;
+    }
     parseImplies() {
         const left = this.parseTernary();
         if (this.match("op", "==>"))
@@ -117,9 +139,9 @@ class Parser {
     parseTernary() {
         const cond = this.parseOr();
         if (this.match("op", "?")) {
-            const then_ = this.parseImplies();
+            const then_ = this.parseIff();
             this.expect("punc", ":");
-            const else_ = this.parseImplies();
+            const else_ = this.parseIff();
             return { kind: "conditional", cond, then: then_, else: else_ };
         }
         return cond;
@@ -187,16 +209,16 @@ class Parser {
                 expr = { kind: "field", obj: expr, field: this.expect("ident").value };
             }
             else if (this.match("punc", "[")) {
-                const idx = this.parseImplies();
+                const idx = this.parseIff();
                 this.expect("punc", "]");
                 expr = { kind: "index", obj: expr, idx };
             }
             else if (this.match("punc", "(")) {
                 const args = [];
                 if (!this.match("punc", ")")) {
-                    args.push(this.parseImplies());
+                    args.push(this.parseIff());
                     while (this.match("punc", ","))
-                        args.push(this.parseImplies());
+                        args.push(this.parseIff());
                     this.expect("punc", ")");
                 }
                 expr = { kind: "call", fn: expr, args };
@@ -276,7 +298,7 @@ class Parser {
                     varType = ty;
                 }
                 this.expect("punc", ",");
-                const body = this.parseImplies();
+                const body = this.parseIff();
                 this.expect("punc", ")");
                 return { kind: q, var: v, varType, body };
             }
@@ -285,7 +307,7 @@ class Parser {
         }
         if (t.type === "punc" && t.value === "(") {
             this.advance();
-            const expr = this.parseImplies();
+            const expr = this.parseIff();
             this.expect("punc", ")");
             return expr;
         }
@@ -293,9 +315,9 @@ class Parser {
             this.advance();
             const elems = [];
             if (!this.match("punc", "]")) {
-                elems.push(this.parseImplies());
+                elems.push(this.parseIff());
                 while (this.match("punc", ","))
-                    elems.push(this.parseImplies());
+                    elems.push(this.parseIff());
                 this.expect("punc", "]");
             }
             return { kind: "arrayLiteral", elems };
@@ -306,11 +328,11 @@ class Parser {
             if (!this.match("punc", "}")) {
                 const name = this.expect("ident").value;
                 this.expect("punc", ":");
-                fields.push({ name, value: this.parseImplies() });
+                fields.push({ name, value: this.parseIff() });
                 while (this.match("punc", ",")) {
                     const n = this.expect("ident").value;
                     this.expect("punc", ":");
-                    fields.push({ name: n, value: this.parseImplies() });
+                    fields.push({ name: n, value: this.parseIff() });
                 }
                 this.expect("punc", "}");
             }

package/tools/dist/transform.js

@@ -158,6 +158,24 @@ function isNat(ty) { return ty.kind === "nat"; }
 function isIntegral(ty) { return ty.kind === "int" || ty.kind === "nat"; }
 function isArray(ty) { return ty.kind === "array"; }
 function isUser(ty) { return ty.kind === "user"; }
+/** Truthiness test for a *lowered* value of source type `ty`, used by `||`
+ *  falsiness lowering. Mirrors narrow.ts's `canBeFalsy`: only int/nat/string/bool
+ *  values can be falsy in JS (`0`, `""`, `false`); every other value (array, user
+ *  type, …) is always truthy. Returns null for the always-truthy types so callers
+ *  can unwrap directly instead of emitting a redundant guard. */
+function valueTruthyCond(value, ty) {
+    switch (ty.kind) {
+        case "int":
+        case "nat":
+            return { kind: "binop", op: "≠", left: value, right: { kind: "num", value: 0 } };
+        case "string":
+            return { kind: "binop", op: ">", left: { kind: "field", obj: value, field: "length" }, right: { kind: "num", value: 0 } };
+        case "bool":
+            return value;
+        default:
+            return null;
+    }
+}
 /** Check if transformed lambda body contains monadic binds. */
 function isMonadicBody(stmts) {
     for (const s of stmts) {
@@ -182,7 +200,7 @@ function isMonadicBody(stmts) {
 const OP_MAP = {
     "===": "=", "!==": "≠", ">=": "≥", "<=": "≤", ">": ">", "<": "<",
     "&&": "∧", "||": "∨", "+": "+", "-": "-", "*": "*", "/": "/", "%": "%",
-    "==": "=", "!=": "≠",
+    "==": "=", "!=": "≠", "<==>": "↔",
 };
 /** Bool-valued operators (for code-level conditions needing Decidable). */
 const BOOL_OP_MAP = {
@@ -248,15 +266,18 @@ function flattenLambdaBody(stmts) {
  * field, index, record, forall, or exists sub-expressions.
  */
 /** JS truthiness coercion for `if`/`while`/`?:` conditions.
- *  Dafny requires bool; TS treats number/string/array as truthy when non-empty.
+ *  Dafny requires bool; coerce number→`≠0`, string→non-empty, array→`true`
+ *  (every array, even `[]`, is truthy in JS).
  *  Optional conds are handled separately by narrow.ts (rewritten to someMatch). */
 function coerceCondToBool(cond, ty) {
     if (ty.kind === "bool")
         return cond;
     if (ty.kind === "int" || ty.kind === "nat")
-        return { kind: "binop", op: ">", left: cond, right: { kind: "num", value: 0 } };
-    if (ty.kind === "string" || ty.kind === "array")
-        return { kind: "binop", op: ">", left: { kind: "field", obj: cond, field: "size" }, right: { kind: "num", value: 0 } };
+        return { kind: "binop", op: "≠", left: cond, right: { kind: "num", value: 0 } };
+    if (ty.kind === "string")
+        return { kind: "binop", op: ">", left: { kind: "field", obj: cond, field: "length" }, right: { kind: "num", value: 0 } };
+    if (ty.kind === "array")
+        return { kind: "bool", value: true };
     return cond;
 }
 /** Wrap an expression in Some/None for optional-typed conditionals.
@@ -272,6 +293,55 @@ function wrapOptionalBranch(expr, raw) {
         return expr; // already Option<T>, don't double-wrap
     return { kind: "constructor", name: "some", type: "Option", args: [expr] };
 }
+/** Lean needs `let mut` for any local that is later reassigned. A const local
+ *  whose collection field is mutated (`b.items.push(v)` → `b := b.(items := …)`)
+ *  becomes an assign in the lowered body, so scan for assign targets and flip
+ *  matching lets to mutable. Harmless on Dafny (method locals are `var`); and an
+ *  assigned let already forces a method, so purity is unaffected. */
+function promoteAssignedLets(stmts) {
+    const assigned = new Set();
+    const collect = (ss) => {
+        for (const s of ss) {
+            if (s.kind === "assign")
+                assigned.add(s.target);
+            else if (s.kind === "if") {
+                collect(s.then);
+                collect(s.else);
+            }
+            else if (s.kind === "while" || s.kind === "forin")
+                collect(s.body);
+            else if (s.kind === "match")
+                s.arms.forEach(a => collect(a.body));
+        }
+    };
+    collect(stmts);
+    if (assigned.size === 0)
+        return stmts;
+    const fix = (ss) => ss.map(s => {
+        const s2 = s.kind === "let" && !s.mutable && assigned.has(s.name) ? { ...s, mutable: true } : s;
+        if (s2.kind === "if")
+            return { ...s2, then: fix(s2.then), else: fix(s2.else) };
+        if (s2.kind === "while" || s2.kind === "forin")
+            return { ...s2, body: fix(s2.body) };
+        if (s2.kind === "match")
+            return { ...s2, arms: s2.arms.map(a => ({ ...a, body: fix(a.body) })) };
+        return s2;
+    });
+    return fix(stmts);
+}
+/** Build a nested record-update assigning `newVal` to a field-path receiver
+ *  rooted at a var: `b.a.items` → `b := b.(a := b.a.(items := newVal))`.
+ *  Returns null if the path isn't a chain of field accesses ending at a var. */
+function buildNestedFieldUpdate(recv, newVal) {
+    if (recv.kind !== "field")
+        return null;
+    const upd = { kind: "record", spread: lowerExpr(recv.obj, null), fields: [{ name: recv.field, value: newVal }] };
+    if (recv.obj.kind === "var")
+        return { root: recv.obj.name, value: upd };
+    if (recv.obj.kind === "field")
+        return buildNestedFieldUpdate(recv.obj, upd);
+    return null;
+}
 function lowerExpr(e, binds) {
     // Monadic lifting: extract embedded method calls to let-binds.
     // `callKind: "method"` means a global var-fn call (classifyCall returns
@@ -298,17 +368,29 @@ function lowerExpr(e, binds) {
             // String truthiness: !str → str == ""
             if (e.op === "!" && e.expr.ty.kind === "string")
                 return { kind: "binop", op: "=", left: lowerExpr(e.expr, binds), right: { kind: "str", value: "" } };
-            // Optional truthiness: !opt → opt is None
+            // Optional truthiness: !opt → None negates to `true`. The Some branch is
+            // `!(value truthy)`: always-truthy inners (array/user) give a plain `false`,
+            // while falsy-capable inners re-test the wrapped value (`!Some(0)` is `true`).
+            // Mirrors the `||` falsiness rule.
             if (e.op === "!" && e.expr.ty.kind === "optional") {
                 const bound = matchBinder("value");
+                const truthy = valueTruthyCond({ kind: "var", name: bound }, e.expr.ty.inner);
                 return {
                     kind: "match", scrutinee: lowerExpr(e.expr, binds),
                     arms: [
-                        { pattern: `.some ${bound}`, body: { kind: "bool", value: false } },
+                        { pattern: `.some ${bound}`, body: truthy ? { kind: "unop", op: "¬", expr: truthy } : { kind: "bool", value: false } },
                         { pattern: ".none", body: { kind: "bool", value: true } },
                     ],
                 };
             }
+            // Number truthiness: !n → n == 0
+            if (e.op === "!" && (e.expr.ty.kind === "int" || e.expr.ty.kind === "nat"))
+                return { kind: "binop", op: "=", left: lowerExpr(e.expr, binds), right: { kind: "num", value: 0 } };
+            // Array truthiness: every array is truthy in JS, so !xs is always false.
+            if (e.op === "!" && e.expr.ty.kind === "array") {
+                lowerExpr(e.expr, binds); // preserve any lifted side effects; value is the constant false
+                return { kind: "bool", value: false };
+            }
             return { kind: "unop", op: e.op === "!" ? "¬" : e.op, expr: lowerExpr(e.expr, binds) };
         case "binop": {
             // Implication: flatten (A && B) ==> C → implies [A, B] C
@@ -327,8 +409,10 @@ function lowerExpr(e, binds) {
                     right: { kind: "constructor", name: e.right.value, type: objTy },
                 };
             }
-            // String literal comparison — constructor if user type, string literal if string
-            if ((e.op === "===" || e.op === "!==") && e.right.kind === "str") {
+            // String literal comparison — constructor if user type, string literal if string.
+            // Skip when the left is optional: fall through to the optional-comparison rule,
+            // which unwraps and compares the inner value (`Some(v) => v == "")`.
+            if ((e.op === "===" || e.op === "!==") && e.right.kind === "str" && e.left.ty.kind !== "optional") {
                 const left = lowerExpr(e.left, binds);
                 const leftTy = e.left.ty.kind === "user" ? e.left.ty.name : undefined;
                 const right = isUser(e.left.ty)
@@ -352,7 +436,13 @@ function lowerExpr(e, binds) {
                         ],
                     };
                 }
-                const valExpr = lowerExpr(valSide, binds);
+                // A string literal compared against an optional user type is the variant
+                // constructor (`o === "red"` → `Some(v) => v == Color.red`), mirroring the
+                // non-optional string-literal rule above.
+                const innerTy = optSide.ty.kind === "optional" ? optSide.ty.inner : optSide.ty;
+                const valExpr = valSide.kind === "str" && innerTy.kind === "user"
+                    ? { kind: "constructor", name: valSide.value, type: innerTy.name }
+                    : lowerExpr(valSide, binds);
                 const cmpOp = BOOL_OP_MAP[e.op] ?? e.op;
                 const noneVal = e.op === "!==" ? true : false;
                 const bound = matchBinder("value");
@@ -364,37 +454,76 @@ function lowerExpr(e, binds) {
                     ],
                 };
             }
-            // || undefined on optional → identity (no-op: x || undefined = x)
+            // || undefined on optional → identity (no-op: x || undefined = x) when the
+            // inner type is always truthy. When it can be falsy, JS still drops the
+            // wrapped value: `Some(0) || undefined === undefined`, so the Some arm
+            // re-tests and falls back to None.
             if (e.op === "||" && e.left.ty.kind === "optional" &&
                 e.right.kind === "var" && e.right.name === "undefined") {
-                return lowerExpr(e.left, binds);
+                const optExpr = lowerExpr(e.left, binds);
+                const bound = matchBinder("value");
+                const truthy = valueTruthyCond({ kind: "var", name: bound }, e.left.ty.inner);
+                if (!truthy)
+                    return optExpr;
+                return {
+                    kind: "match", scrutinee: optExpr,
+                    arms: [
+                        { pattern: `.some ${bound}`, body: {
+                                kind: "if", cond: truthy,
+                                then: { kind: "app", fn: "Some", args: [{ kind: "var", name: bound }] },
+                                else: { kind: "var", name: "undefined" }
+                            } },
+                        { pattern: ".none", body: { kind: "var", name: "undefined" } },
+                    ],
+                };
             }
-            // || on optional → match Some/None with default
+            // || on optional → match Some/None with default. JS `||` tests falsiness of
+            // the *unwrapped* value, so when the inner type can be falsy the Some arm must
+            // re-test (`Some(0) || 1 === 1`); array/user inners are always truthy and
+            // unwrap directly. Mirrors narrow.ts's canBeFalsy gate.
             if (e.op === "||" && e.left.ty.kind === "optional") {
                 const optExpr = lowerExpr(e.left, binds);
                 const defaultExpr = lowerExpr(e.right, binds);
                 const bound = matchBinder("value");
+                const truthy = valueTruthyCond({ kind: "var", name: bound }, e.left.ty.inner);
+                const someBody = truthy
+                    ? { kind: "if", cond: truthy, then: { kind: "var", name: bound }, else: defaultExpr }
+                    : { kind: "var", name: bound };
                 return {
                     kind: "match", scrutinee: optExpr,
                     arms: [
-                        { pattern: `.some ${bound}`, body: { kind: "var", name: bound } },
+                        { pattern: `.some ${bound}`, body: someBody },
                         { pattern: ".none", body: defaultExpr },
                     ],
                 };
             }
-            // || on map index → if key in map then map[key] else default
+            // || on map index → if key in map then map[key] else default. The stored
+            // value is still subject to JS falsiness (`counts.get(k) || 1` returns 1 when
+            // the stored value is 0), so for falsy-capable value types the present branch
+            // re-tests the value too. Always-truthy value types unwrap directly.
             if (e.op === "||" && e.left.kind === "index" && e.left.obj.ty.kind === "map") {
                 const map = lowerExpr(e.left.obj, binds);
                 const key = lowerExpr(e.left.idx, binds);
                 const right = lowerExpr(e.right, binds);
+                const got = { kind: "index", arr: map, idx: key };
+                const truthy = valueTruthyCond(got, e.left.obj.ty.value);
                 return {
                     kind: "if",
                     cond: { kind: "binop", op: "in", left: key, right: map },
-                    then: { kind: "index", arr: map, idx: key }, else: right,
+                    then: truthy ? { kind: "if", cond: truthy, then: got, else: right } : got,
+                    else: right,
                 };
             }
-            // || on non-optional string/array/user → if non-empty then x else default
-            if (e.op === "||" && (e.left.ty.kind === "string" || e.left.ty.kind === "array" ||
+            // || on non-optional array → `xs` itself: every array (even `[]`) is truthy
+            // in JS, so `xs || ys` short-circuits to `xs` and `ys` is never evaluated.
+            // resolve types the whole `||` as the array, so any optional context (e.g.
+            // `xs || undefined`) gets its single Some-wrap from the standard coercion at
+            // the use site — this rule must not add one. Mirrors the `!array` rule above.
+            if (e.op === "||" && e.left.ty.kind === "array") {
+                return lowerExpr(e.left, binds);
+            }
+            // || on non-optional string/user → if non-empty then x else default
+            if (e.op === "||" && (e.left.ty.kind === "string" ||
                 (e.left.ty.kind === "user" && e.right.ty.kind === "string"))) {
                 const left = lowerExpr(e.left, binds);
                 const right = lowerExpr(e.right, binds);
@@ -402,7 +531,9 @@ function lowerExpr(e, binds) {
                 const rightIsUndef = e.right.kind === "var" && e.right.name === "undefined";
                 return {
                     kind: "if",
-                    cond: { kind: "binop", op: ">", left: { kind: "field", obj: left, field: "size" }, right: { kind: "num", value: 0 } },
+                    // strings carry the `length` marker — it renders to `|x|` in Dafny and
+                    // `.length` in Lean (whose String has no `.size` field).
+                    cond: { kind: "binop", op: ">", left: { kind: "field", obj: left, field: e.left.ty.kind === "string" ? "length" : "size" }, right: { kind: "num", value: 0 } },
                     then: rightIsUndef ? { kind: "app", fn: "Some", args: [left] } : left,
                     else: right,
                 };
@@ -421,20 +552,43 @@ function lowerExpr(e, binds) {
                     else: { kind: "var", name: "undefined" },
                 };
             }
-            // int + string → NatToString(int) + string (string concatenation)
-            if (e.op === "+" && _opts.backend === "dafny") {
-                const isIntL = e.left.ty.kind === "int" || e.left.ty.kind === "nat";
-                const isIntR = e.right.ty.kind === "int" || e.right.ty.kind === "nat";
-                if (isIntL && e.right.ty.kind === "string") {
-                    return { kind: "binop", op: "+",
-                        left: { kind: "app", fn: "NatToString", args: [lowerExpr(e.left, binds)] },
-                        right: lowerExpr(e.right, binds) };
-                }
-                if (e.left.ty.kind === "string" && isIntR) {
-                    return { kind: "binop", op: "+",
-                        left: lowerExpr(e.left, binds),
-                        right: { kind: "app", fn: "NatToString", args: [lowerExpr(e.right, binds)] } };
-                }
+            // String concatenation: `+` with a string operand. Stringify int/nat
+            // operands (Dafny NatToString, Lean toString) and join with arrayConcat
+            // (rendered `+` in Dafny, `++` in Lean).
+            if (e.op === "+" && (e.left.ty.kind === "string" || e.right.ty.kind === "string")) {
+                const strify = (o) => {
+                    if (o.ty.kind !== "int" && o.ty.kind !== "nat")
+                        return lowerExpr(o, binds);
+                    // Lean `toString` handles any Int; Dafny needs IntToString for signed
+                    // ints (NatToString is nat-only).
+                    const fn = _opts.backend !== "dafny" ? "ToString" : o.ty.kind === "nat" ? "NatToString" : "IntToString";
+                    return { kind: "app", fn, args: [lowerExpr(o, binds)] };
+                };
+                return { kind: "binop", op: "arrayConcat", left: strify(e.left), right: strify(e.right) };
+            }
+            // JS `%` is truncated (sign of the dividend); a signed `int` differs from the
+            // Euclidean `%` of Dafny/Lean, so route it through JSRem (Lean: `Int.tmod`).
+            if (e.op === "%" && e.left.ty.kind === "int") {
+                return { kind: "app", fn: "JSRem", args: [lowerExpr(e.left, binds), lowerExpr(e.right, binds)] };
+            }
+            // JS bigint `/` truncates toward zero (`-3n / 2n === -1n`); it differs from the
+            // floored `/` of Dafny/Lean, so route it through JSTruncDiv (Lean: `Int.tdiv`).
+            if (e.op === "/" && e.ty.kind === "int") {
+                return { kind: "app", fn: "JSTruncDiv", args: [lowerExpr(e.left, binds), lowerExpr(e.right, binds)] };
+            }
+            // JS string ordering is lexicographic vs Dafny's seq prefix order, so route
+            // through JSStringLt. Dafny-only: Lean's native `<` is already lexicographic.
+            if (_opts.backend === "dafny" && ["<", "<=", ">", ">="].includes(e.op) && e.left.ty.kind === "string") {
+                const l = lowerExpr(e.left, binds), r = lowerExpr(e.right, binds);
+                const lt = (x, y) => ({ kind: "app", fn: "JSStringLt", args: [x, y] });
+                const not = (x) => ({ kind: "unop", op: "¬", expr: x });
+                if (e.op === "<")
+                    return lt(l, r);
+                if (e.op === ">")
+                    return lt(r, l);
+                if (e.op === "<=")
+                    return not(lt(r, l));
+                return not(lt(l, r)); // >=
             }
             // Numeric int→real coercion. After resolve, `/` is always real, and any
             // arithmetic/comparison mixing real and integral operands is real-valued.
@@ -550,14 +704,21 @@ function lowerExpr(e, binds) {
                 let method = e.fn.field;
                 const args = e.args.map((a, i) => {
                     const lowered = lowerExpr(a, binds);
-                    // arr.with index (first arg) needs .toNat when Int-typed
-                    if (e.fn.kind === "field" && e.fn.field === "with" && e.fn.obj.ty.kind === "array" && i === 0 && !isNat(a.ty))
+                    // Array index args must be nat in Lean: `with`'s index (0), includes/indexOf `from` (1).
+                    const isArrIdxArg = e.fn.kind === "field" && e.fn.obj.ty.kind === "array" &&
+                        ((e.fn.field === "with" && i === 0) || ((e.fn.field === "includes" || e.fn.field === "indexOf") && i === 1));
+                    if (isArrIdxArg && !isNat(a.ty))
                         return { kind: "toNat", expr: lowered };
                     return lowered;
                 });
-                // arr.concat(otherArr): array argument → real concatenation, not push
-                if (method === "concat" && e.fn.obj.ty.kind === "array" && e.args.length === 1 && e.args[0].ty.kind === "array") {
-                    return { kind: "binop", op: "arrayConcat", left: recv, right: args[0] };
+                // arr.concat(...args): each array arg is spread, each value arg appended.
+                if (method === "concat" && e.fn.obj.ty.kind === "array") {
+                    let acc = recv;
+                    for (let k = 0; k < args.length; k++) {
+                        const piece = e.args[k].ty.kind === "array" ? args[k] : { kind: "arrayLiteral", elems: [args[k]] };
+                        acc = { kind: "binop", op: "arrayConcat", left: acc, right: piece };
+                    }
+                    return acc;
                 }
                 // Spec-context map get: result type is non-optional → direct access
                 if (method === "get" && e.fn.obj.ty.kind === "map" && e.ty.kind !== "optional") {
@@ -676,7 +837,14 @@ function lowerExpr(e, binds) {
                     })),
                 };
             }
-            return { kind: "record", spread: null, fields: e.fields.map(f => ({ name: f.name, value: lowerExpr(f.value, binds) })) };
+            // Carry the resolved record type so the emitter can pick the right
+            // constructor when two datatypes share a field-name set (Event vs
+            // SparseEvent) — structural matching alone would take the first-declared.
+            const recName = e.ty.kind === "user"
+                ? (e.ty.name.includes("<") ? e.ty.name.slice(0, e.ty.name.indexOf("<")) : e.ty.name)
+                : undefined;
+            const ctor = recName && _typeDecls.find(d => d.name === recName && d.kind === "record") ? recName : undefined;
+            return { kind: "record", spread: null, ctor, fields: e.fields.map(f => ({ name: f.name, value: lowerExpr(f.value, binds) })) };
         }
         case "arrayLiteral":
             if (e.ty.kind === "map" && e.elems.length === 0)
@@ -1184,18 +1352,24 @@ function transformStmt(s, typeDecls) {
         case "break": return [{ kind: "break" }];
         case "continue": return [{ kind: "continue" }];
         case "expr": {
-            // Mutating collection call: m.set(k, v) → m := m.set(k, v)
-            // Same for s.add(x) on sets, arr.push(x)
-            if (s.expr.kind === "call" && s.expr.fn.kind === "field" &&
-                s.expr.fn.obj.kind === "var" &&
-                ((s.expr.fn.obj.ty.kind === "map" || s.expr.fn.obj.ty.kind === "set") &&
-                    (s.expr.fn.field === "set" || s.expr.fn.field === "add" || s.expr.fn.field === "delete")) ||
-                (s.expr.kind === "call" && s.expr.fn.kind === "field" &&
-                    s.expr.fn.obj.kind === "var" && s.expr.fn.obj.ty.kind === "array" &&
-                    s.expr.fn.field === "push")) {
-                const receiver = s.expr.fn.obj.name;
-                const { binds, expr } = liftMethodCalls(s.expr);
-                return [...binds, { kind: "assign", target: receiver, value: expr }];
+            // Mutating collection call: m.set(k, v) → m := m.set(k, v) (same for set
+            // .add/.delete and array .push). The receiver may be a bare var, or a
+            // field path rooted at a var (b.items.push(v) → b := b.(items := b.items + [v])).
+            if (s.expr.kind === "call" && s.expr.fn.kind === "field") {
+                const recv = s.expr.fn.obj;
+                const f = s.expr.fn.field;
+                const isMutating = ((recv.ty.kind === "map" || recv.ty.kind === "set") && (f === "set" || f === "add" || f === "delete")) ||
+                    (recv.ty.kind === "array" && f === "push");
+                if (isMutating && recv.kind === "var") {
+                    const { binds, expr } = liftMethodCalls(s.expr);
+                    return [...binds, { kind: "assign", target: recv.name, value: expr }];
+                }
+                if (isMutating && recv.kind === "field") {
+                    const { binds, expr } = liftMethodCalls(s.expr);
+                    const upd = buildNestedFieldUpdate(recv, expr);
+                    if (upd)
+                        return [...binds, { kind: "assign", target: upd.root, value: upd.value }];
+                }
             }
             // Optional chaining on map.get at statement level: m.get(k)?.push(v)
             // → if k in m { m[k] := m[k] + [v] } (actual mutation, not value-discard).
@@ -1514,7 +1688,7 @@ function transformPureBody(stmts, typeDecls) {
                 const elseExpr = transformPureBody(elseStmts, typeDecls);
                 if (!elseExpr)
                     return null;
-                return { kind: "if", cond: transformExpr(s.cond), then: thenExpr, else: elseExpr };
+                return { kind: "if", cond: coerceCondToBool(transformExpr(s.cond), s.cond.ty), then: thenExpr, else: elseExpr };
             }
             case "switch": return transformPureSwitch(s, typeDecls);
             case "someMatch": {
@@ -1798,7 +1972,7 @@ export function transformModule(mod, specImport) {
         else if (fn.forcePure) {
             // //@ pure but body can't be auto-converted — emit function by method
             _forofCounters.clear();
-            const methodBody = transformStmts(fn.body, mod.typeDecls);
+            const methodBody = promoteAssignedLets(transformStmts(fn.body, mod.typeDecls));
             defByMethods.push({
                 kind: "def-by-method",
                 name: fn.name,
@@ -1860,7 +2034,7 @@ export function transformModule(mod, specImport) {
         _forofCounters.clear();
         let body = pureDefNames.has(fn.name)
             ? [{ kind: "return", value: { kind: "app", fn: `Pure.${fn.name}`, args: fn.params.map(p => ({ kind: "var", name: p.name })) } }]
-            : transformStmts(fn.body, mod.typeDecls);
+            : promoteAssignedLets(transformStmts(fn.body, mod.typeDecls));
         // Shadow reassigned parameters with mutable locals
         const paramNames = new Set(fn.params.map(p => p.name));
         const reassigned = findReassignedNames(fn.body, paramNames);
@@ -1878,6 +2052,7 @@ export function transformModule(mod, specImport) {
             returnType: fn.returnTy,
             requires: fn.requires.map(transformExpr),
             ensures,
+            decreases: fn.decreases ? transformExpr(fn.decreases) : null,
             body,
         };
     });
@@ -1886,7 +2061,7 @@ export function transformModule(mod, specImport) {
         const classMethods = cls.methods.map(fn => {
             const ensures = fn.ensures.map(transformExpr);
             _forofCounters.clear();
-            const body = transformStmts(fn.body, mod.typeDecls);
+            const body = promoteAssignedLets(transformStmts(fn.body, mod.typeDecls));
             return {
                 kind: "method",
                 name: fn.name,
@@ -1895,6 +2070,7 @@ export function transformModule(mod, specImport) {
                 returnType: fn.returnTy,
                 requires: fn.requires.map(transformExpr),
                 ensures,
+                decreases: fn.decreases ? transformExpr(fn.decreases) : null,
                 body,
             };
         });