From 11fa6d1decf6e0f79a8bd2399fdcb9ce70ec66c6 Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Tue, 26 May 2026 12:26:49 -0400
Subject: [PATCH 01/67] some progress on generalizing spec, dspec

---
 backends/lean/Aeneas/Std/Spec.lean         | 74 +++++++++++++++++++
 backends/lean/Aeneas/Std/WP.lean           | 50 ++++++++++---
 backends/lean/Aeneas/Tactic/Step/Init.lean | 33 +++++++++
 backends/lean/Aeneas/Tactic/Step/Step.lean | 85 +++++++++++++++++++++-
 4 files changed, 229 insertions(+), 13 deletions(-)
 create mode 100644 backends/lean/Aeneas/Std/Spec.lean

diff --git a/backends/lean/Aeneas/Std/Spec.lean b/backends/lean/Aeneas/Std/Spec.lean
new file mode 100644
index 000000000..336fbbd71
--- /dev/null
+++ b/backends/lean/Aeneas/Std/Spec.lean
@@ -0,0 +1,74 @@
+import Lean
+import AeneasMeta.Extensions
+-- import Aeneas.Tactic.Step.Init
+open Lean Elab Term Meta
+
+namespace Aeneas
+open Extensions
+
+-- This file defines an extension for defining spec statements that
+-- can be used with the step tactic.
+
+-- structure SpecInfo where
+--   name : Lean.Name
+--   arity : Nat
+--   mk_spec_mono : Array Lean.Expr → Lean.Expr → Lean.Expr
+--   mk_spec_bind : Array Lean.Expr → Lean.Expr → Lean.Expr
+--   -- discr_tree_key : Array Lean.Expr → Array Lean.Expr
+--   program_index : Nat -- index into the arguments of the Result value
+
+--   uncurry_elim_tactics : Array Lean.Name
+--   qimp_elim_tactics : Array Lean.Name
+--   deriving Inhabited -- why does the value type for an extension need to be Inhabited?
+
+-- structure SpecInfoExtensionState where
+--   specInfos : Std.HashMap Name SpecInfo
+
+-- /- Initiliaze the `spec` attribute. -/
+-- initialize specAttr : SimpleScopedEnvExtension SpecInfo SpecInfoExtensionState ← do
+--   let ext ← registerSimpleScopedEnvExtension {
+--     name        := `specStatementRegistrationExtension,
+--     initial     := {
+--       specInfos := Std.HashMap.emptyWithCapacity
+--     },
+--     addEntry    := fun state new =>
+--       {state with specInfos := state.specInfos.insert new.name new},
+--   }
+--   pure ext
+
+-- syntax (name := register_spec_statement_cmd)
+--   "#register_spec_statement " term : command
+
+-- @[command_elab register_spec_statement_cmd]
+-- unsafe def register_spec_statement : Lean.Elab.Command.CommandElab := fun stx => do
+--   let bla := stx[1]
+--   let expr ← Command.liftTermElabM do
+--     elabTerm bla (some (mkConst ``SpecInfo))
+--   let value ← Lean.Elab.Command.liftTermElabM do
+--     Lean.Meta.evalExpr SpecInfo (mkConst ``SpecInfo) expr
+--   specAttr.add value
+
+-- details that are specific to particular kinds of spec statements, like `spec` of `dspec`
+-- unsafe def specStatementLookup : Name → SpecInfo
+--   | ``Std.WP.spec => {
+--     name := ``Std.WP.spec
+--     arity := 3
+--     mk_spec_mono := fun _args thm => thm
+--     mk_spec_bind := fun _args thm => thm
+--     uncurry_elim_tactics := #[]
+--     qimp_elim_tactics := #[]
+--     program_index := 1
+--   }
+--   | ``Std.WP.dspec => {
+--     name := ``Std.WP.dspec
+--     arity := 3
+--     mk_spec_mono := fun _args thm => thm
+--     mk_spec_bind := fun _args thm => thm
+--     uncurry_elim_tactics := #[]
+--     qimp_elim_tactics := #[]
+--     program_index := 1
+--   }
+--   | _ => panic! "not a valid spec statement"
+
+
+end Aeneas
diff --git a/backends/lean/Aeneas/Std/WP.lean b/backends/lean/Aeneas/Std/WP.lean
index 3356c37c1..f622e2368 100644
--- a/backends/lean/Aeneas/Std/WP.lean
+++ b/backends/lean/Aeneas/Std/WP.lean
@@ -2,6 +2,7 @@ import Aeneas.Std.Primitives
 import Aeneas.Std.Delab
 import Std.Do
 import Aeneas.Tactic.Solver.Grind.Init
+import Aeneas.Std.Spec
 
 namespace Aeneas.Std.WP
 
@@ -14,27 +15,32 @@ def Wp α := Post α → Pre
 
 def wp_return (x:α) : Wp α := fun p => p x
 
-def wp_bind (m:Wp α) (k:α -> Wp β) : Wp β :=
-  fun p => m (fun r => k r p)
-
-def wp_ord (wp1 wp2:Wp α) :=
-  forall p, wp1 p → wp2 p
-
 def theta (m:Result α) : Wp α :=
   match m with
   | ok x => wp_return x
   | fail _ => fun _ => False
   | div => fun _ => False
 
-def p2wp (post:Post α) : Wp α :=
-  fun p => forall r, post r → p r
-
-def spec_general (x:Result α) (p:Post α) :=
-  wp_ord (p2wp p) (theta x)
-
 def spec {α} (x:Result α) (p:Post α) :=
   theta x p
 
+def dspec {α} (x:Result α) (p:Post α) :=
+  match x with
+  | ok x => p x
+  | fail _ => False
+  | div => True
+
+theorem spec_dspec {α} {x : Result α} (p: Post α) : spec x p → dspec x p := by
+  intros s
+  simp [spec, dspec] at *
+  cases x <;> simp at * <;> assumption
+
+
+theorem dspec_admissible {α} (p : Post α )
+  : Lean.Order.admissible (fun x => dspec x p) := by
+  apply Lean.Order.admissible_flatOrder
+  simp [dspec]
+
 /-- Variant of `uncurry` used to decompose tuples in post-conditions.
 
 Similar to `uncurry` but specialized for `Prop` and delaborated differently:
@@ -187,6 +193,26 @@ theorem exists_imp_spec {m:Result α} {P:Post α} :
   (∃ y, m = ok y ∧ P y) → spec m P := by
   exact (spec_equiv_exists m P).2
 
+-- #register_spec_statement {
+--     name := ``spec
+--     arity := 3
+--     mk_spec_mono := fun _args thm => thm
+--     mk_spec_bind := fun _args thm => thm
+--     uncurry_elim_tactics := #[]
+--     qimp_elim_tactics := #[]
+--     program_index := 1
+--   }
+
+-- #register_spec_statement {
+--     name := ``dspec
+--     arity := 3
+--     mk_spec_mono := fun _args thm => thm
+--     mk_spec_bind := fun _args thm => thm
+--     uncurry_elim_tactics := #[]
+--     qimp_elim_tactics := #[]
+--     program_index := 1
+--   }
+
 end Aeneas.Std.WP
 
 /-
diff --git a/backends/lean/Aeneas/Tactic/Step/Init.lean b/backends/lean/Aeneas/Tactic/Step/Init.lean
index afaa4f224..64c858e17 100644
--- a/backends/lean/Aeneas/Tactic/Step/Init.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Init.lean
@@ -212,6 +212,39 @@ section Methods
     withLocalDeclsD ⟨ tys ⟩ k
 end Methods
 
+structure SpecInfo where
+  name : Lean.Name
+  arity : Nat
+  mk_spec_mono : Array Lean.Expr → Lean.Expr → Lean.Expr
+  mk_spec_bind : Array Lean.Expr → Lean.Expr → Lean.Expr
+  -- discr_tree_key : Array Lean.Expr → Array Lean.Expr
+  program_index : Nat -- index into the arguments of the Result value
+
+  uncurry_elim_tactics : Array Lean.Name
+  qimp_elim_tactics : Array Lean.Name
+  deriving Inhabited
+
+unsafe def specStatementLookup : Name → SpecInfo
+  | ``Std.WP.spec => {
+    name := ``Std.WP.spec
+    arity := 3
+    mk_spec_mono := fun _args thm => thm
+    mk_spec_bind := fun _args thm => thm
+    uncurry_elim_tactics := #[]
+    qimp_elim_tactics := #[]
+    program_index := 1
+  }
+  | ``Std.WP.dspec => {
+    name := ``Std.WP.dspec
+    arity := 3
+    mk_spec_mono := fun _args thm => thm
+    mk_spec_bind := fun _args thm => thm
+    uncurry_elim_tactics := #[]
+    qimp_elim_tactics := #[]
+    program_index := 1
+  }
+  | _ => panic! "not a valid spec statement"
+
 /- Analyze a goal or a step theorem to decompose its arguments.
 
   StepSpec theorems should be of the following shape:
diff --git a/backends/lean/Aeneas/Tactic/Step/Step.lean b/backends/lean/Aeneas/Tactic/Step/Step.lean
index 3515da9b6..819ffbf39 100644
--- a/backends/lean/Aeneas/Tactic/Step/Step.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Step.lean
@@ -1422,7 +1422,7 @@ namespace Test
   open Std Result
 
   -- Show the traces:
-  -- set_option trace.Step true
+  set_option trace.Step true
   -- set_option pp.rawOnError true
 
   set_option says.verify true
@@ -1431,6 +1431,89 @@ namespace Test
   -- #eval showStoredStepThms
   open alloc.vec
 
+  ---------------------------------------
+
+  -- This section has tests for dspec. TODO: clean these up a bit.
+  -- test proving things about potentially diverging functions.
+  -- this is the output from a simple rust function
+  def simple_diverge (x : Std.I32) : Result Std.I32 := do
+    if x = 0#i32
+    then ok 10#i32
+    -- else if x = 1#i32
+    -- then simple_diverge (← x + 1#i32)
+    else
+      let i1 ← 1#i32 + 1#i32
+      simple_diverge i1
+      -- simple_diverge x
+  partial_fixpoint
+
+  -- -- TODO: if i use unfold then sorry, print proof term, i can see how it proves accessibility
+  -- #check simple_diverge.fixpoint_induct
+  -- @[step]
+  -- theorem test_div (x : Std.I32) : Std.WP.dspec (simple_diverge x) (fun res => res = 10#i32)
+  --   := by
+  --     -- instead of unfold, must use this:
+  --     -- unfold_div (maybe don't need theorem name)
+  --     --
+  --     apply simple_diverge.fixpoint_induct (motive := fun res => WP.dspec res _)
+  --     -- apply simple_diverge.fixpoint_induct (fun f => forall x, WP.dspec (f x) (fun res => res = 10#i32))
+  --     -- apply simple_diverge.fixpoint_induct (fun res => res = 10#i32)
+  --       -- <;> [ apply WP.dspec_admissible ; intros ]
+  --       -- <;> [ sorry ; intros ]
+  --     --
+  --     -- simp only
+  --     -- split
+  --     -- . simp [*]
+  --     -- . step
+  --     --   step
+  --     --   simp [*]
+  --     sorry
+
+  -- #print test_div
+  #print simple_diverge.eq_def
+  #print simple_diverge._proof_4
+
+  -- -- test out using a dspec theorem to prove a dspec.
+  -- example : WP.dspec
+  --   (do let x ← simple_diverge 5#i32
+  --       return x) (fun x => x = 10#i32) := by
+  --     step
+  --     simp [*]
+  --     --
+
+  def simple_converge (x : Std.I32) : Result Std.I32 := do
+    if x = 0#i32
+    then ok 10#i32
+    else ok 10#i32
+
+  @[step]
+  theorem simple_converge_property (x : Std.I32)
+    : Std.WP.spec (simple_converge x) (fun res => res = 10#i32)
+    := by
+      unfold simple_converge
+      split <;> simp [*]
+
+  -- -- test out using a spec theorem to prove a dspec
+  -- example : WP.dspec
+  --   (do let x ← simple_converge 5#i32
+  --       let y ← simple_converge 6#i32
+  --       return x) (fun x => x = 10#i32) := by
+  --     step -- this works because step_bind' is polymorphic over divergence
+  --     step
+  --     simp [*]
+
+  -- -- confirm that you can't use dspec from spec
+  -- example : WP.spec
+  --   (do let x ← simple_diverge 5#i32
+  --       let y ← simple_diverge 6#i32
+  --       return x) (fun x => x = 10#i32) := by
+  --   step -- this should fail!
+  --   step
+  --   simp [*]
+  --   --
+
+  -- ---------------------------------------
+
   /- This test case checks what happens when `step`:
      - manages to solve the current goal
      - but doesn't solve some preconditions

From 56213dc243a330057535bd8587d34f6d384d7328 Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Tue, 26 May 2026 15:56:17 -0400
Subject: [PATCH 02/67] some progress on generalizing spec_mono and spec_bind

---
 backends/lean/Aeneas/Tactic/Step/Init.lean | 52 ++++++++++++-----
 backends/lean/Aeneas/Tactic/Step/Step.lean | 66 ++++++++++++++--------
 2 files changed, 80 insertions(+), 38 deletions(-)

diff --git a/backends/lean/Aeneas/Tactic/Step/Init.lean b/backends/lean/Aeneas/Tactic/Step/Init.lean
index 64c858e17..3b552ed0c 100644
--- a/backends/lean/Aeneas/Tactic/Step/Init.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Init.lean
@@ -215,35 +215,51 @@ end Methods
 structure SpecInfo where
   name : Lean.Name
   arity : Nat
-  mk_spec_mono : Array Lean.Expr → Lean.Expr → Lean.Expr
-  mk_spec_bind : Array Lean.Expr → Lean.Expr → Lean.Expr
-  -- discr_tree_key : Array Lean.Expr → Array Lean.Expr
+  -- mk_spec_mono : Array Lean.Expr → Lean.Expr → MetaM Lean.Expr
+  -- mk_spec_bind : Array Lean.Expr → Lean.Expr → MetaM Lean.Expr
+  mk_spec_mono : Name
+  mk_spec_mono_skip_args : Nat -- number of arguments to be inferred, before Result and Post arguments
+  mk_spec_bind : Name
+  mk_spec_bind_skip_args : Nat
   program_index : Nat -- index into the arguments of the Result value
+  post_index : Nat
 
   uncurry_elim_tactics : Array Lean.Name
   qimp_elim_tactics : Array Lean.Name
   deriving Inhabited
 
-unsafe def specStatementLookup : Name → SpecInfo
-  | ``Std.WP.spec => {
+def specStatementLookup : Name → Option SpecInfo
+  | ``Std.WP.spec => .some {
     name := ``Std.WP.spec
     arity := 3
-    mk_spec_mono := fun _args thm => thm
-    mk_spec_bind := fun _args thm => thm
+    -- mk_spec_mono := fun args thm =>
+    --   mkAppOptM ``Std.WP.spec_mono' #[.none, .none, args[1]!, args[2]!, thm]
+    -- mk_spec_bind := fun args thm =>
+    --   mkAppOptM ``Std.WP.spec_bind' #[.none, .none, .none, .none, args[1]!, args[2]!, thm]
+    mk_spec_mono := ``Std.WP.spec_mono'
+    mk_spec_mono_skip_args := 2
+    mk_spec_bind := ``Std.WP.spec_bind'
+    mk_spec_bind_skip_args := 4
     uncurry_elim_tactics := #[]
     qimp_elim_tactics := #[]
     program_index := 1
+    post_index := 2
   }
-  | ``Std.WP.dspec => {
+  | ``Std.WP.dspec => .some {
     name := ``Std.WP.dspec
     arity := 3
-    mk_spec_mono := fun _args thm => thm
-    mk_spec_bind := fun _args thm => thm
+    -- mk_spec_mono := fun _args thm => pure thm
+    -- mk_spec_bind := fun _args thm => pure thm
+    mk_spec_mono := ``Std.WP.spec_mono'
+    mk_spec_mono_skip_args := 2
+    mk_spec_bind := ``Std.WP.spec_bind'
+    mk_spec_bind_skip_args := 4
     uncurry_elim_tactics := #[]
     qimp_elim_tactics := #[]
     program_index := 1
+    post_index := 2
   }
-  | _ => panic! "not a valid spec statement"
+  | _ => .none
 
 /- Analyze a goal or a step theorem to decompose its arguments.
 
@@ -253,7 +269,7 @@ unsafe def specStatementLookup : Name → SpecInfo
   ```
 -/
 def getStepSpecFunArgsExpr (ty : Expr) :
-  MetaM Expr := do
+  MetaM (Expr × SpecInfo) := do
   let ty := ty.consumeMData
   unless ← isProp ty do
     throwError "Expected a proposition, got {←inferType ty}"
@@ -262,8 +278,13 @@ def getStepSpecFunArgsExpr (ty : Expr) :
   trace[Step] "Universally quantified arguments and assumptions: {xs}"
   -- ty₂ == spec (f x1 ... xn) P
   let (spec?, args) := ty₂.consumeMData.withApp (fun f args => (f, args))
-  if h: spec?.isConstOf ``Std.WP.spec ∧ args.size = 3
-  then pure args[1] -- this is `f x1 ... xn`
+  let specName ← match spec? with
+    | Expr.const name _ => pure name
+    | _ => throwError "Not a constant"
+  let .some info := specStatementLookup specName
+    | throwError "{specName} is not a supported spec statement name"
+  if h: args.size = info.arity
+  then pure (args[info.program_index]!, info) -- this is `f x1 ... xn`
   else throwError "Expected to be a `spec (f x1 ... xn) P`, got {ty₂}"
 
 structure Rules where
@@ -315,11 +336,12 @@ private def saveStepSpecFromThm (ext : Extension) (attrKind : AttributeKind) (th
       -- Normalize to eliminate the let-bindings
       let ty ← normalizeLetBindings type
       trace[Step] "Theorem after normalization (to eliminate the let bindings): {ty}"
-      let fExpr ← getStepSpecFunArgsExpr ty
+      let (fExpr, info) ← getStepSpecFunArgsExpr ty
       trace[Step] "Registering spec theorem for expr: {fExpr}"
       -- Convert the function expression to a discrimination tree key
       DiscrTree.mkPath fExpr)
     -- Save the entry
+    -- TODO: use info.name to use a different discrimination tree here!
     ScopedEnvExtension.add ext (fKey, thName) attrKind
     trace[Step] "Saved the entry"
     pure ()
diff --git a/backends/lean/Aeneas/Tactic/Step/Step.lean b/backends/lean/Aeneas/Tactic/Step/Step.lean
index 819ffbf39..6c6347499 100644
--- a/backends/lean/Aeneas/Tactic/Step/Step.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Step.lean
@@ -223,13 +223,21 @@ structure Args where
 
    If comp = bind m k then return true and m
    Else return false and comp
+
+   NEW: also looks up which type of spec is being used in the statment,
+   and returns the corresponding SpecInfo
 -/
-def getFirstBind (goalTy : Expr) : MetaM (Bool × Expr) := do
+def getFirstBind (goalTy : Expr) : MetaM (Bool × Expr × SpecInfo) := do
   forallTelescope goalTy fun nvars goalTy => do
 
   let (spec?, args) := goalTy.consumeMData.withApp (fun f args => (f, args))
-  let compTy ← if h: spec?.isConstOf ``Std.WP.spec ∧ args.size = 3
-               then pure (args[1])
+  let name ← match spec? with
+    | Expr.const name _ => pure name
+    | _ => throwError "{spec?} is not a spec statement name"
+  let .some info := specStatementLookup name
+    | throwError "{name} is not a supported spec statement name"
+  let compTy ← if h: args.size = info.arity
+               then pure (args[info.program_index]!)
                else throwError "Goal is not a `spec m P`"
 
   trace[Step] "compTy: {compTy}"
@@ -237,8 +245,8 @@ def getFirstBind (goalTy : Expr) : MetaM (Bool × Expr) := do
   let (bind?, args) := compTy.consumeMData.withApp (fun f args => (f, args))
   trace[Step] "bind?: {bind?}"
   if h: bind?.isConstOf ``bind ∧ args.size = 6
-  then pure (true, args[4])
-  else pure (false, compTy)
+  then pure (true, args[4], info)
+  else pure (false, compTy, info)
 
 /-- Names introduced by the `do` elaborator's `mkPatContinuation` as a
     fallback (`_xN`) when no leaf name is available — e.g. all leaves are
@@ -413,6 +421,7 @@ def getPostNamesFromGoal : TacticM (Array (Option Name)) := do
     let goalTy ← (← getMainGoal).getType
     let goalTy ← instantiateMVars goalTy
     goalTy.consumeMData.withApp fun spec? args => do
+    -- TODO: this could be generalized to work with other specs, like `dspec`
     if spec?.isConstOf ``Std.WP.spec ∧ args.size = 3 then
       getPostNames args[2]!
     else pure #[]
@@ -462,7 +471,7 @@ def trySolveTypeclasses (mvarsIds : List MVarId) : TacticM (List MVarId) := do
 The resulting target should be of the shape:
 `qimp_spec P k Q` (or `qimp P Q`)
 -/
-def tryMatch (isLet : Bool) (th : Expr) :
+def tryMatch (info : SpecInfo) (isLet : Bool) (th : Expr) :
   TacticM (Array MVarId) := do
   withTraceNode `Step (fun _ => pure m!"tryMatch") do
   /- Apply the theorem
@@ -485,17 +494,19 @@ def tryMatch (isLet : Bool) (th : Expr) :
 
   -- `thTy` should be of the shape `spec program post`: we need to retrieve `program`
   let (thHead, thArgs) := thTy.consumeMData.withApp (fun f args => (f, args))
-  if !thHead.isConst || thHead.constName! != ``Std.WP.spec then
+  -- TODO: here is where it should be able to lift from spec to dspec
+  if !thHead.isConst || thHead.constName! != info.name then
     throwError "Not a spec theorem"
+
   let (program, P) ←
-    if h: thArgs.size = 3
-    then pure (thArgs[1], thArgs[2])
+    if h: thArgs.size = info.arity
+    then pure (thArgs[info.program_index]!, thArgs[info.post_index]!)
     else throwError "Not a spec theorem"
 
   let (specMonoBindName, varNum) :=
     if isLet
-    then (``Std.WP.spec_bind', 4)
-    else (``Std.WP.spec_mono', 2)
+    then (``Std.WP.spec_bind', info.mk_spec_bind_skip_args)
+    else (``Std.WP.spec_mono', info.mk_spec_mono_skip_args)
   let specMonoBind ← Term.mkConst specMonoBindName
   let specMonoBindTy ← inferType specMonoBind
   trace[Step] "specMonoBind (isLet:{isLet}): {specMonoBind}: {← inferType specMonoBind}"
@@ -815,13 +826,13 @@ def postprocessMainGoal (mainGoal : Option MainGoal) : TacticM (Option MainGoal)
         pure (some ({goal := ← getMainGoal, outputs, stepState := mainGoal.stepState} : MainGoal))
       else pure none
 
-def stepWith (args : Args) (isLet:Bool) (fExpr : Expr) (th : Expr) :
+def stepWith (info : SpecInfo) (args : Args) (isLet:Bool) (fExpr : Expr) (th : Expr) :
   TacticM Goals := do
   withTraceNode `Step (fun _ => pure m!"stepWith") do
   -- Save the main goal before tryMatch (needed for lazy grind state initialization)
   let originalGoal ← getMainGoal
   -- Attempt to instantiate the theorem and introduce it in the context
-  let newGoals ← tryMatch isLet th
+  let newGoals ← tryMatch info isLet th
   --
   withMainContext do
   traceGoalWithNode "current goal"
@@ -898,7 +909,7 @@ def getFirstArg (args : Array Expr) : Option Expr := do
 /-- Helper: try to apply a theorem.
 
     Return the list of post-conditions we introduced if it succeeded. -/
-def tryApply (args : Args) (isLet:Bool) (fExpr : Expr) (kind : String) (th : Option Expr) :
+def tryApply (info : SpecInfo) (args : Args) (isLet:Bool) (fExpr : Expr) (kind : String) (th : Option Expr) :
   TacticM (Option Goals) := do
   let res ← do
     match th with
@@ -910,7 +921,7 @@ def tryApply (args : Args) (isLet:Bool) (fExpr : Expr) (kind : String) (th : Opt
       -- Apply the theorem
       let res ← do
         try
-          let res ← stepWith args isLet fExpr th
+          let res ← stepWith info args isLet fExpr th
           pure (some res)
         catch _ => pure none
   match res with
@@ -922,7 +933,7 @@ def tryApply (args : Args) (isLet:Bool) (fExpr : Expr) (kind : String) (th : Opt
 
     -- TODO: check that they are "compatible" with the goal to avoid a potentially expensive unification
 -/
-def tryAssumptions (args : Args) (isLet:Bool) (fExpr : Expr) :
+def tryAssumptions (info : SpecInfo) (args : Args) (isLet:Bool) (fExpr : Expr) :
   TacticM (Option (Goals × UsedTheorem)) := do
   withTraceNode `Step (fun _ => pure m!"tryAssumptions") do run
 where
@@ -933,7 +944,7 @@ where
   for decl in decls.reverse do
     trace[Step] "Trying assumption: {decl.userName} : {decl.type}"
     try
-      let goal ← stepWith args isLet fExpr decl.toExpr
+      let goal ← stepWith info args isLet fExpr decl.toExpr
       return (some (goal, .localHyp decl))
     catch _ => continue
   pure none
@@ -956,18 +967,18 @@ def stepAsmsOrLookupTheorem (args : Args) (withTh : Option Expr) :
      TODO: we should also check that no quantified variable appears in fExpr.
      If such variables appear, we should just fail because the goal doesn't
      have the proper shape. -/
-  let (goalIsLet, fExpr) ← do
+  let (goalIsLet, fExpr, info) ← do
     withTraceNode `Step (fun _ => pure m!"Calling getFirstBind to deconstruct the target") do
     getFirstBind goalTy
   /- If the user provided a theorem/assumption: use it.
      Otherwise, lookup one. -/
   match withTh with
   | some th => do
-    let goals ← stepWith args goalIsLet fExpr th
+    let goals ← stepWith info args goalIsLet fExpr th
     return (goals, .givenExpr th)
   | none =>
     -- Try all the assumptions one by one and if it fails try to lookup a theorem.
-    if let some res ← tryAssumptions args goalIsLet fExpr then return res
+    if let some res ← tryAssumptions info args goalIsLet fExpr then return res
     /- It failed: lookup the pspec theorems which match the expression *only
        if the function is a constant* -/
     let fIsConst ← do
@@ -990,7 +1001,7 @@ def stepAsmsOrLookupTheorem (args : Args) (withTh : Option Expr) :
       -- Try the theorems one by one
       for pspec in pspecs do
         let pspecExpr ← Term.mkConst pspec
-        match ← tryApply args goalIsLet fExpr "pspec theorem" pspecExpr with
+        match ← tryApply info args goalIsLet fExpr "pspec theorem" pspecExpr with
         | some goals => return (goals, .stepThm pspec)
         | none => pure ()
       -- It failed: try to use the recursive assumptions
@@ -1005,7 +1016,7 @@ def stepAsmsOrLookupTheorem (args : Args) (withTh : Option Expr) :
       for decl in decls.reverse do
         trace[Step] "Trying recursive assumption: {decl.userName} : {decl.type}"
         try
-          let goals ← stepWith args goalIsLet fExpr decl.toExpr
+          let goals ← stepWith info args goalIsLet fExpr decl.toExpr
           return (goals, .localHyp decl)
         catch _ => continue
       -- Nothing worked: failed
@@ -1422,9 +1433,10 @@ namespace Test
   open Std Result
 
   -- Show the traces:
-  set_option trace.Step true
+  -- set_option trace.Step true
   -- set_option pp.rawOnError true
 
+
   set_option says.verify true
 
   -- The following command displays the database of theorems:
@@ -1493,6 +1505,14 @@ namespace Test
       unfold simple_converge
       split <;> simp [*]
 
+  example : WP.spec
+    (do let x ← 1#i32 + 2#i32
+        let y ← x + x
+        return y) (fun z => z.val == 10) := by
+    step
+    step
+    sorry
+
   -- -- test out using a spec theorem to prove a dspec
   -- example : WP.dspec
   --   (do let x ← simple_converge 5#i32

From d3389b3e3584db3e6e4d6c02e9f834e11dba0eb8 Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Tue, 26 May 2026 16:18:39 -0400
Subject: [PATCH 03/67] generalized discr tree lookup to different spec thms

---
 backends/lean/Aeneas/Tactic/Step/Init.lean | 34 ++++++++++++++--------
 backends/lean/Aeneas/Tactic/Step/Step.lean | 10 ++++++-
 2 files changed, 31 insertions(+), 13 deletions(-)

diff --git a/backends/lean/Aeneas/Tactic/Step/Init.lean b/backends/lean/Aeneas/Tactic/Step/Init.lean
index 3b552ed0c..c8802684f 100644
--- a/backends/lean/Aeneas/Tactic/Step/Init.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Init.lean
@@ -287,21 +287,28 @@ def getStepSpecFunArgsExpr (ty : Expr) :
   then pure (args[info.program_index]!, info) -- this is `f x1 ... xn`
   else throwError "Expected to be a `spec (f x1 ... xn) P`, got {ty₂}"
 
+deriving instance Ord for Lean.Name
 structure Rules where
-  rules : DiscrTree Name
+  rules : Std.TreeMap Name (DiscrTree Name)
   /- We can't remove keys from a discrimination tree, so to support
      local rules we keep a set of deactivated rules (rules which have
      come out of scope) on the side -/
   deactivated : Std.HashSet Name
 deriving Inhabited
 
-def Rules.empty : Rules := ⟨ DiscrTree.empty, Std.HashSet.emptyWithCapacity ⟩
+def Rules.empty : Rules := ⟨ Std.TreeMap.empty, Std.HashSet.emptyWithCapacity ⟩
 
-def Extension := SimpleScopedEnvExtension (DiscrTreeKey × Name) Rules
+def Extension := SimpleScopedEnvExtension ((Name × DiscrTreeKey) × Name) Rules
 deriving Inhabited
 
-def Rules.insert (r : Rules) (kv : Array DiscrTree.Key × Name) : Rules :=
-  { rules := r.rules.insertKeyValue kv.fst kv.snd,
+def Rules.insert (r : Rules) (kv : (Name × Array DiscrTree.Key) × Name) : Rules :=
+  let ((specName, prog), thm) := kv
+  { rules :=
+    r.rules.insert specName ((match r.rules.get? specName with
+      | .some dt => dt
+      | .none => DiscrTree.empty
+    ).insertKeyValue prog thm)
+    ,
     deactivated := r.deactivated.erase kv.snd }
 
 def Rules.erase (r : Rules) (k : Name) : Rules :=
@@ -331,7 +338,7 @@ private def saveStepSpecFromThm (ext : Extension) (attrKind : AttributeKind) (th
     let some thDecl := env.findAsync? thName
       | throwError "Could not find theorem {thName}"
     let type := thDecl.sig.get.type
-    let fKey ← MetaM.run' (do
+    let (fKey, info) ← MetaM.run' (do
       trace[Step] "Theorem: {type}"
       -- Normalize to eliminate the let-bindings
       let ty ← normalizeLetBindings type
@@ -339,10 +346,10 @@ private def saveStepSpecFromThm (ext : Extension) (attrKind : AttributeKind) (th
       let (fExpr, info) ← getStepSpecFunArgsExpr ty
       trace[Step] "Registering spec theorem for expr: {fExpr}"
       -- Convert the function expression to a discrimination tree key
-      DiscrTree.mkPath fExpr)
+      pure (← DiscrTree.mkPath fExpr, info))
     -- Save the entry
     -- TODO: use info.name to use a different discrimination tree here!
-    ScopedEnvExtension.add ext (fKey, thName) attrKind
+    ScopedEnvExtension.add ext ((info.name, fKey), thName) attrKind
     trace[Step] "Saved the entry"
     pure ()
 
@@ -363,9 +370,10 @@ initialize stepAttr : StepSpecAttr ← do
   registerBuiltinAttribute attrImpl
   pure { attr := attrImpl, ext := ext }
 
-def StepSpecAttr.find? (s : StepSpecAttr) (e : Expr) : MetaM (Array Name) := do
+def StepSpecAttr.find? (s : StepSpecAttr) (info : SpecInfo) (e : Expr) : MetaM (Array Name) := do
   let state := s.ext.getState (← getEnv)
-  let rules ← state.rules.getMatch e
+  -- let rules ← state.rules.getMatch e
+  let rules ← (state.rules.get! info.name).getMatch e
   pure (rules.filter (fun th => th ∉ state.deactivated))
 
 def StepSpecAttr.getState (s : StepSpecAttr) : MetaM Rules := do
@@ -375,8 +383,10 @@ def showStoredStepThms : MetaM Unit := do
   let st ← stepAttr.getState
   -- TODO: how can we iterate over (at least) the values stored in the tree?
   --let s := st.toList.foldl (fun s (f, th) => f!"{s}\n{f} → {th}") f!""
-  let s := f!"{st.rules}, {st.deactivated.toArray}"
-  IO.println s
+  for key in st.rules.keys do
+    let s := f!"thms for {key}: {st.rules.get! key}}"
+    IO.println s
+  IO.println "deactivated: {st.deactivated.toArray}"
 
 /-! # Attribute: `step_pure` -/
 
diff --git a/backends/lean/Aeneas/Tactic/Step/Step.lean b/backends/lean/Aeneas/Tactic/Step/Step.lean
index 6c6347499..e837bde30 100644
--- a/backends/lean/Aeneas/Tactic/Step/Step.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Step.lean
@@ -990,7 +990,7 @@ def stepAsmsOrLookupTheorem (args : Args) (withTh : Option Expr) :
     else do
       trace[Step] "No assumption succeeded: trying to lookup a pspec theorem"
       let pspecs : Array Name ← do
-        let thNames ← stepAttr.find? fExpr
+        let thNames ← stepAttr.find? info fExpr
         /- TODO: because of reduction, there may be several valid theorems (for
            instance for the scalars). We need to sort them from most specific to
            least specific. For now, we assume the most specific theorems are at
@@ -1513,6 +1513,14 @@ namespace Test
     step
     sorry
 
+  example : WP.spec
+    (do let x ← simple_converge 5#i32
+        let y ← simple_converge 6#i32
+        return x) (fun x => x = 10#i32) := by
+      step -- test using spec thm to prove spec
+      step
+      simp [*]
+
   -- -- test out using a spec theorem to prove a dspec
   -- example : WP.dspec
   --   (do let x ← simple_converge 5#i32

From ec869b950dcc639882e170954889f2d0561c7808 Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Wed, 27 May 2026 10:14:08 -0400
Subject: [PATCH 04/67] use discr tree, dspec partially working

---
 backends/lean/Aeneas/Std/WP.lean           | 26 +++++++++++++++++++
 backends/lean/Aeneas/Tactic/Step/Init.lean |  6 ++---
 backends/lean/Aeneas/Tactic/Step/Step.lean | 30 +++++++++++++++++++---
 3 files changed, 55 insertions(+), 7 deletions(-)

diff --git a/backends/lean/Aeneas/Std/WP.lean b/backends/lean/Aeneas/Std/WP.lean
index f622e2368..a48e129bd 100644
--- a/backends/lean/Aeneas/Std/WP.lean
+++ b/backends/lean/Aeneas/Std/WP.lean
@@ -213,6 +213,32 @@ theorem exists_imp_spec {m:Result α} {P:Post α} :
 --     program_index := 1
 --   }
 
+-- `dspec` theorems
+theorem dspec_mono' {α} {P₁ : Post α} {m : Result α} {P₀ : Post α} (h : spec m P₀):
+  qimp P₀ P₁ → dspec m P₁ := by
+  intros HMonPost
+  revert h
+  unfold dspec
+  cases m <;> grind [qimp]
+
+/-- Implication of a `dspec` predicate with quantifier -/
+def qimp_dspec {α β} (P : α → Prop) (k : α → Result β) (Q : β → Prop) : Prop :=
+  ∀ x, P x → dspec (k x) Q
+
+theorem dspec_bind' {α β} {k : α -> Result β} {Pₖ : Post β} {m : Result α} {Pₘ : Post α} :
+  dspec m Pₘ →
+  (qimp_dspec Pₘ k Pₖ) →
+  dspec (Std.bind m k) Pₖ := by
+  intro Hm Hk
+  cases m
+  · simp
+    apply Hk
+    apply Hm
+  · simp
+    apply Hm
+  · simp
+    apply Hm
+
 end Aeneas.Std.WP
 
 /-
diff --git a/backends/lean/Aeneas/Tactic/Step/Init.lean b/backends/lean/Aeneas/Tactic/Step/Init.lean
index c8802684f..a71a4f8aa 100644
--- a/backends/lean/Aeneas/Tactic/Step/Init.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Init.lean
@@ -248,11 +248,9 @@ def specStatementLookup : Name → Option SpecInfo
   | ``Std.WP.dspec => .some {
     name := ``Std.WP.dspec
     arity := 3
-    -- mk_spec_mono := fun _args thm => pure thm
-    -- mk_spec_bind := fun _args thm => pure thm
-    mk_spec_mono := ``Std.WP.spec_mono'
+    mk_spec_mono := ``Std.WP.dspec_mono'
     mk_spec_mono_skip_args := 2
-    mk_spec_bind := ``Std.WP.spec_bind'
+    mk_spec_bind := ``Std.WP.dspec_bind'
     mk_spec_bind_skip_args := 4
     uncurry_elim_tactics := #[]
     qimp_elim_tactics := #[]
diff --git a/backends/lean/Aeneas/Tactic/Step/Step.lean b/backends/lean/Aeneas/Tactic/Step/Step.lean
index e837bde30..bfb149ccd 100644
--- a/backends/lean/Aeneas/Tactic/Step/Step.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Step.lean
@@ -505,8 +505,8 @@ def tryMatch (info : SpecInfo) (isLet : Bool) (th : Expr) :
 
   let (specMonoBindName, varNum) :=
     if isLet
-    then (``Std.WP.spec_bind', info.mk_spec_bind_skip_args)
-    else (``Std.WP.spec_mono', info.mk_spec_mono_skip_args)
+    then (info.mk_spec_bind, info.mk_spec_bind_skip_args)
+    else (info.mk_spec_mono, info.mk_spec_mono_skip_args)
   let specMonoBind ← Term.mkConst specMonoBindName
   let specMonoBindTy ← inferType specMonoBind
   trace[Step] "specMonoBind (isLet:{isLet}): {specMonoBind}: {← inferType specMonoBind}"
@@ -1433,7 +1433,7 @@ namespace Test
   open Std Result
 
   -- Show the traces:
-  -- set_option trace.Step true
+  set_option trace.Step true
   -- set_option pp.rawOnError true
 
 
@@ -1521,6 +1521,30 @@ namespace Test
       step
       simp [*]
 
+  @[step]
+  theorem simple_converge_property_dspec (x : Std.I32)
+    : Std.WP.dspec (simple_converge x) (fun res => res = 10#i32)
+    := by
+      unfold simple_converge
+      split <;> simp [WP.dspec]
+
+  example : WP.dspec
+    (do let x ← simple_converge 5#i32
+        let y ← simple_converge 6#i32
+        return x) (fun x => x = 10#i32) := by
+      step -- TODO: should work!
+      step -- need qimp intro tactics!
+      simp [*]
+
+  -- requires lifting spec to dspec
+  example : WP.dspec
+    (do let x ← 1#i32 + 2#i32
+        let y ← x + x
+        return y) (fun z => z.val == 10) := by
+    step
+    step
+    sorry
+
   -- -- test out using a spec theorem to prove a dspec
   -- example : WP.dspec
   --   (do let x ← simple_converge 5#i32

From 442c2a78294d04333c07a7f2f039cc58ba9c459b Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Wed, 27 May 2026 10:38:50 -0400
Subject: [PATCH 05/67] dspec working, need lifting

---
 backends/lean/Aeneas/Std/WP.lean           | 22 ++++++++++++++++++++++
 backends/lean/Aeneas/Tactic/Step/Init.lean | 12 ++++++++----
 backends/lean/Aeneas/Tactic/Step/Step.lean | 19 +++++++++----------
 3 files changed, 39 insertions(+), 14 deletions(-)

diff --git a/backends/lean/Aeneas/Std/WP.lean b/backends/lean/Aeneas/Std/WP.lean
index a48e129bd..fe219bc2f 100644
--- a/backends/lean/Aeneas/Std/WP.lean
+++ b/backends/lean/Aeneas/Std/WP.lean
@@ -239,6 +239,28 @@ theorem dspec_bind' {α β} {k : α -> Result β} {Pₖ : Post β} {m : Result 
   · simp
     apply Hm
 
+@[simp]
+def qimp_dspec_uncurry' {α₀ α₁ β} (P : α₀ → α₁ → Prop) (k : α₀ × α₁ → Result β) (Q : β → Prop) :
+  qimp_dspec (uncurry' P) k Q ↔ ∀ x, qimp_dspec (P x) (curry k x) Q := by
+  simp [qimp_dspec, curry]
+
+@[simp]
+theorem qimp_dspec_unit {α} (P : Unit → Prop) (k : Unit → Result α) (Q : α → Prop) :
+  qimp_dspec P k Q ↔ (P () → dspec (k ()) Q) := by
+  grind [qimp_dspec]
+
+@[simp]
+theorem qimp_dspec_exists {α β γ} (P : γ → α → Prop) (k : α → Result β) (Q : β → Prop) :
+  qimp_dspec (fun x => ∃ y, P y x) k Q ↔ ∀ x, qimp_dspec (P x) k Q := by
+  simp only [qimp_dspec, forall_exists_index]; grind
+
+def qimp_dspec_iff {α β} (P : α → Prop) (k : α → Result β) (Q : β → Prop) :
+  qimp_dspec P k Q ↔ ∀ x, imp (P x) (dspec (k x) Q) := by
+  simp [qimp_dspec, imp]
+
+@[simp, grind =, agrind =]
+theorem dspec_ok (x : α) : dspec (ok x) p ↔ p x := by simp [dspec]
+
 end Aeneas.Std.WP
 
 /-
diff --git a/backends/lean/Aeneas/Tactic/Step/Init.lean b/backends/lean/Aeneas/Tactic/Step/Init.lean
index a71a4f8aa..93bed8707 100644
--- a/backends/lean/Aeneas/Tactic/Step/Init.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Init.lean
@@ -240,8 +240,10 @@ def specStatementLookup : Name → Option SpecInfo
     mk_spec_mono_skip_args := 2
     mk_spec_bind := ``Std.WP.spec_bind'
     mk_spec_bind_skip_args := 4
-    uncurry_elim_tactics := #[]
-    qimp_elim_tactics := #[]
+    uncurry_elim_tactics := #[
+      ``Std.WP.qimp_spec_uncurry', ``Std.WP.qimp_spec_unit, ``Std.WP.qimp_spec_exists
+    ]
+    qimp_elim_tactics := #[ ``Std.WP.qimp_spec_iff, ]
     program_index := 1
     post_index := 2
   }
@@ -252,8 +254,10 @@ def specStatementLookup : Name → Option SpecInfo
     mk_spec_mono_skip_args := 2
     mk_spec_bind := ``Std.WP.dspec_bind'
     mk_spec_bind_skip_args := 4
-    uncurry_elim_tactics := #[]
-    qimp_elim_tactics := #[]
+    uncurry_elim_tactics := #[
+      ``Std.WP.qimp_dspec_uncurry', ``Std.WP.qimp_dspec_unit, ``Std.WP.qimp_dspec_exists
+    ]
+    qimp_elim_tactics := #[ ``Std.WP.qimp_dspec_iff, ]
     program_index := 1
     post_index := 2
   }
diff --git a/backends/lean/Aeneas/Tactic/Step/Step.lean b/backends/lean/Aeneas/Tactic/Step/Step.lean
index bfb149ccd..2e7c21dfa 100644
--- a/backends/lean/Aeneas/Tactic/Step/Step.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Step.lean
@@ -589,7 +589,7 @@ def introPrettyEquality (args : Args) (fExpr : Expr) (outputFVars : Array Expr)
     TODO: we use `simp` a lot, which uselessely explores the monadic term and the post-condition.
     We might want to optimize this.
 -/
-def introOutputs (args : Args) (fExpr : Expr) (stepState : StepState) :
+def introOutputs (info : SpecInfo) (args : Args) (fExpr : Expr) (stepState : StepState) :
   TacticM (Option MainGoal) := do
   withTraceNode `Step (fun _ => pure m!"introOutputs") do
   traceGoalWithNode "Initial goal"
@@ -600,12 +600,11 @@ def introOutputs (args : Args) (fExpr : Expr) (stepState : StepState) :
     Simp.simpAt true { maxDischargeDepth := 1, failIfUnchanged := false, iota := false}
             { simpThms := #[← stepSimpExt.getTheorems],
               addSimpThms :=
-                #[``Std.WP.qimp_spec_uncurry', ``Std.WP.qimp_spec_unit,
-                  ``Std.WP.qimp_uncurry', ``Std.WP.qimp_unit,
-                  ``Std.WP.qimp_spec_exists, ``Std.WP.qimp_exists,
-                  -- `Prod.forall`/`Prod.exists` split `∀ x : α × β, p x` into
+                info.uncurry_elim_tactics ++
+                #[ -- `Prod.forall`/`Prod.exists` split `∀ x : α × β, p x` into
                   -- `∀ a b, p (a, b)`, so a tuple post-binder produces one
                   -- output per leaf rather than a single pair.
+                  ``Std.WP.qimp_uncurry', ``Std.WP.qimp_unit, ``Std.WP.qimp_exists,
                   ``Prod.forall, ``Prod.exists,
                   ``forall_unit, ``true_imp_iff] }
             (.targets #[] true)
@@ -619,9 +618,8 @@ def introOutputs (args : Args) (fExpr : Expr) (stepState : StepState) :
     Simp.simpAt true { maxDischargeDepth := 1, failIfUnchanged := false, iota := false}
             { declsToUnfold := #[``Std.WP.curry, ``Std.WP.uncurry']
               addSimpThms :=
-                #[``Std.WP.qimp_spec_iff, ``Std.WP.qimp_iff,
-                  ``Std.WP.imp_and_iff,
-                  ``Prod.forall, ``Prod.exists, ``Std.uncurry_apply_pair,
+                info.qimp_elim_tactics ++
+                #[ ``Std.WP.qimp_iff, ``Std.WP.imp_and_iff, ``Prod.forall, ``Prod.exists, ``Std.uncurry_apply_pair,
                   ``forall_unit, ``true_imp_iff] }
             (.targets #[] true)
     | trace[Step] "The main goal was solved!"; return none
@@ -852,7 +850,7 @@ def stepWith (info : SpecInfo) (args : Args) (isLet:Bool) (fExpr : Expr) (th : E
   /- Process the main goal -/
   -- Introduce the outputs, including the post-conditions, into the context
   setGoals [mainGoal]
-  let mainGoal ← introOutputs args fExpr stepState
+  let mainGoal ← introOutputs info args fExpr stepState
   /- Simplify the post-conditions in the main goal - note that we waited until now
       because by solving the preconditions we may have instantiated meta-variables.
       We also simplify the goal again (to simplify let-bindings, etc.) -/
@@ -1433,7 +1431,7 @@ namespace Test
   open Std Result
 
   -- Show the traces:
-  set_option trace.Step true
+  -- set_option trace.Step true
   -- set_option pp.rawOnError true
 
 
@@ -1535,6 +1533,7 @@ namespace Test
       step -- TODO: should work!
       step -- need qimp intro tactics!
       simp [*]
+      --
 
   -- requires lifting spec to dspec
   example : WP.dspec

From 1f4cca09126a5bb5b5dedb443de7ea30a2629afb Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Thu, 28 May 2026 11:25:41 -0400
Subject: [PATCH 06/67] lifting works

---
 backends/lean/Aeneas/Std/WP.lean           |  2 +-
 backends/lean/Aeneas/Tactic/Step/Init.lean | 36 +++++----
 backends/lean/Aeneas/Tactic/Step/Step.lean | 85 +++++++++++++++-------
 3 files changed, 83 insertions(+), 40 deletions(-)

diff --git a/backends/lean/Aeneas/Std/WP.lean b/backends/lean/Aeneas/Std/WP.lean
index fe219bc2f..e202b5f11 100644
--- a/backends/lean/Aeneas/Std/WP.lean
+++ b/backends/lean/Aeneas/Std/WP.lean
@@ -30,7 +30,7 @@ def dspec {α} (x:Result α) (p:Post α) :=
   | fail _ => False
   | div => True
 
-theorem spec_dspec {α} {x : Result α} (p: Post α) : spec x p → dspec x p := by
+theorem spec_dspec (α) (x : Result α) (p: Post α) : spec x p → dspec x p := by
   intros s
   simp [spec, dspec] at *
   cases x <;> simp at * <;> assumption
diff --git a/backends/lean/Aeneas/Tactic/Step/Init.lean b/backends/lean/Aeneas/Tactic/Step/Init.lean
index 93bed8707..2c09f4065 100644
--- a/backends/lean/Aeneas/Tactic/Step/Init.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Init.lean
@@ -212,30 +212,34 @@ section Methods
     withLocalDeclsD ⟨ tys ⟩ k
 end Methods
 
+structure LiftingInfo where
+  from_statement : Name
+  conversion_thm : Name
+  conversion_thm_inferred_args : Nat
+
 structure SpecInfo where
   name : Lean.Name
   arity : Nat
-  -- mk_spec_mono : Array Lean.Expr → Lean.Expr → MetaM Lean.Expr
-  -- mk_spec_bind : Array Lean.Expr → Lean.Expr → MetaM Lean.Expr
+  program_index : Nat -- index into the arguments of the Result value
+  post_index : Nat
+
   mk_spec_mono : Name
   mk_spec_mono_skip_args : Nat -- number of arguments to be inferred, before Result and Post arguments
   mk_spec_bind : Name
   mk_spec_bind_skip_args : Nat
-  program_index : Nat -- index into the arguments of the Result value
-  post_index : Nat
 
   uncurry_elim_tactics : Array Lean.Name
   qimp_elim_tactics : Array Lean.Name
+
+  liftings : Array LiftingInfo
   deriving Inhabited
 
 def specStatementLookup : Name → Option SpecInfo
   | ``Std.WP.spec => .some {
     name := ``Std.WP.spec
     arity := 3
-    -- mk_spec_mono := fun args thm =>
-    --   mkAppOptM ``Std.WP.spec_mono' #[.none, .none, args[1]!, args[2]!, thm]
-    -- mk_spec_bind := fun args thm =>
-    --   mkAppOptM ``Std.WP.spec_bind' #[.none, .none, .none, .none, args[1]!, args[2]!, thm]
+    program_index := 1
+    post_index := 2
     mk_spec_mono := ``Std.WP.spec_mono'
     mk_spec_mono_skip_args := 2
     mk_spec_bind := ``Std.WP.spec_bind'
@@ -244,12 +248,13 @@ def specStatementLookup : Name → Option SpecInfo
       ``Std.WP.qimp_spec_uncurry', ``Std.WP.qimp_spec_unit, ``Std.WP.qimp_spec_exists
     ]
     qimp_elim_tactics := #[ ``Std.WP.qimp_spec_iff, ]
-    program_index := 1
-    post_index := 2
+    liftings := #[]
   }
   | ``Std.WP.dspec => .some {
     name := ``Std.WP.dspec
     arity := 3
+    program_index := 1
+    post_index := 2
     mk_spec_mono := ``Std.WP.dspec_mono'
     mk_spec_mono_skip_args := 2
     mk_spec_bind := ``Std.WP.dspec_bind'
@@ -258,8 +263,11 @@ def specStatementLookup : Name → Option SpecInfo
       ``Std.WP.qimp_dspec_uncurry', ``Std.WP.qimp_dspec_unit, ``Std.WP.qimp_dspec_exists
     ]
     qimp_elim_tactics := #[ ``Std.WP.qimp_dspec_iff, ]
-    program_index := 1
-    post_index := 2
+    liftings := #[
+      { from_statement := ``Std.WP.spec
+        conversion_thm := ``Std.WP.spec_dspec
+        conversion_thm_inferred_args := 3 }
+    ]
   }
   | _ => .none
 
@@ -372,10 +380,10 @@ initialize stepAttr : StepSpecAttr ← do
   registerBuiltinAttribute attrImpl
   pure { attr := attrImpl, ext := ext }
 
-def StepSpecAttr.find? (s : StepSpecAttr) (info : SpecInfo) (e : Expr) : MetaM (Array Name) := do
+def StepSpecAttr.find? (s : StepSpecAttr) (name : Name) (e : Expr) : MetaM (Array Name) := do
   let state := s.ext.getState (← getEnv)
   -- let rules ← state.rules.getMatch e
-  let rules ← (state.rules.get! info.name).getMatch e
+  let rules ← (state.rules.get! name).getMatch e
   pure (rules.filter (fun th => th ∉ state.deactivated))
 
 def StepSpecAttr.getState (s : StepSpecAttr) : MetaM Rules := do
diff --git a/backends/lean/Aeneas/Tactic/Step/Step.lean b/backends/lean/Aeneas/Tactic/Step/Step.lean
index 2e7c21dfa..2f2cde433 100644
--- a/backends/lean/Aeneas/Tactic/Step/Step.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Step.lean
@@ -471,7 +471,7 @@ def trySolveTypeclasses (mvarsIds : List MVarId) : TacticM (List MVarId) := do
 The resulting target should be of the shape:
 `qimp_spec P k Q` (or `qimp P Q`)
 -/
-def tryMatch (info : SpecInfo) (isLet : Bool) (th : Expr) :
+def tryMatch (info : SpecInfo) (lifting : Option LiftingInfo) (isLet : Bool) (th : Expr) :
   TacticM (Array MVarId) := do
   withTraceNode `Step (fun _ => pure m!"tryMatch") do
   /- Apply the theorem
@@ -492,6 +492,24 @@ def tryMatch (info : SpecInfo) (isLet : Bool) (th : Expr) :
   let th := mkAppN th mvars
   trace[Step] "Uninstantiated theorem: {th}: {← inferType th}"
 
+  -- do lifting if given
+  let (th, thTy) ←
+    match lifting with
+    | .none => pure (th, thTy)
+    | .some lifting => do
+      let liftingThm ← Term.mkConst lifting.conversion_thm
+      trace[Step] "Trying to lift by {liftingThm}"
+      let liftingThmTy ← inferType liftingThm
+      let (liftThmVars, _, _liftThmTy) ← forallMetaBoundedTelescope liftingThmTy lifting.conversion_thm_inferred_args
+      let liftingThmPartiallyApplied ← mkAppOptM' liftingThm (liftThmVars.map some)
+      let liftingThmApplied := mkAppN liftingThmPartiallyApplied #[th]
+      let liftingThmAppliedTy ← inferType liftingThmApplied
+      Lean.Meta.check liftingThmApplied -- need to instantiate the lifting theorem implicit arguments
+      let thTy ← inferType liftingThmApplied
+      let thTy ← normalizeLetBindings thTy
+      trace[Step] "After lifting have: {liftingThmApplied} : {liftingThmAppliedTy}"
+      pure (liftingThmApplied, thTy)
+
   -- `thTy` should be of the shape `spec program post`: we need to retrieve `program`
   let (thHead, thArgs) := thTy.consumeMData.withApp (fun f args => (f, args))
   -- TODO: here is where it should be able to lift from spec to dspec
@@ -510,7 +528,7 @@ def tryMatch (info : SpecInfo) (isLet : Bool) (th : Expr) :
   let specMonoBind ← Term.mkConst specMonoBindName
   let specMonoBindTy ← inferType specMonoBind
   trace[Step] "specMonoBind (isLet:{isLet}): {specMonoBind}: {← inferType specMonoBind}"
-  let (specMonoBindMVars, _, specMonoBindTy) ← forallMetaBoundedTelescope specMonoBindTy varNum
+  let (specMonoBindMVars, _, _specMonoBindTy) ← forallMetaBoundedTelescope specMonoBindTy varNum
   let specMonoBind ← mkAppOptM' specMonoBind (specMonoBindMVars.map some)
   trace[Step] "Uninstantiated specMonoBind: {specMonoBind}: {← inferType specMonoBind}"
 
@@ -824,13 +842,13 @@ def postprocessMainGoal (mainGoal : Option MainGoal) : TacticM (Option MainGoal)
         pure (some ({goal := ← getMainGoal, outputs, stepState := mainGoal.stepState} : MainGoal))
       else pure none
 
-def stepWith (info : SpecInfo) (args : Args) (isLet:Bool) (fExpr : Expr) (th : Expr) :
+def stepWith (info : SpecInfo) (lifting : Option LiftingInfo) (args : Args) (isLet:Bool) (fExpr : Expr) (th : Expr) :
   TacticM Goals := do
   withTraceNode `Step (fun _ => pure m!"stepWith") do
   -- Save the main goal before tryMatch (needed for lazy grind state initialization)
   let originalGoal ← getMainGoal
   -- Attempt to instantiate the theorem and introduce it in the context
-  let newGoals ← tryMatch info isLet th
+  let newGoals ← tryMatch info lifting isLet th
   --
   withMainContext do
   traceGoalWithNode "current goal"
@@ -907,7 +925,7 @@ def getFirstArg (args : Array Expr) : Option Expr := do
 /-- Helper: try to apply a theorem.
 
     Return the list of post-conditions we introduced if it succeeded. -/
-def tryApply (info : SpecInfo) (args : Args) (isLet:Bool) (fExpr : Expr) (kind : String) (th : Option Expr) :
+def tryApply (info : SpecInfo) (lifting : Option LiftingInfo) (args : Args) (isLet:Bool) (fExpr : Expr) (kind : String) (th : Option Expr) :
   TacticM (Option Goals) := do
   let res ← do
     match th with
@@ -919,7 +937,7 @@ def tryApply (info : SpecInfo) (args : Args) (isLet:Bool) (fExpr : Expr) (kind :
       -- Apply the theorem
       let res ← do
         try
-          let res ← stepWith info args isLet fExpr th
+          let res ← stepWith info lifting args isLet fExpr th
           pure (some res)
         catch _ => pure none
   match res with
@@ -942,7 +960,8 @@ where
   for decl in decls.reverse do
     trace[Step] "Trying assumption: {decl.userName} : {decl.type}"
     try
-      let goal ← stepWith info args isLet fExpr decl.toExpr
+      -- TODO: do we ever want to do a lifting with an assumption?
+      let goal ← stepWith info .none args isLet fExpr decl.toExpr
       return (some (goal, .localHyp decl))
     catch _ => continue
   pure none
@@ -972,7 +991,7 @@ def stepAsmsOrLookupTheorem (args : Args) (withTh : Option Expr) :
      Otherwise, lookup one. -/
   match withTh with
   | some th => do
-    let goals ← stepWith info args goalIsLet fExpr th
+    let goals ← stepWith info .none args goalIsLet fExpr th
     return (goals, .givenExpr th)
   | none =>
     -- Try all the assumptions one by one and if it fails try to lookup a theorem.
@@ -987,21 +1006,26 @@ def stepAsmsOrLookupTheorem (args : Args) (withTh : Option Expr) :
       throwError "Step failed"
     else do
       trace[Step] "No assumption succeeded: trying to lookup a pspec theorem"
-      let pspecs : Array Name ← do
-        let thNames ← stepAttr.find? info fExpr
-        /- TODO: because of reduction, there may be several valid theorems (for
-           instance for the scalars). We need to sort them from most specific to
-           least specific. For now, we assume the most specific theorems are at
-           the end. -/
-        let thNames := thNames.reverse
-        trace[Step] "Looked up pspec theorems: {thNames}"
-        pure thNames
-      -- Try the theorems one by one
-      for pspec in pspecs do
-        let pspecExpr ← Term.mkConst pspec
-        match ← tryApply info args goalIsLet fExpr "pspec theorem" pspecExpr with
-        | some goals => return (goals, .stepThm pspec)
-        | none => pure ()
+      -- Try with info.name theorems directly (the `.none`) as well as any liftings
+      let liftings : Array (Option LiftingInfo) := #[.none] ++ Array.map .some info.liftings
+      for lifting in liftings do
+        let pspecs : Array Name ← do
+          let thNames ← stepAttr.find? -- looks up the theorem in a discrimination tree
+            (match lifting with | .none => info.name | .some l => l.from_statement)
+            fExpr
+          /- TODO: because of reduction, there may be several valid theorems (for
+            instance for the scalars). We need to sort them from most specific to
+            least specific. For now, we assume the most specific theorems are at
+            the end. -/
+          let thNames := thNames.reverse
+          trace[Step] "Looked up pspec theorems: {thNames}"
+          pure thNames
+        -- Try the theorems one by one
+        for pspec in pspecs do
+          let pspecExpr ← Term.mkConst pspec
+          match ← tryApply info lifting args goalIsLet fExpr "pspec theorem" pspecExpr with
+          | some goals => return (goals, .stepThm pspec)
+          | none => pure ()
       -- It failed: try to use the recursive assumptions
       trace[Step] "Failed using a pspec theorem: trying to use a recursive assumption"
       -- We try to apply the assumptions of kind "auxDecl"
@@ -1014,7 +1038,8 @@ def stepAsmsOrLookupTheorem (args : Args) (withTh : Option Expr) :
       for decl in decls.reverse do
         trace[Step] "Trying recursive assumption: {decl.userName} : {decl.type}"
         try
-          let goals ← stepWith info args goalIsLet fExpr decl.toExpr
+          -- TODO: do we ever want to do a lifting for a recursive assumption?
+          let goals ← stepWith info .none args goalIsLet fExpr decl.toExpr
           return (goals, .localHyp decl)
         catch _ => continue
       -- Nothing worked: failed
@@ -1535,12 +1560,22 @@ namespace Test
       simp [*]
       --
 
+  example : WP.spec
+    (do let x ← 1#i32 + 2#i32
+        let y ← x + x
+        return y) (fun z => z.val == 6) := by
+    step
+    step
+    simp [*]
+    --
+
   -- requires lifting spec to dspec
   example : WP.dspec
     (do let x ← 1#i32 + 2#i32
         let y ← x + x
-        return y) (fun z => z.val == 10) := by
+        return y) (fun z => z.val == 6) := by
     step
+    --
     step
     sorry
 

From eadd3102cf03aa1f53c98c8f8e95b71795ecedba Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Thu, 28 May 2026 12:15:07 -0400
Subject: [PATCH 07/67] command for registering spec statements

---
 backends/lean/Aeneas/Std/Spec.lean         | 102 ++++++++++-----------
 backends/lean/Aeneas/Std/WP.lean           |  59 ++++++++----
 backends/lean/Aeneas/Tactic/Step/Init.lean |  61 +-----------
 backends/lean/Aeneas/Tactic/Step/Step.lean |   2 +-
 4 files changed, 89 insertions(+), 135 deletions(-)

diff --git a/backends/lean/Aeneas/Std/Spec.lean b/backends/lean/Aeneas/Std/Spec.lean
index 336fbbd71..2d2a0b004 100644
--- a/backends/lean/Aeneas/Std/Spec.lean
+++ b/backends/lean/Aeneas/Std/Spec.lean
@@ -9,66 +9,60 @@ open Extensions
 -- This file defines an extension for defining spec statements that
 -- can be used with the step tactic.
 
--- structure SpecInfo where
---   name : Lean.Name
---   arity : Nat
---   mk_spec_mono : Array Lean.Expr → Lean.Expr → Lean.Expr
---   mk_spec_bind : Array Lean.Expr → Lean.Expr → Lean.Expr
---   -- discr_tree_key : Array Lean.Expr → Array Lean.Expr
---   program_index : Nat -- index into the arguments of the Result value
 
---   uncurry_elim_tactics : Array Lean.Name
---   qimp_elim_tactics : Array Lean.Name
---   deriving Inhabited -- why does the value type for an extension need to be Inhabited?
+structure LiftingInfo where
+  from_statement : Name
+  conversion_thm : Name
+  conversion_thm_inferred_args : Nat
 
--- structure SpecInfoExtensionState where
---   specInfos : Std.HashMap Name SpecInfo
+structure SpecInfo where
+  name : Lean.Name
+  arity : Nat
+  program_index : Nat -- index into the arguments of the Result value
+  post_index : Nat
 
--- /- Initiliaze the `spec` attribute. -/
--- initialize specAttr : SimpleScopedEnvExtension SpecInfo SpecInfoExtensionState ← do
---   let ext ← registerSimpleScopedEnvExtension {
---     name        := `specStatementRegistrationExtension,
---     initial     := {
---       specInfos := Std.HashMap.emptyWithCapacity
---     },
---     addEntry    := fun state new =>
---       {state with specInfos := state.specInfos.insert new.name new},
---   }
---   pure ext
+  mk_spec_mono : Name
+  mk_spec_mono_skip_args : Nat -- number of arguments to be inferred, before Result and Post arguments
+  mk_spec_bind : Name
+  mk_spec_bind_skip_args : Nat
 
--- syntax (name := register_spec_statement_cmd)
---   "#register_spec_statement " term : command
+  uncurry_elim_tactics : Array Lean.Name
+  qimp_elim_tactics : Array Lean.Name
 
--- @[command_elab register_spec_statement_cmd]
--- unsafe def register_spec_statement : Lean.Elab.Command.CommandElab := fun stx => do
---   let bla := stx[1]
---   let expr ← Command.liftTermElabM do
---     elabTerm bla (some (mkConst ``SpecInfo))
---   let value ← Lean.Elab.Command.liftTermElabM do
---     Lean.Meta.evalExpr SpecInfo (mkConst ``SpecInfo) expr
---   specAttr.add value
+  liftings : Array LiftingInfo
+  deriving Inhabited
 
--- details that are specific to particular kinds of spec statements, like `spec` of `dspec`
--- unsafe def specStatementLookup : Name → SpecInfo
---   | ``Std.WP.spec => {
---     name := ``Std.WP.spec
---     arity := 3
---     mk_spec_mono := fun _args thm => thm
---     mk_spec_bind := fun _args thm => thm
---     uncurry_elim_tactics := #[]
---     qimp_elim_tactics := #[]
---     program_index := 1
---   }
---   | ``Std.WP.dspec => {
---     name := ``Std.WP.dspec
---     arity := 3
---     mk_spec_mono := fun _args thm => thm
---     mk_spec_bind := fun _args thm => thm
---     uncurry_elim_tactics := #[]
---     qimp_elim_tactics := #[]
---     program_index := 1
---   }
---   | _ => panic! "not a valid spec statement"
+structure SpecInfoExtensionState where
+  specInfos : Std.HashMap Name SpecInfo
+  deriving Inhabited
 
+-- /- Initialize the state extension for adding spec theorems -/
+initialize specAttr : SimpleScopedEnvExtension SpecInfo SpecInfoExtensionState  ← do
+  let ext ← registerSimpleScopedEnvExtension {
+    name        := `specStatementRegistrationExtension,
+    initial     := {
+      specInfos := Std.HashMap.emptyWithCapacity
+    },
+    addEntry    := fun state new =>
+      {state with specInfos := state.specInfos.insert new.name new},
+  }
+  pure ext
+
+syntax (name := register_spec_statement_cmd)
+  "#register_spec_statement " term : command
+
+@[command_elab register_spec_statement_cmd]
+unsafe def register_spec_statement : Lean.Elab.Command.CommandElab := fun stx => do
+  let info := stx[1]
+  let expr ← Command.liftTermElabM do
+    elabTerm info (some (mkConst ``SpecInfo))
+  let value ← Lean.Elab.Command.liftTermElabM do
+    Lean.Meta.evalExpr SpecInfo (mkConst ``SpecInfo) expr
+  specAttr.add value
+
+def specStatementLookup (n : Name) : MetaM (Option SpecInfo) := do
+  let env ← getEnv
+  let state := specAttr.getState env
+  return state.specInfos.get? n
 
 end Aeneas
diff --git a/backends/lean/Aeneas/Std/WP.lean b/backends/lean/Aeneas/Std/WP.lean
index e202b5f11..158422c2e 100644
--- a/backends/lean/Aeneas/Std/WP.lean
+++ b/backends/lean/Aeneas/Std/WP.lean
@@ -193,26 +193,6 @@ theorem exists_imp_spec {m:Result α} {P:Post α} :
   (∃ y, m = ok y ∧ P y) → spec m P := by
   exact (spec_equiv_exists m P).2
 
--- #register_spec_statement {
---     name := ``spec
---     arity := 3
---     mk_spec_mono := fun _args thm => thm
---     mk_spec_bind := fun _args thm => thm
---     uncurry_elim_tactics := #[]
---     qimp_elim_tactics := #[]
---     program_index := 1
---   }
-
--- #register_spec_statement {
---     name := ``dspec
---     arity := 3
---     mk_spec_mono := fun _args thm => thm
---     mk_spec_bind := fun _args thm => thm
---     uncurry_elim_tactics := #[]
---     qimp_elim_tactics := #[]
---     program_index := 1
---   }
-
 -- `dspec` theorems
 theorem dspec_mono' {α} {P₁ : Post α} {m : Result α} {P₀ : Post α} (h : spec m P₀):
   qimp P₀ P₁ → dspec m P₁ := by
@@ -805,3 +785,42 @@ theorem loop.spec_decr_nat {α : Type u} {β : Type v}
   apply this
 
 end Aeneas.Std
+
+namespace Aeneas.Std.WP
+-- registers the spec statements for use in the step tactic, see Spec.lean
+#register_spec_statement {
+    name := ``Std.WP.spec
+    arity := 3
+    program_index := 1
+    post_index := 2
+    mk_spec_mono := ``Std.WP.spec_mono'
+    mk_spec_mono_skip_args := 2
+    mk_spec_bind := ``Std.WP.spec_bind'
+    mk_spec_bind_skip_args := 4
+    uncurry_elim_tactics := #[
+      ``Std.WP.qimp_spec_uncurry', ``Std.WP.qimp_spec_unit, ``Std.WP.qimp_spec_exists
+    ]
+    qimp_elim_tactics := #[ ``Std.WP.qimp_spec_iff, ]
+    liftings := #[]
+  }
+
+#register_spec_statement {
+    name := ``Std.WP.dspec
+    arity := 3
+    program_index := 1
+    post_index := 2
+    mk_spec_mono := ``Std.WP.dspec_mono'
+    mk_spec_mono_skip_args := 2
+    mk_spec_bind := ``Std.WP.dspec_bind'
+    mk_spec_bind_skip_args := 4
+    uncurry_elim_tactics := #[
+      ``Std.WP.qimp_dspec_uncurry', ``Std.WP.qimp_dspec_unit, ``Std.WP.qimp_dspec_exists
+    ]
+    qimp_elim_tactics := #[ ``Std.WP.qimp_dspec_iff, ]
+    liftings := #[
+      { from_statement := ``Std.WP.spec
+        conversion_thm := ``Std.WP.spec_dspec
+        conversion_thm_inferred_args := 3 }
+    ]
+  }
+end Aeneas.Std.WP
diff --git a/backends/lean/Aeneas/Tactic/Step/Init.lean b/backends/lean/Aeneas/Tactic/Step/Init.lean
index 2c09f4065..71dee3a73 100644
--- a/backends/lean/Aeneas/Tactic/Step/Init.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Init.lean
@@ -212,65 +212,6 @@ section Methods
     withLocalDeclsD ⟨ tys ⟩ k
 end Methods
 
-structure LiftingInfo where
-  from_statement : Name
-  conversion_thm : Name
-  conversion_thm_inferred_args : Nat
-
-structure SpecInfo where
-  name : Lean.Name
-  arity : Nat
-  program_index : Nat -- index into the arguments of the Result value
-  post_index : Nat
-
-  mk_spec_mono : Name
-  mk_spec_mono_skip_args : Nat -- number of arguments to be inferred, before Result and Post arguments
-  mk_spec_bind : Name
-  mk_spec_bind_skip_args : Nat
-
-  uncurry_elim_tactics : Array Lean.Name
-  qimp_elim_tactics : Array Lean.Name
-
-  liftings : Array LiftingInfo
-  deriving Inhabited
-
-def specStatementLookup : Name → Option SpecInfo
-  | ``Std.WP.spec => .some {
-    name := ``Std.WP.spec
-    arity := 3
-    program_index := 1
-    post_index := 2
-    mk_spec_mono := ``Std.WP.spec_mono'
-    mk_spec_mono_skip_args := 2
-    mk_spec_bind := ``Std.WP.spec_bind'
-    mk_spec_bind_skip_args := 4
-    uncurry_elim_tactics := #[
-      ``Std.WP.qimp_spec_uncurry', ``Std.WP.qimp_spec_unit, ``Std.WP.qimp_spec_exists
-    ]
-    qimp_elim_tactics := #[ ``Std.WP.qimp_spec_iff, ]
-    liftings := #[]
-  }
-  | ``Std.WP.dspec => .some {
-    name := ``Std.WP.dspec
-    arity := 3
-    program_index := 1
-    post_index := 2
-    mk_spec_mono := ``Std.WP.dspec_mono'
-    mk_spec_mono_skip_args := 2
-    mk_spec_bind := ``Std.WP.dspec_bind'
-    mk_spec_bind_skip_args := 4
-    uncurry_elim_tactics := #[
-      ``Std.WP.qimp_dspec_uncurry', ``Std.WP.qimp_dspec_unit, ``Std.WP.qimp_dspec_exists
-    ]
-    qimp_elim_tactics := #[ ``Std.WP.qimp_dspec_iff, ]
-    liftings := #[
-      { from_statement := ``Std.WP.spec
-        conversion_thm := ``Std.WP.spec_dspec
-        conversion_thm_inferred_args := 3 }
-    ]
-  }
-  | _ => .none
-
 /- Analyze a goal or a step theorem to decompose its arguments.
 
   StepSpec theorems should be of the following shape:
@@ -291,7 +232,7 @@ def getStepSpecFunArgsExpr (ty : Expr) :
   let specName ← match spec? with
     | Expr.const name _ => pure name
     | _ => throwError "Not a constant"
-  let .some info := specStatementLookup specName
+  let .some info ← specStatementLookup specName
     | throwError "{specName} is not a supported spec statement name"
   if h: args.size = info.arity
   then pure (args[info.program_index]!, info) -- this is `f x1 ... xn`
diff --git a/backends/lean/Aeneas/Tactic/Step/Step.lean b/backends/lean/Aeneas/Tactic/Step/Step.lean
index 2f2cde433..ca835fca7 100644
--- a/backends/lean/Aeneas/Tactic/Step/Step.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Step.lean
@@ -234,7 +234,7 @@ def getFirstBind (goalTy : Expr) : MetaM (Bool × Expr × SpecInfo) := do
   let name ← match spec? with
     | Expr.const name _ => pure name
     | _ => throwError "{spec?} is not a spec statement name"
-  let .some info := specStatementLookup name
+  let .some info ← specStatementLookup name
     | throwError "{name} is not a supported spec statement name"
   let compTy ← if h: args.size = info.arity
                then pure (args[info.program_index]!)

From 7450fd5d799a55311ddf2388f7ca7905caeb7cf6 Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Mon, 1 Jun 2026 17:12:45 -0400
Subject: [PATCH 08/67] wip partial fixpoint induction tactic

---
 backends/lean/Aeneas/Std/WP.lean              |   2 +-
 backends/lean/Aeneas/Tactic/Step/Step.lean    | 187 +++++++----
 backends/lean/Aeneas/Tactic/Step/Trace.lean   |   1 +
 .../lean/Aeneas/Tactic/Step/UnfoldPF.lean     | 310 ++++++++++++++++++
 4 files changed, 430 insertions(+), 70 deletions(-)
 create mode 100644 backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean

diff --git a/backends/lean/Aeneas/Std/WP.lean b/backends/lean/Aeneas/Std/WP.lean
index 158422c2e..9d940e243 100644
--- a/backends/lean/Aeneas/Std/WP.lean
+++ b/backends/lean/Aeneas/Std/WP.lean
@@ -194,7 +194,7 @@ theorem exists_imp_spec {m:Result α} {P:Post α} :
   exact (spec_equiv_exists m P).2
 
 -- `dspec` theorems
-theorem dspec_mono' {α} {P₁ : Post α} {m : Result α} {P₀ : Post α} (h : spec m P₀):
+theorem dspec_mono' {α} {P₁ : Post α} {m : Result α} {P₀ : Post α} (h : dspec m P₀):
   qimp P₀ P₁ → dspec m P₁ := by
   intros HMonPost
   revert h
diff --git a/backends/lean/Aeneas/Tactic/Step/Step.lean b/backends/lean/Aeneas/Tactic/Step/Step.lean
index ca835fca7..3c72e3287 100644
--- a/backends/lean/Aeneas/Tactic/Step/Step.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Step.lean
@@ -1466,8 +1466,6 @@ namespace Test
   -- #eval showStoredStepThms
   open alloc.vec
 
-  ---------------------------------------
-
   -- This section has tests for dspec. TODO: clean these up a bit.
   -- test proving things about potentially diverging functions.
   -- this is the output from a simple rust function
@@ -1482,31 +1480,105 @@ namespace Test
       -- simple_diverge x
   partial_fixpoint
 
-  -- -- TODO: if i use unfold then sorry, print proof term, i can see how it proves accessibility
-  -- #check simple_diverge.fixpoint_induct
+  theorem test_div2 (x : Std.I32) : Std.WP.dspec (simple_diverge x) (fun res => res = 10#i32)
+    := by
+      unfold simple_diverge
+      --
+      sorry
+
+  -- TODO: if i use unfold then sorry, print proof term, i can see how it proves admissibility
+  #check simple_diverge.fixpoint_induct
+  @[step]
+  theorem test_div (x : Std.I32) : Std.WP.dspec (simple_diverge x) (fun res => res = 10#i32)
+    := by
+      --
+      revert x
+      apply simple_diverge.fixpoint_induct
+        (motive := fun simple_diverge => ∀ x, WP.dspec (simple_diverge x) (fun res => res = 10#i32))
+      · apply Lean.Order.admissible_pi
+        intros y
+        apply Lean.Order.admissible_apply (fun _ fx => WP.dspec fx _)
+        apply Lean.Order.admissible_flatOrder
+        simp only [WP.dspec]
+      · intros
+        simp only
+        split
+        . simp [*]
+        . step
+          step
+          simp [*]
+
+  def simple_diverge_2 (x y : Std.I32) : Result Std.I32 := do
+    if x = 0#i32
+    then ok 10#i32
+    else
+      let i1 ← x + y
+      simple_diverge_2 i1 i1
+  partial_fixpoint
+
   -- @[step]
-  -- theorem test_div (x : Std.I32) : Std.WP.dspec (simple_diverge x) (fun res => res = 10#i32)
+  -- theorem test_div_2 (x y : Std.I32) : Std.WP.dspec (simple_diverge_2 x y) (fun res => res = 10#i32)
   --   := by
+  --     revert x y
   --     -- instead of unfold, must use this:
   --     -- unfold_div (maybe don't need theorem name)
   --     --
-  --     apply simple_diverge.fixpoint_induct (motive := fun res => WP.dspec res _)
-  --     -- apply simple_diverge.fixpoint_induct (fun f => forall x, WP.dspec (f x) (fun res => res = 10#i32))
-  --     -- apply simple_diverge.fixpoint_induct (fun res => res = 10#i32)
-  --       -- <;> [ apply WP.dspec_admissible ; intros ]
-  --       -- <;> [ sorry ; intros ]
-  --     --
-  --     -- simp only
-  --     -- split
-  --     -- . simp [*]
-  --     -- . step
-  --     --   step
-  --     --   simp [*]
-  --     sorry
-
-  -- #print test_div
-  #print simple_diverge.eq_def
-  #print simple_diverge._proof_4
+  --     apply simple_diverge_2.fixpoint_induct
+  --       (motive := fun f => ∀ x y, WP.dspec (f x y) (fun res => res = 10#i32))
+  --     · --
+  --       apply Lean.Order.admissible_pi_apply (fun _ fx => WP.dspec fx _)
+  --       intros y
+  --       apply Lean.Order.admissible_pi
+  --       intros y
+  --       -- apply Lean.Order.admissible_apply (fun _ fx => WP.dspec fx _) y
+  --       apply Lean.Order.admissible_apply (fun _ fx => WP.dspec fx _)
+  --       -- refine' (Lean.Order.admissible_apply _ y)
+  --       --
+  --       intros
+  --       apply Lean.Order.admissible_flatOrder
+  --       simp only [WP.dspec]
+  --       --
+  --     · intros
+  --       simp only
+  --       split
+  --       . simp [*]
+  --       . step
+  --         step
+  --         simp [*]
+
+  theorem test_add (α β) (post)
+    : Order.admissible fun (f : α → Result β) => ∀ (x : α), WP.dspec (f x) post := by
+    apply Lean.Order.admissible_pi
+    intros
+    apply Lean.Order.admissible_apply (fun _ fx => WP.dspec fx _)
+    apply Lean.Order.admissible_flatOrder
+    simp only [WP.dspec]
+
+  theorem test_add_more_general (α β) (anything : (α → Result β) → Prop)
+    : Order.admissible fun (f : α → Result β) => anything f := by
+    --
+    sorry
+
+  open Lean.Order
+  def admissible_apply_simpler {α : Sort u}{β : Sort v} [CCPO β] (P : β → Prop) (x : α)
+    (hadm : admissible P) : admissible (fun (f : α → β) => P (f x)) := by
+    apply admissible_apply (fun _ => P) x
+    assumption
+
+  theorem test_add_2 (a1 a2 β) (post)
+    : Order.admissible fun (f : a1 → a2 → Result β) => ∀ (x : a1) (y : a2), WP.dspec (f x y) post := by
+    apply Lean.Order.admissible_pi
+    intros y1
+    apply Lean.Order.admissible_pi
+    intros y2
+    --
+    apply admissible_apply_simpler (β := a2 → Result β) (fun fx => WP.dspec (fx y2) post) y1
+    -- apply Lean.Order.admissible_apply (β := fun _ => a2 → Result β)
+      -- (fun x fx => WP.dspec (fx y2) post) y1
+    apply Lean.Order.admissible_apply (fun _ fx => WP.dspec fx _)
+    apply Lean.Order.admissible_flatOrder
+    simp only [WP.dspec]
+    --
 
   -- -- test out using a dspec theorem to prove a dspec.
   -- example : WP.dspec
@@ -1521,29 +1593,6 @@ namespace Test
     then ok 10#i32
     else ok 10#i32
 
-  @[step]
-  theorem simple_converge_property (x : Std.I32)
-    : Std.WP.spec (simple_converge x) (fun res => res = 10#i32)
-    := by
-      unfold simple_converge
-      split <;> simp [*]
-
-  example : WP.spec
-    (do let x ← 1#i32 + 2#i32
-        let y ← x + x
-        return y) (fun z => z.val == 10) := by
-    step
-    step
-    sorry
-
-  example : WP.spec
-    (do let x ← simple_converge 5#i32
-        let y ← simple_converge 6#i32
-        return x) (fun x => x = 10#i32) := by
-      step -- test using spec thm to prove spec
-      step
-      simp [*]
-
   @[step]
   theorem simple_converge_property_dspec (x : Std.I32)
     : Std.WP.dspec (simple_converge x) (fun res => res = 10#i32)
@@ -1551,12 +1600,13 @@ namespace Test
       unfold simple_converge
       split <;> simp [WP.dspec]
 
+  -- test using dspec theorem to step dspec
   example : WP.dspec
     (do let x ← simple_converge 5#i32
-        let y ← simple_converge 6#i32
+        let _y ← simple_converge 6#i32
         return x) (fun x => x = 10#i32) := by
-      step -- TODO: should work!
-      step -- need qimp intro tactics!
+      step
+      step
       simp [*]
       --
 
@@ -1575,30 +1625,29 @@ namespace Test
         let y ← x + x
         return y) (fun z => z.val == 6) := by
     step
-    --
     step
-    sorry
-
-  -- -- test out using a spec theorem to prove a dspec
-  -- example : WP.dspec
-  --   (do let x ← simple_converge 5#i32
-  --       let y ← simple_converge 6#i32
-  --       return x) (fun x => x = 10#i32) := by
-  --     step -- this works because step_bind' is polymorphic over divergence
-  --     step
-  --     simp [*]
+    simp [*]
 
-  -- -- confirm that you can't use dspec from spec
-  -- example : WP.spec
-  --   (do let x ← simple_diverge 5#i32
-  --       let y ← simple_diverge 6#i32
-  --       return x) (fun x => x = 10#i32) := by
-  --   step -- this should fail!
-  --   step
-  --   simp [*]
-  --   --
+  -- test out using a spec theorem to prove a dspec
+  example : WP.dspec
+    (do let x ← simple_converge 5#i32
+        let _y ← simple_converge 6#i32
+        return x) (fun x => x = 10#i32) := by
+      step
+      step
+      simp [*]
 
-  -- ---------------------------------------
+  -- confirm that you can't use dspec from spec
+  /-- error: Step failed: could not find a local assumption or a theorem to apply -/
+#guard_msgs in
+  example : WP.spec
+    (do let x ← simple_diverge 5#i32
+        let y ← simple_diverge 6#i32
+        return x) (fun x => x = 10#i32) := by
+    step -- this should fail!
+    step
+    simp [*]
+    --
 
   /- This test case checks what happens when `step`:
      - manages to solve the current goal
diff --git a/backends/lean/Aeneas/Tactic/Step/Trace.lean b/backends/lean/Aeneas/Tactic/Step/Trace.lean
index c6eb80fa0..3ee59a3a0 100644
--- a/backends/lean/Aeneas/Tactic/Step/Trace.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Trace.lean
@@ -6,5 +6,6 @@ namespace Aeneas.Step
 -- We can't define and use trace classes in the same file
 initialize registerTraceClass `Step
 initialize registerTraceClass `StepElab
+initialize registerTraceClass `UnfoldPF
 
 end Aeneas.Step
diff --git a/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean b/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean
new file mode 100644
index 000000000..2b9841b4b
--- /dev/null
+++ b/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean
@@ -0,0 +1,310 @@
+import Lean
+import Aeneas.Tactic.Solver.ScalarTac
+import Aeneas.Tactic.Step.Init
+import Aeneas.Tactic.Step.GrindState
+import Aeneas.Std
+import Aeneas.Tactic.Simp.SimpLemmas
+import AeneasMeta.Async
+import Aeneas.Tactic.Solver.Grind.Init
+import Aeneas.Tactic.Step.InferPost
+import Aeneas.Tactic.Step
+
+-- tactic for unfolding partial_fixpoint definitions with fixpoint_induct
+-- normally you would use the normal unfold tactic, but that requires the proof to be terminating
+
+namespace Aeneas
+
+namespace UnfoldPF
+
+open Lean Elab Term Meta Tactic
+open Utils
+open Lean.Order
+open Std Result
+
+
+  theorem curry_admissible (a1 a2 a3) (P : (a1 → a2 → a3) → Prop) [CCPO a3]
+    (h : Order.admissible fun (f : (a1 × a2) → a3) => P (fun x y => f (x, y)))
+    : Order.admissible fun (f : a1 → a2 → a3) => P f := by
+    intros c hchain hc
+    simp only at hc
+    unfold admissible at h
+    simp only at h
+    have h := h (fun f => c (fun x y => f (x, y))) (
+      by
+        unfold chain
+        unfold chain at hchain
+        intros s1 s2 cs1 cs2
+        have thing := hchain (fun x y => s1 (x, y)) (fun x y => s2 (x, y)) cs1 cs2
+        unfold PartialOrder.rel
+        unfold instCCPOPi
+        simp only
+        unfold instOrderPi
+        simp only
+        cases thing with
+        | inl thing =>
+            apply Or.inl
+            intros
+            apply thing
+        | inr thing =>
+          apply Or.inr
+          intros
+          apply thing
+    ) ( by
+      intros f
+      apply hc
+    )
+    simp at h
+    --
+    rw [← Order.fun_csup_eq]
+    unfold fun_csup
+    simp only
+    --
+    simp only [← Order.fun_csup_eq]
+    unfold fun_csup
+    simp only
+    --
+    simp only [← Order.fun_csup_eq] at h
+    unfold fun_csup at h
+    simp only at h
+    --
+    have lemma1 (x : a1) (y : a2)
+      : (fun z => ∃ (f : a1 × a2 → a3), (c fun x y => f (x, y)) ∧ f (x, y) = z)
+        = (fun z => ∃ f, (∃ f_1, c f_1 ∧ f_1 x = f) ∧ f y = z) := by
+      simp
+      funext z
+      simp only [eq_iff_iff]
+      apply Iff.intro
+      · intros h
+        rcases h with ⟨f, a, b⟩
+        exists (fun x y => f (x, y))
+      ·
+        intros h
+        rcases h with ⟨f, a, b⟩
+        exists (fun p => f p.fst p.snd)
+        --
+      --
+    simp [lemma1] at h
+    simp only [↓existsAndEq, and_true] at *
+    apply h
+
+  theorem WP_func_admissible (α β) (arg) (post)
+    : Order.admissible fun (f : α → Result β) => WP.dspec (f arg) post := by
+    apply Lean.Order.admissible_apply (fun _ fx => WP.dspec fx _)
+    apply Lean.Order.admissible_flatOrder
+    simp only [WP.dspec]
+
+  macro "prove_admissible" : tactic =>
+    `(tactic| (
+        (repeat' apply curry_admissible)
+        (repeat' (apply Lean.Order.admissible_pi ; intro))
+        (apply WP_func_admissible)
+    )
+    )
+
+  elab "unfold_div_old" : tactic => do
+    let mut goal ← getMainGoal
+    let ty ← goal.getType
+
+    let (thHead, thArgs) := ty.consumeMData.withApp (fun f args => (f, args))
+    -- TODO: here is where it should be able to lift from spec to dspec
+    if !thHead.isConst || thHead.constName! != ``Std.WP.dspec then
+      throwError "Not dspec statement"
+    -- let .app WP.dspec a b := ty
+    let (func, funcargs) := thArgs[1]!.consumeMData.withApp (fun f args => (f, args))
+    if !func.isConst then
+      throwError "Can only unfold (dspec (func... ) post) when func is a constant"
+
+    let post := thArgs[2]!
+    -- the goal is now split into (dspec (func ..funcargs) post)
+
+    -- let mut vars : Array FVarId := #[]
+
+    -- should we automatically revert variables? could this ever cause a problem?
+    -- -- first, we need to revert free variables that are arguments to the function
+    -- for arg in funcargs do
+    --   -- TODO: maybe its not always a free var, what cases need to be handled here?
+    --   let var := arg.fvarId!
+    --   vars := vars.push var
+    --   (_, goal) ← goal.revert #[var]
+
+
+    -- do some wierd hacky nonsense to get `func.fixpoint_induct`
+    let namee := func.constName!.mkStr "fixpoint_induct"
+    let fi_stx : Syntax ← `(term | $(mkIdent namee))
+    let fixpoint_induct ← Term.elabTerm fi_stx none
+    trace[UnfoldPF] "type of fixpoint_induct is {← inferType fixpoint_induct}"
+
+    -- apply fixpoint_induct
+    let fi_app := mkAppN fixpoint_induct #[
+      .lam `func (← inferType func)
+      (mkAppN (.bvar 0) #[])
+      .default
+    ]
+
+    replaceMainGoal [goal]
+    pure ()
+
+  -- this new version doesn't try to revert the variables, and is more general.
+  -- but it requires that you give it the name of the thing to induct over
+  elab "fixpoint_induction" func:ident : tactic => do
+    let mut goal ← getMainGoal
+    let ty ← goal.getType
+
+    let func_expr ← Term.elabTerm func none
+
+    -- do some wierd hacky nonsense to get `func.fixpoint_induct`
+    let namee := func.getId.mkStr "fixpoint_induct"
+    let fi_stx : Syntax ← `(term | $(mkIdent namee))
+    let fixpoint_induct ← Term.elabTerm fi_stx none
+    trace[UnfoldPF] "type of fixpoint_induct is {← inferType fixpoint_induct}"
+    -- apply fixpoint_induct
+
+    -- make a type family that abstracts over instances of func in the goal type
+    let abs_goal_ty := ty.abstract #[func_expr]
+
+    let fi_app := mkAppN fixpoint_induct #[.lam `func (← inferType func_expr)
+      (abs_goal_ty.instantiate1 (.bvar 0)) .default
+    ]
+
+    let [g1, g2] ← goal.apply fi_app
+      | throwError "bla"
+
+    setGoals [g1]
+    evalTactic (← `(tactic|prove_admissible))
+
+    replaceMainGoal [g2]
+    pure ()
+
+  set_option trace.UnfoldPF true
+  -- #check simple_diverge.fixpoint_induct
+
+  theorem test_div_2 (x : Std.I32) : Std.WP.dspec (simple_diverge x) (fun res => res = 10#i32)
+    := by
+    unfold_div
+    --
+    sorry
+
+namespace Test
+
+  open Std Result Aeneas.UnfoldPF
+  def simple_diverge (x : Std.I32) : Result Std.I32 := do
+    if x = 0#i32
+    then ok 10#i32
+    else
+      let i1 ← 1#i32 + 1#i32
+      simple_diverge i1
+  partial_fixpoint
+
+  theorem test_div2 (x : Std.I32) : Std.WP.dspec (simple_diverge x) (fun res => res = 10#i32)
+    := by
+      unfold simple_diverge
+      --
+      sorry
+
+  -- TODO: if i use unfold then sorry, print proof term, i can see how it proves admissibility
+  #check simple_diverge.fixpoint_induct
+  @[step]
+  theorem test_div (x : Std.I32) : Std.WP.dspec (simple_diverge x) (fun res => res = 10#i32)
+    := by
+      --
+      revert x
+      apply simple_diverge.fixpoint_induct
+        (motive := fun simple_diverge => ∀ x, WP.dspec (simple_diverge x) (fun res => res = 10#i32))
+      · apply Lean.Order.admissible_pi
+        intros y
+        apply Lean.Order.admissible_apply (fun _ fx => WP.dspec fx _)
+        apply Lean.Order.admissible_flatOrder
+        simp only [WP.dspec]
+      · intros
+        simp only
+        split
+        . simp [*]
+        . step
+          step
+          simp [*]
+
+  theorem test_div_no_revert (x : Std.I32) : Std.WP.dspec (simple_diverge x) (fun res => res = 10#i32)
+    := by
+      --
+      apply simple_diverge.fixpoint_induct
+        (motive := fun simple_diverge => ∀ x, WP.dspec (simple_diverge x) (fun res => res = 10#i32))
+      · apply Lean.Order.admissible_pi
+        intros y
+        apply Lean.Order.admissible_apply (fun _ fx => WP.dspec fx _)
+        apply Lean.Order.admissible_flatOrder
+        simp only [WP.dspec]
+        --
+      · intros
+        simp only
+        split
+        . simp [*]
+        . step
+          step
+          simp [*]
+
+  theorem test_div_no_revert_no_all (x : Std.I32) : Std.WP.dspec (simple_diverge x) (fun res => res = 10#i32)
+    := by
+      --
+      apply simple_diverge.fixpoint_induct
+        (motive := fun simple_diverge => WP.dspec (simple_diverge x) (fun res => res = 10#i32))
+      · apply Lean.Order.admissible_apply (fun _ fx => WP.dspec fx _)
+        apply Lean.Order.admissible_flatOrder
+        simp only [WP.dspec]
+      · intros
+        simp only
+        split
+        . simp [*]
+        . step
+          step
+          simp [*]
+  def simple_diverge_2 (x y : Std.I32) : Result Std.I32 := do
+    if x = y#i32
+    then ok 10#i32
+    else
+      let i1 ← 1#i32 + 1#i32
+      let i2 ← 1#i32 + 1#i32
+      simple_diverge_2 i1 i2
+  partial_fixpoint
+
+  def admissible_apply_simpler {α : Sort u}{β : Sort v} [CCPO β] (P : β → Prop) (x : α)
+    (hadm : admissible P) : admissible (fun (f : α → β) => P (f x)) := by
+    apply admissible_apply (fun _ => P) x
+    assumption
+
+  theorem test_add_2 (a1 a2 β) (post)
+    : Order.admissible fun (f : a1 → a2 → Result β) => ∀ (x : a1) (y : a2), WP.dspec (f x y) post := by
+    apply Lean.Order.admissible_pi
+    intros y1
+    apply Lean.Order.admissible_pi
+    intros y2
+    --
+    apply admissible_apply_simpler (β := a2 → Result β) (fun fx => WP.dspec (fx y2) post) y1
+    -- apply Lean.Order.admissible_apply (β := fun _ => a2 → Result β)
+      -- (fun x fx => WP.dspec (fx y2) post) y1
+    apply Lean.Order.admissible_apply (fun _ fx => WP.dspec fx _)
+    apply Lean.Order.admissible_flatOrder
+    simp only [WP.dspec]
+
+  theorem test_div_2 (x y : Std.I32) : Std.WP.dspec (simple_diverge_2 x y) (fun res => res = 10#i32)
+    := by
+      --
+      revert x y
+      apply simple_diverge_2.fixpoint_induct
+        (motive := fun simple_diverge_2 => ∀ x y, WP.dspec (simple_diverge_2 x y) (fun res => res = 10#i32))
+      ·
+        -- apply test_add_2
+        prove_admissible
+        --
+      · intros
+        simp only
+        split
+        . simp [*]
+        . step
+          step
+          simp [*]
+          --
+end Test
+
+
+end UnfoldPF
+end Aeneas

From 7169830b9935aa8a5d2c2bd77498f303397628e6 Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Tue, 2 Jun 2026 11:54:41 -0400
Subject: [PATCH 09/67] got all the parts working individually

---
 .../lean/Aeneas/Tactic/Step/UnfoldPF.lean     | 133 +++++++++---------
 1 file changed, 63 insertions(+), 70 deletions(-)

diff --git a/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean b/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean
index 2b9841b4b..71d56e806 100644
--- a/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean
+++ b/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean
@@ -146,7 +146,7 @@ open Std Result
 
   -- this new version doesn't try to revert the variables, and is more general.
   -- but it requires that you give it the name of the thing to induct over
-  elab "fixpoint_induction" func:ident : tactic => do
+  elab "dspec_induction" func:ident : tactic => do
     let mut goal ← getMainGoal
     let ty ← goal.getType
 
@@ -160,30 +160,38 @@ open Std Result
     -- apply fixpoint_induct
 
     -- make a type family that abstracts over instances of func in the goal type
-    let abs_goal_ty := ty.abstract #[func_expr]
+    -- let abs_goal_ty := ty.abstract #[func_expr]
+    -- let abs_goal_ty := (ty.liftLooseBVars 0 1).replace (fun x => if x == func_expr then some (Expr.bvar 0) else none)
+    -- TODO: where i left off is that i need to find instances of func in the goal,
+    -- and then make a tyep family that abstracts over these instances to pass to fixpoint_induct
 
-    let fi_app := mkAppN fixpoint_induct #[.lam `func (← inferType func_expr)
-      (abs_goal_ty.instantiate1 (.bvar 0)) .default
-    ]
+    let func_expr_ty ← inferType func_expr
+    let fmvar ← Meta.mkFreshExprMVar (some func_expr_ty)
+    let abs_goal_ty := ty.replace (fun x => if x == func_expr then some fmvar else none)
+    let abs_goal_ty := abs_goal_ty.abstract #[fmvar]
+    let abs_goal_ty := Expr.lam `func func_expr_ty abs_goal_ty .default
+
+    trace[UnfoldPF] abs_goal_ty
+
+    -- let fi_app := mkAppN fixpoint_induct #[.lam `func (← inferType func_expr)
+      -- (abs_goal_ty.instantiate1 (.bvar 0)) .default
+    -- ]
+    let fi_app := mkAppN fixpoint_induct #[abs_goal_ty]
 
     let [g1, g2] ← goal.apply fi_app
       | throwError "bla"
 
-    setGoals [g1]
-    evalTactic (← `(tactic|prove_admissible))
 
-    replaceMainGoal [g2]
+    replaceMainGoal [g1, g2]
+    -- setGoals [g1]
+    -- TODO: use withTransparency to stop apply from reducing unecessary things
+    -- TODO: don't evaluate syntax here
+    evalTactic (← `(tactic|prove_admissible))
     pure ()
 
   set_option trace.UnfoldPF true
   -- #check simple_diverge.fixpoint_induct
 
-  theorem test_div_2 (x : Std.I32) : Std.WP.dspec (simple_diverge x) (fun res => res = 10#i32)
-    := by
-    unfold_div
-    --
-    sorry
-
 namespace Test
 
   open Std Result Aeneas.UnfoldPF
@@ -210,11 +218,13 @@ namespace Test
       revert x
       apply simple_diverge.fixpoint_induct
         (motive := fun simple_diverge => ∀ x, WP.dspec (simple_diverge x) (fun res => res = 10#i32))
-      · apply Lean.Order.admissible_pi
-        intros y
-        apply Lean.Order.admissible_apply (fun _ fx => WP.dspec fx _)
-        apply Lean.Order.admissible_flatOrder
-        simp only [WP.dspec]
+      · --
+        prove_admissible
+        -- apply Lean.Order.admissible_pi
+        -- intros y
+        -- apply Lean.Order.admissible_apply (fun _ fx => WP.dspec fx _)
+        -- apply Lean.Order.admissible_flatOrder
+        -- simp only [WP.dspec]
       · intros
         simp only
         split
@@ -223,40 +233,19 @@ namespace Test
           step
           simp [*]
 
-  theorem test_div_no_revert (x : Std.I32) : Std.WP.dspec (simple_diverge x) (fun res => res = 10#i32)
+  theorem test_div' (x : Std.I32) : Std.WP.dspec (simple_diverge x) (fun res => res = 10#i32)
     := by
-      --
-      apply simple_diverge.fixpoint_induct
-        (motive := fun simple_diverge => ∀ x, WP.dspec (simple_diverge x) (fun res => res = 10#i32))
-      · apply Lean.Order.admissible_pi
-        intros y
-        apply Lean.Order.admissible_apply (fun _ fx => WP.dspec fx _)
-        apply Lean.Order.admissible_flatOrder
-        simp only [WP.dspec]
-        --
-      · intros
-        simp only
-        split
-        . simp [*]
-        . step
-          step
-          simp [*]
+      revert x
+      dspec_induction simple_diverge
+      intros
+      simp only
+      split
+      . simp [*]
+      . step
+        step
+        simp [*]
+
 
-  theorem test_div_no_revert_no_all (x : Std.I32) : Std.WP.dspec (simple_diverge x) (fun res => res = 10#i32)
-    := by
-      --
-      apply simple_diverge.fixpoint_induct
-        (motive := fun simple_diverge => WP.dspec (simple_diverge x) (fun res => res = 10#i32))
-      · apply Lean.Order.admissible_apply (fun _ fx => WP.dspec fx _)
-        apply Lean.Order.admissible_flatOrder
-        simp only [WP.dspec]
-      · intros
-        simp only
-        split
-        . simp [*]
-        . step
-          step
-          simp [*]
   def simple_diverge_2 (x y : Std.I32) : Result Std.I32 := do
     if x = y#i32
     then ok 10#i32
@@ -266,25 +255,6 @@ namespace Test
       simple_diverge_2 i1 i2
   partial_fixpoint
 
-  def admissible_apply_simpler {α : Sort u}{β : Sort v} [CCPO β] (P : β → Prop) (x : α)
-    (hadm : admissible P) : admissible (fun (f : α → β) => P (f x)) := by
-    apply admissible_apply (fun _ => P) x
-    assumption
-
-  theorem test_add_2 (a1 a2 β) (post)
-    : Order.admissible fun (f : a1 → a2 → Result β) => ∀ (x : a1) (y : a2), WP.dspec (f x y) post := by
-    apply Lean.Order.admissible_pi
-    intros y1
-    apply Lean.Order.admissible_pi
-    intros y2
-    --
-    apply admissible_apply_simpler (β := a2 → Result β) (fun fx => WP.dspec (fx y2) post) y1
-    -- apply Lean.Order.admissible_apply (β := fun _ => a2 → Result β)
-      -- (fun x fx => WP.dspec (fx y2) post) y1
-    apply Lean.Order.admissible_apply (fun _ fx => WP.dspec fx _)
-    apply Lean.Order.admissible_flatOrder
-    simp only [WP.dspec]
-
   theorem test_div_2 (x y : Std.I32) : Std.WP.dspec (simple_diverge_2 x y) (fun res => res = 10#i32)
     := by
       --
@@ -293,6 +263,16 @@ namespace Test
         (motive := fun simple_diverge_2 => ∀ x y, WP.dspec (simple_diverge_2 x y) (fun res => res = 10#i32))
       ·
         -- apply test_add_2
+        -- apply curry_admissible
+        -- apply Lean.Order.admissible_pi
+        -- intro
+        -- apply Lean.Order.admissible_pi
+        -- intro
+        -- simp only
+        -- apply Lean.Order.admissible_apply (fun _ fx => WP.dspec fx _)
+        -- apply Lean.Order.admissible_flatOrder
+        -- simp only [WP.dspec]
+        ---
         prove_admissible
         --
       · intros
@@ -303,6 +283,19 @@ namespace Test
           step
           simp [*]
           --
+
+  theorem test_div_2' (x y : Std.I32) : Std.WP.dspec (simple_diverge_2 x y) (fun res => res = 10#i32)
+    := by
+      revert x y
+      dspec_induction simple_diverge_2
+      intros
+      simp only
+      split
+      . simp [*]
+      . step
+        step
+        simp [*]
+
 end Test
 
 

From 59d1de427450d70a2749afbea6605ad7fd895ecf Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Tue, 2 Jun 2026 14:02:32 -0400
Subject: [PATCH 10/67] cleaned up UnfoldPF.lean

---
 .../lean/Aeneas/Tactic/Step/UnfoldPF.lean     | 129 ++++--------------
 1 file changed, 30 insertions(+), 99 deletions(-)

diff --git a/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean b/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean
index 71d56e806..2230fe6fa 100644
--- a/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean
+++ b/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean
@@ -87,7 +87,7 @@ open Std Result
     simp only [↓existsAndEq, and_true] at *
     apply h
 
-  theorem WP_func_admissible (α β) (arg) (post)
+  theorem WP_func_admissible (α β : Type) (arg) (post)
     : Order.admissible fun (f : α → Result β) => WP.dspec (f arg) post := by
     apply Lean.Order.admissible_apply (fun _ fx => WP.dspec fx _)
     apply Lean.Order.admissible_flatOrder
@@ -101,51 +101,6 @@ open Std Result
     )
     )
 
-  elab "unfold_div_old" : tactic => do
-    let mut goal ← getMainGoal
-    let ty ← goal.getType
-
-    let (thHead, thArgs) := ty.consumeMData.withApp (fun f args => (f, args))
-    -- TODO: here is where it should be able to lift from spec to dspec
-    if !thHead.isConst || thHead.constName! != ``Std.WP.dspec then
-      throwError "Not dspec statement"
-    -- let .app WP.dspec a b := ty
-    let (func, funcargs) := thArgs[1]!.consumeMData.withApp (fun f args => (f, args))
-    if !func.isConst then
-      throwError "Can only unfold (dspec (func... ) post) when func is a constant"
-
-    let post := thArgs[2]!
-    -- the goal is now split into (dspec (func ..funcargs) post)
-
-    -- let mut vars : Array FVarId := #[]
-
-    -- should we automatically revert variables? could this ever cause a problem?
-    -- -- first, we need to revert free variables that are arguments to the function
-    -- for arg in funcargs do
-    --   -- TODO: maybe its not always a free var, what cases need to be handled here?
-    --   let var := arg.fvarId!
-    --   vars := vars.push var
-    --   (_, goal) ← goal.revert #[var]
-
-
-    -- do some wierd hacky nonsense to get `func.fixpoint_induct`
-    let namee := func.constName!.mkStr "fixpoint_induct"
-    let fi_stx : Syntax ← `(term | $(mkIdent namee))
-    let fixpoint_induct ← Term.elabTerm fi_stx none
-    trace[UnfoldPF] "type of fixpoint_induct is {← inferType fixpoint_induct}"
-
-    -- apply fixpoint_induct
-    let fi_app := mkAppN fixpoint_induct #[
-      .lam `func (← inferType func)
-      (mkAppN (.bvar 0) #[])
-      .default
-    ]
-
-    replaceMainGoal [goal]
-    pure ()
-
-  -- this new version doesn't try to revert the variables, and is more general.
-  -- but it requires that you give it the name of the thing to induct over
   elab "dspec_induction" func:ident : tactic => do
     let mut goal ← getMainGoal
     let ty ← goal.getType
@@ -157,14 +112,8 @@ open Std Result
     let fi_stx : Syntax ← `(term | $(mkIdent namee))
     let fixpoint_induct ← Term.elabTerm fi_stx none
     trace[UnfoldPF] "type of fixpoint_induct is {← inferType fixpoint_induct}"
-    -- apply fixpoint_induct
 
     -- make a type family that abstracts over instances of func in the goal type
-    -- let abs_goal_ty := ty.abstract #[func_expr]
-    -- let abs_goal_ty := (ty.liftLooseBVars 0 1).replace (fun x => if x == func_expr then some (Expr.bvar 0) else none)
-    -- TODO: where i left off is that i need to find instances of func in the goal,
-    -- and then make a tyep family that abstracts over these instances to pass to fixpoint_induct
-
     let func_expr_ty ← inferType func_expr
     let fmvar ← Meta.mkFreshExprMVar (some func_expr_ty)
     let abs_goal_ty := ty.replace (fun x => if x == func_expr then some fmvar else none)
@@ -173,28 +122,38 @@ open Std Result
 
     trace[UnfoldPF] abs_goal_ty
 
-    -- let fi_app := mkAppN fixpoint_induct #[.lam `func (← inferType func_expr)
-      -- (abs_goal_ty.instantiate1 (.bvar 0)) .default
-    -- ]
     let fi_app := mkAppN fixpoint_induct #[abs_goal_ty]
 
-    let [g1, g2] ← goal.apply fi_app
+    let [g_admissible, g_main] ← goal.apply fi_app
       | throwError "bla"
 
 
-    replaceMainGoal [g1, g2]
-    -- setGoals [g1]
-    -- TODO: use withTransparency to stop apply from reducing unecessary things
-    -- TODO: don't evaluate syntax here
-    evalTactic (← `(tactic|prove_admissible))
+    -- prove the admissibility condition. this chunk of code is equivalent to the
+    -- `prove_admissible` tactic above, but apparently calling that directly might cause problems
+    let _ ← withTransparency .none <| do
+      let onError {α} : TacticM α := throwError "failed to prove admissibility condition"
+      let curry_admissible ← mkConstWithFreshMVarLevels `Aeneas.UnfoldPF.curry_admissible
+      let admissible_pi ← mkConstWithFreshMVarLevels `Lean.Order.admissible_pi
+      let WP_func_admissible ← mkConstWithFreshMVarLevels `Aeneas.UnfoldPF.WP_func_admissible
+      let [g_admissible]
+        ← repeat' (fun g => g.apply curry_admissible) [g_admissible] | onError
+      let [g_admissible]
+        ← repeat' (fun g => do
+            let [g] ← (g.apply admissible_pi) | onError
+            pure [(← g.intro1P).snd]
+        ) [g_admissible] | onError
+      let [] ← g_admissible.apply WP_func_admissible | onError
+
+    replaceMainGoal [g_main]
     pure ()
 
-  set_option trace.UnfoldPF true
-  -- #check simple_diverge.fixpoint_induct
+  -- uncomment to see debug traces:
+  -- set_option trace.UnfoldPF true
 
 namespace Test
 
   open Std Result Aeneas.UnfoldPF
+
   def simple_diverge (x : Std.I32) : Result Std.I32 := do
     if x = 0#i32
     then ok 10#i32
@@ -203,28 +162,13 @@ namespace Test
       simple_diverge i1
   partial_fixpoint
 
-  theorem test_div2 (x : Std.I32) : Std.WP.dspec (simple_diverge x) (fun res => res = 10#i32)
-    := by
-      unfold simple_diverge
-      --
-      sorry
-
-  -- TODO: if i use unfold then sorry, print proof term, i can see how it proves admissibility
-  #check simple_diverge.fixpoint_induct
-  @[step]
-  theorem test_div (x : Std.I32) : Std.WP.dspec (simple_diverge x) (fun res => res = 10#i32)
+  -- this version demonstrates what the dspec_induction tactic does, just done manually
+  theorem test_div_manual (x : Std.I32) : Std.WP.dspec (simple_diverge x) (fun res => res = 10#i32)
     := by
-      --
       revert x
       apply simple_diverge.fixpoint_induct
         (motive := fun simple_diverge => ∀ x, WP.dspec (simple_diverge x) (fun res => res = 10#i32))
-      · --
-        prove_admissible
-        -- apply Lean.Order.admissible_pi
-        -- intros y
-        -- apply Lean.Order.admissible_apply (fun _ fx => WP.dspec fx _)
-        -- apply Lean.Order.admissible_flatOrder
-        -- simp only [WP.dspec]
+      · prove_admissible
       · intros
         simp only
         split
@@ -233,7 +177,8 @@ namespace Test
           step
           simp [*]
 
-  theorem test_div' (x : Std.I32) : Std.WP.dspec (simple_diverge x) (fun res => res = 10#i32)
+  -- here, done automatically with the tactic
+  theorem test_div_tactic (x : Std.I32) : Std.WP.dspec (simple_diverge x) (fun res => res = 10#i32)
     := by
       revert x
       dspec_induction simple_diverge
@@ -245,7 +190,6 @@ namespace Test
         step
         simp [*]
 
-
   def simple_diverge_2 (x y : Std.I32) : Result Std.I32 := do
     if x = y#i32
     then ok 10#i32
@@ -255,26 +199,13 @@ namespace Test
       simple_diverge_2 i1 i2
   partial_fixpoint
 
-  theorem test_div_2 (x y : Std.I32) : Std.WP.dspec (simple_diverge_2 x y) (fun res => res = 10#i32)
+  theorem test_div_2_manual (x y : Std.I32) : Std.WP.dspec (simple_diverge_2 x y) (fun res => res = 10#i32)
     := by
       --
       revert x y
       apply simple_diverge_2.fixpoint_induct
         (motive := fun simple_diverge_2 => ∀ x y, WP.dspec (simple_diverge_2 x y) (fun res => res = 10#i32))
-      ·
-        -- apply test_add_2
-        -- apply curry_admissible
-        -- apply Lean.Order.admissible_pi
-        -- intro
-        -- apply Lean.Order.admissible_pi
-        -- intro
-        -- simp only
-        -- apply Lean.Order.admissible_apply (fun _ fx => WP.dspec fx _)
-        -- apply Lean.Order.admissible_flatOrder
-        -- simp only [WP.dspec]
-        ---
-        prove_admissible
-        --
+      · prove_admissible
       · intros
         simp only
         split
@@ -284,7 +215,7 @@ namespace Test
           simp [*]
           --
 
-  theorem test_div_2' (x y : Std.I32) : Std.WP.dspec (simple_diverge_2 x y) (fun res => res = 10#i32)
+  theorem test_div_2_tactic (x y : Std.I32) : Std.WP.dspec (simple_diverge_2 x y) (fun res => res = 10#i32)
     := by
       revert x y
       dspec_induction simple_diverge_2

From 12a67e35f651bc0880f9313831a1bb7d6a8066d8 Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Tue, 2 Jun 2026 14:13:00 -0400
Subject: [PATCH 11/67] cleaned up more

---
 .../lean/Aeneas/Tactic/Step/UnfoldPF.lean     | 378 +++++++++---------
 1 file changed, 190 insertions(+), 188 deletions(-)

diff --git a/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean b/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean
index 2230fe6fa..cf6617e95 100644
--- a/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean
+++ b/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean
@@ -11,6 +11,12 @@ import Aeneas.Tactic.Step
 
 -- tactic for unfolding partial_fixpoint definitions with fixpoint_induct
 -- normally you would use the normal unfold tactic, but that requires the proof to be terminating
+-- instead, you need to use the .fixpoint_induct theorem that is automatically created by lean
+-- however, this requires a bunch of boilerplate that can be automated in the case that
+-- the conclusion is a dspec theorem about a function call.
+-- in particular, the statement needs to be proven to be admissible.
+-- see the examples below to see what the tactic does
+-- and the manual examples show what the tactic is doing written out directly
 
 namespace Aeneas
 
@@ -21,168 +27,152 @@ open Utils
 open Lean.Order
 open Std Result
 
-
-  theorem curry_admissible (a1 a2 a3) (P : (a1 → a2 → a3) → Prop) [CCPO a3]
-    (h : Order.admissible fun (f : (a1 × a2) → a3) => P (fun x y => f (x, y)))
-    : Order.admissible fun (f : a1 → a2 → a3) => P f := by
-    intros c hchain hc
-    simp only at hc
-    unfold admissible at h
-    simp only at h
-    have h := h (fun f => c (fun x y => f (x, y))) (
-      by
-        unfold chain
-        unfold chain at hchain
-        intros s1 s2 cs1 cs2
-        have thing := hchain (fun x y => s1 (x, y)) (fun x y => s2 (x, y)) cs1 cs2
-        unfold PartialOrder.rel
-        unfold instCCPOPi
-        simp only
-        unfold instOrderPi
-        simp only
-        cases thing with
-        | inl thing =>
-            apply Or.inl
-            intros
-            apply thing
-        | inr thing =>
-          apply Or.inr
+theorem curry_admissible (a1 a2 a3) (P : (a1 → a2 → a3) → Prop) [CCPO a3]
+  (h : Order.admissible fun (f : (a1 × a2) → a3) => P (fun x y => f (x, y)))
+  : Order.admissible fun (f : a1 → a2 → a3) => P f := by
+  intros c hchain hc
+  simp only at hc
+  unfold admissible at h
+  simp only at h
+  have h := h (fun f => c (fun x y => f (x, y))) (
+    by
+      unfold chain
+      unfold chain at hchain
+      intros s1 s2 cs1 cs2
+      have thing := hchain (fun x y => s1 (x, y)) (fun x y => s2 (x, y)) cs1 cs2
+      unfold PartialOrder.rel
+      unfold instCCPOPi
+      simp only
+      unfold instOrderPi
+      simp only
+      cases thing with
+      | inl thing =>
+          apply Or.inl
           intros
           apply thing
-    ) ( by
-      intros f
-      apply hc
-    )
-    simp at h
-    --
-    rw [← Order.fun_csup_eq]
-    unfold fun_csup
-    simp only
-    --
-    simp only [← Order.fun_csup_eq]
-    unfold fun_csup
-    simp only
-    --
-    simp only [← Order.fun_csup_eq] at h
-    unfold fun_csup at h
-    simp only at h
-    --
-    have lemma1 (x : a1) (y : a2)
-      : (fun z => ∃ (f : a1 × a2 → a3), (c fun x y => f (x, y)) ∧ f (x, y) = z)
-        = (fun z => ∃ f, (∃ f_1, c f_1 ∧ f_1 x = f) ∧ f y = z) := by
-      simp
-      funext z
-      simp only [eq_iff_iff]
-      apply Iff.intro
-      · intros h
-        rcases h with ⟨f, a, b⟩
-        exists (fun x y => f (x, y))
-      ·
-        intros h
-        rcases h with ⟨f, a, b⟩
-        exists (fun p => f p.fst p.snd)
-        --
-      --
-    simp [lemma1] at h
-    simp only [↓existsAndEq, and_true] at *
-    apply h
-
-  theorem WP_func_admissible (α β : Type) (arg) (post)
-    : Order.admissible fun (f : α → Result β) => WP.dspec (f arg) post := by
-    apply Lean.Order.admissible_apply (fun _ fx => WP.dspec fx _)
-    apply Lean.Order.admissible_flatOrder
-    simp only [WP.dspec]
-
-  macro "prove_admissible" : tactic =>
-    `(tactic| (
-        (repeat' apply curry_admissible)
-        (repeat' (apply Lean.Order.admissible_pi ; intro))
-        (apply WP_func_admissible)
-    )
-    )
-
-  elab "dspec_induction" func:ident : tactic => do
-    let mut goal ← getMainGoal
-    let ty ← goal.getType
-
-    let func_expr ← Term.elabTerm func none
-
-    -- do some wierd hacky nonsense to get `func.fixpoint_induct`
-    let namee := func.getId.mkStr "fixpoint_induct"
-    let fi_stx : Syntax ← `(term | $(mkIdent namee))
-    let fixpoint_induct ← Term.elabTerm fi_stx none
-    trace[UnfoldPF] "type of fixpoint_induct is {← inferType fixpoint_induct}"
-
-    -- make a type family that abstracts over instances of func in the goal type
-    let func_expr_ty ← inferType func_expr
-    let fmvar ← Meta.mkFreshExprMVar (some func_expr_ty)
-    let abs_goal_ty := ty.replace (fun x => if x == func_expr then some fmvar else none)
-    let abs_goal_ty := abs_goal_ty.abstract #[fmvar]
-    let abs_goal_ty := Expr.lam `func func_expr_ty abs_goal_ty .default
-
-    trace[UnfoldPF] abs_goal_ty
-
-    let fi_app := mkAppN fixpoint_induct #[abs_goal_ty]
-
-    let [g_admissible, g_main] ← goal.apply fi_app
-      | throwError "bla"
-
-
-    -- prove the admissibility condition. this chunk of code is equivalent to the
-    -- `prove_admissible` tactic above, but apparently calling that directly might cause problems
-    let _ ← withTransparency .none <| do
-      let onError {α} : TacticM α := throwError "failed to prove admissibility condition"
-      let curry_admissible ← mkConstWithFreshMVarLevels `Aeneas.UnfoldPF.curry_admissible
-      let admissible_pi ← mkConstWithFreshMVarLevels `Lean.Order.admissible_pi
-      let WP_func_admissible ← mkConstWithFreshMVarLevels `Aeneas.UnfoldPF.WP_func_admissible
-      let [g_admissible]
-        ← repeat' (fun g => g.apply curry_admissible) [g_admissible] | onError
-      let [g_admissible]
-        ← repeat' (fun g => do
-            let [g] ← (g.apply admissible_pi) | onError
-            pure [(← g.intro1P).snd]
-        ) [g_admissible] | onError
-      let [] ← g_admissible.apply WP_func_admissible | onError
-
-    replaceMainGoal [g_main]
-    pure ()
-
-  -- uncomment to see debug traces:
-  -- set_option trace.UnfoldPF true
+      | inr thing =>
+        apply Or.inr
+        intros
+        apply thing
+  ) ( by
+    intros f
+    apply hc
+  )
+  simp at h
+  --
+  rw [← Order.fun_csup_eq]
+  unfold fun_csup
+  simp only
+  --
+  simp only [← Order.fun_csup_eq]
+  unfold fun_csup
+  simp only
+  --
+  simp only [← Order.fun_csup_eq] at h
+  unfold fun_csup at h
+  simp only at h
+  --
+  have lemma1 (x : a1) (y : a2)
+    : (fun z => ∃ (f : a1 × a2 → a3), (c fun x y => f (x, y)) ∧ f (x, y) = z)
+      = (fun z => ∃ f, (∃ f_1, c f_1 ∧ f_1 x = f) ∧ f y = z) := by
+    simp
+    funext z
+    simp only [eq_iff_iff]
+    apply Iff.intro
+    · intros h
+      rcases h with ⟨f, a, b⟩
+      exists (fun x y => f (x, y))
+    · intros h
+      rcases h with ⟨f, a, b⟩
+      exists (fun p => f p.fst p.snd)
+  --
+  simp [lemma1] at h
+  simp only [↓existsAndEq, and_true] at *
+  apply h
+
+theorem WP_func_admissible (α β : Type) (arg) (post)
+  : Order.admissible fun (f : α → Result β) => WP.dspec (f arg) post := by
+  apply Lean.Order.admissible_apply (fun _ fx => WP.dspec fx _)
+  apply Lean.Order.admissible_flatOrder
+  simp only [WP.dspec]
+
+macro "prove_admissible" : tactic =>
+  `(tactic| (
+      (repeat' apply curry_admissible)
+      (repeat' (apply Lean.Order.admissible_pi ; intro))
+      (apply WP_func_admissible)
+  )
+  )
+
+elab "dspec_induction" func:ident : tactic => do
+  let mut goal ← getMainGoal
+  let ty ← goal.getType
+
+  let func_expr ← Term.elabTerm func none
+
+  -- do some wierd hacky nonsense to get `func.fixpoint_induct`
+  let namee := func.getId.mkStr "fixpoint_induct"
+  let fi_stx : Syntax ← `(term | $(mkIdent namee))
+  let fixpoint_induct ← Term.elabTerm fi_stx none
+  trace[UnfoldPF] "type of fixpoint_induct is {← inferType fixpoint_induct}"
+
+  -- make a type family that abstracts over instances of func in the goal type
+  let func_expr_ty ← inferType func_expr
+  let fmvar ← Meta.mkFreshExprMVar (some func_expr_ty)
+  let abs_goal_ty := ty.replace (fun x => if x == func_expr then some fmvar else none)
+  let abs_goal_ty := abs_goal_ty.abstract #[fmvar]
+  let abs_goal_ty := Expr.lam `func func_expr_ty abs_goal_ty .default
+
+  trace[UnfoldPF] abs_goal_ty
+
+  let fi_app := mkAppN fixpoint_induct #[abs_goal_ty]
+
+  let [g_admissible, g_main] ← goal.apply fi_app
+    | throwError "bla"
+
+
+  -- prove the admissibility condition. this chunk of code is equivalent to the
+  -- `prove_admissible` tactic above, but apparently calling that directly might cause problems
+  let _ ← withTransparency .none <| do
+    let onError {α} : TacticM α := throwError "failed to prove admissibility condition"
+    let curry_admissible ← mkConstWithFreshMVarLevels `Aeneas.UnfoldPF.curry_admissible
+    let admissible_pi ← mkConstWithFreshMVarLevels `Lean.Order.admissible_pi
+    let WP_func_admissible ← mkConstWithFreshMVarLevels `Aeneas.UnfoldPF.WP_func_admissible
+    let [g_admissible]
+      ← repeat' (fun g => g.apply curry_admissible) [g_admissible] | onError
+    let [g_admissible]
+      ← repeat' (fun g => do
+          let [g] ← (g.apply admissible_pi) | onError
+          pure [(← g.intro1P).snd]
+      ) [g_admissible] | onError
+    let [] ← g_admissible.apply WP_func_admissible | onError
+
+  replaceMainGoal [g_main]
+  pure ()
+
+-- uncomment to see debug traces:
+-- set_option trace.UnfoldPF true
 
 namespace Test
 
-  open Std Result Aeneas.UnfoldPF
-
-  def simple_diverge (x : Std.I32) : Result Std.I32 := do
-    if x = 0#i32
-    then ok 10#i32
-    else
-      let i1 ← 1#i32 + 1#i32
-      simple_diverge i1
-  partial_fixpoint
-
-  -- this version demonstrates what the dspec_induction tactic does, just done manually
-  theorem test_div_manual (x : Std.I32) : Std.WP.dspec (simple_diverge x) (fun res => res = 10#i32)
-    := by
-      revert x
-      apply simple_diverge.fixpoint_induct
-        (motive := fun simple_diverge => ∀ x, WP.dspec (simple_diverge x) (fun res => res = 10#i32))
-      · prove_admissible
-      · intros
-        simp only
-        split
-        . simp [*]
-        . step
-          step
-          simp [*]
-
-  -- here, done automatically with the tactic
-  theorem test_div_tactic (x : Std.I32) : Std.WP.dspec (simple_diverge x) (fun res => res = 10#i32)
-    := by
-      revert x
-      dspec_induction simple_diverge
-      intros
+open Std Result Aeneas.UnfoldPF
+
+def simple_diverge (x : Std.I32) : Result Std.I32 := do
+  if x = 0#i32
+  then ok 10#i32
+  else
+    let i1 ← 1#i32 + 1#i32
+    simple_diverge i1
+partial_fixpoint
+
+-- this version demonstrates what the dspec_induction tactic does, just done manually
+theorem test_div_manual (x : Std.I32) : Std.WP.dspec (simple_diverge x) (fun res => res = 10#i32)
+  := by
+    revert x
+    apply simple_diverge.fixpoint_induct
+      (motive := fun simple_diverge => ∀ x, WP.dspec (simple_diverge x) (fun res => res = 10#i32))
+    · prove_admissible
+    · intros
       simp only
       split
       . simp [*]
@@ -190,45 +180,57 @@ namespace Test
         step
         simp [*]
 
-  def simple_diverge_2 (x y : Std.I32) : Result Std.I32 := do
-    if x = y#i32
-    then ok 10#i32
-    else
-      let i1 ← 1#i32 + 1#i32
-      let i2 ← 1#i32 + 1#i32
-      simple_diverge_2 i1 i2
-  partial_fixpoint
-
-  theorem test_div_2_manual (x y : Std.I32) : Std.WP.dspec (simple_diverge_2 x y) (fun res => res = 10#i32)
-    := by
-      --
-      revert x y
-      apply simple_diverge_2.fixpoint_induct
-        (motive := fun simple_diverge_2 => ∀ x y, WP.dspec (simple_diverge_2 x y) (fun res => res = 10#i32))
-      · prove_admissible
-      · intros
-        simp only
-        split
-        . simp [*]
-        . step
-          step
-          simp [*]
-          --
-
-  theorem test_div_2_tactic (x y : Std.I32) : Std.WP.dspec (simple_diverge_2 x y) (fun res => res = 10#i32)
-    := by
-      revert x y
-      dspec_induction simple_diverge_2
-      intros
+-- here, done automatically with the tactic
+theorem test_div_tactic (x : Std.I32) : Std.WP.dspec (simple_diverge x) (fun res => res = 10#i32)
+  := by
+    revert x
+    dspec_induction simple_diverge
+    intros
+    simp only
+    split
+    . simp [*]
+    . step
+      step
+      simp [*]
+
+def simple_diverge_2 (x y : Std.I32) : Result Std.I32 := do
+  if x = y#i32
+  then ok 10#i32
+  else
+    let i1 ← 1#i32 + 1#i32
+    let i2 ← 1#i32 + 1#i32
+    simple_diverge_2 i1 i2
+partial_fixpoint
+
+theorem test_div_2_manual (x y : Std.I32) : Std.WP.dspec (simple_diverge_2 x y) (fun res => res = 10#i32)
+  := by
+    --
+    revert x y
+    apply simple_diverge_2.fixpoint_induct
+      (motive := fun simple_diverge_2 => ∀ x y, WP.dspec (simple_diverge_2 x y) (fun res => res = 10#i32))
+    · prove_admissible
+    · intros
       simp only
       split
       . simp [*]
       . step
         step
         simp [*]
+        --
 
-end Test
+theorem test_div_2_tactic (x y : Std.I32) : Std.WP.dspec (simple_diverge_2 x y) (fun res => res = 10#i32)
+  := by
+    revert x y
+    dspec_induction simple_diverge_2
+    intros
+    simp only
+    split
+    . simp [*]
+    . step
+      step
+      simp [*]
 
+end Test
 
 end UnfoldPF
 end Aeneas

From bc15c24773f94d1c14a48794c6271367587bbde8 Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Wed, 3 Jun 2026 12:54:10 -0400
Subject: [PATCH 12/67] fixed bug, and found another issue

---
 backends/lean/Aeneas/Std/WP.lean              | 20 +++++
 backends/lean/Aeneas/Tactic/Step.lean         |  1 +
 .../lean/Aeneas/Tactic/Step/UnfoldPF.lean     | 80 +++++++++++++++----
 3 files changed, 87 insertions(+), 14 deletions(-)

diff --git a/backends/lean/Aeneas/Std/WP.lean b/backends/lean/Aeneas/Std/WP.lean
index 9d940e243..5f15297f9 100644
--- a/backends/lean/Aeneas/Std/WP.lean
+++ b/backends/lean/Aeneas/Std/WP.lean
@@ -260,6 +260,10 @@ This way we can expressions like: `x + y ⦃ z => ... ⦄` without having to put
 scoped syntax:54 term:55 " ⦃ " term+ " => " term " ⦄" : term
 scoped syntax:54 term:55 " ⦃ " term " ⦄" : term
 
+-- for dspec
+scoped syntax:54 term:55 " div⦃ " term+ " => " term " ⦄" : term
+scoped syntax:54 term:55 " div⦃ " term " ⦄" : term
+
 open Lean PrettyPrinter
 
 /-- Build a `Std.uncurry` chain wrapping a curried lambda over `xs`.
@@ -302,6 +306,9 @@ macro_rules
   | `($e ⦃ $x => $p ⦄) => do
     let post ← mkBinderFun 0 x p
     `(Aeneas.Std.WP.spec $e $post)
+  | `($e div⦃ $x => $p ⦄) => do
+    let post ← mkBinderFun 0 x p
+    `(Aeneas.Std.WP.dspec $e $post)
 
 /-- Macro expansion for multiple elements -/
 macro_rules
@@ -317,10 +324,23 @@ macro_rules
         `(uncurry' $inner)
     let post ← run 0 xs
     `(Aeneas.Std.WP.spec $e $post)
+  | `($e div⦃ $x $xs:term* => $p ⦄) => do
+    let xs := x :: xs.toList
+    let rec run (depth : Nat) (xs : List Term) : MacroM Term := do
+      match xs with
+      | [] => `($p)
+      | [x] => mkBinderFun depth x p
+      | x :: xs =>
+        let xs ← run (depth + 1) xs
+        let inner ← mkBinderFun depth x xs
+        `(uncurry' $inner)
+    let post ← run 0 xs
+    `(Aeneas.Std.WP.dspec $e $post)
 
 /-- Macro expansion for predicate with no arrow -/
 macro_rules
   | `($e ⦃ $p ⦄) => do `(_root_.Aeneas.Std.WP.spec $e $p)
+  | `($e div⦃ $p ⦄) => do `(_root_.Aeneas.Std.WP.dspec $e $p)
 
 /-!
 # Pretty-printing
diff --git a/backends/lean/Aeneas/Tactic/Step.lean b/backends/lean/Aeneas/Tactic/Step.lean
index 785da8dcb..09c9663ea 100644
--- a/backends/lean/Aeneas/Tactic/Step.lean
+++ b/backends/lean/Aeneas/Tactic/Step.lean
@@ -3,3 +3,4 @@ import Aeneas.Tactic.Step.Step
 import Aeneas.Tactic.Step.StepArraySpec
 import Aeneas.Tactic.Step.StepStar
 import Aeneas.Tactic.Step.Deprecated
+import Aeneas.Tactic.Step.UnfoldPF
diff --git a/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean b/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean
index cf6617e95..6a4edecc4 100644
--- a/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean
+++ b/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean
@@ -7,7 +7,7 @@ import Aeneas.Tactic.Simp.SimpLemmas
 import AeneasMeta.Async
 import Aeneas.Tactic.Solver.Grind.Init
 import Aeneas.Tactic.Step.InferPost
-import Aeneas.Tactic.Step
+import Aeneas.Tactic.Step.Step
 
 -- tactic for unfolding partial_fixpoint definitions with fixpoint_induct
 -- normally you would use the normal unfold tactic, but that requires the proof to be terminating
@@ -109,6 +109,8 @@ elab "dspec_induction" func:ident : tactic => do
   let ty ← goal.getType
 
   let func_expr ← Term.elabTerm func none
+  let func_expr := func_expr.getAppFn
+  let func_expr_name := func_expr.constName!
 
   -- do some wierd hacky nonsense to get `func.fixpoint_induct`
   let namee := func.getId.mkStr "fixpoint_induct"
@@ -119,17 +121,19 @@ elab "dspec_induction" func:ident : tactic => do
   -- make a type family that abstracts over instances of func in the goal type
   let func_expr_ty ← inferType func_expr
   let fmvar ← Meta.mkFreshExprMVar (some func_expr_ty)
-  let abs_goal_ty := ty.replace (fun x => if x == func_expr then some fmvar else none)
+  -- let abs_goal_ty := ty.replace (fun x => if x == func_expr then some fmvar else none)
+  let abs_goal_ty := ty.replace (fun x => if x.isConstOf func_expr_name then some fmvar else none)
   let abs_goal_ty := abs_goal_ty.abstract #[fmvar]
   let abs_goal_ty := Expr.lam `func func_expr_ty abs_goal_ty .default
 
-  trace[UnfoldPF] abs_goal_ty
+  trace[UnfoldPF] "fixpoint_induct with motive: {abs_goal_ty}"
 
   let fi_app := mkAppN fixpoint_induct #[abs_goal_ty]
 
-  let [g_admissible, g_main] ← goal.apply fi_app
-    | throwError "bla"
+  trace[UnfoldPF] "going to apply {fi_app}"
+  trace[UnfoldPF] "of type : {← inferType fi_app}"
 
+  let [g_admissible, g_main] ← goal.apply fi_app | throwError "this shouldn't happen 1"
 
   -- prove the admissibility condition. this chunk of code is equivalent to the
   -- `prove_admissible` tactic above, but apparently calling that directly might cause problems
@@ -151,11 +155,11 @@ elab "dspec_induction" func:ident : tactic => do
   pure ()
 
 -- uncomment to see debug traces:
--- set_option trace.UnfoldPF true
+set_option trace.UnfoldPF true
 
 namespace Test
 
-open Std Result Aeneas.UnfoldPF
+open Std Result Aeneas.Step
 
 def simple_diverge (x : Std.I32) : Result Std.I32 := do
   if x = 0#i32
@@ -193,21 +197,21 @@ theorem test_div_tactic (x : Std.I32) : Std.WP.dspec (simple_diverge x) (fun res
       step
       simp [*]
 
-def simple_diverge_2 (x y : Std.I32) : Result Std.I32 := do
+def simple_diverge_2' (x y : Std.I32) : Result Std.I32 := do
   if x = y#i32
   then ok 10#i32
   else
     let i1 ← 1#i32 + 1#i32
     let i2 ← 1#i32 + 1#i32
-    simple_diverge_2 i1 i2
+    simple_diverge_2' i1 i2
 partial_fixpoint
 
-theorem test_div_2_manual (x y : Std.I32) : Std.WP.dspec (simple_diverge_2 x y) (fun res => res = 10#i32)
+theorem test_div_2_manual (x y : Std.I32) : Std.WP.dspec (simple_diverge_2' x y) (fun res => res = 10#i32)
   := by
     --
     revert x y
-    apply simple_diverge_2.fixpoint_induct
-      (motive := fun simple_diverge_2 => ∀ x y, WP.dspec (simple_diverge_2 x y) (fun res => res = 10#i32))
+    apply simple_diverge_2'.fixpoint_induct
+      (motive := fun simple_diverge_2' => ∀ x y, WP.dspec (simple_diverge_2' x y) (fun res => res = 10#i32))
     · prove_admissible
     · intros
       simp only
@@ -218,10 +222,10 @@ theorem test_div_2_manual (x y : Std.I32) : Std.WP.dspec (simple_diverge_2 x y)
         simp [*]
         --
 
-theorem test_div_2_tactic (x y : Std.I32) : Std.WP.dspec (simple_diverge_2 x y) (fun res => res = 10#i32)
+theorem test_div_2_tactic (x y : Std.I32) : Std.WP.dspec (simple_diverge_2' x y) (fun res => res = 10#i32)
   := by
     revert x y
-    dspec_induction simple_diverge_2
+    dspec_induction simple_diverge_2'
     intros
     simp only
     split
@@ -230,6 +234,54 @@ theorem test_div_2_tactic (x y : Std.I32) : Std.WP.dspec (simple_diverge_2 x y)
       step
       simp [*]
 
+
+open ControlFlow
+/-- [tutorial::dummy_hash]:
+    Source: 'src/lib.rs', lines 250:0-253:1
+    Visibility: public -/
+def dummy_hash (i : Std.U32) : Result Std.U32 := do
+  ok 1000#u32
+
+/-- [tutorial::pseudo_random]: loop body 0:
+    Source: 'src/lib.rs', lines 258:2-260:3
+    Visibility: public -/
+def pseudo_random_loop.body
+  (state : Std.U32) : Result (ControlFlow Std.U32 Std.U32) := do
+  if state > 100#u32
+  then let state1 ← dummy_hash state
+       ok (cont state1)
+  else ok (done state)
+
+/-- [tutorial::pseudo_random]: loop 0:
+    Source: 'src/lib.rs', lines 258:2-260:3
+    Visibility: public -/
+def pseudo_random_loop (state : Std.U32) : Result Std.U32 := do
+  loop
+    (fun state1 => pseudo_random_loop.body state1)
+    state
+
+/-- [tutorial::pseudo_random]:
+    Source: 'src/lib.rs', lines 255:0-262:1
+    Visibility: public -/
+@[reducible] def pseudo_random : Result Std.U32 := do
+               pseudo_random_loop 0#u32
+
+
+#check loop.fixpoint_induct
+theorem pseudo_random_spec :
+  pseudo_random div⦃fun x => x.val <= 100⦄ := by
+  unfold pseudo_random
+  unfold pseudo_random_loop
+  apply (loop.fixpoint_induct pseudo_random_loop.body
+    (fun func => WP.dspec (func 0#u32) (fun x => ↑x ≤ (100 : Nat))))
+  · prove_admissible
+  · sorry
+  -- apply (loop.fixpoint_induct (fun func =>
+  --     (WP.dspec (func (fun state1 => pseudo_random_loop.body state1) 0#u32) (fun x => ↑x ≤ 100)))))
+  -- dspec_induction loop
+  -- --
+  -- sorry
+
 end Test
 
 end UnfoldPF

From a429a66d402b80898db68750658a82ba146348da Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Wed, 3 Jun 2026 14:42:41 -0400
Subject: [PATCH 13/67] checkpoint, still issues with pf variations

---
 .../lean/Aeneas/Tactic/Step/UnfoldPF.lean     | 122 ++++++++++++++----
 1 file changed, 100 insertions(+), 22 deletions(-)

diff --git a/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean b/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean
index 6a4edecc4..64b909895 100644
--- a/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean
+++ b/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean
@@ -104,31 +104,64 @@ macro "prove_admissible" : tactic =>
   )
   )
 
+def getParamNames (ty : Expr) : MetaM (Array Name) := do
+  forallTelescope ty fun xs _ => do
+    xs.mapM fun x => do
+      let localDecl ← x.fvarId!.getDecl
+      return localDecl.userName
+
 elab "dspec_induction" func:ident : tactic => do
   let mut goal ← getMainGoal
-  let ty ← goal.getType
+  let goalTy ← goal.getType
 
   let func_expr ← Term.elabTerm func none
   let func_expr := func_expr.getAppFn
   let func_expr_name := func_expr.constName!
 
-  -- do some wierd hacky nonsense to get `func.fixpoint_induct`
+  -- do some wierd hacky nonsense to get `func.fixpoint_induct`.
+  -- more obvious methods fail, presumably due to buggy lean behavior
   let namee := func.getId.mkStr "fixpoint_induct"
   let fi_stx : Syntax ← `(term | $(mkIdent namee))
   let fixpoint_induct ← Term.elabTerm fi_stx none
+  let fixpoint_induct := fixpoint_induct.getAppFn
   trace[UnfoldPF] "type of fixpoint_induct is {← inferType fixpoint_induct}"
 
+  -- sadly, there are many possible forms that fixpoint_induct can take.
+  -- we need to reverse engineer which form it is by looking at its type.
+  -- see the examples at the end of this file, it depends on which parameters to the
+  -- original function are unchanged in recursive calls. {
+  let func_params ← getParamNames (← inferType func_expr)
+  let fixpoint_induct_params ← getParamNames (← inferType fixpoint_induct)
+  -- the last 3 parameters are the motive, admissibility, and proof of induction
+  let fixpoint_induct_params := fixpoint_induct_params.extract 0 (fixpoint_induct_params.size - 3)
+  -- which params are constant, these are treated specially by fixpoint_induct
+  let constant_params := func_params.map (fun x => fixpoint_induct_params.contains x)
+  trace[UnfoldPF] "constant_params: {constant_params}"
+  let .some func_application := goalTy.find? (fun e => e.getAppFn.isConstOf func_expr_name)
+  | throwError "no"
+  trace[UnfoldPF] "func app in goal is: {func_application}"
+  let args_in_goal := func_application.getAppArgs
+  let const_args := (args_in_goal.zip constant_params).filterMap
+    fun (x, b) => if b then some x else none
+  let nonconst_args := (args_in_goal.zip constant_params).filterMap
+    fun (x, b) => if b then none else some x
+  -- lift these arguments, since they will need to go under a new binder
+  -- let nonconst_args := nonconst_args.map (fun e => e.liftLooseBVars 0 1)
+  trace[UnfoldPF] "const_args: {const_args}"
+  -- }
+
   -- make a type family that abstracts over instances of func in the goal type
   let func_expr_ty ← inferType func_expr
   let fmvar ← Meta.mkFreshExprMVar (some func_expr_ty)
-  -- let abs_goal_ty := ty.replace (fun x => if x == func_expr then some fmvar else none)
-  let abs_goal_ty := ty.replace (fun x => if x.isConstOf func_expr_name then some fmvar else none)
+  let value_to_replace_in_motive := mkAppN fmvar nonconst_args
+  let abs_goal_ty := goalTy.replace
+    (fun x => if x.getAppFn.isConstOf func_expr_name then some value_to_replace_in_motive else none)
   let abs_goal_ty := abs_goal_ty.abstract #[fmvar]
   let abs_goal_ty := Expr.lam `func func_expr_ty abs_goal_ty .default
 
   trace[UnfoldPF] "fixpoint_induct with motive: {abs_goal_ty}"
 
-  let fi_app := mkAppN fixpoint_induct #[abs_goal_ty]
+  let fi_app := mkAppN fixpoint_induct (const_args ++ #[abs_goal_ty])
 
   trace[UnfoldPF] "going to apply {fi_app}"
   trace[UnfoldPF] "of type : {← inferType fi_app}"
@@ -137,7 +170,7 @@ elab "dspec_induction" func:ident : tactic => do
 
   -- prove the admissibility condition. this chunk of code is equivalent to the
   -- `prove_admissible` tactic above, but apparently calling that directly might cause problems
-  let _ ← withTransparency .none <| do
+  let _ ← withTransparency .default <| do -- using a more restricted reducibility doesn't work on some tests below
     let onError {α} : TacticM α := throwError "failed to prove admissibility condition"
     let curry_admissible ← mkConstWithFreshMVarLevels `Aeneas.UnfoldPF.curry_admissible
     let admissible_pi ← mkConstWithFreshMVarLevels `Lean.Order.admissible_pi
@@ -235,19 +268,22 @@ theorem test_div_2_tactic (x y : Std.I32) : Std.WP.dspec (simple_diverge_2' x y)
       simp [*]
 
 
-open ControlFlow
-/-- [tutorial::dummy_hash]:
-    Source: 'src/lib.rs', lines 250:0-253:1
-    Visibility: public -/
+namespace TestHash
+-- variable (dummy_hash : Std.U32 → Result Std.U32)
 def dummy_hash (i : Std.U32) : Result Std.U32 := do
   ok 1000#u32
+  -- ok dummy_val
+
+#check dummy_hash
+
+open ControlFlow
 
 /-- [tutorial::pseudo_random]: loop body 0:
     Source: 'src/lib.rs', lines 258:2-260:3
     Visibility: public -/
 def pseudo_random_loop.body
   (state : Std.U32) : Result (ControlFlow Std.U32 Std.U32) := do
-  if state > 100#u32
+  if state < 100#u32
   then let state1 ← dummy_hash state
        ok (cont state1)
   else ok (done state)
@@ -267,20 +303,62 @@ def pseudo_random_loop (state : Std.U32) : Result Std.U32 := do
                pseudo_random_loop 0#u32
 
 
-#check loop.fixpoint_induct
+#check @loop.fixpoint_induct
 theorem pseudo_random_spec :
-  pseudo_random div⦃fun x => x.val <= 100⦄ := by
+  pseudo_random div⦃fun x => x.val >= 100⦄ := by
   unfold pseudo_random
   unfold pseudo_random_loop
-  apply (loop.fixpoint_induct pseudo_random_loop.body
-    (fun func => WP.dspec (func 0#u32) (fun x => ↑x ≤ (100 : Nat))))
-  · prove_admissible
-  · sorry
-  -- apply (loop.fixpoint_induct (fun func =>
-  --     (WP.dspec (func (fun state1 => pseudo_random_loop.body state1) 0#u32) (fun x => ↑x ≤ 100)))))
-  -- dspec_induction loop
-  -- --
-  -- sorry
+  -- note here that the use must make a potentially non-obvious decision about
+  -- what to generalize and how to do the induction
+  generalize 0#u32 = x
+  revert x
+  dspec_induction loop
+  intros loop' ih x
+  simp only
+  unfold pseudo_random_loop.body
+  simp
+  by_cases ((↑x : Nat) < 100)
+  ·
+    simp [*]
+    unfold dummy_hash
+    simp
+    -- note that here, i am refraining from using the result of dummy_hash,
+    -- since its supposed to represent a hash function where we can't predict the result,
+    -- but it actually is just a constant
+    step
+    grind
+  ·
+    simp [*]
+    grind
+  -- ·
+  --   simp [*] at *
+  --   subst_vars
+  --   simp only
+  --   simp
+  -- ·
+  --   --
+  --   sorry
+  -- ·
+  --   --
+  --   sorry
+  --
+  -- -- --
+end TestHash
+
+
+def first_arg_const (x y : Nat) : Option Nat :=
+  if x = 0 then Option.some 0
+  else first_arg_const x (y + 1)
+partial_fixpoint
+#check first_arg_const.fixpoint_induct
+
+def second_arg_const (x y : Nat) : Option Nat :=
+  if y = 0 then Option.some 0
+  else second_arg_const (x + 1) y
+partial_fixpoint
+#check second_arg_const.fixpoint_induct
+
+#check forallTelescope
 
 end Test
 

From 42f4bb0d481b333a2ae136ea453a9fdcf3592eaf Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Wed, 3 Jun 2026 14:59:33 -0400
Subject: [PATCH 14/67] fixed the bugs

---
 .../lean/Aeneas/Tactic/Step/UnfoldPF.lean     | 39 +++++++------------
 1 file changed, 14 insertions(+), 25 deletions(-)

diff --git a/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean b/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean
index 64b909895..a11813e35 100644
--- a/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean
+++ b/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean
@@ -110,6 +110,12 @@ def getParamNames (ty : Expr) : MetaM (Array Name) := do
       let localDecl ← x.fvarId!.getDecl
       return localDecl.userName
 
+-- given a function type, return list of input types
+def getInputTypes (ty : Expr) : List Expr :=
+  match ty with
+  | .forallE _ ty body _ => .cons ty (getInputTypes body)
+  | _ => []
+
 elab "dspec_induction" func:ident : tactic => do
   let mut goal ← getMainGoal
   let goalTy ← goal.getType
@@ -145,19 +151,21 @@ elab "dspec_induction" func:ident : tactic => do
     fun (x, b) => if b then some x else none
   let nonconst_args := (args_in_goal.zip constant_params).filterMap
     fun (x, b) => if b then none else some x
-  -- lift these arguments, since they will need to go under a new binder
-  -- let nonconst_args := nonconst_args.map (fun e => e.liftLooseBVars 0 1)
   trace[UnfoldPF] "const_args: {const_args}"
   -- }
 
   -- make a type family that abstracts over instances of func in the goal type
-  let func_expr_ty ← inferType func_expr
-  let fmvar ← Meta.mkFreshExprMVar (some func_expr_ty)
+  -- first, we need to find out what type the motive expects, by inspecting the theorem
+  -- this should be something that inputs all of the nonconst_args
+  let applied_fixpoint_induct_type ← inferType (mkAppN fixpoint_induct const_args)
+  let applied_func_type := (getInputTypes (getInputTypes applied_fixpoint_induct_type).getLast!)[0]!
+  -- let applied_func_type ← inferType func_expr
+  let fmvar ← Meta.mkFreshExprMVar (some applied_func_type)
   let value_to_replace_in_motive := mkAppN fmvar nonconst_args
   let abs_goal_ty := goalTy.replace
     (fun x => if x.getAppFn.isConstOf func_expr_name then some value_to_replace_in_motive else none)
   let abs_goal_ty := abs_goal_ty.abstract #[fmvar]
-  let abs_goal_ty := Expr.lam `func func_expr_ty abs_goal_ty .default
+  let abs_goal_ty := Expr.lam `func applied_func_type abs_goal_ty .default
 
   trace[UnfoldPF] "fixpoint_induct with motive: {abs_goal_ty}"
 
@@ -268,13 +276,8 @@ theorem test_div_2_tactic (x y : Std.I32) : Std.WP.dspec (simple_diverge_2' x y)
       simp [*]
 
 
-namespace TestHash
--- variable (dummy_hash : Std.U32 → Result Std.U32)
 def dummy_hash (i : Std.U32) : Result Std.U32 := do
   ok 1000#u32
-  -- ok dummy_val
-
-#check dummy_hash
 
 open ControlFlow
 
@@ -330,22 +333,8 @@ theorem pseudo_random_spec :
   ·
     simp [*]
     grind
-  -- ·
-  --   simp [*] at *
-  --   subst_vars
-  --   simp only
-  --   simp
-  -- ·
-  --   --
-  --   sorry
-  -- ·
-  --   --
-  --   sorry
-  --
-  -- -- --
-end TestHash
-
 
+-- these two examples demonstrate how .fixpoint_induct theorems can take various forms.
 def first_arg_const (x y : Nat) : Option Nat :=
   if x = 0 then Option.some 0
   else first_arg_const x (y + 1)

From 462ae099c0db7f84b6a37de57d9ad5be760e93f3 Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Wed, 3 Jun 2026 15:43:40 -0400
Subject: [PATCH 15/67] tutorial and cleaned up code

---
 backends/lean/Aeneas/Tactic/Step/Step.lean    | 284 ++++++------------
 .../lean/Aeneas/Tactic/Step/UnfoldPF.lean     |   2 +-
 tests/lean/Tutorial/Exercises.lean            |  51 ++++
 tests/lean/Tutorial/Solutions.lean            |  32 ++
 tests/lean/Tutorial/Tutorial.lean             |  32 ++
 tests/src/tutorial/src/lib.rs                 |  14 +
 6 files changed, 230 insertions(+), 185 deletions(-)

diff --git a/backends/lean/Aeneas/Tactic/Step/Step.lean b/backends/lean/Aeneas/Tactic/Step/Step.lean
index 3c72e3287..3299c188a 100644
--- a/backends/lean/Aeneas/Tactic/Step/Step.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Step.lean
@@ -517,7 +517,7 @@ def tryMatch (info : SpecInfo) (lifting : Option LiftingInfo) (isLet : Bool) (th
     throwError "Not a spec theorem"
 
   let (program, P) ←
-    if h: thArgs.size = info.arity
+    if thArgs.size = info.arity
     then pure (thArgs[info.program_index]!, thArgs[info.post_index]!)
     else throwError "Not a spec theorem"
 
@@ -557,7 +557,6 @@ def tryMatch (info : SpecInfo) (lifting : Option LiftingInfo) (isLet : Bool) (th
   mgoal.assign specMonoBind
   trace[Step] "New goal: {ngoal}"
 
-  let env ← getEnv
   let mvarsIds := mvars.map Expr.mvarId!
   let mvarsIds ← mvarsIds.filterM (fun mvar => do pure (not (← mvar.isAssigned)))
 
@@ -1466,188 +1465,6 @@ namespace Test
   -- #eval showStoredStepThms
   open alloc.vec
 
-  -- This section has tests for dspec. TODO: clean these up a bit.
-  -- test proving things about potentially diverging functions.
-  -- this is the output from a simple rust function
-  def simple_diverge (x : Std.I32) : Result Std.I32 := do
-    if x = 0#i32
-    then ok 10#i32
-    -- else if x = 1#i32
-    -- then simple_diverge (← x + 1#i32)
-    else
-      let i1 ← 1#i32 + 1#i32
-      simple_diverge i1
-      -- simple_diverge x
-  partial_fixpoint
-
-  theorem test_div2 (x : Std.I32) : Std.WP.dspec (simple_diverge x) (fun res => res = 10#i32)
-    := by
-      unfold simple_diverge
-      --
-      sorry
-
-  -- TODO: if i use unfold then sorry, print proof term, i can see how it proves admissibility
-  #check simple_diverge.fixpoint_induct
-  @[step]
-  theorem test_div (x : Std.I32) : Std.WP.dspec (simple_diverge x) (fun res => res = 10#i32)
-    := by
-      --
-      revert x
-      apply simple_diverge.fixpoint_induct
-        (motive := fun simple_diverge => ∀ x, WP.dspec (simple_diverge x) (fun res => res = 10#i32))
-      · apply Lean.Order.admissible_pi
-        intros y
-        apply Lean.Order.admissible_apply (fun _ fx => WP.dspec fx _)
-        apply Lean.Order.admissible_flatOrder
-        simp only [WP.dspec]
-      · intros
-        simp only
-        split
-        . simp [*]
-        . step
-          step
-          simp [*]
-
-  def simple_diverge_2 (x y : Std.I32) : Result Std.I32 := do
-    if x = 0#i32
-    then ok 10#i32
-    else
-      let i1 ← x + y
-      simple_diverge_2 i1 i1
-  partial_fixpoint
-
-  -- @[step]
-  -- theorem test_div_2 (x y : Std.I32) : Std.WP.dspec (simple_diverge_2 x y) (fun res => res = 10#i32)
-  --   := by
-  --     revert x y
-  --     -- instead of unfold, must use this:
-  --     -- unfold_div (maybe don't need theorem name)
-  --     --
-  --     apply simple_diverge_2.fixpoint_induct
-  --       (motive := fun f => ∀ x y, WP.dspec (f x y) (fun res => res = 10#i32))
-  --     · --
-  --       apply Lean.Order.admissible_pi_apply (fun _ fx => WP.dspec fx _)
-  --       intros y
-  --       apply Lean.Order.admissible_pi
-  --       intros y
-  --       -- apply Lean.Order.admissible_apply (fun _ fx => WP.dspec fx _) y
-  --       apply Lean.Order.admissible_apply (fun _ fx => WP.dspec fx _)
-  --       -- refine' (Lean.Order.admissible_apply _ y)
-  --       --
-  --       intros
-  --       apply Lean.Order.admissible_flatOrder
-  --       simp only [WP.dspec]
-  --       --
-  --     · intros
-  --       simp only
-  --       split
-  --       . simp [*]
-  --       . step
-  --         step
-  --         simp [*]
-
-  theorem test_add (α β) (post)
-    : Order.admissible fun (f : α → Result β) => ∀ (x : α), WP.dspec (f x) post := by
-    apply Lean.Order.admissible_pi
-    intros
-    apply Lean.Order.admissible_apply (fun _ fx => WP.dspec fx _)
-    apply Lean.Order.admissible_flatOrder
-    simp only [WP.dspec]
-
-  theorem test_add_more_general (α β) (anything : (α → Result β) → Prop)
-    : Order.admissible fun (f : α → Result β) => anything f := by
-    --
-    sorry
-
-  open Lean.Order
-  def admissible_apply_simpler {α : Sort u}{β : Sort v} [CCPO β] (P : β → Prop) (x : α)
-    (hadm : admissible P) : admissible (fun (f : α → β) => P (f x)) := by
-    apply admissible_apply (fun _ => P) x
-    assumption
-
-  theorem test_add_2 (a1 a2 β) (post)
-    : Order.admissible fun (f : a1 → a2 → Result β) => ∀ (x : a1) (y : a2), WP.dspec (f x y) post := by
-    apply Lean.Order.admissible_pi
-    intros y1
-    apply Lean.Order.admissible_pi
-    intros y2
-    --
-    apply admissible_apply_simpler (β := a2 → Result β) (fun fx => WP.dspec (fx y2) post) y1
-    -- apply Lean.Order.admissible_apply (β := fun _ => a2 → Result β)
-      -- (fun x fx => WP.dspec (fx y2) post) y1
-    apply Lean.Order.admissible_apply (fun _ fx => WP.dspec fx _)
-    apply Lean.Order.admissible_flatOrder
-    simp only [WP.dspec]
-    --
-
-  -- -- test out using a dspec theorem to prove a dspec.
-  -- example : WP.dspec
-  --   (do let x ← simple_diverge 5#i32
-  --       return x) (fun x => x = 10#i32) := by
-  --     step
-  --     simp [*]
-  --     --
-
-  def simple_converge (x : Std.I32) : Result Std.I32 := do
-    if x = 0#i32
-    then ok 10#i32
-    else ok 10#i32
-
-  @[step]
-  theorem simple_converge_property_dspec (x : Std.I32)
-    : Std.WP.dspec (simple_converge x) (fun res => res = 10#i32)
-    := by
-      unfold simple_converge
-      split <;> simp [WP.dspec]
-
-  -- test using dspec theorem to step dspec
-  example : WP.dspec
-    (do let x ← simple_converge 5#i32
-        let _y ← simple_converge 6#i32
-        return x) (fun x => x = 10#i32) := by
-      step
-      step
-      simp [*]
-      --
-
-  example : WP.spec
-    (do let x ← 1#i32 + 2#i32
-        let y ← x + x
-        return y) (fun z => z.val == 6) := by
-    step
-    step
-    simp [*]
-    --
-
-  -- requires lifting spec to dspec
-  example : WP.dspec
-    (do let x ← 1#i32 + 2#i32
-        let y ← x + x
-        return y) (fun z => z.val == 6) := by
-    step
-    step
-    simp [*]
-
-  -- test out using a spec theorem to prove a dspec
-  example : WP.dspec
-    (do let x ← simple_converge 5#i32
-        let _y ← simple_converge 6#i32
-        return x) (fun x => x = 10#i32) := by
-      step
-      step
-      simp [*]
-
-  -- confirm that you can't use dspec from spec
-  /-- error: Step failed: could not find a local assumption or a theorem to apply -/
-#guard_msgs in
-  example : WP.spec
-    (do let x ← simple_diverge 5#i32
-        let y ← simple_diverge 6#i32
-        return x) (fun x => x = 10#i32) := by
-    step -- this should fail!
-    step
-    simp [*]
-    --
 
   /- This test case checks what happens when `step`:
      - manages to solve the current goal
@@ -2200,6 +2017,105 @@ z_post : ↑z = ↑x + ↑y
 
   end Ntt
 
+  namespace DspecTests
+  -- This section has tests for dspec.
+  def simple_diverge (x : Std.I32) : Result Std.I32 := do
+    if x = 0#i32
+    then ok 10#i32
+    else
+      let i1 ← 1#i32 + 1#i32
+      simple_diverge i1
+  partial_fixpoint
+
+  @[step]
+  theorem test_div (x : Std.I32) : Std.WP.dspec (simple_diverge x) (fun res => res = 10#i32)
+    := by
+      revert x
+      apply simple_diverge.fixpoint_induct
+        (motive := fun simple_diverge => ∀ x, WP.dspec (simple_diverge x) (fun res => res = 10#i32))
+      · apply Lean.Order.admissible_pi
+        intros y
+        apply Lean.Order.admissible_apply (fun _ fx => WP.dspec fx _)
+        apply Lean.Order.admissible_flatOrder
+        simp only [WP.dspec]
+      · intros
+        simp only
+        split
+        . simp [*]
+        . step
+          step
+          simp [*]
+
+  def simple_diverge_2 (x y : Std.I32) : Result Std.I32 := do
+    if x = 0#i32
+    then ok 10#i32
+    else
+      let i1 ← x + y
+      simple_diverge_2 i1 i1
+  partial_fixpoint
+
+  def simple_converge (x : Std.I32) : Result Std.I32 := do
+    if x = 0#i32
+    then ok 10#i32
+    else ok 10#i32
+
+  @[step]
+  theorem simple_converge_property_dspec (x : Std.I32)
+    : Std.WP.dspec (simple_converge x) (fun res => res = 10#i32)
+    := by
+      unfold simple_converge
+      split <;> simp [WP.dspec]
+
+  -- test using dspec theorem to step dspec
+  example : WP.dspec
+    (do let x ← simple_converge 5#i32
+        let _y ← simple_converge 6#i32
+        return x) (fun x => x = 10#i32) := by
+      step
+      step
+      simp [*]
+      --
+
+  example : WP.spec
+    (do let x ← 1#i32 + 2#i32
+        let y ← x + x
+        return y) (fun z => z.val == 6) := by
+    step
+    step
+    simp [*]
+    --
+
+  -- requires lifting spec to dspec
+  example : WP.dspec
+    (do let x ← 1#i32 + 2#i32
+        let y ← x + x
+        return y) (fun z => z.val == 6) := by
+    step
+    step
+    simp [*]
+
+  -- test out using a spec theorem to prove a dspec
+  example : WP.dspec
+    (do let x ← simple_converge 5#i32
+        let _y ← simple_converge 6#i32
+        return x) (fun x => x = 10#i32) := by
+      step
+      step
+      simp [*]
+
+  -- confirm that you can't use dspec from spec
+  /-- error: Step failed: could not find a local assumption or a theorem to apply -/
+#guard_msgs in
+  example : WP.spec
+    (do let x ← simple_diverge 5#i32
+        let y ← simple_diverge 6#i32
+        return x) (fun x => x = 10#i32) := by
+    step -- this should fail!
+    step
+    simp [*]
+    --
+end DspecTests
+
 end Test
 
 end Step
diff --git a/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean b/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean
index a11813e35..d34f8fef3 100644
--- a/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean
+++ b/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean
@@ -311,7 +311,7 @@ theorem pseudo_random_spec :
   pseudo_random div⦃fun x => x.val >= 100⦄ := by
   unfold pseudo_random
   unfold pseudo_random_loop
-  -- note here that the use must make a potentially non-obvious decision about
+  -- note here that we must make a potentially non-obvious decision about
   -- what to generalize and how to do the induction
   generalize 0#u32 = x
   revert x
diff --git a/tests/lean/Tutorial/Exercises.lean b/tests/lean/Tutorial/Exercises.lean
index be6083f98..1071845c9 100644
--- a/tests/lean/Tutorial/Exercises.lean
+++ b/tests/lean/Tutorial/Exercises.lean
@@ -846,4 +846,55 @@ def add
   let x1 ← alloc.vec.Vec.resize core.clone.CloneU32 x max1 0#u32
   add_loop x1 y max1 0#u8 0#usize
 
+open ControlFlow
+/-- [tutorial::dummy_hash]:
+    Source: 'src/lib.rs', lines 250:0-253:1
+    Visibility: public -/
+def dummy_hash (i : Std.U32) : Result Std.U32 := do
+  ok 1000#u32
+
+/-- [tutorial::pseudo_random]: loop body 0:
+    Source: 'src/lib.rs', lines 258:2-260:3
+    Visibility: public -/
+@[rust_loop_body]
+def pseudo_random_loop.body
+  (state : Std.U32) : Result (ControlFlow Std.U32 Std.U32) := do
+  if state < 100#u32
+  then let state1 ← dummy_hash state
+       ok (cont state1)
+  else ok (done state)
+
+/-- [tutorial::pseudo_random]: loop 0:
+    Source: 'src/lib.rs', lines 258:2-260:3
+    Visibility: public -/
+@[rust_loop]
+def pseudo_random_loop (state : Std.U32) : Result Std.U32 := do
+  loop
+    (fun state1 => pseudo_random_loop.body state1)
+    state
+
+/-- [tutorial::pseudo_random]:
+    Source: 'src/lib.rs', lines 255:0-262:1
+    Visibility: public -/
+@[reducible] def pseudo_random : Result Std.U32 := do
+               pseudo_random_loop 0#u32
+
+/- exersize about dspec.
+For the usual spec `r ⦃post⦄`, one needs to prove that `r` terminates and
+produces a value that satisfies `post`
+
+However, sometimes a function may be potentially nonterminating.
+dspec (notated `r div⦃post⦄`) is a weaker statement,
+and only means that if r terminates then the result satisfies `post`.
+It works with the `step` tactic and any @step theorems for spec are automatically
+lifted to dspec. You will also need the `dspec_induction` tactic to complete this exercise,
+which is used to prove a fact about a recursive function by induction in it's recursive calls.
+
+`dummy_hash` is supposed to represent an opaque function where we can't reason about it's output,
+so don't make use of it's definition as a constant for the solution.
+-/
+theorem pseudo_random_spec :
+  pseudo_random div⦃fun x => x.val >= 100⦄ := by
+  sorry
+
 end Tutorial.Solutions
diff --git a/tests/lean/Tutorial/Solutions.lean b/tests/lean/Tutorial/Solutions.lean
index 905c83f83..052f90502 100644
--- a/tests/lean/Tutorial/Solutions.lean
+++ b/tests/lean/Tutorial/Solutions.lean
@@ -437,4 +437,36 @@ theorem add_with_carry_spec
   step as ⟨ c, x' ⟩
   simp_all
 
+
+#check @loop.fixpoint_induct
+theorem pseudo_random_spec :
+  pseudo_random div⦃fun x => x.val >= 100⦄ := by
+  unfold pseudo_random
+  unfold pseudo_random_loop
+  -- if we proceed by unfolding `loop`, then the proof will be non-terminating.
+  -- instead, we can use the dspec_induction tactic
+  -- note here that we must make a potentially non-obvious decision about
+  -- what to generalize and how to do the induction
+  generalize 0#u32 = x
+  revert x
+  dspec_induction loop
+  intros loop' ih x
+  simp only
+  unfold pseudo_random_loop.body
+  simp
+  by_cases ((↑x : Nat) < 100)
+  ·
+    simp [*]
+    unfold dummy_hash
+    simp
+    -- note that here, i am refraining from using the result of dummy_hash,
+    -- since its supposed to represent a hash function where we can't predict the result,
+    -- but it actually is just a constant
+    step
+    grind
+  ·
+    simp [*]
+    grind
+
+
 end tutorial
diff --git a/tests/lean/Tutorial/Tutorial.lean b/tests/lean/Tutorial/Tutorial.lean
index ba400375e..341ae5238 100644
--- a/tests/lean/Tutorial/Tutorial.lean
+++ b/tests/lean/Tutorial/Tutorial.lean
@@ -418,4 +418,36 @@ def add
        alloc.vec.Vec.push x2 i2
   else ok x2
 
+/-- [tutorial::dummy_hash]:
+    Source: 'src/lib.rs', lines 250:0-253:1
+    Visibility: public -/
+def dummy_hash (i : Std.U32) : Result Std.U32 := do
+  ok 1000#u32
+
+/-- [tutorial::pseudo_random]: loop body 0:
+    Source: 'src/lib.rs', lines 258:2-260:3
+    Visibility: public -/
+@[rust_loop_body]
+def pseudo_random_loop.body
+  (state : Std.U32) : Result (ControlFlow Std.U32 Std.U32) := do
+  if state < 100#u32
+  then let state1 ← dummy_hash state
+       ok (cont state1)
+  else ok (done state)
+
+/-- [tutorial::pseudo_random]: loop 0:
+    Source: 'src/lib.rs', lines 258:2-260:3
+    Visibility: public -/
+@[rust_loop]
+def pseudo_random_loop (state : Std.U32) : Result Std.U32 := do
+  loop
+    (fun state1 => pseudo_random_loop.body state1)
+    state
+
+/-- [tutorial::pseudo_random]:
+    Source: 'src/lib.rs', lines 255:0-262:1
+    Visibility: public -/
+@[reducible] def pseudo_random : Result Std.U32 := do
+               pseudo_random_loop 0#u32
+
 end tutorial
diff --git a/tests/src/tutorial/src/lib.rs b/tests/src/tutorial/src/lib.rs
index f826062aa..8c0027917 100644
--- a/tests/src/tutorial/src/lib.rs
+++ b/tests/src/tutorial/src/lib.rs
@@ -246,3 +246,17 @@ fn test() {
     assert!(x.len() == 1);
     assert!(x[0] == 0xfffffffe);
 }
+
+pub fn dummy_hash(_ : u32) -> u32 {
+    // pretend that this function is opaque and we can't assume anything about the output
+    return 1000;
+}
+
+pub fn pseudo_random() -> u32 {
+  let mut state : u32 = 0;
+
+  while state < 100 {
+    state = dummy_hash(state);
+  }
+  return state;
+}

From fa8c069b8553fd024edb6dce923a381dc751eb2a Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Wed, 3 Jun 2026 19:19:59 -0400
Subject: [PATCH 16/67] fixed some merge issues

---
 backends/lean/Aeneas/Tactic/Step/Init.lean | 3 +--
 tests/lean/Tutorial/Solutions.lean         | 1 -
 2 files changed, 1 insertion(+), 3 deletions(-)

diff --git a/backends/lean/Aeneas/Tactic/Step/Init.lean b/backends/lean/Aeneas/Tactic/Step/Init.lean
index ccb163ec8..f69567837 100644
--- a/backends/lean/Aeneas/Tactic/Step/Init.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Init.lean
@@ -323,8 +323,7 @@ initialize stepAttr : StepSpecAttr ← do
 
 def StepSpecAttr.find? (s : StepSpecAttr) (name : Name) (e : Expr) : MetaM (Array Name) := do
   let state := s.ext.getState (← getEnv)
-  let some dtree := state.rules.get? name
-  | throwError "no such spec statement as {name}, its all {state.rules.keys}"
+  let dtree := state.rules.get! name
   let rules ← dtree.getMatch e
   pure (rules.filter (fun th => th ∉ state.deactivated))
 
diff --git a/tests/lean/Tutorial/Solutions.lean b/tests/lean/Tutorial/Solutions.lean
index 9de7e14e0..899c098eb 100644
--- a/tests/lean/Tutorial/Solutions.lean
+++ b/tests/lean/Tutorial/Solutions.lean
@@ -453,7 +453,6 @@ theorem add_with_carry_spec
   simp_all
 
 
-#check @loop.fixpoint_induct
 theorem pseudo_random_spec :
   pseudo_random div⦃fun x => x.val >= 100⦄ := by
   unfold pseudo_random

From d447531dc4d3c660a460222b077c4bc6dc7d5248 Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Fri, 12 Jun 2026 16:10:53 -0400
Subject: [PATCH 17/67] reordered tactics to preserve old behavior

---
 backends/lean/Aeneas/Std/WP.lean              | 38 ++++++++++++++++---
 backends/lean/Aeneas/Tactic/Step/Step.lean    | 35 ++++++++---------
 .../lean/Aeneas/Tactic/Step/StepStar.lean     |  1 -
 .../Aeneas/Tactic/Step/Tests/UncurryBind.lean |  2 +-
 4 files changed, 52 insertions(+), 24 deletions(-)

diff --git a/backends/lean/Aeneas/Std/WP.lean b/backends/lean/Aeneas/Std/WP.lean
index 17487ca18..4f4edda03 100644
--- a/backends/lean/Aeneas/Std/WP.lean
+++ b/backends/lean/Aeneas/Std/WP.lean
@@ -829,6 +829,11 @@ theorem loop.spec_decr_nat {α : Type u} {β : Type v}
 end Aeneas.Std
 
 namespace Aeneas.Std.WP
+
+/-- Note that `forall_const` is too general: it can eliminate unused outputs that we actually
+want to introduce in the context -/
+theorem forall_unit {p : Prop} : (Unit → p) ↔ p := by simp
+
 -- registers the spec statements for use in the step tactic, see Spec.lean
 #register_spec_statement {
     name := ``Std.WP.spec
@@ -840,10 +845,21 @@ namespace Aeneas.Std.WP
     mk_spec_bind := ``Std.WP.spec_bind'
     mk_spec_bind_skip_args := 4
     uncurry_elim_tactics := #[
-      ``Std.WP.qimp_spec_uncurry', ``Std.WP.qimp_spec_unit, ``Std.WP.qimp_spec_exists,
-      ``Std.WP.qimp_spec_iff, ``Std.WP.qimp_iff,
+      ``Std.WP.qimp_spec_uncurry', ``Std.WP.qimp_spec_unit,
+                  ``Std.WP.qimp_uncurry', ``Std.WP.qimp_unit,
+                  ``Std.WP.qimp_spec_exists, ``Std.WP.qimp_exists,
+                  -- `Prod.forall`/`Prod.exists` split `∀ x : α × β, p x` into
+                  -- `∀ a b, p (a, b)`, so a tuple post-binder produces one
+                  -- output per leaf rather than a single pair.
+                  ``Prod.forall, ``Prod.exists,
+                  ``forall_unit, ``true_imp_iff
     ]
-    qimp_elim_tactics := #[ ``Std.WP.qimp_spec_iff, ]
+    qimp_elim_tactics := #[
+      ``Std.WP.qimp_spec_iff, ``Std.WP.qimp_iff,
+                  ``Std.WP.imp_and_iff, ``Std.WP.imp_exists_iff,
+                  ``Prod.forall, ``Prod.exists, ``Std.uncurry_apply_pair,
+                  ``forall_unit, ``true_imp_iff
+        ]
     liftings := #[]
   }
 
@@ -857,9 +873,21 @@ namespace Aeneas.Std.WP
     mk_spec_bind := ``Std.WP.dspec_bind'
     mk_spec_bind_skip_args := 4
     uncurry_elim_tactics := #[
-      ``Std.WP.qimp_dspec_uncurry', ``Std.WP.qimp_dspec_unit, ``Std.WP.qimp_dspec_exists
+      ``Std.WP.qimp_dspec_uncurry', ``Std.WP.qimp_dspec_unit,
+                  ``Std.WP.qimp_uncurry', ``Std.WP.qimp_unit,
+                  ``Std.WP.qimp_dspec_exists, ``Std.WP.qimp_exists,
+                  -- `Prod.forall`/`Prod.exists` split `∀ x : α × β, p x` into
+                  -- `∀ a b, p (a, b)`, so a tuple post-binder produces one
+                  -- output per leaf rather than a single pair.
+                  ``Prod.forall, ``Prod.exists,
+                  ``forall_unit, ``true_imp_iff
     ]
-    qimp_elim_tactics := #[ ``Std.WP.qimp_dspec_iff, ]
+    qimp_elim_tactics := #[
+      ``Std.WP.qimp_dspec_iff, ``Std.WP.qimp_iff,
+                  ``Std.WP.imp_and_iff, ``Std.WP.imp_exists_iff,
+                  ``Prod.forall, ``Prod.exists, ``Std.uncurry_apply_pair,
+                  ``forall_unit, ``true_imp_iff
+        ]
     liftings := #[
       { from_statement := ``Std.WP.spec
         conversion_thm := ``Std.WP.spec_dspec
diff --git a/backends/lean/Aeneas/Tactic/Step/Step.lean b/backends/lean/Aeneas/Tactic/Step/Step.lean
index 522135ff2..402371439 100644
--- a/backends/lean/Aeneas/Tactic/Step/Step.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Step.lean
@@ -617,13 +617,13 @@ def introOutputs (info : SpecInfo) (args : Args) (fExpr : Expr) (stepState : Ste
     Simp.simpAt true { maxDischargeDepth := 1, failIfUnchanged := false, iota := false}
             { simpThms := #[← stepSimpExt.getTheorems],
               addSimpThms :=
-                info.uncurry_elim_tactics ++
-                #[ -- `Prod.forall`/`Prod.exists` split `∀ x : α × β, p x` into
-                  -- `∀ a b, p (a, b)`, so a tuple post-binder produces one
-                  -- output per leaf rather than a single pair.
-                  ``Std.WP.qimp_uncurry', ``Std.WP.qimp_unit, ``Std.WP.qimp_exists,
-                  ``Prod.forall, ``Prod.exists,
-                  ``forall_unit, ``true_imp_iff] }
+                info.uncurry_elim_tactics } --++
+                -- #[ -- `Prod.forall`/`Prod.exists` split `∀ x : α × β, p x` into
+                --   -- `∀ a b, p (a, b)`, so a tuple post-binder produces one
+                --   -- output per leaf rather than a single pair.
+                --   ``Std.WP.qimp_uncurry', ``Std.WP.qimp_unit, ``Std.WP.qimp_exists,
+                --   ``Prod.forall, ``Prod.exists,
+                --   ``forall_unit, ``true_imp_iff] }
             (.targets #[] true)
     | trace[Step] "The main goal was solved!"; return none
   traceGoalWithNode "goal after decomposing the nested `uncurry'`"
@@ -635,10 +635,10 @@ def introOutputs (info : SpecInfo) (args : Args) (fExpr : Expr) (stepState : Ste
     Simp.simpAt true { maxDischargeDepth := 1, failIfUnchanged := false, iota := false}
             { declsToUnfold := #[``Std.WP.curry, ``Std.WP.uncurry']
               addSimpThms :=
-                info.qimp_elim_tactics ++
-                #[ ``Std.WP.qimp_iff, ``Std.WP.imp_and_iff, ``Prod.forall, ``Prod.exists, ``Std.uncurry_apply_pair,
-                   ``Std.WP.imp_and_iff,  -- ``Std.WP.imp_exists_iff,
-                   ``forall_unit, ``true_imp_iff] }
+                info.qimp_elim_tactics } -- ++
+                -- #[ ``Std.WP.qimp_iff, ``Std.WP.imp_and_iff, ``Prod.forall, ``Prod.exists, ``Std.uncurry_apply_pair,
+                --    ``Std.WP.imp_and_iff,  -- ``Std.WP.imp_exists_iff,
+                --    ``forall_unit, ``true_imp_iff] }
             (.targets #[] true)
     | trace[Step] "The main goal was solved!"; return none
   traceGoalWithNode "goal after aliminating `qimp_spec` and `qimp` and decomposing the post-condition"
@@ -1887,9 +1887,11 @@ case a
 x : U32
 f : U32 → Result U32
 h : ∀ (x : U32), f x ⦃ y => ∃ z > 0, ↑y = ↑x + z ⦄
-y : U32
-z : ∃ z > 0, ↑y = ↑x + z
-⊢ ↑y > ↑x
+y : ℕ
+z : U32
+_✝¹ : y > 0
+_✝ : ↑z = ↑x + y
+⊢ ↑z > ↑x
 -/
 #guard_msgs in
   example (x : U32) (f : U32 → Result U32) (h : ∀ x, f x ⦃ y => ∃ z, z > 0 ∧ y.val = x.val + z ⦄) :
@@ -1931,15 +1933,14 @@ z_post : ↑z = ↑x + ↑y
 
   /- Test that manipulates a post-condition containing an ∃ -/
   /--
-warning: Too many ids provided ([some (s'), some (h0), some (h1)]): expected ≤ 2 ids, got 3
----
 error: unsolved goals
 case a
 zero : Slice U32 → Result (Slice U32)
 zero_spec :
   ∀ (s : Slice U32), zero s ⦃ s' => ∃ (h : s'.length = s.length), ∀ (i : ℕ) (x : i < s.length), s'[i] = 0#u32 ⦄
 s s' : Slice U32
-h0 : ∃ (h : s'.length = s.length), ∀ (i : ℕ) (x : i < s.length), s'[i] = 0#u32
+h0 : s'.length = s.length
+h1 : ∀ (i : ℕ) (x : i < s.length), s'[i] = 0#u32
 ⊢ (do
       let _ ← zero s'
       ok ()) ⦃
diff --git a/backends/lean/Aeneas/Tactic/Step/StepStar.lean b/backends/lean/Aeneas/Tactic/Step/StepStar.lean
index c1eb44ba9..710371a56 100644
--- a/backends/lean/Aeneas/Tactic/Step/StepStar.lean
+++ b/backends/lean/Aeneas/Tactic/Step/StepStar.lean
@@ -1238,7 +1238,6 @@ x : α
 f : α → Result Unit
 f_spec : ∀ (x : α) [Inhabited α], f x ⦃ x✝ => True ⦄
 _ : [> let PUnit.unit ← f x <]
-_✝ : True
 ⊢ (do
       f x
       ok ()) ⦃
diff --git a/backends/lean/Aeneas/Tactic/Step/Tests/UncurryBind.lean b/backends/lean/Aeneas/Tactic/Step/Tests/UncurryBind.lean
index c4e3c3c5a..030453bec 100644
--- a/backends/lean/Aeneas/Tactic/Step/Tests/UncurryBind.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Tests/UncurryBind.lean
@@ -75,7 +75,7 @@ example (xs : List Nat) :
 /--
 info: Try this:
 
-  [apply]     let* ⟨ a, b, c, a_post1, a_post2, a_post3 ⟩ ← readNested_spec
+  [apply]     let* ⟨ a, b, c, a_post ⟩ ← readNested_spec
     let* ⟨ ⟩ ← readSingle_spec
 -/
 #guard_msgs in

From 649686dbb8ea537abeae9ded8ba0fa1935d60afd Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Fri, 12 Jun 2026 17:29:48 -0400
Subject: [PATCH 18/67] used get? instead of get!

---
 backends/lean/Aeneas/Tactic/Step/Init.lean |  3 ++-
 backends/lean/Aeneas/Tactic/Step/Step.lean | 10 ++++++++++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/backends/lean/Aeneas/Tactic/Step/Init.lean b/backends/lean/Aeneas/Tactic/Step/Init.lean
index f69567837..85269fc09 100644
--- a/backends/lean/Aeneas/Tactic/Step/Init.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Init.lean
@@ -323,7 +323,8 @@ initialize stepAttr : StepSpecAttr ← do
 
 def StepSpecAttr.find? (s : StepSpecAttr) (name : Name) (e : Expr) : MetaM (Array Name) := do
   let state := s.ext.getState (← getEnv)
-  let dtree := state.rules.get! name
+  let .some dtree := state.rules.get? name
+  | throwError "no such spec statement as {name}, valid ones are {state.rules.keys}"
   let rules ← dtree.getMatch e
   pure (rules.filter (fun th => th ∉ state.deactivated))
 
diff --git a/backends/lean/Aeneas/Tactic/Step/Step.lean b/backends/lean/Aeneas/Tactic/Step/Step.lean
index 402371439..140344994 100644
--- a/backends/lean/Aeneas/Tactic/Step/Step.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Step.lean
@@ -7,6 +7,7 @@ import Aeneas.Tactic.Simp.SimpLemmas
 import AeneasMeta.Async
 import Aeneas.Tactic.Solver.Grind.Init
 import Aeneas.Tactic.Step.InferPost
+import Aeneas.Std.WP
 
 namespace Aeneas
 
@@ -2057,7 +2058,16 @@ h1 : ∀ (i : ℕ) (x : i < s.length), s'[i] = 0#u32
       simple_diverge i1
   partial_fixpoint
 
+  -- this exists to workaround what is possibly a lean bug.
+  -- it can't find dspec the first time you try, but the subsequent ones work just fine.
+  -- it also seems to have something to do with the step attribute
+  /-- error: no such spec statement as Aeneas.Std.WP.dspec, valid ones are [Aeneas.Std.WP.spec] -/
+  #guard_msgs in
   @[step]
+  theorem lean_bug_workaround : Std.WP.dspec (.ok 10) (fun _ => False) := by
+    step
+    --
+
   theorem test_div (x : Std.I32) : Std.WP.dspec (simple_diverge x) (fun res => res = 10#i32)
     := by
       revert x

From 96fb2bfb67247db9a9edc20d50d0cabe7091a358 Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Mon, 15 Jun 2026 09:08:26 -0400
Subject: [PATCH 19/67] tests update

---
 tests/lean/lakefile.lean  | 25 +++++++++++++------------
 tests/lean/lean-toolchain |  2 +-
 2 files changed, 14 insertions(+), 13 deletions(-)

diff --git a/tests/lean/lakefile.lean b/tests/lean/lakefile.lean
index 936ca2306..c749b3f5b 100644
--- a/tests/lean/lakefile.lean
+++ b/tests/lean/lakefile.lean
@@ -7,9 +7,9 @@ package «tests» {}
 
 @[default_target] lean_lib Adt
 @[default_target] lean_lib AdtBorrows
+@[default_target] lean_lib ArraySliceIndex
 @[default_target] lean_lib Arrays
 @[default_target] lean_lib ArraysDefs
-@[default_target] lean_lib ArraySliceIndex
 @[default_target] lean_lib AsMut
 @[default_target] lean_lib AssertCfg
 @[default_target] lean_lib Avl
@@ -20,7 +20,6 @@ package «tests» {}
 @[default_target] lean_lib Builtin
 @[default_target] lean_lib BuiltinAuto
 @[default_target] lean_lib ChunksExact
-@[default_target] lean_lib Issue804ClosureReturnRef
 @[default_target] lean_lib Closures
 @[default_target] lean_lib ConstShadow
 @[default_target] lean_lib Constants
@@ -28,9 +27,9 @@ package «tests» {}
 @[default_target] lean_lib Curve25519
 @[default_target] lean_lib Default
 @[default_target] lean_lib DefaultedMethod
-@[default_target] lean_lib Derive
 @[default_target] lean_lib Demo
 @[default_target] lean_lib Deref
+@[default_target] lean_lib Derive
 @[default_target] lean_lib Discriminant
 @[default_target] lean_lib Drop
 @[default_target] lean_lib DropBug
@@ -39,45 +38,47 @@ package «tests» {}
 @[default_target] lean_lib FromTo
 @[default_target] lean_lib Hashmap
 @[default_target] lean_lib Into
-@[default_target] lean_lib Iterators
-@[default_target] lean_lib IteratorsArray
-@[default_target] lean_lib IssueCharon1172
+@[default_target] lean_lib Issue1044OpaqueTuple
 @[default_target] lean_lib Issue134LoopSharedBorrows
 @[default_target] lean_lib Issue194RecursiveStructProjector
 @[default_target] lean_lib Issue270LoopList
 @[default_target] lean_lib Issue440TypeError
 @[default_target] lean_lib Issue789LoopCtxMatch
 @[default_target] lean_lib Issue803SelfInArray
+@[default_target] lean_lib Issue804ClosureReturnRef
 @[default_target] lean_lib Issue807MissingSymbolicValue
 @[default_target] lean_lib Issue815GlobalReferencingFallibleGlobal
-@[default_target] lean_lib Issue1044OpaqueTuple
-@[default_target] lean_lib Joins
+@[default_target] lean_lib IssueCharon1172
+@[default_target] lean_lib Iterators
+@[default_target] lean_lib IteratorsArray
+@[default_target] lean_lib IteratorsScalar
 @[default_target] lean_lib JoinDuplicate
+@[default_target] lean_lib Joins
 @[default_target] lean_lib ListBorrows
 @[default_target] lean_lib LoopSharedLoanInJoin
 @[default_target] lean_lib Loops
-@[default_target] lean_lib LoopsRec
 @[default_target] lean_lib LoopsAdts
 @[default_target] lean_lib LoopsIssues
 @[default_target] lean_lib LoopsNested
 @[default_target] lean_lib LoopsNestedRec
+@[default_target] lean_lib LoopsRec
 @[default_target] lean_lib LoopsSequences
 @[default_target] lean_lib MiniTree
 @[default_target] lean_lib MultiTarget
 @[default_target] lean_lib MutBorrowInSharedBorrow
-@[default_target] lean_lib OpaqueMutRegion
 @[default_target] lean_lib Names
 @[default_target] lean_lib NestedBorrows
 @[default_target] lean_lib NoNestedBorrows
+@[default_target] lean_lib OpaqueMutRegion
 @[default_target] lean_lib Options
-@[default_target] lean_lib OverflowingOps
 @[default_target] lean_lib Order
+@[default_target] lean_lib OverflowingOps
 @[default_target] lean_lib Paper
 @[default_target] lean_lib PoloniusList
-@[default_target] lean_lib RustBorrowCheckIssues
 @[default_target] lean_lib Print
 @[default_target] lean_lib Range
 @[default_target] lean_lib RenameAttribute
+@[default_target] lean_lib RustBorrowCheckIssues
 @[default_target] lean_lib Scalars
 @[default_target] lean_lib Slices
 @[default_target] lean_lib Static
diff --git a/tests/lean/lean-toolchain b/tests/lean/lean-toolchain
index 635bb9534..6c7e31fff 100644
--- a/tests/lean/lean-toolchain
+++ b/tests/lean/lean-toolchain
@@ -1 +1 @@
-leanprover/lean4:v4.30.0-rc2
\ No newline at end of file
+leanprover/lean4:v4.30.0-rc2

From 84fb945ac2fca14018816d04c6641b3f44b10fc6 Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Mon, 15 Jun 2026 11:15:29 -0400
Subject: [PATCH 20/67] error test

---
 backends/lean/Aeneas/Tactic/Step/Step.lean | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/backends/lean/Aeneas/Tactic/Step/Step.lean b/backends/lean/Aeneas/Tactic/Step/Step.lean
index 140344994..dcba3d78a 100644
--- a/backends/lean/Aeneas/Tactic/Step/Step.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Step.lean
@@ -2061,8 +2061,8 @@ h1 : ∀ (i : ℕ) (x : i < s.length), s'[i] = 0#u32
   -- this exists to workaround what is possibly a lean bug.
   -- it can't find dspec the first time you try, but the subsequent ones work just fine.
   -- it also seems to have something to do with the step attribute
-  /-- error: no such spec statement as Aeneas.Std.WP.dspec, valid ones are [Aeneas.Std.WP.spec] -/
-  #guard_msgs in
+  /---/
+  #guard_msgs (substring := true) in
   @[step]
   theorem lean_bug_workaround : Std.WP.dspec (.ok 10) (fun _ => False) := by
     step

From 8db658846130367a30f5df1363d9421c920ca8ae Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Mon, 15 Jun 2026 12:13:05 -0400
Subject: [PATCH 21/67] update tests, fix tutorial

---
 .../lean/Aeneas/Tactic/Step/UnfoldPF.lean     |  2 +-
 tests/lean/Tutorial/Exercises.lean            | 20 ++++++-------------
 tests/lean/Tutorial/Solutions.lean            |  5 ++---
 tests/lean/Tutorial/Tutorial.lean             | 19 +++++-------------
 4 files changed, 14 insertions(+), 32 deletions(-)

diff --git a/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean b/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean
index 00ebd9b74..56080ed2a 100644
--- a/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean
+++ b/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean
@@ -144,7 +144,7 @@ elab "dspec_induction" func:ident : tactic => do
   let constant_params := func_params.map (fun x => fixpoint_induct_params.contains x)
   trace[UnfoldPF] "constant_params: {constant_params}"
   let .some func_application := goalTy.find? (fun e => e.getAppFn.isConstOf func_expr_name)
-  | throwError "no"
+  | throwError "{func} not found in goal"
   trace[UnfoldPF] "func app in goal is: {func_application}"
   let args_in_goal := func_application.getAppArgs
   let const_args := (args_in_goal.zip constant_params).filterMap
diff --git a/tests/lean/Tutorial/Exercises.lean b/tests/lean/Tutorial/Exercises.lean
index 581ad38db..08c9a9848 100644
--- a/tests/lean/Tutorial/Exercises.lean
+++ b/tests/lean/Tutorial/Exercises.lean
@@ -857,25 +857,16 @@ open ControlFlow
 def dummy_hash (i : Std.U32) : Result Std.U32 := do
   ok 1000#u32
 
-/-- [tutorial::pseudo_random]: loop body 0:
-    Source: 'src/lib.rs', lines 258:2-260:3
-    Visibility: public -/
-@[rust_loop_body]
-def pseudo_random_loop.body
-  (state : Std.U32) : Result (ControlFlow Std.U32 Std.U32) := do
-  if state < 100#u32
-  then let state1 ← dummy_hash state
-       ok (cont state1)
-  else ok (done state)
-
 /-- [tutorial::pseudo_random]: loop 0:
     Source: 'src/lib.rs', lines 258:2-260:3
     Visibility: public -/
 @[rust_loop]
 def pseudo_random_loop (state : Std.U32) : Result Std.U32 := do
-  loop
-    (fun state1 => pseudo_random_loop.body state1)
-    state
+  if state < 100#u32
+  then let state1 ← dummy_hash state
+       pseudo_random_loop state1
+  else ok state
+partial_fixpoint
 
 /-- [tutorial::pseudo_random]:
     Source: 'src/lib.rs', lines 255:0-262:1
@@ -883,6 +874,7 @@ def pseudo_random_loop (state : Std.U32) : Result Std.U32 := do
 @[reducible] def pseudo_random : Result Std.U32 := do
                pseudo_random_loop 0#u32
 
+
 /- exersize about dspec.
 For the usual spec `r ⦃post⦄`, one needs to prove that `r` terminates and
 produces a value that satisfies `post`
diff --git a/tests/lean/Tutorial/Solutions.lean b/tests/lean/Tutorial/Solutions.lean
index 899c098eb..47d5dd981 100644
--- a/tests/lean/Tutorial/Solutions.lean
+++ b/tests/lean/Tutorial/Solutions.lean
@@ -456,17 +456,16 @@ theorem add_with_carry_spec
 theorem pseudo_random_spec :
   pseudo_random div⦃fun x => x.val >= 100⦄ := by
   unfold pseudo_random
-  unfold pseudo_random_loop
+  -- unfold pseudo_random_loop
   -- if we proceed by unfolding `loop`, then the proof will be non-terminating.
   -- instead, we can use the dspec_induction tactic
   -- note here that we must make a potentially non-obvious decision about
   -- what to generalize and how to do the induction
   generalize 0#u32 = x
   revert x
-  dspec_induction loop
+  dspec_induction pseudo_random_loop
   intros loop' ih x
   simp only
-  unfold pseudo_random_loop.body
   simp
   by_cases ((↑x : Nat) < 100)
   ·
diff --git a/tests/lean/Tutorial/Tutorial.lean b/tests/lean/Tutorial/Tutorial.lean
index a21ddad2b..47c91ac0e 100644
--- a/tests/lean/Tutorial/Tutorial.lean
+++ b/tests/lean/Tutorial/Tutorial.lean
@@ -424,25 +424,16 @@ def add
 def dummy_hash (i : Std.U32) : Result Std.U32 := do
   ok 1000#u32
 
-/-- [tutorial::pseudo_random]: loop body 0:
-    Source: 'src/lib.rs', lines 258:2-260:3
-    Visibility: public -/
-@[rust_loop_body]
-def pseudo_random_loop.body
-  (state : Std.U32) : Result (ControlFlow Std.U32 Std.U32) := do
-  if state < 100#u32
-  then let state1 ← dummy_hash state
-       ok (cont state1)
-  else ok (done state)
-
 /-- [tutorial::pseudo_random]: loop 0:
     Source: 'src/lib.rs', lines 258:2-260:3
     Visibility: public -/
 @[rust_loop]
 def pseudo_random_loop (state : Std.U32) : Result Std.U32 := do
-  loop
-    (fun state1 => pseudo_random_loop.body state1)
-    state
+  if state < 100#u32
+  then let state1 ← dummy_hash state
+       pseudo_random_loop state1
+  else ok state
+partial_fixpoint
 
 /-- [tutorial::pseudo_random]:
     Source: 'src/lib.rs', lines 255:0-262:1

From 533dfac9ee9b1d2b93884e1029c3e35458125c80 Mon Sep 17 00:00:00 2001
From: Jacob <jeprinz@users.noreply.github.com>
Date: Wed, 17 Jun 2026 14:17:34 -0400
Subject: [PATCH 22/67] Update tests/lean/Tutorial/Solutions.lean

Co-authored-by: Son HO <hosonmarc@gmail.com>
---
 tests/lean/Tutorial/Solutions.lean | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/lean/Tutorial/Solutions.lean b/tests/lean/Tutorial/Solutions.lean
index 47d5dd981..f40c99698 100644
--- a/tests/lean/Tutorial/Solutions.lean
+++ b/tests/lean/Tutorial/Solutions.lean
@@ -472,8 +472,8 @@ theorem pseudo_random_spec :
     simp [*]
     unfold dummy_hash
     simp
-    -- note that here, i am refraining from using the result of dummy_hash,
-    -- since its supposed to represent a hash function where we can't predict the result,
+    -- note that here, I am refraining from using the result of dummy_hash,
+    -- since it's supposed to represent a hash function where we can't predict the result,
     -- but it actually is just a constant
     step
     grind

From 5b2d6061140863a1440a5f8b133d805bbad16069 Mon Sep 17 00:00:00 2001
From: Jacob <jeprinz@users.noreply.github.com>
Date: Fri, 19 Jun 2026 09:13:42 -0400
Subject: [PATCH 23/67] Apply suggestions from code review

Co-authored-by: Son HO <son.marc.ho@hotmail.com>
---
 .../lean/Aeneas/Tactic/Step/UnfoldPF.lean     | 30 ++++++++-----------
 tests/lean/Tutorial/Exercises.lean            | 18 +++++------
 2 files changed, 22 insertions(+), 26 deletions(-)

diff --git a/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean b/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean
index 56080ed2a..2b8170091 100644
--- a/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean
+++ b/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean
@@ -9,14 +9,15 @@ import Aeneas.Tactic.Solver.Grind.Init
 import Aeneas.Tactic.Step.InferPost
 import Aeneas.Tactic.Step.Step
 
--- tactic for unfolding partial_fixpoint definitions with fixpoint_induct
--- normally you would use the normal unfold tactic, but that requires the proof to be terminating
--- instead, you need to use the .fixpoint_induct theorem that is automatically created by lean
--- however, this requires a bunch of boilerplate that can be automated in the case that
--- the conclusion is a dspec theorem about a function call.
--- in particular, the statement needs to be proven to be admissible.
--- see the examples below to see what the tactic does
--- and the manual examples show what the tactic is doing written out directly
+/- Tactic for unfolding partial_fixpoint definitions with fixpoint_induct.
+   Normally you would use the normal unfold tactic, but that requires the proof to be terminating.
+   Instead, you need to use the .fixpoint_induct theorem that is automatically created by lean.
+   However, this requires a bunch of boilerplate that can be automated in the case that
+   the conclusion is a dspec theorem about a function call.
+   In particular, the statement needs to be proven to be admissible.
+   
+   See the examples below to see what the tactic does
+   and the manual examples show what the tactic is doing written out directly. -/
 
 namespace Aeneas
 
@@ -135,7 +136,7 @@ elab "dspec_induction" func:ident : tactic => do
   -- sadly, there are many possible forms that fixpoint_induct can take.
   -- we need to reverse engineer which form it is by looking at its type.
   -- see the examples at the end of this file, it depends on which parameters to the
-  -- original function are unchanged in recursive calls. {
+  -- original function are unchanged in recursive calls.
   let func_params ← getParamNames (← inferType func_expr)
   let fixpoint_induct_params ← getParamNames (← inferType fixpoint_induct)
   -- the last 3 parameters are the motive, admissibility, and proof of induction
@@ -152,14 +153,12 @@ elab "dspec_induction" func:ident : tactic => do
   let nonconst_args := (args_in_goal.zip constant_params).filterMap
     fun (x, b) => if b then none else some x
   trace[UnfoldPF] "const_args: {const_args}"
-  -- }
 
   -- make a type family that abstracts over instances of func in the goal type
   -- first, we need to find out what type the motive expects, by inspecting the theorem
   -- this should be something that inputs all of the nonconst_args
   let applied_fixpoint_induct_type ← inferType (mkAppN fixpoint_induct const_args)
   let applied_func_type := (getInputTypes (getInputTypes applied_fixpoint_induct_type).getLast!)[0]!
-  -- let applied_func_type ← inferType func_expr
   let fmvar ← Meta.mkFreshExprMVar (some applied_func_type)
   let value_to_replace_in_motive := mkAppN fmvar nonconst_args
   let abs_goal_ty := goalTy.replace
@@ -176,8 +175,7 @@ elab "dspec_induction" func:ident : tactic => do
 
   let [g_admissible, g_main] ← goal.apply fi_app | throwError "this shouldn't happen 1"
 
-  -- prove the admissibility condition. this chunk of code is equivalent to the
-  -- `prove_admissible` tactic above, but apparently calling that directly might cause problems
+  -- Prove the admissibility condition
   let _ ← withTransparency .default <| do -- using a more restricted reducibility doesn't work on some tests below
     let onError {α} : TacticM α := throwError "failed to prove admissibility condition"
     let curry_admissible ← mkConstWithFreshMVarLevels `Aeneas.UnfoldPF.curry_admissible
@@ -320,8 +318,7 @@ theorem pseudo_random_spec :
   unfold pseudo_random_loop.body
   simp
   by_cases ((↑x : Nat) < 100)
-  ·
-    simp [*]
+  · simp [*]
     unfold dummy_hash
     simp
     -- note that here, i am refraining from using the result of dummy_hash,
@@ -329,8 +326,7 @@ theorem pseudo_random_spec :
     -- but it actually is just a constant
     step
     grind
-  ·
-    simp [*]
+  · simp [*]
     grind
 
 -- these two examples demonstrate how .fixpoint_induct theorems can take various forms.
diff --git a/tests/lean/Tutorial/Exercises.lean b/tests/lean/Tutorial/Exercises.lean
index 08c9a9848..2c6dca69c 100644
--- a/tests/lean/Tutorial/Exercises.lean
+++ b/tests/lean/Tutorial/Exercises.lean
@@ -875,19 +875,19 @@ partial_fixpoint
                pseudo_random_loop 0#u32
 
 
-/- exersize about dspec.
+/- Exercise about dspec.
 For the usual spec `r ⦃post⦄`, one needs to prove that `r` terminates and
 produces a value that satisfies `post`
 
 However, sometimes a function may be potentially nonterminating.
-dspec (notated `r div⦃post⦄`) is a weaker statement,
-and only means that if r terminates then the result satisfies `post`.
-It works with the `step` tactic and any @step theorems for spec are automatically
-lifted to dspec. You will also need the `dspec_induction` tactic to complete this exercise,
-which is used to prove a fact about a recursive function by induction in it's recursive calls.
-
-`dummy_hash` is supposed to represent an opaque function where we can't reason about it's output,
-so don't make use of it's definition as a constant for the solution.
+`dspec` (notation `r div⦃post⦄`) is a weaker statement,
+and only means that if `r` terminates then the result satisfies `post`.
+It works with the `step` tactic and any `@step` theorems for `spec` are automatically
+lifted to `dspec`. You will also need the `dspec_induction` tactic to complete this exercise,
+which is used to prove a fact about a recursive function by induction in its recursive calls.
+
+`dummy_hash` is supposed to represent an opaque function where we can't reason about its output,
+so don't make use of its definition as a constant for the solution.
 -/
 theorem pseudo_random_spec :
   pseudo_random div⦃fun x => x.val >= 100⦄ := by

From 0822cfc25c96412dc92e4a535ee1b719033c924e Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Fri, 19 Jun 2026 09:29:06 -0400
Subject: [PATCH 24/67] examples with first/second_arg_const

---
 .../lean/Aeneas/Tactic/Step/UnfoldPF.lean     | 29 +++++++++++++++----
 1 file changed, 24 insertions(+), 5 deletions(-)

diff --git a/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean b/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean
index 2b8170091..c143cd75c 100644
--- a/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean
+++ b/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean
@@ -15,7 +15,7 @@ import Aeneas.Tactic.Step.Step
    However, this requires a bunch of boilerplate that can be automated in the case that
    the conclusion is a dspec theorem about a function call.
    In particular, the statement needs to be proven to be admissible.
-   
+
    See the examples below to see what the tactic does
    and the manual examples show what the tactic is doing written out directly. -/
 
@@ -330,16 +330,35 @@ theorem pseudo_random_spec :
     grind
 
 -- these two examples demonstrate how .fixpoint_induct theorems can take various forms.
-def first_arg_const (x y : Nat) : Option Nat :=
-  if x = 0 then Option.some 0
+def first_arg_const (x y : Nat) : Result Nat :=
+  if x = 0 then .ok 0
   else first_arg_const x (y + 1)
 partial_fixpoint
 
-def second_arg_const (x y : Nat) : Option Nat :=
-  if y = 0 then Option.some 0
+def second_arg_const (x y : Nat) : Result Nat :=
+  if y = 0 then .ok 0
   else second_arg_const (x + 1) y
 partial_fixpoint
 
+-- uncomment to see the difference:
+-- #check first_arg_const.fixpoint_induct
+-- #check second_arg_const.fixpoint_induct
+
+example x y : (first_arg_const x y) div⦃fun x => x = 0⦄ := by
+  revert y
+  dspec_induction first_arg_const
+  intros first_arg_const' ih y
+  split
+  · trivial
+  · apply ih
+
+example x y : (second_arg_const x y) div⦃fun x => x = 0⦄ := by
+  revert x
+  dspec_induction second_arg_const
+  intros second_arg_const' ih y
+  split
+  · trivial
+  · apply ih
 
 end Test
 

From 870c0283296bc396157cd50b40ea85abd4709ddc Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Fri, 19 Jun 2026 09:46:08 -0400
Subject: [PATCH 25/67] reservedNameAction

---
 .../lean/Aeneas/Tactic/Step/UnfoldPF.lean     | 27 +++++++++----------
 1 file changed, 12 insertions(+), 15 deletions(-)

diff --git a/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean b/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean
index c143cd75c..6661d021c 100644
--- a/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean
+++ b/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean
@@ -97,14 +97,6 @@ theorem WP_func_admissible (α β : Type) (arg) (post)
   apply Lean.Order.admissible_flatOrder
   simp only [WP.dspec]
 
-macro "prove_admissible" : tactic =>
-  `(tactic| (
-      (repeat' apply curry_admissible)
-      (repeat' (apply Lean.Order.admissible_pi ; intro))
-      (apply WP_func_admissible)
-  )
-  )
-
 def getParamNames (ty : Expr) : MetaM (Array Name) := do
   forallTelescope ty fun xs _ => do
     xs.mapM fun x => do
@@ -125,13 +117,10 @@ elab "dspec_induction" func:ident : tactic => do
   let func_expr := func_expr.getAppFn
   let func_expr_name := func_expr.constName!
 
-  -- do some wierd hacky nonsense to get `func.fixpoint_induct`.
-  -- more obvious methods fail, presumably due to buggy lean behavior
-  let namee := func.getId.mkStr "fixpoint_induct"
-  let fi_stx : Syntax ← `(term | $(mkIdent namee))
-  let fixpoint_induct ← Term.elabTerm fi_stx none
-  let fixpoint_induct := fixpoint_induct.getAppFn
-  trace[UnfoldPF] "type of fixpoint_induct is {← inferType fixpoint_induct}"
+  let func_name ← resolveGlobalConstNoOverload func
+  let fi_name := func_name ++ `fixpoint_induct
+  executeReservedNameAction fi_name -- see https://leanprover.zulipchat.com/#narrow/channel/113488-general/topic/.60.2Efixpoint_induct.60.20doesn.27t.20exist.20in.20environment.20until.20used.3F/with/602621282
+  let fixpoint_induct ← Meta.mkConstWithFreshMVarLevels fi_name
 
   -- sadly, there are many possible forms that fixpoint_induct can take.
   -- we need to reverse engineer which form it is by looking at its type.
@@ -208,6 +197,14 @@ def simple_diverge (x : Std.I32) : Result Std.I32 := do
     simple_diverge i1
 partial_fixpoint
 
+macro "prove_admissible" : tactic =>
+  `(tactic| (
+      (repeat' apply curry_admissible)
+      (repeat' (apply Lean.Order.admissible_pi ; intro))
+      (apply WP_func_admissible)
+  )
+  )
+
 -- this version demonstrates what the dspec_induction tactic does, just done manually
 theorem test_div_manual (x : Std.I32) : Std.WP.dspec (simple_diverge x) (fun res => res = 10#i32)
   := by

From 04e82fbb0a94a7a8690f5d64831b2b8bcab195f9 Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Fri, 19 Jun 2026 10:14:09 -0400
Subject: [PATCH 26/67] changed div syntax and added delaborator

---
 backends/lean/Aeneas/Std/WP.lean              | 19 +++++++++++++++----
 .../lean/Aeneas/Tactic/Step/UnfoldPF.lean     |  6 +++---
 tests/lean/Tutorial/Exercises.lean            |  4 ++--
 tests/lean/Tutorial/Solutions.lean            |  2 +-
 4 files changed, 21 insertions(+), 10 deletions(-)

diff --git a/backends/lean/Aeneas/Std/WP.lean b/backends/lean/Aeneas/Std/WP.lean
index 4f4edda03..3df0e5e17 100644
--- a/backends/lean/Aeneas/Std/WP.lean
+++ b/backends/lean/Aeneas/Std/WP.lean
@@ -261,8 +261,8 @@ scoped syntax:54 term:55 " ⦃ " term+ " => " term " ⦄" : term
 scoped syntax:54 term:55 " ⦃ " term " ⦄" : term
 
 -- for dspec
-scoped syntax:54 term:55 " div⦃ " term+ " => " term " ⦄" : term
-scoped syntax:54 term:55 " div⦃ " term " ⦄" : term
+scoped syntax:54 term:55 " ⦃ " term+ " => " term " ⦄div" : term
+scoped syntax:54 term:55 " ⦃ " term " ⦄div" : term
 
 open Lean PrettyPrinter
 
@@ -324,7 +324,7 @@ macro_rules
         `(uncurry' $inner)
     let post ← run 0 xs
     `(Aeneas.Std.WP.spec $e $post)
-  | `($e div⦃ $x $xs:term* => $p ⦄) => do
+  | `($e ⦃ $x $xs:term* => $p ⦄div) => do
     let xs := x :: xs.toList
     let rec run (depth : Nat) (xs : List Term) : MacroM Term := do
       match xs with
@@ -340,7 +340,7 @@ macro_rules
 /-- Macro expansion for predicate with no arrow -/
 macro_rules
   | `($e ⦃ $p ⦄) => do `(_root_.Aeneas.Std.WP.spec $e $p)
-  | `($e div⦃ $p ⦄) => do `(_root_.Aeneas.Std.WP.dspec $e $p)
+  | `($e ⦃ $p ⦄div) => do `(_root_.Aeneas.Std.WP.dspec $e $p)
 
 /-!
 # Pretty-printing
@@ -469,6 +469,17 @@ def delabSpec : Delab := do
   else
     `($monadExpr ⦃ $(binders[0]!) $(binders.drop 1)* => $bodyTerm ⦄)
 
+/-- Delaborator for `WP.dspec e post` → `e ⦃ binders => body ⦄div`. -/
+@[scoped delab app.Aeneas.Std.WP.dspec]
+def delabDSpec : Delab := do
+  guard $ (← getExpr).isAppOfArity' ``dspec 3
+  let monadExpr ← withNaryArg 1 delab
+  let (binders, bodyTerm) ← withNaryArg 2 delabPostBinders
+  if binders.size == 0 then
+    `($monadExpr ⦃ $bodyTerm ⦄div)
+  else
+    `($monadExpr ⦃ $(binders[0]!) $(binders.drop 1)* => $bodyTerm ⦄div)
+
 /-!
 # Tests
 -/
diff --git a/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean b/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean
index 6661d021c..7906c1bb3 100644
--- a/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean
+++ b/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean
@@ -302,7 +302,7 @@ def pseudo_random_loop (state : Std.U32) : Result Std.U32 := do
 
 
 theorem pseudo_random_spec :
-  pseudo_random div⦃fun x => x.val >= 100⦄ := by
+  pseudo_random ⦃fun x => x.val >= 100⦄div := by
   unfold pseudo_random
   unfold pseudo_random_loop
   -- note here that we must make a potentially non-obvious decision about
@@ -341,7 +341,7 @@ partial_fixpoint
 -- #check first_arg_const.fixpoint_induct
 -- #check second_arg_const.fixpoint_induct
 
-example x y : (first_arg_const x y) div⦃fun x => x = 0⦄ := by
+example x y : (first_arg_const x y) ⦃fun x => x = 0⦄div := by
   revert y
   dspec_induction first_arg_const
   intros first_arg_const' ih y
@@ -349,7 +349,7 @@ example x y : (first_arg_const x y) div⦃fun x => x = 0⦄ := by
   · trivial
   · apply ih
 
-example x y : (second_arg_const x y) div⦃fun x => x = 0⦄ := by
+example x y : (second_arg_const x y) ⦃fun x => x = 0⦄div := by
   revert x
   dspec_induction second_arg_const
   intros second_arg_const' ih y
diff --git a/tests/lean/Tutorial/Exercises.lean b/tests/lean/Tutorial/Exercises.lean
index 2c6dca69c..c2ccc1a5e 100644
--- a/tests/lean/Tutorial/Exercises.lean
+++ b/tests/lean/Tutorial/Exercises.lean
@@ -880,7 +880,7 @@ For the usual spec `r ⦃post⦄`, one needs to prove that `r` terminates and
 produces a value that satisfies `post`
 
 However, sometimes a function may be potentially nonterminating.
-`dspec` (notation `r div⦃post⦄`) is a weaker statement,
+`dspec` (notation `r ⦃post⦄div`) is a weaker statement,
 and only means that if `r` terminates then the result satisfies `post`.
 It works with the `step` tactic and any `@step` theorems for `spec` are automatically
 lifted to `dspec`. You will also need the `dspec_induction` tactic to complete this exercise,
@@ -890,7 +890,7 @@ which is used to prove a fact about a recursive function by induction in its rec
 so don't make use of its definition as a constant for the solution.
 -/
 theorem pseudo_random_spec :
-  pseudo_random div⦃fun x => x.val >= 100⦄ := by
+  pseudo_random ⦃fun x => x.val >= 100⦄div := by
   sorry
 
 end Tutorial.Solutions
diff --git a/tests/lean/Tutorial/Solutions.lean b/tests/lean/Tutorial/Solutions.lean
index f40c99698..c5b1fa112 100644
--- a/tests/lean/Tutorial/Solutions.lean
+++ b/tests/lean/Tutorial/Solutions.lean
@@ -454,7 +454,7 @@ theorem add_with_carry_spec
 
 
 theorem pseudo_random_spec :
-  pseudo_random div⦃fun x => x.val >= 100⦄ := by
+  pseudo_random ⦃fun x => x.val >= 100⦄div := by
   unfold pseudo_random
   -- unfold pseudo_random_loop
   -- if we proceed by unfolding `loop`, then the proof will be non-terminating.

From e384cafd15a57f0b2c22e51b36baf5c08dd2ec38 Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Fri, 19 Jun 2026 10:46:08 -0400
Subject: [PATCH 27/67] fixed formatting, renamed file, improved tutorial

---
 backends/lean/Aeneas/Tactic/Step.lean         |  2 +-
 .../{UnfoldPF.lean => DspecInduction.lean}    | 22 ++++++++---------
 backends/lean/Aeneas/Tactic/Step/Step.lean    | 24 ++++++-------------
 backends/lean/Aeneas/Tactic/Step/Trace.lean   |  2 +-
 tests/lean/Tutorial/Solutions.lean            | 15 ++++++------
 5 files changed, 28 insertions(+), 37 deletions(-)
 rename backends/lean/Aeneas/Tactic/Step/{UnfoldPF.lean => DspecInduction.lean} (95%)

diff --git a/backends/lean/Aeneas/Tactic/Step.lean b/backends/lean/Aeneas/Tactic/Step.lean
index 09c9663ea..16fe78ea1 100644
--- a/backends/lean/Aeneas/Tactic/Step.lean
+++ b/backends/lean/Aeneas/Tactic/Step.lean
@@ -3,4 +3,4 @@ import Aeneas.Tactic.Step.Step
 import Aeneas.Tactic.Step.StepArraySpec
 import Aeneas.Tactic.Step.StepStar
 import Aeneas.Tactic.Step.Deprecated
-import Aeneas.Tactic.Step.UnfoldPF
+import Aeneas.Tactic.Step.DspecInduction
diff --git a/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean b/backends/lean/Aeneas/Tactic/Step/DspecInduction.lean
similarity index 95%
rename from backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean
rename to backends/lean/Aeneas/Tactic/Step/DspecInduction.lean
index 7906c1bb3..5c2e2314c 100644
--- a/backends/lean/Aeneas/Tactic/Step/UnfoldPF.lean
+++ b/backends/lean/Aeneas/Tactic/Step/DspecInduction.lean
@@ -21,7 +21,7 @@ import Aeneas.Tactic.Step.Step
 
 namespace Aeneas
 
-namespace UnfoldPF
+namespace DspecInduction
 
 open Lean Elab Term Meta Tactic
 open Utils
@@ -132,16 +132,16 @@ elab "dspec_induction" func:ident : tactic => do
   let fixpoint_induct_params := fixpoint_induct_params.extract 0 (fixpoint_induct_params.size - 3)
   -- which params are constant, these are treated specially by fixpoint_induct
   let constant_params := func_params.map (fun x => fixpoint_induct_params.contains x)
-  trace[UnfoldPF] "constant_params: {constant_params}"
+  trace[DspecInduction] "constant_params: {constant_params}"
   let .some func_application := goalTy.find? (fun e => e.getAppFn.isConstOf func_expr_name)
   | throwError "{func} not found in goal"
-  trace[UnfoldPF] "func app in goal is: {func_application}"
+  trace[DspecInduction] "func app in goal is: {func_application}"
   let args_in_goal := func_application.getAppArgs
   let const_args := (args_in_goal.zip constant_params).filterMap
     fun (x, b) => if b then some x else none
   let nonconst_args := (args_in_goal.zip constant_params).filterMap
     fun (x, b) => if b then none else some x
-  trace[UnfoldPF] "const_args: {const_args}"
+  trace[DspecInduction] "const_args: {const_args}"
 
   -- make a type family that abstracts over instances of func in the goal type
   -- first, we need to find out what type the motive expects, by inspecting the theorem
@@ -155,21 +155,21 @@ elab "dspec_induction" func:ident : tactic => do
   let abs_goal_ty := abs_goal_ty.abstract #[fmvar]
   let abs_goal_ty := Expr.lam `func applied_func_type abs_goal_ty .default
 
-  trace[UnfoldPF] "fixpoint_induct with motive: {abs_goal_ty}"
+  trace[DspecInduction] "fixpoint_induct with motive: {abs_goal_ty}"
 
   let fi_app := mkAppN fixpoint_induct (const_args ++ #[abs_goal_ty])
 
-  trace[UnfoldPF] "going to apply {fi_app}"
-  trace[UnfoldPF] "of type : {← inferType fi_app}"
+  trace[DspecInduction] "going to apply {fi_app}"
+  trace[DspecInduction] "of type : {← inferType fi_app}"
 
   let [g_admissible, g_main] ← goal.apply fi_app | throwError "this shouldn't happen 1"
 
   -- Prove the admissibility condition
   let _ ← withTransparency .default <| do -- using a more restricted reducibility doesn't work on some tests below
     let onError {α} : TacticM α := throwError "failed to prove admissibility condition"
-    let curry_admissible ← mkConstWithFreshMVarLevels `Aeneas.UnfoldPF.curry_admissible
+    let curry_admissible ← mkConstWithFreshMVarLevels `Aeneas.DspecInduction.curry_admissible
     let admissible_pi ← mkConstWithFreshMVarLevels `Lean.Order.admissible_pi
-    let WP_func_admissible ← mkConstWithFreshMVarLevels `Aeneas.UnfoldPF.WP_func_admissible
+    let WP_func_admissible ← mkConstWithFreshMVarLevels `Aeneas.DspecInduction.WP_func_admissible
     let [g_admissible]
       ← repeat' (fun g => g.apply curry_admissible) [g_admissible] | onError
     let [g_admissible]
@@ -183,7 +183,7 @@ elab "dspec_induction" func:ident : tactic => do
   pure ()
 
 -- uncomment to see debug traces:
--- set_option trace.UnfoldPF true
+-- set_option trace.DspecInduction true
 
 namespace Test
 
@@ -359,5 +359,5 @@ example x y : (second_arg_const x y) ⦃fun x => x = 0⦄div := by
 
 end Test
 
-end UnfoldPF
+end DspecInduction
 end Aeneas
diff --git a/backends/lean/Aeneas/Tactic/Step/Step.lean b/backends/lean/Aeneas/Tactic/Step/Step.lean
index dcba3d78a..6baa61781 100644
--- a/backends/lean/Aeneas/Tactic/Step/Step.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Step.lean
@@ -618,13 +618,7 @@ def introOutputs (info : SpecInfo) (args : Args) (fExpr : Expr) (stepState : Ste
     Simp.simpAt true { maxDischargeDepth := 1, failIfUnchanged := false, iota := false}
             { simpThms := #[← stepSimpExt.getTheorems],
               addSimpThms :=
-                info.uncurry_elim_tactics } --++
-                -- #[ -- `Prod.forall`/`Prod.exists` split `∀ x : α × β, p x` into
-                --   -- `∀ a b, p (a, b)`, so a tuple post-binder produces one
-                --   -- output per leaf rather than a single pair.
-                --   ``Std.WP.qimp_uncurry', ``Std.WP.qimp_unit, ``Std.WP.qimp_exists,
-                --   ``Prod.forall, ``Prod.exists,
-                --   ``forall_unit, ``true_imp_iff] }
+                info.uncurry_elim_tactics }
             (.targets #[] true)
     | trace[Step] "The main goal was solved!"; return none
   traceGoalWithNode "goal after decomposing the nested `uncurry'`"
@@ -636,10 +630,7 @@ def introOutputs (info : SpecInfo) (args : Args) (fExpr : Expr) (stepState : Ste
     Simp.simpAt true { maxDischargeDepth := 1, failIfUnchanged := false, iota := false}
             { declsToUnfold := #[``Std.WP.curry, ``Std.WP.uncurry']
               addSimpThms :=
-                info.qimp_elim_tactics } -- ++
-                -- #[ ``Std.WP.qimp_iff, ``Std.WP.imp_and_iff, ``Prod.forall, ``Prod.exists, ``Std.uncurry_apply_pair,
-                --    ``Std.WP.imp_and_iff,  -- ``Std.WP.imp_exists_iff,
-                --    ``forall_unit, ``true_imp_iff] }
+                info.qimp_elim_tactics }
             (.targets #[] true)
     | trace[Step] "The main goal was solved!"; return none
   traceGoalWithNode "goal after aliminating `qimp_spec` and `qimp` and decomposing the post-condition"
@@ -1893,8 +1884,8 @@ z : U32
 _✝¹ : y > 0
 _✝ : ↑z = ↑x + y
 ⊢ ↑z > ↑x
--/
-#guard_msgs in
+  -/
+  #guard_msgs in
   example (x : U32) (f : U32 → Result U32) (h : ∀ x, f x ⦃ y => ∃ z, z > 0 ∧ y.val = x.val + z ⦄) :
     f x ⦃ y => y.val > x.val ⦄ := by
     step as ⟨ y, z ⟩
@@ -1946,8 +1937,8 @@ h1 : ∀ (i : ℕ) (x : i < s.length), s'[i] = 0#u32
       let _ ← zero s'
       ok ()) ⦃
     x✝ => True ⦄
--/
-#guard_msgs in
+  -/
+  #guard_msgs in
   example (zero : Slice U32 → Result (Slice U32))
     (zero_spec : ∀ s, zero s ⦃ s' =>
       ∃ (h : s'.length = s.length),
@@ -1958,7 +1949,6 @@ h1 : ∀ (i : ℕ) (x : i < s.length), s'[i] = 0#u32
       let _ ← zero s'
       pure ()) ⦃ _ => True ⦄ := by
     step with zero_spec as ⟨ s', h0, h1 ⟩
-    --
 
 
   -- `Inhabited α` is not necessary: we add it for the purpose of testing
@@ -2145,7 +2135,7 @@ h1 : ∀ (i : ℕ) (x : i < s.length), s'[i] = 0#u32
 
   -- confirm that you can't use dspec from spec
   /-- error: Step failed: could not find a local assumption or a theorem to apply -/
-#guard_msgs in
+  #guard_msgs in
   example : WP.spec
     (do let x ← simple_diverge 5#i32
         let y ← simple_diverge 6#i32
diff --git a/backends/lean/Aeneas/Tactic/Step/Trace.lean b/backends/lean/Aeneas/Tactic/Step/Trace.lean
index 3ee59a3a0..6212fbe80 100644
--- a/backends/lean/Aeneas/Tactic/Step/Trace.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Trace.lean
@@ -6,6 +6,6 @@ namespace Aeneas.Step
 -- We can't define and use trace classes in the same file
 initialize registerTraceClass `Step
 initialize registerTraceClass `StepElab
-initialize registerTraceClass `UnfoldPF
+initialize registerTraceClass `DspecInduction
 
 end Aeneas.Step
diff --git a/tests/lean/Tutorial/Solutions.lean b/tests/lean/Tutorial/Solutions.lean
index c5b1fa112..079f1dea8 100644
--- a/tests/lean/Tutorial/Solutions.lean
+++ b/tests/lean/Tutorial/Solutions.lean
@@ -452,6 +452,13 @@ theorem add_with_carry_spec
   step as ⟨ c, x' ⟩
   simp_all
 
+  -- I am refraining from using the result of dummy_hash,
+  -- since it's supposed to represent a hash function where we can't predict the result,
+  -- but it actually is just a constant
+@[step]
+theorem dummy_hash_spec x : (dummy_hash x) ⦃fun _ => True⦄div :=
+  by simp [dummy_hash]
+
 
 theorem pseudo_random_spec :
   pseudo_random ⦃fun x => x.val >= 100⦄div := by
@@ -470,13 +477,7 @@ theorem pseudo_random_spec :
   by_cases ((↑x : Nat) < 100)
   ·
     simp [*]
-    unfold dummy_hash
-    simp
-    -- note that here, I am refraining from using the result of dummy_hash,
-    -- since it's supposed to represent a hash function where we can't predict the result,
-    -- but it actually is just a constant
-    step
-    grind
+    step*
   ·
     simp [*]
     grind

From 8d8f6c70d40f860429eede764850447d0fad7293 Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Fri, 19 Jun 2026 12:01:59 -0400
Subject: [PATCH 28/67] generalized spec_to_mvcgen

---
 backends/lean/Aeneas/Std/Spec.lean         |  2 ++
 backends/lean/Aeneas/Std/WP.lean           | 12 ++++++++++++
 backends/lean/Aeneas/Tactic/Step/Init.lean |  7 ++++---
 3 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/backends/lean/Aeneas/Std/Spec.lean b/backends/lean/Aeneas/Std/Spec.lean
index 2d2a0b004..c646241ee 100644
--- a/backends/lean/Aeneas/Std/Spec.lean
+++ b/backends/lean/Aeneas/Std/Spec.lean
@@ -29,6 +29,8 @@ structure SpecInfo where
   uncurry_elim_tactics : Array Lean.Name
   qimp_elim_tactics : Array Lean.Name
 
+  to_mvcgen: Option Name
+
   liftings : Array LiftingInfo
   deriving Inhabited
 
diff --git a/backends/lean/Aeneas/Std/WP.lean b/backends/lean/Aeneas/Std/WP.lean
index 4e625d3c8..87038ceaa 100644
--- a/backends/lean/Aeneas/Std/WP.lean
+++ b/backends/lean/Aeneas/Std/WP.lean
@@ -241,6 +241,10 @@ def qimp_dspec_iff {α β} (P : α → Prop) (k : α → Result β) (Q : β →
 @[simp, grind =, agrind =]
 theorem dspec_ok (x : α) : dspec (ok x) p ↔ p x := by simp [dspec]
 
+theorem dspec_imp_forall {m:Result α} {P:Post α} :
+  dspec m P → (∀ y, m = ok y → P y) := by
+  grind only [= dspec_ok]
+
 end Aeneas.Std.WP
 
 /-
@@ -797,6 +801,12 @@ theorem spec_to_mvcgen {α : Type u} {x : Result α} {Q : α → Prop}
   subst hx
   simp [Triple, WP.wp, PredTrans.apply, hQv]
 
+theorem dspec_to_mvcgen {α : Type u} {x : Result α} {Q : α → Prop}
+    (h : dspec x Q) :
+    ⦃ ⌜ ¬ x = .div ⌝ ⦄ x ⦃ ⇓ r => ⌜ Q r ⌝ ⦄ := by
+  simp [Triple, WP.wp, PredTrans.apply, SPred.pure]
+  cases x <;> simp [*, dspec] at * <;> trivial
+
 end Aeneas.Std.WP
 
 namespace Aeneas.Std
@@ -874,6 +884,7 @@ theorem forall_unit {p : Prop} : (Unit → p) ↔ p := by simp
       ``Std.WP.uncurry'_eq, ``Std.WP.uncurry'_pair,
       ``Std.WP.imp_exists_iff,
       ``forall_unit, ``true_imp_iff]
+    to_mvcgen := .some ``Std.WP.spec_to_mvcgen
     liftings := #[]
   }
 
@@ -897,6 +908,7 @@ theorem forall_unit {p : Prop} : (Unit → p) ↔ p := by simp
       ``Std.WP.uncurry'_eq, ``Std.WP.uncurry'_pair,
       ``Std.WP.imp_exists_iff,
       ``forall_unit, ``true_imp_iff]
+    to_mvcgen := .some ``Std.WP.dspec_to_mvcgen
     liftings := #[
       { from_statement := ``Std.WP.spec
         conversion_thm := ``Std.WP.spec_dspec
diff --git a/backends/lean/Aeneas/Tactic/Step/Init.lean b/backends/lean/Aeneas/Tactic/Step/Init.lean
index 42d5a96a4..f11976141 100644
--- a/backends/lean/Aeneas/Tactic/Step/Init.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Init.lean
@@ -279,7 +279,7 @@ structure StepSpecAttr where
   ext  : Extension
   deriving Inhabited
 
-private def generateMvcgenSpec (stx : Syntax) (attrKind : AttributeKind)
+private def generateMvcgenSpec (thm : Name) (stx : Syntax) (attrKind : AttributeKind)
     (thDecl : AsyncConstantInfo) : MetaM Unit := do
   let sig := thDecl.sig.get
   let thName := thDecl.name
@@ -288,7 +288,7 @@ private def generateMvcgenSpec (stx : Syntax) (attrKind : AttributeKind)
     let thConst := Lean.mkConst thName (sig.levelParams.map .param)
     let thApp := mkAppN thConst fvars
     -- Wrap with spec_to_mvcgen to produce: Triple (f args) ⌜True⌝ post⟨...⟩
-    let proof ← mkAppM ``Aeneas.Std.WP.spec_to_mvcgen #[thApp]
+    let proof ← mkAppM thm #[thApp]
     let innerTy ← inferType proof
     -- Re-introduce all fvars as binders
     let proofTerm ← mkLambdaFVars fvars proof
@@ -331,7 +331,8 @@ private def saveStepSpecFromThm (ext : Extension) (attrKind : AttributeKind) (st
     -- Also generate a corresponding mvcgen (@[spec]) lemma
     try
       trace[Step] "Registering with mvcgen"
-      MetaM.run' (generateMvcgenSpec stx attrKind thDecl)
+      if let .some thm := info.to_mvcgen then
+        MetaM.run' (generateMvcgenSpec thm stx attrKind thDecl)
     catch e =>
       logWarning m!"Could not generate mvcgen spec for {thName}: {e.toMessageData}"
     pure ()

From 0ebb58f07cffd11b016b48abc41bb3f93a792084 Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Fri, 19 Jun 2026 12:46:54 -0400
Subject: [PATCH 29/67] copied in coinductive library and itrees

---
 .../lean/Aeneas/Data/Coinductive/CoInd.lean   | 713 ++++++++++++++++++
 .../lean/Aeneas/Data/Coinductive/Effect.lean  |  42 ++
 .../lean/Aeneas/Data/Coinductive/ITree.lean   | 327 ++++++++
 backends/lean/Aeneas/Data/Coinductive/LICENSE |   9 +
 backends/lean/Aeneas/Data/Coinductive/README  |   2 +
 5 files changed, 1093 insertions(+)
 create mode 100644 backends/lean/Aeneas/Data/Coinductive/CoInd.lean
 create mode 100644 backends/lean/Aeneas/Data/Coinductive/Effect.lean
 create mode 100644 backends/lean/Aeneas/Data/Coinductive/ITree.lean
 create mode 100644 backends/lean/Aeneas/Data/Coinductive/LICENSE
 create mode 100644 backends/lean/Aeneas/Data/Coinductive/README

diff --git a/backends/lean/Aeneas/Data/Coinductive/CoInd.lean b/backends/lean/Aeneas/Data/Coinductive/CoInd.lean
new file mode 100644
index 000000000..735142aef
--- /dev/null
+++ b/backends/lean/Aeneas/Data/Coinductive/CoInd.lean
@@ -0,0 +1,713 @@
+namespace Aeneas.Data.Coinductive
+
+@[expose] public section
+
+/-!
+# Coinductive Types via Polynomial Functors
+
+This file constructs coinductive types as the terminal coalgebra of a polynomial
+functor (PF). The approach follows the "approximation sequences" style: the coinductive
+type `CoInd F` is defined as a coherent sequence of finite depth approximations
+`CoIndN F n`.
+
+## Comparison to QPF
+This work is inspired by QPFTypes https://github.com/alexkeizer/QpfTypes and the corresponding
+thesis https://eprints.illc.uva.nl/id/eprint/2239/1/MoL-2023-03.text.pdf
+However, the technical implementation differs and we currently do not support quotients.
+-/
+
+/-- A polynomial functor, given by a set of "shapes" `In` and for each shape `i`, a type `Out i`
+describing the outputs. The polynomial functor it represents maps `α` to `Σ i : In, Out i → α`. -/
+structure PFunctor : Type (u + 1) where
+  In : Type u
+  Out : In → Type u
+
+/-- The application of a polynomial functor `PF` to a type `α`: a shape `i : PF.In`
+together with a function filling each position `PF.Out i → α`.
+
+The `obj_dummy` constructor is a technical device to prevent Lean from eta-expanding
+this type. -/
+inductive PFunctor.Obj (PF : PFunctor) (α : Type u) : Type u where
+  | obj (i : PF.In) (k : PF.Out i → α)
+  -- Necessary to avoid eta expansion on this type.
+  | obj_dummy (e : Empty)
+
+/-- A **polynomial functor (PF)**: a functor `F` that is isomorphic to some
+polynomial functor `PFunctor`. Note that unlike Qpf in Mathlib and QPFTypes, this definition does *not* support quotients and instead requires an isomorphism to PFunctor. -/
+class PF (F : Type u → Type u) where
+  P : PFunctor
+  unpack {α} : F α → P.Obj α
+  pack {α} : P.Obj α → F α
+  unpack_pack {α} (x : F α) : pack (unpack x) = x
+  pack_unpack {α} (x : P.Obj α) : unpack (pack x) = x
+
+attribute [simp] PF.unpack_pack PF.pack_unpack
+
+variable (F : Type u → Type u) [PF F]
+
+/-- Map a function over `F` via the PF isomorphism. -/
+def PF.map {α β} (f : α → β) (x : F α) : F β :=
+  let .obj i k := unpack x; pack (.obj i λ x => f (k x))
+
+@[simp]
+theorem PF.map_pack {α β} (f : α → β) i k :
+    map F f (pack (.obj i k)) = pack (.obj i λ x => f (k x)) := by
+  simp [map]
+
+@[simp]
+theorem PF.unpack_map {α β} (f : α → β) x :
+    unpack (map F f x) = let .obj i k := unpack x; .obj i λ x => f (k x) := by
+  simp [map]
+  split
+  simp
+
+@[simp]
+theorem PF.map_map {α β γ} (f : α → β) (g : β → γ) x :
+    map F g (map F f x) = map F (λ x => g (f x)) x := by
+  simp [map]
+  rcases h : unpack x with ⟨i, k⟩ | ⟨⟨⟩⟩
+  simp
+
+/-!
+## Approximation sequences
+
+We define `CoIndN F n`, the type of depth-`n` approximations of the coinductive type.
+- At depth 0, every element is trivial (`PUnit`).
+- At depth `n+1`, an approximation is an `F` whose children are depth-`n`
+  approximations.
+-/
+
+/-- The `n`-step approximation of the coinductive fixpoint of `F`. -/
+def CoIndN : Nat → Type u
+  | 0 => PUnit
+  | n + 1 => F (CoIndN n)
+
+/-- Two `PFunctor.Obj` values are **coherent** (with respect to a relation `K` on their
+children) if they have the same shape and their children are pairwise related by `K`. -/
+inductive coherent1 {PF : PFunctor} {α1 α2 : Type u} (K : α1 → α2 → Prop) :
+    PF.Obj α1 → PF.Obj α2 → Prop where
+  | single i i1 i2 k1 k2 :
+    i1 = .obj i k1 →
+    i2 = .obj i k2 →
+    (∀ x, K (k1 x) (k2 x)) →
+    coherent1 K i1 i2
+
+/-- `coherent1` is monotone in its relation argument. -/
+theorem coherent1_mono {PF : PFunctor} {α1 α2 : Type u} (K1 K2 : α1 → α2 → Prop)
+    (i1 : PF.Obj α1) i2 :
+    coherent1 K1 i1 i2 →
+    (∀ x y, K1 x y → K2 x y) →
+    coherent1 K2 i1 i2 := by
+  rintro ⟨_, _, _, _⟩ himp
+  constructor <;> try assumption
+  grind
+
+/-- Two approximations `c1 : CoIndN F n` and `c2 : CoIndN F m` are **coherent** if they
+agree on shape wherever both are non-trivial. -/
+def coherent {n m} (c1 : CoIndN F n) (c2 : CoIndN F m) : Prop :=
+  match n, m with
+  | 0, _ => True
+  | _, 0 => True
+  | _+1, _+1 => coherent1 coherent (PF.unpack c1) (PF.unpack c2)
+
+/-!
+## The coinductive type
+
+`CoInd F` is the terminal coalgebra of `F`, represented as a coherent sequence of
+approximations.
+-/
+
+/-- The coinductive fixpoint of `F`: a sequence of approximations `approx n : CoIndN F n`
+that are mutually coherent at every pair of depths. -/
+structure CoInd : Type u where
+  approx : ∀ n, CoIndN F n
+  is_coherent : ∀ n m, coherent F (approx n) (approx m)
+
+@[ext]
+theorem CoInd.ext (c1 c2 : CoInd F) :
+    (∀ n, c1.approx n = c2.approx n) → c1 = c2 := by
+  intros hn; cases c1; cases c2; congr; ext; apply hn
+
+/-- **fold**ing: turn `F (CoInd F)` into `CoInd F`. This is one direction of the coalgebra
+isomorphism `F (CoInd F) ≅ CoInd F`. -/
+def CoInd.fold (x : F (CoInd F)) : CoInd F where
+  approx
+    | 0 => ⟨⟩
+    | n + 1 => PF.map F (λ c => c.approx n) x
+  is_coherent := by
+    rintro ⟨⟩ ⟨⟩ <;> simp [coherent]
+    split
+    constructor <;> try rfl
+    simp [is_coherent]
+
+theorem CoInd.fold_approx (x : F (CoInd F)) n :
+    (CoInd.fold F x).approx (n + 1) = PF.map F (λ c => c.approx n) x :=
+  by simp [fold]
+
+theorem coherent_eq_i (x : CoInd F) n m {i1 k1 i2 k2} :
+    PF.unpack (x.approx (n + 1)) = .obj i1 k1 →
+    PF.unpack (x.approx (m + 1)) = .obj i2 k2 →
+    i1 = i2 := by
+  have h := x.is_coherent (n+1) (m+1)
+  simp [coherent] at h
+  cases h
+  grind
+
+theorem coherent_eq_k (x : CoInd F) n m {i k1 k2 o} :
+    PF.unpack (x.approx (n + 1)) = .obj i k1 →
+    PF.unpack (x.approx (m + 1)) = .obj i k2 →
+    coherent F (k1 o) (k2 o) := by
+  intro h1 h2
+  have h := x.is_coherent (n+1) (m+1)
+  simp [coherent] at h
+  cases h
+  simp_all
+  rcases h1 with ⟨_, _⟩
+  subst_eqs
+  simp [*]
+
+/-- **unfold**ing: extract an `F (CoInd F)` from a `CoInd F` by reading off the
+depth-1 approximation for the shape, and reconstructing each child's full approximation
+sequence from the deeper approximations. This is the other direction of the coalgebra
+isomorphism. -/
+def CoInd.unfold (x : CoInd F) : F (CoInd F) :=
+  match h1 : PF.unpack (x.approx 1) with
+  | .obj i1 k1 =>
+  PF.pack $ .obj i1 λ o => {
+    approx n :=
+      match h2 : PF.unpack (x.approx (n + 1)) with
+      | .obj _ k2 => k2 (cast (congrArg _ (coherent_eq_i F x _ _ h1 h2)) o)
+    is_coherent := by
+      intro n m; split; split
+      have := coherent_eq_i F x 0 n (by assumption) (by assumption)
+      subst_eqs
+      have := coherent_eq_i F x n m (by assumption) (by assumption)
+      subst_eqs
+      simp only [cast_eq]
+      apply coherent_eq_k <;> assumption
+  }
+
+/-- `unfold` is a left inverse of `fold`. -/
+@[simp]
+theorem unfold_fold x :
+    CoInd.fold F (CoInd.unfold F x) = x := by
+  ext n
+  cases n with
+  | zero => rfl
+  | succ n =>
+  simp [CoInd.fold, CoInd.unfold]
+  split
+  simp
+  split
+  have := coherent_eq_i F x 0 n (by assumption) (by assumption)
+  subst_eqs
+  simp
+  rename_i h
+  rw [<-h]
+  simp
+
+/-- `fold` is a left inverse of `unfold`. Together with `unfold_fold`, this shows
+`fold` and `unfold` are inverse isomorphisms, i.e. `CoInd F ≅ F (CoInd F)`. -/
+@[simp]
+theorem fold_unfold x :
+    CoInd.unfold F (CoInd.fold F x) = x := by
+  simp [CoInd.unfold, CoInd.fold]
+  split
+  next h =>
+  simp at h
+  split at h
+  next heq =>
+  simp at h
+  rcases h with ⟨_, _⟩
+  subst_eqs
+  rw (occs := .pos [27]) [<-(PF.unpack_pack x)]
+  rw [heq]
+  congr
+  funext x
+  ext n
+  simp
+  split
+  next heq2 =>
+  simp [heq] at heq2
+  rcases heq2 with ⟨_, _⟩
+  subst_eqs
+  simp
+
+/-!
+## Cofixpoint
+
+The **cofixpoint** of a coalgebra `f : α → F α` produces a `CoInd F` element by
+iterating `f` at each approximation depth.
+-/
+
+/-- The depth-`n` approximation of `cofix f a`, obtained by applying `f` iteratively. -/
+def cofix_approx {α} (f : α → F α) (a : α) : ∀ n, CoIndN F n
+  | 0 => ⟨⟩
+  | n+1 => PF.map F (λ a => cofix_approx f a n) (f a)
+
+/-- The cofixpoint of a coalgebra `f : α → F α`. -/
+def cofix {α} (f : α → F α) (a : α) : CoInd F where
+  approx := cofix_approx F f a
+  is_coherent := by
+    intro n m
+    induction n generalizing m a with
+    | zero => simp only [coherent]
+    | succ n ih =>
+      cases m with
+      | zero => simp only [coherent]
+      | succ m =>
+        simp only [cofix_approx, coherent]
+        rw [PF.unpack_map]; split
+        rw [PF.unpack_map]; split
+        simp [*] at *
+        rename_i h1 h2
+        rcases h1 with ⟨_, _⟩; rcases h2 with ⟨_, _⟩
+        subst_eqs
+        constructor <;> try rfl
+        grind
+
+theorem cofix_eq {α} (f : α → F α) a :
+    cofix F f a = CoInd.fold F (PF.map F (cofix F f) (f a)) := by
+  ext n
+  cases n
+  · rfl
+  simp [cofix, CoInd.fold, cofix_approx]
+
+section partial_order
+open Lean.Order
+open Classical
+
+/-!
+## Partial order on `CoInd F`
+
+We equip `CoInd F` with a partial order where the bottom element `⊥` is  given by iterating `Inhabited (F PUnit)`
+and `c1 ≤ c2` is defined coinductively: either `c1 = ⊥`, or `c1` and `c2` have the
+same shape and all corresponding children satisfy `c1_child ≤ c2_child`.
+-/
+
+/-- The bottom element of `CoInd F`, given by taking the cofixpoint of `Inhabited (F PUnit)`. -/
+def CoInd.bot [Inhabited (F PUnit)] : CoInd F :=
+  cofix F (λ _ : PUnit => default) ⟨⟩
+
+theorem CoInd.bot_eq [Inhabited (F PUnit)] :
+    bot F = CoInd.fold F (PF.map F (λ _ : PUnit => bot F) default) :=
+  by unfold bot; rw (occs := [1]) [cofix_eq]
+
+/-- The coinductive partial order on `CoInd F`: `c1 ≤ c2` holds if `c1 = ⊥`, or `c1`
+and `c2` have matching shapes and all children are recursively related. -/
+def CoInd.le [Inhabited (F PUnit)] (c1 : CoInd F) (c2 : CoInd F) : Prop :=
+  c1 = bot F ∨ coherent1 CoInd.le (PF.unpack c1.unfold) (PF.unpack c2.unfold)
+coinductive_fixpoint monotonicity fun f f' himp => by
+  rintro _ _ (⟨⟨⟩⟩|x)
+  · simp
+  · right; apply coherent1_mono <;> assumption
+
+/-- If `c` is coherent with `⊥` in the tree order, then `c = ⊥`. Used to prove
+antisymmetry and transitivity of the partial order. -/
+theorem CoInd.le.coherent_bot_eq [Inhabited (F PUnit)] c :
+    coherent1 (le F) (PF.unpack (unfold F c))
+      (PF.unpack (unfold F (bot F))) →
+    c = bot F := by
+  intro h
+  ext n
+  induction n generalizing c h; rfl
+  rw [CoInd.bot_eq]
+  rw [<-unfold_fold _ c, CoInd.fold_approx]
+  simp [CoInd.fold_approx]
+  rw [CoInd.bot_eq] at h
+  simp at h
+  split at h
+  rcases h
+  simp_all
+  rename (_ ∧ _) => h
+  cases h
+  subst_eqs
+  grind [le, PF.map]
+
+instance [Inhabited (F PUnit)] : PartialOrder (CoInd F) where
+  rel := CoInd.le F
+  rel_refl := by
+    intro c
+    apply CoInd.le.coinduct _ (Eq)
+    case x => grind
+    intro x1 x2 h
+    subst_eqs
+    right
+    rcases (PF.unpack (CoInd.unfold F x1)) with ⟨_, _⟩ <;> try trivial
+    constructor <;> try trivial
+    simp
+  rel_trans := by
+    intro c1 c2 c3 _ _
+    apply CoInd.le.coinduct _ (λ c1 c3 => ∃ c2, CoInd.le F c1 c2 ∧ CoInd.le F c2 c3)
+    case x => grind
+    rintro c1 c3 ⟨c2, h1, h2⟩
+    unfold CoInd.le at h1 h2
+    cases h1 with
+    | inl h1 => left; subst_eqs; trivial
+    | inr h1 =>
+    cases h2 with
+    | inl h2 =>
+      grind [CoInd.le.coherent_bot_eq]
+    | inr h2 =>
+    right
+    rcases h1 with ⟨_, _, _, _, _, _, h3⟩
+    rcases h2 with ⟨⟩
+    simp_all
+    cases h3
+    subst_eqs
+    constructor <;> try rfl
+    grind
+  rel_antisymm := by
+    intro c1 c2 h1 h2
+    ext n
+    induction n generalizing c1 c2 h1 h2; rfl
+    unfold CoInd.le at h1 h2
+    cases h1 with
+    | inl h1 => grind [CoInd.le.coherent_bot_eq]
+    | inr h1 =>
+    cases h2 with
+    | inl h2 => grind [CoInd.le.coherent_bot_eq]
+    | inr h2 =>
+    cases h1
+    cases h2
+    simp_all
+    rename (_ ∧ _) => eq
+    cases eq
+    subst_eqs
+    rw [<-unfold_fold _ c1]
+    rw [<-unfold_fold _ c2]
+    unfold CoInd.fold
+    simp [PF.map, *]
+    grind
+
+/-!
+## CCPO
+
+We define the supremum of a chain `c : CoInd F → Prop` and show it satisfies the
+required `is_sup` property, making `CoInd F` a chain-complete partial order (CCPO).
+-/
+
+/-- The supremum of a chain `c`. If the chain has a non-bottom element, the sup is
+built by taking any non-bottom element's shape and recursively taking sups of children
+across all chain elements with that shape. Otherwise the sup is `⊥`. -/
+noncomputable def CoInd.csup [Inhabited (F PUnit)] (c : CoInd F → Prop) : CoInd F :=
+  cofix F (λ c =>
+    if h : ∃ t, c t ∧ t ≠ CoInd.bot F then
+      let .obj i _ := PF.unpack (choose h).unfold;
+      PF.pack $ .obj i λ o c' =>
+        ∃ c0, c c0 ∧ c0 ≠ CoInd.bot F ∧
+          let .obj i' k := PF.unpack c0.unfold
+          ∃ eq : i = i', c' = k (cast (congrArg _ eq) o)
+    else
+      PF.map F (λ _ : PUnit => c) default
+  ) c
+
+theorem CoInd.csup_eq [Inhabited (F PUnit)] (c : CoInd F → Prop) :
+    csup F c = if h : ∃ t, c t ∧ t ≠ CoInd.bot F then
+        let .obj i _ := PF.unpack (choose h).unfold
+        CoInd.fold F $ PF.pack $ .obj i λ o => csup F λ c' =>
+          ∃ c0, c c0 ∧ c0 ≠ CoInd.bot F ∧
+           let .obj i' k := PF.unpack c0.unfold
+           ∃ eq : i = i', c' = k (cast (congrArg _ eq) o)
+      else
+        CoInd.fold F $ PF.map F (λ _ : PUnit => csup F c) default := by
+  unfold csup
+  rw (occs := [1]) [cofix_eq]
+  repeat split <;> simp
+
+/-- If the chain has no non-bottom elements, its supremum is `⊥`. -/
+theorem CoInd.csup_eq_bot {c} [Inhabited (F PUnit)] :
+    (¬∃ t, c t ∧ t ≠ bot F) →
+    CoInd.csup F c = bot F := by
+  intro h
+  ext n
+  induction n; rfl
+  next n ih =>
+  rw [CoInd.bot_eq, CoInd.csup_eq]
+  simp [*, fold_approx]
+
+theorem CoInd.le_unfold [Inhabited (F PUnit)] c1 c2 :
+    (c1 ⊑ c2) = (c1 = bot F ∨ coherent1 (PartialOrder.rel) (PF.unpack c1.unfold) (PF.unpack c2.unfold)) := by
+  simp [PartialOrder.rel, CoInd.le]
+
+/-- For a chain, any two non-bottom elements have the same shape at the top-level, and their
+children are comparable. -/
+theorem CoInd.le_chain_step [Inhabited (F PUnit)] c c1 c2 i1 k1 i2 k2 :
+    c c1 →
+    c c2 →
+    chain c →
+    c1 ≠ bot F →
+    c2 ≠ bot F →
+    PF.unpack (unfold F c1) = .obj i1 k1 →
+    PF.unpack (unfold F c2) = .obj i2 k2 →
+    ∃ eq : i1 = i2, (∀ o, k1 o ⊑ k2 (cast (congrArg _ eq) o) ∨ k2 (cast (congrArg _ eq) o) ⊑ k1 o) := by
+  intros _ _ hc _ _ _ _
+  obtain h | h := hc c1 c2 (by assumption) (by assumption)
+  · simp [CoInd.le_unfold, *] at h
+    cases h
+    simp_all
+    rename (_ ∧ _) => h
+    cases h
+    subst_eqs
+    rename (_ ∧ _) => h
+    cases h
+    subst_eqs
+    grind
+  · simp [CoInd.le_unfold, *] at h
+    cases h
+    simp_all
+    rename (_ ∧ _) => h
+    cases h
+    subst_eqs
+    rename (_ ∧ _) => h
+    cases h
+    subst_eqs
+    grind
+
+/-- If a chain contains a non-bottom element `t` with unpacked shape `i`, the supremum
+unfolds to an `F`-structure with that same shape, whose children are sups of the
+corresponding sub-chains. -/
+theorem CoInd.csup_step {c} [Inhabited (F PUnit)] t i k :
+    c t →
+    chain c →
+    t ≠ bot F →
+    PF.unpack t.unfold = .obj i k →
+    CoInd.csup F c = CoInd.fold F (PF.pack $ .obj i
+      λ o => CoInd.csup F λ c' => ∃ c0, c c0 ∧ c0 ≠ CoInd.bot F ∧
+          let .obj i' k := PF.unpack c0.unfold
+          ∃ eq : i = i', c' = k (cast (congrArg _ eq) o)) := by
+  intro ht hc _ _
+  rw [CoInd.csup_eq]
+  split; rotate_left 1; grind
+  next h =>
+  split
+  next i' _ _ =>
+  obtain _ : i = i' := by grind [CoInd.le_chain_step]
+  subst_eqs
+  congr
+
+/-- `CoInd.csup` is indeed the supremum of any chain: it is an upper bound and the least
+such upper bound. -/
+theorem CoInd.csup_spec [Inhabited (F PUnit)] {c : CoInd F → Prop}
+    (hc : chain c) :
+    is_sup c (CoInd.csup F c) := by
+  intro x
+  constructor
+  · -- csup is an upper bound: every element of the chain is ≤ csup
+    intro hsup t ht
+    apply PartialOrder.rel_trans; rotate_left 1; assumption
+    apply le.coinduct _ (λ c1 c2 => ∃ c, c c1 ∧ chain c ∧ c2 = csup F c); rotate_left 1; grind
+    rintro c1 c2 ⟨c, hc1, hc, heq⟩
+    subst_eqs
+    by_cases (c1 = bot F)
+    · grind
+    right
+    rcases h : (PF.unpack (unfold F c1)); rotate_left 1; trivial
+    rw [CoInd.csup_step F c1] <;> try trivial
+    simp
+    constructor <;> try trivial
+    intro
+    apply (Exists.intro _)
+    and_intros; rotate_left 2; rfl
+    · grind
+    rintro x y ⟨c1, _, _, hm1⟩ ⟨c2, _, _, hm2⟩
+    grind [CoInd.le_chain_step]
+  · -- csup is the least upper bound: any upper bound x satisfies csup ≤ x
+    intro _
+    apply le.coinduct _ (λ c1 c2 => ∃ c, chain c ∧ c1 = csup F c ∧ (∀ (y : CoInd F), c y → y ⊑ c2)); rotate_left 1; grind
+    rintro c1 c2 ⟨c, hc, heq, hc2⟩
+    subst_eqs
+    by_cases h : ∃ t, c t ∧ t ≠ CoInd.bot F
+    · right
+      rcases h with ⟨t, _, _⟩
+      cases h : (PF.unpack (unfold F t)) <;> try trivial
+      rw [CoInd.csup_step F t] <;> try trivial
+      cases h2 : (PF.unpack (unfold F c2)) <;> try trivial
+      simp
+      have heq := hc2 t (by assumption)
+      rw [CoInd.le_unfold] at heq
+      simp [*] at heq
+      rcases heq
+      simp_all
+      rename (_ ∧ _) => h
+      cases h
+      subst_eqs
+      rename (_ ∧ _) => h
+      cases h
+      subst_eqs
+      constructor <;> try trivial
+      intro _
+      apply (Exists.intro _)
+      and_intros; rotate_left 1; rfl
+      · rintro _ ⟨c', _, _, hm⟩
+        split at hm
+        rcases hm
+        subst_eqs
+        simp
+        have heq := hc2 c' (by assumption)
+        rw [CoInd.le_unfold] at heq
+        simp [*] at heq
+        rcases heq
+        simp_all
+        rename (_ ∧ _) => h
+        cases h
+        subst_eqs
+        grind
+      rintro x y ⟨c1, _, _, hm1⟩ ⟨c2, _, _, hm2⟩
+      grind [CoInd.le_chain_step]
+    · grind [CoInd.csup_eq_bot]
+
+/-- `CoInd F` is a chain-complete partial order (CCPO): every chain has a supremum. -/
+noncomputable instance (priority := default + 100) [Inhabited (F PUnit)] : CCPO (CoInd F) where
+  has_csup {c} ch := .intro (CoInd.csup F c) (CoInd.csup_spec F ch)
+
+section CoIndN_le
+
+/-!
+## Relating approximation-wise order to the coinductive order
+
+We show that `c1 ≤ c2` in `CoInd F` if and only if all their approximations are related
+pointwise by the induced order `CoIndN.le` on `CoIndN F n`.
+-/
+
+theorem coherent_unfold_eq_i (x : CoInd F) n {i1 k1 i2 k2} :
+    PF.unpack (x.approx (n + 1)) = .obj i1 k1 →
+    PF.unpack (x.unfold) = .obj i2 k2 →
+    i1 = i2 := by
+  simp [CoInd.unfold]
+  split
+  simp
+  grind [coherent_eq_i]
+
+theorem coherent_unfold_eq_k (x : CoInd F) n {i k1 k2} o :
+    PF.unpack (x.approx (n + 1)) = .obj i k1 →
+    PF.unpack (x.unfold) = .obj i k2 →
+    k1 o = (k2 o).approx n := by
+  simp [CoInd.unfold]
+  split
+  simp
+  rintro _ rfl rfl
+  simp
+  split
+  simp_all
+  rename (_ ∧ _) => h
+  cases h
+  subst_eqs
+  simp
+
+/-- The depth-`n` approximation of the bottom element of `CoInd F`. -/
+def CoIndN.bot [Inhabited (F PUnit)] (n : Nat) : CoIndN F n :=
+  (CoInd.bot F).approx n
+
+theorem CoIndN.bot.eq_plus_1 [Inhabited (F PUnit)] n :
+    CoIndN.bot F (n + 1) = PF.map F (λ _ : PUnit => CoIndN.bot F n) default := by
+  unfold CoIndN.bot
+  rw (occs:=[1]) [CoInd.bot_eq]
+  simp [CoInd.fold]
+
+/-- The pointwise partial order on `CoIndN F n`: `c1 ≤ c2` at depth 0 is always true;
+at depth `n+1`, either `c1` is bot or both have the same shape
+with children recursively related. -/
+def CoIndN.le {n} [Inhabited (F PUnit)] (c1 : CoIndN F n) (c2 : CoIndN F n) : Prop :=
+  match n with
+  | 0 => True
+  | n+1 => c1 = bot F (n+1) ∨ coherent1 CoIndN.le (PF.unpack c1) (PF.unpack c2)
+coinductive_fixpoint monotonicity fun f f' himp => by
+  rintro ⟨_|_⟩ _ _ h <;> simp at *
+  cases h
+  · grind
+  next h =>
+  right; cases h; constructor <;> try assumption
+  intro _; apply himp; grind
+
+/-- Pointwise ordering of approximations implies the coinductive order. -/
+theorem CoInd.le_leN [Inhabited (F PUnit)] (c1 c2 : CoInd F) :
+    (∀ n, CoIndN.le F (c1.approx n) (c2.approx n)) →
+    c1 ⊑ c2 := by
+  intro hn; apply CoInd.le.coinduct _ (λ c1 c2 => (∀ n, CoIndN.le F (c1.approx n) (c2.approx n)))
+  rotate_right 1; grind
+  intro c1 c2 ih
+  by_cases hbot : (c1 = CoInd.bot F); grind
+  right
+  by_cases hex : (∃ n, c1.approx n ≠ CoIndN.bot F n)
+  · rcases hex with ⟨n, hn⟩
+    cases n; contradiction
+    next n =>
+    have h := ih (n+1)
+    simp [CoIndN.le] at h
+    cases h; grind
+    next h =>
+    cases h
+    cases h1 : (PF.unpack (CoInd.unfold F c1))
+    cases h2 : (PF.unpack (CoInd.unfold F c2))
+    have := coherent_unfold_eq_i F c1 n (by assumption) (by assumption)
+    have := coherent_unfold_eq_i F c2 n (by assumption) (by assumption)
+    subst_eqs
+    constructor <;> try rfl
+    rotate_left 1
+    · rename Empty => h; cases h
+    · rename Empty => h; cases h
+    intro o m
+    have h := ih (m + 1)
+    simp [CoIndN.le] at h
+    cases h
+    · cases _ : (PF.unpack $ c1.approx (m + 1))
+      rotate_left 1
+      · rename Empty => h; cases h
+      have := coherent_unfold_eq_i F c1 m (by assumption) (by assumption)
+      subst_eqs
+      have hk := coherent_unfold_eq_k F c1 m o (by assumption) (by assumption)
+      rw [<-hk]
+      clear hk
+      simp_all [CoIndN.bot.eq_plus_1]
+      split at *
+      simp_all
+      rename (_ ∧ _) => h
+      cases h
+      subst_eqs
+      cases m <;> simp [CoIndN.le]
+    next h =>
+    cases h
+    have := coherent_eq_i F c1 n m (by assumption) (by assumption)
+    subst_eqs
+    have := coherent_unfold_eq_k F c1 m o (by assumption) (by assumption)
+    have := coherent_unfold_eq_k F c2 m o (by assumption) (by assumption)
+    grind
+  · false_or_by_contra
+    apply hbot
+    ext n
+    false_or_by_contra
+    next h =>
+    apply hex
+    exists n
+
+/-- The coinductive order implies the pointwise ordering of all approximations. -/
+theorem CoInd.leN_le [Inhabited (F PUnit)] (c1 c2 : CoInd F) n :
+    c1 ⊑ c2 →
+    CoIndN.le F (c1.approx n) (c2.approx n) := by
+  induction n generalizing c1 c2 <;> simp [CoIndN.le]
+  next n ih =>
+  intro hc
+  rw [CoInd.le_unfold] at hc
+  cases hc
+  · simp_all [CoIndN.bot]
+  next h =>
+  cases h
+  right
+  cases _ : (PF.unpack $ c1.approx (n + 1))
+  rotate_left 1
+  · rename Empty => h; cases h
+  cases _ : (PF.unpack $ c2.approx (n + 1))
+  rotate_left 1
+  · rename Empty => h; cases h
+  have := coherent_unfold_eq_i F c1 n (by assumption) (by assumption)
+  have := coherent_unfold_eq_i F c2 n (by assumption) (by assumption)
+  subst_eqs
+  constructor <;> try rfl
+  intro o
+  have := coherent_unfold_eq_k F c1 n o (by assumption) (by assumption)
+  have := coherent_unfold_eq_k F c2 n o (by assumption) (by assumption)
+  grind
+
+end CoIndN_le
+end partial_order
diff --git a/backends/lean/Aeneas/Data/Coinductive/Effect.lean b/backends/lean/Aeneas/Data/Coinductive/Effect.lean
new file mode 100644
index 000000000..3bc28b964
--- /dev/null
+++ b/backends/lean/Aeneas/Data/Coinductive/Effect.lean
@@ -0,0 +1,42 @@
+namespace Aeneas.Data.Coinductive
+
+structure Effect : Type (u + 1) where
+  I : Type u
+  O : I → Type u
+
+def SumE (E₁ : Effect.{u}) (E₂ : Effect.{u}) : Effect.{u} where
+  I := E₁.I ⊕ E₂.I
+  O
+  | .inl i => E₁.O i
+  | .inr i => E₂.O i
+
+infixr:30 " ⊕ₑ " => SumE
+
+-- we cannot make `SumE` reducible since we want to key on it in TC search,
+-- but we also need to make sure that SumE.O reduces at reducible transparency
+-- thus we add the following unification hints
+unif_hint (E₁ E₂ : Effect.{u}) (T : Type u) (e : E₁.I)  where
+  E₁.O e ≟ T |- (E₁ ⊕ₑ E₂).O (Sum.inl e) ≟ T
+unif_hint (E₁ E₂ : Effect.{u}) (T : Type u) (e : E₂.I)  where
+  E₂.O e ≟ T |- (E₁ ⊕ₑ E₂).O (Sum.inr e) ≟ T
+
+class Subeffect (E₁ : Effect.{u}) (E₂ : Effect.{v}) where
+  map : (i₁ : E₁.I) → ((i₂ : E₂.I) × (E₂.O i₂ → E₁.O i₁))
+
+infix:20 " -< " => Subeffect
+
+instance {E : Effect} : E -< E where
+  map i := ⟨i, λ x => x⟩
+
+instance {E₁ : Effect} {E₂ : Effect} {E' : Effect} [subl : E₁ -< E'] [subr : E₂ -< E'] : (E₁ ⊕ₑ E₂) -< E' where
+  map
+  | .inl x => subl.map x
+  | .inr x => subr.map x
+
+instance (priority:=mid) {E₁ : Effect} {E₂ : Effect} {E' : Effect} [sub : E₁ -< E₂] : E₁ -< (E₂ ⊕ₑ E') where
+  map t := let ⟨i, f⟩ := (sub.map t); ⟨.inl i, f⟩
+
+instance (priority:=low) {E₁ : Effect} {E₂ : Effect} {E' : Effect} [sub : E₁ -< E₂] : E₁ -< E' ⊕ₑ E₂ where
+  map t := let ⟨i, f⟩ := (sub.map t); ⟨.inr i, f⟩
+
+end Aeneas.Data.Coinductive
diff --git a/backends/lean/Aeneas/Data/Coinductive/ITree.lean b/backends/lean/Aeneas/Data/Coinductive/ITree.lean
new file mode 100644
index 000000000..418f5677f
--- /dev/null
+++ b/backends/lean/Aeneas/Data/Coinductive/ITree.lean
@@ -0,0 +1,327 @@
+-- TODO: can we make this a non-public import and hide all CoInd things from clients of this?
+import Aeneas.Data.Coinductive.CoInd
+import Aeneas.Data.Coinductive.Effect
+
+namespace Aeneas.Data.Coinductive
+
+open Lean.Order
+
+-- compared to the original version at https://github.com/ISTA-PLV/coinductive/tree/main
+-- which uses the traditional tau constructor, this version instead has a bottom element
+-- div. tau is not needed to guard recursion, since we are using partial_fixpoint
+-- instead of coinduction.
+inductive ITreeF (E : Effect.{u}) (R : Type v) (ITree : Type w) : Type (max u v w) where
+  | ret (r : R)
+  | div -- equivalent to infinite tau stream from traditional ITrees
+  | vis (i : E.I) (k : E.O i → ITree)
+
+inductive ITreeF.In (E : Effect.{u}) (R : Type u) : Type u where
+  | ret (r : R)
+  | div
+  | vis (i : E.I)
+
+instance (E : Effect.{u}) (R : Type u) : PF (ITreeF E R) where
+  P := ⟨ITreeF.In E R, fun
+    | .ret _ => PEmpty
+    | .div => PEmpty
+    | .vis i => E.O i⟩
+  unpack
+    | .ret r => .obj (.ret r) nofun
+    | .div => .obj .div nofun
+    | .vis i k => .obj (.vis i) k
+  pack
+    | .obj (.ret r) _ => .ret r
+    | .obj .div k => .div
+    | .obj (.vis i) k => .vis i k
+  unpack_pack := by rintro _ ⟨⟩ <;> simp
+  pack_unpack := by rintro _ (⟨⟨⟩, _⟩ | ⟨⟨⟩⟩) <;> simp <;> funext x <;> cases x
+
+abbrev ITree (E : Effect.{u}) (R : Type u) : Type u := CoInd (ITreeF E R)
+abbrev ITreeN (E : Effect.{u}) (R : Type u) (n : Nat) : Type u := CoIndN (ITreeF E R) n
+
+variable {E : Effect.{u}} {R : Type u}
+
+def ITree.fold (t : ITreeF E R (ITree E R)) : ITree E R := CoInd.fold _ t
+def ITree.ret (r : R) : ITree E R := ITree.fold (.ret r)
+def ITree.div : ITree E R := ITree.fold .div
+def ITree.vis (i : E.I) (k : E.O i → ITree E R) : ITree E R := ITree.fold (.vis i k)
+def ITree.unfold (t : ITree E R) : ITreeF E R (ITree E R) := CoInd.unfold _ t
+
+/- Ideally everything above this would be automatically generated -/
+
+instance : Inhabited (ITreeF E R PUnit) where default := .div
+
+@[simp]
+theorem ITree.unfold_fold (t : ITree E R) :
+  ITree.fold (ITree.unfold t) = t := by simp [ITree.fold, ITree.unfold]
+
+@[simp]
+theorem ret_approx_1 (r : R) n :
+  (ITree.ret (E:=E) r).approx (n + 1) = ITreeF.ret r := by
+    simp [ITree.ret, ITree.fold, CoInd.fold, PF.map, PF.pack]
+
+@[simp]
+theorem fold_ret_approx_1 (r : R) n :
+  (ITree.fold (ITreeF.ret (E:=E) r)).approx (n + 1) = ITreeF.ret r :=
+    ret_approx_1 r n
+
+
+-- TODO: why doesnt this work
+@[simp]
+theorem div_approx_1 n :
+  (ITree.div (E:=E) (R:=R)).approx  (n + 1) = ITreeF.div := by
+    simp [ITree.div, ITree.fold, CoInd.fold, PF.map, PF.pack]
+
+@[simp]
+theorem fold_div_approx_1 n :
+  (ITree.fold (ITreeF.div)).approx (F := ITreeF E R) (n + 1) = ITreeF.div :=
+    div_approx_1 n
+
+@[simp]
+theorem vis_approx_1 i (t : E.O i → ITree E R) n :
+  (ITree.vis i t).approx (n + 1) = ITreeF.vis i (λ o => (t o).approx n) := by
+    simp [ITree.vis, ITree.fold, CoInd.fold, PF.map, PF.pack]
+    rfl
+
+@[simp]
+theorem fold_vis_approx_1 i (t : E.O i → ITree E R) n :
+  (ITree.fold (ITreeF.vis i t)).approx (n + 1) = ITreeF.vis i (λ o => (t o).approx n) := vis_approx_1 i t n
+
+@[simp]
+theorem unfold_ret (r : R) :
+  ITree.unfold (ITree.ret r) = ITreeF.ret (E:=E) r := by
+    simp [ITree.ret, ITree.fold, ITree.unfold]
+
+@[simp]
+theorem unfold_tau :
+  ITree.unfold (E:=E) (R:=R) (ITree.div) = ITreeF.div := by
+    simp [ITree.div, ITree.fold, ITree.unfold]
+
+@[simp]
+theorem unfold_vis i (t : E.O i → ITree E R) :
+  ITree.unfold (ITree.vis i t) = ITreeF.vis i t := by
+    simp [ITree.vis, ITree.fold, ITree.unfold]
+
+theorem vis_monoN i (t1 t2 : E.O i → ITree E R) n :
+  (∀ o, CoIndN.le _ ((t1 o).approx n) ((t2 o).approx n)) →
+  CoIndN.le _ ((ITree.vis i t1).approx (n + 1)) ((ITree.vis i t2).approx (n + 1))
+ := by
+    intro hs
+    simp [CoIndN.le, PF.unpack]
+    right
+    constructor <;> try rfl
+    grind [coherent1]
+
+@[partial_fixpoint_monotone]
+theorem vis_mono α [PartialOrder α] i (f : α → E.O i → ITree E R) :
+  monotone f →
+  monotone (λ x => ITree.vis i (f x)) := by
+    intro hf t1 t2 hle
+    apply CoInd.le_leN
+    rintro ⟨n⟩; simp [CoIndN.le]
+    apply vis_monoN
+    intro o
+    have := hf t1 t2 hle o
+    grind [CoInd.leN_le]
+
+def ITree.spin : ITree E R := ITree.div
+
+@[simp]
+theorem ITree.bot_eq :
+  CoInd.bot (ITreeF E R) = ITree.spin := by
+    ext n
+    induction n; congr 0
+    rw [CoInd.bot_eq, spin]
+    simp [PF.map, PF.pack, CoInd.fold, *]
+    --
+
+theorem ITree.le_unfold (t1 t2 : ITree E R) :
+  (t1 ⊑ t2) = (t1 = .spin ∨
+    (∃ r, t1 = .ret r ∧ t2 = .ret r) ∨
+    (∃ i t1' t2', t1 = .vis i t1' ∧ t2 = .vis i t2' ∧ ∀ o, t1' o ⊑ t2' o)) := by
+    ext
+    constructor
+    · intro h
+      rw [CoInd.le_unfold] at h
+      rcases h with (rfl|⟨i, _, _, _, _, h1, h2⟩); simp
+      rw [<-Coinductive.unfold_fold _ t1, <-Coinductive.unfold_fold _ t2]
+      rw [<-PF.unpack_pack (CoInd.unfold _ t1), <-PF.unpack_pack (CoInd.unfold _ t2)]
+      simp only [h1, h2]
+      cases i <;> simp [PF.pack, ret, spin, div, vis, fold]
+      · grind
+      · grind
+    · rintro (rfl| ⟨_, rfl, rfl⟩ | ⟨_, _, _, rfl, rfl, _⟩)
+      · simp [CoInd.le_unfold]
+      · apply PartialOrder.rel_refl
+      · simp [CoInd.le_unfold]
+        right
+        simp [PF.unpack, ITree.vis, ITree.fold]
+        constructor <;> try rfl
+        grind
+
+-- use Bind.bind instead
+def ITree.bind {S} (t1 : ITree E R) (t2 : R → ITree E S) :=
+  match t1.unfold with
+  | .ret r => t2 r
+  | .div => .div
+  | .vis i k => .vis i (λ o => ITree.bind (k o) t2)
+partial_fixpoint
+
+@[simp]
+theorem itree_ret_bind {S} r (t : S → ITree E R) :
+  ITree.bind (.ret r) t = t r := by
+    rw [ITree.bind]
+    simp [ITree.ret, ITree.fold, ITree.unfold]
+
+@[simp]
+theorem itree_vis_bind {S} i k (t : S → ITree E R) :
+  ITree.bind (.vis i k) t = .vis i (λ o => ITree.bind (k o) t) := by
+    rw [ITree.bind]
+    simp [ITree.vis, ITree.fold, ITree.unfold]
+
+@[simp]
+theorem itree_div_bind {S} (t : S → ITree E R) :
+  ITree.bind .div t = .div := by
+    simp [ITree.bind]
+
+
+@[partial_fixpoint_monotone]
+theorem bind_mono {α} {S} [PartialOrder α]
+  (f : α → ITree E R) (g : α → R → ITree E S) :
+  monotone f →
+  monotone g →
+  monotone (λ x => ITree.bind (f x) (g x)) := by
+    intro hf hg t1 t2 hle
+    apply CoInd.le_leN
+    intro n
+    dsimp only
+    have hlef : (f t1) ⊑ (f t2) := by apply hf; assumption
+    generalize f t1 = t1, f t2 = t2 at hlef
+    induction n generalizing t1 t2; simp [CoIndN.le]
+    unfold ITree.bind
+    rw [ITree.le_unfold] at hlef
+    rcases hlef with (rfl|⟨_, rfl, rfl⟩|⟨_, _, _, rfl, rfl, _⟩)
+    · simp [ITree.spin]
+      simp [CoIndN.le, CoIndN.bot]
+      left
+      simp [ITree.spin]
+    · rename_i x
+      simp
+      have := hg t1 t2 hle x
+      grind [CoInd.leN_le, monotone]
+    · simp
+      apply vis_monoN
+      grind [CoInd.leN_le, monotone]
+
+
+instance : Monad (ITree.{u} E) where
+  pure := ITree.ret
+  bind := ITree.bind
+
+@[elab_as_elim, cases_eliminator]
+def ITree.cases {E : Effect.{u}} {R}
+    {motive : ITree E R → Sort v}
+    (ret : ∀ r, motive (pure r))
+    (div :  motive (.div))
+    (vis : ∀ i k, motive (ITree.vis i k))
+    (t : ITree E R) : motive t := by
+    rw [<-ITree.unfold_fold t]
+    cases t.unfold
+    · apply ret
+    · apply div
+    · apply vis
+
+@[simp]
+theorem unfold_pure (r : R) :
+  ITree.unfold (pure r) = ITreeF.ret (E:=E) r := by
+    simp [pure]
+
+@[simp]
+theorem pure_approx_1 (r : R) n :
+  (pure r : ITree _ _).approx (n + 1) = ITreeF.ret (E:=E) r := by
+    simp [pure]
+
+instance : LawfulMonad (ITree E) := LawfulMonad.mk' (ITree E)
+  (id_map := by
+    simp [Functor.map]
+    intro _ t
+    ext n
+    induction n generalizing t; congr 0
+    unfold ITree.bind
+    cases t <;> simp [*])
+  (pure_bind := by simp [pure, Bind.bind])
+  (bind_assoc := by
+    simp [Bind.bind]
+    intro _ _ _ t1 t2 t3
+    ext n
+    induction n generalizing t1; congr 0
+    rw [ITree.bind.eq_def t1]
+    rw [ITree.bind.eq_def t1]
+    split <;> simp [*])
+
+instance : MonoBind (ITree E) where
+  bind_mono_left := by
+    intro _ _ _ _ _ _
+    dsimp [Bind.bind]
+    apply bind_mono (λ x => x) <;> grind [monotone, PartialOrder.rel_refl]
+  bind_mono_right := by
+    intro _ _ a _ _ _
+    dsimp [Bind.bind]
+    apply bind_mono (λ x => a) (λ x => x)
+    · grind [monotone, PartialOrder.rel_refl]
+    · grind [monotone, PartialOrder.rel_refl]
+    · intro _; grind
+
+#check itree_div_bind
+
+@[simp]
+theorem div_bind (t : S → ITree E R) :
+  .div >>= t = .div := by simp [Bind.bind]
+
+@[simp]
+theorem vis_bind i k (t : S → ITree E R) :
+  (.vis i k) >>= t = .vis i (λ o => k o >>= t) := by simp [Bind.bind]
+
+
+def Effect.trigger (E₁ : Effect.{u}) {E₂ : Effect.{u}} [E₁ -< E₂] (i : E₁.I) : ITree.{u} E₂ (E₁.O i) :=
+  let ⟨i₂, f⟩ := (Subeffect.map i);
+  ITree.vis i₂ (λ x => return (f x))
+
+def ITree.iter {α β} (t : α → ITree E (α ⊕ β)) : α → ITree E β :=
+  λ a => do
+    match ← (t a) with
+    | .inl a => .iter t a
+    | .inr b => return b
+partial_fixpoint
+
+def ITree.interp {F} (f : (i : E.I) → ITree F (E.O i)) : ITree E R → ITree F R :=
+  ITree.iter λ t =>
+    match t.unfold with
+    | .ret r => return (.inr r)
+    | .div => ITree.div
+    | .vis i k => f i >>= λ o => return (.inl (k o))
+
+@[simp]
+theorem interp_pure {F} (f : (i : E.I) → ITree F (E.O i)) (r : R) :
+  ITree.interp f (pure r) = pure r := by
+    unfold ITree.interp ITree.iter
+    simp
+
+@[simp]
+theorem interp_div {F} (f : (i : E.I) → ITree F (E.O i)) :
+  ITree.interp (R:=R) f .div = .div := by
+    unfold ITree.interp
+    rw (occs := [1]) [ITree.iter]
+    simp
+
+@[simp]
+theorem interp_vis {F} (f : (i : E.I) → ITree F (E.O i)) i (k : E.O i → ITree E R) :
+  ITree.interp f (ITree.vis i k) = (f i) >>= λ o => (ITree.interp f (k o)) := by
+    unfold ITree.interp
+    rw (occs := [1]) [ITree.iter]
+    simp
+
+-- #synth CCPO (ITree E R)
+-- #synth MonoBind (ITree E)
+
+namespace Aeneas.Data.Coinductive
diff --git a/backends/lean/Aeneas/Data/Coinductive/LICENSE b/backends/lean/Aeneas/Data/Coinductive/LICENSE
new file mode 100644
index 000000000..7128627fd
--- /dev/null
+++ b/backends/lean/Aeneas/Data/Coinductive/LICENSE
@@ -0,0 +1,9 @@
+Copyright (c) 2025 The coinductive contributors.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+
+    1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+    2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+    3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
\ No newline at end of file
diff --git a/backends/lean/Aeneas/Data/Coinductive/README b/backends/lean/Aeneas/Data/Coinductive/README
new file mode 100644
index 000000000..fad87accc
--- /dev/null
+++ b/backends/lean/Aeneas/Data/Coinductive/README
@@ -0,0 +1,2 @@
+This definition of coinductive types in lean and definition of ITrees is adapted from https://github.com/ISTA-PLV/coinductive/tree/main
+The original version was written by Michael Sammler
\ No newline at end of file

From 3f0276885ecde92992f7e008fe440ff23d74754b Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Fri, 19 Jun 2026 15:31:07 -0400
Subject: [PATCH 30/67] start working on hoare logic spec statement

---
 tests/lean/SpecTests/Hoare.lean | 3 +++
 1 file changed, 3 insertions(+)
 create mode 100644 tests/lean/SpecTests/Hoare.lean

diff --git a/tests/lean/SpecTests/Hoare.lean b/tests/lean/SpecTests/Hoare.lean
new file mode 100644
index 000000000..a8fcdf736
--- /dev/null
+++ b/tests/lean/SpecTests/Hoare.lean
@@ -0,0 +1,3 @@
+import Aeneas.Std.Primitives
+import Aeneas.Std.Delab
+import Std.Do

From 77f1f8538e6d38d1ea1249b07b0166b9855df5fb Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Fri, 19 Jun 2026 16:36:02 -0400
Subject: [PATCH 31/67] Use trait to make opaque hash function

---
 tests/lean/Tutorial/Exercises.lean | 31 +++++++++++++++---------------
 tests/lean/Tutorial/Solutions.lean | 22 ++++++++-------------
 tests/lean/Tutorial/Tutorial.lean  | 21 ++++++++++----------
 tests/src/tutorial/src/lib.rs      | 12 ++++++------
 4 files changed, 41 insertions(+), 45 deletions(-)

diff --git a/tests/lean/Tutorial/Exercises.lean b/tests/lean/Tutorial/Exercises.lean
index c2ccc1a5e..e66f1efeb 100644
--- a/tests/lean/Tutorial/Exercises.lean
+++ b/tests/lean/Tutorial/Exercises.lean
@@ -851,29 +851,29 @@ def add
   add_loop x1 y max1 0#u8 0#usize
 
 open ControlFlow
-/-- [tutorial::dummy_hash]:
-    Source: 'src/lib.rs', lines 250:0-253:1
-    Visibility: public -/
-def dummy_hash (i : Std.U32) : Result Std.U32 := do
-  ok 1000#u32
+/-- Trait declaration: [tutorial::Hash]
+    Source: 'src/lib.rs', lines 250:0-252:1 -/
+structure Hash (Self : Type) where
+  hash : Std.U32 → Result Std.U32
 
 /-- [tutorial::pseudo_random]: loop 0:
     Source: 'src/lib.rs', lines 258:2-260:3
     Visibility: public -/
 @[rust_loop]
-def pseudo_random_loop (state : Std.U32) : Result Std.U32 := do
+def pseudo_random_loop
+  {T : Type} (HashInst : Hash T) (state : Std.U32) : Result Std.U32 := do
   if state < 100#u32
-  then let state1 ← dummy_hash state
-       pseudo_random_loop state1
+  then let state1 ← HashInst.hash state
+       pseudo_random_loop HashInst state1
   else ok state
 partial_fixpoint
 
 /-- [tutorial::pseudo_random]:
     Source: 'src/lib.rs', lines 255:0-262:1
     Visibility: public -/
-@[reducible] def pseudo_random : Result Std.U32 := do
-               pseudo_random_loop 0#u32
-
+@[reducible]
+def pseudo_random {T : Type} (HashInst : Hash T) : Result Std.U32 := do
+  pseudo_random_loop HashInst 0#u32
 
 /- Exercise about dspec.
 For the usual spec `r ⦃post⦄`, one needs to prove that `r` terminates and
@@ -886,11 +886,12 @@ It works with the `step` tactic and any `@step` theorems for `spec` are automati
 lifted to `dspec`. You will also need the `dspec_induction` tactic to complete this exercise,
 which is used to prove a fact about a recursive function by induction in its recursive calls.
 
-`dummy_hash` is supposed to represent an opaque function where we can't reason about its output,
-so don't make use of its definition as a constant for the solution.
+The hash function is opaque and the `hash_spec` input tells nothing about its value.
 -/
-theorem pseudo_random_spec :
-  pseudo_random ⦃fun x => x.val >= 100⦄div := by
+theorem pseudo_random_spec {T} {h : Hash T}
+  (hash_spec : ∀ x, (h.hash x) ⦃fun _ => True⦄div)
+  :
+  pseudo_random h ⦃fun x => x.val >= 100⦄div := by
   sorry
 
 end Tutorial.Solutions
diff --git a/tests/lean/Tutorial/Solutions.lean b/tests/lean/Tutorial/Solutions.lean
index 079f1dea8..14571b756 100644
--- a/tests/lean/Tutorial/Solutions.lean
+++ b/tests/lean/Tutorial/Solutions.lean
@@ -452,22 +452,18 @@ theorem add_with_carry_spec
   step as ⟨ c, x' ⟩
   simp_all
 
-  -- I am refraining from using the result of dummy_hash,
-  -- since it's supposed to represent a hash function where we can't predict the result,
-  -- but it actually is just a constant
-@[step]
-theorem dummy_hash_spec x : (dummy_hash x) ⦃fun _ => True⦄div :=
-  by simp [dummy_hash]
-
 
-theorem pseudo_random_spec :
-  pseudo_random ⦃fun x => x.val >= 100⦄div := by
+theorem pseudo_random_spec {T} {h : Hash T}
+  (hash_spec : ∀ x, (h.hash x) ⦃fun _ => True⦄div)
+  :
+  pseudo_random h ⦃fun x => x.val >= 100⦄div := by
   unfold pseudo_random
   -- unfold pseudo_random_loop
-  -- if we proceed by unfolding `loop`, then the proof will be non-terminating.
+  -- if we proceed by unfolding `pseudo_random_loop`, then the proof will be non-terminating.
   -- instead, we can use the dspec_induction tactic
   -- note here that we must make a potentially non-obvious decision about
   -- what to generalize and how to do the induction
+  -- clear new_spec
   generalize 0#u32 = x
   revert x
   dspec_induction pseudo_random_loop
@@ -475,11 +471,9 @@ theorem pseudo_random_spec :
   simp only
   simp
   by_cases ((↑x : Nat) < 100)
-  ·
-    simp [*]
+  · simp [*]
     step*
-  ·
-    simp [*]
+  · simp [*]
     grind
 
 
diff --git a/tests/lean/Tutorial/Tutorial.lean b/tests/lean/Tutorial/Tutorial.lean
index 47c91ac0e..7fc8cc012 100644
--- a/tests/lean/Tutorial/Tutorial.lean
+++ b/tests/lean/Tutorial/Tutorial.lean
@@ -418,27 +418,28 @@ def add
        alloc.vec.Vec.push x2 i2
   else ok x2
 
-/-- [tutorial::dummy_hash]:
-    Source: 'src/lib.rs', lines 250:0-253:1
-    Visibility: public -/
-def dummy_hash (i : Std.U32) : Result Std.U32 := do
-  ok 1000#u32
+/-- Trait declaration: [tutorial::Hash]
+    Source: 'src/lib.rs', lines 250:0-252:1 -/
+structure Hash (Self : Type) where
+  hash : Std.U32 → Result Std.U32
 
 /-- [tutorial::pseudo_random]: loop 0:
     Source: 'src/lib.rs', lines 258:2-260:3
     Visibility: public -/
 @[rust_loop]
-def pseudo_random_loop (state : Std.U32) : Result Std.U32 := do
+def pseudo_random_loop
+  {T : Type} (HashInst : Hash T) (state : Std.U32) : Result Std.U32 := do
   if state < 100#u32
-  then let state1 ← dummy_hash state
-       pseudo_random_loop state1
+  then let state1 ← HashInst.hash state
+       pseudo_random_loop HashInst state1
   else ok state
 partial_fixpoint
 
 /-- [tutorial::pseudo_random]:
     Source: 'src/lib.rs', lines 255:0-262:1
     Visibility: public -/
-@[reducible] def pseudo_random : Result Std.U32 := do
-               pseudo_random_loop 0#u32
+@[reducible]
+def pseudo_random {T : Type} (HashInst : Hash T) : Result Std.U32 := do
+  pseudo_random_loop HashInst 0#u32
 
 end tutorial
diff --git a/tests/src/tutorial/src/lib.rs b/tests/src/tutorial/src/lib.rs
index 8c0027917..d856d4b65 100644
--- a/tests/src/tutorial/src/lib.rs
+++ b/tests/src/tutorial/src/lib.rs
@@ -247,16 +247,16 @@ fn test() {
     assert!(x[0] == 0xfffffffe);
 }
 
-pub fn dummy_hash(_ : u32) -> u32 {
-    // pretend that this function is opaque and we can't assume anything about the output
-    return 1000;
+trait Hash {
+  fn hash(_ : u32) -> u32;
 }
 
-pub fn pseudo_random() -> u32 {
+
+pub fn pseudo_random<T : Hash>() -> u32 {
   let mut state : u32 = 0;
 
   while state < 100 {
-    state = dummy_hash(state);
+    state = <T as Hash>::hash(state);
   }
   return state;
-}
+}
\ No newline at end of file

From f4d51b84632a1481e25b5a0ef6de96f8ba81a67b Mon Sep 17 00:00:00 2001
From: Jacob <jeprinz@users.noreply.github.com>
Date: Tue, 23 Jun 2026 10:43:52 -0400
Subject: [PATCH 32/67] Apply suggestions from code review

Co-authored-by: Son HO <son.marc.ho@hotmail.com>
---
 backends/lean/Aeneas/Std/Spec.lean            |  2 +-
 backends/lean/Aeneas/Std/WP.lean              |  4 +---
 .../Aeneas/Tactic/Step/DspecInduction.lean    |  2 --
 backends/lean/Aeneas/Tactic/Step/Step.lean    | 20 ++++++-------------
 4 files changed, 8 insertions(+), 20 deletions(-)

diff --git a/backends/lean/Aeneas/Std/Spec.lean b/backends/lean/Aeneas/Std/Spec.lean
index c646241ee..6b8442a33 100644
--- a/backends/lean/Aeneas/Std/Spec.lean
+++ b/backends/lean/Aeneas/Std/Spec.lean
@@ -38,7 +38,7 @@ structure SpecInfoExtensionState where
   specInfos : Std.HashMap Name SpecInfo
   deriving Inhabited
 
--- /- Initialize the state extension for adding spec theorems -/
+/- Initialize the state extension for adding spec theorems -/
 initialize specAttr : SimpleScopedEnvExtension SpecInfo SpecInfoExtensionState  ← do
   let ext ← registerSimpleScopedEnvExtension {
     name        := `specStatementRegistrationExtension,
diff --git a/backends/lean/Aeneas/Std/WP.lean b/backends/lean/Aeneas/Std/WP.lean
index 87038ceaa..5dc9faf3c 100644
--- a/backends/lean/Aeneas/Std/WP.lean
+++ b/backends/lean/Aeneas/Std/WP.lean
@@ -34,8 +34,6 @@ theorem spec_dspec (α) (x : Result α) (p: Post α) : spec x p → dspec x p :=
   intros s
   simp [spec, dspec] at *
   cases x <;> simp at * <;> assumption
-
-
 theorem dspec_admissible {α} (p : Post α )
   : Lean.Order.admissible (fun x => dspec x p) := by
   apply Lean.Order.admissible_flatOrder
@@ -310,7 +308,7 @@ macro_rules
   | `($e ⦃ $x => $p ⦄) => do
     let post ← mkBinderFun 0 x p
     `(Aeneas.Std.WP.spec $e $post)
-  | `($e div⦃ $x => $p ⦄) => do
+  | `($e ⦃ $x => $p ⦄div) => do
     let post ← mkBinderFun 0 x p
     `(Aeneas.Std.WP.dspec $e $post)
 
diff --git a/backends/lean/Aeneas/Tactic/Step/DspecInduction.lean b/backends/lean/Aeneas/Tactic/Step/DspecInduction.lean
index 5c2e2314c..a4c438b13 100644
--- a/backends/lean/Aeneas/Tactic/Step/DspecInduction.lean
+++ b/backends/lean/Aeneas/Tactic/Step/DspecInduction.lean
@@ -244,7 +244,6 @@ partial_fixpoint
 
 theorem test_div_2_manual (x y : Std.I32) : Std.WP.dspec (simple_diverge_2' x y) (fun res => res = 10#i32)
   := by
-    --
     revert x y
     apply simple_diverge_2'.fixpoint_induct
       (motive := fun simple_diverge_2' => ∀ x y, WP.dspec (simple_diverge_2' x y) (fun res => res = 10#i32))
@@ -256,7 +255,6 @@ theorem test_div_2_manual (x y : Std.I32) : Std.WP.dspec (simple_diverge_2' x y)
       . step
         step
         simp [*]
-        --
 
 theorem test_div_2_tactic (x y : Std.I32) : Std.WP.dspec (simple_diverge_2' x y) (fun res => res = 10#i32)
   := by
diff --git a/backends/lean/Aeneas/Tactic/Step/Step.lean b/backends/lean/Aeneas/Tactic/Step/Step.lean
index a19e583d1..da18c424f 100644
--- a/backends/lean/Aeneas/Tactic/Step/Step.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Step.lean
@@ -228,7 +228,7 @@ structure Args where
    If comp = bind m k then return true and m
    Else return false and comp
 
-   NEW: also looks up which type of spec is being used in the statment,
+   Also looks up which type of spec is being used in the statement,
    and returns the corresponding SpecInfo
 -/
 def getFirstBind (goalTy : Expr) : MetaM (Bool × Expr × SpecInfo) := do
@@ -237,12 +237,12 @@ def getFirstBind (goalTy : Expr) : MetaM (Bool × Expr × SpecInfo) := do
   let (spec?, args) := goalTy.consumeMData.withApp (fun f args => (f, args))
   let name ← match spec? with
     | Expr.const name _ => pure name
-    | _ => throwError "{spec?} is not a spec statement name"
+    | _ => throwError "{spec?} is not a spec statement"
   let .some info ← specStatementLookup name
-    | throwError "{name} is not a supported spec statement name"
+    | throwError "{name} is not a supported spec statement"
   let compTy ← if h: args.size = info.arity
                then pure (args[info.program_index]!)
-               else throwError "Goal is not a `spec m P`"
+               else throwError "Goal is not a fully applied `spec m P`"
 
   trace[Step] "compTy: {compTy}"
 
@@ -515,7 +515,6 @@ def tryMatch (info : SpecInfo) (lifting : Option LiftingInfo) (isLet : Bool) (th
 
   -- `thTy` should be of the shape `spec program post`: we need to retrieve `program`
   let (thHead, thArgs) := thTy.consumeMData.withApp (fun f args => (f, args))
-  -- TODO: here is where it should be able to lift from spec to dspec
   if !thHead.isConst || thHead.constName! != info.name then
     throwError "Not a spec theorem"
 
@@ -1042,7 +1041,7 @@ where
   for decl in decls.reverse do
     trace[Step] "Trying assumption: {decl.userName} : {decl.type}"
     try
-      -- TODO: do we ever want to do a lifting with an assumption?
+      -- TODO: generalize to allow lifting assumptions
       let goal ← stepWith info .none args isLet fExpr decl.toExpr
       return (some (goal, .localHyp decl))
     catch _ => continue
@@ -1120,7 +1119,7 @@ def stepAsmsOrLookupTheorem (args : Args) (withTh : Option Expr) :
       for decl in decls.reverse do
         trace[Step] "Trying recursive assumption: {decl.userName} : {decl.type}"
         try
-          -- TODO: do we ever want to do a lifting for a recursive assumption?
+          -- We should never need to lift a recursive assumption
           let goals ← stepWith info .none args goalIsLet fExpr decl.toExpr
           return (goals, .localHyp decl)
         catch _ => continue
@@ -1541,14 +1540,12 @@ namespace Test
   -- set_option trace.Step true
   -- set_option pp.rawOnError true
 
-
   set_option says.verify true
 
   -- The following command displays the database of theorems:
   -- #eval showStoredStepThms
   open alloc.vec
 
-
   /- This test case checks what happens when `step`:
      - manages to solve the current goal
      - but doesn't solve some preconditions
@@ -2141,12 +2138,10 @@ h1 : ∀ (i : ℕ) (x : i < s.length), s'[i] = 0#u32
   -- this exists to workaround what is possibly a lean bug.
   -- it can't find dspec the first time you try, but the subsequent ones work just fine.
   -- it also seems to have something to do with the step attribute
-  /---/
   #guard_msgs (substring := true) in
   @[step]
   theorem lean_bug_workaround : Std.WP.dspec (.ok 10) (fun _ => False) := by
     step
-    --
 
   theorem test_div (x : Std.I32) : Std.WP.dspec (simple_diverge x) (fun res => res = 10#i32)
     := by
@@ -2194,7 +2189,6 @@ h1 : ∀ (i : ℕ) (x : i < s.length), s'[i] = 0#u32
       step
       step
       simp [*]
-      --
 
   example : WP.spec
     (do let x ← 1#i32 + 2#i32
@@ -2203,7 +2197,6 @@ h1 : ∀ (i : ℕ) (x : i < s.length), s'[i] = 0#u32
     step
     step
     simp [*]
-    --
 
   -- requires lifting spec to dspec
   example : WP.dspec
@@ -2233,7 +2226,6 @@ h1 : ∀ (i : ℕ) (x : i < s.length), s'[i] = 0#u32
     step -- this should fail!
     step
     simp [*]
-    --
 end DspecTests
 
 end Test

From 30aee162adb02b59af7828c5615ca3ac57035a6f Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Tue, 23 Jun 2026 10:59:36 -0400
Subject: [PATCH 33/67] more work on spec for itree

---
 .../lean/Aeneas/Data/Coinductive/ITree.lean   |   1 +
 backends/lean/Aeneas/Std/Spec.lean            |   4 +-
 backends/lean/Aeneas/Std/WP.lean              |   4 +-
 backends/lean/Aeneas/Tactic/Step/Init.lean    |   2 +-
 backends/lean/Aeneas/Tactic/Step/Step.lean    |   4 +-
 tests/lean/SpecTests/Coin.lean                | 138 ++++++++++++++++++
 tests/lean/SpecTests/Hoare.lean               |   3 -
 7 files changed, 146 insertions(+), 10 deletions(-)
 create mode 100644 tests/lean/SpecTests/Coin.lean
 delete mode 100644 tests/lean/SpecTests/Hoare.lean

diff --git a/backends/lean/Aeneas/Data/Coinductive/ITree.lean b/backends/lean/Aeneas/Data/Coinductive/ITree.lean
index 418f5677f..86f882813 100644
--- a/backends/lean/Aeneas/Data/Coinductive/ITree.lean
+++ b/backends/lean/Aeneas/Data/Coinductive/ITree.lean
@@ -323,5 +323,6 @@ theorem interp_vis {F} (f : (i : E.I) → ITree F (E.O i)) i (k : E.O i → ITre
 
 -- #synth CCPO (ITree E R)
 -- #synth MonoBind (ITree E)
+-- #synth Bind (ITree E)
 
 namespace Aeneas.Data.Coinductive
diff --git a/backends/lean/Aeneas/Std/Spec.lean b/backends/lean/Aeneas/Std/Spec.lean
index c646241ee..7bb0e3b34 100644
--- a/backends/lean/Aeneas/Std/Spec.lean
+++ b/backends/lean/Aeneas/Std/Spec.lean
@@ -16,7 +16,7 @@ structure LiftingInfo where
   conversion_thm_inferred_args : Nat
 
 structure SpecInfo where
-  name : Lean.Name
+  spec_name : Lean.Name
   arity : Nat
   program_index : Nat -- index into the arguments of the Result value
   post_index : Nat
@@ -46,7 +46,7 @@ initialize specAttr : SimpleScopedEnvExtension SpecInfo SpecInfoExtensionState
       specInfos := Std.HashMap.emptyWithCapacity
     },
     addEntry    := fun state new =>
-      {state with specInfos := state.specInfos.insert new.name new},
+      {state with specInfos := state.specInfos.insert new.spec_name new},
   }
   pure ext
 
diff --git a/backends/lean/Aeneas/Std/WP.lean b/backends/lean/Aeneas/Std/WP.lean
index 87038ceaa..b7afc0fe8 100644
--- a/backends/lean/Aeneas/Std/WP.lean
+++ b/backends/lean/Aeneas/Std/WP.lean
@@ -865,7 +865,7 @@ theorem forall_unit {p : Prop} : (Unit → p) ↔ p := by simp
 
 -- registers the spec statements for use in the step tactic, see Spec.lean
 #register_spec_statement {
-    name := ``Std.WP.spec
+    spec_name := ``Std.WP.spec
     arity := 3
     program_index := 1
     post_index := 2
@@ -889,7 +889,7 @@ theorem forall_unit {p : Prop} : (Unit → p) ↔ p := by simp
   }
 
 #register_spec_statement {
-    name := ``Std.WP.dspec
+    spec_name := ``Std.WP.dspec
     arity := 3
     program_index := 1
     post_index := 2
diff --git a/backends/lean/Aeneas/Tactic/Step/Init.lean b/backends/lean/Aeneas/Tactic/Step/Init.lean
index f11976141..a10a96954 100644
--- a/backends/lean/Aeneas/Tactic/Step/Init.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Init.lean
@@ -326,7 +326,7 @@ private def saveStepSpecFromThm (ext : Extension) (attrKind : AttributeKind) (st
       pure (← DiscrTree.mkPath fExpr, info))
     -- Save the entry
     -- TODO: use info.name to use a different discrimination tree here!
-    ScopedEnvExtension.add ext ((info.name, fKey), thName) attrKind
+    ScopedEnvExtension.add ext ((info.spec_name, fKey), thName) attrKind
     trace[Step] "Saved the entry"
     -- Also generate a corresponding mvcgen (@[spec]) lemma
     try
diff --git a/backends/lean/Aeneas/Tactic/Step/Step.lean b/backends/lean/Aeneas/Tactic/Step/Step.lean
index a19e583d1..c9df2014f 100644
--- a/backends/lean/Aeneas/Tactic/Step/Step.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Step.lean
@@ -516,7 +516,7 @@ def tryMatch (info : SpecInfo) (lifting : Option LiftingInfo) (isLet : Bool) (th
   -- `thTy` should be of the shape `spec program post`: we need to retrieve `program`
   let (thHead, thArgs) := thTy.consumeMData.withApp (fun f args => (f, args))
   -- TODO: here is where it should be able to lift from spec to dspec
-  if !thHead.isConst || thHead.constName! != info.name then
+  if !thHead.isConst || thHead.constName! != info.spec_name then
     throwError "Not a spec theorem"
 
   let (program, P) ←
@@ -1093,7 +1093,7 @@ def stepAsmsOrLookupTheorem (args : Args) (withTh : Option Expr) :
       for lifting in liftings do
         let pspecs : Array Name ← do
           let thNames ← stepAttr.find? -- looks up the theorem in a discrimination tree
-            (match lifting with | .none => info.name | .some l => l.from_statement)
+            (match lifting with | .none => info.spec_name | .some l => l.from_statement)
             fExpr
           /- TODO: because of reduction, there may be several valid theorems (for
             instance for the scalars). We need to sort them from most specific to
diff --git a/tests/lean/SpecTests/Coin.lean b/tests/lean/SpecTests/Coin.lean
new file mode 100644
index 000000000..51dd1cdc6
--- /dev/null
+++ b/tests/lean/SpecTests/Coin.lean
@@ -0,0 +1,138 @@
+import Aeneas.Std.Primitives
+import Aeneas.Std.Delab
+import Std.Do
+import Aeneas.Std.Spec
+import Aeneas.Std.WP
+import Aeneas.Data.Coinductive.ITree
+import Aeneas.Data.Coinductive.Effect
+import Aeneas.Std
+import Std
+import Aeneas.Tactic.Step
+import Aeneas
+
+open Aeneas
+open Std Result WP Data Coinductive Effect Lean.Order
+
+def Coin : Effect := {
+   I := Unit
+   O := fun _ => Bool
+}
+
+def ITreeC := ITree Coin
+
+
+-- can just use coinductive props!
+coinductive coinSpec {α} (p : Post α) : (x : ITreeC α) → Prop where
+| ret : ∀ x, p x → coinSpec p (ITree.ret x)
+| vis : ∀ k, (∀ b, coinSpec p (k b)) → coinSpec p (ITree.vis () k)
+
+theorem coinSpec_mono {α} {P₁ : Post α} {m : ITreeC α} {P₀ : Post α} (h : coinSpec P₀ m):
+  (∀ x, P₀ x → P₁ x) → coinSpec P₁ m := by
+  intros
+  refine coinSpec.coinduct _ (coinSpec P₀) ?_ _ h
+  intros x c
+  cases c <;> grind only
+
+/-- Implication of a `dspec` predicate with quantifier -/
+def qimp_coinSpec {α β} (P : α → Prop) (k : α → ITreeC β) (Q : β → Prop) : Prop :=
+  ∀ x, P x → coinSpec Q (k x)
+
+theorem coinSpec_bind {α β} {k : α -> ITreeC β} {Pₖ : Post β} {m : ITreeC α} {Pₘ : Post α} :
+  coinSpec Pₘ m →
+  (qimp_coinSpec Pₘ k Pₖ) →
+  coinSpec Pₖ (ITree.bind m k) := by
+  intro Hm Hk
+  refine coinSpec.coinduct _
+    (fun t => ∃ (m : ITreeC α) (k : _), t = ITree.bind m k ∧ coinSpec Pₘ m ∧ qimp_coinSpec Pₘ k Pₖ)
+    ?_ _ ?_
+  · clear k Hk
+    simp only
+    rintro i ⟨m, k, rfl, cm, ck⟩
+    cases cm with
+    | ret a Pₘa =>
+      simp
+      have test := ck a Pₘa
+      generalize h : k a = thing at *
+      clear h
+      have ck := ck a
+      clear ck
+      clear ck k
+      cases test with
+      | ret a' Pa' =>
+        left
+        grind
+      | vis m' k' =>
+        right
+        exists m'
+        simp
+        intros b
+        exists (ITree.ret a)
+        simp [*, coinSpec.ret]
+        unfold qimp_coinSpec
+        exists (fun _ => m' b) -- this seems really weird. is the statement really right?
+        simp [*]
+    | vis m k =>
+      simp
+      right
+      grind
+  · simp only
+    exists m, k
+
+#register_spec_statement {
+    spec_name := ``coinSpec
+    arity := 3
+    program_index := 2
+    post_index := 1
+    mk_spec_mono := ``coinSpec_mono
+    mk_spec_mono_skip_args := 2
+    mk_spec_bind := ``coinSpec_bind
+    mk_spec_bind_skip_args := 4
+    uncurry_elim_tactics := #[
+      -- ``Std.WP.qimp_dspec_unit,
+      ``Std.WP.qimp_unit,
+      -- ``Std.WP.qimp_dspec_exists,
+      ``Std.WP.qimp_exists,
+      ``forall_unit, ``true_imp_iff
+    ]
+    qimp_elim_tactics := #[
+      -- ``Std.WP.qimp_dspec_iff,
+      ``Std.WP.qimp_iff,
+      ``Std.WP.imp_and_iff, ``Std.uncurry_apply_pair,
+      ``Std.WP.uncurry'_eq, ``Std.WP.uncurry'_pair,
+      ``Std.WP.imp_exists_iff,
+      ``forall_unit, ``true_imp_iff
+    ]
+    to_mvcgen := .none
+    liftings := #[
+      -- { from_statement := ``Std.WP.spec
+      --   conversion_thm := ``Std.WP.spec_dspec
+      --   conversion_thm_inferred_args := 3 }
+    ]
+  }
+
+  instance : MonadLift Result ITreeC where
+    monadLift r := match r with
+      | .fail _e => .div -- TODO
+      | .div => .div
+      | .ok x => .ret x
+
+  instance : Monad ITreeC := instMonadITree
+  instance {T} : Lean.Order.PartialOrder (ITreeC T) := instPartialOrderCoIndOfInhabitedPUnit _
+  noncomputable instance {T} : Lean.Order.CCPO (ITreeC T) := instCCPOCoIndOfInhabitedPUnit _
+  instance : MonoBind ITreeC := instMonoBindITree
+
+
+  def res : Result Nat := .ok 5
+  def itreec : ITreeC Nat := res
+
+  /--
+error: no such spec statement as coinSpec, valid ones are [Aeneas.Std.WP.dspec, Aeneas.Std.WP.spec]
+-/
+#guard_msgs in
+  example : coinSpec (fun z => z.val == 6)
+    (do let x ← 1#i32 + 2#i32
+        let y ← x + x
+        ITree.ret y)  := by
+    step
+    step
+    simp [*]
diff --git a/tests/lean/SpecTests/Hoare.lean b/tests/lean/SpecTests/Hoare.lean
deleted file mode 100644
index a8fcdf736..000000000
--- a/tests/lean/SpecTests/Hoare.lean
+++ /dev/null
@@ -1,3 +0,0 @@
-import Aeneas.Std.Primitives
-import Aeneas.Std.Delab
-import Std.Do

From 801ac5c16dc5db5d47d621ea7beefa04058867e3 Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Tue, 23 Jun 2026 11:11:10 -0400
Subject: [PATCH 34/67] some small fixes from code review

---
 backends/lean/Aeneas/Std/WP.lean           | 29 ++++++++--------------
 backends/lean/Aeneas/Tactic/Step/Init.lean |  8 ++++--
 backends/lean/Aeneas/Tactic/Step/Step.lean |  2 +-
 3 files changed, 18 insertions(+), 21 deletions(-)

diff --git a/backends/lean/Aeneas/Std/WP.lean b/backends/lean/Aeneas/Std/WP.lean
index 5dc9faf3c..a8bbf342d 100644
--- a/backends/lean/Aeneas/Std/WP.lean
+++ b/backends/lean/Aeneas/Std/WP.lean
@@ -312,31 +312,24 @@ macro_rules
     let post ← mkBinderFun 0 x p
     `(Aeneas.Std.WP.dspec $e $post)
 
+def mk_function_syntax (p : TSyntax `term) (depth : Nat) (xs : List Term) : MacroM Term := do
+  match xs with
+  | [] => `($p)
+  | [x] => mkBinderFun depth x p
+  | x :: xs =>
+    let xs ← mk_function_syntax p (depth + 1) xs
+    let inner ← mkBinderFun depth x xs
+    `(uncurry' $inner)
+
 /-- Macro expansion for multiple elements -/
 macro_rules
   | `($e ⦃ $x $xs:term* => $p ⦄) => do
     let xs := x :: xs.toList
-    let rec run (depth : Nat) (xs : List Term) : MacroM Term := do
-      match xs with
-      | [] => `($p)
-      | [x] => mkBinderFun depth x p
-      | x :: xs =>
-        let xs ← run (depth + 1) xs
-        let inner ← mkBinderFun depth x xs
-        `(uncurry' $inner)
-    let post ← run 0 xs
+    let post ← mk_function_syntax p 0 xs
     `(Aeneas.Std.WP.spec $e $post)
   | `($e ⦃ $x $xs:term* => $p ⦄div) => do
     let xs := x :: xs.toList
-    let rec run (depth : Nat) (xs : List Term) : MacroM Term := do
-      match xs with
-      | [] => `($p)
-      | [x] => mkBinderFun depth x p
-      | x :: xs =>
-        let xs ← run (depth + 1) xs
-        let inner ← mkBinderFun depth x xs
-        `(uncurry' $inner)
-    let post ← run 0 xs
+    let post ← mk_function_syntax p 0 xs
     `(Aeneas.Std.WP.dspec $e $post)
 
 /-- Macro expansion for predicate with no arrow -/
diff --git a/backends/lean/Aeneas/Tactic/Step/Init.lean b/backends/lean/Aeneas/Tactic/Step/Init.lean
index f11976141..b567c4ffe 100644
--- a/backends/lean/Aeneas/Tactic/Step/Init.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Init.lean
@@ -240,6 +240,10 @@ def getStepSpecFunArgsExpr (ty : Expr) :
 
 deriving instance Ord for Lean.Name
 structure Rules where
+  /--
+  This mapping stores theorems to be used automatically with the `step` tactic,
+  spec statement name -> program expression pattern -> step theorem name
+  -/
   rules : Std.TreeMap Name (DiscrTree Name)
   /- We can't remove keys from a discrimination tree, so to support
      local rules we keep a set of deactivated rules (rules which have
@@ -279,7 +283,7 @@ structure StepSpecAttr where
   ext  : Extension
   deriving Inhabited
 
-private def generateMvcgenSpec (thm : Name) (stx : Syntax) (attrKind : AttributeKind)
+private def generateMvcgenSpec (toMvcgenThm : Name) (stx : Syntax) (attrKind : AttributeKind)
     (thDecl : AsyncConstantInfo) : MetaM Unit := do
   let sig := thDecl.sig.get
   let thName := thDecl.name
@@ -288,7 +292,7 @@ private def generateMvcgenSpec (thm : Name) (stx : Syntax) (attrKind : Attribute
     let thConst := Lean.mkConst thName (sig.levelParams.map .param)
     let thApp := mkAppN thConst fvars
     -- Wrap with spec_to_mvcgen to produce: Triple (f args) ⌜True⌝ post⟨...⟩
-    let proof ← mkAppM thm #[thApp]
+    let proof ← mkAppM toMvcgenThm #[thApp]
     let innerTy ← inferType proof
     -- Re-introduce all fvars as binders
     let proofTerm ← mkLambdaFVars fvars proof
diff --git a/backends/lean/Aeneas/Tactic/Step/Step.lean b/backends/lean/Aeneas/Tactic/Step/Step.lean
index da18c424f..ae3592c1c 100644
--- a/backends/lean/Aeneas/Tactic/Step/Step.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Step.lean
@@ -418,7 +418,7 @@ def getBindVarNames : TacticM (Array (Option Name)) := do
   catch _ => pure #[]
 
 /-- Extract the names used in the post-condition of the current goal.
-    The goal should have the shape `spec program post`. -/
+    The goal should be a valid spec statement, such as `spec program post`. -/
 def getPostNamesFromGoal : TacticM (Array (Option Name)) := do
   try
     let goalTy ← (← getMainGoal).getType

From 8ed34903a4ab6a26b4e8cde8464fa5d0299a8302 Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Tue, 23 Jun 2026 11:19:29 -0400
Subject: [PATCH 35/67] generalized getPostNamesFromGoal and renamed spec_name

---
 backends/lean/Aeneas/Std/Spec.lean         |  4 ++--
 backends/lean/Aeneas/Std/WP.lean           |  4 ++--
 backends/lean/Aeneas/Tactic/Step/Init.lean |  2 +-
 backends/lean/Aeneas/Tactic/Step/Step.lean | 14 +++++++++-----
 4 files changed, 14 insertions(+), 10 deletions(-)

diff --git a/backends/lean/Aeneas/Std/Spec.lean b/backends/lean/Aeneas/Std/Spec.lean
index 6b8442a33..89f3ff905 100644
--- a/backends/lean/Aeneas/Std/Spec.lean
+++ b/backends/lean/Aeneas/Std/Spec.lean
@@ -16,7 +16,7 @@ structure LiftingInfo where
   conversion_thm_inferred_args : Nat
 
 structure SpecInfo where
-  name : Lean.Name
+  spec_name : Lean.Name
   arity : Nat
   program_index : Nat -- index into the arguments of the Result value
   post_index : Nat
@@ -46,7 +46,7 @@ initialize specAttr : SimpleScopedEnvExtension SpecInfo SpecInfoExtensionState
       specInfos := Std.HashMap.emptyWithCapacity
     },
     addEntry    := fun state new =>
-      {state with specInfos := state.specInfos.insert new.name new},
+      {state with specInfos := state.specInfos.insert new.spec_name new},
   }
   pure ext
 
diff --git a/backends/lean/Aeneas/Std/WP.lean b/backends/lean/Aeneas/Std/WP.lean
index a8bbf342d..e6971d334 100644
--- a/backends/lean/Aeneas/Std/WP.lean
+++ b/backends/lean/Aeneas/Std/WP.lean
@@ -856,7 +856,7 @@ theorem forall_unit {p : Prop} : (Unit → p) ↔ p := by simp
 
 -- registers the spec statements for use in the step tactic, see Spec.lean
 #register_spec_statement {
-    name := ``Std.WP.spec
+    spec_name := ``Std.WP.spec
     arity := 3
     program_index := 1
     post_index := 2
@@ -880,7 +880,7 @@ theorem forall_unit {p : Prop} : (Unit → p) ↔ p := by simp
   }
 
 #register_spec_statement {
-    name := ``Std.WP.dspec
+    spec_name := ``Std.WP.dspec
     arity := 3
     program_index := 1
     post_index := 2
diff --git a/backends/lean/Aeneas/Tactic/Step/Init.lean b/backends/lean/Aeneas/Tactic/Step/Init.lean
index b567c4ffe..19256f0fd 100644
--- a/backends/lean/Aeneas/Tactic/Step/Init.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Init.lean
@@ -330,7 +330,7 @@ private def saveStepSpecFromThm (ext : Extension) (attrKind : AttributeKind) (st
       pure (← DiscrTree.mkPath fExpr, info))
     -- Save the entry
     -- TODO: use info.name to use a different discrimination tree here!
-    ScopedEnvExtension.add ext ((info.name, fKey), thName) attrKind
+    ScopedEnvExtension.add ext ((info.spec_name, fKey), thName) attrKind
     trace[Step] "Saved the entry"
     -- Also generate a corresponding mvcgen (@[spec]) lemma
     try
diff --git a/backends/lean/Aeneas/Tactic/Step/Step.lean b/backends/lean/Aeneas/Tactic/Step/Step.lean
index ae3592c1c..1959cdccf 100644
--- a/backends/lean/Aeneas/Tactic/Step/Step.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Step.lean
@@ -424,9 +424,13 @@ def getPostNamesFromGoal : TacticM (Array (Option Name)) := do
     let goalTy ← (← getMainGoal).getType
     let goalTy ← instantiateMVars goalTy
     goalTy.consumeMData.withApp fun spec? args => do
-    -- TODO: this could be generalized to work with other specs, like `dspec`
-    if spec?.isConstOf ``Std.WP.spec ∧ args.size = 3 then
-      getPostNames args[2]!
+    let specname ← match spec? with
+      | Expr.const name _ => pure name
+      | _ => throwError "{spec?} is not a spec statement"
+    let .some info ← specStatementLookup specname
+      | throwError "{specname} is not a supported spec statement"
+    if args.size = info.arity then
+      getPostNames args[info.post_index]!
     else pure #[]
   catch _ => pure #[]
 
@@ -515,7 +519,7 @@ def tryMatch (info : SpecInfo) (lifting : Option LiftingInfo) (isLet : Bool) (th
 
   -- `thTy` should be of the shape `spec program post`: we need to retrieve `program`
   let (thHead, thArgs) := thTy.consumeMData.withApp (fun f args => (f, args))
-  if !thHead.isConst || thHead.constName! != info.name then
+  if !thHead.isConst || thHead.constName! != info.spec_name then
     throwError "Not a spec theorem"
 
   let (program, P) ←
@@ -1092,7 +1096,7 @@ def stepAsmsOrLookupTheorem (args : Args) (withTh : Option Expr) :
       for lifting in liftings do
         let pspecs : Array Name ← do
           let thNames ← stepAttr.find? -- looks up the theorem in a discrimination tree
-            (match lifting with | .none => info.name | .some l => l.from_statement)
+            (match lifting with | .none => info.spec_name | .some l => l.from_statement)
             fExpr
           /- TODO: because of reduction, there may be several valid theorems (for
             instance for the scalars). We need to sort them from most specific to

From f6162aacdac2cc0bb597889b417c36277d789a3c Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Tue, 23 Jun 2026 11:53:47 -0400
Subject: [PATCH 36/67] fixed state extension bug

---
 backends/lean/Aeneas/Tactic/Step/Init.lean | 8 ++++++--
 backends/lean/Aeneas/Tactic/Step/Step.lean | 8 --------
 2 files changed, 6 insertions(+), 10 deletions(-)

diff --git a/backends/lean/Aeneas/Tactic/Step/Init.lean b/backends/lean/Aeneas/Tactic/Step/Init.lean
index 19256f0fd..4a2efc6c4 100644
--- a/backends/lean/Aeneas/Tactic/Step/Init.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Init.lean
@@ -359,9 +359,13 @@ initialize stepAttr : StepSpecAttr ← do
   pure { attr := attrImpl, ext := ext }
 
 def StepSpecAttr.find? (s : StepSpecAttr) (name : Name) (e : Expr) : MetaM (Array Name) := do
-  let state := s.ext.getState (← getEnv)
+  let env ← getEnv
+  let state := s.ext.getState env
+  let specState := specAttr.getState env
+  if not (specState.specInfos.contains name) then
+    throwError "no such spec statement as {name}, valid ones are {state.rules.keys}"
   let .some dtree := state.rules.get? name
-  | throwError "no such spec statement as {name}, valid ones are {state.rules.keys}"
+  | pure #[] -- no spec theorems have been added for this theorem yet
   let rules ← dtree.getMatch e
   pure (rules.filter (fun th => th ∉ state.deactivated))
 
diff --git a/backends/lean/Aeneas/Tactic/Step/Step.lean b/backends/lean/Aeneas/Tactic/Step/Step.lean
index 1959cdccf..66b304070 100644
--- a/backends/lean/Aeneas/Tactic/Step/Step.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Step.lean
@@ -2139,14 +2139,6 @@ h1 : ∀ (i : ℕ) (x : i < s.length), s'[i] = 0#u32
       simple_diverge i1
   partial_fixpoint
 
-  -- this exists to workaround what is possibly a lean bug.
-  -- it can't find dspec the first time you try, but the subsequent ones work just fine.
-  -- it also seems to have something to do with the step attribute
-  #guard_msgs (substring := true) in
-  @[step]
-  theorem lean_bug_workaround : Std.WP.dspec (.ok 10) (fun _ => False) := by
-    step
-
   theorem test_div (x : Std.I32) : Std.WP.dspec (simple_diverge x) (fun res => res = 10#i32)
     := by
       revert x

From 86a2443910bbf68166d0bc2b91da0e09f86ee8e8 Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Tue, 23 Jun 2026 15:34:11 -0400
Subject: [PATCH 37/67] progress on ITree based spec example

---
 tests/lean/SpecTests/Coin.lean | 97 ++++++++++++++++++++++++++--------
 1 file changed, 76 insertions(+), 21 deletions(-)

diff --git a/tests/lean/SpecTests/Coin.lean b/tests/lean/SpecTests/Coin.lean
index 51dd1cdc6..a19267201 100644
--- a/tests/lean/SpecTests/Coin.lean
+++ b/tests/lean/SpecTests/Coin.lean
@@ -20,7 +20,6 @@ def Coin : Effect := {
 
 def ITreeC := ITree Coin
 
-
 -- can just use coinductive props!
 coinductive coinSpec {α} (p : Post α) : (x : ITreeC α) → Prop where
 | ret : ∀ x, p x → coinSpec p (ITree.ret x)
@@ -78,6 +77,54 @@ theorem coinSpec_bind {α β} {k : α -> ITreeC β} {Pₖ : Post β} {m : ITreeC
   · simp only
     exists m, k
 
+  instance : MonadLift Result ITreeC where
+    monadLift r := match r with
+      | .fail _e => .div -- TODO
+      | .div => .div
+      | .ok x => .ret x
+
+theorem spec_coinSpec {α} {x : Result α} {p: Post α} : spec x p → coinSpec p x := by
+  intros s
+  cases x
+  · apply coinSpec.ret
+    assumption
+  · contradiction
+  · contradiction
+#check spec_coinSpec
+
+@[simp]
+theorem qimp_coinSpec_unit {α} (P : Unit → Prop) (k : Unit → ITreeC α) (Q : α → Prop) :
+  qimp_coinSpec P k Q ↔ (P () → coinSpec Q (k ())) := by
+  grind [qimp_coinSpec]
+
+@[simp]
+theorem qimp_coinSpec_exists {α β γ} (P : γ → α → Prop) (k : α → ITreeC β) (Q : β → Prop) :
+  qimp_coinSpec (fun x => ∃ y, P y x) k Q ↔ ∀ x, qimp_coinSpec (P x) k Q := by
+  simp only [qimp_coinSpec, forall_exists_index]; grind
+
+def qimp_coinSpec_iff {α β} (P : α → Prop) (k : α → ITreeC β) (Q : β → Prop) :
+  qimp_coinSpec P k Q ↔ ∀ x, imp (P x) (coinSpec Q (k x)) := by
+  simp [qimp_coinSpec, imp]
+
+#check CoInd.unfold
+
+@[simp, grind =, agrind =]
+theorem coinSpec_ret {α p} (x : α) : coinSpec p (ITree.ret x) ↔ p x := by
+  constructor
+  · intros s
+    generalize h : ITree.ret x = thing at s
+    cases s with
+    | @ret x asdf =>
+    have h := congrArg (CoInd.unfold _) h
+    cases h
+    assumption
+    | vis k _ =>
+    have h := congrArg (CoInd.unfold _) h
+    cases h
+  · intros
+    apply coinSpec.ret
+    assumption
+
 #register_spec_statement {
     spec_name := ``coinSpec
     arity := 3
@@ -88,14 +135,14 @@ theorem coinSpec_bind {α β} {k : α -> ITreeC β} {Pₖ : Post β} {m : ITreeC
     mk_spec_bind := ``coinSpec_bind
     mk_spec_bind_skip_args := 4
     uncurry_elim_tactics := #[
-      -- ``Std.WP.qimp_dspec_unit,
+      ``qimp_coinSpec_unit,
       ``Std.WP.qimp_unit,
-      -- ``Std.WP.qimp_dspec_exists,
+      ``qimp_coinSpec_exists,
       ``Std.WP.qimp_exists,
       ``forall_unit, ``true_imp_iff
     ]
     qimp_elim_tactics := #[
-      -- ``Std.WP.qimp_dspec_iff,
+      ``qimp_coinSpec_iff,
       ``Std.WP.qimp_iff,
       ``Std.WP.imp_and_iff, ``Std.uncurry_apply_pair,
       ``Std.WP.uncurry'_eq, ``Std.WP.uncurry'_pair,
@@ -104,18 +151,12 @@ theorem coinSpec_bind {α β} {k : α -> ITreeC β} {Pₖ : Post β} {m : ITreeC
     ]
     to_mvcgen := .none
     liftings := #[
-      -- { from_statement := ``Std.WP.spec
-      --   conversion_thm := ``Std.WP.spec_dspec
-      --   conversion_thm_inferred_args := 3 }
+      { from_statement := ``Std.WP.spec
+        conversion_thm := ``spec_coinSpec
+        conversion_thm_inferred_args := 3 }
     ]
   }
 
-  instance : MonadLift Result ITreeC where
-    monadLift r := match r with
-      | .fail _e => .div -- TODO
-      | .div => .div
-      | .ok x => .ret x
-
   instance : Monad ITreeC := instMonadITree
   instance {T} : Lean.Order.PartialOrder (ITreeC T) := instPartialOrderCoIndOfInhabitedPUnit _
   noncomputable instance {T} : Lean.Order.CCPO (ITreeC T) := instCCPOCoIndOfInhabitedPUnit _
@@ -125,14 +166,28 @@ theorem coinSpec_bind {α β} {k : α -> ITreeC β} {Pₖ : Post β} {m : ITreeC
   def res : Result Nat := .ok 5
   def itreec : ITreeC Nat := res
 
-  /--
-error: no such spec statement as coinSpec, valid ones are [Aeneas.Std.WP.dspec, Aeneas.Std.WP.spec]
--/
-#guard_msgs in
+  -- #check bind
+
+  example : spec
+    (do let x ← 1#i32 + 2#i32
+        let y ← x + x
+        .ok x)
+    (fun z => z.val == 6)  := by
+    step?
+    sorry
+
+  #check I32.add_spec
+  -- set_option trace.Step true
+
   example : coinSpec (fun z => z.val == 6)
     (do let x ← 1#i32 + 2#i32
         let y ← x + x
-        ITree.ret y)  := by
-    step
-    step
-    simp [*]
+        ITree.vis () fun (b : Bool) =>
+        if b then ITree.ret y else ITree.ret 6#i32)  := by
+    step with (fun h1 h2 => spec_coinSpec (I32.add_spec h1 h2))
+    step with (fun h1 h2 => spec_coinSpec (I32.add_spec h1 h2))
+    apply coinSpec.vis
+    intros b
+    cases b
+    · simp [*]
+    · simp [*]

From 8458994f6bf4263dd3eecb0990a2058907ffaeab Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Wed, 24 Jun 2026 11:40:55 -0400
Subject: [PATCH 38/67] lifting feature in Step, lift works now with coinSpec

---
 backends/lean/Aeneas/Tactic/Step/Step.lean |  8 ++++++++
 tests/lean/SpecTests/Coin.lean             | 15 +++------------
 2 files changed, 11 insertions(+), 12 deletions(-)

diff --git a/backends/lean/Aeneas/Tactic/Step/Step.lean b/backends/lean/Aeneas/Tactic/Step/Step.lean
index 66b304070..b59469f39 100644
--- a/backends/lean/Aeneas/Tactic/Step/Step.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Step.lean
@@ -1095,6 +1095,13 @@ def stepAsmsOrLookupTheorem (args : Args) (withTh : Option Expr) :
       let liftings : Array (Option LiftingInfo) := #[.none] ++ Array.map .some info.liftings
       for lifting in liftings do
         let pspecs : Array Name ← do
+          -- some liftings will use liftM to convert to a different monad, so we strip
+          -- liftM off of fExpr if it exists
+          let fExpr :=
+            let (liftM?, args) := fExpr.consumeMData.withApp (fun f args => (f, args))
+            if h: liftM?.isConstOf ``liftM ∧ args.size = 5
+            then args[4]
+            else fExpr
           let thNames ← stepAttr.find? -- looks up the theorem in a discrimination tree
             (match lifting with | .none => info.spec_name | .some l => l.from_statement)
             fExpr
@@ -1108,6 +1115,7 @@ def stepAsmsOrLookupTheorem (args : Args) (withTh : Option Expr) :
         -- Try the theorems one by one
         for pspec in pspecs do
           let pspecExpr ← Term.mkConst pspec
+          -- TODO: should this fExpr have the liftM stripped also?
           match ← tryApply info lifting args goalIsLet fExpr "pspec theorem" pspecExpr with
           | some goals => return (goals, .stepThm pspec)
           | none => pure ()
diff --git a/tests/lean/SpecTests/Coin.lean b/tests/lean/SpecTests/Coin.lean
index a19267201..ab3cf058b 100644
--- a/tests/lean/SpecTests/Coin.lean
+++ b/tests/lean/SpecTests/Coin.lean
@@ -166,26 +166,17 @@ theorem coinSpec_ret {α p} (x : α) : coinSpec p (ITree.ret x) ↔ p x := by
   def res : Result Nat := .ok 5
   def itreec : ITreeC Nat := res
 
-  -- #check bind
-
-  example : spec
-    (do let x ← 1#i32 + 2#i32
-        let y ← x + x
-        .ok x)
-    (fun z => z.val == 6)  := by
-    step?
-    sorry
 
   #check I32.add_spec
   -- set_option trace.Step true
 
-  example : coinSpec (fun z => z.val == 6)
+  theorem test : coinSpec (fun z => z.val == 6)
     (do let x ← 1#i32 + 2#i32
         let y ← x + x
         ITree.vis () fun (b : Bool) =>
         if b then ITree.ret y else ITree.ret 6#i32)  := by
-    step with (fun h1 h2 => spec_coinSpec (I32.add_spec h1 h2))
-    step with (fun h1 h2 => spec_coinSpec (I32.add_spec h1 h2))
+    step
+    step
     apply coinSpec.vis
     intros b
     cases b

From 292974e7ea01e55e888d9ca2d9766e8ad7221269 Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Wed, 24 Jun 2026 13:57:16 -0400
Subject: [PATCH 39/67] plan for result being itree

---
 backends/lean/Aeneas/Tactic/Step/Step.lean |  1 +
 tests/lean/SpecTests/Coin.lean             | 10 +++++-----
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/backends/lean/Aeneas/Tactic/Step/Step.lean b/backends/lean/Aeneas/Tactic/Step/Step.lean
index b59469f39..3b9920327 100644
--- a/backends/lean/Aeneas/Tactic/Step/Step.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Step.lean
@@ -1097,6 +1097,7 @@ def stepAsmsOrLookupTheorem (args : Args) (withTh : Option Expr) :
         let pspecs : Array Name ← do
           -- some liftings will use liftM to convert to a different monad, so we strip
           -- liftM off of fExpr if it exists
+          -- TODO: delete this whole liftM thing after i alter Result to use ITree
           let fExpr :=
             let (liftM?, args) := fExpr.consumeMData.withApp (fun f args => (f, args))
             if h: liftM?.isConstOf ``liftM ∧ args.size = 5
diff --git a/tests/lean/SpecTests/Coin.lean b/tests/lean/SpecTests/Coin.lean
index ab3cf058b..32eb7e604 100644
--- a/tests/lean/SpecTests/Coin.lean
+++ b/tests/lean/SpecTests/Coin.lean
@@ -77,11 +77,11 @@ theorem coinSpec_bind {α β} {k : α -> ITreeC β} {Pₖ : Post β} {m : ITreeC
   · simp only
     exists m, k
 
-  instance : MonadLift Result ITreeC where
-    monadLift r := match r with
-      | .fail _e => .div -- TODO
-      | .div => .div
-      | .ok x => .ret x
+instance : MonadLift Result ITreeC where
+  monadLift r := match r with
+    | .fail _e => .div -- TODO
+    | .div => .div
+    | .ok x => .ret x
 
 theorem spec_coinSpec {α} {x : Result α} {p: Post α} : spec x p → coinSpec p x := by
   intros s

From 9914155a0512d8320f1f76dd85302b632c988175 Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Wed, 24 Jun 2026 14:44:12 -0400
Subject: [PATCH 40/67] lifting for assumptions and `step with` + tests

---
 backends/lean/Aeneas/Tactic/Step/Step.lean | 52 ++++++++++++++++++++--
 1 file changed, 48 insertions(+), 4 deletions(-)

diff --git a/backends/lean/Aeneas/Tactic/Step/Step.lean b/backends/lean/Aeneas/Tactic/Step/Step.lean
index 66b304070..5af899eb3 100644
--- a/backends/lean/Aeneas/Tactic/Step/Step.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Step.lean
@@ -1029,6 +1029,28 @@ def tryApply (info : SpecInfo) (lifting : Option LiftingInfo) (args : Args) (isL
   | some res => pure (some res)
   | none => pure none
 
+/-- Given a theorem to be applied, find the lifting that can lift it to the given
+    spec statment represented by `info`
+    or `none` if it already is the correct spec statement
+-/
+def getLiftingForThm (info : SpecInfo) (thm : Expr) : MetaM (Option LiftingInfo) := do
+  let thTy ← inferType thm
+  let thTy ← normalizeLetBindings thTy
+  let thOutput ← forallTelescopeReducing thTy (fun _ out => return out)
+  let spec? := thOutput.consumeMData.withApp (fun f _ => f)
+  trace[Step] "spec? is {spec?}"
+  let name ← match spec? with
+    | Expr.const name _ => pure name
+    | _ =>
+      -- We don't want to error here to ensure it doesn't break cases where
+      -- no lifting occurs, but the theorem can't reduce
+      return .none
+  trace[Step] "name is {name}"
+  for lifting in info.liftings do
+    if lifting.from_statement == name then return lifting
+  if name == info.spec_name then return .none else
+  throwError "{name} is not a valid spec theorem"
+
 /-- Try to step with an assumption.
     Return `some` if we succeed, `none` otherwise.
 
@@ -1045,8 +1067,8 @@ where
   for decl in decls.reverse do
     trace[Step] "Trying assumption: {decl.userName} : {decl.type}"
     try
-      -- TODO: generalize to allow lifting assumptions
-      let goal ← stepWith info .none args isLet fExpr decl.toExpr
+      let lifting ← getLiftingForThm info decl.toExpr
+      let goal ← stepWith info lifting args isLet fExpr decl.toExpr
       return (some (goal, .localHyp decl))
     catch _ => continue
   pure none
@@ -1076,7 +1098,8 @@ def stepAsmsOrLookupTheorem (args : Args) (withTh : Option Expr) :
      Otherwise, lookup one. -/
   match withTh with
   | some th => do
-    let goals ← stepWith info .none args goalIsLet fExpr th
+    let lifting ← getLiftingForThm info th
+    let goals ← stepWith info lifting args goalIsLet fExpr th
     return (goals, .givenExpr th)
   | none =>
     -- Try all the assumptions one by one and if it fails try to lookup a theorem.
@@ -2203,7 +2226,28 @@ h1 : ∀ (i : ℕ) (x : i < s.length), s'[i] = 0#u32
     step
     simp [*]
 
-  -- test out using a spec theorem to prove a dspec
+  -- test lifting using `step with`
+  example : WP.dspec
+    (do let x ← 1#i32 + 2#i32
+        let y ← x + x
+        ok y) (fun z => z.val == 6) := by
+    step with I32.add_spec
+    step with I32.add_spec
+    simp [*]
+
+  -- test lifting an assumption
+  example (f : I32 → Result I32)
+    (h : ∀ x, (f x) ⦃fun y => y.val = 10⦄)
+    :
+    ( do let x ← f 1#i32
+         let y ← x + 1#i32
+         ok y) ⦃fun y => y.val = 11⦄div
+    := by
+    step
+    step
+    simp [*]
+
+  -- test using a spec theorem to prove a dspec
   example : WP.dspec
     (do let x ← simple_converge 5#i32
         let _y ← simple_converge 6#i32

From 27345a940f9c5d58e23c0470754f7df86f67778a Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Wed, 1 Jul 2026 12:54:09 -0400
Subject: [PATCH 41/67] some more itree tests

---
 tests/lean/SpecTests/ConcurrencyTest.lean | 54 ++++++++++++++++++++++
 tests/lean/SpecTests/NonDet.lean          | 55 +++++++++++++++++++++++
 tests/lean/SpecTests/SimpleState.lean     | 39 ++++++++++++++++
 3 files changed, 148 insertions(+)
 create mode 100644 tests/lean/SpecTests/ConcurrencyTest.lean
 create mode 100644 tests/lean/SpecTests/NonDet.lean
 create mode 100644 tests/lean/SpecTests/SimpleState.lean

diff --git a/tests/lean/SpecTests/ConcurrencyTest.lean b/tests/lean/SpecTests/ConcurrencyTest.lean
new file mode 100644
index 000000000..24cb6347b
--- /dev/null
+++ b/tests/lean/SpecTests/ConcurrencyTest.lean
@@ -0,0 +1,54 @@
+import Aeneas.Std.Primitives
+import Aeneas.Std.Delab
+import Std.Do
+import Aeneas.Std.Spec
+import Aeneas.Std.WP
+import Aeneas.Data.Coinductive.ITree
+import Aeneas.Data.Coinductive.Effect
+import Aeneas.Std
+import Std
+import Aeneas.Tactic.Step
+import Aeneas
+
+open Aeneas
+open Std Result WP Data Coinductive Effect Lean.Order
+
+def State := Nat
+
+inductive CEffect.I where
+| set : State → CEffect.I
+| get : CEffect.I
+| fork : CEffect.I
+-- there is an issue that both threads have to return the return type.
+-- maybe this is fine, and you can just bind an operation that returns Unit?
+-- i could make a generalized ITree definition which allows you to do stuff to the return type in Effect?
+
+def CEffect.O (i : CEffect.I) : Type :=
+  match i with
+  | .set _n => Unit
+  | .get => State
+  | .fork => Bool
+
+def CEffect : Effect := {
+  I := CEffect.I
+  O := CEffect.O
+}
+
+def ITreeS : Type → Type := ITree CEffect
+
+-- can just use coinductive props!
+coinductive sspec {α} (p : Post α) : (s : State → Prop) → (x : ITreeS α) → Prop where
+| ret : ∀ x s, p x → sspec p s (ITree.ret x)
+| set : ∀ k s n, s n → sspec p s k → sspec p s (ITree.vis (.set n) (fun _ => k))
+| get : ∀ k s, (∀ n, s n → sspec p s (k n)) → sspec p s (ITree.vis .get k)
+| fork : ∀ k s, sspec p s (k true) → sspec p s (k false) → sspec p s (ITree.vis .fork k)
+
+-- coinductive possible {α} : (T : Type) → State → (T → ITreeS α) → State → α → Prop where
+-- | ret : ∀ T x s t pool, pool t = .ret x → possible T s pool s x
+-- | fork : ∀ T pool s1 s2 a,
+--   possible (Option T) s1 (fun x => match x with | .some x => _ | .none => _) s2 a
+--   → possible T s1 pool s2 a
+
+def par {R} (t1 t2 : ITreeS R) : ITreeS R :=
+  match t1, t2 with
+  | x, y => _
diff --git a/tests/lean/SpecTests/NonDet.lean b/tests/lean/SpecTests/NonDet.lean
new file mode 100644
index 000000000..e98eafa17
--- /dev/null
+++ b/tests/lean/SpecTests/NonDet.lean
@@ -0,0 +1,55 @@
+import Aeneas.Std.Primitives
+import Aeneas.Std.Delab
+import Std.Do
+import Aeneas.Std.Spec
+import Aeneas.Std.WP
+import Aeneas.Data.Coinductive.ITree
+import Aeneas.Data.Coinductive.Effect
+import Aeneas.Std
+import Std
+import Aeneas.Tactic.Step
+import Aeneas
+
+open Aeneas
+open Std Result WP Data Coinductive Effect Lean.Order
+
+def State := Nat
+
+inductive CEffect.I where
+| set : State → CEffect.I
+| get : CEffect.I
+| choose : CEffect.I
+-- there is an issue that both threads have to return the return type.
+-- maybe this is fine, and you can just bind an operation that returns Unit?
+-- i could make a generalized ITree definition which allows you to do stuff to the return type in Effect?
+
+def CEffect.O (i : CEffect.I) : Type :=
+  match i with
+  | .set _n => Unit
+  | .get => State
+  | .choose => Bool
+
+def CEffect : Effect := {
+  I := CEffect.I
+  O := CEffect.O
+}
+
+def ITreeS : Type → Type := ITree CEffect
+
+-- can just use coinductive props!
+coinductive sspec {α} (p : Post α) : (s : State → Prop) → (x : ITreeS α) → Prop where
+| ret : ∀ x s, p x → sspec p s (ITree.ret x)
+| set : ∀ k s n, s n → sspec p s k → sspec p s (ITree.vis (.set n) (fun _ => k))
+| get : ∀ k s, (∀ n, s n → sspec p s (k n)) → sspec p s (ITree.vis .get k)
+| fork : ∀ k s, sspec p s (k true) → sspec p s (k false) → sspec p s (ITree.vis .choose k)
+
+-- coinductive possible {α} : (T : Type) → State → (T → ITreeS α) → State → α → Prop where
+-- | ret : ∀ T x s t pool, pool t = .ret x → possible T s pool s x
+-- | fork : ∀ T pool s1 s2 a,
+--   possible (Option T) s1 (fun x => match x with | .some x => _ | .none => _) s2 a
+--   → possible T s1 pool s2 a
+
+-- def choice {R : Type} (a b : ITreeS R) : ITreeS R := .vis .choose (fun b => if b then a else b)
+
+-- def par {R} (t1 t2 : ITreeS R) : ITreeS R :=
+  -- ITree.cases _ _ _ t1
diff --git a/tests/lean/SpecTests/SimpleState.lean b/tests/lean/SpecTests/SimpleState.lean
new file mode 100644
index 000000000..f07a27796
--- /dev/null
+++ b/tests/lean/SpecTests/SimpleState.lean
@@ -0,0 +1,39 @@
+import Aeneas.Std.Primitives
+import Aeneas.Std.Delab
+import Std.Do
+import Aeneas.Std.Spec
+import Aeneas.Std.WP
+import Aeneas.Data.Coinductive.ITree
+import Aeneas.Data.Coinductive.Effect
+import Aeneas.Std
+import Std
+import Aeneas.Tactic.Step
+import Aeneas
+
+open Aeneas
+open Std Result WP Data Coinductive Effect Lean.Order
+
+def State := Nat
+
+inductive SEffect.I where
+| set : State → SEffect.I
+| get : SEffect.I
+
+def SEffect.O (i : SEffect.I) : Type :=
+  match i with
+  | .set _n => Unit
+  | .get => State
+
+def SEffect : Effect := {
+   I := SEffect.I
+   O := SEffect.O
+}
+
+def ITreeS : Type → Type := ITree SEffect
+
+-- can just use coinductive props!
+coinductive sspec {α} (p : Post α) : (s : State → Prop) → (x : ITreeS α) → Prop where
+| ret : ∀ x s, p x → sspec p s (ITree.ret x)
+| set : ∀ k s n, s n → sspec p s k → sspec p s (ITree.vis (.set n) (fun _ => k))
+| get : ∀ k s, (∀ n, s n → sspec p s (k n)) → sspec p s (ITree.vis .get k)
+-- | vis : ∀ k, (∀ b, coinSpec p (k b)) → coinSpec p (ITree.vis () k)

From ec3b030622b803d2693800322f2bbad3dabdb0a4 Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Thu, 2 Jul 2026 15:32:19 -0400
Subject: [PATCH 42/67] some progress converting Result to ITree, errors

---
 .../lean/Aeneas/Data/Coinductive/CoInd.lean   |   2 +-
 .../lean/Aeneas/Data/Coinductive/ITree.lean   |  33 ++-
 backends/lean/Aeneas/Std/Primitives.lean      | 204 ++++++++++------
 backends/lean/Aeneas/Std/WP.lean              | 217 ++++++++++--------
 4 files changed, 286 insertions(+), 170 deletions(-)

diff --git a/backends/lean/Aeneas/Data/Coinductive/CoInd.lean b/backends/lean/Aeneas/Data/Coinductive/CoInd.lean
index 735142aef..d05231de8 100644
--- a/backends/lean/Aeneas/Data/Coinductive/CoInd.lean
+++ b/backends/lean/Aeneas/Data/Coinductive/CoInd.lean
@@ -34,7 +34,7 @@ inductive PFunctor.Obj (PF : PFunctor) (α : Type u) : Type u where
 
 /-- A **polynomial functor (PF)**: a functor `F` that is isomorphic to some
 polynomial functor `PFunctor`. Note that unlike Qpf in Mathlib and QPFTypes, this definition does *not* support quotients and instead requires an isomorphism to PFunctor. -/
-class PF (F : Type u → Type u) where
+class PF (F : Type u → Type v) where
   P : PFunctor
   unpack {α} : F α → P.Obj α
   pack {α} : P.Obj α → F α
diff --git a/backends/lean/Aeneas/Data/Coinductive/ITree.lean b/backends/lean/Aeneas/Data/Coinductive/ITree.lean
index 86f882813..7965fc79a 100644
--- a/backends/lean/Aeneas/Data/Coinductive/ITree.lean
+++ b/backends/lean/Aeneas/Data/Coinductive/ITree.lean
@@ -272,8 +272,6 @@ instance : MonoBind (ITree E) where
     · grind [monotone, PartialOrder.rel_refl]
     · intro _; grind
 
-#check itree_div_bind
-
 @[simp]
 theorem div_bind (t : S → ITree E R) :
   .div >>= t = .div := by simp [Bind.bind]
@@ -325,4 +323,35 @@ theorem interp_vis {F} (f : (i : E.I) → ITree F (E.O i)) i (k : E.O i → ITre
 -- #synth MonoBind (ITree E)
 -- #synth Bind (ITree E)
 
+#check CoInd.approx
+
+-- TODO: These have been added on top of original library. I'm not sure if there's a better
+-- way to do this yet.
+
+@[simp, grind .]
+theorem not_vis_ret {E} {α} {x : α} {e k} : ¬ ITree.ret (E := E) x = ITree.vis e k := by
+  intros eq
+  have eq := congrArg (fun i => i.approx 1) eq
+  simp at eq
+
+@[simp, grind .]
+theorem not_ret_div {E} {α} {x : α} : ¬ ITree.ret (E := E) x = ITree.div := by
+  intros eq
+  have eq := congrArg (fun i => i.approx 1) eq
+  simp at eq
+
+@[simp, grind .]
+theorem not_div_vis {E} {α} {e k} : ¬  @ITree.div α E = ITree.vis e k := by
+  intros eq
+  have eq := congrArg (fun i => i.approx 1) eq
+  simp at eq
+
+@[simp, grind .]
+theorem ret_inj {E} {α} {x y} : @ITree.ret α E x = ITree.ret y → x = y := by
+  intros eq
+  have eq := congrArg (fun i => i.approx 1) eq
+  simp at eq
+  grind only
+
+
 namespace Aeneas.Data.Coinductive
diff --git a/backends/lean/Aeneas/Std/Primitives.lean b/backends/lean/Aeneas/Std/Primitives.lean
index e7712225d..4d26c74f5 100644
--- a/backends/lean/Aeneas/Std/Primitives.lean
+++ b/backends/lean/Aeneas/Std/Primitives.lean
@@ -2,6 +2,8 @@ import Lean
 import Aeneas.Std.Global
 import Aeneas.Extract
 import AeneasMeta.BvEnumToBitVec
+import Aeneas.Data.Coinductive.ITree
+import Aeneas.Data.Coinductive.Effect
 
 namespace Aeneas
 
@@ -12,6 +14,7 @@ namespace Std
 -/
 
 open Lean Elab Command Term Meta
+open Aeneas.Data.Coinductive
 
 syntax (name := assert) "#assert" term: command
 
@@ -60,11 +63,43 @@ deriving Repr, BEq
 
 open Error
 
-inductive Result (α : Type u) where
-  | ok (v: α): Result α
-  | fail (e: Error): Result α
-  | div
-deriving Repr, BEq
+-- TODO: delete this
+-- inductive Result (α : Type u) where
+--   | ok (v: α): Result α
+--   | fail (e: Error): Result α
+--   | div
+-- deriving Repr, BEq
+
+inductive RustEffect.I : Type u where
+| fail : Error → RustEffect.I
+-- there is an issue that both threads have to return the return type.
+-- maybe this is fine, and you can just bind an operation that returns Unit?
+-- i could make a generalized ITree definition which allows you to do stuff to the return type in Effect?
+
+def RustEffect.O (i : RustEffect.I) : Type u :=
+  match i with
+  | .fail _ => PEmpty
+
+def RustEffect : Effect.{u} := {
+  I := RustEffect.I
+  O := RustEffect.O
+}
+
+def Result (α : Type u) : Type u := ITree RustEffect α
+
+instance : Monad Result := instMonadITree
+instance : LawfulMonad Result := instLawfulMonadITree
+
+def Result.ok {α} (a : α) : Result α := .ret a
+
+def Result.fail {α} (e : Error) : Result α := .vis (.fail e) PEmpty.elim
+
+def Result.div {α} : Result α := ITree.div
+
+example : ¬ Result.fail e1 = Result.ok x := by
+  simp [Result.fail, Result.ok]
+  --
+  sorry
 
 open Result
 
@@ -78,27 +113,36 @@ instance Result_Nonempty (α : Type u) : Nonempty (Result α) :=
 # Helpers
 -/
 
-@[global_simps]
-def ok? {α: Type u} (r: Result α): Bool :=
-  match r with
-  | ok _ => true
-  | fail _ | div => false
-
-def div? {α: Type u} (r: Result α): Bool :=
-  match r with
-  | div => true
-  | ok _ | fail _ => false
+-- TODO: where these ever used anywhere? not sure yet.
+-- @[global_simps]
+-- def ok? {α: Type u} (r: Result α): Bool :=
+--   ITree.cases
+--     (fun o =>
+--       match o with
+--       | .ok _ => true
+--       | .fail _ => false
+--     )
+--     false
+--     (fun _ _ => false)
+--     r
+
+-- def div? {α: Type u} (r: Result α): Bool :=
+--   ITree.cases
+--     (fun _ => false)
+--     true
+--     (fun _ _ => false)
+--     r
 
 def massert (b : Prop) [Decidable b] : Result Unit :=
   if b then ok () else fail assertionFailure
 
 macro "prove_eval_global" : tactic => `(tactic| simp (failIfUnchanged := false) only [global_simps] <;> first | apply Eq.refl | decide)
 
-@[global_simps]
-def eval_global {α: Type u} (x: Result α) (_: ok? x := by prove_eval_global) : α :=
-  match x with
-  | fail _ | div => by contradiction
-  | ok x => x
+-- @[global_simps]
+-- def eval_global {α: Type u} (x: Result α) (_: ok? x := by prove_eval_global) : α :=
+--   -- match x with
+--   -- | fail _ | div => by contradiction
+--   -- | ok x => x
 
 @[simp]
 def Result.ofOption {a : Type u} (x : Option a) (e : Error) : Result a :=
@@ -115,47 +159,78 @@ def Result.ofOption {a : Type u} (x : Option a) (e : Error) : Result a :=
 # Do-DSL Support
 -/
 
-def bind {α : Type u} {β : Type v} (x: Result α) (f: α → Result β) : Result β :=
-  match x with
-  | ok v  => f v
-  | fail v => fail v
-  | div => div
+-- TODO: in addition to type levels, does it cause issues that bind comes from the Monad instance?
+-- -- TODO: is it ok to not have β be at a different level `v`?
+-- def bind {α : Type u} {β : Type u} (x: Result α) (f: α → Result β) : Result β :=
+--   ITree.bind x f
+
+-- TODO: should this just be deleted to clean things up now, or left for backwards compatibility?
+def bind {α : Type u} {β : Type u} (x: Result α) (f: α → Result β) : Result β :=
+  @Bind.bind Result _ α β x f
 
--- Allows using Result in do-blocks
-instance : Bind Result where
-  bind := bind
+-- -- Allows using Result in do-blocks
+-- instance : Bind Result where
+  -- bind := bind
 
 -- Allows using pure x in do-blocks
 instance : Pure Result where
   pure := fun x => ok x
 
-@[simp] theorem bind_ok (x : α) (f : α → Result β) : bind (.ok x) f = f x := by simp [bind]
-@[simp] theorem bind_fail (x : Error) (f : α → Result β) : bind (.fail x) f = .fail x := by simp [bind]
-@[simp] theorem bind_div (f : α → Result β) : bind .div f = .div := by simp [bind]
+@[simp] theorem bind_ok (x : α) (f : α → Result β) : bind (.ok x) f = f x :=
+  by simp [bind, Bind.bind, ok]
+@[simp] theorem bind_fail (x : Error) (f : α → Result β) : bind (.fail x) f = .fail x :=
+  by simp [bind, Bind.bind, fail]
+     apply congrArg
+     funext x
+     contradiction
+
+@[simp] theorem bind_div (f : α → Result β) : bind .div f = .div := by simp [bind, Bind.bind, div]
 
 @[simp] theorem bind_tc_ok (x : α) (f : α → Result β) :
-  (do let y ← .ok x; f y) = f x := by simp [Bind.bind, bind]
+  (do let y ← .ok x; f y) = f x := by simp [Bind.bind, ok]
 
 @[simp] theorem bind_tc_fail (x : Error) (f : α → Result β) :
-  (do let y ← fail x; f y) = fail x := by simp [Bind.bind, bind]
+  (do let y ← fail x; f y) = fail x := by
+  simp [Bind.bind, bind, fail]
+  apply congrArg
+  funext x
+  contradiction
 
 @[simp] theorem bind_tc_div (f : α → Result β) :
-  (do let y ← div; f y) = div := by simp [Bind.bind, bind]
+  (do let y ← div; f y) = div := by simp [Bind.bind, bind, div]
 
 @[simp] theorem bind_assoc_eq {a b c : Type u}
   (e : Result a) (g :  a → Result b) (h : b → Result c) :
   (Bind.bind (Bind.bind e g) h) =
-  (Bind.bind e (λ x => Bind.bind (g x) h)) := by
-  simp [Bind.bind]
-  cases e <;> simp
-
-@[simp]
-def bind_eq_iff (x : Result α) (y y' : α → Result β) :
-  ((Bind.bind x y) = (Bind.bind x y')) ↔
-  ∀ v, x = ok v → y v = y' v := by
-  cases x <;> simp_all
-
-instance : Monad Result where
+  (Bind.bind e (λ x => Bind.bind (g x) h)) := by apply bind_assoc
+
+-- TODO: i think that this is false for the ITree version?
+-- because if x = `vis _ k`, then the rhs of the ↔ says exactly nothing,
+-- and the lhs says that y = y'.
+-- @[simp]
+-- def bind_eq_iff (x : Result α) (y y' : α → Result β) :
+--   ((Bind.bind x y) = (Bind.bind x y')) ↔
+--   ∀ v, x = ok v → y v = y' v := by
+  -- -- cases x <;> simp_all
+  -- constructor
+  -- · intros
+  --   subst_vars
+  --   simp at *
+  --   assumption
+  -- · intros h
+  --   revert h
+  --   refine ITree.cases ?_ ?_ ?_ x
+  --   ·
+  --     intros r h
+  --     refine (.trans (pure_bind _ _) (.trans ?_ (Eq.symm (pure_bind _ _))))
+  --     apply h
+  --     simp [pure]
+  --     rfl
+  --   · intros h
+  --     simp [bind, itree_div_bind]
+  --   ·
+  --     intros
+  --     sorry
 
 /-!
 # Partial Fixpoint
@@ -165,19 +240,9 @@ section Order
 
 open Lean.Order
 
-instance : PartialOrder (Result α) := inferInstanceAs (PartialOrder (FlatOrder .div))
-noncomputable instance : CCPO (Result α) where
-  has_csup hc := FlatOrder.instCCPO (b := Result.div).has_csup hc
-noncomputable instance : MonoBind Result where
-  bind_mono_left h := by
-    cases h
-    · exact FlatOrder.rel.bot
-    · exact FlatOrder.rel.refl
-  bind_mono_right h := by
-    cases ‹Result _›
-    · exact h _
-    · exact FlatOrder.rel.refl
-    · exact FlatOrder.rel.refl
+instance : PartialOrder (Result α) := instPartialOrderCoIndOfInhabitedPUnit _
+noncomputable instance : CCPO (Result α) := instCCPOCoIndOfInhabitedPUnit _
+noncomputable instance : MonoBind Result := instMonoBindITree
 
 end Order
 
@@ -277,14 +342,12 @@ inductive ControlFlow (α : Type u) (β : Type v) where
   | done (v : β) -- break
 deriving Repr, BEq
 
-def loop {α : Type u} {β : Type v} (body : α → Result (ControlFlow α β)) (x : α) : Result β := do
-  match body x with
-  | ok r =>
-    match r with
-    | ControlFlow.cont x => loop body x
-    | ControlFlow.done x => ok x
-  | fail e => fail e
-  | div => div
+-- TODO: will the fact that β now has level u instead of v cause problems?
+def loop {α : Type u} {β : Type u} (body : α → Result (ControlFlow α β)) (x : α) : Result β := do
+  let r ← body x
+  match r with
+  | ControlFlow.cont x => loop body x
+  | ControlFlow.done x => ok x
 partial_fixpoint
 
 /-!
@@ -301,13 +364,16 @@ instance SubtypeLawfulBEq [BEq α] (p : α → Prop) [LawfulBEq α] : LawfulBEq
   eq_of_beq {a b} h := by cases a; cases b; simp_all [BEq.beq]
   rfl := by intro a; cases a; simp [BEq.beq]
 
+-- TODO: will this make sense, given that .vis now returns none?
 /- A helper function that converts failure to none and success to some
    TODO: move up to Core module? -/
 def Option.ofResult {a : Type u} (x : Result a) :
   Option a :=
-  match x with
-  | ok x => some x
-  | _ => none
+  ITree.cases
+    .some
+    .none
+    (fun _ _ => .none)
+    x
 
 /-!
 # bv_decide
diff --git a/backends/lean/Aeneas/Std/WP.lean b/backends/lean/Aeneas/Std/WP.lean
index e6971d334..002d672a3 100644
--- a/backends/lean/Aeneas/Std/WP.lean
+++ b/backends/lean/Aeneas/Std/WP.lean
@@ -3,10 +3,13 @@ import Aeneas.Std.Delab
 import Std.Do
 import Aeneas.Tactic.Solver.Grind.Init
 import Aeneas.Std.Spec
+import Aeneas.Data.Coinductive.ITree
+import Aeneas.Data.Coinductive.Effect
 
 namespace Aeneas.Std.WP
 
 open Std Result
+open Aeneas.Data.Coinductive
 
 def Post α := (α -> Prop)
 def Pre := Prop
@@ -15,29 +18,47 @@ def Wp α := Post α → Pre
 
 def wp_return (x:α) : Wp α := fun p => p x
 
-def theta (m:Result α) : Wp α :=
-  match m with
-  | ok x => wp_return x
-  | fail _ => fun _ => False
-  | div => fun _ => False
+-- TODO: clean this up if i end up going with the coinductive one
+-- def theta (m:Result α) : Wp α :=
+--   match m with
+--   | ok x => wp_return x
+--   | fail _ => fun _ => False
+--   | div => fun _ => False
 
-def spec {α} (x:Result α) (p:Post α) :=
-  theta x p
+-- def spec {α} (x:Result α) (p:Post α) :=
+--   theta x p
 
-def dspec {α} (x:Result α) (p:Post α) :=
-  match x with
-  | ok x => p x
-  | fail _ => False
-  | div => True
+coinductive spec' {α} (p : Post α) : (x : Result α) → Prop where
+| ret : ∀ x, p x → spec' p (ITree.ret x)
+-- | vis : ∀ k, (∀ b, spec p (k b)) → spec p (ITree.vis () k)
+-- | fail : ∀ k, (∀ b, spec p (k b)) → spec p (ITree.vis () k)
+
+def spec {α} p x := @spec' α x p
+
+-- TODO: clean up
+-- def dspec {α} (x:Result α) (p:Post α) :=
+--   match x with
+--   | ok x => p x
+--   | fail _ => False
+--   | div => True
+coinductive dspec' {α} (p : Post α) : (x : Result α) → Prop where
+| ret : ∀ x, p x → dspec' p (ITree.ret x)
+| div : dspec' p div
+
+def dspec {α} p x := @dspec' α x p
 
 theorem spec_dspec (α) (x : Result α) (p: Post α) : spec x p → dspec x p := by
   intros s
   simp [spec, dspec] at *
-  cases x <;> simp at * <;> assumption
-theorem dspec_admissible {α} (p : Post α )
-  : Lean.Order.admissible (fun x => dspec x p) := by
-  apply Lean.Order.admissible_flatOrder
-  simp [dspec]
+  cases s
+  apply dspec'.ret
+  assumption
+
+-- TODO: do i need this?
+-- theorem dspec_admissible {α} (p : Post α )
+--   : Lean.Order.admissible (fun x => dspec x p) := by
+--   apply Lean.Order.admissible_flatOrder
+--   simp [dspec]
 
 /-- Variant of `uncurry` used to decompose tuples in post-conditions.
 
@@ -56,13 +77,17 @@ def uncurry' {α β} (p : α → β → Prop) : α × β → Prop :=
 @[defeq] theorem uncurry'_eq x (p : α → β → Prop) : uncurry' p x = p x.fst x.snd := by simp [uncurry']
 
 @[simp, grind =, agrind =]
-theorem spec_ok (x : α) : spec (ok x) p ↔ p x := by simp [spec, theta, wp_return]
+theorem spec_ok (x : α) : spec (ok x) p ↔ p x := by
+  simp [spec, spec', ok]
+  grind
 
 @[simp, grind =, agrind =]
-theorem spec_fail (e : Error) : spec (fail e) p ↔ False := by simp [spec, theta]
+theorem spec_fail (e : Error) : spec (fail e) p ↔ False := by
+  grind only [spec', spec, fail, not_vis_ret]
 
 @[simp, grind =, agrind =]
-theorem spec_div : spec div p ↔ False := by simp [spec, theta]
+theorem spec_div : spec div p ↔ False := by
+  grind only [spec, div, spec', not_ret_div]
 
 /-! ### `spec_*` for tuple posts
 
@@ -85,22 +110,18 @@ theorem spec_mono {α} {P₁ : Post α} {m : Result α} {P₀ : Post α} (h : sp
   (∀ x, P₀ x → P₁ x) → spec m P₁ := by
   intros HMonPost
   revert h
-  unfold spec theta wp_return
+  simp [spec, spec']
   cases m <;> grind
 
 theorem spec_bind {α β} {k : α -> Result β} {Pₖ : Post β} {m : Result α} {Pₘ : Post α} :
   spec m Pₘ →
   (forall x, Pₘ x → spec (k x) Pₖ) →
-  spec (Std.bind m k) Pₖ := by
+  spec (m >>= k) Pₖ := by
   intro Hm Hk
-  cases m
-  · simp
-    apply Hk
-    apply Hm
-  · simp
-    apply Hm
-  · simp
-    apply Hm
+  simp [spec] at *
+  cases Hm
+  simp [Bind.bind]
+  grind only
 
 /-- Small helper to currify functions -/
 def curry {α β γ} (f : α × β → γ) (x : α) : β → γ := fun y => f (x, y)
@@ -128,8 +149,8 @@ theorem spec_mono' {α} {P₁ : Post α} {m : Result α} {P₀ : Post α} (h : s
   qimp P₀ P₁ → spec m P₁ := by
   intros HMonPost
   revert h
-  unfold spec theta wp_return
-  cases m <;> grind [qimp]
+  unfold spec spec'
+  grind only [qimp]
 
 /-- Implication of a `spec` predicate with quantifier -/
 def qimp_spec {α β} (P : α → Prop) (k : α → Result β) (Q : β → Prop) : Prop :=
@@ -141,14 +162,10 @@ theorem spec_bind' {α β} {k : α -> Result β} {Pₖ : Post β} {m : Result α
   (qimp_spec Pₘ k Pₖ) →
   spec (Std.bind m k) Pₖ := by
   intro Hm Hk
-  cases m
-  · simp
-    apply Hk
-    apply Hm
-  · simp
-    apply Hm
-  · simp
-    apply Hm
+  simp [spec, spec', bind, Bind.bind, qimp_spec] at *
+  rcases Hm with ⟨x, px, rfl⟩
+  simp only [itree_ret_bind]
+  grind only
 
 /-- We use this lemma to decompose nested `uncurry'` predicates into a sequence of universal quantifiers. -/
 @[simp]
@@ -181,7 +198,8 @@ theorem qimp_spec_exists {α β γ} (P : γ → α → Prop) (k : α → Result
 
 theorem spec_equiv_exists (m:Result α) (P:Post α) :
   spec m P ↔ (∃ y, m = ok y ∧ P y) := by
-  cases m <;> simp [spec, theta, wp_return]
+  simp [spec, spec', ok]
+  grind only
 
 theorem spec_imp_exists {m:Result α} {P:Post α} :
   spec m P → (∃ y, m = ok y ∧ P y) := by
@@ -196,8 +214,8 @@ theorem dspec_mono' {α} {P₁ : Post α} {m : Result α} {P₀ : Post α} (h :
   qimp P₀ P₁ → dspec m P₁ := by
   intros HMonPost
   revert h
-  unfold dspec
-  cases m <;> grind [qimp]
+  unfold dspec dspec'
+  grind only [qimp]
 
 /-- Implication of a `dspec` predicate with quantifier -/
 def qimp_dspec {α β} (P : α → Prop) (k : α → Result β) (Q : β → Prop) : Prop :=
@@ -208,14 +226,12 @@ theorem dspec_bind' {α β} {k : α -> Result β} {Pₖ : Post β} {m : Result 
   (qimp_dspec Pₘ k Pₖ) →
   dspec (Std.bind m k) Pₖ := by
   intro Hm Hk
-  cases m
-  · simp
-    apply Hk
-    apply Hm
-  · simp
-    apply Hm
-  · simp
-    apply Hm
+  simp [dspec, dspec', bind, Bind.bind, qimp_dspec] at *
+  rcases Hm with ⟨h, Hm⟩
+  · rcases Hm with ⟨x, px, rfl⟩
+    simp only [itree_ret_bind]
+    grind only
+  · simp [*, div]
 
 @[simp]
 def qimp_dspec_uncurry' {α₀ α₁ β} (P : α₀ → α₁ → Prop) (k : α₀ × α₁ → Result β) (Q : β → Prop) :
@@ -237,7 +253,9 @@ def qimp_dspec_iff {α β} (P : α → Prop) (k : α → Result β) (Q : β →
   simp [qimp_dspec, imp]
 
 @[simp, grind =, agrind =]
-theorem dspec_ok (x : α) : dspec (ok x) p ↔ p x := by simp [dspec]
+theorem dspec_ok (x : α) : dspec (ok x) p ↔ p x := by
+  simp [dspec, dspec', ok, div]
+  grind
 
 theorem dspec_imp_forall {m:Result α} {P:Post α} :
   dspec m P → (∀ y, m = ok y → P y) := by
@@ -753,50 +771,53 @@ namespace Aeneas.Std.WP
 open Std Result
 open Std.Do
 
-instance Result.instWP : WP Result.{u} (.except (ULift Error) (.except PUnit .pure)) where
-  wp x := {
-    trans Q := match x with | .ok a => Q.1 a | .fail e => Q.2.1 (ULift.up e) | .div => Q.2.2.1 .unit
-    conjunctiveRaw Q₁ Q₂ := by
-      apply SPred.bientails.of_eq
-      cases x <;> simp
-  }
-
-instance : LawfulMonad Result where
-    map_const := by intros; rfl
-    id_map := by intros _ x; cases x <;> rfl
-    seqLeft_eq := by intros _ _ x y; cases x <;> cases y <;> rfl
-    seqRight_eq := by intros _ _ x y; cases x <;> cases y <;> rfl
-    pure_seq := by intros _ _ _ x; cases x <;> rfl
-    pure_bind := by intros; rfl
-    bind_pure_comp := by intros; rfl
-    bind_map := by intros; rfl
-    bind_assoc := by intros _ _ _ x _ _; cases x <;> rfl
-
-instance Result.instWPMonad : WPMonad Result (.except (ULift Error) (.except PUnit .pure)) where
-  wp_pure a := by apply PredTrans.ext; intro Q; simp [PredTrans.apply, wp, WP.wp]; rfl
-  wp_bind x f := by apply PredTrans.ext; intro Q; simp [PredTrans.apply, wp, WP.wp]; cases x <;> rfl
-
-theorem Result.of_wp {α : Type u} {x : Result α} (P : Result α → Prop) :
-    (⊢ₛ wp⟦x⟧ (fun a => ⌜P (.ok a)⌝,
-                  fun e => ⌜P (.fail e.down)⌝,
-                  fun .unit => ⌜P .div⌝, .unit)) → P x := by
-  intro hspec
-  simp only [WP.wp, PredTrans.apply] at hspec
-  split at hspec <;> simp_all
-
-/-- Lift an Aeneas step spec to an mvcgen-compatible `Triple`. -/
-theorem spec_to_mvcgen {α : Type u} {x : Result α} {Q : α → Prop}
-    (h : spec x Q) :
-    ⦃ ⌜ True ⌝ ⦄ x ⦃ ⇓ r => ⌜ Q r ⌝ ⦄ := by
-  obtain ⟨v, hx, hQv⟩ := spec_imp_exists h
-  subst hx
-  simp [Triple, WP.wp, PredTrans.apply, hQv]
-
-theorem dspec_to_mvcgen {α : Type u} {x : Result α} {Q : α → Prop}
-    (h : dspec x Q) :
-    ⦃ ⌜ ¬ x = .div ⌝ ⦄ x ⦃ ⇓ r => ⌜ Q r ⌝ ⦄ := by
-  simp [Triple, WP.wp, PredTrans.apply, SPred.pure]
-  cases x <;> simp [*, dspec] at * <;> trivial
+-- TODO: do we expect mvcgen to work with Result if we include arbitrary effects?
+-- what do we lose by getting rid of this stuff?
+-- instance Result.instWP : WP Result.{u} (.except (ULift Error) (.except PUnit .pure)) where
+--   wp x := {
+--     trans Q := match x with | .ok a => Q.1 a | .fail e => Q.2.1 (ULift.up e) | .div => Q.2.2.1 .unit
+--     conjunctiveRaw Q₁ Q₂ := by
+--       apply SPred.bientails.of_eq
+--       cases x <;> simp
+--   }
+
+
+-- instance : LawfulMonad Result where
+--     map_const := by intros; rfl
+--     id_map := by intros _ x; cases x <;> rfl
+--     seqLeft_eq := by intros _ _ x y; cases x <;> cases y <;> rfl
+--     seqRight_eq := by intros _ _ x y; cases x <;> cases y <;> rfl
+--     pure_seq := by intros _ _ _ x; cases x <;> rfl
+--     pure_bind := by intros; rfl
+--     bind_pure_comp := by intros; rfl
+--     bind_map := by intros; rfl
+--     bind_assoc := by intros _ _ _ x _ _; cases x <;> rfl
+
+-- instance Result.instWPMonad : WPMonad Result (.except (ULift Error) (.except PUnit .pure)) where
+--   wp_pure a := by apply PredTrans.ext; intro Q; simp [PredTrans.apply, wp, WP.wp]; rfl
+--   wp_bind x f := by apply PredTrans.ext; intro Q; simp [PredTrans.apply, wp, WP.wp]; cases x <;> rfl
+
+-- theorem Result.of_wp {α : Type u} {x : Result α} (P : Result α → Prop) :
+--     (⊢ₛ wp⟦x⟧ (fun a => ⌜P (.ok a)⌝,
+--                   fun e => ⌜P (.fail e.down)⌝,
+--                   fun .unit => ⌜P .div⌝, .unit)) → P x := by
+--   intro hspec
+--   simp only [WP.wp, PredTrans.apply] at hspec
+--   split at hspec <;> simp_all
+
+-- /-- Lift an Aeneas step spec to an mvcgen-compatible `Triple`. -/
+-- theorem spec_to_mvcgen {α : Type u} {x : Result α} {Q : α → Prop}
+--     (h : spec x Q) :
+--     ⦃ ⌜ True ⌝ ⦄ x ⦃ ⇓ r => ⌜ Q r ⌝ ⦄ := by
+--   obtain ⟨v, hx, hQv⟩ := spec_imp_exists h
+--   subst hx
+--   simp [Triple, WP.wp, PredTrans.apply, hQv]
+
+-- theorem dspec_to_mvcgen {α : Type u} {x : Result α} {Q : α → Prop}
+--     (h : dspec x Q) :
+--     ⦃ ⌜ ¬ x = .div ⌝ ⦄ x ⦃ ⇓ r => ⌜ Q r ⌝ ⦄ := by
+--   simp [Triple, WP.wp, PredTrans.apply, SPred.pure]
+--   cases x <;> simp [*, dspec] at * <;> trivial
 
 end Aeneas.Std.WP
 
@@ -875,7 +896,7 @@ theorem forall_unit {p : Prop} : (Unit → p) ↔ p := by simp
       ``Std.WP.uncurry'_eq, ``Std.WP.uncurry'_pair,
       ``Std.WP.imp_exists_iff,
       ``forall_unit, ``true_imp_iff]
-    to_mvcgen := .some ``Std.WP.spec_to_mvcgen
+    to_mvcgen := .none -- .some ``Std.WP.spec_to_mvcgen
     liftings := #[]
   }
 
@@ -899,7 +920,7 @@ theorem forall_unit {p : Prop} : (Unit → p) ↔ p := by simp
       ``Std.WP.uncurry'_eq, ``Std.WP.uncurry'_pair,
       ``Std.WP.imp_exists_iff,
       ``forall_unit, ``true_imp_iff]
-    to_mvcgen := .some ``Std.WP.dspec_to_mvcgen
+    to_mvcgen := .none -- .some ``Std.WP.dspec_to_mvcgen
     liftings := #[
       { from_statement := ``Std.WP.spec
         conversion_thm := ``Std.WP.spec_dspec

From 2e948ba04bb4b30ed059771acfa9ac70758892d7 Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Fri, 3 Jul 2026 16:27:21 -0400
Subject: [PATCH 43/67] some progress on various fronts

---
 .../lean/Aeneas/Data/Coinductive/CoInd.lean   |  16 +-
 .../lean/Aeneas/Data/Coinductive/ITree.lean   | 216 ++++++++++++++----
 backends/lean/Aeneas/Std/Core/Ops.lean        |   8 +-
 backends/lean/Aeneas/Std/Primitives.lean      |  58 +++--
 .../lean/Aeneas/Std/PrimitivesLemmas.lean     |   2 +-
 backends/lean/Aeneas/Std/Scalar/Core.lean     |  73 +++++-
 backends/lean/Aeneas/Std/Scalar/Ops/Mul.lean  |   3 +-
 backends/lean/Aeneas/Std/Scalar/Ops/Neg.lean  |   5 +-
 backends/lean/Aeneas/Std/WP.lean              |  84 ++++---
 9 files changed, 353 insertions(+), 112 deletions(-)

diff --git a/backends/lean/Aeneas/Data/Coinductive/CoInd.lean b/backends/lean/Aeneas/Data/Coinductive/CoInd.lean
index d05231de8..ed879fa4f 100644
--- a/backends/lean/Aeneas/Data/Coinductive/CoInd.lean
+++ b/backends/lean/Aeneas/Data/Coinductive/CoInd.lean
@@ -18,16 +18,16 @@ However, the technical implementation differs and we currently do not support qu
 
 /-- A polynomial functor, given by a set of "shapes" `In` and for each shape `i`, a type `Out i`
 describing the outputs. The polynomial functor it represents maps `α` to `Σ i : In, Out i → α`. -/
-structure PFunctor : Type (u + 1) where
+structure PFunctor : Type ((max u v) + 1) where
   In : Type u
-  Out : In → Type u
+  Out : In → Type v
 
 /-- The application of a polynomial functor `PF` to a type `α`: a shape `i : PF.In`
 together with a function filling each position `PF.Out i → α`.
 
 The `obj_dummy` constructor is a technical device to prevent Lean from eta-expanding
 this type. -/
-inductive PFunctor.Obj (PF : PFunctor) (α : Type u) : Type u where
+inductive PFunctor.Obj (PF : PFunctor.{u, v}) (α : Type w) : Type (max u v w) where
   | obj (i : PF.In) (k : PF.Out i → α)
   -- Necessary to avoid eta expansion on this type.
   | obj_dummy (e : Empty)
@@ -35,7 +35,7 @@ inductive PFunctor.Obj (PF : PFunctor) (α : Type u) : Type u where
 /-- A **polynomial functor (PF)**: a functor `F` that is isomorphic to some
 polynomial functor `PFunctor`. Note that unlike Qpf in Mathlib and QPFTypes, this definition does *not* support quotients and instead requires an isomorphism to PFunctor. -/
 class PF (F : Type u → Type v) where
-  P : PFunctor
+  P : PFunctor.{a, b}
   unpack {α} : F α → P.Obj α
   pack {α} : P.Obj α → F α
   unpack_pack {α} (x : F α) : pack (unpack x) = x
@@ -361,6 +361,7 @@ instance [Inhabited (F PUnit)] : PartialOrder (CoInd F) where
     intro c1 c2 h1 h2
     ext n
     induction n generalizing c1 c2 h1 h2; rfl
+    rename_i n ih -- TODO: make this not suck
     unfold CoInd.le at h1 h2
     cases h1 with
     | inl h1 => grind [CoInd.le.coherent_bot_eq]
@@ -371,6 +372,7 @@ instance [Inhabited (F PUnit)] : PartialOrder (CoInd F) where
     cases h1
     cases h2
     simp_all
+    rename_i _ _ _ _ le1 _ _ _ _ _ le2 _ _ -- TODO: this also
     rename (_ ∧ _) => eq
     cases eq
     subst_eqs
@@ -378,7 +380,11 @@ instance [Inhabited (F PUnit)] : PartialOrder (CoInd F) where
     rw [<-unfold_fold _ c2]
     unfold CoInd.fold
     simp [PF.map, *]
-    grind
+    congr
+    funext x
+    apply ih
+    · apply le1
+    · apply le2
 
 /-!
 ## CCPO
diff --git a/backends/lean/Aeneas/Data/Coinductive/ITree.lean b/backends/lean/Aeneas/Data/Coinductive/ITree.lean
index 7965fc79a..655269b05 100644
--- a/backends/lean/Aeneas/Data/Coinductive/ITree.lean
+++ b/backends/lean/Aeneas/Data/Coinductive/ITree.lean
@@ -10,17 +10,18 @@ open Lean.Order
 -- which uses the traditional tau constructor, this version instead has a bottom element
 -- div. tau is not needed to guard recursion, since we are using partial_fixpoint
 -- instead of coinduction.
-inductive ITreeF (E : Effect.{u}) (R : Type v) (ITree : Type w) : Type (max u v w) where
+inductive ITreeF.{u,v} (E : Effect.{u}) (R : Type v) (ITree : Type (max u v)) : Type (max u v) where
   | ret (r : R)
   | div -- equivalent to infinite tau stream from traditional ITrees
   | vis (i : E.I) (k : E.O i → ITree)
 
-inductive ITreeF.In (E : Effect.{u}) (R : Type u) : Type u where
+
+inductive ITreeF.In (E : Effect.{u}) (R : Type v) : Type (max u v) where
   | ret (r : R)
   | div
   | vis (i : E.I)
 
-instance (E : Effect.{u}) (R : Type u) : PF (ITreeF E R) where
+instance (E : Effect.{u}) (R : Type v) : PF (ITreeF E R) where
   P := ⟨ITreeF.In E R, fun
     | .ret _ => PEmpty
     | .div => PEmpty
@@ -36,10 +37,10 @@ instance (E : Effect.{u}) (R : Type u) : PF (ITreeF E R) where
   unpack_pack := by rintro _ ⟨⟩ <;> simp
   pack_unpack := by rintro _ (⟨⟨⟩, _⟩ | ⟨⟨⟩⟩) <;> simp <;> funext x <;> cases x
 
-abbrev ITree (E : Effect.{u}) (R : Type u) : Type u := CoInd (ITreeF E R)
+abbrev ITree.{u, v} (E : Effect.{v}) (R : Type u) : Type (max u v) := CoInd (ITreeF E R)
 abbrev ITreeN (E : Effect.{u}) (R : Type u) (n : Nat) : Type u := CoIndN (ITreeF E R) n
 
-variable {E : Effect.{u}} {R : Type u}
+variable {E : Effect.{v}} {R : Type u}
 
 def ITree.fold (t : ITreeF E R (ITree E R)) : ITree E R := CoInd.fold _ t
 def ITree.ret (r : R) : ITree E R := ITree.fold (.ret r)
@@ -160,7 +161,7 @@ theorem ITree.le_unfold (t1 t2 : ITree E R) :
         grind
 
 -- use Bind.bind instead
-def ITree.bind {S} (t1 : ITree E R) (t2 : R → ITree E S) :=
+def ITree.bind.{w} {S : Type w} (t1 : ITree E R) (t2 : R → ITree E S) :=
   match t1.unfold with
   | .ret r => t2 r
   | .div => .div
@@ -285,73 +286,208 @@ def Effect.trigger (E₁ : Effect.{u}) {E₂ : Effect.{u}} [E₁ -< E₂] (i : E
   let ⟨i₂, f⟩ := (Subeffect.map i);
   ITree.vis i₂ (λ x => return (f x))
 
-def ITree.iter {α β} (t : α → ITree E (α ⊕ β)) : α → ITree E β :=
+-- TODO: make β have level b instead of a
+def ITree.iter {α : Type a} {β : Type b} (t : α → ITree E (α ⊕ β)) : α → ITree E β :=
   λ a => do
-    match ← (t a) with
+    bind (t a) λ val =>
+    match val with
     | .inl a => .iter t a
     | .inr b => return b
 partial_fixpoint
 
-def ITree.interp {F} (f : (i : E.I) → ITree F (E.O i)) : ITree E R → ITree F R :=
-  ITree.iter λ t =>
-    match t.unfold with
-    | .ret r => return (.inr r)
-    | .div => ITree.div
-    | .vis i k => f i >>= λ o => return (.inl (k o))
-
-@[simp]
-theorem interp_pure {F} (f : (i : E.I) → ITree F (E.O i)) (r : R) :
-  ITree.interp f (pure r) = pure r := by
-    unfold ITree.interp ITree.iter
-    simp
-
-@[simp]
-theorem interp_div {F} (f : (i : E.I) → ITree F (E.O i)) :
-  ITree.interp (R:=R) f .div = .div := by
-    unfold ITree.interp
-    rw (occs := [1]) [ITree.iter]
-    simp
-
-@[simp]
-theorem interp_vis {F} (f : (i : E.I) → ITree F (E.O i)) i (k : E.O i → ITree E R) :
-  ITree.interp f (ITree.vis i k) = (f i) >>= λ o => (ITree.interp f (k o)) := by
-    unfold ITree.interp
-    rw (occs := [1]) [ITree.iter]
-    simp
+-- TODO: do we need interp?
+-- def ITree.interp {F : Effect.{w}} (f : (i : E.I) → ITree F (E.O i)) : ITree E R → ITree F R :=
+--   ITree.iter λ t =>
+--     match t.unfold with
+--     | .ret r => return (.inr r)
+--     | .div => ITree.div
+--     -- | .vis i k => f i >>= λ o => return (.inl (k o))
+--     | .vis i k => bind (f i) λ o => return (.inl (k o))
+
+-- @[simp]
+-- theorem interp_pure {F} (f : (i : E.I) → ITree F (E.O i)) (r : R) :
+--   ITree.interp f (pure r) = pure r := by
+--     unfold ITree.interp ITree.iter ITree.bind
+--     simp
+
+-- @[simp]
+-- theorem interp_div {F} (f : (i : E.I) → ITree F (E.O i)) :
+--   ITree.interp (R:=R) f .div = .div := by
+--     unfold ITree.interp
+--     rw (occs := [1]) [ITree.iter]
+--     simp
+
+-- -- #synth LawfulMonad (ITree E)
+-- -- #check instLawfulMonadITree.bind_assoc
+-- @[simp]
+-- theorem interp_vis {F : Effect.{v}} (f : (i : E.I) → ITree F (E.O i)) i (k : E.O i → ITree E R) :
+--   ITree.interp f (ITree.vis i k) = (f i) >>= (λ o => (ITree.interp f (k o))) := by
+--     unfold ITree.interp
+--     rw (occs := [1]) [ITree.iter]
+--     simp
+--     rw [instLawfulMonadITree.bind_assoc]
+--     simp [(Eq.refl _ : ITree.bind = Bind.bind)]
+--     rw [bind_assoc]
+    --
 
 -- #synth CCPO (ITree E R)
 -- #synth MonoBind (ITree E)
 -- #synth Bind (ITree E)
 
-#check CoInd.approx
-
 -- TODO: These have been added on top of original library. I'm not sure if there's a better
 -- way to do this yet.
 
-@[simp, grind .]
+-- @[simp, grind .]
 theorem not_vis_ret {E} {α} {x : α} {e k} : ¬ ITree.ret (E := E) x = ITree.vis e k := by
   intros eq
   have eq := congrArg (fun i => i.approx 1) eq
   simp at eq
 
-@[simp, grind .]
+-- @[simp, grind .]
 theorem not_ret_div {E} {α} {x : α} : ¬ ITree.ret (E := E) x = ITree.div := by
   intros eq
   have eq := congrArg (fun i => i.approx 1) eq
   simp at eq
 
-@[simp, grind .]
+-- @[simp, grind .]
 theorem not_div_vis {E} {α} {e k} : ¬  @ITree.div α E = ITree.vis e k := by
   intros eq
   have eq := congrArg (fun i => i.approx 1) eq
   simp at eq
 
-@[simp, grind .]
+-- @[simp, grind .]
 theorem ret_inj {E} {α} {x y} : @ITree.ret α E x = ITree.ret y → x = y := by
   intros eq
   have eq := congrArg (fun i => i.approx 1) eq
   simp at eq
   grind only
 
+#check ITree.cases
+#check Eq.rec
+
+def Eqrec2.{w, u_1} {α : Sort u_1} {a' : α} {motive : (a : α) → a' = a → Sort w}
+  (refl : motive a' (Eq.refl a')) {a'1 : α}
+  (t : a' = a'1) : motive a'1 t := by
+  subst t
+  apply refl
+
+def Eqrec3.{w, u_1} {α : Sort u_1} {a' : α} {motive : (a : α) → a' = a → Sort w}
+  {a'1 : α}
+  (t : a' = a'1)
+  (refl : motive a'1 t)
+  :
+  motive a' (Eq.refl a')
+  := by
+  subst t
+  apply refl
+
+-- theorems to make ITree.cases actually compute with simp
+@[simp]
+theorem ITree.cases.ret {E R motive r d v x}
+  : @ITree.cases E R motive r d v (.ret x) = r x := by
+  --
+  -- TODO: the issue is that i need to do this rewrite, but the rewrite tactic
+  -- isn't fancy enough
+  -- rw [<-ITree.unfold_fold (E := E) (ITree.ret x)]
+  -- this would help, but again we aren't fancy enough
+  -- generalize h : (ITree.ret x) = a
+  -- so we need to do a transport manually! using the equality in a cast!
+  --
+  -- once we get that, we will be able to do this cases
+  -- cases (ITree.ret (E := E) x).unfold
+  -- simp [ITree.cases, ITreeF.rec, ITree.unfold, CoInd.unfold]
+  --
+  --
+  let rwmotive : (i : ITree E R) → (ITree.ret x = i) → Prop :=
+    fun i eq => (@ITree.cases E R motive r d v i) = cast (congrArg _ eq) (r x)
+  -- generalize h : (ITree.ret x) = a at R
+  let a := ITree.ret (E := E) x
+  have h : a = ITree.ret x := by rfl
+  generalize h2 : a = b at h
+  subst a
+  clear h2
+  --
+  have thing := Eq.rec (motive := rwmotive) (t := Eq.symm h)
+  unfold rwmotive at thing
+  -- apply thing
+  --
+  have thing2 := Eqrec3 (motive := rwmotive) (t := Eq.symm h)
+  unfold rwmotive at thing2
+  apply thing2
+  clear thing thing2
+  -- unfold rwmotive
+  -- apply thing2 -- this works, but doesn't give us what we need!
+  -- rw [<- ITree.unfold_fold (E := E) b]
+  -- have thing3 := Eqrec3 (motive := rwmotive) (t := Eq.symm (ITree.unfold_fold (E := E) (ITree.ret x)))
+  -- apply thing3 -- NOTE: this one works!
+  -- unfold rwmotive
+  -- ok so i have evaded transport hell and done the thing, but....
+  -- this cases still doesn't work because of more transport hell issues
+  -- cases (ITree.ret (E := E) x).unfold
+  --
+  revert h
+  rw [<- ITree.unfold_fold (E := E) b]
+  -- cases (ITree.ret (E := E) x).unfold
+  cases b.unfold
+  ·
+    intros h
+    simp [fold]
+    -- simp [fold, CoInd.fold, cases, unfold]
+    -- have bla := (Eqrec2 (motive := rwmotive) (t := Eq.symm h))
+    -- unfold rwmotive at bla
+    --
+    sorry
+  · sorry
+  · sorry
+  --
+  -- sorry
+
+-- NOTE: while it is possible to fix the above,
+-- i also could just make an alternate version of ITree.cases
+-- that is not dependently typed and it would be very easy to prove things about
+
+def ITree.reccases {E : Effect.{u}} {R}
+    {motive : Sort v}
+    (ret : R → motive)
+    (div : motive)
+    (vis : (i : E.I) → (k : E.O i → ITree E R) → motive)
+    (t : ITree E R) : motive := by
+    -- rw [<-ITree.unfold_fold t]
+    cases t.unfold with
+    | ret x => apply ret x
+    | div => apply div
+    | vis e k => apply vis e k
+
+#check ITreeF.rec
+
+theorem ITree.reccases.ret {E R motive r d v x}
+  : @ITree.reccases E R motive r d v (.ret x) = r x := by
+  rw [<-ITree.unfold_fold (E := E) (ITree.ret x)]
+  -- generalize h : (ITree.ret x) = a
+  cases h : (ITree.ret (E := E) x).unfold
+  -- simp [ITree.cases, ITreeF.rec, ITree.unfold, CoInd.unfold]
+  ·
+    simp [reccases]
+    -- unfold fold unfold
+    -- NOTE: here, we clearly should be able to use fold_unfold at the end and then
+    -- we would be able to step ITreeF.rec !!! but it doesnt work somehow
+    rename_i r'
+    have thing : (fold (ITreeF.ret r')).unfold = ITreeF.ret r'
+      := fold_unfold (ITreeF E R) (ITreeF.ret r')
+    -- rw [thing] -- ANOTHER Transpot hell issue!
+    let rwmotive : (i : ITreeF E R (ITree E R)) -> (eq : (fold (ITreeF.ret r')).unfold = i) -> Prop :=
+      fun i eq =>
+        ITreeF.rec (motive := fun t => (fold (ITreeF.ret r')).unfold = t → motive) (fun r_1 h => r r_1) (fun h => d)
+        (fun i k h => v i k) i eq = r x
+    --
+    apply Eqrec2 (a' := ITreeF.ret r') (motive := rwmotive) (t := Eq.symm thing)
+    unfold rwmotive
+    simp
+    simp at h
+    subst x
+    rfl
+  · sorry
+  · sorry
+
 
 namespace Aeneas.Data.Coinductive
diff --git a/backends/lean/Aeneas/Std/Core/Ops.lean b/backends/lean/Aeneas/Std/Core/Ops.lean
index 40ac140e2..d4fc6098e 100644
--- a/backends/lean/Aeneas/Std/Core/Ops.lean
+++ b/backends/lean/Aeneas/Std/Core/Ops.lean
@@ -64,11 +64,9 @@ def BuiltinFnOnce (Inputs : Type u) (Outputs : Type v) : core.ops.function.FnOnc
 
 def BuiltinFnMut (Inputs : Type u) (Outputs : Type v) : core.ops.function.FnMut (Inputs → Result Outputs) Inputs Outputs := {
   FnOnceInst := BuiltinFnOnce Inputs Outputs
-  call_mut f x :=
-    match f x with
-    | ok y => ok (y, f)
-    | fail e => fail e
-    | div => div
+  call_mut f x := do
+    bind (f x) λ v =>
+    ok (v, f)
 }
 
 def BuiltinFn (Inputs : Type u) (Outputs : Type v) : core.ops.function.Fn (Inputs → Result Outputs) Inputs Outputs := {
diff --git a/backends/lean/Aeneas/Std/Primitives.lean b/backends/lean/Aeneas/Std/Primitives.lean
index 4d26c74f5..73204dc4f 100644
--- a/backends/lean/Aeneas/Std/Primitives.lean
+++ b/backends/lean/Aeneas/Std/Primitives.lean
@@ -70,17 +70,17 @@ open Error
 --   | div
 -- deriving Repr, BEq
 
-inductive RustEffect.I : Type u where
+inductive RustEffect.I : Type where
 | fail : Error → RustEffect.I
 -- there is an issue that both threads have to return the return type.
 -- maybe this is fine, and you can just bind an operation that returns Unit?
 -- i could make a generalized ITree definition which allows you to do stuff to the return type in Effect?
 
-def RustEffect.O (i : RustEffect.I) : Type u :=
+def RustEffect.O (i : RustEffect.I) : Type :=
   match i with
   | .fail _ => PEmpty
 
-def RustEffect : Effect.{u} := {
+def RustEffect : Effect := {
   I := RustEffect.I
   O := RustEffect.O
 }
@@ -88,6 +88,8 @@ def RustEffect : Effect.{u} := {
 def Result (α : Type u) : Type u := ITree RustEffect α
 
 instance : Monad Result := instMonadITree
+instance : Bind Result where
+  bind := ITree.bind
 instance : LawfulMonad Result := instLawfulMonadITree
 
 def Result.ok {α} (a : α) : Result α := .ret a
@@ -96,10 +98,26 @@ def Result.fail {α} (e : Error) : Result α := .vis (.fail e) PEmpty.elim
 
 def Result.div {α} : Result α := ITree.div
 
-example : ¬ Result.fail e1 = Result.ok x := by
-  simp [Result.fail, Result.ok]
-  --
-  sorry
+-- TODO: adding these to simp set messes up some things
+-- @[simp, grind .]
+theorem ok_not_fail {α} {a : α} {e} : ¬ Result.ok a = .fail e := by grind [Result.ok, Result.fail, not_vis_ret]
+-- @[simp, grind .]
+theorem ok_not_div {α} {a : α} : ¬ Result.ok a = .div := by grind [Result.ok, Result.div, not_ret_div]
+-- @[simp, grind .]
+theorem ok_inj {α} {a b : α} : Result.ok a = .ok b → a = b := by grind [Result.ok, ret_inj]
+
+-- previously Result was an inductive with ok, div, and fail cases only.
+-- this function can be used in many cases to replace pattern matching on that inductive:
+-- TODO: maybe delete this and just use ITree.cases directly?
+abbrev Result.match {α} (r : Result α)
+  {motive : Result α → Type}
+  (ok : ∀ r, motive (pure r))
+  (div :  motive (.div))
+  (vis : ∀ i k, motive (ITree.vis i k))
+  : motive r := ITree.cases ok div vis r
+
+-- making .cases go
+-- theorem ITree.cases.div
 
 open Result
 
@@ -161,12 +179,12 @@ def Result.ofOption {a : Type u} (x : Option a) (e : Error) : Result a :=
 
 -- TODO: in addition to type levels, does it cause issues that bind comes from the Monad instance?
 -- -- TODO: is it ok to not have β be at a different level `v`?
--- def bind {α : Type u} {β : Type u} (x: Result α) (f: α → Result β) : Result β :=
---   ITree.bind x f
+def bind {α : Type u} {β : Type v} (x: Result α) (f: α → Result β) : Result β :=
+  ITree.bind x f
 
 -- TODO: should this just be deleted to clean things up now, or left for backwards compatibility?
-def bind {α : Type u} {β : Type u} (x: Result α) (f: α → Result β) : Result β :=
-  @Bind.bind Result _ α β x f
+-- def bind {α : Type u} {β : Type v} (x: Result α) (f: α → Result β) : Result β :=
+--   @Bind.bind Result _ α β x f
 
 -- -- Allows using Result in do-blocks
 -- instance : Bind Result where
@@ -343,13 +361,27 @@ inductive ControlFlow (α : Type u) (β : Type v) where
 deriving Repr, BEq
 
 -- TODO: will the fact that β now has level u instead of v cause problems?
-def loop {α : Type u} {β : Type u} (body : α → Result (ControlFlow α β)) (x : α) : Result β := do
-  let r ← body x
+def loop {α : Type u} {β : Type v} (body : α → Result (ControlFlow α β)) (x : α) : Result β := do
+  ITree.bind (body x) fun r =>
+  -- let r ← body x
+  -- _
   match r with
   | ControlFlow.cont x => loop body x
   | ControlFlow.done x => ok x
 partial_fixpoint
 
+
+-- TODO: this is original, delete this
+-- def loop {α : Type u} {β : Type v} (body : α → Result (ControlFlow α β)) (x : α) : Result β := do
+--   match body x with
+--   | ok r =>
+--     match r with
+--     | ControlFlow.cont x => loop body x
+--     | ControlFlow.done x => ok x
+--   | fail e => fail e
+--   | div => div
+-- partial_fixpoint
+
 /-!
 # Misc
 -/
diff --git a/backends/lean/Aeneas/Std/PrimitivesLemmas.lean b/backends/lean/Aeneas/Std/PrimitivesLemmas.lean
index 079f45dd3..42c9b6033 100644
--- a/backends/lean/Aeneas/Std/PrimitivesLemmas.lean
+++ b/backends/lean/Aeneas/Std/PrimitivesLemmas.lean
@@ -12,7 +12,7 @@ theorem massert_spec (b : Prop) [Decidable b] (h : b) :
   simp [massert, *]
 
 @[simp, step_pre_simps, bvify]
-theorem massert_ok (b : Prop) [Decidable b] : massert b = ok () ↔ b := by simp [massert]
+theorem massert_ok (b : Prop) [Decidable b] : massert b = ok () ↔ b := by grind [massert, ok_not_fail]
 
 @[simp, step_pre_simps, bvify]
 theorem spec_massert (b : Prop) [Decidable b] : Std.WP.spec (massert b) P ↔ (b ∧ P ()) := by
diff --git a/backends/lean/Aeneas/Std/Scalar/Core.lean b/backends/lean/Aeneas/Std/Scalar/Core.lean
index 831484534..f814d4446 100644
--- a/backends/lean/Aeneas/Std/Scalar/Core.lean
+++ b/backends/lean/Aeneas/Std/Scalar/Core.lean
@@ -612,14 +612,50 @@ theorem UScalar.tryMkOpt_eq (ty : UScalarTy) (x : Nat) :
   split_ifs <;> simp_all
   simp [UScalar.val, UScalarTy.numBits] at *
 
+-- TODO: maybe to make this sort of thing closer to the original Result veresion,
+-- i could consider putting the Fail case into the Ret case of the ITree?
+-- or mabye i could make a match function for Result which gives
+-- 3 cases: ok, fail, and 'other effect'?
 theorem UScalar.tryMk_eq (ty : UScalarTy) (x : Nat) :
-  match tryMk ty x with
-  | ok y => y.val = x ∧ inBounds ty x
-  | fail _ => ¬ (inBounds ty x)
-  | _ => False := by
+  (∃ v, tryMk ty x = .ok v ∧ inBounds ty v.val ∧ x = v.val)
+  ∨ (∃ e, tryMk ty x = .fail e ∧ ¬ (inBounds ty x))
+    := by
   have := UScalar.tryMkOpt_eq ty x
   simp [tryMk, ofOption]
-  cases h: tryMkOpt ty x <;> simp_all
+  cases h: tryMkOpt ty x
+  · right
+    grind
+  · left
+    grind
+
+theorem UScalar.tryMk_eq_test (ty : UScalarTy) (x : Nat) :
+  -- match tryMk ty x with
+  -- | ok y => y.val = x ∧ inBounds ty x
+  -- | fail _ => ¬ (inBounds ty x)
+  -- | _ => False
+  (tryMk ty x).cases
+    (fun y => y.val = x ∧ inBounds ty x)
+    False
+    (fun e _ =>
+      match e with
+      | .fail _e => ¬ (inBounds ty x)
+      -- | _ => False -- uncomment this once there are other effects
+      )
+  := by
+  have := UScalar.tryMkOpt_eq ty x
+  simp [tryMk, ofOption]
+  cases h: tryMkOpt ty x <;> simp_all [fail, Aeneas.Data.Coinductive.ITree.cases]
+  --
+
+-- TODO: delete old one
+-- theorem UScalar.tryMk_eq (ty : UScalarTy) (x : Nat) :
+--   match tryMk ty x with
+--   | ok y => y.val = x ∧ inBounds ty x
+--   | fail _ => ¬ (inBounds ty x)
+--   | _ => False := by
+--   have := UScalar.tryMkOpt_eq ty x
+--   simp [tryMk, ofOption]
+--   cases h: tryMkOpt ty x <;> simp_all
 
 theorem IScalar.tryMkOpt_eq (ty : IScalarTy) (x : Int) :
   match tryMkOpt ty x with
@@ -635,13 +671,26 @@ theorem IScalar.tryMkOpt_eq (ty : IScalarTy) (x : Int) :
   cases h: System.Platform.numBits_eq <;> simp_all <;> omega
 
 theorem IScalar.tryMk_eq (ty : IScalarTy) (x : Int) :
-  match tryMk ty x with
-  | ok y => y.val = x ∧ inBounds ty x
-  | fail _ => ¬ (inBounds ty x)
-  | _ => False := by
-  have := tryMkOpt_eq ty x
-  simp [tryMk]
-  cases h : tryMkOpt ty x <;> simp_all
+  (∃ v, tryMk ty x = .ok v ∧ inBounds ty v.val ∧ x = v.val)
+  ∨ (∃ e, tryMk ty x = .fail e ∧ ¬ (inBounds ty x))
+    := by
+  have := IScalar.tryMkOpt_eq ty x
+  simp [tryMk, ofOption]
+  cases h: tryMkOpt ty x
+  · right
+    grind
+  · left
+    grind
+
+-- TODO: delete old one
+-- theorem IScalar.tryMk_eq (ty : IScalarTy) (x : Int) :
+--   match tryMk ty x with
+--   | ok y => y.val = x ∧ inBounds ty x
+--   | fail _ => ¬ (inBounds ty x)
+--   | _ => False := by
+--   have := tryMkOpt_eq ty x
+--   simp [tryMk]
+--   cases h : tryMkOpt ty x <;> simp_all
 
 @[simp] theorem UScalar.zero_in_cbounds {ty : UScalarTy} : 0 < 2^ty.numBits := by
   simp
diff --git a/backends/lean/Aeneas/Std/Scalar/Ops/Mul.lean b/backends/lean/Aeneas/Std/Scalar/Ops/Mul.lean
index fc1ab6f61..91053aec4 100644
--- a/backends/lean/Aeneas/Std/Scalar/Ops/Mul.lean
+++ b/backends/lean/Aeneas/Std/Scalar/Ops/Mul.lean
@@ -43,7 +43,8 @@ theorem UScalar.mul_equiv {ty} (x y : UScalar ty) :
   match mul x y with
   | ok z => x.val * y.val ≤ UScalar.max ty ∧ (↑z : Nat) = ↑x * ↑y ∧ z.bv = x.bv * y.bv
   | fail _ => UScalar.max ty < x.val * y.val
-  | .div => False := by
+  | .div => False
+  := by
   simp only [mul]
   have := tryMk_eq ty (x.val * y.val)
   split <;> simp_all only [inBounds, true_and, not_lt, gt_iff_lt]
diff --git a/backends/lean/Aeneas/Std/Scalar/Ops/Neg.lean b/backends/lean/Aeneas/Std/Scalar/Ops/Neg.lean
index 6b72d5ada..a4e420c36 100644
--- a/backends/lean/Aeneas/Std/Scalar/Ops/Neg.lean
+++ b/backends/lean/Aeneas/Std/Scalar/Ops/Neg.lean
@@ -17,11 +17,8 @@ def IScalar.neg {ty : IScalarTy} (x : IScalar ty) : Result (IScalar ty) := IScal
 theorem IScalar.neg_step {ty} (x: IScalar ty) (h: x ≠ IScalar.min ty): IScalar.neg x ⦃ r => r = -x.val ⦄ := by
   simp [neg]
   have h := tryMk_eq ty (-x.val)
-  simp [inBounds] at h
-  split at h <;> simp_all
   have := IScalar.hBounds x
-  simp [IScalar.min] at *
-  grind
+  cases h <;> try grind [IScalar.min]
 
 /--
 The notation typeclass for heterogeneous negation.
diff --git a/backends/lean/Aeneas/Std/WP.lean b/backends/lean/Aeneas/Std/WP.lean
index 002d672a3..73dab23d4 100644
--- a/backends/lean/Aeneas/Std/WP.lean
+++ b/backends/lean/Aeneas/Std/WP.lean
@@ -28,12 +28,12 @@ def wp_return (x:α) : Wp α := fun p => p x
 -- def spec {α} (x:Result α) (p:Post α) :=
 --   theta x p
 
-coinductive spec' {α} (p : Post α) : (x : Result α) → Prop where
-| ret : ∀ x, p x → spec' p (ITree.ret x)
+@[grind]
+inductive spec {α} : (x : Result α) → (p : Post α) →  Prop where
+| ret : ∀ x, p x → spec (ITree.ret x) p
 -- | vis : ∀ k, (∀ b, spec p (k b)) → spec p (ITree.vis () k)
 -- | fail : ∀ k, (∀ b, spec p (k b)) → spec p (ITree.vis () k)
 
-def spec {α} p x := @spec' α x p
 
 -- TODO: clean up
 -- def dspec {α} (x:Result α) (p:Post α) :=
@@ -41,17 +41,14 @@ def spec {α} p x := @spec' α x p
 --   | ok x => p x
 --   | fail _ => False
 --   | div => True
-coinductive dspec' {α} (p : Post α) : (x : Result α) → Prop where
-| ret : ∀ x, p x → dspec' p (ITree.ret x)
-| div : dspec' p div
-
-def dspec {α} p x := @dspec' α x p
+inductive dspec {α} : (x : Result α) → (p : Post α) →  Prop where
+| ret : ∀ x, p x → dspec (ITree.ret x) p
+| div : dspec div p
 
 theorem spec_dspec (α) (x : Result α) (p: Post α) : spec x p → dspec x p := by
   intros s
-  simp [spec, dspec] at *
   cases s
-  apply dspec'.ret
+  apply dspec.ret
   assumption
 
 -- TODO: do i need this?
@@ -78,16 +75,23 @@ def uncurry' {α β} (p : α → β → Prop) : α × β → Prop :=
 
 @[simp, grind =, agrind =]
 theorem spec_ok (x : α) : spec (ok x) p ↔ p x := by
-  simp [spec, spec', ok]
-  grind
+  constructor
+  · intros s
+    generalize H : ok x = v at s
+    simp [ok] at H
+    cases s
+    grind only [ret_inj]
+  · intros px
+    constructor
+    assumption
 
 @[simp, grind =, agrind =]
 theorem spec_fail (e : Error) : spec (fail e) p ↔ False := by
-  grind only [spec', spec, fail, not_vis_ret]
+  grind only [spec, fail, not_vis_ret]
 
 @[simp, grind =, agrind =]
 theorem spec_div : spec div p ↔ False := by
-  grind only [spec, div, spec', not_ret_div]
+  grind only [spec, div, not_ret_div]
 
 /-! ### `spec_*` for tuple posts
 
@@ -110,15 +114,15 @@ theorem spec_mono {α} {P₁ : Post α} {m : Result α} {P₀ : Post α} (h : sp
   (∀ x, P₀ x → P₁ x) → spec m P₁ := by
   intros HMonPost
   revert h
-  simp [spec, spec']
-  cases m <;> grind
+  intros s
+  cases s
+  grind
 
 theorem spec_bind {α β} {k : α -> Result β} {Pₖ : Post β} {m : Result α} {Pₘ : Post α} :
   spec m Pₘ →
   (forall x, Pₘ x → spec (k x) Pₖ) →
   spec (m >>= k) Pₖ := by
   intro Hm Hk
-  simp [spec] at *
   cases Hm
   simp [Bind.bind]
   grind only
@@ -149,7 +153,9 @@ theorem spec_mono' {α} {P₁ : Post α} {m : Result α} {P₀ : Post α} (h : s
   qimp P₀ P₁ → spec m P₁ := by
   intros HMonPost
   revert h
-  unfold spec spec'
+  intros s
+  cases s
+  constructor
   grind only [qimp]
 
 /-- Implication of a `spec` predicate with quantifier -/
@@ -162,8 +168,8 @@ theorem spec_bind' {α β} {k : α -> Result β} {Pₖ : Post β} {m : Result α
   (qimp_spec Pₘ k Pₖ) →
   spec (Std.bind m k) Pₖ := by
   intro Hm Hk
-  simp [spec, spec', bind, Bind.bind, qimp_spec] at *
-  rcases Hm with ⟨x, px, rfl⟩
+  simp only [bind, qimp_spec] at *
+  cases Hm
   simp only [itree_ret_bind]
   grind only
 
@@ -198,8 +204,11 @@ theorem qimp_spec_exists {α β γ} (P : γ → α → Prop) (k : α → Result
 
 theorem spec_equiv_exists (m:Result α) (P:Post α) :
   spec m P ↔ (∃ y, m = ok y ∧ P y) := by
-  simp [spec, spec', ok]
-  grind only
+  constructor
+  · intros s
+    cases s
+    grind only [ok]
+  · grind
 
 theorem spec_imp_exists {m:Result α} {P:Post α} :
   spec m P → (∃ y, m = ok y ∧ P y) := by
@@ -214,7 +223,8 @@ theorem dspec_mono' {α} {P₁ : Post α} {m : Result α} {P₀ : Post α} (h :
   qimp P₀ P₁ → dspec m P₁ := by
   intros HMonPost
   revert h
-  unfold dspec dspec'
+  intros s
+  cases s <;> constructor
   grind only [qimp]
 
 /-- Implication of a `dspec` predicate with quantifier -/
@@ -226,12 +236,12 @@ theorem dspec_bind' {α β} {k : α -> Result β} {Pₖ : Post β} {m : Result 
   (qimp_dspec Pₘ k Pₖ) →
   dspec (Std.bind m k) Pₖ := by
   intro Hm Hk
-  simp [dspec, dspec', bind, Bind.bind, qimp_dspec] at *
-  rcases Hm with ⟨h, Hm⟩
-  · rcases Hm with ⟨x, px, rfl⟩
-    simp only [itree_ret_bind]
+  simp only [bind, qimp_dspec] at *
+  cases Hm
+  · simp only [itree_ret_bind]
     grind only
-  · simp [*, div]
+  · simp [div]
+    constructor
 
 @[simp]
 def qimp_dspec_uncurry' {α₀ α₁ β} (P : α₀ → α₁ → Prop) (k : α₀ × α₁ → Result β) (Q : β → Prop) :
@@ -254,8 +264,14 @@ def qimp_dspec_iff {α β} (P : α → Prop) (k : α → Result β) (Q : β →
 
 @[simp, grind =, agrind =]
 theorem dspec_ok (x : α) : dspec (ok x) p ↔ p x := by
-  simp [dspec, dspec', ok, div]
-  grind
+  simp [ok]
+  constructor
+  · intros s
+    generalize h : ITree.ret x = v at s
+    cases s <;> grind [div, ret_inj, not_ret_div]
+  · intros px
+    constructor
+    assumption
 
 theorem dspec_imp_forall {m:Result α} {P:Post α} :
   dspec m P → (∀ y, m = ok y → P y) := by
@@ -850,7 +866,13 @@ theorem loop.spec {α : Type u} {β : Type v} {γ : Type w}
   apply @wf.wf.fix γ (fun x' =>
     ∀ x, measure x = x' →
     inv x → loop body x ⦃ post ⦄)
-  grind [loop]
+  intros y h x eq ix
+  have hBody' := hBody x ix; clear hBody
+  rw [WP.spec_equiv_exists] at hBody'
+  rcases hBody' with ⟨y, p, yc⟩
+  unfold loop
+  simp [p, Result.ok]
+  grind
 
 theorem loop.spec_decr_nat {α : Type u} {β : Type v}
   (measure : α → Nat)

From 24d67e8baa5fd26a8e67b7efa0d59151c771c215 Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Mon, 6 Jul 2026 15:27:08 -0400
Subject: [PATCH 44/67] some more progress on ITree eliminators

---
 .../lean/Aeneas/Data/Coinductive/ITree.lean   | 100 ++++++++++++------
 backends/lean/Aeneas/Std/Scalar/Core.lean     |  57 +++++-----
 backends/lean/Aeneas/Std/Scalar/Ops/Add.lean  |  16 ++-
 3 files changed, 109 insertions(+), 64 deletions(-)

diff --git a/backends/lean/Aeneas/Data/Coinductive/ITree.lean b/backends/lean/Aeneas/Data/Coinductive/ITree.lean
index 655269b05..0154a5498 100644
--- a/backends/lean/Aeneas/Data/Coinductive/ITree.lean
+++ b/backends/lean/Aeneas/Data/Coinductive/ITree.lean
@@ -362,15 +362,8 @@ theorem ret_inj {E} {α} {x y} : @ITree.ret α E x = ITree.ret y → x = y := by
   simp at eq
   grind only
 
-#check ITree.cases
-#check Eq.rec
-
-def Eqrec2.{w, u_1} {α : Sort u_1} {a' : α} {motive : (a : α) → a' = a → Sort w}
-  (refl : motive a' (Eq.refl a')) {a'1 : α}
-  (t : a' = a'1) : motive a'1 t := by
-  subst t
-  apply refl
 
+-- TODO: probably dont need this:
 def Eqrec3.{w, u_1} {α : Sort u_1} {a' : α} {motive : (a : α) → a' = a → Sort w}
   {a'1 : α}
   (t : a' = a'1)
@@ -446,12 +439,13 @@ theorem ITree.cases.ret {E R motive r d v x}
 -- i also could just make an alternate version of ITree.cases
 -- that is not dependently typed and it would be very easy to prove things about
 
+-- @[cases_eliminator]
 def ITree.reccases {E : Effect.{u}} {R}
-    {motive : Sort v}
-    (ret : R → motive)
-    (div : motive)
-    (vis : (i : E.I) → (k : E.O i → ITree E R) → motive)
-    (t : ITree E R) : motive := by
+    {Out : Sort v}
+    (ret : R → Out)
+    (div : Out)
+    (vis : (i : E.I) → (k : E.O i → ITree E R) → Out)
+    (t : ITree E R) : Out := by
     -- rw [<-ITree.unfold_fold t]
     cases t.unfold with
     | ret x => apply ret x
@@ -460,34 +454,72 @@ def ITree.reccases {E : Effect.{u}} {R}
 
 #check ITreeF.rec
 
+@[simp]
 theorem ITree.reccases.ret {E R motive r d v x}
   : @ITree.reccases E R motive r d v (.ret x) = r x := by
   rw [<-ITree.unfold_fold (E := E) (ITree.ret x)]
-  -- generalize h : (ITree.ret x) = a
-  cases h : (ITree.ret (E := E) x).unfold
-  -- simp [ITree.cases, ITreeF.rec, ITree.unfold, CoInd.unfold]
-  ·
+  cases h : (ITree.ret (E := E) x).unfold with
+  | ret r' =>
+    simp at h
+    subst x
     simp [reccases]
-    -- unfold fold unfold
-    -- NOTE: here, we clearly should be able to use fold_unfold at the end and then
-    -- we would be able to step ITreeF.rec !!! but it doesnt work somehow
-    rename_i r'
-    have thing : (fold (ITreeF.ret r')).unfold = ITreeF.ret r'
+    have to_rewrite_by : (fold (ITreeF.ret r')).unfold = ITreeF.ret r'
       := fold_unfold (ITreeF E R) (ITreeF.ret r')
-    -- rw [thing] -- ANOTHER Transpot hell issue!
-    let rwmotive : (i : ITreeF E R (ITree E R)) -> (eq : (fold (ITreeF.ret r')).unfold = i) -> Prop :=
-      fun i eq =>
-        ITreeF.rec (motive := fun t => (fold (ITreeF.ret r')).unfold = t → motive) (fun r_1 h => r r_1) (fun h => d)
-        (fun i k h => v i k) i eq = r x
-    --
-    apply Eqrec2 (a' := ITreeF.ret r') (motive := rwmotive) (t := Eq.symm thing)
-    unfold rwmotive
+    -- rw [to_rewrite_by] -- we want to do this.... but we are in transport hell!
+    -- we can circumvent transport hell by manually transporting along this type family
+    let motive : (i : ITreeF E R (ITree E R)) -> (eq : (fold (ITreeF.ret r')).unfold = i)
+      -> Prop := fun i eq =>
+        ITreeF.rec (motive := fun t => (fold (ITreeF.ret r')).unfold = t → motive)
+          (fun r_1 h => r r_1) (fun h => d)
+          (fun i k h => v i k) i eq = r r'
+    refine @Eq.rec _ (ITreeF.ret r') motive ?_ _ (Eq.symm to_rewrite_by)
+    unfold motive
     simp
+  | _ => simp at h
+
+@[simp]
+theorem ITree.reccases.div {E R motive r d v}
+  : @ITree.reccases E R motive r d v .div = d := by
+  -- cases h
+  rw [<-ITree.unfold_fold (E := E) (ITree.div)]
+  cases h : (ITree.div.unfold) with
+  | div =>
     simp at h
-    subst x
-    rfl
-  · sorry
-  · sorry
+    simp [reccases]
+    have to_rewrite_by : (fold (ITreeF.div)).unfold = ITreeF.div
+      := fold_unfold (ITreeF E R) (ITreeF.div)
+    -- rw [to_rewrite_by] -- again, rw is not smart enough
+    let motive : (i : ITreeF E R (ITree E R)) -> (eq : (fold (ITreeF.div)).unfold = i)
+      -> Prop := fun i eq =>
+        ITreeF.rec (motive := fun t => (fold (ITreeF.div)).unfold = t → motive)
+          (fun r_1 h => r r_1) (fun h => d)
+          (fun i k h => v i k) i eq = d
+    refine @Eq.rec _ (ITreeF.div) motive ?_ _ (Eq.symm to_rewrite_by)
+    simp [motive]
+  | _ => simp at h
+
+@[simp]
+theorem ITree.reccases.vis {E R motive r d v e k}
+  : @ITree.reccases E R motive r d v (.vis e k) = v e k := by
+  -- cases h
+  rw [<-ITree.unfold_fold (E := E) (ITree.vis e k)]
+  cases h : (ITree.vis e k).unfold with
+  | vis e' k' =>
+    simp at h
+    cases h
+    subst_vars
+    simp [reccases]
+    have to_rewrite_by : (fold (ITreeF.vis e' k)).unfold = ITreeF.vis e' k
+      := fold_unfold (ITreeF E R) (ITreeF.vis e' k)
+    -- rw [to_rewrite_by] -- again, rw is not smart enough
+    let motive : (i : ITreeF E R (ITree E R)) -> (eq : (fold (ITreeF.vis e' k)).unfold = i)
+      -> Prop := fun i eq =>
+        ITreeF.rec (motive := fun t => (fold (ITreeF.vis e' k)).unfold = t → motive)
+          (fun r_1 h => r r_1) (fun h => d)
+          (fun i k h => v i k) i eq = v e' k
+    refine @Eq.rec _ (ITreeF.vis e' k) motive ?_ _ (Eq.symm to_rewrite_by)
+    simp [motive]
+  | _ => simp at h
 
 
 namespace Aeneas.Data.Coinductive
diff --git a/backends/lean/Aeneas/Std/Scalar/Core.lean b/backends/lean/Aeneas/Std/Scalar/Core.lean
index f814d4446..cbb2299e8 100644
--- a/backends/lean/Aeneas/Std/Scalar/Core.lean
+++ b/backends/lean/Aeneas/Std/Scalar/Core.lean
@@ -612,11 +612,8 @@ theorem UScalar.tryMkOpt_eq (ty : UScalarTy) (x : Nat) :
   split_ifs <;> simp_all
   simp [UScalar.val, UScalarTy.numBits] at *
 
--- TODO: maybe to make this sort of thing closer to the original Result veresion,
--- i could consider putting the Fail case into the Ret case of the ITree?
--- or mabye i could make a match function for Result which gives
--- 3 cases: ok, fail, and 'other effect'?
-theorem UScalar.tryMk_eq (ty : UScalarTy) (x : Nat) :
+-- TODO: delete this:
+theorem UScalar.tryMk_eq_DELETE_THIS_PROBABLY (ty : UScalarTy) (x : Nat) :
   (∃ v, tryMk ty x = .ok v ∧ inBounds ty v.val ∧ x = v.val)
   ∨ (∃ e, tryMk ty x = .fail e ∧ ¬ (inBounds ty x))
     := by
@@ -628,24 +625,19 @@ theorem UScalar.tryMk_eq (ty : UScalarTy) (x : Nat) :
   · left
     grind
 
-theorem UScalar.tryMk_eq_test (ty : UScalarTy) (x : Nat) :
-  -- match tryMk ty x with
-  -- | ok y => y.val = x ∧ inBounds ty x
-  -- | fail _ => ¬ (inBounds ty x)
-  -- | _ => False
-  (tryMk ty x).cases
+theorem UScalar.tryMk_eq (ty : UScalarTy) (x : Nat) :
+  (tryMk ty x).reccases
     (fun y => y.val = x ∧ inBounds ty x)
     False
-    (fun e _ =>
+    (fun (e : RustEffect.I) _ =>
       match e with
-      | .fail _e => ¬ (inBounds ty x)
+      | RustEffect.I.fail _e => ¬ (inBounds ty x)
       -- | _ => False -- uncomment this once there are other effects
       )
   := by
   have := UScalar.tryMkOpt_eq ty x
   simp [tryMk, ofOption]
-  cases h: tryMkOpt ty x <;> simp_all [fail, Aeneas.Data.Coinductive.ITree.cases]
-  --
+  cases h: tryMkOpt ty x <;> simp_all [fail, ok]
 
 -- TODO: delete old one
 -- theorem UScalar.tryMk_eq (ty : UScalarTy) (x : Nat) :
@@ -670,17 +662,32 @@ theorem IScalar.tryMkOpt_eq (ty : IScalarTy) (x : Int) :
   simp [Int.bmod] <;> split <;> (try omega) <;>
   cases h: System.Platform.numBits_eq <;> simp_all <;> omega
 
+-- TODO: delete this
+-- theorem IScalar.tryMk_eq (ty : IScalarTy) (x : Int) :
+--   (∃ v, tryMk ty x = .ok v ∧ inBounds ty v.val ∧ x = v.val)
+--   ∨ (∃ e, tryMk ty x = .fail e ∧ ¬ (inBounds ty x))
+--     := by
+--   have := IScalar.tryMkOpt_eq ty x
+--   simp [tryMk, ofOption]
+--   cases h: tryMkOpt ty x
+--   · right
+--     grind
+--   · left
+--     grind
+
 theorem IScalar.tryMk_eq (ty : IScalarTy) (x : Int) :
-  (∃ v, tryMk ty x = .ok v ∧ inBounds ty v.val ∧ x = v.val)
-  ∨ (∃ e, tryMk ty x = .fail e ∧ ¬ (inBounds ty x))
-    := by
-  have := IScalar.tryMkOpt_eq ty x
-  simp [tryMk, ofOption]
-  cases h: tryMkOpt ty x
-  · right
-    grind
-  · left
-    grind
+  (tryMk ty x).reccases
+  (fun y => y.val = x ∧ inBounds ty x)
+  False
+  (fun (e : RustEffect.I) _ =>
+    match e with
+    | RustEffect.I.fail _e => ¬ (inBounds ty x)
+    -- | _ => False -- uncomment this once there are other effects
+    )
+  := by
+  have := tryMkOpt_eq ty x
+  simp [tryMk]
+  cases h : tryMkOpt ty x <;> simp_all [fail, ok]
 
 -- TODO: delete old one
 -- theorem IScalar.tryMk_eq (ty : IScalarTy) (x : Int) :
diff --git a/backends/lean/Aeneas/Std/Scalar/Ops/Add.lean b/backends/lean/Aeneas/Std/Scalar/Ops/Add.lean
index a4e909a1c..60a8ec009 100644
--- a/backends/lean/Aeneas/Std/Scalar/Ops/Add.lean
+++ b/backends/lean/Aeneas/Std/Scalar/Ops/Add.lean
@@ -53,18 +53,24 @@ theorem UScalar.add_equiv {ty} (x y : UScalar ty) :
   simp [*]
 
 theorem IScalar.add_equiv {ty} (x y : IScalar ty) :
-  match x + y with
-  | ok z =>
+  (x + y).reccases
+  (fun z =>
     IScalar.inBounds ty (x.val + y.val) ∧
     z.val = x.val + y.val ∧
-    z.bv = x.bv + y.bv
-  | fail _ => ¬ (IScalar.inBounds ty (x.val + y.val))
-  | _ => ⊥ := by
+    z.bv = x.bv + y.bv)
+  ⊥
+  (fun (e : RustEffect.I) _k =>
+    match e with
+    | .fail _e => ¬ (IScalar.inBounds ty (x.val + y.val)))
+  := by
   have : x + y = add x y := by rfl
   rw [this]
   simp [add]
   have h := tryMk_eq ty (↑x + ↑y)
   simp [inBounds] at h
+  generalize test : (tryMk ty (↑x + ↑y)) = thing at h
+  cases thing -- TODO: to make this work, i need cases_eliminator attr on cases for result
+              -- its not good enough to have it just for ITree!
   split at h <;> simp_all
   apply BitVec.eq_of_toInt_eq
   simp

From 1e585464a22fa03e4bc3e36906865bd0ba4f96b1 Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Tue, 7 Jul 2026 11:29:47 -0400
Subject: [PATCH 45/67] theorems for computing ITree dependent eliminator

---
 .../lean/Aeneas/Data/Coinductive/ITree.lean   | 262 ++++++++----------
 backends/lean/Aeneas/Std/Primitives.lean      |   3 +-
 backends/lean/Aeneas/Std/Scalar/Ops/Add.lean  |  13 +-
 3 files changed, 133 insertions(+), 145 deletions(-)

diff --git a/backends/lean/Aeneas/Data/Coinductive/ITree.lean b/backends/lean/Aeneas/Data/Coinductive/ITree.lean
index 0154a5498..47e4e71e5 100644
--- a/backends/lean/Aeneas/Data/Coinductive/ITree.lean
+++ b/backends/lean/Aeneas/Data/Coinductive/ITree.lean
@@ -52,6 +52,7 @@ def ITree.unfold (t : ITree E R) : ITreeF E R (ITree E R) := CoInd.unfold _ t
 
 instance : Inhabited (ITreeF E R PUnit) where default := .div
 
+-- TODO: are all these little simp theorems every used or needed?
 @[simp]
 theorem ITree.unfold_fold (t : ITree E R) :
   ITree.fold (ITree.unfold t) = t := by simp [ITree.fold, ITree.unfold]
@@ -66,8 +67,6 @@ theorem fold_ret_approx_1 (r : R) n :
   (ITree.fold (ITreeF.ret (E:=E) r)).approx (n + 1) = ITreeF.ret r :=
     ret_approx_1 r n
 
-
--- TODO: why doesnt this work
 @[simp]
 theorem div_approx_1 n :
   (ITree.div (E:=E) (R:=R)).approx  (n + 1) = ITreeF.div := by
@@ -286,7 +285,6 @@ def Effect.trigger (E₁ : Effect.{u}) {E₂ : Effect.{u}} [E₁ -< E₂] (i : E
   let ⟨i₂, f⟩ := (Subeffect.map i);
   ITree.vis i₂ (λ x => return (f x))
 
--- TODO: make β have level b instead of a
 def ITree.iter {α : Type a} {β : Type b} (t : α → ITree E (α ⊕ β)) : α → ITree E β :=
   λ a => do
     bind (t a) λ val =>
@@ -378,148 +376,132 @@ def Eqrec3.{w, u_1} {α : Sort u_1} {a' : α} {motive : (a : α) → a' = a →
 @[simp]
 theorem ITree.cases.ret {E R motive r d v x}
   : @ITree.cases E R motive r d v (.ret x) = r x := by
-  --
-  -- TODO: the issue is that i need to do this rewrite, but the rewrite tactic
-  -- isn't fancy enough
-  -- rw [<-ITree.unfold_fold (E := E) (ITree.ret x)]
-  -- this would help, but again we aren't fancy enough
-  -- generalize h : (ITree.ret x) = a
-  -- so we need to do a transport manually! using the equality in a cast!
-  --
-  -- once we get that, we will be able to do this cases
-  -- cases (ITree.ret (E := E) x).unfold
-  -- simp [ITree.cases, ITreeF.rec, ITree.unfold, CoInd.unfold]
-  --
-  --
-  let rwmotive : (i : ITree E R) → (ITree.ret x = i) → Prop :=
-    fun i eq => (@ITree.cases E R motive r d v i) = cast (congrArg _ eq) (r x)
-  -- generalize h : (ITree.ret x) = a at R
-  let a := ITree.ret (E := E) x
-  have h : a = ITree.ret x := by rfl
-  generalize h2 : a = b at h
-  subst a
-  clear h2
-  --
-  have thing := Eq.rec (motive := rwmotive) (t := Eq.symm h)
-  unfold rwmotive at thing
-  -- apply thing
-  --
-  have thing2 := Eqrec3 (motive := rwmotive) (t := Eq.symm h)
-  unfold rwmotive at thing2
-  apply thing2
-  clear thing thing2
-  -- unfold rwmotive
-  -- apply thing2 -- this works, but doesn't give us what we need!
-  -- rw [<- ITree.unfold_fold (E := E) b]
-  -- have thing3 := Eqrec3 (motive := rwmotive) (t := Eq.symm (ITree.unfold_fold (E := E) (ITree.ret x)))
-  -- apply thing3 -- NOTE: this one works!
-  -- unfold rwmotive
-  -- ok so i have evaded transport hell and done the thing, but....
-  -- this cases still doesn't work because of more transport hell issues
-  -- cases (ITree.ret (E := E) x).unfold
-  --
-  revert h
-  rw [<- ITree.unfold_fold (E := E) b]
-  -- cases (ITree.ret (E := E) x).unfold
-  cases b.unfold
-  ·
-    intros h
-    simp [fold]
-    -- simp [fold, CoInd.fold, cases, unfold]
-    -- have bla := (Eqrec2 (motive := rwmotive) (t := Eq.symm h))
-    -- unfold rwmotive at bla
-    --
-    sorry
-  · sorry
-  · sorry
-  --
-  -- sorry
-
--- NOTE: while it is possible to fix the above,
--- i also could just make an alternate version of ITree.cases
--- that is not dependently typed and it would be very easy to prove things about
-
--- @[cases_eliminator]
-def ITree.reccases {E : Effect.{u}} {R}
-    {Out : Sort v}
-    (ret : R → Out)
-    (div : Out)
-    (vis : (i : E.I) → (k : E.O i → ITree E R) → Out)
-    (t : ITree E R) : Out := by
-    -- rw [<-ITree.unfold_fold t]
-    cases t.unfold with
-    | ret x => apply ret x
-    | div => apply div
-    | vis e k => apply vis e k
-
-#check ITreeF.rec
+  simp [cases]
+  -- simp [ITree.ret] -- uncomment to see where the rewrite target is supposed to be in the goal
+  have to_rewrite_by : (fold (ITreeF.ret x)).unfold = ITreeF.ret x
+    := fold_unfold (ITreeF E R) (ITreeF.ret x)
+  -- rw [to_rewrite_by] -- we want to do this.... but we are in transport hell!
+  let rwmotive : (i : ITreeF E R (ITree E R)) -> (eq : (fold (ITreeF.ret x)).unfold = i)
+    -> Prop := fun i eq =>
+      ITreeF.rec (motive := fun t => (fold (ITreeF.ret x)).unfold = t → motive (fold (ITree.ret x).unfold))
+        (fun r_1 h => cast (by simp [fold, unfold] at h; rw[unfold_fold]; simp[pure, *] ) (r r_1))
+        (fun h => cast (by contradiction) d)
+        (fun i k h => cast (by contradiction) (v i k)) i eq = r x
+  refine @Eq.rec _ (ITreeF.ret x) rwmotive ?_ _ (Eq.symm to_rewrite_by)
+  unfold rwmotive
+  simp [cast]
 
 @[simp]
-theorem ITree.reccases.ret {E R motive r d v x}
-  : @ITree.reccases E R motive r d v (.ret x) = r x := by
-  rw [<-ITree.unfold_fold (E := E) (ITree.ret x)]
-  cases h : (ITree.ret (E := E) x).unfold with
-  | ret r' =>
-    simp at h
-    subst x
-    simp [reccases]
-    have to_rewrite_by : (fold (ITreeF.ret r')).unfold = ITreeF.ret r'
-      := fold_unfold (ITreeF E R) (ITreeF.ret r')
-    -- rw [to_rewrite_by] -- we want to do this.... but we are in transport hell!
-    -- we can circumvent transport hell by manually transporting along this type family
-    let motive : (i : ITreeF E R (ITree E R)) -> (eq : (fold (ITreeF.ret r')).unfold = i)
-      -> Prop := fun i eq =>
-        ITreeF.rec (motive := fun t => (fold (ITreeF.ret r')).unfold = t → motive)
-          (fun r_1 h => r r_1) (fun h => d)
-          (fun i k h => v i k) i eq = r r'
-    refine @Eq.rec _ (ITreeF.ret r') motive ?_ _ (Eq.symm to_rewrite_by)
-    unfold motive
-    simp
-  | _ => simp at h
+theorem ITree.cases.div {E R motive r d v}
+  : @ITree.cases E R motive r d v .div = d := by
+  simp [cases]
+  -- simp [ITree.div] -- uncomment to see where the rewrite target is supposed to be in the goal
+  have to_rewrite_by : (fold ITreeF.div).unfold = ITreeF.div
+    := fold_unfold (ITreeF E R) (ITreeF.div)
+  -- rw [to_rewrite_by] -- we want to do this.... but we are in transport hell!
+  let rwmotive : (i : ITreeF E R (ITree E R)) -> (eq : (fold ITreeF.div).unfold = i)
+    -> Prop := fun i eq =>
+      ITreeF.rec (motive := fun t => (fold ITreeF.div).unfold = t → motive (fold ITree.div.unfold))
+        (fun r_1 h => cast (by contradiction) (r r_1))
+        (fun h => cast (by simp [fold, unfold]) d)
+        (fun i k h => cast (by contradiction) (v i k)) i eq = d
+  refine @Eq.rec _ ITreeF.div rwmotive ?_ _ (Eq.symm to_rewrite_by)
+  unfold rwmotive
+  simp [cast]
 
 @[simp]
-theorem ITree.reccases.div {E R motive r d v}
-  : @ITree.reccases E R motive r d v .div = d := by
-  -- cases h
-  rw [<-ITree.unfold_fold (E := E) (ITree.div)]
-  cases h : (ITree.div.unfold) with
-  | div =>
-    simp at h
-    simp [reccases]
-    have to_rewrite_by : (fold (ITreeF.div)).unfold = ITreeF.div
-      := fold_unfold (ITreeF E R) (ITreeF.div)
-    -- rw [to_rewrite_by] -- again, rw is not smart enough
-    let motive : (i : ITreeF E R (ITree E R)) -> (eq : (fold (ITreeF.div)).unfold = i)
-      -> Prop := fun i eq =>
-        ITreeF.rec (motive := fun t => (fold (ITreeF.div)).unfold = t → motive)
-          (fun r_1 h => r r_1) (fun h => d)
-          (fun i k h => v i k) i eq = d
-    refine @Eq.rec _ (ITreeF.div) motive ?_ _ (Eq.symm to_rewrite_by)
-    simp [motive]
-  | _ => simp at h
+theorem ITree.cases.vis {E R motive r d v e k}
+  : @ITree.cases E R motive r d v (.vis e k) = v e k := by
+  simp [cases]
+  -- simp [ITree.vis] -- uncomment to see where the rewrite target is supposed to be in the goal
+  have to_rewrite_by : (fold (ITreeF.vis e k)).unfold = ITreeF.vis e k
+    := fold_unfold (ITreeF E R) (ITreeF.vis e k)
+  -- rw [to_rewrite_by] -- we want to do this.... but we are in transport hell!
+  let rwmotive : (i : ITreeF E R (ITree E R)) -> (eq : (fold (ITreeF.vis e k)).unfold = i)
+    -> Prop := fun i eq =>
+      ITreeF.rec (motive := fun t => (fold (ITreeF.vis e k)).unfold = t → motive (fold (ITree.vis e k).unfold))
+        (fun r_1 h => cast (by contradiction) (r r_1))
+        (fun h => cast (by contradiction) d)
+        (fun i k h => cast (by simp [fold, unfold] at h; rw [unfold_fold]; grind) (v i k)) i eq = v e k
+  refine @Eq.rec _ (ITreeF.vis e k) rwmotive ?_ _ (Eq.symm to_rewrite_by)
+  unfold rwmotive
+  simp [cast]
+
+-- TODO: delete non-dependent eliminator if we indeed don't need it
+-- -- @[cases_eliminator]
+-- def ITree.reccases {E : Effect.{u}} {R}
+--     {Out : Sort v}
+--     (ret : R → Out)
+--     (div : Out)
+--     (vis : (i : E.I) → (k : E.O i → ITree E R) → Out)
+--     (t : ITree E R) : Out := by
+--     -- rw [<-ITree.unfold_fold t]
+--     cases t.unfold with
+--     | ret x => apply ret x
+--     | div => apply div
+--     | vis e k => apply vis e k
+
+-- #check ITreeF.rec
 
-@[simp]
-theorem ITree.reccases.vis {E R motive r d v e k}
-  : @ITree.reccases E R motive r d v (.vis e k) = v e k := by
-  -- cases h
-  rw [<-ITree.unfold_fold (E := E) (ITree.vis e k)]
-  cases h : (ITree.vis e k).unfold with
-  | vis e' k' =>
-    simp at h
-    cases h
-    subst_vars
-    simp [reccases]
-    have to_rewrite_by : (fold (ITreeF.vis e' k)).unfold = ITreeF.vis e' k
-      := fold_unfold (ITreeF E R) (ITreeF.vis e' k)
-    -- rw [to_rewrite_by] -- again, rw is not smart enough
-    let motive : (i : ITreeF E R (ITree E R)) -> (eq : (fold (ITreeF.vis e' k)).unfold = i)
-      -> Prop := fun i eq =>
-        ITreeF.rec (motive := fun t => (fold (ITreeF.vis e' k)).unfold = t → motive)
-          (fun r_1 h => r r_1) (fun h => d)
-          (fun i k h => v i k) i eq = v e' k
-    refine @Eq.rec _ (ITreeF.vis e' k) motive ?_ _ (Eq.symm to_rewrite_by)
-    simp [motive]
-  | _ => simp at h
+-- @[simp]
+-- theorem ITree.reccases.ret {E R motive r d v x}
+--   : @ITree.reccases E R motive r d v (.ret x) = r x := by
+--   simp [reccases]
+--   simp [ITree.ret]
+--   have to_rewrite_by : (fold (ITreeF.ret x)).unfold = ITreeF.ret x
+--     := fold_unfold (ITreeF E R) (ITreeF.ret x)
+--   -- rw [to_rewrite_by] -- we want to do this.... but we are in transport hell!
+--   let rwmotive : (i : ITreeF E R (ITree E R)) -> (eq : (fold (ITreeF.ret x)).unfold = i)
+--     -> Prop := fun i eq =>
+--       ITreeF.rec (motive := fun t => (fold (ITreeF.ret x)).unfold = t → motive)
+--         (fun r_1 h => r r_1) (fun h => d)
+--         (fun i k h => v i k) i eq = r x
+--   refine @Eq.rec _ (ITreeF.ret x) rwmotive ?_ _ (Eq.symm to_rewrite_by)
+--   unfold rwmotive
+--   simp
+
+-- @[simp]
+-- theorem ITree.reccases.div {E R motive r d v}
+--   : @ITree.reccases E R motive r d v .div = d := by
+--   -- simp [ITree.div, fold]
+--   --
+--   rw [<-ITree.unfold_fold (E := E) (ITree.div)]
+--   cases h : (ITree.div.unfold) with
+--   | div =>
+--     simp [reccases]
+--     have to_rewrite_by : (fold (ITreeF.div)).unfold = ITreeF.div
+--       := fold_unfold (ITreeF E R) (ITreeF.div)
+--     -- rw [to_rewrite_by] -- again, rw is not smart enough
+--     let motive : (i : ITreeF E R (ITree E R)) -> (eq : (fold (ITreeF.div)).unfold = i)
+--       -> Prop := fun i eq =>
+--         ITreeF.rec (motive := fun t => (fold (ITreeF.div)).unfold = t → motive)
+--           (fun r_1 h => r r_1) (fun h => d)
+--           (fun i k h => v i k) i eq = d
+--     refine @Eq.rec _ (ITreeF.div) motive ?_ _ (Eq.symm to_rewrite_by)
+--     simp [motive]
+--   | _ => simp at h
+
+-- @[simp]
+-- theorem ITree.reccases.vis {E R motive r d v e k}
+--   : @ITree.reccases E R motive r d v (.vis e k) = v e k := by
+--   rw [<-ITree.unfold_fold (E := E) (ITree.vis e k)]
+--   cases h : (ITree.vis e k).unfold with
+--   | vis e' k' =>
+--     simp at h
+--     cases h
+--     subst_vars
+--     simp [reccases]
+--     have to_rewrite_by : (fold (ITreeF.vis e' k)).unfold = ITreeF.vis e' k
+--       := fold_unfold (ITreeF E R) (ITreeF.vis e' k)
+--     -- rw [to_rewrite_by] -- again, rw is not smart enough
+--     let motive : (i : ITreeF E R (ITree E R)) -> (eq : (fold (ITreeF.vis e' k)).unfold = i)
+--       -> Prop := fun i eq =>
+--         ITreeF.rec (motive := fun t => (fold (ITreeF.vis e' k)).unfold = t → motive)
+--           (fun r_1 h => r r_1) (fun h => d)
+--           (fun i k h => v i k) i eq = v e' k
+--     refine @Eq.rec _ (ITreeF.vis e' k) motive ?_ _ (Eq.symm to_rewrite_by)
+--     simp [motive]
+--   | _ => simp at h
 
 
 namespace Aeneas.Data.Coinductive
diff --git a/backends/lean/Aeneas/Std/Primitives.lean b/backends/lean/Aeneas/Std/Primitives.lean
index 73204dc4f..5fa138d4e 100644
--- a/backends/lean/Aeneas/Std/Primitives.lean
+++ b/backends/lean/Aeneas/Std/Primitives.lean
@@ -109,8 +109,9 @@ theorem ok_inj {α} {a b : α} : Result.ok a = .ok b → a = b := by grind [Resu
 -- previously Result was an inductive with ok, div, and fail cases only.
 -- this function can be used in many cases to replace pattern matching on that inductive:
 -- TODO: maybe delete this and just use ITree.cases directly?
+@[elab_as_elim, cases_eliminator]
 abbrev Result.match {α} (r : Result α)
-  {motive : Result α → Type}
+  {motive : Result α → Sort v}
   (ok : ∀ r, motive (pure r))
   (div :  motive (.div))
   (vis : ∀ i k, motive (ITree.vis i k))
diff --git a/backends/lean/Aeneas/Std/Scalar/Ops/Add.lean b/backends/lean/Aeneas/Std/Scalar/Ops/Add.lean
index 60a8ec009..08019f370 100644
--- a/backends/lean/Aeneas/Std/Scalar/Ops/Add.lean
+++ b/backends/lean/Aeneas/Std/Scalar/Ops/Add.lean
@@ -68,10 +68,15 @@ theorem IScalar.add_equiv {ty} (x y : IScalar ty) :
   simp [add]
   have h := tryMk_eq ty (↑x + ↑y)
   simp [inBounds] at h
-  generalize test : (tryMk ty (↑x + ↑y)) = thing at h
-  cases thing -- TODO: to make this work, i need cases_eliminator attr on cases for result
-              -- its not good enough to have it just for ITree!
-  split at h <;> simp_all
+  generalize valh : (tryMk ty (↑x + ↑y)) = val at h
+  -- cases val -- TODO: to make this work, i need cases_eliminator attr on cases for result
+  --             -- its not good enough to have it just for ITree!
+  -- TODO: to make this work good, i need the cases_eliminator attribute on Result.match
+  -- i need to use Result.match in the theorem statement,
+  -- and i need simp lemmas that step Result.match using Result.div, Result.ok, Result.vis
+  -- so that its not necessary to unfold these definitions in here.
+  -- i also need to make Result.match actually compute in ITree.lean.
+  cases val <;> simp_all [div, pure]
   apply BitVec.eq_of_toInt_eq
   simp
   have := bmod_pow_numBits_eq_of_lt ty (x.val + y.val) (by omega) (by omega)

From b27cee575bc3cbcf93befb83e69d33239c4ebf53 Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Tue, 7 Jul 2026 14:22:32 -0400
Subject: [PATCH 46/67] will give eliminator one case per effect

---
 backends/lean/Aeneas/Std/Primitives.lean     | 14 ++++--
 backends/lean/Aeneas/Std/Scalar/Core.lean    |  4 +-
 backends/lean/Aeneas/Std/Scalar/Ops/Add.lean | 47 ++++++++++----------
 3 files changed, 36 insertions(+), 29 deletions(-)

diff --git a/backends/lean/Aeneas/Std/Primitives.lean b/backends/lean/Aeneas/Std/Primitives.lean
index 5fa138d4e..04b6d31b6 100644
--- a/backends/lean/Aeneas/Std/Primitives.lean
+++ b/backends/lean/Aeneas/Std/Primitives.lean
@@ -108,7 +108,6 @@ theorem ok_inj {α} {a b : α} : Result.ok a = .ok b → a = b := by grind [Resu
 
 -- previously Result was an inductive with ok, div, and fail cases only.
 -- this function can be used in many cases to replace pattern matching on that inductive:
--- TODO: maybe delete this and just use ITree.cases directly?
 @[elab_as_elim, cases_eliminator]
 abbrev Result.match {α} (r : Result α)
   {motive : Result α → Sort v}
@@ -117,8 +116,17 @@ abbrev Result.match {α} (r : Result α)
   (vis : ∀ i k, motive (ITree.vis i k))
   : motive r := ITree.cases ok div vis r
 
--- making .cases go
--- theorem ITree.cases.div
+@[simp]
+theorem Result.match.ok {R motive r d v x}
+  : @Result.match R (.ok x) motive r d v = r x := ITree.cases.ret
+
+@[simp]
+theorem Result.match.div {R motive r d v}
+  : @Result.match R .div motive r d v = d := ITree.cases.div
+
+@[simp]
+theorem Result.match.vis {R motive r d v e k}
+  : @Result.match R (.vis e k) motive r d v = v e k := ITree.cases.vis
 
 open Result
 
diff --git a/backends/lean/Aeneas/Std/Scalar/Core.lean b/backends/lean/Aeneas/Std/Scalar/Core.lean
index cbb2299e8..df465fa4f 100644
--- a/backends/lean/Aeneas/Std/Scalar/Core.lean
+++ b/backends/lean/Aeneas/Std/Scalar/Core.lean
@@ -626,7 +626,7 @@ theorem UScalar.tryMk_eq_DELETE_THIS_PROBABLY (ty : UScalarTy) (x : Nat) :
     grind
 
 theorem UScalar.tryMk_eq (ty : UScalarTy) (x : Nat) :
-  (tryMk ty x).reccases
+  (tryMk ty x).match
     (fun y => y.val = x ∧ inBounds ty x)
     False
     (fun (e : RustEffect.I) _ =>
@@ -676,7 +676,7 @@ theorem IScalar.tryMkOpt_eq (ty : IScalarTy) (x : Int) :
 --     grind
 
 theorem IScalar.tryMk_eq (ty : IScalarTy) (x : Int) :
-  (tryMk ty x).reccases
+  (tryMk ty x).match
   (fun y => y.val = x ∧ inBounds ty x)
   False
   (fun (e : RustEffect.I) _ =>
diff --git a/backends/lean/Aeneas/Std/Scalar/Ops/Add.lean b/backends/lean/Aeneas/Std/Scalar/Ops/Add.lean
index 08019f370..dde343b9c 100644
--- a/backends/lean/Aeneas/Std/Scalar/Ops/Add.lean
+++ b/backends/lean/Aeneas/Std/Scalar/Ops/Add.lean
@@ -35,33 +35,37 @@ instance {ty} : HAdd (IScalar ty) (IScalar ty) (Result (IScalar ty)) where
 -/
 
 theorem UScalar.add_equiv {ty} (x y : UScalar ty) :
-  match x + y with
-  | ok z => x.val + y.val < 2^ty.numBits ∧
+  (x + y).match
+  (fun z => x.val + y.val < 2^ty.numBits ∧
     z.val = x.val + y.val ∧
-    z.bv = x.bv + y.bv
-  | fail _ => ¬ (UScalar.inBounds ty (x.val + y.val))
-  | _ => ⊥ := by
+    z.bv = x.bv + y.bv)
+  ⊥
+  (fun e _k =>
+    match (e : RustEffect.I) with
+    | .fail _e => ¬ (UScalar.inBounds ty (x.val + y.val)))
+  := by
   have : x + y = add x y := by rfl
   rw [this]
   simp [add]
   have h := tryMk_eq ty (↑x + ↑y)
   simp [inBounds] at h
-  split at h <;> simp_all
+  generalize valh : (tryMk ty (↑x + ↑y)) = val at h
+  cases val <;> (try (simp_all <;> split)) <;> simp_all [pure]
   zify; simp
   zify at h
   have := @Int.emod_eq_of_lt (x.val + y.val) (2^ty.numBits) (by omega) (by omega)
   simp [*]
 
 theorem IScalar.add_equiv {ty} (x y : IScalar ty) :
-  (x + y).reccases
-  (fun z =>
-    IScalar.inBounds ty (x.val + y.val) ∧
-    z.val = x.val + y.val ∧
-    z.bv = x.bv + y.bv)
-  ⊥
-  (fun (e : RustEffect.I) _k =>
-    match e with
-    | .fail _e => ¬ (IScalar.inBounds ty (x.val + y.val)))
+  (x + y).match
+    (fun z =>
+      IScalar.inBounds ty (x.val + y.val) ∧
+      z.val = x.val + y.val ∧
+      z.bv = x.bv + y.bv)
+    ⊥
+    (fun (e : RustEffect.I) _k =>
+      match e with
+      | .fail _e => ¬ (IScalar.inBounds ty (x.val + y.val)))
   := by
   have : x + y = add x y := by rfl
   rw [this]
@@ -69,14 +73,7 @@ theorem IScalar.add_equiv {ty} (x y : IScalar ty) :
   have h := tryMk_eq ty (↑x + ↑y)
   simp [inBounds] at h
   generalize valh : (tryMk ty (↑x + ↑y)) = val at h
-  -- cases val -- TODO: to make this work, i need cases_eliminator attr on cases for result
-  --             -- its not good enough to have it just for ITree!
-  -- TODO: to make this work good, i need the cases_eliminator attribute on Result.match
-  -- i need to use Result.match in the theorem statement,
-  -- and i need simp lemmas that step Result.match using Result.div, Result.ok, Result.vis
-  -- so that its not necessary to unfold these definitions in here.
-  -- i also need to make Result.match actually compute in ITree.lean.
-  cases val <;> simp_all [div, pure]
+  cases val <;> simp_all [pure]
   apply BitVec.eq_of_toInt_eq
   simp
   have := bmod_pow_numBits_eq_of_lt ty (x.val + y.val) (by omega) (by omega)
@@ -92,7 +89,9 @@ theorem UScalar.add_bv_spec {ty} {x y : UScalar ty}
   (hmax : ↑x + ↑y ≤ UScalar.max ty) :
   x + y ⦃ z => (↑z : Nat) = ↑x + ↑y ∧ z.bv = x.bv + y.bv ⦄ := by
   have h := @add_equiv ty x y
-  split at h <;> simp_all [max]
+  generalize hval : (x + y) = val at h
+  cases val <;> simp_all [max]
+  -- split at h <;> simp_all [max]
   have : 0 < 2^ty.numBits := by simp
   omega
 

From 256407809e7725165298ab7d837d5ec7782a1884 Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Tue, 7 Jul 2026 15:44:31 -0400
Subject: [PATCH 47/67] fixed many of the Result match issues

---
 backends/lean/Aeneas/Std/Primitives.lean     | 55 ++++++++++++++++----
 backends/lean/Aeneas/Std/Scalar/Core.lean    | 12 +----
 backends/lean/Aeneas/Std/Scalar/Ops/Add.lean | 22 ++++----
 backends/lean/Aeneas/Std/Scalar/Ops/Neg.lean |  6 ++-
 backends/lean/Aeneas/Std/Scalar/Ops/Sub.lean | 35 +++++++------
 5 files changed, 82 insertions(+), 48 deletions(-)

diff --git a/backends/lean/Aeneas/Std/Primitives.lean b/backends/lean/Aeneas/Std/Primitives.lean
index 04b6d31b6..d48c857c8 100644
--- a/backends/lean/Aeneas/Std/Primitives.lean
+++ b/backends/lean/Aeneas/Std/Primitives.lean
@@ -104,29 +104,64 @@ theorem ok_not_fail {α} {a : α} {e} : ¬ Result.ok a = .fail e := by grind [Re
 -- @[simp, grind .]
 theorem ok_not_div {α} {a : α} : ¬ Result.ok a = .div := by grind [Result.ok, Result.div, not_ret_div]
 -- @[simp, grind .]
-theorem ok_inj {α} {a b : α} : Result.ok a = .ok b → a = b := by grind [Result.ok, ret_inj]
+@[simp]
+theorem Result.ok.injEq {α} {a b : α} : (Result.ok a = .ok b) = (a = b) := by
+  grind [Result.ok, ret_inj]
 
 -- previously Result was an inductive with ok, div, and fail cases only.
 -- this function can be used in many cases to replace pattern matching on that inductive:
+-- TODO: why do things error when this is def instead of abbrev?
 @[elab_as_elim, cases_eliminator]
 abbrev Result.match {α} (r : Result α)
   {motive : Result α → Sort v}
-  (ok : ∀ r, motive (pure r))
+  (ok : ∀ r, motive (.ok r))
+  (fail : ∀ e, motive (.fail e))
   (div :  motive (.div))
-  (vis : ∀ i k, motive (ITree.vis i k))
-  : motive r := ITree.cases ok div vis r
+  -- will add more inputs as we add effects
+  : motive r := ITree.cases ok div (
+      fun e k => match e with
+        | .fail e => by
+            have same : k = PEmpty.elim := by funext x; contradiction
+            simp [same]
+            exact (fail e)
+    ) r
+
+@[simp]
+theorem Result.match.ok {R motive r d f x}
+  : @Result.match R (.ok x) motive r f d = r x := ITree.cases.ret
+
+@[simp]
+theorem Result.match.div {R motive r d f}
+  : @Result.match R .div motive r f d = d := ITree.cases.div
+
+@[simp]
+theorem Result.match.fail {R motive r d f e}
+  : @Result.match R (.fail e) motive r f d = f e := ITree.cases.vis
+
+-- TODO: do we need both versions? I had problems with motives not being correct using the
+-- dependent version, and maybe you can't use this one as a cases eliminator. TODO
+def Result.nmatch {α} (r : Result α)
+  {Out : Sort v}
+  (ok : α  → Out)
+  (fail : Error → Out)
+  (div :  Out)
+  -- will add more inputs as we add effects
+  : Out := ITree.cases ok div (
+      fun e _k => match e with
+        | .fail e => fail e
+    ) r
 
 @[simp]
-theorem Result.match.ok {R motive r d v x}
-  : @Result.match R (.ok x) motive r d v = r x := ITree.cases.ret
+theorem Result.nmatch.ok {R Out r d f x}
+  : @Result.nmatch R (.ok x) Out r f d = r x := ITree.cases.ret
 
 @[simp]
-theorem Result.match.div {R motive r d v}
-  : @Result.match R .div motive r d v = d := ITree.cases.div
+theorem Result.nmatch.div {R Out r d f}
+  : @Result.nmatch R .div Out r f d = d := ITree.cases.div
 
 @[simp]
-theorem Result.match.vis {R motive r d v e k}
-  : @Result.match R (.vis e k) motive r d v = v e k := ITree.cases.vis
+theorem Result.nmatch.fail {R Out r d f e}
+  : @Result.nmatch R (.fail e) Out r f d = f e := ITree.cases.vis
 
 open Result
 
diff --git a/backends/lean/Aeneas/Std/Scalar/Core.lean b/backends/lean/Aeneas/Std/Scalar/Core.lean
index df465fa4f..8aab9f13e 100644
--- a/backends/lean/Aeneas/Std/Scalar/Core.lean
+++ b/backends/lean/Aeneas/Std/Scalar/Core.lean
@@ -628,12 +628,8 @@ theorem UScalar.tryMk_eq_DELETE_THIS_PROBABLY (ty : UScalarTy) (x : Nat) :
 theorem UScalar.tryMk_eq (ty : UScalarTy) (x : Nat) :
   (tryMk ty x).match
     (fun y => y.val = x ∧ inBounds ty x)
+    (fun e => ¬ (inBounds ty x))
     False
-    (fun (e : RustEffect.I) _ =>
-      match e with
-      | RustEffect.I.fail _e => ¬ (inBounds ty x)
-      -- | _ => False -- uncomment this once there are other effects
-      )
   := by
   have := UScalar.tryMkOpt_eq ty x
   simp [tryMk, ofOption]
@@ -678,12 +674,8 @@ theorem IScalar.tryMkOpt_eq (ty : IScalarTy) (x : Int) :
 theorem IScalar.tryMk_eq (ty : IScalarTy) (x : Int) :
   (tryMk ty x).match
   (fun y => y.val = x ∧ inBounds ty x)
+  (fun _e => ¬ (inBounds ty x))
   False
-  (fun (e : RustEffect.I) _ =>
-    match e with
-    | RustEffect.I.fail _e => ¬ (inBounds ty x)
-    -- | _ => False -- uncomment this once there are other effects
-    )
   := by
   have := tryMkOpt_eq ty x
   simp [tryMk]
diff --git a/backends/lean/Aeneas/Std/Scalar/Ops/Add.lean b/backends/lean/Aeneas/Std/Scalar/Ops/Add.lean
index dde343b9c..1425436b0 100644
--- a/backends/lean/Aeneas/Std/Scalar/Ops/Add.lean
+++ b/backends/lean/Aeneas/Std/Scalar/Ops/Add.lean
@@ -39,10 +39,8 @@ theorem UScalar.add_equiv {ty} (x y : UScalar ty) :
   (fun z => x.val + y.val < 2^ty.numBits ∧
     z.val = x.val + y.val ∧
     z.bv = x.bv + y.bv)
+  (fun _e => ¬ (UScalar.inBounds ty (x.val + y.val)))
   ⊥
-  (fun e _k =>
-    match (e : RustEffect.I) with
-    | .fail _e => ¬ (UScalar.inBounds ty (x.val + y.val)))
   := by
   have : x + y = add x y := by rfl
   rw [this]
@@ -50,7 +48,7 @@ theorem UScalar.add_equiv {ty} (x y : UScalar ty) :
   have h := tryMk_eq ty (↑x + ↑y)
   simp [inBounds] at h
   generalize valh : (tryMk ty (↑x + ↑y)) = val at h
-  cases val <;> (try (simp_all <;> split)) <;> simp_all [pure]
+  cases val <;> simp_all
   zify; simp
   zify at h
   have := @Int.emod_eq_of_lt (x.val + y.val) (2^ty.numBits) (by omega) (by omega)
@@ -62,10 +60,8 @@ theorem IScalar.add_equiv {ty} (x y : IScalar ty) :
       IScalar.inBounds ty (x.val + y.val) ∧
       z.val = x.val + y.val ∧
       z.bv = x.bv + y.bv)
+    (fun _e => ¬ (IScalar.inBounds ty (x.val + y.val)))
     ⊥
-    (fun (e : RustEffect.I) _k =>
-      match e with
-      | .fail _e => ¬ (IScalar.inBounds ty (x.val + y.val)))
   := by
   have : x + y = add x y := by rfl
   rw [this]
@@ -73,7 +69,7 @@ theorem IScalar.add_equiv {ty} (x y : IScalar ty) :
   have h := tryMk_eq ty (↑x + ↑y)
   simp [inBounds] at h
   generalize valh : (tryMk ty (↑x + ↑y)) = val at h
-  cases val <;> simp_all [pure]
+  cases val <;> simp_all
   apply BitVec.eq_of_toInt_eq
   simp
   have := bmod_pow_numBits_eq_of_lt ty (x.val + y.val) (by omega) (by omega)
@@ -91,7 +87,6 @@ theorem UScalar.add_bv_spec {ty} {x y : UScalar ty}
   have h := @add_equiv ty x y
   generalize hval : (x + y) = val at h
   cases val <;> simp_all [max]
-  -- split at h <;> simp_all [max]
   have : 0 < 2^ty.numBits := by simp
   omega
 
@@ -101,7 +96,8 @@ theorem IScalar.add_bv_spec {ty}  {x y : IScalar ty}
   (hmax : ↑x + ↑y ≤ IScalar.max ty) :
   x + y ⦃ z => (↑z : Int) = ↑x + ↑y ∧ z.bv = x.bv + y.bv ⦄ := by
   have h := @add_equiv ty x y
-  split at h <;> simp_all [min, max]
+  generalize hval : (x + y) = val at h
+  cases val <;> simp_all [min, max]
   omega
 
 uscalar theorem «%S».add_bv_spec {x y : «%S»} (hmax : x.val + y.val ≤ «%S».max) :
@@ -125,7 +121,8 @@ theorem UScalar.add_spec {ty} {x y : UScalar ty}
   (hmax : ↑x + ↑y ≤ UScalar.max ty) :
   x + y ⦃ z => (↑z : Nat) = ↑x + ↑y ⦄ := by
   have h := @add_equiv ty x y
-  split at h <;> simp_all [max]
+  generalize hval : (x + y) = val at h
+  cases val <;> simp_all [max]
   have : 0 < 2^ty.numBits := by simp
   omega
 
@@ -136,7 +133,8 @@ theorem IScalar.add_spec {ty} {x y : IScalar ty}
   (hmax : ↑x + ↑y ≤ IScalar.max ty) :
   x + y ⦃ z => (↑z : Int) = ↑x + ↑y ⦄ := by
   have h := @add_equiv ty x y
-  split at h <;> simp_all [min, max]
+  generalize hval : (x + y) = val at h
+  cases val <;> simp_all [min, max]
   omega
 
 uscalar @[step] theorem «%S».add_spec {x y : «%S»} (hmax : x.val + y.val ≤ «%S».max) :
diff --git a/backends/lean/Aeneas/Std/Scalar/Ops/Neg.lean b/backends/lean/Aeneas/Std/Scalar/Ops/Neg.lean
index a4e420c36..8f78b2df0 100644
--- a/backends/lean/Aeneas/Std/Scalar/Ops/Neg.lean
+++ b/backends/lean/Aeneas/Std/Scalar/Ops/Neg.lean
@@ -17,8 +17,12 @@ def IScalar.neg {ty : IScalarTy} (x : IScalar ty) : Result (IScalar ty) := IScal
 theorem IScalar.neg_step {ty} (x: IScalar ty) (h: x ≠ IScalar.min ty): IScalar.neg x ⦃ r => r = -x.val ⦄ := by
   simp [neg]
   have h := tryMk_eq ty (-x.val)
+  simp [inBounds] at h
+  generalize hval : (tryMk ty (-↑x)) = val at h
+  cases val <;> simp_all
   have := IScalar.hBounds x
-  cases h <;> try grind [IScalar.min]
+  simp [IScalar.min] at *
+  grind
 
 /--
 The notation typeclass for heterogeneous negation.
diff --git a/backends/lean/Aeneas/Std/Scalar/Ops/Sub.lean b/backends/lean/Aeneas/Std/Scalar/Ops/Sub.lean
index 060181a6c..dd30609e2 100644
--- a/backends/lean/Aeneas/Std/Scalar/Ops/Sub.lean
+++ b/backends/lean/Aeneas/Std/Scalar/Ops/Sub.lean
@@ -37,13 +37,13 @@ instance {ty} : HSub (IScalar ty) (IScalar ty) (Result (IScalar ty)) where
 -/
 
 theorem UScalar.sub_equiv {ty} (x y : UScalar ty) :
-  match x - y with
-  | ok z =>
+  (x - y).nmatch -- TODO: here, the dependent version breaks things in the proof
+  (fun z =>
     y.val ≤ x.val ∧
     x.val = z.val + y.val ∧
-    z.bv = x.bv - y.bv
-  | fail _ => x.val < y.val
-  | _ => ⊥ := by
+    z.bv = x.bv - y.bv)
+  (fun _ => x.val < y.val)
+  ⊥ := by
   have : x - y = sub x y := by rfl
   simp [this, sub]
   dcases h : x.val < y.val <;> simp [h]
@@ -81,18 +81,19 @@ theorem UScalar.sub_equiv {ty} (x y : UScalar ty) :
     ring_nf
 
 theorem IScalar.sub_equiv {ty} (x y : IScalar ty) :
-  match x - y with
-  | ok z =>
+  (x - y).nmatch
+  (fun z =>
     IScalar.inBounds ty (x.val - y.val) ∧
     z.val = x.val - y.val ∧
-    z.bv = x.bv - y.bv
-  | fail _ => ¬ (IScalar.inBounds ty (x.val - y.val))
-  | _ => ⊥ := by
+    z.bv = x.bv - y.bv)
+  (fun _ => ¬ (IScalar.inBounds ty (x.val - y.val)))
+  ⊥ := by
   have : x - y = sub x y := by rfl
   simp [this, sub]
   have h := tryMk_eq ty (↑x - ↑y)
   simp [inBounds] at h
-  split at h <;> simp_all
+  generalize valh : (tryMk ty (↑x - ↑y)) = val at h
+  cases val <;> simp_all
   apply BitVec.eq_of_toInt_eq
   simp
   have := bmod_pow_numBits_eq_of_lt ty (x.val - y.val) (by omega) (by omega)
@@ -107,7 +108,8 @@ theorem UScalar.sub_bv_spec {ty} {x y : UScalar ty}
   (h : y.val ≤ x.val) :
   x - y ⦃ z => z.val = x.val - y.val ∧ y.val ≤ x.val ∧ z.bv = x.bv - y.bv ⦄ := by
   have h := @sub_equiv ty x y
-  split at h <;> simp_all
+  generalize hval : x - y = val at h
+  cases val <;> simp_all
   omega
 
 /- Generic theorem - shouldn't be used much -/
@@ -116,7 +118,8 @@ theorem IScalar.sub_bv_spec {ty} {x y : IScalar ty}
   (hmax : ↑x - ↑y ≤ IScalar.max ty) :
   x - y ⦃ z => (↑z : Int) = ↑x - ↑y ∧ z.bv = x.bv - y.bv ⦄ := by
   have h := @sub_equiv ty x y
-  split at h <;> simp_all [min, max]
+  generalize hval : x - y = val at h
+  cases val <;> simp_all [min, max]
   omega
 
 uscalar theorem «%S».sub_bv_spec {x y : «%S»} (h : y.val ≤ x.val) :
@@ -138,7 +141,8 @@ theorem UScalar.sub_spec {ty} {x y : UScalar ty}
   (h : y.val ≤ x.val) :
   x - y ⦃ z => z.val = x.val - y.val ∧ y.val ≤ x.val ⦄ := by
   have h := @sub_equiv ty x y
-  split at h <;> simp_all
+  generalize hval : x - y = val at h
+  cases val <;> simp_all
   omega
 
 /- Generic theorem - shouldn't be used much -/
@@ -148,7 +152,8 @@ theorem IScalar.sub_spec {ty} {x y : IScalar ty}
   (hmax : ↑x - ↑y ≤ IScalar.max ty) :
   x - y ⦃ z => (↑z : Int) = ↑x - ↑y ⦄ := by
   have h := @sub_equiv ty x y
-  split at h <;> simp_all [min, max]
+  generalize hval : x - y = val at h
+  cases val <;> simp_all [min, max]
   omega
 
 uscalar @[step] theorem «%S».sub_spec {x y : «%S»} (h : y.val ≤ x.val) :

From e28578fc92531330de0105ea86bba2d8277a3bc4 Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Tue, 7 Jul 2026 17:00:10 -0400
Subject: [PATCH 48/67] more progress to fixing ITree migration

---
 backends/lean/Aeneas/Std/Primitives.lean     | 15 +++++----
 backends/lean/Aeneas/Std/Scalar/Core.lean    |  2 +-
 backends/lean/Aeneas/Std/Scalar/Ops/Mul.lean | 33 +++++++++++---------
 3 files changed, 27 insertions(+), 23 deletions(-)

diff --git a/backends/lean/Aeneas/Std/Primitives.lean b/backends/lean/Aeneas/Std/Primitives.lean
index d48c857c8..604bc7457 100644
--- a/backends/lean/Aeneas/Std/Primitives.lean
+++ b/backends/lean/Aeneas/Std/Primitives.lean
@@ -239,27 +239,27 @@ instance : Pure Result where
   pure := fun x => ok x
 
 @[simp] theorem bind_ok (x : α) (f : α → Result β) : bind (.ok x) f = f x :=
-  by simp [bind, Bind.bind, ok]
+  by simp [bind, ok]
 @[simp] theorem bind_fail (x : Error) (f : α → Result β) : bind (.fail x) f = .fail x :=
-  by simp [bind, Bind.bind, fail]
+  by simp [bind, fail]
      apply congrArg
      funext x
      contradiction
 
-@[simp] theorem bind_div (f : α → Result β) : bind .div f = .div := by simp [bind, Bind.bind, div]
+@[simp] theorem bind_div (f : α → Result β) : bind .div f = .div := by simp [bind, div]
 
 @[simp] theorem bind_tc_ok (x : α) (f : α → Result β) :
   (do let y ← .ok x; f y) = f x := by simp [Bind.bind, ok]
 
 @[simp] theorem bind_tc_fail (x : Error) (f : α → Result β) :
   (do let y ← fail x; f y) = fail x := by
-  simp [Bind.bind, bind, fail]
+  simp [Bind.bind, fail]
   apply congrArg
   funext x
   contradiction
 
 @[simp] theorem bind_tc_div (f : α → Result β) :
-  (do let y ← div; f y) = div := by simp [Bind.bind, bind, div]
+  (do let y ← div; f y) = div := by simp [Bind.bind, div]
 
 @[simp] theorem bind_assoc_eq {a b c : Type u}
   (e : Result a) (g :  a → Result b) (h : b → Result c) :
@@ -445,11 +445,10 @@ instance SubtypeLawfulBEq [BEq α] (p : α → Prop) [LawfulBEq α] : LawfulBEq
    TODO: move up to Core module? -/
 def Option.ofResult {a : Type u} (x : Result a) :
   Option a :=
-  ITree.cases
+  x.nmatch
     .some
+    (fun _ => .none)
     .none
-    (fun _ _ => .none)
-    x
 
 /-!
 # bv_decide
diff --git a/backends/lean/Aeneas/Std/Scalar/Core.lean b/backends/lean/Aeneas/Std/Scalar/Core.lean
index 8aab9f13e..032b51559 100644
--- a/backends/lean/Aeneas/Std/Scalar/Core.lean
+++ b/backends/lean/Aeneas/Std/Scalar/Core.lean
@@ -628,7 +628,7 @@ theorem UScalar.tryMk_eq_DELETE_THIS_PROBABLY (ty : UScalarTy) (x : Nat) :
 theorem UScalar.tryMk_eq (ty : UScalarTy) (x : Nat) :
   (tryMk ty x).match
     (fun y => y.val = x ∧ inBounds ty x)
-    (fun e => ¬ (inBounds ty x))
+    (fun _e => ¬ (inBounds ty x))
     False
   := by
   have := UScalar.tryMkOpt_eq ty x
diff --git a/backends/lean/Aeneas/Std/Scalar/Ops/Mul.lean b/backends/lean/Aeneas/Std/Scalar/Ops/Mul.lean
index 91053aec4..c1755e1aa 100644
--- a/backends/lean/Aeneas/Std/Scalar/Ops/Mul.lean
+++ b/backends/lean/Aeneas/Std/Scalar/Ops/Mul.lean
@@ -40,16 +40,17 @@ Theorems with a specification which use integers and bit-vectors
 -/
 
 theorem UScalar.mul_equiv {ty} (x y : UScalar ty) :
-  match mul x y with
-  | ok z => x.val * y.val ≤ UScalar.max ty ∧ (↑z : Nat) = ↑x * ↑y ∧ z.bv = x.bv * y.bv
-  | fail _ => UScalar.max ty < x.val * y.val
-  | .div => False
+  (mul x y).match
+  (fun z => x.val * y.val ≤ UScalar.max ty ∧ (↑z : Nat) = ↑x * ↑y ∧ z.bv = x.bv * y.bv)
+  (fun _ => UScalar.max ty < x.val * y.val)
+  False
   := by
   simp only [mul]
   have := tryMk_eq ty (x.val * y.val)
-  split <;> simp_all only [inBounds, true_and, not_lt, gt_iff_lt]
+  generalize hval : tryMk ty (↑x * ↑y) = val at this
+  cases val <;> simp_all [inBounds, true_and, not_lt, gt_iff_lt, «match».ok]
   simp_all only [tryMk, ofOption, tryMkOpt, check_bounds, decide_true, dite_true, ok.injEq]
-  rename_i hEq; simp only [← hEq, ofNatCore, val]
+  rename_i hEq; simp only [← hval, ofNatCore, val]
   split_conjs
   . simp only [bv_toNat, max]; omega
   . zify at this; zify; simp only [bv_toNat, BitVec.toNat_ofFin, Nat.cast_mul, BitVec.toNat_mul,
@@ -67,20 +68,23 @@ theorem UScalar.mul_bv_spec {ty} {x y : UScalar ty}
   x * y ⦃ z => (↑z : Nat) = ↑x * ↑y ∧ z.bv = x.bv * y.bv ⦄ := by
   have : x * y = mul x y := by rfl
   have := mul_equiv x y
-  split at this <;> simp_all [spec_ok, and_self, spec_fail]
+  generalize hval : x.mul y = val at this
+  cases val <;> simp_all [spec_ok, and_self, spec_fail]
   omega
 
 theorem IScalar.mul_equiv {ty} (x y : IScalar ty) :
-  match mul x y with
-  | ok z => IScalar.min ty ≤ x.val * y.val ∧ x.val * y.val ≤ IScalar.max ty ∧ z.val = x.val * y.val ∧ z.bv = x.bv * y.bv
-  | fail _ => ¬(IScalar.min ty ≤ x.val * y.val ∧ x.val * y.val ≤ IScalar.max ty)
-  | .div => False := by
+  (mul x y).match
+  (fun z => IScalar.min ty ≤ x.val * y.val ∧ x.val * y.val ≤ IScalar.max ty ∧ z.val = x.val * y.val ∧ z.bv = x.bv * y.bv)
+  (fun _ => ¬(IScalar.min ty ≤ x.val * y.val ∧ x.val * y.val ≤ IScalar.max ty))
+  False := by
   simp only [mul, not_and, not_le]
   have := tryMk_eq ty (x.val * y.val)
-  split <;> simp_all only [inBounds, min, max, true_and, not_and, not_lt] <;>
+  generalize hval : tryMk ty (↑x * ↑y) = value at this
+  cases value <;> simp_all only [«match».ok, «match».div, «match».fail, inBounds, min, max, true_and, not_and, not_lt] <;>
   simp_all only [tryMk, ofOption, tryMkOpt, check_bounds, and_self, decide_true, dite_true,
     ok.injEq, Bool.decide_and, Bool.and_eq_true, decide_eq_true_eq] <;>
-  rename_i hEq <;> simp only [← hEq, ofIntCore, val] <;>
+  simp only [← hval, ofIntCore, val] <;>
+  clear hval <;>
   simp only [bv_toInt_eq, ← BitVec.toInt_inj, BitVec.toInt_mul]
   . split_conjs
     . omega
@@ -119,7 +123,8 @@ theorem IScalar.mul_bv_spec {ty} {x y : IScalar ty}
   x * y ⦃ z => (↑z : Int) = ↑x * ↑y ∧ z.bv = x.bv * y.bv ⦄ := by
   have : x * y = mul x y := by rfl
   have := mul_equiv x y
-  split at this <;> simp_all
+  generalize hvalue : x.mul y = value at this
+  cases value <;> simp_all
 
 uscalar theorem «%S».mul_bv_spec {x y : «%S»} (hmax : x.val * y.val ≤ «%S».max) :
   x * y ⦃ z => (↑z : Nat) = ↑x * ↑y ∧ z.bv = x.bv * y.bv ⦄ :=

From ffc411b17ef6be53901689c17fafd9d4054d11cf Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Wed, 8 Jul 2026 11:24:48 -0400
Subject: [PATCH 49/67] more progress fixing migration errors

---
 backends/lean/Aeneas/Std/Array/Core.lean     | 12 ++-
 backends/lean/Aeneas/Std/Primitives.lean     | 88 +++++++++++++-------
 backends/lean/Aeneas/Std/Scalar/Core.lean    |  4 +-
 backends/lean/Aeneas/Std/Scalar/Ops/Add.lean |  4 +-
 backends/lean/Aeneas/Std/Scalar/Ops/Mul.lean |  6 +-
 backends/lean/Aeneas/Std/WP.lean             | 31 ++++---
 6 files changed, 85 insertions(+), 60 deletions(-)

diff --git a/backends/lean/Aeneas/Std/Array/Core.lean b/backends/lean/Aeneas/Std/Array/Core.lean
index 9d2cdf044..a81fcea93 100644
--- a/backends/lean/Aeneas/Std/Array/Core.lean
+++ b/backends/lean/Aeneas/Std/Array/Core.lean
@@ -34,10 +34,14 @@ theorem List.mapM_clone_eq {T : Type u} {clone : T → Result T} {l : List T}
   apply h
 
 def List.clone (clone : α → Result α) (l : List α) : Result ({ l' : List α // l'.length = l.length}) :=
-  match h :List.mapM clone l with
-  | ok v => ok ⟨ v, by have := List.mapM_Result_length h; scalar_tac ⟩
-  | fail e => fail e
-  | div => div
+  -- match h :List.mapM clone l with
+  -- | ok v => ok ⟨ v, by have := List.mapM_Result_length h; scalar_tac ⟩
+  -- | fail e => fail e
+  -- | div => div
+  (List.mapM clone l).match
+  (fun v => ok ⟨ v, by have := List.mapM_Result_length h; scalar_tac ⟩)
+  (fun e => fail e)
+  div
 
 @[step]
 def List.clone_spec {clone : α → Result α} {l : List α} (h : ∀ x ∈ l, clone x = ok x) :
diff --git a/backends/lean/Aeneas/Std/Primitives.lean b/backends/lean/Aeneas/Std/Primitives.lean
index 604bc7457..183a39c72 100644
--- a/backends/lean/Aeneas/Std/Primitives.lean
+++ b/backends/lean/Aeneas/Std/Primitives.lean
@@ -63,18 +63,8 @@ deriving Repr, BEq
 
 open Error
 
--- TODO: delete this
--- inductive Result (α : Type u) where
---   | ok (v: α): Result α
---   | fail (e: Error): Result α
---   | div
--- deriving Repr, BEq
-
 inductive RustEffect.I : Type where
 | fail : Error → RustEffect.I
--- there is an issue that both threads have to return the return type.
--- maybe this is fine, and you can just bind an operation that returns Unit?
--- i could make a generalized ITree definition which allows you to do stuff to the return type in Effect?
 
 def RustEffect.O (i : RustEffect.I) : Type :=
   match i with
@@ -87,10 +77,6 @@ def RustEffect : Effect := {
 
 def Result (α : Type u) : Type u := ITree RustEffect α
 
-instance : Monad Result := instMonadITree
-instance : Bind Result where
-  bind := ITree.bind
-instance : LawfulMonad Result := instLawfulMonadITree
 
 def Result.ok {α} (a : α) : Result α := .ret a
 
@@ -98,13 +84,34 @@ def Result.fail {α} (e : Error) : Result α := .vis (.fail e) PEmpty.elim
 
 def Result.div {α} : Result α := ITree.div
 
+
+-- TODO: in addition to type levels, does it cause issues that bind comes from the Monad instance?
+-- -- TODO: is it ok to not have β be at a different level `v`?
+def bind {α : Type u} {β : Type v} (x: Result α) (f: α → Result β) : Result β :=
+  ITree.bind x f
+-- instance : Monad Result := instMonadITree
+instance : Monad Result where
+  pure := .ok
+  bind := bind
+-- instance : Bind Result where
+--   bind := bind -- ITree.bind
+instance : LawfulMonad Result := instLawfulMonadITree
+
 -- TODO: adding these to simp set messes up some things
--- @[simp, grind .]
+@[simp, grind .]
+-- @[simp]
 theorem ok_not_fail {α} {a : α} {e} : ¬ Result.ok a = .fail e := by grind [Result.ok, Result.fail, not_vis_ret]
--- @[simp, grind .]
+-- @[simp]
+@[simp, grind .]
+theorem fail_not_ok {α} {a : α} {e} : ¬ Result.fail e = .ok a := by grind [Result.ok, Result.fail, not_vis_ret]
+-- @[simp]
+@[simp, grind .]
 theorem ok_not_div {α} {a : α} : ¬ Result.ok a = .div := by grind [Result.ok, Result.div, not_ret_div]
--- @[simp, grind .]
-@[simp]
+-- @[simp]
+@[simp, grind .]
+theorem div_not_ok {α} {a : α} : ¬ Result.div = .ok a := by grind [Result.ok, Result.div, not_ret_div]
+-- @[simp]
+@[simp, grind .]
 theorem Result.ok.injEq {α} {a b : α} : (Result.ok a = .ok b) = (a = b) := by
   grind [Result.ok, ret_inj]
 
@@ -221,11 +228,6 @@ def Result.ofOption {a : Type u} (x : Option a) (e : Error) : Result a :=
 # Do-DSL Support
 -/
 
--- TODO: in addition to type levels, does it cause issues that bind comes from the Monad instance?
--- -- TODO: is it ok to not have β be at a different level `v`?
-def bind {α : Type u} {β : Type v} (x: Result α) (f: α → Result β) : Result β :=
-  ITree.bind x f
-
 -- TODO: should this just be deleted to clean things up now, or left for backwards compatibility?
 -- def bind {α : Type u} {β : Type v} (x: Result α) (f: α → Result β) : Result β :=
 --   @Bind.bind Result _ α β x f
@@ -235,8 +237,8 @@ def bind {α : Type u} {β : Type v} (x: Result α) (f: α → Result β) : Resu
   -- bind := bind
 
 -- Allows using pure x in do-blocks
-instance : Pure Result where
-  pure := fun x => ok x
+-- instance : Pure Result where
+--   pure := fun x => ok x
 
 @[simp] theorem bind_ok (x : α) (f : α → Result β) : bind (.ok x) f = f x :=
   by simp [bind, ok]
@@ -249,17 +251,17 @@ instance : Pure Result where
 @[simp] theorem bind_div (f : α → Result β) : bind .div f = .div := by simp [bind, div]
 
 @[simp] theorem bind_tc_ok (x : α) (f : α → Result β) :
-  (do let y ← .ok x; f y) = f x := by simp [Bind.bind, ok]
+  (do let y ← .ok x; f y) = f x := by simp [bind, Bind.bind, ok]
 
 @[simp] theorem bind_tc_fail (x : Error) (f : α → Result β) :
   (do let y ← fail x; f y) = fail x := by
-  simp [Bind.bind, fail]
+  simp [bind, Bind.bind, fail]
   apply congrArg
   funext x
   contradiction
 
 @[simp] theorem bind_tc_div (f : α → Result β) :
-  (do let y ← div; f y) = div := by simp [Bind.bind, div]
+  (do let y ← div; f y) = div := by simp [bind, Bind.bind, div]
 
 @[simp] theorem bind_assoc_eq {a b c : Type u}
   (e : Result a) (g :  a → Result b) (h : b → Result c) :
@@ -306,6 +308,31 @@ instance : PartialOrder (Result α) := instPartialOrderCoIndOfInhabitedPUnit _
 noncomputable instance : CCPO (Result α) := instCCPOCoIndOfInhabitedPUnit _
 noncomputable instance : MonoBind Result := instMonoBindITree
 
+-- TODO: is there a way to not need to state this, and just use the typeclass instance?
+-- @[partial_fixpoint_monotone]
+-- theorem monotone_bind
+--     {α β : Type u}
+--     {γ : Sort w} [PartialOrder γ]
+--     (f : γ → Result α) (g : γ → α → Result β)
+--     (hmono₁ : monotone f)
+--     (hmono₂ : monotone g) :
+--     monotone (fun (x : γ) => bind (f x) (g x)) := by
+--   intro x₁ x₂ hx₁₂
+--   apply PartialOrder.rel_trans
+--   · apply MonoBind.bind_mono_left (hmono₁ _ _ hx₁₂)
+--   · apply MonoBind.bind_mono_right (fun y => monotone_apply y _ hmono₂ _ _ hx₁₂)
+
+@[partial_fixpoint_monotone]
+theorem bind_mono {R : Type a} {α} {S : Type b} [PartialOrder α]
+  (f : α → Result R) (g : α → R → Result S) :
+  monotone f →
+  monotone g →
+  monotone (λ x => bind (f x) (g x)) := by
+    simp [bind]
+    apply Aeneas.Data.Coinductive.bind_mono
+
+-- TODO: when we add more effects, use Aeneas.Data.Coinductive.vis_mono
+-- to instantiate monotonicity theorems for those effects.
 end Order
 
 /-- Aeneas-internal version of `Function.uncurry` for tuple destructuring in bind
@@ -404,11 +431,8 @@ inductive ControlFlow (α : Type u) (β : Type v) where
   | done (v : β) -- break
 deriving Repr, BEq
 
--- TODO: will the fact that β now has level u instead of v cause problems?
 def loop {α : Type u} {β : Type v} (body : α → Result (ControlFlow α β)) (x : α) : Result β := do
-  ITree.bind (body x) fun r =>
-  -- let r ← body x
-  -- _
+  bind (body x) fun r =>
   match r with
   | ControlFlow.cont x => loop body x
   | ControlFlow.done x => ok x
diff --git a/backends/lean/Aeneas/Std/Scalar/Core.lean b/backends/lean/Aeneas/Std/Scalar/Core.lean
index 032b51559..09e233218 100644
--- a/backends/lean/Aeneas/Std/Scalar/Core.lean
+++ b/backends/lean/Aeneas/Std/Scalar/Core.lean
@@ -672,14 +672,14 @@ theorem IScalar.tryMkOpt_eq (ty : IScalarTy) (x : Int) :
 --     grind
 
 theorem IScalar.tryMk_eq (ty : IScalarTy) (x : Int) :
-  (tryMk ty x).match
+  (tryMk ty x).nmatch
   (fun y => y.val = x ∧ inBounds ty x)
   (fun _e => ¬ (inBounds ty x))
   False
   := by
   have := tryMkOpt_eq ty x
   simp [tryMk]
-  cases h : tryMkOpt ty x <;> simp_all [fail, ok]
+  cases h : tryMkOpt ty x <;> simp_all
 
 -- TODO: delete old one
 -- theorem IScalar.tryMk_eq (ty : IScalarTy) (x : Int) :
diff --git a/backends/lean/Aeneas/Std/Scalar/Ops/Add.lean b/backends/lean/Aeneas/Std/Scalar/Ops/Add.lean
index 1425436b0..b8b5fbf18 100644
--- a/backends/lean/Aeneas/Std/Scalar/Ops/Add.lean
+++ b/backends/lean/Aeneas/Std/Scalar/Ops/Add.lean
@@ -35,7 +35,7 @@ instance {ty} : HAdd (IScalar ty) (IScalar ty) (Result (IScalar ty)) where
 -/
 
 theorem UScalar.add_equiv {ty} (x y : UScalar ty) :
-  (x + y).match
+  (x + y).nmatch
   (fun z => x.val + y.val < 2^ty.numBits ∧
     z.val = x.val + y.val ∧
     z.bv = x.bv + y.bv)
@@ -55,7 +55,7 @@ theorem UScalar.add_equiv {ty} (x y : UScalar ty) :
   simp [*]
 
 theorem IScalar.add_equiv {ty} (x y : IScalar ty) :
-  (x + y).match
+  (x + y).nmatch
     (fun z =>
       IScalar.inBounds ty (x.val + y.val) ∧
       z.val = x.val + y.val ∧
diff --git a/backends/lean/Aeneas/Std/Scalar/Ops/Mul.lean b/backends/lean/Aeneas/Std/Scalar/Ops/Mul.lean
index c1755e1aa..7af3c434e 100644
--- a/backends/lean/Aeneas/Std/Scalar/Ops/Mul.lean
+++ b/backends/lean/Aeneas/Std/Scalar/Ops/Mul.lean
@@ -40,7 +40,7 @@ Theorems with a specification which use integers and bit-vectors
 -/
 
 theorem UScalar.mul_equiv {ty} (x y : UScalar ty) :
-  (mul x y).match
+  (mul x y).nmatch
   (fun z => x.val * y.val ≤ UScalar.max ty ∧ (↑z : Nat) = ↑x * ↑y ∧ z.bv = x.bv * y.bv)
   (fun _ => UScalar.max ty < x.val * y.val)
   False
@@ -73,14 +73,14 @@ theorem UScalar.mul_bv_spec {ty} {x y : UScalar ty}
   omega
 
 theorem IScalar.mul_equiv {ty} (x y : IScalar ty) :
-  (mul x y).match
+  (mul x y).nmatch
   (fun z => IScalar.min ty ≤ x.val * y.val ∧ x.val * y.val ≤ IScalar.max ty ∧ z.val = x.val * y.val ∧ z.bv = x.bv * y.bv)
   (fun _ => ¬(IScalar.min ty ≤ x.val * y.val ∧ x.val * y.val ≤ IScalar.max ty))
   False := by
   simp only [mul, not_and, not_le]
   have := tryMk_eq ty (x.val * y.val)
   generalize hval : tryMk ty (↑x * ↑y) = value at this
-  cases value <;> simp_all only [«match».ok, «match».div, «match».fail, inBounds, min, max, true_and, not_and, not_lt] <;>
+  cases value <;> simp_all only [«nmatch».ok, «nmatch».div, «nmatch».fail, inBounds, min, max, true_and, not_and, not_lt] <;>
   simp_all only [tryMk, ofOption, tryMkOpt, check_bounds, and_self, decide_true, dite_true,
     ok.injEq, Bool.decide_and, Bool.and_eq_true, decide_eq_true_eq] <;>
   simp only [← hval, ofIntCore, val] <;>
diff --git a/backends/lean/Aeneas/Std/WP.lean b/backends/lean/Aeneas/Std/WP.lean
index 73dab23d4..e7b376fa2 100644
--- a/backends/lean/Aeneas/Std/WP.lean
+++ b/backends/lean/Aeneas/Std/WP.lean
@@ -30,7 +30,7 @@ def wp_return (x:α) : Wp α := fun p => p x
 
 @[grind]
 inductive spec {α} : (x : Result α) → (p : Post α) →  Prop where
-| ret : ∀ x, p x → spec (ITree.ret x) p
+| ret : ∀ x, p x → spec (.ok x) p
 -- | vis : ∀ k, (∀ b, spec p (k b)) → spec p (ITree.vis () k)
 -- | fail : ∀ k, (∀ b, spec p (k b)) → spec p (ITree.vis () k)
 
@@ -42,7 +42,7 @@ inductive spec {α} : (x : Result α) → (p : Post α) →  Prop where
 --   | fail _ => False
 --   | div => True
 inductive dspec {α} : (x : Result α) → (p : Post α) →  Prop where
-| ret : ∀ x, p x → dspec (ITree.ret x) p
+| ret : ∀ x, p x → dspec (.ok x) p
 | div : dspec div p
 
 theorem spec_dspec (α) (x : Result α) (p: Post α) : spec x p → dspec x p := by
@@ -78,20 +78,18 @@ theorem spec_ok (x : α) : spec (ok x) p ↔ p x := by
   constructor
   · intros s
     generalize H : ok x = v at s
-    simp [ok] at H
     cases s
-    grind only [ret_inj]
+    simp at H
+    grind
   · intros px
     constructor
     assumption
 
 @[simp, grind =, agrind =]
-theorem spec_fail (e : Error) : spec (fail e) p ↔ False := by
-  grind only [spec, fail, not_vis_ret]
+theorem spec_fail (e : Error) : spec (fail e) p ↔ False := by grind
 
 @[simp, grind =, agrind =]
-theorem spec_div : spec div p ↔ False := by
-  grind only [spec, div, not_ret_div]
+theorem spec_div : spec div p ↔ False := by grind
 
 /-! ### `spec_*` for tuple posts
 
@@ -168,9 +166,9 @@ theorem spec_bind' {α β} {k : α -> Result β} {Pₖ : Post β} {m : Result α
   (qimp_spec Pₘ k Pₖ) →
   spec (Std.bind m k) Pₖ := by
   intro Hm Hk
-  simp only [bind, qimp_spec] at *
+  simp only [qimp_spec] at *
   cases Hm
-  simp only [itree_ret_bind]
+  simp
   grind only
 
 /-- We use this lemma to decompose nested `uncurry'` predicates into a sequence of universal quantifiers. -/
@@ -236,11 +234,11 @@ theorem dspec_bind' {α β} {k : α -> Result β} {Pₖ : Post β} {m : Result 
   (qimp_dspec Pₘ k Pₖ) →
   dspec (Std.bind m k) Pₖ := by
   intro Hm Hk
-  simp only [bind, qimp_dspec] at *
+  simp only [qimp_dspec] at *
   cases Hm
-  · simp only [itree_ret_bind]
+  · simp
     grind only
-  · simp [div]
+  · simp
     constructor
 
 @[simp]
@@ -264,11 +262,10 @@ def qimp_dspec_iff {α β} (P : α → Prop) (k : α → Result β) (Q : β →
 
 @[simp, grind =, agrind =]
 theorem dspec_ok (x : α) : dspec (ok x) p ↔ p x := by
-  simp [ok]
   constructor
   · intros s
-    generalize h : ITree.ret x = v at s
-    cases s <;> grind [div, ret_inj, not_ret_div]
+    generalize h : Result.ok x = v at s
+    cases s <;> simp at *; grind
   · intros px
     constructor
     assumption
@@ -871,7 +868,7 @@ theorem loop.spec {α : Type u} {β : Type v} {γ : Type w}
   rw [WP.spec_equiv_exists] at hBody'
   rcases hBody' with ⟨y, p, yc⟩
   unfold loop
-  simp [p, Result.ok]
+  simp [p]
   grind
 
 theorem loop.spec_decr_nat {α : Type u} {β : Type v}

From 95d535f326b49a48e26f3ffb7f0f094860a8df0a Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Fri, 10 Jul 2026 15:11:22 -0400
Subject: [PATCH 50/67] a bunch more work on updating to new Result

---
 .../lean/Aeneas/Data/Coinductive/ITree.lean   |   7 +
 backends/lean/Aeneas/Std/Array/Array.lean     |   4 +-
 .../lean/Aeneas/Std/Array/ArraySlice.lean     |  11 +-
 backends/lean/Aeneas/Std/Array/Core.lean      |  12 +-
 backends/lean/Aeneas/Std/Primitives.lean      | 158 ++++++++++++++----
 backends/lean/Aeneas/Std/RangeIter.lean       |   5 +-
 backends/lean/Aeneas/Std/Scalar/Core.lean     |  10 +-
 backends/lean/Aeneas/Std/Scalar/Ops/Add.lean  |   6 +-
 backends/lean/Aeneas/Std/Scalar/Ops/Mul.lean  |  10 +-
 backends/lean/Aeneas/Std/Scalar/Ops/Sub.lean  |   4 +-
 backends/lean/Aeneas/Std/Slice.lean           |  71 ++++----
 backends/lean/Aeneas/Std/SliceIter.lean       |  45 ++---
 backends/lean/Aeneas/Std/Vec.lean             |  17 +-
 13 files changed, 228 insertions(+), 132 deletions(-)

diff --git a/backends/lean/Aeneas/Data/Coinductive/ITree.lean b/backends/lean/Aeneas/Data/Coinductive/ITree.lean
index 47e4e71e5..ef628d23c 100644
--- a/backends/lean/Aeneas/Data/Coinductive/ITree.lean
+++ b/backends/lean/Aeneas/Data/Coinductive/ITree.lean
@@ -360,6 +360,13 @@ theorem ret_inj {E} {α} {x y} : @ITree.ret α E x = ITree.ret y → x = y := by
   simp at eq
   grind only
 
+theorem vis_inj_effect {E} {α} {e1 e2 k1 k2} : @ITree.vis α E e1 k1 = ITree.vis e2 k2
+  → e1 = e2 := by
+  intros eq
+  have eq := congrArg (fun i => i.approx 1) eq
+  simp at eq
+  grind
+
 
 -- TODO: probably dont need this:
 def Eqrec3.{w, u_1} {α : Sort u_1} {a' : α} {motive : (a : α) → a' = a → Sort w}
diff --git a/backends/lean/Aeneas/Std/Array/Array.lean b/backends/lean/Aeneas/Std/Array/Array.lean
index 8ca6173c2..556d454d8 100644
--- a/backends/lean/Aeneas/Std/Array/Array.lean
+++ b/backends/lean/Aeneas/Std/Array/Array.lean
@@ -232,7 +232,7 @@ def Array.index_mut_usize {α : Type u} {n : Usize} (v: Array α n) (i: Usize) :
 theorem Array.index_mut_usize_spec {α : Type u} {n : Usize} (v: Array α n) (i: Usize)
   (hbound : i.val < v.length) :
   v.index_mut_usize i ⦃ x back => x = v.val[i.val] ∧ back = set v i ⦄ := by
-  simp only [index_mut_usize, Bind.bind, bind]
+  simp only [index_mut_usize, Bind.bind]
   have ⟨ x, h ⟩ := spec_imp_exists (index_usize_spec v i hbound)
   simp [h]
 
@@ -283,7 +283,7 @@ theorem Array.clone_length {α : Type u} {n : Usize} (clone : α → Result α)
   s'.length = s.length := by
   simp [Array.clone] at h
   simp [List.clone] at h
-  split at h <;> simp_all
+  cases _ : List.mapM clone ↑s <;> simp_all
 
 @[step]
 theorem Array.clone_spec {α : Type u} {n : Usize} {clone : α → Result α} {s : Array α n} (h : ∀ x ∈ s.val, clone x = ok x) :
diff --git a/backends/lean/Aeneas/Std/Array/ArraySlice.lean b/backends/lean/Aeneas/Std/Array/ArraySlice.lean
index f8f4ee2aa..1d944b038 100644
--- a/backends/lean/Aeneas/Std/Array/ArraySlice.lean
+++ b/backends/lean/Aeneas/Std/Array/ArraySlice.lean
@@ -336,10 +336,8 @@ theorem Array.index_mut_SliceIndexRangeToUsizeSlice {T : Type} {N : Usize}
   have hts : a.to_slice.length = N := by simp [Array.to_slice, Slice.length]
   simp only [core.slice.index.SliceIndexRangeToUsizeSlice.index_mut,
     show (r.end : Usize) ≤ a.to_slice.length from by scalar_tac]
-  refine ⟨?_, ?_, ?_⟩
-  · simp [Array.to_slice]
-  · simp [Slice.length]; scalar_tac
-  · intro s'; simp [Array.from_slice, Array.to_slice]
+  simp
+  assumption
 
 -- Array index/index_mut with RangeFrom
 
@@ -366,9 +364,6 @@ theorem Array.index_mut_SliceIndexRangeFromUsizeSlice {T : Type} {N : Usize}
   simp only [core.slice.index.SliceIndexRangeFromUsizeSlice.index_mut,
     Slice.drop,
     show (r.start : Usize) ≤ a.to_slice.length from by scalar_tac]
-  refine ⟨?_, ?_, ?_⟩
-  · simp [Array.to_slice]
-  · simp [Slice.length, List.length_drop]
-  · intro s'; simp [Array.from_slice, Array.to_slice]
+  simp
 
 end Aeneas.Std
diff --git a/backends/lean/Aeneas/Std/Array/Core.lean b/backends/lean/Aeneas/Std/Array/Core.lean
index a81fcea93..d4bcb2fb2 100644
--- a/backends/lean/Aeneas/Std/Array/Core.lean
+++ b/backends/lean/Aeneas/Std/Array/Core.lean
@@ -34,20 +34,22 @@ theorem List.mapM_clone_eq {T : Type u} {clone : T → Result T} {l : List T}
   apply h
 
 def List.clone (clone : α → Result α) (l : List α) : Result ({ l' : List α // l'.length = l.length}) :=
+  -- TODO: clean this up
   -- match h :List.mapM clone l with
   -- | ok v => ok ⟨ v, by have := List.mapM_Result_length h; scalar_tac ⟩
   -- | fail e => fail e
   -- | div => div
-  (List.mapM clone l).match
-  (fun v => ok ⟨ v, by have := List.mapM_Result_length h; scalar_tac ⟩)
-  (fun e => fail e)
-  div
+  -- (List.mapM clone l).match_dep
+  Result.match_dep' (motive := fun l => _) (List.mapM clone l)
+  (fun v h => ok ⟨ v, by have := List.mapM_Result_length h; scalar_tac ⟩)
+  (fun e _h => fail e)
+  (fun _h => div)
 
 @[step]
 def List.clone_spec {clone : α → Result α} {l : List α} (h : ∀ x ∈ l, clone x = ok x) :
   List.clone clone l ⦃ l' => l'.val = l ∧ l'.val.length = l.length ⦄ := by
   simp only [List.clone]
   have := List.mapM_clone_eq h
-  split <;> simp_all
+  simp [this]
 
 end Aeneas.Std
diff --git a/backends/lean/Aeneas/Std/Primitives.lean b/backends/lean/Aeneas/Std/Primitives.lean
index 183a39c72..5bb48991b 100644
--- a/backends/lean/Aeneas/Std/Primitives.lean
+++ b/backends/lean/Aeneas/Std/Primitives.lean
@@ -99,33 +99,41 @@ instance : LawfulMonad Result := instLawfulMonadITree
 
 -- TODO: adding these to simp set messes up some things
 @[simp, grind .]
--- @[simp]
 theorem ok_not_fail {α} {a : α} {e} : ¬ Result.ok a = .fail e := by grind [Result.ok, Result.fail, not_vis_ret]
--- @[simp]
 @[simp, grind .]
 theorem fail_not_ok {α} {a : α} {e} : ¬ Result.fail e = .ok a := by grind [Result.ok, Result.fail, not_vis_ret]
--- @[simp]
 @[simp, grind .]
 theorem ok_not_div {α} {a : α} : ¬ Result.ok a = .div := by grind [Result.ok, Result.div, not_ret_div]
--- @[simp]
 @[simp, grind .]
 theorem div_not_ok {α} {a : α} : ¬ Result.div = .ok a := by grind [Result.ok, Result.div, not_ret_div]
--- @[simp]
+@[simp, grind .]
+theorem fail_not_div {α} {e} : ¬ @Result.fail α e = .div := by grind [Result.div, Result.fail, not_div_vis]
+@[simp, grind .]
+theorem div_not_fail {α} {e} : ¬ .div = @Result.fail α e := by grind [Result.div, Result.fail, not_div_vis]
 @[simp, grind .]
 theorem Result.ok.injEq {α} {a b : α} : (Result.ok a = .ok b) = (a = b) := by
   grind [Result.ok, ret_inj]
-
+@[simp, grind .]
+theorem Result.fail.injEq {α} {a b : Error} : (@Result.fail α a = .fail b) = (a = b) := by
+  grind [Result.fail, vis_inj_effect]
+
+-- NOTE: in order for lean's metaprogramming surrounding the `split` tactic to not
+-- spaghetti code itself to death, cases without inputs like div must input a Unit
+-- NOTE: its seems that for registering a matcher for split, we need the motive to be before the result input.
+-- NOTE: in order to register custom matches for the `split` tactic,
+-- the name of the function must start with "match_". See the implementation of Matcherinfo.lean/`getMatcherInfo?`
 -- previously Result was an inductive with ok, div, and fail cases only.
 -- this function can be used in many cases to replace pattern matching on that inductive:
 -- TODO: why do things error when this is def instead of abbrev?
 @[elab_as_elim, cases_eliminator]
-abbrev Result.match {α} (r : Result α)
+abbrev Result.match_dep {α}
   {motive : Result α → Sort v}
+  (r : Result α)
   (ok : ∀ r, motive (.ok r))
   (fail : ∀ e, motive (.fail e))
-  (div :  motive (.div))
+  (div :  Unit → motive (.div))
   -- will add more inputs as we add effects
-  : motive r := ITree.cases ok div (
+  : motive r := ITree.cases ok (div ()) (
       fun e k => match e with
         | .fail e => by
             have same : k = PEmpty.elim := by funext x; contradiction
@@ -135,40 +143,126 @@ abbrev Result.match {α} (r : Result α)
 
 @[simp]
 theorem Result.match.ok {R motive r d f x}
-  : @Result.match R (.ok x) motive r f d = r x := ITree.cases.ret
+  : @Result.match_dep R motive (.ok x) r f d = r x := ITree.cases.ret
 
 @[simp]
 theorem Result.match.div {R motive r d f}
-  : @Result.match R .div motive r f d = d := ITree.cases.div
+  : @Result.match_dep R motive .div r f d = d () := ITree.cases.div
 
 @[simp]
 theorem Result.match.fail {R motive r d f e}
-  : @Result.match R (.fail e) motive r f d = f e := ITree.cases.vis
-
--- TODO: do we need both versions? I had problems with motives not being correct using the
--- dependent version, and maybe you can't use this one as a cases eliminator. TODO
-def Result.nmatch {α} (r : Result α)
-  {Out : Sort v}
-  (ok : α  → Out)
-  (fail : Error → Out)
-  (div :  Out)
+  : @Result.match_dep R motive (.fail e) r f d = f e := ITree.cases.vis
+
+-- theorem Result.match_dep_destruct {α}
+--   {motive : Result α → Sort v}
+--   (r : Result α)
+--   (ok : ∀ r, motive (.ok r))
+--   (fail : ∀ e, motive (.fail e))
+--   (div :  Unit → motive (.div))
+--   : r.match_dep (motive:=motive) ok fail div =
+--     (∃ a, r = .ok a ∧ ok _) := by sorry
+
+-- @[elab_as_elim, cases_eliminator]
+abbrev Result.match_dep' {α}
+  {motive : Result α → Sort v}
+  (r : Result α)
+  (ok : ∀ x, r = .ok x → motive (.ok x))
+  (fail : ∀ e, r = .fail e → motive (.fail e))
+  (div : r = .div → motive (.div))
   -- will add more inputs as we add effects
-  : Out := ITree.cases ok div (
-      fun e _k => match e with
-        | .fail e => fail e
-    ) r
+  : motive r :=
+    Result.match_dep (motive := fun r' => r = r' -> motive r') r ok fail (fun _ => div) rfl
 
 @[simp]
-theorem Result.nmatch.ok {R Out r d f x}
-  : @Result.nmatch R (.ok x) Out r f d = r x := ITree.cases.ret
+theorem Result.match_dep'.ok {R motive v r d f x}
+  (h : v = Result.ok x)
+  : @Result.match_dep' R motive v r f d = cast (congrArg motive (Eq.symm h)) (r x h) := by
+  cases v <;> unfold match_dep' <;> simp <;> grind
 
 @[simp]
-theorem Result.nmatch.div {R Out r d f}
-  : @Result.nmatch R .div Out r f d = d := ITree.cases.div
+theorem Result.match_dep'.fail {R motive v r d f e}
+  (h : v = Result.fail e)
+  : @Result.match_dep' R motive v r f d = cast (congrArg motive (Eq.symm h)) (f e h) := by
+  cases v <;> unfold match_dep' <;> simp <;> grind
 
 @[simp]
-theorem Result.nmatch.fail {R Out r d f e}
-  : @Result.nmatch R (.fail e) Out r f d = f e := ITree.cases.vis
+theorem Result.match_dep'.div {R motive v r d f}
+  (h : v = .div)
+  : @Result.match_dep' R motive v r f d = cast (congrArg motive (Eq.symm h)) (d h) := by
+  cases v <;> unfold match_dep' <;> simp <;> grind
+
+-- @[elab_as_elim, cases_eliminator]
+abbrev Result.match_dep'' {α}
+  {motive : Result α → Sort v}
+  (r : Result α)
+  (ok : ∀ x, r = .ok x → motive r)
+  (fail : ∀ e, r = .fail e → motive r)
+  (div : r = .div → motive r)
+  -- will add more inputs as we add effects
+  : motive r :=
+    Result.match_dep (motive := fun r' => r = r' -> motive r') r
+      (fun r (.refl _) => ok r (by assumption))
+      (fun e (.refl _) => fail e (by assumption))
+      (fun _ (.refl _) => div (by assumption))
+      rfl
+
+-- theorem Result.match_dep''.ok {R motive v r d f x}
+--   (h : v = Result.ok x)
+--   : @Result.match_dep'' R motive v r f d = r x h := by
+--   cases v
+--   sorry
+
+-- TODO: this is how to register for split, but we probably won't use that
+-- run_meta
+--   Lean.Meta.Match.addMatcherInfo ``Result.match_dep {
+--     numParams := 1
+--     numDiscrs := 1
+--     altInfos := #[
+--       {
+--         numFields := 1
+--         numOverlaps := 0
+--         hasUnitThunk := false
+--       },
+--       {
+--         numFields := 1
+--         numOverlaps := 0
+--         hasUnitThunk := false
+--       },
+--       {
+--         numFields := 0
+--         numOverlaps := 0
+--         hasUnitThunk := true
+--       }
+--     ]
+--     uElimPos? := .some 0
+--     discrInfos := #[{ hName? := none }]
+--     overlaps := { map := Std.HashMap.ofList [] }
+--   }
+
+-- -- TODO: do we need both versions? I had problems with motives not being correct using the
+-- -- dependent version, and maybe you can't use this one as a cases eliminator. TODO
+-- def Result.match_nondep {α} (r : Result α)
+--   {Out : Sort v}
+--   (ok : α  → Out)
+--   (fail : Error → Out)
+--   (div :  Out)
+--   -- will add more inputs as we add effects
+--   : Out := ITree.cases ok div (
+--       fun e _k => match e with
+--         | .fail e => fail e
+--     ) r
+
+-- @[simp]
+-- theorem Result.nmatch.ok {R Out r d f x}
+--   : @Result.match_nondep R (.ok x) Out r f d = r x := ITree.cases.ret
+
+-- @[simp]
+-- theorem Result.nmatch.div {R Out r d f}
+--   : @Result.match_nondep R .div Out r f d = d := ITree.cases.div
+
+-- @[simp]
+-- theorem Result.nmatch.fail {R Out r d f e}
+--   : @Result.match_nondep R (.fail e) Out r f d = f e := ITree.cases.vis
 
 open Result
 
@@ -469,10 +563,10 @@ instance SubtypeLawfulBEq [BEq α] (p : α → Prop) [LawfulBEq α] : LawfulBEq
    TODO: move up to Core module? -/
 def Option.ofResult {a : Type u} (x : Result a) :
   Option a :=
-  x.nmatch
+  x.match_dep
     .some
     (fun _ => .none)
-    .none
+    (fun _ => .none)
 
 /-!
 # bv_decide
diff --git a/backends/lean/Aeneas/Std/RangeIter.lean b/backends/lean/Aeneas/Std/RangeIter.lean
index a2cf2dd62..d483362a8 100644
--- a/backends/lean/Aeneas/Std/RangeIter.lean
+++ b/backends/lean/Aeneas/Std/RangeIter.lean
@@ -27,7 +27,10 @@ theorem core.iter.range.IteratorRange.next_Usize_spec
     liftFun1, liftFun2, bind_tc_ok,
     hlt, decide_true, ↓reduceIte]
   have hadd := @UScalar.add_equiv UScalarTy.Usize range.start (1#usize)
-  split at hadd
+  -- generalize hval : range.start + 1#usize = val at hadd
+  -- cases val
+  cases h : range.start + 1#usize <;> simp only [h] at *
+  -- split at hadd
   · rename_i z heq
     obtain ⟨_, hval, _⟩ := hadd
     have hdite : range.start.val + 1 ≤ UScalar.max .Usize := by scalar_tac
diff --git a/backends/lean/Aeneas/Std/Scalar/Core.lean b/backends/lean/Aeneas/Std/Scalar/Core.lean
index 09e233218..befc353d9 100644
--- a/backends/lean/Aeneas/Std/Scalar/Core.lean
+++ b/backends/lean/Aeneas/Std/Scalar/Core.lean
@@ -626,14 +626,14 @@ theorem UScalar.tryMk_eq_DELETE_THIS_PROBABLY (ty : UScalarTy) (x : Nat) :
     grind
 
 theorem UScalar.tryMk_eq (ty : UScalarTy) (x : Nat) :
-  (tryMk ty x).match
+  (tryMk ty x).match_dep
     (fun y => y.val = x ∧ inBounds ty x)
     (fun _e => ¬ (inBounds ty x))
-    False
+    (fun _ => False)
   := by
   have := UScalar.tryMkOpt_eq ty x
   simp [tryMk, ofOption]
-  cases h: tryMkOpt ty x <;> simp_all [fail, ok]
+  cases h: tryMkOpt ty x <;> simp_all
 
 -- TODO: delete old one
 -- theorem UScalar.tryMk_eq (ty : UScalarTy) (x : Nat) :
@@ -672,10 +672,10 @@ theorem IScalar.tryMkOpt_eq (ty : IScalarTy) (x : Int) :
 --     grind
 
 theorem IScalar.tryMk_eq (ty : IScalarTy) (x : Int) :
-  (tryMk ty x).nmatch
+  (tryMk ty x).match_dep
   (fun y => y.val = x ∧ inBounds ty x)
   (fun _e => ¬ (inBounds ty x))
-  False
+  (fun _ => False)
   := by
   have := tryMkOpt_eq ty x
   simp [tryMk]
diff --git a/backends/lean/Aeneas/Std/Scalar/Ops/Add.lean b/backends/lean/Aeneas/Std/Scalar/Ops/Add.lean
index b8b5fbf18..5d1c56877 100644
--- a/backends/lean/Aeneas/Std/Scalar/Ops/Add.lean
+++ b/backends/lean/Aeneas/Std/Scalar/Ops/Add.lean
@@ -35,7 +35,7 @@ instance {ty} : HAdd (IScalar ty) (IScalar ty) (Result (IScalar ty)) where
 -/
 
 theorem UScalar.add_equiv {ty} (x y : UScalar ty) :
-  (x + y).nmatch
+  (x + y).match_dep
   (fun z => x.val + y.val < 2^ty.numBits ∧
     z.val = x.val + y.val ∧
     z.bv = x.bv + y.bv)
@@ -49,13 +49,15 @@ theorem UScalar.add_equiv {ty} (x y : UScalar ty) :
   simp [inBounds] at h
   generalize valh : (tryMk ty (↑x + ↑y)) = val at h
   cases val <;> simp_all
+  -- TODO: using my registered MatcherInfo, currently this sort of works but needs the generalize for some reason
+  -- split at h <;> simp_all
   zify; simp
   zify at h
   have := @Int.emod_eq_of_lt (x.val + y.val) (2^ty.numBits) (by omega) (by omega)
   simp [*]
 
 theorem IScalar.add_equiv {ty} (x y : IScalar ty) :
-  (x + y).nmatch
+  (x + y).match_dep
     (fun z =>
       IScalar.inBounds ty (x.val + y.val) ∧
       z.val = x.val + y.val ∧
diff --git a/backends/lean/Aeneas/Std/Scalar/Ops/Mul.lean b/backends/lean/Aeneas/Std/Scalar/Ops/Mul.lean
index 7af3c434e..9cb77c862 100644
--- a/backends/lean/Aeneas/Std/Scalar/Ops/Mul.lean
+++ b/backends/lean/Aeneas/Std/Scalar/Ops/Mul.lean
@@ -40,10 +40,10 @@ Theorems with a specification which use integers and bit-vectors
 -/
 
 theorem UScalar.mul_equiv {ty} (x y : UScalar ty) :
-  (mul x y).nmatch
+  (mul x y).match_dep
   (fun z => x.val * y.val ≤ UScalar.max ty ∧ (↑z : Nat) = ↑x * ↑y ∧ z.bv = x.bv * y.bv)
   (fun _ => UScalar.max ty < x.val * y.val)
-  False
+  (fun _ => False)
   := by
   simp only [mul]
   have := tryMk_eq ty (x.val * y.val)
@@ -73,14 +73,14 @@ theorem UScalar.mul_bv_spec {ty} {x y : UScalar ty}
   omega
 
 theorem IScalar.mul_equiv {ty} (x y : IScalar ty) :
-  (mul x y).nmatch
+  (mul x y).match_dep
   (fun z => IScalar.min ty ≤ x.val * y.val ∧ x.val * y.val ≤ IScalar.max ty ∧ z.val = x.val * y.val ∧ z.bv = x.bv * y.bv)
   (fun _ => ¬(IScalar.min ty ≤ x.val * y.val ∧ x.val * y.val ≤ IScalar.max ty))
-  False := by
+  (fun _ => False) := by
   simp only [mul, not_and, not_le]
   have := tryMk_eq ty (x.val * y.val)
   generalize hval : tryMk ty (↑x * ↑y) = value at this
-  cases value <;> simp_all only [«nmatch».ok, «nmatch».div, «nmatch».fail, inBounds, min, max, true_and, not_and, not_lt] <;>
+  cases value <;> simp_all only [«match».ok, «match».div, «match».fail, inBounds, min, max, true_and, not_and, not_lt] <;>
   simp_all only [tryMk, ofOption, tryMkOpt, check_bounds, and_self, decide_true, dite_true,
     ok.injEq, Bool.decide_and, Bool.and_eq_true, decide_eq_true_eq] <;>
   simp only [← hval, ofIntCore, val] <;>
diff --git a/backends/lean/Aeneas/Std/Scalar/Ops/Sub.lean b/backends/lean/Aeneas/Std/Scalar/Ops/Sub.lean
index dd30609e2..92c0f2be2 100644
--- a/backends/lean/Aeneas/Std/Scalar/Ops/Sub.lean
+++ b/backends/lean/Aeneas/Std/Scalar/Ops/Sub.lean
@@ -37,7 +37,7 @@ instance {ty} : HSub (IScalar ty) (IScalar ty) (Result (IScalar ty)) where
 -/
 
 theorem UScalar.sub_equiv {ty} (x y : UScalar ty) :
-  (x - y).nmatch -- TODO: here, the dependent version breaks things in the proof
+  (x - y).match_dep -- TODO: here, the dependent version breaks things in the proof
   (fun z =>
     y.val ≤ x.val ∧
     x.val = z.val + y.val ∧
@@ -81,7 +81,7 @@ theorem UScalar.sub_equiv {ty} (x y : UScalar ty) :
     ring_nf
 
 theorem IScalar.sub_equiv {ty} (x y : IScalar ty) :
-  (x - y).nmatch
+  (x - y).match_dep
   (fun z =>
     IScalar.inBounds ty (x.val - y.val) ∧
     z.val = x.val - y.val ∧
diff --git a/backends/lean/Aeneas/Std/Slice.lean b/backends/lean/Aeneas/Std/Slice.lean
index 5daa21ddb..f7a291c2e 100644
--- a/backends/lean/Aeneas/Std/Slice.lean
+++ b/backends/lean/Aeneas/Std/Slice.lean
@@ -282,7 +282,7 @@ def Slice.index_mut_usize {α : Type u} (v: Slice α) (i: Usize) :
 theorem Slice.index_mut_usize_spec {α : Type u} (v: Slice α) (i: Usize)
   (hbound : i.val < v.length) :
   v.index_mut_usize i ⦃ x back => x = v.val[i.val] ∧ back = Slice.set v i ⦄ := by
-  simp only [index_mut_usize, Bind.bind, bind]
+  simp only [index_mut_usize, Bind.bind]
   have ⟨ x, h ⟩ := spec_imp_exists (Slice.index_usize_spec v i hbound)
   simp [h]
 
@@ -649,10 +649,11 @@ def core.slice.index.SliceIndexRangeFromUsizeSlice.index_mut {T : Type}
   else fail .panic
 
 theorem _SliceIndexRangeFromUsizeSlice.index_mut.test {T} (s : Slice T) (r : core.ops.range.RangeFrom Usize) (h : r.start ≤ s.length) :
-  match core.slice.index.SliceIndexRangeFromUsizeSlice.index_mut r s with
-  | ok (s1, back) =>
-    back s1 = s
-  | _ => False := by
+  (core.slice.index.SliceIndexRangeFromUsizeSlice.index_mut r s).match_dep
+  (fun (s1, back) => back s1 = s)
+  (fun _ => False)
+  (fun _ => False) :=
+  by
   unfold core.slice.index.SliceIndexRangeFromUsizeSlice.index_mut
   simp [h]
 
@@ -686,7 +687,7 @@ theorem Slice.clone_length {T : Type} {clone : T → Result T} {s s' : Slice T}
   s'.length = s.length := by
   simp [Slice.clone] at h
   simp [List.clone] at h
-  split at h <;> simp_all
+  cases h2 : List.mapM clone ↑s <;> simp_all
   rename_i heq
   have := List.mapM_Result_length heq
   cases s'; simp_all
@@ -785,19 +786,19 @@ theorem core.slice.Slice.swap_spec {T : Type} [Inhabited T] (s : Slice T) (a b :
       s'.val[a.val]! = s.val[b.val]! ∧
       s'.val[b.val]! = s.val[a.val]! ∧
       ∀ i, i ≠ a.val → i ≠ b.val → s'.val[i]! = s.val[i]! ⦄ := by
-  simp only [core.slice.Slice.swap, Bind.bind, bind]
+  simp only [core.slice.Slice.swap, Bind.bind]
   have ⟨av, hav⟩ := spec_imp_exists (Slice.index_usize_spec s a ha)
   simp only [hav]
   have ⟨bv, hbv⟩ := spec_imp_exists (Slice.index_usize_spec s b hb)
   simp only [hbv]
   have ⟨s1, hs1⟩ := spec_imp_exists (Slice.update_spec s a (s.val[b.val]) ha)
-  simp only [hs1]
+  simp only [bind_ok, Slice.length, ne_eq, hs1]
   have hlen1 : b.val < s1.length := by rw [hs1.2, Slice.set_length]; exact hb
   have ⟨s', hs'⟩ := spec_imp_exists (Slice.update_spec s1 b (s.val[a.val]) hlen1)
   rw [hs1.2] at hs'
   simp only [hs', spec_ok]
   refine ⟨?_, ?_, ?_, ?_⟩
-  · simp only [Slice.length, Slice.set_val_eq, List.length_set]
+  · simp only [Slice.set_val_eq, List.length_set]
   · by_cases hab : (↑a : ℕ) = ↑b
     · simp only [Slice.set_val_eq, hab]; grind
     · simp only [Slice.set_val_eq]
@@ -1007,10 +1008,10 @@ theorem core.slice.Slice.copy_from_slice.step_spec (copyInst : core.marker.Copy
   simp [h]
 
 def Slice.mapM  {α β} (f : α → Result β) (x : Slice α) : Result (Slice β) :=
-  match h : x.val.mapM f with
-  | ok xs  => ok ⟨xs, List.mapM_Result_length h ▸ x.prop⟩
-  | fail e => fail e
-  | div    => div
+  (x.val.mapM f).match_dep' (motive := fun _ => _)
+    (fun xs h => ok ⟨xs, List.mapM_Result_length h ▸ x.prop⟩)
+    (fun e _ => fail e)
+    (fun _ => div)
 
 @[step]
 theorem Slice.mapM_spec {α β} {f : α → Result β} {s : Slice α} {post : Nat → β → Prop}
@@ -1022,7 +1023,7 @@ theorem Slice.mapM_spec {α β} {f : α → Result β} {s : Slice α} {post : Na
       apply this; intro i hi
       let i' : Usize := Usize.ofNatCore i (by scalar_tac)
       have hf' := hf i' (by scalar_tac)
-      simp [spec, theta] at hf'
+      simp only [getElem_Usize_eq] at hf'
       show ∃ b, f s[i'] = ok b
       cases hfi : f s[i'] <;> simp_all
     intro l; induction l with
@@ -1031,20 +1032,16 @@ theorem Slice.mapM_spec {α β} {f : α → Result β} {s : Slice α} {post : Na
       intro hall
       obtain ⟨b, hb⟩ := hall 0 (by simp); simp at hb
       obtain ⟨ts, hts⟩ := ih (fun i hi => hall (i + 1) (by simp; omega))
-      exact ⟨b :: ts, by simp [List.mapM_cons, hb, hts, pure, bind, Bind.bind]⟩
+      exact ⟨b :: ts, by simp [List.mapM_cons, hb, hts, pure, Bind.bind]⟩
   obtain ⟨l', hl'⟩ := hmapM_ok
-  split
-  case h_1 xs heq =>
-    simp only [UScalar.lt_equiv, Usize.ofNatCore_val_eq, spec_ok]
-    refine ⟨by grind [List.mapM_Result_length], fun i hi => ?_⟩
-    have hlen : i < s.len := by have := List.mapM_Result_length heq; simp [Slice.len] at *; omega
-    have hthis := List.mapM_Result_ok heq (↑i) (by scalar_tac)
-    specialize hf i hlen; simp only [spec, theta] at hf
-    erw [hthis] at hf
-    simp only [wp_return] at hf ⊢
-    exact hf
-  case h_2 e heq => simp [hl'] at heq
-  case h_3 heq => simp [hl'] at heq
+  simp [hl']
+  refine ⟨by grind [List.mapM_Result_length], fun i hi => ?_⟩
+  have hlen : i < s.len := by have := List.mapM_Result_length hl'; simp [Slice.len] at *; omega
+  have hthis := List.mapM_Result_ok hl' (↑i) (by scalar_tac)
+  specialize hf i hlen; simp only [getElem_Usize_eq] at hf
+  erw [hthis] at hf
+  simp [spec_ok] at hf ⊢
+  exact hf
 
 -- ============================================================================
 -- Slice.fill — overwrite every element with a clone of `v`
@@ -1055,10 +1052,10 @@ theorem Slice.mapM_spec {α β} {f : α → Result β} {s : Slice α} {post : Na
 @[rust_fun "core::slice::{[@T]}::fill"]
 def core.slice.Slice.fill {T : Type} (cloneInst : core.clone.Clone T)
     (s : Slice T) (v : T) : Result (Slice T) :=
-  match h : s.val.mapM (fun _ => cloneInst.clone v) with
-  | .ok val => .ok ⟨val, List.mapM_Result_length h ▸ s.property⟩
-  | .fail e => .fail e
-  | .div => .div
+  (s.val.mapM (fun _ => cloneInst.clone v)).match_dep' (motive := fun _ => _)
+    (fun val h => .ok ⟨val, List.mapM_Result_length h ▸ s.property⟩)
+    (fun e _ => .fail e)
+    (fun _ => .div)
 
 private theorem List.mapM_const_ok {T : Type} (l : List T)
     {g : Result T} {v : T} (hg : g = ok v) :
@@ -1080,16 +1077,8 @@ theorem core.slice.Slice.fill.spec {T : Type} (cloneInst : core.clone.Clone T)
       s'.val = List.replicate s.length v ⦄ := by
   unfold core.slice.Slice.fill
   have hcl : cloneInst.clone v = ok v := by
-    simp only [WP.spec, WP.theta] at hclone
-    match hc : cloneInst.clone v with
-    | .ok v' =>
-      congr 1; have := hclone; rw [hc] at this; simp [WP.wp_return] at this; exact this
-    | .fail _ => exfalso; have := hclone; rw [hc] at this; simp at this
-    | .div => exfalso; have := hclone; rw [hc] at this; simp at this
+    cases h : (cloneInst.clone v) <;> simp_all
   have hmapM := List.mapM_const_ok s.val hcl
-  split
-  · rename_i val heq; rw [hmapM] at heq; cases heq; simp [spec_ok, Slice.length, List.length_replicate]
-  · exfalso; simp_all
-  · exfalso; simp_all
+  simp [hmapM]
 
 end Aeneas.Std
diff --git a/backends/lean/Aeneas/Std/SliceIter.lean b/backends/lean/Aeneas/Std/SliceIter.lean
index 32ac76b80..6dc61e9ca 100644
--- a/backends/lean/Aeneas/Std/SliceIter.lean
+++ b/backends/lean/Aeneas/Std/SliceIter.lean
@@ -266,76 +266,83 @@ private def collectStepBy (sbi : core.iter.adapters.step_by.StepBy (core.slice.i
 
 -- step_by(0) panics
 #assert
-  match core.slice.iter.IteratorSliceIter.step_by (mkSliceIter [1, 2, 3]) 0#usize with
-  | .fail .panic => true
-  | _ => false
+  -- TODO: once i fix the below ones by dealing with BEq, fix this one too.
+  (core.slice.iter.IteratorSliceIter.step_by (mkSliceIter [1, 2, 3]) 0#usize).match_dep
+  (fun _ => false)
+  (fun e => e == .panic)
+  (fun _ => false)
+
+-- TODO: decide where to place this function, its here just for now
+def Result.assert_eq_ok {T} [BEq T] (r : Result T) (t : T) : Bool :=
+  r.match_dep (fun x => x == t) (fun _ => false) (fun _ => false)
 
 -- step_by(1) returns all elements
 #assert (do
   let sbi ← core.slice.iter.IteratorSliceIter.step_by (mkSliceIter [0, 1, 2, 3, 4]) 1#usize
-  collectStepBy sbi) == .ok [0, 1, 2, 3, 4]
+  collectStepBy sbi).assert_eq_ok [0, 1, 2, 3, 4]
 
 -- step_by(2) returns every other element
 #assert (do
   let sbi ← core.slice.iter.IteratorSliceIter.step_by (mkSliceIter [0, 1, 2, 3, 4]) 2#usize
-  collectStepBy sbi) == .ok [0, 2, 4]
+  collectStepBy sbi).assert_eq_ok [0, 2, 4]
 
 -- step_by(3)
 #assert (do
   let sbi ← core.slice.iter.IteratorSliceIter.step_by (mkSliceIter [0, 1, 2, 3, 4, 5, 6]) 3#usize
-  collectStepBy sbi) == .ok [0, 3, 6]
+  collectStepBy sbi).assert_eq_ok [0, 3, 6]
 
 -- step_by larger than collection: returns only first element
 #assert (do
   let sbi ← core.slice.iter.IteratorSliceIter.step_by (mkSliceIter [0, 1, 2]) 10#usize
-  collectStepBy sbi) == .ok [0]
+  collectStepBy sbi).assert_eq_ok [0]
 
 -- step_by on empty iterator
 #assert (do
   let sbi ← core.slice.iter.IteratorSliceIter.step_by (mkSliceIter []) 2#usize
-  collectStepBy sbi) == .ok []
+  collectStepBy sbi).assert_eq_ok []
 
 -- step_by(1) on single element
 #assert (do
   let sbi ← core.slice.iter.IteratorSliceIter.step_by (mkSliceIter [42]) 1#usize
-  collectStepBy sbi) == .ok [42]
+  collectStepBy sbi).assert_eq_ok [42]
 
 -- step_by(2) on single element
 #assert (do
   let sbi ← core.slice.iter.IteratorSliceIter.step_by (mkSliceIter [42]) 2#usize
-  collectStepBy sbi) == .ok [42]
+  collectStepBy sbi).assert_eq_ok [42]
 
 -- step_by equal to length: returns only first element
 #assert (do
   let sbi ← core.slice.iter.IteratorSliceIter.step_by (mkSliceIter [0, 1, 2]) 3#usize
-  collectStepBy sbi) == .ok [0]
+  collectStepBy sbi).assert_eq_ok [0]
 
 -- step_by = length - 1
 #assert (do
   let sbi ← core.slice.iter.IteratorSliceIter.step_by (mkSliceIter [0, 1, 2]) 2#usize
-  collectStepBy sbi) == .ok [0, 2]
+  collectStepBy sbi).assert_eq_ok [0, 2]
 
 -- step_by(2) on two elements: returns only first
 #assert (do
   let sbi ← core.slice.iter.IteratorSliceIter.step_by (mkSliceIter [0, 1]) 2#usize
-  collectStepBy sbi) == .ok [0]
+  collectStepBy sbi).assert_eq_ok [0]
 
 -- step_by(2) on three elements: returns first and third
 #assert (do
   let sbi ← core.slice.iter.IteratorSliceIter.step_by (mkSliceIter [0, 1, 2]) 2#usize
-  collectStepBy sbi) == .ok [0, 2]
+  collectStepBy sbi).assert_eq_ok [0, 2]
 
 -- step_by(4) on longer sequence
 #assert (do
   let sbi ← core.slice.iter.IteratorSliceIter.step_by
     (mkSliceIter [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11]) 4#usize
-  collectStepBy sbi) == .ok [0, 4, 8]
+  collectStepBy sbi).assert_eq_ok [0, 4, 8]
 
 -- Verify that step_by(0) on the generic Iterator.step_by.default also panics
 #assert
-  match core.iter.traits.iterator.Iterator.step_by.default (mkSliceIter [1]) 0#usize with
-  | .fail .panic => true
-  | _ => false
+  (core.iter.traits.iterator.Iterator.step_by.default (mkSliceIter [1]) 0#usize).match_dep
+    (fun _ => false)
+    (fun e => e == .panic)
+    (fun _ => false)
 
 -- Nested step_by: step_by(2) then step_by(2) on [0..8] gives [0, 4]
 private def collectNestedStepBy
@@ -360,7 +367,7 @@ private def collectNestedStepBy
     (mkSliceIter [0, 1, 2, 3, 4, 5, 6, 7]) 2#usize
   let sbi2 ← core.iter.adapters.step_by.IteratorStepBy.step_by
     (core.iter.traits.iterator.IteratorSliceIter Nat) sbi 2#usize
-  collectNestedStepBy sbi2) == .ok [0, 4]
+  collectNestedStepBy sbi2).assert_eq_ok [0, 4]
 
 -- ============================================================================
 -- Step specs for SharedArray.into_iter and SharedSlice.into_iter
diff --git a/backends/lean/Aeneas/Std/Vec.lean b/backends/lean/Aeneas/Std/Vec.lean
index 2ca7c7f20..9e2351af3 100644
--- a/backends/lean/Aeneas/Std/Vec.lean
+++ b/backends/lean/Aeneas/Std/Vec.lean
@@ -178,11 +178,8 @@ theorem Vec.set_length {α : Type u} (v: Vec α) (i: Usize) (x: α) :
 
 def Vec.index_mut_usize {α : Type u} (v: Vec α) (i: Usize) :
   Result (α × (α → Vec α)) :=
-  match Vec.index_usize v i with
-  | ok x =>
-    ok (x, Vec.set v i)
-  | fail e => fail e
-  | div => div
+  do let x ← Vec.index_usize v i
+     ok (x, Vec.set v i)
 
 @[step]
 theorem Vec.index_mut_usize_spec {α : Type u} (v: Vec α) (i: Usize)
@@ -353,11 +350,11 @@ def alloc.vec.Vec.with_capacity (T : Type) (_ : Usize) : alloc.vec.Vec T := Vec.
 def alloc.vec.Vec.extend_from_slice {T : Type} (cloneInst : core.clone.Clone T)
   (v : alloc.vec.Vec T) (s : Slice T) : Result (alloc.vec.Vec T) :=
   if h : v.length + s.length ≤ Usize.max then do
-    match h' : Slice.clone cloneInst.clone s with
-    | ok s' =>
-      ok ⟨ v.val ++ s'.val , by have := Slice.clone_length h'; scalar_tac ⟩
-    | fail e => fail e
-    | div => div
+    (Slice.clone cloneInst.clone s).match_dep' (motive := fun _ => _)
+      (fun s' h' =>
+        ok ⟨ v.val ++ s'.val , by have := Slice.clone_length h'; scalar_tac ⟩)
+      (fun e _ => fail e)
+      (fun _ => div)
   else fail .panic
 
 @[rust_fun "alloc::vec::{core::ops::deref::Deref<alloc::vec::Vec<@T>, [@T]>}::deref"

From 67414dafb57e283165bcc7a9080b09288df705f3 Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Mon, 13 Jul 2026 12:09:17 -0400
Subject: [PATCH 51/67] fixed do-elab bug caused by Result reducibility

---
 backends/lean/Aeneas/Std/Primitives.lean | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/backends/lean/Aeneas/Std/Primitives.lean b/backends/lean/Aeneas/Std/Primitives.lean
index 5bb48991b..a02471815 100644
--- a/backends/lean/Aeneas/Std/Primitives.lean
+++ b/backends/lean/Aeneas/Std/Primitives.lean
@@ -75,7 +75,11 @@ def RustEffect : Effect := {
   O := RustEffect.O
 }
 
+-- We need Result to be irreducble outside this file (to not break metaprograms which normalize types),
+-- but reducible within. The `unseal` command only affects the local context.
+@[irreducible]
 def Result (α : Type u) : Type u := ITree RustEffect α
+unseal Result
 
 
 def Result.ok {α} (a : α) : Result α := .ret a
@@ -93,8 +97,6 @@ def bind {α : Type u} {β : Type v} (x: Result α) (f: α → Result β) : Resu
 instance : Monad Result where
   pure := .ok
   bind := bind
--- instance : Bind Result where
---   bind := bind -- ITree.bind
 instance : LawfulMonad Result := instLawfulMonadITree
 
 -- TODO: adding these to simp set messes up some things

From 3162d322d1a0610cfa46b254828a1e883447d2dc Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Tue, 14 Jul 2026 10:26:32 -0400
Subject: [PATCH 52/67] fixed dspec admissibility with ITree

---
 .../lean/Aeneas/Data/Coinductive/ITree.lean   | 67 +++++++++++--
 backends/lean/Aeneas/Std/Primitives.lean      |  6 +-
 backends/lean/Aeneas/Std/WP.lean              | 99 +++++++++++++++++--
 .../Aeneas/Tactic/Step/DspecInduction.lean    |  7 +-
 backends/lean/Aeneas/Tactic/Step/Step.lean    |  3 +-
 5 files changed, 156 insertions(+), 26 deletions(-)

diff --git a/backends/lean/Aeneas/Data/Coinductive/ITree.lean b/backends/lean/Aeneas/Data/Coinductive/ITree.lean
index 313cdbffe..b78f57f51 100644
--- a/backends/lean/Aeneas/Data/Coinductive/ITree.lean
+++ b/backends/lean/Aeneas/Data/Coinductive/ITree.lean
@@ -125,18 +125,17 @@ theorem vis_mono α [PartialOrder α] i (f : α → E.O i → ITree E R) :
     have := hf t1 t2 hle o
     grind [CoInd.leN_le]
 
-def ITree.spin : ITree E R := ITree.div
-
 @[simp]
 theorem ITree.bot_eq :
-  CoInd.bot (ITreeF E R) = ITree.spin := by
+  CoInd.bot (ITreeF E R) = ITree.div := by
     ext n
     induction n; congr 0
-    rw [CoInd.bot_eq, spin]
+    rw [CoInd.bot_eq, div]
     simp [PF.map, PF.pack, CoInd.fold, *, PF.unpack, default]
 
+
 theorem ITree.le_unfold (t1 t2 : ITree E R) :
-  (t1 ⊑ t2) = (t1 = .spin ∨
+  (t1 ⊑ t2) = (t1 = .div ∨
     (∃ r, t1 = .ret r ∧ t2 = .ret r) ∨
     (∃ i t1' t2', t1 = .vis i t1' ∧ t2 = .vis i t2' ∧ ∀ o, t1' o ⊑ t2' o)) := by
     ext
@@ -147,7 +146,7 @@ theorem ITree.le_unfold (t1 t2 : ITree E R) :
       rw [<-Coinductive.unfold_fold _ t1, <-Coinductive.unfold_fold _ t2]
       rw [<-PF.unpack_pack (CoInd.unfold _ t1), <-PF.unpack_pack (CoInd.unfold _ t2)]
       simp only [h1, h2]
-      cases i <;> simp [PF.pack, ret, spin, div, vis, fold]
+      cases i <;> simp [PF.pack, ret, div, div, vis, fold]
       · grind
       · grind
     · rintro (rfl| ⟨_, rfl, rfl⟩ | ⟨_, _, _, rfl, rfl, _⟩)
@@ -201,10 +200,7 @@ theorem bind_mono {α} {S} [PartialOrder α]
     unfold ITree.bind
     rw [ITree.le_unfold] at hlef
     rcases hlef with (rfl|⟨_, rfl, rfl⟩|⟨_, _, _, rfl, rfl, _⟩)
-    · simp [ITree.spin]
-      simp [CoIndN.le, CoIndN.bot]
-      left
-      simp [ITree.spin]
+    · simp [CoIndN.le, CoIndN.bot]
     · rename_i x
       simp
       have := hg t1 t2 hle x
@@ -511,4 +507,55 @@ theorem ITree.cases.vis {E R motive r d v e k}
 --   | _ => simp at h
 
 
+theorem ITree.le_div_is_div
+  (t : ITree E R)
+  (h : t ⊑ div)
+  : t = div := by
+  -- have := bot_le t
+  -- apply PartialOrder.rel_antisymm <;> try assumption
+  -- simp [← ITree.bot_eq]
+  -- -- unfold bot at this
+  -- have bla := CoInd.csup_eq_bot (c := (empty_chain (ITree E R)))
+  -- have bla := bla (by grind [empty_chain])
+  -- -- rw [bla] at this
+  -- -- simp [bot, instCCPOCoIndOfInhabitedPUnit] at this
+  -- -- apply CoInd.csup_eq_bot
+  -- sorry
+  simp [PartialOrder.rel, CoInd.le] at h
+  cases h with | inl _ => assumption | inr h =>
+  simp [div, fold] at h
+  cases h
+  rename_i i k1 k2 a a1 a2
+  cases i
+  · simp [PF.unpack] at a2
+  · cases t
+    · simp [pure, ret, fold, PF.unpack] at a1
+    · rfl
+    · simp [vis, fold, PF.unpack] at a1
+  · simp [PF.unpack] at a2
+
+theorem ITree.le_ret_inj
+  (x y : R)
+  (h : ITree.ret (E:=E) x ⊑ ITree.ret y)
+  : x = y := by
+  simp [PartialOrder.rel, CoInd.le] at h
+  cases h with |inl h => _ | inr h => _
+  · exfalso
+    apply not_ret_div h
+  · simp [ret, fold] at h
+    cases h
+    rename_i i k1 k2 a a1 a2
+    cases i
+    · simp [PF.unpack] at a1 a2
+      simp [a1.left, a2.left]
+    · simp [PF.unpack] at a2
+    · simp [PF.unpack] at a2
+
+theorem ITree.div_is_bot :
+  bot = (.div : ITree E R) := by
+  unfold bot
+  have dir1 := csup_le (x := .div) (chain_empty (ITree E R)) (by grind [empty_chain])
+  apply ITree.le_div_is_div
+  assumption
+
 namespace Aeneas.Data.Coinductive
diff --git a/backends/lean/Aeneas/Std/Primitives.lean b/backends/lean/Aeneas/Std/Primitives.lean
index a02471815..baf1e0109 100644
--- a/backends/lean/Aeneas/Std/Primitives.lean
+++ b/backends/lean/Aeneas/Std/Primitives.lean
@@ -400,8 +400,10 @@ section Order
 
 open Lean.Order
 
-instance : PartialOrder (Result α) := instPartialOrderCoIndOfInhabitedPUnit _
-noncomputable instance : CCPO (Result α) := instCCPOCoIndOfInhabitedPUnit _
+instance : PartialOrder (Result α) := instPartialOrderCoIndOfInhabitedPUnit (ITreeF RustEffect α) -- by unfold Result; infer_instance
+  -- instPartialOrderCoIndOfInhabitedPUnit _
+noncomputable instance : CCPO (Result α) := instCCPOCoIndOfInhabitedPUnit (ITreeF RustEffect α) -- by unfold Result; infer_instance
+  -- instCCPOCoIndOfInhabitedPUnit _
 noncomputable instance : MonoBind Result := instMonoBindITree
 
 -- TODO: is there a way to not need to state this, and just use the typeclass instance?
diff --git a/backends/lean/Aeneas/Std/WP.lean b/backends/lean/Aeneas/Std/WP.lean
index 045b56e81..174c9c41f 100644
--- a/backends/lean/Aeneas/Std/WP.lean
+++ b/backends/lean/Aeneas/Std/WP.lean
@@ -10,6 +10,7 @@ namespace Aeneas.Std.WP
 
 open Std Result
 open Aeneas.Data.Coinductive
+open Lean.Order
 
 def Post α := (α -> Prop)
 def Pre := Prop
@@ -30,7 +31,7 @@ def wp_return (x:α) : Wp α := fun p => p x
 
 @[grind]
 inductive spec {α} : (x : Result α) → (p : Post α) →  Prop where
-| ret : ∀ x, p x → spec (.ok x) p
+| ret : ∀ p x, p x → spec (.ok x) p
 -- | vis : ∀ k, (∀ b, spec p (k b)) → spec p (ITree.vis () k)
 -- | fail : ∀ k, (∀ b, spec p (k b)) → spec p (ITree.vis () k)
 
@@ -42,8 +43,8 @@ inductive spec {α} : (x : Result α) → (p : Post α) →  Prop where
 --   | fail _ => False
 --   | div => True
 inductive dspec {α} : (x : Result α) → (p : Post α) →  Prop where
-| ret : ∀ x, p x → dspec (.ok x) p
-| div : dspec div p
+| ret : ∀ p x, p x → dspec (.ok x) p
+| div : ∀ p, dspec div p
 
 theorem spec_dspec (α) (x : Result α) (p: Post α) : spec x p → dspec x p := by
   intros s
@@ -51,11 +52,93 @@ theorem spec_dspec (α) (x : Result α) (p: Post α) : spec x p → dspec x p :=
   apply dspec.ret
   assumption
 
--- TODO: do i need this?
--- theorem dspec_admissible {α} (p : Post α )
---   : Lean.Order.admissible (fun x => dspec x p) := by
---   apply Lean.Order.admissible_flatOrder
---   simp [dspec]
+unseal Result
+theorem dspec_admissible {α} (p : Post α )
+  : admissible (fun x => dspec x p) := by
+  intro c hchain h
+  simp at h
+  by_cases (∃ a, c a) <;> rename_i h1
+  · have : c (CCPO.csup hchain) := by
+      by_cases (∃ a, c (.ok a))
+      · rename_i h2
+        rcases h2 with ⟨a, ca⟩
+        have dir1 := csup_le (x:=.ok a) hchain (by
+          intros y cy
+          have h := h y cy
+          cases h
+          · have order := hchain _ _ ca cy
+            cases order <;> try assumption
+            rename_i h
+            simp [ok] at *
+            rw [ITree.le_ret_inj _ _ h]
+            rfl
+          · simp [div, ok]
+            rw [← ITree.div_is_bot]
+            apply bot_le
+          )
+        have dir2 := le_csup hchain ca
+        rw [PartialOrder.rel_antisymm dir1 dir2]
+        assumption
+      · have := CCPO.csup_spec hchain
+        simp [is_sup] at this
+        have this := (this .div).mpr
+        have only_div : ∀ a, c a → a = div := by
+          intros a ca
+          have h := h a ca
+          cases h <;> grind
+        have this := this (by
+          intros y cy
+          simp [only_div y cy]
+          apply PartialOrder.rel_refl
+          )
+        simp [Result, instCCPOResult]
+        rw [ITree.le_div_is_div (CCPO.csup (c:=c) hchain) this]
+        rcases h1 with ⟨a, ca⟩
+        have h := h a ca
+        simp [div] at only_div
+        rw [← only_div a ca]
+        assumption
+    grind
+  · have : CCPO.csup hchain = bot := by
+      unfold bot empty_chain
+      congr
+      grind
+    rw [this]
+    unfold Result
+    rw [ITree.div_is_bot]
+    constructor
+seal Result
+  -- by_cases h' : ∃ x, c x ∧ x ≠ .div
+  -- ·
+  --   simp [Lean.Order.CCPO.csup]
+  --   -- simp [← flat_csup_eq, flat_csup, h']
+  --   apply Classical.some_spec₂ (q := (dspec · p))
+  --   intro x ⟨hcx, hneb⟩
+  --   apply h x hcx
+  --   --
+  -- ·
+  --   simp [Lean.Order.CCPO.csup]
+  --   simp [← flat_csup_eq, flat_csup, h', hnot]
+  -- -- unfold Lean.Order.admissible
+  -- -- intros c hc dspecc
+  -- -- simp at *
+  -- -- by_cases ∃ x, c (.ok x)
+  -- -- · sorry
+  -- -- ·
+  -- --   have : Lean.Order.CCPO.csup hc = Result.div := by
+  -- --     generalize hsup : Lean.Order.CCPO.csup hc = sup at *
+  -- --     have dspecc := dspecc (Lean.Order.CCPO.csup hc) ?_ -- (Lean.Order.CCPO.csup_spec hc)
+  -- --     cases h : (Lean.Order.CCPO.csup hc) <;> try rfl
+  -- --     · sorry
+  -- --     · sorry
+  -- --     ·
+  -- --       sorry
+  -- --     --
+  -- --     -- sorry
+  -- --   sorry
+  -- -- apply Lean.Order.admissible_flatOrder
+  -- -- simp [dspec]
+  -- -- sorry
 
 /-- Variant of `uncurry` used to decompose tuples in post-conditions.
 
diff --git a/backends/lean/Aeneas/Tactic/Step/DspecInduction.lean b/backends/lean/Aeneas/Tactic/Step/DspecInduction.lean
index 25ee63dd1..714d3bc0e 100644
--- a/backends/lean/Aeneas/Tactic/Step/DspecInduction.lean
+++ b/backends/lean/Aeneas/Tactic/Step/DspecInduction.lean
@@ -93,8 +93,7 @@ theorem curry_admissible (a1 a2 a3) (P : (a1 → a2 → a3) → Prop) [CCPO a3]
 theorem WP_func_admissible (α β : Type) (arg) (post)
   : Order.admissible fun (f : α → Result β) => WP.dspec (f arg) post := by
   apply Lean.Order.admissible_apply (fun _ fx => WP.dspec fx _)
-  apply Lean.Order.admissible_flatOrder
-  simp only [WP.dspec]
+  apply WP.dspec_admissible
 
 def getParamNames (ty : Expr) : MetaM (Array Name) := do
   forallTelescope ty fun xs _ => do
@@ -343,7 +342,7 @@ example x y : (first_arg_const x y) ⦃fun x => x = 0⦄div := by
   dspec_induction first_arg_const
   intros first_arg_const' ih y
   split
-  · trivial
+  · simp
   · apply ih
 
 example x y : (second_arg_const x y) ⦃fun x => x = 0⦄div := by
@@ -351,7 +350,7 @@ example x y : (second_arg_const x y) ⦃fun x => x = 0⦄div := by
   dspec_induction second_arg_const
   intros second_arg_const' ih y
   split
-  · trivial
+  · simp
   · apply ih
 
 end Test
diff --git a/backends/lean/Aeneas/Tactic/Step/Step.lean b/backends/lean/Aeneas/Tactic/Step/Step.lean
index 2c4312fb2..02d92e13f 100644
--- a/backends/lean/Aeneas/Tactic/Step/Step.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Step.lean
@@ -2169,8 +2169,7 @@ h1 : ∀ (i : ℕ) (x : i < s.length), s'[i] = 0#u32
       · apply Lean.Order.admissible_pi
         intros y
         apply Lean.Order.admissible_apply (fun _ fx => WP.dspec fx _)
-        apply Lean.Order.admissible_flatOrder
-        simp only [WP.dspec]
+        apply WP.dspec_admissible
       · intros
         simp only
         split

From ded4e4f72ffdc03cf6f31aeb76755e0be2948261 Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Tue, 14 Jul 2026 14:09:34 -0400
Subject: [PATCH 53/67] fixed all errors in backend

---
 .../lean/Aeneas/Command/Decompose/Tests.lean  |  2 +-
 backends/lean/Aeneas/Tactic/Step/Step.lean    |  2 +-
 .../Tactic/Step/Tests/IntroOutputs.lean       |  3 +-
 .../Aeneas/Tactic/Step/Tests/MvcgenSpec.lean  | 34 ++++++++++---------
 tests/lean/lakefile.lean                      |  6 ++--
 5 files changed, 25 insertions(+), 22 deletions(-)

diff --git a/backends/lean/Aeneas/Command/Decompose/Tests.lean b/backends/lean/Aeneas/Command/Decompose/Tests.lean
index 6752bdee3..533e73dcc 100644
--- a/backends/lean/Aeneas/Command/Decompose/Tests.lean
+++ b/backends/lean/Aeneas/Command/Decompose/Tests.lean
@@ -1570,7 +1570,7 @@ info: test39_eq : ∀ (n : ℕ),
 #guard_msgs in
 #check @test39_eq
 /--
-info: 'Aeneas.Command.Decompose.Tests.test39_eq' depends on axioms: [propext, Quot.sound]
+info: 'Aeneas.Command.Decompose.Tests.test39_eq' depends on axioms: [propext, Classical.choice, Quot.sound]
 -/
 #guard_msgs in
 #print axioms test39_eq
diff --git a/backends/lean/Aeneas/Tactic/Step/Step.lean b/backends/lean/Aeneas/Tactic/Step/Step.lean
index 02d92e13f..2438ffa8e 100644
--- a/backends/lean/Aeneas/Tactic/Step/Step.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Step.lean
@@ -2196,7 +2196,7 @@ h1 : ∀ (i : ℕ) (x : i < s.length), s'[i] = 0#u32
     : Std.WP.dspec (simple_converge x) (fun res => res = 10#i32)
     := by
       unfold simple_converge
-      split <;> simp [WP.dspec]
+      split <;> simp
 
   -- test using dspec theorem to step dspec
   example : WP.dspec
diff --git a/backends/lean/Aeneas/Tactic/Step/Tests/IntroOutputs.lean b/backends/lean/Aeneas/Tactic/Step/Tests/IntroOutputs.lean
index 03c801cc8..7049ec6f6 100644
--- a/backends/lean/Aeneas/Tactic/Step/Tests/IntroOutputs.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Tests/IntroOutputs.lean
@@ -453,7 +453,8 @@ def nestedExistentialProg : Result ((Nat × Nat) × Nat) := ok ((1, 2), 3)
 @[step]
 theorem nestedExistentialProg_spec :
     nestedExistentialProg ⦃ (a, b) c => ∃ (_ : a = 1), b = 2 ∧ c = 3 ⦄ := by
-  unfold nestedExistentialProg; exact ⟨rfl, rfl, rfl⟩
+  constructor
+  simp
 
 /--
 info: Try this:
diff --git a/backends/lean/Aeneas/Tactic/Step/Tests/MvcgenSpec.lean b/backends/lean/Aeneas/Tactic/Step/Tests/MvcgenSpec.lean
index ab18dc289..7cf4100cd 100644
--- a/backends/lean/Aeneas/Tactic/Step/Tests/MvcgenSpec.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Tests/MvcgenSpec.lean
@@ -11,21 +11,23 @@ set_option mvcgen.warning false
 For every @[step] theorem, the attribute handler also generates an `mvcgen` spec.
 -/
 
-example {x y : U8} (hmax : x.val + y.val ≤ U8.max) :
-    ⦃ ⌜ True ⌝ ⦄ (x + y) ⦃ ⇓ z => ⌜ z.val = x.val + y.val ⌝ ⦄ := by
-  mvcgen; scalar_tac
+-- TODO: figure out if mvcgen can work with new Result
 
-example {x y : U8} :
-    ⦃ ⌜ True ⌝ ⦄
-      (do
-        if x < 10#u8
-        then x * 2#u8
-        else pure y)
-    ⦃ ⇓ z => ⌜ z.val ≠ y → z.val < 20 ⌝ ⦄ := by
-  mvcgen <;> scalar_tac
+-- example {x y : U8} (hmax : x.val + y.val ≤ U8.max) :
+--     ⦃ ⌜ True ⌝ ⦄ (x + y) ⦃ ⇓ z => ⌜ z.val = x.val + y.val ⌝ ⦄ := by
+--   mvcgen; scalar_tac
 
-example (arr : Array U8 25#usize) (i : Usize) (a : U8) (hi : i < arr.length) :
-    ⦃ ⌜ True ⌝ ⦄
-      Array.update arr i a
-    ⦃ ⇓ r => ⌜ r.get? i = some a ⌝ ⦄ := by
-  mvcgen; grind
+-- example {x y : U8} :
+--     ⦃ ⌜ True ⌝ ⦄
+--       (do
+--         if x < 10#u8
+--         then x * 2#u8
+--         else pure y)
+--     ⦃ ⇓ z => ⌜ z.val ≠ y → z.val < 20 ⌝ ⦄ := by
+--   mvcgen <;> scalar_tac
+
+-- example (arr : Array U8 25#usize) (i : Usize) (a : U8) (hi : i < arr.length) :
+--     ⦃ ⌜ True ⌝ ⦄
+--       Array.update arr i a
+--     ⦃ ⇓ r => ⌜ r.get? i = some a ⌝ ⦄ := by
+--   mvcgen; grind
diff --git a/tests/lean/lakefile.lean b/tests/lean/lakefile.lean
index 5e857ea8b..b0168d5dd 100644
--- a/tests/lean/lakefile.lean
+++ b/tests/lean/lakefile.lean
@@ -23,9 +23,9 @@ package «tests» {}
 @[default_target] lean_lib CastSigned
 @[default_target] lean_lib ChunksExact
 @[default_target] lean_lib Closures
+@[default_target] lean_lib ConstShadow
 @[default_target] lean_lib Constants
 @[default_target] lean_lib ConstantsLean
-@[default_target] lean_lib ConstShadow
 @[default_target] lean_lib Curve25519
 @[default_target] lean_lib Default
 @[default_target] lean_lib DefaultedMethod
@@ -62,10 +62,10 @@ package «tests» {}
 @[default_target] lean_lib JoinDuplicate
 @[default_target] lean_lib Joins
 @[default_target] lean_lib ListBorrows
-@[default_target] lean_lib Loops
-@[default_target] lean_lib LoopsAdts
 @[default_target] lean_lib LoopSharedBorrowProj
 @[default_target] lean_lib LoopSharedLoanInJoin
+@[default_target] lean_lib Loops
+@[default_target] lean_lib LoopsAdts
 @[default_target] lean_lib LoopsIssues
 @[default_target] lean_lib LoopsNested
 @[default_target] lean_lib LoopsNestedRec

From 1546bd9fe4143cc0138483a12b4a1a91eaa4ebbf Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Wed, 15 Jul 2026 11:08:18 -0400
Subject: [PATCH 54/67] assert issue

---
 .../lean/Aeneas/Data/Coinductive/ITree.lean   | 39 +++++++++----------
 backends/lean/Aeneas/Std/Primitives.lean      | 10 +++++
 backends/lean/Aeneas/Std/SliceIter.lean       |  4 --
 3 files changed, 29 insertions(+), 24 deletions(-)

diff --git a/backends/lean/Aeneas/Data/Coinductive/ITree.lean b/backends/lean/Aeneas/Data/Coinductive/ITree.lean
index b78f57f51..78bc46d04 100644
--- a/backends/lean/Aeneas/Data/Coinductive/ITree.lean
+++ b/backends/lean/Aeneas/Data/Coinductive/ITree.lean
@@ -331,30 +331,32 @@ partial_fixpoint
 -- TODO: These have been added on top of original library. I'm not sure if there's a better
 -- way to do this yet.
 
--- @[simp, grind .]
+@[simp, grind .]
 theorem not_vis_ret {E} {α} {x : α} {e k} : ¬ ITree.ret (E := E) x = ITree.vis e k := by
   intros eq
   have eq := congrArg (fun i => i.approx 1) eq
   simp at eq
 
--- @[simp, grind .]
+@[simp, grind .]
 theorem not_ret_div {E} {α} {x : α} : ¬ ITree.ret (E := E) x = ITree.div := by
   intros eq
   have eq := congrArg (fun i => i.approx 1) eq
   simp at eq
 
--- @[simp, grind .]
+@[simp, grind .]
 theorem not_div_vis {E} {α} {e k} : ¬  @ITree.div α E = ITree.vis e k := by
   intros eq
   have eq := congrArg (fun i => i.approx 1) eq
   simp at eq
 
--- @[simp, grind .]
-theorem ret_inj {E} {α} {x y} : @ITree.ret α E x = ITree.ret y → x = y := by
-  intros eq
-  have eq := congrArg (fun i => i.approx 1) eq
-  simp at eq
-  grind only
+@[simp, grind .]
+theorem ret_inj {E} {α} {x y} : (@ITree.ret α E x = ITree.ret y) ↔ (x = y) := by
+  constructor
+  · intros eq
+    have eq := congrArg (fun i => i.approx 1) eq
+    simp at eq
+    grind only
+  · grind only
 
 theorem vis_inj_effect {E} {α} {e1 e2 k1 k2} : @ITree.vis α E e1 k1 = ITree.vis e2 k2
   → e1 = e2 := by
@@ -539,17 +541,14 @@ theorem ITree.le_ret_inj
   (h : ITree.ret (E:=E) x ⊑ ITree.ret y)
   : x = y := by
   simp [PartialOrder.rel, CoInd.le] at h
-  cases h with |inl h => _ | inr h => _
-  · exfalso
-    apply not_ret_div h
-  · simp [ret, fold] at h
-    cases h
-    rename_i i k1 k2 a a1 a2
-    cases i
-    · simp [PF.unpack] at a1 a2
-      simp [a1.left, a2.left]
-    · simp [PF.unpack] at a2
-    · simp [PF.unpack] at a2
+  simp [ret, fold] at h
+  cases h
+  rename_i i k1 k2 a a1 a2
+  cases i
+  · simp [PF.unpack] at a1 a2
+    simp [a1.left, a2.left]
+  · simp [PF.unpack] at a2
+  · simp [PF.unpack] at a2
 
 theorem ITree.div_is_bot :
   bot = (.div : ITree E R) := by
diff --git a/backends/lean/Aeneas/Std/Primitives.lean b/backends/lean/Aeneas/Std/Primitives.lean
index baf1e0109..398271966 100644
--- a/backends/lean/Aeneas/Std/Primitives.lean
+++ b/backends/lean/Aeneas/Std/Primitives.lean
@@ -164,6 +164,12 @@ theorem Result.match.fail {R motive r d f e}
 --   : r.match_dep (motive:=motive) ok fail div =
 --     (∃ a, r = .ok a ∧ ok _) := by sorry
 
+-- TODO: clean up if i dont use this
+-- def Result.assert_eq_ok {T} [BEq T] (r : Result T) (t : T) : Bool :=
+--   r.match_dep (fun x => x == t) (fun _ => false) (fun _ => false)
+-- def Result.beq {T} [BEq T] (r1 r2 : Result T) : Bool :=
+--   r.match_dep (fun)
+
 -- @[elab_as_elim, cases_eliminator]
 abbrev Result.match_dep' {α}
   {motive : Result α → Sort v}
@@ -193,6 +199,10 @@ theorem Result.match_dep'.div {R motive v r d f}
   : @Result.match_dep' R motive v r f d = cast (congrArg motive (Eq.symm h)) (d h) := by
   cases v <;> unfold match_dep' <;> simp <;> grind
 
+def Result.assert_eq_ok {T} [BEq T] (r : Result T) (t : T) : Bool :=
+  r.match_dep (fun x => x == t) (fun _ => false) (fun _ => false)
+
+-- TODO: I don't think this one is needed:
 -- @[elab_as_elim, cases_eliminator]
 abbrev Result.match_dep'' {α}
   {motive : Result α → Sort v}
diff --git a/backends/lean/Aeneas/Std/SliceIter.lean b/backends/lean/Aeneas/Std/SliceIter.lean
index 840b77aad..c79ea7716 100644
--- a/backends/lean/Aeneas/Std/SliceIter.lean
+++ b/backends/lean/Aeneas/Std/SliceIter.lean
@@ -320,10 +320,6 @@ private def collectStepBy (sbi : core.iter.adapters.step_by.StepBy (core.slice.i
   (fun e => e == .panic)
   (fun _ => false)
 
--- TODO: decide where to place this function, its here just for now
-def Result.assert_eq_ok {T} [BEq T] (r : Result T) (t : T) : Bool :=
-  r.match_dep (fun x => x == t) (fun _ => false) (fun _ => false)
-
 -- step_by(1) returns all elements
 #assert (do
   let sbi ← core.slice.iter.IteratorSliceIter.step_by (mkSliceIter [0, 1, 2, 3, 4]) 1#usize

From 26c5f659e798793a2edb2287f5aad554675e6135 Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Thu, 16 Jul 2026 12:25:39 -0400
Subject: [PATCH 55/67] some progress to fixing assertions

---
 backends/lean/Aeneas/Std/Primitives.lean | 95 ++++++++++--------------
 backends/lean/Aeneas/Std/SliceIter.lean  | 26 +++----
 src/extract/Extract.ml                   |  2 +-
 3 files changed, 52 insertions(+), 71 deletions(-)

diff --git a/backends/lean/Aeneas/Std/Primitives.lean b/backends/lean/Aeneas/Std/Primitives.lean
index 398271966..fb5579317 100644
--- a/backends/lean/Aeneas/Std/Primitives.lean
+++ b/backends/lean/Aeneas/Std/Primitives.lean
@@ -18,22 +18,43 @@ open Aeneas.Data.Coinductive
 
 syntax (name := assert) "#assert" term: command
 
+-- @[command_elab assert]
+-- unsafe
+-- def assertImpl : CommandElab := fun (stx: Syntax) => do
+--   runTermElabM (fun _ => do
+--     let r ← evalTerm Bool (mkConst ``Bool) stx[1]
+--     if not r then
+--       logInfo ("Assertion failed for:\n" ++ stx[1])
+--       throwError ("Expression reduced to false:\n"  ++ stx[1])
+--     pure ())
+
 @[command_elab assert]
-unsafe
 def assertImpl : CommandElab := fun (stx: Syntax) => do
   runTermElabM (fun _ => do
-    let r ← evalTerm Bool (mkConst ``Bool) stx[1]
-    if not r then
+    let prop ← Elab.Term.elabTerm stx[1] (.some (.sort .zero))
+    Term.synthesizeSyntheticMVarsNoPostponing
+    let prop ← instantiateMVars prop
+    let ty ← inferType prop
+    if ty != .sort .zero then
+      throwError "Assertion must be a Prop"
+    let mvar ← Meta.mkFreshExprMVar prop
+    let goal := mvar.mvarId!
+    let (newgoals, _) ← Lean.Elab.runTactic goal (← `(tactic| cbv))
+    if not newgoals.isEmpty then
       logInfo ("Assertion failed for:\n" ++ stx[1])
-      throwError ("Expression reduced to false:\n"  ++ stx[1])
+      throwError ("Assertion failed for:\n"  ++ stx[1])
     pure ())
 
-/--
-info: true
--/
-#guard_msgs in
-#eval 2 == 2
-#assert (2 == 2)
+
+example : 1 + 1 = 2 := by
+  run_tac
+    let goal ← Lean.Elab.Tactic.getMainGoal
+    dbg_trace "{(← goal.getDecl).type}"
+    let (newgoals, _) ← Lean.Elab.runTactic goal (← `(tactic| cbv))
+    dbg_trace "{newgoals.length}"
+  -- cbv
+  --
+
 
 syntax (name := elabSyntax) "#elab" term: command
 
@@ -101,20 +122,20 @@ instance : LawfulMonad Result := instLawfulMonadITree
 
 -- TODO: adding these to simp set messes up some things
 @[simp, grind .]
-theorem ok_not_fail {α} {a : α} {e} : ¬ Result.ok a = .fail e := by grind [Result.ok, Result.fail, not_vis_ret]
+theorem ok_not_fail {α} {a : α} {e} : ¬ Result.ok a = .fail e := by grind [Result.ok, Result.fail]
 @[simp, grind .]
-theorem fail_not_ok {α} {a : α} {e} : ¬ Result.fail e = .ok a := by grind [Result.ok, Result.fail, not_vis_ret]
+theorem fail_not_ok {α} {a : α} {e} : ¬ Result.fail e = .ok a := by grind [Result.ok, Result.fail]
 @[simp, grind .]
-theorem ok_not_div {α} {a : α} : ¬ Result.ok a = .div := by grind [Result.ok, Result.div, not_ret_div]
+theorem ok_not_div {α} {a : α} : ¬ Result.ok a = .div := by grind [Result.ok, Result.div]
 @[simp, grind .]
-theorem div_not_ok {α} {a : α} : ¬ Result.div = .ok a := by grind [Result.ok, Result.div, not_ret_div]
+theorem div_not_ok {α} {a : α} : ¬ Result.div = .ok a := by grind [Result.ok, Result.div]
 @[simp, grind .]
-theorem fail_not_div {α} {e} : ¬ @Result.fail α e = .div := by grind [Result.div, Result.fail, not_div_vis]
+theorem fail_not_div {α} {e} : ¬ @Result.fail α e = .div := by grind [Result.div, Result.fail]
 @[simp, grind .]
-theorem div_not_fail {α} {e} : ¬ .div = @Result.fail α e := by grind [Result.div, Result.fail, not_div_vis]
+theorem div_not_fail {α} {e} : ¬ .div = @Result.fail α e := by grind [Result.div, Result.fail]
 @[simp, grind .]
 theorem Result.ok.injEq {α} {a b : α} : (Result.ok a = .ok b) = (a = b) := by
-  grind [Result.ok, ret_inj]
+  grind [Result.ok]
 @[simp, grind .]
 theorem Result.fail.injEq {α} {a b : Error} : (@Result.fail α a = .fail b) = (a = b) := by
   grind [Result.fail, vis_inj_effect]
@@ -155,21 +176,6 @@ theorem Result.match.div {R motive r d f}
 theorem Result.match.fail {R motive r d f e}
   : @Result.match_dep R motive (.fail e) r f d = f e := ITree.cases.vis
 
--- theorem Result.match_dep_destruct {α}
---   {motive : Result α → Sort v}
---   (r : Result α)
---   (ok : ∀ r, motive (.ok r))
---   (fail : ∀ e, motive (.fail e))
---   (div :  Unit → motive (.div))
---   : r.match_dep (motive:=motive) ok fail div =
---     (∃ a, r = .ok a ∧ ok _) := by sorry
-
--- TODO: clean up if i dont use this
--- def Result.assert_eq_ok {T} [BEq T] (r : Result T) (t : T) : Bool :=
---   r.match_dep (fun x => x == t) (fun _ => false) (fun _ => false)
--- def Result.beq {T} [BEq T] (r1 r2 : Result T) : Bool :=
---   r.match_dep (fun)
-
 -- @[elab_as_elim, cases_eliminator]
 abbrev Result.match_dep' {α}
   {motive : Result α → Sort v}
@@ -199,31 +205,6 @@ theorem Result.match_dep'.div {R motive v r d f}
   : @Result.match_dep' R motive v r f d = cast (congrArg motive (Eq.symm h)) (d h) := by
   cases v <;> unfold match_dep' <;> simp <;> grind
 
-def Result.assert_eq_ok {T} [BEq T] (r : Result T) (t : T) : Bool :=
-  r.match_dep (fun x => x == t) (fun _ => false) (fun _ => false)
-
--- TODO: I don't think this one is needed:
--- @[elab_as_elim, cases_eliminator]
-abbrev Result.match_dep'' {α}
-  {motive : Result α → Sort v}
-  (r : Result α)
-  (ok : ∀ x, r = .ok x → motive r)
-  (fail : ∀ e, r = .fail e → motive r)
-  (div : r = .div → motive r)
-  -- will add more inputs as we add effects
-  : motive r :=
-    Result.match_dep (motive := fun r' => r = r' -> motive r') r
-      (fun r (.refl _) => ok r (by assumption))
-      (fun e (.refl _) => fail e (by assumption))
-      (fun _ (.refl _) => div (by assumption))
-      rfl
-
--- theorem Result.match_dep''.ok {R motive v r d f x}
---   (h : v = Result.ok x)
---   : @Result.match_dep'' R motive v r f d = r x h := by
---   cases v
---   sorry
-
 -- TODO: this is how to register for split, but we probably won't use that
 -- run_meta
 --   Lean.Meta.Match.addMatcherInfo ``Result.match_dep {
diff --git a/backends/lean/Aeneas/Std/SliceIter.lean b/backends/lean/Aeneas/Std/SliceIter.lean
index c79ea7716..120306fda 100644
--- a/backends/lean/Aeneas/Std/SliceIter.lean
+++ b/backends/lean/Aeneas/Std/SliceIter.lean
@@ -323,63 +323,63 @@ private def collectStepBy (sbi : core.iter.adapters.step_by.StepBy (core.slice.i
 -- step_by(1) returns all elements
 #assert (do
   let sbi ← core.slice.iter.IteratorSliceIter.step_by (mkSliceIter [0, 1, 2, 3, 4]) 1#usize
-  collectStepBy sbi).assert_eq_ok [0, 1, 2, 3, 4]
+  collectStepBy sbi) = .ok [0, 1, 2, 3, 4]
 
 -- step_by(2) returns every other element
 #assert (do
   let sbi ← core.slice.iter.IteratorSliceIter.step_by (mkSliceIter [0, 1, 2, 3, 4]) 2#usize
-  collectStepBy sbi).assert_eq_ok [0, 2, 4]
+  collectStepBy sbi) = .ok [0, 2, 4]
 
 -- step_by(3)
 #assert (do
   let sbi ← core.slice.iter.IteratorSliceIter.step_by (mkSliceIter [0, 1, 2, 3, 4, 5, 6]) 3#usize
-  collectStepBy sbi).assert_eq_ok [0, 3, 6]
+  collectStepBy sbi) = .ok [0, 3, 6]
 
 -- step_by larger than collection: returns only first element
 #assert (do
   let sbi ← core.slice.iter.IteratorSliceIter.step_by (mkSliceIter [0, 1, 2]) 10#usize
-  collectStepBy sbi).assert_eq_ok [0]
+  collectStepBy sbi) = .ok [0]
 
 -- step_by on empty iterator
 #assert (do
   let sbi ← core.slice.iter.IteratorSliceIter.step_by (mkSliceIter []) 2#usize
-  collectStepBy sbi).assert_eq_ok []
+  collectStepBy sbi) = .ok []
 
 -- step_by(1) on single element
 #assert (do
   let sbi ← core.slice.iter.IteratorSliceIter.step_by (mkSliceIter [42]) 1#usize
-  collectStepBy sbi).assert_eq_ok [42]
+  collectStepBy sbi) = .ok [42]
 
 -- step_by(2) on single element
 #assert (do
   let sbi ← core.slice.iter.IteratorSliceIter.step_by (mkSliceIter [42]) 2#usize
-  collectStepBy sbi).assert_eq_ok [42]
+  collectStepBy sbi) = .ok [42]
 
 -- step_by equal to length: returns only first element
 #assert (do
   let sbi ← core.slice.iter.IteratorSliceIter.step_by (mkSliceIter [0, 1, 2]) 3#usize
-  collectStepBy sbi).assert_eq_ok [0]
+  collectStepBy sbi) = .ok [0]
 
 -- step_by = length - 1
 #assert (do
   let sbi ← core.slice.iter.IteratorSliceIter.step_by (mkSliceIter [0, 1, 2]) 2#usize
-  collectStepBy sbi).assert_eq_ok [0, 2]
+  collectStepBy sbi) = .ok [0, 2]
 
 -- step_by(2) on two elements: returns only first
 #assert (do
   let sbi ← core.slice.iter.IteratorSliceIter.step_by (mkSliceIter [0, 1]) 2#usize
-  collectStepBy sbi).assert_eq_ok [0]
+  collectStepBy sbi) = .ok [0]
 
 -- step_by(2) on three elements: returns first and third
 #assert (do
   let sbi ← core.slice.iter.IteratorSliceIter.step_by (mkSliceIter [0, 1, 2]) 2#usize
-  collectStepBy sbi).assert_eq_ok [0, 2]
+  collectStepBy sbi) = .ok [0, 2]
 
 -- step_by(4) on longer sequence
 #assert (do
   let sbi ← core.slice.iter.IteratorSliceIter.step_by
     (mkSliceIter [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11]) 4#usize
-  collectStepBy sbi).assert_eq_ok [0, 4, 8]
+  collectStepBy sbi) = .ok [0, 4, 8]
 
 -- Verify that step_by(0) on the generic Iterator.step_by.default also panics
 #assert
@@ -411,7 +411,7 @@ private def collectNestedStepBy
     (mkSliceIter [0, 1, 2, 3, 4, 5, 6, 7]) 2#usize
   let sbi2 ← core.iter.adapters.step_by.IteratorStepBy.step_by
     (core.iter.traits.iterator.IteratorSliceIter Nat) sbi 2#usize
-  collectNestedStepBy sbi2).assert_eq_ok [0, 4]
+  collectNestedStepBy sbi2) = .ok [0, 4]
 
 -- ============================================================================
 -- Step specs for SharedArray.into_iter and SharedSlice.into_iter
diff --git a/src/extract/Extract.ml b/src/extract/Extract.ml
index 2dc4a57fb..099487a69 100644
--- a/src/extract/Extract.ml
+++ b/src/extract/Extract.ml
@@ -3762,7 +3762,7 @@ let extract_unit_test_if_marked (ctx : extraction_ctx) (fmt : F.formatter)
             F.pp_print_space fmt ();
             F.pp_print_string fmt "()");
           F.pp_print_space fmt ();
-          F.pp_print_string fmt "==";
+          F.pp_print_string fmt "=";
           F.pp_print_space fmt ();
           let success =
             ctx_get_variant def.item_meta.span (TBuiltin TResult) result_ok_id

From 2be6bae7bc077902527bbe1511ef1394e91d6ee1 Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Thu, 16 Jul 2026 17:01:49 -0400
Subject: [PATCH 56/67] fixed assert issue

---
 backends/lean/Aeneas/Std/Primitives.lean | 83 ++++++++++++++----------
 backends/lean/Aeneas/Std/SliceIter.lean  | 26 ++++----
 src/extract/Extract.ml                   |  9 +--
 tests/lean/CastSigned.lean               | 30 ++++-----
 tests/lean/ChunksExact.lean              | 18 ++---
 tests/lean/IterAdapters.lean             | 66 +++++++++----------
 tests/lean/NoNestedBorrows.lean          | 26 ++++----
 tests/lean/Paper.lean                    |  6 +-
 tests/lean/Scalars.lean                  | 12 ++--
 tests/lean/SpecTests/Coin.lean           | 13 ++--
 tests/lean/StepBy.lean                   | 22 +++----
 11 files changed, 164 insertions(+), 147 deletions(-)

diff --git a/backends/lean/Aeneas/Std/Primitives.lean b/backends/lean/Aeneas/Std/Primitives.lean
index fb5579317..6f79a6179 100644
--- a/backends/lean/Aeneas/Std/Primitives.lean
+++ b/backends/lean/Aeneas/Std/Primitives.lean
@@ -18,42 +18,32 @@ open Aeneas.Data.Coinductive
 
 syntax (name := assert) "#assert" term: command
 
--- @[command_elab assert]
--- unsafe
--- def assertImpl : CommandElab := fun (stx: Syntax) => do
---   runTermElabM (fun _ => do
---     let r ← evalTerm Bool (mkConst ``Bool) stx[1]
---     if not r then
---       logInfo ("Assertion failed for:\n" ++ stx[1])
---       throwError ("Expression reduced to false:\n"  ++ stx[1])
---     pure ())
-
 @[command_elab assert]
+unsafe
 def assertImpl : CommandElab := fun (stx: Syntax) => do
   runTermElabM (fun _ => do
-    let prop ← Elab.Term.elabTerm stx[1] (.some (.sort .zero))
-    Term.synthesizeSyntheticMVarsNoPostponing
-    let prop ← instantiateMVars prop
-    let ty ← inferType prop
-    if ty != .sort .zero then
-      throwError "Assertion must be a Prop"
-    let mvar ← Meta.mkFreshExprMVar prop
-    let goal := mvar.mvarId!
-    let (newgoals, _) ← Lean.Elab.runTactic goal (← `(tactic| cbv))
-    if not newgoals.isEmpty then
+    let r ← evalTerm Bool (mkConst ``Bool) stx[1]
+    if not r then
       logInfo ("Assertion failed for:\n" ++ stx[1])
-      throwError ("Assertion failed for:\n"  ++ stx[1])
+      throwError ("Expression reduced to false:\n"  ++ stx[1])
     pure ())
 
-
-example : 1 + 1 = 2 := by
-  run_tac
-    let goal ← Lean.Elab.Tactic.getMainGoal
-    dbg_trace "{(← goal.getDecl).type}"
-    let (newgoals, _) ← Lean.Elab.runTactic goal (← `(tactic| cbv))
-    dbg_trace "{newgoals.length}"
-  -- cbv
-  --
+-- @[command_elab assert]
+-- def assertImpl : CommandElab := fun (stx: Syntax) => do
+--   runTermElabM (fun _ => do
+--     let prop ← Elab.Term.elabTerm stx[1] (.some (.sort .zero))
+--     Term.synthesizeSyntheticMVarsNoPostponing
+--     let prop ← instantiateMVars prop
+--     let ty ← inferType prop
+--     if ty != .sort .zero then
+--       throwError "Assertion must be a Prop"
+--     let mvar ← Meta.mkFreshExprMVar prop
+--     let goal := mvar.mvarId!
+--     let (newgoals, _) ← Lean.Elab.runTactic goal (← `(tactic| cbv))
+--     if not newgoals.isEmpty then
+--       logInfo ("Assertion failed for:\n" ++ stx[1])
+--       throwError ("Assertion failed for:\n"  ++ stx[1])
+--     pure ())
 
 
 syntax (name := elabSyntax) "#elab" term: command
@@ -98,20 +88,24 @@ def RustEffect : Effect := {
 
 -- We need Result to be irreducble outside this file (to not break metaprograms which normalize types),
 -- but reducible within. The `unseal` command only affects the local context.
-@[irreducible]
+@[irreducible /-, cbv_opaque-/]
 def Result (α : Type u) : Type u := ITree RustEffect α
 unseal Result
 
 
+-- TODO: clean up the cbv stuff
+-- @[cbv_opaque]
 def Result.ok {α} (a : α) : Result α := .ret a
 
+-- @[cbv_opaque]
 def Result.fail {α} (e : Error) : Result α := .vis (.fail e) PEmpty.elim
 
+-- @[cbv_opaque]
 def Result.div {α} : Result α := ITree.div
 
-
 -- TODO: in addition to type levels, does it cause issues that bind comes from the Monad instance?
 -- -- TODO: is it ok to not have β be at a different level `v`?
+-- @[cbv_opaque]
 def bind {α : Type u} {β : Type v} (x: Result α) (f: α → Result β) : Result β :=
   ITree.bind x f
 -- instance : Monad Result := instMonadITree
@@ -119,6 +113,15 @@ instance : Monad Result where
   pure := .ok
   bind := bind
 instance : LawfulMonad Result := instLawfulMonadITree
+  -- pure_bind      (x : α) (f : α → m β) : pure x >>= f = f x
+
+-- @[cbv_eval]
+theorem Result_ok_bind.{u} {A B : Type u} : ∀ (x : A) (f : A → Result B),
+  bind (Result.ok x) f = f x := by
+    intros x f
+    let h := instLawfulMonadResult.pure_bind x f
+    simp [Bind.bind] at h
+    assumption
 
 -- TODO: adding these to simp set messes up some things
 @[simp, grind .]
@@ -149,7 +152,8 @@ theorem Result.fail.injEq {α} {a b : Error} : (@Result.fail α a = .fail b) = (
 -- this function can be used in many cases to replace pattern matching on that inductive:
 -- TODO: why do things error when this is def instead of abbrev?
 @[elab_as_elim, cases_eliminator]
-abbrev Result.match_dep {α}
+-- @[elab_as_elim, cases_eliminator, irreducible, cbv_opaque]
+def Result.match_dep {α}
   {motive : Result α → Sort v}
   (r : Result α)
   (ok : ∀ r, motive (.ok r))
@@ -163,6 +167,7 @@ abbrev Result.match_dep {α}
             simp [same]
             exact (fail e)
     ) r
+-- unseal Result.match_dep
 
 @[simp]
 theorem Result.match.ok {R motive r d f x}
@@ -176,8 +181,12 @@ theorem Result.match.div {R motive r d f}
 theorem Result.match.fail {R motive r d f e}
   : @Result.match_dep R motive (.fail e) r f d = f e := ITree.cases.vis
 
+def Result.is_ok {R : Type} [BEq R] (r : Result R) (expected : R) : Bool :=
+  r.match_dep (fun x => x == expected) (fun _ => false) (fun _ => false)
+
 -- @[elab_as_elim, cases_eliminator]
-abbrev Result.match_dep' {α}
+-- @[irreducible, cbv_opaque]
+def Result.match_dep' {α}
   {motive : Result α → Sort v}
   (r : Result α)
   (ok : ∀ x, r = .ok x → motive (.ok x))
@@ -205,6 +214,12 @@ theorem Result.match_dep'.div {R motive v r d f}
   : @Result.match_dep' R motive v r f d = cast (congrArg motive (Eq.symm h)) (d h) := by
   cases v <;> unfold match_dep' <;> simp <;> grind
 
+instance {T} [Repr T] : Repr (Result T) where
+  reprPrec x n := x.match_dep
+    (fun t => .append (.text "ok ") (reprPrec t n))
+    (fun e => .append (.text "fail ") (reprPrec e n))
+    (fun _ => .text "div")
+
 -- TODO: this is how to register for split, but we probably won't use that
 -- run_meta
 --   Lean.Meta.Match.addMatcherInfo ``Result.match_dep {
diff --git a/backends/lean/Aeneas/Std/SliceIter.lean b/backends/lean/Aeneas/Std/SliceIter.lean
index 120306fda..fae5c2994 100644
--- a/backends/lean/Aeneas/Std/SliceIter.lean
+++ b/backends/lean/Aeneas/Std/SliceIter.lean
@@ -323,63 +323,63 @@ private def collectStepBy (sbi : core.iter.adapters.step_by.StepBy (core.slice.i
 -- step_by(1) returns all elements
 #assert (do
   let sbi ← core.slice.iter.IteratorSliceIter.step_by (mkSliceIter [0, 1, 2, 3, 4]) 1#usize
-  collectStepBy sbi) = .ok [0, 1, 2, 3, 4]
+  collectStepBy sbi).is_ok [0, 1, 2, 3, 4]
 
 -- step_by(2) returns every other element
 #assert (do
   let sbi ← core.slice.iter.IteratorSliceIter.step_by (mkSliceIter [0, 1, 2, 3, 4]) 2#usize
-  collectStepBy sbi) = .ok [0, 2, 4]
+  collectStepBy sbi).is_ok [0, 2, 4]
 
 -- step_by(3)
 #assert (do
   let sbi ← core.slice.iter.IteratorSliceIter.step_by (mkSliceIter [0, 1, 2, 3, 4, 5, 6]) 3#usize
-  collectStepBy sbi) = .ok [0, 3, 6]
+  collectStepBy sbi).is_ok [0, 3, 6]
 
 -- step_by larger than collection: returns only first element
 #assert (do
   let sbi ← core.slice.iter.IteratorSliceIter.step_by (mkSliceIter [0, 1, 2]) 10#usize
-  collectStepBy sbi) = .ok [0]
+  collectStepBy sbi).is_ok [0]
 
 -- step_by on empty iterator
 #assert (do
   let sbi ← core.slice.iter.IteratorSliceIter.step_by (mkSliceIter []) 2#usize
-  collectStepBy sbi) = .ok []
+  collectStepBy sbi).is_ok []
 
 -- step_by(1) on single element
 #assert (do
   let sbi ← core.slice.iter.IteratorSliceIter.step_by (mkSliceIter [42]) 1#usize
-  collectStepBy sbi) = .ok [42]
+  collectStepBy sbi).is_ok [42]
 
 -- step_by(2) on single element
 #assert (do
   let sbi ← core.slice.iter.IteratorSliceIter.step_by (mkSliceIter [42]) 2#usize
-  collectStepBy sbi) = .ok [42]
+  collectStepBy sbi).is_ok [42]
 
 -- step_by equal to length: returns only first element
 #assert (do
   let sbi ← core.slice.iter.IteratorSliceIter.step_by (mkSliceIter [0, 1, 2]) 3#usize
-  collectStepBy sbi) = .ok [0]
+  collectStepBy sbi).is_ok [0]
 
 -- step_by = length - 1
 #assert (do
   let sbi ← core.slice.iter.IteratorSliceIter.step_by (mkSliceIter [0, 1, 2]) 2#usize
-  collectStepBy sbi) = .ok [0, 2]
+  collectStepBy sbi).is_ok [0, 2]
 
 -- step_by(2) on two elements: returns only first
 #assert (do
   let sbi ← core.slice.iter.IteratorSliceIter.step_by (mkSliceIter [0, 1]) 2#usize
-  collectStepBy sbi) = .ok [0]
+  collectStepBy sbi).is_ok [0]
 
 -- step_by(2) on three elements: returns first and third
 #assert (do
   let sbi ← core.slice.iter.IteratorSliceIter.step_by (mkSliceIter [0, 1, 2]) 2#usize
-  collectStepBy sbi) = .ok [0, 2]
+  collectStepBy sbi).is_ok [0, 2]
 
 -- step_by(4) on longer sequence
 #assert (do
   let sbi ← core.slice.iter.IteratorSliceIter.step_by
     (mkSliceIter [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11]) 4#usize
-  collectStepBy sbi) = .ok [0, 4, 8]
+  collectStepBy sbi).is_ok [0, 4, 8]
 
 -- Verify that step_by(0) on the generic Iterator.step_by.default also panics
 #assert
@@ -411,7 +411,7 @@ private def collectNestedStepBy
     (mkSliceIter [0, 1, 2, 3, 4, 5, 6, 7]) 2#usize
   let sbi2 ← core.iter.adapters.step_by.IteratorStepBy.step_by
     (core.iter.traits.iterator.IteratorSliceIter Nat) sbi 2#usize
-  collectNestedStepBy sbi2) = .ok [0, 4]
+  collectNestedStepBy sbi2).is_ok [0, 4]
 
 -- ============================================================================
 -- Step specs for SharedArray.into_iter and SharedSlice.into_iter
diff --git a/src/extract/Extract.ml b/src/extract/Extract.ml
index 099487a69..c84c5d01f 100644
--- a/src/extract/Extract.ml
+++ b/src/extract/Extract.ml
@@ -3753,7 +3753,7 @@ let extract_unit_test_if_marked (ctx : extraction_ctx) (fmt : F.formatter)
       | Lean ->
           F.pp_print_string fmt "#assert";
           F.pp_print_space fmt ();
-          F.pp_print_string fmt "(";
+          F.pp_print_string fmt "((";
           let fun_name =
             ctx_get_local_function def.item_meta.span def.def_id def.loop_id ctx
           in
@@ -3762,13 +3762,14 @@ let extract_unit_test_if_marked (ctx : extraction_ctx) (fmt : F.formatter)
             F.pp_print_space fmt ();
             F.pp_print_string fmt "()");
           F.pp_print_space fmt ();
-          F.pp_print_string fmt "=";
+          F.pp_print_string fmt ").is_ok";
           F.pp_print_space fmt ();
-          let success =
+          (*let success =
             ctx_get_variant def.item_meta.span (TBuiltin TResult) result_ok_id
               ctx
           in
-          F.pp_print_string fmt (success ^ " ())")
+          F.pp_print_string fmt (success ^ " ())")*)
+          F.pp_print_string fmt "())"
       | HOL4 ->
           F.pp_print_string fmt "val _ = assert_ok (";
           F.pp_print_string fmt "“";
diff --git a/tests/lean/CastSigned.lean b/tests/lean/CastSigned.lean
index b1139e148..f45999ea9 100644
--- a/tests/lean/CastSigned.lean
+++ b/tests/lean/CastSigned.lean
@@ -22,7 +22,7 @@ def test_u8_cast_signed_all_ones : Result Unit := do
   massert (y = (-1)#i8)
 
 /- Unit test for [cast_signed::test_u8_cast_signed_all_ones] -/
-#assert (test_u8_cast_signed_all_ones == ok ())
+#assert ((test_u8_cast_signed_all_ones ).is_ok ())
 
 /-- [cast_signed::test_i8_cast_unsigned_neg_one]:
     Source: 'tests/src/cast_signed.rs', lines 17:0-21:1
@@ -32,7 +32,7 @@ def test_i8_cast_unsigned_neg_one : Result Unit := do
   massert (y = 255#u8)
 
 /- Unit test for [cast_signed::test_i8_cast_unsigned_neg_one] -/
-#assert (test_i8_cast_unsigned_neg_one == ok ())
+#assert ((test_i8_cast_unsigned_neg_one ).is_ok ())
 
 /-- [cast_signed::test_u16_cast_signed_high_bit]:
     Source: 'tests/src/cast_signed.rs', lines 25:0-29:1
@@ -42,7 +42,7 @@ def test_u16_cast_signed_high_bit : Result Unit := do
   massert (y = core.num.I16.MIN)
 
 /- Unit test for [cast_signed::test_u16_cast_signed_high_bit] -/
-#assert (test_u16_cast_signed_high_bit == ok ())
+#assert ((test_u16_cast_signed_high_bit ).is_ok ())
 
 /-- [cast_signed::test_i16_cast_unsigned_neg_one]:
     Source: 'tests/src/cast_signed.rs', lines 33:0-37:1
@@ -52,7 +52,7 @@ def test_i16_cast_unsigned_neg_one : Result Unit := do
   massert (y = core.num.U16.MAX)
 
 /- Unit test for [cast_signed::test_i16_cast_unsigned_neg_one] -/
-#assert (test_i16_cast_unsigned_neg_one == ok ())
+#assert ((test_i16_cast_unsigned_neg_one ).is_ok ())
 
 /-- [cast_signed::test_u32_cast_signed_small]:
     Source: 'tests/src/cast_signed.rs', lines 41:0-45:1
@@ -62,7 +62,7 @@ def test_u32_cast_signed_small : Result Unit := do
   massert (y = 255#i32)
 
 /- Unit test for [cast_signed::test_u32_cast_signed_small] -/
-#assert (test_u32_cast_signed_small == ok ())
+#assert ((test_u32_cast_signed_small ).is_ok ())
 
 /-- [cast_signed::test_u32_cast_signed_all_ones]:
     Source: 'tests/src/cast_signed.rs', lines 49:0-53:1
@@ -72,7 +72,7 @@ def test_u32_cast_signed_all_ones : Result Unit := do
   massert (y = (-1)#i32)
 
 /- Unit test for [cast_signed::test_u32_cast_signed_all_ones] -/
-#assert (test_u32_cast_signed_all_ones == ok ())
+#assert ((test_u32_cast_signed_all_ones ).is_ok ())
 
 /-- [cast_signed::test_u32_cast_signed_high_bit]:
     Source: 'tests/src/cast_signed.rs', lines 57:0-61:1
@@ -82,7 +82,7 @@ def test_u32_cast_signed_high_bit : Result Unit := do
   massert (y = core.num.I32.MIN)
 
 /- Unit test for [cast_signed::test_u32_cast_signed_high_bit] -/
-#assert (test_u32_cast_signed_high_bit == ok ())
+#assert ((test_u32_cast_signed_high_bit ).is_ok ())
 
 /-- [cast_signed::test_i32_cast_unsigned_neg_one]:
     Source: 'tests/src/cast_signed.rs', lines 65:0-69:1
@@ -92,7 +92,7 @@ def test_i32_cast_unsigned_neg_one : Result Unit := do
   massert (y = 4294967295#u32)
 
 /- Unit test for [cast_signed::test_i32_cast_unsigned_neg_one] -/
-#assert (test_i32_cast_unsigned_neg_one == ok ())
+#assert ((test_i32_cast_unsigned_neg_one ).is_ok ())
 
 /-- [cast_signed::test_i32_cast_roundtrip]:
     Source: 'tests/src/cast_signed.rs', lines 73:0-77:1
@@ -103,7 +103,7 @@ def test_i32_cast_roundtrip : Result Unit := do
   massert (y = 3735928559#u32)
 
 /- Unit test for [cast_signed::test_i32_cast_roundtrip] -/
-#assert (test_i32_cast_roundtrip == ok ())
+#assert ((test_i32_cast_roundtrip ).is_ok ())
 
 /-- [cast_signed::test_u64_cast_signed_all_ones]:
     Source: 'tests/src/cast_signed.rs', lines 81:0-85:1
@@ -113,7 +113,7 @@ def test_u64_cast_signed_all_ones : Result Unit := do
   massert (y = (-1)#i64)
 
 /- Unit test for [cast_signed::test_u64_cast_signed_all_ones] -/
-#assert (test_u64_cast_signed_all_ones == ok ())
+#assert ((test_u64_cast_signed_all_ones ).is_ok ())
 
 /-- [cast_signed::test_i64_cast_unsigned_neg_one]:
     Source: 'tests/src/cast_signed.rs', lines 89:0-93:1
@@ -123,7 +123,7 @@ def test_i64_cast_unsigned_neg_one : Result Unit := do
   massert (y = core.num.U64.MAX)
 
 /- Unit test for [cast_signed::test_i64_cast_unsigned_neg_one] -/
-#assert (test_i64_cast_unsigned_neg_one == ok ())
+#assert ((test_i64_cast_unsigned_neg_one ).is_ok ())
 
 /-- [cast_signed::test_u128_cast_signed_all_ones]:
     Source: 'tests/src/cast_signed.rs', lines 97:0-101:1
@@ -133,7 +133,7 @@ def test_u128_cast_signed_all_ones : Result Unit := do
   massert (y = (-1)#i128)
 
 /- Unit test for [cast_signed::test_u128_cast_signed_all_ones] -/
-#assert (test_u128_cast_signed_all_ones == ok ())
+#assert ((test_u128_cast_signed_all_ones ).is_ok ())
 
 /-- [cast_signed::test_i128_cast_unsigned_neg_one]:
     Source: 'tests/src/cast_signed.rs', lines 105:0-109:1
@@ -143,7 +143,7 @@ def test_i128_cast_unsigned_neg_one : Result Unit := do
   massert (y = core.num.U128.MAX)
 
 /- Unit test for [cast_signed::test_i128_cast_unsigned_neg_one] -/
-#assert (test_i128_cast_unsigned_neg_one == ok ())
+#assert ((test_i128_cast_unsigned_neg_one ).is_ok ())
 
 /-- [cast_signed::test_usize_cast_roundtrip]:
     Source: 'tests/src/cast_signed.rs', lines 113:0-117:1
@@ -154,7 +154,7 @@ def test_usize_cast_roundtrip : Result Unit := do
   massert (y = 12345#usize)
 
 /- Unit test for [cast_signed::test_usize_cast_roundtrip] -/
-#assert (test_usize_cast_roundtrip == ok ())
+#assert ((test_usize_cast_roundtrip ).is_ok ())
 
 /-- [cast_signed::test_isize_cast_unsigned_neg_one]:
     Source: 'tests/src/cast_signed.rs', lines 121:0-125:1
@@ -164,6 +164,6 @@ def test_isize_cast_unsigned_neg_one : Result Unit := do
   massert (y = core.num.Usize.MAX)
 
 /- Unit test for [cast_signed::test_isize_cast_unsigned_neg_one] -/
-#assert (test_isize_cast_unsigned_neg_one == ok ())
+#assert ((test_isize_cast_unsigned_neg_one ).is_ok ())
 
 end cast_signed
diff --git a/tests/lean/ChunksExact.lean b/tests/lean/ChunksExact.lean
index 4e6dab516..9300fe2a1 100644
--- a/tests/lean/ChunksExact.lean
+++ b/tests/lean/ChunksExact.lean
@@ -46,7 +46,7 @@ def test_chunks_exact_exact_fit : Result Unit := do
   massert (i6 = 0#usize)
 
 /- Unit test for [chunks_exact::test_chunks_exact_exact_fit] -/
-#assert (test_chunks_exact_exact_fit == ok ())
+#assert ((test_chunks_exact_exact_fit ).is_ok ())
 
 /-- [chunks_exact::test_chunks_exact_with_remainder]:
     Source: 'tests/src/chunks_exact.rs', lines 26:0-41:1
@@ -82,7 +82,7 @@ def test_chunks_exact_with_remainder : Result Unit := do
   massert (i7 = 7#u32)
 
 /- Unit test for [chunks_exact::test_chunks_exact_with_remainder] -/
-#assert (test_chunks_exact_with_remainder == ok ())
+#assert ((test_chunks_exact_with_remainder ).is_ok ())
 
 /-- [chunks_exact::test_chunks_exact_remainder_2]:
     Source: 'tests/src/chunks_exact.rs', lines 45:0-57:1
@@ -112,7 +112,7 @@ def test_chunks_exact_remainder_2 : Result Unit := do
   massert (i5 = 50#u32)
 
 /- Unit test for [chunks_exact::test_chunks_exact_remainder_2] -/
-#assert (test_chunks_exact_remainder_2 == ok ())
+#assert ((test_chunks_exact_remainder_2 ).is_ok ())
 
 /-- [chunks_exact::test_chunks_exact_size_1]:
     Source: 'tests/src/chunks_exact.rs', lines 61:0-73:1
@@ -141,7 +141,7 @@ def test_chunks_exact_size_1 : Result Unit := do
   massert (i3 = 0#usize)
 
 /- Unit test for [chunks_exact::test_chunks_exact_size_1] -/
-#assert (test_chunks_exact_size_1 == ok ())
+#assert ((test_chunks_exact_size_1 ).is_ok ())
 
 /-- [chunks_exact::test_chunks_exact_empty]:
     Source: 'tests/src/chunks_exact.rs', lines 77:0-83:1
@@ -157,7 +157,7 @@ def test_chunks_exact_empty : Result Unit := do
   massert (i = 0#usize)
 
 /- Unit test for [chunks_exact::test_chunks_exact_empty] -/
-#assert (test_chunks_exact_empty == ok ())
+#assert ((test_chunks_exact_empty ).is_ok ())
 
 /-- [chunks_exact::test_chunks_exact_chunk_larger_than_slice]:
     Source: 'tests/src/chunks_exact.rs', lines 87:0-95:1
@@ -177,7 +177,7 @@ def test_chunks_exact_chunk_larger_than_slice : Result Unit := do
   massert (i2 = 2#u32)
 
 /- Unit test for [chunks_exact::test_chunks_exact_chunk_larger_than_slice] -/
-#assert (test_chunks_exact_chunk_larger_than_slice == ok ())
+#assert ((test_chunks_exact_chunk_larger_than_slice ).is_ok ())
 
 /-- [chunks_exact::test_chunks_exact_chunk_equals_slice]:
     Source: 'tests/src/chunks_exact.rs', lines 99:0-109:1
@@ -201,7 +201,7 @@ def test_chunks_exact_chunk_equals_slice : Result Unit := do
   massert (i3 = 0#usize)
 
 /- Unit test for [chunks_exact::test_chunks_exact_chunk_equals_slice] -/
-#assert (test_chunks_exact_chunk_equals_slice == ok ())
+#assert ((test_chunks_exact_chunk_equals_slice ).is_ok ())
 
 /-- [chunks_exact::test_chunks_exact_2_odd]:
     Source: 'tests/src/chunks_exact.rs', lines 113:0-126:1
@@ -233,7 +233,7 @@ def test_chunks_exact_2_odd : Result Unit := do
   massert (i5 = 5#u32)
 
 /- Unit test for [chunks_exact::test_chunks_exact_2_odd] -/
-#assert (test_chunks_exact_2_odd == ok ())
+#assert ((test_chunks_exact_2_odd ).is_ok ())
 
 /-- [chunks_exact::test_chunks_exact_2_single_element]:
     Source: 'tests/src/chunks_exact.rs', lines 130:0-137:1
@@ -251,6 +251,6 @@ def test_chunks_exact_2_single_element : Result Unit := do
   massert (i1 = 42#u32)
 
 /- Unit test for [chunks_exact::test_chunks_exact_2_single_element] -/
-#assert (test_chunks_exact_2_single_element == ok ())
+#assert ((test_chunks_exact_2_single_element ).is_ok ())
 
 end chunks_exact
diff --git a/tests/lean/IterAdapters.lean b/tests/lean/IterAdapters.lean
index 3f0dfafa8..7cf077d71 100644
--- a/tests/lean/IterAdapters.lean
+++ b/tests/lean/IterAdapters.lean
@@ -47,7 +47,7 @@ def test_enumerate_slice : Result Unit := do
   massert b
 
 /- Unit test for [iter_adapters::test_enumerate_slice] -/
-#assert (test_enumerate_slice == ok ())
+#assert ((test_enumerate_slice ).is_ok ())
 
 /-- [iter_adapters::test_enumerate_empty]:
     Source: 'tests/src/iter_adapters.rs', lines 28:0-32:1
@@ -63,7 +63,7 @@ def test_enumerate_empty : Result Unit := do
   massert b
 
 /- Unit test for [iter_adapters::test_enumerate_empty] -/
-#assert (test_enumerate_empty == ok ())
+#assert ((test_enumerate_empty ).is_ok ())
 
 /-- [iter_adapters::test_take_2]:
     Source: 'tests/src/iter_adapters.rs', lines 40:0-46:1
@@ -91,7 +91,7 @@ def test_take_2 : Result Unit := do
   massert b
 
 /- Unit test for [iter_adapters::test_take_2] -/
-#assert (test_take_2 == ok ())
+#assert ((test_take_2 ).is_ok ())
 
 /-- [iter_adapters::test_take_0]:
     Source: 'tests/src/iter_adapters.rs', lines 50:0-54:1
@@ -108,7 +108,7 @@ def test_take_0 : Result Unit := do
   massert b
 
 /- Unit test for [iter_adapters::test_take_0] -/
-#assert (test_take_0 == ok ())
+#assert ((test_take_0 ).is_ok ())
 
 /-- [iter_adapters::test_take_more_than_available]:
     Source: 'tests/src/iter_adapters.rs', lines 58:0-65:1
@@ -139,7 +139,7 @@ def test_take_more_than_available : Result Unit := do
   massert b
 
 /- Unit test for [iter_adapters::test_take_more_than_available] -/
-#assert (test_take_more_than_available == ok ())
+#assert ((test_take_more_than_available ).is_ok ())
 
 /-- [iter_adapters::test_range_u8]: loop body 0:
     Source: 'tests/src/iter_adapters.rs', lines 75:4-77:5
@@ -174,7 +174,7 @@ def test_range_u8 : Result Unit := do
   massert (count = 5#u32)
 
 /- Unit test for [iter_adapters::test_range_u8] -/
-#assert (test_range_u8 == ok ())
+#assert ((test_range_u8 ).is_ok ())
 
 /-- [iter_adapters::test_range_u16]: loop body 0:
     Source: 'tests/src/iter_adapters.rs', lines 85:4-87:5
@@ -211,7 +211,7 @@ def test_range_u16 : Result Unit := do
   massert (count = 4#u32)
 
 /- Unit test for [iter_adapters::test_range_u16] -/
-#assert (test_range_u16 == ok ())
+#assert ((test_range_u16 ).is_ok ())
 
 /-- [iter_adapters::test_range_u32]: loop body 0:
     Source: 'tests/src/iter_adapters.rs', lines 95:4-97:5
@@ -248,7 +248,7 @@ def test_range_u32 : Result Unit := do
   massert (count = 3#u32)
 
 /- Unit test for [iter_adapters::test_range_u32] -/
-#assert (test_range_u32 == ok ())
+#assert ((test_range_u32 ).is_ok ())
 
 /-- [iter_adapters::test_range_u64]: loop body 0:
     Source: 'tests/src/iter_adapters.rs', lines 105:4-107:5
@@ -285,7 +285,7 @@ def test_range_u64 : Result Unit := do
   massert (count = 4#u64)
 
 /- Unit test for [iter_adapters::test_range_u64] -/
-#assert (test_range_u64 == ok ())
+#assert ((test_range_u64 ).is_ok ())
 
 /-- [iter_adapters::test_range_usize]: loop body 0:
     Source: 'tests/src/iter_adapters.rs', lines 115:4-117:5
@@ -324,7 +324,7 @@ def test_range_usize : Result Unit := do
   massert (count = 5#usize)
 
 /- Unit test for [iter_adapters::test_range_usize] -/
-#assert (test_range_usize == ok ())
+#assert ((test_range_usize ).is_ok ())
 
 /-- [iter_adapters::test_range_empty]: loop body 0:
     Source: 'tests/src/iter_adapters.rs', lines 125:4-127:5
@@ -359,7 +359,7 @@ def test_range_empty : Result Unit := do
   massert (count = 0#u32)
 
 /- Unit test for [iter_adapters::test_range_empty] -/
-#assert (test_range_empty == ok ())
+#assert ((test_range_empty ).is_ok ())
 
 /-- [iter_adapters::test_array_into_iter]:
     Source: 'tests/src/iter_adapters.rs', lines 137:0-144:1
@@ -382,7 +382,7 @@ def test_array_into_iter : Result Unit := do
   massert b
 
 /- Unit test for [iter_adapters::test_array_into_iter] -/
-#assert (test_array_into_iter == ok ())
+#assert ((test_array_into_iter ).is_ok ())
 
 /-- [iter_adapters::test_slice_into_iter]:
     Source: 'tests/src/iter_adapters.rs', lines 148:0-157:1
@@ -408,7 +408,7 @@ def test_slice_into_iter : Result Unit := do
   massert b
 
 /- Unit test for [iter_adapters::test_slice_into_iter] -/
-#assert (test_slice_into_iter == ok ())
+#assert ((test_slice_into_iter ).is_ok ())
 
 /-- [iter_adapters::test_enumerate_step_by]:
     Source: 'tests/src/iter_adapters.rs', lines 165:0-172:1
@@ -438,7 +438,7 @@ def test_enumerate_step_by : Result Unit := do
   massert (x1 = 30#u32)
 
 /- Unit test for [iter_adapters::test_enumerate_step_by] -/
-#assert (test_enumerate_step_by == ok ())
+#assert ((test_enumerate_step_by ).is_ok ())
 
 /-- [iter_adapters::test_enumerate_take]:
     Source: 'tests/src/iter_adapters.rs', lines 176:0-184:1
@@ -474,7 +474,7 @@ def test_enumerate_take : Result Unit := do
   massert b
 
 /- Unit test for [iter_adapters::test_enumerate_take] -/
-#assert (test_enumerate_take == ok ())
+#assert ((test_enumerate_take ).is_ok ())
 
 /-- [iter_adapters::test_take_exhausted_then_next]:
     Source: 'tests/src/iter_adapters.rs', lines 188:0-197:1
@@ -500,7 +500,7 @@ def test_take_exhausted_then_next : Result Unit := do
   massert b1
 
 /- Unit test for [iter_adapters::test_take_exhausted_then_next] -/
-#assert (test_take_exhausted_then_next == ok ())
+#assert ((test_take_exhausted_then_next ).is_ok ())
 
 /-- [iter_adapters::test_range_single_element]:
     Source: 'tests/src/iter_adapters.rs', lines 206:0-210:1
@@ -516,7 +516,7 @@ def test_range_single_element : Result Unit := do
   massert b
 
 /- Unit test for [iter_adapters::test_range_single_element] -/
-#assert (test_range_single_element == ok ())
+#assert ((test_range_single_element ).is_ok ())
 
 /-- [iter_adapters::test_range_u8_near_max]:
     Source: 'tests/src/iter_adapters.rs', lines 214:0-218:1
@@ -532,7 +532,7 @@ def test_range_u8_near_max : Result Unit := do
   massert b
 
 /- Unit test for [iter_adapters::test_range_u8_near_max] -/
-#assert (test_range_u8_near_max == ok ())
+#assert ((test_range_u8_near_max ).is_ok ())
 
 /-- [iter_adapters::test_range_u8_start_gt_end]:
     Source: 'tests/src/iter_adapters.rs', lines 222:0-225:1
@@ -545,7 +545,7 @@ def test_range_u8_start_gt_end : Result Unit := do
   massert b
 
 /- Unit test for [iter_adapters::test_range_u8_start_gt_end] -/
-#assert (test_range_u8_start_gt_end == ok ())
+#assert ((test_range_u8_start_gt_end ).is_ok ())
 
 /-- [iter_adapters::test_range_u8_start_eq_end]:
     Source: 'tests/src/iter_adapters.rs', lines 229:0-232:1
@@ -558,7 +558,7 @@ def test_range_u8_start_eq_end : Result Unit := do
   massert b
 
 /- Unit test for [iter_adapters::test_range_u8_start_eq_end] -/
-#assert (test_range_u8_start_eq_end == ok ())
+#assert ((test_range_u8_start_eq_end ).is_ok ())
 
 /-- [iter_adapters::test_range_u16_boundary]:
     Source: 'tests/src/iter_adapters.rs', lines 236:0-242:1
@@ -583,7 +583,7 @@ def test_range_u16_boundary : Result Unit := do
   massert b
 
 /- Unit test for [iter_adapters::test_range_u16_boundary] -/
-#assert (test_range_u16_boundary == ok ())
+#assert ((test_range_u16_boundary ).is_ok ())
 
 /-- [iter_adapters::test_range_u32_boundary]:
     Source: 'tests/src/iter_adapters.rs', lines 246:0-251:1
@@ -604,7 +604,7 @@ def test_range_u32_boundary : Result Unit := do
   massert b
 
 /- Unit test for [iter_adapters::test_range_u32_boundary] -/
-#assert (test_range_u32_boundary == ok ())
+#assert ((test_range_u32_boundary ).is_ok ())
 
 /-- [iter_adapters::test_range_u64_boundary]:
     Source: 'tests/src/iter_adapters.rs', lines 255:0-261:1
@@ -629,7 +629,7 @@ def test_range_u64_boundary : Result Unit := do
   massert b
 
 /- Unit test for [iter_adapters::test_range_u64_boundary] -/
-#assert (test_range_u64_boundary == ok ())
+#assert ((test_range_u64_boundary ).is_ok ())
 
 /-- [iter_adapters::test_range_usize_start_gt_end]:
     Source: 'tests/src/iter_adapters.rs', lines 265:0-268:1
@@ -642,7 +642,7 @@ def test_range_usize_start_gt_end : Result Unit := do
   massert b
 
 /- Unit test for [iter_adapters::test_range_usize_start_gt_end] -/
-#assert (test_range_usize_start_gt_end == ok ())
+#assert ((test_range_usize_start_gt_end ).is_ok ())
 
 /-- [iter_adapters::test_step_by_larger_than_range]:
     Source: 'tests/src/iter_adapters.rs', lines 272:0-276:1
@@ -663,7 +663,7 @@ def test_step_by_larger_than_range : Result Unit := do
   massert b
 
 /- Unit test for [iter_adapters::test_step_by_larger_than_range] -/
-#assert (test_step_by_larger_than_range == ok ())
+#assert ((test_step_by_larger_than_range ).is_ok ())
 
 /-- [iter_adapters::test_step_by_exact_range]:
     Source: 'tests/src/iter_adapters.rs', lines 280:0-284:1
@@ -684,7 +684,7 @@ def test_step_by_exact_range : Result Unit := do
   massert b
 
 /- Unit test for [iter_adapters::test_step_by_exact_range] -/
-#assert (test_step_by_exact_range == ok ())
+#assert ((test_step_by_exact_range ).is_ok ())
 
 /-- [iter_adapters::test_step_by_one]:
     Source: 'tests/src/iter_adapters.rs', lines 288:0-295:1
@@ -720,7 +720,7 @@ def test_step_by_one : Result Unit := do
   massert b
 
 /- Unit test for [iter_adapters::test_step_by_one] -/
-#assert (test_step_by_one == ok ())
+#assert ((test_step_by_one ).is_ok ())
 
 /-- [iter_adapters::test_step_by_empty]:
     Source: 'tests/src/iter_adapters.rs', lines 299:0-302:1
@@ -736,7 +736,7 @@ def test_step_by_empty : Result Unit := do
   massert b
 
 /- Unit test for [iter_adapters::test_step_by_empty] -/
-#assert (test_step_by_empty == ok ())
+#assert ((test_step_by_empty ).is_ok ())
 
 /-- [iter_adapters::test_step_by_odd_range]:
     Source: 'tests/src/iter_adapters.rs', lines 306:0-312:1
@@ -767,7 +767,7 @@ def test_step_by_odd_range : Result Unit := do
   massert b
 
 /- Unit test for [iter_adapters::test_step_by_odd_range] -/
-#assert (test_step_by_odd_range == ok ())
+#assert ((test_step_by_odd_range ).is_ok ())
 
 /-- [iter_adapters::test_step_by_u8_near_max]:
     Source: 'tests/src/iter_adapters.rs', lines 316:0-322:1
@@ -798,7 +798,7 @@ def test_step_by_u8_near_max : Result Unit := do
   massert b
 
 /- Unit test for [iter_adapters::test_step_by_u8_near_max] -/
-#assert (test_step_by_u8_near_max == ok ())
+#assert ((test_step_by_u8_near_max ).is_ok ())
 
 /-- [iter_adapters::test_range_inclusive_basic]:
     Source: 'tests/src/iter_adapters.rs', lines 330:0-336:1
@@ -827,7 +827,7 @@ def test_range_inclusive_basic : Result Unit := do
   massert b
 
 /- Unit test for [iter_adapters::test_range_inclusive_basic] -/
-#assert (test_range_inclusive_basic == ok ())
+#assert ((test_range_inclusive_basic ).is_ok ())
 
 /-- [iter_adapters::test_range_inclusive_singleton]:
     Source: 'tests/src/iter_adapters.rs', lines 340:0-344:1
@@ -846,7 +846,7 @@ def test_range_inclusive_singleton : Result Unit := do
   massert b
 
 /- Unit test for [iter_adapters::test_range_inclusive_singleton] -/
-#assert (test_range_inclusive_singleton == ok ())
+#assert ((test_range_inclusive_singleton ).is_ok ())
 
 /-- [iter_adapters::test_range_inclusive_empty]:
     Source: 'tests/src/iter_adapters.rs', lines 348:0-351:1
@@ -860,6 +860,6 @@ def test_range_inclusive_empty : Result Unit := do
   massert b
 
 /- Unit test for [iter_adapters::test_range_inclusive_empty] -/
-#assert (test_range_inclusive_empty == ok ())
+#assert ((test_range_inclusive_empty ).is_ok ())
 
 end iter_adapters
diff --git a/tests/lean/NoNestedBorrows.lean b/tests/lean/NoNestedBorrows.lean
index e2a706b74..82a85021e 100644
--- a/tests/lean/NoNestedBorrows.lean
+++ b/tests/lean/NoNestedBorrows.lean
@@ -91,7 +91,7 @@ def test2 : Result Unit := do
   ok ()
 
 /- Unit test for [no_nested_borrows::test2] -/
-#assert (test2 == ok ())
+#assert ((test2 ).is_ok ())
 
 /-- [no_nested_borrows::get_max]:
     Source: 'tests/src/no_nested_borrows.rs', lines 76:0-82:1
@@ -111,7 +111,7 @@ def test3 : Result Unit := do
   massert (z = 15#u32)
 
 /- Unit test for [no_nested_borrows::test3] -/
-#assert (test3 == ok ())
+#assert ((test3 ).is_ok ())
 
 /-- [no_nested_borrows::test_neg1]:
     Source: 'tests/src/no_nested_borrows.rs', lines 93:0-97:1
@@ -121,7 +121,7 @@ def test_neg1 : Result Unit := do
   massert (y = (-3)#i32)
 
 /- Unit test for [no_nested_borrows::test_neg1] -/
-#assert (test_neg1 == ok ())
+#assert ((test_neg1 ).is_ok ())
 
 /-- [no_nested_borrows::refs_test1]:
     Source: 'tests/src/no_nested_borrows.rs', lines 101:0-110:1
@@ -130,7 +130,7 @@ def refs_test1 : Result Unit := do
   massert (1#i32 = 1#i32)
 
 /- Unit test for [no_nested_borrows::refs_test1] -/
-#assert (refs_test1 == ok ())
+#assert ((refs_test1 ).is_ok ())
 
 /-- [no_nested_borrows::refs_test2]:
     Source: 'tests/src/no_nested_borrows.rs', lines 113:0-125:1
@@ -142,7 +142,7 @@ def refs_test2 : Result Unit := do
   massert (2#i32 = 2#i32)
 
 /- Unit test for [no_nested_borrows::refs_test2] -/
-#assert (refs_test2 == ok ())
+#assert ((refs_test2 ).is_ok ())
 
 /-- [no_nested_borrows::test_list1]:
     Source: 'tests/src/no_nested_borrows.rs', lines 130:0-132:1
@@ -151,7 +151,7 @@ def test_list1 : Result Unit := do
   ok ()
 
 /- Unit test for [no_nested_borrows::test_list1] -/
-#assert (test_list1 == ok ())
+#assert ((test_list1 ).is_ok ())
 
 /-- [no_nested_borrows::copy_int]:
     Source: 'tests/src/no_nested_borrows.rs', lines 134:0-136:1
@@ -185,7 +185,7 @@ def test_copy_int : Result Unit := do
   massert (0#i32 = y)
 
 /- Unit test for [no_nested_borrows::test_copy_int] -/
-#assert (test_copy_int == ok ())
+#assert ((test_copy_int ).is_ok ())
 
 /-- [no_nested_borrows::is_cons]:
     Source: 'tests/src/no_nested_borrows.rs', lines 170:0-175:1
@@ -203,7 +203,7 @@ def test_is_cons : Result Unit := do
   massert b
 
 /- Unit test for [no_nested_borrows::test_is_cons] -/
-#assert (test_is_cons == ok ())
+#assert ((test_is_cons ).is_ok ())
 
 /-- [no_nested_borrows::split_list]:
     Source: 'tests/src/no_nested_borrows.rs', lines 184:0-189:1
@@ -221,7 +221,7 @@ def test_split_list : Result Unit := do
   massert (hd = 0#i32)
 
 /- Unit test for [no_nested_borrows::test_split_list] -/
-#assert (test_split_list == ok ())
+#assert ((test_split_list ).is_ok ())
 
 /-- [no_nested_borrows::choose]:
     Source: 'tests/src/no_nested_borrows.rs', lines 200:0-206:1
@@ -246,7 +246,7 @@ def choose_test : Result Unit := do
   massert (y = 0#i32)
 
 /- Unit test for [no_nested_borrows::choose_test] -/
-#assert (choose_test == ok ())
+#assert ((choose_test ).is_ok ())
 
 /-- [no_nested_borrows::test_char]:
     Source: 'tests/src/no_nested_borrows.rs', lines 221:0-223:1
@@ -369,7 +369,7 @@ def test_list_functions : Result Unit := do
   massert (i6 = 2#i32)
 
 /- Unit test for [no_nested_borrows::test_list_functions] -/
-#assert (test_list_functions == ok ())
+#assert ((test_list_functions ).is_ok ())
 
 /-- [no_nested_borrows::id_mut_pair1]:
     Source: 'tests/src/no_nested_borrows.rs', lines 348:0-350:1
@@ -460,7 +460,7 @@ def test_constants : Result Unit := do
   massert (swp.p.x = 1#u32)
 
 /- Unit test for [no_nested_borrows::test_constants] -/
-#assert (test_constants == ok ())
+#assert ((test_constants ).is_ok ())
 
 /-- [no_nested_borrows::test_weird_borrows1]:
     Source: 'tests/src/no_nested_borrows.rs', lines 407:0-415:1
@@ -469,7 +469,7 @@ def test_weird_borrows1 : Result Unit := do
   ok ()
 
 /- Unit test for [no_nested_borrows::test_weird_borrows1] -/
-#assert (test_weird_borrows1 == ok ())
+#assert ((test_weird_borrows1 ).is_ok ())
 
 /-- [no_nested_borrows::test_mem_replace]:
     Source: 'tests/src/no_nested_borrows.rs', lines 417:0-421:1
diff --git a/tests/lean/Paper.lean b/tests/lean/Paper.lean
index 0f0142377..9bedd0a46 100644
--- a/tests/lean/Paper.lean
+++ b/tests/lean/Paper.lean
@@ -28,7 +28,7 @@ def test_incr : Result Unit := do
   massert (x = 1#i32)
 
 /- Unit test for [paper::test_incr] -/
-#assert (test_incr == ok ())
+#assert ((test_incr ).is_ok ())
 
 /-- [paper::choose]:
     Source: 'tests/src/paper.rs', lines 19:0-25:1
@@ -53,7 +53,7 @@ def test_choose : Result Unit := do
   massert (y = 0#i32)
 
 /- Unit test for [paper::test_choose] -/
-#assert (test_choose == ok ())
+#assert ((test_choose ).is_ok ())
 
 /-- [paper::List]
     Source: 'tests/src/paper.rs', lines 40:0-43:1
@@ -105,7 +105,7 @@ def test_nth : Result Unit := do
   massert (i = 7#i32)
 
 /- Unit test for [paper::test_nth] -/
-#assert (test_nth == ok ())
+#assert ((test_nth ).is_ok ())
 
 /-- [paper::call_choose]:
     Source: 'tests/src/paper.rs', lines 82:0-88:1
diff --git a/tests/lean/Scalars.lean b/tests/lean/Scalars.lean
index b08de12b1..e5b08c740 100644
--- a/tests/lean/Scalars.lean
+++ b/tests/lean/Scalars.lean
@@ -187,7 +187,7 @@ def test_is_multiple_of_true : Result Unit := do
   massert b
 
 /- Unit test for [scalars::test_is_multiple_of_true] -/
-#assert (test_is_multiple_of_true == ok ())
+#assert ((test_is_multiple_of_true ).is_ok ())
 
 /-- [scalars::test_is_multiple_of_false]:
     Source: 'tests/src/scalars.rs', lines 142:0-144:1
@@ -197,7 +197,7 @@ def test_is_multiple_of_false : Result Unit := do
   massert (¬ b)
 
 /- Unit test for [scalars::test_is_multiple_of_false] -/
-#assert (test_is_multiple_of_false == ok ())
+#assert ((test_is_multiple_of_false ).is_ok ())
 
 /-- [scalars::test_is_multiple_of_zero_divisor]:
     Source: 'tests/src/scalars.rs', lines 147:0-151:1
@@ -209,7 +209,7 @@ def test_is_multiple_of_zero_divisor : Result Unit := do
   massert (¬ b1)
 
 /- Unit test for [scalars::test_is_multiple_of_zero_divisor] -/
-#assert (test_is_multiple_of_zero_divisor == ok ())
+#assert ((test_is_multiple_of_zero_divisor ).is_ok ())
 
 /-- [scalars::test_try_from_usize_u32_ok]:
     Source: 'tests/src/scalars.rs', lines 158:0-160:1
@@ -221,7 +221,7 @@ def test_try_from_usize_u32_ok : Result Unit := do
   massert b
 
 /- Unit test for [scalars::test_try_from_usize_u32_ok] -/
-#assert (test_try_from_usize_u32_ok == ok ())
+#assert ((test_try_from_usize_u32_ok ).is_ok ())
 
 /-- [scalars::checked_div]:
     Source: 'tests/src/scalars.rs', lines 166:0-171:1 -/
@@ -257,7 +257,7 @@ def test_question_mark_ok : Result Unit := do
   massert (i = 6#u32)
 
 /- Unit test for [scalars::test_question_mark_ok] -/
-#assert (test_question_mark_ok == ok ())
+#assert ((test_question_mark_ok ).is_ok ())
 
 /-- [scalars::test_question_mark_err]:
     Source: 'tests/src/scalars.rs', lines 186:0-189:1
@@ -268,6 +268,6 @@ def test_question_mark_err : Result Unit := do
   massert (¬ b)
 
 /- Unit test for [scalars::test_question_mark_err] -/
-#assert (test_question_mark_err == ok ())
+#assert ((test_question_mark_err ).is_ok ())
 
 end scalars
diff --git a/tests/lean/SpecTests/Coin.lean b/tests/lean/SpecTests/Coin.lean
index 32eb7e604..c2a3143f7 100644
--- a/tests/lean/SpecTests/Coin.lean
+++ b/tests/lean/SpecTests/Coin.lean
@@ -45,7 +45,7 @@ theorem coinSpec_bind {α β} {k : α -> ITreeC β} {Pₖ : Post β} {m : ITreeC
     (fun t => ∃ (m : ITreeC α) (k : _), t = ITree.bind m k ∧ coinSpec Pₘ m ∧ qimp_coinSpec Pₘ k Pₖ)
     ?_ _ ?_
   · clear k Hk
-    simp only
+    -- simp only
     rintro i ⟨m, k, rfl, cm, ck⟩
     cases cm with
     | ret a Pₘa =>
@@ -74,14 +74,15 @@ theorem coinSpec_bind {α β} {k : α -> ITreeC β} {Pₖ : Post β} {m : ITreeC
       simp
       right
       grind
-  · simp only
+  · --simp only
     exists m, k
 
 instance : MonadLift Result ITreeC where
-  monadLift r := match r with
-    | .fail _e => .div -- TODO
-    | .div => .div
-    | .ok x => .ret x
+  monadLift r :=
+    r.match_dep
+      (fun a => .ret a)
+      (fun _e => .div) -- TODO
+      (fun _ => .div)
 
 theorem spec_coinSpec {α} {x : Result α} {p: Post α} : spec x p → coinSpec p x := by
   intros s
diff --git a/tests/lean/StepBy.lean b/tests/lean/StepBy.lean
index 35097ffec..3be87b954 100644
--- a/tests/lean/StepBy.lean
+++ b/tests/lean/StepBy.lean
@@ -55,7 +55,7 @@ def test_step_by_1 : Result Unit := do
   massert b
 
 /- Unit test for [step_by::test_step_by_1] -/
-#assert (test_step_by_1 == ok ())
+#assert ((test_step_by_1 ).is_ok ())
 
 /-- [step_by::test_step_by_2]:
     Source: 'tests/src/step_by.rs', lines 21:0-28:1
@@ -88,7 +88,7 @@ def test_step_by_2 : Result Unit := do
   massert b
 
 /- Unit test for [step_by::test_step_by_2] -/
-#assert (test_step_by_2 == ok ())
+#assert ((test_step_by_2 ).is_ok ())
 
 /-- [step_by::test_step_by_3]:
     Source: 'tests/src/step_by.rs', lines 32:0-39:1
@@ -121,7 +121,7 @@ def test_step_by_3 : Result Unit := do
   massert b
 
 /- Unit test for [step_by::test_step_by_3] -/
-#assert (test_step_by_3 == ok ())
+#assert ((test_step_by_3 ).is_ok ())
 
 /-- [step_by::test_step_by_larger_than_len]:
     Source: 'tests/src/step_by.rs', lines 43:0-48:1
@@ -142,7 +142,7 @@ def test_step_by_larger_than_len : Result Unit := do
   massert b
 
 /- Unit test for [step_by::test_step_by_larger_than_len] -/
-#assert (test_step_by_larger_than_len == ok ())
+#assert ((test_step_by_larger_than_len ).is_ok ())
 
 /-- [step_by::test_step_by_empty]:
     Source: 'tests/src/step_by.rs', lines 52:0-56:1
@@ -158,7 +158,7 @@ def test_step_by_empty : Result Unit := do
   massert b
 
 /- Unit test for [step_by::test_step_by_empty] -/
-#assert (test_step_by_empty == ok ())
+#assert ((test_step_by_empty ).is_ok ())
 
 /-- [step_by::test_step_by_single]:
     Source: 'tests/src/step_by.rs', lines 60:0-65:1
@@ -179,7 +179,7 @@ def test_step_by_single : Result Unit := do
   massert b
 
 /- Unit test for [step_by::test_step_by_single] -/
-#assert (test_step_by_single == ok ())
+#assert ((test_step_by_single ).is_ok ())
 
 /-- [step_by::test_step_by_single_step_2]:
     Source: 'tests/src/step_by.rs', lines 69:0-74:1
@@ -200,7 +200,7 @@ def test_step_by_single_step_2 : Result Unit := do
   massert b
 
 /- Unit test for [step_by::test_step_by_single_step_2] -/
-#assert (test_step_by_single_step_2 == ok ())
+#assert ((test_step_by_single_step_2 ).is_ok ())
 
 /-- [step_by::test_step_by_eq_len]:
     Source: 'tests/src/step_by.rs', lines 78:0-83:1
@@ -221,7 +221,7 @@ def test_step_by_eq_len : Result Unit := do
   massert b
 
 /- Unit test for [step_by::test_step_by_eq_len] -/
-#assert (test_step_by_eq_len == ok ())
+#assert ((test_step_by_eq_len ).is_ok ())
 
 /-- [step_by::test_step_by_len_minus_1]:
     Source: 'tests/src/step_by.rs', lines 87:0-93:1
@@ -247,7 +247,7 @@ def test_step_by_len_minus_1 : Result Unit := do
   massert b
 
 /- Unit test for [step_by::test_step_by_len_minus_1] -/
-#assert (test_step_by_len_minus_1 == ok ())
+#assert ((test_step_by_len_minus_1 ).is_ok ())
 
 /-- [step_by::test_step_by_two_elements]:
     Source: 'tests/src/step_by.rs', lines 97:0-102:1
@@ -268,7 +268,7 @@ def test_step_by_two_elements : Result Unit := do
   massert b
 
 /- Unit test for [step_by::test_step_by_two_elements] -/
-#assert (test_step_by_two_elements == ok ())
+#assert ((test_step_by_two_elements ).is_ok ())
 
 /-- [step_by::test_step_by_4_on_longer]:
     Source: 'tests/src/step_by.rs', lines 106:0-113:1
@@ -304,6 +304,6 @@ def test_step_by_4_on_longer : Result Unit := do
   massert b
 
 /- Unit test for [step_by::test_step_by_4_on_longer] -/
-#assert (test_step_by_4_on_longer == ok ())
+#assert ((test_step_by_4_on_longer ).is_ok ())
 
 end step_by

From f7c00b03031f9f5d9cb496614978bff5c69b241c Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Fri, 17 Jul 2026 09:58:10 -0400
Subject: [PATCH 57/67] fixed all errors from ITree migration

---
 tests/lean/BaseTutorial.lean              | 12 -----
 tests/lean/Hashmap/Properties.lean        |  7 +--
 tests/lean/SpecTests/Coin.lean            | 32 ++++++-------
 tests/lean/SpecTests/ConcurrencyTest.lean | 54 ----------------------
 tests/lean/SpecTests/NonDet.lean          | 55 -----------------------
 tests/lean/SpecTests/SimpleState.lean     | 39 ----------------
 6 files changed, 20 insertions(+), 179 deletions(-)
 delete mode 100644 tests/lean/SpecTests/ConcurrencyTest.lean
 delete mode 100644 tests/lean/SpecTests/NonDet.lean
 delete mode 100644 tests/lean/SpecTests/SimpleState.lean

diff --git a/tests/lean/BaseTutorial.lean b/tests/lean/BaseTutorial.lean
index 52a9947fe..b7397542c 100644
--- a/tests/lean/BaseTutorial.lean
+++ b/tests/lean/BaseTutorial.lean
@@ -68,18 +68,6 @@ def mul2_add1 (x : U32) : Result U32 := do
  -/
 #print Aeneas.Std.bind
 
-/- We show a desugared version of [mul2_add1] below: we remove the syntactic
-   sugar, and inline the definition of [bind] to make the matches over the
-   results explicit.
- -/
-def mul2_add1_desugared (x : U32) : Result U32 :=
-  match UScalar.add x x with
-  | ok x1 => -- Success case
-    match UScalar.add x1 (U32.ofNat 1) with
-    | ok x2 => ok x2
-    | error => error
-  | error => error -- Propagating the errors
-
 /- Now that we have seen how [mul2_add1] is defined precisely, we can prove
    simple properties about it. For instance, what about proving that it evaluates
    to [2 * x + 1]?
diff --git a/tests/lean/Hashmap/Properties.lean b/tests/lean/Hashmap/Properties.lean
index c63c42845..c0cb4d0d5 100644
--- a/tests/lean/Hashmap/Properties.lean
+++ b/tests/lean/Hashmap/Properties.lean
@@ -29,9 +29,10 @@ namespace HashMap
 def distinct_keys (ls : List (Usize × α)) := ls.pairwise_rel (λ x y => x.fst ≠ y.fst)
 
 def hash_mod_key (k : Usize) (l : Nat) : Nat :=
-  match hash_key k with
-  | .ok k => k.val % l
-  | _ => 0
+  (hash_key k).match_dep
+    (fun k => k.val % l)
+    (fun _ => 0)
+    (fun _ => 0)
 
 @[simp, scalar_tac_simps, grind =, agrind =]
 theorem hash_mod_key_eq : hash_mod_key k l = k.val % l := by
diff --git a/tests/lean/SpecTests/Coin.lean b/tests/lean/SpecTests/Coin.lean
index c2a3143f7..e63d5b64a 100644
--- a/tests/lean/SpecTests/Coin.lean
+++ b/tests/lean/SpecTests/Coin.lean
@@ -88,10 +88,10 @@ theorem spec_coinSpec {α} {x : Result α} {p: Post α} : spec x p → coinSpec
   intros s
   cases x
   · apply coinSpec.ret
+    simp [spec_ok] at s
     assumption
-  · contradiction
-  · contradiction
-#check spec_coinSpec
+  · simp at s
+  · simp at s
 
 @[simp]
 theorem qimp_coinSpec_unit {α} (P : Unit → Prop) (k : Unit → ITreeC α) (Q : α → Prop) :
@@ -126,7 +126,7 @@ theorem coinSpec_ret {α p} (x : α) : coinSpec p (ITree.ret x) ↔ p x := by
     apply coinSpec.ret
     assumption
 
-#register_spec_statement {
+#register_spec_info {
     spec_name := ``coinSpec
     arity := 3
     program_index := 2
@@ -171,15 +171,15 @@ theorem coinSpec_ret {α p} (x : α) : coinSpec p (ITree.ret x) ↔ p x := by
   #check I32.add_spec
   -- set_option trace.Step true
 
-  theorem test : coinSpec (fun z => z.val == 6)
-    (do let x ← 1#i32 + 2#i32
-        let y ← x + x
-        ITree.vis () fun (b : Bool) =>
-        if b then ITree.ret y else ITree.ret 6#i32)  := by
-    step
-    step
-    apply coinSpec.vis
-    intros b
-    cases b
-    · simp [*]
-    · simp [*]
+  -- theorem test : coinSpec (fun z => z.val == 6)
+  --   (do let x ← 1#i32 + 2#i32
+  --       let y ← x + x
+  --       ITree.vis () fun (b : Bool) =>
+  --       if b then ITree.ret y else ITree.ret 6#i32)  := by
+  --   step
+  --   step
+  --   apply coinSpec.vis
+  --   intros b
+  --   cases b
+  --   · simp [*]
+  --   · simp [*]
diff --git a/tests/lean/SpecTests/ConcurrencyTest.lean b/tests/lean/SpecTests/ConcurrencyTest.lean
deleted file mode 100644
index 24cb6347b..000000000
--- a/tests/lean/SpecTests/ConcurrencyTest.lean
+++ /dev/null
@@ -1,54 +0,0 @@
-import Aeneas.Std.Primitives
-import Aeneas.Std.Delab
-import Std.Do
-import Aeneas.Std.Spec
-import Aeneas.Std.WP
-import Aeneas.Data.Coinductive.ITree
-import Aeneas.Data.Coinductive.Effect
-import Aeneas.Std
-import Std
-import Aeneas.Tactic.Step
-import Aeneas
-
-open Aeneas
-open Std Result WP Data Coinductive Effect Lean.Order
-
-def State := Nat
-
-inductive CEffect.I where
-| set : State → CEffect.I
-| get : CEffect.I
-| fork : CEffect.I
--- there is an issue that both threads have to return the return type.
--- maybe this is fine, and you can just bind an operation that returns Unit?
--- i could make a generalized ITree definition which allows you to do stuff to the return type in Effect?
-
-def CEffect.O (i : CEffect.I) : Type :=
-  match i with
-  | .set _n => Unit
-  | .get => State
-  | .fork => Bool
-
-def CEffect : Effect := {
-  I := CEffect.I
-  O := CEffect.O
-}
-
-def ITreeS : Type → Type := ITree CEffect
-
--- can just use coinductive props!
-coinductive sspec {α} (p : Post α) : (s : State → Prop) → (x : ITreeS α) → Prop where
-| ret : ∀ x s, p x → sspec p s (ITree.ret x)
-| set : ∀ k s n, s n → sspec p s k → sspec p s (ITree.vis (.set n) (fun _ => k))
-| get : ∀ k s, (∀ n, s n → sspec p s (k n)) → sspec p s (ITree.vis .get k)
-| fork : ∀ k s, sspec p s (k true) → sspec p s (k false) → sspec p s (ITree.vis .fork k)
-
--- coinductive possible {α} : (T : Type) → State → (T → ITreeS α) → State → α → Prop where
--- | ret : ∀ T x s t pool, pool t = .ret x → possible T s pool s x
--- | fork : ∀ T pool s1 s2 a,
---   possible (Option T) s1 (fun x => match x with | .some x => _ | .none => _) s2 a
---   → possible T s1 pool s2 a
-
-def par {R} (t1 t2 : ITreeS R) : ITreeS R :=
-  match t1, t2 with
-  | x, y => _
diff --git a/tests/lean/SpecTests/NonDet.lean b/tests/lean/SpecTests/NonDet.lean
deleted file mode 100644
index e98eafa17..000000000
--- a/tests/lean/SpecTests/NonDet.lean
+++ /dev/null
@@ -1,55 +0,0 @@
-import Aeneas.Std.Primitives
-import Aeneas.Std.Delab
-import Std.Do
-import Aeneas.Std.Spec
-import Aeneas.Std.WP
-import Aeneas.Data.Coinductive.ITree
-import Aeneas.Data.Coinductive.Effect
-import Aeneas.Std
-import Std
-import Aeneas.Tactic.Step
-import Aeneas
-
-open Aeneas
-open Std Result WP Data Coinductive Effect Lean.Order
-
-def State := Nat
-
-inductive CEffect.I where
-| set : State → CEffect.I
-| get : CEffect.I
-| choose : CEffect.I
--- there is an issue that both threads have to return the return type.
--- maybe this is fine, and you can just bind an operation that returns Unit?
--- i could make a generalized ITree definition which allows you to do stuff to the return type in Effect?
-
-def CEffect.O (i : CEffect.I) : Type :=
-  match i with
-  | .set _n => Unit
-  | .get => State
-  | .choose => Bool
-
-def CEffect : Effect := {
-  I := CEffect.I
-  O := CEffect.O
-}
-
-def ITreeS : Type → Type := ITree CEffect
-
--- can just use coinductive props!
-coinductive sspec {α} (p : Post α) : (s : State → Prop) → (x : ITreeS α) → Prop where
-| ret : ∀ x s, p x → sspec p s (ITree.ret x)
-| set : ∀ k s n, s n → sspec p s k → sspec p s (ITree.vis (.set n) (fun _ => k))
-| get : ∀ k s, (∀ n, s n → sspec p s (k n)) → sspec p s (ITree.vis .get k)
-| fork : ∀ k s, sspec p s (k true) → sspec p s (k false) → sspec p s (ITree.vis .choose k)
-
--- coinductive possible {α} : (T : Type) → State → (T → ITreeS α) → State → α → Prop where
--- | ret : ∀ T x s t pool, pool t = .ret x → possible T s pool s x
--- | fork : ∀ T pool s1 s2 a,
---   possible (Option T) s1 (fun x => match x with | .some x => _ | .none => _) s2 a
---   → possible T s1 pool s2 a
-
--- def choice {R : Type} (a b : ITreeS R) : ITreeS R := .vis .choose (fun b => if b then a else b)
-
--- def par {R} (t1 t2 : ITreeS R) : ITreeS R :=
-  -- ITree.cases _ _ _ t1
diff --git a/tests/lean/SpecTests/SimpleState.lean b/tests/lean/SpecTests/SimpleState.lean
deleted file mode 100644
index f07a27796..000000000
--- a/tests/lean/SpecTests/SimpleState.lean
+++ /dev/null
@@ -1,39 +0,0 @@
-import Aeneas.Std.Primitives
-import Aeneas.Std.Delab
-import Std.Do
-import Aeneas.Std.Spec
-import Aeneas.Std.WP
-import Aeneas.Data.Coinductive.ITree
-import Aeneas.Data.Coinductive.Effect
-import Aeneas.Std
-import Std
-import Aeneas.Tactic.Step
-import Aeneas
-
-open Aeneas
-open Std Result WP Data Coinductive Effect Lean.Order
-
-def State := Nat
-
-inductive SEffect.I where
-| set : State → SEffect.I
-| get : SEffect.I
-
-def SEffect.O (i : SEffect.I) : Type :=
-  match i with
-  | .set _n => Unit
-  | .get => State
-
-def SEffect : Effect := {
-   I := SEffect.I
-   O := SEffect.O
-}
-
-def ITreeS : Type → Type := ITree SEffect
-
--- can just use coinductive props!
-coinductive sspec {α} (p : Post α) : (s : State → Prop) → (x : ITreeS α) → Prop where
-| ret : ∀ x s, p x → sspec p s (ITree.ret x)
-| set : ∀ k s n, s n → sspec p s k → sspec p s (ITree.vis (.set n) (fun _ => k))
-| get : ∀ k s, (∀ n, s n → sspec p s (k n)) → sspec p s (ITree.vis .get k)
--- | vis : ∀ k, (∀ b, coinSpec p (k b)) → coinSpec p (ITree.vis () k)

From c1a707b8b87a174fc741bbe7692bd8d7d900d8c4 Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Fri, 17 Jul 2026 10:22:19 -0400
Subject: [PATCH 58/67] cleaned up some definitions

---
 backends/lean/Aeneas/Std/Primitives.lean      | 174 +-----------------
 .../lean/Aeneas/Std/PrimitivesLemmas.lean     |   2 +-
 2 files changed, 11 insertions(+), 165 deletions(-)

diff --git a/backends/lean/Aeneas/Std/Primitives.lean b/backends/lean/Aeneas/Std/Primitives.lean
index 6f79a6179..48b17146a 100644
--- a/backends/lean/Aeneas/Std/Primitives.lean
+++ b/backends/lean/Aeneas/Std/Primitives.lean
@@ -28,24 +28,6 @@ def assertImpl : CommandElab := fun (stx: Syntax) => do
       throwError ("Expression reduced to false:\n"  ++ stx[1])
     pure ())
 
--- @[command_elab assert]
--- def assertImpl : CommandElab := fun (stx: Syntax) => do
---   runTermElabM (fun _ => do
---     let prop ← Elab.Term.elabTerm stx[1] (.some (.sort .zero))
---     Term.synthesizeSyntheticMVarsNoPostponing
---     let prop ← instantiateMVars prop
---     let ty ← inferType prop
---     if ty != .sort .zero then
---       throwError "Assertion must be a Prop"
---     let mvar ← Meta.mkFreshExprMVar prop
---     let goal := mvar.mvarId!
---     let (newgoals, _) ← Lean.Elab.runTactic goal (← `(tactic| cbv))
---     if not newgoals.isEmpty then
---       logInfo ("Assertion failed for:\n" ++ stx[1])
---       throwError ("Assertion failed for:\n"  ++ stx[1])
---     pure ())
-
-
 syntax (name := elabSyntax) "#elab" term: command
 
 @[command_elab elabSyntax]
@@ -88,34 +70,25 @@ def RustEffect : Effect := {
 
 -- We need Result to be irreducble outside this file (to not break metaprograms which normalize types),
 -- but reducible within. The `unseal` command only affects the local context.
-@[irreducible /-, cbv_opaque-/]
+@[irreducible]
 def Result (α : Type u) : Type u := ITree RustEffect α
 unseal Result
 
-
--- TODO: clean up the cbv stuff
--- @[cbv_opaque]
 def Result.ok {α} (a : α) : Result α := .ret a
 
--- @[cbv_opaque]
 def Result.fail {α} (e : Error) : Result α := .vis (.fail e) PEmpty.elim
 
--- @[cbv_opaque]
 def Result.div {α} : Result α := ITree.div
 
--- TODO: in addition to type levels, does it cause issues that bind comes from the Monad instance?
--- -- TODO: is it ok to not have β be at a different level `v`?
--- @[cbv_opaque]
 def bind {α : Type u} {β : Type v} (x: Result α) (f: α → Result β) : Result β :=
   ITree.bind x f
--- instance : Monad Result := instMonadITree
+
 instance : Monad Result where
   pure := .ok
   bind := bind
+
 instance : LawfulMonad Result := instLawfulMonadITree
-  -- pure_bind      (x : α) (f : α → m β) : pure x >>= f = f x
 
--- @[cbv_eval]
 theorem Result_ok_bind.{u} {A B : Type u} : ∀ (x : A) (f : A → Result B),
   bind (Result.ok x) f = f x := by
     intros x f
@@ -123,7 +96,6 @@ theorem Result_ok_bind.{u} {A B : Type u} : ∀ (x : A) (f : A → Result B),
     simp [Bind.bind] at h
     assumption
 
--- TODO: adding these to simp set messes up some things
 @[simp, grind .]
 theorem ok_not_fail {α} {a : α} {e} : ¬ Result.ok a = .fail e := by grind [Result.ok, Result.fail]
 @[simp, grind .]
@@ -143,23 +115,19 @@ theorem Result.ok.injEq {α} {a b : α} : (Result.ok a = .ok b) = (a = b) := by
 theorem Result.fail.injEq {α} {a b : Error} : (@Result.fail α a = .fail b) = (a = b) := by
   grind [Result.fail, vis_inj_effect]
 
--- NOTE: in order for lean's metaprogramming surrounding the `split` tactic to not
--- spaghetti code itself to death, cases without inputs like div must input a Unit
--- NOTE: its seems that for registering a matcher for split, we need the motive to be before the result input.
--- NOTE: in order to register custom matches for the `split` tactic,
--- the name of the function must start with "match_". See the implementation of Matcherinfo.lean/`getMatcherInfo?`
--- previously Result was an inductive with ok, div, and fail cases only.
+-- Before ITrees, Result was an inductive with ok, div, and fail cases only.
 -- this function can be used in many cases to replace pattern matching on that inductive:
--- TODO: why do things error when this is def instead of abbrev?
+-- NOTE about split: to work with the `split` tactic, the name must start with "match_", the motive must come
+-- before the Result input, and the div case must input a Unit.
+-- If we commit to not needing split, we can change these things.
 @[elab_as_elim, cases_eliminator]
--- @[elab_as_elim, cases_eliminator, irreducible, cbv_opaque]
 def Result.match_dep {α}
   {motive : Result α → Sort v}
   (r : Result α)
   (ok : ∀ r, motive (.ok r))
   (fail : ∀ e, motive (.fail e))
+  -- TODO: add more cases as we add more effects.
   (div :  Unit → motive (.div))
-  -- will add more inputs as we add effects
   : motive r := ITree.cases ok (div ()) (
       fun e k => match e with
         | .fail e => by
@@ -167,7 +135,6 @@ def Result.match_dep {α}
             simp [same]
             exact (fail e)
     ) r
--- unseal Result.match_dep
 
 @[simp]
 theorem Result.match.ok {R motive r d f x}
@@ -184,15 +151,12 @@ theorem Result.match.fail {R motive r d f e}
 def Result.is_ok {R : Type} [BEq R] (r : Result R) (expected : R) : Bool :=
   r.match_dep (fun x => x == expected) (fun _ => false) (fun _ => false)
 
--- @[elab_as_elim, cases_eliminator]
--- @[irreducible, cbv_opaque]
 def Result.match_dep' {α}
   {motive : Result α → Sort v}
   (r : Result α)
   (ok : ∀ x, r = .ok x → motive (.ok x))
   (fail : ∀ e, r = .fail e → motive (.fail e))
   (div : r = .div → motive (.div))
-  -- will add more inputs as we add effects
   : motive r :=
     Result.match_dep (motive := fun r' => r = r' -> motive r') r ok fail (fun _ => div) rfl
 
@@ -247,31 +211,6 @@ instance {T} [Repr T] : Repr (Result T) where
 --     overlaps := { map := Std.HashMap.ofList [] }
 --   }
 
--- -- TODO: do we need both versions? I had problems with motives not being correct using the
--- -- dependent version, and maybe you can't use this one as a cases eliminator. TODO
--- def Result.match_nondep {α} (r : Result α)
---   {Out : Sort v}
---   (ok : α  → Out)
---   (fail : Error → Out)
---   (div :  Out)
---   -- will add more inputs as we add effects
---   : Out := ITree.cases ok div (
---       fun e _k => match e with
---         | .fail e => fail e
---     ) r
-
--- @[simp]
--- theorem Result.nmatch.ok {R Out r d f x}
---   : @Result.match_nondep R (.ok x) Out r f d = r x := ITree.cases.ret
-
--- @[simp]
--- theorem Result.nmatch.div {R Out r d f}
---   : @Result.match_nondep R .div Out r f d = d := ITree.cases.div
-
--- @[simp]
--- theorem Result.nmatch.fail {R Out r d f e}
---   : @Result.match_nondep R (.fail e) Out r f d = f e := ITree.cases.vis
-
 open Result
 
 instance Result_Inhabited (α : Type u) : Inhabited (Result α) :=
@@ -284,37 +223,9 @@ instance Result_Nonempty (α : Type u) : Nonempty (Result α) :=
 # Helpers
 -/
 
--- TODO: where these ever used anywhere? not sure yet.
--- @[global_simps]
--- def ok? {α: Type u} (r: Result α): Bool :=
---   ITree.cases
---     (fun o =>
---       match o with
---       | .ok _ => true
---       | .fail _ => false
---     )
---     false
---     (fun _ _ => false)
---     r
-
--- def div? {α: Type u} (r: Result α): Bool :=
---   ITree.cases
---     (fun _ => false)
---     true
---     (fun _ _ => false)
---     r
-
 def massert (b : Prop) [Decidable b] : Result Unit :=
   if b then ok () else fail assertionFailure
 
-macro "prove_eval_global" : tactic => `(tactic| simp (failIfUnchanged := false) only [global_simps] <;> first | apply Eq.refl | decide)
-
--- @[global_simps]
--- def eval_global {α: Type u} (x: Result α) (_: ok? x := by prove_eval_global) : α :=
---   -- match x with
---   -- | fail _ | div => by contradiction
---   -- | ok x => x
-
 @[simp]
 def Result.ofOption {a : Type u} (x : Option a) (e : Error) : Result a :=
   match x with
@@ -330,18 +241,6 @@ def Result.ofOption {a : Type u} (x : Option a) (e : Error) : Result a :=
 # Do-DSL Support
 -/
 
--- TODO: should this just be deleted to clean things up now, or left for backwards compatibility?
--- def bind {α : Type u} {β : Type v} (x: Result α) (f: α → Result β) : Result β :=
---   @Bind.bind Result _ α β x f
-
--- -- Allows using Result in do-blocks
--- instance : Bind Result where
-  -- bind := bind
-
--- Allows using pure x in do-blocks
--- instance : Pure Result where
---   pure := fun x => ok x
-
 @[simp] theorem bind_ok (x : α) (f : α → Result β) : bind (.ok x) f = f x :=
   by simp [bind, ok]
 @[simp] theorem bind_fail (x : Error) (f : α → Result β) : bind (.fail x) f = .fail x :=
@@ -370,34 +269,6 @@ def Result.ofOption {a : Type u} (x : Option a) (e : Error) : Result a :=
   (Bind.bind (Bind.bind e g) h) =
   (Bind.bind e (λ x => Bind.bind (g x) h)) := by apply bind_assoc
 
--- TODO: i think that this is false for the ITree version?
--- because if x = `vis _ k`, then the rhs of the ↔ says exactly nothing,
--- and the lhs says that y = y'.
--- @[simp]
--- def bind_eq_iff (x : Result α) (y y' : α → Result β) :
---   ((Bind.bind x y) = (Bind.bind x y')) ↔
---   ∀ v, x = ok v → y v = y' v := by
-  -- -- cases x <;> simp_all
-  -- constructor
-  -- · intros
-  --   subst_vars
-  --   simp at *
-  --   assumption
-  -- · intros h
-  --   revert h
-  --   refine ITree.cases ?_ ?_ ?_ x
-  --   ·
-  --     intros r h
-  --     refine (.trans (pure_bind _ _) (.trans ?_ (Eq.symm (pure_bind _ _))))
-  --     apply h
-  --     simp [pure]
-  --     rfl
-  --   · intros h
-  --     simp [bind, itree_div_bind]
-  --   ·
-  --     intros
-  --     sorry
-
 /-!
 # Partial Fixpoint
 -/
@@ -412,20 +283,6 @@ noncomputable instance : CCPO (Result α) := instCCPOCoIndOfInhabitedPUnit (ITre
   -- instCCPOCoIndOfInhabitedPUnit _
 noncomputable instance : MonoBind Result := instMonoBindITree
 
--- TODO: is there a way to not need to state this, and just use the typeclass instance?
--- @[partial_fixpoint_monotone]
--- theorem monotone_bind
---     {α β : Type u}
---     {γ : Sort w} [PartialOrder γ]
---     (f : γ → Result α) (g : γ → α → Result β)
---     (hmono₁ : monotone f)
---     (hmono₂ : monotone g) :
---     monotone (fun (x : γ) => bind (f x) (g x)) := by
---   intro x₁ x₂ hx₁₂
---   apply PartialOrder.rel_trans
---   · apply MonoBind.bind_mono_left (hmono₁ _ _ hx₁₂)
---   · apply MonoBind.bind_mono_right (fun y => monotone_apply y _ hmono₂ _ _ hx₁₂)
-
 @[partial_fixpoint_monotone]
 theorem bind_mono {R : Type a} {α} {S : Type b} [PartialOrder α]
   (f : α → Result R) (g : α → R → Result S) :
@@ -437,6 +294,7 @@ theorem bind_mono {R : Type a} {α} {S : Type b} [PartialOrder α]
 
 -- TODO: when we add more effects, use Aeneas.Data.Coinductive.vis_mono
 -- to instantiate monotonicity theorems for those effects.
+
 end Order
 
 /-- Aeneas-internal version of `Function.uncurry` for tuple destructuring in bind
@@ -542,18 +400,6 @@ def loop {α : Type u} {β : Type v} (body : α → Result (ControlFlow α β))
   | ControlFlow.done x => ok x
 partial_fixpoint
 
-
--- TODO: this is original, delete this
--- def loop {α : Type u} {β : Type v} (body : α → Result (ControlFlow α β)) (x : α) : Result β := do
---   match body x with
---   | ok r =>
---     match r with
---     | ControlFlow.cont x => loop body x
---     | ControlFlow.done x => ok x
---   | fail e => fail e
---   | div => div
--- partial_fixpoint
-
 /-!
 # Misc
 -/
@@ -568,7 +414,7 @@ instance SubtypeLawfulBEq [BEq α] (p : α → Prop) [LawfulBEq α] : LawfulBEq
   eq_of_beq {a b} h := by cases a; cases b; simp_all [BEq.beq]
   rfl := by intro a; cases a; simp [BEq.beq]
 
--- TODO: will this make sense, given that .vis now returns none?
+-- TODO: will this make sense when we add more effects, given that .vis returns none?
 /- A helper function that converts failure to none and success to some
    TODO: move up to Core module? -/
 def Option.ofResult {a : Type u} (x : Result a) :
diff --git a/backends/lean/Aeneas/Std/PrimitivesLemmas.lean b/backends/lean/Aeneas/Std/PrimitivesLemmas.lean
index 42c9b6033..6bc5e9cca 100644
--- a/backends/lean/Aeneas/Std/PrimitivesLemmas.lean
+++ b/backends/lean/Aeneas/Std/PrimitivesLemmas.lean
@@ -12,7 +12,7 @@ theorem massert_spec (b : Prop) [Decidable b] (h : b) :
   simp [massert, *]
 
 @[simp, step_pre_simps, bvify]
-theorem massert_ok (b : Prop) [Decidable b] : massert b = ok () ↔ b := by grind [massert, ok_not_fail]
+theorem massert_ok (b : Prop) [Decidable b] : massert b = ok () ↔ b := by grind [massert]
 
 @[simp, step_pre_simps, bvify]
 theorem spec_massert (b : Prop) [Decidable b] : Std.WP.spec (massert b) P ↔ (b ∧ P ()) := by

From 6593d65a620cb3d7b140ad7e546d8040f386c24c Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Mon, 20 Jul 2026 12:23:47 -0400
Subject: [PATCH 59/67] improved Result matching, easier to add effects

---
 backends/lean/Aeneas/Std/Array/Core.lean      |  18 +-
 backends/lean/Aeneas/Std/Primitives.lean      | 219 +++++++++++-------
 backends/lean/Aeneas/Std/Scalar/Core.lean     |  17 +-
 backends/lean/Aeneas/Std/Scalar/Ops/Add.lean  |  26 +--
 backends/lean/Aeneas/Std/Scalar/Ops/Mul.lean  |  27 +--
 backends/lean/Aeneas/Std/Scalar/Ops/Sub.lean  |  20 +-
 .../Aeneas/Std/Scalar/OverflowingOps/Div.lean |   3 +
 backends/lean/Aeneas/Std/Slice.lean           |  55 +++--
 backends/lean/Aeneas/Std/SliceIter.lean       |  15 +-
 backends/lean/Aeneas/Std/Vec.lean             |  12 +-
 backends/lean/Aeneas/Std/WP.lean              |   7 +-
 backends/lean/Aeneas/Tactic/Step/Step.lean    |   2 +-
 12 files changed, 247 insertions(+), 174 deletions(-)

diff --git a/backends/lean/Aeneas/Std/Array/Core.lean b/backends/lean/Aeneas/Std/Array/Core.lean
index d4bcb2fb2..6a590ab8d 100644
--- a/backends/lean/Aeneas/Std/Array/Core.lean
+++ b/backends/lean/Aeneas/Std/Array/Core.lean
@@ -40,16 +40,24 @@ def List.clone (clone : α → Result α) (l : List α) : Result ({ l' : List α
   -- | fail e => fail e
   -- | div => div
   -- (List.mapM clone l).match_dep
-  Result.match_dep' (motive := fun l => _) (List.mapM clone l)
-  (fun v h => ok ⟨ v, by have := List.mapM_Result_length h; scalar_tac ⟩)
-  (fun e _h => fail e)
-  (fun _h => div)
+  -- Result.match_dep' (motive := fun l => _) (List.mapM clone l)
+  -- (fun v h => ok ⟨ v, by have := List.mapM_Result_length h; scalar_tac ⟩)
+  -- (fun e _h => fail e)
+  -- (fun _h => div)
+  match h : (List.mapM clone l).match with
+  | .ok v => ok ⟨ v, by
+    cases h2 : List.mapM clone l <;> simp_all
+    have := List.mapM_Result_length h2
+    scalar_tac ⟩
+  | .vis (.fail e) _ => fail e
+  | .div => div
 
 @[step]
 def List.clone_spec {clone : α → Result α} {l : List α} (h : ∀ x ∈ l, clone x = ok x) :
   List.clone clone l ⦃ l' => l'.val = l ∧ l'.val.length = l.length ⦄ := by
   simp only [List.clone]
   have := List.mapM_clone_eq h
-  simp [this]
+  split <;> simp_all
+  cases h : List.mapM clone l <;> simp_all
 
 end Aeneas.Std
diff --git a/backends/lean/Aeneas/Std/Primitives.lean b/backends/lean/Aeneas/Std/Primitives.lean
index 48b17146a..22abfdd12 100644
--- a/backends/lean/Aeneas/Std/Primitives.lean
+++ b/backends/lean/Aeneas/Std/Primitives.lean
@@ -58,10 +58,12 @@ open Error
 
 inductive RustEffect.I : Type where
 | fail : Error → RustEffect.I
+-- | test_effect : RustEffect.I
 
 def RustEffect.O (i : RustEffect.I) : Type :=
   match i with
   | .fail _ => PEmpty
+  -- | .test_effect => PUnit
 
 def RustEffect : Effect := {
   I := RustEffect.I
@@ -76,10 +78,14 @@ unseal Result
 
 def Result.ok {α} (a : α) : Result α := .ret a
 
-def Result.fail {α} (e : Error) : Result α := .vis (.fail e) PEmpty.elim
+def Result.vis {α} (eff : RustEffect.I) (k : RustEffect.O eff → Result α) : Result α := ITree.vis eff k
+
+@[simp, grind .]
+def Result.fail {α} (e : Error) : Result α := Result.vis (.fail e) PEmpty.elim
 
 def Result.div {α} : Result α := ITree.div
 
+-- TODO: maybe rename Result.bind
 def bind {α : Type u} {β : Type v} (x: Result α) (f: α → Result β) : Result β :=
   ITree.bind x f
 
@@ -89,6 +95,7 @@ instance : Monad Result where
 
 instance : LawfulMonad Result := instLawfulMonadITree
 
+-- TODO: is this not redundant with theorems below in this file?
 theorem Result_ok_bind.{u} {A B : Type u} : ∀ (x : A) (f : A → Result B),
   bind (Result.ok x) f = f x := by
     intros x f
@@ -97,92 +104,133 @@ theorem Result_ok_bind.{u} {A B : Type u} : ∀ (x : A) (f : A → Result B),
     assumption
 
 @[simp, grind .]
-theorem ok_not_fail {α} {a : α} {e} : ¬ Result.ok a = .fail e := by grind [Result.ok, Result.fail]
+theorem ok_not_vis {α} {a : α} {eff k} : ¬ Result.ok a = .vis eff k := by grind [Result.ok, Result.vis]
 @[simp, grind .]
-theorem fail_not_ok {α} {a : α} {e} : ¬ Result.fail e = .ok a := by grind [Result.ok, Result.fail]
+theorem vis_not_ok {α} {a : α} {eff k} : ¬ .vis eff k = Result.ok a := by grind [Result.ok, Result.vis]
 @[simp, grind .]
 theorem ok_not_div {α} {a : α} : ¬ Result.ok a = .div := by grind [Result.ok, Result.div]
 @[simp, grind .]
 theorem div_not_ok {α} {a : α} : ¬ Result.div = .ok a := by grind [Result.ok, Result.div]
 @[simp, grind .]
-theorem fail_not_div {α} {e} : ¬ @Result.fail α e = .div := by grind [Result.div, Result.fail]
+theorem vis_not_div {α} {eff k} : ¬ @Result.vis α eff k = .div := by grind [Result.div, Result.vis]
 @[simp, grind .]
-theorem div_not_fail {α} {e} : ¬ .div = @Result.fail α e := by grind [Result.div, Result.fail]
+theorem div_not_vis {α} {eff k} : ¬ .div = @Result.vis α eff k := by grind [Result.div, Result.vis]
 @[simp, grind .]
 theorem Result.ok.injEq {α} {a b : α} : (Result.ok a = .ok b) = (a = b) := by
   grind [Result.ok]
-@[simp, grind .]
-theorem Result.fail.injEq {α} {a b : Error} : (@Result.fail α a = .fail b) = (a = b) := by
-  grind [Result.fail, vis_inj_effect]
-
--- Before ITrees, Result was an inductive with ok, div, and fail cases only.
--- this function can be used in many cases to replace pattern matching on that inductive:
--- NOTE about split: to work with the `split` tactic, the name must start with "match_", the motive must come
--- before the Result input, and the div case must input a Unit.
--- If we commit to not needing split, we can change these things.
-@[elab_as_elim, cases_eliminator]
-def Result.match_dep {α}
-  {motive : Result α → Sort v}
-  (r : Result α)
-  (ok : ∀ r, motive (.ok r))
-  (fail : ∀ e, motive (.fail e))
-  -- TODO: add more cases as we add more effects.
-  (div :  Unit → motive (.div))
-  : motive r := ITree.cases ok (div ()) (
-      fun e k => match e with
-        | .fail e => by
-            have same : k = PEmpty.elim := by funext x; contradiction
-            simp [same]
-            exact (fail e)
-    ) r
-
-@[simp]
-theorem Result.match.ok {R motive r d f x}
-  : @Result.match_dep R motive (.ok x) r f d = r x := ITree.cases.ret
+-- TODO: do we need the stronger version of this that has the continuations with ≍?
+@[grind .]
+theorem Result.vis.injEq {α} {a b} {k1 k2} : (@Result.vis α a k1 = .vis b k2) → (a = b) := by
+  grind [Result.vis, vis_inj_effect]
 
-@[simp]
-theorem Result.match.div {R motive r d f}
-  : @Result.match_dep R motive .div r f d = d () := ITree.cases.div
 
-@[simp]
-theorem Result.match.fail {R motive r d f e}
-  : @Result.match_dep R motive (.fail e) r f d = f e := ITree.cases.vis
-
-def Result.is_ok {R : Type} [BEq R] (r : Result R) (expected : R) : Bool :=
-  r.match_dep (fun x => x == expected) (fun _ => false) (fun _ => false)
-
-def Result.match_dep' {α}
-  {motive : Result α → Sort v}
-  (r : Result α)
-  (ok : ∀ x, r = .ok x → motive (.ok x))
-  (fail : ∀ e, r = .fail e → motive (.fail e))
-  (div : r = .div → motive (.div))
-  : motive r :=
-    Result.match_dep (motive := fun r' => r = r' -> motive r') r ok fail (fun _ => div) rfl
-
-@[simp]
-theorem Result.match_dep'.ok {R motive v r d f x}
-  (h : v = Result.ok x)
-  : @Result.match_dep' R motive v r f d = cast (congrArg motive (Eq.symm h)) (r x h) := by
-  cases v <;> unfold match_dep' <;> simp <;> grind
+-- #check ITree.cases
+@[elab_as_elim, cases_eliminator]
+def Result.cases {R}
+    {motive : Result R → Sort v}
+    (t : Result R)
+    (ret : ∀ r, motive (Result.ok r))
+    (vis : ∀ i k, motive (Result.vis i k))
+    (div :  motive (Result.div))
+    : motive t := ITree.cases ret div vis t
+
+-- inductive MatchResult : ∀ {α : Type u}, Result α → Type _ where
+-- | ok {α} : (a : α) → MatchResult (Result.ok a)
+-- | div : ∀ {α}, @MatchResult α .div
+-- | fail : ∀ {α}, (e : Error) → @MatchResult α (.fail e)
+
+inductive MatchResult (α : Type u) : Type u where
+| ok : (a : α) → MatchResult α
+| div : MatchResult α
+| vis : (eff : RustEffect.I) → (RustEffect.O eff → Result α) → MatchResult α
+
+def Result.match.{u} {α : Type u} (r : Result α) : MatchResult α :=
+  r.cases .ok .vis .div
 
-@[simp]
-theorem Result.match_dep'.fail {R motive v r d f e}
-  (h : v = Result.fail e)
-  : @Result.match_dep' R motive v r f d = cast (congrArg motive (Eq.symm h)) (f e h) := by
-  cases v <;> unfold match_dep' <;> simp <;> grind
+@[simp, grind .]
+theorem Result.match.ok {α : Type u} {a : α} : (Result.ok a).match = .ok a := by
+  simp [Result.match, Result.ok, Result.cases]
+@[simp, grind .]
+theorem Result.match.vis {α : Type u} {e k} : (@Result.vis α e k).match = .vis e k := by
+  simp [Result.match, Result.vis, Result.cases]
+@[simp, grind .]
+theorem Result.match.div {α : Type u} : Result.div.match = @MatchResult.div α := by
+  simp [Result.match, Result.div, Result.cases]
 
 @[simp]
-theorem Result.match_dep'.div {R motive v r d f}
-  (h : v = .div)
-  : @Result.match_dep' R motive v r f d = cast (congrArg motive (Eq.symm h)) (d h) := by
-  cases v <;> unfold match_dep' <;> simp <;> grind
+theorem Result.match.is_ok {α : Type u} {a : α} {r : Result α} : (r.match = .ok a) ↔ r = .ok a := by
+  cases r <;> grind
+
+-- -- Before ITrees, Result was an inductive with ok, div, and fail cases only.
+-- -- this function can be used in many cases to replace pattern matching on that inductive:
+-- -- NOTE about split: to work with the `split` tactic, the name must start with "match_", the motive must come
+-- -- before the Result input, and the div case must input a Unit.
+-- -- If we commit to not needing split, we can change these things.
+-- @[elab_as_elim, cases_eliminator]
+-- def Result.match_dep {α}
+--   {motive : Result α → Sort v}
+--   (r : Result α)
+--   (m : ∀ {r'}, MatchResult r' → motive r')
+--   : motive r := ITree.cases (fun x => m (.ok x)) (m .div) (
+--       fun e k => match e with
+--         | .fail e => by
+--             have same : k = PEmpty.elim := by funext x; contradiction
+--             simp [same]
+--             let h := (@m (.fail e) (.fail e))
+--             simp [fail] at h
+--             apply h
+--     ) r
+
+-- @[simp]
+-- theorem Result.match.ok {R motive m x}
+--   : @Result.match_dep R motive (.ok x) m = (m (.ok x)) := ITree.cases.ret
+
+-- @[simp]
+-- theorem Result.match.div {R motive m}
+--   : @Result.match_dep R motive .div m = m .div := ITree.cases.div
+
+-- @[simp]
+-- theorem Result.match.fail {R motive m}
+--   : @Result.match_dep R motive (.fail e) m = m (.fail e) := ITree.cases.vis
 
-instance {T} [Repr T] : Repr (Result T) where
-  reprPrec x n := x.match_dep
-    (fun t => .append (.text "ok ") (reprPrec t n))
-    (fun e => .append (.text "fail ") (reprPrec e n))
-    (fun _ => .text "div")
+def Result.is_ok {R : Type} [BEq R] (r : Result R) (expected : R) : Bool :=
+  match r.match with
+  | .ok x => x == expected
+  | _ => false
+
+-- def Result.match_dep' {α}
+--   {motive : Result α → Sort v}
+--   (r : Result α)
+--   (ok : ∀ x, r = .ok x → motive (.ok x))
+--   (fail : ∀ e, r = .fail e → motive (.fail e))
+--   (div : r = .div → motive (.div))
+--   : motive r :=
+--     Result.match_dep (motive := fun r' => r = r' -> motive r') r ok fail (fun _ => div) rfl
+
+-- @[simp]
+-- theorem Result.match_dep'.ok {R motive v r d f x}
+--   (h : v = Result.ok x)
+--   : @Result.match_dep' R motive v r f d = cast (congrArg motive (Eq.symm h)) (r x h) := by
+--   cases v <;> unfold match_dep' <;> simp <;> grind
+
+-- @[simp]
+-- theorem Result.match_dep'.fail {R motive v r d f e}
+--   (h : v = Result.fail e)
+--   : @Result.match_dep' R motive v r f d = cast (congrArg motive (Eq.symm h)) (f e h) := by
+--   cases v <;> unfold match_dep' <;> simp <;> grind
+
+-- @[simp]
+-- theorem Result.match_dep'.div {R motive v r d f}
+--   (h : v = .div)
+--   : @Result.match_dep' R motive v r f d = cast (congrArg motive (Eq.symm h)) (d h) := by
+--   cases v <;> unfold match_dep' <;> simp <;> grind
+
+-- TODO: do we need this?
+-- instance {T} [Repr T] : Repr (Result T) where
+--   reprPrec x n := x.match_dep fun x => match x with
+--     | .ok t => .append (.text "ok ") (reprPrec t n)
+--     | .fail e => .append (.text "fail ") (reprPrec e n)
+--     | .div => .text "div"
 
 -- TODO: this is how to register for split, but we probably won't use that
 -- run_meta
@@ -243,8 +291,13 @@ def Result.ofOption {a : Type u} (x : Option a) (e : Error) : Result a :=
 
 @[simp] theorem bind_ok (x : α) (f : α → Result β) : bind (.ok x) f = f x :=
   by simp [bind, ok]
-@[simp] theorem bind_fail (x : Error) (f : α → Result β) : bind (.fail x) f = .fail x :=
-  by simp [bind, fail]
+-- @[simp] theorem bind_fail (x : Error) (f : α → Result β) : bind (.fail x) f = .fail x :=
+--   by simp [bind, vis]
+--      apply congrArg
+--      funext x
+--      contradiction
+@[simp] theorem bind_vis (e k) (f : α → Result β) : bind (.vis e k) f = .vis e (fun x => bind (k x) f) :=
+  by simp [bind, vis]
      apply congrArg
      funext x
      contradiction
@@ -254,9 +307,16 @@ def Result.ofOption {a : Type u} (x : Option a) (e : Error) : Result a :=
 @[simp] theorem bind_tc_ok (x : α) (f : α → Result β) :
   (do let y ← .ok x; f y) = f x := by simp [bind, Bind.bind, ok]
 
-@[simp] theorem bind_tc_fail (x : Error) (f : α → Result β) :
-  (do let y ← fail x; f y) = fail x := by
-  simp [bind, Bind.bind, fail]
+-- TODO: will this create backwards compatibility issues?
+-- @[simp] theorem bind_tc_fail (x : Error) (f : α → Result β) :
+--   (do let y ← fail x; f y) = fail x := by
+--   simp [bind, Bind.bind, vis]
+--   apply congrArg
+--   funext x
+--   contradiction
+@[simp] theorem bind_tc_vis (e k) (f : α → Result β) :
+  (do let y ← Result.vis e k; f y) = .vis e (fun x => do let y ← k x; f y) := by
+  simp [bind, Bind.bind, vis]
   apply congrArg
   funext x
   contradiction
@@ -419,10 +479,9 @@ instance SubtypeLawfulBEq [BEq α] (p : α → Prop) [LawfulBEq α] : LawfulBEq
    TODO: move up to Core module? -/
 def Option.ofResult {a : Type u} (x : Result a) :
   Option a :=
-  x.match_dep
-    .some
-    (fun _ => .none)
-    (fun _ => .none)
+  match x.match with
+  | .ok x => .some x
+  | _ => .none
 
 /-!
 # bv_decide
diff --git a/backends/lean/Aeneas/Std/Scalar/Core.lean b/backends/lean/Aeneas/Std/Scalar/Core.lean
index befc353d9..1a66e2919 100644
--- a/backends/lean/Aeneas/Std/Scalar/Core.lean
+++ b/backends/lean/Aeneas/Std/Scalar/Core.lean
@@ -626,14 +626,15 @@ theorem UScalar.tryMk_eq_DELETE_THIS_PROBABLY (ty : UScalarTy) (x : Nat) :
     grind
 
 theorem UScalar.tryMk_eq (ty : UScalarTy) (x : Nat) :
-  (tryMk ty x).match_dep
-    (fun y => y.val = x ∧ inBounds ty x)
-    (fun _e => ¬ (inBounds ty x))
-    (fun _ => False)
+  match (tryMk ty x).match with
+    | .ok y => y.val = x ∧ inBounds ty x
+    | .vis (.fail _e) _k => ¬ (inBounds ty x)
+    | _ => False
   := by
   have := UScalar.tryMkOpt_eq ty x
   simp [tryMk, ofOption]
   cases h: tryMkOpt ty x <;> simp_all
+  --
 
 -- TODO: delete old one
 -- theorem UScalar.tryMk_eq (ty : UScalarTy) (x : Nat) :
@@ -672,10 +673,10 @@ theorem IScalar.tryMkOpt_eq (ty : IScalarTy) (x : Int) :
 --     grind
 
 theorem IScalar.tryMk_eq (ty : IScalarTy) (x : Int) :
-  (tryMk ty x).match_dep
-  (fun y => y.val = x ∧ inBounds ty x)
-  (fun _e => ¬ (inBounds ty x))
-  (fun _ => False)
+  match (tryMk ty x).match with
+  | .ok y => y.val = x ∧ inBounds ty x
+  | .vis (.fail _e) _k => ¬ (inBounds ty x)
+  | _ => False
   := by
   have := tryMkOpt_eq ty x
   simp [tryMk]
diff --git a/backends/lean/Aeneas/Std/Scalar/Ops/Add.lean b/backends/lean/Aeneas/Std/Scalar/Ops/Add.lean
index 5d1c56877..dd4914491 100644
--- a/backends/lean/Aeneas/Std/Scalar/Ops/Add.lean
+++ b/backends/lean/Aeneas/Std/Scalar/Ops/Add.lean
@@ -35,13 +35,12 @@ instance {ty} : HAdd (IScalar ty) (IScalar ty) (Result (IScalar ty)) where
 -/
 
 theorem UScalar.add_equiv {ty} (x y : UScalar ty) :
-  (x + y).match_dep
-  (fun z => x.val + y.val < 2^ty.numBits ∧
+  match (x + y).match with
+  | .ok z => x.val + y.val < 2^ty.numBits ∧
     z.val = x.val + y.val ∧
-    z.bv = x.bv + y.bv)
-  (fun _e => ¬ (UScalar.inBounds ty (x.val + y.val)))
-  ⊥
-  := by
+    z.bv = x.bv + y.bv
+  | .vis (.fail _) _ => ¬ (UScalar.inBounds ty (x.val + y.val))
+  | _ => ⊥ := by
   have : x + y = add x y := by rfl
   rw [this]
   simp [add]
@@ -57,14 +56,13 @@ theorem UScalar.add_equiv {ty} (x y : UScalar ty) :
   simp [*]
 
 theorem IScalar.add_equiv {ty} (x y : IScalar ty) :
-  (x + y).match_dep
-    (fun z =>
-      IScalar.inBounds ty (x.val + y.val) ∧
-      z.val = x.val + y.val ∧
-      z.bv = x.bv + y.bv)
-    (fun _e => ¬ (IScalar.inBounds ty (x.val + y.val)))
-    ⊥
-  := by
+  match (x + y).match with
+  | .ok z =>
+    IScalar.inBounds ty (x.val + y.val) ∧
+    z.val = x.val + y.val ∧
+    z.bv = x.bv + y.bv
+  | .vis (.fail _) _ => ¬ (IScalar.inBounds ty (x.val + y.val))
+  | _ => ⊥ := by
   have : x + y = add x y := by rfl
   rw [this]
   simp [add]
diff --git a/backends/lean/Aeneas/Std/Scalar/Ops/Mul.lean b/backends/lean/Aeneas/Std/Scalar/Ops/Mul.lean
index 9cb77c862..9cca50923 100644
--- a/backends/lean/Aeneas/Std/Scalar/Ops/Mul.lean
+++ b/backends/lean/Aeneas/Std/Scalar/Ops/Mul.lean
@@ -40,11 +40,10 @@ Theorems with a specification which use integers and bit-vectors
 -/
 
 theorem UScalar.mul_equiv {ty} (x y : UScalar ty) :
-  (mul x y).match_dep
-  (fun z => x.val * y.val ≤ UScalar.max ty ∧ (↑z : Nat) = ↑x * ↑y ∧ z.bv = x.bv * y.bv)
-  (fun _ => UScalar.max ty < x.val * y.val)
-  (fun _ => False)
-  := by
+  match (mul x y).match with
+  | .ok z => x.val * y.val ≤ UScalar.max ty ∧ (↑z : Nat) = ↑x * ↑y ∧ z.bv = x.bv * y.bv
+  | .vis (.fail _) _ => UScalar.max ty < x.val * y.val
+  | .div => False := by
   simp only [mul]
   have := tryMk_eq ty (x.val * y.val)
   generalize hval : tryMk ty (↑x * ↑y) = val at this
@@ -69,22 +68,20 @@ theorem UScalar.mul_bv_spec {ty} {x y : UScalar ty}
   have : x * y = mul x y := by rfl
   have := mul_equiv x y
   generalize hval : x.mul y = val at this
-  cases val <;> simp_all [spec_ok, and_self, spec_fail]
+  cases val <;> simp_all [spec_ok, and_self, spec_vis]
   omega
 
 theorem IScalar.mul_equiv {ty} (x y : IScalar ty) :
-  (mul x y).match_dep
-  (fun z => IScalar.min ty ≤ x.val * y.val ∧ x.val * y.val ≤ IScalar.max ty ∧ z.val = x.val * y.val ∧ z.bv = x.bv * y.bv)
-  (fun _ => ¬(IScalar.min ty ≤ x.val * y.val ∧ x.val * y.val ≤ IScalar.max ty))
-  (fun _ => False) := by
+  match (mul x y).match with
+  | .ok z => IScalar.min ty ≤ x.val * y.val ∧ x.val * y.val ≤ IScalar.max ty ∧ z.val = x.val * y.val ∧ z.bv = x.bv * y.bv
+  | .vis (.fail _) _ => ¬(IScalar.min ty ≤ x.val * y.val ∧ x.val * y.val ≤ IScalar.max ty)
+  | .div => False := by
   simp only [mul, not_and, not_le]
   have := tryMk_eq ty (x.val * y.val)
-  generalize hval : tryMk ty (↑x * ↑y) = value at this
-  cases value <;> simp_all only [«match».ok, «match».div, «match».fail, inBounds, min, max, true_and, not_and, not_lt] <;>
+  split <;> simp_all only [inBounds, min, max, true_and, not_and, not_lt] <;>
   simp_all only [tryMk, ofOption, tryMkOpt, check_bounds, and_self, decide_true, dite_true,
-    ok.injEq, Bool.decide_and, Bool.and_eq_true, decide_eq_true_eq] <;>
-  simp only [← hval, ofIntCore, val] <;>
-  clear hval <;>
+    Bool.decide_and, Bool.and_eq_true, decide_eq_true_eq] <;>
+  rename_i hEq <;> simp at hEq <;> simp only [← hEq, ofIntCore, val] <;>
   simp only [bv_toInt_eq, ← BitVec.toInt_inj, BitVec.toInt_mul]
   . split_conjs
     . omega
diff --git a/backends/lean/Aeneas/Std/Scalar/Ops/Sub.lean b/backends/lean/Aeneas/Std/Scalar/Ops/Sub.lean
index 92c0f2be2..4772ca22c 100644
--- a/backends/lean/Aeneas/Std/Scalar/Ops/Sub.lean
+++ b/backends/lean/Aeneas/Std/Scalar/Ops/Sub.lean
@@ -37,13 +37,13 @@ instance {ty} : HSub (IScalar ty) (IScalar ty) (Result (IScalar ty)) where
 -/
 
 theorem UScalar.sub_equiv {ty} (x y : UScalar ty) :
-  (x - y).match_dep -- TODO: here, the dependent version breaks things in the proof
-  (fun z =>
+  match (x - y).match with
+  | .ok z =>
     y.val ≤ x.val ∧
     x.val = z.val + y.val ∧
-    z.bv = x.bv - y.bv)
-  (fun _ => x.val < y.val)
-  ⊥ := by
+    z.bv = x.bv - y.bv
+  | .vis (.fail _) _ => x.val < y.val
+  | _ => ⊥ := by
   have : x - y = sub x y := by rfl
   simp [this, sub]
   dcases h : x.val < y.val <;> simp [h]
@@ -81,13 +81,13 @@ theorem UScalar.sub_equiv {ty} (x y : UScalar ty) :
     ring_nf
 
 theorem IScalar.sub_equiv {ty} (x y : IScalar ty) :
-  (x - y).match_dep
-  (fun z =>
+  match (x - y).match with
+  | .ok z =>
     IScalar.inBounds ty (x.val - y.val) ∧
     z.val = x.val - y.val ∧
-    z.bv = x.bv - y.bv)
-  (fun _ => ¬ (IScalar.inBounds ty (x.val - y.val)))
-  ⊥ := by
+    z.bv = x.bv - y.bv
+  | .vis (.fail _) _ => ¬ (IScalar.inBounds ty (x.val - y.val))
+  | _ => ⊥ := by
   have : x - y = sub x y := by rfl
   simp [this, sub]
   have h := tryMk_eq ty (↑x - ↑y)
diff --git a/backends/lean/Aeneas/Std/Scalar/OverflowingOps/Div.lean b/backends/lean/Aeneas/Std/Scalar/OverflowingOps/Div.lean
index 6119bd94b..085731cec 100644
--- a/backends/lean/Aeneas/Std/Scalar/OverflowingOps/Div.lean
+++ b/backends/lean/Aeneas/Std/Scalar/OverflowingOps/Div.lean
@@ -42,6 +42,9 @@ theorem UScalar.overflowing_div_eq {ty} (x y : UScalar ty) :
   simp [overflowing_div, UScalar.div]
   rw [map_eq_bind_pure_comp]
   split <;> simp [pure]
+  congr
+  funext
+  contradiction
 
 uscalar @[step_pure overflowing_div x y]
 theorem core.num.«%S».overflowing_div_eq (x y : «%S») :
diff --git a/backends/lean/Aeneas/Std/Slice.lean b/backends/lean/Aeneas/Std/Slice.lean
index 8ce08412d..d9190eabb 100644
--- a/backends/lean/Aeneas/Std/Slice.lean
+++ b/backends/lean/Aeneas/Std/Slice.lean
@@ -648,11 +648,10 @@ def core.slice.index.SliceIndexRangeFromUsizeSlice.index_mut {T : Type}
   else fail .panic
 
 theorem _SliceIndexRangeFromUsizeSlice.index_mut.test {T} (s : Slice T) (r : core.ops.range.RangeFrom Usize) (h : r.start ≤ s.length) :
-  (core.slice.index.SliceIndexRangeFromUsizeSlice.index_mut r s).match_dep
-  (fun (s1, back) => back s1 = s)
-  (fun _ => False)
-  (fun _ => False) :=
-  by
+  match (core.slice.index.SliceIndexRangeFromUsizeSlice.index_mut r s).match with
+  | .ok (s1, back) =>
+    back s1 = s
+  | _ => False := by
   unfold core.slice.index.SliceIndexRangeFromUsizeSlice.index_mut
   simp [h]
 
@@ -686,8 +685,9 @@ theorem Slice.clone_length {T : Type} {clone : T → Result T} {s s' : Slice T}
   s'.length = s.length := by
   simp [Slice.clone] at h
   simp [List.clone] at h
-  cases h2 : List.mapM clone ↑s <;> simp_all
+  split at h <;> simp_all
   rename_i heq
+  simp at heq
   have := List.mapM_Result_length heq
   cases s'; simp_all
   cases h; simp_all
@@ -915,7 +915,7 @@ theorem core.slice.index.SliceIndexRangeUsizeSlice.index.step_spec {α : Type}
   · simp only [spec_ok, true_and]
     simp_lists
     omega
-  · simp only [spec_fail]
+  · simp only [fail, spec_vis]
     scalar_tac
 
 -- RangeTo step specs
@@ -1010,10 +1010,10 @@ theorem core.slice.Slice.copy_from_slice.step_spec (copyInst : core.marker.Copy
   simp [h]
 
 def Slice.mapM  {α β} (f : α → Result β) (x : Slice α) : Result (Slice β) :=
-  (x.val.mapM f).match_dep' (motive := fun _ => _)
-    (fun xs h => ok ⟨xs, List.mapM_Result_length h ▸ x.prop⟩)
-    (fun e _ => fail e)
-    (fun _ => div)
+  match h : (x.val.mapM f).match with
+  | .ok xs  => ok ⟨xs, List.mapM_Result_length (by simp at h; apply h) ▸ x.prop⟩
+  | .vis (.fail e) _ => fail e
+  | .div    => div
 
 @[step]
 theorem Slice.mapM_spec {α β} {f : α → Result β} {s : Slice α} {post : Nat → β → Prop}
@@ -1034,16 +1034,21 @@ theorem Slice.mapM_spec {α β} {f : α → Result β} {s : Slice α} {post : Na
       intro hall
       obtain ⟨b, hb⟩ := hall 0 (by simp); simp at hb
       obtain ⟨ts, hts⟩ := ih (fun i hi => hall (i + 1) (by simp; omega))
-      exact ⟨b :: ts, by simp [List.mapM_cons, hb, hts, pure, Bind.bind]⟩
+      exact ⟨b :: ts, by simp [List.mapM_cons, hb, hts, pure]⟩
   obtain ⟨l', hl'⟩ := hmapM_ok
-  simp [hl']
-  refine ⟨by grind [List.mapM_Result_length], fun i hi => ?_⟩
-  have hlen : i < s.len := by have := List.mapM_Result_length hl'; simp [Slice.len] at *; omega
-  have hthis := List.mapM_Result_ok hl' (↑i) (by scalar_tac)
-  specialize hf i hlen; simp only [getElem_Usize_eq] at hf
-  erw [hthis] at hf
-  simp [spec_ok] at hf ⊢
-  exact hf
+  split
+  case h_1 xs heq =>
+    simp only [UScalar.lt_equiv, Usize.ofNatCore_val_eq, spec_ok]
+    refine ⟨by grind [List.mapM_Result_length], fun i hi => ?_⟩
+    simp at heq
+    have hlen : i < s.len := by have := List.mapM_Result_length heq; simp [Slice.len] at *; omega
+    have hthis := List.mapM_Result_ok heq (↑i) (by scalar_tac)
+    specialize hf i hlen; simp only [getElem_Usize_eq] at hf
+    erw [hthis] at hf
+    simp only [spec_ok] at hf ⊢
+    exact hf
+  case h_2 e heq => simp [hl'] at heq
+  case h_3 heq => simp [hl'] at heq
 
 -- ============================================================================
 -- Slice.fill — overwrite every element with a clone of `v`
@@ -1054,10 +1059,10 @@ theorem Slice.mapM_spec {α β} {f : α → Result β} {s : Slice α} {post : Na
 @[rust_fun "core::slice::{[@T]}::fill"]
 def core.slice.Slice.fill {T : Type} (cloneInst : core.clone.Clone T)
     (s : Slice T) (v : T) : Result (Slice T) :=
-  (s.val.mapM (fun _ => cloneInst.clone v)).match_dep' (motive := fun _ => _)
-    (fun val h => .ok ⟨val, List.mapM_Result_length h ▸ s.property⟩)
-    (fun e _ => .fail e)
-    (fun _ => .div)
+  match h : (s.val.mapM (fun _ => cloneInst.clone v)).match with
+  | .ok val => .ok ⟨val, List.mapM_Result_length (by simp at h; apply h) ▸ s.property⟩
+  | .vis (.fail e) _ => .fail e
+  | .div => .div
 
 private theorem List.mapM_const_ok {T : Type} (l : List T)
     {g : Result T} {v : T} (hg : g = ok v) :
@@ -1081,6 +1086,6 @@ theorem core.slice.Slice.fill.spec {T : Type} (cloneInst : core.clone.Clone T)
   have hcl : cloneInst.clone v = ok v := by
     cases h : (cloneInst.clone v) <;> simp_all
   have hmapM := List.mapM_const_ok s.val hcl
-  simp [hmapM]
+  grind
 
 end Aeneas.Std
diff --git a/backends/lean/Aeneas/Std/SliceIter.lean b/backends/lean/Aeneas/Std/SliceIter.lean
index fae5c2994..26d9a6496 100644
--- a/backends/lean/Aeneas/Std/SliceIter.lean
+++ b/backends/lean/Aeneas/Std/SliceIter.lean
@@ -314,11 +314,9 @@ private def collectStepBy (sbi : core.iter.adapters.step_by.StepBy (core.slice.i
 
 -- step_by(0) panics
 #assert
-  -- TODO: once i fix the below ones by dealing with BEq, fix this one too.
-  (core.slice.iter.IteratorSliceIter.step_by (mkSliceIter [1, 2, 3]) 0#usize).match_dep
-  (fun _ => false)
-  (fun e => e == .panic)
-  (fun _ => false)
+  match (core.slice.iter.IteratorSliceIter.step_by (mkSliceIter [1, 2, 3]) 0#usize).match with
+  | .vis (.fail e) _ => e == panic
+  | _ => false
 
 -- step_by(1) returns all elements
 #assert (do
@@ -383,10 +381,9 @@ private def collectStepBy (sbi : core.iter.adapters.step_by.StepBy (core.slice.i
 
 -- Verify that step_by(0) on the generic Iterator.step_by.default also panics
 #assert
-  (core.iter.traits.iterator.Iterator.step_by.default (mkSliceIter [1]) 0#usize).match_dep
-    (fun _ => false)
-    (fun e => e == .panic)
-    (fun _ => false)
+  match (core.iter.traits.iterator.Iterator.step_by.default (mkSliceIter [1]) 0#usize).match with
+  | .vis (.fail e) _ => e == panic
+  | _ => false
 
 -- Nested step_by: step_by(2) then step_by(2) on [0..8] gives [0, 4]
 private def collectNestedStepBy
diff --git a/backends/lean/Aeneas/Std/Vec.lean b/backends/lean/Aeneas/Std/Vec.lean
index 3e5e42642..4abe71355 100644
--- a/backends/lean/Aeneas/Std/Vec.lean
+++ b/backends/lean/Aeneas/Std/Vec.lean
@@ -350,11 +350,13 @@ def alloc.vec.Vec.with_capacity (T : Type) (_ : Usize) : alloc.vec.Vec T := Vec.
 def alloc.vec.Vec.extend_from_slice {T : Type} (cloneInst : core.clone.Clone T)
   (v : alloc.vec.Vec T) (s : Slice T) : Result (alloc.vec.Vec T) :=
   if h : v.length + s.length ≤ Usize.max then do
-    (Slice.clone cloneInst.clone s).match_dep' (motive := fun _ => _)
-      (fun s' h' =>
-        ok ⟨ v.val ++ s'.val , by have := Slice.clone_length h'; scalar_tac ⟩)
-      (fun e _ => fail e)
-      (fun _ => div)
+    match h' : (Slice.clone cloneInst.clone s).match with
+    | .ok s' =>
+      ok ⟨ v.val ++ s'.val , by
+        simp at h'
+        have := Slice.clone_length h'
+        scalar_tac ⟩
+    | _ => Slice.clone cloneInst.clone s
   else fail .panic
 
 @[rust_fun "alloc::vec::{core::ops::deref::Deref<alloc::vec::Vec<@T>, [@T]>}::deref"
diff --git a/backends/lean/Aeneas/Std/WP.lean b/backends/lean/Aeneas/Std/WP.lean
index 174c9c41f..66677d62f 100644
--- a/backends/lean/Aeneas/Std/WP.lean
+++ b/backends/lean/Aeneas/Std/WP.lean
@@ -168,8 +168,11 @@ theorem spec_ok (x : α) : spec (ok x) p ↔ p x := by
     constructor
     assumption
 
+-- TODO: clean this up
+-- @[simp, grind =, agrind =]
+-- theorem spec_fail (e : Error) : spec (fail e) p ↔ False := by grind
 @[simp, grind =, agrind =]
-theorem spec_fail (e : Error) : spec (fail e) p ↔ False := by grind
+theorem spec_vis (e k) : spec (.vis e k) p ↔ False := by grind
 
 @[simp, grind =, agrind =]
 theorem spec_div : spec div p ↔ False := by grind
@@ -185,7 +188,7 @@ theorem spec_ok_pair {α β} (a : α) (b : β) (f : α → β → Prop) :
 
 @[simp, grind =, agrind =]
 theorem spec_fail_pair (e : Error) (f : α → β → Prop) :
-    spec (fail e) (uncurry f) ↔ False := by simp
+    spec (fail e) (uncurry f) ↔ False := by grind
 
 @[simp, grind =, agrind =]
 theorem spec_div_pair (f : α → β → Prop) :
diff --git a/backends/lean/Aeneas/Tactic/Step/Step.lean b/backends/lean/Aeneas/Tactic/Step/Step.lean
index 2438ffa8e..b387b2749 100644
--- a/backends/lean/Aeneas/Tactic/Step/Step.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Step.lean
@@ -65,7 +65,7 @@ want to introduce in the context -/
 theorem forall_unit {p : Prop} : (Unit → p) ↔ p := by simp
 
 attribute [step_simps]
-  bind_assoc Std.bind_tc_ok Std.bind_tc_fail Std.bind_tc_div
+  bind_assoc Std.bind_tc_ok Std.bind_tc_vis Std.bind_tc_div
   /- Those are quite useful to simplify the goal further by eliminating existential quantifiers for instance. -/
   and_assoc Std.Result.ok.injEq Prod.mk.injEq
   exists_eq_left exists_eq_left' exists_eq_right exists_eq_right' exists_eq exists_eq' true_and and_true

From 72f9852d85a184d40169ed5d985ed86b11f33523 Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Mon, 20 Jul 2026 13:26:46 -0400
Subject: [PATCH 60/67] fixed matches in tests

---
 tests/lean/Hashmap/Properties.lean |  7 +++----
 tests/lean/SpecTests/Coin.lean     | 10 +++-------
 2 files changed, 6 insertions(+), 11 deletions(-)

diff --git a/tests/lean/Hashmap/Properties.lean b/tests/lean/Hashmap/Properties.lean
index c0cb4d0d5..4d08f6d7e 100644
--- a/tests/lean/Hashmap/Properties.lean
+++ b/tests/lean/Hashmap/Properties.lean
@@ -29,10 +29,9 @@ namespace HashMap
 def distinct_keys (ls : List (Usize × α)) := ls.pairwise_rel (λ x y => x.fst ≠ y.fst)
 
 def hash_mod_key (k : Usize) (l : Nat) : Nat :=
-  (hash_key k).match_dep
-    (fun k => k.val % l)
-    (fun _ => 0)
-    (fun _ => 0)
+  match (hash_key k).match with
+  | .ok k => k.val % l
+  | _ => 0
 
 @[simp, scalar_tac_simps, grind =, agrind =]
 theorem hash_mod_key_eq : hash_mod_key k l = k.val % l := by
diff --git a/tests/lean/SpecTests/Coin.lean b/tests/lean/SpecTests/Coin.lean
index e63d5b64a..99435fdac 100644
--- a/tests/lean/SpecTests/Coin.lean
+++ b/tests/lean/SpecTests/Coin.lean
@@ -79,10 +79,9 @@ theorem coinSpec_bind {α β} {k : α -> ITreeC β} {Pₖ : Post β} {m : ITreeC
 
 instance : MonadLift Result ITreeC where
   monadLift r :=
-    r.match_dep
-      (fun a => .ret a)
-      (fun _e => .div) -- TODO
-      (fun _ => .div)
+  match r.match with
+  | .ok a => .ret a
+  | _ => .div -- TODO
 
 theorem spec_coinSpec {α} {x : Result α} {p: Post α} : spec x p → coinSpec p x := by
   intros s
@@ -107,8 +106,6 @@ def qimp_coinSpec_iff {α β} (P : α → Prop) (k : α → ITreeC β) (Q : β 
   qimp_coinSpec P k Q ↔ ∀ x, imp (P x) (coinSpec Q (k x)) := by
   simp [qimp_coinSpec, imp]
 
-#check CoInd.unfold
-
 @[simp, grind =, agrind =]
 theorem coinSpec_ret {α p} (x : α) : coinSpec p (ITree.ret x) ↔ p x := by
   constructor
@@ -168,7 +165,6 @@ theorem coinSpec_ret {α p} (x : α) : coinSpec p (ITree.ret x) ↔ p x := by
   def itreec : ITreeC Nat := res
 
 
-  #check I32.add_spec
   -- set_option trace.Step true
 
   -- theorem test : coinSpec (fun z => z.val == 6)

From fc93b20fc39d75acf5ab3475f62a6a7d643eb476 Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Mon, 20 Jul 2026 15:15:08 -0400
Subject: [PATCH 61/67] proofs work with any effects (hopefully)

---
 backends/lean/Aeneas/Std/Array/Core.lean      | 35 +++++++++++--------
 backends/lean/Aeneas/Std/Primitives.lean      | 18 +++++-----
 backends/lean/Aeneas/Std/RangeIter.lean       | 24 ++++++-------
 .../Aeneas/Std/Scalar/CheckedOps/Add.lean     |  4 +--
 .../Aeneas/Std/Scalar/CheckedOps/Mul.lean     |  4 +--
 .../Aeneas/Std/Scalar/CheckedOps/Sub.lean     |  4 +--
 backends/lean/Aeneas/Std/Scalar/Ops/Add.lean  | 21 ++++-------
 backends/lean/Aeneas/Std/Scalar/Ops/Mul.lean  | 23 +++++-------
 backends/lean/Aeneas/Std/Scalar/Ops/Sub.lean  | 15 +++-----
 backends/lean/Aeneas/Std/Slice.lean           |  7 ++--
 10 files changed, 74 insertions(+), 81 deletions(-)

diff --git a/backends/lean/Aeneas/Std/Array/Core.lean b/backends/lean/Aeneas/Std/Array/Core.lean
index 6a590ab8d..2363ec9a6 100644
--- a/backends/lean/Aeneas/Std/Array/Core.lean
+++ b/backends/lean/Aeneas/Std/Array/Core.lean
@@ -34,23 +34,28 @@ theorem List.mapM_clone_eq {T : Type u} {clone : T → Result T} {l : List T}
   apply h
 
 def List.clone (clone : α → Result α) (l : List α) : Result ({ l' : List α // l'.length = l.length}) :=
-  -- TODO: clean this up
-  -- match h :List.mapM clone l with
-  -- | ok v => ok ⟨ v, by have := List.mapM_Result_length h; scalar_tac ⟩
-  -- | fail e => fail e
-  -- | div => div
-  -- (List.mapM clone l).match_dep
-  -- Result.match_dep' (motive := fun l => _) (List.mapM clone l)
-  -- (fun v h => ok ⟨ v, by have := List.mapM_Result_length h; scalar_tac ⟩)
-  -- (fun e _h => fail e)
-  -- (fun _h => div)
   match h : (List.mapM clone l).match with
   | .ok v => ok ⟨ v, by
-    cases h2 : List.mapM clone l <;> simp_all
-    have := List.mapM_Result_length h2
-    scalar_tac ⟩
-  | .vis (.fail e) _ => fail e
-  | .div => div
+    simp at h
+    have := List.mapM_Result_length h
+    assumption⟩
+  -- TODO: is this acceptable?
+  | .vis _ _ => .fail .panic
+  | .div => .div
+  -- match h : (List.mapM clone l).match with
+  -- | .ok v => ok ⟨ v, by
+  --   simp at h
+  --   have := List.mapM_Result_length h
+  --   assumption⟩
+  -- | .vis e k => by
+  --     -- .vis e k
+  --     simp at h
+  --     simp [List.mapM] at h
+  --     simp [List.mapM.loop] at h
+  --     sorry
+  -- | .div => div
+  -- -- | _ => by
+  -- --   sorry
 
 @[step]
 def List.clone_spec {clone : α → Result α} {l : List α} (h : ∀ x ∈ l, clone x = ok x) :
diff --git a/backends/lean/Aeneas/Std/Primitives.lean b/backends/lean/Aeneas/Std/Primitives.lean
index 22abfdd12..c6bffed56 100644
--- a/backends/lean/Aeneas/Std/Primitives.lean
+++ b/backends/lean/Aeneas/Std/Primitives.lean
@@ -58,12 +58,12 @@ open Error
 
 inductive RustEffect.I : Type where
 | fail : Error → RustEffect.I
--- | test_effect : RustEffect.I
+| test_effect : RustEffect.I
 
 def RustEffect.O (i : RustEffect.I) : Type :=
   match i with
   | .fail _ => PEmpty
-  -- | .test_effect => PUnit
+  | .test_effect => PUnit
 
 def RustEffect : Effect := {
   I := RustEffect.I
@@ -160,6 +160,12 @@ theorem Result.match.div {α : Type u} : Result.div.match = @MatchResult.div α
 @[simp]
 theorem Result.match.is_ok {α : Type u} {a : α} {r : Result α} : (r.match = .ok a) ↔ r = .ok a := by
   cases r <;> grind
+@[simp]
+theorem Result.match.is_vis {α : Type u} {e k} {r : Result α} : (r.match = .vis e k) ↔ r = .vis e k := by
+  cases r <;> grind
+@[simp]
+theorem Result.match.is_div {α : Type u} {r : Result α} : (r.match = .div) ↔ r = .div := by
+  cases r <;> grind
 
 -- -- Before ITrees, Result was an inductive with ok, div, and fail cases only.
 -- -- this function can be used in many cases to replace pattern matching on that inductive:
@@ -298,9 +304,7 @@ def Result.ofOption {a : Type u} (x : Option a) (e : Error) : Result a :=
 --      contradiction
 @[simp] theorem bind_vis (e k) (f : α → Result β) : bind (.vis e k) f = .vis e (fun x => bind (k x) f) :=
   by simp [bind, vis]
-     apply congrArg
-     funext x
-     contradiction
+     rfl
 
 @[simp] theorem bind_div (f : α → Result β) : bind .div f = .div := by simp [bind, div]
 
@@ -317,9 +321,7 @@ def Result.ofOption {a : Type u} (x : Option a) (e : Error) : Result a :=
 @[simp] theorem bind_tc_vis (e k) (f : α → Result β) :
   (do let y ← Result.vis e k; f y) = .vis e (fun x => do let y ← k x; f y) := by
   simp [bind, Bind.bind, vis]
-  apply congrArg
-  funext x
-  contradiction
+  rfl
 
 @[simp] theorem bind_tc_div (f : α → Result β) :
   (do let y ← div; f y) = div := by simp [bind, Bind.bind, div]
diff --git a/backends/lean/Aeneas/Std/RangeIter.lean b/backends/lean/Aeneas/Std/RangeIter.lean
index 6146ec9e0..02e5bb79e 100644
--- a/backends/lean/Aeneas/Std/RangeIter.lean
+++ b/backends/lean/Aeneas/Std/RangeIter.lean
@@ -358,12 +358,13 @@ theorem core.iter.adapters.enumerate.IteratorEnumerate.next_some_spec
   intro ⟨opt, it⟩ ⟨hopt, hit⟩
   subst hopt; subst hit
   have hadd := @UScalar.add_equiv UScalarTy.Usize self.count (1#usize)
-  generalize hval : self.count + 1#usize = val at hadd
-  cases val <;> simp at *
-  · rename_i z
+  split at hadd
+  · rename_i z heq
+    simp at heq
     obtain ⟨_, hval, _⟩ := hadd
-    simp [hval]
-  · exfalso; scalar_tac
+    simp [heq, bind_tc_ok, spec_ok, uncurry', hval]
+  · exfalso; simp [UScalar.inBounds] at hadd; scalar_tac
+  · exact hadd.elim
 
 /-- `Enumerate.next` — none case.  No `@[step]` — see the merged `next_spec`.
     When the inner iterator yields `none`, enumerate propagates none. -/
@@ -448,14 +449,13 @@ theorem core.iter.adapters.take.IteratorTake.next_ChunksExact_spec {T : Type}
     simp only [core.slice.iter.IteratorChunksExact.next]
     have hsub : ∃ z, iter.n - 1#usize = ok z ∧ z.val = iter.n.val - 1 := by
       have h := @UScalar.sub_equiv .Usize iter.n (1#usize)
-      generalize hval : iter.n - 1#usize = val at h
-      cases val
-      -- split at h
-      next z =>
+      split at h
+      next z heq =>
         obtain ⟨_, hval, _⟩ := h
-        exact ⟨z, rfl, by scalar_tac⟩
-      next =>
-        exfalso; simp at h; scalar_tac
+        simp at heq
+        exact ⟨z, heq, by scalar_tac⟩
+      next heq =>
+        exfalso; scalar_tac
       next => exact h.elim
     obtain ⟨z, hsub_eq, hzval⟩ := hsub
     simp only [hsub_eq, bind_tc_ok]
diff --git a/backends/lean/Aeneas/Std/Scalar/CheckedOps/Add.lean b/backends/lean/Aeneas/Std/Scalar/CheckedOps/Add.lean
index 8bf6c9a9d..3fff9a7dd 100644
--- a/backends/lean/Aeneas/Std/Scalar/CheckedOps/Add.lean
+++ b/backends/lean/Aeneas/Std/Scalar/CheckedOps/Add.lean
@@ -35,7 +35,7 @@ theorem core.num.checked_add_UScalar_bv_spec {ty} (x y : UScalar ty) :
   have h := UScalar.add_equiv x y
   have hAdd : x + y = UScalar.add x y := by rfl
   rw [hAdd] at h
-  cases hEq : UScalar.add x y <;> simp_all [Option.ofResult, checked_add_UScalar, UScalar.max] <;>
+  split at h <;> simp_all [Option.ofResult, checked_add_UScalar, UScalar.max] <;>
   (have : 0 < 2^ty.numBits := by simp) <;>
   omega
 
@@ -58,7 +58,7 @@ theorem core.num.checked_add_IScalar_bv_spec {ty} (x y : IScalar ty) :
   have h := IScalar.add_equiv x y
   have hAdd : x + y = IScalar.add x y := by rfl
   rw [hAdd] at h
-  cases hEq : IScalar.add x y <;> simp_all [Option.ofResult, checked_add_IScalar, IScalar.min, IScalar.max] <;>
+  split at h <;> simp_all [Option.ofResult, checked_add_IScalar, IScalar.min, IScalar.max] <;>
   omega
 
 iscalar @[step_pure «%S».checked_add x y]
diff --git a/backends/lean/Aeneas/Std/Scalar/CheckedOps/Mul.lean b/backends/lean/Aeneas/Std/Scalar/CheckedOps/Mul.lean
index 45988ed41..cd90a6e61 100644
--- a/backends/lean/Aeneas/Std/Scalar/CheckedOps/Mul.lean
+++ b/backends/lean/Aeneas/Std/Scalar/CheckedOps/Mul.lean
@@ -34,7 +34,7 @@ theorem core.num.checked_mul_UScalar_bv_spec {ty} (x y : UScalar ty) :
   | none => UScalar.max ty < x.val * y.val := by
   have h := UScalar.mul_equiv x y
   simp [checked_mul_UScalar]
-  cases hEq : UScalar.mul x y <;> simp_all [Option.ofResult]
+  split at h <;> simp_all [Option.ofResult]
 
 uscalar @[step_pure «%S».checked_mul x y]
 theorem «%S».checked_mul_bv_spec (x y : «%S») :
@@ -54,7 +54,7 @@ theorem core.num.checked_mul_IScalar_bv_spec {ty} (x y : IScalar ty) :
   | none => ¬ (IScalar.min ty ≤ x.val * y.val ∧ x.val * y.val ≤ IScalar.max ty) := by
   have h := IScalar.mul_equiv x y
   simp [checked_mul_IScalar]
-  cases hEq : IScalar.mul x y <;> simp_all [Option.ofResult]
+  split at h <;> simp_all [Option.ofResult]
 
 iscalar @[step_pure «%S».checked_mul x y]
 theorem «%S».checked_mul_bv_spec (x y : «%S») :
diff --git a/backends/lean/Aeneas/Std/Scalar/CheckedOps/Sub.lean b/backends/lean/Aeneas/Std/Scalar/CheckedOps/Sub.lean
index 8e7a316fc..7b05b8c4b 100644
--- a/backends/lean/Aeneas/Std/Scalar/CheckedOps/Sub.lean
+++ b/backends/lean/Aeneas/Std/Scalar/CheckedOps/Sub.lean
@@ -35,7 +35,7 @@ theorem core.num.checked_sub_UScalar_bv_spec {ty} (x y : UScalar ty) :
   have h := UScalar.sub_equiv x y
   have hsub : x - y = UScalar.sub x y := by rfl
   rw [hsub] at h
-  cases hEq : UScalar.sub x y <;> simp_all [Option.ofResult, checked_sub_UScalar]
+  split at h <;> simp_all [Option.ofResult, checked_sub_UScalar]
 
 uscalar @[step_pure «%S».checked_sub x y]
 theorem «%S».checked_sub_bv_spec (x y : «%S») :
@@ -56,7 +56,7 @@ theorem core.num.checked_sub_IScalar_bv_spec {ty} (x y : IScalar ty) :
   have h := IScalar.sub_equiv x y
   have hsub : x - y = IScalar.sub x y := by rfl
   rw [hsub] at h
-  cases hEq : IScalar.sub x y <;> simp_all [Option.ofResult, checked_sub_IScalar, IScalar.min, IScalar.max] <;>
+  split at h <;> simp_all [Option.ofResult, checked_sub_IScalar, IScalar.min, IScalar.max] <;>
   (have : 0 < 2^ty.numBits := by simp) <;>
   omega
 
diff --git a/backends/lean/Aeneas/Std/Scalar/Ops/Add.lean b/backends/lean/Aeneas/Std/Scalar/Ops/Add.lean
index dd4914491..8a2701f7a 100644
--- a/backends/lean/Aeneas/Std/Scalar/Ops/Add.lean
+++ b/backends/lean/Aeneas/Std/Scalar/Ops/Add.lean
@@ -46,10 +46,7 @@ theorem UScalar.add_equiv {ty} (x y : UScalar ty) :
   simp [add]
   have h := tryMk_eq ty (↑x + ↑y)
   simp [inBounds] at h
-  generalize valh : (tryMk ty (↑x + ↑y)) = val at h
-  cases val <;> simp_all
-  -- TODO: using my registered MatcherInfo, currently this sort of works but needs the generalize for some reason
-  -- split at h <;> simp_all
+  split at h <;> simp_all
   zify; simp
   zify at h
   have := @Int.emod_eq_of_lt (x.val + y.val) (2^ty.numBits) (by omega) (by omega)
@@ -68,8 +65,7 @@ theorem IScalar.add_equiv {ty} (x y : IScalar ty) :
   simp [add]
   have h := tryMk_eq ty (↑x + ↑y)
   simp [inBounds] at h
-  generalize valh : (tryMk ty (↑x + ↑y)) = val at h
-  cases val <;> simp_all
+  split at h <;> simp_all
   apply BitVec.eq_of_toInt_eq
   simp
   have := bmod_pow_numBits_eq_of_lt ty (x.val + y.val) (by omega) (by omega)
@@ -85,8 +81,7 @@ theorem UScalar.add_bv_spec {ty} {x y : UScalar ty}
   (hmax : ↑x + ↑y ≤ UScalar.max ty) :
   x + y ⦃ z => (↑z : Nat) = ↑x + ↑y ∧ z.bv = x.bv + y.bv ⦄ := by
   have h := @add_equiv ty x y
-  generalize hval : (x + y) = val at h
-  cases val <;> simp_all [max]
+  split at h <;> simp_all [max]
   have : 0 < 2^ty.numBits := by simp
   omega
 
@@ -96,8 +91,8 @@ theorem IScalar.add_bv_spec {ty}  {x y : IScalar ty}
   (hmax : ↑x + ↑y ≤ IScalar.max ty) :
   x + y ⦃ z => (↑z : Int) = ↑x + ↑y ∧ z.bv = x.bv + y.bv ⦄ := by
   have h := @add_equiv ty x y
-  generalize hval : (x + y) = val at h
-  cases val <;> simp_all [min, max]
+  split at h <;> simp_all [min, max]
+  have : 0 < 2^ty.numBits := by simp
   omega
 
 uscalar theorem «%S».add_bv_spec {x y : «%S»} (hmax : x.val + y.val ≤ «%S».max) :
@@ -121,8 +116,7 @@ theorem UScalar.add_spec {ty} {x y : UScalar ty}
   (hmax : ↑x + ↑y ≤ UScalar.max ty) :
   x + y ⦃ z => (↑z : Nat) = ↑x + ↑y ⦄ := by
   have h := @add_equiv ty x y
-  generalize hval : (x + y) = val at h
-  cases val <;> simp_all [max]
+  split at h <;> simp_all [max]
   have : 0 < 2^ty.numBits := by simp
   omega
 
@@ -133,8 +127,7 @@ theorem IScalar.add_spec {ty} {x y : IScalar ty}
   (hmax : ↑x + ↑y ≤ IScalar.max ty) :
   x + y ⦃ z => (↑z : Int) = ↑x + ↑y ⦄ := by
   have h := @add_equiv ty x y
-  generalize hval : (x + y) = val at h
-  cases val <;> simp_all [min, max]
+  split at h <;> simp_all [min, max]
   omega
 
 uscalar @[step] theorem «%S».add_spec {x y : «%S»} (hmax : x.val + y.val ≤ «%S».max) :
diff --git a/backends/lean/Aeneas/Std/Scalar/Ops/Mul.lean b/backends/lean/Aeneas/Std/Scalar/Ops/Mul.lean
index 9cca50923..fdfcb200b 100644
--- a/backends/lean/Aeneas/Std/Scalar/Ops/Mul.lean
+++ b/backends/lean/Aeneas/Std/Scalar/Ops/Mul.lean
@@ -43,20 +43,17 @@ theorem UScalar.mul_equiv {ty} (x y : UScalar ty) :
   match (mul x y).match with
   | .ok z => x.val * y.val ≤ UScalar.max ty ∧ (↑z : Nat) = ↑x * ↑y ∧ z.bv = x.bv * y.bv
   | .vis (.fail _) _ => UScalar.max ty < x.val * y.val
-  | .div => False := by
+  | _ => False := by
   simp only [mul]
   have := tryMk_eq ty (x.val * y.val)
-  generalize hval : tryMk ty (↑x * ↑y) = val at this
-  cases val <;> simp_all [inBounds, true_and, not_lt, gt_iff_lt, «match».ok]
-  simp_all only [tryMk, ofOption, tryMkOpt, check_bounds, decide_true, dite_true, ok.injEq]
-  rename_i hEq; simp only [← hval, ofNatCore, val]
+  split <;> simp_all only [inBounds, true_and, not_lt, gt_iff_lt]
+  simp_all only [tryMk, ofOption, tryMkOpt, check_bounds, decide_true, dite_true]
+  rename_i hEq; simp only [← hEq, ofNatCore, val] at *
   split_conjs
   . simp only [bv_toNat, max]; omega
-  . zify at this; zify; simp only [bv_toNat, BitVec.toNat_ofFin, Nat.cast_mul, BitVec.toNat_mul,
+  . zify at this; zify; simp only [bv_toNat, BitVec.toNat_mul,
     Int.natCast_emod, Nat.cast_pow, Nat.cast_ofNat] at *
-    rw [Int.emod_eq_of_lt]
-    . apply Int.pos_mul_pos_is_pos <;> simp
-    . simp only [this]
+    rw [Int.emod_eq_of_lt] <;> grind
   . have : 0 < 2^ty.numBits := by simp
     simp only [max, gt_iff_lt]
     omega
@@ -67,15 +64,14 @@ theorem UScalar.mul_bv_spec {ty} {x y : UScalar ty}
   x * y ⦃ z => (↑z : Nat) = ↑x * ↑y ∧ z.bv = x.bv * y.bv ⦄ := by
   have : x * y = mul x y := by rfl
   have := mul_equiv x y
-  generalize hval : x.mul y = val at this
-  cases val <;> simp_all [spec_ok, and_self, spec_vis]
+  split at this <;> simp_all [spec_ok, and_self, spec_vis]
   omega
 
 theorem IScalar.mul_equiv {ty} (x y : IScalar ty) :
   match (mul x y).match with
   | .ok z => IScalar.min ty ≤ x.val * y.val ∧ x.val * y.val ≤ IScalar.max ty ∧ z.val = x.val * y.val ∧ z.bv = x.bv * y.bv
   | .vis (.fail _) _ => ¬(IScalar.min ty ≤ x.val * y.val ∧ x.val * y.val ≤ IScalar.max ty)
-  | .div => False := by
+  | _ => False := by
   simp only [mul, not_and, not_le]
   have := tryMk_eq ty (x.val * y.val)
   split <;> simp_all only [inBounds, min, max, true_and, not_and, not_lt] <;>
@@ -120,8 +116,7 @@ theorem IScalar.mul_bv_spec {ty} {x y : IScalar ty}
   x * y ⦃ z => (↑z : Int) = ↑x * ↑y ∧ z.bv = x.bv * y.bv ⦄ := by
   have : x * y = mul x y := by rfl
   have := mul_equiv x y
-  generalize hvalue : x.mul y = value at this
-  cases value <;> simp_all
+  split at this <;> simp_all [spec_ok, and_self]
 
 uscalar theorem «%S».mul_bv_spec {x y : «%S»} (hmax : x.val * y.val ≤ «%S».max) :
   x * y ⦃ z => (↑z : Nat) = ↑x * ↑y ∧ z.bv = x.bv * y.bv ⦄ :=
diff --git a/backends/lean/Aeneas/Std/Scalar/Ops/Sub.lean b/backends/lean/Aeneas/Std/Scalar/Ops/Sub.lean
index 4772ca22c..712e6e5c3 100644
--- a/backends/lean/Aeneas/Std/Scalar/Ops/Sub.lean
+++ b/backends/lean/Aeneas/Std/Scalar/Ops/Sub.lean
@@ -92,8 +92,7 @@ theorem IScalar.sub_equiv {ty} (x y : IScalar ty) :
   simp [this, sub]
   have h := tryMk_eq ty (↑x - ↑y)
   simp [inBounds] at h
-  generalize valh : (tryMk ty (↑x - ↑y)) = val at h
-  cases val <;> simp_all
+  split at h <;> simp_all
   apply BitVec.eq_of_toInt_eq
   simp
   have := bmod_pow_numBits_eq_of_lt ty (x.val - y.val) (by omega) (by omega)
@@ -108,8 +107,7 @@ theorem UScalar.sub_bv_spec {ty} {x y : UScalar ty}
   (h : y.val ≤ x.val) :
   x - y ⦃ z => z.val = x.val - y.val ∧ y.val ≤ x.val ∧ z.bv = x.bv - y.bv ⦄ := by
   have h := @sub_equiv ty x y
-  generalize hval : x - y = val at h
-  cases val <;> simp_all
+  split at h <;> simp_all
   omega
 
 /- Generic theorem - shouldn't be used much -/
@@ -118,8 +116,7 @@ theorem IScalar.sub_bv_spec {ty} {x y : IScalar ty}
   (hmax : ↑x - ↑y ≤ IScalar.max ty) :
   x - y ⦃ z => (↑z : Int) = ↑x - ↑y ∧ z.bv = x.bv - y.bv ⦄ := by
   have h := @sub_equiv ty x y
-  generalize hval : x - y = val at h
-  cases val <;> simp_all [min, max]
+  split at h <;> simp_all [min, max]
   omega
 
 uscalar theorem «%S».sub_bv_spec {x y : «%S»} (h : y.val ≤ x.val) :
@@ -141,8 +138,7 @@ theorem UScalar.sub_spec {ty} {x y : UScalar ty}
   (h : y.val ≤ x.val) :
   x - y ⦃ z => z.val = x.val - y.val ∧ y.val ≤ x.val ⦄ := by
   have h := @sub_equiv ty x y
-  generalize hval : x - y = val at h
-  cases val <;> simp_all
+  split at h <;> simp_all
   omega
 
 /- Generic theorem - shouldn't be used much -/
@@ -152,8 +148,7 @@ theorem IScalar.sub_spec {ty} {x y : IScalar ty}
   (hmax : ↑x - ↑y ≤ IScalar.max ty) :
   x - y ⦃ z => (↑z : Int) = ↑x - ↑y ⦄ := by
   have h := @sub_equiv ty x y
-  generalize hval : x - y = val at h
-  cases val <;> simp_all [min, max]
+  split at h <;> simp_all [min, max]
   omega
 
 uscalar @[step] theorem «%S».sub_spec {x y : «%S»} (h : y.val ≤ x.val) :
diff --git a/backends/lean/Aeneas/Std/Slice.lean b/backends/lean/Aeneas/Std/Slice.lean
index d9190eabb..1753aeec4 100644
--- a/backends/lean/Aeneas/Std/Slice.lean
+++ b/backends/lean/Aeneas/Std/Slice.lean
@@ -1012,7 +1012,9 @@ theorem core.slice.Slice.copy_from_slice.step_spec (copyInst : core.marker.Copy
 def Slice.mapM  {α β} (f : α → Result β) (x : Slice α) : Result (Slice β) :=
   match h : (x.val.mapM f).match with
   | .ok xs  => ok ⟨xs, List.mapM_Result_length (by simp at h; apply h) ▸ x.prop⟩
-  | .vis (.fail e) _ => fail e
+  -- | .vis (.fail e) _ => fail e
+  -- TODO: is this ok?
+  | .vis _ _ => .fail .panic
   | .div    => div
 
 @[step]
@@ -1061,7 +1063,8 @@ def core.slice.Slice.fill {T : Type} (cloneInst : core.clone.Clone T)
     (s : Slice T) (v : T) : Result (Slice T) :=
   match h : (s.val.mapM (fun _ => cloneInst.clone v)).match with
   | .ok val => .ok ⟨val, List.mapM_Result_length (by simp at h; apply h) ▸ s.property⟩
-  | .vis (.fail e) _ => .fail e
+  -- TODO: is this ok?
+  | .vis _ _ => .fail .panic
   | .div => .div
 
 private theorem List.mapM_const_ok {T : Type} (l : List T)

From 64cbe6239dfbcd44fdea4d2169dd23e274e1441f Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Mon, 20 Jul 2026 15:29:28 -0400
Subject: [PATCH 62/67] delete test effect

---
 backends/lean/Aeneas/Std/Primitives.lean | 2 --
 1 file changed, 2 deletions(-)

diff --git a/backends/lean/Aeneas/Std/Primitives.lean b/backends/lean/Aeneas/Std/Primitives.lean
index c6bffed56..aa3744b48 100644
--- a/backends/lean/Aeneas/Std/Primitives.lean
+++ b/backends/lean/Aeneas/Std/Primitives.lean
@@ -58,12 +58,10 @@ open Error
 
 inductive RustEffect.I : Type where
 | fail : Error → RustEffect.I
-| test_effect : RustEffect.I
 
 def RustEffect.O (i : RustEffect.I) : Type :=
   match i with
   | .fail _ => PEmpty
-  | .test_effect => PUnit
 
 def RustEffect : Effect := {
   I := RustEffect.I

From e5f73a971877d751be170af79bc376c1a15236f8 Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Wed, 22 Jul 2026 13:13:52 -0400
Subject: [PATCH 63/67] clean up comments and old code

---
 .../lean/Aeneas/Data/Coinductive/CoInd.lean   |   4 +
 .../lean/Aeneas/Data/Coinductive/ITree.lean   | 204 ++----------------
 backends/lean/Aeneas/Data/Coinductive/README  |   4 +-
 backends/lean/Aeneas/Std/Array/Array.lean     |   2 +-
 backends/lean/Aeneas/Std/Array/Core.lean      |  15 --
 backends/lean/Aeneas/Std/Primitives.lean      | 121 +----------
 backends/lean/Aeneas/Std/Scalar/Core.lean     |  47 ----
 backends/lean/Aeneas/Std/Scalar/Ops/Neg.lean  |   3 +-
 backends/lean/Aeneas/Std/Slice.lean           |   3 -
 backends/lean/Aeneas/Std/WP.lean              |  49 -----
 src/extract/Extract.ml                        |   5 -
 11 files changed, 32 insertions(+), 425 deletions(-)

diff --git a/backends/lean/Aeneas/Data/Coinductive/CoInd.lean b/backends/lean/Aeneas/Data/Coinductive/CoInd.lean
index ed879fa4f..595b369e8 100644
--- a/backends/lean/Aeneas/Data/Coinductive/CoInd.lean
+++ b/backends/lean/Aeneas/Data/Coinductive/CoInd.lean
@@ -1,3 +1,7 @@
+/-
+This file is adaped from https://github.com/ISTA-PLV/coinductive/tree/main,
+see README in this folder.
+-/
 namespace Aeneas.Data.Coinductive
 
 @[expose] public section
diff --git a/backends/lean/Aeneas/Data/Coinductive/ITree.lean b/backends/lean/Aeneas/Data/Coinductive/ITree.lean
index 78bc46d04..372af99a3 100644
--- a/backends/lean/Aeneas/Data/Coinductive/ITree.lean
+++ b/backends/lean/Aeneas/Data/Coinductive/ITree.lean
@@ -1,4 +1,7 @@
--- TODO: can we make this a non-public import and hide all CoInd things from clients of this?
+/-
+This file is adaped from https://github.com/ISTA-PLV/coinductive/tree/main,
+see README in this folder.
+-/
 import Aeneas.Data.Coinductive.CoInd
 import Aeneas.Data.Coinductive.Effect
 
@@ -6,7 +9,7 @@ namespace Aeneas.Data.Coinductive
 
 open Lean.Order
 
--- compared to the original version at https://github.com/ISTA-PLV/coinductive/tree/main
+-- compared to the original version
 -- which uses the traditional tau constructor, this version instead has a bottom element
 -- div. tau is not needed to guard recursion, since we are using partial_fixpoint
 -- instead of coinduction.
@@ -48,11 +51,8 @@ def ITree.div : ITree E R := ITree.fold .div
 def ITree.vis (i : E.I) (k : E.O i → ITree E R) : ITree E R := ITree.fold (.vis i k)
 def ITree.unfold (t : ITree E R) : ITreeF E R (ITree E R) := CoInd.unfold _ t
 
-/- Ideally everything above this would be automatically generated -/
-
 instance : Inhabited (ITreeF E R PUnit) where default := .div
 
--- TODO: are all these little simp theorems every used or needed?
 @[simp]
 theorem ITree.unfold_fold (t : ITree E R) :
   ITree.fold (ITree.unfold t) = t := by simp [ITree.fold, ITree.unfold]
@@ -158,7 +158,6 @@ theorem ITree.le_unfold (t1 t2 : ITree E R) :
         constructor <;> try rfl
         grind
 
--- use Bind.bind instead
 def ITree.bind.{w} {S : Type w} (t1 : ITree E R) (t2 : R → ITree E S) :=
   match t1.unfold with
   | .ret r => t2 r
@@ -289,48 +288,10 @@ def ITree.iter {α : Type a} {β : Type b} (t : α → ITree E (α ⊕ β)) : α
     | .inr b => return b
 partial_fixpoint
 
--- TODO: do we need interp?
--- def ITree.interp {F : Effect.{w}} (f : (i : E.I) → ITree F (E.O i)) : ITree E R → ITree F R :=
---   ITree.iter λ t =>
---     match t.unfold with
---     | .ret r => return (.inr r)
---     | .div => ITree.div
---     -- | .vis i k => f i >>= λ o => return (.inl (k o))
---     | .vis i k => bind (f i) λ o => return (.inl (k o))
-
--- @[simp]
--- theorem interp_pure {F} (f : (i : E.I) → ITree F (E.O i)) (r : R) :
---   ITree.interp f (pure r) = pure r := by
---     unfold ITree.interp ITree.iter ITree.bind
---     simp
-
--- @[simp]
--- theorem interp_div {F} (f : (i : E.I) → ITree F (E.O i)) :
---   ITree.interp (R:=R) f .div = .div := by
---     unfold ITree.interp
---     rw (occs := [1]) [ITree.iter]
---     simp
-
--- -- #synth LawfulMonad (ITree E)
--- -- #check instLawfulMonadITree.bind_assoc
--- @[simp]
--- theorem interp_vis {F : Effect.{v}} (f : (i : E.I) → ITree F (E.O i)) i (k : E.O i → ITree E R) :
---   ITree.interp f (ITree.vis i k) = (f i) >>= (λ o => (ITree.interp f (k o))) := by
---     unfold ITree.interp
---     rw (occs := [1]) [ITree.iter]
---     simp
---     rw [instLawfulMonadITree.bind_assoc]
---     simp [(Eq.refl _ : ITree.bind = Bind.bind)]
---     rw [bind_assoc]
-    --
-
--- #synth CCPO (ITree E R)
--- #synth MonoBind (ITree E)
--- #synth Bind (ITree E)
-
--- TODO: These have been added on top of original library. I'm not sure if there's a better
--- way to do this yet.
+-- NOTE: the original library had a function ITree.interp, which could handle converting an ITree from
+-- on set of Effects to another. If we need this, recover it from the original library.
 
+-- These simp theorems are not present in the original library
 @[simp, grind .]
 theorem not_vis_ret {E} {α} {x : α} {e k} : ¬ ITree.ret (E := E) x = ITree.vis e k := by
   intros eq
@@ -365,164 +326,23 @@ theorem vis_inj_effect {E} {α} {e1 e2 k1 k2} : @ITree.vis α E e1 k1 = ITree.vi
   simp at eq
   grind
 
-
--- TODO: probably dont need this:
-def Eqrec3.{w, u_1} {α : Sort u_1} {a' : α} {motive : (a : α) → a' = a → Sort w}
-  {a'1 : α}
-  (t : a' = a'1)
-  (refl : motive a'1 t)
-  :
-  motive a' (Eq.refl a')
-  := by
-  subst t
-  apply refl
-
--- theorems to make ITree.cases actually compute with simp
+-- theorems to make ITree.cases compute:
 @[simp]
 theorem ITree.cases.ret {E R motive r d v x}
-  : @ITree.cases E R motive r d v (.ret x) = r x := by
-  simp [cases]
-  -- simp [ITree.ret] -- uncomment to see where the rewrite target is supposed to be in the goal
-  have to_rewrite_by : (fold (ITreeF.ret x)).unfold = ITreeF.ret x
-    := fold_unfold (ITreeF E R) (ITreeF.ret x)
-  -- rw [to_rewrite_by] -- we want to do this.... but we are in transport hell!
-  let rwmotive : (i : ITreeF E R (ITree E R)) -> (eq : (fold (ITreeF.ret x)).unfold = i)
-    -> Prop := fun i eq =>
-      ITreeF.rec (motive := fun t => (fold (ITreeF.ret x)).unfold = t → motive (fold (ITree.ret x).unfold))
-        (fun r_1 h => cast (by simp [fold, unfold] at h; rw[unfold_fold]; simp[pure, *] ) (r r_1))
-        (fun h => cast (by contradiction) d)
-        (fun i k h => cast (by contradiction) (v i k)) i eq = r x
-  refine @Eq.rec _ (ITreeF.ret x) rwmotive ?_ _ (Eq.symm to_rewrite_by)
-  unfold rwmotive
-  simp [cast]
+  : @ITree.cases E R motive r d v (.ret x) = r x := by cbv
 
 @[simp]
 theorem ITree.cases.div {E R motive r d v}
-  : @ITree.cases E R motive r d v .div = d := by
-  simp [cases]
-  -- simp [ITree.div] -- uncomment to see where the rewrite target is supposed to be in the goal
-  have to_rewrite_by : (fold ITreeF.div).unfold = ITreeF.div
-    := fold_unfold (ITreeF E R) (ITreeF.div)
-  -- rw [to_rewrite_by] -- we want to do this.... but we are in transport hell!
-  let rwmotive : (i : ITreeF E R (ITree E R)) -> (eq : (fold ITreeF.div).unfold = i)
-    -> Prop := fun i eq =>
-      ITreeF.rec (motive := fun t => (fold ITreeF.div).unfold = t → motive (fold ITree.div.unfold))
-        (fun r_1 h => cast (by contradiction) (r r_1))
-        (fun h => cast (by simp [fold, unfold]) d)
-        (fun i k h => cast (by contradiction) (v i k)) i eq = d
-  refine @Eq.rec _ ITreeF.div rwmotive ?_ _ (Eq.symm to_rewrite_by)
-  unfold rwmotive
-  simp [cast]
+  : @ITree.cases E R motive r d v .div = d := by cbv
 
 @[simp]
 theorem ITree.cases.vis {E R motive r d v e k}
-  : @ITree.cases E R motive r d v (.vis e k) = v e k := by
-  simp [cases]
-  -- simp [ITree.vis] -- uncomment to see where the rewrite target is supposed to be in the goal
-  have to_rewrite_by : (fold (ITreeF.vis e k)).unfold = ITreeF.vis e k
-    := fold_unfold (ITreeF E R) (ITreeF.vis e k)
-  -- rw [to_rewrite_by] -- we want to do this.... but we are in transport hell!
-  let rwmotive : (i : ITreeF E R (ITree E R)) -> (eq : (fold (ITreeF.vis e k)).unfold = i)
-    -> Prop := fun i eq =>
-      ITreeF.rec (motive := fun t => (fold (ITreeF.vis e k)).unfold = t → motive (fold (ITree.vis e k).unfold))
-        (fun r_1 h => cast (by contradiction) (r r_1))
-        (fun h => cast (by contradiction) d)
-        (fun i k h => cast (by simp [fold, unfold] at h; rw [unfold_fold]; grind) (v i k)) i eq = v e k
-  refine @Eq.rec _ (ITreeF.vis e k) rwmotive ?_ _ (Eq.symm to_rewrite_by)
-  unfold rwmotive
-  simp [cast]
-
--- TODO: delete non-dependent eliminator if we indeed don't need it
--- -- @[cases_eliminator]
--- def ITree.reccases {E : Effect.{u}} {R}
---     {Out : Sort v}
---     (ret : R → Out)
---     (div : Out)
---     (vis : (i : E.I) → (k : E.O i → ITree E R) → Out)
---     (t : ITree E R) : Out := by
---     -- rw [<-ITree.unfold_fold t]
---     cases t.unfold with
---     | ret x => apply ret x
---     | div => apply div
---     | vis e k => apply vis e k
-
--- #check ITreeF.rec
-
--- @[simp]
--- theorem ITree.reccases.ret {E R motive r d v x}
---   : @ITree.reccases E R motive r d v (.ret x) = r x := by
---   simp [reccases]
---   simp [ITree.ret]
---   have to_rewrite_by : (fold (ITreeF.ret x)).unfold = ITreeF.ret x
---     := fold_unfold (ITreeF E R) (ITreeF.ret x)
---   -- rw [to_rewrite_by] -- we want to do this.... but we are in transport hell!
---   let rwmotive : (i : ITreeF E R (ITree E R)) -> (eq : (fold (ITreeF.ret x)).unfold = i)
---     -> Prop := fun i eq =>
---       ITreeF.rec (motive := fun t => (fold (ITreeF.ret x)).unfold = t → motive)
---         (fun r_1 h => r r_1) (fun h => d)
---         (fun i k h => v i k) i eq = r x
---   refine @Eq.rec _ (ITreeF.ret x) rwmotive ?_ _ (Eq.symm to_rewrite_by)
---   unfold rwmotive
---   simp
-
--- @[simp]
--- theorem ITree.reccases.div {E R motive r d v}
---   : @ITree.reccases E R motive r d v .div = d := by
---   -- simp [ITree.div, fold]
---   --
---   rw [<-ITree.unfold_fold (E := E) (ITree.div)]
---   cases h : (ITree.div.unfold) with
---   | div =>
---     simp [reccases]
---     have to_rewrite_by : (fold (ITreeF.div)).unfold = ITreeF.div
---       := fold_unfold (ITreeF E R) (ITreeF.div)
---     -- rw [to_rewrite_by] -- again, rw is not smart enough
---     let motive : (i : ITreeF E R (ITree E R)) -> (eq : (fold (ITreeF.div)).unfold = i)
---       -> Prop := fun i eq =>
---         ITreeF.rec (motive := fun t => (fold (ITreeF.div)).unfold = t → motive)
---           (fun r_1 h => r r_1) (fun h => d)
---           (fun i k h => v i k) i eq = d
---     refine @Eq.rec _ (ITreeF.div) motive ?_ _ (Eq.symm to_rewrite_by)
---     simp [motive]
---   | _ => simp at h
-
--- @[simp]
--- theorem ITree.reccases.vis {E R motive r d v e k}
---   : @ITree.reccases E R motive r d v (.vis e k) = v e k := by
---   rw [<-ITree.unfold_fold (E := E) (ITree.vis e k)]
---   cases h : (ITree.vis e k).unfold with
---   | vis e' k' =>
---     simp at h
---     cases h
---     subst_vars
---     simp [reccases]
---     have to_rewrite_by : (fold (ITreeF.vis e' k)).unfold = ITreeF.vis e' k
---       := fold_unfold (ITreeF E R) (ITreeF.vis e' k)
---     -- rw [to_rewrite_by] -- again, rw is not smart enough
---     let motive : (i : ITreeF E R (ITree E R)) -> (eq : (fold (ITreeF.vis e' k)).unfold = i)
---       -> Prop := fun i eq =>
---         ITreeF.rec (motive := fun t => (fold (ITreeF.vis e' k)).unfold = t → motive)
---           (fun r_1 h => r r_1) (fun h => d)
---           (fun i k h => v i k) i eq = v e' k
---     refine @Eq.rec _ (ITreeF.vis e' k) motive ?_ _ (Eq.symm to_rewrite_by)
---     simp [motive]
---   | _ => simp at h
-
+  : @ITree.cases E R motive r d v (.vis e k) = v e k := by cbv
 
 theorem ITree.le_div_is_div
   (t : ITree E R)
   (h : t ⊑ div)
   : t = div := by
-  -- have := bot_le t
-  -- apply PartialOrder.rel_antisymm <;> try assumption
-  -- simp [← ITree.bot_eq]
-  -- -- unfold bot at this
-  -- have bla := CoInd.csup_eq_bot (c := (empty_chain (ITree E R)))
-  -- have bla := bla (by grind [empty_chain])
-  -- -- rw [bla] at this
-  -- -- simp [bot, instCCPOCoIndOfInhabitedPUnit] at this
-  -- -- apply CoInd.csup_eq_bot
-  -- sorry
   simp [PartialOrder.rel, CoInd.le] at h
   cases h with | inl _ => assumption | inr h =>
   simp [div, fold] at h
diff --git a/backends/lean/Aeneas/Data/Coinductive/README b/backends/lean/Aeneas/Data/Coinductive/README
index fad87accc..bb0551bb6 100644
--- a/backends/lean/Aeneas/Data/Coinductive/README
+++ b/backends/lean/Aeneas/Data/Coinductive/README
@@ -1,2 +1,4 @@
 This definition of coinductive types in lean and definition of ITrees is adapted from https://github.com/ISTA-PLV/coinductive/tree/main
-The original version was written by Michael Sammler
\ No newline at end of file
+The original version was written by Michael Sammler
+
+Compared to the original version, I've changed ITree to not have a tau constructor since we are not using corecursion. Instead, it has simple bottom element called div. I've also added some simp theorems for computing with ITrees.
\ No newline at end of file
diff --git a/backends/lean/Aeneas/Std/Array/Array.lean b/backends/lean/Aeneas/Std/Array/Array.lean
index 55ce2f608..cee7e1665 100644
--- a/backends/lean/Aeneas/Std/Array/Array.lean
+++ b/backends/lean/Aeneas/Std/Array/Array.lean
@@ -283,7 +283,7 @@ theorem Array.clone_length {α : Type u} {n : Usize} (clone : α → Result α)
   s'.length = s.length := by
   simp [Array.clone] at h
   simp [List.clone] at h
-  cases _ : List.mapM clone ↑s <;> simp_all
+  split at h <;> simp_all
 
 @[step]
 theorem Array.clone_spec {α : Type u} {n : Usize} {clone : α → Result α} {s : Array α n} (h : ∀ x ∈ s.val, clone x = ok x) :
diff --git a/backends/lean/Aeneas/Std/Array/Core.lean b/backends/lean/Aeneas/Std/Array/Core.lean
index 2363ec9a6..95976d4eb 100644
--- a/backends/lean/Aeneas/Std/Array/Core.lean
+++ b/backends/lean/Aeneas/Std/Array/Core.lean
@@ -39,23 +39,8 @@ def List.clone (clone : α → Result α) (l : List α) : Result ({ l' : List α
     simp at h
     have := List.mapM_Result_length h
     assumption⟩
-  -- TODO: is this acceptable?
   | .vis _ _ => .fail .panic
   | .div => .div
-  -- match h : (List.mapM clone l).match with
-  -- | .ok v => ok ⟨ v, by
-  --   simp at h
-  --   have := List.mapM_Result_length h
-  --   assumption⟩
-  -- | .vis e k => by
-  --     -- .vis e k
-  --     simp at h
-  --     simp [List.mapM] at h
-  --     simp [List.mapM.loop] at h
-  --     sorry
-  -- | .div => div
-  -- -- | _ => by
-  -- --   sorry
 
 @[step]
 def List.clone_spec {clone : α → Result α} {l : List α} (h : ∀ x ∈ l, clone x = ok x) :
diff --git a/backends/lean/Aeneas/Std/Primitives.lean b/backends/lean/Aeneas/Std/Primitives.lean
index aa3744b48..c8e609fde 100644
--- a/backends/lean/Aeneas/Std/Primitives.lean
+++ b/backends/lean/Aeneas/Std/Primitives.lean
@@ -28,6 +28,13 @@ def assertImpl : CommandElab := fun (stx: Syntax) => do
       throwError ("Expression reduced to false:\n"  ++ stx[1])
     pure ())
 
+/--
+info: true
+-/
+#guard_msgs in
+#eval 2 == 2
+#assert (2 == 2)
+
 syntax (name := elabSyntax) "#elab" term: command
 
 @[command_elab elabSyntax]
@@ -83,7 +90,6 @@ def Result.fail {α} (e : Error) : Result α := Result.vis (.fail e) PEmpty.elim
 
 def Result.div {α} : Result α := ITree.div
 
--- TODO: maybe rename Result.bind
 def bind {α : Type u} {β : Type v} (x: Result α) (f: α → Result β) : Result β :=
   ITree.bind x f
 
@@ -93,14 +99,6 @@ instance : Monad Result where
 
 instance : LawfulMonad Result := instLawfulMonadITree
 
--- TODO: is this not redundant with theorems below in this file?
-theorem Result_ok_bind.{u} {A B : Type u} : ∀ (x : A) (f : A → Result B),
-  bind (Result.ok x) f = f x := by
-    intros x f
-    let h := instLawfulMonadResult.pure_bind x f
-    simp [Bind.bind] at h
-    assumption
-
 @[simp, grind .]
 theorem ok_not_vis {α} {a : α} {eff k} : ¬ Result.ok a = .vis eff k := by grind [Result.ok, Result.vis]
 @[simp, grind .]
@@ -116,13 +114,11 @@ theorem div_not_vis {α} {eff k} : ¬ .div = @Result.vis α eff k := by grind [R
 @[simp, grind .]
 theorem Result.ok.injEq {α} {a b : α} : (Result.ok a = .ok b) = (a = b) := by
   grind [Result.ok]
--- TODO: do we need the stronger version of this that has the continuations with ≍?
+-- TODO: when necessary, we may need a stronger version of this which outputs ≍ for the continuations
 @[grind .]
 theorem Result.vis.injEq {α} {a b} {k1 k2} : (@Result.vis α a k1 = .vis b k2) → (a = b) := by
   grind [Result.vis, vis_inj_effect]
 
-
--- #check ITree.cases
 @[elab_as_elim, cases_eliminator]
 def Result.cases {R}
     {motive : Result R → Sort v}
@@ -132,16 +128,14 @@ def Result.cases {R}
     (div :  motive (Result.div))
     : motive t := ITree.cases ret div vis t
 
--- inductive MatchResult : ∀ {α : Type u}, Result α → Type _ where
--- | ok {α} : (a : α) → MatchResult (Result.ok a)
--- | div : ∀ {α}, @MatchResult α .div
--- | fail : ∀ {α}, (e : Error) → @MatchResult α (.fail e)
-
 inductive MatchResult (α : Type u) : Type u where
 | ok : (a : α) → MatchResult α
 | div : MatchResult α
 | vis : (eff : RustEffect.I) → (RustEffect.O eff → Result α) → MatchResult α
 
+/-!
+Can simulate a match on the Result type by matching on the output of this function.
+-/
 def Result.match.{u} {α : Type u} (r : Result α) : MatchResult α :=
   r.cases .ok .vis .div
 
@@ -165,104 +159,11 @@ theorem Result.match.is_vis {α : Type u} {e k} {r : Result α} : (r.match = .vi
 theorem Result.match.is_div {α : Type u} {r : Result α} : (r.match = .div) ↔ r = .div := by
   cases r <;> grind
 
--- -- Before ITrees, Result was an inductive with ok, div, and fail cases only.
--- -- this function can be used in many cases to replace pattern matching on that inductive:
--- -- NOTE about split: to work with the `split` tactic, the name must start with "match_", the motive must come
--- -- before the Result input, and the div case must input a Unit.
--- -- If we commit to not needing split, we can change these things.
--- @[elab_as_elim, cases_eliminator]
--- def Result.match_dep {α}
---   {motive : Result α → Sort v}
---   (r : Result α)
---   (m : ∀ {r'}, MatchResult r' → motive r')
---   : motive r := ITree.cases (fun x => m (.ok x)) (m .div) (
---       fun e k => match e with
---         | .fail e => by
---             have same : k = PEmpty.elim := by funext x; contradiction
---             simp [same]
---             let h := (@m (.fail e) (.fail e))
---             simp [fail] at h
---             apply h
---     ) r
-
--- @[simp]
--- theorem Result.match.ok {R motive m x}
---   : @Result.match_dep R motive (.ok x) m = (m (.ok x)) := ITree.cases.ret
-
--- @[simp]
--- theorem Result.match.div {R motive m}
---   : @Result.match_dep R motive .div m = m .div := ITree.cases.div
-
--- @[simp]
--- theorem Result.match.fail {R motive m}
---   : @Result.match_dep R motive (.fail e) m = m (.fail e) := ITree.cases.vis
-
 def Result.is_ok {R : Type} [BEq R] (r : Result R) (expected : R) : Bool :=
   match r.match with
   | .ok x => x == expected
   | _ => false
 
--- def Result.match_dep' {α}
---   {motive : Result α → Sort v}
---   (r : Result α)
---   (ok : ∀ x, r = .ok x → motive (.ok x))
---   (fail : ∀ e, r = .fail e → motive (.fail e))
---   (div : r = .div → motive (.div))
---   : motive r :=
---     Result.match_dep (motive := fun r' => r = r' -> motive r') r ok fail (fun _ => div) rfl
-
--- @[simp]
--- theorem Result.match_dep'.ok {R motive v r d f x}
---   (h : v = Result.ok x)
---   : @Result.match_dep' R motive v r f d = cast (congrArg motive (Eq.symm h)) (r x h) := by
---   cases v <;> unfold match_dep' <;> simp <;> grind
-
--- @[simp]
--- theorem Result.match_dep'.fail {R motive v r d f e}
---   (h : v = Result.fail e)
---   : @Result.match_dep' R motive v r f d = cast (congrArg motive (Eq.symm h)) (f e h) := by
---   cases v <;> unfold match_dep' <;> simp <;> grind
-
--- @[simp]
--- theorem Result.match_dep'.div {R motive v r d f}
---   (h : v = .div)
---   : @Result.match_dep' R motive v r f d = cast (congrArg motive (Eq.symm h)) (d h) := by
---   cases v <;> unfold match_dep' <;> simp <;> grind
-
--- TODO: do we need this?
--- instance {T} [Repr T] : Repr (Result T) where
---   reprPrec x n := x.match_dep fun x => match x with
---     | .ok t => .append (.text "ok ") (reprPrec t n)
---     | .fail e => .append (.text "fail ") (reprPrec e n)
---     | .div => .text "div"
-
--- TODO: this is how to register for split, but we probably won't use that
--- run_meta
---   Lean.Meta.Match.addMatcherInfo ``Result.match_dep {
---     numParams := 1
---     numDiscrs := 1
---     altInfos := #[
---       {
---         numFields := 1
---         numOverlaps := 0
---         hasUnitThunk := false
---       },
---       {
---         numFields := 1
---         numOverlaps := 0
---         hasUnitThunk := false
---       },
---       {
---         numFields := 0
---         numOverlaps := 0
---         hasUnitThunk := true
---       }
---     ]
---     uElimPos? := .some 0
---     discrInfos := #[{ hName? := none }]
---     overlaps := { map := Std.HashMap.ofList [] }
---   }
-
 open Result
 
 instance Result_Inhabited (α : Type u) : Inhabited (Result α) :=
diff --git a/backends/lean/Aeneas/Std/Scalar/Core.lean b/backends/lean/Aeneas/Std/Scalar/Core.lean
index 1a66e2919..295fb4682 100644
--- a/backends/lean/Aeneas/Std/Scalar/Core.lean
+++ b/backends/lean/Aeneas/Std/Scalar/Core.lean
@@ -612,19 +612,6 @@ theorem UScalar.tryMkOpt_eq (ty : UScalarTy) (x : Nat) :
   split_ifs <;> simp_all
   simp [UScalar.val, UScalarTy.numBits] at *
 
--- TODO: delete this:
-theorem UScalar.tryMk_eq_DELETE_THIS_PROBABLY (ty : UScalarTy) (x : Nat) :
-  (∃ v, tryMk ty x = .ok v ∧ inBounds ty v.val ∧ x = v.val)
-  ∨ (∃ e, tryMk ty x = .fail e ∧ ¬ (inBounds ty x))
-    := by
-  have := UScalar.tryMkOpt_eq ty x
-  simp [tryMk, ofOption]
-  cases h: tryMkOpt ty x
-  · right
-    grind
-  · left
-    grind
-
 theorem UScalar.tryMk_eq (ty : UScalarTy) (x : Nat) :
   match (tryMk ty x).match with
     | .ok y => y.val = x ∧ inBounds ty x
@@ -634,17 +621,6 @@ theorem UScalar.tryMk_eq (ty : UScalarTy) (x : Nat) :
   have := UScalar.tryMkOpt_eq ty x
   simp [tryMk, ofOption]
   cases h: tryMkOpt ty x <;> simp_all
-  --
-
--- TODO: delete old one
--- theorem UScalar.tryMk_eq (ty : UScalarTy) (x : Nat) :
---   match tryMk ty x with
---   | ok y => y.val = x ∧ inBounds ty x
---   | fail _ => ¬ (inBounds ty x)
---   | _ => False := by
---   have := UScalar.tryMkOpt_eq ty x
---   simp [tryMk, ofOption]
---   cases h: tryMkOpt ty x <;> simp_all
 
 theorem IScalar.tryMkOpt_eq (ty : IScalarTy) (x : Int) :
   match tryMkOpt ty x with
@@ -659,19 +635,6 @@ theorem IScalar.tryMkOpt_eq (ty : IScalarTy) (x : Int) :
   simp [Int.bmod] <;> split <;> (try omega) <;>
   cases h: System.Platform.numBits_eq <;> simp_all <;> omega
 
--- TODO: delete this
--- theorem IScalar.tryMk_eq (ty : IScalarTy) (x : Int) :
---   (∃ v, tryMk ty x = .ok v ∧ inBounds ty v.val ∧ x = v.val)
---   ∨ (∃ e, tryMk ty x = .fail e ∧ ¬ (inBounds ty x))
---     := by
---   have := IScalar.tryMkOpt_eq ty x
---   simp [tryMk, ofOption]
---   cases h: tryMkOpt ty x
---   · right
---     grind
---   · left
---     grind
-
 theorem IScalar.tryMk_eq (ty : IScalarTy) (x : Int) :
   match (tryMk ty x).match with
   | .ok y => y.val = x ∧ inBounds ty x
@@ -682,16 +645,6 @@ theorem IScalar.tryMk_eq (ty : IScalarTy) (x : Int) :
   simp [tryMk]
   cases h : tryMkOpt ty x <;> simp_all
 
--- TODO: delete old one
--- theorem IScalar.tryMk_eq (ty : IScalarTy) (x : Int) :
---   match tryMk ty x with
---   | ok y => y.val = x ∧ inBounds ty x
---   | fail _ => ¬ (inBounds ty x)
---   | _ => False := by
---   have := tryMkOpt_eq ty x
---   simp [tryMk]
---   cases h : tryMkOpt ty x <;> simp_all
-
 @[simp] theorem UScalar.zero_in_cbounds {ty : UScalarTy} : 0 < 2^ty.numBits := by
   simp
 
diff --git a/backends/lean/Aeneas/Std/Scalar/Ops/Neg.lean b/backends/lean/Aeneas/Std/Scalar/Ops/Neg.lean
index 8f78b2df0..6b72d5ada 100644
--- a/backends/lean/Aeneas/Std/Scalar/Ops/Neg.lean
+++ b/backends/lean/Aeneas/Std/Scalar/Ops/Neg.lean
@@ -18,8 +18,7 @@ theorem IScalar.neg_step {ty} (x: IScalar ty) (h: x ≠ IScalar.min ty): IScalar
   simp [neg]
   have h := tryMk_eq ty (-x.val)
   simp [inBounds] at h
-  generalize hval : (tryMk ty (-↑x)) = val at h
-  cases val <;> simp_all
+  split at h <;> simp_all
   have := IScalar.hBounds x
   simp [IScalar.min] at *
   grind
diff --git a/backends/lean/Aeneas/Std/Slice.lean b/backends/lean/Aeneas/Std/Slice.lean
index 1753aeec4..9d14aabea 100644
--- a/backends/lean/Aeneas/Std/Slice.lean
+++ b/backends/lean/Aeneas/Std/Slice.lean
@@ -1012,8 +1012,6 @@ theorem core.slice.Slice.copy_from_slice.step_spec (copyInst : core.marker.Copy
 def Slice.mapM  {α β} (f : α → Result β) (x : Slice α) : Result (Slice β) :=
   match h : (x.val.mapM f).match with
   | .ok xs  => ok ⟨xs, List.mapM_Result_length (by simp at h; apply h) ▸ x.prop⟩
-  -- | .vis (.fail e) _ => fail e
-  -- TODO: is this ok?
   | .vis _ _ => .fail .panic
   | .div    => div
 
@@ -1063,7 +1061,6 @@ def core.slice.Slice.fill {T : Type} (cloneInst : core.clone.Clone T)
     (s : Slice T) (v : T) : Result (Slice T) :=
   match h : (s.val.mapM (fun _ => cloneInst.clone v)).match with
   | .ok val => .ok ⟨val, List.mapM_Result_length (by simp at h; apply h) ▸ s.property⟩
-  -- TODO: is this ok?
   | .vis _ _ => .fail .panic
   | .div => .div
 
diff --git a/backends/lean/Aeneas/Std/WP.lean b/backends/lean/Aeneas/Std/WP.lean
index 66677d62f..dc1cde050 100644
--- a/backends/lean/Aeneas/Std/WP.lean
+++ b/backends/lean/Aeneas/Std/WP.lean
@@ -19,29 +19,11 @@ def Wp α := Post α → Pre
 
 def wp_return (x:α) : Wp α := fun p => p x
 
--- TODO: clean this up if i end up going with the coinductive one
--- def theta (m:Result α) : Wp α :=
---   match m with
---   | ok x => wp_return x
---   | fail _ => fun _ => False
---   | div => fun _ => False
-
--- def spec {α} (x:Result α) (p:Post α) :=
---   theta x p
-
 @[grind]
 inductive spec {α} : (x : Result α) → (p : Post α) →  Prop where
 | ret : ∀ p x, p x → spec (.ok x) p
--- | vis : ∀ k, (∀ b, spec p (k b)) → spec p (ITree.vis () k)
--- | fail : ∀ k, (∀ b, spec p (k b)) → spec p (ITree.vis () k)
 
 
--- TODO: clean up
--- def dspec {α} (x:Result α) (p:Post α) :=
---   match x with
---   | ok x => p x
---   | fail _ => False
---   | div => True
 inductive dspec {α} : (x : Result α) → (p : Post α) →  Prop where
 | ret : ∀ p x, p x → dspec (.ok x) p
 | div : ∀ p, dspec div p
@@ -108,37 +90,6 @@ theorem dspec_admissible {α} (p : Post α )
     rw [ITree.div_is_bot]
     constructor
 seal Result
-  -- by_cases h' : ∃ x, c x ∧ x ≠ .div
-  -- ·
-  --   simp [Lean.Order.CCPO.csup]
-  --   -- simp [← flat_csup_eq, flat_csup, h']
-  --   apply Classical.some_spec₂ (q := (dspec · p))
-  --   intro x ⟨hcx, hneb⟩
-  --   apply h x hcx
-  --   --
-  -- ·
-  --   simp [Lean.Order.CCPO.csup]
-  --   simp [← flat_csup_eq, flat_csup, h', hnot]
-  -- -- unfold Lean.Order.admissible
-  -- -- intros c hc dspecc
-  -- -- simp at *
-  -- -- by_cases ∃ x, c (.ok x)
-  -- -- · sorry
-  -- -- ·
-  -- --   have : Lean.Order.CCPO.csup hc = Result.div := by
-  -- --     generalize hsup : Lean.Order.CCPO.csup hc = sup at *
-  -- --     have dspecc := dspecc (Lean.Order.CCPO.csup hc) ?_ -- (Lean.Order.CCPO.csup_spec hc)
-  -- --     cases h : (Lean.Order.CCPO.csup hc) <;> try rfl
-  -- --     · sorry
-  -- --     · sorry
-  -- --     ·
-  -- --       sorry
-  -- --     --
-  -- --     -- sorry
-  -- --   sorry
-  -- -- apply Lean.Order.admissible_flatOrder
-  -- -- simp [dspec]
-  -- -- sorry
 
 /-- Variant of `uncurry` used to decompose tuples in post-conditions.
 
diff --git a/src/extract/Extract.ml b/src/extract/Extract.ml
index f2db63e1c..2fbf26c1a 100644
--- a/src/extract/Extract.ml
+++ b/src/extract/Extract.ml
@@ -3774,11 +3774,6 @@ let extract_unit_test_if_marked (ctx : extraction_ctx) (fmt : F.formatter)
           F.pp_print_space fmt ();
           F.pp_print_string fmt ").is_ok";
           F.pp_print_space fmt ();
-          (*let success =
-            ctx_get_variant def.item_meta.span (TBuiltin TResult) result_ok_id
-              ctx
-          in
-          F.pp_print_string fmt (success ^ " ())")*)
           F.pp_print_string fmt "())"
       | HOL4 ->
           F.pp_print_string fmt "val _ = assert_ok (";

From 0b753e2c6e6d675afa8dc6cbb1ff192378b4c953 Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Wed, 22 Jul 2026 13:42:18 -0400
Subject: [PATCH 64/67] reinstated mvcgen

---
 backends/lean/Aeneas/Std/Primitives.lean      |  2 +-
 backends/lean/Aeneas/Std/WP.lean              | 91 ++++++++++---------
 .../Aeneas/Tactic/Step/Tests/MvcgenSpec.lean  | 34 ++++---
 3 files changed, 63 insertions(+), 64 deletions(-)

diff --git a/backends/lean/Aeneas/Std/Primitives.lean b/backends/lean/Aeneas/Std/Primitives.lean
index c8e609fde..5f584048f 100644
--- a/backends/lean/Aeneas/Std/Primitives.lean
+++ b/backends/lean/Aeneas/Std/Primitives.lean
@@ -76,7 +76,7 @@ def RustEffect : Effect := {
 }
 
 -- We need Result to be irreducble outside this file (to not break metaprograms which normalize types),
--- but reducible within. The `unseal` command only affects the local context.
+-- but reducible within. The `unseal` command only affects the local scope.
 @[irreducible]
 def Result (α : Type u) : Type u := ITree RustEffect α
 unseal Result
diff --git a/backends/lean/Aeneas/Std/WP.lean b/backends/lean/Aeneas/Std/WP.lean
index dc1cde050..f70bca43c 100644
--- a/backends/lean/Aeneas/Std/WP.lean
+++ b/backends/lean/Aeneas/Std/WP.lean
@@ -859,51 +859,52 @@ open Std.Do
 
 -- TODO: do we expect mvcgen to work with Result if we include arbitrary effects?
 -- what do we lose by getting rid of this stuff?
--- instance Result.instWP : WP Result.{u} (.except (ULift Error) (.except PUnit .pure)) where
---   wp x := {
---     trans Q := match x with | .ok a => Q.1 a | .fail e => Q.2.1 (ULift.up e) | .div => Q.2.2.1 .unit
---     conjunctiveRaw Q₁ Q₂ := by
---       apply SPred.bientails.of_eq
---       cases x <;> simp
---   }
-
-
--- instance : LawfulMonad Result where
---     map_const := by intros; rfl
---     id_map := by intros _ x; cases x <;> rfl
---     seqLeft_eq := by intros _ _ x y; cases x <;> cases y <;> rfl
---     seqRight_eq := by intros _ _ x y; cases x <;> cases y <;> rfl
---     pure_seq := by intros _ _ _ x; cases x <;> rfl
---     pure_bind := by intros; rfl
---     bind_pure_comp := by intros; rfl
---     bind_map := by intros; rfl
---     bind_assoc := by intros _ _ _ x _ _; cases x <;> rfl
-
--- instance Result.instWPMonad : WPMonad Result (.except (ULift Error) (.except PUnit .pure)) where
---   wp_pure a := by apply PredTrans.ext; intro Q; simp [PredTrans.apply, wp, WP.wp]; rfl
---   wp_bind x f := by apply PredTrans.ext; intro Q; simp [PredTrans.apply, wp, WP.wp]; cases x <;> rfl
-
--- theorem Result.of_wp {α : Type u} {x : Result α} (P : Result α → Prop) :
---     (⊢ₛ wp⟦x⟧ (fun a => ⌜P (.ok a)⌝,
---                   fun e => ⌜P (.fail e.down)⌝,
---                   fun .unit => ⌜P .div⌝, .unit)) → P x := by
---   intro hspec
---   simp only [WP.wp, PredTrans.apply] at hspec
---   split at hspec <;> simp_all
+instance Result.instWP : WP Result.{u} (.except (ULift Error) (.except PUnit .pure)) where
+  wp x := {
+    -- TODO: what happens when more effects are added to vis constructor?
+    trans Q := match x.match with | .ok a => Q.1 a | .vis (.fail e) _ => Q.2.1 (ULift.up e) | .div => Q.2.2.1 .unit
+    conjunctiveRaw Q₁ Q₂ := by
+      apply SPred.bientails.of_eq
+      cases x <;> simp
+  }
+
+instance Result.instWPMonad : WPMonad Result (.except (ULift Error) (.except PUnit .pure)) where
+  wp_pure a := by apply PredTrans.ext; intro Q; simp [PredTrans.apply, wp, WP.wp]; rfl
+  wp_bind x f := by
+    apply PredTrans.ext
+    intro Q
+    simp [PredTrans.apply, wp, WP.wp]
+    cases x <;> cbv
+
+
+theorem Result.of_wp {α : Type u} {x : Result α} (P : Result α → Prop) :
+    (⊢ₛ wp⟦x⟧ (fun a => ⌜P (.ok a)⌝,
+                  fun e => ⌜P (.fail e.down)⌝,
+                  fun .unit => ⌜P .div⌝, .unit)) → P x := by
+  intro hspec
+  simp only [WP.wp, PredTrans.apply] at hspec
+  split at hspec <;> simp_all
+  rename_i heq a
+  have : heq = PEmpty.elim := by funext; contradiction
+  simp [*]
 
 -- /-- Lift an Aeneas step spec to an mvcgen-compatible `Triple`. -/
--- theorem spec_to_mvcgen {α : Type u} {x : Result α} {Q : α → Prop}
---     (h : spec x Q) :
---     ⦃ ⌜ True ⌝ ⦄ x ⦃ ⇓ r => ⌜ Q r ⌝ ⦄ := by
---   obtain ⟨v, hx, hQv⟩ := spec_imp_exists h
---   subst hx
---   simp [Triple, WP.wp, PredTrans.apply, hQv]
-
--- theorem dspec_to_mvcgen {α : Type u} {x : Result α} {Q : α → Prop}
---     (h : dspec x Q) :
---     ⦃ ⌜ ¬ x = .div ⌝ ⦄ x ⦃ ⇓ r => ⌜ Q r ⌝ ⦄ := by
---   simp [Triple, WP.wp, PredTrans.apply, SPred.pure]
---   cases x <;> simp [*, dspec] at * <;> trivial
+theorem spec_to_mvcgen {α : Type u} {x : Result α} {Q : α → Prop}
+    (h : spec x Q) :
+    ⦃ ⌜ True ⌝ ⦄ x ⦃ ⇓ r => ⌜ Q r ⌝ ⦄ := by
+  obtain ⟨v, hx, hQv⟩ := spec_imp_exists h
+  subst hx
+  simp [Triple, WP.wp, PredTrans.apply, hQv]
+
+theorem dspec_to_mvcgen {α : Type u} {x : Result α} {Q : α → Prop}
+    (h : dspec x Q) :
+    ⦃ ⌜ ¬ x = .div ⌝ ⦄ x ⦃ ⇓ r => ⌜ Q r ⌝ ⦄ := by
+  simp [Triple, WP.wp, PredTrans.apply, SPred.pure]
+  cases x <;> simp [*] at *
+  · trivial
+  · rename_i i k
+    generalize hval : vis i k = val at h
+    cases h <;> simp at hval
 
 end Aeneas.Std.WP
 
@@ -988,7 +989,7 @@ theorem forall_unit {p : Prop} : (Unit → p) ↔ p := by simp
       ``Std.WP.uncurry'_eq, ``Std.WP.uncurry'_pair,
       ``Std.WP.imp_exists_iff,
       ``forall_unit, ``true_imp_iff]
-    to_mvcgen := .none -- .some ``Std.WP.spec_to_mvcgen
+    to_mvcgen := .some ``Std.WP.spec_to_mvcgen
     liftings := #[]
   }
 
@@ -1012,7 +1013,7 @@ theorem forall_unit {p : Prop} : (Unit → p) ↔ p := by simp
       ``Std.WP.uncurry'_eq, ``Std.WP.uncurry'_pair,
       ``Std.WP.imp_exists_iff,
       ``forall_unit, ``true_imp_iff]
-    to_mvcgen := .none -- .some ``Std.WP.dspec_to_mvcgen
+    to_mvcgen := .some ``Std.WP.dspec_to_mvcgen
     liftings := #[
       { from_statement := ``Std.WP.spec
         conversion_thm := ``Std.WP.spec_dspec
diff --git a/backends/lean/Aeneas/Tactic/Step/Tests/MvcgenSpec.lean b/backends/lean/Aeneas/Tactic/Step/Tests/MvcgenSpec.lean
index 7cf4100cd..ab18dc289 100644
--- a/backends/lean/Aeneas/Tactic/Step/Tests/MvcgenSpec.lean
+++ b/backends/lean/Aeneas/Tactic/Step/Tests/MvcgenSpec.lean
@@ -11,23 +11,21 @@ set_option mvcgen.warning false
 For every @[step] theorem, the attribute handler also generates an `mvcgen` spec.
 -/
 
--- TODO: figure out if mvcgen can work with new Result
+example {x y : U8} (hmax : x.val + y.val ≤ U8.max) :
+    ⦃ ⌜ True ⌝ ⦄ (x + y) ⦃ ⇓ z => ⌜ z.val = x.val + y.val ⌝ ⦄ := by
+  mvcgen; scalar_tac
 
--- example {x y : U8} (hmax : x.val + y.val ≤ U8.max) :
---     ⦃ ⌜ True ⌝ ⦄ (x + y) ⦃ ⇓ z => ⌜ z.val = x.val + y.val ⌝ ⦄ := by
---   mvcgen; scalar_tac
+example {x y : U8} :
+    ⦃ ⌜ True ⌝ ⦄
+      (do
+        if x < 10#u8
+        then x * 2#u8
+        else pure y)
+    ⦃ ⇓ z => ⌜ z.val ≠ y → z.val < 20 ⌝ ⦄ := by
+  mvcgen <;> scalar_tac
 
--- example {x y : U8} :
---     ⦃ ⌜ True ⌝ ⦄
---       (do
---         if x < 10#u8
---         then x * 2#u8
---         else pure y)
---     ⦃ ⇓ z => ⌜ z.val ≠ y → z.val < 20 ⌝ ⦄ := by
---   mvcgen <;> scalar_tac
-
--- example (arr : Array U8 25#usize) (i : Usize) (a : U8) (hi : i < arr.length) :
---     ⦃ ⌜ True ⌝ ⦄
---       Array.update arr i a
---     ⦃ ⇓ r => ⌜ r.get? i = some a ⌝ ⦄ := by
---   mvcgen; grind
+example (arr : Array U8 25#usize) (i : Usize) (a : U8) (hi : i < arr.length) :
+    ⦃ ⌜ True ⌝ ⦄
+      Array.update arr i a
+    ⦃ ⇓ r => ⌜ r.get? i = some a ⌝ ⦄ := by
+  mvcgen; grind

From b3ddc6c8d80a999449ba74f0956ebb9572eaf31d Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Wed, 22 Jul 2026 14:24:48 -0400
Subject: [PATCH 65/67] Made mvcgen work with further effects

---
 backends/lean/Aeneas/Std/WP.lean | 48 +++++++++++++++++++++++---------
 1 file changed, 35 insertions(+), 13 deletions(-)

diff --git a/backends/lean/Aeneas/Std/WP.lean b/backends/lean/Aeneas/Std/WP.lean
index f70bca43c..e9e423c3f 100644
--- a/backends/lean/Aeneas/Std/WP.lean
+++ b/backends/lean/Aeneas/Std/WP.lean
@@ -857,36 +857,58 @@ namespace Aeneas.Std.WP
 open Std Result
 open Std.Do
 
--- TODO: do we expect mvcgen to work with Result if we include arbitrary effects?
--- what do we lose by getting rid of this stuff?
-instance Result.instWP : WP Result.{u} (.except (ULift Error) (.except PUnit .pure)) where
+-- mvcgen does not support all types of effects, and currently this implementation only works with fail and div.
+-- This option is set here so that this same code works for any extension to RustEffect.I
+set_option match.ignoreUnusedAlts true
+-- There are three types of exceptions in the type: the Error from Result.fail,
+-- a dummy exception thrown when any other effect is used, and Result.div.
+instance Result.instWP : WP Result.{u} (.except (ULift Error) (.except PUnit (.except PUnit .pure))) where
   wp x := {
-    -- TODO: what happens when more effects are added to vis constructor?
-    trans Q := match x.match with | .ok a => Q.1 a | .vis (.fail e) _ => Q.2.1 (ULift.up e) | .div => Q.2.2.1 .unit
+    trans Q := match x.match with
+      | .ok a => Q.1 a
+      | .vis eff _ =>
+        match eff with
+        | .fail e => Q.2.1 (ULift.up e)
+        | _ => Q.2.2.1 PUnit.unit
+      | .div => Q.2.2.2.1 .unit
     conjunctiveRaw Q₁ Q₂ := by
       apply SPred.bientails.of_eq
       cases x <;> simp
+      try (rename_i i k)
+      try (cases i <;> simp)
   }
+set_option match.ignoreUnusedAlts false
 
-instance Result.instWPMonad : WPMonad Result (.except (ULift Error) (.except PUnit .pure)) where
+instance Result.instWPMonad : WPMonad Result (.except (ULift Error) (.except PUnit (.except PUnit .pure))) where
   wp_pure a := by apply PredTrans.ext; intro Q; simp [PredTrans.apply, wp, WP.wp]; rfl
   wp_bind x f := by
     apply PredTrans.ext
     intro Q
     simp [PredTrans.apply, wp, WP.wp]
-    cases x <;> cbv
+    cases x
+    · cbv
+    · simp
+      rename_i i k
+      cases i <;> cbv
+    · cbv
 
 
+-- Because Result can contain more effects, we can't have this theorem. Leaving this here for future reference.
 theorem Result.of_wp {α : Type u} {x : Result α} (P : Result α → Prop) :
     (⊢ₛ wp⟦x⟧ (fun a => ⌜P (.ok a)⌝,
                   fun e => ⌜P (.fail e.down)⌝,
+                  fun _ => ⌜False⌝, -- this is the case for other effects, in which case this provides no info.
                   fun .unit => ⌜P .div⌝, .unit)) → P x := by
-  intro hspec
-  simp only [WP.wp, PredTrans.apply] at hspec
-  split at hspec <;> simp_all
-  rename_i heq a
-  have : heq = PEmpty.elim := by funext; contradiction
-  simp [*]
+    intro hspec
+    simp only [WP.wp, PredTrans.apply] at hspec
+    split at hspec <;> simp_all
+    rename_i x eff heq a
+    cases eff
+    have : heq = PEmpty.elim := by funext; contradiction
+    simp [*] at *
+    try trivial
+    try (all_goals simp at hspec)
+
 
 -- /-- Lift an Aeneas step spec to an mvcgen-compatible `Triple`. -/
 theorem spec_to_mvcgen {α : Type u} {x : Result α} {Q : α → Prop}

From 13f7340db1c9ad79f5be730793f323455b2d97ec Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Wed, 22 Jul 2026 14:47:35 -0400
Subject: [PATCH 66/67] Cleaned up more comments

---
 .../lean/Aeneas/Data/Coinductive/CoInd.lean   |   2 +-
 .../lean/Aeneas/Data/Coinductive/Effect.lean  |   4 +
 .../lean/Aeneas/Data/Coinductive/ITree.lean   |   9 +-
 backends/lean/Aeneas/Data/Coinductive/README  |   2 +-
 backends/lean/Aeneas/Std/Primitives.lean      |  19 +---
 backends/lean/Aeneas/Std/WP.lean              |   8 +-
 tests/lean/SpecTests/Coin.lean                | 107 +++++++++---------
 7 files changed, 69 insertions(+), 82 deletions(-)

diff --git a/backends/lean/Aeneas/Data/Coinductive/CoInd.lean b/backends/lean/Aeneas/Data/Coinductive/CoInd.lean
index 595b369e8..afe08b088 100644
--- a/backends/lean/Aeneas/Data/Coinductive/CoInd.lean
+++ b/backends/lean/Aeneas/Data/Coinductive/CoInd.lean
@@ -1,5 +1,5 @@
 /-
-This file is adaped from https://github.com/ISTA-PLV/coinductive/tree/main,
+This file is from https://github.com/ISTA-PLV/coinductive/tree/main,
 see README in this folder.
 -/
 namespace Aeneas.Data.Coinductive
diff --git a/backends/lean/Aeneas/Data/Coinductive/Effect.lean b/backends/lean/Aeneas/Data/Coinductive/Effect.lean
index 3bc28b964..d3fbe5ebe 100644
--- a/backends/lean/Aeneas/Data/Coinductive/Effect.lean
+++ b/backends/lean/Aeneas/Data/Coinductive/Effect.lean
@@ -1,3 +1,7 @@
+/-
+This file is from https://github.com/ISTA-PLV/coinductive/tree/main,
+see README in this folder.
+-/
 namespace Aeneas.Data.Coinductive
 
 structure Effect : Type (u + 1) where
diff --git a/backends/lean/Aeneas/Data/Coinductive/ITree.lean b/backends/lean/Aeneas/Data/Coinductive/ITree.lean
index 372af99a3..5593919b8 100644
--- a/backends/lean/Aeneas/Data/Coinductive/ITree.lean
+++ b/backends/lean/Aeneas/Data/Coinductive/ITree.lean
@@ -9,10 +9,9 @@ namespace Aeneas.Data.Coinductive
 
 open Lean.Order
 
--- compared to the original version
--- which uses the traditional tau constructor, this version instead has a bottom element
--- div. tau is not needed to guard recursion, since we are using partial_fixpoint
--- instead of coinduction.
+-- Compared to the original version which uses the traditional tau constructor,
+-- this version instead has a bottom element div. Tau is not needed to guard recursion,
+-- since we are using partial_fixpoint instead of coinduction.
 inductive ITreeF.{u,v} (E : Effect.{u}) (R : Type v) (ITree : Type (max u v)) : Type (max u v) where
   | ret (r : R)
   | div -- equivalent to infinite tau stream from traditional ITrees
@@ -326,7 +325,7 @@ theorem vis_inj_effect {E} {α} {e1 e2 k1 k2} : @ITree.vis α E e1 k1 = ITree.vi
   simp at eq
   grind
 
--- theorems to make ITree.cases compute:
+-- Theorems to make ITree.cases compute:
 @[simp]
 theorem ITree.cases.ret {E R motive r d v x}
   : @ITree.cases E R motive r d v (.ret x) = r x := by cbv
diff --git a/backends/lean/Aeneas/Data/Coinductive/README b/backends/lean/Aeneas/Data/Coinductive/README
index bb0551bb6..d1aed87de 100644
--- a/backends/lean/Aeneas/Data/Coinductive/README
+++ b/backends/lean/Aeneas/Data/Coinductive/README
@@ -1,4 +1,4 @@
 This definition of coinductive types in lean and definition of ITrees is adapted from https://github.com/ISTA-PLV/coinductive/tree/main
-The original version was written by Michael Sammler
+The original version was written by Michael Sammler.
 
 Compared to the original version, I've changed ITree to not have a tau constructor since we are not using corecursion. Instead, it has simple bottom element called div. I've also added some simp theorems for computing with ITrees.
\ No newline at end of file
diff --git a/backends/lean/Aeneas/Std/Primitives.lean b/backends/lean/Aeneas/Std/Primitives.lean
index 5f584048f..32293a3b9 100644
--- a/backends/lean/Aeneas/Std/Primitives.lean
+++ b/backends/lean/Aeneas/Std/Primitives.lean
@@ -210,13 +210,6 @@ def Result.ofOption {a : Type u} (x : Option a) (e : Error) : Result a :=
 @[simp] theorem bind_tc_ok (x : α) (f : α → Result β) :
   (do let y ← .ok x; f y) = f x := by simp [bind, Bind.bind, ok]
 
--- TODO: will this create backwards compatibility issues?
--- @[simp] theorem bind_tc_fail (x : Error) (f : α → Result β) :
---   (do let y ← fail x; f y) = fail x := by
---   simp [bind, Bind.bind, vis]
---   apply congrArg
---   funext x
---   contradiction
 @[simp] theorem bind_tc_vis (e k) (f : α → Result β) :
   (do let y ← Result.vis e k; f y) = .vis e (fun x => do let y ← k x; f y) := by
   simp [bind, Bind.bind, vis]
@@ -238,10 +231,8 @@ section Order
 
 open Lean.Order
 
-instance : PartialOrder (Result α) := instPartialOrderCoIndOfInhabitedPUnit (ITreeF RustEffect α) -- by unfold Result; infer_instance
-  -- instPartialOrderCoIndOfInhabitedPUnit _
-noncomputable instance : CCPO (Result α) := instCCPOCoIndOfInhabitedPUnit (ITreeF RustEffect α) -- by unfold Result; infer_instance
-  -- instCCPOCoIndOfInhabitedPUnit _
+instance : PartialOrder (Result α) := instPartialOrderCoIndOfInhabitedPUnit (ITreeF RustEffect α)
+noncomputable instance : CCPO (Result α) := instCCPOCoIndOfInhabitedPUnit (ITreeF RustEffect α)
 noncomputable instance : MonoBind Result := instMonoBindITree
 
 @[partial_fixpoint_monotone]
@@ -253,8 +244,9 @@ theorem bind_mono {R : Type a} {α} {S : Type b} [PartialOrder α]
     simp [bind]
     apply Aeneas.Data.Coinductive.bind_mono
 
--- TODO: when we add more effects, use Aeneas.Data.Coinductive.vis_mono
+-- TODO: when we add more effects, use Aeneas.Data.Coinductive.ITree.vis_mono
 -- to instantiate monotonicity theorems for those effects.
+-- This will allow partial fixpoint definitions that call the effects.
 
 end Order
 
@@ -375,8 +367,7 @@ instance SubtypeLawfulBEq [BEq α] (p : α → Prop) [LawfulBEq α] : LawfulBEq
   eq_of_beq {a b} h := by cases a; cases b; simp_all [BEq.beq]
   rfl := by intro a; cases a; simp [BEq.beq]
 
--- TODO: will this make sense when we add more effects, given that .vis returns none?
-/- A helper function that converts failure to none and success to some
+/- A helper function that converts failure (and any effects) to none and success to some
    TODO: move up to Core module? -/
 def Option.ofResult {a : Type u} (x : Result a) :
   Option a :=
diff --git a/backends/lean/Aeneas/Std/WP.lean b/backends/lean/Aeneas/Std/WP.lean
index e9e423c3f..73de4c1c1 100644
--- a/backends/lean/Aeneas/Std/WP.lean
+++ b/backends/lean/Aeneas/Std/WP.lean
@@ -119,9 +119,6 @@ theorem spec_ok (x : α) : spec (ok x) p ↔ p x := by
     constructor
     assumption
 
--- TODO: clean this up
--- @[simp, grind =, agrind =]
--- theorem spec_fail (e : Error) : spec (fail e) p ↔ False := by grind
 @[simp, grind =, agrind =]
 theorem spec_vis (e k) : spec (.vis e k) p ↔ False := by grind
 
@@ -893,11 +890,10 @@ instance Result.instWPMonad : WPMonad Result (.except (ULift Error) (.except PUn
     · cbv
 
 
--- Because Result can contain more effects, we can't have this theorem. Leaving this here for future reference.
 theorem Result.of_wp {α : Type u} {x : Result α} (P : Result α → Prop) :
     (⊢ₛ wp⟦x⟧ (fun a => ⌜P (.ok a)⌝,
                   fun e => ⌜P (.fail e.down)⌝,
-                  fun _ => ⌜False⌝, -- this is the case for other effects, in which case this provides no info.
+                  fun _ => ⌜False⌝, -- if other effects are used, this provides no information.
                   fun .unit => ⌜P .div⌝, .unit)) → P x := by
     intro hspec
     simp only [WP.wp, PredTrans.apply] at hspec
@@ -910,7 +906,7 @@ theorem Result.of_wp {α : Type u} {x : Result α} (P : Result α → Prop) :
     try (all_goals simp at hspec)
 
 
--- /-- Lift an Aeneas step spec to an mvcgen-compatible `Triple`. -/
+/-- Lift an Aeneas step spec to an mvcgen-compatible `Triple`. -/
 theorem spec_to_mvcgen {α : Type u} {x : Result α} {Q : α → Prop}
     (h : spec x Q) :
     ⦃ ⌜ True ⌝ ⦄ x ⦃ ⇓ r => ⌜ Q r ⌝ ⦄ := by
diff --git a/tests/lean/SpecTests/Coin.lean b/tests/lean/SpecTests/Coin.lean
index 99435fdac..01909ffac 100644
--- a/tests/lean/SpecTests/Coin.lean
+++ b/tests/lean/SpecTests/Coin.lean
@@ -13,6 +13,8 @@ import Aeneas
 open Aeneas
 open Std Result WP Data Coinductive Effect Lean.Order
 
+-- This file shows how to build coinductive predicates over ITrees.
+
 def Coin : Effect := {
    I := Unit
    O := fun _ => Bool
@@ -124,58 +126,53 @@ theorem coinSpec_ret {α p} (x : α) : coinSpec p (ITree.ret x) ↔ p x := by
     assumption
 
 #register_spec_info {
-    spec_name := ``coinSpec
-    arity := 3
-    program_index := 2
-    post_index := 1
-    mk_spec_mono := ``coinSpec_mono
-    mk_spec_mono_skip_args := 2
-    mk_spec_bind := ``coinSpec_bind
-    mk_spec_bind_skip_args := 4
-    uncurry_elim_tactics := #[
-      ``qimp_coinSpec_unit,
-      ``Std.WP.qimp_unit,
-      ``qimp_coinSpec_exists,
-      ``Std.WP.qimp_exists,
-      ``forall_unit, ``true_imp_iff
-    ]
-    qimp_elim_tactics := #[
-      ``qimp_coinSpec_iff,
-      ``Std.WP.qimp_iff,
-      ``Std.WP.imp_and_iff, ``Std.uncurry_apply_pair,
-      ``Std.WP.uncurry'_eq, ``Std.WP.uncurry'_pair,
-      ``Std.WP.imp_exists_iff,
-      ``forall_unit, ``true_imp_iff
-    ]
-    to_mvcgen := .none
-    liftings := #[
-      { from_statement := ``Std.WP.spec
-        conversion_thm := ``spec_coinSpec
-        conversion_thm_inferred_args := 3 }
-    ]
-  }
-
-  instance : Monad ITreeC := instMonadITree
-  instance {T} : Lean.Order.PartialOrder (ITreeC T) := instPartialOrderCoIndOfInhabitedPUnit _
-  noncomputable instance {T} : Lean.Order.CCPO (ITreeC T) := instCCPOCoIndOfInhabitedPUnit _
-  instance : MonoBind ITreeC := instMonoBindITree
-
-
-  def res : Result Nat := .ok 5
-  def itreec : ITreeC Nat := res
-
-
-  -- set_option trace.Step true
-
-  -- theorem test : coinSpec (fun z => z.val == 6)
-  --   (do let x ← 1#i32 + 2#i32
-  --       let y ← x + x
-  --       ITree.vis () fun (b : Bool) =>
-  --       if b then ITree.ret y else ITree.ret 6#i32)  := by
-  --   step
-  --   step
-  --   apply coinSpec.vis
-  --   intros b
-  --   cases b
-  --   · simp [*]
-  --   · simp [*]
+  spec_name := ``coinSpec
+  arity := 3
+  program_index := 2
+  post_index := 1
+  mk_spec_mono := ``coinSpec_mono
+  mk_spec_mono_skip_args := 2
+  mk_spec_bind := ``coinSpec_bind
+  mk_spec_bind_skip_args := 4
+  uncurry_elim_tactics := #[
+    ``qimp_coinSpec_unit,
+    ``Std.WP.qimp_unit,
+    ``qimp_coinSpec_exists,
+    ``Std.WP.qimp_exists,
+    ``forall_unit, ``true_imp_iff
+  ]
+  qimp_elim_tactics := #[
+    ``qimp_coinSpec_iff,
+    ``Std.WP.qimp_iff,
+    ``Std.WP.imp_and_iff, ``Std.uncurry_apply_pair,
+    ``Std.WP.uncurry'_eq, ``Std.WP.uncurry'_pair,
+    ``Std.WP.imp_exists_iff,
+    ``forall_unit, ``true_imp_iff
+  ]
+  to_mvcgen := .none
+  liftings := #[
+    { from_statement := ``Std.WP.spec
+      conversion_thm := ``spec_coinSpec
+      conversion_thm_inferred_args := 3 }
+  ]
+}
+
+instance : Monad ITreeC := instMonadITree
+instance {T} : Lean.Order.PartialOrder (ITreeC T) := instPartialOrderCoIndOfInhabitedPUnit _
+noncomputable instance {T} : Lean.Order.CCPO (ITreeC T) := instCCPOCoIndOfInhabitedPUnit _
+instance : MonoBind ITreeC := instMonoBindITree
+
+-- Currently, step does not support other monads.
+
+-- theorem test : coinSpec (fun z => z.val == 6)
+--   (do let x ← 1#i32 + 2#i32
+--       let y ← x + x
+--       ITree.vis () fun (b : Bool) =>
+--       if b then ITree.ret y else ITree.ret 6#i32)  := by
+--   step
+--   step
+--   apply coinSpec.vis
+--   intros b
+--   cases b
+--   · simp [*]
+--   · simp [*]

From 4ec5b5b51521950e8ae8194783e3b69ff1c77c7d Mon Sep 17 00:00:00 2001
From: Jacob Prinz <jacobeliasprinz@gmail.com>
Date: Fri, 24 Jul 2026 11:12:49 -0400
Subject: [PATCH 67/67] Slice.clone, List.clone, Slice.fill may use effs

---
 backends/lean/Aeneas/Std/Array/Array.lean |  3 +-
 backends/lean/Aeneas/Std/Array/Core.lean  | 68 ++++++++++++-------
 backends/lean/Aeneas/Std/Slice.lean       | 83 +++++++++--------------
 3 files changed, 77 insertions(+), 77 deletions(-)

diff --git a/backends/lean/Aeneas/Std/Array/Array.lean b/backends/lean/Aeneas/Std/Array/Array.lean
index cee7e1665..2c75041da 100644
--- a/backends/lean/Aeneas/Std/Array/Array.lean
+++ b/backends/lean/Aeneas/Std/Array/Array.lean
@@ -282,8 +282,7 @@ def Array.clone {α : Type u} {n : Usize} (clone : α → Result α) (s : Array
 theorem Array.clone_length {α : Type u} {n : Usize} (clone : α → Result α) (s s' : Array α n) (h : Array.clone clone s = ok s') :
   s'.length = s.length := by
   simp [Array.clone] at h
-  simp [List.clone] at h
-  split at h <;> simp_all
+  cases h2 : List.clone clone ↑s <;> simp_all
 
 @[step]
 theorem Array.clone_spec {α : Type u} {n : Usize} {clone : α → Result α} {s : Array α n} (h : ∀ x ∈ s.val, clone x = ok x) :
diff --git a/backends/lean/Aeneas/Std/Array/Core.lean b/backends/lean/Aeneas/Std/Array/Core.lean
index 95976d4eb..881bba977 100644
--- a/backends/lean/Aeneas/Std/Array/Core.lean
+++ b/backends/lean/Aeneas/Std/Array/Core.lean
@@ -18,36 +18,54 @@ instance {α : Type u} : GetElem? (List α) Usize α (fun l i => i < l.length) w
 /-
 # Theorems
 -/
-theorem List.mapM_clone_eq {T : Type u} {clone : T → Result T} {l : List T}
-  (h : ∀ x ∈ l, clone x = ok x) :
-  List.mapM clone l = ok l := by
-  have hind (l acc : List T) (h : ∀ x ∈ l, clone x = ok x) :
-    List.mapM.loop clone l acc = ok (List.reverse acc ++ l) := by
-    revert acc
-    induction l <;> intro acc <;> simp_all only [List.not_mem_nil, IsEmpty.forall_iff, implies_true,
-      List.append_nil, List.mem_cons, or_true, forall_const, forall_eq_or_imp] <;> unfold List.mapM.loop
-    . simp only [pure]
-    . rename_i hd tl ih
-      simp only [List.reverse_cons, List.append_assoc, List.cons_append, List.nil_append,
-        bind_tc_ok, h, ih]
-  apply hind
-  apply h
+def List.mapM_with_length {m : Type u → Type v} [Monad m] {α : Type w} {β : Type u} (f : α → m β) (as : List α)
+  : m ({ l : List β // l.length = as.length}) :=
+  match as with
+  | [] => pure ⟨[], by trivial⟩
+  | a :: as => do
+    let ⟨l, len⟩ ← List.mapM_with_length f as
+    let a' ← f a
+    pure ⟨a' :: l, by grind⟩
+
+theorem List.mapM_with_length_spec{post : Nat → β → Prop} {f : α → Result β} {l : List α}
+  (h : ∀ i (hi : i < l.length), f l[i] ⦃ post i ⦄) :
+  exists l', (List.mapM_with_length f l = .ok l')
+    ∧ (l'.val.map ok = l.map f)
+    := by
+  induction l generalizing post with
+  | nil => simp [mapM_with_length, pure]
+  | cons a as ih =>
+    have ih := ih (post := fun n => post n.succ)
+    have : ∀ (i : ℕ) (hi : i < as.length), f as[i] ⦃ post i.succ ⦄ := by
+      intros i hi
+      apply h i.succ (by grind)
+    obtain ⟨lih, propih⟩ := ih this
+    have fa := h 0 (by grind)
+    cases hfa : (f a) <;> simp_all
+    rename_i r
+    exists (r :: lih)
+    constructor
+    · constructor
+      · simp [mapM_with_length]
+        simp [*]
+        simp [Functor.map]
+      · grind
+    · grind
 
 def List.clone (clone : α → Result α) (l : List α) : Result ({ l' : List α // l'.length = l.length}) :=
-  match h : (List.mapM clone l).match with
-  | .ok v => ok ⟨ v, by
-    simp at h
-    have := List.mapM_Result_length h
-    assumption⟩
-  | .vis _ _ => .fail .panic
-  | .div => .div
+  List.mapM_with_length clone l
 
 @[step]
-def List.clone_spec {clone : α → Result α} {l : List α} (h : ∀ x ∈ l, clone x = ok x) :
+theorem List.clone_spec {clone : α → Result α} {l : List α} (h : ∀ x ∈ l, clone x = ok x) :
   List.clone clone l ⦃ l' => l'.val = l ∧ l'.val.length = l.length ⦄ := by
   simp only [List.clone]
-  have := List.mapM_clone_eq h
-  split <;> simp_all
-  cases h : List.mapM clone l <;> simp_all
+  induction l with
+  | nil => simp [mapM_with_length, pure]
+  | cons a as ih =>
+    simp [mapM_with_length, pure]
+    have : ∀ x ∈ as, clone x = ok x := by grind
+    have ih := ih this
+    apply spec_bind ih; intros h2 h3
+    simp [*]
 
 end Aeneas.Std
diff --git a/backends/lean/Aeneas/Std/Slice.lean b/backends/lean/Aeneas/Std/Slice.lean
index 9d14aabea..bfd07851d 100644
--- a/backends/lean/Aeneas/Std/Slice.lean
+++ b/backends/lean/Aeneas/Std/Slice.lean
@@ -684,13 +684,8 @@ def Slice.clone {T : Type} (clone : T → Result T) (s : Slice T) : Result (Slic
 theorem Slice.clone_length {T : Type} {clone : T → Result T} {s s' : Slice T} (h : Slice.clone clone s = ok s') :
   s'.length = s.length := by
   simp [Slice.clone] at h
-  simp [List.clone] at h
-  split at h <;> simp_all
-  rename_i heq
-  simp at heq
-  have := List.mapM_Result_length heq
-  cases s'; simp_all
-  cases h; simp_all
+  cases h2 : List.clone clone ↑s <;> simp_all
+  grind
 
 @[step]
 theorem Slice.clone_spec {T : Type} {clone : T → Result T} {s : Slice T} (h : ∀ x ∈ s.val, clone x = ok x) :
@@ -1010,45 +1005,25 @@ theorem core.slice.Slice.copy_from_slice.step_spec (copyInst : core.marker.Copy
   simp [h]
 
 def Slice.mapM  {α β} (f : α → Result β) (x : Slice α) : Result (Slice β) :=
-  match h : (x.val.mapM f).match with
-  | .ok xs  => ok ⟨xs, List.mapM_Result_length (by simp at h; apply h) ▸ x.prop⟩
-  | .vis _ _ => .fail .panic
-  | .div    => div
+  do let ⟨l, p⟩ ← List.mapM_with_length f x.val
+     ok ⟨l, by grind⟩
 
 @[step]
 theorem Slice.mapM_spec {α β} {f : α → Result β} {s : Slice α} {post : Nat → β → Prop}
     (hf : ∀ i (hi : i < s.len), f s[i] ⦃ post i ⦄) :
     s.mapM f ⦃ s' => s'.len = s.len ∧ ∀ i (hi : i < s'.len), post i s'[i] ⦄ := by
-  simp only [mapM]
-  have hmapM_ok : ∃ l', List.mapM f s.val = ok l' := by
-    suffices ∀ (l : List α), (∀ i (hi : i < l.length), ∃ b, f l[i] = ok b) → ∃ l', l.mapM f = ok l' by
-      apply this; intro i hi
-      let i' : Usize := Usize.ofNatCore i (by scalar_tac)
-      have hf' := hf i' (by scalar_tac)
-      simp only [getElem_Usize_eq] at hf'
-      show ∃ b, f s[i'] = ok b
-      cases hfi : f s[i'] <;> simp_all
-    intro l; induction l with
-    | nil => exact fun _ => ⟨[], rfl⟩
-    | cons a t ih =>
-      intro hall
-      obtain ⟨b, hb⟩ := hall 0 (by simp); simp at hb
-      obtain ⟨ts, hts⟩ := ih (fun i hi => hall (i + 1) (by simp; omega))
-      exact ⟨b :: ts, by simp [List.mapM_cons, hb, hts, pure]⟩
-  obtain ⟨l', hl'⟩ := hmapM_ok
-  split
-  case h_1 xs heq =>
-    simp only [UScalar.lt_equiv, Usize.ofNatCore_val_eq, spec_ok]
-    refine ⟨by grind [List.mapM_Result_length], fun i hi => ?_⟩
-    simp at heq
-    have hlen : i < s.len := by have := List.mapM_Result_length heq; simp [Slice.len] at *; omega
-    have hthis := List.mapM_Result_ok heq (↑i) (by scalar_tac)
-    specialize hf i hlen; simp only [getElem_Usize_eq] at hf
-    erw [hthis] at hf
-    simp only [spec_ok] at hf ⊢
-    exact hf
-  case h_2 e heq => simp [hl'] at heq
-  case h_3 heq => simp [hl'] at heq
+  obtain ⟨l', eq, mapeq⟩ := List.mapM_with_length_spec (post:=post) (f:=f) (l:=s.val) (by
+    intros i hi
+    simp at *
+    apply (hf ⟨i, by grind⟩)
+    simp [UScalar.val, hi])
+  simp [mapM]
+  simp [eq]
+  constructor
+  · grind
+  · intros i hi
+    have : (List.map ok ↑l')[i.val] = (List.map f ↑s)[i.val] := by grind
+    grind
 
 -- ============================================================================
 -- Slice.fill — overwrite every element with a clone of `v`
@@ -1059,10 +1034,8 @@ theorem Slice.mapM_spec {α β} {f : α → Result β} {s : Slice α} {post : Na
 @[rust_fun "core::slice::{[@T]}::fill"]
 def core.slice.Slice.fill {T : Type} (cloneInst : core.clone.Clone T)
     (s : Slice T) (v : T) : Result (Slice T) :=
-  match h : (s.val.mapM (fun _ => cloneInst.clone v)).match with
-  | .ok val => .ok ⟨val, List.mapM_Result_length (by simp at h; apply h) ▸ s.property⟩
-  | .vis _ _ => .fail .panic
-  | .div => .div
+  do let ⟨l, p⟩ ← List.mapM_with_length (fun _ => cloneInst.clone v) s.val
+     ok ⟨l, by grind⟩
 
 private theorem List.mapM_const_ok {T : Type} (l : List T)
     {g : Result T} {v : T} (hg : g = ok v) :
@@ -1082,10 +1055,20 @@ theorem core.slice.Slice.fill.spec {T : Type} (cloneInst : core.clone.Clone T)
     ⦃ (s' : Slice T) =>
       s'.length = s.length ∧
       s'.val = List.replicate s.length v ⦄ := by
-  unfold core.slice.Slice.fill
-  have hcl : cloneInst.clone v = ok v := by
-    cases h : (cloneInst.clone v) <;> simp_all
-  have hmapM := List.mapM_const_ok s.val hcl
-  grind
+  cases h : cloneInst.clone v <;> simp_all
+  simp [fill, h]
+  obtain ⟨l', eq, mapeq⟩ := List.mapM_with_length_spec (post:=fun _ v' => v' = v) (f:=fun _ => ok v) (l:=s.val) (by
+    intros i hi
+    simp)
+  simp at mapeq
+  simp [eq]
+  rw [<- List.map_const'] at mapeq
+  have same : (fun x : T => ok v) = ok ∘ (fun x => v) := by grind
+  rw [same] at mapeq
+  rw [<- List.map_map (g := ok) (f := (fun _ => v))] at mapeq
+  rw [List.map_inj_right _] at mapeq
+  · simp at mapeq
+    assumption
+  · simp
 
 end Aeneas.Std