lemmascript 0.5.8 → 0.5.9

package/README.md

@@ -29,7 +29,7 @@ See the external case studies:
 - **[xyflow-lemmascript](https://github.com/midspiral/xyflow-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield verification of [xyflow](https://github.com/xyflow/xyflow)'s core edge and geometry utilities. 9 functions verified: `addEdge` (dedup — never loses edges, adds at most one), `reconnectEdge` (semantic: under a unique-id precondition, the result is in-place — `|result| ≤ |edges|`, no insertion — *and* when a matching edge existed with non-empty new endpoints, the output contains an edge with those endpoints. Uses `//@ assume` to characterize destructuring, `find`, and the constructed edge), `connectionExists`, `getEdgeCenter` (midpoint correctness), `clamp` (bounds), `rectToBox`/`boxToRect` (field arithmetic), `getBoundsOfBoxes` (enclosure), `getOverlappingArea` (non-negative), `areSetsEqual` (subset + same size). 14 Dafny proof obligations. Also adds a new verified feature — a **DAG connection gate**: `canReach` decides reachability soundly *and* completely, and `wouldCreateCycle` gates both new connections and edge reconnections so the graph is proven to stay acyclic, with `isAcyclic` (sound + complete) establishing the base case and a topological-rank witness giving a safe evaluation order (+29 obligations), shown live in a React Flow demo that refuses cycle-closing edges — extending the case study from verifying existing code to adding a verified feature. Dafny only.
 - **[rallly-lemmascript](https://github.com/midspiral/rallly-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield verification of [rallly](https://github.com/lukevella/rallly)'s meeting-poll Next.js app. 2 functions: `validateRedirectUrl` (in-place — open-redirect predicate; non-`undefined` outputs start with `/` but not `//`) and `scorePoll` (extracted ranking core — length preservation, score bounds, top-choice characterization, score-formula equality, within-poll monotonicity, tiebreaker injectivity). The injectivity proof surfaced a real spec-level constraint on the existing `(yes + ifNeedBe) * 1000 + yes` encoding: it overflows when an option has ≥ 1000 yes votes. 10 Dafny VCs, 0 errors. Drove four toolchain additions: `s.startsWith()`, `T | null` nullability, `\result` narrowing under `==>`, `Math.max(...arr)` spread. Dafny only.
 - **[opencode-lemmascript](https://github.com/midspiral/opencode-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield verification of [opencode](https://github.com/anomalyco/opencode)'s permission system and unified-diff patch parser. Highlights: (1) `Patch.parsePatch` carries conservation loop invariants over local ghost state — a parser bug here would silently corrupt user files when an AI applies a patch, and (2) the permission-engine work mechanically closes opencode bug #26514 (subagents bypassing Plan Mode's file-edit restrictions). 9 functions verified in-place, 0 errors. Dafny only.
-- **[pi-lemmascript](https://github.com/midspiral/pi-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield, **in-place** verification of the context-compaction cut-point selector in **pi** (the [earendil-works](https://pi.dev) agent harness). When the context window fills, pi discards history before a chosen cut; a provider API rejects a retained prefix containing an orphaned `toolResult` (a tool result whose tool call was cut away). Both selector functions proven: the cut never lets the kept suffix *start with* — nor *split a tool-use/tool-result run* into — an orphaned tool result, even across the backward metadata snap. The no-orphan result forced the session tree's tool-pairing ordering into an explicit `requires`. 4 VCs, 0 errors. Drove five toolchain additions, headlined by an **opaque fall-through type**: a union LemmaScript can't discriminate (here an array-element union of unreachable imports) becomes a single opaque `type` — the field stays present so distinct values stay distinct, and with no constructor or tag predicate it can only be passed through, never unsoundly observed. Dafny only.
+- **[pi-lemmascript](https://github.com/midspiral/pi-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield, **in-place** verification of the context-compaction cut-point selector in **pi** (the [earendil-works](https://pi.dev) agent harness). When the context window fills, pi discards history before a chosen cut; a provider API rejects a retained prefix containing an orphaned `toolResult` (a tool result whose tool call was cut away). Both selector functions proven: the cut never lets the kept suffix *start with* — nor *split a tool-use/tool-result run* into — an orphaned tool result, even across the backward metadata snap. The no-orphan result forced the session tree's tool-pairing ordering into an explicit `requires`. 4 VCs, 0 errors. Drove five toolchain additions, headlined by an **opaque fall-through type**: a union LemmaScript can't discriminate (here an array-element union of unreachable imports) becomes a single opaque `type` — the field stays present so distinct values stay distinct, and with no constructor or tag predicate it can only be passed through, never unsoundly observed. **Dafny + Lean**: the no-orphan theorem, the changelog semver core, and both tool-output truncators also carry Lean 4 (Velvet/Loom) proofs from the same annotated source, zero `sorry`; the Lean port drove the backend's brownfield batch (cross-file externs, union destructor lowering, Bool-vs-Prop contexts, `return`-in-loop elimination).
 - **[balanced-match-lemmascript](https://github.com/midspiral/balanced-match-lemmascript/blob/lemmascript/README_LemmaScript.md)** — brownfield, **in-place** verification of [balanced-match](https://github.com/juliangruber/balanced-match), the ~70-line balanced-bracket finder pulled in by `npm`, `webpack`, and most of the JS tooling stack (1B+ downloads/month). The stack-based `range` core is verified by **refinement**: a pure recursive spec `range_spec` mirrors the loop one branch per recursive case, so the single equivalence `range == range_spec` transfers every property automatically — including an unconditional Dyck body-balance theorem for the interior of every returned pair. 2233 VCs, 0 errors under `--isolate-assertions` (registered on the `dafny-slow` track). Dafny only.
 - **[guardians-lemmascript](https://github.com/midspiral/guardians-lemmascript)** — greenfield verification of the core safety argument behind [Guardians](https://github.com/metareflection/guardians) (Erik Meijer, "Guardians of the Agents", CACM Jan 2026), a generate-verify-execute checker for AI-agent workflows. Instead of verifying an app, it proves the agent *guardrail itself sound* — that a static taint/automaton check over the real recursive workflow AST can never admit an unsafe plan. Highlights: taint over **nested conditionals** as a sound branch-union over-approximation; per-source **provenance** with a join (a multi-input tool is tainted if *any* input was); **unbounded loops** discharged by a one-step pre-fixpoint (`sat = t0 ‖ bodyTaint(t0)`) that bounds taint over any iteration count without iterating to a fixpoint; and a **unified capstone** (`verifyWfSound`) — one clean verdict rules out, on *every* path, both a tainted-data-to-sink leak and a security-automaton error. 54 Dafny obligations, 0 errors. The verified cores are reached from a Guardians-style `Workflow`/`Policy` through a thin *unverified* adapter, differentially tested against the real Python Guardians (used as the oracle, not a porting target). Dafny only.
 - **[quorum-lemmascript](https://github.com/midspiral/quorum-lemmascript)** — greenfield verified when2meet/Doodle-style group scheduler (React + Cloudflare Durable Objects), with one `domain.ts` running unchanged in the browser, the in-app query, and the server. The standout is that **the proof licenses the architecture**: `countFree` is a homomorphism from participant-list concatenation to integer addition (so the heatmap is order-independent) plus same-participant last-writer-wins convergence — which is exactly what makes the lock-free, no-login, *optimistic* multi-device backend safe, with the Durable Object and the browser applying the **same** verified `applyOp` (server-authoritatively, client-optimistically) with no rollback or operational transform. Also: heatmap is exactly the per-slot count and `isBest` exactly its argmax; monotonicity; invariant-preserving mutations + op-log `replay`; a sparse export codec round-trip; an in-app `whoIsFree(e, s)` whose length provably equals the cell's count; and a separate `grid.ts` proving the `(day, time) → slot` map in-range + injective — which makes specific-dates-vs-days-of-the-week pure shell labeling at zero proof cost; and full element-level permutation invariance (`heatmapPermInvariant` — the heatmap depends only on the *multiset* of participant rows), which drove the `perm(...)` spec predicate into LemmaScript itself. 100 Dafny VCs (90 + 10), 0 errors. The *aggregate* is proven; the React UI, WebSocket/DO I/O, and timezone labeling are the stated trust boundary. Dafny only.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lemmascript",
-  "version": "0.5.8",
+  "version": "0.5.9",
   "description": "A verification toolchain for TypeScript — generates Lean 4 or Dafny from annotated TS",
   "type": "module",
   "engines": {

package/tools/dist/dafny-emit.js

@@ -533,6 +533,9 @@ function emitExpr(e) {
         case "exists": return emitQuantifier(e, "exists");
         case "let": return `(var ${escapeName(e.name)} := ${emitExpr(e.value)}; ${emitExpr(e.body)})`;
         case "havoc": return "*";
+        // No Dafny producer: the only `default` source is the Lean return-in-loop
+        // rewrite, which never runs on the Dafny path (native in-loop returns).
+        case "default": throw new Error("default-value expression not produced on the Dafny path");
     }
 }
 /** Emit a pure expression with indentation for if/match/let. */

package/tools/dist/ir.js

@@ -4,4 +4,59 @@
  * The transform phase produces these types.
  * The emit phase pretty-prints them to backend syntax (Lean or Dafny).
  */
-export {};
+export function anyExpr(e, pred) {
+    if (pred(e))
+        return true;
+    switch (e.kind) {
+        case "var":
+        case "num":
+        case "bool":
+        case "str":
+        case "emptyMap":
+        case "emptySet":
+        case "havoc":
+        case "default": return false;
+        case "constructor": return (e.args ?? []).some(a => anyExpr(a, pred));
+        case "binop": return anyExpr(e.left, pred) || anyExpr(e.right, pred);
+        case "unop":
+        case "toNat":
+        case "toReal": return anyExpr(e.expr, pred);
+        case "app": return e.args.some(a => anyExpr(a, pred));
+        case "field": return anyExpr(e.obj, pred);
+        case "index": return anyExpr(e.arr, pred) || anyExpr(e.idx, pred);
+        case "implies": return e.premises.some(p => anyExpr(p, pred)) || anyExpr(e.conclusion, pred);
+        case "record": return (e.spread ? anyExpr(e.spread, pred) : false) || e.fields.some(f => anyExpr(f.value, pred));
+        case "arrayLiteral": return e.elems.some(x => anyExpr(x, pred));
+        case "mapLiteral": return e.entries.some(en => anyExpr(en.key, pred) || anyExpr(en.value, pred));
+        case "methodCall": return anyExpr(e.obj, pred) || e.args.some(a => anyExpr(a, pred));
+        case "lambda": return e.body.some(s => anyExprInStmt(s, pred));
+        case "if": return anyExpr(e.cond, pred) || anyExpr(e.then, pred) || anyExpr(e.else, pred);
+        case "match": return (typeof e.scrutinee !== "string" && anyExpr(e.scrutinee, pred)) || e.arms.some(a => anyExpr(a.body, pred));
+        case "forall":
+        case "exists": return anyExpr(e.body, pred);
+        case "let": return anyExpr(e.value, pred) || anyExpr(e.body, pred);
+    }
+}
+export function anyExprInStmt(s, pred) {
+    switch (s.kind) {
+        case "let":
+        case "assign":
+        case "bind":
+        case "let-bind":
+        case "return":
+        case "ghostLet":
+        case "ghostAssign": return anyExpr(s.value, pred);
+        case "assert": return anyExpr(s.expr, pred);
+        case "break":
+        case "continue": return false;
+        case "if": return anyExpr(s.cond, pred) || anyExprInStmts(s.then, pred) || anyExprInStmts(s.else, pred);
+        case "match": return (typeof s.scrutinee !== "string" && anyExpr(s.scrutinee, pred)) || s.arms.some(a => anyExprInStmts(a.body, pred));
+        case "while": return anyExpr(s.cond, pred) || s.invariants.some(i => anyExpr(i, pred))
+            || (s.decreasing ? anyExpr(s.decreasing, pred) : false) || (s.doneWith ? anyExpr(s.doneWith, pred) : false)
+            || anyExprInStmts(s.body, pred);
+        case "forin": return anyExpr(s.bound, pred) || s.invariants.some(i => anyExpr(i, pred)) || anyExprInStmts(s.body, pred);
+    }
+}
+export function anyExprInStmts(stmts, pred) {
+    return stmts.some(s => anyExprInStmt(s, pred));
+}

package/tools/dist/lean-emit.js

@@ -2,6 +2,7 @@
  * Lean emitter — IR → Lean text.
  * No logic, no type decisions — just serialization.
  */
+import { anyExpr } from "./ir.js";
 // ── Ty → Lean type string ──────────────────────────────────
 function tyToLean(ty) {
     switch (ty.kind) {
@@ -55,7 +56,14 @@ function tyToLean(ty) {
             const retStr = ret.includes(" ") ? `(${ret})` : ret;
             return [...params, retStr].join(" → ");
         }
-        case "unknown": return "_";
+        // Out-of-subset (`any`/`unknown`) — an opaque carrier, so unmodeled payloads
+        // (e.g. a `details` field never inspected by the verified code) pass through
+        // but real ops on them fail loudly. Mirrors the Dafny backend's
+        // `type Unknown(==, 0)`. The decl is emitted once, in the first file that
+        // needs it (the def file imports the types file, so no duplicate).
+        case "unknown":
+            _needsUnknown = true;
+            return "Unknown";
     }
 }
 // ── Lean keyword escaping ────────────────────────────────────
@@ -83,8 +91,119 @@ const PREC = {
     "+": 5, "-": 5, "++": 5, "arrayConcat": 5, "*": 6, "/": 6, "%": 6,
 };
 function prec(op) { return PREC[op] ?? 10; }
-// ── Method call → Lean syntax ───────────────────────────────
+const _unionCtors = new Map();
+// Types that transitively reference an `opaque` type can't derive `Repr` or
+// `DecidableEq` (the opaque type provides neither). `Inhabited` still derives
+// (via the empty array / first constructor), so only those two are dropped.
+// "Unknown" (the `any`/`unknown` carrier) is opaque by construction.
+const _opaqueNames = new Set(["Unknown"]);
+const _typeRefs = new Map();
+const _taintedTypes = new Set();
+function collectUserRefs(ty, into) {
+    switch (ty.kind) {
+        case "array":
+        case "set":
+            collectUserRefs(ty.elem, into);
+            break;
+        case "optional":
+            collectUserRefs(ty.inner, into);
+            break;
+        case "map":
+            collectUserRefs(ty.key, into);
+            collectUserRefs(ty.value, into);
+            break;
+        case "fn":
+            ty.params.forEach(p => collectUserRefs(p, into));
+            collectUserRefs(ty.result, into);
+            break;
+        case "user":
+            into.add(ty.name.includes("<") ? ty.name.slice(0, ty.name.indexOf("<")) : ty.name);
+            break;
+        case "unknown":
+            into.add("Unknown");
+            break;
+    }
+}
+function registerInductives(decls) {
+    for (const d of decls) {
+        if (d.kind === "inductive") {
+            _unionCtors.set(d.name, d.constructors);
+            const refs = new Set();
+            for (const c of d.constructors)
+                for (const f of c.fields)
+                    collectUserRefs(f.type, refs);
+            _typeRefs.set(d.name, refs);
+        }
+        else if (d.kind === "structure") {
+            const refs = new Set();
+            for (const f of d.fields)
+                collectUserRefs(f.type, refs);
+            _typeRefs.set(d.name, refs);
+        }
+        else if (d.kind === "opaque-type") {
+            _opaqueNames.add(d.name);
+        }
+    }
+    // Fixpoint: a type is tainted if it references an opaque or already-tainted type.
+    let changed = true;
+    while (changed) {
+        changed = false;
+        for (const [name, refs] of _typeRefs) {
+            if (_taintedTypes.has(name))
+                continue;
+            if ([...refs].some(r => _opaqueNames.has(r) || _taintedTypes.has(r))) {
+                _taintedTypes.add(name);
+                changed = true;
+            }
+        }
+    }
+}
+/** Deriving clause, dropping `Repr`/`DecidableEq` for opaque-tainted types. */
+function emitDeriving(name, deriving) {
+    const der = _taintedTypes.has(name) ? deriving.filter(x => x !== "Repr" && x !== "DecidableEq") : deriving;
+    return der.length > 0 ? `\nderiving ${der.join(", ")}` : "";
+}
 let _needsJSString = false;
+let _needsUnknown = false;
+let _unknownEmitted = false; // across files in one run — the def file imports the types file
+// Bool-vs-Prop context. Lean keeps `Bool` and `Prop` distinct; the IR uses the
+// Prop connectives (∧/∨/¬) uniformly. In a computational position the connectives
+// may need to be the Bool ones (&&/||/!). They are only *required* when a connective
+// has an operand that does not coerce Bool→Prop — see `needsBoolConnectives`. A body
+// built only from decidable atoms (comparisons, Bool-returning calls) coerces fine
+// and stays in the more proof-friendly Prop form.
+let _boolCtx = false;
+// A Bool-valued atom that does NOT coerce to Prop: an inlined union discriminator
+// (lowered to a match-bool `match x with | .C .. => true | _ => false`) or a raw
+// `match` used as a Bool — neither has a `Decidable` instance Lean can synthesize
+// through the `match`. Under a Prop connective (∧/∨/¬) such an operand is a type
+// error, so its presence forces the whole body to Bool connectives.
+function isNonCoercibleBoolAtom(e) {
+    if (e.kind === "match")
+        return true;
+    if (e.kind === "binop" && (e.op === "=" || e.op === "≠") && e.right.kind === "constructor") {
+        const rhs = e.right; // capture the narrowed node so it survives the closure below
+        const ctor = rhs.type ? _unionCtors.get(rhs.type)?.find(c => c.name === rhs.name) : undefined;
+        return !!ctor && ctor.fields.length > 0;
+    }
+    return false;
+}
+// A ∧/∨/¬ connective with a non-coercible operand — the specific node that would
+// fail to elaborate if emitted in Prop form.
+function connectiveHasNonCoercibleOperand(e) {
+    if (e.kind === "binop" && (e.op === "∧" || e.op === "∨"))
+        return isNonCoercibleBoolAtom(e.left) || isNonCoercibleBoolAtom(e.right);
+    if (e.kind === "unop" && e.op === "¬")
+        return isNonCoercibleBoolAtom(e.expr);
+    return false;
+}
+// True iff some ∧/∨/¬ connective in `e` has a non-coercible operand, i.e. emitting
+// the body with Prop connectives would fail to elaborate. (A decidable atom coerces,
+// so a body with no such operand stays Prop — this keeps arithmetic predicates like
+// `x ≥ 0 ∧ x < n` in `∧` form rather than forcing `&&`.)
+function needsBoolConnectives(e) {
+    return anyExpr(e, connectiveHasNonCoercibleOperand);
+}
 function emitMethodCall(tyKind, method, monadic, obj, args) {
     // Array methods
     if (tyKind === "array") {
@@ -100,10 +219,14 @@ function emitMethodCall(tyKind, method, monadic, obj, args) {
             return args.length > 1 ? `(${obj}.extract ${args[1]} ${obj}.size).contains ${args[0]}` : `${obj}.contains ${args[0]}`;
         if (method === "find")
             return `${obj}.find? ${args[0]}`;
+        if (method === "join")
+            return `(String.intercalate ${args[0]} ${obj}.toList)`;
         if (method === "with")
             return `${obj}.set! ${args[0]} ${args[1]}`;
         if (method === "push")
             return args.length === 1 ? `Array.push ${obj} ${args[0]}` : `${obj} ++ #[${args.join(", ")}]`;
+        if (method === "unshift")
+            return `(#[${args.join(", ")}] ++ ${obj})`;
         if (method === "concat")
             return args.length === 1 ? `Array.push ${obj} ${args[0]}` : `${obj} ++ #[${args.join(", ")}]`;
         // arr.slice → Array.extract. No-arg slice is a full copy (Array is a value
@@ -162,7 +285,8 @@ function wrapOperand(sub, parentPrec) {
 }
 function emitExpr(e, parentPrec) {
     switch (e.kind) {
-        case "var": return escapeName(e.name);
+        // `undefined` is the IR's spelling of the absent optional (mirrors dafny-emit's None)
+        case "var": return e.name === "undefined" ? "none" : escapeName(e.name);
         case "num": return `${e.value}`;
         case "bool": return e.value ? "true" : "false";
         case "str": return `"${e.value.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\n/g, '\\n')}"`;
@@ -183,6 +307,7 @@ function emitExpr(e, parentPrec) {
             return `#[${e.elems.map(el => emitExpr(el)).join(", ")}]`;
         case "emptyMap": return `Std.HashMap.empty`;
         case "emptySet": return `Std.HashSet.empty`;
+        case "default": return `(default : ${tyToLean(e.type)})`;
         case "methodCall": {
             const obj = emitExpr(e.obj);
             const wrap = e.obj.kind === "binop" || e.obj.kind === "app" || e.obj.kind === "methodCall" || e.obj.kind === "if" || e.obj.kind === "let";
@@ -201,11 +326,25 @@ function emitExpr(e, parentPrec) {
         }
         case "unop":
             if (e.op === "¬")
-                return `¬(${emitExpr(e.expr)})`;
+                return _boolCtx ? `!(${emitExpr(e.expr)})` : `¬(${emitExpr(e.expr)})`;
             if (e.op === "-" && e.expr.kind === "num")
                 return `-${e.expr.value}`;
             return `(-${emitExpr(e.expr)})`;
         case "binop": {
+            // Discriminator test against a constructor that carries fields:
+            // `x = .Ctor` → `(match x with | .Ctor .. => true | _ => false)`. A
+            // multi-field constructor is a function, not a value, so a bare
+            // `x = Type.Ctor` is ill-typed. The Bool result coerces to Prop in spec
+            // positions, mirroring how the backend already treats decidable atoms.
+            // Nullary constructors (enums) keep the cheap `DecidableEq` comparison.
+            if ((e.op === "=" || e.op === "≠") && e.right.kind === "constructor") {
+                const rhs = e.right; // capture the narrowed node so it survives into the closure below
+                const ctor = rhs.type ? _unionCtors.get(rhs.type)?.find(c => c.name === rhs.name) : undefined;
+                if (ctor && ctor.fields.length > 0) {
+                    const [yes, no] = e.op === "=" ? ["true", "false"] : ["false", "true"];
+                    return `(match ${emitExpr(e.left)} with | .${escapeName(rhs.name)} .. => ${yes} | _ => ${no})`;
+                }
+            }
             // `k in m` (map/set membership) → `m.contains k` in Lean. Dafny has
             // native `in`; Lean uses the method form for HashMap/HashSet.
             if (e.op === "in") {
@@ -213,7 +352,10 @@ function emitExpr(e, parentPrec) {
                 const wrap = e.right.kind === "binop" || e.right.kind === "app" || e.right.kind === "methodCall";
                 return `${wrap ? `(${recv})` : recv}.contains ${emitExpr(e.left)}`;
             }
-            const op = e.op === "arrayConcat" ? "++" : e.op;
+            const op = e.op === "arrayConcat" ? "++"
+                : _boolCtx && e.op === "∧" ? "&&"
+                    : _boolCtx && e.op === "∨" ? "||"
+                        : e.op;
             // ↔ does not chain in Lean — a nested iff operand needs parens.
             const childPrec = e.op === "↔" ? prec(e.op) + 1 : prec(e.op);
             // `-`, `/`, `%` are left-associative and non-associative, so an equal-
@@ -241,6 +383,12 @@ function emitExpr(e, parentPrec) {
             // the bare form, so its output is unaffected.)
             if (e.ctorOf)
                 return args.length ? `${e.ctorOf}.${e.fn} ${args.join(" ")}` : `${e.ctorOf}.${e.fn}`;
+            // Option constructors arrive Dafny-spelled from transform (`app "Some"`);
+            // Lean core exports the lowercase forms as top-level names.
+            if (e.fn === "Some" && args.length === 1)
+                return `some ${args[0]}`;
+            if (e.fn === "None" && args.length === 0)
+                return `none`;
             // SetToSeq → .toArray for Lean (HashSet has native toArray)
             if (e.fn === "SetToSeq" && args.length === 1)
                 return `${args[0]}.toArray`;
@@ -263,6 +411,24 @@ function emitExpr(e, parentPrec) {
             return `${e.fn} ${args.join(" ")}`;
         }
         case "field": {
+            // Union destructor (tagged by transform): `x.field` where x is a
+            // multi-constructor inductive. Lean has no projection there, so match the
+            // owning constructor, bind the field positionally, and ignore the rest.
+            // Other constructors fall to `default` — the source guards every such
+            // access with a discriminator test, so that branch is never reached.
+            if (e.fromUnion) {
+                const ctors = _unionCtors.get(e.fromUnion);
+                // Pin the owning ctor when given (field names repeat across variants);
+                // otherwise fall back to the sole variant carrying this field name.
+                const owner = (e.ctor ? ctors?.find(c => c.name === e.ctor) : undefined)
+                    ?? ctors?.find(c => c.fields.some(f => f.name === e.field));
+                if (owner) {
+                    const idx = owner.fields.findIndex(f => f.name === e.field);
+                    const pats = owner.fields.map((_, i) => (i === idx ? "_v" : "_")).join(" ");
+                    const fty = tyToLean(owner.fields[idx].type);
+                    return `(match ${emitExpr(e.obj)} with | .${escapeName(owner.name)} ${pats} => _v | _ => (default : ${fty}))`;
+                }
+            }
             const obj = emitExpr(e.obj);
             if (e.field === "collectionSize")
                 return `${obj}.size`;
@@ -328,10 +494,19 @@ function emitStmts(stmts, indent) {
 function emitStmt(s, indent) {
     const pad = "  ".repeat(indent);
     switch (s.kind) {
-        case "let":
-            return s.mutable
-                ? `${pad}let mut ${escapeName(s.name)} : ${tyToLean(s.type)} := ${emitExpr(s.value)}`
-                : `${pad}let ${escapeName(s.name)} := ${emitExpr(s.value)}`;
+        case "let": {
+            // `mut` lets always carry their type (assignments must re-elaborate at it).
+            // Immutable lets are ascribed only when the initializer is a `match` (the
+            // `??` / Option-unwrap lowerings): Velvet's WP elaboration runs *backwards*,
+            // so without the ascription the binding's type is a metavariable that a
+            // later use pins first — e.g. `lines.size ≤ maxLines` pins `maxLines : ℕ`
+            // and the ℤ-valued unwrap arms then fail to elaborate. Other initializer
+            // shapes determine their own type, and leaving them bare keeps previously
+            // generated (and proven) artifacts byte-stable.
+            const ascribe = s.mutable || s.value.kind === "match";
+            const ty = ascribe && s.type.kind !== "unknown" ? ` : ${tyToLean(s.type)}` : "";
+            return `${pad}let ${s.mutable ? "mut " : ""}${escapeName(s.name)}${ty} := ${emitExpr(s.value)}`;
+        }
         case "assign": return `${pad}${escapeName(s.target)} := ${emitExpr(s.value)}`;
         case "ghostLet":
             return `${pad}let mut ${escapeName(s.name)} : ${tyToLean(s.type)} := ${emitExpr(s.value)}`;
@@ -344,7 +519,10 @@ function emitStmt(s, indent) {
             // to WPGen.default, which drops the assertion. Coerce to Prop via `= true`.
             // Top-level Prop constructs (`=`, `<`, `∧`, `¬`, `∀`, `∃`, `→`) already
             // land in Prop — Lean auto-coerces inner Bools there.
+            const prevBoolCtx = _boolCtx;
+            _boolCtx = false; // assertions are Prop
             const inner = emitExpr(s.expr);
+            _boolCtx = prevBoolCtx;
             const wrapped = isPropValued(s.expr) ? inner : `(${inner}) = true`;
             return `${pad}assertGadget (${wrapped})`;
         }
@@ -411,21 +589,30 @@ function emitStmt(s, indent) {
             return lines.join("\n");
         }
         case "while": {
+            // Guard is computational (Bool); invariants / done_with are Prop.
             const lines = [`${pad}while ${emitExpr(s.cond)}`];
+            const prevBoolCtx = _boolCtx;
+            _boolCtx = false;
             for (const inv of s.invariants)
                 lines.push(`${pad}  invariant ${emitExpr(inv)}`);
+            // `done_with True` (the auto-supplied fact for breaking loops) is a Prop;
+            // the bool literal would need a coercion, so emit the Prop `True` directly.
             if (s.doneWith)
-                lines.push(`${pad}  done_with ${emitExpr(s.doneWith)}`);
+                lines.push(`${pad}  done_with ${s.doneWith.kind === "bool" && s.doneWith.value ? "True" : emitExpr(s.doneWith)}`);
             if (s.decreasing)
                 lines.push(`${pad}  decreasing ${emitExpr(s.decreasing)}`);
+            _boolCtx = prevBoolCtx;
             lines.push(`${pad}do`);
             lines.push(emitStmts(s.body, indent + 1));
             return lines.join("\n");
         }
         case "forin": {
             const lines = [`${pad}for ${s.idx} in [:${emitExpr(s.bound)}]`];
+            const prevBoolCtx = _boolCtx;
+            _boolCtx = false; // invariants are Prop
             for (const inv of s.invariants)
                 lines.push(`${pad}  invariant ${emitExpr(inv)}`);
+            _boolCtx = prevBoolCtx;
             lines.push(`${pad}do`);
             lines.push(emitStmts(s.body, indent + 1));
             return lines.join("\n");
@@ -446,17 +633,13 @@ function emitDecl(d) {
                     lines.push(`  | ${c.name} ${params} : ${d.name}`);
                 }
             }
-            if (d.deriving.length > 0)
-                lines.push(`deriving ${d.deriving.join(", ")}`);
-            return lines.join("\n");
+            return lines.join("\n") + emitDeriving(d.name, d.deriving);
         }
         case "structure": {
             const lines = [`structure ${d.name} where`];
             for (const f of d.fields)
                 lines.push(`  ${escapeName(f.name)} : ${tyToLean(f.type)}`);
-            if (d.deriving.length > 0)
-                lines.push(`deriving ${d.deriving.join(", ")}`);
-            return lines.join("\n");
+            return lines.join("\n") + emitDeriving(d.name, d.deriving);
         }
         case "type-alias": {
             return `abbrev ${d.name} := ${tyToLean(d.target)}`;
@@ -467,7 +650,17 @@ function emitDecl(d) {
         }
         case "def": {
             const params = d.params.map(p => `(${escapeName(p.name)} : ${tyToLean(p.type)})`).join(" ");
-            let out = `def ${d.name} ${params} : ${tyToLean(d.returnType)} :=\n${emitPureExpr(d.body, 1)}`;
+            // A Bool-returning pure function is a computation, not a proposition, so its
+            // connectives *may* need the Bool operators (&&/||/!) — but only when a
+            // connective has a non-coercible operand (e.g. an inlined union discriminator).
+            // A predicate built from decidable atoms (`x ≥ 0 ∧ x < n`) coerces to Bool as
+            // a whole and stays in the more proof-friendly Prop form. Other return types
+            // only have connectives inside (Decidable) conditions, where Prop is fine.
+            const prevBoolCtx = _boolCtx;
+            _boolCtx = tyToLean(d.returnType) === "Bool" && needsBoolConnectives(d.body);
+            const body = emitPureExpr(d.body, 1);
+            _boolCtx = prevBoolCtx;
+            let out = `def ${d.name} ${params} : ${tyToLean(d.returnType)} :=\n${body}`;
             // A `//@ decreases` on a pure function marks it recursive and names its
             // termination measure — emit it as Lean's `termination_by`. This is
             // required when the recursion is on `arr.slice(...)` (→ `Array.extract`,
@@ -484,13 +677,18 @@ function emitDecl(d) {
             throw new Error("function by method is not supported for Lean backend");
         case "method": {
             const params = d.params.map(p => `(${escapeName(p.name)} : ${tyToLean(p.type)})`).join(" ");
+            // Spec clauses are Prop; the `do` body is computational (Bool).
+            const prevBoolCtx = _boolCtx;
+            _boolCtx = false;
             const lines = [`method ${d.name} ${params} return (res : ${tyToLean(d.returnType)})`];
             for (const r of d.requires)
                 lines.push(`  require ${emitExpr(r)}`);
             for (const e of d.ensures)
                 lines.push(`  ensures ${emitExpr(e)}`);
             lines.push("  do");
+            _boolCtx = true;
             lines.push(emitStmts(d.body, 2));
+            _boolCtx = prevBoolCtx;
             return lines.join("\n");
         }
         case "namespace": {
@@ -504,10 +702,25 @@ function emitDecl(d) {
             throw new Error(`Lean class support not yet implemented: ${d.name}`);
         case "const":
             return `def ${escapeName(d.name)} : ${tyToLean(d.type)} := ${emitExpr(d.value)}`;
-        case "extern":
-            // Lean: emit an opaque function declaration. The user is expected to
-            // provide an axiomatic body or a stub in the companion spec file.
-            throw new Error(`Lean extern support not yet implemented: ${d.name}`);
+        case "extern": {
+            // Mirror Dafny's `function {:axiom}`: an uninterpreted total function.
+            // In Lean that is an `opaque` declaration (sound — it commits to no body,
+            // only to the type being inhabited). Any `requires`/`ensures` the source
+            // carried become a characterizing `axiom`; `\result` was already replaced
+            // by the call expression in the transform, so ensures reference `name args`.
+            const tp = d.typeParams.length > 0 ? ` {${d.typeParams.join(" ")} : Type}` : "";
+            const params = d.params.map(p => `(${escapeName(p.name)} : ${tyToLean(p.type)})`).join(" ");
+            const sig = `opaque ${escapeName(d.name)}${tp}${params ? ` ${params}` : ""} : ${tyToLean(d.returnType)}`;
+            if (d.requires.length === 0 && d.ensures.length === 0)
+                return sig;
+            // Spec axiom: ∀ params, req1 → … → (ens1 ∧ … ∧ ensN). Tagged `@[grind]` so
+            // the proof automation can use it, matching the ghost-function convention.
+            const hyps = d.requires.map(emitExpr);
+            const concl = d.ensures.map(emitExpr).join(" ∧ ");
+            const axBody = [...hyps, concl].join(" → ");
+            const axiom = `@[grind] axiom ${escapeName(d.name)}_spec${params ? ` ${params}` : ""} : ${axBody}`;
+            return `${sig}\n${axiom}`;
+        }
     }
 }
 /** Emit a pure expression with indented if/match blocks. */
@@ -533,12 +746,19 @@ function emitPureExpr(e, indent) {
 // ── File emission ────────────────────────────────────────────
 export function emitLeanFile(file) {
     _needsJSString = false;
-    // Emit declarations first so _needsJSString is set
+    _needsUnknown = false;
+    registerInductives(file.decls);
+    // Emit declarations first so _needsJSString / _needsUnknown are set
     const declLines = [];
     for (const decl of file.decls) {
         declLines.push("");
         declLines.push(emitDecl(decl));
     }
+    // The `unknown` carrier must precede every use (Lean is definition-before-use).
+    if (_needsUnknown && !_unknownEmitted) {
+        declLines.unshift("", "/-- Opaque carrier for `unknown`-typed values (mirrors Dafny's `type Unknown(==, 0)`). -/", "opaque Unknown : Type");
+        _unknownEmitted = true;
+    }
     const lines = [];
     if (file.comment) {
         lines.push("/-");

package/tools/dist/lsc.js

@@ -82,6 +82,13 @@ function main() {
     }
     // File-level directives consumed by the Dafny emitter.
     const safeSlice = /\/\/@ safe-slice\b/.test(fullText);
+    // `//@ lean-module <name>` overrides the Lean module base (default: file
+    // basename). Lean module names are flat/global, so two identically-named
+    // `.ts` files (e.g. an in-place fork's duplicated `compaction.ts`) would emit
+    // colliding `foo.types`/`foo.def` modules; this gives one a distinct base so
+    // both can be separate Lean libraries. Lean-only — Dafny is unaffected.
+    const leanModuleDirective = fullText.match(/\/\/@ lean-module ([A-Za-z0-9_.\-]+)/);
+    const leanModuleOverride = leanModuleDirective ? leanModuleDirective[1] : undefined;
     // Extract: ts-morph → Raw IR
     const raw = extractModule(sourceFile);
     if (cmd === "extract") {
@@ -140,15 +147,16 @@ function main() {
         process.exit(1);
     }
     // ── Lean backend ──────────────────────────────────────────
-    const specPath = path.join(dir, `${base}.spec.lean`);
-    const specImport = existsSync(specPath) ? `«${base}.spec»` : undefined;
-    let { typesFile, defFile } = transformModuleLean(typed, specImport);
+    const leanBase = leanModuleOverride ?? base;
+    const specPath = path.join(dir, `${leanBase}.spec.lean`);
+    const specImport = existsSync(specPath) ? `«${leanBase}.spec»` : undefined;
+    let { typesFile, defFile } = transformModuleLean(typed, specImport, leanModuleOverride);
     if (typesFile)
         typesFile = peepholeModule(typesFile, "lean");
     defFile = peepholeModule(defFile, "lean");
-    const typesPath = typesFile ? path.join(dir, `${base}.types.lean`) : null;
+    const typesPath = typesFile ? path.join(dir, `${leanBase}.types.lean`) : null;
     const typesText = typesFile ? emitLeanFile(typesFile) : null;
-    const defPath = path.join(dir, `${base}.def.lean`);
+    const defPath = path.join(dir, `${leanBase}.def.lean`);
     const defText = emitLeanFile(defFile);
     if (cmd === "gen") {
         leanGen(typesPath, defPath, typesText, defText);
@@ -156,7 +164,7 @@ function main() {
     }
     if (cmd === "check") {
         leanGen(typesPath, defPath, typesText, defText);
-        if (!leanCheck(dir, base))
+        if (!leanCheck(dir, leanBase))
             process.exit(1);
         return;
     }

package/tools/dist/narrow.js

@@ -144,7 +144,7 @@ function walkStmt(s) {
     // array rule fires; independent narrows commute, so the order is harmless.)
     // && rules fire before the simple rule because they produce nested ifs whose
     // inner shape doesn't match the simple rule directly.
-    return ruleIfAndOptional(r) ?? ruleIfAndArrayIsArray(r) ?? ruleIfOptionalSimple(r) ?? r;
+    return ruleIfAndOptional(r) ?? ruleIfAndArrayIsArray(r) ?? ruleIfOptionalSimple(r) ?? ruleExprStmtAndOptional(r) ?? r;
 }
 function walkStmts(stmts) {
     const result = [];
@@ -653,6 +653,38 @@ function ruleIfAndOptional(s) {
         noneBody: [],
     };
 }
+/** Rule: a bare expression statement `x !== undefined && rest` (the `if`-less
+ *  guard idiom, TS-equivalent to `if (x !== undefined) rest;`) where `x` is a
+ *  pure access path.
+ *  → `someMatch x { Some(_x_val) => rest;, None => {} }`.
+ *  Runs `rest` for effect inside the narrowed scope. Wrapping `rest` as an
+ *  expr-statement and walking it lets chained checks
+ *  (`a !== undefined && a.b !== undefined && a.b.f()`) nest into someMatches.
+ *  Unlike the ternary rule (`ruleConditionalAndOptional`), a method call in
+ *  `rest` is fine here: a statement-level someMatch arm keeps it in statement
+ *  position, so transform never ANF-lifts it out of the arm (which would drop
+ *  the guard and reference the un-narrowed optional). */
+function ruleExprStmtAndOptional(s) {
+    if (s.kind !== "expr")
+        return null;
+    if (s.expr.kind !== "binop" || s.expr.op !== "&&")
+        return null;
+    const extracted = extractLeftmostOptionalCheck(s.expr);
+    if (!extracted)
+        return null;
+    const { check, restCond } = extracted;
+    const innerStmt = { kind: "expr", expr: restCond };
+    const someBody = canBeFalsy(check)
+        ? [{ kind: "if", cond: bound(check), then: [walkStmt(innerStmt)], else: [] }]
+        : [walkStmt(innerStmt)];
+    return {
+        kind: "someMatch",
+        scrutinee: check.scrutinee, binderTy: check.innerTy,
+        binder: check.binderHint,
+        someBody,
+        noneBody: [],
+    };
+}
 // ── Discriminant narrowing ──────────────────────────────────
 /** Detect `Array.isArray(<path>)` where `<path>` is a var or a chain of
  *  field accesses rooted at a var, and the path's type is a synthesized

package/tools/dist/peephole.js

@@ -13,6 +13,7 @@ function mapExpr(e, f) {
         case "emptyMap":
         case "emptySet":
         case "havoc":
+        case "default":
         case "mapLiteral": return e;
         case "binop": return { ...e, left: r(e.left), right: r(e.right) };
         case "unop": return { ...e, expr: r(e.expr) };
@@ -358,6 +359,7 @@ function rewriteChildrenExpr(e) {
         case "emptyMap":
         case "emptySet":
         case "havoc":
+        case "default":
         case "mapLiteral": return e;
         case "binop": return { ...e, left: r(e.left), right: r(e.right) };
         case "unop": return { ...e, expr: r(e.expr) };

package/tools/dist/transform.js

@@ -4,6 +4,7 @@
  * Consumes resolved types and classifications.
  * No type lookups, no string parsing, no re-inference.
  */
+import { anyExprInStmts } from "./ir.js";
 import { parseTsType } from "./types.js";
 // ── Generic IR walkers ──────────────────────────────────────
 /**
@@ -23,7 +24,8 @@ function mapExpr(e, f) {
         case "str":
         case "emptyMap":
         case "emptySet":
-        case "havoc": return e;
+        case "havoc":
+        case "default": return e;
         case "mapLiteral": return { ...e, entries: e.entries.map(en => ({ key: r(en.key), value: r(en.value) })) };
         case "constructor": return e.args ? { ...e, args: e.args.map(r) } : e;
         case "binop": return { ...e, left: r(e.left), right: r(e.right) };
@@ -630,6 +632,17 @@ function lowerExpr(e, binds) {
                     return { kind: "field", obj: transformExpr(e.obj), field: "true_?" };
                 }
             }
+            // Union destructor: `x.field` where x is a discriminated union and `field`
+            // is a data field of one of its variants. Dafny reads the destructor
+            // directly; Lean has no field projection on a multi-ctor inductive, so tag
+            // the node with the union's base name and let the Lean emitter `match`.
+            if (e.obj.ty.kind === "user") {
+                const baseName = e.obj.ty.name.includes("<") ? e.obj.ty.name.slice(0, e.obj.ty.name.indexOf("<")) : e.obj.ty.name;
+                const decl = _typeDecls.find(d => d.name === baseName && d.kind === "discriminated-union");
+                if (decl?.variants?.some(v => v.fields.some(f => f.name === e.field))) {
+                    return { kind: "field", obj: transformExpr(e.obj), field: e.field, fromUnion: baseName };
+                }
+            }
             return { kind: "field", obj: transformExpr(e.obj), field: e.field };
         case "index": {
             const idx = transformExpr(e.idx);
@@ -1106,6 +1119,188 @@ function buildPopLowering(arrName, arrTy) {
     const guardedTrunc = { kind: "if", cond: isNonEmpty, then: truncated, else: arrVar };
     return { optValue, guardedTrunc };
 }
+/**
+ * Velvet (Lean backend) rejects `return` inside a loop. For a function shaped as
+ * `…; while (…) { … early returns … }; return fallthrough`, hoist a mutable
+ * result variable: each in-loop `return e` becomes `_loopRet := e; break`, then
+ * `return _loopRet` after the loop. The trailing fallthrough return seeds
+ * `_loopRet`, so a normal loop exit returns it unchanged. Dafny is untouched —
+ * it keeps the native early returns.
+ */
+function stmtsContainReturn(stmts) {
+    for (const s of stmts) {
+        if (s.kind === "return")
+            return true;
+        if (s.kind === "if" && (stmtsContainReturn(s.then) || stmtsContainReturn(s.else)))
+            return true;
+        if (s.kind === "match" && s.arms.some(a => stmtsContainReturn(a.body)))
+            return true;
+        // Don't descend into a nested while — its returns would target that loop.
+    }
+    return false;
+}
+function replaceReturnsWithBreak(stmts, retVar) {
+    return stmts.flatMap((s) => {
+        if (s.kind === "return")
+            return [{ kind: "assign", target: retVar, value: s.value }, { kind: "break" }];
+        if (s.kind === "if")
+            return [{ ...s, then: replaceReturnsWithBreak(s.then, retVar), else: replaceReturnsWithBreak(s.else, retVar) }];
+        if (s.kind === "match")
+            return [{ ...s, arms: s.arms.map(a => ({ ...a, body: replaceReturnsWithBreak(a.body, retVar) })) }];
+        return [s];
+    });
+}
+// Seed value for `_loopRet` when a return-in-loop function has no trailing
+// fallthrough return. Readable literals for the primitives; everything else
+// (user types, arrays, maps, optionals) gets a typed `default : T` rather than a
+// type-incorrect `0` — these types derive `Inhabited`, so the default exists.
+function defaultExprForTy(ty) {
+    switch (ty.kind) {
+        case "bool": return { kind: "bool", value: false };
+        case "string": return { kind: "str", value: "" };
+        case "nat":
+        case "int":
+        case "real": return { kind: "num", value: 0 };
+        default: return { kind: "default", type: ty };
+    }
+}
+function eliminateReturnInLoops(stmts, retTy, resultInvariants) {
+    const out = [];
+    for (let i = 0; i < stmts.length; i++) {
+        const s = stmts[i];
+        if (s.kind === "while" && stmtsContainReturn(s.body)) {
+            const retVar = "_loopRet";
+            const next = stmts[i + 1];
+            const init = next && next.kind === "return" ? next.value : defaultExprForTy(retTy);
+            out.push({ kind: "let", name: retVar, type: retTy, mutable: true, value: init });
+            // The result variable carries the postcondition (the function's `ensures`
+            // with `\result` → `_loopRet`) as a loop invariant: it holds initially (the
+            // fallthrough seed) and after each `_loopRet := e; break`, so the
+            // postcondition is re-established from the invariant when the loop exits.
+            // Where Dafny discharged the postcondition at each `return` site, the
+            // break-rewrite discharges it once, after the loop.
+            out.push({ ...s, invariants: [...s.invariants, ...resultInvariants], body: replaceReturnsWithBreak(s.body, retVar) });
+            out.push({ kind: "return", value: { kind: "var", name: retVar } });
+            if (next && next.kind === "return")
+                i++; // consume the seeded fallthrough return
+        }
+        else {
+            out.push(s);
+        }
+    }
+    return out;
+}
+/** True if `name` is referenced as a variable anywhere in `stmts`. Conservative:
+ *  counts every occurrence and ignores shadowing — a spurious hit only costs an
+ *  unused `let`, whereas a miss would leave a binder unbound. */
+function stmtsUseVar(stmts, name) {
+    return anyExprInStmts(stmts, e => e.kind === "var" && e.name === name);
+}
+/**
+ * Velvet (Lean backend) cannot synthesize a `WPGen` for a monadic statement
+ * `match` on a user inductive in a method body (loom's matcher-WPGen drops a
+ * `sorry`). loom *can* handle method-body `if`s (cf. examples/arrayEquals), so
+ * lower such matches to discriminator `if`-chains: `match x with | .C f.. => B`
+ * becomes `if x.C? then (let f := x.f-destructor; B) else …`. Constructor field
+ * binders become `let`s bound to the (already-supported) union destructor. Option
+ * matches and other non-user matches are left alone (loom handles those). Dafny
+ * is untouched — it keeps the native match.
+ */
+function matchToIfChains(stmts) {
+    return stmts.flatMap((s) => {
+        if (s.kind === "if")
+            return [{ ...s, then: matchToIfChains(s.then), else: matchToIfChains(s.else) }];
+        if (s.kind === "while")
+            return [{ ...s, body: matchToIfChains(s.body) }];
+        if (s.kind === "forin")
+            return [{ ...s, body: matchToIfChains(s.body) }];
+        if (s.kind !== "match")
+            return [s];
+        const arms = s.arms.map(a => ({ ...a, body: matchToIfChains(a.body) }));
+        const ctorArms = arms.filter(a => a.pattern.trim() !== "_");
+        const firstCtor = ctorArms[0]?.pattern.trim().split(/\s+/)[0].replace(/^\./, "");
+        const decl = firstCtor
+            ? _typeDecls.find(d => (d.kind === "discriminated-union" || d.kind === "string-union") &&
+                ((d.variants?.some(v => v.name === firstCtor)) || (d.values?.includes(firstCtor))))
+            : undefined;
+        if (!decl)
+            return [{ ...s, arms }]; // not a user union (e.g. Option) — leave as match
+        const scrutExpr = typeof s.scrutinee === "string" ? { kind: "var", name: s.scrutinee } : s.scrutinee;
+        const defaultArm = arms.find(a => a.pattern.trim() === "_");
+        let elseBranch = defaultArm ? defaultArm.body : [];
+        for (let k = ctorArms.length - 1; k >= 0; k--) {
+            const armBody = ctorArms[k].body;
+            if (armBody.length === 0)
+                continue; // empty arm (no-op) — let it fall through to `else`
+            const toks = ctorArms[k].pattern.trim().split(/\s+/);
+            const ctor = toks[0].replace(/^\./, "");
+            const binders = toks.slice(1);
+            const variant = decl.variants?.find(v => v.name === ctor);
+            // Discriminator condition. A nullary discriminated-union constructor would
+            // need `DecidableEq` for `x = .Ctor` (which such unions don't derive), so
+            // use a match-bool instead. Multi-field ctors already lower to a match-bool;
+            // string-unions derive DecidableEq, so `=` is fine there.
+            const cond = decl.kind === "discriminated-union" && binders.length === 0
+                ? { kind: "match", scrutinee: scrutExpr, arms: [
+                        { pattern: `.${ctor}`, body: { kind: "bool", value: true } },
+                        { pattern: "_", body: { kind: "bool", value: false } }
+                    ] }
+                : { kind: "binop", op: "=", left: scrutExpr, right: { kind: "constructor", name: ctor, type: decl.name } };
+            // Bind only the constructor-field binders the body actually uses, pinning the
+            // owning ctor so the destructor doesn't guess (variants share field names).
+            const lets = [];
+            binders.forEach((b, i) => {
+                const f = variant?.fields[i];
+                if (b !== "_" && f && stmtsUseVar(armBody, b))
+                    lets.push({
+                        kind: "let", name: b, type: f.type ?? { kind: "unknown" }, mutable: false,
+                        value: { kind: "field", obj: scrutExpr, field: f.name, fromUnion: decl.name, ctor },
+                    });
+            });
+            elseBranch = [{ kind: "if", cond, then: [...lets, ...armBody], else: elseBranch }];
+        }
+        return elseBranch;
+    });
+}
+/** True if `stmts` contain a `break` not nested inside another while. */
+function stmtsContainBreak(stmts) {
+    for (const s of stmts) {
+        if (s.kind === "break")
+            return true;
+        if (s.kind === "if" && (stmtsContainBreak(s.then) || stmtsContainBreak(s.else)))
+            return true;
+        if (s.kind === "match" && s.arms.some(a => stmtsContainBreak(a.body)))
+            return true;
+    }
+    return false;
+}
+/**
+ * loom's default loop-exit fact is `¬guard`, which does not hold for a loop that
+ * `break`s (a break exits with the guard still true). Such loops need an explicit
+ * `//@ done_with` in the TS source (`//@ done_with true` when the loop invariant
+ * alone carries the exit facts). Rather than silently supplying one, reject —
+ * the exit fact is part of the spec and belongs beside the invariants.
+ * Lean-only; Dafny derives loop-exit facts from the break sites themselves.
+ */
+function requireDoneWithForBreaks(stmts, fnName) {
+    for (const s of stmts) {
+        if (s.kind === "if") {
+            requireDoneWithForBreaks(s.then, fnName);
+            requireDoneWithForBreaks(s.else, fnName);
+        }
+        if (s.kind === "match")
+            for (const a of s.arms)
+                requireDoneWithForBreaks(a.body, fnName);
+        if (s.kind === "while") {
+            if (!s.doneWith && stmtsContainBreak(s.body)) {
+                throw new Error(`${fnName}: loop with break needs //@ done_with on the Lean backend ` +
+                    `(an early return in a loop also lowers to a break). ` +
+                    `Use //@ done_with true when the loop invariants carry the exit facts.`);
+            }
+            requireDoneWithForBreaks(s.body, fnName);
+        }
+    }
+}
 function eliminateTopLevelContinue(stmts) {
     const out = [];
     for (let i = 0; i < stmts.length; i++) {
@@ -1914,11 +2109,11 @@ function replaceVar(e, name, replacement, narrowing) {
 }
 // ── Top-level transform ──────────────────────────────────────
 /** Transform for Lean backend — same logic, Lean options. */
-export function transformModuleLean(mod, specImport) {
+export function transformModuleLean(mod, specImport, moduleBase) {
     const prev = _opts;
     _opts = LEAN_OPTIONS;
     try {
-        return transformModule(mod, specImport);
+        return transformModule(mod, specImport, moduleBase);
     }
     finally {
         _opts = prev;
@@ -1935,7 +2130,7 @@ export function transformModuleDafny(mod) {
         _opts = prev;
     }
 }
-export function transformModule(mod, specImport) {
+export function transformModule(mod, specImport, moduleBaseOverride) {
     _forofCounters.clear();
     _liftCounter = 0;
     _typeDecls = mod.typeDecls;
@@ -1988,6 +2183,9 @@ export function transformModule(mod, specImport) {
         }
     }
     const base = mod.file.split("/").pop()?.replace(/\.ts$/, "") ?? "module";
+    // Lean module base — overridable via `//@ lean-module` (see lsc.ts). Only the
+    // def→types import below reads it; Dafny never passes an override.
+    const moduleBase = moduleBaseOverride ?? base;
     // Externs: emit as top-of-file `function {:axiom}` (Dafny) declarations.
     // Any `requires`/`ensures` from the source declaration come along so callers
     // see the same spec the source itself verified. Substitute `\result` with the
@@ -2011,12 +2209,18 @@ export function transformModule(mod, specImport) {
         ? [{ kind: "namespace", name: "Pure", decls: pureDefs }]
         : [];
     if (typeDecls.length > 0 || pureDefs.length > 0 || externDecls.length > 0) {
+        // Declaration order differs by backend. Dafny allows forward references, so
+        // externs go first to be in scope everywhere. Lean requires definition-before-use:
+        // an extern's signature may reference a declared type (e.g. `estimateTokens(m: AgentMessage)`),
+        // so types must precede externs, which in turn precede the pure mirrors that may call them.
+        const decls = _opts.backend === "lean"
+            ? [...typeDecls, ...externDecls, ...pureNamespace]
+            : [...externDecls, ...typeDecls, ...pureNamespace];
         typesFile = {
             comment: "  Generated by lsc — Lean types and pure function mirrors.",
             imports: typesImports,
             options: [],
-            // Externs come first so they're in scope for every later declaration.
-            decls: [...externDecls, ...typeDecls, ...pureNamespace],
+            decls,
         };
     }
     // Def file: Velvet methods
@@ -2036,6 +2240,19 @@ export function transformModule(mod, specImport) {
         let body = pureDefNames.has(fn.name)
             ? [{ kind: "return", value: { kind: "app", fn: `Pure.${fn.name}`, args: fn.params.map(p => ({ kind: "var", name: p.name })) } }]
             : promoteAssignedLets(transformStmts(fn.body, mod.typeDecls));
+        // Lean-only method-body rewrites (Velvet can't WP-synthesize monadic matches
+        // and forbids `return` in loops):
+        //   1. monadic statement-`match` on a user union → discriminator `if`-chains
+        //   2. `return` inside a loop → result var + break (postcondition as invariant)
+        // Dafny keeps the native forms. Breaking loops (including those synthesized
+        // by rewrite 2) must carry a `//@ done_with` in the TS source — enforced here,
+        // since loom's default loop-exit fact `¬guard` does not hold across a break.
+        if (_opts.backend === "lean" && !pureDefNames.has(fn.name)) {
+            body = matchToIfChains(body);
+            const resultInvariants = fn.ensures.map(e => replaceVar(transformExpr(e), "\\result", { kind: "var", name: "_loopRet" }));
+            body = eliminateReturnInLoops(body, fn.returnTy, resultInvariants);
+            requireDoneWithForBreaks(body, fn.name);
+        }
         // Shadow reassigned parameters with mutable locals
         const paramNames = new Set(fn.params.map(p => p.name));
         const reassigned = findReassignedNames(fn.body, paramNames);
@@ -2082,7 +2299,7 @@ export function transformModule(mod, specImport) {
             methods: classMethods,
         };
     });
-    const defImport = specImport ?? (typesFile ? `«${base}.types»` : null);
+    const defImport = specImport ?? (typesFile ? `«${moduleBase}.types»` : null);
     const defBaseImports = defImport ? [defImport] : ["LemmaScript"];
     const defFile = {
         comment: "  Generated by lsc from " + (mod.file.split("/").pop() ?? "") + "\n  Do not edit — re-run `lsc gen` to regenerate.",

package/tools/dist/emit.js

@@ -1,253 +0,0 @@
-/**
- * Lean IR → text. Trivial pretty-printer.
- * No logic, no type decisions — just serialization.
- */
-// ── Lean keyword escaping ────────────────────────────────────
-const LEAN_KEYWORDS = new Set([
-    "def", "theorem", "lemma", "example", "structure", "class", "instance",
-    "inductive", "where", "match", "with", "if", "then", "else", "do",
-    "let", "mut", "return", "for", "in", "while", "break", "continue",
-    "import", "open", "section", "namespace", "end", "set_option",
-    "variable", "axiom", "constant", "private", "protected", "noncomputable",
-    "partial", "unsafe", "macro", "syntax", "by", "fun", "have", "show",
-    "at", "from", "to", "deriving", "extends", "true", "false",
-]);
-function escapeName(name) {
-    return LEAN_KEYWORDS.has(name) ? `«${name}»` : name;
-}
-// ── Operator precedence (for parenthesization) ──────────────
-const PREC = {
-    "→": 1, "∨": 2, "∧": 3,
-    "=": 4, "≠": 4, "≥": 4, "≤": 4, ">": 4, "<": 4,
-    "+": 5, "-": 5, "*": 6, "/": 6, "%": 6,
-};
-function prec(op) { return PREC[op] ?? 10; }
-// ── Expression emission ─────────────────────────────────────
-function emitExpr(e, parentPrec) {
-    switch (e.kind) {
-        case "var": return escapeName(e.name);
-        case "num": return `${e.value}`;
-        case "bool": return e.value ? "true" : "false";
-        case "str": return `"${e.value}"`;
-        case "constructor": return `.${e.name}`;
-        case "arrayLiteral":
-            if (e.elems.length === 0)
-                return `#[]`;
-            return `#[${e.elems.map(el => emitExpr(el)).join(", ")}]`;
-        case "dotCall": {
-            const obj = emitExpr(e.obj);
-            const wrap = e.obj.kind === "binop" || e.obj.kind === "app" || e.obj.kind === "dotCall";
-            const receiver = wrap ? `(${obj})` : obj;
-            const args = e.args.map(a => (a.kind === "binop" || a.kind === "unop" || a.kind === "implies" || a.kind === "app") ? `(${emitExpr(a)})` : emitExpr(a));
-            return args.length > 0 ? `${receiver}.${e.method} ${args.join(" ")}` : `${receiver}.${e.method}`;
-        }
-        case "lambda": {
-            const params = e.params.map(p => p.name).join(" ");
-            // Single return statement → expression lambda
-            if (e.body.length === 1 && e.body[0].kind === "return") {
-                return `(fun ${params} => ${emitExpr(e.body[0].value)})`;
-            }
-            // Multi-statement → do block
-            return `(fun ${params} => do\n${emitStmts(e.body, 2)})`;
-        }
-        case "unop":
-            if (e.op === "¬")
-                return `¬(${emitExpr(e.expr)})`;
-            if (e.op === "-" && e.expr.kind === "num")
-                return `-${e.expr.value}`;
-            return `(-${emitExpr(e.expr)})`;
-        case "binop": {
-            const s = `${emitExpr(e.left, prec(e.op))} ${e.op} ${emitExpr(e.right, prec(e.op))}`;
-            return (parentPrec !== undefined && prec(e.op) < parentPrec) ? `(${s})` : s;
-        }
-        case "implies": {
-            const parts = [...e.premises.map(p => emitExpr(p)), emitExpr(e.conclusion)];
-            const s = parts.join(" → ");
-            return parentPrec !== undefined ? `(${s})` : s;
-        }
-        case "app": {
-            const args = e.args.map(a => (a.kind === "binop" || a.kind === "unop" || a.kind === "implies" || a.kind === "app") ? `(${emitExpr(a)})` : emitExpr(a));
-            return `${e.fn} ${args.join(" ")}`;
-        }
-        case "field": {
-            const obj = emitExpr(e.obj);
-            const wrap = e.obj.kind !== "var" && e.obj.kind !== "num" && e.obj.kind !== "bool";
-            return wrap ? `(${obj}).${escapeName(e.field)}` : `${obj}.${escapeName(e.field)}`;
-        }
-        case "toNat": {
-            const inner = emitExpr(e.expr);
-            const wrap = e.expr.kind !== "var" && e.expr.kind !== "num";
-            return wrap ? `(${inner}).toNat` : `${inner}.toNat`;
-        }
-        case "index":
-            return `${emitExpr(e.arr)}[${emitExpr(e.idx)}]!`;
-        case "record": {
-            const fields = e.fields.map(f => `${escapeName(f.name)} := ${emitExpr(f.value)}`);
-            if (e.spread)
-                return `{ ${emitExpr(e.spread)} with ${fields.join(", ")} }`;
-            return `{ ${fields.join(", ")} }`;
-        }
-        case "if":
-            return `if ${emitExpr(e.cond)} then ${emitExpr(e.then)} else ${emitExpr(e.else)}`;
-        case "match": {
-            const arms = e.arms.map(a => `| ${a.pattern} => ${emitExpr(a.body)}`);
-            return `match ${e.scrutinee} with ${arms.join(" ")}`;
-        }
-        case "forall": return `∀ ${e.var} : ${e.type}, ${emitExpr(e.body)}`;
-        case "exists": return `∃ ${e.var} : ${e.type}, ${emitExpr(e.body)}`;
-        case "let": return `let ${e.name} := ${emitExpr(e.value)}\n${emitExpr(e.body)}`;
-    }
-}
-// ── Statement emission ──────────────────────────────────────
-function emitStmts(stmts, indent) {
-    const pad = "  ".repeat(indent);
-    return stmts.map(s => emitStmt(s, indent)).join("\n");
-}
-function emitStmt(s, indent) {
-    const pad = "  ".repeat(indent);
-    switch (s.kind) {
-        case "let":
-            return s.mutable
-                ? `${pad}let mut ${escapeName(s.name)} : ${s.type} := ${emitExpr(s.value)}`
-                : `${pad}let ${escapeName(s.name)} := ${emitExpr(s.value)}`;
-        case "assign": return `${pad}${escapeName(s.target)} := ${emitExpr(s.value)}`;
-        case "bind": return `${pad}${escapeName(s.target)} ← ${emitExpr(s.value)}`;
-        case "let-bind": return `${pad}let ${s.name} ← ${emitExpr(s.value)}`;
-        case "return": return `${pad}return ${emitExpr(s.value)}`;
-        case "break": return `${pad}break`;
-        case "continue": return `${pad}continue`;
-        case "if": {
-            let out = `${pad}if ${emitExpr(s.cond)} then\n${emitStmts(s.then, indent + 1)}`;
-            if (s.else.length > 0) {
-                if (s.else.length === 1 && s.else[0].kind === "if") {
-                    const ei = s.else[0];
-                    out += `\n${pad}else if ${emitExpr(ei.cond)} then\n${emitStmts(ei.then, indent + 1)}`;
-                    if (ei.else.length > 0)
-                        out += `\n${pad}else\n${emitStmts(ei.else, indent + 1)}`;
-                }
-                else {
-                    out += `\n${pad}else\n${emitStmts(s.else, indent + 1)}`;
-                }
-            }
-            return out;
-        }
-        case "match": {
-            const lines = [`${pad}match ${s.scrutinee} with`];
-            for (const arm of s.arms) {
-                lines.push(`${pad}| ${arm.pattern} =>`);
-                lines.push(emitStmts(arm.body, indent + 1));
-            }
-            return lines.join("\n");
-        }
-        case "while": {
-            const lines = [`${pad}while ${emitExpr(s.cond)}`];
-            for (const inv of s.invariants)
-                lines.push(`${pad}  invariant ${emitExpr(inv)}`);
-            if (s.doneWith)
-                lines.push(`${pad}  done_with ${emitExpr(s.doneWith)}`);
-            if (s.decreasing)
-                lines.push(`${pad}  decreasing ${emitExpr(s.decreasing)}`);
-            lines.push(`${pad}do`);
-            lines.push(emitStmts(s.body, indent + 1));
-            return lines.join("\n");
-        }
-        case "forin": {
-            const lines = [`${pad}for ${s.idx} in [:${emitExpr(s.bound)}]`];
-            for (const inv of s.invariants)
-                lines.push(`${pad}  invariant ${emitExpr(inv)}`);
-            lines.push(`${pad}do`);
-            lines.push(emitStmts(s.body, indent + 1));
-            return lines.join("\n");
-        }
-    }
-}
-// ── Declaration emission ─────────────────────────────────────
-function emitDecl(d) {
-    switch (d.kind) {
-        case "inductive": {
-            const lines = [`inductive ${d.name} where`];
-            for (const c of d.constructors) {
-                if (c.fields.length === 0) {
-                    lines.push(`  | ${c.name} : ${d.name}`);
-                }
-                else {
-                    const params = c.fields.map(f => `(${escapeName(f.name)} : ${f.type})`).join(" ");
-                    lines.push(`  | ${c.name} ${params} : ${d.name}`);
-                }
-            }
-            if (d.deriving.length > 0)
-                lines.push(`deriving ${d.deriving.join(", ")}`);
-            return lines.join("\n");
-        }
-        case "structure": {
-            const lines = [`structure ${d.name} where`];
-            for (const f of d.fields)
-                lines.push(`  ${escapeName(f.name)} : ${f.type}`);
-            if (d.deriving.length > 0)
-                lines.push(`deriving ${d.deriving.join(", ")}`);
-            return lines.join("\n");
-        }
-        case "def": {
-            const params = d.params.map(p => `(${escapeName(p.name)} : ${p.type})`).join(" ");
-            return `def ${d.name} ${params} : ${d.returnType} :=\n${emitPureExpr(d.body, 1)}`;
-        }
-        case "method": {
-            const params = d.params.map(p => `(${escapeName(p.name)} : ${p.type})`).join(" ");
-            const lines = [`method ${d.name} ${params} return (res : ${d.returnType})`];
-            for (const r of d.requires)
-                lines.push(`  require ${emitExpr(r)}`);
-            for (const e of d.ensures)
-                lines.push(`  ensures ${emitExpr(e)}`);
-            lines.push("  do");
-            lines.push(emitStmts(d.body, 2));
-            return lines.join("\n");
-        }
-        case "namespace": {
-            const lines = [`namespace ${d.name}`];
-            for (const inner of d.decls)
-                lines.push("", emitDecl(inner));
-            lines.push("", `end ${d.name}`);
-            return lines.join("\n");
-        }
-    }
-}
-/** Emit a pure expression with indented if/match blocks. */
-function emitPureExpr(e, indent) {
-    const pad = "  ".repeat(indent);
-    switch (e.kind) {
-        case "if":
-            return `${pad}if ${emitExpr(e.cond)} then\n${emitPureExpr(e.then, indent + 1)}\n${pad}else\n${emitPureExpr(e.else, indent + 1)}`;
-        case "match": {
-            const lines = [`${pad}match ${e.scrutinee} with`];
-            for (const arm of e.arms) {
-                lines.push(`${pad}| ${arm.pattern} =>`);
-                lines.push(emitPureExpr(arm.body, indent + 1));
-            }
-            return lines.join("\n");
-        }
-        case "let":
-            return `${pad}let ${e.name} := ${emitExpr(e.value)}\n${emitPureExpr(e.body, indent)}`;
-        default:
-            return `${pad}${emitExpr(e)}`;
-    }
-}
-// ── File emission ────────────────────────────────────────────
-export function emitFile(file) {
-    const lines = [];
-    if (file.comment) {
-        lines.push("/-");
-        lines.push(file.comment);
-        lines.push("-/");
-    }
-    for (const imp of file.imports)
-        lines.push(`import ${imp}`);
-    if (file.options.length > 0)
-        lines.push("");
-    for (const opt of file.options)
-        lines.push(`set_option ${opt.key} ${opt.value}`);
-    for (const decl of file.decls) {
-        lines.push("");
-        lines.push(emitDecl(decl));
-    }
-    return lines.join("\n") + "\n";
-}