lemmascript 0.5.7 → 0.5.9

package/README.md

@@ -29,7 +29,7 @@ See the external case studies:
 - **[xyflow-lemmascript](https://github.com/midspiral/xyflow-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield verification of [xyflow](https://github.com/xyflow/xyflow)'s core edge and geometry utilities. 9 functions verified: `addEdge` (dedup — never loses edges, adds at most one), `reconnectEdge` (semantic: under a unique-id precondition, the result is in-place — `|result| ≤ |edges|`, no insertion — *and* when a matching edge existed with non-empty new endpoints, the output contains an edge with those endpoints. Uses `//@ assume` to characterize destructuring, `find`, and the constructed edge), `connectionExists`, `getEdgeCenter` (midpoint correctness), `clamp` (bounds), `rectToBox`/`boxToRect` (field arithmetic), `getBoundsOfBoxes` (enclosure), `getOverlappingArea` (non-negative), `areSetsEqual` (subset + same size). 14 Dafny proof obligations. Also adds a new verified feature — a **DAG connection gate**: `canReach` decides reachability soundly *and* completely, and `wouldCreateCycle` gates both new connections and edge reconnections so the graph is proven to stay acyclic, with `isAcyclic` (sound + complete) establishing the base case and a topological-rank witness giving a safe evaluation order (+29 obligations), shown live in a React Flow demo that refuses cycle-closing edges — extending the case study from verifying existing code to adding a verified feature. Dafny only.
 - **[rallly-lemmascript](https://github.com/midspiral/rallly-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield verification of [rallly](https://github.com/lukevella/rallly)'s meeting-poll Next.js app. 2 functions: `validateRedirectUrl` (in-place — open-redirect predicate; non-`undefined` outputs start with `/` but not `//`) and `scorePoll` (extracted ranking core — length preservation, score bounds, top-choice characterization, score-formula equality, within-poll monotonicity, tiebreaker injectivity). The injectivity proof surfaced a real spec-level constraint on the existing `(yes + ifNeedBe) * 1000 + yes` encoding: it overflows when an option has ≥ 1000 yes votes. 10 Dafny VCs, 0 errors. Drove four toolchain additions: `s.startsWith()`, `T | null` nullability, `\result` narrowing under `==>`, `Math.max(...arr)` spread. Dafny only.
 - **[opencode-lemmascript](https://github.com/midspiral/opencode-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield verification of [opencode](https://github.com/anomalyco/opencode)'s permission system and unified-diff patch parser. Highlights: (1) `Patch.parsePatch` carries conservation loop invariants over local ghost state — a parser bug here would silently corrupt user files when an AI applies a patch, and (2) the permission-engine work mechanically closes opencode bug #26514 (subagents bypassing Plan Mode's file-edit restrictions). 9 functions verified in-place, 0 errors. Dafny only.
-- **[pi-lemmascript](https://github.com/midspiral/pi-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield, **in-place** verification of the context-compaction cut-point selector in **pi** (the [earendil-works](https://pi.dev) agent harness). When the context window fills, pi discards history before a chosen cut; a provider API rejects a retained prefix containing an orphaned `toolResult` (a tool result whose tool call was cut away). Both selector functions proven: the cut never lets the kept suffix *start with* — nor *split a tool-use/tool-result run* into — an orphaned tool result, even across the backward metadata snap. The no-orphan result forced the session tree's tool-pairing ordering into an explicit `requires`. 4 VCs, 0 errors. Drove five toolchain additions, headlined by an **opaque fall-through type**: a union LemmaScript can't discriminate (here an array-element union of unreachable imports) becomes a single opaque `type` — the field stays present so distinct values stay distinct, and with no constructor or tag predicate it can only be passed through, never unsoundly observed. Dafny only.
+- **[pi-lemmascript](https://github.com/midspiral/pi-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield, **in-place** verification of the context-compaction cut-point selector in **pi** (the [earendil-works](https://pi.dev) agent harness). When the context window fills, pi discards history before a chosen cut; a provider API rejects a retained prefix containing an orphaned `toolResult` (a tool result whose tool call was cut away). Both selector functions proven: the cut never lets the kept suffix *start with* — nor *split a tool-use/tool-result run* into — an orphaned tool result, even across the backward metadata snap. The no-orphan result forced the session tree's tool-pairing ordering into an explicit `requires`. 4 VCs, 0 errors. Drove five toolchain additions, headlined by an **opaque fall-through type**: a union LemmaScript can't discriminate (here an array-element union of unreachable imports) becomes a single opaque `type` — the field stays present so distinct values stay distinct, and with no constructor or tag predicate it can only be passed through, never unsoundly observed. **Dafny + Lean**: the no-orphan theorem, the changelog semver core, and both tool-output truncators also carry Lean 4 (Velvet/Loom) proofs from the same annotated source, zero `sorry`; the Lean port drove the backend's brownfield batch (cross-file externs, union destructor lowering, Bool-vs-Prop contexts, `return`-in-loop elimination).
 - **[balanced-match-lemmascript](https://github.com/midspiral/balanced-match-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield, **in-place** verification of [balanced-match](https://github.com/juliangruber/balanced-match), the ~70-line balanced-bracket finder pulled in by `npm`, `webpack`, and most of the JS tooling stack (1B+ downloads/month). The stack-based `range` core is verified by **refinement**: a pure recursive spec `range_spec` mirrors the loop one branch per recursive case, so the single equivalence `range == range_spec` transfers every property automatically — including an unconditional Dyck body-balance theorem for the interior of every returned pair. 2233 VCs, 0 errors under `--isolate-assertions` (registered on the `dafny-slow` track). Dafny only.
 - **[guardians-lemmascript](https://github.com/midspiral/guardians-lemmascript)** — greenfield verification of the core safety argument behind [Guardians](https://github.com/metareflection/guardians) (Erik Meijer, "Guardians of the Agents", CACM Jan 2026), a generate-verify-execute checker for AI-agent workflows. Instead of verifying an app, it proves the agent *guardrail itself sound* — that a static taint/automaton check over the real recursive workflow AST can never admit an unsafe plan. Highlights: taint over **nested conditionals** as a sound branch-union over-approximation; per-source **provenance** with a join (a multi-input tool is tainted if *any* input was); **unbounded loops** discharged by a one-step pre-fixpoint (`sat = t0 ‖ bodyTaint(t0)`) that bounds taint over any iteration count without iterating to a fixpoint; and a **unified capstone** (`verifyWfSound`) — one clean verdict rules out, on *every* path, both a tainted-data-to-sink leak and a security-automaton error. 54 Dafny obligations, 0 errors. The verified cores are reached from a Guardians-style `Workflow`/`Policy` through a thin *unverified* adapter, differentially tested against the real Python Guardians (used as the oracle, not a porting target). Dafny only.
 - **[quorum-lemmascript](https://github.com/midspiral/quorum-lemmascript)** — greenfield verified when2meet/Doodle-style group scheduler (React + Cloudflare Durable Objects), with one `domain.ts` running unchanged in the browser, the in-app query, and the server. The standout is that **the proof licenses the architecture**: `countFree` is a homomorphism from participant-list concatenation to integer addition (so the heatmap is order-independent) plus same-participant last-writer-wins convergence — which is exactly what makes the lock-free, no-login, *optimistic* multi-device backend safe, with the Durable Object and the browser applying the **same** verified `applyOp` (server-authoritatively, client-optimistically) with no rollback or operational transform. Also: heatmap is exactly the per-slot count and `isBest` exactly its argmax; monotonicity; invariant-preserving mutations + op-log `replay`; a sparse export codec round-trip; an in-app `whoIsFree(e, s)` whose length provably equals the cell's count; and a separate `grid.ts` proving the `(day, time) → slot` map in-range + injective — which makes specific-dates-vs-days-of-the-week pure shell labeling at zero proof cost; and full element-level permutation invariance (`heatmapPermInvariant` — the heatmap depends only on the *multiset* of participant rows), which drove the `perm(...)` spec predicate into LemmaScript itself. 100 Dafny VCs (90 + 10), 0 errors. The *aggregate* is proven; the React UI, WebSocket/DO I/O, and timezone labeling are the stated trust boundary. Dafny only.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lemmascript",
-  "version": "0.5.7",
+  "version": "0.5.9",
   "description": "A verification toolchain for TypeScript — generates Lean 4 or Dafny from annotated TS",
   "type": "module",
   "engines": {

package/tools/dist/dafny-emit.js

@@ -19,7 +19,11 @@ function tyToDafny(ty) {
         }
         case "user": return ty.name;
         case "fn": return `(${ty.params.map(tyToDafny).join(", ")}) -> ${tyToDafny(ty.result)}`;
-        case "unknown": return "int";
+        // Out-of-subset (`any`/`unknown`); opaque so real ops on it fail loudly
+        // rather than silently verify as `int`. Mirrors the Lean backend's `_`.
+        case "unknown":
+            needPreamble("UnknownType");
+            return "Unknown";
     }
 }
 // ── Dafny keyword escaping ──────────────────────────────────
@@ -159,8 +163,14 @@ function emitExpr(e) {
                 }
                 if (e.method === "push")
                     return `(${obj} + [${args.join(", ")}])`;
+                if (e.method === "unshift")
+                    return `([${args.join(", ")}] + ${obj})`;
                 if (e.method === "concat")
                     return `(${obj} + [${args.join(", ")}])`;
+                if (e.method === "sort") {
+                    needPreamble("SeqSortBy");
+                    return `SeqSortBy(${obj}, ${args[0]})`;
+                }
                 // No-arg slice is a full copy; Dafny seq is an immutable value type, so
                 // the copy is just the seq itself (the idiom for "copy then mutate").
                 if (e.method === "slice" && args.length === 0)
@@ -523,6 +533,9 @@ function emitExpr(e) {
         case "exists": return emitQuantifier(e, "exists");
         case "let": return `(var ${escapeName(e.name)} := ${emitExpr(e.value)}; ${emitExpr(e.body)})`;
         case "havoc": return "*";
+        // No Dafny producer: the only `default` source is the Lean return-in-loop
+        // rewrite, which never runs on the Dafny path (native in-loop returns).
+        case "default": throw new Error("default-value expression not produced on the Dafny path");
     }
 }
 /** Emit a pure expression with indentation for if/match/let. */
@@ -671,7 +684,8 @@ function emitDecl(d) {
             return `datatype ${d.name}${tp} = ${ctors.join(" | ")}`;
         }
         case "structure": {
-            return `datatype ${d.name} = ${d.name}(${paramList(d.fields)})`;
+            const tp = d.typeParams?.length ? `<${d.typeParams.join(", ")}>` : "";
+            return `datatype ${d.name}${tp} = ${d.name}(${paramList(d.fields)})`;
         }
         case "type-alias": {
             return `type ${d.name} = ${tyToDafny(d.target)}`;
@@ -964,6 +978,17 @@ const STRING_SPLIT = `function {:axiom} StringSplit(s: string, d: string): seq<s
   ensures |StringSplit(s, d)| >= 1
   ensures |StringSplit(s, d)| <= |s| + 1
   ensures forall k :: 0 <= k < |StringSplit(s, d)| ==> |StringSplit(s, d)[k]| <= |s|`;
+// `xs.sort(cmp)` in TS sorts in place by a comparator (negative ⟺ a before b).
+// Modeled here as an axiom returning a permutation sorted by cmp. The `requires`
+// is the soundness condition — cmp must be a total preorder, otherwise no sorted
+// permutation exists and the axiom would be vacuous. Callers discharge it (e.g.
+// `(a,b) => a.k - b.k` is total + transitive by linear arithmetic).
+const SEQ_SORT_BY = `function {:axiom} SeqSortBy<T(==,!new)>(s: seq<T>, cmp: (T, T) -> int): seq<T>
+  requires forall a: T, b: T :: cmp(a, b) <= 0 || cmp(b, a) <= 0
+  requires forall a: T, b: T, c: T :: cmp(a, b) <= 0 && cmp(b, c) <= 0 ==> cmp(a, c) <= 0
+  ensures multiset(SeqSortBy(s, cmp)) == multiset(s)
+  ensures |SeqSortBy(s, cmp)| == |s|
+  ensures forall i: int, j: int :: 0 <= i <= j < |SeqSortBy(s, cmp)| ==> cmp(SeqSortBy(s, cmp)[i], SeqSortBy(s, cmp)[j]) <= 0`;
 const STRING_TRIM = `function StringTrimLeft(s: string): string
   ensures |StringTrimLeft(s)| <= |s|
   ensures StringTrimLeft(s) == "" || (|StringTrimLeft(s)| > 0 && StringTrimLeft(s)[0] != ' ')
@@ -1095,6 +1120,9 @@ const SET_TO_SEQ = `method SetToSeq<T>(s: set<T>) returns (res: seq<T>)
 /** Preamble code keyed by name. Emitted in this order when needed. */
 const PREAMBLE_CODE = [
     ["OptionType", "datatype Option<T> = None | Some(value: T)"],
+    // Opaque carrier for `unknown`-typed values. `(==)` for compare/map-key/match;
+    // `(0)` (auto-init ⇒ nonempty) so `havoc` (`:= *`) is well-formed.
+    ["UnknownType", "type Unknown(==, 0)"],
     ["SetToSeq", SET_TO_SEQ],
     ["Pow2", POW2],
     ["BitAnd", BIT_AND],
@@ -1114,6 +1142,7 @@ const PREAMBLE_CODE = [
     ["SafeSlice", SAFE_SLICE],
     ["StringIndexOf", STRING_INDEX_OF],
     ["StringSplit", STRING_SPLIT],
+    ["SeqSortBy", SEQ_SORT_BY],
     ["StringTrim", STRING_TRIM],
     ["StringToLower", STRING_TO_LOWER],
     ["StringToUpper", STRING_TO_UPPER],
@@ -1202,6 +1231,23 @@ export function emitDafnyFile(file, tsFileName, opts) {
     // Track successfully emitted pure defs — method wrappers are only
     // skipped when the corresponding pure def was actually emitted.
     const emittedPureDefs = new Set();
+    // Emit a decl, rolling back any preamble requirements it registered if it
+    // throws. A skipped decl must contribute neither text nor preambles — else a
+    // side-effecting `needPreamble` from a half-emitted decl leaves an unused
+    // preamble (e.g. `type Unknown` from a skipped const whose head is
+    // `unknown`-typed but whose value expr is unsupported).
+    const emitDeclTx = (d) => {
+        const saved = new Set(_neededPreambles);
+        try {
+            return emitDecl(d);
+        }
+        catch (e) {
+            _neededPreambles.clear();
+            for (const k of saved)
+                _neededPreambles.add(k);
+            throw e;
+        }
+    };
     // Emit declarations
     const declLines = [];
     const skipped = [];
@@ -1214,7 +1260,7 @@ export function emitDafnyFile(file, tsFileName, opts) {
             for (const inner of decl.decls) {
                 try {
                     declLines.push("");
-                    declLines.push(emitDecl(inner));
+                    declLines.push(emitDeclTx(inner));
                     if (inner.kind === "def")
                         emittedPureDefs.add(inner.name);
                 }
@@ -1230,7 +1276,7 @@ export function emitDafnyFile(file, tsFileName, opts) {
         }
         try {
             declLines.push("");
-            declLines.push(emitDecl(decl));
+            declLines.push(emitDeclTx(decl));
             if (decl.kind === "def-by-method")
                 emittedPureDefs.add(decl.name);
         }

package/tools/dist/extract.js

@@ -487,9 +487,9 @@ function extractExpr(node) {
     }
     // Object literal: { res: true, done: false } or { ...obj, res: true }
     if (Node.isObjectLiteralExpression(node)) {
-        // Fold properties in source order: a later spread overrides everything before
-        // it, a named field is a record-update on the accumulator, a computed key is a
-        // map `.set`. Order matters: if `a` has `k`, `{ k: v, ...a }` is `a`, not `a.(k := v)`.
+        // Fold properties in source order: a spread on top of existing content is a
+        // field-wise merge (resolve expands it against the result type), a named field
+        // is a record-update on the accumulator, a computed key is a map `.set`.
         let acc = null;
         const update = (name, value) => {
             acc = acc && acc.kind === "record"
@@ -498,7 +498,8 @@ function extractExpr(node) {
         };
         for (const prop of node.getProperties()) {
             if (Node.isSpreadAssignment(prop)) {
-                acc = extractExpr(prop.getExpression());
+                const s = extractExpr(prop.getExpression());
+                acc = acc === null ? s : { kind: "recordMerge", base: acc, override: s };
             }
             else if (Node.isShorthandPropertyAssignment(prop)) {
                 const name = prop.getName();
@@ -985,6 +986,14 @@ function forCounterRename(decl, forStmt) {
     const scopeRoot = fnLike ?? forStmt.getSourceFile();
     const isScope = (a) => Node.isBlock(a) || Node.isSourceFile(a) ||
         Node.isForStatement(a) || Node.isForOfStatement(a) || Node.isForInStatement(a);
+    // A counting-`for` counter is hoisted out of its `for`, so its real scope is
+    // the nearest enclosing block, not the `for` itself.
+    const hoistScope = (d) => {
+        const owner = d.getParent()?.getParent();
+        return owner && Node.isForStatement(owner) && owner.getInitializer() === d.getParent()
+            ? d.getFirstAncestor(a => Node.isBlock(a) || Node.isSourceFile(a))
+            : undefined;
+    };
     // Scopes that enclose this loop — its counter, once hoisted, lives in one of
     // these, so a same-named binding scoped here would collide.
     const enclosing = new Set(forStmt.getAncestors());
@@ -992,6 +1001,11 @@ function forCounterRename(decl, forStmt) {
     const declClash = scopeRoot.getDescendantsOfKind(SyntaxKind.VariableDeclaration).some(d => {
         if (d === decl || d.getName() !== name)
             return false;
+        // Two sibling for-counters hoisting into the same block: rename only the
+        // later loop, so the first keeps its name. Any other clash (e.g. a `let`) yields.
+        const counterScope = hoistScope(d);
+        if (counterScope)
+            return enclosing.has(counterScope) && d.getStart() < decl.getStart();
         const scope = d.getFirstAncestor(isScope);
         return !!scope && enclosing.has(scope);
     });
@@ -1027,6 +1041,7 @@ function renameRawExpr(e, from, to) {
         case "index": return { ...e, obj: r(e.obj), idx: r(e.idx) };
         case "field": return { ...e, obj: r(e.obj) };
         case "record": return { ...e, spread: e.spread ? r(e.spread) : null, fields: e.fields.map(f => ({ ...f, value: r(f.value) })) };
+        case "recordMerge": return { ...e, base: r(e.base), override: r(e.override) };
         case "arrayLiteral": return { ...e, elems: e.elems.map(r) };
         case "conditional": return { ...e, cond: r(e.cond), then: r(e.then), else: r(e.else) };
         case "nullish": return { ...e, left: r(e.left), right: r(e.right) };
@@ -1567,32 +1582,38 @@ function extractStmts(stmts) {
             //      nested loop stays put.
             const stripExitBreaks = (b) => b.filter(st => st.kind !== "break");
             const isExit = (st) => !!st && ["break", "return", "throw", "continue"].includes(st.kind);
-            let fallthrough = [];
-            for (const clause of s.getClauses()) {
-                if (Node.isCaseClause(clause)) {
-                    const label = clause.getExpression().getText().replace(/^["']|["']$/g, "");
-                    if (clause.getStatements().length === 0) {
-                        fallthrough.push(label);
-                        continue;
-                    }
-                    const raw = extractStmts(clause.getStatements());
-                    if (!isExit(raw[raw.length - 1]))
-                        throw new Error(`switch case "${label}" at line ${line}: a non-empty case must end with break/return/throw; fall-through into the next case is not supported`);
-                    const body = stripExitBreaks(raw);
-                    for (const l of fallthrough)
-                        cases.push({ label: l, body });
-                    cases.push({ label, body });
-                    fallthrough = [];
-                }
-                else {
-                    defaultBody = stripExitBreaks(extractStmts(clause.getStatements()));
-                    for (const l of fallthrough)
-                        cases.push({ label: l, body: defaultBody });
-                    fallthrough = [];
+            // Resolve JS fall-through positionally: a clause's effective body is its
+            // own statements concatenated with each following clause's statements up
+            // to and including the first clause that ends in break/return/throw (or
+            // the switch end). This covers both empty stacked labels (`case A: case
+            // B: body`) and a *non-empty* case that falls through (`case A: sA; case
+            // B: ...`) — the stripped breaks are the switch exits.
+            const clauseInfos = s.getClauses().map(clause => {
+                const stmts = extractStmts(clause.getStatements());
+                return {
+                    label: Node.isCaseClause(clause)
+                        ? clause.getExpression().getText().replace(/^["']|["']$/g, "")
+                        : null,
+                    stmts,
+                    exits: isExit(stmts[stmts.length - 1]),
+                };
+            });
+            const fallThroughBody = (start) => {
+                let body = [];
+                for (let j = start; j < clauseInfos.length; j++) {
+                    body = body.concat(clauseInfos[j].stmts);
+                    if (clauseInfos[j].exits)
+                        break;
                 }
+                return stripExitBreaks(body);
+            };
+            for (let i = 0; i < clauseInfos.length; i++) {
+                const c = clauseInfos[i];
+                if (c.label === null)
+                    defaultBody = fallThroughBody(i);
+                else
+                    cases.push({ label: c.label, body: fallThroughBody(i) });
             }
-            for (const l of fallthrough)
-                cases.push({ label: l, body: [] });
             result.push({ kind: "switch", expr: switchExpr, discriminant, cases, defaultBody, line });
             continue;
         }
@@ -1692,17 +1713,21 @@ function extractFunction(fn, parentAnnotations) {
     }
 }
 function extractFunctionInner(fn, parentAnnotations) {
-    // Generic bounds erasure: <T extends Base> → substitute T with Base everywhere
-    // Unbounded type params are preserved as Dafny type parameters
+    // A `<T extends B>` bound is handled one of two ways. When B is a modelable
+    // type (a record/nominal), substitute T with B — a body that reads T's fields
+    // (e.g. `x.id`) then typechecks against B. When B is a union/intersection we
+    // can't model as one Dafny type (e.g. `string & {}` tricks), keep T as a Dafny
+    // type param instead; such a T must be phantom (any field read won't typecheck).
     _typeParamMap = new Map();
     _reservedForCounterNames = new Set();
-    const unboundedTypeParams = [];
+    const typeParams = [];
     for (const tp of fn.getTypeParameters?.() ?? []) {
         const constraint = tp.getConstraint();
-        if (constraint)
+        const ct = constraint?.getType();
+        if (constraint && !ct?.isUnion() && !ct?.isIntersection())
             _typeParamMap.set(tp.getName(), constraint.getText());
         else
-            unboundedTypeParams.push(tp.getName());
+            typeParams.push(tp.getName());
     }
     const body = fn.getBody();
     // Expression-body arrow: wrap in implicit return
@@ -1731,7 +1756,7 @@ function extractFunctionInner(fn, parentAnnotations) {
     return {
         name: fn.getName?.() ?? "<anonymous>",
         exported: false, // set in extractModule against the source file's export surface
-        typeParams: unboundedTypeParams,
+        typeParams,
         // Original TS parameter grouping, before the flatten below loses it. `defaults` carries
         // each bound name's default initializer text (omitted when none) for TS-targeting consumers.
         tsParams: fn.getParameters().map(p => {
@@ -1759,10 +1784,20 @@ function extractFunctionInner(fn, parentAnnotations) {
             const nameNode = p.getNameNode();
             if (Node.isObjectBindingPattern(nameNode)) {
                 const type = p.getType();
+                // `//@ declare-type` types are invisible to the TS checker, so
+                // `type.getProperty` finds nothing for them and the bindings would
+                // collapse to `unknown`. Fall back to the declared record's field types.
+                const declTypeName = p.getTypeNode()?.getText();
+                const declFields = declTypeName
+                    ? _synthArrayUnions?.find(d => d.name === declTypeName && d.kind === "record")?.fields
+                    : undefined;
                 return nameNode.getElements().map(el => {
                     const name = el.getName();
                     const propType = type.getProperty(name)?.getTypeAtLocation(p);
-                    return { name, tsType: propType ? typeToString(propType) : "unknown" };
+                    if (propType)
+                        return { name, tsType: typeToString(propType) };
+                    const declTy = declFields?.find(f => f.name === name)?.tsType;
+                    return { name, tsType: declTy ?? "unknown" };
                 });
             }
             // Syntactic union nodes go through _tsTypeFromUnionNode so synth fires
@@ -1843,15 +1878,17 @@ export function extractModule(sourceFile) {
     // `//@ declare-type Name { f1: T1, ... }` — record form.
     // `//@ declare-type Name = TsType`         — alias form (e.g. `Ruleset = Rule[]`).
     function parseDeclareType(body) {
-        const recordMatch = body.match(/^(\w+)\s*\{(.+)\}$/);
+        const recordMatch = body.match(/^(\w+)\s*(?:<([^>]+)>)?\s*\{(.+)\}$/);
         if (recordMatch) {
             const name = recordMatch[1];
-            const fields = recordMatch[2].split(",").map(f => f.trim()).filter(Boolean).map(f => {
+            // `<T extends B>` → bare `T`: a Dafny type param, like the def path.
+            const typeParams = recordMatch[2]?.split(",").map(s => s.trim().split(/\s+extends\s+/)[0].trim()).filter(Boolean);
+            const fields = recordMatch[3].split(",").map(f => f.trim()).filter(Boolean).map(f => {
                 const [fname, ftype] = f.split(":").map(s => s.trim());
                 const synth = _synthFromTsTypeString(ftype);
                 return { name: fname, tsType: synth ?? ftype };
             });
-            typeDecls.push({ name, kind: "record", fields });
+            typeDecls.push({ name, kind: "record", fields, ...(typeParams?.length ? { typeParams } : {}) });
             return;
         }
         const aliasMatch = body.match(/^(\w+)\s*=\s*(.+)$/);
@@ -2052,7 +2089,8 @@ export function extractModule(sourceFile) {
         const sig = f.node.getType().getCallSignatures()[0];
         if (!sig)
             continue;
-        const typeParams = sig.getTypeParameters().map(tp => tp.getText());
+        // Bare names, dropping `extends B` — same as the def path.
+        const typeParams = sig.getTypeParameters().map(tp => tp.getText().split(/\s+extends\s+/)[0].trim());
         // Normalize via typeToString (not raw getText): resolves declare-type
         // shadows and yields bare names, so a param typed by an unreachable import
         // becomes `AgentMessage`, not `import("/abs/path").AgentMessage`.
@@ -2297,6 +2335,10 @@ export function extractModule(sourceFile) {
                     collectNamesExpr(e.spread);
                 e.fields.forEach(f => collectNamesExpr(f.value));
             }
+            if (e.kind === "recordMerge") {
+                collectNamesExpr(e.base);
+                collectNamesExpr(e.override);
+            }
             if (e.kind === "arrayLiteral") {
                 e.elems.forEach(collectNamesExpr);
             }
@@ -2305,6 +2347,31 @@ export function extractModule(sourceFile) {
                 collectNamesExpr(e.then);
                 collectNamesExpr(e.else);
             }
+            if (e.kind === "nullish") {
+                collectNamesExpr(e.left);
+                collectNamesExpr(e.right);
+            }
+            if (e.kind === "nonNull") {
+                collectNamesExpr(e.expr);
+            }
+            if (e.kind === "optChain") {
+                collectNamesExpr(e.obj);
+                for (const c of e.chain) {
+                    if (c.kind === "call")
+                        c.args.forEach(collectNamesExpr);
+                    if (c.kind === "index")
+                        collectNamesExpr(c.idx);
+                }
+            }
+            if (e.kind === "lambda") {
+                if (Array.isArray(e.body))
+                    collectNames(e.body);
+                else
+                    collectNamesExpr(e.body);
+            }
+            if (e.kind === "forall" || e.kind === "exists") {
+                collectNamesExpr(e.body);
+            }
         }
         // Signature types (params + return) get base-name stripping below; body /
         // spec references stay exact-match (so a body `let xs: Hunk[]` doesn't pull

package/tools/dist/ir.js

@@ -4,4 +4,59 @@
  * The transform phase produces these types.
  * The emit phase pretty-prints them to backend syntax (Lean or Dafny).
  */
-export {};
+export function anyExpr(e, pred) {
+    if (pred(e))
+        return true;
+    switch (e.kind) {
+        case "var":
+        case "num":
+        case "bool":
+        case "str":
+        case "emptyMap":
+        case "emptySet":
+        case "havoc":
+        case "default": return false;
+        case "constructor": return (e.args ?? []).some(a => anyExpr(a, pred));
+        case "binop": return anyExpr(e.left, pred) || anyExpr(e.right, pred);
+        case "unop":
+        case "toNat":
+        case "toReal": return anyExpr(e.expr, pred);
+        case "app": return e.args.some(a => anyExpr(a, pred));
+        case "field": return anyExpr(e.obj, pred);
+        case "index": return anyExpr(e.arr, pred) || anyExpr(e.idx, pred);
+        case "implies": return e.premises.some(p => anyExpr(p, pred)) || anyExpr(e.conclusion, pred);
+        case "record": return (e.spread ? anyExpr(e.spread, pred) : false) || e.fields.some(f => anyExpr(f.value, pred));
+        case "arrayLiteral": return e.elems.some(x => anyExpr(x, pred));
+        case "mapLiteral": return e.entries.some(en => anyExpr(en.key, pred) || anyExpr(en.value, pred));
+        case "methodCall": return anyExpr(e.obj, pred) || e.args.some(a => anyExpr(a, pred));
+        case "lambda": return e.body.some(s => anyExprInStmt(s, pred));
+        case "if": return anyExpr(e.cond, pred) || anyExpr(e.then, pred) || anyExpr(e.else, pred);
+        case "match": return (typeof e.scrutinee !== "string" && anyExpr(e.scrutinee, pred)) || e.arms.some(a => anyExpr(a.body, pred));
+        case "forall":
+        case "exists": return anyExpr(e.body, pred);
+        case "let": return anyExpr(e.value, pred) || anyExpr(e.body, pred);
+    }
+}
+export function anyExprInStmt(s, pred) {
+    switch (s.kind) {
+        case "let":
+        case "assign":
+        case "bind":
+        case "let-bind":
+        case "return":
+        case "ghostLet":
+        case "ghostAssign": return anyExpr(s.value, pred);
+        case "assert": return anyExpr(s.expr, pred);
+        case "break":
+        case "continue": return false;
+        case "if": return anyExpr(s.cond, pred) || anyExprInStmts(s.then, pred) || anyExprInStmts(s.else, pred);
+        case "match": return (typeof s.scrutinee !== "string" && anyExpr(s.scrutinee, pred)) || s.arms.some(a => anyExprInStmts(a.body, pred));
+        case "while": return anyExpr(s.cond, pred) || s.invariants.some(i => anyExpr(i, pred))
+            || (s.decreasing ? anyExpr(s.decreasing, pred) : false) || (s.doneWith ? anyExpr(s.doneWith, pred) : false)
+            || anyExprInStmts(s.body, pred);
+        case "forin": return anyExpr(s.bound, pred) || s.invariants.some(i => anyExpr(i, pred)) || anyExprInStmts(s.body, pred);
+    }
+}
+export function anyExprInStmts(stmts, pred) {
+    return stmts.some(s => anyExprInStmt(s, pred));
+}